@camstack/system 1.2.444 → 1.2.445

package/dist/{agent-https-U0d4uvn2.mjs → agent-https-D4Q8iFNd.mjs}

@@ -1,18 +1,672 @@
+import { Di as defineRecordKinds } from "./dist-BNunRyXT.mjs";
 import { S as backdatedNotBefore, _ as NameConstraints, a as KeyUsageFlags, c as Pkcs10CertificateRequest, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, g as GeneralSubtrees, h as GeneralSubtree, i as Extension, l as Pkcs10CertificateRequestGenerator, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension, u as SubjectAlternativeNameExtension, v as GeneralName, x as AsnConvert } from "./x509.es-DK__ETIe.mjs";
+import { c as SERVER_AUTH_OID$1, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "./constants-BMHCxRzb.mjs";
+import { z } from "zod";
 import { X509Certificate, createHash, createPrivateKey, randomBytes, webcrypto } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { isIP } from "node:net";
 import { join } from "node:path";
 import * as os$1 from "node:os";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-//#region src/tls/agent-https-names.ts
+//#region src/kernel/moleculer/mesh-mtls/mesh-ca.ts
+/**
+* Hub mesh CA — EC P-256, key in the keychain, cert in `cluster.meshCa`.
+*
+* Distinct from the HTTPS local CA (`tls/cert-issue.ts`, RSA): the mesh CA
+* signs node leaves (CN = nodeID) and unlock-ticket JWS (ES256). Issuance uses
+* `@peculiar/x509` over WebCrypto — same library the HTTPS path already uses
+* (installed `1.14.3`; registry latest at adoption time was `2.1.0` — stay on
+* the pinned range already shipping).
+*/
+cryptoProvider.set(webcrypto);
+var MS_PER_DAY$2 = 864e5;
+/** Key generation — EC P-256 (plan). WebCrypto DOM names are not in @types/node. */
+var MESH_KEY_ALGORITHM = {
+	name: "ECDSA",
+	namedCurve: "P-256"
+};
+/** Signing — ECDSA with SHA-256. */
+var MESH_SIGNING_ALGORITHM = {
+	name: "ECDSA",
+	hash: "SHA-256"
+};
+/** A node id: letters, digits, `.`, `_`, `-`; at most 63 characters; starts with a letter or digit. */
+var NODE_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,62}$/i;
+/** Ids no agent may take: the hub's own, whatever the case (D857). */
+var RESERVED_NODE_IDS = new Set(["hub"]);
+/** True for an id an agent may carry: the pattern, and not a reserved name. */
+function isValidAgentNodeId(nodeId) {
+	return NODE_ID_PATTERN.test(nodeId) && !RESERVED_NODE_IDS.has(nodeId.toLowerCase());
+}
+function freshSerial$1() {
+	return `00${randomBytes(16).toString("hex")}`;
+}
+function toPkcs8Pem$1(pkcs8) {
+	return `${PemConverter.encode(pkcs8, "PRIVATE KEY")}\n`;
+}
+function toCertPem$1(cert) {
+	return `${cert.toString("pem")}\n`;
+}
+async function exportKeyPem$1(key) {
+	return toPkcs8Pem$1(await webcrypto.subtle.exportKey("pkcs8", key));
+}
+/** SHA-256 fingerprint of the DER cert, colon-hex uppercase (Node style). */
+function caFingerprint(certPem) {
+	return new X509Certificate(certPem).fingerprint256;
+}
+/** Compact fingerprint (lowercase hex, no colons). */
+function caFingerprintCompact(certPem) {
+	return createHash("sha256").update(new X509Certificate(certPem).raw).digest("hex");
+}
+async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
+	const keys = await webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
+	const extensions = [
+		new BasicConstraintsExtension(true, 0, true),
+		new KeyUsagesExtension(KeyUsageFlags.keyCertSign | KeyUsageFlags.cRLSign, true),
+		await SubjectKeyIdentifierExtension.create(keys.publicKey)
+	];
+	const cert = await X509CertificateGenerator.createSelfSigned({
+		serialNumber: freshSerial$1(),
+		name: `CN=${MESH_CA_COMMON_NAME}`,
+		notBefore: backdatedNotBefore(now),
+		notAfter: new Date(now.getTime() + MESH_CA_VALIDITY_DAYS * MS_PER_DAY$2),
+		keys,
+		signingAlgorithm: MESH_SIGNING_ALGORITHM,
+		extensions
+	});
+	return {
+		certPem: toCertPem$1(cert),
+		keyPem: await exportKeyPem$1(keys.privateKey),
+		cert,
+		privateKey: keys.privateKey,
+		publicKey: keys.publicKey
+	};
+}
+async function loadMeshCa(certPem, keyPem) {
+	const cert = new X509Certificate$1(certPem);
+	return {
+		certPem,
+		keyPem,
+		cert,
+		privateKey: await webcrypto.subtle.importKey("pkcs8", PemConverter.decodeFirst(keyPem), MESH_KEY_ALGORITHM, true, ["sign"]),
+		publicKey: await cert.publicKey.export(webcrypto)
+	};
+}
+/**
+* Issue a leaf from a CSR. CN must be present; when `expectedNodeId` is set
+* it must match. Validity: 30 days.
