@camstack/system 1.2.458 → 1.2.459

package/dist/{agent-https-CQA3W-3e.mjs → agent-https-Iw3RSQup.mjs}

@@ -1,6 +1,5 @@
-import { Ki as defineRecordKinds } from "./dist-B_GRPhnY.mjs";
+import { Gi as defineRecordKinds } from "./dist-Wy8cTxg6.mjs";
 import { S as backdatedNotBefore, _ as NameConstraints, a as KeyUsageFlags, c as Pkcs10CertificateRequest, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, g as GeneralSubtrees, h as GeneralSubtree, i as Extension, l as Pkcs10CertificateRequestGenerator, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension, u as SubjectAlternativeNameExtension, v as GeneralName, x as AsnConvert } from "./x509.es-DK__ETIe.mjs";
-import { c as SERVER_AUTH_OID$1, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "./constants-FGjnsE2x.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createPrivateKey, randomBytes, webcrypto } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
@@ -8,615 +7,6 @@ import { isIP } from "node:net";
 import { join } from "node:path";
 import * as os$1 from "node:os";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-//#region src/kernel/moleculer/mesh-mtls/mesh-ca.ts
-/**
-* Hub mesh CA — EC P-256, key in the keychain, cert in `cluster.meshCa`.
-*
-* Distinct from the HTTPS local CA (`tls/cert-issue.ts`, RSA): the mesh CA
-* signs node leaves (CN = nodeID) and unlock-ticket JWS (ES256). Issuance uses
-* `@peculiar/x509` over WebCrypto — same library the HTTPS path already uses
-* (installed `1.14.3`; registry latest at adoption time was `2.1.0` — stay on
-* the pinned range already shipping).
-*/
-cryptoProvider.set(webcrypto);
-var MS_PER_DAY$2 = 864e5;
-/** Key generation — EC P-256 (plan). WebCrypto DOM names are not in @types/node. */
-var MESH_KEY_ALGORITHM = {
-	name: "ECDSA",
-	namedCurve: "P-256"
-};
-/** Signing — ECDSA with SHA-256. */
-var MESH_SIGNING_ALGORITHM = {
-	name: "ECDSA",
-	hash: "SHA-256"
-};
-/** A node id: letters, digits, `.`, `_`, `-`; at most 63 characters; starts with a letter or digit. */
-var NODE_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,62}$/i;
-/** Ids no agent may take: the hub's own, whatever the case (D857). */
-var RESERVED_NODE_IDS = new Set(["hub"]);
-/** True for an id an agent may carry: the pattern, and not a reserved name. */
-function isValidAgentNodeId(nodeId) {
-	return NODE_ID_PATTERN.test(nodeId) && !RESERVED_NODE_IDS.has(nodeId.toLowerCase());
-}
-function freshSerial$1() {
-	return `00${randomBytes(16).toString("hex")}`;
-}
-function toPkcs8Pem$1(pkcs8) {
-	return `${PemConverter.encode(pkcs8, "PRIVATE KEY")}\n`;
-}
-function toCertPem$1(cert) {
-	return `${cert.toString("pem")}\n`;
-}
-async function exportKeyPem$1(key) {
-	return toPkcs8Pem$1(await webcrypto.subtle.exportKey("pkcs8", key));
-}
-/** SHA-256 fingerprint of the DER cert, colon-hex uppercase (Node style). */
-function caFingerprint(certPem) {
-	return new X509Certificate(certPem).fingerprint256;
-}
-/** Compact fingerprint (lowercase hex, no colons). */
-function caFingerprintCompact(certPem) {
-	return createHash("sha256").update(new X509Certificate(certPem).raw).digest("hex");
-}
-async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
-	const keys = await webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
-	const extensions = [
-		new BasicConstraintsExtension(true, 0, true),
-		new KeyUsagesExtension(KeyUsageFlags.keyCertSign | KeyUsageFlags.cRLSign, true),
-		await SubjectKeyIdentifierExtension.create(keys.publicKey)
-	];
-	const cert = await X509CertificateGenerator.createSelfSigned({
-		serialNumber: freshSerial$1(),
-		name: `CN=${MESH_CA_COMMON_NAME}`,
-		notBefore: backdatedNotBefore(now),
-		notAfter: new Date(now.getTime() + MESH_CA_VALIDITY_DAYS * MS_PER_DAY$2),
-		keys,
-		signingAlgorithm: MESH_SIGNING_ALGORITHM,
-		extensions
-	});
-	return {
-		certPem: toCertPem$1(cert),
-		keyPem: await exportKeyPem$1(keys.privateKey),
-		cert,
-		privateKey: keys.privateKey,
-		publicKey: keys.publicKey
-	};
-}
-async function loadMeshCa(certPem, keyPem) {
-	const cert = new X509Certificate$1(certPem);
-	return {
-		certPem,
-		keyPem,
-		cert,
-		privateKey: await webcrypto.subtle.importKey("pkcs8", PemConverter.decodeFirst(keyPem), MESH_KEY_ALGORITHM, true, ["sign"]),
-		publicKey: await cert.publicKey.export(webcrypto)
-	};
-}
-/**
-* Issue a leaf from a CSR. CN must be present; when `expectedNodeId` is set
-* it must match. Validity: 30 days.
