@camstack/system 1.2.428 → 1.2.430

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,8 +1,9 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Dr as defineCustomActions, Er as customAction, Ir as isSecretClear, Lr as isSecretMarker, Mr as hydrateSchema, Xr as secretTreeFromSchema, cr as errMsg, ei as transformSecretWrite, lr as BaseAddon, zr as makeSecretMarker } from "../../dist-DHSJV4Qc.mjs";
+import { Br as hydrateSchema, Fr as defineCustomActions, Gr as isSecretMarker, Pr as customAction, Wr as isSecretClear, _r as BaseAddon, ci as transformSecretWrite, gr as errMsg, ii as secretTreeFromSchema, qr as makeSecretMarker } from "../../dist-CXG6muCR.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
-import { a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, c as MESH_JOIN_TOKEN_MAX_TTL_SEC, d as CLUSTER_SECRET_REF, i as MESH_CA_FIELD, l as SERVER_AUTH_OID, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID, v as hashClusterSecret } from "../../constants-CR4If_lP.mjs";
 import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "../../x509.es-CAjSsrkk.mjs";
+import { a as setProcessAgentHttpsNames, n as AGENT_HTTPS_NAMES_COLUMNS, r as AgentHttpsNames, t as AGENT_HTTPS_NAMES_COLLECTION } from "../../agent-https-names-uetr4OQl.mjs";
+import { a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, c as MESH_JOIN_TOKEN_MAX_TTL_SEC, d as CLUSTER_SECRET_REF, i as MESH_CA_FIELD, l as SERVER_AUTH_OID, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID, v as hashClusterSecret } from "../../constants-CttE77VF.mjs";
 import { t as require_src } from "../../src-hG4grMU4.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createHmac, randomBytes, timingSafeEqual, webcrypto } from "node:crypto";
@@ -416,7 +417,7 @@ async function exportMeshPrivateKeyPem(key) {
 }
 //#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-ca-keeper.ts
-var SLOT$2 = Symbol.for("camstack.mesh.ca");
+var SLOT$3 = Symbol.for("camstack.mesh.ca");
 var NOT_LOADED = {
 	state: "unavailable",
 	reason: "not-loaded"
@@ -428,10 +429,10 @@ function isState(value) {
 	return state === "unavailable" && typeof Reflect.get(value, "reason") === "string";
 }
 function setProcessMeshCa(state) {
-	Reflect.set(globalThis, SLOT$2, state);
+	Reflect.set(globalThis, SLOT$3, state);
 }
 function getProcessMeshCaState() {
-	const value = Reflect.get(globalThis, SLOT$2);
+	const value = Reflect.get(globalThis, SLOT$3);
 	return isState(value) ? value : NOT_LOADED;
 }
 function requireProcessMeshCa() {
@@ -573,10 +574,10 @@ async function loadOrGenerateMeshCa(deps) {
 var MeshCrl = class {
 	serials = /* @__PURE__ */ new Set();
 	revoke(serialNumber) {
-		this.serials.add(normalizeSerial(serialNumber));
+		this.serials.add(normalizeSerial$1(serialNumber));
 	}
 	isRevoked(serialNumber) {
-		return this.serials.has(normalizeSerial(serialNumber));
+		return this.serials.has(normalizeSerial$1(serialNumber));
 	}
 	list() {
 		return [...this.serials];
@@ -584,21 +585,650 @@ var MeshCrl = class {
 	/** Restore from persisted serials (system-settings). */
 	replaceAll(serials) {
 		this.serials.clear();
-		for (const s of serials) this.serials.add(normalizeSerial(s));
+		for (const s of serials) this.serials.add(normalizeSerial$1(s));
 	}
 };
-function normalizeSerial(serial) {
+function normalizeSerial$1(serial) {
 	return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
 }
-var SLOT$1 = Symbol.for("camstack.mesh.crl");
+var SLOT$2 = Symbol.for("camstack.mesh.crl");
 function processMeshCrl() {
-	const existing = Reflect.get(globalThis, SLOT$1);
+	const existing = Reflect.get(globalThis, SLOT$2);
 	if (existing instanceof MeshCrl) return existing;
 	const crl = new MeshCrl();
-	Reflect.set(globalThis, SLOT$1, crl);
+	Reflect.set(globalThis, SLOT$2, crl);
 	return crl;
 }
 //#endregion
+//#region src/kernel/moleculer/mesh-mtls/mesh-certificate-registry.ts
+/**
+* The hub's record of every mesh leaf (D856): which certificate each node holds,
+* when it expires, and which serials are revoked.
+*
+* Three ways a row appears:
+*  - `enroll` / `renewal` / `boot` - the hub issued it and wrote it down at the
+*    moment of issuing (the authoritative record);
+*  - `observed` - a node enrolled before this record existed (or by a path that
+*    did not write it) presented this leaf on its LIVE mutual-TLS connection.
+*
+* Revoked serials are persisted here and replayed into the in-memory CRL at boot,
+* so a revocation survives a hub restart. Hub only: agents persist none of it.
+*/
+/**
+* @durable class=config owner=system-config
+*   write="the hub records every mesh leaf it issues (enroll, renewal, boot) and every
+*     leaf a connected node is observed presenting; a revocation stamps revokedAt"
+*   retention="a revoked or expired row is kept 90 days past its end, then reaped; a
+*     live row is never deleted. Forgetting a node does not delete its rows."