+*/
+async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
+	const csr = new Pkcs10CertificateRequest(csrPem);
+	if (!await csr.verify(webcrypto)) throw new Error("CSR signature is invalid");
+	const cn = subjectCn(csr.subject);
+	if (cn === null || cn.length === 0) throw new Error("CSR subject has no CN");
+	if (opts.allowReserved !== true && !isValidAgentNodeId(cn)) throw new Error(`CSR CN '${cn}' is not an id an agent may carry`);
+	if (opts.expectedNodeId !== void 0 && opts.expectedNodeId !== cn) throw new Error(`CSR CN '${cn}' does not match the token nodeId '${opts.expectedNodeId}'`);
+	const now = opts.now ?? /* @__PURE__ */ new Date();
+	const validDays = opts.validDays ?? 30;
+	const serialNumber = freshSerial$1();
+	const notAfter = new Date(now.getTime() + validDays * MS_PER_DAY$2);
+	const extensions = [
+		new BasicConstraintsExtension(false, void 0, true),
+		new KeyUsagesExtension(KeyUsageFlags.digitalSignature, true),
+		new ExtendedKeyUsageExtension([SERVER_AUTH_OID$1, CLIENT_AUTH_OID]),
+		await SubjectKeyIdentifierExtension.create(csr.publicKey),
+		await AuthorityKeyIdentifierExtension.create(ca.cert)
+	];
+	return {
+		certPem: toCertPem$1(await X509CertificateGenerator.create({
+			serialNumber,
+			subject: `CN=${cn}`,
+			issuer: ca.cert.subject,
+			notBefore: backdatedNotBefore(now),
+			notAfter,
+			publicKey: csr.publicKey,
+			signingKey: ca.privateKey,
+			signingAlgorithm: MESH_SIGNING_ALGORITHM,
+			extensions
+		})),
+		serialNumber,
+		notAfter,
+		commonName: cn
+	};
+}
+/** Issue a leaf for a known nodeID with a freshly generated key pair (tests / hub self). */
+async function issueMeshLeafForNode(ca, nodeId, opts = {}) {
+	const keys = await webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
+	return {
+		...await issueMeshLeafFromCsr(ca, await createMeshCsrPem(keys, nodeId), {
+			expectedNodeId: nodeId,
+			now: opts.now,
+			validDays: opts.validDays,
+			allowReserved: true
+		}),
+		keyPem: await exportKeyPem$1(keys.privateKey)
+	};
+}
+function subjectCn(subject) {
+	return /(?:^|,)\s*CN\s*=\s*([^,]+)/i.exec(subject)?.[1]?.trim() ?? null;
+}
+async function createMeshCsrPem(keys, commonName) {
+	return `${(await Pkcs10CertificateRequestGenerator.create({
+		name: `CN=${commonName}`,
+		keys,
+		signingAlgorithm: MESH_SIGNING_ALGORITHM
+	})).toString("pem")}\n`;
+}
+async function generateMeshKeyPair() {
+	return webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
+}
+async function exportMeshPrivateKeyPem(key) {
+	return exportKeyPem$1(key);
+}
+//#endregion
+//#region src/kernel/moleculer/mesh-mtls/mesh-certificate-registry.ts
+/**
+* The hub's record of every mesh leaf (D856): which certificate each node holds,
+* when it expires, and which serials are revoked.
