@camstack/system 1.2.432 → 1.2.434

package/dist/kernel/moleculer/mesh-mtls/pairing/agent-pairing.d.ts

@@ -0,0 +1,204 @@
+import { type AgentPairingState } from "./pairing-protocol.js";
+/** What the agent persists when a pairing completes. */
+export interface InstalledPairing {
+	readonly meshTls: {
+		readonly certPem: string;
+		readonly keyPem: string;
+		readonly caCertPem: string;
+	};
+	/** Host the broker dials (no port: the TLS port is the cluster default). */
+	readonly hubAddress: string;
+	readonly hubUrl: string;
+}
+/** What the agent's own machine is told, and nobody else (console, 0600 file, local window). */
+export interface LocalPairingSecret {
+	readonly pairingId: string;
+	readonly pin: string;
+	/** The six digits, once the hub revealed its nonce; `null` before that. */
+	readonly code: string | null;
+	readonly hub: {
+		readonly nodeId: string;
+		readonly url: string;
+		readonly caFingerprint: string;
+	};
+	readonly expiresAt: number;
+}
+export interface AgentPairingDeps {
+	readonly nodeId: string;
+	readonly version: string | null;
+	/** True when `agent.json` already holds mesh material. */
+	readonly isPaired: () => boolean;
+	/** Persist the material and reconnect. A throw cancels the pairing. */
+	readonly install: (pairing: InstalledPairing) => Promise<void>;
+	readonly now?: () => number;
+	readonly log?: (message: string, meta?: Record<string, unknown>) => void;
+	/** The pairing state may have changed (pending <-> unpaired): re-announce it. */
+	readonly onStateChange?: () => void;
+	/**
+	* A pairing needs the operator's eyes on THIS machine: print the PIN and the code to the console,
+	* write them to a 0600 file, show them in the local window. Called at the offer (code `null`)
+	* and again when the code is known.
+	*/
+	readonly onLocalSecret?: (secret: LocalPairingSecret) => void;
+	/** The pairing ended: remove what `onLocalSecret` wrote. */
+	readonly onLocalSecretCleared?: (pairingId: string) => void;
+	/**
+	* The LOCAL RESET CODE: print it to the console and a 0600 file. It clears the offer lockouts and
+	* the pending offers (a stranger who filled the slots with throwaway CAs would otherwise block
+	* pairing). Called at construction and again each time it is used.
+	*/
+	readonly onResetCode?: (code: string) => void;
+}
+export type PairingFailure = {
+	readonly ok: false;
+	readonly status: number;
+	readonly error: string;
+	readonly message: string;
+	/** Set on a rationed offer: how long until it may be tried again. */
+	readonly retryAfterMs?: number;
+};
+export type PairingResult<T> = ({
+	readonly ok: true;
+} & T) | PairingFailure;
+/** What an unauthenticated `hello` says. */
+export interface AgentHello {
+	/** The pairing protocol version the agent speaks; the hub compares it. */
+	readonly protocol: number;
+	readonly nodeId: string;
+	readonly version: string | null;
+	readonly state: AgentPairingState;
+	readonly pendingExpiresAt: number | null;
+}
+export interface OfferRequest {
+	readonly protocol: number;
+	readonly hubNodeId: string;
+	readonly hubCaCertPem: string;
+	readonly commitment: string;
+	readonly hubUrl: string;
+	readonly hubMeshAddress: string;
+	/** The offer, signed with the hub CA's KEY: a public CA certificate alone cannot make one. */
+	readonly signature: string;
+}
+export interface OfferAnswer {
+	readonly pairingId: string;
+	readonly csrPem: string;
+	readonly agentNonce: string;
+	readonly expiresAt: number;
+}
+export type PairingOutcome = "completed" | "rejected" | "expired" | "code-mismatch" | "failed";
+/** Who is asking, as the HTTP layer decided it (genuine loopback, no forwarding header). */
+export interface PairingRequestContext {
+	readonly local: boolean;
+	/** The caller's address, for per-source throttling of wrong PINs / reset codes. */
+	readonly source?: string;
+}
+/** One pending pairing as the NETWORK may see it: who asks, never a secret. */
+export interface PendingPairingPublic {
+	readonly hub: {
+		readonly nodeId: string;
+		readonly url: string;
+		readonly caFingerprint: string;
+	};
+	readonly expiresAt: number;
+}
+/** What anyone on the network may read from `status`. */
+export interface AgentPairingPublicView {
+	readonly state: AgentPairingState;
+	readonly pending: readonly PendingPairingPublic[];
+}
