@camstack/system 1.2.458 → 1.2.460

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,9 +1,9 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Gi as defineCustomActions, Ui as customAction, Zi as hydrateSchema, ni as BaseAddon, ti as errMsg, ut as ServerNameSchema, xr as shortHostname } from "../../dist-B_GRPhnY.mjs";
+import { Ui as customAction, Wi as defineCustomActions, Xi as hydrateSchema, ni as BaseAddon, ti as errMsg, ut as ServerNameSchema, xr as shortHostname } from "../../dist-Wy8cTxg6.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
-import { c as Pkcs10CertificateRequest } from "../../x509.es-DK__ETIe.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "../../constants-FGjnsE2x.mjs";
-import { $ as generateMeshCa, B as setProcessAgentHttpsNames, H as MESH_NODE_CERTIFICATES_COLLECTION, I as AGENT_HTTPS_NAMES_COLLECTION, J as setProcessMeshCertificateRegistry, K as describeMeshLeaf, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, Q as exportMeshPrivateKeyPem, R as AgentHttpsNames, U as MESH_NODE_CERTIFICATES_COLUMNS, V as systemConfigRecordKinds, W as MeshCertificateRegistry, X as caFingerprintCompact, Z as createMeshCsrPem, at as subjectCn, et as generateMeshKeyPair, it as loadMeshCa, nt as issueMeshLeafForNode, rt as issueMeshLeafFromCsr, tt as isValidAgentNodeId, u as isPrivateAddress, z as getProcessAgentHttpsNames } from "../../agent-https-CQA3W-3e.mjs";
+import { S as backdatedNotBefore, a as KeyUsageFlags, c as Pkcs10CertificateRequest, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, l as Pkcs10CertificateRequestGenerator, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension } from "../../x509.es-DK__ETIe.mjs";
+import { B as setProcessAgentHttpsNames, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, R as AgentHttpsNames, V as systemConfigRecordKinds, u as isPrivateAddress, z as getProcessAgentHttpsNames } from "../../agent-https-Iw3RSQup.mjs";
+import { a as MESH_CA_KEY_REF, c as SERVER_AUTH_OID, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "../../constants-BnkOdj9Q.mjs";
 import { t as require_src } from "../../src-hG4grMU4.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createPrivateKey, randomBytes, randomInt, sign, timingSafeEqual, verify, webcrypto } from "node:crypto";
@@ -288,8 +288,161 @@ function parsePayload(value) {
 	};
 }
 //#endregion
+//#region src/kernel/moleculer/mesh-mtls/mesh-ca.ts
+/**
+* Hub mesh CA — EC P-256, key in the keychain, cert in `cluster.meshCa`.
+*
+* Distinct from the HTTPS local CA (`tls/cert-issue.ts`, RSA): the mesh CA
+* signs node leaves (CN = nodeID) and unlock-ticket JWS (ES256). Issuance uses
+* `@peculiar/x509` over WebCrypto — same library the HTTPS path already uses
+* (installed `1.14.3`; registry latest at adoption time was `2.1.0` — stay on
+* the pinned range already shipping).
+*/
+cryptoProvider.set(webcrypto);
+var MS_PER_DAY = 864e5;
+/** Key generation — EC P-256 (plan). WebCrypto DOM names are not in @types/node. */
+var MESH_KEY_ALGORITHM = {
+	name: "ECDSA",
+	namedCurve: "P-256"
+};
+/** Signing — ECDSA with SHA-256. */
+var MESH_SIGNING_ALGORITHM = {
+	name: "ECDSA",
+	hash: "SHA-256"
+};
+/** A node id: letters, digits, `.`, `_`, `-`; at most 63 characters; starts with a letter or digit. */
+var NODE_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,62}$/i;
+/** Ids no agent may take: the hub's own, whatever the case (D857). */
+var RESERVED_NODE_IDS = new Set(["hub"]);
+/** True for an id an agent may carry: the pattern, and not a reserved name. */
+function isValidAgentNodeId(nodeId) {
+	return NODE_ID_PATTERN.test(nodeId) && !RESERVED_NODE_IDS.has(nodeId.toLowerCase());
+}
+function freshSerial() {
+	return `00${randomBytes(16).toString("hex")}`;
+}
+function toPkcs8Pem(pkcs8) {
+	return `${PemConverter.encode(pkcs8, "PRIVATE KEY")}\n`;
+}
+function toCertPem(cert) {
+	return `${cert.toString("pem")}\n`;
+}
+async function exportKeyPem(key) {
+	return toPkcs8Pem(await webcrypto.subtle.exportKey("pkcs8", key));
+}
+/** SHA-256 fingerprint of the DER cert, colon-hex uppercase (Node style). */
+function caFingerprint(certPem) {
+	return new X509Certificate(certPem).fingerprint256;
+}
+/** Compact fingerprint (lowercase hex, no colons). */
+function caFingerprintCompact(certPem) {
+	return createHash("sha256").update(new X509Certificate(certPem).raw).digest("hex");
+}
+async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
+	const keys = await webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
+	const extensions = [
+		new BasicConstraintsExtension(true, 0, true),
+		new KeyUsagesExtension(KeyUsageFlags.keyCertSign | KeyUsageFlags.cRLSign, true),
+		await SubjectKeyIdentifierExtension.create(keys.publicKey)
+	];
+	const cert = await X509CertificateGenerator.createSelfSigned({
+		serialNumber: freshSerial(),
+		name: `CN=${MESH_CA_COMMON_NAME}`,
+		notBefore: backdatedNotBefore(now),
+		notAfter: new Date(now.getTime() + MESH_CA_VALIDITY_DAYS * MS_PER_DAY),
+		keys,
+		signingAlgorithm: MESH_SIGNING_ALGORITHM,
+		extensions
+	});
+	return {
+		certPem: toCertPem(cert),
+		keyPem: await exportKeyPem(keys.privateKey),
+		cert,
+		privateKey: keys.privateKey,
+		publicKey: keys.publicKey
+	};
+}
+async function loadMeshCa(certPem, keyPem) {
+	const cert = new X509Certificate$1(certPem);
+	return {
+		certPem,
+		keyPem,
+		cert,
+		privateKey: await webcrypto.subtle.importKey("pkcs8", PemConverter.decodeFirst(keyPem), MESH_KEY_ALGORITHM, true, ["sign"]),
+		publicKey: await cert.publicKey.export(webcrypto)
+	};
+}
+/**
+* Issue a leaf from a CSR. CN must be present; when `expectedNodeId` is set
+* it must match. Validity: 30 days.
