@camstack/system 1.2.444 → 1.2.445

package/dist/builtins/system-config/system-config.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D1vECb_6.js");
+const require_dist = require("../../dist-DgOG8flk.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_x509_es = require("../../x509.es-C4cOo48M.js");
-const require_agent_https = require("../../agent-https-DlpTMDqA.js");
-const require_constants$8 = require("../../constants-BXiNEIeV.js");
+const require_constants$8 = require("../../constants-Br879Axi.js");
+const require_agent_https = require("../../agent-https-CiOW0-sj.js");
 const require_src$1 = require("../../src-CnAqG6EF.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -298,161 +298,8 @@ function parsePayload(value) {
 	};
 }
 //#endregion
-//#region src/kernel/moleculer/mesh-mtls/mesh-ca.ts
-/**
-* Hub mesh CA — EC P-256, key in the keychain, cert in `cluster.meshCa`.
-*
-* Distinct from the HTTPS local CA (`tls/cert-issue.ts`, RSA): the mesh CA
-* signs node leaves (CN = nodeID) and unlock-ticket JWS (ES256). Issuance uses
-* `@peculiar/x509` over WebCrypto — same library the HTTPS path already uses
-* (installed `1.14.3`; registry latest at adoption time was `2.1.0` — stay on
-* the pinned range already shipping).
-*/
-require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
-var MS_PER_DAY = 864e5;
-/** Key generation — EC P-256 (plan). WebCrypto DOM names are not in @types/node. */
-var MESH_KEY_ALGORITHM = {
-	name: "ECDSA",
-	namedCurve: "P-256"
-};
-/** Signing — ECDSA with SHA-256. */
-var MESH_SIGNING_ALGORITHM = {
-	name: "ECDSA",
-	hash: "SHA-256"
-};
-/** A node id: letters, digits, `.`, `_`, `-`; at most 63 characters; starts with a letter or digit. */
-var NODE_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,62}$/i;
-/** Ids no agent may take: the hub's own, whatever the case (D857). */
-var RESERVED_NODE_IDS = new Set(["hub"]);
-/** True for an id an agent may carry: the pattern, and not a reserved name. */
-function isValidAgentNodeId(nodeId) {
-	return NODE_ID_PATTERN.test(nodeId) && !RESERVED_NODE_IDS.has(nodeId.toLowerCase());
-}
-function freshSerial() {
-	return `00${(0, node_crypto.randomBytes)(16).toString("hex")}`;
-}
-function toPkcs8Pem(pkcs8) {
-	return `${require_x509_es.PemConverter.encode(pkcs8, "PRIVATE KEY")}\n`;
-}
-function toCertPem(cert) {
-	return `${cert.toString("pem")}\n`;
-}
-async function exportKeyPem(key) {
-	return toPkcs8Pem(await node_crypto.webcrypto.subtle.exportKey("pkcs8", key));
-}
-/** SHA-256 fingerprint of the DER cert, colon-hex uppercase (Node style). */
-function caFingerprint(certPem) {
-	return new node_crypto.X509Certificate(certPem).fingerprint256;
-}
-/** Compact fingerprint (lowercase hex, no colons). */
-function caFingerprintCompact(certPem) {
-	return (0, node_crypto.createHash)("sha256").update(new node_crypto.X509Certificate(certPem).raw).digest("hex");
-}
-async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
-	const keys = await node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
-	const extensions = [
-		new require_x509_es.BasicConstraintsExtension(true, 0, true),
-		new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.keyCertSign | require_x509_es.KeyUsageFlags.cRLSign, true),
-		await require_x509_es.SubjectKeyIdentifierExtension.create(keys.publicKey)
-	];
-	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
-		serialNumber: freshSerial(),
-		name: `CN=${require_constants$8.MESH_CA_COMMON_NAME}`,
-		notBefore: require_x509_es.backdatedNotBefore(now),
-		notAfter: new Date(now.getTime() + require_constants$8.MESH_CA_VALIDITY_DAYS * MS_PER_DAY),
-		keys,
-		signingAlgorithm: MESH_SIGNING_ALGORITHM,
-		extensions
-	});
-	return {
-		certPem: toCertPem(cert),
-		keyPem: await exportKeyPem(keys.privateKey),
-		cert,
-		privateKey: keys.privateKey,
-		publicKey: keys.publicKey
-	};
-}
-async function loadMeshCa(certPem, keyPem) {
-	const cert = new require_x509_es.X509Certificate(certPem);
-	return {
-		certPem,
-		keyPem,
-		cert,
-		privateKey: await node_crypto.webcrypto.subtle.importKey("pkcs8", require_x509_es.PemConverter.decodeFirst(keyPem), MESH_KEY_ALGORITHM, true, ["sign"]),
-		publicKey: await cert.publicKey.export(node_crypto.webcrypto)
-	};
-}
-/**
-* Issue a leaf from a CSR. CN must be present; when `expectedNodeId` is set
-* it must match. Validity: 30 days.
