@camstack/system 1.2.458 → 1.2.459

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,9 +1,9 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Gi as defineCustomActions, Ui as customAction, Zi as hydrateSchema, ni as BaseAddon, ti as errMsg, ut as ServerNameSchema, xr as shortHostname } from "../../dist-B_GRPhnY.mjs";
+import { Ui as customAction, Wi as defineCustomActions, Xi as hydrateSchema, ni as BaseAddon, ti as errMsg, ut as ServerNameSchema, xr as shortHostname } from "../../dist-Wy8cTxg6.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
-import { c as Pkcs10CertificateRequest } from "../../x509.es-DK__ETIe.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "../../constants-FGjnsE2x.mjs";
-import { $ as generateMeshCa, B as setProcessAgentHttpsNames, H as MESH_NODE_CERTIFICATES_COLLECTION, I as AGENT_HTTPS_NAMES_COLLECTION, J as setProcessMeshCertificateRegistry, K as describeMeshLeaf, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, Q as exportMeshPrivateKeyPem, R as AgentHttpsNames, U as MESH_NODE_CERTIFICATES_COLUMNS, V as systemConfigRecordKinds, W as MeshCertificateRegistry, X as caFingerprintCompact, Z as createMeshCsrPem, at as subjectCn, et as generateMeshKeyPair, it as loadMeshCa, nt as issueMeshLeafForNode, rt as issueMeshLeafFromCsr, tt as isValidAgentNodeId, u as isPrivateAddress, z as getProcessAgentHttpsNames } from "../../agent-https-CQA3W-3e.mjs";
+import { S as backdatedNotBefore, a as KeyUsageFlags, c as Pkcs10CertificateRequest, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, l as Pkcs10CertificateRequestGenerator, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension } from "../../x509.es-DK__ETIe.mjs";
+import { B as setProcessAgentHttpsNames, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, R as AgentHttpsNames, V as systemConfigRecordKinds, u as isPrivateAddress, z as getProcessAgentHttpsNames } from "../../agent-https-Iw3RSQup.mjs";
+import { a as MESH_CA_KEY_REF, c as SERVER_AUTH_OID, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "../../constants-BnkOdj9Q.mjs";
 import { t as require_src } from "../../src-hG4grMU4.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createPrivateKey, randomBytes, randomInt, sign, timingSafeEqual, verify, webcrypto } from "node:crypto";
@@ -288,8 +288,161 @@ function parsePayload(value) {
 	};
 }
 //#endregion
+//#region src/kernel/moleculer/mesh-mtls/mesh-ca.ts
+/**
+* Hub mesh CA — EC P-256, key in the keychain, cert in `cluster.meshCa`.
+*
+* Distinct from the HTTPS local CA (`tls/cert-issue.ts`, RSA): the mesh CA
+* signs node leaves (CN = nodeID) and unlock-ticket JWS (ES256). Issuance uses
+* `@peculiar/x509` over WebCrypto — same library the HTTPS path already uses
+* (installed `1.14.3`; registry latest at adoption time was `2.1.0` — stay on
+* the pinned range already shipping).