+*/
+async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
+	const csr = new Pkcs10CertificateRequest(csrPem);
+	if (!await csr.verify(webcrypto)) throw new Error("CSR signature is invalid");
+	const cn = subjectCn(csr.subject);
+	if (cn === null || cn.length === 0) throw new Error("CSR subject has no CN");
+	if (opts.allowReserved !== true && !isValidAgentNodeId(cn)) throw new Error(`CSR CN '${cn}' is not an id an agent may carry`);
+	if (opts.expectedNodeId !== void 0 && opts.expectedNodeId !== cn) throw new Error(`CSR CN '${cn}' does not match the token nodeId '${opts.expectedNodeId}'`);
+	const now = opts.now ?? /* @__PURE__ */ new Date();
+	const validDays = opts.validDays ?? 30;
+	const serialNumber = freshSerial();
+	const notAfter = new Date(now.getTime() + validDays * MS_PER_DAY);
+	const extensions = [
+		new BasicConstraintsExtension(false, void 0, true),
+		new KeyUsagesExtension(KeyUsageFlags.digitalSignature, true),
+		new ExtendedKeyUsageExtension([SERVER_AUTH_OID, CLIENT_AUTH_OID]),
+		await SubjectKeyIdentifierExtension.create(csr.publicKey),
+		await AuthorityKeyIdentifierExtension.create(ca.cert)
+	];
+	return {
+		certPem: toCertPem(await X509CertificateGenerator.create({
+			serialNumber,
+			subject: `CN=${cn}`,
+			issuer: ca.cert.subject,
+			notBefore: backdatedNotBefore(now),
+			notAfter,
+			publicKey: csr.publicKey,
+			signingKey: ca.privateKey,
+			signingAlgorithm: MESH_SIGNING_ALGORITHM,
+			extensions
+		})),
+		serialNumber,
+		notAfter,
+		commonName: cn
+	};
+}
+/** Issue a leaf for a known nodeID with a freshly generated key pair (tests / hub self). */
+async function issueMeshLeafForNode(ca, nodeId, opts = {}) {
+	const keys = await webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
+	return {
+		...await issueMeshLeafFromCsr(ca, await createMeshCsrPem(keys, nodeId), {
+			expectedNodeId: nodeId,
+			now: opts.now,
+			validDays: opts.validDays,
+			allowReserved: true
+		}),
+		keyPem: await exportKeyPem(keys.privateKey)
+	};
+}
+function subjectCn(subject) {
+	return /(?:^|,)\s*CN\s*=\s*([^,]+)/i.exec(subject)?.[1]?.trim() ?? null;
+}
+async function createMeshCsrPem(keys, commonName) {
+	return `${(await Pkcs10CertificateRequestGenerator.create({
+		name: `CN=${commonName}`,
+		keys,
+		signingAlgorithm: MESH_SIGNING_ALGORITHM
+	})).toString("pem")}\n`;
+}
+async function generateMeshKeyPair() {
+	return webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
+}
+async function exportMeshPrivateKeyPem(key) {
+	return exportKeyPem(key);
+}
+//#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-ca-keeper.ts
-var SLOT$2 = Symbol.for("camstack.mesh.ca");
+var SLOT$3 = Symbol.for("camstack.mesh.ca");
 var NOT_LOADED = {
 	state: "unavailable",
 	reason: "not-loaded"
@@ -301,10 +454,10 @@ function isState(value) {
 	return state === "unavailable" && typeof Reflect.get(value, "reason") === "string";
 }
 function setProcessMeshCa(state) {
-	Reflect.set(globalThis, SLOT$2, state);
+	Reflect.set(globalThis, SLOT$3, state);
 }
 function getProcessMeshCaState() {
-	const value = Reflect.get(globalThis, SLOT$2);
+	const value = Reflect.get(globalThis, SLOT$3);
 	return isState(value) ? value : NOT_LOADED;
 }
 function requireProcessMeshCa() {
@@ -446,10 +599,10 @@ async function loadOrGenerateMeshCa(deps) {
 var MeshCrl = class {
 	serials = /* @__PURE__ */ new Set();
 	revoke(serialNumber) {
-		this.serials.add(normalizeSerial(serialNumber));
+		this.serials.add(normalizeSerial$1(serialNumber));
 	}
 	isRevoked(serialNumber) {
-		return this.serials.has(normalizeSerial(serialNumber));
+		return this.serials.has(normalizeSerial$1(serialNumber));
 	}
 	list() {
 		return [...this.serials];
@@ -457,21 +610,478 @@ var MeshCrl = class {
 	/** Restore from persisted serials (system-settings). */
 	replaceAll(serials) {
 		this.serials.clear();
-		for (const s of serials) this.serials.add(normalizeSerial(s));
+		for (const s of serials) this.serials.add(normalizeSerial$1(s));
 	}
 };
-function normalizeSerial(serial) {
+function normalizeSerial$1(serial) {
 	return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
 }
-var SLOT$1 = Symbol.for("camstack.mesh.crl");
+var SLOT$2 = Symbol.for("camstack.mesh.crl");
 function processMeshCrl() {
-	const existing = Reflect.get(globalThis, SLOT$1);
+	const existing = Reflect.get(globalThis, SLOT$2);
 	if (existing instanceof MeshCrl) return existing;
 	const crl = new MeshCrl();
-	Reflect.set(globalThis, SLOT$1, crl);
+	Reflect.set(globalThis, SLOT$2, crl);
 	return crl;
 }
 //#endregion
+//#region src/kernel/moleculer/mesh-mtls/mesh-certificate-registry.ts
+/**
+* The hub's record of every mesh leaf (D856): which certificate each node holds,
+* when it expires, and which serials are revoked.
+*
+* Three ways a row appears:
+*  - `enroll` / `renewal` / `boot` - the hub issued it and wrote it down at the
+*    moment of issuing (the authoritative record);
+*  - `observed` - a node enrolled before this record existed (or by a path that
+*    did not write it) presented this leaf on its LIVE mutual-TLS connection.
+*
+* Revoked serials are persisted here and replayed into the in-memory CRL at boot,
+* so a revocation survives a hub restart. Hub only: agents persist none of it.
+*/
+/**
+* @durable class=config owner=system-config
+*   write="the hub records every mesh leaf it issues (enroll, renewal, boot) and every
+*     leaf a connected node is observed presenting; a revocation stamps revokedAt"
+*   retention="a revoked or expired row is kept 90 days past its end, then reaped; a
+*     live row is never deleted. Forgetting a node does not delete its rows."
+*/
+var MESH_NODE_CERTIFICATES_COLLECTION = "mesh_node_certificates";
+var MESH_NODE_CERTIFICATES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "nodeId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "serial",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "fingerprint",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "notBefore",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "notAfter",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "issuedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "issuedVia",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "revokedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "revokedReason",
+		type: "TEXT"
+	}
+];
+var RETENTION_MS = 90 * 864e5;
+/**
+* A leaf the hub signed for a renewal that did not complete. It must not be the node's
+* `current` leaf, but it is NOT on the CRL: the node may still hold it (the swap
+* could have landed without the hub seeing it), and cutting it off would be the
+* outage the hand-over exists to prevent. If the node is later seen presenting it, it
+* is reinstated.
+*/
+var RENEWAL_ABANDONED = "renewal-abandoned";
+var VIAS = [
+	"enroll",
+	"pairing",
+	"renewal",
+	"boot",
+	"observed"
+];
+/** CN, serial, fingerprint and validity of a leaf PEM (or DER). */
+function describeMeshLeaf(cert) {
+	const x509 = new X509Certificate(cert);
+	return {
+		cn: subjectCn(x509.subject) ?? "",
+		serial: x509.serialNumber,
+		fingerprint: x509.fingerprint256,
+		notBefore: Date.parse(x509.validFrom),
+		notAfter: Date.parse(x509.validTo)
+	};
+}
+function normalizeSerial(serial) {
+	return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
+}
+function parse$2(data) {
+	const str = (k) => {
+		const v = data[k];
+		return typeof v === "string" && v.length > 0 ? v : null;
+	};
+	const num = (k) => {
+		const v = data[k];
+		return typeof v === "number" && Number.isFinite(v) ? v : null;
+	};
+	const nodeId = str("nodeId");
+	const serial = str("serial");
+	const fingerprint = str("fingerprint");
+	const notBefore = num("notBefore");
+	const notAfter = num("notAfter");
+	const issuedAt = num("issuedAt");
+	if (nodeId === null || serial === null || fingerprint === null || notBefore === null || notAfter === null || issuedAt === null) return null;
+	return {
+		nodeId,
+		serial,
+		fingerprint,
+		notBefore,
+		notAfter,
+		issuedAt,
+		issuedVia: VIAS.find((v) => v === data["issuedVia"]) ?? "observed",
+		revokedAt: num("revokedAt"),
+		revokedReason: str("revokedReason")
+	};
+}
+var MeshCertificateRegistry = class {
+	store;
+	deps;
+	rows = /* @__PURE__ */ new Map();
+	constructor(store, deps = {}) {
+		this.store = store;
+		this.deps = deps;
+	}
+	recordToBody(record) {
+		return {
+			nodeId: record.nodeId,
+			serial: record.serial,
+			fingerprint: record.fingerprint,
+			notBefore: record.notBefore,
+			notAfter: record.notAfter,
+			issuedAt: record.issuedAt,
+			issuedVia: record.issuedVia,
+			revokedAt: record.revokedAt,
+			revokedReason: record.revokedReason
+		};
+	}
+	now() {
+		return (this.deps.now ?? Date.now)();
+	}
+	async load() {
+		const kind = this.deps.meshKind ?? null;
+		if (kind !== null) {
+			const page = await kind.query({ limit: 1e4 });
+			for (const row of page.records) {
+				const { fingerprint: _fp, ...body } = row.data;
+				const record = parse$2({
+					...body,
+					fingerprint: row.id
+				});
+				if (record !== null) this.rows.set(record.fingerprint, record);
+			}
+			return;
+		}
+		const rows = await this.store.query.query({ collection: MESH_NODE_CERTIFICATES_COLLECTION });
+		for (const row of rows) {
+			const record = parse$2(row.data);
+			if (record !== null) this.rows.set(record.fingerprint, record);
+		}
+	}
+	/** Write down a leaf the hub just issued. Idempotent per fingerprint. */
+	async recordIssued(nodeId, certPem, via) {
+		const leaf = describeMeshLeaf(certPem);
+		const existing = this.rows.get(leaf.fingerprint);
+		if (existing !== void 0) return existing;
+		const record = {
+			nodeId,
+			serial: leaf.serial,
+			fingerprint: leaf.fingerprint,
+			notBefore: leaf.notBefore,
+			notAfter: leaf.notAfter,
+			issuedAt: this.now(),
+			issuedVia: via,
+			revokedAt: null,
+			revokedReason: null
+		};
+		await this.insert(record);
+		this.deps.logger?.info("Mesh certificate recorded", {
+			tags: { nodeId },
+			meta: {
+				via,
+				serial: leaf.serial,
+				notAfter: new Date(leaf.notAfter).toISOString()
+			}
+		});
+		return record;
+	}
+	/**
+	* A node was seen presenting `leaf` on its live connection. A leaf the hub already
+	* knows is left alone; an unknown one is recorded `observed` (a node enrolled
+	* before this record existed).