-*/
-async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
-	const csr = new require_x509_es.Pkcs10CertificateRequest(csrPem);
-	if (!await csr.verify(node_crypto.webcrypto)) throw new Error("CSR signature is invalid");
-	const cn = subjectCn(csr.subject);
-	if (cn === null || cn.length === 0) throw new Error("CSR subject has no CN");
-	if (opts.allowReserved !== true && !isValidAgentNodeId(cn)) throw new Error(`CSR CN '${cn}' is not an id an agent may carry`);
-	if (opts.expectedNodeId !== void 0 && opts.expectedNodeId !== cn) throw new Error(`CSR CN '${cn}' does not match the token nodeId '${opts.expectedNodeId}'`);
-	const now = opts.now ?? /* @__PURE__ */ new Date();
-	const validDays = opts.validDays ?? 30;
-	const serialNumber = freshSerial();
-	const notAfter = new Date(now.getTime() + validDays * MS_PER_DAY);
-	const extensions = [
-		new require_x509_es.BasicConstraintsExtension(false, void 0, true),
-		new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.digitalSignature, true),
-		new require_x509_es.ExtendedKeyUsageExtension([require_constants$8.SERVER_AUTH_OID, require_constants$8.CLIENT_AUTH_OID]),
-		await require_x509_es.SubjectKeyIdentifierExtension.create(csr.publicKey),
-		await require_x509_es.AuthorityKeyIdentifierExtension.create(ca.cert)
-	];
-	return {
-		certPem: toCertPem(await require_x509_es.X509CertificateGenerator.create({
-			serialNumber,
-			subject: `CN=${cn}`,
-			issuer: ca.cert.subject,
-			notBefore: require_x509_es.backdatedNotBefore(now),
-			notAfter,
-			publicKey: csr.publicKey,
-			signingKey: ca.privateKey,
-			signingAlgorithm: MESH_SIGNING_ALGORITHM,
-			extensions
-		})),
-		serialNumber,
-		notAfter,
-		commonName: cn
-	};
-}
-/** Issue a leaf for a known nodeID with a freshly generated key pair (tests / hub self). */
-async function issueMeshLeafForNode(ca, nodeId, opts = {}) {
-	const keys = await node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
-	return {
-		...await issueMeshLeafFromCsr(ca, await createMeshCsrPem(keys, nodeId), {
-			expectedNodeId: nodeId,
-			now: opts.now,
-			validDays: opts.validDays,
-			allowReserved: true
-		}),
-		keyPem: await exportKeyPem(keys.privateKey)
-	};
-}
-function subjectCn(subject) {
-	return /(?:^|,)\s*CN\s*=\s*([^,]+)/i.exec(subject)?.[1]?.trim() ?? null;
-}
-async function createMeshCsrPem(keys, commonName) {
-	return `${(await require_x509_es.Pkcs10CertificateRequestGenerator.create({
-		name: `CN=${commonName}`,
-		keys,
-		signingAlgorithm: MESH_SIGNING_ALGORITHM
-	})).toString("pem")}\n`;
-}
-async function generateMeshKeyPair() {
-	return node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
-}
-async function exportMeshPrivateKeyPem(key) {
-	return exportKeyPem(key);
-}
-//#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-ca-keeper.ts
-var SLOT$3 = Symbol.for("camstack.mesh.ca");
+var SLOT$2 = Symbol.for("camstack.mesh.ca");
 var NOT_LOADED = {
 	state: "unavailable",
 	reason: "not-loaded"
@@ -464,10 +311,10 @@ function isState(value) {
 	return state === "unavailable" && typeof Reflect.get(value, "reason") === "string";
 }
 function setProcessMeshCa(state) {
-	Reflect.set(globalThis, SLOT$3, state);
+	Reflect.set(globalThis, SLOT$2, state);
 }
 function getProcessMeshCaState() {
-	const value = Reflect.get(globalThis, SLOT$3);
+	const value = Reflect.get(globalThis, SLOT$2);
 	return isState(value) ? value : NOT_LOADED;
 }
 function requireProcessMeshCa() {
@@ -573,7 +420,7 @@ async function loadOrGenerateMeshCa(deps) {
 			try {
 				return {
 					state: "ready",
-					ca: await loadMeshCa(certPem, entry.value)
+					ca: await require_agent_https.loadMeshCa(certPem, entry.value)
 				};
 			} catch (err) {
 				return {
@@ -583,12 +430,12 @@ async function loadOrGenerateMeshCa(deps) {
 			}
 		}
 		case "missing": try {
-			const generated = await generateMeshCa();
+			const generated = await require_agent_https.generateMeshCa();
 			await deps.secrets.put(require_constants$8.MESH_CA_KEY_REF, generated.keyPem);
 			await deps.writeMeshCaCert(generated.certPem);
 			return {
 				state: "ready",
-				ca: await loadMeshCa(generated.certPem, generated.keyPem)
+				ca: await require_agent_https.loadMeshCa(generated.certPem, generated.keyPem)
 			};
 		} catch (err) {
 			return {
@@ -609,10 +456,10 @@ async function loadOrGenerateMeshCa(deps) {
 var MeshCrl = class {
 	serials = /* @__PURE__ */ new Set();
 	revoke(serialNumber) {
-		this.serials.add(normalizeSerial$1(serialNumber));
+		this.serials.add(normalizeSerial(serialNumber));
 	}
 	isRevoked(serialNumber) {
-		return this.serials.has(normalizeSerial$1(serialNumber));
+		return this.serials.has(normalizeSerial(serialNumber));
 	}
 	list() {
 		return [...this.serials];
@@ -620,424 +467,21 @@ var MeshCrl = class {
 	/** Restore from persisted serials (system-settings). */
 	replaceAll(serials) {
 		this.serials.clear();
-		for (const s of serials) this.serials.add(normalizeSerial$1(s));
+		for (const s of serials) this.serials.add(normalizeSerial(s));
 	}
 };
-function normalizeSerial$1(serial) {
+function normalizeSerial(serial) {
 	return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
 }
-var SLOT$2 = Symbol.for("camstack.mesh.crl");
+var SLOT$1 = Symbol.for("camstack.mesh.crl");
 function processMeshCrl() {
-	const existing = Reflect.get(globalThis, SLOT$2);
+	const existing = Reflect.get(globalThis, SLOT$1);
 	if (existing instanceof MeshCrl) return existing;
 	const crl = new MeshCrl();
-	Reflect.set(globalThis, SLOT$2, crl);
+	Reflect.set(globalThis, SLOT$1, crl);
 	return crl;
 }
 //#endregion
-//#region src/kernel/moleculer/mesh-mtls/mesh-certificate-registry.ts
-/**
-* The hub's record of every mesh leaf (D856): which certificate each node holds,
-* when it expires, and which serials are revoked.