+*
+* Three ways a row appears:
+*  - `enroll` / `renewal` / `boot` - the hub issued it and wrote it down at the
+*    moment of issuing (the authoritative record);
+*  - `observed` - a node enrolled before this record existed (or by a path that
+*    did not write it) presented this leaf on its LIVE mutual-TLS connection.
+*
+* Revoked serials are persisted here and replayed into the in-memory CRL at boot,
+* so a revocation survives a hub restart. Hub only: agents persist none of it.
+*/
 /**
 * @durable class=config owner=system-config
-*   write="the hub records the names it signed into an agent's HTTPS leaf, replacing that
-*     node's previous row"
-*   retention="one row per node, replaced on every issue; a forgotten node's row stays until
-*     the node is issued again or an operator clears it (it only blocks reuse of its names)"
+*   write="the hub records every mesh leaf it issues (enroll, renewal, boot) and every
+*     leaf a connected node is observed presenting; a revocation stamps revokedAt"
+*   retention="a revoked or expired row is kept 90 days past its end, then reaped; a
+*     live row is never deleted. Forgetting a node does not delete its rows."
 */
+var MESH_NODE_CERTIFICATES_COLLECTION = "mesh_node_certificates";
+var MESH_NODE_CERTIFICATES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "nodeId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "serial",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "fingerprint",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "notBefore",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "notAfter",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "issuedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "issuedVia",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "revokedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "revokedReason",
+		type: "TEXT"
+	}
+];
+var RETENTION_MS = 90 * 864e5;
+/**
+* A leaf the hub signed for a renewal that did not complete. It must not be the node's
+* `current` leaf, but it is NOT on the CRL: the node may still hold it (the swap
+* could have landed without the hub seeing it), and cutting it off would be the
+* outage the hand-over exists to prevent. If the node is later seen presenting it, it
+* is reinstated.
+*/
+var RENEWAL_ABANDONED = "renewal-abandoned";
+var VIAS = [
+	"enroll",
+	"pairing",
+	"renewal",
+	"boot",
+	"observed"
+];
+/** CN, serial, fingerprint and validity of a leaf PEM (or DER). */
+function describeMeshLeaf(cert) {
+	const x509 = new X509Certificate(cert);
+	return {
+		cn: subjectCn(x509.subject) ?? "",
+		serial: x509.serialNumber,
+		fingerprint: x509.fingerprint256,
+		notBefore: Date.parse(x509.validFrom),
+		notAfter: Date.parse(x509.validTo)
+	};
+}
+function normalizeSerial(serial) {
+	return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
+}
+function parse$1(data) {
+	const str = (k) => {
+		const v = data[k];
+		return typeof v === "string" && v.length > 0 ? v : null;
+	};
+	const num = (k) => {
+		const v = data[k];
+		return typeof v === "number" && Number.isFinite(v) ? v : null;
+	};
+	const nodeId = str("nodeId");
+	const serial = str("serial");
+	const fingerprint = str("fingerprint");
+	const notBefore = num("notBefore");
+	const notAfter = num("notAfter");
+	const issuedAt = num("issuedAt");
+	if (nodeId === null || serial === null || fingerprint === null || notBefore === null || notAfter === null || issuedAt === null) return null;
+	return {
+		nodeId,
+		serial,
+		fingerprint,
+		notBefore,
+		notAfter,
+		issuedAt,
+		issuedVia: VIAS.find((v) => v === data["issuedVia"]) ?? "observed",
+		revokedAt: num("revokedAt"),
+		revokedReason: str("revokedReason")
+	};
+}
+var MeshCertificateRegistry = class {
+	store;
+	deps;
+	rows = /* @__PURE__ */ new Map();
+	constructor(store, deps = {}) {
+		this.store = store;
+		this.deps = deps;
+	}
+	recordToBody(record) {
+		return {
+			nodeId: record.nodeId,
+			serial: record.serial,
+			fingerprint: record.fingerprint,
+			notBefore: record.notBefore,
+			notAfter: record.notAfter,
+			issuedAt: record.issuedAt,
+			issuedVia: record.issuedVia,
+			revokedAt: record.revokedAt,
+			revokedReason: record.revokedReason
+		};
+	}
+	now() {