+	*/
+	async recordObserved(nodeId, leaf) {
+		const known = this.rows.get(leaf.fingerprint);
+		if (known !== void 0) {
+			if (known.revokedReason !== "renewal-abandoned") return known.revokedAt === null ? this.abandonRenewalsNewerThan(known) : false;
+			const reinstated = {
+				...known,
+				revokedAt: null,
+				revokedReason: null
+			};
+			this.rows.set(known.fingerprint, reinstated);
+			await this.persist(reinstated);
+			this.deps.logger?.warn("An abandoned renewal leaf is in use - reinstated", {
+				tags: { nodeId },
+				meta: { serial: known.serial }
+			});
+			return true;
+		}
+		const record = {
+			nodeId,
+			serial: leaf.serial,
+			fingerprint: leaf.fingerprint,
+			notBefore: leaf.notBefore,
+			notAfter: leaf.notAfter,
+			issuedAt: this.now(),
+			issuedVia: "observed",
+			revokedAt: null,
+			revokedReason: null
+		};
+		await this.insert(record);
+		this.deps.logger?.info("Mesh certificate observed on a live connection and recorded", {
+			tags: { nodeId },
+			meta: {
+				serial: leaf.serial,
+				fingerprint: leaf.fingerprint
+			}
+		});
+		return true;
+	}
+	list(nodeId) {
+		return [...this.rows.values()].filter((r) => nodeId === void 0 || r.nodeId === nodeId).toSorted((a, b) => b.issuedAt - a.issuedAt);
+	}
+	/** The newest non-revoked leaf of a node, or `undefined`. */
+	currentFor(nodeId) {
+		return this.list(nodeId).find((r) => r.revokedAt === null);
+	}
+	/** Every non-revoked leaf of a node (a renewal in flight has two). */
+	liveFor(nodeId) {
+		return this.list(nodeId).filter((r) => r.revokedAt === null);
+	}
+	/** Stamp a leaf revoked (and mirror it into `crl`). `false` when unknown or already revoked. */
+	async revoke(fingerprint, reason, crl) {
+		const record = this.rows.get(fingerprint);
+		if (record === void 0 || record.revokedAt !== null) return false;
+		const revoked = {
+			...record,
+			revokedAt: this.now(),
+			revokedReason: reason
+		};
+		this.rows.set(fingerprint, revoked);
+		crl?.revoke(record.serial);
+		await this.persist(revoked);
+		this.deps.logger?.warn("Mesh certificate revoked", {
+			tags: { nodeId: record.nodeId },
+			meta: {
+				serial: record.serial,
+				reason
+			}
+		});
+		return true;
+	}
+	/**
+	* Operator revocation of a whole node: EVERY leaf of the node that is not already on the
+	* CRL goes on it - the current one, an observed one, a renewal one, and a leaf that was set
+	* aside (`renewal-abandoned`: a copy of it may sit on a stolen box, and it must not stay
+	* valid just because the hub once set it aside). Returns the serials put on the CRL.
+	* A leaf revoked this way is never reinstated by `recordObserved`.
+	*/
+	async revokeAllForNode(nodeId, reason, crl, keepFingerprint) {
+		const serials = [];
+		for (const record of this.list(nodeId)) {
+			if (keepFingerprint !== void 0 && record.fingerprint === keepFingerprint) continue;
+			if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned") continue;
+			const revoked = {
+				...record,
+				revokedAt: record.revokedAt ?? this.now(),
+				revokedReason: reason
+			};
+			this.rows.set(record.fingerprint, revoked);
+			crl.revoke(record.serial);
+			await this.persist(revoked);
+			serials.push(record.serial);
+		}
+		if (serials.length > 0) this.deps.logger?.warn("Every mesh certificate of the node revoked", {
+			tags: { nodeId },
+			meta: {
+				serials,
+				reason
+			}
+		});
+		return serials;
+	}
+	/**
+	* At boot: a node with TWO live leaves had a renewal in flight when the hub stopped. The
+	* newer (renewal) one is set aside - it is not the node's current leaf until the node is
+	* seen presenting it, which reinstates it. It is NOT put on the CRL.
+	*/
+	async settleInterruptedRenewals() {
+		let settled = 0;
+		const byNode = /* @__PURE__ */ new Map();
+		for (const record of this.rows.values()) {
+			if (record.revokedAt !== null) continue;
+			byNode.set(record.nodeId, [...byNode.get(record.nodeId) ?? [], record]);
+		}
+		for (const records of byNode.values()) {
+			if (records.length < 2) continue;
+			for (const record of records) if (record.issuedVia === "renewal" && await this.abandon(record.fingerprint)) settled += 1;
+		}
+		return settled;
+	}
+	/** Set a never-completed renewal leaf aside (not current, NOT on the CRL). */
+	/** Fingerprints of renewal leaves whose handover is running right now (this process only). */
+	renewalsInFlight = /* @__PURE__ */ new Set();
+	/**
+	* A renewal's leaf is "in flight" from signing until the handover ends. While it is, a node seen
+	* presenting its OLD leaf is simply not swapped yet: the new leaf is not set aside (that would
+	* flap set-aside / reinstate on the node's first connection with it).
+	*/
+	beginRenewal(fingerprint) {
+		this.renewalsInFlight.add(fingerprint);
+	}
+	endRenewal(fingerprint) {
+		this.renewalsInFlight.delete(fingerprint);
+	}
+	async abandonRenewalsNewerThan(presented) {
+		let changed = false;
+		for (const record of this.liveFor(presented.nodeId)) {
+			if (record.fingerprint === presented.fingerprint) continue;
+			if (record.issuedVia !== "renewal" || record.issuedAt <= presented.issuedAt) continue;
+			if (this.renewalsInFlight.has(record.fingerprint)) continue;
+			if (await this.abandon(record.fingerprint)) changed = true;
+		}
+		return changed;
+	}
+	async abandon(fingerprint) {
+		const record = this.rows.get(fingerprint);
+		if (record === void 0 || record.revokedAt !== null) return false;
+		const abandoned = {
+			...record,
+			revokedAt: this.now(),
+			revokedReason: RENEWAL_ABANDONED
+		};
+		this.rows.set(fingerprint, abandoned);
+		await this.persist(abandoned);
+		this.deps.logger?.warn("Renewal leaf set aside (not current, not on the CRL)", {
+			tags: { nodeId: record.nodeId },
+			meta: { serial: record.serial }
+		});
+		return true;
+	}
+	/** Replay every persisted revocation into `crl` (hub boot). Set-aside leaves are not revocations. */
+	restoreCrl(crl) {
+		let restored = 0;
+		for (const record of this.rows.values()) {
+			if (record.revokedAt === null || record.revokedReason === "renewal-abandoned") continue;
+			crl.revoke(record.serial);
+			restored += 1;
+		}
+		return restored;
+	}
+	/** Is `serial` listed as revoked here? */
+	isRevoked(serial) {
+		const wanted = normalizeSerial(serial);
+		for (const record of this.rows.values()) if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned" && normalizeSerial(record.serial) === wanted) return true;
+		return false;
+	}
+	async reap() {
+		const cutoff = this.now() - RETENTION_MS;
+		const dead = [...this.rows.values()].filter((r) => (r.revokedAt ?? r.notAfter) < cutoff);
+		for (const r of dead) {
+			this.rows.delete(r.fingerprint);
+			await this.deleteRow(r.fingerprint);
+		}
+		return dead.length;
+	}
+	async insert(record) {
+		this.rows.set(record.fingerprint, record);
+		const kind = this.deps.meshKind ?? null;
+		if (kind !== null) {
+			const parsed = systemConfigRecordKinds["mesh-node-certificates"].schema.safeParse(this.recordToBody(record));
+			if (!parsed.success) throw new Error(parsed.error.message);
+			await kind.put({
+				id: record.fingerprint,
+				data: parsed.data
+			});
+			return;
+		}
+		await this.store.insert.mutate({
+			collection: MESH_NODE_CERTIFICATES_COLLECTION,
+			record: {
+				id: record.fingerprint,
+				data: { ...record }
+			}
+		});
+	}
+	async deleteRow(fingerprint) {
+		const kind = this.deps.meshKind ?? null;
+		if (kind !== null) {
+			await kind.delete(fingerprint);
+			return;
+		}
+		await this.store.delete.mutate({
+			collection: MESH_NODE_CERTIFICATES_COLLECTION,
+			key: fingerprint
+		});
+	}
+	async persist(record) {
+		try {
+			const kind = this.deps.meshKind ?? null;
+			if (kind !== null) {
+				const parsed = systemConfigRecordKinds["mesh-node-certificates"].schema.safeParse(this.recordToBody(record));
