@camstack/server 1.2.577 → 1.2.579

package/dist/main.js

@@ -59,7 +59,6 @@ const ws_1 = require("@trpc/server/adapters/ws");
 const ws_2 = require("ws");
 const addon_upload_1 = require("./api/addon-upload");
 const auth_whoami_1 = require("./api/auth-whoami");
-const enroll_routes_js_1 = require("./api/mesh/enroll.routes.js");
 const backup_download_js_1 = require("./api/backup-download.js");
 const cap_providers_1 = require("./api/core/cap-providers");
 const logging_settings_1 = require("./api/core/logging-settings");
@@ -99,6 +98,7 @@ const sso_finish_deps_js_1 = require("./auth/sso-finish-deps.js");
 const app_confirmations_js_1 = require("./auth/app-confirmations.js");
 const app_confirm_routes_js_1 = require("./auth/app-confirm-routes.js");
 const app_passkey_routes_js_1 = require("./auth/app-passkey-routes.js");
+const app_refused_route_js_1 = require("./auth/app-refused-route.js");
 const passkey_provider_js_1 = require("./auth/passkey-provider.js");
 const second_factors_js_1 = require("./auth/second-factors.js");
 const sso_routes_js_1 = require("./auth/sso-routes.js");
@@ -474,7 +474,6 @@ async function bootstrap() {
         // Mirrors the addon-upload auth chain so the CLI can ping for
         // token-still-valid without consuming a real cap.
         await (0, auth_whoami_1.registerAuthWhoamiRoute)(fastify, uploadAuthService, uploadAddonRegistry);
-        (0, enroll_routes_js_1.registerMeshEnrollRoute)(fastify);
         console.log('[bootstrap] Auth whoami route registered at GET /api/auth/whoami');
     }
     catch (err) {
@@ -981,6 +980,7 @@ async function bootstrap() {
             limiter: authRouteLimiter,
             logger: app.get(logging_service_1.LoggingService).createLogger('app-passkey'),
         });
+        (0, app_refused_route_js_1.registerAppRefusedRoute)(fastify);
         // The last step of both app flows: "Sign in the app as <user>?" - the
         // handoff code is minted only when the person presses Continue (D858).
         (0, app_confirm_routes_js_1.registerAppConfirmRoutes)(fastify, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.577",
+  "version": "1.2.579",
   "license": "MIT",
   "private": false,
   "files": [
@@ -38,19 +38,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.426",
-    "@camstack/addon-agent-ui": "1.2.233",
-    "@camstack/addon-auth": "1.2.145",
+    "@camstack/addon-admin-ui": "1.2.427",
+    "@camstack/addon-agent-ui": "1.2.234",
+    "@camstack/addon-auth": "1.2.146",
     "@camstack/addon-decoder-nodeav": "1.2.123",
     "@camstack/addon-notifiers": "1.2.134",
     "@camstack/addon-pipeline": "1.2.369",
-    "@camstack/addon-pipeline-orchestrator": "1.2.322",
+    "@camstack/addon-pipeline-orchestrator": "1.2.323",
     "@camstack/addon-post-analysis": "1.2.369",
-    "@camstack/develop": "0.1.10",
+    "@camstack/develop": "0.1.11",
     "@camstack/sdk": "1.2.131",
-    "@camstack/system": "1.2.435",
-    "@camstack/types": "1.2.371",
-    "@camstack/ui-library": "1.2.289",
+    "@camstack/system": "1.2.436",
+    "@camstack/types": "1.2.372",
+    "@camstack/ui-library": "1.2.290",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",

package/dist/agent/agent-mesh-enroll.js

@@ -1,317 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MeshEnrollError = void 0;
-exports.decodeJoinTokenClaims = decodeJoinTokenClaims;
-exports.hubHostFromMeshAddress = hubHostFromMeshAddress;
-exports.enrollAgentMesh = enrollAgentMesh;
-exports.readJsonFile = readJsonFile;
-exports.writeJsonFile0600 = writeJsonFile0600;
-exports.persistEnrollment = persistEnrollment;
-exports.discardPendingJoinToken = discardPendingJoinToken;
-exports.enrollAndPersist = enrollAndPersist;
-/**
- * The agent's side of mesh mTLS enrollment (Release A).
