@camstack/system 1.2.458 → 1.2.459

package/dist/builtins/system-config/system-config.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BZQjLPiz.js");
+const require_dist = require("../../dist-Bn-RNanh.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_x509_es = require("../../x509.es-C4cOo48M.js");
-const require_constants$8 = require("../../constants-Njka8Cv6.js");
-const require_agent_https = require("../../agent-https-DOELEug8.js");
+const require_agent_https = require("../../agent-https-Dnr_nIVx.js");
+const require_constants$8 = require("../../constants-6OeJiZgi.js");
 const require_src$1 = require("../../src-CnAqG6EF.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -298,8 +298,161 @@ function parsePayload(value) {
 	};
 }
 //#endregion
+//#region src/kernel/moleculer/mesh-mtls/mesh-ca.ts
+/**
+* Hub mesh CA — EC P-256, key in the keychain, cert in `cluster.meshCa`.
+*
+* Distinct from the HTTPS local CA (`tls/cert-issue.ts`, RSA): the mesh CA
+* signs node leaves (CN = nodeID) and unlock-ticket JWS (ES256). Issuance uses
+* `@peculiar/x509` over WebCrypto — same library the HTTPS path already uses
+* (installed `1.14.3`; registry latest at adoption time was `2.1.0` — stay on
+* the pinned range already shipping).
+*/
+require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
+var MS_PER_DAY = 864e5;
+/** Key generation — EC P-256 (plan). WebCrypto DOM names are not in @types/node. */
+var MESH_KEY_ALGORITHM = {
+	name: "ECDSA",
+	namedCurve: "P-256"
+};
+/** Signing — ECDSA with SHA-256. */
+var MESH_SIGNING_ALGORITHM = {
+	name: "ECDSA",
+	hash: "SHA-256"
+};
+/** A node id: letters, digits, `.`, `_`, `-`; at most 63 characters; starts with a letter or digit. */
+var NODE_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,62}$/i;
+/** Ids no agent may take: the hub's own, whatever the case (D857). */
+var RESERVED_NODE_IDS = new Set(["hub"]);
+/** True for an id an agent may carry: the pattern, and not a reserved name. */
+function isValidAgentNodeId(nodeId) {
+	return NODE_ID_PATTERN.test(nodeId) && !RESERVED_NODE_IDS.has(nodeId.toLowerCase());
+}
+function freshSerial() {
+	return `00${(0, node_crypto.randomBytes)(16).toString("hex")}`;
+}
+function toPkcs8Pem(pkcs8) {
+	return `${require_x509_es.PemConverter.encode(pkcs8, "PRIVATE KEY")}\n`;
+}
+function toCertPem(cert) {
+	return `${cert.toString("pem")}\n`;
+}
+async function exportKeyPem(key) {
+	return toPkcs8Pem(await node_crypto.webcrypto.subtle.exportKey("pkcs8", key));
+}
+/** SHA-256 fingerprint of the DER cert, colon-hex uppercase (Node style). */
+function caFingerprint(certPem) {
+	return new node_crypto.X509Certificate(certPem).fingerprint256;
+}
+/** Compact fingerprint (lowercase hex, no colons). */
+function caFingerprintCompact(certPem) {
+	return (0, node_crypto.createHash)("sha256").update(new node_crypto.X509Certificate(certPem).raw).digest("hex");
+}
+async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
+	const keys = await node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
+	const extensions = [
+		new require_x509_es.BasicConstraintsExtension(true, 0, true),
+		new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.keyCertSign | require_x509_es.KeyUsageFlags.cRLSign, true),
+		await require_x509_es.SubjectKeyIdentifierExtension.create(keys.publicKey)
+	];
+	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
+		serialNumber: freshSerial(),
+		name: `CN=${require_constants$8.MESH_CA_COMMON_NAME}`,
+		notBefore: require_x509_es.backdatedNotBefore(now),
+		notAfter: new Date(now.getTime() + require_constants$8.MESH_CA_VALIDITY_DAYS * MS_PER_DAY),
+		keys,
+		signingAlgorithm: MESH_SIGNING_ALGORITHM,
+		extensions
+	});
+	return {
+		certPem: toCertPem(cert),
+		keyPem: await exportKeyPem(keys.privateKey),
+		cert,
+		privateKey: keys.privateKey,
+		publicKey: keys.publicKey
+	};
+}
+async function loadMeshCa(certPem, keyPem) {
+	const cert = new require_x509_es.X509Certificate(certPem);
+	return {
+		certPem,
+		keyPem,
+		cert,
+		privateKey: await node_crypto.webcrypto.subtle.importKey("pkcs8", require_x509_es.PemConverter.decodeFirst(keyPem), MESH_KEY_ALGORITHM, true, ["sign"]),
+		publicKey: await cert.publicKey.export(node_crypto.webcrypto)
+	};
+}
+/**
+* Issue a leaf from a CSR. CN must be present; when `expectedNodeId` is set
+* it must match. Validity: 30 days.
