@camstack/system 1.2.457 → 1.2.459

package/dist/{agent-https-CoyOZ3pC.js → agent-https-Dnr_nIVx.js}

@@ -1,7 +1,6 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-C89nqNnn.js");
+const require_dist = require("./dist-Bn-RNanh.js");
 const require_x509_es = require("./x509.es-C4cOo48M.js");
-const require_constants = require("./constants-B_X9cWEK.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -10,615 +9,6 @@ let node_path = require("node:path");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");
-//#region src/kernel/moleculer/mesh-mtls/mesh-ca.ts
-/**
-* Hub mesh CA — EC P-256, key in the keychain, cert in `cluster.meshCa`.
-*
-* Distinct from the HTTPS local CA (`tls/cert-issue.ts`, RSA): the mesh CA
-* signs node leaves (CN = nodeID) and unlock-ticket JWS (ES256). Issuance uses
-* `@peculiar/x509` over WebCrypto — same library the HTTPS path already uses
-* (installed `1.14.3`; registry latest at adoption time was `2.1.0` — stay on
-* the pinned range already shipping).
-*/
-require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
-var MS_PER_DAY$2 = 864e5;
-/** Key generation — EC P-256 (plan). WebCrypto DOM names are not in @types/node. */
-var MESH_KEY_ALGORITHM = {
-	name: "ECDSA",
-	namedCurve: "P-256"
-};
-/** Signing — ECDSA with SHA-256. */
-var MESH_SIGNING_ALGORITHM = {
-	name: "ECDSA",
-	hash: "SHA-256"
-};
-/** A node id: letters, digits, `.`, `_`, `-`; at most 63 characters; starts with a letter or digit. */
-var NODE_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,62}$/i;
-/** Ids no agent may take: the hub's own, whatever the case (D857). */
-var RESERVED_NODE_IDS = new Set(["hub"]);
-/** True for an id an agent may carry: the pattern, and not a reserved name. */
-function isValidAgentNodeId(nodeId) {
-	return NODE_ID_PATTERN.test(nodeId) && !RESERVED_NODE_IDS.has(nodeId.toLowerCase());
-}
-function freshSerial$1() {
-	return `00${(0, node_crypto.randomBytes)(16).toString("hex")}`;
-}
-function toPkcs8Pem$1(pkcs8) {
-	return `${require_x509_es.PemConverter.encode(pkcs8, "PRIVATE KEY")}\n`;
-}
-function toCertPem$1(cert) {
-	return `${cert.toString("pem")}\n`;
-}
-async function exportKeyPem$1(key) {
-	return toPkcs8Pem$1(await node_crypto.webcrypto.subtle.exportKey("pkcs8", key));
-}
-/** SHA-256 fingerprint of the DER cert, colon-hex uppercase (Node style). */
-function caFingerprint(certPem) {
-	return new node_crypto.X509Certificate(certPem).fingerprint256;
-}
-/** Compact fingerprint (lowercase hex, no colons). */
-function caFingerprintCompact(certPem) {
-	return (0, node_crypto.createHash)("sha256").update(new node_crypto.X509Certificate(certPem).raw).digest("hex");
-}
-async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
-	const keys = await node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
-	const extensions = [
-		new require_x509_es.BasicConstraintsExtension(true, 0, true),
-		new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.keyCertSign | require_x509_es.KeyUsageFlags.cRLSign, true),
-		await require_x509_es.SubjectKeyIdentifierExtension.create(keys.publicKey)
-	];
-	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
-		serialNumber: freshSerial$1(),
-		name: `CN=${require_constants.MESH_CA_COMMON_NAME}`,
-		notBefore: require_x509_es.backdatedNotBefore(now),
-		notAfter: new Date(now.getTime() + require_constants.MESH_CA_VALIDITY_DAYS * MS_PER_DAY$2),
-		keys,
-		signingAlgorithm: MESH_SIGNING_ALGORITHM,
-		extensions
-	});
-	return {
-		certPem: toCertPem$1(cert),
-		keyPem: await exportKeyPem$1(keys.privateKey),
-		cert,
-		privateKey: keys.privateKey,
-		publicKey: keys.publicKey
-	};
-}
-async function loadMeshCa(certPem, keyPem) {
-	const cert = new require_x509_es.X509Certificate(certPem);
-	return {
-		certPem,
-		keyPem,
-		cert,
-		privateKey: await node_crypto.webcrypto.subtle.importKey("pkcs8", require_x509_es.PemConverter.decodeFirst(keyPem), MESH_KEY_ALGORITHM, true, ["sign"]),
-		publicKey: await cert.publicKey.export(node_crypto.webcrypto)
-	};
-}
-/**
-* Issue a leaf from a CSR. CN must be present; when `expectedNodeId` is set
-* it must match. Validity: 30 days.
