@camstack/system 1.2.428 → 1.2.429

package/dist/builtins/system-config/system-config.addon.js

@@ -3,10 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-Bgy_AmwX.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
-const require_constants$8 = require("../../constants-CCSJGnjs.js");
 const require_x509_es = require("../../x509.es-Dzl0BbmG.js");
+const require_agent_https_names = require("../../agent-https-names-CpUSuP4w.js");
+const require_constants$8 = require("../../constants-RI-hGP5S.js");
 const require_src$1 = require("../../src-CnAqG6EF.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -425,7 +426,7 @@ async function exportMeshPrivateKeyPem(key) {
 }
 //#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-ca-keeper.ts
-var SLOT$2 = Symbol.for("camstack.mesh.ca");
+var SLOT$3 = Symbol.for("camstack.mesh.ca");
 var NOT_LOADED = {
 	state: "unavailable",
 	reason: "not-loaded"
@@ -437,10 +438,10 @@ function isState(value) {
 	return state === "unavailable" && typeof Reflect.get(value, "reason") === "string";
 }
 function setProcessMeshCa(state) {
-	Reflect.set(globalThis, SLOT$2, state);
+	Reflect.set(globalThis, SLOT$3, state);
 }
 function getProcessMeshCaState() {
-	const value = Reflect.get(globalThis, SLOT$2);
+	const value = Reflect.get(globalThis, SLOT$3);
 	return isState(value) ? value : NOT_LOADED;
 }
 function requireProcessMeshCa() {
@@ -582,10 +583,10 @@ async function loadOrGenerateMeshCa(deps) {
 var MeshCrl = class {
 	serials = /* @__PURE__ */ new Set();
 	revoke(serialNumber) {
-		this.serials.add(normalizeSerial(serialNumber));
+		this.serials.add(normalizeSerial$1(serialNumber));
 	}
 	isRevoked(serialNumber) {
-		return this.serials.has(normalizeSerial(serialNumber));
+		return this.serials.has(normalizeSerial$1(serialNumber));
 	}
 	list() {
 		return [...this.serials];
@@ -593,21 +594,650 @@ var MeshCrl = class {
 	/** Restore from persisted serials (system-settings). */
 	replaceAll(serials) {
 		this.serials.clear();
-		for (const s of serials) this.serials.add(normalizeSerial(s));
+		for (const s of serials) this.serials.add(normalizeSerial$1(s));
 	}
 };
-function normalizeSerial(serial) {
+function normalizeSerial$1(serial) {
 	return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
 }
-var SLOT$1 = Symbol.for("camstack.mesh.crl");
+var SLOT$2 = Symbol.for("camstack.mesh.crl");
 function processMeshCrl() {
-	const existing = Reflect.get(globalThis, SLOT$1);
+	const existing = Reflect.get(globalThis, SLOT$2);
 	if (existing instanceof MeshCrl) return existing;
 	const crl = new MeshCrl();
-	Reflect.set(globalThis, SLOT$1, crl);
+	Reflect.set(globalThis, SLOT$2, crl);
 	return crl;
 }
 //#endregion
+//#region src/kernel/moleculer/mesh-mtls/mesh-certificate-registry.ts
+/**
+* The hub's record of every mesh leaf (D856): which certificate each node holds,
+* when it expires, and which serials are revoked.
+*
+* Three ways a row appears:
+*  - `enroll` / `renewal` / `boot` - the hub issued it and wrote it down at the
+*    moment of issuing (the authoritative record);
+*  - `observed` - a node enrolled before this record existed (or by a path that
+*    did not write it) presented this leaf on its LIVE mutual-TLS connection.
+*
+* Revoked serials are persisted here and replayed into the in-memory CRL at boot,
+* so a revocation survives a hub restart. Hub only: agents persist none of it.
+*/
+/**
+* @durable class=config owner=system-config
+*   write="the hub records every mesh leaf it issues (enroll, renewal, boot) and every
+*     leaf a connected node is observed presenting; a revocation stamps revokedAt"
+*   retention="a revoked or expired row is kept 90 days past its end, then reaped; a
+*     live row is never deleted. Forgetting a node does not delete its rows."
+*/
+var MESH_NODE_CERTIFICATES_COLLECTION = "mesh_node_certificates";
+var MESH_NODE_CERTIFICATES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "nodeId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "serial",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "fingerprint",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "notBefore",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "notAfter",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "issuedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "issuedVia",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "revokedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "revokedReason",
+		type: "TEXT"
+	}
+];
+var RETENTION_MS = 90 * 864e5;
+/**
+* A leaf the hub signed for a renewal that did not complete. It must not be the node's
+* `current` leaf, but it is NOT on the CRL: the node may still hold it (the swap
+* could have landed without the hub seeing it), and cutting it off would be the
+* outage the hand-over exists to prevent. If the node is later seen presenting it, it
+* is reinstated.