- *
- * The operator mints a single-use join token on the hub (System → Cluster →
- * Add agent) and pastes it into this agent's setup. Redeeming it:
- *
- *   1. decode the token's claims WITHOUT trusting them (the agent holds no CA
- *      key yet): `hubUrl`, `hubMeshAddress`, `caFingerprint`, optional `nodeId`;
- *   2. a token pinned to another node id is refused before anything is sent;
- *   3. generate this node's own key pair; the private key never leaves it;
- *   4. `POST <hubUrl>/api/mesh/enroll` with `{ token, csr }`. The hub's HTTPS
- *      certificate is NOT the mesh CA, so the TLS peer is not what is pinned:
- *   5. the answer is trusted only if its CA certificate hashes to the token's
- *      `caFingerprint` (a MITM with another CA fails here), the token's ES256
- *      signature verifies against that CA, and the issued leaf is signed by it,
- *      carries this node id as CN and matches the private key;
- *   6. only then are the material and the hub address persisted (`agent.json`,
- *      0600) — the dial port is NOT stored: with a certificate the broker dials
- *      the TLS port, so the address keeps the host only.
- */
-const node_crypto_1 = require("node:crypto");
-const fs = __importStar(require("node:fs"));
-const http = __importStar(require("node:http"));
-const https = __importStar(require("node:https"));
-const system_1 = require("@camstack/system");
-const node_1 = require("@camstack/types/node");
-class MeshEnrollError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'MeshEnrollError';
-    }
-}
-exports.MeshEnrollError = MeshEnrollError;
-const ENROLL_PATH = '/api/mesh/enroll';
-const ENROLL_TIMEOUT_MS = 15_000;
-function base64urlJson(segment) {
-    return JSON.parse(Buffer.from(segment, 'base64url').toString('utf8'));
-}
-/** Decode the payload of a compact JWS. Untrusted: nothing here is verified. */
-function decodeJoinTokenClaims(token) {
-    const parts = token.trim().split('.');
-    if (parts.length !== 3 || parts[1] === undefined) {
-        throw new MeshEnrollError('join token is malformed (expected a compact JWT)');
-    }
-    let payload;
-    try {
-        payload = base64urlJson(parts[1]);
-    }
-    catch {
-        throw new MeshEnrollError('join token payload is not valid JSON');
-    }
-    if (payload === null || typeof payload !== 'object') {
-        throw new MeshEnrollError('join token payload is not an object');
-    }
-    const hubUrl = Reflect.get(payload, 'hubUrl');
-    const hubMeshAddress = Reflect.get(payload, 'hubMeshAddress');
-    const caFingerprint = Reflect.get(payload, 'caFingerprint');
-    const nodeId = Reflect.get(payload, 'nodeId');
-    const exp = Reflect.get(payload, 'exp');
-    if (typeof hubUrl !== 'string' || hubUrl.length === 0) {
-        throw new MeshEnrollError('join token carries no hubUrl');
-    }
-    if (typeof hubMeshAddress !== 'string' || hubMeshAddress.length === 0) {
-        throw new MeshEnrollError('join token carries no hubMeshAddress');
-    }
-    if (typeof caFingerprint !== 'string' || caFingerprint.length === 0) {
-        throw new MeshEnrollError('join token carries no caFingerprint');
-    }
-    if (typeof exp !== 'number')
-        throw new MeshEnrollError('join token carries no expiry');
-    return {
-        hubUrl,
-        hubMeshAddress,