-*
-* Three ways a row appears:
-*  - `enroll` / `renewal` / `boot` - the hub issued it and wrote it down at the
-*    moment of issuing (the authoritative record);
-*  - `observed` - a node enrolled before this record existed (or by a path that
-*    did not write it) presented this leaf on its LIVE mutual-TLS connection.
-*
-* Revoked serials are persisted here and replayed into the in-memory CRL at boot,
-* so a revocation survives a hub restart. Hub only: agents persist none of it.
-*/
-/**
-* @durable class=config owner=system-config
-*   write="the hub records every mesh leaf it issues (enroll, renewal, boot) and every
-*     leaf a connected node is observed presenting; a revocation stamps revokedAt"
-*   retention="a revoked or expired row is kept 90 days past its end, then reaped; a
-*     live row is never deleted. Forgetting a node does not delete its rows."
-*/
-var MESH_NODE_CERTIFICATES_COLLECTION = "mesh_node_certificates";
-var MESH_NODE_CERTIFICATES_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "nodeId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "serial",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "fingerprint",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "notBefore",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "notAfter",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "issuedAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "issuedVia",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "revokedAt",
-		type: "INTEGER"
-	},
-	{
-		name: "revokedReason",
-		type: "TEXT"
-	}
-];
-var RETENTION_MS = 90 * 864e5;
-/**
-* A leaf the hub signed for a renewal that did not complete. It must not be the node's
-* `current` leaf, but it is NOT on the CRL: the node may still hold it (the swap
-* could have landed without the hub seeing it), and cutting it off would be the
-* outage the hand-over exists to prevent. If the node is later seen presenting it, it
-* is reinstated.
-*/
-var RENEWAL_ABANDONED = "renewal-abandoned";
-var VIAS = [
-	"enroll",
-	"pairing",
-	"renewal",
-	"boot",
-	"observed"
-];
-/** CN, serial, fingerprint and validity of a leaf PEM (or DER). */
-function describeMeshLeaf(cert) {
-	const x509 = new node_crypto.X509Certificate(cert);
-	return {
-		cn: subjectCn(x509.subject) ?? "",
-		serial: x509.serialNumber,
-		fingerprint: x509.fingerprint256,
-		notBefore: Date.parse(x509.validFrom),
-		notAfter: Date.parse(x509.validTo)
-	};
-}
-function normalizeSerial(serial) {
-	return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
-}
-function parse$1(data) {
-	const str = (k) => {
-		const v = data[k];
-		return typeof v === "string" && v.length > 0 ? v : null;
-	};
-	const num = (k) => {
-		const v = data[k];
-		return typeof v === "number" && Number.isFinite(v) ? v : null;
-	};
-	const nodeId = str("nodeId");
-	const serial = str("serial");
-	const fingerprint = str("fingerprint");
-	const notBefore = num("notBefore");
-	const notAfter = num("notAfter");
-	const issuedAt = num("issuedAt");
-	if (nodeId === null || serial === null || fingerprint === null || notBefore === null || notAfter === null || issuedAt === null) return null;
-	return {
-		nodeId,
-		serial,
-		fingerprint,
-		notBefore,
-		notAfter,
-		issuedAt,
-		issuedVia: VIAS.find((v) => v === data["issuedVia"]) ?? "observed",
-		revokedAt: num("revokedAt"),
-		revokedReason: str("revokedReason")
-	};
-}
-var MeshCertificateRegistry = class {
-	store;
-	deps;
-	rows = /* @__PURE__ */ new Map();
-	constructor(store, deps = {}) {
-		this.store = store;
-		this.deps = deps;
-	}
-	now() {
-		return (this.deps.now ?? Date.now)();
-	}
-	async load() {
-		const rows = await this.store.query.query({ collection: MESH_NODE_CERTIFICATES_COLLECTION });
-		for (const row of rows) {
-			const record = parse$1(row.data);
-			if (record !== null) this.rows.set(record.fingerprint, record);
-		}
-	}
-	/** Write down a leaf the hub just issued. Idempotent per fingerprint. */
-	async recordIssued(nodeId, certPem, via) {
-		const leaf = describeMeshLeaf(certPem);
-		const existing = this.rows.get(leaf.fingerprint);
-		if (existing !== void 0) return existing;
-		const record = {
-			nodeId,
-			serial: leaf.serial,
-			fingerprint: leaf.fingerprint,
-			notBefore: leaf.notBefore,
-			notAfter: leaf.notAfter,
-			issuedAt: this.now(),
-			issuedVia: via,
-			revokedAt: null,
-			revokedReason: null
-		};
-		await this.insert(record);
-		this.deps.logger?.info("Mesh certificate recorded", {
-			tags: { nodeId },
-			meta: {
-				via,
-				serial: leaf.serial,
-				notAfter: new Date(leaf.notAfter).toISOString()
-			}
-		});
-		return record;
-	}
-	/**
-	* A node was seen presenting `leaf` on its live connection. A leaf the hub already
-	* knows is left alone; an unknown one is recorded `observed` (a node enrolled
-	* before this record existed).