+		return (this.deps.now ?? Date.now)();
+	}
+	async load() {
+		const kind = this.deps.meshKind ?? null;
+		if (kind !== null) {
+			const page = await kind.query({ limit: 1e4 });
+			for (const row of page.records) {
+				const { fingerprint: _fp, ...body } = row.data;
+				const record = parse$1({
+					...body,
+					fingerprint: row.id
+				});
+				if (record !== null) this.rows.set(record.fingerprint, record);
+			}
+			return;
+		}
+		const rows = await this.store.query.query({ collection: MESH_NODE_CERTIFICATES_COLLECTION });
+		for (const row of rows) {
+			const record = parse$1(row.data);
+			if (record !== null) this.rows.set(record.fingerprint, record);
+		}
+	}
+	/** Write down a leaf the hub just issued. Idempotent per fingerprint. */
+	async recordIssued(nodeId, certPem, via) {
+		const leaf = describeMeshLeaf(certPem);
+		const existing = this.rows.get(leaf.fingerprint);
+		if (existing !== void 0) return existing;
+		const record = {
+			nodeId,
+			serial: leaf.serial,
+			fingerprint: leaf.fingerprint,
+			notBefore: leaf.notBefore,
+			notAfter: leaf.notAfter,
+			issuedAt: this.now(),
+			issuedVia: via,
+			revokedAt: null,
+			revokedReason: null
+		};
+		await this.insert(record);
+		this.deps.logger?.info("Mesh certificate recorded", {
+			tags: { nodeId },
+			meta: {
+				via,
+				serial: leaf.serial,
+				notAfter: new Date(leaf.notAfter).toISOString()
+			}
+		});
+		return record;
+	}
+	/**
+	* A node was seen presenting `leaf` on its live connection. A leaf the hub already
+	* knows is left alone; an unknown one is recorded `observed` (a node enrolled
+	* before this record existed).
+	*/
+	async recordObserved(nodeId, leaf) {
+		const known = this.rows.get(leaf.fingerprint);
+		if (known !== void 0) {
+			if (known.revokedReason !== "renewal-abandoned") return known.revokedAt === null ? this.abandonRenewalsNewerThan(known) : false;
+			const reinstated = {
+				...known,
+				revokedAt: null,
+				revokedReason: null
+			};
+			this.rows.set(known.fingerprint, reinstated);
+			await this.persist(reinstated);
+			this.deps.logger?.warn("An abandoned renewal leaf is in use - reinstated", {
+				tags: { nodeId },
+				meta: { serial: known.serial }
+			});
+			return true;
+		}
+		const record = {
+			nodeId,
+			serial: leaf.serial,
+			fingerprint: leaf.fingerprint,
+			notBefore: leaf.notBefore,
+			notAfter: leaf.notAfter,
+			issuedAt: this.now(),
+			issuedVia: "observed",
+			revokedAt: null,
+			revokedReason: null
+		};
+		await this.insert(record);
+		this.deps.logger?.info("Mesh certificate observed on a live connection and recorded", {
+			tags: { nodeId },
+			meta: {
+				serial: leaf.serial,
+				fingerprint: leaf.fingerprint
+			}
+		});
+		return true;
+	}
+	list(nodeId) {
+		return [...this.rows.values()].filter((r) => nodeId === void 0 || r.nodeId === nodeId).toSorted((a, b) => b.issuedAt - a.issuedAt);
+	}
+	/** The newest non-revoked leaf of a node, or `undefined`. */
+	currentFor(nodeId) {
+		return this.list(nodeId).find((r) => r.revokedAt === null);
+	}
+	/** Every non-revoked leaf of a node (a renewal in flight has two). */
+	liveFor(nodeId) {
+		return this.list(nodeId).filter((r) => r.revokedAt === null);
+	}
+	/** Stamp a leaf revoked (and mirror it into `crl`). `false` when unknown or already revoked. */
+	async revoke(fingerprint, reason, crl) {
+		const record = this.rows.get(fingerprint);
+		if (record === void 0 || record.revokedAt !== null) return false;
+		const revoked = {
+			...record,
+			revokedAt: this.now(),
+			revokedReason: reason
+		};
+		this.rows.set(fingerprint, revoked);
+		crl?.revoke(record.serial);
+		await this.persist(revoked);
+		this.deps.logger?.warn("Mesh certificate revoked", {
+			tags: { nodeId: record.nodeId },
+			meta: {
+				serial: record.serial,
+				reason
+			}
+		});
+		return true;
+	}
+	/**
+	* Operator revocation of a whole node: EVERY leaf of the node that is not already on the
+	* CRL goes on it - the current one, an observed one, a renewal one, and a leaf that was set
+	* aside (`renewal-abandoned`: a copy of it may sit on a stolen box, and it must not stay
+	* valid just because the hub once set it aside). Returns the serials put on the CRL.