+*/
+var MESH_NODE_CERTIFICATES_COLLECTION = "mesh_node_certificates";
+var MESH_NODE_CERTIFICATES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "nodeId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "serial",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "fingerprint",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "notBefore",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "notAfter",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "issuedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "issuedVia",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "revokedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "revokedReason",
+		type: "TEXT"
+	}
+];
+var RETENTION_MS = 90 * 864e5;
+/**
+* A leaf the hub signed for a renewal that did not complete. It must not be the node's
+* `current` leaf, but it is NOT on the CRL: the node may still hold it (the swap
+* could have landed without the hub seeing it), and cutting it off would be the
+* outage the hand-over exists to prevent. If the node is later seen presenting it, it
+* is reinstated.
+*/
+var RENEWAL_ABANDONED = "renewal-abandoned";
+var VIAS = [
+	"enroll",
+	"renewal",
+	"boot",
+	"observed"
+];
+/** CN, serial, fingerprint and validity of a leaf PEM (or DER). */
+function describeMeshLeaf(cert) {
+	const x509 = new X509Certificate(cert);
+	return {
+		cn: subjectCn(x509.subject) ?? "",
+		serial: x509.serialNumber,
+		fingerprint: x509.fingerprint256,
+		notBefore: Date.parse(x509.validFrom),
+		notAfter: Date.parse(x509.validTo)
+	};
+}
+function normalizeSerial(serial) {
+	return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
+}
+function parse$2(data) {
+	const str = (k) => {
+		const v = data[k];
+		return typeof v === "string" && v.length > 0 ? v : null;
+	};
+	const num = (k) => {
+		const v = data[k];
+		return typeof v === "number" && Number.isFinite(v) ? v : null;
+	};
+	const nodeId = str("nodeId");
+	const serial = str("serial");
+	const fingerprint = str("fingerprint");
+	const notBefore = num("notBefore");
+	const notAfter = num("notAfter");
+	const issuedAt = num("issuedAt");
+	if (nodeId === null || serial === null || fingerprint === null || notBefore === null || notAfter === null || issuedAt === null) return null;
+	return {
+		nodeId,
+		serial,
+		fingerprint,
+		notBefore,
+		notAfter,
+		issuedAt,
+		issuedVia: VIAS.find((v) => v === data["issuedVia"]) ?? "observed",
+		revokedAt: num("revokedAt"),
+		revokedReason: str("revokedReason")
+	};
+}
+var MeshCertificateRegistry = class {
+	store;
+	deps;
+	rows = /* @__PURE__ */ new Map();
+	constructor(store, deps = {}) {
+		this.store = store;
+		this.deps = deps;
+	}
+	now() {
+		return (this.deps.now ?? Date.now)();
+	}
+	async load() {
+		const rows = await this.store.query.query({ collection: MESH_NODE_CERTIFICATES_COLLECTION });
+		for (const row of rows) {
+			const record = parse$2(row.data);
+			if (record !== null) this.rows.set(record.fingerprint, record);
+		}
+	}
+	/** Write down a leaf the hub just issued. Idempotent per fingerprint. */
+	async recordIssued(nodeId, certPem, via) {
+		const leaf = describeMeshLeaf(certPem);
+		const existing = this.rows.get(leaf.fingerprint);
+		if (existing !== void 0) return existing;
+		const record = {
+			nodeId,
+			serial: leaf.serial,
+			fingerprint: leaf.fingerprint,
+			notBefore: leaf.notBefore,
+			notAfter: leaf.notAfter,
+			issuedAt: this.now(),
+			issuedVia: via,
+			revokedAt: null,
+			revokedReason: null
+		};
+		await this.insert(record);
+		this.deps.logger?.info("Mesh certificate recorded", {
+			tags: { nodeId },
+			meta: {
+				via,
+				serial: leaf.serial,
+				notAfter: new Date(leaf.notAfter).toISOString()
+			}
+		});
+		return record;
+	}
+	/**
+	* A node was seen presenting `leaf` on its live connection. A leaf the hub already
+	* knows is left alone; an unknown one is recorded `observed` (a node enrolled
+	* before this record existed).