+				if (!parsed.success) throw new Error(parsed.error.message);
+				await kind.put({
+					id: record.fingerprint,
+					data: parsed.data
+				});
+				return;
+			}
+			await this.store.update.mutate({
+				collection: MESH_NODE_CERTIFICATES_COLLECTION,
+				id: record.fingerprint,
+				data: { ...record }
+			});
+		} catch (error) {
+			this.deps.logger?.error("Mesh certificate write failed - the change holds until restart", {
+				tags: { nodeId: record.nodeId },
+				meta: { error: error instanceof Error ? error.message : String(error) }
+			});
+		}
+	}
+};
+var SLOT$1 = Symbol.for("camstack.mesh.certificate-registry");
+function setProcessMeshCertificateRegistry(registry) {
+	if (registry === null) Reflect.deleteProperty(globalThis, SLOT$1);
+	else Reflect.set(globalThis, SLOT$1, registry);
+}
+function getProcessMeshCertificateRegistry() {
+	const value = Reflect.get(globalThis, SLOT$1);
+	return value !== null && typeof value === "object" && typeof Reflect.get(value, "recordIssued") === "function" ? value : null;
+}
+//#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-tls-gate.ts
 var STATE_SLOT = Symbol.for("camstack.mesh.tls-listener-state");
 function setProcessMeshTlsListenerState(state) {
@@ -20803,7 +21413,7 @@ var require_utils$3 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var kleur = require_kleur();
 	var os$17 = __require("os");
 	var path$39 = __require("path");
-	var fs$18 = __require("fs");
+	var fs$19 = __require("fs");
 	var { TimeoutError } = require_errors$2();
 	var lut = [];
 	for (let i = 0; i < 256; i++) lut[i] = (i < 16 ? "0" : "") + i.toString(16);
@@ -21096,7 +21706,7 @@ var require_utils$3 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		makeDirs(p) {
 			p.split(path$39.sep).reduce((prevPath, folder) => {
 				const currentPath = path$39.join(prevPath, folder, path$39.sep);
-				if (!fs$18.existsSync(currentPath)) fs$18.mkdirSync(currentPath);
+				if (!fs$19.existsSync(currentPath)) fs$19.mkdirSync(currentPath);
 				return currentPath;
 			}, "");
 		},
@@ -22322,7 +22932,7 @@ var require_csv = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var { makeDirs } = require_utils$3();
 	var _ = require_lodash();
 	var path$38 = __require("path");
-	var fs$17 = __require("fs");
+	var fs$18 = __require("fs");
 	var METRIC = require_constants$6();
 	var MODE_METRIC = "metric";
 	var MODE_LABEL = "label";
@@ -22481,8 +23091,8 @@ var require_csv = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		*/
 		writeRow(filename, headers, fields) {
 			try {
-				if (!fs$17.existsSync(filename)) fs$17.writeFileSync(filename, headers.join(this.opts.delimiter) + this.opts.rowDelimiter);
-				fs$17.appendFileSync(filename, fields.join(this.opts.delimiter) + this.opts.rowDelimiter);
+				if (!fs$18.existsSync(filename)) fs$18.writeFileSync(filename, headers.join(this.opts.delimiter) + this.opts.rowDelimiter);
+				fs$18.appendFileSync(filename, fields.join(this.opts.delimiter) + this.opts.rowDelimiter);
 			} catch (err) {
 				/* istanbul ignore next */
 				this.logger.error(`Unable to write metrics values to the '${filename}' file. Error: ${err.message}`, fields, err);
@@ -30514,7 +31124,7 @@ var require_process$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/detect-libc/lib/filesystem.js
 var require_filesystem = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var fs$16 = __require("fs");
+	var fs$17 = __require("fs");
 	var LDD_PATH = "/usr/bin/ldd";
 	var SELF_PATH = "/proc/self/exe";
 	var MAX_LENGTH = 2048;
@@ -30525,10 +31135,10 @@ var require_filesystem = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* @returns {Buffer}
 	*/
 	var readFileSync = (path) => {
-		const fd = fs$16.openSync(path, "r");
+		const fd = fs$17.openSync(path, "r");
 		const buffer = Buffer.alloc(MAX_LENGTH);
-		const bytesRead = fs$16.readSync(fd, buffer, 0, MAX_LENGTH, 0);
-		fs$16.close(fd, () => {});
+		const bytesRead = fs$17.readSync(fd, buffer, 0, MAX_LENGTH, 0);
+		fs$17.close(fd, () => {});
 		return buffer.subarray(0, bytesRead);
 	};
 	/**
@@ -30538,13 +31148,13 @@ var require_filesystem = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* @returns {Promise<Buffer>}
 	*/
 	var readFile = (path) => new Promise((resolve, reject) => {
-		fs$16.open(path, "r", (err, fd) => {
+		fs$17.open(path, "r", (err, fd) => {
 			if (err) reject(err);
 			else {
 				const buffer = Buffer.alloc(MAX_LENGTH);
-				fs$16.read(fd, buffer, 0, MAX_LENGTH, 0, (_, bytesRead) => {
+				fs$17.read(fd, buffer, 0, MAX_LENGTH, 0, (_, bytesRead) => {
 					resolve(buffer.subarray(0, bytesRead));
-					fs$16.close(fd, () => {});
+					fs$17.close(fd, () => {});
 				});
 			}
 		});
@@ -30797,7 +31407,7 @@ var require_detect_libc = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/node-gyp-build-optional-packages/index.js
 var require_node_gyp_build_optional_packages = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var fs$15 = __require("fs");
+	var fs$16 = __require("fs");
 	var path$37 = __require("path");
 	var url$2 = __require("url");
 	var vars = process.config && process.config.variables || {};
@@ -30864,7 +31474,7 @@ var require_node_gyp_build_optional_packages = /* @__PURE__ */ __commonJSMin(((e
 	};
 	function readdirSync(dir) {
 		try {
-			return fs$15.readdirSync(dir);
+			return fs$16.readdirSync(dir);
 		} catch (err) {
 			return [];
 		}
@@ -36343,7 +36953,7 @@ var require_debug = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 var require_file$2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var FormattedLogger = require_formatted();
 	var _ = require_lodash();
-	var fs$14 = __require("fs/promises");
+	var fs$15 = __require("fs/promises");
 	var path$36 = __require("path");
 	var os$11 = __require("os");
 	var { makeDirs } = require_utils$3();
@@ -36447,7 +37057,7 @@ var require_file$2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				const rows = Array.from(this.queue);
 				this.queue.length = 0;
 				const buf = rows.join(this.opts.eol) + this.opts.eol;
-				return fs$14.appendFile(filename, buf).catch((err) => {
+				return fs$15.appendFile(filename, buf).catch((err) => {
 					/* istanbul ignore next */
 					console.debug("Unable to write log file:", filename, err);
 				});
@@ -37965,7 +38575,7 @@ var require_clone = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/graceful-fs/graceful-fs.js
 var require_graceful_fs = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var fs$13 = __require("fs");
+	var fs$14 = __require("fs");
 	var polyfills = require_polyfills();
 	var legacy = require_legacy_streams();
 	var clone = require_clone();
@@ -37994,36 +38604,36 @@ var require_graceful_fs = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		m = "GFS4: " + m.split(/\n/).join("\nGFS4: ");
 		console.error(m);
 	};
-	if (!fs$13[gracefulQueue]) {
-		publishQueue(fs$13, global[gracefulQueue] || []);
-		fs$13.close = (function(fs$close) {
+	if (!fs$14[gracefulQueue]) {
+		publishQueue(fs$14, global[gracefulQueue] || []);
+		fs$14.close = (function(fs$close) {
 			function close(fd, cb) {
-				return fs$close.call(fs$13, fd, function(err) {
+				return fs$close.call(fs$14, fd, function(err) {
 					if (!err) resetQueue();
 					if (typeof cb === "function") cb.apply(this, arguments);
 				});
 			}
 			Object.defineProperty(close, previousSymbol, { value: fs$close });
 			return close;
-		})(fs$13.close);
-		fs$13.closeSync = (function(fs$closeSync) {
+		})(fs$14.close);
+		fs$14.closeSync = (function(fs$closeSync) {
 			function closeSync(fd) {
-				fs$closeSync.apply(fs$13, arguments);
+				fs$closeSync.apply(fs$14, arguments);
 				resetQueue();
 			}
 			Object.defineProperty(closeSync, previousSymbol, { value: fs$closeSync });