+*/
+cryptoProvider.set(webcrypto);
+var MS_PER_DAY = 864e5;
+/** Key generation — EC P-256 (plan). WebCrypto DOM names are not in @types/node. */
+var MESH_KEY_ALGORITHM = {
+	name: "ECDSA",
+	namedCurve: "P-256"
+};
+/** Signing — ECDSA with SHA-256. */
+var MESH_SIGNING_ALGORITHM = {
+	name: "ECDSA",
+	hash: "SHA-256"
+};
+/** A node id: letters, digits, `.`, `_`, `-`; at most 63 characters; starts with a letter or digit. */
+var NODE_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,62}$/i;
+/** Ids no agent may take: the hub's own, whatever the case (D857). */
+var RESERVED_NODE_IDS = new Set(["hub"]);
+/** True for an id an agent may carry: the pattern, and not a reserved name. */
+function isValidAgentNodeId(nodeId) {
+	return NODE_ID_PATTERN.test(nodeId) && !RESERVED_NODE_IDS.has(nodeId.toLowerCase());
+}
+function freshSerial() {
+	return `00${randomBytes(16).toString("hex")}`;
+}
+function toPkcs8Pem(pkcs8) {
+	return `${PemConverter.encode(pkcs8, "PRIVATE KEY")}\n`;
+}
+function toCertPem(cert) {
+	return `${cert.toString("pem")}\n`;
+}
+async function exportKeyPem(key) {
+	return toPkcs8Pem(await webcrypto.subtle.exportKey("pkcs8", key));
+}
+/** SHA-256 fingerprint of the DER cert, colon-hex uppercase (Node style). */
+function caFingerprint(certPem) {
+	return new X509Certificate(certPem).fingerprint256;
+}
+/** Compact fingerprint (lowercase hex, no colons). */
+function caFingerprintCompact(certPem) {
+	return createHash("sha256").update(new X509Certificate(certPem).raw).digest("hex");
+}
+async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
+	const keys = await webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
+	const extensions = [
+		new BasicConstraintsExtension(true, 0, true),
+		new KeyUsagesExtension(KeyUsageFlags.keyCertSign | KeyUsageFlags.cRLSign, true),
+		await SubjectKeyIdentifierExtension.create(keys.publicKey)
+	];
+	const cert = await X509CertificateGenerator.createSelfSigned({
+		serialNumber: freshSerial(),
+		name: `CN=${MESH_CA_COMMON_NAME}`,
+		notBefore: backdatedNotBefore(now),
+		notAfter: new Date(now.getTime() + MESH_CA_VALIDITY_DAYS * MS_PER_DAY),
+		keys,
+		signingAlgorithm: MESH_SIGNING_ALGORITHM,
+		extensions
+	});
+	return {
+		certPem: toCertPem(cert),
+		keyPem: await exportKeyPem(keys.privateKey),
+		cert,
+		privateKey: keys.privateKey,
+		publicKey: keys.publicKey
+	};
+}
+async function loadMeshCa(certPem, keyPem) {
+	const cert = new X509Certificate$1(certPem);
+	return {
+		certPem,
+		keyPem,
+		cert,
+		privateKey: await webcrypto.subtle.importKey("pkcs8", PemConverter.decodeFirst(keyPem), MESH_KEY_ALGORITHM, true, ["sign"]),
+		publicKey: await cert.publicKey.export(webcrypto)
+	};
+}
+/**
+* Issue a leaf from a CSR. CN must be present; when `expectedNodeId` is set
+* it must match. Validity: 30 days.
+*/
+async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
+	const csr = new Pkcs10CertificateRequest(csrPem);
+	if (!await csr.verify(webcrypto)) throw new Error("CSR signature is invalid");
+	const cn = subjectCn(csr.subject);
+	if (cn === null || cn.length === 0) throw new Error("CSR subject has no CN");
+	if (opts.allowReserved !== true && !isValidAgentNodeId(cn)) throw new Error(`CSR CN '${cn}' is not an id an agent may carry`);
+	if (opts.expectedNodeId !== void 0 && opts.expectedNodeId !== cn) throw new Error(`CSR CN '${cn}' does not match the token nodeId '${opts.expectedNodeId}'`);
+	const now = opts.now ?? /* @__PURE__ */ new Date();
+	const validDays = opts.validDays ?? 30;
+	const serialNumber = freshSerial();
+	const notAfter = new Date(now.getTime() + validDays * MS_PER_DAY);
+	const extensions = [
+		new BasicConstraintsExtension(false, void 0, true),
+		new KeyUsagesExtension(KeyUsageFlags.digitalSignature, true),