-	*/
-	async recordObserved(nodeId, leaf) {
-		const known = this.rows.get(leaf.fingerprint);
-		if (known !== void 0) {
-			if (known.revokedReason !== "renewal-abandoned") return known.revokedAt === null ? this.abandonRenewalsNewerThan(known) : false;
-			const reinstated = {
-				...known,
-				revokedAt: null,
-				revokedReason: null
-			};
-			this.rows.set(known.fingerprint, reinstated);
-			await this.persist(reinstated);
-			this.deps.logger?.warn("An abandoned renewal leaf is in use - reinstated", {
-				tags: { nodeId },
-				meta: { serial: known.serial }
-			});
-			return true;
-		}
-		const record = {
-			nodeId,
-			serial: leaf.serial,
-			fingerprint: leaf.fingerprint,
-			notBefore: leaf.notBefore,
-			notAfter: leaf.notAfter,
-			issuedAt: this.now(),
-			issuedVia: "observed",
-			revokedAt: null,
-			revokedReason: null
-		};
-		await this.insert(record);
-		this.deps.logger?.info("Mesh certificate observed on a live connection and recorded", {
-			tags: { nodeId },
-			meta: {
-				serial: leaf.serial,
-				fingerprint: leaf.fingerprint
-			}
-		});
-		return true;
-	}
-	list(nodeId) {
-		return [...this.rows.values()].filter((r) => nodeId === void 0 || r.nodeId === nodeId).toSorted((a, b) => b.issuedAt - a.issuedAt);
-	}
-	/** The newest non-revoked leaf of a node, or `undefined`. */
-	currentFor(nodeId) {
-		return this.list(nodeId).find((r) => r.revokedAt === null);
-	}
-	/** Every non-revoked leaf of a node (a renewal in flight has two). */
-	liveFor(nodeId) {
-		return this.list(nodeId).filter((r) => r.revokedAt === null);
-	}
-	/** Stamp a leaf revoked (and mirror it into `crl`). `false` when unknown or already revoked. */
-	async revoke(fingerprint, reason, crl) {
-		const record = this.rows.get(fingerprint);
-		if (record === void 0 || record.revokedAt !== null) return false;
-		const revoked = {
-			...record,
-			revokedAt: this.now(),
-			revokedReason: reason
-		};
-		this.rows.set(fingerprint, revoked);
-		crl?.revoke(record.serial);
-		await this.persist(revoked);
-		this.deps.logger?.warn("Mesh certificate revoked", {
-			tags: { nodeId: record.nodeId },
-			meta: {
-				serial: record.serial,
-				reason
-			}
-		});
-		return true;
-	}
-	/**
-	* Operator revocation of a whole node: EVERY leaf of the node that is not already on the
-	* CRL goes on it - the current one, an observed one, a renewal one, and a leaf that was set
-	* aside (`renewal-abandoned`: a copy of it may sit on a stolen box, and it must not stay
-	* valid just because the hub once set it aside). Returns the serials put on the CRL.
-	* A leaf revoked this way is never reinstated by `recordObserved`.
-	*/
-	async revokeAllForNode(nodeId, reason, crl, keepFingerprint) {
-		const serials = [];
-		for (const record of this.list(nodeId)) {
-			if (keepFingerprint !== void 0 && record.fingerprint === keepFingerprint) continue;
-			if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned") continue;
-			const revoked = {
-				...record,
-				revokedAt: record.revokedAt ?? this.now(),
-				revokedReason: reason
-			};
-			this.rows.set(record.fingerprint, revoked);
-			crl.revoke(record.serial);
-			await this.persist(revoked);
-			serials.push(record.serial);
-		}
-		if (serials.length > 0) this.deps.logger?.warn("Every mesh certificate of the node revoked", {
-			tags: { nodeId },
-			meta: {
-				serials,
-				reason
-			}
-		});
-		return serials;
-	}
-	/**
-	* At boot: a node with TWO live leaves had a renewal in flight when the hub stopped. The
-	* newer (renewal) one is set aside - it is not the node's current leaf until the node is
-	* seen presenting it, which reinstates it. It is NOT put on the CRL.
-	*/
-	async settleInterruptedRenewals() {
-		let settled = 0;
-		const byNode = /* @__PURE__ */ new Map();
-		for (const record of this.rows.values()) {
-			if (record.revokedAt !== null) continue;
-			byNode.set(record.nodeId, [...byNode.get(record.nodeId) ?? [], record]);
-		}
-		for (const records of byNode.values()) {
-			if (records.length < 2) continue;
-			for (const record of records) if (record.issuedVia === "renewal" && await this.abandon(record.fingerprint)) settled += 1;
-		}
-		return settled;
-	}
-	/** Set a never-completed renewal leaf aside (not current, NOT on the CRL). */
-	/** Fingerprints of renewal leaves whose handover is running right now (this process only). */
-	renewalsInFlight = /* @__PURE__ */ new Set();
-	/**
-	* A renewal's leaf is "in flight" from signing until the handover ends. While it is, a node seen
-	* presenting its OLD leaf is simply not swapped yet: the new leaf is not set aside (that would
-	* flap set-aside / reinstate on the node's first connection with it).