-        caFingerprint: normalizeFingerprint(caFingerprint),
-        ...(typeof nodeId === 'string' && nodeId.length > 0 ? { nodeId } : {}),
-        exp,
-    };
-}
-function normalizeFingerprint(fp) {
-    return fp.replace(/:/g, '').toLowerCase();
-}
-/** `host:6000` / `[::1]:6000` / `host` → the host, port dropped. */
-function hubHostFromMeshAddress(address) {
-    const trimmed = address.trim();
-    const bracketed = /^(\[[^\]]+\])(?::\d+)?$/.exec(trimmed);
-    if (bracketed?.[1] !== undefined)
-        return bracketed[1];
-    const hostPort = /^([^:]+):\d+$/.exec(trimmed);
-    return hostPort?.[1] ?? trimmed;
-}
-function compactFingerprint(certPem) {
-    return (0, node_crypto_1.createHash)('sha256').update(new node_crypto_1.X509Certificate(certPem).raw).digest('hex');
-}
-/** ES256 compact-JWS signature check against the CA certificate's public key. */
-function tokenSignatureValid(token, caCertPem) {
-    const parts = token.trim().split('.');
-    if (parts.length !== 3)
-        return false;
-    const [header, payload, signature] = parts;
-    if (header === undefined || payload === undefined || signature === undefined)
-        return false;
-    try {
-        return (0, node_crypto_1.verify)('sha256', Buffer.from(`${header}.${payload}`), { key: new node_crypto_1.X509Certificate(caCertPem).publicKey, dsaEncoding: 'ieee-p1363' }, Buffer.from(signature, 'base64url'));
-    }
-    catch {
-        return false;
-    }
-}
-/** Node `http(s)` POST. The hub's HTTPS leaf is not the mesh CA, so the CA pin below is the trust. */
-const nodeEnrollFetch = (url, init) => new Promise((resolve, reject) => {
-    const target = new URL(url);
-    const request = (target.protocol === 'http:' ? http : https).request(target, {
-        method: init.method,
-        headers: { ...init.headers, 'content-length': Buffer.byteLength(init.body) },
-        timeout: ENROLL_TIMEOUT_MS,
-        ...(target.protocol === 'https:' ? { rejectUnauthorized: false } : {}),
-    }, (res) => {
-        const chunks = [];
-        res.on('data', (chunk) => chunks.push(chunk));
-        res.on('end', () => {
-            const raw = Buffer.concat(chunks).toString('utf8');
-            resolve({
-                status: res.statusCode ?? 0,
-                json: () => Promise.resolve(JSON.parse(raw)),
-            });
-        });
-        res.on('error', reject);
-    });
-    request.on('timeout', () => request.destroy(new Error(`enroll request timed out`)));
-    request.on('error', reject);
-    request.end(init.body);
-});
-function readAnswer(status, body) {
-    const record = body !== null && typeof body === 'object' ? body : {};
-    if (status !== 200 || Reflect.get(record, 'ok') !== true) {
-        const error = Reflect.get(record, 'error');
-        throw new MeshEnrollError(`hub refused the enrollment (HTTP ${status}): ${typeof error === 'string' ? error : 'no reason given'}`);
-    }
-    const cert = Reflect.get(record, 'cert');
-    const caCert = Reflect.get(record, 'caCert');
-    if (typeof cert !== 'string' || typeof caCert !== 'string') {
-        throw new MeshEnrollError('hub answered without a certificate and CA certificate');
-    }
-    return { cert, caCert };
-}
-/**
- * Redeem a join token. Throws {@link MeshEnrollError} with an operator-readable
- * reason; nothing is persisted here.
