@camstack/system 1.2.444 → 1.2.445

package/dist/{agent-https-DlpTMDqA.js → agent-https-CiOW0-sj.js}

@@ -1,5 +1,8 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
+const require_dist = require("./dist-DgOG8flk.js");
 const require_x509_es = require("./x509.es-C4cOo48M.js");
+const require_constants = require("./constants-Br879Axi.js");
+let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_net = require("node:net");
@@ -7,14 +10,665 @@ let node_path = require("node:path");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");
-//#region src/tls/agent-https-names.ts
+//#region src/kernel/moleculer/mesh-mtls/mesh-ca.ts
+/**
+* Hub mesh CA — EC P-256, key in the keychain, cert in `cluster.meshCa`.
+*
+* Distinct from the HTTPS local CA (`tls/cert-issue.ts`, RSA): the mesh CA
+* signs node leaves (CN = nodeID) and unlock-ticket JWS (ES256). Issuance uses
+* `@peculiar/x509` over WebCrypto — same library the HTTPS path already uses
+* (installed `1.14.3`; registry latest at adoption time was `2.1.0` — stay on
+* the pinned range already shipping).
+*/
+require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
+var MS_PER_DAY$2 = 864e5;
+/** Key generation — EC P-256 (plan). WebCrypto DOM names are not in @types/node. */
+var MESH_KEY_ALGORITHM = {
+	name: "ECDSA",
+	namedCurve: "P-256"
+};
+/** Signing — ECDSA with SHA-256. */
+var MESH_SIGNING_ALGORITHM = {
+	name: "ECDSA",
+	hash: "SHA-256"
+};
+/** A node id: letters, digits, `.`, `_`, `-`; at most 63 characters; starts with a letter or digit. */
+var NODE_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,62}$/i;
+/** Ids no agent may take: the hub's own, whatever the case (D857). */
+var RESERVED_NODE_IDS = new Set(["hub"]);
+/** True for an id an agent may carry: the pattern, and not a reserved name. */
+function isValidAgentNodeId(nodeId) {
+	return NODE_ID_PATTERN.test(nodeId) && !RESERVED_NODE_IDS.has(nodeId.toLowerCase());
+}
+function freshSerial$1() {
+	return `00${(0, node_crypto.randomBytes)(16).toString("hex")}`;
+}
+function toPkcs8Pem$1(pkcs8) {
+	return `${require_x509_es.PemConverter.encode(pkcs8, "PRIVATE KEY")}\n`;
+}
+function toCertPem$1(cert) {
+	return `${cert.toString("pem")}\n`;
+}
+async function exportKeyPem$1(key) {
+	return toPkcs8Pem$1(await node_crypto.webcrypto.subtle.exportKey("pkcs8", key));
+}
+/** SHA-256 fingerprint of the DER cert, colon-hex uppercase (Node style). */
+function caFingerprint(certPem) {
+	return new node_crypto.X509Certificate(certPem).fingerprint256;
+}
+/** Compact fingerprint (lowercase hex, no colons). */
+function caFingerprintCompact(certPem) {
+	return (0, node_crypto.createHash)("sha256").update(new node_crypto.X509Certificate(certPem).raw).digest("hex");
+}
+async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
+	const keys = await node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
+	const extensions = [
+		new require_x509_es.BasicConstraintsExtension(true, 0, true),
+		new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.keyCertSign | require_x509_es.KeyUsageFlags.cRLSign, true),
+		await require_x509_es.SubjectKeyIdentifierExtension.create(keys.publicKey)
+	];
+	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
+		serialNumber: freshSerial$1(),
+		name: `CN=${require_constants.MESH_CA_COMMON_NAME}`,
+		notBefore: require_x509_es.backdatedNotBefore(now),
+		notAfter: new Date(now.getTime() + require_constants.MESH_CA_VALIDITY_DAYS * MS_PER_DAY$2),
+		keys,
+		signingAlgorithm: MESH_SIGNING_ALGORITHM,
+		extensions
+	});
+	return {
+		certPem: toCertPem$1(cert),
+		keyPem: await exportKeyPem$1(keys.privateKey),
+		cert,
+		privateKey: keys.privateKey,
+		publicKey: keys.publicKey
+	};
+}
+async function loadMeshCa(certPem, keyPem) {
+	const cert = new require_x509_es.X509Certificate(certPem);
+	return {
+		certPem,
+		keyPem,
+		cert,
+		privateKey: await node_crypto.webcrypto.subtle.importKey("pkcs8", require_x509_es.PemConverter.decodeFirst(keyPem), MESH_KEY_ALGORITHM, true, ["sign"]),
+		publicKey: await cert.publicKey.export(node_crypto.webcrypto)
+	};
+}
+/**
+* Issue a leaf from a CSR. CN must be present; when `expectedNodeId` is set
+* it must match. Validity: 30 days.
