camstack 1.2.194 → 1.2.195

package/dist/{launcher-UJ7M7YRF.js → launcher-VKN5MWTJ.js}

@@ -24024,9 +24024,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-BZQjLPiz.js
-var require_dist_BZQjLPiz = __commonJS({
-  "../system/dist/dist-BZQjLPiz.js"(exports) {
+// ../system/dist/dist-Bn-RNanh.js
+var require_dist_Bn_RNanh = __commonJS({
+  "../system/dist/dist-Bn-RNanh.js"(exports) {
     "use strict";
     var zod = require_zod();
     __require("crypto");
@@ -26671,7 +26671,13 @@ var require_dist_BZQjLPiz = __commonJS({
       secretPaths: zod.z.array(zod.z.string().min(1)).default([]),
       /** The id key of each array that carries a secret (`{ headers: 'name' }`). */
       secretArrayKeys: zod.z.record(zod.z.string(), zod.z.string()).default({}),
-      /** The legacy table this kind adopts from; the boot guard reads it (D853: no migration code). */
+      /**
+      * RETIRED (D900): the legacy table a kind adopted from during the records
+      * migration. Nothing declares it any more and nothing reads it; the schema
+      * still ACCEPTS it because the catalog rows the migration wrote carry it
+      * (an orphaned kind is never redeclared) and an addon built before the
+      * removal still sends it. Never set it.
+      */
       adoptsFrom: zod.z.string().min(1).optional(),
       /** Kinds that must agree through `transact` sit in one file under one family name. */
       transactFamily: zod.z.string().min(1).optional(),
@@ -26738,7 +26744,6 @@ var require_dist_BZQjLPiz = __commonJS({
           maxDataBytes: spec.maxDataBytes,
           secretPaths: [...secretPaths],
           secretArrayKeys: spec.secretArrayKeys === void 0 ? void 0 : { ...spec.secretArrayKeys },
-          adoptsFrom: spec.adoptsFrom,
           transactFamily: spec.transactFamily,
           entry: spec.entry === void 0 ? void 0 : {
             title: spec.entry.title,
@@ -26755,27 +26760,6 @@ var require_dist_BZQjLPiz = __commonJS({
       }
       return out;
     }
-    function declarationsOf(kinds) {
-      return Object.fromEntries(Object.entries(kinds).map(([name, kind]) => [name, kind.declaration]));
-    }
-    function parseSettingsBrokersAdoptsFrom(from) {
-      if (!from.startsWith("@settings-brokers/")) return null;
-      const addonId = from.slice(18);
-      return addonId.length > 0 ? addonId : null;
-    }
-    function parseSettingsArrayAdoptsFrom(from) {
-      if (!from.startsWith("@settings-array/")) return null;
-      const rest = from.slice(16);
-      const slash = rest.indexOf("/");
-      if (slash <= 0 || slash >= rest.length - 1) return null;
-      const addonId = rest.slice(0, slash);
-      const settingsKey = rest.slice(slash + 1);
-      if (addonId.length === 0 || settingsKey.length === 0) return null;
-      return {
-        addonId,
-        settingsKey
-      };
-    }
     var CamProfileSchema = zod.z.enum([
       "high",
       "mid",
@@ -36873,11 +36857,12 @@ var require_dist_BZQjLPiz = __commonJS({
       kindId: zod.z.number().int(),
       state: RecordKindStateSchema,
       createdIndexes: zod.z.array(zod.z.string()),
-      /** The boot guard: the kind is empty while its legacy table still holds rows. */
-      adoptionPending: zod.z.object({
-        legacyTable: zod.z.string(),
-        legacyRows: zod.z.number().int()
-      }).nullable()
+      /**
+      * RETIRED (D900): always `null`. It carried the records-migration boot guard;
+      * it stays on the wire, null, because an addon built before the removal reads
+      * an ABSENT field as "adoption pending" and refuses to start.