+*/
+var RENEWAL_ABANDONED = "renewal-abandoned";
+var VIAS = [
+	"enroll",
+	"renewal",
+	"boot",
+	"observed"
+];
+/** CN, serial, fingerprint and validity of a leaf PEM (or DER). */
+function describeMeshLeaf(cert) {
+	const x509 = new node_crypto.X509Certificate(cert);
+	return {
+		cn: subjectCn(x509.subject) ?? "",
+		serial: x509.serialNumber,
+		fingerprint: x509.fingerprint256,
+		notBefore: Date.parse(x509.validFrom),
+		notAfter: Date.parse(x509.validTo)
+	};
+}
+function normalizeSerial(serial) {
+	return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
+}
+function parse$1(data) {
+	const str = (k) => {
+		const v = data[k];
+		return typeof v === "string" && v.length > 0 ? v : null;
+	};
+	const num = (k) => {
+		const v = data[k];
+		return typeof v === "number" && Number.isFinite(v) ? v : null;
+	};
+	const nodeId = str("nodeId");
+	const serial = str("serial");
+	const fingerprint = str("fingerprint");
+	const notBefore = num("notBefore");
+	const notAfter = num("notAfter");
+	const issuedAt = num("issuedAt");
+	if (nodeId === null || serial === null || fingerprint === null || notBefore === null || notAfter === null || issuedAt === null) return null;
+	return {
+		nodeId,
+		serial,
+		fingerprint,
+		notBefore,
+		notAfter,
+		issuedAt,
+		issuedVia: VIAS.find((v) => v === data["issuedVia"]) ?? "observed",
+		revokedAt: num("revokedAt"),
+		revokedReason: str("revokedReason")
+	};
+}
+var MeshCertificateRegistry = class {
+	store;
+	deps;
+	rows = /* @__PURE__ */ new Map();
+	constructor(store, deps = {}) {
+		this.store = store;
+		this.deps = deps;
+	}
+	now() {
+		return (this.deps.now ?? Date.now)();
+	}
+	async load() {
+		const rows = await this.store.query.query({ collection: MESH_NODE_CERTIFICATES_COLLECTION });
+		for (const row of rows) {
+			const record = parse$1(row.data);
+			if (record !== null) this.rows.set(record.fingerprint, record);
+		}
+	}
+	/** Write down a leaf the hub just issued. Idempotent per fingerprint. */
+	async recordIssued(nodeId, certPem, via) {
+		const leaf = describeMeshLeaf(certPem);
+		const existing = this.rows.get(leaf.fingerprint);
+		if (existing !== void 0) return existing;
+		const record = {
+			nodeId,
+			serial: leaf.serial,
+			fingerprint: leaf.fingerprint,
+			notBefore: leaf.notBefore,
+			notAfter: leaf.notAfter,
+			issuedAt: this.now(),
+			issuedVia: via,
+			revokedAt: null,
+			revokedReason: null
+		};
+		await this.insert(record);
+		this.deps.logger?.info("Mesh certificate recorded", {
+			tags: { nodeId },
+			meta: {
+				via,
+				serial: leaf.serial,
+				notAfter: new Date(leaf.notAfter).toISOString()
+			}
+		});
+		return record;
+	}
+	/**
+	* A node was seen presenting `leaf` on its live connection. A leaf the hub already
+	* knows is left alone; an unknown one is recorded `observed` (a node enrolled
+	* before this record existed).
+	*/
+	async recordObserved(nodeId, leaf) {
+		const known = this.rows.get(leaf.fingerprint);
+		if (known !== void 0) {
+			if (known.revokedReason !== "renewal-abandoned") return false;
+			const reinstated = {
+				...known,
+				revokedAt: null,
+				revokedReason: null
+			};
+			this.rows.set(known.fingerprint, reinstated);
+			await this.persist(reinstated);
+			this.deps.logger?.warn("An abandoned renewal leaf is in use - reinstated", {
+				tags: { nodeId },
+				meta: { serial: known.serial }
+			});
+			return true;
+		}
+		const record = {
+			nodeId,
+			serial: leaf.serial,
+			fingerprint: leaf.fingerprint,
+			notBefore: leaf.notBefore,
+			notAfter: leaf.notAfter,
+			issuedAt: this.now(),
+			issuedVia: "observed",
+			revokedAt: null,
+			revokedReason: null
+		};
+		await this.insert(record);
+		this.deps.logger?.info("Mesh certificate observed on a live connection and recorded", {
+			tags: { nodeId },
+			meta: {
+				serial: leaf.serial,
+				fingerprint: leaf.fingerprint
+			}
+		});
+		return true;
+	}
+	list(nodeId) {
+		return [...this.rows.values()].filter((r) => nodeId === void 0 || r.nodeId === nodeId).toSorted((a, b) => b.issuedAt - a.issuedAt);
+	}
+	/** The newest non-revoked leaf of a node, or `undefined`. */
+	currentFor(nodeId) {
+		return this.list(nodeId).find((r) => r.revokedAt === null);
+	}
+	/** Every non-revoked leaf of a node (a renewal in flight has two). */
+	liveFor(nodeId) {
+		return this.list(nodeId).filter((r) => r.revokedAt === null);
+	}
+	/** Stamp a leaf revoked (and mirror it into `crl`). `false` when unknown or already revoked. */
+	async revoke(fingerprint, reason, crl) {
+		const record = this.rows.get(fingerprint);
+		if (record === void 0 || record.revokedAt !== null) return false;
+		const revoked = {
+			...record,
+			revokedAt: this.now(),
+			revokedReason: reason
+		};
+		this.rows.set(fingerprint, revoked);
+		crl?.revoke(record.serial);
+		await this.persist(revoked);
+		this.deps.logger?.warn("Mesh certificate revoked", {
+			tags: { nodeId: record.nodeId },
+			meta: {
+				serial: record.serial,
+				reason
+			}
+		});
+		return true;
+	}
+	/**
+	* Operator revocation of a whole node: EVERY leaf of the node that is not already on the
+	* CRL goes on it - the current one, an observed one, a renewal one, and a leaf that was set
+	* aside (`renewal-abandoned`: a copy of it may sit on a stolen box, and it must not stay
+	* valid just because the hub once set it aside). Returns the serials put on the CRL.