- */
-async function enrollAgentMesh(input) {
-    const token = input.token.trim();
-    const claims = decodeJoinTokenClaims(token);
-    const nowSec = input.nowSec ?? Math.floor(Date.now() / 1000);
-    if (claims.exp <= nowSec) {
-        throw new MeshEnrollError('join token has expired — mint a new one on the hub');
-    }
-    if (claims.nodeId !== undefined && claims.nodeId !== input.nodeId) {
-        throw new MeshEnrollError(`join token is for node "${claims.nodeId}", but this agent is "${input.nodeId}"`);
-    }
-    const keys = await (0, system_1.generateMeshKeyPair)();
-    const csr = await (0, system_1.createMeshCsrPem)(keys, input.nodeId);
-    const keyPem = await (0, system_1.exportMeshPrivateKeyPem)(keys.privateKey);
-    const url = `${claims.hubUrl.replace(/\/+$/, '')}${ENROLL_PATH}`;
-    const fetchFn = input.fetchFn ?? nodeEnrollFetch;
-    let response;
-    try {
-        response = await fetchFn(url, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ token, csr }),
-        });
-    }
-    catch (err) {
-        throw new MeshEnrollError(`could not reach the hub at ${claims.hubUrl}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    let body;
-    try {
-        body = await response.json();
-    }
-    catch {
-        body = null;
-    }
-    const answer = readAnswer(response.status, body);
-    // Trust nothing the hub said until it proves it holds the CA the token names.
-    let fingerprint;
-    try {
-        fingerprint = compactFingerprint(answer.caCert);
-    }
-    catch {
-        throw new MeshEnrollError('hub returned an unreadable CA certificate');
-    }
-    if (fingerprint !== claims.caFingerprint) {
-        throw new MeshEnrollError('the CA certificate returned by the hub does not match the token fingerprint — ' +
-            'enrollment aborted (is something between this agent and the hub?)');
-    }
-    if (!tokenSignatureValid(token, answer.caCert)) {
-        throw new MeshEnrollError('join token signature does not verify against the hub CA');
-    }
-    assertLeafIsOurs(answer, keyPem, input.nodeId);
-    return {
-        meshTls: { certPem: answer.cert, keyPem, caCertPem: answer.caCert },
-        hubAddress: hubHostFromMeshAddress(claims.hubMeshAddress),
-        claims,
-    };
-}
-function assertLeafIsOurs(answer, keyPem, nodeId) {
-    let leaf;
-    try {
-        leaf = new node_crypto_1.X509Certificate(answer.cert);
-    }
-    catch {
-        throw new MeshEnrollError('hub returned an unreadable node certificate');
-    }
-    const ca = new node_crypto_1.X509Certificate(answer.caCert);
-    if (!leaf.verify(ca.publicKey)) {
-        throw new MeshEnrollError('the node certificate is not signed by the hub CA');
-    }
-    if (!new RegExp(`(?:^|\\n)CN=${escapeRegExp(nodeId)}(?:\\n|$)`).test(leaf.subject)) {
-        throw new MeshEnrollError(`the node certificate is not issued for "${nodeId}"`);
-    }
-    if (!leaf.checkPrivateKey((0, node_crypto_1.createPrivateKey)(keyPem))) {
-        throw new MeshEnrollError('the node certificate does not match this agent’s private key');
-    }
-}
-function escapeRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-function readJsonFile(file) {
-    if (!fs.existsSync(file))
-        return {};
-    try {
-        const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'));
-        return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
-            ? Object.fromEntries(Object.entries(parsed))
-            : {};
-    }
-    catch {
-        return {};
-    }
-}
-function withoutJoinToken(record) {
-    return Object.fromEntries(Object.entries(record).filter(([key]) => key !== 'joinToken'));
-}
-/** Owner-only on every OS (an owner+SYSTEM ACL on Windows, where 0600 is a no-op). */
-function writeJsonFile0600(file, data) {
-    (0, node_1.writeOwnerOnlyFileSync)(file, JSON.stringify(data, null, 2));
-}
-/**
- * Write the enrollment into `agent.json` (0600): `meshTls` + the host-only
- * `hubAddress`; a pending `joinToken` is removed. The cluster secret, if any,
- * stays — it is still a valid join proof for one release.