+      */
+      adoptionPending: zod.z.null()
     });
     var SecretRefsList = zod.z.array(zod.z.string());
     var RecordSecretRefsSchema = zod.z.record(zod.z.string(), zod.z.record(zod.z.string(), zod.z.string()));
@@ -37067,19 +37052,7 @@ var require_dist_BZQjLPiz = __commonJS({
       "stream-broker:rtsp-tokens",
       "notification-center:device-mutes",
       "recorder:recording-configs",
-      "pipeline-orchestrator:device-features",
-      "pipeline-analytics:stats-5m",
-      "pipeline-orchestrator:stats-5m",
-      "vec_object_clip",
-      "addon-devices",
-      "sections",
-      "provider-settings",
-      "device-settings",
-      "ai:budgets",
-      "pipeline-analytics:retrain-dataset-versions",
-      "training:dataset-versions",
-      "benchmark:replay-runs",
-      "viewer-settings-snapshots"
+      "pipeline-orchestrator:device-features"
     ];
     var STORAGE_ADMIN_SCOPED_BASES = [
       "addon-settings",
@@ -37130,42 +37103,7 @@ var require_dist_BZQjLPiz = __commonJS({
         readRecords: method(RecordQueryInputSchema.extend({
           owner: zod.z.string().min(1),
           kind: RecordKindNameSchema
-        }), RecordQueryResultSchema, { auth: "admin" }),
-        /**
-        * The migration copy path (D881): write rows into a kind AS ITS DECLARED
-        * OWNER. Refused when that owner's manifest does not declare the kind.
-        * Idempotent (a put by id, so a re-run resumes). A secret field carries a
-        * keychain marker bound to the row's own ref - the operator script imports
-        * the value first - and a plain string there is refused.
-        */
-        adoptRecords: method(zod.z.object({
-          owner: zod.z.string().min(1),
-          kind: RecordKindNameSchema,
-          records: zod.z.array(RecordInputSchema).max(RECORD_BATCH_MAX),
-          /** The LAST batch: the copy is complete, the boot guard stops asking. */
-          complete: zod.z.boolean().optional()
-        }).refine((input) => input.records.length > 0 || input.complete === true, { message: "records must be non-empty unless complete is true" }), zod.z.object({ adopted: zod.z.number().int() }), {
-          kind: "mutation",
-          auth: "admin"
-        }),
-        /**
-        * Read rows from a legacy KV table by physical name, without a running
-        * `declareCollection`. Used by `records-adopt.ts` when the owner already
-        * moved to records and the collection door refuses the name.
-        */
-        readLegacyCollection: method(zod.z.object({
-          collection: zod.z.string().min(1),
-          cursor: zod.z.string().optional(),
-          limit: zod.z.number().int().min(1).max(1e3).optional()
-        }), zod.z.object({
-          rows: zod.z.array(zod.z.object({
-            id: zod.z.string(),
-            data: zod.z.record(zod.z.string(), zod.z.unknown())
-          })),
-          nextCursor: zod.z.string().nullable()
-        }), { auth: "admin" }),
-        /** True when a declared kind lists `collection` as `adoptsFrom` and adoption finished. */
-        isAdoptedLegacyTable: method(zod.z.object({ collection: zod.z.string().min(1) }), zod.z.object({ adopted: zod.z.boolean() }), { auth: "admin" })
+        }), RecordQueryResultSchema, { auth: "admin" })
       }
     };
     var EntryKindInfoSchema = zod.z.object({
@@ -89394,6 +89332,12 @@ var require_dist_BZQjLPiz = __commonJS({
         addonId: null,
         access: "view"
       },
+      "deviceHistory.queryMany": {
+        capName: "device-history",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "deviceHistory.queryNode": {
         capName: "device-history",
         capScope: "system",
@@ -94614,24 +94558,12 @@ var require_dist_BZQjLPiz = __commonJS({
