@camstack/server 1.2.563 → 1.2.565

package/dist/api/core/certificates.router.js

@@ -0,0 +1,505 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCertificatesRouter = createCertificatesRouter;
+/**
+ * Certificates inventory and management - fixed core API for Identity ->
+ * Certificates (D855, D856).
+ *
+ * Hand-written (not a `*.cap.ts`) like `cluster-nodes.router.ts`: it joins the node
+ * list (agent registry), the `local-network` provider (the hub's HTTPS leaf), the
+ * mesh CA and the registry of mesh leaves, and calls each agent's
+ * `node-certificates` capability. Device credentials are the `device-credentials`
+ * capability; this router never touches them.
+ *
+ *  - HTTPS: the hub serves its own leaf (renewed with `regenerateCertificate`);
+ *    every agent serves a leaf the HUB issued from its local CA, on the same port
+ *    as its plain HTTP. An agent without one yet says so (`not-served`, with the
+ *    reason), never an empty row that reads as "no certificate".
+ *  - Mesh: every leaf the hub issues is recorded; a node enrolled earlier is
+ *    recorded from the leaf it presents on its live connection (`observed`).
+ *    Renewal is a handover that never leaves a node without a working leaf
+ *    (`mesh-renewal.ts`); revocation puts the serial on the CRL and disconnects
+ *    the node, which must re-join with a new join token. Neither forgets a node:
+ *    that stays `clusterNodes.forgetNode`.
+ */
+const node_crypto_1 = require("node:crypto");
+const system_1 = require("@camstack/system");
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const HUB_NODE_ID = 'hub';
+const EXPIRING_SOON_MS = 7 * 86_400_000;
+const TlsStatusRowSchema = zod_1.z.object({
+    mode: zod_1.z.enum(['generated', 'uploaded', 'disabled']),
+    leafFingerprintSha256: zod_1.z.string().nullable(),
+    caFingerprintSha256: zod_1.z.string().nullable(),
+    validTo: zod_1.z.string().nullable(),
+    sans: zod_1.z.array(zod_1.z.string()),
+    reissueError: zod_1.z.string().nullable(),
+    restartRequired: zod_1.z.boolean(),
+});
+const NodeHttpsSchema = zod_1.z.object({
+    nodeId: zod_1.z.string(),
+    isHub: zod_1.z.boolean(),
+    online: zod_1.z.boolean(),
+    https: zod_1.z.discriminatedUnion('kind', [
+        zod_1.z.object({ kind: zod_1.z.literal('served'), status: TlsStatusRowSchema }),
+        zod_1.z.object({ kind: zod_1.z.literal('not-served'), reason: zod_1.z.string() }),
+        /** The hub could not read it right now: say so, never present it as "none". */
+        zod_1.z.object({ kind: zod_1.z.literal('unreadable'), reason: zod_1.z.string() }),
+    ]),
+});
+const MeshLeafRowSchema = zod_1.z.object({
+    serial: zod_1.z.string(),
+    fingerprintSha256: zod_1.z.string(),
+    notBefore: zod_1.z.number(),
+    notAfter: zod_1.z.number(),
+    issuedAt: zod_1.z.number(),
+    /** `enroll` | `renewal` | `boot` were issued by the hub; `observed` was read off a live connection. */
+    issuedVia: zod_1.z.enum(['enroll', 'renewal', 'boot', 'observed']),
+    status: zod_1.z.enum(['valid', 'expiring', 'expired', 'revoked']),
+    revokedAt: zod_1.z.number().nullable(),
+    revokedReason: zod_1.z.string().nullable(),
+});
+const MeshNodeSchema = zod_1.z.object({
+    nodeId: zod_1.z.string(),
+    online: zod_1.z.boolean(),
+    /** The leaf the node holds now: the newest non-revoked one. `null` when none is known. */
+    current: MeshLeafRowSchema.nullable(),
+    /** The node is connected and presents exactly `current`. `null` when it is offline. */