+*/
+async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
+	const csr = new require_x509_es.Pkcs10CertificateRequest(csrPem);
+	if (!await csr.verify(node_crypto.webcrypto)) throw new Error("CSR signature is invalid");
+	const cn = subjectCn(csr.subject);
+	if (cn === null || cn.length === 0) throw new Error("CSR subject has no CN");
+	if (opts.allowReserved !== true && !isValidAgentNodeId(cn)) throw new Error(`CSR CN '${cn}' is not an id an agent may carry`);
+	if (opts.expectedNodeId !== void 0 && opts.expectedNodeId !== cn) throw new Error(`CSR CN '${cn}' does not match the token nodeId '${opts.expectedNodeId}'`);
+	const now = opts.now ?? /* @__PURE__ */ new Date();
+	const validDays = opts.validDays ?? 30;
+	const serialNumber = freshSerial$1();
+	const notAfter = new Date(now.getTime() + validDays * MS_PER_DAY$2);
+	const extensions = [
+		new require_x509_es.BasicConstraintsExtension(false, void 0, true),
+		new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.digitalSignature, true),
+		new require_x509_es.ExtendedKeyUsageExtension([require_constants.SERVER_AUTH_OID, require_constants.CLIENT_AUTH_OID]),
+		await require_x509_es.SubjectKeyIdentifierExtension.create(csr.publicKey),
+		await require_x509_es.AuthorityKeyIdentifierExtension.create(ca.cert)
+	];
+	return {
+		certPem: toCertPem$1(await require_x509_es.X509CertificateGenerator.create({
+			serialNumber,
+			subject: `CN=${cn}`,
+			issuer: ca.cert.subject,
+			notBefore: require_x509_es.backdatedNotBefore(now),
+			notAfter,
+			publicKey: csr.publicKey,
+			signingKey: ca.privateKey,
+			signingAlgorithm: MESH_SIGNING_ALGORITHM,
+			extensions
+		})),
+		serialNumber,
+		notAfter,
+		commonName: cn
+	};
+}
+/** Issue a leaf for a known nodeID with a freshly generated key pair (tests / hub self). */
+async function issueMeshLeafForNode(ca, nodeId, opts = {}) {
+	const keys = await node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
+	return {
+		...await issueMeshLeafFromCsr(ca, await createMeshCsrPem(keys, nodeId), {
+			expectedNodeId: nodeId,
+			now: opts.now,
+			validDays: opts.validDays,
+			allowReserved: true
+		}),
+		keyPem: await exportKeyPem$1(keys.privateKey)
+	};
+}
+function subjectCn(subject) {
+	return /(?:^|,)\s*CN\s*=\s*([^,]+)/i.exec(subject)?.[1]?.trim() ?? null;
+}
+async function createMeshCsrPem(keys, commonName) {
+	return `${(await require_x509_es.Pkcs10CertificateRequestGenerator.create({
+		name: `CN=${commonName}`,
+		keys,
+		signingAlgorithm: MESH_SIGNING_ALGORITHM
+	})).toString("pem")}\n`;
+}
+async function generateMeshKeyPair() {
+	return node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
+}
+async function exportMeshPrivateKeyPem(key) {
+	return exportKeyPem$1(key);
+}
+//#endregion
+//#region src/kernel/moleculer/mesh-mtls/mesh-certificate-registry.ts
+/**
+* The hub's record of every mesh leaf (D856): which certificate each node holds,
+* when it expires, and which serials are revoked.
+*
+* Three ways a row appears:
+*  - `enroll` / `renewal` / `boot` - the hub issued it and wrote it down at the
+*    moment of issuing (the authoritative record);
+*  - `observed` - a node enrolled before this record existed (or by a path that
+*    did not write it) presented this leaf on its LIVE mutual-TLS connection.
+*
+* Revoked serials are persisted here and replayed into the in-memory CRL at boot,
+* so a revocation survives a hub restart. Hub only: agents persist none of it.