         addonId: null,
         access: "create"
       },
-      "storageAdmin.adoptRecords": {
-        capName: "storage-admin",
-        capScope: "system",
-        addonId: null,
-        access: "create"
-      },
       "storageAdmin.dropCollection": {
         capName: "storage-admin",
         capScope: "system",
         addonId: null,
         access: "delete"
       },
-      "storageAdmin.isAdoptedLegacyTable": {
-        capName: "storage-admin",
-        capScope: "system",
-        addonId: null,
-        access: "view"
-      },
       "storageAdmin.listKinds": {
         capName: "storage-admin",
         capScope: "system",
@@ -94644,12 +94576,6 @@ var require_dist_BZQjLPiz = __commonJS({
         addonId: null,
         access: "view"
       },
-      "storageAdmin.readLegacyCollection": {
-        capName: "storage-admin",
-        capScope: "system",
-        addonId: null,
-        access: "view"
-      },
       "storageAdmin.readRecords": {
         capName: "storage-admin",
         capScope: "system",
@@ -98721,12 +98647,6 @@ var require_dist_BZQjLPiz = __commonJS({
         form: "single",
         optional: false
       }],
-      "storageAdmin.adoptRecords": [{
-        name: "records",
-        form: "object-array",
-        optional: false,
-        itemField: "deviceId"
-      }],
       "storageAdmin.readRecords": [{
         name: "deviceId",
         form: "single",
@@ -101822,12 +101742,6 @@ var require_dist_BZQjLPiz = __commonJS({
         return declarationOwnerNodeId;
       }
     });
-    Object.defineProperty(exports, "declarationsOf", {
-      enumerable: true,
-      get: function() {
-        return declarationsOf;
-      }
-    });
     Object.defineProperty(exports, "decodeVectorBase64", {
       enumerable: true,
       get: function() {
@@ -102308,18 +102222,6 @@ var require_dist_BZQjLPiz = __commonJS({
         return parseSecretRef;
       }
     });
-    Object.defineProperty(exports, "parseSettingsArrayAdoptsFrom", {
-      enumerable: true,
-      get: function() {
-        return parseSettingsArrayAdoptsFrom;
-      }
-    });
-    Object.defineProperty(exports, "parseSettingsBrokersAdoptsFrom", {
-      enumerable: true,
-      get: function() {
-        return parseSettingsBrokersAdoptsFrom;
-      }
-    });
     Object.defineProperty(exports, "parseStreamParamsFormPatch", {
       enumerable: true,
       get: function() {
@@ -114164,11 +114066,11 @@ ${values.join("\n")}` : `${blockName} :`;
   }
 });
 
-// ../system/dist/device-ca-BrVK_5s3.js
-var require_device_ca_BrVK_5s3 = __commonJS({
-  "../system/dist/device-ca-BrVK_5s3.js"(exports) {
+// ../system/dist/device-ca-CPTDs--d.js
+var require_device_ca_CPTDs_d = __commonJS({
+  "../system/dist/device-ca-CPTDs--d.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var require_x509_es = require_x509_es_C4cOo48M();
     var node_crypto = __require("crypto");
     var SYSTEM_SECRET_OWNER = "system";
@@ -114583,95 +114485,6 @@ var require_device_ca_BrVK_5s3 = __commonJS({
   }
 });
 
-// ../system/dist/phase6-declare-gate-Dag1_WR2.js
-var require_phase6_declare_gate_Dag1_WR2 = __commonJS({
-  "../system/dist/phase6-declare-gate-Dag1_WR2.js"(exports) {
-    "use strict";
-    var require_dist10 = require_dist_BZQjLPiz();
-    function legacyTableRowCountFromList(tables, collection) {
-      return tables.find((t) => t.name === collection)?.rows ?? 0;
-    }
-    var CAMSTACK_RECORDS_DECLARE_PHASE6 = "CAMSTACK_RECORDS_DECLARE_PHASE6";
-    function isPhase6RecordsDeclareForced() {
-      const raw = process.env[CAMSTACK_RECORDS_DECLARE_PHASE6]?.trim().toLowerCase();
-      return raw === "1" || raw === "true" || raw === "yes";
-    }