+*/
+async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
+	const csr = new require_x509_es.Pkcs10CertificateRequest(csrPem);
+	if (!await csr.verify(node_crypto.webcrypto)) throw new Error("CSR signature is invalid");
+	const cn = subjectCn(csr.subject);
+	if (cn === null || cn.length === 0) throw new Error("CSR subject has no CN");
+	if (opts.allowReserved !== true && !isValidAgentNodeId(cn)) throw new Error(`CSR CN '${cn}' is not an id an agent may carry`);
+	if (opts.expectedNodeId !== void 0 && opts.expectedNodeId !== cn) throw new Error(`CSR CN '${cn}' does not match the token nodeId '${opts.expectedNodeId}'`);
+	const now = opts.now ?? /* @__PURE__ */ new Date();
+	const validDays = opts.validDays ?? 30;
+	const serialNumber = freshSerial();
+	const notAfter = new Date(now.getTime() + validDays * MS_PER_DAY);
+	const extensions = [
+		new require_x509_es.BasicConstraintsExtension(false, void 0, true),
+		new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.digitalSignature, true),
+		new require_x509_es.ExtendedKeyUsageExtension([require_constants$8.SERVER_AUTH_OID, require_constants$8.CLIENT_AUTH_OID]),
+		await require_x509_es.SubjectKeyIdentifierExtension.create(csr.publicKey),
+		await require_x509_es.AuthorityKeyIdentifierExtension.create(ca.cert)
+	];
+	return {
+		certPem: toCertPem(await require_x509_es.X509CertificateGenerator.create({
+			serialNumber,
+			subject: `CN=${cn}`,
+			issuer: ca.cert.subject,
+			notBefore: require_x509_es.backdatedNotBefore(now),
+			notAfter,
+			publicKey: csr.publicKey,
+			signingKey: ca.privateKey,
+			signingAlgorithm: MESH_SIGNING_ALGORITHM,
+			extensions
+		})),
+		serialNumber,
+		notAfter,
+		commonName: cn
+	};
+}
+/** Issue a leaf for a known nodeID with a freshly generated key pair (tests / hub self). */
+async function issueMeshLeafForNode(ca, nodeId, opts = {}) {
+	const keys = await node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
+	return {
+		...await issueMeshLeafFromCsr(ca, await createMeshCsrPem(keys, nodeId), {
+			expectedNodeId: nodeId,
+			now: opts.now,
+			validDays: opts.validDays,
+			allowReserved: true
+		}),
+		keyPem: await exportKeyPem(keys.privateKey)
+	};
+}
+function subjectCn(subject) {
+	return /(?:^|,)\s*CN\s*=\s*([^,]+)/i.exec(subject)?.[1]?.trim() ?? null;
+}
+async function createMeshCsrPem(keys, commonName) {
+	return `${(await require_x509_es.Pkcs10CertificateRequestGenerator.create({
+		name: `CN=${commonName}`,
+		keys,
+		signingAlgorithm: MESH_SIGNING_ALGORITHM
+	})).toString("pem")}\n`;
+}
+async function generateMeshKeyPair() {
+	return node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
+}
+async function exportMeshPrivateKeyPem(key) {
+	return exportKeyPem(key);
+}
+//#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-ca-keeper.ts
-var SLOT$2 = Symbol.for("camstack.mesh.ca");
+var SLOT$3 = Symbol.for("camstack.mesh.ca");
 var NOT_LOADED = {
 	state: "unavailable",
 	reason: "not-loaded"
@@ -311,10 +464,10 @@ function isState(value) {
 	return state === "unavailable" && typeof Reflect.get(value, "reason") === "string";
 }
 function setProcessMeshCa(state) {
-	Reflect.set(globalThis, SLOT$2, state);
+	Reflect.set(globalThis, SLOT$3, state);
 }
 function getProcessMeshCaState() {
-	const value = Reflect.get(globalThis, SLOT$2);
+	const value = Reflect.get(globalThis, SLOT$3);
 	return isState(value) ? value : NOT_LOADED;
 }
 function requireProcessMeshCa() {
@@ -420,7 +573,7 @@ async function loadOrGenerateMeshCa(deps) {
 			try {
 				return {
 					state: "ready",
-					ca: await require_agent_https.loadMeshCa(certPem, entry.value)
+					ca: await loadMeshCa(certPem, entry.value)
 				};
 			} catch (err) {
 				return {
@@ -430,12 +583,12 @@ async function loadOrGenerateMeshCa(deps) {
 			}
 		}
 		case "missing": try {
-			const generated = await require_agent_https.generateMeshCa();
+			const generated = await generateMeshCa();
 			await deps.secrets.put(require_constants$8.MESH_CA_KEY_REF, generated.keyPem);
 			await deps.writeMeshCaCert(generated.certPem);
 			return {
 				state: "ready",
-				ca: await require_agent_https.loadMeshCa(generated.certPem, generated.keyPem)
+				ca: await loadMeshCa(generated.certPem, generated.keyPem)
 			};
 		} catch (err) {
 			return {
@@ -456,10 +609,10 @@ async function loadOrGenerateMeshCa(deps) {
 var MeshCrl = class {
 	serials = /* @__PURE__ */ new Set();
 	revoke(serialNumber) {
-		this.serials.add(normalizeSerial(serialNumber));
+		this.serials.add(normalizeSerial$1(serialNumber));
 	}
 	isRevoked(serialNumber) {
-		return this.serials.has(normalizeSerial(serialNumber));
+		return this.serials.has(normalizeSerial$1(serialNumber));
 	}
 	list() {
 		return [...this.serials];
@@ -467,21 +620,478 @@ var MeshCrl = class {
 	/** Restore from persisted serials (system-settings). */
 	replaceAll(serials) {
 		this.serials.clear();
-		for (const s of serials) this.serials.add(normalizeSerial(s));
+		for (const s of serials) this.serials.add(normalizeSerial$1(s));
 	}
 };
-function normalizeSerial(serial) {
+function normalizeSerial$1(serial) {
 	return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
 }
-var SLOT$1 = Symbol.for("camstack.mesh.crl");
+var SLOT$2 = Symbol.for("camstack.mesh.crl");
 function processMeshCrl() {
-	const existing = Reflect.get(globalThis, SLOT$1);
+	const existing = Reflect.get(globalThis, SLOT$2);
 	if (existing instanceof MeshCrl) return existing;
 	const crl = new MeshCrl();
-	Reflect.set(globalThis, SLOT$1, crl);
+	Reflect.set(globalThis, SLOT$2, crl);
 	return crl;
 }
 //#endregion
+//#region src/kernel/moleculer/mesh-mtls/mesh-certificate-registry.ts
+/**
+* The hub's record of every mesh leaf (D856): which certificate each node holds,
+* when it expires, and which serials are revoked.