+*/
 /**
 * @durable class=config owner=system-config
-*   write="the hub records the names it signed into an agent's HTTPS leaf, replacing that
-*     node's previous row"
-*   retention="one row per node, replaced on every issue; a forgotten node's row stays until
-*     the node is issued again or an operator clears it (it only blocks reuse of its names)"
+*   write="the hub records every mesh leaf it issues (enroll, renewal, boot) and every
+*     leaf a connected node is observed presenting; a revocation stamps revokedAt"
+*   retention="a revoked or expired row is kept 90 days past its end, then reaped; a
+*     live row is never deleted. Forgetting a node does not delete its rows."
 */
+var MESH_NODE_CERTIFICATES_COLLECTION = "mesh_node_certificates";
+var MESH_NODE_CERTIFICATES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "nodeId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "serial",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "fingerprint",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "notBefore",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "notAfter",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "issuedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "issuedVia",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "revokedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "revokedReason",
+		type: "TEXT"
+	}
+];
+var RETENTION_MS = 90 * 864e5;
+/**
+* A leaf the hub signed for a renewal that did not complete. It must not be the node's
+* `current` leaf, but it is NOT on the CRL: the node may still hold it (the swap
+* could have landed without the hub seeing it), and cutting it off would be the
+* outage the hand-over exists to prevent. If the node is later seen presenting it, it
+* is reinstated.
+*/
+var RENEWAL_ABANDONED = "renewal-abandoned";
+var VIAS = [
+	"enroll",
+	"pairing",
+	"renewal",
+	"boot",
+	"observed"
+];
+/** CN, serial, fingerprint and validity of a leaf PEM (or DER). */
+function describeMeshLeaf(cert) {
+	const x509 = new node_crypto.X509Certificate(cert);
+	return {
+		cn: subjectCn(x509.subject) ?? "",
+		serial: x509.serialNumber,
+		fingerprint: x509.fingerprint256,
+		notBefore: Date.parse(x509.validFrom),
+		notAfter: Date.parse(x509.validTo)
+	};
+}
+function normalizeSerial(serial) {
+	return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
+}
+function parse$1(data) {
+	const str = (k) => {
+		const v = data[k];
+		return typeof v === "string" && v.length > 0 ? v : null;
+	};
+	const num = (k) => {
+		const v = data[k];
+		return typeof v === "number" && Number.isFinite(v) ? v : null;
+	};
+	const nodeId = str("nodeId");
+	const serial = str("serial");
+	const fingerprint = str("fingerprint");
+	const notBefore = num("notBefore");
+	const notAfter = num("notAfter");
+	const issuedAt = num("issuedAt");
+	if (nodeId === null || serial === null || fingerprint === null || notBefore === null || notAfter === null || issuedAt === null) return null;
+	return {
+		nodeId,
+		serial,
+		fingerprint,
+		notBefore,
+		notAfter,
+		issuedAt,
+		issuedVia: VIAS.find((v) => v === data["issuedVia"]) ?? "observed",
+		revokedAt: num("revokedAt"),
+		revokedReason: str("revokedReason")
+	};
+}
+var MeshCertificateRegistry = class {
+	store;
+	deps;
+	rows = /* @__PURE__ */ new Map();
+	constructor(store, deps = {}) {
+		this.store = store;
+		this.deps = deps;
+	}
+	recordToBody(record) {
+		return {
+			nodeId: record.nodeId,
+			serial: record.serial,
+			fingerprint: record.fingerprint,
+			notBefore: record.notBefore,
+			notAfter: record.notAfter,
+			issuedAt: record.issuedAt,
+			issuedVia: record.issuedVia,
+			revokedAt: record.revokedAt,
+			revokedReason: record.revokedReason
+		};
+	}
+	now() {
+		return (this.deps.now ?? Date.now)();
+	}
+	async load() {
+		const kind = this.deps.meshKind ?? null;
+		if (kind !== null) {
+			const page = await kind.query({ limit: 1e4 });
+			for (const row of page.records) {
+				const { fingerprint: _fp, ...body } = row.data;
+				const record = parse$1({
+					...body,
+					fingerprint: row.id
+				});
+				if (record !== null) this.rows.set(record.fingerprint, record);
+			}
+			return;
+		}
+		const rows = await this.store.query.query({ collection: MESH_NODE_CERTIFICATES_COLLECTION });
+		for (const row of rows) {
+			const record = parse$1(row.data);
+			if (record !== null) this.rows.set(record.fingerprint, record);
+		}
+	}
+	/** Write down a leaf the hub just issued. Idempotent per fingerprint. */
+	async recordIssued(nodeId, certPem, via) {
+		const leaf = describeMeshLeaf(certPem);
+		const existing = this.rows.get(leaf.fingerprint);
+		if (existing !== void 0) return existing;
+		const record = {
+			nodeId,
+			serial: leaf.serial,
+			fingerprint: leaf.fingerprint,
+			notBefore: leaf.notBefore,
+			notAfter: leaf.notAfter,
+			issuedAt: this.now(),
+			issuedVia: via,
+			revokedAt: null,
+			revokedReason: null
+		};
+		await this.insert(record);
+		this.deps.logger?.info("Mesh certificate recorded", {
+			tags: { nodeId },
+			meta: {
+				via,
+				serial: leaf.serial,
+				notAfter: new Date(leaf.notAfter).toISOString()
+			}
+		});
+		return record;
+	}
+	/**
+	* A node was seen presenting `leaf` on its live connection. A leaf the hub already
+	* knows is left alone; an unknown one is recorded `observed` (a node enrolled
+	* before this record existed).