+    presentingCurrent: zod_1.z.boolean().nullable(),
+    /** Older and revoked leaves, newest first. */
+    history: zod_1.z.array(MeshLeafRowSchema),
+});
+const MeshInventorySchema = zod_1.z.object({
+    ca: zod_1.z.discriminatedUnion('state', [
+        zod_1.z.object({
+            state: zod_1.z.literal('ready'),
+            subject: zod_1.z.string(),
+            fingerprintSha256: zod_1.z.string(),
+            validTo: zod_1.z.string(),
+        }),
+        zod_1.z.object({ state: zod_1.z.literal('unavailable'), reason: zod_1.z.string() }),
+    ]),
+    /** Serials the hub refuses at the mesh handshake. Persisted with the registry and replayed at boot. */
+    revokedSerials: zod_1.z.array(zod_1.z.string()),
+    /** `false` while the registry is not up (no settings store): the node list is then incomplete. */
+    registryAvailable: zod_1.z.boolean(),
+    /** The hub's mesh TLS listener: `closed` means every agent is refused (e.g. revocations not loaded). */
+    listener: zod_1.z.discriminatedUnion('state', [
+        zod_1.z.object({ state: zod_1.z.literal('open') }),
+        zod_1.z.object({ state: zod_1.z.literal('closed'), reason: zod_1.z.string(), since: zod_1.z.number() }),
+        zod_1.z.object({ state: zod_1.z.literal('not-started') }),
+    ]),
+    nodes: zod_1.z.array(MeshNodeSchema),
+});
+const MeshRenewResultSchema = zod_1.z.discriminatedUnion('ok', [
+    zod_1.z.object({
+        ok: zod_1.z.literal(true),
+        nodeId: zod_1.z.string(),
+        oldSerial: zod_1.z.string().nullable(),
+        newSerial: zod_1.z.string(),
+        newNotAfter: zod_1.z.number(),
+    }),
+    zod_1.z.object({
+        ok: zod_1.z.literal(false),
+        nodeId: zod_1.z.string(),
+        stage: zod_1.z.enum(['prepare', 'issue', 'install', 'reconnect', 'confirm']),
+        reason: zod_1.z.string(),
+        /** The node is on its previous leaf (or never left it): nothing was broken. */
+        keptPreviousLeaf: zod_1.z.boolean(),
+    }),
+]);
+const MeshRevokeResultSchema = zod_1.z.object({
+    nodeId: zod_1.z.string(),
+    revokedSerials: zod_1.z.array(zod_1.z.string()),
+    disconnected: zod_1.z.number().int(),
+    /** What the operator does next. Revoking does not forget the node. */
+    next: zod_1.z.string(),
+});
+function leafStatus(record, at) {
+    if (record.revokedAt !== null)
+        return 'revoked';
+    if (record.notAfter <= at)
+        return 'expired';
+    return record.notAfter - at < EXPIRING_SOON_MS ? 'expiring' : 'valid';
+}
+function createCertificatesRouter(deps) {
+    const localNetwork = () => {
+        const provider = deps.registry?.getSingleton('local-network');
+        if (!provider) {
+            throw new server_1.TRPCError({
+                code: 'PRECONDITION_FAILED',
+                message: 'The local-network capability is not available yet',
+            });
+        }
+        return provider;
+    };
+    const peers = deps.peers ?? {
+        peerLeaf: (nodeId) => (0, system_1.getProcessPeerLeaf)(nodeId),
+        dropPeer: (nodeId) => (0, system_1.dropProcessPeer)(nodeId),
+    };
+    const meshRegistry = deps.meshRegistry ?? system_1.getProcessMeshCertificateRegistry;
+    const crl = deps.crl ?? system_1.processMeshCrl;
+    const meshCa = deps.meshCa ??
+        (() => {
+            const state = (0, system_1.getProcessMeshCaState)();
+            return state.state === 'ready' ? state.ca : null;
+        });
+    const issueHttps = deps.issueHttps ?? system_1.issueAgentHttpsLeaf;
+    const listenerState = deps.listenerState ??