+*
+* Three ways a row appears:
+*  - `enroll` / `renewal` / `boot` - the hub issued it and wrote it down at the
+*    moment of issuing (the authoritative record);
+*  - `observed` - a node enrolled before this record existed (or by a path that
+*    did not write it) presented this leaf on its LIVE mutual-TLS connection.
+*
+* Revoked serials are persisted here and replayed into the in-memory CRL at boot,
+* so a revocation survives a hub restart. Hub only: agents persist none of it.
+*/
+/**
+* @durable class=config owner=system-config
+*   write="the hub records every mesh leaf it issues (enroll, renewal, boot) and every
+*     leaf a connected node is observed presenting; a revocation stamps revokedAt"
+*   retention="a revoked or expired row is kept 90 days past its end, then reaped; a
+*     live row is never deleted. Forgetting a node does not delete its rows."
+*/
+var MESH_NODE_CERTIFICATES_COLLECTION = "mesh_node_certificates";
+var MESH_NODE_CERTIFICATES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "nodeId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "serial",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "fingerprint",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "notBefore",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "notAfter",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "issuedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "issuedVia",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "revokedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "revokedReason",
+		type: "TEXT"
+	}
+];
+var RETENTION_MS = 90 * 864e5;
+/**
+* A leaf the hub signed for a renewal that did not complete. It must not be the node's
+* `current` leaf, but it is NOT on the CRL: the node may still hold it (the swap
+* could have landed without the hub seeing it), and cutting it off would be the
+* outage the hand-over exists to prevent. If the node is later seen presenting it, it
+* is reinstated.
+*/
+var RENEWAL_ABANDONED = "renewal-abandoned";
+var VIAS = [
+	"enroll",
+	"pairing",
+	"renewal",
+	"boot",
+	"observed"
+];
+/** CN, serial, fingerprint and validity of a leaf PEM (or DER). */
+function describeMeshLeaf(cert) {
+	const x509 = new node_crypto.X509Certificate(cert);
+	return {
+		cn: subjectCn(x509.subject) ?? "",
+		serial: x509.serialNumber,
+		fingerprint: x509.fingerprint256,
+		notBefore: Date.parse(x509.validFrom),
+		notAfter: Date.parse(x509.validTo)
+	};
+}
+function normalizeSerial(serial) {
+	return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
+}
+function parse$1(data) {
+	const str = (k) => {
+		const v = data[k];
+		return typeof v === "string" && v.length > 0 ? v : null;
+	};
+	const num = (k) => {
+		const v = data[k];
+		return typeof v === "number" && Number.isFinite(v) ? v : null;
+	};
+	const nodeId = str("nodeId");
+	const serial = str("serial");
+	const fingerprint = str("fingerprint");
+	const notBefore = num("notBefore");
+	const notAfter = num("notAfter");
+	const issuedAt = num("issuedAt");
+	if (nodeId === null || serial === null || fingerprint === null || notBefore === null || notAfter === null || issuedAt === null) return null;
+	return {
+		nodeId,
+		serial,
+		fingerprint,
+		notBefore,
+		notAfter,
+		issuedAt,
+		issuedVia: VIAS.find((v) => v === data["issuedVia"]) ?? "observed",
+		revokedAt: num("revokedAt"),
+		revokedReason: str("revokedReason")
+	};
+}
+var MeshCertificateRegistry = class {
+	store;
+	deps;
+	rows = /* @__PURE__ */ new Map();
+	constructor(store, deps = {}) {
+		this.store = store;
+		this.deps = deps;
+	}
+	recordToBody(record) {
+		return {
+			nodeId: record.nodeId,
+			serial: record.serial,
+			fingerprint: record.fingerprint,
+			notBefore: record.notBefore,
+			notAfter: record.notAfter,
+			issuedAt: record.issuedAt,
+			issuedVia: record.issuedVia,
+			revokedAt: record.revokedAt,
+			revokedReason: record.revokedReason
+		};
+	}
+	now() {
+		return (this.deps.now ?? Date.now)();
+	}
+	async load() {
+		const kind = this.deps.meshKind ?? null;
+		if (kind !== null) {
+			const page = await kind.query({ limit: 1e4 });
+			for (const row of page.records) {
+				const { fingerprint: _fp, ...body } = row.data;
+				const record = parse$1({
+					...body,
+					fingerprint: row.id
+				});
+				if (record !== null) this.rows.set(record.fingerprint, record);
+			}
+			return;
+		}
+		const rows = await this.store.query.query({ collection: MESH_NODE_CERTIFICATES_COLLECTION });
+		for (const row of rows) {
+			const record = parse$1(row.data);
+			if (record !== null) this.rows.set(record.fingerprint, record);
+		}
+	}
+	/** Write down a leaf the hub just issued. Idempotent per fingerprint. */
+	async recordIssued(nodeId, certPem, via) {
+		const leaf = describeMeshLeaf(certPem);
+		const existing = this.rows.get(leaf.fingerprint);
+		if (existing !== void 0) return existing;
+		const record = {
+			nodeId,
+			serial: leaf.serial,
+			fingerprint: leaf.fingerprint,
+			notBefore: leaf.notBefore,
+			notAfter: leaf.notAfter,
+			issuedAt: this.now(),
+			issuedVia: via,
+			revokedAt: null,
+			revokedReason: null
+		};
+		await this.insert(record);
+		this.deps.logger?.info("Mesh certificate recorded", {
+			tags: { nodeId },
+			meta: {
+				via,
+				serial: leaf.serial,
+				notAfter: new Date(leaf.notAfter).toISOString()
+			}
+		});
+		return record;
+	}
+	/**
+	* A node was seen presenting `leaf` on its live connection. A leaf the hub already
+	* knows is left alone; an unknown one is recorded `observed` (a node enrolled
+	* before this record existed).