+	*/
+	async recordObserved(nodeId, leaf) {
+		const known = this.rows.get(leaf.fingerprint);
+		if (known !== void 0) {
+			if (known.revokedReason !== "renewal-abandoned") return known.revokedAt === null ? this.abandonRenewalsNewerThan(known) : false;
+			const reinstated = {
+				...known,
+				revokedAt: null,
+				revokedReason: null
+			};
+			this.rows.set(known.fingerprint, reinstated);
+			await this.persist(reinstated);
+			this.deps.logger?.warn("An abandoned renewal leaf is in use - reinstated", {
+				tags: { nodeId },
+				meta: { serial: known.serial }
+			});
+			return true;
+		}
+		const record = {
+			nodeId,
+			serial: leaf.serial,
+			fingerprint: leaf.fingerprint,
+			notBefore: leaf.notBefore,
+			notAfter: leaf.notAfter,
+			issuedAt: this.now(),
+			issuedVia: "observed",
+			revokedAt: null,
+			revokedReason: null
+		};
+		await this.insert(record);
+		this.deps.logger?.info("Mesh certificate observed on a live connection and recorded", {
+			tags: { nodeId },
+			meta: {
+				serial: leaf.serial,
+				fingerprint: leaf.fingerprint
+			}
+		});
+		return true;
+	}
+	list(nodeId) {
+		return [...this.rows.values()].filter((r) => nodeId === void 0 || r.nodeId === nodeId).toSorted((a, b) => b.issuedAt - a.issuedAt);
+	}
+	/** The newest non-revoked leaf of a node, or `undefined`. */
+	currentFor(nodeId) {
+		return this.list(nodeId).find((r) => r.revokedAt === null);
+	}
+	/** Every non-revoked leaf of a node (a renewal in flight has two). */
+	liveFor(nodeId) {
+		return this.list(nodeId).filter((r) => r.revokedAt === null);
+	}
+	/** Stamp a leaf revoked (and mirror it into `crl`). `false` when unknown or already revoked. */
+	async revoke(fingerprint, reason, crl) {
+		const record = this.rows.get(fingerprint);
+		if (record === void 0 || record.revokedAt !== null) return false;
+		const revoked = {
+			...record,
+			revokedAt: this.now(),
+			revokedReason: reason
+		};
+		this.rows.set(fingerprint, revoked);
+		crl?.revoke(record.serial);
+		await this.persist(revoked);
+		this.deps.logger?.warn("Mesh certificate revoked", {
+			tags: { nodeId: record.nodeId },
+			meta: {
+				serial: record.serial,
+				reason
+			}
+		});
+		return true;
+	}
+	/**
+	* Operator revocation of a whole node: EVERY leaf of the node that is not already on the
+	* CRL goes on it - the current one, an observed one, a renewal one, and a leaf that was set
+	* aside (`renewal-abandoned`: a copy of it may sit on a stolen box, and it must not stay
+	* valid just because the hub once set it aside). Returns the serials put on the CRL.
+	* A leaf revoked this way is never reinstated by `recordObserved`.