- */
-function persistEnrollment(configPath, enrolled) {
-    const next = {
-        ...withoutJoinToken(readJsonFile(configPath)),
-        hubAddress: enrolled.hubAddress,
-        meshTls: enrolled.meshTls,
-    };
-    writeJsonFile0600(configPath, next);
-}
-/** Drop a pending `joinToken` from `agent.json` (consumed — or dead). */
-function discardPendingJoinToken(configPath) {
-    const existing = readJsonFile(configPath);
-    if (!('joinToken' in existing))
-        return;
-    writeJsonFile0600(configPath, withoutJoinToken(existing));
-}
-/** Redeem `token` and persist the result. Throws {@link MeshEnrollError}. */
-async function enrollAndPersist(input) {
-    const enrolled = await enrollAgentMesh(input);
-    persistEnrollment(input.configPath, enrolled);
-    return enrolled;
-}

package/dist/agent/agent-mesh-join.js

@@ -1,140 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createAgentMeshJoin = createAgentMeshJoin;
-/**
- * The agent's mesh join (D802): authenticate to the hub on every connection,
- * before anything else reaches it, and check that the hub is the hub — plus
- * the agent's inbound mesh gate so only that proven hub (and this agent's own
- * registered children) may call it.
- *
- * `MeshJoinClient` (in `@camstack/system`) holds the outbound protocol and the
- * call gate; `AgentMeshAuthenticator` + `createMeshAccessMiddleware` hold the
- * inbound side. This file binds both to the agent's broker lifecycle:
- *  - the hub connects → a join runs; a settled mutual proof stamps the hub;
- *  - the hub disconnects → back to `pending` (calls wait for the next join)
- *    and the hub is forgotten on the inbound gate;
- *  - any other node disconnects → forgotten on the inbound gate;
- *  - the hub says "not authenticated" (it restarted and lost us) → join again;
- *  - the join settles `unavailable` (the hub cannot read its secret yet) →
- *    retried every {@link REJOIN_INTERVAL_MS} while connected.
- */
-const system_1 = require("@camstack/system");
-const REJOIN_INTERVAL_MS = 15_000;
-const HUB_NODE_ID = 'hub';
-function nodeIdOf(data) {
-    if (data === null || typeof data !== 'object')
-        return undefined;
-    const node = Reflect.get(data, 'node');
-    if (node === null || typeof node !== 'object')
-        return undefined;
-    const id = Reflect.get(node, 'id');
-    return typeof id === 'string' ? id : undefined;
-}
-function createAgentMeshJoin(opts) {
-    let connected = false;
-    let rejoinTimer = null;
-    const clearRejoin = () => {
-        if (rejoinTimer !== null)
-            clearTimeout(rejoinTimer);
-        rejoinTimer = null;
-    };
-    const authenticator = new system_1.AgentMeshAuthenticator({
-        ownNodeId: opts.nodeId,
-        hubNodeId: HUB_NODE_ID,
-        ...(opts.isVerifiedPeer !== undefined ? { isVerifiedPeer: opts.isVerifiedPeer } : {}),
-        ...(opts.isPaired !== undefined ? { isPaired: opts.isPaired } : {}),
-        hasSecret: () => {
-            const s = opts.secret();
-            return s !== null && s.length > 0;
-        },
-        onTolerated: (nodeId, action) => {
-            opts.log?.(`mesh inbound: node "${nodeId}" is calling without having authenticated — ` +
-                `tolerated while this agent has no cluster secret (first call: ${action})`);
-        },
-        // D848: what the hub sent before the join settled is held, then decided — said here.