+	* A leaf revoked this way is never reinstated by `recordObserved`.
+	*/
+	async revokeAllForNode(nodeId, reason, crl) {
+		const serials = [];
+		for (const record of this.list(nodeId)) {
+			if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned") continue;
+			const revoked = {
+				...record,
+				revokedAt: record.revokedAt ?? this.now(),
+				revokedReason: reason
+			};
+			this.rows.set(record.fingerprint, revoked);
+			crl.revoke(record.serial);
+			await this.persist(revoked);
+			serials.push(record.serial);
+		}
+		if (serials.length > 0) this.deps.logger?.warn("Every mesh certificate of the node revoked", {
+			tags: { nodeId },
+			meta: {
+				serials,
+				reason
+			}
+		});
+		return serials;
+	}
+	/**
+	* At boot: a node with TWO live leaves had a renewal in flight when the hub stopped. The
+	* newer (renewal) one is set aside - it is not the node's current leaf until the node is
+	* seen presenting it, which reinstates it. It is NOT put on the CRL.
+	*/
+	async settleInterruptedRenewals() {
+		let settled = 0;
+		const byNode = /* @__PURE__ */ new Map();
+		for (const record of this.rows.values()) {
+			if (record.revokedAt !== null) continue;
+			byNode.set(record.nodeId, [...byNode.get(record.nodeId) ?? [], record]);
+		}
+		for (const records of byNode.values()) {
+			if (records.length < 2) continue;
+			for (const record of records) if (record.issuedVia === "renewal" && await this.abandon(record.fingerprint)) settled += 1;
+		}
+		return settled;
+	}
+	/** Set a never-completed renewal leaf aside (not current, NOT on the CRL). */
+	async abandon(fingerprint) {
+		const record = this.rows.get(fingerprint);
+		if (record === void 0 || record.revokedAt !== null) return false;
+		const abandoned = {
+			...record,
+			revokedAt: this.now(),
+			revokedReason: RENEWAL_ABANDONED
+		};
+		this.rows.set(fingerprint, abandoned);
+		await this.persist(abandoned);
+		this.deps.logger?.warn("Renewal leaf set aside (not current, not on the CRL)", {
+			tags: { nodeId: record.nodeId },
+			meta: { serial: record.serial }
+		});
+		return true;
+	}
+	/** Replay every persisted revocation into `crl` (hub boot). Set-aside leaves are not revocations. */
+	restoreCrl(crl) {
+		let restored = 0;
+		for (const record of this.rows.values()) {
+			if (record.revokedAt === null || record.revokedReason === "renewal-abandoned") continue;
+			crl.revoke(record.serial);
+			restored += 1;
+		}
+		return restored;
+	}
+	/** Is `serial` listed as revoked here? */
+	isRevoked(serial) {
+		const wanted = normalizeSerial(serial);
+		for (const record of this.rows.values()) if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned" && normalizeSerial(record.serial) === wanted) return true;
+		return false;
+	}
+	async reap() {
+		const cutoff = this.now() - RETENTION_MS;
+		const dead = [...this.rows.values()].filter((r) => (r.revokedAt ?? r.notAfter) < cutoff);
+		for (const r of dead) {
+			this.rows.delete(r.fingerprint);
+			await this.store.delete.mutate({
+				collection: MESH_NODE_CERTIFICATES_COLLECTION,
+				key: r.fingerprint
+			});
+		}
+		return dead.length;
+	}
+	async insert(record) {
+		this.rows.set(record.fingerprint, record);
+		await this.store.insert.mutate({
+			collection: MESH_NODE_CERTIFICATES_COLLECTION,
+			record: {
+				id: record.fingerprint,
+				data: { ...record }
+			}
+		});
+	}
+	async persist(record) {
+		try {
+			await this.store.update.mutate({
+				collection: MESH_NODE_CERTIFICATES_COLLECTION,
+				id: record.fingerprint,
+				data: { ...record }
+			});
+		} catch (error) {
+			this.deps.logger?.error("Mesh certificate write failed - the change holds until restart", {
+				tags: { nodeId: record.nodeId },
+				meta: { error: error instanceof Error ? error.message : String(error) }
+			});
+		}
+	}
+};
+var SLOT$1 = Symbol.for("camstack.mesh.certificate-registry");
+function setProcessMeshCertificateRegistry(registry) {
+	if (registry === null) Reflect.deleteProperty(globalThis, SLOT$1);
+	else Reflect.set(globalThis, SLOT$1, registry);
+}
+function getProcessMeshCertificateRegistry() {
+	const value = Reflect.get(globalThis, SLOT$1);
+	return value !== null && typeof value === "object" && typeof Reflect.get(value, "recordIssued") === "function" ? value : null;
+}
+//#endregion
+//#region src/kernel/moleculer/mesh-mtls/mesh-tls-gate.ts
+var STATE_SLOT = Symbol.for("camstack.mesh.tls-listener-state");
+function setProcessMeshTlsListenerState(state) {
+	if (state === null) Reflect.deleteProperty(globalThis, STATE_SLOT);
+	else Reflect.set(globalThis, STATE_SLOT, state);
+}
+/** `null` before the gate has run at all (no mesh CA yet). */
+function getProcessMeshTlsListenerState() {
+	const value = Reflect.get(globalThis, STATE_SLOT);
+	if (value === null || typeof value !== "object") return null;
+	const state = Reflect.get(value, "state");
+	return state === "open" || state === "closed" ? value : null;
+}
+var DEFAULT_RETRY_MS = 15e3;
+/**
+* Nothing in `run` can reject: a load or an open that throws is reported and retried, so a
+* failure can never become an unhandled rejection that leaves the listener closed in silence.