+/** The local view: the same, plus what only the agent's own machine may see. */
+export interface AgentPairingLocalView extends AgentPairingPublicView {
+	readonly pending: readonly (PendingPairingPublic & {
+		readonly pairingId: string;
+		readonly pin: string;
+		readonly code: string | null;
+		readonly localConfirmed: boolean;
+	})[];
+}
+/** What the hub learns by polling with the pairing id it was given. */
+export interface AgentPairingPoll {
+	/** `pending` while the pairing lives, `idle` once it ended. */
+	readonly state: "pending" | "idle";
+	readonly localConfirmed: boolean;
+	readonly last: {
+		readonly pairingId: string;
+		readonly outcome: PairingOutcome;
+	} | null;
+}
+/** `host:6443` / `[::1]:6443` / `host` → the host, port dropped. */
+export declare function hubHostFromMeshAddress(address: string): string;
+export declare class AgentPairing {
+	private readonly deps;
+	private readonly sessions;
+	/** Outcome of each recent pairing BY id (bounded): ending others never overwrites an answer. */
+	private readonly outcomes;
+	/** When pairings that never reached local confirmation ended. */
+	private abandoned;
+	private lockedUntil;
+	private readonly perCa;
+	private readonly pinBySource;
+	private globalPinFailures;
+	private resetCode;
+	/** Commitments already offered (signed offers are single use) until their signature is stale. */
+	private readonly seenCommitments;
+	private readonly now;
+	constructor(deps: AgentPairingDeps);
+	hello(): AgentHello;
+	state(): AgentPairingState;
+	/** Who is asking to pair, and until when. No code, no pairing id, no PIN. */
+	publicView(): AgentPairingPublicView;
+	/** The view for the agent's own machine: also the pairing ids, the codes and the PINs. */
+	localView(): AgentPairingLocalView;
+	offer(body: unknown): Promise<PairingResult<{
+		answer: OfferAnswer;
+	}>>;
+	/** The hub reveals its nonce; the agent checks it against the commitment and derives the code. */
+	reveal(body: unknown): PairingResult<object>;
+	/** The hub polls with the pairing id: did the agent's operator confirm, did it end? */
+	poll(body: unknown): PairingResult<{
+		poll: AgentPairingPoll;
+	}>;
+	/**
+	* The operator typed the code the HUB shows. From the agent's own machine that is enough; from
+	* anywhere else the one-time PIN of THIS pairing (read on the agent's console) must come with
+	* it. A wrong code counts against the pairing (the third cancels it); a wrong PIN counts against
+	* the agent (five lock confirming for five minutes).
+	*/
+	confirm(body: unknown, ctx: PairingRequestContext): PairingResult<object>;
+	reject(body: unknown, ctx: PairingRequestContext): PairingResult<object>;
+	/** The hub withdraws its own pairing (authorized by the pairing id it was given). */
+	cancel(body: unknown): PairingResult<object>;
+	complete(body: unknown): Promise<PairingResult<object>>;
+	/** The agent forgot its hub (local action): the pairing slate is clean. */
+	noteUnpaired(): void;
+	/** Remaining lock for a source, or `null`. Loopback never calls this. */
+	private sourceLock;
+	/** A wrong PIN or reset code from `source`: five in five minutes lock THAT source, doubling. */
+	private noteWrongSecret;
+	/**
+	* The operator clears the lockouts, the budget and every pending offer. From this machine
+	* (genuine loopback) or with the LOCAL RESET CODE printed at boot; the code is renewed on use.
+	*/
+	reset(body: unknown, ctx: PairingRequestContext): PairingResult<object>;
+	/** Verify the CA-key signature of an offer and spend its commitment. */
+	private checkOfferSignature;
+	/**
+	* All slots taken: a signed offer makes room by dropping the oldest pairing whose hub never showed
+	* activity (no reveal, no poll) and that no operator confirmed. `false` when there is none.
+	*/
+	private makeRoom;
+	/** Offers that never reached local confirmation are rationed - globally and per hub CA. */
+	private rationOffer;
+	/** A pairing ended without the local operator confirming it: it counts against the budget. */
+	private noteAbandoned;
+	/** The pairing this local request means, else the refusal. */
+	private localTarget;
+	private announceLocally;
+	private checkCompletion;
+	/** The live session `body.pairingId` names, else the refusal. */
+	private pending;
+	private expireIfDue;
+	private outcomeOf;
+	private rememberOutcome;
+	private end;
+}