+	*/
+	async recordObserved(nodeId, leaf) {
+		const known = this.rows.get(leaf.fingerprint);
+		if (known !== void 0) {
+			if (known.revokedReason !== "renewal-abandoned") return known.revokedAt === null ? this.abandonRenewalsNewerThan(known) : false;
+			const reinstated = {
+				...known,
+				revokedAt: null,
+				revokedReason: null
+			};
+			this.rows.set(known.fingerprint, reinstated);
+			await this.persist(reinstated);
+			this.deps.logger?.warn("An abandoned renewal leaf is in use - reinstated", {
+				tags: { nodeId },
+				meta: { serial: known.serial }
+			});
+			return true;
+		}
+		const record = {
+			nodeId,
+			serial: leaf.serial,
+			fingerprint: leaf.fingerprint,
+			notBefore: leaf.notBefore,
+			notAfter: leaf.notAfter,
+			issuedAt: this.now(),
+			issuedVia: "observed",
+			revokedAt: null,
+			revokedReason: null
+		};
+		await this.insert(record);
+		this.deps.logger?.info("Mesh certificate observed on a live connection and recorded", {
+			tags: { nodeId },
+			meta: {
+				serial: leaf.serial,
+				fingerprint: leaf.fingerprint
+			}
+		});
+		return true;
+	}
+	list(nodeId) {
+		return [...this.rows.values()].filter((r) => nodeId === void 0 || r.nodeId === nodeId).toSorted((a, b) => b.issuedAt - a.issuedAt);
+	}
+	/** The newest non-revoked leaf of a node, or `undefined`. */
+	currentFor(nodeId) {
+		return this.list(nodeId).find((r) => r.revokedAt === null);
+	}
+	/** Every non-revoked leaf of a node (a renewal in flight has two). */
+	liveFor(nodeId) {
+		return this.list(nodeId).filter((r) => r.revokedAt === null);
+	}
+	/** Stamp a leaf revoked (and mirror it into `crl`). `false` when unknown or already revoked. */
+	async revoke(fingerprint, reason, crl) {
+		const record = this.rows.get(fingerprint);
+		if (record === void 0 || record.revokedAt !== null) return false;
+		const revoked = {
+			...record,
+			revokedAt: this.now(),
+			revokedReason: reason
+		};
+		this.rows.set(fingerprint, revoked);
+		crl?.revoke(record.serial);
+		await this.persist(revoked);
+		this.deps.logger?.warn("Mesh certificate revoked", {
+			tags: { nodeId: record.nodeId },
+			meta: {
+				serial: record.serial,
+				reason
+			}
+		});
+		return true;
+	}
+	/**
+	* Operator revocation of a whole node: EVERY leaf of the node that is not already on the
+	* CRL goes on it - the current one, an observed one, a renewal one, and a leaf that was set
+	* aside (`renewal-abandoned`: a copy of it may sit on a stolen box, and it must not stay
+	* valid just because the hub once set it aside). Returns the serials put on the CRL.
+	* A leaf revoked this way is never reinstated by `recordObserved`.
+	*/
+	async revokeAllForNode(nodeId, reason, crl, keepFingerprint) {
+		const serials = [];
+		for (const record of this.list(nodeId)) {
+			if (keepFingerprint !== void 0 && record.fingerprint === keepFingerprint) continue;
+			if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned") continue;
+			const revoked = {
+				...record,
+				revokedAt: record.revokedAt ?? this.now(),
+				revokedReason: reason
+			};
+			this.rows.set(record.fingerprint, revoked);
+			crl.revoke(record.serial);
+			await this.persist(revoked);
+			serials.push(record.serial);
+		}
+		if (serials.length > 0) this.deps.logger?.warn("Every mesh certificate of the node revoked", {
+			tags: { nodeId },
+			meta: {
+				serials,
+				reason
+			}
+		});
+		return serials;
+	}
+	/**
+	* At boot: a node with TWO live leaves had a renewal in flight when the hub stopped. The
+	* newer (renewal) one is set aside - it is not the node's current leaf until the node is
+	* seen presenting it, which reinstates it. It is NOT put on the CRL.
+	*/
+	async settleInterruptedRenewals() {
+		let settled = 0;
+		const byNode = /* @__PURE__ */ new Map();
+		for (const record of this.rows.values()) {
+			if (record.revokedAt !== null) continue;
+			byNode.set(record.nodeId, [...byNode.get(record.nodeId) ?? [], record]);
+		}
+		for (const records of byNode.values()) {
+			if (records.length < 2) continue;
+			for (const record of records) if (record.issuedVia === "renewal" && await this.abandon(record.fingerprint)) settled += 1;
+		}
+		return settled;
+	}
+	/** Set a never-completed renewal leaf aside (not current, NOT on the CRL). */
+	/** Fingerprints of renewal leaves whose handover is running right now (this process only). */
+	renewalsInFlight = /* @__PURE__ */ new Set();
+	/**
+	* A renewal's leaf is "in flight" from signing until the handover ends. While it is, a node seen
+	* presenting its OLD leaf is simply not swapped yet: the new leaf is not set aside (that would
+	* flap set-aside / reinstate on the node's first connection with it).