+		new ExtendedKeyUsageExtension([SERVER_AUTH_OID, CLIENT_AUTH_OID]),
+		await SubjectKeyIdentifierExtension.create(csr.publicKey),
+		await AuthorityKeyIdentifierExtension.create(ca.cert)
+	];
+	return {
+		certPem: toCertPem(await X509CertificateGenerator.create({
+			serialNumber,
+			subject: `CN=${cn}`,
+			issuer: ca.cert.subject,
+			notBefore: backdatedNotBefore(now),
+			notAfter,
+			publicKey: csr.publicKey,
+			signingKey: ca.privateKey,
+			signingAlgorithm: MESH_SIGNING_ALGORITHM,
+			extensions
+		})),
+		serialNumber,
+		notAfter,
+		commonName: cn
+	};
+}
+/** Issue a leaf for a known nodeID with a freshly generated key pair (tests / hub self). */
+async function issueMeshLeafForNode(ca, nodeId, opts = {}) {
+	const keys = await webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
+	return {
+		...await issueMeshLeafFromCsr(ca, await createMeshCsrPem(keys, nodeId), {
+			expectedNodeId: nodeId,
+			now: opts.now,
+			validDays: opts.validDays,
+			allowReserved: true
+		}),
+		keyPem: await exportKeyPem(keys.privateKey)
+	};
+}
+function subjectCn(subject) {
+	return /(?:^|,)\s*CN\s*=\s*([^,]+)/i.exec(subject)?.[1]?.trim() ?? null;
+}
+async function createMeshCsrPem(keys, commonName) {
+	return `${(await Pkcs10CertificateRequestGenerator.create({
+		name: `CN=${commonName}`,
+		keys,
+		signingAlgorithm: MESH_SIGNING_ALGORITHM
+	})).toString("pem")}\n`;
+}
+async function generateMeshKeyPair() {
+	return webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
+}
+async function exportMeshPrivateKeyPem(key) {
+	return exportKeyPem(key);
+}
+//#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-ca-keeper.ts
-var SLOT$2 = Symbol.for("camstack.mesh.ca");
+var SLOT$3 = Symbol.for("camstack.mesh.ca");
 var NOT_LOADED = {
 	state: "unavailable",
 	reason: "not-loaded"
@@ -301,10 +454,10 @@ function isState(value) {
 	return state === "unavailable" && typeof Reflect.get(value, "reason") === "string";
 }
 function setProcessMeshCa(state) {
-	Reflect.set(globalThis, SLOT$2, state);
+	Reflect.set(globalThis, SLOT$3, state);
 }
 function getProcessMeshCaState() {
-	const value = Reflect.get(globalThis, SLOT$2);
+	const value = Reflect.get(globalThis, SLOT$3);
 	return isState(value) ? value : NOT_LOADED;
 }
 function requireProcessMeshCa() {
@@ -446,10 +599,10 @@ async function loadOrGenerateMeshCa(deps) {
 var MeshCrl = class {
 	serials = /* @__PURE__ */ new Set();
 	revoke(serialNumber) {
-		this.serials.add(normalizeSerial(serialNumber));
+		this.serials.add(normalizeSerial$1(serialNumber));
 	}
 	isRevoked(serialNumber) {
-		return this.serials.has(normalizeSerial(serialNumber));
+		return this.serials.has(normalizeSerial$1(serialNumber));
 	}
 	list() {
 		return [...this.serials];
@@ -457,21 +610,478 @@ var MeshCrl = class {
 	/** Restore from persisted serials (system-settings). */
 	replaceAll(serials) {
 		this.serials.clear();
-		for (const s of serials) this.serials.add(normalizeSerial(s));
+		for (const s of serials) this.serials.add(normalizeSerial$1(s));
 	}
 };
-function normalizeSerial(serial) {
+function normalizeSerial$1(serial) {
 	return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
 }
-var SLOT$1 = Symbol.for("camstack.mesh.crl");
+var SLOT$2 = Symbol.for("camstack.mesh.crl");
 function processMeshCrl() {
-	const existing = Reflect.get(globalThis, SLOT$1);
+	const existing = Reflect.get(globalThis, SLOT$2);
 	if (existing instanceof MeshCrl) return existing;
 	const crl = new MeshCrl();
-	Reflect.set(globalThis, SLOT$1, crl);
+	Reflect.set(globalThis, SLOT$2, crl);
 	return crl;
 }
 //#endregion
+//#region src/kernel/moleculer/mesh-mtls/mesh-certificate-registry.ts
+/**
+* The hub's record of every mesh leaf (D856): which certificate each node holds,
+* when it expires, and which serials are revoked.