+*/
+function openMeshTlsWhenRevocationsLoaded(deps) {
+	let attempt = 0;
+	let opened = false;
+	const now = deps.now ?? Date.now;
+	let closedSince = null;
+	const closed = (reason) => {
+		closedSince ??= now();
+		deps.onState?.({
+			state: "closed",
+			reason,
+			since: closedSince
+		});
+	};
+	const run = async () => {
+		if (opened) return true;
+		attempt += 1;
+		let registry = null;
+		try {
+			registry = await deps.loadRegistry();
+		} catch (error) {
+			deps.onError?.(error);
+		}
+		if (registry === null) {
+			closed("the revocation registry has not loaded - agents are refused");
+			deps.onWaiting?.(attempt);
+			deps.retry(() => void run(), deps.retryMs ?? DEFAULT_RETRY_MS);
+			return false;
+		}
+		try {
+			await deps.open(registry);
+		} catch (error) {
+			deps.onError?.(error);
+			closed("the listener failed to open - retrying");
+			deps.retry(() => void run(), deps.retryMs ?? DEFAULT_RETRY_MS);
+			return false;
+		}
+		opened = true;
+		deps.onState?.({ state: "open" });
+		return true;
+	};
+	return run();
+}
+//#endregion
+//#region src/kernel/moleculer/mesh-mtls/mesh-renewal.ts
+var DEFAULT_RECONNECT_TIMEOUT_MS = 45e3;
+var DEFAULT_CONFIRM_RETRY_MS = 500;
+function defaultSetTimer(fn, ms) {
+	const timer = setTimeout(fn, ms);
+	timer.unref?.();
+	return { cancel: () => clearTimeout(timer) };
+}
+function defaultSleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function message$1(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+async function renewMeshCertificate(deps) {
+	const { nodeId, log } = deps;
+	const tags = { nodeId };
+	const sleep = deps.sleep ?? defaultSleep;
+	const confirmRetryMs = deps.confirmRetryMs ?? DEFAULT_CONFIRM_RETRY_MS;
+	const setTimer = deps.setTimer ?? defaultSetTimer;
+	const timeoutMs = deps.reconnectTimeoutMs ?? DEFAULT_RECONNECT_TIMEOUT_MS;
+	const now = deps.now ?? Date.now;
+	const live = deps.peers.peerLeaf(nodeId);
+	const previous = live ?? deps.registry.currentFor(nodeId);
+	if (live !== void 0) await deps.registry.recordObserved(nodeId, {
+		cn: nodeId,
+		serial: live.serial,
+		fingerprint: live.fingerprint,
+		notBefore: live.notBefore,
+		notAfter: live.notAfter
+	});
+	log.info("Mesh renewal: starting", {
+		tags,
+		meta: {
+			currentSerial: previous?.serial ?? null,
+			connected: live !== void 0
+		}
+	});
+	const fail = (stage, reason, keptPreviousLeaf) => {
+		log.error("Mesh renewal: failed", {
+			tags,
+			meta: {
+				stage,
+				reason,
+				keptPreviousLeaf
+			}
+		});
+		return {
+			ok: false,
+			stage,
+			reason,
+			keptPreviousLeaf
+		};
+	};
+	let csrPem;
+	try {
+		csrPem = (await deps.client.prepareMeshRenewal()).csrPem;
+		log.info("Mesh renewal: the node generated a new key and sent its CSR", { tags });
+	} catch (error) {
+		return fail("prepare", message$1(error), true);
+	}
+	let issued;
+	try {
+		issued = await issueMeshLeafFromCsr(deps.ca, csrPem, { expectedNodeId: nodeId });
+		await deps.registry.recordIssued(nodeId, issued.certPem, "renewal");
+		log.info("Mesh renewal: new leaf signed and recorded", {
+			tags,
+			meta: {
+				serial: issued.serialNumber,
+				notAfter: issued.notAfter.toISOString()
+			}
+		});
+	} catch (error) {
+		return fail("issue", message$1(error), true);
+	}
+	const newLeaf = describeMeshLeaf(issued.certPem);
+	let resolveRegistered = () => void 0;
+	const registeredPromise = new Promise((resolve) => {
+		resolveRegistered = resolve;
+	});
+	const unsubscribe = deps.registrations.subscribe((id) => {
+		if (id === nodeId && deps.peers.peerLeaf(nodeId)?.fingerprint === newLeaf.fingerprint) resolveRegistered(true);
+	});