+	*/
+	beginRenewal(fingerprint) {
+		this.renewalsInFlight.add(fingerprint);
+	}
+	endRenewal(fingerprint) {
+		this.renewalsInFlight.delete(fingerprint);
+	}
+	async abandonRenewalsNewerThan(presented) {
+		let changed = false;
+		for (const record of this.liveFor(presented.nodeId)) {
+			if (record.fingerprint === presented.fingerprint) continue;
+			if (record.issuedVia !== "renewal" || record.issuedAt <= presented.issuedAt) continue;
+			if (this.renewalsInFlight.has(record.fingerprint)) continue;
+			if (await this.abandon(record.fingerprint)) changed = true;
+		}
+		return changed;
+	}
+	async abandon(fingerprint) {
+		const record = this.rows.get(fingerprint);
+		if (record === void 0 || record.revokedAt !== null) return false;
+		const abandoned = {
+			...record,
+			revokedAt: this.now(),
+			revokedReason: RENEWAL_ABANDONED
+		};
+		this.rows.set(fingerprint, abandoned);
+		await this.persist(abandoned);
+		this.deps.logger?.warn("Renewal leaf set aside (not current, not on the CRL)", {
+			tags: { nodeId: record.nodeId },
+			meta: { serial: record.serial }
+		});
+		return true;
+	}
+	/** Replay every persisted revocation into `crl` (hub boot). Set-aside leaves are not revocations. */
+	restoreCrl(crl) {
+		let restored = 0;
+		for (const record of this.rows.values()) {
+			if (record.revokedAt === null || record.revokedReason === "renewal-abandoned") continue;
+			crl.revoke(record.serial);
+			restored += 1;
+		}
+		return restored;
+	}
+	/** Is `serial` listed as revoked here? */
+	isRevoked(serial) {
+		const wanted = normalizeSerial(serial);
+		for (const record of this.rows.values()) if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned" && normalizeSerial(record.serial) === wanted) return true;
+		return false;
+	}
+	async reap() {
+		const cutoff = this.now() - RETENTION_MS;
+		const dead = [...this.rows.values()].filter((r) => (r.revokedAt ?? r.notAfter) < cutoff);
+		for (const r of dead) {
+			this.rows.delete(r.fingerprint);
+			await this.deleteRow(r.fingerprint);
+		}
+		return dead.length;
+	}
+	async insert(record) {
+		this.rows.set(record.fingerprint, record);
+		const kind = this.deps.meshKind ?? null;
+		if (kind !== null) {
+			const parsed = require_agent_https.systemConfigRecordKinds["mesh-node-certificates"].schema.safeParse(this.recordToBody(record));
+			if (!parsed.success) throw new Error(parsed.error.message);
+			await kind.put({
+				id: record.fingerprint,
+				data: parsed.data
+			});
+			return;
+		}
+		await this.store.insert.mutate({
+			collection: MESH_NODE_CERTIFICATES_COLLECTION,
+			record: {
+				id: record.fingerprint,
+				data: { ...record }
+			}
+		});
+	}
+	async deleteRow(fingerprint) {
+		const kind = this.deps.meshKind ?? null;
+		if (kind !== null) {
+			await kind.delete(fingerprint);
+			return;
+		}
+		await this.store.delete.mutate({
+			collection: MESH_NODE_CERTIFICATES_COLLECTION,
+			key: fingerprint
+		});
+	}
+	async persist(record) {
+		try {
+			const kind = this.deps.meshKind ?? null;
+			if (kind !== null) {
+				const parsed = require_agent_https.systemConfigRecordKinds["mesh-node-certificates"].schema.safeParse(this.recordToBody(record));
+				if (!parsed.success) throw new Error(parsed.error.message);
+				await kind.put({
+					id: record.fingerprint,
+					data: parsed.data
+				});
+				return;
+			}
+			await this.store.update.mutate({
+				collection: MESH_NODE_CERTIFICATES_COLLECTION,
+				id: record.fingerprint,
+				data: { ...record }
+			});
+		} catch (error) {
+			this.deps.logger?.error("Mesh certificate write failed - the change holds until restart", {
+				tags: { nodeId: record.nodeId },
+				meta: { error: error instanceof Error ? error.message : String(error) }
+			});
+		}
+	}
+};
+var SLOT$1 = Symbol.for("camstack.mesh.certificate-registry");
+function setProcessMeshCertificateRegistry(registry) {
+	if (registry === null) Reflect.deleteProperty(globalThis, SLOT$1);
+	else Reflect.set(globalThis, SLOT$1, registry);
+}
+function getProcessMeshCertificateRegistry() {
+	const value = Reflect.get(globalThis, SLOT$1);
+	return value !== null && typeof value === "object" && typeof Reflect.get(value, "recordIssued") === "function" ? value : null;
+}
+//#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-tls-gate.ts
 var STATE_SLOT = Symbol.for("camstack.mesh.tls-listener-state");
 function setProcessMeshTlsListenerState(state) {
@@ -624,7 +1234,7 @@ async function runRenewal(deps, inFlight) {
 	}
 	let issued;
 	try {
-		issued = await require_agent_https.issueMeshLeafFromCsr(deps.ca, csrPem, { expectedNodeId: nodeId });
+		issued = await issueMeshLeafFromCsr(deps.ca, csrPem, { expectedNodeId: nodeId });