+	*/
+	async revokeAllForNode(nodeId, reason, crl, keepFingerprint) {
+		const serials = [];
+		for (const record of this.list(nodeId)) {
+			if (keepFingerprint !== void 0 && record.fingerprint === keepFingerprint) continue;
+			if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned") continue;
+			const revoked = {
+				...record,
+				revokedAt: record.revokedAt ?? this.now(),
+				revokedReason: reason
+			};
+			this.rows.set(record.fingerprint, revoked);
+			crl.revoke(record.serial);
+			await this.persist(revoked);
+			serials.push(record.serial);
+		}
+		if (serials.length > 0) this.deps.logger?.warn("Every mesh certificate of the node revoked", {
+			tags: { nodeId },
+			meta: {
+				serials,
+				reason
+			}
+		});
+		return serials;
+	}
+	/**
+	* At boot: a node with TWO live leaves had a renewal in flight when the hub stopped. The
+	* newer (renewal) one is set aside - it is not the node's current leaf until the node is
+	* seen presenting it, which reinstates it. It is NOT put on the CRL.
+	*/
+	async settleInterruptedRenewals() {
+		let settled = 0;
+		const byNode = /* @__PURE__ */ new Map();
+		for (const record of this.rows.values()) {
+			if (record.revokedAt !== null) continue;
+			byNode.set(record.nodeId, [...byNode.get(record.nodeId) ?? [], record]);
+		}
+		for (const records of byNode.values()) {
+			if (records.length < 2) continue;
+			for (const record of records) if (record.issuedVia === "renewal" && await this.abandon(record.fingerprint)) settled += 1;
+		}
+		return settled;
+	}
+	/** Set a never-completed renewal leaf aside (not current, NOT on the CRL). */
+	/** Fingerprints of renewal leaves whose handover is running right now (this process only). */
+	renewalsInFlight = /* @__PURE__ */ new Set();
+	/**
+	* A renewal's leaf is "in flight" from signing until the handover ends. While it is, a node seen
+	* presenting its OLD leaf is simply not swapped yet: the new leaf is not set aside (that would
+	* flap set-aside / reinstate on the node's first connection with it).
+	*/
+	beginRenewal(fingerprint) {
+		this.renewalsInFlight.add(fingerprint);
+	}
+	endRenewal(fingerprint) {
+		this.renewalsInFlight.delete(fingerprint);
+	}
+	async abandonRenewalsNewerThan(presented) {
+		let changed = false;
+		for (const record of this.liveFor(presented.nodeId)) {
+			if (record.fingerprint === presented.fingerprint) continue;
+			if (record.issuedVia !== "renewal" || record.issuedAt <= presented.issuedAt) continue;
+			if (this.renewalsInFlight.has(record.fingerprint)) continue;
+			if (await this.abandon(record.fingerprint)) changed = true;
+		}
+		return changed;
+	}
+	async abandon(fingerprint) {
+		const record = this.rows.get(fingerprint);
+		if (record === void 0 || record.revokedAt !== null) return false;
+		const abandoned = {
+			...record,
+			revokedAt: this.now(),
+			revokedReason: RENEWAL_ABANDONED
+		};
+		this.rows.set(fingerprint, abandoned);
+		await this.persist(abandoned);
+		this.deps.logger?.warn("Renewal leaf set aside (not current, not on the CRL)", {
+			tags: { nodeId: record.nodeId },
+			meta: { serial: record.serial }
+		});
+		return true;
+	}
+	/** Replay every persisted revocation into `crl` (hub boot). Set-aside leaves are not revocations. */
+	restoreCrl(crl) {
+		let restored = 0;
+		for (const record of this.rows.values()) {
+			if (record.revokedAt === null || record.revokedReason === "renewal-abandoned") continue;
+			crl.revoke(record.serial);
+			restored += 1;
+		}
+		return restored;
+	}
+	/** Is `serial` listed as revoked here? */
+	isRevoked(serial) {
+		const wanted = normalizeSerial(serial);
+		for (const record of this.rows.values()) if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned" && normalizeSerial(record.serial) === wanted) return true;
+		return false;