-*/
-async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
-	const csr = new require_x509_es.Pkcs10CertificateRequest(csrPem);
-	if (!await csr.verify(node_crypto.webcrypto)) throw new Error("CSR signature is invalid");
-	const cn = subjectCn(csr.subject);
-	if (cn === null || cn.length === 0) throw new Error("CSR subject has no CN");
-	if (opts.allowReserved !== true && !isValidAgentNodeId(cn)) throw new Error(`CSR CN '${cn}' is not an id an agent may carry`);
-	if (opts.expectedNodeId !== void 0 && opts.expectedNodeId !== cn) throw new Error(`CSR CN '${cn}' does not match the token nodeId '${opts.expectedNodeId}'`);
-	const now = opts.now ?? /* @__PURE__ */ new Date();
-	const validDays = opts.validDays ?? 30;
-	const serialNumber = freshSerial$1();
-	const notAfter = new Date(now.getTime() + validDays * MS_PER_DAY$2);
-	const extensions = [
-		new require_x509_es.BasicConstraintsExtension(false, void 0, true),
-		new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.digitalSignature, true),
-		new require_x509_es.ExtendedKeyUsageExtension([require_constants.SERVER_AUTH_OID, require_constants.CLIENT_AUTH_OID]),
-		await require_x509_es.SubjectKeyIdentifierExtension.create(csr.publicKey),
-		await require_x509_es.AuthorityKeyIdentifierExtension.create(ca.cert)
-	];
-	return {
-		certPem: toCertPem$1(await require_x509_es.X509CertificateGenerator.create({
-			serialNumber,
-			subject: `CN=${cn}`,
-			issuer: ca.cert.subject,
-			notBefore: require_x509_es.backdatedNotBefore(now),
-			notAfter,
-			publicKey: csr.publicKey,
-			signingKey: ca.privateKey,
-			signingAlgorithm: MESH_SIGNING_ALGORITHM,
-			extensions
-		})),
-		serialNumber,
-		notAfter,
-		commonName: cn
-	};
-}
-/** Issue a leaf for a known nodeID with a freshly generated key pair (tests / hub self). */
-async function issueMeshLeafForNode(ca, nodeId, opts = {}) {
-	const keys = await node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
-	return {
-		...await issueMeshLeafFromCsr(ca, await createMeshCsrPem(keys, nodeId), {
-			expectedNodeId: nodeId,
-			now: opts.now,
-			validDays: opts.validDays,
-			allowReserved: true
-		}),
-		keyPem: await exportKeyPem$1(keys.privateKey)
-	};
-}
-function subjectCn(subject) {
-	return /(?:^|,)\s*CN\s*=\s*([^,]+)/i.exec(subject)?.[1]?.trim() ?? null;
-}
-async function createMeshCsrPem(keys, commonName) {
-	return `${(await require_x509_es.Pkcs10CertificateRequestGenerator.create({
-		name: `CN=${commonName}`,
-		keys,
-		signingAlgorithm: MESH_SIGNING_ALGORITHM
-	})).toString("pem")}\n`;
-}
-async function generateMeshKeyPair() {
-	return node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
-}
-async function exportMeshPrivateKeyPem(key) {
-	return exportKeyPem$1(key);
-}
-//#endregion
-//#region src/kernel/moleculer/mesh-mtls/mesh-certificate-registry.ts
-/**
-* The hub's record of every mesh leaf (D856): which certificate each node holds,
-* when it expires, and which serials are revoked.