-    async function legacyTablesHoldRows(collections, legacyRowCount) {
-      for (const collection of collections) if (await legacyRowCount(collection) > 0) return true;
-      return false;
-    }
-    async function catalogKindsFullyAdopted(owner, kindNames, declarations, listKindsForOwner, isAdoptedLegacyTable) {
-      const listed = await listKindsForOwner(owner);
-      const byKind = new Map(listed.map((k) => [k.kind, k]));
-      for (const name of kindNames) {
-        if (byKind.get(name) === void 0) return false;
-        const legacy = declarations[name]?.adoptsFrom;
-        if (typeof legacy !== "string") continue;
-        if (!await isAdoptedLegacyTable(legacy)) return false;
-      }
-      return true;
-    }
-    async function resolvePhase6UseRecordsPath(deps) {
-      const declarations = require_dist10.declarationsOf(deps.kinds);
-      const kindNames = Object.keys(deps.kinds);
-      if (await catalogKindsFullyAdopted(deps.owner, kindNames, declarations, deps.listKindsForOwner, deps.isAdoptedLegacyTable)) {
-        await deps.records.declare(deps.kinds);
-        return true;
-      }
-      if (!await legacyTablesHoldRows(deps.legacyCollections, deps.legacyRowCount)) {
-        await deps.records.declare(deps.kinds);
-        return true;
-      }
-      if (isPhase6RecordsDeclareForced()) {
-        try {
-          await deps.records.declare(deps.kinds);
-        } catch (err) {
-          if (!(err instanceof Error ? err.message : String(err)).startsWith("records/adoption-pending:")) throw err;
-          deps.log.info("phase 6: records kinds declared; legacy tables until adopt completes", { owner: deps.owner });
-        }
-        return false;
-      }
-      deps.log.info("phase 6: skipping records.declare \u2014 serving legacy collections until adopt completes", { owner: deps.owner });
-      return false;
-    }
-    async function resolvePhase6UseRecordsPathForHub(ctx, owner, kinds, legacyCollections) {
-      const records = ctx.records;
-      const store = ctx.api?.settingsStore;
-      if (records === void 0 || store === void 0) return false;
-      const admin = ctx.api?.storageAdmin;
-      return resolvePhase6UseRecordsPath({
-        owner,
-        records,
-        kinds,
-        legacyCollections,
-        legacyRowCount: async (collection) => {
-          if (admin !== void 0) {
-            const fromEngine = legacyTableRowCountFromList((await admin.listTables.query({})).tables, collection);
-            if (fromEngine > 0) return fromEngine;
-          }
-          try {
-            return await store.count.query({ collection });
-          } catch {
-            return admin === void 0 ? 0 : legacyTableRowCountFromList((await admin.listTables.query({})).tables, collection);
-          }
-        },
-        listKindsForOwner: async (o) => admin === void 0 ? [] : (await admin.listKinds.query({
-          owner: o,
-          counts: false
-        })).kinds,
-        isAdoptedLegacyTable: async (collection) => admin === void 0 ? false : (await admin.isAdoptedLegacyTable.query({ collection })).adopted,
-        log: { info: (message, meta) => ctx.logger.info(message, meta ? { meta } : void 0) }
-      });
-    }
-    Object.defineProperty(exports, "resolvePhase6UseRecordsPathForHub", {
-      enumerable: true,
-      get: function() {
-        return resolvePhase6UseRecordsPathForHub;
-      }
-    });
-  }
-});
-
 // ../system/dist/builtins/alerts/alerts.addon.js
 var require_alerts_addon = __commonJS({
   "../system/dist/builtins/alerts/alerts.addon.js"(exports) {
@@ -114681,9 +114494,8 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var require_read_all_rows$1 = require_read_all_rows_CVoO1ONM();
-    var require_phase6_declare_gate = require_phase6_declare_gate_Dag1_WR2();