package/dist/kernel/moleculer/mesh-mtls/pairing/hub-pairing.d.ts

@@ -0,0 +1,115 @@
+/**
+* The hub's side of pairing (D857): starts a pairing with an agent it found
+* (mDNS) or was given an address for, computes the same six digits the agent
+* shows, and signs the agent's certificate ONLY after the operator confirmed
+* them on the hub AND the agent's own operator confirmed them there.
+*
+* Either confirmation may come first. The hub learns the agent's by polling the
+* agent's pairing status (`advance`), never by being told: nothing the agent
+* says is trusted beyond "my operator confirmed", and even that only matters
+* together with the hub's own confirmation.
+*
+* Transport-agnostic: `AgentPairingTransport` is the HTTP client in production
+* and an in-memory shim (or a man in the middle) in specs.
+*/
+import { type MeshCaSigner } from "../mesh-ca.js";
+import type { AgentHello, AgentPairingPoll, OfferAnswer, OfferRequest } from "./agent-pairing.js";
+/** Where an agent's API is. */
+export interface AgentEndpoint {
+	readonly host: string;
+	readonly port: number;
+}
+/** A refusal the agent sent, kept with its machine-readable code. */
+export declare class PairingHttpError extends Error {
+	readonly status: number;
+	readonly code: string;
+	constructor(status: number, code: string, message: string);
+}
+/** The agent's pairing HTTP surface, as the hub calls it. Throws {@link PairingHttpError}. */
+export interface AgentPairingTransport {
+	hello(endpoint: AgentEndpoint): Promise<AgentHello>;
+	offer(endpoint: AgentEndpoint, body: OfferRequest): Promise<OfferAnswer>;
+	reveal(endpoint: AgentEndpoint, body: {
+		pairingId: string;
+		hubNonce: string;
+	}): Promise<void>;
+	/** Did the agent's operator confirm? Authorized by the pairing id. */
+	poll(endpoint: AgentEndpoint, pairingId: string): Promise<AgentPairingPoll>;
+	complete(endpoint: AgentEndpoint, body: {
+		pairingId: string;
+		leafPem: string;
+		caCertPem: string;
+		proof: string;
+	}): Promise<void>;
+	reject(endpoint: AgentEndpoint, pairingId: string): Promise<void>;
+}
+export type HubPairingState = "awaiting-confirmation" | "completing" | "paired" | "rejected" | "expired" | "failed";
+export interface HubPairingView {
+	readonly pairingId: string;
+	readonly nodeId: string;
+	readonly endpoint: AgentEndpoint;
+	/** The six digits the agent's page shows. The operator types them on the hub to confirm. */
+	readonly code: string;
+	readonly state: HubPairingState;
+	readonly hubConfirmed: boolean;
+	readonly agentConfirmed: boolean;
+	readonly expiresAt: number;
+	readonly failure: string | null;
+}
+export interface HubPairingDeps {
+	readonly transport: AgentPairingTransport;
+	/** The mesh CA, `null` while it is not ready. */
+	readonly ca: () => MeshCaSigner | null;
+	readonly hubNodeId: string;
+	readonly hubUrl: () => Promise<string>;
+	readonly hubMeshAddress: () => Promise<string>;
+	/** True when `nodeId` is connected to the mesh with a verified certificate. */
+	readonly isNodeConnected: (nodeId: string) => boolean;
+	/** Node ids the hub already knows (certificates issued, nodes seen), for the case-insensitive collision check. */
+	readonly knownNodeIds?: () => readonly string[];
+	/** Record a leaf this hub just issued (the certificate registry). */
+	readonly recordIssued: (nodeId: string, certPem: string) => Promise<void>;
+	/**
+	* Put the leaves of `nodeId` on the CRL: a node id is held by one device. With `keepCertPem`, every
+	* leaf EXCEPT that one - the previous leaves go only after the new pairing completed.
+	*/
+	readonly revokeNode: (nodeId: string, reason: string, keepCertPem?: string) => Promise<void>;
+	/** Revoke ONE leaf (it was never presented): used when the agent provably did not install it. */
+	/** True when the node's live mesh connection presents exactly this leaf (registry convergence). */
+	readonly isLeafPresented?: (nodeId: string, certPem: string) => boolean;
+	readonly revokeLeaf?: (nodeId: string, certPem: string, reason: string) => Promise<void>;
+	readonly now?: () => number;
+	readonly log?: (message: string, meta?: Record<string, unknown>) => void;
+}
+export declare class HubPairing {
+	private readonly deps;
+	private readonly sessions;
+	private readonly now;
+	constructor(deps: HubPairingDeps);
+	/** Offer the hub's CA to the agent at `endpoint` and derive the code. Throws an `Error` with the reason. */
+	begin(endpoint: AgentEndpoint): Promise<HubPairingView>;
+	/** The operator typed the code the AGENT shows. A wrong one counts; the third cancels the pairing. */
+	confirm(pairingId: string, code: string): Promise<HubPairingView>;
+	reject(pairingId: string): Promise<HubPairingView>;
+	get(pairingId: string): HubPairingView | undefined;
+	list(): readonly HubPairingView[];
+	/** Active pairings, for the poller. */
+	activeIds(): readonly string[];
+	/**
+	* Move a pairing on: notice an expiry, a cancellation or the agent's
+	* confirmation, and complete when both sides confirmed. Never throws.
+	*/
+	advance(pairingId: string): Promise<HubPairingView>;
+	private complete;
+	/** The new leaf is installed: older leaves of the node go, the new one stays. */
+	private installed;
+	/** After a failed completion call: did the agent install the certificate after all? */
+	private installOutcome;
+	private assertNodeIdUsable;
+	private expireIfDue;
+	private finish;
+	private cancel;
+	private require;
+	private remember;
+	private view;
+}