+	* A leaf revoked this way is never reinstated by `recordObserved`.
+	*/
+	async revokeAllForNode(nodeId, reason, crl, keepFingerprint) {
+		const serials = [];
+		for (const record of this.list(nodeId)) {
+			if (keepFingerprint !== void 0 && record.fingerprint === keepFingerprint) continue;
+			if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned") continue;
+			const revoked = {
+				...record,
+				revokedAt: record.revokedAt ?? this.now(),
+				revokedReason: reason
+			};
+			this.rows.set(record.fingerprint, revoked);
+			crl.revoke(record.serial);
+			await this.persist(revoked);
+			serials.push(record.serial);
+		}
+		if (serials.length > 0) this.deps.logger?.warn("Every mesh certificate of the node revoked", {
+			tags: { nodeId },
+			meta: {
+				serials,
+				reason
+			}
+		});
+		return serials;
+	}
+	/**
+	* At boot: a node with TWO live leaves had a renewal in flight when the hub stopped. The
+	* newer (renewal) one is set aside - it is not the node's current leaf until the node is
+	* seen presenting it, which reinstates it. It is NOT put on the CRL.
+	*/
+	async settleInterruptedRenewals() {
+		let settled = 0;
+		const byNode = /* @__PURE__ */ new Map();
+		for (const record of this.rows.values()) {
+			if (record.revokedAt !== null) continue;
+			byNode.set(record.nodeId, [...byNode.get(record.nodeId) ?? [], record]);
+		}
+		for (const records of byNode.values()) {
+			if (records.length < 2) continue;
+			for (const record of records) if (record.issuedVia === "renewal" && await this.abandon(record.fingerprint)) settled += 1;
+		}
+		return settled;
+	}
+	/** Set a never-completed renewal leaf aside (not current, NOT on the CRL). */
+	/** Fingerprints of renewal leaves whose handover is running right now (this process only). */
+	renewalsInFlight = /* @__PURE__ */ new Set();
+	/**
+	* A renewal's leaf is "in flight" from signing until the handover ends. While it is, a node seen
+	* presenting its OLD leaf is simply not swapped yet: the new leaf is not set aside (that would
+	* flap set-aside / reinstate on the node's first connection with it).