-*
-* Three ways a row appears:
-*  - `enroll` / `renewal` / `boot` - the hub issued it and wrote it down at the
-*    moment of issuing (the authoritative record);
-*  - `observed` - a node enrolled before this record existed (or by a path that
-*    did not write it) presented this leaf on its LIVE mutual-TLS connection.
-*
-* Revoked serials are persisted here and replayed into the in-memory CRL at boot,
-* so a revocation survives a hub restart. Hub only: agents persist none of it.
-*/
-/**
-* @durable class=config owner=system-config
-*   write="the hub records every mesh leaf it issues (enroll, renewal, boot) and every
-*     leaf a connected node is observed presenting; a revocation stamps revokedAt"
-*   retention="a revoked or expired row is kept 90 days past its end, then reaped; a
-*     live row is never deleted. Forgetting a node does not delete its rows."
-*/
-var MESH_NODE_CERTIFICATES_COLLECTION = "mesh_node_certificates";
-var MESH_NODE_CERTIFICATES_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "nodeId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "serial",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "fingerprint",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "notBefore",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "notAfter",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "issuedAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "issuedVia",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "revokedAt",
-		type: "INTEGER"
-	},
-	{
-		name: "revokedReason",
-		type: "TEXT"
-	}
-];
-var RETENTION_MS = 90 * 864e5;
-/**
-* A leaf the hub signed for a renewal that did not complete. It must not be the node's
-* `current` leaf, but it is NOT on the CRL: the node may still hold it (the swap
-* could have landed without the hub seeing it), and cutting it off would be the
-* outage the hand-over exists to prevent. If the node is later seen presenting it, it
-* is reinstated.
-*/
-var RENEWAL_ABANDONED = "renewal-abandoned";
-var VIAS = [
-	"enroll",
-	"pairing",
-	"renewal",
-	"boot",
-	"observed"
-];
-/** CN, serial, fingerprint and validity of a leaf PEM (or DER). */
-function describeMeshLeaf(cert) {
-	const x509 = new node_crypto.X509Certificate(cert);
-	return {
-		cn: subjectCn(x509.subject) ?? "",
-		serial: x509.serialNumber,
-		fingerprint: x509.fingerprint256,
-		notBefore: Date.parse(x509.validFrom),
-		notAfter: Date.parse(x509.validTo)
-	};
-}
-function normalizeSerial(serial) {
-	return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
-}
-function parse$1(data) {
-	const str = (k) => {
-		const v = data[k];
-		return typeof v === "string" && v.length > 0 ? v : null;
-	};
-	const num = (k) => {
-		const v = data[k];
-		return typeof v === "number" && Number.isFinite(v) ? v : null;
-	};
-	const nodeId = str("nodeId");
-	const serial = str("serial");
-	const fingerprint = str("fingerprint");
-	const notBefore = num("notBefore");
-	const notAfter = num("notAfter");
-	const issuedAt = num("issuedAt");
-	if (nodeId === null || serial === null || fingerprint === null || notBefore === null || notAfter === null || issuedAt === null) return null;
-	return {
-		nodeId,
-		serial,
-		fingerprint,
-		notBefore,
-		notAfter,
-		issuedAt,
-		issuedVia: VIAS.find((v) => v === data["issuedVia"]) ?? "observed",
-		revokedAt: num("revokedAt"),
-		revokedReason: str("revokedReason")
-	};
-}