+*
+* Three ways a row appears:
+*  - `enroll` / `renewal` / `boot` - the hub issued it and wrote it down at the
+*    moment of issuing (the authoritative record);
+*  - `observed` - a node enrolled before this record existed (or by a path that
+*    did not write it) presented this leaf on its LIVE mutual-TLS connection.
+*
+* Revoked serials are persisted here and replayed into the in-memory CRL at boot,
+* so a revocation survives a hub restart. Hub only: agents persist none of it.
+*/
+/**
+* @durable class=config owner=system-config
+*   write="the hub records every mesh leaf it issues (enroll, renewal, boot) and every
+*     leaf a connected node is observed presenting; a revocation stamps revokedAt"
+*   retention="a revoked or expired row is kept 90 days past its end, then reaped; a
+*     live row is never deleted. Forgetting a node does not delete its rows."
+*/
+var MESH_NODE_CERTIFICATES_COLLECTION = "mesh_node_certificates";
+var MESH_NODE_CERTIFICATES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "nodeId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "serial",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "fingerprint",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "notBefore",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "notAfter",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "issuedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "issuedVia",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "revokedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "revokedReason",
+		type: "TEXT"
+	}
+];
+var RETENTION_MS = 90 * 864e5;
+/**
+* A leaf the hub signed for a renewal that did not complete. It must not be the node's
+* `current` leaf, but it is NOT on the CRL: the node may still hold it (the swap
+* could have landed without the hub seeing it), and cutting it off would be the
+* outage the hand-over exists to prevent. If the node is later seen presenting it, it
+* is reinstated.
+*/
+var RENEWAL_ABANDONED = "renewal-abandoned";
+var VIAS = [
+	"enroll",
+	"pairing",
+	"renewal",
+	"boot",
+	"observed"
+];
+/** CN, serial, fingerprint and validity of a leaf PEM (or DER). */
+function describeMeshLeaf(cert) {
+	const x509 = new X509Certificate(cert);
+	return {
+		cn: subjectCn(x509.subject) ?? "",
+		serial: x509.serialNumber,
+		fingerprint: x509.fingerprint256,
+		notBefore: Date.parse(x509.validFrom),
+		notAfter: Date.parse(x509.validTo)
+	};
+}
+function normalizeSerial(serial) {
+	return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
+}
+function parse$2(data) {
+	const str = (k) => {
+		const v = data[k];
+		return typeof v === "string" && v.length > 0 ? v : null;
+	};
+	const num = (k) => {
+		const v = data[k];
+		return typeof v === "number" && Number.isFinite(v) ? v : null;
+	};
+	const nodeId = str("nodeId");
+	const serial = str("serial");
+	const fingerprint = str("fingerprint");
+	const notBefore = num("notBefore");
+	const notAfter = num("notAfter");
+	const issuedAt = num("issuedAt");
+	if (nodeId === null || serial === null || fingerprint === null || notBefore === null || notAfter === null || issuedAt === null) return null;
+	return {
+		nodeId,
+		serial,
+		fingerprint,
+		notBefore,
+		notAfter,
+		issuedAt,
+		issuedVia: VIAS.find((v) => v === data["issuedVia"]) ?? "observed",
+		revokedAt: num("revokedAt"),
+		revokedReason: str("revokedReason")
+	};
+}
+var MeshCertificateRegistry = class {
+	store;
+	deps;
+	rows = /* @__PURE__ */ new Map();
+	constructor(store, deps = {}) {
+		this.store = store;
+		this.deps = deps;
+	}
+	recordToBody(record) {
+		return {
+			nodeId: record.nodeId,
+			serial: record.serial,
+			fingerprint: record.fingerprint,
+			notBefore: record.notBefore,
+			notAfter: record.notAfter,
+			issuedAt: record.issuedAt,
+			issuedVia: record.issuedVia,
+			revokedAt: record.revokedAt,
+			revokedReason: record.revokedReason
+		};
+	}
+	now() {
+		return (this.deps.now ?? Date.now)();
+	}
+	async load() {
+		const kind = this.deps.meshKind ?? null;
+		if (kind !== null) {