+	*/
+	beginRenewal(fingerprint) {
+		this.renewalsInFlight.add(fingerprint);
+	}
+	endRenewal(fingerprint) {
+		this.renewalsInFlight.delete(fingerprint);
+	}
+	async abandonRenewalsNewerThan(presented) {
+		let changed = false;
+		for (const record of this.liveFor(presented.nodeId)) {
+			if (record.fingerprint === presented.fingerprint) continue;
+			if (record.issuedVia !== "renewal" || record.issuedAt <= presented.issuedAt) continue;
+			if (this.renewalsInFlight.has(record.fingerprint)) continue;
+			if (await this.abandon(record.fingerprint)) changed = true;
+		}
+		return changed;
+	}
+	async abandon(fingerprint) {
+		const record = this.rows.get(fingerprint);
+		if (record === void 0 || record.revokedAt !== null) return false;
+		const abandoned = {
+			...record,
+			revokedAt: this.now(),
+			revokedReason: RENEWAL_ABANDONED
+		};
+		this.rows.set(fingerprint, abandoned);
+		await this.persist(abandoned);
+		this.deps.logger?.warn("Renewal leaf set aside (not current, not on the CRL)", {
+			tags: { nodeId: record.nodeId },
+			meta: { serial: record.serial }
+		});
+		return true;
+	}
+	/** Replay every persisted revocation into `crl` (hub boot). Set-aside leaves are not revocations. */
+	restoreCrl(crl) {
+		let restored = 0;
+		for (const record of this.rows.values()) {
+			if (record.revokedAt === null || record.revokedReason === "renewal-abandoned") continue;
+			crl.revoke(record.serial);
+			restored += 1;
+		}
+		return restored;
+	}
+	/** Is `serial` listed as revoked here? */
+	isRevoked(serial) {
+		const wanted = normalizeSerial(serial);
+		for (const record of this.rows.values()) if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned" && normalizeSerial(record.serial) === wanted) return true;
+		return false;
+	}
+	async reap() {
+		const cutoff = this.now() - RETENTION_MS;
+		const dead = [...this.rows.values()].filter((r) => (r.revokedAt ?? r.notAfter) < cutoff);
+		for (const r of dead) {
+			this.rows.delete(r.fingerprint);
+			await this.deleteRow(r.fingerprint);
+		}
+		return dead.length;
+	}
+	async insert(record) {
+		this.rows.set(record.fingerprint, record);
+		const kind = this.deps.meshKind ?? null;
+		if (kind !== null) {
+			const parsed = systemConfigRecordKinds["mesh-node-certificates"].schema.safeParse(this.recordToBody(record));
+			if (!parsed.success) throw new Error(parsed.error.message);
+			await kind.put({
+				id: record.fingerprint,
+				data: parsed.data
+			});
+			return;
+		}
+		await this.store.insert.mutate({
+			collection: MESH_NODE_CERTIFICATES_COLLECTION,
+			record: {
+				id: record.fingerprint,
+				data: { ...record }
+			}
+		});
+	}
+	async deleteRow(fingerprint) {
+		const kind = this.deps.meshKind ?? null;
+		if (kind !== null) {
+			await kind.delete(fingerprint);
+			return;
+		}
+		await this.store.delete.mutate({
+			collection: MESH_NODE_CERTIFICATES_COLLECTION,
+			key: fingerprint
+		});
+	}
+	async persist(record) {
+		try {
+			const kind = this.deps.meshKind ?? null;
+			if (kind !== null) {
+				const parsed = systemConfigRecordKinds["mesh-node-certificates"].schema.safeParse(this.recordToBody(record));
+				if (!parsed.success) throw new Error(parsed.error.message);
+				await kind.put({
+					id: record.fingerprint,
+					data: parsed.data
+				});
+				return;
+			}
+			await this.store.update.mutate({
+				collection: MESH_NODE_CERTIFICATES_COLLECTION,
+				id: record.fingerprint,
+				data: { ...record }
+			});
+		} catch (error) {
+			this.deps.logger?.error("Mesh certificate write failed - the change holds until restart", {
+				tags: { nodeId: record.nodeId },