 			return closeSync;
-		})(fs$13.closeSync);
+		})(fs$14.closeSync);
 		if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || "")) process.on("exit", function() {
-			debug(fs$13[gracefulQueue]);
-			__require("assert").equal(fs$13[gracefulQueue].length, 0);
+			debug(fs$14[gracefulQueue]);
+			__require("assert").equal(fs$14[gracefulQueue].length, 0);
 		});
 	}
-	if (!global[gracefulQueue]) publishQueue(global, fs$13[gracefulQueue]);
-	module.exports = patch(clone(fs$13));
-	if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs$13.__patched) {
-		module.exports = patch(fs$13);
-		fs$13.__patched = true;
+	if (!global[gracefulQueue]) publishQueue(global, fs$14[gracefulQueue]);
+	module.exports = patch(clone(fs$14));
+	if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs$14.__patched) {
+		module.exports = patch(fs$14);
+		fs$14.__patched = true;
 	}
 	function patch(fs) {
 		polyfills(fs);
@@ -38278,23 +38888,23 @@ var require_graceful_fs = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	}
 	function enqueue(elem) {
 		debug("ENQUEUE", elem[0].name, elem[1]);
-		fs$13[gracefulQueue].push(elem);
+		fs$14[gracefulQueue].push(elem);
 		retry();
 	}
 	var retryTimer;
 	function resetQueue() {
 		var now = Date.now();
-		for (var i = 0; i < fs$13[gracefulQueue].length; ++i) if (fs$13[gracefulQueue][i].length > 2) {
-			fs$13[gracefulQueue][i][3] = now;
-			fs$13[gracefulQueue][i][4] = now;
+		for (var i = 0; i < fs$14[gracefulQueue].length; ++i) if (fs$14[gracefulQueue][i].length > 2) {
+			fs$14[gracefulQueue][i][3] = now;
+			fs$14[gracefulQueue][i][4] = now;
 		}
 		retry();
 	}
 	function retry() {
 		clearTimeout(retryTimer);
 		retryTimer = void 0;
-		if (fs$13[gracefulQueue].length === 0) return;
-		var elem = fs$13[gracefulQueue].shift();
+		if (fs$14[gracefulQueue].length === 0) return;
+		var elem = fs$14[gracefulQueue].shift();
 		var fn = elem[0];
 		var args = elem[1];
 		var err = elem[2];
@@ -38313,7 +38923,7 @@ var require_graceful_fs = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			if (sinceAttempt >= Math.min(sinceStart * 1.2, 100)) {
 				debug("RETRY", fn.name, args);
 				fn.apply(null, args.concat([startTime]));
-			} else fs$13[gracefulQueue].push(elem);
+			} else fs$14[gracefulQueue].push(elem);
 		}
 		if (retryTimer === void 0) retryTimer = setTimeout(retry, 0);
 	}
@@ -39868,9 +40478,9 @@ var require_output = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#region ../../node_modules/streamroller/node_modules/fs-extra/lib/index.js
 var require_lib$4 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = Object.assign({}, require_fs(), require_copy_sync(), require_copy(), require_empty(), require_ensure(), require_json(), require_mkdirs(), require_move_sync(), require_move(), require_output(), require_path_exists(), require_remove());
-	var fs$12 = __require("fs");
-	if (Object.getOwnPropertyDescriptor(fs$12, "promises")) Object.defineProperty(module.exports, "promises", { get() {
-		return fs$12.promises;
+	var fs$13 = __require("fs");
+	if (Object.getOwnPropertyDescriptor(fs$13, "promises")) Object.defineProperty(module.exports, "promises", { get() {
+		return fs$13.promises;
 	} });
 }));
 //#endregion
@@ -40534,12 +41144,12 @@ var require_dateFile = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 var require_fileSync = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var debug = require_src()("log4js:fileSync");
 	var path$13 = __require("path");
-	var fs$11 = __require("fs");
+	var fs$12 = __require("fs");
 	var eol = __require("os").EOL || "\n";
 	function touchFile(file, options) {
-		if (fs$11.existsSync(file)) return;
-		const id = fs$11.openSync(file, options.flags, options.mode);
-		fs$11.closeSync(id);
+		if (fs$12.existsSync(file)) return;
+		const id = fs$12.openSync(file, options.flags, options.mode);
+		fs$12.closeSync(id);
 	}
 	var RollingFileSync = class {
 		constructor(filename, size, backups, options) {
@@ -40556,7 +41166,7 @@ var require_fileSync = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			function currentFileSize(file) {
 				let fileSize = 0;
 				try {
-					fileSize = fs$11.statSync(file).size;
+					fileSize = fs$12.statSync(file).size;
 				} catch (e) {
 					touchFile(file, options);
 				}
@@ -40587,15 +41197,15 @@ var require_fileSync = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				debug(`Index of ${fileToRename} is ${idx}`);
 				if (idx < that.backups) {
 					try {
-						fs$11.unlinkSync(`${filename}.${idx + 1}`);
+						fs$12.unlinkSync(`${filename}.${idx + 1}`);
 					} catch (e) {}
 					debug(`Renaming ${fileToRename} -> ${filename}.${idx + 1}`);
-					fs$11.renameSync(path$13.join(path$13.dirname(filename), fileToRename), `${filename}.${idx + 1}`);
+					fs$12.renameSync(path$13.join(path$13.dirname(filename), fileToRename), `${filename}.${idx + 1}`);
 				}
 			}
 			function renameTheFiles() {
 				debug("Renaming the old files");
-				fs$11.readdirSync(path$13.dirname(filename)).filter(justTheseFiles).sort(byIndex).reverse().forEach(increaseFileIndex);
+				fs$12.readdirSync(path$13.dirname(filename)).filter(justTheseFiles).sort(byIndex).reverse().forEach(increaseFileIndex);
 			}
 			debug("Rolling, rolling, rolling");
 			renameTheFiles();
@@ -40605,7 +41215,7 @@ var require_fileSync = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			function writeTheChunk() {
 				debug("writing the chunk to the file");
 				that.currentSize += chunk.length;
-				fs$11.appendFileSync(that.filename, chunk);
+				fs$12.appendFileSync(that.filename, chunk);
 			}
 			debug("in write");
 			if (this.shouldRoll()) {
@@ -40640,7 +41250,7 @@ var require_fileSync = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			else stream = ((f) => {
 				touchFile(f, options);
 				return { write(data) {
-					fs$11.appendFileSync(f, data);
+					fs$12.appendFileSync(f, data);
 				} };
 			})(filePath);
 			return stream;
@@ -41239,7 +41849,7 @@ var require_log4js$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* Website: http://log4js.berlios.de
 	*/
 	var debug = require_src()("log4js:main");
-	var fs$10 = __require("fs");
+	var fs$11 = __require("fs");
 	var deepClone = require_rfdc()({ proto: true });
 	var configuration = require_configuration();
 	var layouts = require_layouts();
@@ -41260,7 +41870,7 @@ var require_log4js$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	function loadConfigurationFile(filename) {
 		debug(`Loading configuration from ${filename}`);
 		try {
-			return JSON.parse(fs$10.readFileSync(filename, "utf8"));
+			return JSON.parse(fs$11.readFileSync(filename, "utf8"));
 		} catch (e) {
 			throw new Error(`Problem reading config from file "${filename}". Error was ${e.message}`, e);
 		}
@@ -42348,7 +42958,7 @@ var require_atomic_sleep = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/sonic-boom/index.js
 var require_sonic_boom = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var fs$9 = __require("fs");
+	var fs$10 = __require("fs");
 	var EventEmitter$8 = __require("events");
 	var inherits = __require("util").inherits;
 	var path$11 = __require("path");
@@ -42391,17 +43001,17 @@ var require_sonic_boom = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		const flags = sonic.append ? "a" : "w";
 		const mode = sonic.mode;
 		if (sonic.sync) try {
-			if (sonic.mkdir) fs$9.mkdirSync(path$11.dirname(file), { recursive: true });
-			fileOpened(null, fs$9.openSync(file, flags, mode));
+			if (sonic.mkdir) fs$10.mkdirSync(path$11.dirname(file), { recursive: true });
+			fileOpened(null, fs$10.openSync(file, flags, mode));
 		} catch (err) {
 			fileOpened(err);
 			throw err;
 		}
-		else if (sonic.mkdir) fs$9.mkdir(path$11.dirname(file), { recursive: true }, (err) => {