+	*/
+	async recordObserved(nodeId, leaf) {
+		const known = this.rows.get(leaf.fingerprint);
+		if (known !== void 0) {
+			if (known.revokedReason !== "renewal-abandoned") return false;
+			const reinstated = {
+				...known,
+				revokedAt: null,
+				revokedReason: null
+			};
+			this.rows.set(known.fingerprint, reinstated);
+			await this.persist(reinstated);
+			this.deps.logger?.warn("An abandoned renewal leaf is in use - reinstated", {
+				tags: { nodeId },
+				meta: { serial: known.serial }
+			});
+			return true;
+		}
+		const record = {
+			nodeId,
+			serial: leaf.serial,
+			fingerprint: leaf.fingerprint,
+			notBefore: leaf.notBefore,
+			notAfter: leaf.notAfter,
+			issuedAt: this.now(),
+			issuedVia: "observed",
+			revokedAt: null,
+			revokedReason: null
+		};
+		await this.insert(record);
+		this.deps.logger?.info("Mesh certificate observed on a live connection and recorded", {
+			tags: { nodeId },
+			meta: {
+				serial: leaf.serial,
+				fingerprint: leaf.fingerprint
+			}
+		});
+		return true;
+	}
+	list(nodeId) {
+		return [...this.rows.values()].filter((r) => nodeId === void 0 || r.nodeId === nodeId).toSorted((a, b) => b.issuedAt - a.issuedAt);
+	}
+	/** The newest non-revoked leaf of a node, or `undefined`. */
+	currentFor(nodeId) {
+		return this.list(nodeId).find((r) => r.revokedAt === null);
+	}
+	/** Every non-revoked leaf of a node (a renewal in flight has two). */
+	liveFor(nodeId) {
+		return this.list(nodeId).filter((r) => r.revokedAt === null);
+	}
+	/** Stamp a leaf revoked (and mirror it into `crl`). `false` when unknown or already revoked. */
+	async revoke(fingerprint, reason, crl) {
+		const record = this.rows.get(fingerprint);
+		if (record === void 0 || record.revokedAt !== null) return false;
+		const revoked = {
+			...record,
+			revokedAt: this.now(),
+			revokedReason: reason
+		};
+		this.rows.set(fingerprint, revoked);
+		crl?.revoke(record.serial);
+		await this.persist(revoked);
+		this.deps.logger?.warn("Mesh certificate revoked", {
+			tags: { nodeId: record.nodeId },
+			meta: {
+				serial: record.serial,
+				reason
+			}
+		});
+		return true;
+	}
+	/**
+	* Operator revocation of a whole node: EVERY leaf of the node that is not already on the
+	* CRL goes on it - the current one, an observed one, a renewal one, and a leaf that was set
+	* aside (`renewal-abandoned`: a copy of it may sit on a stolen box, and it must not stay
+	* valid just because the hub once set it aside). Returns the serials put on the CRL.
+	* A leaf revoked this way is never reinstated by `recordObserved`.
+	*/
+	async revokeAllForNode(nodeId, reason, crl) {
+		const serials = [];
+		for (const record of this.list(nodeId)) {
+			if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned") continue;
+			const revoked = {
+				...record,
+				revokedAt: record.revokedAt ?? this.now(),
+				revokedReason: reason
+			};
+			this.rows.set(record.fingerprint, revoked);
+			crl.revoke(record.serial);
+			await this.persist(revoked);
+			serials.push(record.serial);
+		}
+		if (serials.length > 0) this.deps.logger?.warn("Every mesh certificate of the node revoked", {
+			tags: { nodeId },
+			meta: {
+				serials,
+				reason
+			}
+		});
+		return serials;
+	}
+	/**
+	* At boot: a node with TWO live leaves had a renewal in flight when the hub stopped. The
+	* newer (renewal) one is set aside - it is not the node's current leaf until the node is
+	* seen presenting it, which reinstates it. It is NOT put on the CRL.
+	*/
+	async settleInterruptedRenewals() {
+		let settled = 0;
+		const byNode = /* @__PURE__ */ new Map();
+		for (const record of this.rows.values()) {
+			if (record.revokedAt !== null) continue;
+			byNode.set(record.nodeId, [...byNode.get(record.nodeId) ?? [], record]);
+		}
+		for (const records of byNode.values()) {
+			if (records.length < 2) continue;
+			for (const record of records) if (record.issuedVia === "renewal" && await this.abandon(record.fingerprint)) settled += 1;
+		}
+		return settled;
+	}
+	/** Set a never-completed renewal leaf aside (not current, NOT on the CRL). */
+	async abandon(fingerprint) {
+		const record = this.rows.get(fingerprint);
+		if (record === void 0 || record.revokedAt !== null) return false;
+		const abandoned = {
+			...record,
+			revokedAt: this.now(),
+			revokedReason: RENEWAL_ABANDONED
+		};
+		this.rows.set(fingerprint, abandoned);
+		await this.persist(abandoned);
+		this.deps.logger?.warn("Renewal leaf set aside (not current, not on the CRL)", {
+			tags: { nodeId: record.nodeId },
+			meta: { serial: record.serial }
+		});
+		return true;
+	}
+	/** Replay every persisted revocation into `crl` (hub boot). Set-aside leaves are not revocations. */
+	restoreCrl(crl) {
+		let restored = 0;
+		for (const record of this.rows.values()) {
+			if (record.revokedAt === null || record.revokedReason === "renewal-abandoned") continue;
+			crl.revoke(record.serial);
+			restored += 1;
+		}
+		return restored;