-	*/
-	beginRenewal(fingerprint) {
-		this.renewalsInFlight.add(fingerprint);
-	}
-	endRenewal(fingerprint) {
-		this.renewalsInFlight.delete(fingerprint);
-	}
-	async abandonRenewalsNewerThan(presented) {
-		let changed = false;
-		for (const record of this.liveFor(presented.nodeId)) {
-			if (record.fingerprint === presented.fingerprint) continue;
-			if (record.issuedVia !== "renewal" || record.issuedAt <= presented.issuedAt) continue;
-			if (this.renewalsInFlight.has(record.fingerprint)) continue;
-			if (await this.abandon(record.fingerprint)) changed = true;
-		}
-		return changed;
-	}
-	async abandon(fingerprint) {
-		const record = this.rows.get(fingerprint);
-		if (record === void 0 || record.revokedAt !== null) return false;
-		const abandoned = {
-			...record,
-			revokedAt: this.now(),
-			revokedReason: RENEWAL_ABANDONED
-		};
-		this.rows.set(fingerprint, abandoned);
-		await this.persist(abandoned);
-		this.deps.logger?.warn("Renewal leaf set aside (not current, not on the CRL)", {
-			tags: { nodeId: record.nodeId },
-			meta: { serial: record.serial }
-		});
-		return true;
-	}
-	/** Replay every persisted revocation into `crl` (hub boot). Set-aside leaves are not revocations. */
-	restoreCrl(crl) {
-		let restored = 0;
-		for (const record of this.rows.values()) {
-			if (record.revokedAt === null || record.revokedReason === "renewal-abandoned") continue;
-			crl.revoke(record.serial);
-			restored += 1;
-		}
-		return restored;
-	}
-	/** Is `serial` listed as revoked here? */
-	isRevoked(serial) {
-		const wanted = normalizeSerial(serial);
-		for (const record of this.rows.values()) if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned" && normalizeSerial(record.serial) === wanted) return true;
-		return false;
-	}
-	async reap() {
-		const cutoff = this.now() - RETENTION_MS;
-		const dead = [...this.rows.values()].filter((r) => (r.revokedAt ?? r.notAfter) < cutoff);
-		for (const r of dead) {
-			this.rows.delete(r.fingerprint);
-			await this.store.delete.mutate({
-				collection: MESH_NODE_CERTIFICATES_COLLECTION,
-				key: r.fingerprint
-			});
-		}
-		return dead.length;
-	}
-	async insert(record) {
-		this.rows.set(record.fingerprint, record);
-		await this.store.insert.mutate({
-			collection: MESH_NODE_CERTIFICATES_COLLECTION,
-			record: {
-				id: record.fingerprint,
-				data: { ...record }
-			}
-		});
-	}
-	async persist(record) {
-		try {
-			await this.store.update.mutate({
-				collection: MESH_NODE_CERTIFICATES_COLLECTION,
-				id: record.fingerprint,
-				data: { ...record }
-			});
-		} catch (error) {
-			this.deps.logger?.error("Mesh certificate write failed - the change holds until restart", {
-				tags: { nodeId: record.nodeId },
-				meta: { error: error instanceof Error ? error.message : String(error) }
-			});
-		}
-	}
-};
-var SLOT$1 = Symbol.for("camstack.mesh.certificate-registry");
-function setProcessMeshCertificateRegistry(registry) {
-	if (registry === null) Reflect.deleteProperty(globalThis, SLOT$1);
-	else Reflect.set(globalThis, SLOT$1, registry);
-}
-function getProcessMeshCertificateRegistry() {
-	const value = Reflect.get(globalThis, SLOT$1);
-	return value !== null && typeof value === "object" && typeof Reflect.get(value, "recordIssued") === "function" ? value : null;
-}
-//#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-tls-gate.ts
 var STATE_SLOT = Symbol.for("camstack.mesh.tls-listener-state");
 function setProcessMeshTlsListenerState(state) {
@@ -1180,7 +624,7 @@ async function runRenewal(deps, inFlight) {
 	}
 	let issued;
 	try {
-		issued = await issueMeshLeafFromCsr(deps.ca, csrPem, { expectedNodeId: nodeId });
+		issued = await require_agent_https.issueMeshLeafFromCsr(deps.ca, csrPem, { expectedNodeId: nodeId });
 		await deps.registry.recordIssued(nodeId, issued.certPem, "renewal");
 		log.info("Mesh renewal: new leaf signed and recorded", {
 			tags,
@@ -1192,7 +636,7 @@ async function runRenewal(deps, inFlight) {
 	} catch (error) {
 		return fail("issue", message(error), true);
 	}
-	const newLeaf = describeMeshLeaf(issued.certPem);
+	const newLeaf = require_agent_https.describeMeshLeaf(issued.certPem);
 	deps.registry.beginRenewal(newLeaf.fingerprint);
 	inFlight.fingerprint = newLeaf.fingerprint;
 	let resolveRegistered = () => void 0;
@@ -86710,7 +86154,7 @@ function peerIdentity(socket) {
 	if (cert == null || typeof cert !== "object" || !("raw" in cert) || !cert.raw) return null;
 	try {
 		const x509 = new node_crypto.X509Certificate(cert.raw);
-		const cn = subjectCn(x509.subject) ?? subjectCn(`CN=${cert.subject?.CN ?? ""}`);
+		const cn = require_agent_https.subjectCn(x509.subject) ?? require_agent_https.subjectCn(`CN=${cert.subject?.CN ?? ""}`);
 		if (cn === null || cn.length === 0) return null;