package/dist/kernel/moleculer/mesh-mtls/pairing/index.d.ts

@@ -0,0 +1,3 @@
+export { AgentPairing, hubHostFromMeshAddress, type AgentHello, type AgentPairingDeps, type AgentPairingLocalView, type AgentPairingPoll, type AgentPairingPublicView, type LocalPairingSecret, type PairingRequestContext, type PendingPairingPublic, type InstalledPairing, type OfferAnswer, type OfferRequest, type PairingFailure, type PairingOutcome, type PairingResult } from "./agent-pairing.js";
+export { HubPairing, PairingHttpError, type AgentEndpoint, type AgentPairingTransport, type HubPairingDeps, type HubPairingState, type HubPairingView } from "./hub-pairing.js";
+export { computePairingCommitment, computePairingSas, describeCsr, keyFingerprintShort, PAIRING_CODE_DIGITS, isValidAgentNodeId, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PIN_DIGITS, PAIRING_PATHS, PAIRING_PROTOCOL, PAIRING_TTL_MS, signPairingProof, verifyPairingProof, type AgentPairingState, type DescribedCsr, type PairingProofClaims, type PairingSasInput } from "./pairing-protocol.js";

package/dist/kernel/moleculer/mesh-mtls/pairing/pairing-protocol.d.ts

@@ -0,0 +1,107 @@
+import { isValidAgentNodeId } from "../mesh-ca.js";
+export { isValidAgentNodeId };
+export declare const PAIRING_PROTOCOL: 1;
+export declare const PAIRING_DOMAIN = "camstack-pairing/v1";
+export declare const PAIRING_PROOF_TYP = "camstack-pairing-complete+jwt";
+export declare const PAIRING_PROOF_USE = "pairing-complete";
+export declare const PAIRING_OFFER_TYP = "camstack-pairing-offer+jwt";
+export declare const PAIRING_OFFER_USE = "pairing-offer";
+/** An offer signature older than this (or from further ahead than 60 s) is refused. */
+export declare const PAIRING_OFFER_MAX_AGE_MS: number;
+/** A pairing that is not confirmed on both sides within this window is cancelled on both. */
+export declare const PAIRING_TTL_MS: number;
+/** Wrong codes typed before the pairing is cancelled. */
+export declare const PAIRING_MAX_CODE_ATTEMPTS = 3;
+export declare const PAIRING_CODE_DIGITS = 6;
+/** Pending pairings an agent holds at once, one per hub CA (offer squatting, D857). */
+export declare const PAIRING_MAX_SESSIONS = 4;
+/** The local PIN: single use, shown only on the agent's own machine. */
+export declare const PAIRING_PIN_DIGITS = 8;
+/** A pairing proof is valid this long from `iat`, never longer. */
+export declare const PAIRING_PROOF_MAX_LIFETIME_MS: number;
+/** Agent endpoints, all under the agent API (`:4444`). */
+export declare const PAIRING_PATHS: {
+	readonly hello: "/api/agent/pairing/hello";
+	readonly offer: "/api/agent/pairing/offer";
+	readonly reveal: "/api/agent/pairing/reveal";
+	/** Public: who asks to pair - never a code, a pairing id or a PIN. */
+	readonly status: "/api/agent/pairing/status";
+	/** The hub's poll, authorized by the pairing id: did the agent's operator confirm? */
+	readonly poll: "/api/agent/pairing/poll";
+	readonly complete: "/api/agent/pairing/complete";
+	/** The agent's operator: the hub's code + the local PIN (or genuine loopback). */
+	readonly confirm: "/api/agent/pairing/confirm";
+	readonly reject: "/api/agent/pairing/reject";
+	/** The hub withdraws its pairing, authorized by the pairing id. */
+	readonly cancel: "/api/agent/pairing/cancel";
+	/** The agent's operator clears lockouts and pending offers (loopback, or the local reset code). */