+	}
+	/** Is `serial` listed as revoked here? */
+	isRevoked(serial) {
+		const wanted = normalizeSerial(serial);
+		for (const record of this.rows.values()) if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned" && normalizeSerial(record.serial) === wanted) return true;
+		return false;
+	}
+	async reap() {
+		const cutoff = this.now() - RETENTION_MS;
+		const dead = [...this.rows.values()].filter((r) => (r.revokedAt ?? r.notAfter) < cutoff);
+		for (const r of dead) {
+			this.rows.delete(r.fingerprint);
+			await this.store.delete.mutate({
+				collection: MESH_NODE_CERTIFICATES_COLLECTION,
+				key: r.fingerprint
+			});
+		}
+		return dead.length;
+	}
+	async insert(record) {
+		this.rows.set(record.fingerprint, record);
+		await this.store.insert.mutate({
+			collection: MESH_NODE_CERTIFICATES_COLLECTION,
+			record: {
+				id: record.fingerprint,
+				data: { ...record }
+			}
+		});
+	}
+	async persist(record) {
+		try {
+			await this.store.update.mutate({
+				collection: MESH_NODE_CERTIFICATES_COLLECTION,
+				id: record.fingerprint,
+				data: { ...record }
+			});
+		} catch (error) {
+			this.deps.logger?.error("Mesh certificate write failed - the change holds until restart", {
+				tags: { nodeId: record.nodeId },
+				meta: { error: error instanceof Error ? error.message : String(error) }
+			});
+		}
+	}
+};
+var SLOT$1 = Symbol.for("camstack.mesh.certificate-registry");
+function setProcessMeshCertificateRegistry(registry) {
+	if (registry === null) Reflect.deleteProperty(globalThis, SLOT$1);
+	else Reflect.set(globalThis, SLOT$1, registry);
+}
+function getProcessMeshCertificateRegistry() {
+	const value = Reflect.get(globalThis, SLOT$1);
+	return value !== null && typeof value === "object" && typeof Reflect.get(value, "recordIssued") === "function" ? value : null;
+}
+//#endregion
+//#region src/kernel/moleculer/mesh-mtls/mesh-tls-gate.ts
+var STATE_SLOT = Symbol.for("camstack.mesh.tls-listener-state");
+function setProcessMeshTlsListenerState(state) {
+	if (state === null) Reflect.deleteProperty(globalThis, STATE_SLOT);
+	else Reflect.set(globalThis, STATE_SLOT, state);
+}
+/** `null` before the gate has run at all (no mesh CA yet). */
+function getProcessMeshTlsListenerState() {
+	const value = Reflect.get(globalThis, STATE_SLOT);
+	if (value === null || typeof value !== "object") return null;
+	const state = Reflect.get(value, "state");
+	return state === "open" || state === "closed" ? value : null;
+}
+var DEFAULT_RETRY_MS = 15e3;
+/**
+* Nothing in `run` can reject: a load or an open that throws is reported and retried, so a
+* failure can never become an unhandled rejection that leaves the listener closed in silence.
+*/
+function openMeshTlsWhenRevocationsLoaded(deps) {
+	let attempt = 0;
+	let opened = false;
+	const now = deps.now ?? Date.now;
+	let closedSince = null;
+	const closed = (reason) => {
+		closedSince ??= now();
+		deps.onState?.({
+			state: "closed",
+			reason,
+			since: closedSince
+		});
+	};
+	const run = async () => {
+		if (opened) return true;
+		attempt += 1;
+		let registry = null;
+		try {
+			registry = await deps.loadRegistry();
+		} catch (error) {
+			deps.onError?.(error);
+		}
+		if (registry === null) {
+			closed("the revocation registry has not loaded - agents are refused");
+			deps.onWaiting?.(attempt);
+			deps.retry(() => void run(), deps.retryMs ?? DEFAULT_RETRY_MS);
+			return false;
+		}
+		try {
+			await deps.open(registry);
+		} catch (error) {
+			deps.onError?.(error);
+			closed("the listener failed to open - retrying");
+			deps.retry(() => void run(), deps.retryMs ?? DEFAULT_RETRY_MS);
+			return false;
+		}
+		opened = true;
+		deps.onState?.({ state: "open" });
+		return true;
+	};
+	return run();
+}
+//#endregion
+//#region src/kernel/moleculer/mesh-mtls/mesh-renewal.ts
+var DEFAULT_RECONNECT_TIMEOUT_MS = 45e3;
+var DEFAULT_CONFIRM_RETRY_MS = 500;
+function defaultSetTimer(fn, ms) {
+	const timer = setTimeout(fn, ms);
+	timer.unref?.();
+	return { cancel: () => clearTimeout(timer) };
+}
+function defaultSleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function message$1(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+async function renewMeshCertificate(deps) {
+	const { nodeId, log } = deps;
+	const tags = { nodeId };
+	const sleep = deps.sleep ?? defaultSleep;
+	const confirmRetryMs = deps.confirmRetryMs ?? DEFAULT_CONFIRM_RETRY_MS;
+	const setTimer = deps.setTimer ?? defaultSetTimer;
+	const timeoutMs = deps.reconnectTimeoutMs ?? DEFAULT_RECONNECT_TIMEOUT_MS;
+	const now = deps.now ?? Date.now;
+	const live = deps.peers.peerLeaf(nodeId);
+	const previous = live ?? deps.registry.currentFor(nodeId);
+	if (live !== void 0) await deps.registry.recordObserved(nodeId, {
+		cn: nodeId,
+		serial: live.serial,
+		fingerprint: live.fingerprint,
+		notBefore: live.notBefore,
+		notAfter: live.notAfter
+	});
+	log.info("Mesh renewal: starting", {
+		tags,
+		meta: {
+			currentSerial: previous?.serial ?? null,