+			const page = await kind.query({ limit: 1e4 });
+			for (const row of page.records) {
+				const { fingerprint: _fp, ...body } = row.data;
+				const record = parse$2({
+					...body,
+					fingerprint: row.id
+				});
+				if (record !== null) this.rows.set(record.fingerprint, record);
+			}
+			return;
+		}
+		const rows = await this.store.query.query({ collection: MESH_NODE_CERTIFICATES_COLLECTION });
+		for (const row of rows) {
+			const record = parse$2(row.data);
+			if (record !== null) this.rows.set(record.fingerprint, record);
+		}
+	}
+	/** Write down a leaf the hub just issued. Idempotent per fingerprint. */
+	async recordIssued(nodeId, certPem, via) {
+		const leaf = describeMeshLeaf(certPem);
+		const existing = this.rows.get(leaf.fingerprint);
+		if (existing !== void 0) return existing;
+		const record = {
+			nodeId,
+			serial: leaf.serial,
+			fingerprint: leaf.fingerprint,
+			notBefore: leaf.notBefore,
+			notAfter: leaf.notAfter,
+			issuedAt: this.now(),
+			issuedVia: via,
+			revokedAt: null,
+			revokedReason: null
+		};
+		await this.insert(record);
+		this.deps.logger?.info("Mesh certificate recorded", {
+			tags: { nodeId },
+			meta: {
+				via,
+				serial: leaf.serial,
+				notAfter: new Date(leaf.notAfter).toISOString()
+			}
+		});
+		return record;
+	}
+	/**
+	* A node was seen presenting `leaf` on its live connection. A leaf the hub already
+	* knows is left alone; an unknown one is recorded `observed` (a node enrolled
+	* before this record existed).
+	*/
+	async recordObserved(nodeId, leaf) {
+		const known = this.rows.get(leaf.fingerprint);
+		if (known !== void 0) {
+			if (known.revokedReason !== "renewal-abandoned") return known.revokedAt === null ? this.abandonRenewalsNewerThan(known) : false;
+			const reinstated = {
+				...known,
+				revokedAt: null,
+				revokedReason: null
+			};
+			this.rows.set(known.fingerprint, reinstated);
+			await this.persist(reinstated);
+			this.deps.logger?.warn("An abandoned renewal leaf is in use - reinstated", {
+				tags: { nodeId },
+				meta: { serial: known.serial }
+			});
+			return true;
+		}
+		const record = {
+			nodeId,
+			serial: leaf.serial,
+			fingerprint: leaf.fingerprint,
+			notBefore: leaf.notBefore,
+			notAfter: leaf.notAfter,
+			issuedAt: this.now(),
+			issuedVia: "observed",
+			revokedAt: null,
+			revokedReason: null
+		};
+		await this.insert(record);
+		this.deps.logger?.info("Mesh certificate observed on a live connection and recorded", {
+			tags: { nodeId },
+			meta: {
+				serial: leaf.serial,
+				fingerprint: leaf.fingerprint
+			}
+		});
+		return true;
+	}
+	list(nodeId) {
+		return [...this.rows.values()].filter((r) => nodeId === void 0 || r.nodeId === nodeId).toSorted((a, b) => b.issuedAt - a.issuedAt);
+	}
+	/** The newest non-revoked leaf of a node, or `undefined`. */
+	currentFor(nodeId) {
+		return this.list(nodeId).find((r) => r.revokedAt === null);
+	}
+	/** Every non-revoked leaf of a node (a renewal in flight has two). */
+	liveFor(nodeId) {
+		return this.list(nodeId).filter((r) => r.revokedAt === null);
+	}
+	/** Stamp a leaf revoked (and mirror it into `crl`). `false` when unknown or already revoked. */
+	async revoke(fingerprint, reason, crl) {
+		const record = this.rows.get(fingerprint);
+		if (record === void 0 || record.revokedAt !== null) return false;
+		const revoked = {
+			...record,
+			revokedAt: this.now(),
+			revokedReason: reason
+		};
+		this.rows.set(fingerprint, revoked);
+		crl?.revoke(record.serial);
+		await this.persist(revoked);
+		this.deps.logger?.warn("Mesh certificate revoked", {
+			tags: { nodeId: record.nodeId },
+			meta: {
+				serial: record.serial,
+				reason
+			}
+		});
+		return true;
+	}
+	/**
+	* Operator revocation of a whole node: EVERY leaf of the node that is not already on the
+	* CRL goes on it - the current one, an observed one, a renewal one, and a leaf that was set
+	* aside (`renewal-abandoned`: a copy of it may sit on a stolen box, and it must not stay
+	* valid just because the hub once set it aside). Returns the serials put on the CRL.