+		else if (sonic.mkdir) fs$10.mkdir(path$11.dirname(file), { recursive: true }, (err) => {
 			if (err) return fileOpened(err);
-			fs$9.open(file, flags, mode, fileOpened);
+			fs$10.open(file, flags, mode, fileOpened);
 		});
-		else fs$9.open(file, flags, mode, fileOpened);
+		else fs$10.open(file, flags, mode, fileOpened);
 	}
 	function SonicBoom(opts) {
 		if (!(this instanceof SonicBoom)) return new SonicBoom(opts);
@@ -42439,8 +43049,8 @@ var require_sonic_boom = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			this.flush = flushBuffer;
 			this.flushSync = flushBufferSync;
 			this._actualWrite = actualWriteBuffer;
-			fsWriteSync = () => fs$9.writeSync(this.fd, this._writingBuf);
-			fsWrite = () => fs$9.write(this.fd, this._writingBuf, this.release);
+			fsWriteSync = () => fs$10.writeSync(this.fd, this._writingBuf);
+			fsWrite = () => fs$10.write(this.fd, this._writingBuf, this.release);
 		} else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
 			this._writingBuf = "";
 			this.write = write;
@@ -42448,12 +43058,12 @@ var require_sonic_boom = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			this.flushSync = flushSync;
 			this._actualWrite = actualWrite;
 			fsWriteSync = () => {
-				if (Buffer.isBuffer(this._writingBuf)) return fs$9.writeSync(this.fd, this._writingBuf);
-				return fs$9.writeSync(this.fd, this._writingBuf, "utf8");
+				if (Buffer.isBuffer(this._writingBuf)) return fs$10.writeSync(this.fd, this._writingBuf);
+				return fs$10.writeSync(this.fd, this._writingBuf, "utf8");
 			};
 			fsWrite = () => {
-				if (Buffer.isBuffer(this._writingBuf)) return fs$9.write(this.fd, this._writingBuf, this.release);
-				return fs$9.write(this.fd, this._writingBuf, "utf8", this.release);
+				if (Buffer.isBuffer(this._writingBuf)) return fs$10.write(this.fd, this._writingBuf, this.release);
+				return fs$10.write(this.fd, this._writingBuf, "utf8", this.release);
 			};
 		} else throw new Error(`SonicBoom supports "${kContentModeUtf8}" and "${kContentModeBuffer}", but passed ${contentMode}`);
 		if (typeof fd === "number") {
@@ -42498,7 +43108,7 @@ var require_sonic_boom = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 					return;
 				}
 			}
-			if (this._fsync) fs$9.fsyncSync(this.fd);
+			if (this._fsync) fs$10.fsyncSync(this.fd);
 			const len = this._len;
 			if (this._reopening) {
 				this._writing = false;
@@ -42595,7 +43205,7 @@ var require_sonic_boom = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		this._flushPending = true;
 		const onDrain = () => {
 			if (!this._fsync) try {
-				fs$9.fsync(this.fd, (err) => {
+				fs$10.fsync(this.fd, (err) => {
 					this._flushPending = false;
 					cb(err);
 				});
@@ -42672,7 +43282,7 @@ var require_sonic_boom = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		if (this._writing) return;
 		const fd = this.fd;
 		this.once("ready", () => {
-			if (fd !== this.fd) fs$9.close(fd, (err) => {
+			if (fd !== this.fd) fs$10.close(fd, (err) => {
 				if (err) return this.emit("error", err);
 			});
 		});
@@ -42703,7 +43313,7 @@ var require_sonic_boom = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		while (this._bufs.length || buf.length) {
 			if (buf.length <= 0) buf = this._bufs[0];
 			try {
-				const n = Buffer.isBuffer(buf) ? fs$9.writeSync(this.fd, buf) : fs$9.writeSync(this.fd, buf, "utf8");
+				const n = Buffer.isBuffer(buf) ? fs$10.writeSync(this.fd, buf) : fs$10.writeSync(this.fd, buf, "utf8");
 				const releasedBufObj = releaseWritingBuf(buf, this._len, n);
 				buf = releasedBufObj.writingBuf;
 				this._len = releasedBufObj.len;
@@ -42714,7 +43324,7 @@ var require_sonic_boom = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			}
 		}
 		try {
-			fs$9.fsyncSync(this.fd);
+			fs$10.fsyncSync(this.fd);
 		} catch {}
 	}
 	function flushBufferSync() {
@@ -42728,7 +43338,7 @@ var require_sonic_boom = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		while (this._bufs.length || buf.length) {
 			if (buf.length <= 0) buf = mergeBuf(this._bufs[0], this._lens[0]);
 			try {
-				const n = fs$9.writeSync(this.fd, buf);
+				const n = fs$10.writeSync(this.fd, buf);
 				buf = buf.subarray(n);
 				this._len = Math.max(this._len - n, 0);
 				if (buf.length <= 0) {
@@ -42750,24 +43360,24 @@ var require_sonic_boom = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		this._writing = true;
 		this._writingBuf = this._writingBuf.length ? this._writingBuf : this._bufs.shift() || "";
 		if (this.sync) try {
-			release(null, Buffer.isBuffer(this._writingBuf) ? fs$9.writeSync(this.fd, this._writingBuf) : fs$9.writeSync(this.fd, this._writingBuf, "utf8"));
+			release(null, Buffer.isBuffer(this._writingBuf) ? fs$10.writeSync(this.fd, this._writingBuf) : fs$10.writeSync(this.fd, this._writingBuf, "utf8"));
 		} catch (err) {
 			release(err);
 		}
-		else fs$9.write(this.fd, this._writingBuf, release);
+		else fs$10.write(this.fd, this._writingBuf, release);
 	}
 	function actualWriteBuffer() {
 		const release = this.release;
 		this._writing = true;
 		this._writingBuf = this._writingBuf.length ? this._writingBuf : mergeBuf(this._bufs.shift(), this._lens.shift());
 		if (this.sync) try {
-			release(null, fs$9.writeSync(this.fd, this._writingBuf));
+			release(null, fs$10.writeSync(this.fd, this._writingBuf));
 		} catch (err) {
 			release(err);
 		}
 		else {
 			if (kCopyBuffer) this._writingBuf = Buffer.from(this._writingBuf);
-			fs$9.write(this.fd, this._writingBuf, release);
+			fs$10.write(this.fd, this._writingBuf, release);
 		}
 	}
 	function actualClose(sonic) {
@@ -42781,10 +43391,10 @@ var require_sonic_boom = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		sonic._lens = [];
 		assert$1(typeof sonic.fd === "number", `sonic.fd must be a number, got ${typeof sonic.fd}`);
 		try {
-			fs$9.fsync(sonic.fd, closeWrapped);
+			fs$10.fsync(sonic.fd, closeWrapped);
 		} catch {}
 		function closeWrapped() {
-			if (sonic.fd !== 1 && sonic.fd !== 2) fs$9.close(sonic.fd, done);
+			if (sonic.fd !== 1 && sonic.fd !== 2) fs$10.close(sonic.fd, done);
 			else done();
 		}
 		function done(err) {
@@ -71581,7 +72191,7 @@ var require_tcp = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var Transporter = require_base$1();
 	var _ = require_lodash();
 	var { isObject, isString } = require_utils$3();
-	var fs$8 = __require("fs");
+	var fs$9 = __require("fs");
 	var kleur = require_kleur();
 	var Node = require_node();
 	var P = require_packets();
@@ -71728,7 +72338,7 @@ var require_tcp = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				if (isString(str) && str.startsWith("file://")) {
 					const fName = str.replace("file://", "");
 					this.logger.debug(`Load nodes list from file '${fName}'...`);
-					let content = fs$8.readFileSync(fName);
+					let content = fs$9.readFileSync(fName);
 					if (content && content.length > 0) {
 						const str = content.toString().trim();
 						if (str.startsWith("{") || str.startsWith("[")) return JSON.parse(str);
@@ -74218,7 +74828,7 @@ var require_ttl = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#region ../../node_modules/recursive-watch/index.js
 var require_recursive_watch = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var os$5 = __require("os");
-	var fs$7 = __require("fs");
+	var fs$8 = __require("fs");
 	var path$10 = __require("path");
 	var Cache = require_ttl();
 	var watchDirectory = os$5.platform() === "linux" ? watchFallback : watchRecursive;
@@ -74226,7 +74836,7 @@ var require_recursive_watch = /* @__PURE__ */ __commonJSMin(((exports, module) =
 	function watch(name, onchange) {
 		var clear = null;
 		var stopped = false;
-		fs$7.lstat(name, function(_, st) {
+		fs$8.lstat(name, function(_, st) {
 			if (!st || stopped) {
 				stopped = true;
 				return;