-*/
-async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
-	const csr = new Pkcs10CertificateRequest(csrPem);
-	if (!await csr.verify(webcrypto)) throw new Error("CSR signature is invalid");
-	const cn = subjectCn(csr.subject);
-	if (cn === null || cn.length === 0) throw new Error("CSR subject has no CN");
-	if (opts.allowReserved !== true && !isValidAgentNodeId(cn)) throw new Error(`CSR CN '${cn}' is not an id an agent may carry`);
-	if (opts.expectedNodeId !== void 0 && opts.expectedNodeId !== cn) throw new Error(`CSR CN '${cn}' does not match the token nodeId '${opts.expectedNodeId}'`);
-	const now = opts.now ?? /* @__PURE__ */ new Date();
-	const validDays = opts.validDays ?? 30;
-	const serialNumber = freshSerial$1();
-	const notAfter = new Date(now.getTime() + validDays * MS_PER_DAY$2);
-	const extensions = [
-		new BasicConstraintsExtension(false, void 0, true),
-		new KeyUsagesExtension(KeyUsageFlags.digitalSignature, true),
-		new ExtendedKeyUsageExtension([SERVER_AUTH_OID$1, CLIENT_AUTH_OID]),
-		await SubjectKeyIdentifierExtension.create(csr.publicKey),
-		await AuthorityKeyIdentifierExtension.create(ca.cert)
-	];
-	return {
-		certPem: toCertPem$1(await X509CertificateGenerator.create({
-			serialNumber,
-			subject: `CN=${cn}`,
-			issuer: ca.cert.subject,
-			notBefore: backdatedNotBefore(now),
-			notAfter,
-			publicKey: csr.publicKey,
-			signingKey: ca.privateKey,
-			signingAlgorithm: MESH_SIGNING_ALGORITHM,
-			extensions
-		})),
-		serialNumber,
-		notAfter,
-		commonName: cn
-	};
-}
-/** Issue a leaf for a known nodeID with a freshly generated key pair (tests / hub self). */
-async function issueMeshLeafForNode(ca, nodeId, opts = {}) {
-	const keys = await webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
-	return {
-		...await issueMeshLeafFromCsr(ca, await createMeshCsrPem(keys, nodeId), {
-			expectedNodeId: nodeId,
-			now: opts.now,
-			validDays: opts.validDays,
-			allowReserved: true
-		}),
-		keyPem: await exportKeyPem$1(keys.privateKey)
-	};
-}
-function subjectCn(subject) {
-	return /(?:^|,)\s*CN\s*=\s*([^,]+)/i.exec(subject)?.[1]?.trim() ?? null;
-}
-async function createMeshCsrPem(keys, commonName) {
-	return `${(await Pkcs10CertificateRequestGenerator.create({
-		name: `CN=${commonName}`,
-		keys,
-		signingAlgorithm: MESH_SIGNING_ALGORITHM
-	})).toString("pem")}\n`;
-}
-async function generateMeshKeyPair() {
-	return webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
-}
-async function exportMeshPrivateKeyPem(key) {
-	return exportKeyPem$1(key);
-}
-//#endregion
-//#region src/kernel/moleculer/mesh-mtls/mesh-certificate-registry.ts
-/**
-* The hub's record of every mesh leaf (D856): which certificate each node holds,
-* when it expires, and which serials are revoked.