+	readonly reset: "/api/agent/pairing/reset";
+	readonly forget: "/api/agent/pairing/forget";
+};
+export type AgentPairingState = "unpaired" | "pending" | "paired";
+/** A fresh single-use local PIN: digits only, uniformly random. */
+export declare function randomPin(): string;
+export declare function randomHex(bytes: number): string;
+export declare function newPairingId(): string;
+/** The hub's commitment to its nonce, bound to the CA certificate it offers. */
+export declare function computePairingCommitment(caCertPem: string, hubNonce: string): string;
+export declare function commitmentsEqual(expected: string, presented: unknown): boolean;
+export interface PairingSasInput {
+	readonly caCertPem: string;
+	/** SPKI DER of the agent's mesh public key, base64. */
+	readonly agentPublicKeySpki: string;
+	readonly hubNonce: string;
+	readonly agentNonce: string;
+}
+/** The six digits both screens show. */
+export declare function computePairingSas(input: PairingSasInput): string;
+export declare function constantTimeEqual(expected: string, presented: unknown): boolean;
+/** What the hub learns from an agent's CSR, after checking the CSR's own signature. */
+export interface DescribedCsr {
+	readonly commonName: string;
+	/** SPKI DER, base64 — what the SAS binds. */
+	readonly publicKeySpki: string;
+}
+export declare function describeCsr(csrPem: string): Promise<DescribedCsr>;
+/** The transcript the CA signs when the hub completes a pairing. */
+export interface PairingProofClaims {
+	readonly v: typeof PAIRING_PROTOCOL;
+	readonly use: typeof PAIRING_PROOF_USE;
+	readonly pairingId: string;
+	readonly nodeId: string;
+	readonly hubNonce: string;
+	readonly agentNonce: string;
+	/** SHA-256 hex of the leaf DER. */
+	readonly leafFingerprint: string;
+	readonly caFingerprint: string;
+	readonly hubMeshAddress: string;
+	readonly hubUrl: string;
+	/** Epoch ms. */
+	readonly iat: number;
+	/** Epoch ms; at most {@link PAIRING_PROOF_MAX_LIFETIME_MS} after `iat`. */
+	readonly exp: number;
+}
+export declare function leafFingerprintCompact(certPem: string): string;
+export declare function signPairingProof(caKeyPem: string, claims: PairingProofClaims): string;
+/**
+* The claims of `proof` when it was signed by `caCertPem`'s key, else `null`.
+* Shape, expiry and the binding to a session are the caller's to check.
+*/
+export declare function verifyPairingProof(caCertPem: string, proof: string): PairingProofClaims | null;
+/** A short public fingerprint of a public key, for the mDNS TXT record. */
+export declare function keyFingerprintShort(publicKeySpkiB64: string): string;
+/** What a hub signs with its CA key to make an offer: nobody holding only the public CA can. */
+export interface PairingOfferClaims {
+	readonly use: typeof PAIRING_OFFER_USE;
+	/** The agent the offer is for - an offer cannot be replayed to another agent. */
+	readonly agentNodeId: string;
+	readonly hubNodeId: string;
+	readonly caFingerprint: string;
+	readonly commitment: string;
+	readonly hubUrl: string;
+	readonly hubMeshAddress: string;
+	readonly iat: number;
+}
+export declare function signPairingOffer(caKeyPem: string, claims: PairingOfferClaims): string;
+/** The claims of `token` when `caCertPem`'s key signed it as a pairing offer, else `null`. */
+export declare function verifyPairingOffer(caCertPem: string, token: string): PairingOfferClaims | null;