+	* A leaf revoked this way is never reinstated by `recordObserved`.
+	*/
+	async revokeAllForNode(nodeId, reason, crl, keepFingerprint) {
+		const serials = [];
+		for (const record of this.list(nodeId)) {
+			if (keepFingerprint !== void 0 && record.fingerprint === keepFingerprint) continue;
+			if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned") continue;
+			const revoked = {
+				...record,
+				revokedAt: record.revokedAt ?? this.now(),
+				revokedReason: reason
+			};
+			this.rows.set(record.fingerprint, revoked);
+			crl.revoke(record.serial);
+			await this.persist(revoked);
+			serials.push(record.serial);
+		}
+		if (serials.length > 0) this.deps.logger?.warn("Every mesh certificate of the node revoked", {
+			tags: { nodeId },
+			meta: {
+				serials,
+				reason
+			}
+		});
+		return serials;
+	}
+	/**
+	* At boot: a node with TWO live leaves had a renewal in flight when the hub stopped. The
+	* newer (renewal) one is set aside - it is not the node's current leaf until the node is
+	* seen presenting it, which reinstates it. It is NOT put on the CRL.
+	*/
+	async settleInterruptedRenewals() {
+		let settled = 0;
+		const byNode = /* @__PURE__ */ new Map();
+		for (const record of this.rows.values()) {
+			if (record.revokedAt !== null) continue;
+			byNode.set(record.nodeId, [...byNode.get(record.nodeId) ?? [], record]);
+		}
+		for (const records of byNode.values()) {
+			if (records.length < 2) continue;
+			for (const record of records) if (record.issuedVia === "renewal" && await this.abandon(record.fingerprint)) settled += 1;
+		}
+		return settled;
+	}
+	/** Set a never-completed renewal leaf aside (not current, NOT on the CRL). */
+	/** Fingerprints of renewal leaves whose handover is running right now (this process only). */
+	renewalsInFlight = /* @__PURE__ */ new Set();
+	/**
+	* A renewal's leaf is "in flight" from signing until the handover ends. While it is, a node seen
+	* presenting its OLD leaf is simply not swapped yet: the new leaf is not set aside (that would
+	* flap set-aside / reinstate on the node's first connection with it).
+	*/
+	beginRenewal(fingerprint) {
+		this.renewalsInFlight.add(fingerprint);
+	}
+	endRenewal(fingerprint) {
+		this.renewalsInFlight.delete(fingerprint);
+	}
+	async abandonRenewalsNewerThan(presented) {
+		let changed = false;
+		for (const record of this.liveFor(presented.nodeId)) {
+			if (record.fingerprint === presented.fingerprint) continue;
+			if (record.issuedVia !== "renewal" || record.issuedAt <= presented.issuedAt) continue;
+			if (this.renewalsInFlight.has(record.fingerprint)) continue;
+			if (await this.abandon(record.fingerprint)) changed = true;
+		}
+		return changed;
+	}
+	async abandon(fingerprint) {
+		const record = this.rows.get(fingerprint);
+		if (record === void 0 || record.revokedAt !== null) return false;
+		const abandoned = {
+			...record,
+			revokedAt: this.now(),
+			revokedReason: RENEWAL_ABANDONED
+		};
+		this.rows.set(fingerprint, abandoned);
+		await this.persist(abandoned);
+		this.deps.logger?.warn("Renewal leaf set aside (not current, not on the CRL)", {
+			tags: { nodeId: record.nodeId },
+			meta: { serial: record.serial }
+		});
+		return true;
+	}
+	/** Replay every persisted revocation into `crl` (hub boot). Set-aside leaves are not revocations. */
+	restoreCrl(crl) {