+        (() => (0, system_1.getProcessMeshTlsListenerState)() ?? { state: 'not-started' });
+    const httpsNames = deps.httpsNames ?? system_1.getProcessAgentHttpsNames;
+    const registrations = deps.registrations ?? {
+        subscribe: (listener) => (0, system_1.onProcessNodeRegistered)(listener),
+    };
+    /** One certificate operation per node at a time: a second one is refused, not interleaved. */
+    const busy = new Set();
+    const exclusive = async (key, what, run) => {
+        if (busy.has(key)) {
+            deps.log.warn('Certificate operation refused: another one is running on this node', {
+                tags: { nodeId: key },
+                meta: { what },
+            });
+            throw new server_1.TRPCError({
+                code: 'CONFLICT',
+                message: `Another certificate operation is already running on ${key}. Wait for it to finish.`,
+            });
+        }
+        busy.add(key);
+        try {
+            return await run();
+        }
+        finally {
+            busy.delete(key);
+        }
+    };
+    const requireAgent = (nodeId) => {
+        if (nodeId === HUB_NODE_ID) {
+            throw new server_1.TRPCError({
+                code: 'PRECONDITION_FAILED',
+                message: 'The hub is not an agent: its HTTPS leaf is renewed with renewHttpsOnNode on "hub", and its mesh leaf is re-issued at every boot.',
+            });
+        }
+        const client = deps.nodeClient(nodeId);
+        if (client === null) {
+            throw new server_1.TRPCError({
+                code: 'PRECONDITION_FAILED',
+                message: `Node ${nodeId} is not reachable, or runs an agent too old to manage its certificates (update it).`,
+            });
+        }
+        return client;
+    };
+    /** Record the leaf each connected node presents, for nodes enrolled before the registry existed. */
+    const observeConnectedNodes = async (registry) => {
+        for (const node of deps.agentRegistry.listNodeLiveness()) {
+            if (node.id === HUB_NODE_ID || !node.isOnline)
+                continue;
+            const leaf = peers.peerLeaf(node.id);
+            if (leaf === undefined)
+                continue;
+            await registry.recordObserved(node.id, {
+                cn: node.id,
+                serial: leaf.serial,
+                fingerprint: leaf.fingerprint,
+                notBefore: leaf.notBefore,
+                notAfter: leaf.notAfter,
+            });
+        }
+    };
+    const statusOfLeaf = (leaf) => ({
+        mode: 'generated',
+        leafFingerprintSha256: leaf.fingerprintSha256,
+        caFingerprintSha256: null,
+        validTo: new Date(leaf.notAfter).toISOString(),
+        sans: leaf.sans,
+        reissueError: null,
+        restartRequired: false,
+    });
+    return (0, trpc_middleware_js_1.trpcRouter)({
+        /** HTTPS certificate state per node. The hub serves its own; an agent serves a hub-issued leaf. */
+        listHttpsCertificates: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.void())
+            .output(zod_1.z.array(NodeHttpsSchema))
+            .query(async () => {
+            const nodes = deps.agentRegistry.listNodeLiveness();
+            const entries = nodes.some((n) => n.id === HUB_NODE_ID)
+                ? nodes
+                : [{ id: HUB_NODE_ID, isOnline: true }, ...nodes];
+            const rows = [];
+            for (const node of entries) {
+                const isHub = node.id === HUB_NODE_ID;
+                if (isHub) {
+                    try {
+                        const status = await localNetwork().getTlsStatus();
+                        const { caCertPem: _pem, ...rest } = status;
+                        rows.push({
+                            nodeId: node.id,
+                            isHub,
+                            online: true,
+                            https: { kind: 'served', status: rest },
+                        });
+                    }
+                    catch (error) {
+                        rows.push({
+                            nodeId: node.id,
+                            isHub,
+                            online: true,
+                            https: {
+                                kind: 'unreadable',
+                                reason: error instanceof Error ? error.message : String(error),
+                            },
+                        });
+                    }
+                    continue;
+                }
+                if (!node.isOnline) {
+                    rows.push({
+                        nodeId: node.id,
+                        isHub,
+                        online: false,
+                        https: {
+                            kind: 'unreadable',
+                            reason: 'The node is offline - its certificate cannot be read.',
+                        },
+                    });
+                    continue;
+                }
+                const client = deps.nodeClient(node.id);
+                if (client === null) {
+                    rows.push({
+                        nodeId: node.id,
+                        isHub,
+                        online: true,
+                        https: {
+                            kind: 'unreadable',
+                            reason: 'The node does not provide node-certificates (update the agent).',
+                        },
+                    });
+                    continue;
+                }
+                try {
+                    const answer = await client.getCertificates();
+                    rows.push({
+                        nodeId: node.id,
+                        isHub,
+                        online: true,
+                        https: answer.https.state === 'served'
+                            ? { kind: 'served', status: statusOfLeaf(answer.https.leaf) }
+                            : { kind: 'not-served', reason: answer.https.reason },
+                    });
+                }
+                catch (error) {
+                    rows.push({
+                        nodeId: node.id,
+                        isHub,
+                        online: true,
+                        https: {
+                            kind: 'unreadable',
+                            reason: error instanceof Error ? error.message : String(error),
+                        },
+                    });
+                }
+            }
+            return rows;
+        }),
+        /**
+         * Issue a new HTTPS leaf. On the hub: a new leaf under the local CA
+         * (`regenerateCertificate`; refused while an uploaded certificate is served). On an
+         * agent: the agent makes a key + CSR, the hub signs the public key under the same
+         * local CA for the names the agent reports (private addresses and local-only host
+         * names), and the agent hot-swaps it - no restart, no private key on the mesh.