@@ -74242,8 +74852,8 @@ var require_recursive_watch = /* @__PURE__ */ __commonJSMin(((exports, module) =
 	function watchFile(filename, onchange) {
 		var prev = null;
 		var prevTime = 0;
-		var w = fs$7.watch(filename, function() {
-			fs$7.lstat(filename, function(_, st) {
+		var w = fs$8.watch(filename, function() {
+			fs$8.lstat(filename, function(_, st) {
 				var now = Date.now();
 				if (now - prevTime > 2e3 || !same(st, prev)) onchange(filename);
 				prevTime = now;
@@ -74255,7 +74865,7 @@ var require_recursive_watch = /* @__PURE__ */ __commonJSMin(((exports, module) =
 		};
 	}
 	function watchRecursive(directory, onchange) {
-		var w = fs$7.watch(directory, { recursive: true }, function(change, filename) {
+		var w = fs$8.watch(directory, { recursive: true }, function(change, filename) {
 			if (!filename) return;
 			onchange(path$10.join(directory, filename));
 		});
@@ -74285,7 +74895,7 @@ var require_recursive_watch = /* @__PURE__ */ __commonJSMin(((exports, module) =
 		}
 		function update() {
 			var filename = queued[0];
-			fs$7.lstat(filename, function(err, st) {
+			fs$8.lstat(filename, function(err, st) {
 				var w = watching[filename];
 				if (err && w) {
 					w.close();
@@ -74302,17 +74912,17 @@ var require_recursive_watch = /* @__PURE__ */ __commonJSMin(((exports, module) =
 		}
 		function visit(next, cb) {
 			var dir = path$10.join(directory, next);
-			fs$7.lstat(dir, function(err, st) {
+			fs$8.lstat(dir, function(err, st) {
 				if (err || !st.isDirectory()) return cb();
 				if (watching[dir]) return cb();
 				if (loaded) emit(dir);
-				var w = fs$7.watch(dir, function(change, filename) {
+				var w = fs$8.watch(dir, function(change, filename) {
 					filename = path$10.join(next, filename);
 					emit(path$10.join(directory, filename));
 				});
 				w.on("error", noop);
 				watching[dir] = w;
-				fs$7.readdir(dir, function(err, list) {
+				fs$8.readdir(dir, function(err, list) {
 					if (err) return cb(err);
 					loop();
 					function loop() {
@@ -74332,7 +74942,7 @@ var require_recursive_watch = /* @__PURE__ */ __commonJSMin(((exports, module) =
 //#endregion
 //#region ../../node_modules/moleculer/src/middlewares/hot-reload.js
 var require_hot_reload = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var fs$6 = __require("fs");
+	var fs$7 = __require("fs");
 	var kleur = require_kleur();
 	var path$9 = __require("path");
 	var watch = require_recursive_watch();
@@ -74349,7 +74959,7 @@ var require_hot_reload = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			const relPath = path$9.relative(process.cwd(), service.__filename);
 			broker.logger.info(`Hot reload '${service.name}' service...`, kleur.grey(relPath));
 			return broker.destroyService(service).then(() => {
-				if (fs$6.existsSync(service.__filename)) try {
+				if (fs$7.existsSync(service.__filename)) try {
 					return broker.loadService(service.__filename);
 				} catch (err) {
 					broker.logger.error(`Failed to load service '${service.__filename}'`, err);
@@ -74381,7 +74991,7 @@ var require_hot_reload = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				});
 				broker.logger.info(kleur.bgMagenta().white().bold(`Reload ${needToReloadDedup.length} service(s)`));
 				needToReloadDedup.forEach((svc) => {
-					if (typeof svc == "string") if (fs$6.existsSync(svc)) return broker.loadService(svc);
+					if (typeof svc == "string") if (fs$7.existsSync(svc)) return broker.loadService(svc);
 					else return;
 					return hotReloadService(svc);
 				});
@@ -74391,7 +75001,7 @@ var require_hot_reload = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			broker.logger.debug("");
 			broker.logger.debug(kleur.yellow().bold("Watching the following project files:"));
 			projectFiles.forEach((watchItem, fName) => {
-				if (!fs$6.existsSync(fName)) projectFiles.delete(fName);
+				if (!fs$7.existsSync(fName)) projectFiles.delete(fName);
 			});
 			projectFiles.forEach((watchItem, fName) => {
 				const relPath = path$9.relative(process.cwd(), fName);
@@ -74402,7 +75012,7 @@ var require_hot_reload = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 					watchItem.services.forEach((svcFullname) => broker.logger.debug(kleur.grey(`    ${svcFullname}`)));
 					watchItem.others.forEach((filename) => broker.logger.debug(kleur.grey(`    ${path$9.relative(process.cwd(), filename)}`)));
 				}
-				watchItem.watcher = fs$6.watch(fName, (eventType) => {
+				watchItem.watcher = fs$7.watch(fName, (eventType) => {
 					const relPath = path$9.relative(process.cwd(), fName);
 					broker.logger.info(kleur.magenta().bold(`The '${relPath}' file is changed. (Event: ${eventType})`));
 					clearRequireCache(fName);
@@ -74528,7 +75138,7 @@ var require_hot_reload = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 								if (filename.endsWith(".service.js") || filename.endsWith(".service.ts")) {
 									broker.logger.debug(`There is changes in '${folder}' folder: `, path$9.basename(filename));
 									const isLoaded = broker.services.some((svc) => svc.__filename == filename);
-									const fileExists = fs$6.existsSync(filename);
+									const fileExists = fs$7.existsSync(filename);
 									if (!isLoaded && fileExists) {
 										broker.logger.debug("Loading new file: ", path$9.basename(filename));
 										needToLoad.add(filename);
@@ -74706,7 +75316,7 @@ var require_compression = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 var require_transit_logger = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var _ = require_lodash();
 	var kleur = require_kleur();
-	var fs$5 = __require("fs");
+	var fs$6 = __require("fs");
 	var path$8 = __require("path");
 	var { makeDirs, safetyObject } = require_utils$3();
 	module.exports = function TransitLoggerMiddleware(opts) {
@@ -74732,7 +75342,7 @@ var require_transit_logger = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 			} catch {
 				data = JSON.stringify(safetyObject(payload), payload instanceof Error ? Object.getOwnPropertyNames(payload) : null, 4);
 			}
-			fs$5.writeFile(path$8.join(targetFolder, filename), data, () => {});
+			fs$6.writeFile(path$8.join(targetFolder, filename), data, () => {});
 		}
 		const coloringSend = opts.colors && opts.colors.send ? opts.colors.send.split(".").reduce((a, b) => a[b] || a()[b], kleur) : (s) => s;
 		const coloringReceive = opts.colors && opts.colors.receive ? opts.colors.receive.split(".").reduce((a, b) => a[b] || a()[b], kleur) : (s) => s;
@@ -74780,7 +75390,7 @@ var require_transit_logger = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 var require_action_logger = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var _ = require_lodash();
 	var kleur = require_kleur();
-	var fs$4 = __require("fs");
+	var fs$5 = __require("fs");
 	var path$7 = __require("path");
 	var { makeDirs, match, isObject, safetyObject } = require_utils$3();
 	module.exports = function ActionLoggerMiddleware(opts) {
@@ -74810,7 +75420,7 @@ var require_action_logger = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 			} catch {
 				data = JSON.stringify(safetyObject(payload), payload instanceof Error ? Object.getOwnPropertyNames(payload) : null, 4);
 			}
-			fs$4.writeFile(path$7.join(targetFolder, filename), data, () => {});
+			fs$5.writeFile(path$7.join(targetFolder, filename), data, () => {});
 		}
 		function isWhiteListed(actionName) {
 			return !!opts.whitelist.find((pattern) => match(actionName, pattern));
@@ -82033,7 +82643,7 @@ var require_help = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/args/lib/version.js
 var require_version = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var fs$3 = __require("fs");
+	var fs$4 = __require("fs");
 	var path$3 = __require("path");
 	/**
 	* Retrieves the main module package.json information.