-*
-* Three ways a row appears:
-*  - `enroll` / `renewal` / `boot` - the hub issued it and wrote it down at the
-*    moment of issuing (the authoritative record);
-*  - `observed` - a node enrolled before this record existed (or by a path that
-*    did not write it) presented this leaf on its LIVE mutual-TLS connection.
-*
-* Revoked serials are persisted here and replayed into the in-memory CRL at boot,
-* so a revocation survives a hub restart. Hub only: agents persist none of it.
-*/
-/**
-* @durable class=config owner=system-config
-*   write="the hub records every mesh leaf it issues (enroll, renewal, boot) and every
-*     leaf a connected node is observed presenting; a revocation stamps revokedAt"
-*   retention="a revoked or expired row is kept 90 days past its end, then reaped; a
-*     live row is never deleted. Forgetting a node does not delete its rows."
-*/
-var MESH_NODE_CERTIFICATES_COLLECTION = "mesh_node_certificates";
-var MESH_NODE_CERTIFICATES_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "nodeId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "serial",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "fingerprint",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "notBefore",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "notAfter",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "issuedAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "issuedVia",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "revokedAt",
-		type: "INTEGER"
-	},
-	{
-		name: "revokedReason",
-		type: "TEXT"
-	}
-];
-var RETENTION_MS = 90 * 864e5;
-/**
-* A leaf the hub signed for a renewal that did not complete. It must not be the node's
-* `current` leaf, but it is NOT on the CRL: the node may still hold it (the swap
-* could have landed without the hub seeing it), and cutting it off would be the
-* outage the hand-over exists to prevent. If the node is later seen presenting it, it
-* is reinstated.
-*/
-var RENEWAL_ABANDONED = "renewal-abandoned";
-var VIAS = [
-	"enroll",
-	"pairing",
-	"renewal",
-	"boot",
-	"observed"
-];
-/** CN, serial, fingerprint and validity of a leaf PEM (or DER). */
-function describeMeshLeaf(cert) {
-	const x509 = new X509Certificate(cert);
-	return {
-		cn: subjectCn(x509.subject) ?? "",
-		serial: x509.serialNumber,
-		fingerprint: x509.fingerprint256,
-		notBefore: Date.parse(x509.validFrom),
-		notAfter: Date.parse(x509.validTo)
-	};
-}
-function normalizeSerial(serial) {
-	return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
-}
-function parse$1(data) {
-	const str = (k) => {
-		const v = data[k];
-		return typeof v === "string" && v.length > 0 ? v : null;
-	};
-	const num = (k) => {
-		const v = data[k];
-		return typeof v === "number" && Number.isFinite(v) ? v : null;
-	};
-	const nodeId = str("nodeId");
-	const serial = str("serial");
-	const fingerprint = str("fingerprint");
-	const notBefore = num("notBefore");
-	const notAfter = num("notAfter");
-	const issuedAt = num("issuedAt");
-	if (nodeId === null || serial === null || fingerprint === null || notBefore === null || notAfter === null || issuedAt === null) return null;
-	return {
-		nodeId,
-		serial,
-		fingerprint,
-		notBefore,
-		notAfter,
-		issuedAt,
-		issuedVia: VIAS.find((v) => v === data["issuedVia"]) ?? "observed",
-		revokedAt: num("revokedAt"),
-		revokedReason: str("revokedReason")
-	};
-}
-var MeshCertificateRegistry = class {
-	store;
-	deps;
-	rows = /* @__PURE__ */ new Map();
-	constructor(store, deps = {}) {
-		this.store = store;
-		this.deps = deps;
-	}
-	recordToBody(record) {
-		return {
-			nodeId: record.nodeId,
-			serial: record.serial,
-			fingerprint: record.fingerprint,
-			notBefore: record.notBefore,
-			notAfter: record.notAfter,
-			issuedAt: record.issuedAt,
-			issuedVia: record.issuedVia,
-			revokedAt: record.revokedAt,
-			revokedReason: record.revokedReason
-		};
-	}
-	now() {
-		return (this.deps.now ?? Date.now)();
-	}
-	async load() {
-		const kind = this.deps.meshKind ?? null;
-		if (kind !== null) {
-			const page = await kind.query({ limit: 1e4 });