package/dist/kernel/moleculer/mesh-mtls/tls-tcp-transporter.d.ts

@@ -113,6 +113,12 @@ export interface FilteredGossip {
 * remove the payload is returned unchanged.
 */
 export declare function keepOnlyGossipNodes(payload: unknown, keep: ReadonlySet<string>): FilteredGossip;
+/** A mesh peer whose certificate identity was verified at the handshake (D857). */
+export interface VerifiedMeshPeer {
+	/** The leaf CN, which is the node id. */
+	readonly nodeId: string;
+	readonly serial: string;
+}
 /** What a peer's leaf looks like, recorded at handshake. */
 interface PeerLeaf {
 	readonly serial: string;
@@ -177,6 +183,18 @@ export declare class TlsTcpTransporter extends TcpTransporterBase {
 	*/
 	peerTransport(nodeId: string): "tls" | "clear";
 	/**
+	* The certificate identity of `nodeId` (D857): its mutual-TLS handshake chained to the
+	* mesh CA this transporter was built with, its leaf CN is `nodeId`, and the leaf is not
+	* revoked now. This is the ONLY proof of "who is calling" the mesh gates accept:
+	* every inbound packet on a TLS socket is dropped unless its `sender` equals the leaf CN
+	* (see `onIncomingMessage`), so a node id in a delivered packet that is verified here was
+	* claimed by the holder of that node's private key.
+	*
+	* `undefined` for a node that reached us over clear text, never completed a handshake,
+	* or whose serial is on the CRL.
+	*/
+	verifiedPeer(nodeId: string): VerifiedMeshPeer | undefined;
+	/**
 	* The node disconnected: its next connection decides its transport again —
 	* unless it already re-handshook (the disconnect can be noticed after the
 	* restarted node is back), in which case its live TLS socket keeps it `tls`.