+         */
+        renewHttpsOnNode: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({ nodeId: zod_1.z.string().min(1), reason: zod_1.z.string().max(200).optional() }))
+            .output(TlsStatusRowSchema)
+            .mutation(async ({ input }) => {
+            if (input.nodeId === HUB_NODE_ID) {
+                const status = await localNetwork().regenerateCertificate({
+                    ...(input.reason !== undefined ? { reason: input.reason } : {}),
+                });
+                const { caCertPem: _pem, ...rest } = status;
+                return rest;
+            }
+            const client = requireAgent(input.nodeId);
+            const tags = { nodeId: input.nodeId };
+            return exclusive(input.nodeId, 'https', async () => {
+                try {
+                    const prepared = await client.prepareHttpsCertificate();
+                    // The hub signs what it knows by itself: the node id and the address of the node's
+                    // LIVE mesh socket. Whatever the agent reports is dropped (and logged below).
+                    const observedAddress = peers.peerLeaf(input.nodeId)?.remoteAddress;
+                    if (observedAddress === undefined) {
+                        throw new Error('the node has no live mesh connection the hub can read its address from - connect it first');
+                    }
+                    // Without the names registry the hub cannot tell whether a name is already another
+                    // node's, so it signs nothing.
+                    const names = httpsNames();
+                    if (names === null) {
+                        throw new Error('the agent HTTPS names registry is not loaded yet - try again shortly');
+                    }
+                    const issued = await issueHttps({
+                        hubDataDir: deps.hubDataDir,
+                        nodeId: input.nodeId,
+                        csrPem: prepared.csrPem,
+                        reportedNames: [...prepared.hostnames, ...prepared.addresses],
+                        observedAddress,
+                        takenByOthers: names.takenByOthers(input.nodeId),
+                    });
+                    // Written down BEFORE the install answer: if the answer is lost the names stay taken
+                    // (the node may hold the leaf), never silently free for another node.
+                    await names.record(input.nodeId, issued.accepted);
+                    // The hub's local CA was rotated (D227) when the node pinned another one: say so, over
+                    // the authenticated install call, so the node re-pins instead of refusing for ever.