-			for (const row of page.records) {
-				const { fingerprint: _fp, ...body } = row.data;
-				const record = parse$1({
-					...body,
-					fingerprint: row.id
-				});
-				if (record !== null) this.rows.set(record.fingerprint, record);
-			}
-			return;
-		}
-		const rows = await this.store.query.query({ collection: MESH_NODE_CERTIFICATES_COLLECTION });
-		for (const row of rows) {
-			const record = parse$1(row.data);
-			if (record !== null) this.rows.set(record.fingerprint, record);
-		}
-	}
-	/** Write down a leaf the hub just issued. Idempotent per fingerprint. */
-	async recordIssued(nodeId, certPem, via) {
-		const leaf = describeMeshLeaf(certPem);
-		const existing = this.rows.get(leaf.fingerprint);
-		if (existing !== void 0) return existing;
-		const record = {
-			nodeId,
-			serial: leaf.serial,
-			fingerprint: leaf.fingerprint,
-			notBefore: leaf.notBefore,
-			notAfter: leaf.notAfter,
-			issuedAt: this.now(),
-			issuedVia: via,
-			revokedAt: null,
-			revokedReason: null
-		};
-		await this.insert(record);
-		this.deps.logger?.info("Mesh certificate recorded", {
-			tags: { nodeId },
-			meta: {
-				via,
-				serial: leaf.serial,
-				notAfter: new Date(leaf.notAfter).toISOString()
-			}
-		});
-		return record;
-	}
-	/**
-	* A node was seen presenting `leaf` on its live connection. A leaf the hub already
-	* knows is left alone; an unknown one is recorded `observed` (a node enrolled
-	* before this record existed).
-	*/
-	async recordObserved(nodeId, leaf) {
-		const known = this.rows.get(leaf.fingerprint);
-		if (known !== void 0) {
-			if (known.revokedReason !== "renewal-abandoned") return known.revokedAt === null ? this.abandonRenewalsNewerThan(known) : false;
-			const reinstated = {
-				...known,
-				revokedAt: null,
-				revokedReason: null
-			};
-			this.rows.set(known.fingerprint, reinstated);
-			await this.persist(reinstated);
-			this.deps.logger?.warn("An abandoned renewal leaf is in use - reinstated", {
-				tags: { nodeId },
-				meta: { serial: known.serial }
-			});
-			return true;
-		}
-		const record = {
-			nodeId,
-			serial: leaf.serial,
-			fingerprint: leaf.fingerprint,
-			notBefore: leaf.notBefore,
-			notAfter: leaf.notAfter,
-			issuedAt: this.now(),
-			issuedVia: "observed",
-			revokedAt: null,
-			revokedReason: null
-		};
-		await this.insert(record);
-		this.deps.logger?.info("Mesh certificate observed on a live connection and recorded", {
-			tags: { nodeId },
-			meta: {
-				serial: leaf.serial,
-				fingerprint: leaf.fingerprint
-			}
-		});
-		return true;
-	}
-	list(nodeId) {
-		return [...this.rows.values()].filter((r) => nodeId === void 0 || r.nodeId === nodeId).toSorted((a, b) => b.issuedAt - a.issuedAt);
-	}
-	/** The newest non-revoked leaf of a node, or `undefined`. */
-	currentFor(nodeId) {
-		return this.list(nodeId).find((r) => r.revokedAt === null);
-	}
-	/** Every non-revoked leaf of a node (a renewal in flight has two). */
-	liveFor(nodeId) {
-		return this.list(nodeId).filter((r) => r.revokedAt === null);
-	}
-	/** Stamp a leaf revoked (and mirror it into `crl`). `false` when unknown or already revoked. */
-	async revoke(fingerprint, reason, crl) {
-		const record = this.rows.get(fingerprint);
-		if (record === void 0 || record.revokedAt !== null) return false;
-		const revoked = {
-			...record,
-			revokedAt: this.now(),
-			revokedReason: reason
-		};
-		this.rows.set(fingerprint, revoked);
-		crl?.revoke(record.serial);
-		await this.persist(revoked);
-		this.deps.logger?.warn("Mesh certificate revoked", {
-			tags: { nodeId: record.nodeId },
-			meta: {
-				serial: record.serial,
-				reason
-			}
-		});
-		return true;
-	}
-	/**
-	* Operator revocation of a whole node: EVERY leaf of the node that is not already on the
-	* CRL goes on it - the current one, an observed one, a renewal one, and a leaf that was set
-	* aside (`renewal-abandoned`: a copy of it may sit on a stolen box, and it must not stay
-	* valid just because the hub once set it aside). Returns the serials put on the CRL.