 		await deps.registry.recordIssued(nodeId, issued.certPem, "renewal");
 		log.info("Mesh renewal: new leaf signed and recorded", {
 			tags,
@@ -636,7 +1246,7 @@ async function runRenewal(deps, inFlight) {
 	} catch (error) {
 		return fail("issue", message(error), true);
 	}
-	const newLeaf = require_agent_https.describeMeshLeaf(issued.certPem);
+	const newLeaf = describeMeshLeaf(issued.certPem);
 	deps.registry.beginRenewal(newLeaf.fingerprint);
 	inFlight.fingerprint = newLeaf.fingerprint;
 	let resolveRegistered = () => void 0;
@@ -86154,7 +86764,7 @@ function peerIdentity(socket) {
 	if (cert == null || typeof cert !== "object" || !("raw" in cert) || !cert.raw) return null;
 	try {
 		const x509 = new node_crypto.X509Certificate(cert.raw);
-		const cn = require_agent_https.subjectCn(x509.subject) ?? require_agent_https.subjectCn(`CN=${cert.subject?.CN ?? ""}`);
+		const cn = subjectCn(x509.subject) ?? subjectCn(`CN=${cert.subject?.CN ?? ""}`);
 		if (cn === null || cn.length === 0) return null;
 		return {
 			cn,
@@ -86682,7 +87292,7 @@ function newPairingId() {
 }
 /** The hub's commitment to its nonce, bound to the CA certificate it offers. */
 function computePairingCommitment(caCertPem, hubNonce) {
-	return (0, node_crypto.createHash)("sha256").update(`${PAIRING_DOMAIN}|commit|${require_agent_https.caFingerprintCompact(caCertPem)}|${hubNonce}`, "utf8").digest("hex");
+	return (0, node_crypto.createHash)("sha256").update(`${PAIRING_DOMAIN}|commit|${caFingerprintCompact(caCertPem)}|${hubNonce}`, "utf8").digest("hex");
 }
 function commitmentsEqual(expected, presented) {
 	return constantTimeEqual(expected, presented);
@@ -86692,7 +87302,7 @@ function computePairingSas(input) {
 	const value = (0, node_crypto.createHash)("sha256").update([
 		PAIRING_DOMAIN,
 		"sas",
-		require_agent_https.caFingerprintCompact(input.caCertPem),
+		caFingerprintCompact(input.caCertPem),
 		input.agentPublicKeySpki,
 		input.hubNonce,
 		input.agentNonce
@@ -86708,7 +87318,7 @@ function constantTimeEqual(expected, presented) {
 async function describeCsr(csrPem) {
 	const csr = new require_x509_es.Pkcs10CertificateRequest(csrPem);
 	if (!await csr.verify(node_crypto.webcrypto)) throw new Error("the agent CSR signature is invalid");
-	const cn = require_agent_https.subjectCn(csr.subject);
+	const cn = subjectCn(csr.subject);
 	if (cn === null || cn.length === 0) throw new Error("the agent CSR has no CN");
 	return {
 		commonName: cn,
@@ -87019,23 +87629,23 @@ var AgentPairing = class {
 	async offer(body) {
 		this.expireIfDue();
 		if (this.deps.isPaired()) return fail(409, "already-paired", "this agent is paired — unpair it first (from the hub or here)");
-		if (!require_agent_https.isValidAgentNodeId(this.deps.nodeId)) return fail(409, "invalid-node-id", `this agent's node id "${this.deps.nodeId}" cannot be paired - rename the agent`);
+		if (!isValidAgentNodeId(this.deps.nodeId)) return fail(409, "invalid-node-id", `this agent's node id "${this.deps.nodeId}" cannot be paired - rename the agent`);
 		const request = parseOffer(body);
 		if (request === null) return fail(400, "bad-offer", "the offer is malformed");
 		if (request.protocol !== 1) return fail(400, "unsupported-protocol", `pairing protocol ${String(request.protocol)} is not supported`);
 		if (readCaCertificate(request.hubCaCertPem, this.now()) === null) return fail(400, "bad-ca", "the offered CA is not a valid self-signed CA certificate");
 		if (!/^[0-9a-f]{64}$/.test(request.commitment)) return fail(400, "bad-offer", "the commitment is malformed");
 		if (!isHttpUrl(request.hubUrl)) return fail(400, "bad-offer", "hubUrl is not an http(s) URL");
-		const caFingerprint = require_agent_https.caFingerprintCompact(request.hubCaCertPem);
+		const caFingerprint = caFingerprintCompact(request.hubCaCertPem);
 		const refused = this.checkOfferSignature(request, caFingerprint);
 		if (refused !== null) return refused;
 		const rationed = this.rationOffer(caFingerprint);
 		if (rationed !== null) return rationed;
 		for (const existing of [...this.sessions.values()]) if (existing.hub.caFingerprint === caFingerprint) this.end(existing, "failed");
 		if (this.sessions.size >= 4 && !this.makeRoom()) return fail(409, "too-many-pending", "too many pairings are pending on this agent");
-		const keys = await require_agent_https.generateMeshKeyPair();
-		const csrPem = await require_agent_https.createMeshCsrPem(keys, this.deps.nodeId);
-		const keyPem = await require_agent_https.exportMeshPrivateKeyPem(keys.privateKey);
+		const keys = await generateMeshKeyPair();
+		const csrPem = await createMeshCsrPem(keys, this.deps.nodeId);