+		let restored = 0;
+		for (const record of this.rows.values()) {
+			if (record.revokedAt === null || record.revokedReason === "renewal-abandoned") continue;
+			crl.revoke(record.serial);
+			restored += 1;
+		}
+		return restored;
+	}
+	/** Is `serial` listed as revoked here? */
+	isRevoked(serial) {
+		const wanted = normalizeSerial(serial);
+		for (const record of this.rows.values()) if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned" && normalizeSerial(record.serial) === wanted) return true;
+		return false;
+	}
+	async reap() {
+		const cutoff = this.now() - RETENTION_MS;
+		const dead = [...this.rows.values()].filter((r) => (r.revokedAt ?? r.notAfter) < cutoff);
+		for (const r of dead) {
+			this.rows.delete(r.fingerprint);
+			await this.deleteRow(r.fingerprint);
+		}
+		return dead.length;
+	}
+	async insert(record) {
+		this.rows.set(record.fingerprint, record);
+		const kind = this.deps.meshKind ?? null;
+		if (kind !== null) {
+			const parsed = systemConfigRecordKinds["mesh-node-certificates"].schema.safeParse(this.recordToBody(record));
+			if (!parsed.success) throw new Error(parsed.error.message);
+			await kind.put({
+				id: record.fingerprint,
+				data: parsed.data
+			});
+			return;
+		}
+		await this.store.insert.mutate({
+			collection: MESH_NODE_CERTIFICATES_COLLECTION,
+			record: {
+				id: record.fingerprint,
+				data: { ...record }
+			}
+		});
+	}
+	async deleteRow(fingerprint) {
+		const kind = this.deps.meshKind ?? null;
+		if (kind !== null) {
+			await kind.delete(fingerprint);
+			return;
+		}
+		await this.store.delete.mutate({
+			collection: MESH_NODE_CERTIFICATES_COLLECTION,
+			key: fingerprint
+		});
+	}
+	async persist(record) {
+		try {
+			const kind = this.deps.meshKind ?? null;
+			if (kind !== null) {
+				const parsed = systemConfigRecordKinds["mesh-node-certificates"].schema.safeParse(this.recordToBody(record));
+				if (!parsed.success) throw new Error(parsed.error.message);
+				await kind.put({
+					id: record.fingerprint,
+					data: parsed.data
+				});
+				return;
+			}
+			await this.store.update.mutate({
+				collection: MESH_NODE_CERTIFICATES_COLLECTION,
+				id: record.fingerprint,
+				data: { ...record }
+			});
+		} catch (error) {
+			this.deps.logger?.error("Mesh certificate write failed - the change holds until restart", {
+				tags: { nodeId: record.nodeId },
+				meta: { error: error instanceof Error ? error.message : String(error) }
+			});
+		}
+	}
+};
+var SLOT$1 = Symbol.for("camstack.mesh.certificate-registry");
+function setProcessMeshCertificateRegistry(registry) {
+	if (registry === null) Reflect.deleteProperty(globalThis, SLOT$1);
+	else Reflect.set(globalThis, SLOT$1, registry);
+}
+function getProcessMeshCertificateRegistry() {
+	const value = Reflect.get(globalThis, SLOT$1);
+	return value !== null && typeof value === "object" && typeof Reflect.get(value, "recordIssued") === "function" ? value : null;
+}
+//#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-tls-gate.ts
 var STATE_SLOT = Symbol.for("camstack.mesh.tls-listener-state");
 function setProcessMeshTlsListenerState(state) {
@@ -88264,4 +88874,4 @@ function parseMintUnlockInput(input) {
 	};
 }
 //#endregion