-	* A leaf revoked this way is never reinstated by `recordObserved`.
-	*/
-	async revokeAllForNode(nodeId, reason, crl, keepFingerprint) {
-		const serials = [];
-		for (const record of this.list(nodeId)) {
-			if (keepFingerprint !== void 0 && record.fingerprint === keepFingerprint) continue;
-			if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned") continue;
-			const revoked = {
-				...record,
-				revokedAt: record.revokedAt ?? this.now(),
-				revokedReason: reason
-			};
-			this.rows.set(record.fingerprint, revoked);
-			crl.revoke(record.serial);
-			await this.persist(revoked);
-			serials.push(record.serial);
-		}
-		if (serials.length > 0) this.deps.logger?.warn("Every mesh certificate of the node revoked", {
-			tags: { nodeId },
-			meta: {
-				serials,
-				reason
-			}
-		});
-		return serials;
-	}
-	/**
-	* At boot: a node with TWO live leaves had a renewal in flight when the hub stopped. The
-	* newer (renewal) one is set aside - it is not the node's current leaf until the node is
-	* seen presenting it, which reinstates it. It is NOT put on the CRL.
-	*/
-	async settleInterruptedRenewals() {
-		let settled = 0;
-		const byNode = /* @__PURE__ */ new Map();
-		for (const record of this.rows.values()) {
-			if (record.revokedAt !== null) continue;
-			byNode.set(record.nodeId, [...byNode.get(record.nodeId) ?? [], record]);
-		}
-		for (const records of byNode.values()) {
-			if (records.length < 2) continue;
-			for (const record of records) if (record.issuedVia === "renewal" && await this.abandon(record.fingerprint)) settled += 1;
-		}
-		return settled;
-	}
-	/** Set a never-completed renewal leaf aside (not current, NOT on the CRL). */
-	/** Fingerprints of renewal leaves whose handover is running right now (this process only). */
-	renewalsInFlight = /* @__PURE__ */ new Set();
-	/**
-	* A renewal's leaf is "in flight" from signing until the handover ends. While it is, a node seen
-	* presenting its OLD leaf is simply not swapped yet: the new leaf is not set aside (that would
-	* flap set-aside / reinstate on the node's first connection with it).
-	*/
-	beginRenewal(fingerprint) {
-		this.renewalsInFlight.add(fingerprint);
-	}
-	endRenewal(fingerprint) {
-		this.renewalsInFlight.delete(fingerprint);
-	}
-	async abandonRenewalsNewerThan(presented) {
-		let changed = false;
-		for (const record of this.liveFor(presented.nodeId)) {
-			if (record.fingerprint === presented.fingerprint) continue;
-			if (record.issuedVia !== "renewal" || record.issuedAt <= presented.issuedAt) continue;
-			if (this.renewalsInFlight.has(record.fingerprint)) continue;
-			if (await this.abandon(record.fingerprint)) changed = true;
-		}
-		return changed;
-	}
-	async abandon(fingerprint) {
-		const record = this.rows.get(fingerprint);
-		if (record === void 0 || record.revokedAt !== null) return false;
-		const abandoned = {
-			...record,
-			revokedAt: this.now(),
-			revokedReason: RENEWAL_ABANDONED
-		};
-		this.rows.set(fingerprint, abandoned);
-		await this.persist(abandoned);
-		this.deps.logger?.warn("Renewal leaf set aside (not current, not on the CRL)", {
-			tags: { nodeId: record.nodeId },
-			meta: { serial: record.serial }
-		});
-		return true;
-	}
-	/** Replay every persisted revocation into `crl` (hub boot). Set-aside leaves are not revocations. */
-	restoreCrl(crl) {
-		let restored = 0;
-		for (const record of this.rows.values()) {
-			if (record.revokedAt === null || record.revokedReason === "renewal-abandoned") continue;
-			crl.revoke(record.serial);
-			restored += 1;