+		const keyPem = await exportMeshPrivateKeyPem(keys.privateKey);
 		const publicKeySpki = Buffer.from(await node_crypto.webcrypto.subtle.exportKey("spki", keys.publicKey)).toString("base64");
 		if (this.sessions.size >= 4 && !this.makeRoom()) return fail(409, "too-many-pending", "too many pairings are pending on this agent");
 		const session = {
@@ -87375,7 +87985,7 @@ var AgentPairing = class {
 			const leaf = new node_crypto.X509Certificate(leafPem);
 			const ca = new node_crypto.X509Certificate(session.hub.caCertPem);
 			if (!leaf.verify(ca.publicKey)) return fail(400, "bad-leaf", "the certificate is not signed by the offered CA");
-			if (require_agent_https.subjectCn(leaf.subject.replaceAll("\n", ",")) !== this.deps.nodeId) return fail(400, "bad-leaf", `the certificate is not issued for "${this.deps.nodeId}"`);
+			if (subjectCn(leaf.subject.replaceAll("\n", ",")) !== this.deps.nodeId) return fail(400, "bad-leaf", `the certificate is not issued for "${this.deps.nodeId}"`);
 			if (!leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(session.keyPem))) return fail(400, "bad-leaf", "the certificate does not match this agent's private key");
 			if (Date.parse(leaf.validTo) <= this.now()) return fail(400, "bad-leaf", "the certificate is already expired");
 		} catch {
@@ -87433,7 +88043,7 @@ function field(body, key) {
 }
 function caFingerprintOf(pem) {
 	try {
-		return require_agent_https.caFingerprintCompact(pem);
+		return caFingerprintCompact(pem);
 	} catch {
 		return null;
 	}
@@ -87528,7 +88138,7 @@ var HubPairing = class {
 				use: PAIRING_OFFER_USE,
 				agentNodeId: hello.nodeId,
 				hubNodeId: this.deps.hubNodeId,
-				caFingerprint: require_agent_https.caFingerprintCompact(ca.certPem),
+				caFingerprint: caFingerprintCompact(ca.certPem),
 				commitment,
 				hubUrl,
 				hubMeshAddress,
@@ -87645,14 +88255,14 @@ var HubPairing = class {
 	}
 	async complete(session) {
 		const ca = this.deps.ca();
-		if (ca === null || require_agent_https.caFingerprintCompact(ca.certPem) !== require_agent_https.caFingerprintCompact(session.caCertPem)) {
+		if (ca === null || caFingerprintCompact(ca.certPem) !== caFingerprintCompact(session.caCertPem)) {
 			await this.cancel(session, "failed", "the mesh CA changed during the pairing");
 			return;
 		}
 		session.state = "completing";
 		let issuedPem = null;
 		try {
-			const leaf = await require_agent_https.issueMeshLeafFromCsr(ca, session.csrPem, { expectedNodeId: session.nodeId });
+			const leaf = await issueMeshLeafFromCsr(ca, session.csrPem, { expectedNodeId: session.nodeId });
 			issuedPem = leaf.certPem;
 			await this.deps.recordIssued(session.nodeId, leaf.certPem);
 			session.issued = true;
@@ -87664,7 +88274,7 @@ var HubPairing = class {
 				hubNonce: session.hubNonce,
 				agentNonce: session.agentNonce,
 				leafFingerprint: leafFingerprintCompact(leaf.certPem),
-				caFingerprint: require_agent_https.caFingerprintCompact(ca.certPem),
+				caFingerprint: caFingerprintCompact(ca.certPem),
 				hubMeshAddress: session.hubMeshAddress,
 				hubUrl: session.hubUrl,
 				iat: this.now(),
@@ -87718,7 +88328,7 @@ var HubPairing = class {
 		}
 	}
 	assertNodeIdUsable(nodeId) {
-		if (!require_agent_https.isValidAgentNodeId(nodeId)) throw new Error(`"${nodeId}" cannot be an agent node id (letters, digits, . _ - ; not "hub"; at most 63 characters)`);
+		if (!isValidAgentNodeId(nodeId)) throw new Error(`"${nodeId}" cannot be an agent node id (letters, digits, . _ - ; not "hub"; at most 63 characters)`);
 		if (this.deps.isNodeConnected(nodeId)) throw new Error(`a node called "${nodeId}" is already connected to this hub — unpair it first`);
 		const lower = nodeId.toLowerCase();
 		const clash = (this.deps.knownNodeIds?.() ?? []).find((known) => known !== nodeId && known.toLowerCase() === lower);
@@ -87903,7 +88513,7 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		};
 	}
 	async onShutdown() {
-		require_agent_https.setProcessMeshCertificateRegistry(null);
+		setProcessMeshCertificateRegistry(null);
 		setProcessMeshTlsListenerState(null);
 		require_agent_https.setProcessAgentHttpsNames(null);
 		this.stoppedMesh = true;
@@ -87934,14 +88544,14 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		this.loadAgentHttpsNames(store, records);
 		try {
 			if (records === void 0) await store.declareCollection.mutate({
-				collection: require_agent_https.MESH_NODE_CERTIFICATES_COLLECTION,
-				columns: require_agent_https.MESH_NODE_CERTIFICATES_COLUMNS,
+				collection: MESH_NODE_CERTIFICATES_COLLECTION,
+				columns: MESH_NODE_CERTIFICATES_COLUMNS,
 				indexes: [{
 					name: "idx_mesh_node_certificates_node",
 					columns: ["nodeId"]
 				}]