package/dist/{lib-B_R6sPC3.mjs → lib-BeGzVQcd.mjs}

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, r as __exportAll, t as __commonJSMin } from "./chunk-CNf5ZN-e.mjs";
-import { h as tslib_es6_exports, m as init_tslib_es6 } from "./x509.es-CAjSsrkk.mjs";
+import { h as tslib_es6_exports, m as init_tslib_es6 } from "./x509.es-CDvj67p1.mjs";
 import { t as require_src } from "./src-hG4grMU4.mjs";
 //#region ../../node_modules/source-map/lib/base64.js
 var require_base64 = /* @__PURE__ */ __commonJSMin(((exports) => {

package/dist/{lib-DOJ5yyWA.js → lib-NNxHSOIE.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_x509_es = require("./x509.es-Dzl0BbmG.js");
+const require_x509_es = require("./x509.es-r7Ht1thA.js");
 const require_src$1 = require("./src-CnAqG6EF.js");
 //#region ../../node_modules/source-map/lib/base64.js
 var require_base64 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports) => {

package/dist/{restore-archive-Bh34W8J8.mjs → restore-archive-5ml7uYMf.mjs}

@@ -1,4 +1,4 @@
-import { g as DATABASE_SNAPSHOT_SUFFIX } from "./dist-Bt8GTRHB.mjs";
+import { v as DATABASE_SNAPSHOT_SUFFIX } from "./dist-CYcBqnXk.mjs";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/{restore-archive-DhHH7VQp.js → restore-archive-Do0QwAik.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BCKOeWu_.js");
+const require_dist = require("./dist-CCH3XPqO.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/{retired-settings-keys-u3Wwkdrq.js → retired-settings-keys-CEiCaI_j.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BCKOeWu_.js");
+const require_dist = require("./dist-CCH3XPqO.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-CmcEitC2.mjs → retired-settings-keys-CyDdyjLP.mjs}

@@ -1,4 +1,4 @@
-import { Dr as asJsonObject } from "./dist-Bt8GTRHB.mjs";
+import { Ar as asJsonObject } from "./dist-CYcBqnXk.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/tls/agent-https-names.d.ts

@@ -17,6 +17,8 @@ export declare class AgentHttpsNames {
 	private readonly byNode;
 	constructor(store: SettingsStoreClient);
 	load(): Promise<void>;
+	/** The names certified to `nodeId` (its id and the address of its live mesh socket), or `null`. */
+	namesOf(nodeId: string): readonly string[] | null;
 	/** Every name certified to a node other than `nodeId`. */
 	takenByOthers(nodeId: string): ReadonlySet<string>;
 	/** Free every name certified to a node that was forgotten. */

package/dist/tls/cert-backdate.d.ts

@@ -0,0 +1,10 @@
+/**
+* How far a freshly issued certificate's `notBefore` is moved into the past.
+*
+* TLS refuses a certificate whose `notBefore` is in the verifier's future, and X.509 dates have
+* one-second resolution, so a certificate dated "now" fails the handshake on any peer whose clock
+* runs even slightly behind the issuer's. Expiry is always computed from the real `now`; only the
+* start of validity moves.
+*/
+export declare const CERT_NOT_BEFORE_BACKDATE_MS: number;
+export declare function backdatedNotBefore(now: Date): Date;

package/dist/tls/cert-issue.d.ts

@@ -1,23 +1,3 @@
-/**
-* Certificate issuance. Isolated so `cert-manager.ts` reads as policy and
-* this file reads as mechanics.
-*
-* **In-process, by decision (D551).** This used to shell out to `openssl`
-* three times. The hub's own TLS identity is not allowed to be a function
-* of which openssl happens to sit on the host: this fleet alone runs four
-* of them, and one — Ubuntu 20.04's 1.1.1f — silently ADDED the ambient
-* `/etc/ssl/openssl.cnf` `[req] x509_extensions = v3_ca` block on top of
-* our `-addext` flags, producing a root with two `basicConstraints` and
-* two `subjectKeyIdentifier` extensions. RFC 5280 §4.2 allows each at
-* most once, so OpenSSL 3 (which is what `node:crypto` is) marked that
-* root invalid: `X509Certificate.ca` read `false` on our own CA and
-* `checkIssued()` refused the pair. Under D227 that means "not issued by
-* the local CA", i.e. rotate the root — on every boot, forever, voiding
-* every trust an operator had granted by hand.
-*
-* Keys come from WebCrypto (`node:crypto`'s own implementation) and the
-* DER is assembled by `@peculiar/x509`. Nothing here reads the host.
-*/
 import type { webcrypto as WebCrypto } from "node:crypto";
 import { X509Certificate as PeculiarCertificate } from "@peculiar/x509";
 import type { CertIdentity } from "./cert-identity.js";