     function nextEpisodeId(input) {
       const { previous } = input;
       if (previous !== null && require_dist10.isAlertEpisodeOpen(previous.status)) {
@@ -114873,8 +114685,7 @@ var require_alerts_addon = __commonJS({
       retention: {
         owner: "alert-center",
         reason: "maxAlerts cap and retentionDays enforced on write (enforceMaxAlerts / enforceRetention); read alerts preferred when trimming overflow"
-      },
-      adoptsFrom: ALERTS_COLLECTION
+      }
     } });
     var alertCenterRecordKinds = _alertCenterRecordKinds;
     var alertsRecordKind = _alertCenterRecordKinds.alerts;
@@ -115229,8 +115040,8 @@ var require_alerts_addon = __commonJS({
       async onInitialize() {
         const records = this.ctx.records;
         const store = this.ctx.api?.settingsStore;
-        const useRecords = records !== void 0 && store !== void 0 && await require_phase6_declare_gate.resolvePhase6UseRecordsPathForHub(this.ctx, "alert-center", alertCenterRecordKinds, ["alerts"]);
-        this.alertStore = useRecords && records !== void 0 ? AlertStore.of(records) : store === void 0 ? null : AlertStore.legacy(store);
+        if (records !== void 0) await records.declare(alertCenterRecordKinds);
+        this.alertStore = records !== void 0 ? AlertStore.of(records) : store === void 0 ? null : AlertStore.legacy(store);
         if (this.alertStore === null) throw new Error("alert-center needs ctx.records or settings-store on the hub");
         const alertsProvider = {
           emit: (alert) => this.emitAlert(alert),
@@ -116088,7 +115899,7 @@ var require_calendars_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var require_settle_sources = require_settle_sources_Bhsy57y();
     var zod = require_zod();
     var CALENDAR_COLOR_PALETTE = [
@@ -116113,7 +115924,6 @@ var require_calendars_addon = __commonJS({
       }
       return CALENDAR_COLOR_PALETTE[Math.abs(hash) % CALENDAR_COLOR_PALETTE.length];
     }
-    var CALENDARS_USER_PREFS_COLLECTION = "calendars:user-prefs";
     var CalendarUserPrefsBodySchema = zod.z.object({
       calendars: require_dist10.CalendarPreferencesSchema.shape.calendars,
       updatedAt: zod.z.number()
@@ -116128,8 +115938,7 @@ var require_calendars_addon = __commonJS({
         name: "updated_at",
         fields: ["updatedAt"]
       }],
-      retention: { none: "a missing row reads as empty prefs (all visible, system colours)" },
-      adoptsFrom: CALENDARS_USER_PREFS_COLLECTION
+      retention: { none: "a missing row reads as empty prefs (all visible, system colours)" }
     } });
     var calendarsRecordKinds = _calendarsRecordKinds;
     _calendarsRecordKinds["user-prefs"];
@@ -116306,11 +116115,11 @@ var require_calendars = __commonJS({
   }
 });
 
-// ../system/dist/composition-sources-DURQNDJ4.js
-var require_composition_sources_DURQNDJ4 = __commonJS({
-  "../system/dist/composition-sources-DURQNDJ4.js"(exports) {
+// ../system/dist/composition-sources-b0e_2I-D.js
+var require_composition_sources_b0e_2I_D = __commonJS({
+  "../system/dist/composition-sources-b0e_2I-D.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     function normalizedNativeOwner(owner) {
       const trimmed = owner?.trim();
       return trimmed ? trimmed : null;
@@ -116425,8 +116234,8 @@ var require_composer_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
-    var require_composition_sources = require_composition_sources_DURQNDJ4();
+    var require_dist10 = require_dist_Bn_RNanh();
+    var require_composition_sources = require_composition_sources_b0e_2I_D();
     var zod = require_zod();
     function isRecord$2(value) {