-var MeshCertificateRegistry = class {
-	store;
-	deps;
-	rows = /* @__PURE__ */ new Map();
-	constructor(store, deps = {}) {
-		this.store = store;
-		this.deps = deps;
-	}
-	recordToBody(record) {
-		return {
-			nodeId: record.nodeId,
-			serial: record.serial,
-			fingerprint: record.fingerprint,
-			notBefore: record.notBefore,
-			notAfter: record.notAfter,
-			issuedAt: record.issuedAt,
-			issuedVia: record.issuedVia,
-			revokedAt: record.revokedAt,
-			revokedReason: record.revokedReason
-		};
-	}
-	now() {
-		return (this.deps.now ?? Date.now)();
-	}
-	async load() {
-		const kind = this.deps.meshKind ?? null;
-		if (kind !== null) {
-			const page = await kind.query({ limit: 1e4 });
-			for (const row of page.records) {
-				const { fingerprint: _fp, ...body } = row.data;
-				const record = parse$1({
-					...body,
-					fingerprint: row.id
-				});
-				if (record !== null) this.rows.set(record.fingerprint, record);
-			}
-			return;
-		}
-		const rows = await this.store.query.query({ collection: MESH_NODE_CERTIFICATES_COLLECTION });
-		for (const row of rows) {
-			const record = parse$1(row.data);
-			if (record !== null) this.rows.set(record.fingerprint, record);
-		}
-	}
-	/** Write down a leaf the hub just issued. Idempotent per fingerprint. */
-	async recordIssued(nodeId, certPem, via) {
-		const leaf = describeMeshLeaf(certPem);
-		const existing = this.rows.get(leaf.fingerprint);
-		if (existing !== void 0) return existing;
-		const record = {
-			nodeId,
-			serial: leaf.serial,
-			fingerprint: leaf.fingerprint,
-			notBefore: leaf.notBefore,
-			notAfter: leaf.notAfter,
-			issuedAt: this.now(),
-			issuedVia: via,
-			revokedAt: null,
-			revokedReason: null
-		};
-		await this.insert(record);
-		this.deps.logger?.info("Mesh certificate recorded", {
-			tags: { nodeId },
-			meta: {
-				via,
-				serial: leaf.serial,
-				notAfter: new Date(leaf.notAfter).toISOString()
-			}
-		});
-		return record;
-	}
-	/**
-	* A node was seen presenting `leaf` on its live connection. A leaf the hub already
-	* knows is left alone; an unknown one is recorded `observed` (a node enrolled
-	* before this record existed).
-	*/
-	async recordObserved(nodeId, leaf) {
-		const known = this.rows.get(leaf.fingerprint);
-		if (known !== void 0) {
-			if (known.revokedReason !== "renewal-abandoned") return known.revokedAt === null ? this.abandonRenewalsNewerThan(known) : false;
-			const reinstated = {
-				...known,
-				revokedAt: null,
-				revokedReason: null
-			};
-			this.rows.set(known.fingerprint, reinstated);
-			await this.persist(reinstated);
-			this.deps.logger?.warn("An abandoned renewal leaf is in use - reinstated", {
-				tags: { nodeId },
-				meta: { serial: known.serial }
-			});
-			return true;
-		}
-		const record = {
-			nodeId,
-			serial: leaf.serial,
-			fingerprint: leaf.fingerprint,
-			notBefore: leaf.notBefore,
-			notAfter: leaf.notAfter,
-			issuedAt: this.now(),
-			issuedVia: "observed",
-			revokedAt: null,
-			revokedReason: null
-		};
-		await this.insert(record);
-		this.deps.logger?.info("Mesh certificate observed on a live connection and recorded", {
-			tags: { nodeId },
-			meta: {
-				serial: leaf.serial,
-				fingerprint: leaf.fingerprint
-			}
-		});
-		return true;
-	}
-	list(nodeId) {
-		return [...this.rows.values()].filter((r) => nodeId === void 0 || r.nodeId === nodeId).toSorted((a, b) => b.issuedAt - a.issuedAt);
-	}