+				meta: { error: error instanceof Error ? error.message : String(error) }
+			});
+		}
+	}
+};
+var SLOT$1 = Symbol.for("camstack.mesh.certificate-registry");
+function setProcessMeshCertificateRegistry(registry) {
+	if (registry === null) Reflect.deleteProperty(globalThis, SLOT$1);
+	else Reflect.set(globalThis, SLOT$1, registry);
+}
+function getProcessMeshCertificateRegistry() {
+	const value = Reflect.get(globalThis, SLOT$1);
+	return value !== null && typeof value === "object" && typeof Reflect.get(value, "recordIssued") === "function" ? value : null;
+}
+var MeshNodeCertificateBodySchema = z.object({
+	nodeId: z.string(),
+	serial: z.string(),
+	fingerprint: z.string(),
+	notBefore: z.number(),
+	notAfter: z.number(),
+	issuedAt: z.number(),
+	issuedVia: z.string(),
+	revokedAt: z.number().nullish(),
+	revokedReason: z.string().nullish()
+});
+var AgentHttpsNameBodySchema = z.object({
+	names: z.array(z.string()).readonly(),
+	issuedAt: z.number()
+});
+var _systemConfigRecordKinds = defineRecordKinds({
+	"mesh-node-certificates": {
+		schema: MeshNodeCertificateBodySchema,
+		class: "config",
+		writeTrigger: "mesh pairing, renewal, revocation (CRL mirror refreshed from rows)",
+		device: "none",
+		at: "none",
+		indexes: [{
+			name: "node",
+			fields: ["nodeId"]
+		}, {
+			name: "fingerprint",
+			fields: ["fingerprint"]
+		}],
+		retention: {
+			owner: "system-config",
+			reason: "daily reap removes revoked/expired rows older than 90 days"
+		},
+		adoptsFrom: MESH_NODE_CERTIFICATES_COLLECTION
+	},
+	"agent-https-names": {
+		schema: AgentHttpsNameBodySchema,
+		class: "config",
+		writeTrigger: "agent HTTPS certificate issuance records the CN/SAN set",
+		device: "none",
+		at: "none",
+		retention: { none: "one row per node id" },
+		adoptsFrom: AGENT_HTTPS_NAMES_COLLECTION
+	}
+});
+var systemConfigRecordKinds = _systemConfigRecordKinds;
+_systemConfigRecordKinds["mesh-node-certificates"];
+_systemConfigRecordKinds["agent-https-names"];
+//#endregion
+//#region src/tls/agent-https-names.ts
 var AGENT_HTTPS_NAMES_COLLECTION = "agent_https_names";
 var AGENT_HTTPS_NAMES_COLUMNS = [
 	{
@@ -33,23 +687,34 @@ var AGENT_HTTPS_NAMES_COLUMNS = [
 	}
 ];
 var AgentHttpsNames = class {
-	store;
 	byNode = /* @__PURE__ */ new Map();
-	constructor(store) {
-		this.store = store;
+	kind;
+	store;
+	constructor(deps) {
+		if ("agentHttpsNamesKind" in deps) {
+			this.kind = deps.agentHttpsNamesKind;
+			this.store = deps.legacyStore ?? null;
+		} else {
+			this.kind = null;
+			this.store = deps;
+		}
 	}
 	async load() {
+		const kind = this.kind;
+		if (kind !== null) {
+			const page = await kind.query({ limit: 1e4 });
+			for (const row of page.records) this.byNode.set(row.id, row.data.names.map((n) => n.toLowerCase()));
+			return;
+		}
 		const rows = await this.store.query.query({ collection: AGENT_HTTPS_NAMES_COLLECTION });
 		for (const row of rows) {
 			const names = row.data["names"];
 			if (Array.isArray(names)) this.byNode.set(row.id, names.filter((n) => typeof n === "string").map((n) => n.toLowerCase()));
 		}
 	}
-	/** The names certified to `nodeId` (its id and the address of its live mesh socket), or `null`. */
 	namesOf(nodeId) {
 		return this.byNode.get(nodeId) ?? null;
 	}
-	/** Every name certified to a node other than `nodeId`. */
 	takenByOthers(nodeId) {
 		const out = /* @__PURE__ */ new Set();
 		for (const [id, names] of this.byNode) {
@@ -58,9 +723,13 @@ var AgentHttpsNames = class {
 		}
 		return out;
 	}
-	/** Free every name certified to a node that was forgotten. */
 	async release(nodeId) {