@@ -82046,7 +82656,7 @@ var require_version = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	*/
 	function findPackage(directory) {
 		const file = path$3.resolve(directory, "package.json");
-		if (fs$3.existsSync(file) && fs$3.statSync(file).isFile()) return __require(file);
+		if (fs$4.existsSync(file) && fs$4.statSync(file).isFile()) return __require(file);
 		const parent = path$3.resolve(directory, "..");
 		return parent === directory ? null : findPackage(parent);
 	}
@@ -82108,7 +82718,7 @@ var require_lib = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/dotenv/lib/main.js
 var require_main = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var fs$2 = __require("fs");
+	var fs$3 = __require("fs");
 	var path$2 = __require("path");
 	var os$3 = __require("os");
 	var crypto = __require("crypto");
@@ -82236,10 +82846,10 @@ var require_main = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	function _vaultPath(options) {
 		let possibleVaultPath = null;
 		if (options && options.path && options.path.length > 0) if (Array.isArray(options.path)) {
-			for (const filepath of options.path) if (fs$2.existsSync(filepath)) possibleVaultPath = filepath.endsWith(".vault") ? filepath : `${filepath}.vault`;
+			for (const filepath of options.path) if (fs$3.existsSync(filepath)) possibleVaultPath = filepath.endsWith(".vault") ? filepath : `${filepath}.vault`;
 		} else possibleVaultPath = options.path.endsWith(".vault") ? options.path : `${options.path}.vault`;
 		else possibleVaultPath = path$2.resolve(process.cwd(), ".env.vault");
-		if (fs$2.existsSync(possibleVaultPath)) return possibleVaultPath;
+		if (fs$3.existsSync(possibleVaultPath)) return possibleVaultPath;
 		return null;
 	}
 	function _resolveHome(envPath) {
@@ -82273,7 +82883,7 @@ var require_main = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		let lastError;
 		const parsedAll = {};
 		for (const path of optionPaths) try {
-			const parsed = DotenvModule.parse(fs$2.readFileSync(path, { encoding }));
+			const parsed = DotenvModule.parse(fs$3.readFileSync(path, { encoding }));
 			DotenvModule.populate(parsedAll, parsed, options);
 		} catch (e) {
 			if (debug) _debug(`failed to load ${path} ${e.message}`);
@@ -82385,7 +82995,7 @@ var require_runner = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	*/
 	var ServiceBroker = require_service_broker();
 	var utils = require_utils$3();
-	var fs$1 = __require("fs");
+	var fs$2 = __require("fs");
 	var path$1 = __require("path");
 	var { globSync } = require_index_min$1();
 	var inspect = __require("util").inspect;
@@ -82610,7 +83220,7 @@ var require_runner = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		*/
 		isDirectory(p) {
 			try {
-				return fs$1.lstatSync(p).isDirectory();
+				return fs$2.lstatSync(p).isDirectory();
 			} catch {}
 			return false;
 		}
@@ -82622,7 +83232,7 @@ var require_runner = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		*/
 		isServiceFile(p) {
 			try {
-				return !fs$1.lstatSync(p).isDirectory();
+				return !fs$2.lstatSync(p).isDirectory();
 			} catch {}
 			return false;
 		}
@@ -82835,12 +83445,12 @@ var Gt = (n, t, e) => {
 	}
 	return h;
 };
-var fe = "\0SLASH" + Math.random() + "\0", ue = "\0OPEN" + Math.random() + "\0", qt = "\0CLOSE" + Math.random() + "\0", de = "\0COMMA" + Math.random() + "\0", pe = "\0PERIOD" + Math.random() + "\0", is = new RegExp(fe, "g"), rs = new RegExp(ue, "g"), ns = new RegExp(qt, "g"), os$1 = new RegExp(de, "g"), hs = new RegExp(pe, "g"), as = /\\\\/g, ls = /\\{/g, cs = /\\}/g, fs = /\\,/g, us = /\\./g, ds = 1e5;
+var fe = "\0SLASH" + Math.random() + "\0", ue = "\0OPEN" + Math.random() + "\0", qt = "\0CLOSE" + Math.random() + "\0", de = "\0COMMA" + Math.random() + "\0", pe = "\0PERIOD" + Math.random() + "\0", is = new RegExp(fe, "g"), rs = new RegExp(ue, "g"), ns = new RegExp(qt, "g"), os$1 = new RegExp(de, "g"), hs = new RegExp(pe, "g"), as = /\\\\/g, ls = /\\{/g, cs = /\\}/g, fs$1 = /\\,/g, us = /\\./g, ds = 1e5;
 function Ht(n) {
 	return isNaN(n) ? n.charCodeAt(0) : parseInt(n, 10);
 }
 function ps(n) {
-	return n.replace(as, fe).replace(ls, ue).replace(cs, qt).replace(fs, de).replace(us, pe);
+	return n.replace(as, fe).replace(ls, ue).replace(cs, qt).replace(fs$1, de).replace(us, pe);
 }
 function ms(n) {
 	return n.replace(is, "\\").replace(rs, "{").replace(ns, "}").replace(os$1, ",").replace(hs, ".");
@@ -83014,7 +83624,7 @@ var xs = new Set([
 	"+",
 	"*",
 	"@"
-]), be = (n) => xs.has(n), vs = "(?!(?:^|/)\\.\\.?(?:$|/))", Ct = "(?!\\.)", Cs = new Set(["[", "."]), Ts = new Set(["..", "."]), As$1 = /* @__PURE__ */ new Set("().*{}+?[]^$\\!"), ks = (n) => n.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, "\\$&"), Kt$1 = "[^/]", Se = Kt$1 + "*?", Ee = Kt$1 + "+?", Q = class n {
+]), be = (n) => xs.has(n), vs = "(?!(?:^|/)\\.\\.?(?:$|/))", Ct = "(?!\\.)", Cs = new Set(["[", "."]), Ts = new Set(["..", "."]), As$1 = /* @__PURE__ */ new Set("().*{}+?[]^$\\!"), ks = (n) => n.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, "\\$&"), Kt = "[^/]", Se = Kt + "*?", Ee = Kt + "+?", Q = class n {
 	type;
 	#t;
 	#s;
@@ -83241,7 +83851,7 @@ var xs = new Set([
 				}
 			}
 			if (l === "?") {
-				r += Kt$1, e = !0;
+				r += Kt, e = !0;
 				continue;
 			}
 			r += ks(l);
@@ -88264,4 +88874,4 @@ function parseMintUnlockInput(input) {
 	};
 }
 //#endregion
-export { parseCidrList as $, setProcessMeshPeerTransportLookup as A, requireProcessMeshCa as B, setProcessMeshTlsEnabler as C, getProcessPeerLeaf as D, getProcessNodeMeshTransport as E, setProcessMeshTlsListenerState as F, AGENT_UI_UNLOCK_VERSION as G, AGENT_UI_UNLOCK_TTL_MS as H, MeshCrl as I, mintAgentUiUnlockTicket as J, UnlockTicketJtiStore as K, processMeshCrl as L, revokeMeshCertificate as M, getProcessMeshTlsListenerState as N, isProcessVerifiedMeshPeer as O, openMeshTlsWhenRevocationsLoaded as P, normalizeIp as Q, MeshCaKeeper as R, ServiceBroker as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, emitProcessNodeRegistered as T, AGENT_UI_UNLOCK_TYP as U, AGENT_DASHBOARD_ORIGINS_FIELD as V, AGENT_UI_UNLOCK_USE as W, verifyAgentUiUnlockTicket as X, parseAgentDashboardOrigins as Y, createCidrMatcher as Z, signPairingProof as _, hubHostFromMeshAddress as a, TlsTcpTransporter as b, PAIRING_MAX_SESSIONS as c, PAIRING_PROTOCOL as d, readCidrSetting as et, PAIRING_TTL_MS as f, keyFingerprintShort as g, describeCsr as h, AgentPairing as i, renewMeshCertificate as j, onProcessNodeRegistered as k, PAIRING_PATHS as l, computePairingSas as m, HubPairing as n, PAIRING_CODE_DIGITS as o, computePairingCommitment as p, isAllowedAgentDashboardReturnTo as q, PairingHttpError as r, PAIRING_MAX_CODE_ATTEMPTS as s, systemConfigMeshActions as t, PAIRING_PIN_DIGITS as u, verifyPairingProof as v, dropProcessPeer as w, Errors as x, MESH_TLS_PORT_HELLO_FIELD as y, getProcessMeshCaState as z };
+export { generateMeshKeyPair as $, setProcessMeshPeerTransportLookup as A, describeMeshLeaf as B, setProcessMeshTlsEnabler as C, getProcessPeerLeaf as D, getProcessNodeMeshTransport as E, setProcessMeshTlsListenerState as F, MeshCaKeeper as G, setProcessMeshCertificateRegistry as H, MESH_NODE_CERTIFICATES_COLLECTION as I, caFingerprint as J, getProcessMeshCaState as K, MESH_NODE_CERTIFICATES_COLUMNS as L, revokeMeshCertificate as M, getProcessMeshTlsListenerState as N, isProcessVerifiedMeshPeer as O, openMeshTlsWhenRevocationsLoaded as P, generateMeshCa as Q, MeshCertificateRegistry as R, ServiceBroker as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, emitProcessNodeRegistered as T, MeshCrl as U, getProcessMeshCertificateRegistry as V, processMeshCrl as W, createMeshCsrPem as X, caFingerprintCompact as Y, exportMeshPrivateKeyPem as Z, signPairingProof as _, readCidrSetting as _t, hubHostFromMeshAddress as a, AGENT_UI_UNLOCK_TTL_MS as at, TlsTcpTransporter as b, PAIRING_MAX_SESSIONS as c, AGENT_UI_UNLOCK_VERSION as ct, PAIRING_PROTOCOL as d, mintAgentUiUnlockTicket as dt, isValidAgentNodeId as et, PAIRING_TTL_MS as f, parseAgentDashboardOrigins as ft, keyFingerprintShort as g, parseCidrList as gt, describeCsr as h, normalizeIp as ht, AgentPairing as i, AGENT_DASHBOARD_ORIGINS_FIELD as it, renewMeshCertificate as j, onProcessNodeRegistered as k, PAIRING_PATHS as l, UnlockTicketJtiStore as lt, computePairingSas as m, createCidrMatcher as mt, HubPairing as n, issueMeshLeafFromCsr as nt, PAIRING_CODE_DIGITS as o, AGENT_UI_UNLOCK_TYP as ot, computePairingCommitment as p, verifyAgentUiUnlockTicket as pt, requireProcessMeshCa as q, PairingHttpError as r, loadMeshCa as rt, PAIRING_MAX_CODE_ATTEMPTS as s, AGENT_UI_UNLOCK_USE as st, systemConfigMeshActions as t, issueMeshLeafForNode as tt, PAIRING_PIN_DIGITS as u, isAllowedAgentDashboardReturnTo as ut, verifyPairingProof as v, dropProcessPeer as w, Errors as x, MESH_TLS_PORT_HELLO_FIELD as y, RENEWAL_ABANDONED as z };