       return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -120236,7 +120045,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -124626,9 +124435,9 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var require_read_all_rows$1 = require_read_all_rows_CVoO1ONM();
-    var require_composition_sources = require_composition_sources_DURQNDJ4();
+    var require_composition_sources = require_composition_sources_b0e_2I_D();
     var require_prefix_range = require_prefix_range_D_KueXbQ();
     var require_prefix_walk = require_prefix_walk_Dv6MLZlM();
     var zod = require_zod();
@@ -125065,8 +124874,7 @@ export default class CoreBlockAddon extends BaseAddon {
           fields: ["enabled"]
         }],
         retention: { none: "operator delete only" },
-        maxDataBytes: 256 * 1024,
-        adoptsFrom: CORE_BLOCKS_COLLECTION
+        maxDataBytes: 256 * 1024
       },
       settings: {
         schema: CoreBlockSettingsBodySchema,
@@ -125074,8 +124882,7 @@ export default class CoreBlockAddon extends BaseAddon {
         writeTrigger: "legacy only \u2014 migrateRawSecrets reads then deletes rows (D880)",
         device: "none",
         at: "none",
-        retention: { none: "rows deleted by migrateRawSecrets" },
-        adoptsFrom: CORE_BLOCK_SETTINGS_COLLECTION
+        retention: { none: "rows deleted by migrateRawSecrets" }
       }
     });
     var coreBlocksRecordKinds = _coreBlocksRecordKinds;
@@ -127033,9 +126840,9 @@ var require_event_category_eSqkye_K = __commonJS({
   }
 });
 
-// ../types/dist/sleep-DKtoyk6X.js
-var require_sleep_DKtoyk6X = __commonJS({
-  "../types/dist/sleep-DKtoyk6X.js"(exports) {
+// ../types/dist/sleep-gRQc2IoX.js
+var require_sleep_gRQc2IoX = __commonJS({
+  "../types/dist/sleep-gRQc2IoX.js"(exports) {
     "use strict";
     var require_event_category = require_event_category_eSqkye_K();
     var zod = require_zod();
@@ -129714,7 +129521,6 @@ var require_sleep_DKtoyk6X = __commonJS({
       "secret-unavailable",
       "invalid-record",
       "declaration-refused",
-      "adoption-pending",
       "no-caller",
       "batch-too-large"
     ];
@@ -129801,12 +129607,6 @@ var require_sleep_DKtoyk6X = __commonJS({
         this.name = "DeclarationRefusedError";
       }
     };
-    var AdoptionPendingError = class extends RecordsError {
-      constructor(detail) {
-        super("adoption-pending", detail);
-        this.name = "AdoptionPendingError";
-      }
-    };
     var NoCallerError = class extends RecordsError {
       constructor(detail) {
         super("no-caller", detail);
@@ -129832,7 +129632,6 @@ var require_sleep_DKtoyk6X = __commonJS({
       "secret-unavailable": (d) => new RecordSecretUnavailableError(d),
       "invalid-record": (d) => new InvalidRecordError(d),
       "declaration-refused": (d) => new DeclarationRefusedError(d),
-      "adoption-pending": (d) => new AdoptionPendingError(d),
       "no-caller": (d) => new NoCallerError(d),
       "batch-too-large": (d) => new BatchTooLargeError(d)
     };
@@ -130055,7 +129854,13 @@ var require_sleep_DKtoyk6X = __commonJS({
       secretPaths: zod.z.array(zod.z.string().min(1)).default([]),
       /** The id key of each array that carries a secret (`{ headers: 'name' }`). */
       secretArrayKeys: zod.z.record(zod.z.string(), zod.z.string()).default({}),
-      /** The legacy table this kind adopts from; the boot guard reads it (D853: no migration code). */
+      /**
+      * RETIRED (D900): the legacy table a kind adopted from during the records
+      * migration. Nothing declares it any more and nothing reads it; the schema
+      * still ACCEPTS it because the catalog rows the migration wrote carry it
+      * (an orphaned kind is never redeclared) and an addon built before the
+      * removal still sends it. Never set it.