+			connected: live !== void 0
+		}
+	});
+	const fail = (stage, reason, keptPreviousLeaf) => {
+		log.error("Mesh renewal: failed", {
+			tags,
+			meta: {
+				stage,
+				reason,
+				keptPreviousLeaf
+			}
+		});
+		return {
+			ok: false,
+			stage,
+			reason,
+			keptPreviousLeaf
+		};
+	};
+	let csrPem;
+	try {
+		csrPem = (await deps.client.prepareMeshRenewal()).csrPem;
+		log.info("Mesh renewal: the node generated a new key and sent its CSR", { tags });
+	} catch (error) {
+		return fail("prepare", message$1(error), true);
+	}
+	let issued;
+	try {
+		issued = await issueMeshLeafFromCsr(deps.ca, csrPem, { expectedNodeId: nodeId });
+		await deps.registry.recordIssued(nodeId, issued.certPem, "renewal");
+		log.info("Mesh renewal: new leaf signed and recorded", {
+			tags,
+			meta: {
+				serial: issued.serialNumber,
+				notAfter: issued.notAfter.toISOString()
+			}
+		});
+	} catch (error) {
+		return fail("issue", message$1(error), true);
+	}
+	const newLeaf = describeMeshLeaf(issued.certPem);
+	let resolveRegistered = () => void 0;
+	const registeredPromise = new Promise((resolve) => {
+		resolveRegistered = resolve;
+	});
+	const unsubscribe = deps.registrations.subscribe((id) => {
+		if (id === nodeId && deps.peers.peerLeaf(nodeId)?.fingerprint === newLeaf.fingerprint) resolveRegistered(true);
+	});
+	const deadlineTimer = setTimer(() => resolveRegistered(false), timeoutMs);
+	registeredPromise.then(() => deadlineTimer.cancel());
+	try {
+		await deps.client.installMeshLeaf({
+			certPem: issued.certPem,
+			caCertPem: deps.ca.certPem,
+			confirmWithinMs: timeoutMs + 3e4
+		});
+		log.info("Mesh renewal: the node installed the new leaf and is reconnecting", { tags });
+	} catch (error) {
+		unsubscribe();
+		deadlineTimer.cancel();
+		await deps.client.rollbackMeshLeaf().catch(() => void 0);
+		await deps.registry.abandon(newLeaf.fingerprint);
+		return fail("install", message$1(error), true);
+	}
+	const deadline = now() + timeoutMs;
+	const registered = await registeredPromise;
+	unsubscribe();
+	if (!registered) {
+		const back = await deps.client.rollbackMeshLeaf().catch(() => ({ rolledBack: false }));
+		log.warn("Mesh renewal: the node was not back and registered with the new leaf in time", {
+			tags,
+			meta: {
+				timeoutMs,
+				rolledBack: back.rolledBack
+			}
+		});
+		await deps.registry.abandon(newLeaf.fingerprint);
+		return fail("reconnect", `the node was not back and registered with the new leaf within ${Math.round(timeoutMs / 1e3)} s; the previous leaf was kept and is still valid`, true);
+	}
+	log.info("Mesh renewal: the node registered presenting the new leaf", { tags });
+	let confirmError = "the node did not confirm the new leaf";
+	let confirmedByNode = false;
+	for (;;) {
+		try {
+			if ((await deps.client.confirmMeshLeaf({ fingerprintSha256: newLeaf.fingerprint })).confirmed) {
+				confirmedByNode = true;
+				break;
+			}
+			confirmError = "the node did not confirm the new leaf";
+		} catch (error) {
+			confirmError = message$1(error);
+			log.warn("Mesh renewal: confirm not accepted yet", {
+				tags,
+				meta: { error: confirmError }
+			});
+		}
+		if (now() >= deadline) break;
+		await sleep(confirmRetryMs);
+	}
+	if (!confirmedByNode) return fail("confirm", confirmError, false);
+	if (previous !== void 0 && previous.serial !== newLeaf.serial) {
+		await deps.registry.revoke(previous.fingerprint, "replaced-by-renewal", deps.crl);
+		deps.crl.revoke(previous.serial);
+		log.info("Mesh renewal: the previous leaf is revoked", {
+			tags,
+			meta: { oldSerial: previous.serial }
+		});
+	}
+	log.info("Mesh renewal: done", {
+		tags,
+		meta: {
+			newSerial: newLeaf.serial,
+			notAfter: new Date(newLeaf.notAfter).toISOString()
+		}
+	});
+	return {
+		ok: true,
+		oldSerial: previous?.serial ?? null,
+		newSerial: newLeaf.serial,
+		newNotAfter: newLeaf.notAfter
+	};
+}
+/**
+* Revoke every live mesh leaf of `nodeId` and cut its connection. The node cannot
+* reconnect: it must re-join with a new join token. The node is NOT forgotten
+* (that stays `clusterNodes.forgetNode`).
+*/
+async function revokeMeshCertificate(deps) {
+	const { nodeId, log } = deps;
+	const tags = { nodeId };
+	const live = deps.peers.peerLeaf(nodeId);
+	if (live !== void 0) await deps.registry.recordObserved(nodeId, {
+		cn: nodeId,
+		serial: live.serial,
+		fingerprint: live.fingerprint,
+		notBefore: live.notBefore,
+		notAfter: live.notAfter
+	});
+	const serials = [...await deps.registry.revokeAllForNode(nodeId, "revoked-by-operator", deps.crl)];
+	const disconnected = deps.peers.dropPeer(nodeId);
+	log.warn("Mesh certificate revoked and the node disconnected", {
+		tags,
+		meta: {
+			serials,
+			disconnected
+		}
+	});
+	return {
+		nodeId,
+		revokedSerials: serials,
+		disconnected,
+		next: "The node can no longer connect. Re-join it with a new join token (System -> Cluster -> Add agent); to remove it from the cluster use Forget node."