+	}
+	async reap() {
+		const cutoff = this.now() - RETENTION_MS;
+		const dead = [...this.rows.values()].filter((r) => (r.revokedAt ?? r.notAfter) < cutoff);
+		for (const r of dead) {
+			this.rows.delete(r.fingerprint);
+			await this.deleteRow(r.fingerprint);
+		}
+		return dead.length;
+	}
+	async insert(record) {
+		this.rows.set(record.fingerprint, record);
+		const kind = this.deps.meshKind ?? null;
+		if (kind !== null) {
+			const parsed = systemConfigRecordKinds["mesh-node-certificates"].schema.safeParse(this.recordToBody(record));
+			if (!parsed.success) throw new Error(parsed.error.message);
+			await kind.put({
+				id: record.fingerprint,
+				data: parsed.data
+			});
+			return;
+		}
+		await this.store.insert.mutate({
+			collection: MESH_NODE_CERTIFICATES_COLLECTION,
+			record: {
+				id: record.fingerprint,
+				data: { ...record }
+			}
+		});
+	}
+	async deleteRow(fingerprint) {
+		const kind = this.deps.meshKind ?? null;
+		if (kind !== null) {
+			await kind.delete(fingerprint);
+			return;
+		}
+		await this.store.delete.mutate({
+			collection: MESH_NODE_CERTIFICATES_COLLECTION,
+			key: fingerprint
+		});
+	}
+	async persist(record) {
+		try {
+			const kind = this.deps.meshKind ?? null;
+			if (kind !== null) {
+				const parsed = systemConfigRecordKinds["mesh-node-certificates"].schema.safeParse(this.recordToBody(record));
+				if (!parsed.success) throw new Error(parsed.error.message);
+				await kind.put({
+					id: record.fingerprint,
+					data: parsed.data
+				});
+				return;
+			}
+			await this.store.update.mutate({
+				collection: MESH_NODE_CERTIFICATES_COLLECTION,
+				id: record.fingerprint,
+				data: { ...record }
+			});
+		} catch (error) {
+			this.deps.logger?.error("Mesh certificate write failed - the change holds until restart", {
+				tags: { nodeId: record.nodeId },
+				meta: { error: error instanceof Error ? error.message : String(error) }
+			});
+		}
+	}
+};
+var SLOT$1 = Symbol.for("camstack.mesh.certificate-registry");
+function setProcessMeshCertificateRegistry(registry) {
+	if (registry === null) Reflect.deleteProperty(globalThis, SLOT$1);
+	else Reflect.set(globalThis, SLOT$1, registry);
+}
+function getProcessMeshCertificateRegistry() {
+	const value = Reflect.get(globalThis, SLOT$1);
+	return value !== null && typeof value === "object" && typeof Reflect.get(value, "recordIssued") === "function" ? value : null;
+}
+var MeshNodeCertificateBodySchema = zod.z.object({
+	nodeId: zod.z.string(),
+	serial: zod.z.string(),
+	fingerprint: zod.z.string(),
+	notBefore: zod.z.number(),
+	notAfter: zod.z.number(),
+	issuedAt: zod.z.number(),
+	issuedVia: zod.z.string(),
+	revokedAt: zod.z.number().nullish(),
+	revokedReason: zod.z.string().nullish()
+});
+var AgentHttpsNameBodySchema = zod.z.object({
+	names: zod.z.array(zod.z.string()).readonly(),
+	issuedAt: zod.z.number()
+});
+var _systemConfigRecordKinds = require_dist.defineRecordKinds({
+	"mesh-node-certificates": {
+		schema: MeshNodeCertificateBodySchema,
+		class: "config",
+		writeTrigger: "mesh pairing, renewal, revocation (CRL mirror refreshed from rows)",
+		device: "none",
+		at: "none",
+		indexes: [{
+			name: "node",
+			fields: ["nodeId"]
+		}, {
+			name: "fingerprint",
+			fields: ["fingerprint"]
+		}],
+		retention: {
+			owner: "system-config",
+			reason: "daily reap removes revoked/expired rows older than 90 days"
+		},
+		adoptsFrom: MESH_NODE_CERTIFICATES_COLLECTION
+	},
+	"agent-https-names": {
+		schema: AgentHttpsNameBodySchema,
+		class: "config",
+		writeTrigger: "agent HTTPS certificate issuance records the CN/SAN set",
+		device: "none",
+		at: "none",
+		retention: { none: "one row per node id" },
+		adoptsFrom: AGENT_HTTPS_NAMES_COLLECTION
+	}
+});
+var systemConfigRecordKinds = _systemConfigRecordKinds;