 		return {
 			cn,
@@ -87238,7 +86682,7 @@ function newPairingId() {
 }
 /** The hub's commitment to its nonce, bound to the CA certificate it offers. */
 function computePairingCommitment(caCertPem, hubNonce) {
-	return (0, node_crypto.createHash)("sha256").update(`${PAIRING_DOMAIN}|commit|${caFingerprintCompact(caCertPem)}|${hubNonce}`, "utf8").digest("hex");
+	return (0, node_crypto.createHash)("sha256").update(`${PAIRING_DOMAIN}|commit|${require_agent_https.caFingerprintCompact(caCertPem)}|${hubNonce}`, "utf8").digest("hex");
 }
 function commitmentsEqual(expected, presented) {
 	return constantTimeEqual(expected, presented);
@@ -87248,7 +86692,7 @@ function computePairingSas(input) {
 	const value = (0, node_crypto.createHash)("sha256").update([
 		PAIRING_DOMAIN,
 		"sas",
-		caFingerprintCompact(input.caCertPem),
+		require_agent_https.caFingerprintCompact(input.caCertPem),
 		input.agentPublicKeySpki,
 		input.hubNonce,
 		input.agentNonce
@@ -87264,7 +86708,7 @@ function constantTimeEqual(expected, presented) {
 async function describeCsr(csrPem) {
 	const csr = new require_x509_es.Pkcs10CertificateRequest(csrPem);
 	if (!await csr.verify(node_crypto.webcrypto)) throw new Error("the agent CSR signature is invalid");
-	const cn = subjectCn(csr.subject);
+	const cn = require_agent_https.subjectCn(csr.subject);
 	if (cn === null || cn.length === 0) throw new Error("the agent CSR has no CN");
 	return {
 		commonName: cn,
@@ -87575,23 +87019,23 @@ var AgentPairing = class {
 	async offer(body) {
 		this.expireIfDue();
 		if (this.deps.isPaired()) return fail(409, "already-paired", "this agent is paired — unpair it first (from the hub or here)");
-		if (!isValidAgentNodeId(this.deps.nodeId)) return fail(409, "invalid-node-id", `this agent's node id "${this.deps.nodeId}" cannot be paired - rename the agent`);
+		if (!require_agent_https.isValidAgentNodeId(this.deps.nodeId)) return fail(409, "invalid-node-id", `this agent's node id "${this.deps.nodeId}" cannot be paired - rename the agent`);
 		const request = parseOffer(body);
 		if (request === null) return fail(400, "bad-offer", "the offer is malformed");
 		if (request.protocol !== 1) return fail(400, "unsupported-protocol", `pairing protocol ${String(request.protocol)} is not supported`);
 		if (readCaCertificate(request.hubCaCertPem, this.now()) === null) return fail(400, "bad-ca", "the offered CA is not a valid self-signed CA certificate");
 		if (!/^[0-9a-f]{64}$/.test(request.commitment)) return fail(400, "bad-offer", "the commitment is malformed");
 		if (!isHttpUrl(request.hubUrl)) return fail(400, "bad-offer", "hubUrl is not an http(s) URL");
-		const caFingerprint = caFingerprintCompact(request.hubCaCertPem);
+		const caFingerprint = require_agent_https.caFingerprintCompact(request.hubCaCertPem);
 		const refused = this.checkOfferSignature(request, caFingerprint);
 		if (refused !== null) return refused;
 		const rationed = this.rationOffer(caFingerprint);
 		if (rationed !== null) return rationed;
 		for (const existing of [...this.sessions.values()]) if (existing.hub.caFingerprint === caFingerprint) this.end(existing, "failed");
 		if (this.sessions.size >= 4 && !this.makeRoom()) return fail(409, "too-many-pending", "too many pairings are pending on this agent");
-		const keys = await generateMeshKeyPair();
-		const csrPem = await createMeshCsrPem(keys, this.deps.nodeId);
-		const keyPem = await exportMeshPrivateKeyPem(keys.privateKey);
+		const keys = await require_agent_https.generateMeshKeyPair();
+		const csrPem = await require_agent_https.createMeshCsrPem(keys, this.deps.nodeId);
+		const keyPem = await require_agent_https.exportMeshPrivateKeyPem(keys.privateKey);
 		const publicKeySpki = Buffer.from(await node_crypto.webcrypto.subtle.exportKey("spki", keys.publicKey)).toString("base64");
 		if (this.sessions.size >= 4 && !this.makeRoom()) return fail(409, "too-many-pending", "too many pairings are pending on this agent");
 		const session = {
@@ -87931,7 +87375,7 @@ var AgentPairing = class {
 			const leaf = new node_crypto.X509Certificate(leafPem);
 			const ca = new node_crypto.X509Certificate(session.hub.caCertPem);
 			if (!leaf.verify(ca.publicKey)) return fail(400, "bad-leaf", "the certificate is not signed by the offered CA");
-			if (subjectCn(leaf.subject.replaceAll("\n", ",")) !== this.deps.nodeId) return fail(400, "bad-leaf", `the certificate is not issued for "${this.deps.nodeId}"`);
+			if (require_agent_https.subjectCn(leaf.subject.replaceAll("\n", ",")) !== this.deps.nodeId) return fail(400, "bad-leaf", `the certificate is not issued for "${this.deps.nodeId}"`);
 			if (!leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(session.keyPem))) return fail(400, "bad-leaf", "the certificate does not match this agent's private key");