+	};
+}
+//#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-peer-transport.ts
 var LOOKUP_SLOT = Symbol.for("camstack.cluster.mesh-peer-transport-lookup");
 /** Published by the hub broker owner; cleared on shutdown. */
@@ -617,6 +1247,36 @@ function getProcessMeshPeerTransportLookup() {
 function getProcessNodeMeshTransport(nodeId) {
 	return getProcessMeshPeerTransportLookup()?.transportOf(nodeId);
 }
+/** The leaf `nodeId` presented on its live connection, or `undefined`. */
+function getProcessPeerLeaf(nodeId) {
+	return getProcessMeshPeerTransportLookup()?.peerLeaf?.(nodeId);
+}
+/** Disconnect `nodeId` (closes its mutual-TLS sockets). `0` when none were open. */
+function dropProcessPeer(nodeId) {
+	return getProcessMeshPeerTransportLookup()?.dropPeer?.(nodeId) ?? 0;
+}
+var REGISTRATION_SLOT = Symbol.for("camstack.cluster.node-registration-listeners");
+function registrationListeners() {
+	const existing = Reflect.get(globalThis, REGISTRATION_SLOT);
+	if (existing instanceof Set) return existing;
+	const created = /* @__PURE__ */ new Set();
+	Reflect.set(globalThis, REGISTRATION_SLOT, created);
+	return created;
+}
+/** Subscribe to "node X finished registering". Returns the unsubscribe. */
+function onProcessNodeRegistered(listener) {
+	const listeners = registrationListeners();
+	listeners.add(listener);
+	return () => {
+		listeners.delete(listener);
+	};
+}
+/** Called by the hub when a node's `registerNode` has been applied. */
+function emitProcessNodeRegistered(nodeId) {
+	for (const listener of [...registrationListeners()]) try {
+		listener(nodeId);
+	} catch {}
+}
 //#endregion
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder("utf-8", { fatal: !0 });
@@ -1466,6 +2126,11 @@ async function enrollMeshNode(body, deps) {
 			status: 400
 		};
 	}
+	try {
+		await deps.onIssued?.(leaf.commonName, leaf.certPem);
+	} catch (err) {
+		deps.onRecordFailed?.(leaf.commonName, err);
+	}
 	return {
 		ok: true,
 		cert: leaf.certPem,
@@ -86783,6 +87448,23 @@ function peekSender(transporter, type, message) {
 		return null;
 	}
 }
+function peerLeafOf(socket) {
+	const cert = socket.getPeerCertificate(true);
+	if (cert == null || typeof cert !== "object" || !("raw" in cert) || !Buffer.isBuffer(cert.raw)) return null;
+	try {
+		const x509 = new X509Certificate(cert.raw);
+		const remote = socket.remoteAddress;
+		return {
+			...remote !== void 0 ? { remoteAddress: remote.replace(/^::ffff:/, "") } : {},
+			serial: x509.serialNumber,
+			fingerprint: x509.fingerprint256,
+			notBefore: Date.parse(x509.validFrom),
+			notAfter: Date.parse(x509.validTo)
+		};
+	} catch {
+		return null;
+	}
+}
 function peerIdentity(socket) {
 	const cert = socket.getPeerCertificate(true);
 	if (cert == null || typeof cert !== "object" || !("raw" in cert) || !cert.raw) return null;
@@ -86810,6 +87492,8 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	tlsSockets = /* @__PURE__ */ new Set();
 	/** Node id (certificate CN) → serial of every peer that completed a mutual-TLS handshake. */
 	tlsPeers = /* @__PURE__ */ new Map();
+	/** Node id → the leaf it presented at its last handshake (hub inventory, D856). */
+	peerLeaves = /* @__PURE__ */ new Map();
 	clearDisabled = false;
 	hubTlsOnly;
 	hubOnlyPeers;
@@ -86923,6 +87607,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 						tlsSock.meshPeerCn = identity.cn;
 						tlsSock.meshPeerSerial = identity.serial;
 						self.tlsPeers.set(identity.cn, identity.serial);
+						self.rememberPeerLeaf(identity.cn, tlsSock);
 						self.tlsSockets.add(tlsSock);
 						tlsSock.on("close", () => {
 							self.tlsSockets.delete(tlsSock);
@@ -86975,6 +87660,25 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	forgetPeer(nodeId) {
 		for (const socket of this.tlsSockets) if (socket.meshPeerCn === nodeId && !socket.destroyed) return;
 		this.tlsPeers.delete(nodeId);
+		this.peerLeaves.delete(nodeId);
+	}
+	rememberPeerLeaf(nodeId, socket) {
+		const leaf = peerLeafOf(socket);
+		if (leaf !== null) this.peerLeaves.set(nodeId, leaf);
+	}
+	/** The leaf `nodeId` presented at its last mutual-TLS handshake. */
+	peerLeaf(nodeId) {
+		return this.peerLeaves.get(nodeId);
+	}
+	/** Close every live mutual-TLS socket of `nodeId` (revocation, renewal). Returns how many. */
+	dropPeer(nodeId) {
+		let closed = 0;
+		for (const socket of this.tlsSockets) {
+			if (socket.meshPeerCn !== nodeId || socket.destroyed) continue;
+			socket.destroy();
+			closed += 1;
+		}
+		return closed;
 	}
 	/** True once the mutual-TLS listener is bound. */
 	isTlsListening() {
@@ -87029,6 +87733,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		} catch {}
 		this.tlsSockets.clear();
 		this.tlsPeers.clear();
+		this.peerLeaves.clear();
 		return super.disconnect();
 	}
 	/**
@@ -87157,6 +87862,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		socket.meshPeerSerial = identity.serial;
 		this.tlsSockets.add(socket);
 		this.tlsPeers.set(identity.cn, identity.serial);
+		this.rememberPeerLeaf(identity.cn, socket);
 		const reader = this.reader;
 		socket.on("close", () => {
 			this.tlsSockets.delete(socket);
@@ -87377,6 +88083,8 @@ var systemConfigMeshActions = defineCustomActions({
 });
 //#endregion
 //#region src/builtins/system-config/system-config.addon.ts
+/** How often superseded and expired mesh certificate rows are reaped. */
+var MESH_REAP_MS = 24 * 36e5;
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.