+_systemConfigRecordKinds["mesh-node-certificates"];
+_systemConfigRecordKinds["agent-https-names"];
+//#endregion
+//#region src/tls/agent-https-names.ts
 var AGENT_HTTPS_NAMES_COLLECTION = "agent_https_names";
 var AGENT_HTTPS_NAMES_COLUMNS = [
 	{
@@ -35,23 +689,34 @@ var AGENT_HTTPS_NAMES_COLUMNS = [
 	}
 ];
 var AgentHttpsNames = class {
-	store;
 	byNode = /* @__PURE__ */ new Map();
-	constructor(store) {
-		this.store = store;
+	kind;
+	store;
+	constructor(deps) {
+		if ("agentHttpsNamesKind" in deps) {
+			this.kind = deps.agentHttpsNamesKind;
+			this.store = deps.legacyStore ?? null;
+		} else {
+			this.kind = null;
+			this.store = deps;
+		}
 	}
 	async load() {
+		const kind = this.kind;
+		if (kind !== null) {
+			const page = await kind.query({ limit: 1e4 });
+			for (const row of page.records) this.byNode.set(row.id, row.data.names.map((n) => n.toLowerCase()));
+			return;
+		}
 		const rows = await this.store.query.query({ collection: AGENT_HTTPS_NAMES_COLLECTION });
 		for (const row of rows) {
 			const names = row.data["names"];
 			if (Array.isArray(names)) this.byNode.set(row.id, names.filter((n) => typeof n === "string").map((n) => n.toLowerCase()));
 		}
 	}
-	/** The names certified to `nodeId` (its id and the address of its live mesh socket), or `null`. */
 	namesOf(nodeId) {
 		return this.byNode.get(nodeId) ?? null;
 	}
-	/** Every name certified to a node other than `nodeId`. */
 	takenByOthers(nodeId) {
 		const out = /* @__PURE__ */ new Set();
 		for (const [id, names] of this.byNode) {
@@ -60,9 +725,13 @@ var AgentHttpsNames = class {
 		}
 		return out;
 	}
-	/** Free every name certified to a node that was forgotten. */
 	async release(nodeId) {
 		if (!this.byNode.delete(nodeId)) return false;
+		const kind = this.kind;
+		if (kind !== null) {
+			await kind.delete(nodeId);
+			return true;
+		}
 		await this.store.delete.mutate({
 			collection: AGENT_HTTPS_NAMES_COLLECTION,
 			key: nodeId
@@ -73,9 +742,24 @@ var AgentHttpsNames = class {
 		const lowered = names.map((n) => n.toLowerCase());
 		const existed = this.byNode.has(nodeId);
 		this.byNode.set(nodeId, lowered);
+		const issuedAt = Date.now();
+		const body = {
+			names: lowered,
+			issuedAt
+		};
+		const kind = this.kind;
+		if (kind !== null) {
+			const parsed = systemConfigRecordKinds["agent-https-names"].schema.safeParse(body);
+			if (!parsed.success) throw new Error(parsed.error.message);
+			await kind.put({
+				id: nodeId,
+				data: parsed.data
+			});
+			return;
+		}
 		const data = {
 			names: lowered,
-			issuedAt: Date.now()
+			issuedAt
 		};
 		if (existed) await this.store.update.mutate({
 			collection: AGENT_HTTPS_NAMES_COLLECTION,
@@ -993,6 +1677,24 @@ Object.defineProperty(exports, "MAX_LEAF_VALIDITY_DAYS", {
 		return MAX_LEAF_VALIDITY_DAYS;
 	}
 });
+Object.defineProperty(exports, "MESH_NODE_CERTIFICATES_COLLECTION", {
+	enumerable: true,
+	get: function() {
+		return MESH_NODE_CERTIFICATES_COLLECTION;
+	}
+});
+Object.defineProperty(exports, "MESH_NODE_CERTIFICATES_COLUMNS", {
+	enumerable: true,
+	get: function() {
+		return MESH_NODE_CERTIFICATES_COLUMNS;
+	}
+});
+Object.defineProperty(exports, "MeshCertificateRegistry", {
+	enumerable: true,
+	get: function() {
+		return MeshCertificateRegistry;
+	}
+});
 Object.defineProperty(exports, "PERMITTED_DNS_SUFFIXES", {
 	enumerable: true,
 	get: function() {
@@ -1005,6 +1707,12 @@ Object.defineProperty(exports, "PERMITTED_IP_RANGES", {
 		return PERMITTED_IP_RANGES;
 	}
 });
+Object.defineProperty(exports, "RENEWAL_ABANDONED", {
+	enumerable: true,
+	get: function() {
+		return RENEWAL_ABANDONED;
+	}
+});
 Object.defineProperty(exports, "SERVER_AUTH_OID", {
 	enumerable: true,
 	get: function() {
@@ -1029,6 +1737,18 @@ Object.defineProperty(exports, "buildNameConstraintSet", {