 		if (!this.byNode.delete(nodeId)) return false;
+		const kind = this.kind;
+		if (kind !== null) {
+			await kind.delete(nodeId);
+			return true;
+		}
 		await this.store.delete.mutate({
 			collection: AGENT_HTTPS_NAMES_COLLECTION,
 			key: nodeId
@@ -71,9 +740,24 @@ var AgentHttpsNames = class {
 		const lowered = names.map((n) => n.toLowerCase());
 		const existed = this.byNode.has(nodeId);
 		this.byNode.set(nodeId, lowered);
+		const issuedAt = Date.now();
+		const body = {
+			names: lowered,
+			issuedAt
+		};
+		const kind = this.kind;
+		if (kind !== null) {
+			const parsed = systemConfigRecordKinds["agent-https-names"].schema.safeParse(body);
+			if (!parsed.success) throw new Error(parsed.error.message);
+			await kind.put({
+				id: nodeId,
+				data: parsed.data
+			});
+			return;
+		}
 		const data = {
 			names: lowered,
-			issuedAt: Date.now()
+			issuedAt
 		};
 		if (existed) await this.store.update.mutate({
 			collection: AGENT_HTTPS_NAMES_COLLECTION,
@@ -943,4 +1627,4 @@ function pemDigest(pem) {
 	return createHash("sha256").update(pem).digest("hex").slice(0, 16);
 }
 //#endregion
-export { isConstrainedCa as A, MAX_LEAF_VALIDITY_DAYS as C, PERMITTED_DNS_SUFFIXES as D, reasonRequiresNewCa as E, AGENT_HTTPS_NAMES_COLLECTION as F, AGENT_HTTPS_NAMES_COLUMNS as I, AgentHttpsNames as L, permitsIdentity as M, permitsName as N, PERMITTED_IP_RANGES as O, readNameConstraints as P, getProcessAgentHttpsNames as R, LEAF_RENEWAL_WINDOW_DAYS as S, evaluateExistingCert as T, issueLeaf as _, collectAgentNames as a, systemHostFacts as b, installAgentHttps as c, issueAgentHttpsLeaf as d, loadAgentHttps as f, generateCa as g, CA_COMMON_NAME as h, certificateNames as i, isLocalOnlyHostname as j, buildNameConstraintSet as k, isContainerBridgeAddress as l, pinnedHttpsCaFingerprint as m, acceptAgentSans as n, createAgentHttpsRequest as o, pemDigest as p, agentHttpsPaths as r, describeHttpsLeaf as s, AgentHttpsInstallError as t, isPrivateAddress as u, loadCa as v, SERVER_AUTH_OID as w, CA_VALIDITY_DAYS as x, collectCertIdentity as y, setProcessAgentHttpsNames as z };
+export { generateMeshKeyPair as $, isConstrainedCa as A, systemConfigRecordKinds as B, MAX_LEAF_VALIDITY_DAYS as C, PERMITTED_DNS_SUFFIXES as D, reasonRequiresNewCa as E, AGENT_HTTPS_NAMES_COLLECTION as F, describeMeshLeaf as G, MESH_NODE_CERTIFICATES_COLUMNS as H, AGENT_HTTPS_NAMES_COLUMNS as I, caFingerprint as J, getProcessMeshCertificateRegistry as K, AgentHttpsNames as L, permitsIdentity as M, permitsName as N, PERMITTED_IP_RANGES as O, readNameConstraints as P, generateMeshCa as Q, getProcessAgentHttpsNames as R, LEAF_RENEWAL_WINDOW_DAYS as S, evaluateExistingCert as T, MeshCertificateRegistry as U, MESH_NODE_CERTIFICATES_COLLECTION as V, RENEWAL_ABANDONED as W, createMeshCsrPem as X, caFingerprintCompact as Y, exportMeshPrivateKeyPem as Z, issueLeaf as _, collectAgentNames as a, systemHostFacts as b, installAgentHttps as c, issueAgentHttpsLeaf as d, isValidAgentNodeId as et, loadAgentHttps as f, generateCa as g, CA_COMMON_NAME as h, certificateNames as i, subjectCn as it, isLocalOnlyHostname as j, buildNameConstraintSet as k, isContainerBridgeAddress as l, pinnedHttpsCaFingerprint as m, acceptAgentSans as n, issueMeshLeafFromCsr as nt, createAgentHttpsRequest as o, pemDigest as p, setProcessMeshCertificateRegistry as q, agentHttpsPaths as r, loadMeshCa as rt, describeHttpsLeaf as s, AgentHttpsInstallError as t, issueMeshLeafForNode as tt, isPrivateAddress as u, loadCa as v, SERVER_AUTH_OID as w, CA_VALIDITY_DAYS as x, collectCertIdentity as y, setProcessAgentHttpsNames as z };