-	/** The newest non-revoked leaf of a node, or `undefined`. */
-	currentFor(nodeId) {
-		return this.list(nodeId).find((r) => r.revokedAt === null);
-	}
-	/** Every non-revoked leaf of a node (a renewal in flight has two). */
-	liveFor(nodeId) {
-		return this.list(nodeId).filter((r) => r.revokedAt === null);
-	}
-	/** Stamp a leaf revoked (and mirror it into `crl`). `false` when unknown or already revoked. */
-	async revoke(fingerprint, reason, crl) {
-		const record = this.rows.get(fingerprint);
-		if (record === void 0 || record.revokedAt !== null) return false;
-		const revoked = {
-			...record,
-			revokedAt: this.now(),
-			revokedReason: reason
-		};
-		this.rows.set(fingerprint, revoked);
-		crl?.revoke(record.serial);
-		await this.persist(revoked);
-		this.deps.logger?.warn("Mesh certificate revoked", {
-			tags: { nodeId: record.nodeId },
-			meta: {
-				serial: record.serial,
-				reason
-			}
-		});
-		return true;
-	}
-	/**
-	* Operator revocation of a whole node: EVERY leaf of the node that is not already on the
-	* CRL goes on it - the current one, an observed one, a renewal one, and a leaf that was set
-	* aside (`renewal-abandoned`: a copy of it may sit on a stolen box, and it must not stay
-	* valid just because the hub once set it aside). Returns the serials put on the CRL.
-	* A leaf revoked this way is never reinstated by `recordObserved`.
-	*/
-	async revokeAllForNode(nodeId, reason, crl, keepFingerprint) {
-		const serials = [];
-		for (const record of this.list(nodeId)) {
-			if (keepFingerprint !== void 0 && record.fingerprint === keepFingerprint) continue;
-			if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned") continue;
-			const revoked = {
-				...record,
-				revokedAt: record.revokedAt ?? this.now(),
-				revokedReason: reason
-			};
-			this.rows.set(record.fingerprint, revoked);
-			crl.revoke(record.serial);
-			await this.persist(revoked);
-			serials.push(record.serial);
-		}
-		if (serials.length > 0) this.deps.logger?.warn("Every mesh certificate of the node revoked", {
-			tags: { nodeId },
-			meta: {
-				serials,
-				reason
-			}
-		});
-		return serials;
-	}
-	/**
-	* At boot: a node with TWO live leaves had a renewal in flight when the hub stopped. The
-	* newer (renewal) one is set aside - it is not the node's current leaf until the node is
-	* seen presenting it, which reinstates it. It is NOT put on the CRL.
-	*/
-	async settleInterruptedRenewals() {
-		let settled = 0;
-		const byNode = /* @__PURE__ */ new Map();
-		for (const record of this.rows.values()) {
-			if (record.revokedAt !== null) continue;
-			byNode.set(record.nodeId, [...byNode.get(record.nodeId) ?? [], record]);
-		}
-		for (const records of byNode.values()) {
-			if (records.length < 2) continue;
-			for (const record of records) if (record.issuedVia === "renewal" && await this.abandon(record.fingerprint)) settled += 1;
-		}
-		return settled;
-	}
-	/** Set a never-completed renewal leaf aside (not current, NOT on the CRL). */
-	/** Fingerprints of renewal leaves whose handover is running right now (this process only). */
-	renewalsInFlight = /* @__PURE__ */ new Set();
-	/**
-	* A renewal's leaf is "in flight" from signing until the handover ends. While it is, a node seen
-	* presenting its OLD leaf is simply not swapped yet: the new leaf is not set aside (that would
-	* flap set-aside / reinstate on the node's first connection with it).