+                    const caRotation = prepared.pinnedCaFingerprintSha256 !== null &&
+                        prepared.pinnedCaFingerprintSha256 !==
+                            new node_crypto_1.X509Certificate(issued.caCertPem).fingerprint256;
+                    deps.log.info('Agent HTTPS leaf issued', {
+                        tags,
+                        meta: { accepted: issued.accepted, rejected: issued.rejected },
+                    });
+                    const leaf = await client.installHttpsCertificate({
+                        certPem: issued.certPem,
+                        caCertPem: issued.caCertPem,
+                        ...(caRotation ? { caRotation: true } : {}),
+                    });
+                    deps.log.info('Agent HTTPS leaf installed', {
+                        tags,
+                        meta: { fingerprint: leaf.fingerprintSha256 },
+                    });
+                    return statusOfLeaf(leaf);
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    deps.log.error('Agent HTTPS renewal failed', { tags, meta: { error: message } });
+                    throw new server_1.TRPCError({
+                        code: 'INTERNAL_SERVER_ERROR',
+                        message: `HTTPS renewal on ${input.nodeId} failed: ${message}. The node keeps serving what it had.`,
+                    });
+                }
+            });
+        }),
+        /** The mesh CA, the revocation list, and every node's recorded leaves. */
+        getMeshCertificates: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.void())
+            .output(MeshInventorySchema)
+            .query(async () => {
+            const state = (0, system_1.getProcessMeshCaState)();
+            const ca = state.state === 'ready'
+                ? {
+                    state: 'ready',
+                    subject: new node_crypto_1.X509Certificate(state.ca.certPem).subject,
+                    fingerprintSha256: (0, system_1.caFingerprint)(state.ca.certPem),
+                    validTo: new node_crypto_1.X509Certificate(state.ca.certPem).validTo,
+                }
+                : { state: 'unavailable', reason: state.reason };
+            const registry = meshRegistry();
+            const at = Date.now();
+            const nodes = [];
+            if (registry !== null) {
+                await observeConnectedNodes(registry);
+                const liveness = new Map(deps.agentRegistry.listNodeLiveness().map((n) => [n.id, n.isOnline]));
+                const nodeIds = new Set([...registry.list().map((r) => r.nodeId), ...liveness.keys()]);
+                for (const nodeId of [...nodeIds].toSorted()) {
+                    const rows = registry.list(nodeId).map((r) => ({
+                        serial: r.serial,
+                        fingerprintSha256: r.fingerprint,
+                        notBefore: r.notBefore,
+                        notAfter: r.notAfter,
+                        issuedAt: r.issuedAt,
+                        issuedVia: r.issuedVia,
+                        status: leafStatus(r, at),
+                        revokedAt: r.revokedAt,
+                        revokedReason: r.revokedReason,
+                    }));
+                    const current = rows.find((r) => r.status !== 'revoked') ?? null;
+                    const online = nodeId === HUB_NODE_ID ? true : (liveness.get(nodeId) ?? false);
+                    const presented = nodeId === HUB_NODE_ID ? undefined : peers.peerLeaf(nodeId);
+                    nodes.push({
+                        nodeId,
+                        online,
+                        current,
+                        presentingCurrent: !online || nodeId === HUB_NODE_ID || current === null
+                            ? null
+                            : presented?.fingerprint === current.fingerprintSha256,
+                        history: rows.filter((r) => r !== current),
+                    });
+                }
+            }
+            return {
+                ca,
+                revokedSerials: [...crl().list()],
+                registryAvailable: registry !== null,
+                listener: listenerState(),
+                nodes,
+            };
+        }),
+        /**
+         * Replace a node's mesh leaf without ever leaving it without one: the node makes a new
+         * key and CSR, the hub signs and records it, the node swaps and reconnects, and only
+         * after the hub SEES it connected with the new leaf is the old serial revoked. A failed
+         * swap keeps the old leaf valid and says why.
+         */
+        renewMeshOnNode: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({ nodeId: zod_1.z.string().min(1) }))
+            .output(MeshRenewResultSchema)
+            .mutation(async ({ input }) => {
+            const client = requireAgent(input.nodeId);
+            const ca = meshCa();
+            const registry = meshRegistry();
+            if (ca === null || registry === null) {
+                throw new server_1.TRPCError({
+                    code: 'PRECONDITION_FAILED',
+                    message: 'The mesh CA or the certificate registry is not available yet.',
+                });
+            }
+            const result = await exclusive(input.nodeId, 'mesh', () => (0, system_1.renewMeshCertificate)({
+                nodeId: input.nodeId,
+                client,
+                ca,
+                registry,
+                crl: crl(),
+                peers,
+                registrations,
+                log: deps.log,
+                ...(deps.reconnectTimeoutMs !== undefined
+                    ? { reconnectTimeoutMs: deps.reconnectTimeoutMs }
+                    : {}),
+                ...(deps.sleep !== undefined ? { sleep: deps.sleep } : {}),
+                ...(deps.setTimer !== undefined ? { setTimer: deps.setTimer } : {}),
+            }));
+            return { ...result, nodeId: input.nodeId };
+        }),
+        /**
+         * Put the node's mesh leaf on the CRL and disconnect it. The node can no longer
+         * connect: it must re-join with a new join token. It is NOT forgotten - that stays
+         * `clusterNodes.forgetNode`.