 *
@@ -87454,6 +88162,10 @@ var SystemConfigAddon = class extends BaseAddon {
 	id = "system-config";
 	clusterSecretKeeper = null;
 	meshCaKeeper = null;
+	meshReapTimer = null;
+	meshGateTimers = /* @__PURE__ */ new Set();
+	stoppedMesh = false;
+	loggedNoSettingsStore = false;
 	constructor() {
 		super({});
 	}
@@ -87493,19 +88205,107 @@ var SystemConfigAddon = class extends BaseAddon {
 	}
 	async onShutdown() {
 		setProcessMeshEnforcer(null);
+		setProcessMeshCertificateRegistry(null);
+		setProcessMeshTlsListenerState(null);
+		setProcessAgentHttpsNames(null);
+		this.stoppedMesh = true;
+		if (this.meshReapTimer !== null) clearInterval(this.meshReapTimer);
+		this.meshReapTimer = null;
+		for (const timer of this.meshGateTimers) clearTimeout(timer);
+		this.meshGateTimers.clear();
 		this.meshCaKeeper?.stop();
 		this.meshCaKeeper = null;
 		this.clusterSecretKeeper?.stop();
 		this.clusterSecretKeeper = null;
 	}
+	/**
+	* The hub's record of mesh leaves (D856): declared and loaded BEFORE the TLS
+	* listener opens, so persisted revocations are in the CRL before any node can
+	* connect. Best effort: a hub whose settings store is not up still serves the
+	* mesh (the registry then fills from the leaves nodes present).
+	*/
+	async initMeshCertificateRegistry() {
+		const store = this.ctx.api?.settingsStore;
+		if (!store) {
+			if (!this.loggedNoSettingsStore) {
+				this.loggedNoSettingsStore = true;
+				this.ctx.logger.error("No settings store in this process: the revocation registry cannot load, so the mesh TLS listener stays CLOSED and every agent is refused (shown on Identity -> Certificates)");
+			}
+			return null;
+		}
+		this.loadAgentHttpsNames(store);
+		try {
+			await store.declareCollection.mutate({
+				collection: MESH_NODE_CERTIFICATES_COLLECTION,
+				columns: MESH_NODE_CERTIFICATES_COLUMNS,
+				indexes: [{
+					name: "idx_mesh_node_certificates_node",
+					columns: ["nodeId"]
+				}]
+			});
+			const registry = new MeshCertificateRegistry(store, { logger: this.ctx.logger });
+			await registry.load();
+			const restored = registry.restoreCrl(processMeshCrl());
+			const settled = await registry.settleInterruptedRenewals();
+			if (settled > 0) this.ctx.logger.warn("A mesh renewal was interrupted by a hub restart - its new leaf was set aside", { meta: { settled } });
+			setProcessMeshCertificateRegistry(registry);
+			if (restored > 0) this.ctx.logger.info("Mesh revocations restored into the CRL", { meta: { restored } });
+			return registry;
+		} catch (err) {
+			this.ctx.logger.error("Mesh certificate registry unavailable", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			return null;
+		}
+	}
+	/** Which names the hub certified to which agent. Best effort; nothing waits on it. */
+	async loadAgentHttpsNames(store) {
+		try {
+			await store.declareCollection.mutate({
+				collection: AGENT_HTTPS_NAMES_COLLECTION,
+				columns: AGENT_HTTPS_NAMES_COLUMNS
+			});
+			const names = new AgentHttpsNames(store);
+			await names.load();
+			setProcessAgentHttpsNames(names);
+		} catch (err) {
+			this.ctx.logger.warn("Agent HTTPS names registry unavailable (agent HTTPS issuance will be refused until it loads)", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
+	/**
+	* The mesh TLS listener opens ONLY after the revocation registry has loaded and its
+	* revocations are in the CRL (D856): until then every agent is refused, because an
+	* empty CRL would accept a revoked leaf. Retries until the settings store answers.