-	*/
-	beginRenewal(fingerprint) {
-		this.renewalsInFlight.add(fingerprint);
-	}
-	endRenewal(fingerprint) {
-		this.renewalsInFlight.delete(fingerprint);
-	}
-	async abandonRenewalsNewerThan(presented) {
-		let changed = false;
-		for (const record of this.liveFor(presented.nodeId)) {
-			if (record.fingerprint === presented.fingerprint) continue;
-			if (record.issuedVia !== "renewal" || record.issuedAt <= presented.issuedAt) continue;
-			if (this.renewalsInFlight.has(record.fingerprint)) continue;
-			if (await this.abandon(record.fingerprint)) changed = true;
-		}
-		return changed;
-	}
-	async abandon(fingerprint) {
-		const record = this.rows.get(fingerprint);
-		if (record === void 0 || record.revokedAt !== null) return false;
-		const abandoned = {
-			...record,
-			revokedAt: this.now(),
-			revokedReason: RENEWAL_ABANDONED
-		};
-		this.rows.set(fingerprint, abandoned);
-		await this.persist(abandoned);
-		this.deps.logger?.warn("Renewal leaf set aside (not current, not on the CRL)", {
-			tags: { nodeId: record.nodeId },
-			meta: { serial: record.serial }
-		});
-		return true;
-	}
-	/** Replay every persisted revocation into `crl` (hub boot). Set-aside leaves are not revocations. */
-	restoreCrl(crl) {
-		let restored = 0;
-		for (const record of this.rows.values()) {
-			if (record.revokedAt === null || record.revokedReason === "renewal-abandoned") continue;
-			crl.revoke(record.serial);
-			restored += 1;
-		}
-		return restored;
-	}
-	/** Is `serial` listed as revoked here? */
-	isRevoked(serial) {
-		const wanted = normalizeSerial(serial);
-		for (const record of this.rows.values()) if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned" && normalizeSerial(record.serial) === wanted) return true;
-		return false;
-	}
-	async reap() {
-		const cutoff = this.now() - RETENTION_MS;
-		const dead = [...this.rows.values()].filter((r) => (r.revokedAt ?? r.notAfter) < cutoff);
-		for (const r of dead) {
-			this.rows.delete(r.fingerprint);
-			await this.deleteRow(r.fingerprint);
-		}
-		return dead.length;
-	}
-	async insert(record) {
-		this.rows.set(record.fingerprint, record);
-		const kind = this.deps.meshKind ?? null;
-		if (kind !== null) {
-			const parsed = systemConfigRecordKinds["mesh-node-certificates"].schema.safeParse(this.recordToBody(record));
-			if (!parsed.success) throw new Error(parsed.error.message);
-			await kind.put({
-				id: record.fingerprint,
-				data: parsed.data
-			});
-			return;
-		}
-		await this.store.insert.mutate({
-			collection: MESH_NODE_CERTIFICATES_COLLECTION,
-			record: {
-				id: record.fingerprint,
-				data: { ...record }
-			}
-		});
-	}
-	async deleteRow(fingerprint) {
-		const kind = this.deps.meshKind ?? null;
-		if (kind !== null) {
-			await kind.delete(fingerprint);
-			return;
-		}
-		await this.store.delete.mutate({
-			collection: MESH_NODE_CERTIFICATES_COLLECTION,
-			key: fingerprint
-		});
-	}
-	async persist(record) {
-		try {
-			const kind = this.deps.meshKind ?? null;
-			if (kind !== null) {
-				const parsed = systemConfigRecordKinds["mesh-node-certificates"].schema.safeParse(this.recordToBody(record));
-				if (!parsed.success) throw new Error(parsed.error.message);
-				await kind.put({
-					id: record.fingerprint,