-        onHoldReport: (r) => {
-            const what = `${r.events} hub event(s) and ${r.calls} hub call(s) held ${r.heldForMs} ms before the mesh join settled`;
-            const overflow = r.overflow > 0 ? `; ${r.overflow} more refused because the hold was full` : '';
-            opts.log?.(r.outcome === 'delivered'
-                ? `[mesh-join] ${what}: delivered${overflow}`
-                : `[mesh-join] ${what}: REFUSED (join ${r.reason})${overflow}`);
-        },
-    });
-    const client = new system_1.MeshJoinClient({
-        nodeId: opts.nodeId,
-        secret: opts.secret,
-        call: opts.call,
-        hubNodeId: HUB_NODE_ID,
-        ...(opts.log !== undefined ? { log: opts.log } : {}),
-        onSettled: (state) => {
-            authenticator.noteHubJoinState(state);
-            opts.onState?.(state);
-            clearRejoin();
-            if (state === 'unavailable' && connected) {
-                rejoinTimer = setTimeout(() => void runJoin(), REJOIN_INTERVAL_MS);
-                rejoinTimer.unref?.();
-            }
-        },
-    });
-    const runJoin = async () => {
-        if (!connected)
-            return;
-        await client.join();
-    };
-    const rejoin = () => {
-        client.reset();
-        authenticator.noteHubJoinState('pending');
-        void runJoin();
-    };
-    const joinMiddleware = client.middleware(rejoin);
-    const eventScope = (0, system_1.createAgentEventScope)({
-        hubNodeId: HUB_NODE_ID,
-        ...(opts.log !== undefined ? { log: opts.log } : {}),
-    });
-    const inboundMiddleware = (0, system_1.createMeshAccessMiddleware)({
-        ownNodeId: opts.nodeId,
-        authenticator,
-        logger: {
-            warn: (message, meta) => {
-                const detail = meta === undefined
-                    ? ''
-                    : ` ${Object.entries(meta)
-                        .map(([k, v]) => `${k}=${String(v)}`)
-                        .join(' ')}`;
-                opts.log?.(`${message}${detail}`);
-            },
-        },
-    });
-    return {
-        client,
-        authenticator,
-        middleware: joinMiddleware,
-        eventScope,
-        middlewares: [inboundMiddleware, joinMiddleware, eventScope.middleware],
-        rejoin() {
-            if (connected)
-                rejoin();
-        },
-        attach(broker) {
-            broker.localBus.on('$node.connected', (data) => {
-                if (nodeIdOf(data) !== HUB_NODE_ID)
-                    return;
-                connected = true;
-                rejoin();
-            });
-            broker.localBus.on('$node.disconnected', (data) => {
-                const id = nodeIdOf(data);
-                if (id === undefined)
-                    return;
-                authenticator.forget(id);
-                if (id !== HUB_NODE_ID)
-                    return;
-                connected = false;
-                clearRejoin();
-                client.reset();
-                authenticator.noteHubJoinState('pending');
-            });
-        },
-        stop: clearRejoin,
-    };
-}

package/dist/api/mesh/enroll.routes.js

@@ -1,34 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.registerMeshEnrollRoute = registerMeshEnrollRoute;
-const system_1 = require("@camstack/system");
-function registerMeshEnrollRoute(fastify) {
-    fastify.post('/api/mesh/enroll', async (request, reply) => {
-        const caState = (0, system_1.getProcessMeshCaState)();
-        if (caState.state !== 'ready') {
-            return reply.status(503).send({
-                ok: false,
-                error: `mesh CA unavailable: ${caState.reason}`,
-            });
-        }
-        const body = request.body ?? {};
-        const result = await (0, system_1.enrollMeshNode)({ token: body.token ?? '', csr: body.csr ?? '' }, {
-            ca: caState.ca,
-            onRecordFailed: (nodeId, error) => fastify.log.warn({ nodeId, error: error instanceof Error ? error.message : String(error) }, 'mesh enroll: the issued leaf could not be recorded'),
-            onIssued: async (nodeId, certPem) => {
-                await (0, system_1.getProcessMeshCertificateRegistry)()?.recordIssued(nodeId, certPem, 'enroll');
-            },
-        });
-        if (!result.ok) {
-            return reply.status(result.status).send({ ok: false, error: result.error });
-        }
-        return reply.send({
-            ok: true,
-            cert: result.cert,
-            caCert: result.caCert,
-            nodeId: result.nodeId,
-            notAfter: result.notAfter,
-            serialNumber: result.serialNumber,
-        });
-    });
-}