 			if (Date.parse(leaf.validTo) <= this.now()) return fail(400, "bad-leaf", "the certificate is already expired");
 		} catch {
@@ -87989,7 +87433,7 @@ function field(body, key) {
 }
 function caFingerprintOf(pem) {
 	try {
-		return caFingerprintCompact(pem);
+		return require_agent_https.caFingerprintCompact(pem);
 	} catch {
 		return null;
 	}
@@ -88084,7 +87528,7 @@ var HubPairing = class {
 				use: PAIRING_OFFER_USE,
 				agentNodeId: hello.nodeId,
 				hubNodeId: this.deps.hubNodeId,
-				caFingerprint: caFingerprintCompact(ca.certPem),
+				caFingerprint: require_agent_https.caFingerprintCompact(ca.certPem),
 				commitment,
 				hubUrl,
 				hubMeshAddress,
@@ -88201,14 +87645,14 @@ var HubPairing = class {
 	}
 	async complete(session) {
 		const ca = this.deps.ca();
-		if (ca === null || caFingerprintCompact(ca.certPem) !== caFingerprintCompact(session.caCertPem)) {
+		if (ca === null || require_agent_https.caFingerprintCompact(ca.certPem) !== require_agent_https.caFingerprintCompact(session.caCertPem)) {
 			await this.cancel(session, "failed", "the mesh CA changed during the pairing");
 			return;
 		}
 		session.state = "completing";
 		let issuedPem = null;
 		try {
-			const leaf = await issueMeshLeafFromCsr(ca, session.csrPem, { expectedNodeId: session.nodeId });
+			const leaf = await require_agent_https.issueMeshLeafFromCsr(ca, session.csrPem, { expectedNodeId: session.nodeId });
 			issuedPem = leaf.certPem;
 			await this.deps.recordIssued(session.nodeId, leaf.certPem);
 			session.issued = true;
@@ -88220,7 +87664,7 @@ var HubPairing = class {
 				hubNonce: session.hubNonce,
 				agentNonce: session.agentNonce,
 				leafFingerprint: leafFingerprintCompact(leaf.certPem),
-				caFingerprint: caFingerprintCompact(ca.certPem),
+				caFingerprint: require_agent_https.caFingerprintCompact(ca.certPem),
 				hubMeshAddress: session.hubMeshAddress,
 				hubUrl: session.hubUrl,
 				iat: this.now(),
@@ -88274,7 +87718,7 @@ var HubPairing = class {
 		}
 	}
 	assertNodeIdUsable(nodeId) {
-		if (!isValidAgentNodeId(nodeId)) throw new Error(`"${nodeId}" cannot be an agent node id (letters, digits, . _ - ; not "hub"; at most 63 characters)`);
+		if (!require_agent_https.isValidAgentNodeId(nodeId)) throw new Error(`"${nodeId}" cannot be an agent node id (letters, digits, . _ - ; not "hub"; at most 63 characters)`);
 		if (this.deps.isNodeConnected(nodeId)) throw new Error(`a node called "${nodeId}" is already connected to this hub — unpair it first`);
 		const lower = nodeId.toLowerCase();
 		const clash = (this.deps.knownNodeIds?.() ?? []).find((known) => known !== nodeId && known.toLowerCase() === lower);
@@ -88459,7 +87903,7 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		};
 	}
 	async onShutdown() {
-		setProcessMeshCertificateRegistry(null);
+		require_agent_https.setProcessMeshCertificateRegistry(null);
 		setProcessMeshTlsListenerState(null);
 		require_agent_https.setProcessAgentHttpsNames(null);
 		this.stoppedMesh = true;
@@ -88485,22 +87929,27 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 			}
 			return null;
 		}
-		this.loadAgentHttpsNames(store);
+		const records = this.ctx.records;
+		const meshKind = records === void 0 ? null : (await records.declare(require_agent_https.systemConfigRecordKinds), records.kind(require_agent_https.systemConfigRecordKinds["mesh-node-certificates"]));
+		this.loadAgentHttpsNames(store, records);
 		try {
-			await store.declareCollection.mutate({
-				collection: MESH_NODE_CERTIFICATES_COLLECTION,
-				columns: MESH_NODE_CERTIFICATES_COLUMNS,
+			if (records === void 0) await store.declareCollection.mutate({
+				collection: require_agent_https.MESH_NODE_CERTIFICATES_COLLECTION,
+				columns: require_agent_https.MESH_NODE_CERTIFICATES_COLUMNS,
 				indexes: [{
 					name: "idx_mesh_node_certificates_node",
 					columns: ["nodeId"]
 				}]
 			});
-			const registry = new MeshCertificateRegistry(store, { logger: this.ctx.logger });
+			const registry = new require_agent_https.MeshCertificateRegistry(store, {
+				logger: this.ctx.logger,
+				meshKind
+			});
 			await registry.load();
 			const restored = registry.restoreCrl(processMeshCrl());
 			const settled = await registry.settleInterruptedRenewals();
 			if (settled > 0) this.ctx.logger.warn("A mesh renewal was interrupted by a hub restart - its new leaf was set aside", { meta: { settled } });
-			setProcessMeshCertificateRegistry(registry);
+			require_agent_https.setProcessMeshCertificateRegistry(registry);
 			if (restored > 0) this.ctx.logger.info("Mesh revocations restored into the CRL", { meta: { restored } });
 			return registry;
 		} catch (err) {
@@ -88509,13 +87958,16 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		}