-					data: parsed.data
-				});
-				return;
-			}
-			await this.store.update.mutate({
-				collection: MESH_NODE_CERTIFICATES_COLLECTION,
-				id: record.fingerprint,
-				data: { ...record }
-			});
-		} catch (error) {
-			this.deps.logger?.error("Mesh certificate write failed - the change holds until restart", {
-				tags: { nodeId: record.nodeId },
-				meta: { error: error instanceof Error ? error.message : String(error) }
-			});
-		}
-	}
-};
-var SLOT$1 = Symbol.for("camstack.mesh.certificate-registry");
-function setProcessMeshCertificateRegistry(registry) {
-	if (registry === null) Reflect.deleteProperty(globalThis, SLOT$1);
-	else Reflect.set(globalThis, SLOT$1, registry);
-}
-function getProcessMeshCertificateRegistry() {
-	const value = Reflect.get(globalThis, SLOT$1);
-	return value !== null && typeof value === "object" && typeof Reflect.get(value, "recordIssued") === "function" ? value : null;
-}
 var MeshNodeCertificateBodySchema = zod.z.object({
 	nodeId: zod.z.string(),
 	serial: zod.z.string(),
@@ -651,8 +41,7 @@ var _systemConfigRecordKinds = require_dist.defineRecordKinds({
 		retention: {
 			owner: "system-config",
 			reason: "daily reap removes revoked/expired rows older than 90 days"
-		},
-		adoptsFrom: MESH_NODE_CERTIFICATES_COLLECTION
+		}
 	},
 	"agent-https-names": {
 		schema: AgentHttpsNameBodySchema,
@@ -660,8 +49,7 @@ var _systemConfigRecordKinds = require_dist.defineRecordKinds({
 		writeTrigger: "agent HTTPS certificate issuance records the CN/SAN set",
 		device: "none",
 		at: "none",
-		retention: { none: "one row per node id" },
-		adoptsFrom: AGENT_HTTPS_NAMES_COLLECTION
+		retention: { none: "one row per node id" }
 	}
 });
 var systemConfigRecordKinds = _systemConfigRecordKinds;
@@ -1704,24 +1092,6 @@ Object.defineProperty(exports, "MAX_LEAF_VALIDITY_DAYS", {
 		return MAX_LEAF_VALIDITY_DAYS;
 	}
 });
-Object.defineProperty(exports, "MESH_NODE_CERTIFICATES_COLLECTION", {
-	enumerable: true,
-	get: function() {
-		return MESH_NODE_CERTIFICATES_COLLECTION;
-	}
-});
-Object.defineProperty(exports, "MESH_NODE_CERTIFICATES_COLUMNS", {
-	enumerable: true,
-	get: function() {
-		return MESH_NODE_CERTIFICATES_COLUMNS;
-	}
-});
-Object.defineProperty(exports, "MeshCertificateRegistry", {
-	enumerable: true,
-	get: function() {
-		return MeshCertificateRegistry;
-	}
-});
 Object.defineProperty(exports, "PERMITTED_DNS_SUFFIXES", {
 	enumerable: true,
 	get: function() {
@@ -1734,12 +1104,6 @@ Object.defineProperty(exports, "PERMITTED_IP_RANGES", {
 		return PERMITTED_IP_RANGES;
 	}
 });
-Object.defineProperty(exports, "RENEWAL_ABANDONED", {
-	enumerable: true,
-	get: function() {
-		return RENEWAL_ABANDONED;
-	}
-});
 Object.defineProperty(exports, "SERVER_AUTH_OID", {
 	enumerable: true,
 	get: function() {
@@ -1764,18 +1128,6 @@ Object.defineProperty(exports, "buildNameConstraintSet", {
 		return buildNameConstraintSet;
 	}
 });
-Object.defineProperty(exports, "caFingerprint", {
-	enumerable: true,
-	get: function() {
-		return caFingerprint;
-	}
-});
-Object.defineProperty(exports, "caFingerprintCompact", {
-	enumerable: true,
-	get: function() {
-		return caFingerprintCompact;
-	}
-});
 Object.defineProperty(exports, "certificateNames", {
 	enumerable: true,