-		}
-		return restored;
-	}
-	/** Is `serial` listed as revoked here? */
-	isRevoked(serial) {
-		const wanted = normalizeSerial(serial);
-		for (const record of this.rows.values()) if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned" && normalizeSerial(record.serial) === wanted) return true;
-		return false;
-	}
-	async reap() {
-		const cutoff = this.now() - RETENTION_MS;
-		const dead = [...this.rows.values()].filter((r) => (r.revokedAt ?? r.notAfter) < cutoff);
-		for (const r of dead) {
-			this.rows.delete(r.fingerprint);
-			await this.deleteRow(r.fingerprint);
-		}
-		return dead.length;
-	}
-	async insert(record) {
-		this.rows.set(record.fingerprint, record);
-		const kind = this.deps.meshKind ?? null;
-		if (kind !== null) {
-			const parsed = systemConfigRecordKinds["mesh-node-certificates"].schema.safeParse(this.recordToBody(record));
-			if (!parsed.success) throw new Error(parsed.error.message);
-			await kind.put({
-				id: record.fingerprint,
-				data: parsed.data
-			});
-			return;
-		}
-		await this.store.insert.mutate({
-			collection: MESH_NODE_CERTIFICATES_COLLECTION,
-			record: {
-				id: record.fingerprint,
-				data: { ...record }
-			}
-		});
-	}
-	async deleteRow(fingerprint) {
-		const kind = this.deps.meshKind ?? null;
-		if (kind !== null) {
-			await kind.delete(fingerprint);
-			return;
-		}
-		await this.store.delete.mutate({
-			collection: MESH_NODE_CERTIFICATES_COLLECTION,
-			key: fingerprint
-		});
-	}
-	async persist(record) {
-		try {
-			const kind = this.deps.meshKind ?? null;
-			if (kind !== null) {
-				const parsed = systemConfigRecordKinds["mesh-node-certificates"].schema.safeParse(this.recordToBody(record));
-				if (!parsed.success) throw new Error(parsed.error.message);
-				await kind.put({
-					id: record.fingerprint,
-					data: parsed.data
-				});
-				return;
-			}
-			await this.store.update.mutate({
-				collection: MESH_NODE_CERTIFICATES_COLLECTION,
-				id: record.fingerprint,
-				data: { ...record }
-			});
-		} catch (error) {
-			this.deps.logger?.error("Mesh certificate write failed - the change holds until restart", {
-				tags: { nodeId: record.nodeId },
-				meta: { error: error instanceof Error ? error.message : String(error) }
-			});
-		}
-	}
-};
-var SLOT$1 = Symbol.for("camstack.mesh.certificate-registry");
-function setProcessMeshCertificateRegistry(registry) {
-	if (registry === null) Reflect.deleteProperty(globalThis, SLOT$1);
-	else Reflect.set(globalThis, SLOT$1, registry);
-}
-function getProcessMeshCertificateRegistry() {
-	const value = Reflect.get(globalThis, SLOT$1);
-	return value !== null && typeof value === "object" && typeof Reflect.get(value, "recordIssued") === "function" ? value : null;
-}
 var MeshNodeCertificateBodySchema = z.object({
 	nodeId: z.string(),
 	serial: z.string(),
@@ -649,8 +39,7 @@ var _systemConfigRecordKinds = defineRecordKinds({
 		retention: {
 			owner: "system-config",
 			reason: "daily reap removes revoked/expired rows older than 90 days"
-		},
-		adoptsFrom: MESH_NODE_CERTIFICATES_COLLECTION
+		}
 	},
 	"agent-https-names": {
 		schema: AgentHttpsNameBodySchema,
@@ -658,8 +47,7 @@ var _systemConfigRecordKinds = defineRecordKinds({
 		writeTrigger: "agent HTTPS certificate issuance records the CN/SAN set",
 		device: "none",
 		at: "none",
-		retention: { none: "one row per node id" },
-		adoptsFrom: AGENT_HTTPS_NAMES_COLLECTION
+		retention: { none: "one row per node id" }
 	}
 });
 var systemConfigRecordKinds = _systemConfigRecordKinds;