 		return buildNameConstraintSet;
 	}
 });
+Object.defineProperty(exports, "caFingerprint", {
+	enumerable: true,
+	get: function() {
+		return caFingerprint;
+	}
+});
+Object.defineProperty(exports, "caFingerprintCompact", {
+	enumerable: true,
+	get: function() {
+		return caFingerprintCompact;
+	}
+});
 Object.defineProperty(exports, "certificateNames", {
 	enumerable: true,
 	get: function() {
@@ -1053,30 +1773,66 @@ Object.defineProperty(exports, "createAgentHttpsRequest", {
 		return createAgentHttpsRequest;
 	}
 });
+Object.defineProperty(exports, "createMeshCsrPem", {
+	enumerable: true,
+	get: function() {
+		return createMeshCsrPem;
+	}
+});
 Object.defineProperty(exports, "describeHttpsLeaf", {
 	enumerable: true,
 	get: function() {
 		return describeHttpsLeaf;
 	}
 });
+Object.defineProperty(exports, "describeMeshLeaf", {
+	enumerable: true,
+	get: function() {
+		return describeMeshLeaf;
+	}
+});
 Object.defineProperty(exports, "evaluateExistingCert", {
 	enumerable: true,
 	get: function() {
 		return evaluateExistingCert;
 	}
 });
+Object.defineProperty(exports, "exportMeshPrivateKeyPem", {
+	enumerable: true,
+	get: function() {
+		return exportMeshPrivateKeyPem;
+	}
+});
 Object.defineProperty(exports, "generateCa", {
 	enumerable: true,
 	get: function() {
 		return generateCa;
 	}
 });
+Object.defineProperty(exports, "generateMeshCa", {
+	enumerable: true,
+	get: function() {
+		return generateMeshCa;
+	}
+});
+Object.defineProperty(exports, "generateMeshKeyPair", {
+	enumerable: true,
+	get: function() {
+		return generateMeshKeyPair;
+	}
+});
 Object.defineProperty(exports, "getProcessAgentHttpsNames", {
 	enumerable: true,
 	get: function() {
 		return getProcessAgentHttpsNames;
 	}
 });
+Object.defineProperty(exports, "getProcessMeshCertificateRegistry", {
+	enumerable: true,
+	get: function() {
+		return getProcessMeshCertificateRegistry;
+	}
+});
 Object.defineProperty(exports, "installAgentHttps", {
 	enumerable: true,
 	get: function() {
@@ -1107,6 +1863,12 @@ Object.defineProperty(exports, "isPrivateAddress", {
 		return isPrivateAddress;
 	}
 });
+Object.defineProperty(exports, "isValidAgentNodeId", {
+	enumerable: true,
+	get: function() {
+		return isValidAgentNodeId;
+	}
+});
 Object.defineProperty(exports, "issueAgentHttpsLeaf", {
 	enumerable: true,
 	get: function() {
@@ -1119,6 +1881,18 @@ Object.defineProperty(exports, "issueLeaf", {
 		return issueLeaf;
 	}
 });
+Object.defineProperty(exports, "issueMeshLeafForNode", {
+	enumerable: true,
+	get: function() {
+		return issueMeshLeafForNode;
+	}
+});
+Object.defineProperty(exports, "issueMeshLeafFromCsr", {
+	enumerable: true,
+	get: function() {
+		return issueMeshLeafFromCsr;
+	}
+});
 Object.defineProperty(exports, "loadAgentHttps", {
 	enumerable: true,
 	get: function() {
@@ -1131,6 +1905,12 @@ Object.defineProperty(exports, "loadCa", {
 		return loadCa;
 	}
 });
+Object.defineProperty(exports, "loadMeshCa", {
+	enumerable: true,
+	get: function() {
+		return loadMeshCa;
+	}
+});
 Object.defineProperty(exports, "pemDigest", {
 	enumerable: true,
 	get: function() {
@@ -1173,6 +1953,24 @@ Object.defineProperty(exports, "setProcessAgentHttpsNames", {
 		return setProcessAgentHttpsNames;
 	}
 });
+Object.defineProperty(exports, "setProcessMeshCertificateRegistry", {
+	enumerable: true,
+	get: function() {
+		return setProcessMeshCertificateRegistry;
+	}
+});
+Object.defineProperty(exports, "subjectCn", {
+	enumerable: true,
+	get: function() {
+		return subjectCn;
+	}
+});
+Object.defineProperty(exports, "systemConfigRecordKinds", {
+	enumerable: true,
+	get: function() {
+		return systemConfigRecordKinds;
+	}
+});
 Object.defineProperty(exports, "systemHostFacts", {
 	enumerable: true,
 	get: function() {