 	}
 	/** Which names the hub certified to which agent. Best effort; nothing waits on it. */
-	async loadAgentHttpsNames(store) {
+	async loadAgentHttpsNames(store, records) {
 		try {
-			await store.declareCollection.mutate({
+			if (records === void 0) await store.declareCollection.mutate({
 				collection: require_agent_https.AGENT_HTTPS_NAMES_COLLECTION,
 				columns: require_agent_https.AGENT_HTTPS_NAMES_COLUMNS
 			});
-			const names = new require_agent_https.AgentHttpsNames(store);
+			const names = records === void 0 ? new require_agent_https.AgentHttpsNames(store) : new require_agent_https.AgentHttpsNames({
+				agentHttpsNamesKind: records.kind(require_agent_https.systemConfigRecordKinds["agent-https-names"]),
+				legacyStore: store
+			});
 			await names.load();
 			require_agent_https.setProcessAgentHttpsNames(names);
 		} catch (err) {
@@ -88531,7 +87983,7 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		await openMeshTlsWhenRevocationsLoaded({
 			loadRegistry: () => this.initMeshCertificateRegistry(),
 			open: async (registry) => {
-				const hubLeaf = await issueMeshLeafForNode(ca, "hub");
+				const hubLeaf = await require_agent_https.issueMeshLeafForNode(ca, "hub");
 				await registry.recordIssued("hub", hubLeaf.certPem, "boot").catch((err) => {
 					this.ctx.logger.warn("Hub mesh leaf could not be recorded", { meta: { error: err instanceof Error ? err.message : String(err) } });
 				});
@@ -88838,11 +88290,8 @@ exports.AGENT_UI_UNLOCK_VERSION = AGENT_UI_UNLOCK_VERSION;
 exports.AgentPairing = AgentPairing;
 exports.Errors = Errors;
 exports.HubPairing = HubPairing;
-exports.MESH_NODE_CERTIFICATES_COLLECTION = MESH_NODE_CERTIFICATES_COLLECTION;
-exports.MESH_NODE_CERTIFICATES_COLUMNS = MESH_NODE_CERTIFICATES_COLUMNS;
 exports.MESH_TLS_PORT_HELLO_FIELD = MESH_TLS_PORT_HELLO_FIELD;
 exports.MeshCaKeeper = MeshCaKeeper;
-exports.MeshCertificateRegistry = MeshCertificateRegistry;
 exports.MeshCrl = MeshCrl;
 exports.PAIRING_CODE_DIGITS = PAIRING_CODE_DIGITS;
 exports.PAIRING_MAX_CODE_ATTEMPTS = PAIRING_MAX_CODE_ATTEMPTS;
@@ -88852,39 +88301,26 @@ exports.PAIRING_PIN_DIGITS = PAIRING_PIN_DIGITS;
 exports.PAIRING_PROTOCOL = PAIRING_PROTOCOL;
 exports.PAIRING_TTL_MS = PAIRING_TTL_MS;
 exports.PairingHttpError = PairingHttpError;
-exports.RENEWAL_ABANDONED = RENEWAL_ABANDONED;
 exports.SYSTEM_CONFIG_CLUSTER_SECTION_ID = SYSTEM_CONFIG_CLUSTER_SECTION_ID;
 exports.ServiceBroker = ServiceBroker;
 exports.SystemConfigAddon = SystemConfigAddon;
 exports.default = SystemConfigAddon;
 exports.TlsTcpTransporter = TlsTcpTransporter;
 exports.UnlockTicketJtiStore = UnlockTicketJtiStore;
-exports.caFingerprint = caFingerprint;
-exports.caFingerprintCompact = caFingerprintCompact;
 exports.computePairingCommitment = computePairingCommitment;
 exports.computePairingSas = computePairingSas;
 exports.createCidrMatcher = createCidrMatcher;
-exports.createMeshCsrPem = createMeshCsrPem;
 exports.describeCsr = describeCsr;
-exports.describeMeshLeaf = describeMeshLeaf;
 exports.dropProcessPeer = dropProcessPeer;
 exports.emitProcessNodeRegistered = emitProcessNodeRegistered;
-exports.exportMeshPrivateKeyPem = exportMeshPrivateKeyPem;
-exports.generateMeshCa = generateMeshCa;
-exports.generateMeshKeyPair = generateMeshKeyPair;
 exports.getProcessMeshCaState = getProcessMeshCaState;
-exports.getProcessMeshCertificateRegistry = getProcessMeshCertificateRegistry;
 exports.getProcessMeshTlsListenerState = getProcessMeshTlsListenerState;
 exports.getProcessNodeMeshTransport = getProcessNodeMeshTransport;
 exports.getProcessPeerLeaf = getProcessPeerLeaf;
 exports.hubHostFromMeshAddress = hubHostFromMeshAddress;
 exports.isAllowedAgentDashboardReturnTo = isAllowedAgentDashboardReturnTo;
 exports.isProcessVerifiedMeshPeer = isProcessVerifiedMeshPeer;
-exports.isValidAgentNodeId = isValidAgentNodeId;
-exports.issueMeshLeafForNode = issueMeshLeafForNode;
-exports.issueMeshLeafFromCsr = issueMeshLeafFromCsr;
 exports.keyFingerprintShort = keyFingerprintShort;
-exports.loadMeshCa = loadMeshCa;
 exports.mintAgentUiUnlockTicket = mintAgentUiUnlockTicket;
 exports.normalizeIp = normalizeIp;
 exports.onProcessNodeRegistered = onProcessNodeRegistered;
@@ -88896,7 +88332,6 @@ exports.readCidrSetting = readCidrSetting;
 exports.renewMeshCertificate = renewMeshCertificate;
 exports.requireProcessMeshCa = requireProcessMeshCa;
 exports.revokeMeshCertificate = revokeMeshCertificate;
-exports.setProcessMeshCertificateRegistry = setProcessMeshCertificateRegistry;
 exports.setProcessMeshPeerTransportLookup = setProcessMeshPeerTransportLookup;
 exports.setProcessMeshTlsEnabler = setProcessMeshTlsEnabler;
 exports.setProcessMeshTlsListenerState = setProcessMeshTlsListenerState;