 	get: function() {
@@ -1800,66 +1152,30 @@ Object.defineProperty(exports, "createAgentHttpsRequest", {
 		return createAgentHttpsRequest;
 	}
 });
-Object.defineProperty(exports, "createMeshCsrPem", {
-	enumerable: true,
-	get: function() {
-		return createMeshCsrPem;
-	}
-});
 Object.defineProperty(exports, "describeHttpsLeaf", {
 	enumerable: true,
 	get: function() {
 		return describeHttpsLeaf;
 	}
 });
-Object.defineProperty(exports, "describeMeshLeaf", {
-	enumerable: true,
-	get: function() {
-		return describeMeshLeaf;
-	}
-});
 Object.defineProperty(exports, "evaluateExistingCert", {
 	enumerable: true,
 	get: function() {
 		return evaluateExistingCert;
 	}
 });
-Object.defineProperty(exports, "exportMeshPrivateKeyPem", {
-	enumerable: true,
-	get: function() {
-		return exportMeshPrivateKeyPem;
-	}
-});
 Object.defineProperty(exports, "generateCa", {
 	enumerable: true,
 	get: function() {
 		return generateCa;
 	}
 });
-Object.defineProperty(exports, "generateMeshCa", {
-	enumerable: true,
-	get: function() {
-		return generateMeshCa;
-	}
-});
-Object.defineProperty(exports, "generateMeshKeyPair", {
-	enumerable: true,
-	get: function() {
-		return generateMeshKeyPair;
-	}
-});
 Object.defineProperty(exports, "getProcessAgentHttpsNames", {
 	enumerable: true,
 	get: function() {
 		return getProcessAgentHttpsNames;
 	}
 });
-Object.defineProperty(exports, "getProcessMeshCertificateRegistry", {
-	enumerable: true,
-	get: function() {
-		return getProcessMeshCertificateRegistry;
-	}
-});
 Object.defineProperty(exports, "installAgentHttps", {
 	enumerable: true,
 	get: function() {
@@ -1890,12 +1206,6 @@ Object.defineProperty(exports, "isPrivateAddress", {
 		return isPrivateAddress;
 	}
 });
-Object.defineProperty(exports, "isValidAgentNodeId", {
-	enumerable: true,
-	get: function() {
-		return isValidAgentNodeId;
-	}
-});
 Object.defineProperty(exports, "issueAgentHttpsLeaf", {
 	enumerable: true,
 	get: function() {
@@ -1908,18 +1218,6 @@ Object.defineProperty(exports, "issueLeaf", {
 		return issueLeaf;
 	}
 });
-Object.defineProperty(exports, "issueMeshLeafForNode", {
-	enumerable: true,
-	get: function() {
-		return issueMeshLeafForNode;
-	}
-});
-Object.defineProperty(exports, "issueMeshLeafFromCsr", {
-	enumerable: true,
-	get: function() {
-		return issueMeshLeafFromCsr;
-	}
-});
 Object.defineProperty(exports, "loadAgentHttps", {
 	enumerable: true,
 	get: function() {
@@ -1932,12 +1230,6 @@ Object.defineProperty(exports, "loadCa", {
 		return loadCa;
 	}
 });
-Object.defineProperty(exports, "loadMeshCa", {
-	enumerable: true,
-	get: function() {
-		return loadMeshCa;
-	}
-});
 Object.defineProperty(exports, "localCaCommonName", {
 	enumerable: true,
 	get: function() {
@@ -1986,18 +1278,6 @@ Object.defineProperty(exports, "setProcessAgentHttpsNames", {
 		return setProcessAgentHttpsNames;
 	}
 });
-Object.defineProperty(exports, "setProcessMeshCertificateRegistry", {
-	enumerable: true,
-	get: function() {
-		return setProcessMeshCertificateRegistry;
-	}
-});
-Object.defineProperty(exports, "subjectCn", {
-	enumerable: true,
-	get: function() {
-		return subjectCn;
-	}
-});
 Object.defineProperty(exports, "systemConfigRecordKinds", {
 	enumerable: true,
 	get: function() {