+	const deadlineTimer = setTimer(() => resolveRegistered(false), timeoutMs);
+	registeredPromise.then(() => deadlineTimer.cancel());
+	try {
+		await deps.client.installMeshLeaf({
+			certPem: issued.certPem,
+			caCertPem: deps.ca.certPem,
+			confirmWithinMs: timeoutMs + 3e4
+		});
+		log.info("Mesh renewal: the node installed the new leaf and is reconnecting", { tags });
+	} catch (error) {
+		unsubscribe();
+		deadlineTimer.cancel();
+		await deps.client.rollbackMeshLeaf().catch(() => void 0);
+		await deps.registry.abandon(newLeaf.fingerprint);
+		return fail("install", message$1(error), true);
+	}
+	const deadline = now() + timeoutMs;
+	const registered = await registeredPromise;
+	unsubscribe();
+	if (!registered) {
+		const back = await deps.client.rollbackMeshLeaf().catch(() => ({ rolledBack: false }));
+		log.warn("Mesh renewal: the node was not back and registered with the new leaf in time", {
+			tags,
+			meta: {
+				timeoutMs,
+				rolledBack: back.rolledBack
+			}
+		});
+		await deps.registry.abandon(newLeaf.fingerprint);
+		return fail("reconnect", `the node was not back and registered with the new leaf within ${Math.round(timeoutMs / 1e3)} s; the previous leaf was kept and is still valid`, true);
+	}
+	log.info("Mesh renewal: the node registered presenting the new leaf", { tags });
+	let confirmError = "the node did not confirm the new leaf";
+	let confirmedByNode = false;
+	for (;;) {
+		try {
+			if ((await deps.client.confirmMeshLeaf({ fingerprintSha256: newLeaf.fingerprint })).confirmed) {
+				confirmedByNode = true;
+				break;
+			}
+			confirmError = "the node did not confirm the new leaf";
+		} catch (error) {
+			confirmError = message$1(error);
+			log.warn("Mesh renewal: confirm not accepted yet", {
+				tags,
+				meta: { error: confirmError }
+			});
+		}
+		if (now() >= deadline) break;
+		await sleep(confirmRetryMs);
+	}
+	if (!confirmedByNode) return fail("confirm", confirmError, false);
+	if (previous !== void 0 && previous.serial !== newLeaf.serial) {
+		await deps.registry.revoke(previous.fingerprint, "replaced-by-renewal", deps.crl);
+		deps.crl.revoke(previous.serial);
+		log.info("Mesh renewal: the previous leaf is revoked", {
+			tags,
+			meta: { oldSerial: previous.serial }
+		});
+	}
+	log.info("Mesh renewal: done", {
+		tags,
+		meta: {
+			newSerial: newLeaf.serial,
+			notAfter: new Date(newLeaf.notAfter).toISOString()
+		}
+	});
+	return {
+		ok: true,
+		oldSerial: previous?.serial ?? null,
+		newSerial: newLeaf.serial,
+		newNotAfter: newLeaf.notAfter
+	};
+}
+/**
+* Revoke every live mesh leaf of `nodeId` and cut its connection. The node cannot
+* reconnect: it must re-join with a new join token. The node is NOT forgotten
+* (that stays `clusterNodes.forgetNode`).
+*/
+async function revokeMeshCertificate(deps) {
+	const { nodeId, log } = deps;
+	const tags = { nodeId };
+	const live = deps.peers.peerLeaf(nodeId);
+	if (live !== void 0) await deps.registry.recordObserved(nodeId, {
+		cn: nodeId,
+		serial: live.serial,
+		fingerprint: live.fingerprint,
+		notBefore: live.notBefore,
+		notAfter: live.notAfter
+	});
+	const serials = [...await deps.registry.revokeAllForNode(nodeId, "revoked-by-operator", deps.crl)];
+	const disconnected = deps.peers.dropPeer(nodeId);
+	log.warn("Mesh certificate revoked and the node disconnected", {
+		tags,
+		meta: {
+			serials,
+			disconnected
+		}
+	});
+	return {
+		nodeId,
+		revokedSerials: serials,
+		disconnected,
+		next: "The node can no longer connect. Re-join it with a new join token (System -> Cluster -> Add agent); to remove it from the cluster use Forget node."