@@ -1654,4 +1042,4 @@ function pemDigest(pem) {
 	return createHash("sha256").update(pem).digest("hex").slice(0, 16);
 }
 //#endregion
-export { generateMeshCa as $, buildNameConstraintSet as A, setProcessAgentHttpsNames as B, LEAF_RENEWAL_WINDOW_DAYS as C, reasonRequiresNewCa as D, evaluateExistingCert as E, readNameConstraints as F, RENEWAL_ABANDONED as G, MESH_NODE_CERTIFICATES_COLLECTION as H, AGENT_HTTPS_NAMES_COLLECTION as I, setProcessMeshCertificateRegistry as J, describeMeshLeaf as K, AGENT_HTTPS_NAMES_COLUMNS as L, isLocalOnlyHostname as M, permitsIdentity as N, PERMITTED_DNS_SUFFIXES as O, permitsName as P, exportMeshPrivateKeyPem as Q, AgentHttpsNames as R, CA_VALIDITY_DAYS as S, SERVER_AUTH_OID as T, MESH_NODE_CERTIFICATES_COLUMNS as U, systemConfigRecordKinds as V, MeshCertificateRegistry as W, caFingerprintCompact as X, caFingerprint as Y, createMeshCsrPem as Z, issueLeaf as _, collectAgentNames as a, subjectCn as at, collectCertIdentity as b, installAgentHttps as c, issueAgentHttpsLeaf as d, generateMeshKeyPair as et, loadAgentHttps as f, generateCa as g, CA_COMMON_NAME as h, certificateNames as i, loadMeshCa as it, isConstrainedCa as j, PERMITTED_IP_RANGES as k, isContainerBridgeAddress as l, pinnedHttpsCaFingerprint as m, acceptAgentSans as n, issueMeshLeafForNode as nt, createAgentHttpsRequest as o, pemDigest as p, getProcessMeshCertificateRegistry as q, agentHttpsPaths as r, issueMeshLeafFromCsr as rt, describeHttpsLeaf as s, AgentHttpsInstallError as t, isValidAgentNodeId as tt, isPrivateAddress as u, loadCa as v, MAX_LEAF_VALIDITY_DAYS as w, systemHostFacts as x, localCaCommonName as y, getProcessAgentHttpsNames as z };
+export { buildNameConstraintSet as A, setProcessAgentHttpsNames as B, LEAF_RENEWAL_WINDOW_DAYS as C, reasonRequiresNewCa as D, evaluateExistingCert as E, readNameConstraints as F, AGENT_HTTPS_NAMES_COLLECTION as I, AGENT_HTTPS_NAMES_COLUMNS as L, isLocalOnlyHostname as M, permitsIdentity as N, PERMITTED_DNS_SUFFIXES as O, permitsName as P, AgentHttpsNames as R, CA_VALIDITY_DAYS as S, SERVER_AUTH_OID as T, systemConfigRecordKinds as V, issueLeaf as _, collectAgentNames as a, collectCertIdentity as b, installAgentHttps as c, issueAgentHttpsLeaf as d, loadAgentHttps as f, generateCa as g, CA_COMMON_NAME as h, certificateNames as i, isConstrainedCa as j, PERMITTED_IP_RANGES as k, isContainerBridgeAddress as l, pinnedHttpsCaFingerprint as m, acceptAgentSans as n, createAgentHttpsRequest as o, pemDigest as p, agentHttpsPaths as r, describeHttpsLeaf as s, AgentHttpsInstallError as t, isPrivateAddress as u, loadCa as v, MAX_LEAF_VALIDITY_DAYS as w, systemHostFacts as x, localCaCommonName as y, getProcessAgentHttpsNames as z };

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BZQjLPiz.js");
+const require_dist = require("../../dist-Bn-RNanh.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Oa as EventCategory, ni as BaseAddon, ti as errMsg, yt as addonPagesCapability } from "../../dist-B_GRPhnY.mjs";
+import { Ta as EventCategory, ni as BaseAddon, ti as errMsg, yt as addonPagesCapability } from "../../dist-Wy8cTxg6.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BZQjLPiz.js");
+const require_dist = require("../../dist-Bn-RNanh.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Oa as EventCategory, ni as BaseAddon, ti as errMsg, xt as addonWidgetsCapability } from "../../dist-B_GRPhnY.mjs";
+import { Ta as EventCategory, ni as BaseAddon, ti as errMsg, xt as addonWidgetsCapability } from "../../dist-Wy8cTxg6.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";