+         */
+        revokeMeshOnNode: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({ nodeId: zod_1.z.string().min(1) }))
+            .output(MeshRevokeResultSchema)
+            .mutation(async ({ input }) => {
+            if (input.nodeId === HUB_NODE_ID) {
+                throw new server_1.TRPCError({
+                    code: 'PRECONDITION_FAILED',
+                    message: "The hub's own mesh leaf is re-issued at every boot; there is nothing to revoke.",
+                });
+            }
+            const registry = meshRegistry();
+            if (registry === null) {
+                throw new server_1.TRPCError({
+                    code: 'PRECONDITION_FAILED',
+                    message: 'The certificate registry is not available yet.',
+                });
+            }
+            const result = await (0, system_1.revokeMeshCertificate)({
+                nodeId: input.nodeId,
+                registry,
+                crl: crl(),
+                peers,
+                log: deps.log,
+            });
+            return { ...result, revokedSerials: [...result.revokedSerials] };
+        }),
+    });
+}

package/dist/api/mesh/enroll.routes.js

@@ -12,7 +12,13 @@ function registerMeshEnrollRoute(fastify) {
             });
         }
         const body = request.body ?? {};
-        const result = await (0, system_1.enrollMeshNode)({ token: body.token ?? '', csr: body.csr ?? '' }, { ca: caState.ca });
+        const result = await (0, system_1.enrollMeshNode)({ token: body.token ?? '', csr: body.csr ?? '' }, {
+            ca: caState.ca,
+            onRecordFailed: (nodeId, error) => fastify.log.warn({ nodeId, error: error instanceof Error ? error.message : String(error) }, 'mesh enroll: the issued leaf could not be recorded'),
+            onIssued: async (nodeId, certPem) => {
+                await (0, system_1.getProcessMeshCertificateRegistry)()?.recordIssued(nodeId, certPem, 'enroll');
+            },
+        });
         if (!result.ok) {
             return reply.status(result.status).send({ ok: false, error: result.error });
         }

package/dist/api/trpc/generated-cap-mounts.js

@@ -2,7 +2,7 @@
 // AUTO-GENERATED by scripts/generate-cap-mounts.ts — DO NOT EDIT
 // Re-run: npx tsx scripts/generate-cap-mounts.ts
 //
-// Mounted: 167    Skipped (legacy): 3
+// Mounted: 169    Skipped (legacy): 3
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LEGACY_SHAPE_SKIP = void 0;
 exports.mountAllCaps = mountAllCaps;
@@ -188,6 +188,7 @@ function mountAllCaps(services) {
         deviceAdminLink: (0, generated_cap_routers_js_1.createCapRouter_deviceAdminLink)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'device-admin-link'), remoteCapProxy),
         deviceAdoption: (0, generated_cap_routers_js_1.createCapRouter_deviceAdoption)((_ctx) => reg?.getSingleton('device-adoption') ??
             null, remoteCapProxy),
+        deviceCredentials: (0, generated_cap_routers_js_1.createCapRouter_deviceCredentials)((_ctx) => reg?.getSingleton('device-credentials') ?? null, remoteCapProxy),
         deviceDiscovery: (0, generated_cap_routers_js_1.createCapRouter_deviceDiscovery)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'device-discovery'), remoteCapProxy),
         deviceExport: (0, generated_cap_routers_js_1.createCapRouter_deviceExport)((_ctx, addonId) => {
             if (!reg)
@@ -402,6 +403,8 @@ function mountAllCaps(services) {
         networkLink: (0, generated_cap_routers_js_1.createCapRouter_networkLink)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'network-link'), remoteCapProxy),
         networkQuality: (0, generated_cap_routers_js_1.createCapRouter_networkQuality)((_ctx) => reg?.getSingleton('network-quality') ??
             null, remoteCapProxy),
+        nodeCertificates: (0, generated_cap_routers_js_1.createCapRouter_nodeCertificates)((_ctx) => reg?.getSingleton('node-certificates') ??
+            null, remoteCapProxy),
         nodes: (0, generated_cap_routers_js_1.createCapRouter_nodes)((_ctx) => reg?.getSingleton('nodes') ?? null, remoteCapProxy),
         notificationOutput: (0, generated_cap_routers_js_1.createCapRouter_notificationOutput)((_ctx, addonId) => {
             if (!reg)