+	};
+}
+//#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-peer-transport.ts
 var LOOKUP_SLOT = Symbol.for("camstack.cluster.mesh-peer-transport-lookup");
 /** Published by the hub broker owner; cleared on shutdown. */
@@ -626,6 +1256,36 @@ function getProcessMeshPeerTransportLookup() {
 function getProcessNodeMeshTransport(nodeId) {
 	return getProcessMeshPeerTransportLookup()?.transportOf(nodeId);
 }
+/** The leaf `nodeId` presented on its live connection, or `undefined`. */
+function getProcessPeerLeaf(nodeId) {
+	return getProcessMeshPeerTransportLookup()?.peerLeaf?.(nodeId);
+}
+/** Disconnect `nodeId` (closes its mutual-TLS sockets). `0` when none were open. */
+function dropProcessPeer(nodeId) {
+	return getProcessMeshPeerTransportLookup()?.dropPeer?.(nodeId) ?? 0;
+}
+var REGISTRATION_SLOT = Symbol.for("camstack.cluster.node-registration-listeners");
+function registrationListeners() {
+	const existing = Reflect.get(globalThis, REGISTRATION_SLOT);
+	if (existing instanceof Set) return existing;
+	const created = /* @__PURE__ */ new Set();
+	Reflect.set(globalThis, REGISTRATION_SLOT, created);
+	return created;
+}
+/** Subscribe to "node X finished registering". Returns the unsubscribe. */
+function onProcessNodeRegistered(listener) {
+	const listeners = registrationListeners();
+	listeners.add(listener);
+	return () => {
+		listeners.delete(listener);
+	};
+}
+/** Called by the hub when a node's `registerNode` has been applied. */
+function emitProcessNodeRegistered(nodeId) {
+	for (const listener of [...registrationListeners()]) try {
+		listener(nodeId);
+	} catch {}
+}
 //#endregion
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder("utf-8", { fatal: !0 });
@@ -1475,6 +2135,11 @@ async function enrollMeshNode(body, deps) {
 			status: 400
 		};
 	}
+	try {
+		await deps.onIssued?.(leaf.commonName, leaf.certPem);
+	} catch (err) {
+		deps.onRecordFailed?.(leaf.commonName, err);
+	}
 	return {
 		ok: true,
 		cert: leaf.certPem,
@@ -86792,6 +87457,23 @@ function peekSender(transporter, type, message) {
 		return null;
 	}
 }
+function peerLeafOf(socket) {
+	const cert = socket.getPeerCertificate(true);
+	if (cert == null || typeof cert !== "object" || !("raw" in cert) || !Buffer.isBuffer(cert.raw)) return null;
+	try {
+		const x509 = new node_crypto.X509Certificate(cert.raw);
+		const remote = socket.remoteAddress;
+		return {
+			...remote !== void 0 ? { remoteAddress: remote.replace(/^::ffff:/, "") } : {},
+			serial: x509.serialNumber,
+			fingerprint: x509.fingerprint256,
+			notBefore: Date.parse(x509.validFrom),
+			notAfter: Date.parse(x509.validTo)
+		};
+	} catch {
+		return null;
+	}
+}
 function peerIdentity(socket) {
 	const cert = socket.getPeerCertificate(true);
 	if (cert == null || typeof cert !== "object" || !("raw" in cert) || !cert.raw) return null;
@@ -86819,6 +87501,8 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	tlsSockets = /* @__PURE__ */ new Set();
 	/** Node id (certificate CN) → serial of every peer that completed a mutual-TLS handshake. */
 	tlsPeers = /* @__PURE__ */ new Map();
+	/** Node id → the leaf it presented at its last handshake (hub inventory, D856). */
+	peerLeaves = /* @__PURE__ */ new Map();
 	clearDisabled = false;
 	hubTlsOnly;
 	hubOnlyPeers;
@@ -86932,6 +87616,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 						tlsSock.meshPeerCn = identity.cn;
 						tlsSock.meshPeerSerial = identity.serial;
 						self.tlsPeers.set(identity.cn, identity.serial);
+						self.rememberPeerLeaf(identity.cn, tlsSock);
 						self.tlsSockets.add(tlsSock);
 						tlsSock.on("close", () => {
 							self.tlsSockets.delete(tlsSock);
@@ -86984,6 +87669,25 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	forgetPeer(nodeId) {
 		for (const socket of this.tlsSockets) if (socket.meshPeerCn === nodeId && !socket.destroyed) return;
 		this.tlsPeers.delete(nodeId);
+		this.peerLeaves.delete(nodeId);
+	}
+	rememberPeerLeaf(nodeId, socket) {
+		const leaf = peerLeafOf(socket);
+		if (leaf !== null) this.peerLeaves.set(nodeId, leaf);
+	}
+	/** The leaf `nodeId` presented at its last mutual-TLS handshake. */
+	peerLeaf(nodeId) {
+		return this.peerLeaves.get(nodeId);
+	}
+	/** Close every live mutual-TLS socket of `nodeId` (revocation, renewal). Returns how many. */
+	dropPeer(nodeId) {
+		let closed = 0;
+		for (const socket of this.tlsSockets) {
+			if (socket.meshPeerCn !== nodeId || socket.destroyed) continue;
+			socket.destroy();
+			closed += 1;
+		}
+		return closed;
 	}
 	/** True once the mutual-TLS listener is bound. */
 	isTlsListening() {
@@ -87038,6 +87742,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		} catch {}
 		this.tlsSockets.clear();
 		this.tlsPeers.clear();
+		this.peerLeaves.clear();
 		return super.disconnect();
 	}
 	/**
@@ -87166,6 +87871,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		socket.meshPeerSerial = identity.serial;
 		this.tlsSockets.add(socket);
 		this.tlsPeers.set(identity.cn, identity.serial);
+		this.rememberPeerLeaf(identity.cn, socket);
 		const reader = this.reader;
 		socket.on("close", () => {
 			this.tlsSockets.delete(socket);
@@ -87387,6 +88093,8 @@ var systemConfigMeshActions = require_dist.defineCustomActions({
 });
 //#endregion
 //#region src/builtins/system-config/system-config.addon.ts
+/** How often superseded and expired mesh certificate rows are reaped. */
+var MESH_REAP_MS = 24 * 36e5;
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.