 			});
-			const registry = new require_agent_https.MeshCertificateRegistry(store, {
+			const registry = new MeshCertificateRegistry(store, {
 				logger: this.ctx.logger,
 				meshKind
 			});
@@ -87949,7 +88559,7 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 			const restored = registry.restoreCrl(processMeshCrl());
 			const settled = await registry.settleInterruptedRenewals();
 			if (settled > 0) this.ctx.logger.warn("A mesh renewal was interrupted by a hub restart - its new leaf was set aside", { meta: { settled } });
-			require_agent_https.setProcessMeshCertificateRegistry(registry);
+			setProcessMeshCertificateRegistry(registry);
 			if (restored > 0) this.ctx.logger.info("Mesh revocations restored into the CRL", { meta: { restored } });
 			return registry;
 		} catch (err) {
@@ -87983,7 +88593,7 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		await openMeshTlsWhenRevocationsLoaded({
 			loadRegistry: () => this.initMeshCertificateRegistry(),
 			open: async (registry) => {
-				const hubLeaf = await require_agent_https.issueMeshLeafForNode(ca, "hub");
+				const hubLeaf = await issueMeshLeafForNode(ca, "hub");
 				await registry.recordIssued("hub", hubLeaf.certPem, "boot").catch((err) => {
 					this.ctx.logger.warn("Hub mesh leaf could not be recorded", { meta: { error: err instanceof Error ? err.message : String(err) } });
 				});
@@ -88290,8 +88900,11 @@ exports.AGENT_UI_UNLOCK_VERSION = AGENT_UI_UNLOCK_VERSION;
 exports.AgentPairing = AgentPairing;
 exports.Errors = Errors;
 exports.HubPairing = HubPairing;
+exports.MESH_NODE_CERTIFICATES_COLLECTION = MESH_NODE_CERTIFICATES_COLLECTION;
+exports.MESH_NODE_CERTIFICATES_COLUMNS = MESH_NODE_CERTIFICATES_COLUMNS;
 exports.MESH_TLS_PORT_HELLO_FIELD = MESH_TLS_PORT_HELLO_FIELD;
 exports.MeshCaKeeper = MeshCaKeeper;
+exports.MeshCertificateRegistry = MeshCertificateRegistry;
 exports.MeshCrl = MeshCrl;
 exports.PAIRING_CODE_DIGITS = PAIRING_CODE_DIGITS;
 exports.PAIRING_MAX_CODE_ATTEMPTS = PAIRING_MAX_CODE_ATTEMPTS;
@@ -88301,26 +88914,39 @@ exports.PAIRING_PIN_DIGITS = PAIRING_PIN_DIGITS;
 exports.PAIRING_PROTOCOL = PAIRING_PROTOCOL;
 exports.PAIRING_TTL_MS = PAIRING_TTL_MS;
 exports.PairingHttpError = PairingHttpError;
+exports.RENEWAL_ABANDONED = RENEWAL_ABANDONED;
 exports.SYSTEM_CONFIG_CLUSTER_SECTION_ID = SYSTEM_CONFIG_CLUSTER_SECTION_ID;
 exports.ServiceBroker = ServiceBroker;
 exports.SystemConfigAddon = SystemConfigAddon;
 exports.default = SystemConfigAddon;
 exports.TlsTcpTransporter = TlsTcpTransporter;
 exports.UnlockTicketJtiStore = UnlockTicketJtiStore;
+exports.caFingerprint = caFingerprint;
+exports.caFingerprintCompact = caFingerprintCompact;
 exports.computePairingCommitment = computePairingCommitment;
 exports.computePairingSas = computePairingSas;
 exports.createCidrMatcher = createCidrMatcher;
+exports.createMeshCsrPem = createMeshCsrPem;
 exports.describeCsr = describeCsr;
+exports.describeMeshLeaf = describeMeshLeaf;
 exports.dropProcessPeer = dropProcessPeer;
 exports.emitProcessNodeRegistered = emitProcessNodeRegistered;
+exports.exportMeshPrivateKeyPem = exportMeshPrivateKeyPem;
+exports.generateMeshCa = generateMeshCa;
+exports.generateMeshKeyPair = generateMeshKeyPair;
 exports.getProcessMeshCaState = getProcessMeshCaState;
+exports.getProcessMeshCertificateRegistry = getProcessMeshCertificateRegistry;
 exports.getProcessMeshTlsListenerState = getProcessMeshTlsListenerState;
 exports.getProcessNodeMeshTransport = getProcessNodeMeshTransport;
 exports.getProcessPeerLeaf = getProcessPeerLeaf;
 exports.hubHostFromMeshAddress = hubHostFromMeshAddress;
 exports.isAllowedAgentDashboardReturnTo = isAllowedAgentDashboardReturnTo;
 exports.isProcessVerifiedMeshPeer = isProcessVerifiedMeshPeer;
+exports.isValidAgentNodeId = isValidAgentNodeId;
+exports.issueMeshLeafForNode = issueMeshLeafForNode;
+exports.issueMeshLeafFromCsr = issueMeshLeafFromCsr;
 exports.keyFingerprintShort = keyFingerprintShort;
+exports.loadMeshCa = loadMeshCa;
 exports.mintAgentUiUnlockTicket = mintAgentUiUnlockTicket;
 exports.normalizeIp = normalizeIp;
 exports.onProcessNodeRegistered = onProcessNodeRegistered;
@@ -88332,6 +88958,7 @@ exports.readCidrSetting = readCidrSetting;
 exports.renewMeshCertificate = renewMeshCertificate;
 exports.requireProcessMeshCa = requireProcessMeshCa;
 exports.revokeMeshCertificate = revokeMeshCertificate;
+exports.setProcessMeshCertificateRegistry = setProcessMeshCertificateRegistry;
 exports.setProcessMeshPeerTransportLookup = setProcessMeshPeerTransportLookup;
 exports.setProcessMeshTlsEnabler = setProcessMeshTlsEnabler;
 exports.setProcessMeshTlsListenerState = setProcessMeshTlsListenerState;