+	*/
 	async onMeshCaReady(ca) {
-		const hubLeaf = await issueMeshLeafForNode(ca, "hub");
-		await requestProcessMeshTlsEnable({
-			caCertPem: ca.certPem,
-			certPem: hubLeaf.certPem,
-			keyPem: hubLeaf.keyPem
+		await openMeshTlsWhenRevocationsLoaded({
+			loadRegistry: () => this.initMeshCertificateRegistry(),
+			open: async (registry) => {
+				const hubLeaf = await issueMeshLeafForNode(ca, "hub");
+				await registry.recordIssued("hub", hubLeaf.certPem, "boot").catch((err) => {
+					this.ctx.logger.warn("Hub mesh leaf could not be recorded", { meta: { error: err instanceof Error ? err.message : String(err) } });
+				});
+				await registry.reap().catch(() => void 0);
+				if (this.meshReapTimer !== null) clearInterval(this.meshReapTimer);
+				this.meshReapTimer = setInterval(() => void registry.reap().catch(() => void 0), MESH_REAP_MS);
+				this.meshReapTimer.unref?.();
+				await requestProcessMeshTlsEnable({
+					caCertPem: ca.certPem,
+					certPem: hubLeaf.certPem,
+					keyPem: hubLeaf.keyPem
+				});
+				this.ctx.logger.info("Mesh CA ready — revocations loaded, TLS material offered to the transporter");
+			},
+			retry: (fn, ms) => {
+				if (this.stoppedMesh) return;
+				const timer = setTimeout(fn, ms);
+				timer.unref?.();
+				this.meshGateTimers.add(timer);
+			},
+			onState: (state) => setProcessMeshTlsListenerState(state),
+			onWaiting: (attempt) => {
+				if (attempt === 1 || attempt % 20 === 0) this.ctx.logger.error("Mesh TLS stays CLOSED: the revocation registry has not loaded, so agents are refused rather than accepted with an empty CRL", { meta: { attempt } });
+			},
+			onError: (err) => this.ctx.logger.error("Mesh certificate registry failed to load", { meta: { error: err instanceof Error ? err.message : String(err) } })
 		});
-		this.ctx.logger.info("Mesh CA ready — TLS material offered to the transporter");
 	}
 	async mintJoinToken(input) {
 		const ca = requireProcessMeshCa();
@@ -87847,4 +88647,4 @@ function readJwtExp(token) {
 	return typeof exp === "number" ? exp : 0;
 }
 //#endregion
-export { AGENT_UI_UNLOCK_TTL_MS as A, isMeshAuthMode as B, generateMeshCa as C, loadMeshCa as D, issueMeshLeafFromCsr as E, parseAgentDashboardOrigins as F, setProcessMeshEnforcer as G, requestProcessMeshEnforcement as H, verifyAgentUiUnlockTicket as I, parseCidrList as J, createCidrMatcher as K, MESH_AUTH_MODE_FIELD as L, UnlockTicketJtiStore as M, isAllowedAgentDashboardReturnTo as N, AGENT_DASHBOARD_ORIGINS_FIELD as O, mintAgentUiUnlockTicket as P, getProcessMeshAuthMode as R, exportMeshPrivateKeyPem as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, issueMeshLeafForNode as T, setProcessMeshAuthMode as U, parseMeshAuthMode as V, setProcessMeshAuthStatusSource as W, readCidrSetting as Y, getProcessMeshCaState as _, ServiceBroker as a, caFingerprintCompact as b, JoinTokenJtiStore as c, verifyMeshJoinToken as d, getProcessNodeMeshTransport as f, MeshCaKeeper as g, processMeshCrl as h, Errors as i, AGENT_UI_UNLOCK_VERSION as j, AGENT_UI_UNLOCK_DOMAIN as k, mintMeshJoinToken as l, MeshCrl as m, MESH_TLS_PORT_HELLO_FIELD as n, setProcessMeshTlsEnabler as o, setProcessMeshPeerTransportLookup as p, normalizeIp as q, TlsTcpTransporter as r, enrollMeshNode as s, systemConfigMeshActions as t, processJoinTokenJtiStore as u, requireProcessMeshCa as v, generateMeshKeyPair as w, createMeshCsrPem as x, caFingerprint as y, getProcessMeshAuthStatus as z };
+export { MESH_AUTH_MODE_FIELD as $, MeshCrl as A, generateMeshKeyPair as B, MESH_NODE_CERTIFICATES_COLLECTION as C, describeMeshLeaf as D, RENEWAL_ABANDONED as E, caFingerprint as F, AGENT_UI_UNLOCK_DOMAIN as G, issueMeshLeafFromCsr as H, caFingerprintCompact as I, UnlockTicketJtiStore as J, AGENT_UI_UNLOCK_TTL_MS as K, createMeshCsrPem as L, MeshCaKeeper as M, getProcessMeshCaState as N, getProcessMeshCertificateRegistry as O, requireProcessMeshCa as P, verifyAgentUiUnlockTicket as Q, exportMeshPrivateKeyPem as R, setProcessMeshTlsListenerState as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, MeshCertificateRegistry as T, loadMeshCa as U, issueMeshLeafForNode as V, AGENT_DASHBOARD_ORIGINS_FIELD as W, mintAgentUiUnlockTicket as X, isAllowedAgentDashboardReturnTo as Y, parseAgentDashboardOrigins as Z, setProcessMeshPeerTransportLookup as _, ServiceBroker as a, setProcessMeshAuthMode as at, getProcessMeshTlsListenerState as b, JoinTokenJtiStore as c, createCidrMatcher as ct, verifyMeshJoinToken as d, readCidrSetting as dt, getProcessMeshAuthMode as et, dropProcessPeer as f, onProcessNodeRegistered as g, getProcessPeerLeaf as h, Errors as i, requestProcessMeshEnforcement as it, processMeshCrl as j, setProcessMeshCertificateRegistry as k, mintMeshJoinToken as l, normalizeIp as lt, getProcessNodeMeshTransport as m, MESH_TLS_PORT_HELLO_FIELD as n, isMeshAuthMode as nt, setProcessMeshTlsEnabler as o, setProcessMeshAuthStatusSource as ot, emitProcessNodeRegistered as p, AGENT_UI_UNLOCK_VERSION as q, TlsTcpTransporter as r, parseMeshAuthMode as rt, enrollMeshNode as s, setProcessMeshEnforcer as st, systemConfigMeshActions as t, getProcessMeshAuthStatus as tt, processJoinTokenJtiStore as u, parseCidrList as ut, renewMeshCertificate as v, MESH_NODE_CERTIFICATES_COLUMNS as w, openMeshTlsWhenRevocationsLoaded as x, revokeMeshCertificate as y, generateMeshCa as z };