 *
@@ -87464,6 +88172,10 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 	id = "system-config";
 	clusterSecretKeeper = null;
 	meshCaKeeper = null;
+	meshReapTimer = null;
+	meshGateTimers = /* @__PURE__ */ new Set();
+	stoppedMesh = false;
+	loggedNoSettingsStore = false;
 	constructor() {
 		super({});
 	}
@@ -87503,19 +88215,107 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 	}
 	async onShutdown() {
 		setProcessMeshEnforcer(null);
+		setProcessMeshCertificateRegistry(null);
+		setProcessMeshTlsListenerState(null);
+		require_agent_https_names.setProcessAgentHttpsNames(null);
+		this.stoppedMesh = true;
+		if (this.meshReapTimer !== null) clearInterval(this.meshReapTimer);
+		this.meshReapTimer = null;
+		for (const timer of this.meshGateTimers) clearTimeout(timer);
+		this.meshGateTimers.clear();
 		this.meshCaKeeper?.stop();
 		this.meshCaKeeper = null;
 		this.clusterSecretKeeper?.stop();
 		this.clusterSecretKeeper = null;
 	}
+	/**
+	* The hub's record of mesh leaves (D856): declared and loaded BEFORE the TLS
+	* listener opens, so persisted revocations are in the CRL before any node can
+	* connect. Best effort: a hub whose settings store is not up still serves the
+	* mesh (the registry then fills from the leaves nodes present).
+	*/
+	async initMeshCertificateRegistry() {
+		const store = this.ctx.api?.settingsStore;
+		if (!store) {
+			if (!this.loggedNoSettingsStore) {
+				this.loggedNoSettingsStore = true;
+				this.ctx.logger.error("No settings store in this process: the revocation registry cannot load, so the mesh TLS listener stays CLOSED and every agent is refused (shown on Identity -> Certificates)");
+			}
+			return null;
+		}
+		this.loadAgentHttpsNames(store);
+		try {
+			await store.declareCollection.mutate({
+				collection: MESH_NODE_CERTIFICATES_COLLECTION,
+				columns: MESH_NODE_CERTIFICATES_COLUMNS,
+				indexes: [{
+					name: "idx_mesh_node_certificates_node",
+					columns: ["nodeId"]
+				}]
+			});
+			const registry = new MeshCertificateRegistry(store, { logger: this.ctx.logger });
+			await registry.load();
+			const restored = registry.restoreCrl(processMeshCrl());
+			const settled = await registry.settleInterruptedRenewals();
+			if (settled > 0) this.ctx.logger.warn("A mesh renewal was interrupted by a hub restart - its new leaf was set aside", { meta: { settled } });
+			setProcessMeshCertificateRegistry(registry);
+			if (restored > 0) this.ctx.logger.info("Mesh revocations restored into the CRL", { meta: { restored } });
+			return registry;
+		} catch (err) {
+			this.ctx.logger.error("Mesh certificate registry unavailable", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			return null;
+		}
+	}
+	/** Which names the hub certified to which agent. Best effort; nothing waits on it. */
+	async loadAgentHttpsNames(store) {
+		try {
+			await store.declareCollection.mutate({
+				collection: require_agent_https_names.AGENT_HTTPS_NAMES_COLLECTION,
+				columns: require_agent_https_names.AGENT_HTTPS_NAMES_COLUMNS
+			});
+			const names = new require_agent_https_names.AgentHttpsNames(store);
+			await names.load();
+			require_agent_https_names.setProcessAgentHttpsNames(names);
+		} catch (err) {
+			this.ctx.logger.warn("Agent HTTPS names registry unavailable (agent HTTPS issuance will be refused until it loads)", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
+	/**
+	* The mesh TLS listener opens ONLY after the revocation registry has loaded and its
+	* revocations are in the CRL (D856): until then every agent is refused, because an
+	* empty CRL would accept a revoked leaf. Retries until the settings store answers.
+	*/
 	async onMeshCaReady(ca) {
-		const hubLeaf = await issueMeshLeafForNode(ca, "hub");
-		await requestProcessMeshTlsEnable({
-			caCertPem: ca.certPem,
-			certPem: hubLeaf.certPem,
-			keyPem: hubLeaf.keyPem
+		await openMeshTlsWhenRevocationsLoaded({
+			loadRegistry: () => this.initMeshCertificateRegistry(),
+			open: async (registry) => {
+				const hubLeaf = await issueMeshLeafForNode(ca, "hub");
+				await registry.recordIssued("hub", hubLeaf.certPem, "boot").catch((err) => {
+					this.ctx.logger.warn("Hub mesh leaf could not be recorded", { meta: { error: err instanceof Error ? err.message : String(err) } });
+				});
+				await registry.reap().catch(() => void 0);
+				if (this.meshReapTimer !== null) clearInterval(this.meshReapTimer);
+				this.meshReapTimer = setInterval(() => void registry.reap().catch(() => void 0), MESH_REAP_MS);
+				this.meshReapTimer.unref?.();