-export { parseCidrList as $, setProcessMeshPeerTransportLookup as A, requireProcessMeshCa as B, setProcessMeshTlsEnabler as C, getProcessPeerLeaf as D, getProcessNodeMeshTransport as E, setProcessMeshTlsListenerState as F, AGENT_UI_UNLOCK_VERSION as G, AGENT_UI_UNLOCK_TTL_MS as H, MeshCrl as I, mintAgentUiUnlockTicket as J, UnlockTicketJtiStore as K, processMeshCrl as L, revokeMeshCertificate as M, getProcessMeshTlsListenerState as N, isProcessVerifiedMeshPeer as O, openMeshTlsWhenRevocationsLoaded as P, normalizeIp as Q, MeshCaKeeper as R, ServiceBroker as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, emitProcessNodeRegistered as T, AGENT_UI_UNLOCK_TYP as U, AGENT_DASHBOARD_ORIGINS_FIELD as V, AGENT_UI_UNLOCK_USE as W, verifyAgentUiUnlockTicket as X, parseAgentDashboardOrigins as Y, createCidrMatcher as Z, signPairingProof as _, hubHostFromMeshAddress as a, TlsTcpTransporter as b, PAIRING_MAX_SESSIONS as c, PAIRING_PROTOCOL as d, readCidrSetting as et, PAIRING_TTL_MS as f, keyFingerprintShort as g, describeCsr as h, AgentPairing as i, renewMeshCertificate as j, onProcessNodeRegistered as k, PAIRING_PATHS as l, computePairingSas as m, HubPairing as n, PAIRING_CODE_DIGITS as o, computePairingCommitment as p, isAllowedAgentDashboardReturnTo as q, PairingHttpError as r, PAIRING_MAX_CODE_ATTEMPTS as s, systemConfigMeshActions as t, PAIRING_PIN_DIGITS as u, verifyPairingProof as v, dropProcessPeer as w, Errors as x, MESH_TLS_PORT_HELLO_FIELD as y, getProcessMeshCaState as z };
+export { generateMeshKeyPair as $, setProcessMeshPeerTransportLookup as A, describeMeshLeaf as B, setProcessMeshTlsEnabler as C, getProcessPeerLeaf as D, getProcessNodeMeshTransport as E, setProcessMeshTlsListenerState as F, MeshCaKeeper as G, setProcessMeshCertificateRegistry as H, MESH_NODE_CERTIFICATES_COLLECTION as I, caFingerprint as J, getProcessMeshCaState as K, MESH_NODE_CERTIFICATES_COLUMNS as L, revokeMeshCertificate as M, getProcessMeshTlsListenerState as N, isProcessVerifiedMeshPeer as O, openMeshTlsWhenRevocationsLoaded as P, generateMeshCa as Q, MeshCertificateRegistry as R, ServiceBroker as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, emitProcessNodeRegistered as T, MeshCrl as U, getProcessMeshCertificateRegistry as V, processMeshCrl as W, createMeshCsrPem as X, caFingerprintCompact as Y, exportMeshPrivateKeyPem as Z, signPairingProof as _, readCidrSetting as _t, hubHostFromMeshAddress as a, AGENT_UI_UNLOCK_TTL_MS as at, TlsTcpTransporter as b, PAIRING_MAX_SESSIONS as c, AGENT_UI_UNLOCK_VERSION as ct, PAIRING_PROTOCOL as d, mintAgentUiUnlockTicket as dt, isValidAgentNodeId as et, PAIRING_TTL_MS as f, parseAgentDashboardOrigins as ft, keyFingerprintShort as g, parseCidrList as gt, describeCsr as h, normalizeIp as ht, AgentPairing as i, AGENT_DASHBOARD_ORIGINS_FIELD as it, renewMeshCertificate as j, onProcessNodeRegistered as k, PAIRING_PATHS as l, UnlockTicketJtiStore as lt, computePairingSas as m, createCidrMatcher as mt, HubPairing as n, issueMeshLeafFromCsr as nt, PAIRING_CODE_DIGITS as o, AGENT_UI_UNLOCK_TYP as ot, computePairingCommitment as p, verifyAgentUiUnlockTicket as pt, requireProcessMeshCa as q, PairingHttpError as r, loadMeshCa as rt, PAIRING_MAX_CODE_ATTEMPTS as s, AGENT_UI_UNLOCK_USE as st, systemConfigMeshActions as t, issueMeshLeafForNode as tt, PAIRING_PIN_DIGITS as u, isAllowedAgentDashboardReturnTo as ut, verifyPairingProof as v, dropProcessPeer as w, Errors as x, MESH_TLS_PORT_HELLO_FIELD as y, RENEWAL_ABANDONED as z };