package/dist/{x509.es-CAjSsrkk.mjs → x509.es-CDvj67p1.mjs}

@@ -1,4 +1,17 @@
 import { n as __esmMin, r as __exportAll, t as __commonJSMin } from "./chunk-CNf5ZN-e.mjs";
+//#region src/tls/cert-backdate.ts
+/**
+* How far a freshly issued certificate's `notBefore` is moved into the past.
+*
+* TLS refuses a certificate whose `notBefore` is in the verifier's future, and X.509 dates have
+* one-second resolution, so a certificate dated "now" fails the handshake on any peer whose clock
+* runs even slightly behind the issuer's. Expiry is always computed from the real `now`; only the
+* start of validity moves.
+*/
+var CERT_NOT_BEFORE_BACKDATE_MS = 5 * 6e4;
+function backdatedNotBefore(now) {
+	return /* @__PURE__ */ new Date(now.getTime() - CERT_NOT_BEFORE_BACKDATE_MS);
+}
 /*! *****************************************************************************
 Copyright (C) Microsoft. All rights reserved.
 Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -11900,4 +11913,4 @@ AsnEcSignatureFormatter.namedCurveSize.set("K-256", 32);
 AsnEcSignatureFormatter.namedCurveSize.set("P-384", 48);
 AsnEcSignatureFormatter.namedCurveSize.set("P-521", 66);
 //#endregion
-export { KeyUsagesExtension as a, Pkcs10CertificateRequestGenerator as c, X509Certificate as d, X509CertificateGenerator as f, tslib_es6_exports as h, KeyUsageFlags as i, SubjectAlternativeNameExtension as l, init_tslib_es6 as m, BasicConstraintsExtension as n, PemConverter as o, cryptoProvider as p, ExtendedKeyUsageExtension as r, Pkcs10CertificateRequest as s, AuthorityKeyIdentifierExtension as t, SubjectKeyIdentifierExtension as u };
+export { KeyUsagesExtension as a, Pkcs10CertificateRequestGenerator as c, X509Certificate as d, X509CertificateGenerator as f, backdatedNotBefore as g, tslib_es6_exports as h, KeyUsageFlags as i, SubjectAlternativeNameExtension as l, init_tslib_es6 as m, BasicConstraintsExtension as n, PemConverter as o, cryptoProvider as p, ExtendedKeyUsageExtension as r, Pkcs10CertificateRequest as s, AuthorityKeyIdentifierExtension as t, SubjectKeyIdentifierExtension as u };

package/dist/{x509.es-Dzl0BbmG.js → x509.es-r7Ht1thA.js}

@@ -1,4 +1,17 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
+//#region src/tls/cert-backdate.ts
+/**
+* How far a freshly issued certificate's `notBefore` is moved into the past.
+*
+* TLS refuses a certificate whose `notBefore` is in the verifier's future, and X.509 dates have
+* one-second resolution, so a certificate dated "now" fails the handshake on any peer whose clock
+* runs even slightly behind the issuer's. Expiry is always computed from the real `now`; only the
+* start of validity moves.
+*/
+var CERT_NOT_BEFORE_BACKDATE_MS = 5 * 6e4;
+function backdatedNotBefore(now) {
+	return /* @__PURE__ */ new Date(now.getTime() - CERT_NOT_BEFORE_BACKDATE_MS);
+}
 /*! *****************************************************************************
 Copyright (C) Microsoft. All rights reserved.
 Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -11972,6 +11985,12 @@ Object.defineProperty(exports, "X509CertificateGenerator", {
 		return X509CertificateGenerator;
 	}
 });
+Object.defineProperty(exports, "backdatedNotBefore", {
+	enumerable: true,
+	get: function() {
+		return backdatedNotBefore;
+	}
+});
 Object.defineProperty(exports, "cryptoProvider", {
 	enumerable: true,
 	get: function() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.432",
+  "version": "1.2.434",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",