+				await requestProcessMeshTlsEnable({
+					caCertPem: ca.certPem,
+					certPem: hubLeaf.certPem,
+					keyPem: hubLeaf.keyPem
+				});
+				this.ctx.logger.info("Mesh CA ready — revocations loaded, TLS material offered to the transporter");
+			},
+			retry: (fn, ms) => {
+				if (this.stoppedMesh) return;
+				const timer = setTimeout(fn, ms);
+				timer.unref?.();
+				this.meshGateTimers.add(timer);
+			},
+			onState: (state) => setProcessMeshTlsListenerState(state),
+			onWaiting: (attempt) => {
+				if (attempt === 1 || attempt % 20 === 0) this.ctx.logger.error("Mesh TLS stays CLOSED: the revocation registry has not loaded, so agents are refused rather than accepted with an empty CRL", { meta: { attempt } });
+			},
+			onError: (err) => this.ctx.logger.error("Mesh certificate registry failed to load", { meta: { error: err instanceof Error ? err.message : String(err) } })
 		});
-		this.ctx.logger.info("Mesh CA ready — TLS material offered to the transporter");
 	}
 	async mintJoinToken(input) {
 		const ca = requireProcessMeshCa();
@@ -87864,9 +88664,13 @@ exports.AGENT_UI_UNLOCK_VERSION = AGENT_UI_UNLOCK_VERSION;
 exports.Errors = Errors;
 exports.JoinTokenJtiStore = JoinTokenJtiStore;
 exports.MESH_AUTH_MODE_FIELD = MESH_AUTH_MODE_FIELD;
+exports.MESH_NODE_CERTIFICATES_COLLECTION = MESH_NODE_CERTIFICATES_COLLECTION;
+exports.MESH_NODE_CERTIFICATES_COLUMNS = MESH_NODE_CERTIFICATES_COLUMNS;
 exports.MESH_TLS_PORT_HELLO_FIELD = MESH_TLS_PORT_HELLO_FIELD;
 exports.MeshCaKeeper = MeshCaKeeper;
+exports.MeshCertificateRegistry = MeshCertificateRegistry;
 exports.MeshCrl = MeshCrl;
+exports.RENEWAL_ABANDONED = RENEWAL_ABANDONED;
 exports.SYSTEM_CONFIG_CLUSTER_SECTION_ID = SYSTEM_CONFIG_CLUSTER_SECTION_ID;
 exports.ServiceBroker = ServiceBroker;
 exports.SystemConfigAddon = SystemConfigAddon;
@@ -87877,6 +88681,9 @@ exports.caFingerprint = caFingerprint;
 exports.caFingerprintCompact = caFingerprintCompact;
 exports.createCidrMatcher = createCidrMatcher;
 exports.createMeshCsrPem = createMeshCsrPem;
+exports.describeMeshLeaf = describeMeshLeaf;
+exports.dropProcessPeer = dropProcessPeer;
+exports.emitProcessNodeRegistered = emitProcessNodeRegistered;
 exports.enrollMeshNode = enrollMeshNode;
 exports.exportMeshPrivateKeyPem = exportMeshPrivateKeyPem;
 exports.generateMeshCa = generateMeshCa;
@@ -87884,7 +88691,10 @@ exports.generateMeshKeyPair = generateMeshKeyPair;
 exports.getProcessMeshAuthMode = getProcessMeshAuthMode;
 exports.getProcessMeshAuthStatus = getProcessMeshAuthStatus;
 exports.getProcessMeshCaState = getProcessMeshCaState;
+exports.getProcessMeshCertificateRegistry = getProcessMeshCertificateRegistry;
+exports.getProcessMeshTlsListenerState = getProcessMeshTlsListenerState;
 exports.getProcessNodeMeshTransport = getProcessNodeMeshTransport;
+exports.getProcessPeerLeaf = getProcessPeerLeaf;
 exports.isAllowedAgentDashboardReturnTo = isAllowedAgentDashboardReturnTo;
 exports.isMeshAuthMode = isMeshAuthMode;
 exports.issueMeshLeafForNode = issueMeshLeafForNode;
@@ -87893,19 +88703,25 @@ exports.loadMeshCa = loadMeshCa;
 exports.mintAgentUiUnlockTicket = mintAgentUiUnlockTicket;
 exports.mintMeshJoinToken = mintMeshJoinToken;
 exports.normalizeIp = normalizeIp;
+exports.onProcessNodeRegistered = onProcessNodeRegistered;
+exports.openMeshTlsWhenRevocationsLoaded = openMeshTlsWhenRevocationsLoaded;
 exports.parseAgentDashboardOrigins = parseAgentDashboardOrigins;
 exports.parseCidrList = parseCidrList;
 exports.parseMeshAuthMode = parseMeshAuthMode;
 exports.processJoinTokenJtiStore = processJoinTokenJtiStore;
 exports.processMeshCrl = processMeshCrl;
 exports.readCidrSetting = readCidrSetting;
+exports.renewMeshCertificate = renewMeshCertificate;
 exports.requestProcessMeshEnforcement = requestProcessMeshEnforcement;
 exports.requireProcessMeshCa = requireProcessMeshCa;
+exports.revokeMeshCertificate = revokeMeshCertificate;
 exports.setProcessMeshAuthMode = setProcessMeshAuthMode;
 exports.setProcessMeshAuthStatusSource = setProcessMeshAuthStatusSource;
+exports.setProcessMeshCertificateRegistry = setProcessMeshCertificateRegistry;
 exports.setProcessMeshEnforcer = setProcessMeshEnforcer;
 exports.setProcessMeshPeerTransportLookup = setProcessMeshPeerTransportLookup;
 exports.setProcessMeshTlsEnabler = setProcessMeshTlsEnabler;
+exports.setProcessMeshTlsListenerState = setProcessMeshTlsListenerState;
 exports.systemConfigMeshActions = systemConfigMeshActions;
 exports.verifyAgentUiUnlockTicket = verifyAgentUiUnlockTicket;
 exports.verifyMeshJoinToken = verifyMeshJoinToken;