+      */
       adoptsFrom: zod.z.string().min(1).optional(),
       /** Kinds that must agree through `transact` sit in one file under one family name. */
       transactFamily: zod.z.string().min(1).optional(),
@@ -130122,7 +129927,6 @@ var require_sleep_DKtoyk6X = __commonJS({
           maxDataBytes: spec.maxDataBytes,
           secretPaths: [...secretPaths],
           secretArrayKeys: spec.secretArrayKeys === void 0 ? void 0 : { ...spec.secretArrayKeys },
-          adoptsFrom: spec.adoptsFrom,
           transactFamily: spec.transactFamily,
           entry: spec.entry === void 0 ? void 0 : {
             title: spec.entry.title,
@@ -130459,10 +130263,7 @@ var require_sleep_DKtoyk6X = __commonJS({
           return delegate;
         },
         async declare(kinds) {
-          const result = await call(() => options.transport.declareKinds({ kinds: { ...declarationsOf(kinds) } }));
-          const pending = Object.entries(result.kinds).filter((entry) => entry[1].adoptionPending !== null);
-          if (pending.length > 0) throw new AdoptionPendingError(`${pending.map(([name, r]) => r.adoptionPending === null ? name : `${name} (legacy table "${r.adoptionPending.legacyTable}" holds ${r.adoptionPending.legacyRows} rows)`).join(", ")}. Stop the addon and run scripts/hub/records-adopt.ts --copy --apply before starting this build`);
-          return result.kinds;
+          return (await call(() => options.transport.declareKinds({ kinds: { ...declarationsOf(kinds) } }))).kinds;
         },
         kind(definition) {
           const existing = handles.get(definition);
@@ -130503,7 +130304,6 @@ var require_sleep_DKtoyk6X = __commonJS({
         ...spec.database === void 0 ? {} : { database: spec.database },
         ...spec.indexes === void 0 ? {} : { indexes: spec.indexes },
         ...spec.secretArrayKeys === void 0 ? {} : { secretArrayKeys: spec.secretArrayKeys },
-        ...spec.adoptsFrom === void 0 ? {} : { adoptsFrom: spec.adoptsFrom },
         entry: {
           title: spec.title,
           ...spec.nameField === void 0 ? {} : { nameField: spec.nameField }
@@ -130512,32 +130312,6 @@ var require_sleep_DKtoyk6X = __commonJS({
       if (defined === void 0) throw new DeclarationRefusedError(`entry kind "${name}" was not built`);
       return defined;
     }
-    var SETTINGS_BROKERS_ADOPTS_PREFIX = "@settings-brokers/";
-    function settingsBrokersAdoptsFrom(addonId) {
-      return `${SETTINGS_BROKERS_ADOPTS_PREFIX}${addonId}`;
-    }
-    function parseSettingsBrokersAdoptsFrom(from) {
-      if (!from.startsWith("@settings-brokers/")) return null;
-      const addonId = from.slice(18);
-      return addonId.length > 0 ? addonId : null;
-    }
-    var SETTINGS_ARRAY_ADOPTS_PREFIX = "@settings-array/";
-    function settingsArrayAdoptsFrom(addonId, settingsKey) {
-      return `${SETTINGS_ARRAY_ADOPTS_PREFIX}${addonId}/${settingsKey}`;
-    }
-    function parseSettingsArrayAdoptsFrom(from) {
-      if (!from.startsWith("@settings-array/")) return null;
-      const rest = from.slice(16);
-      const slash = rest.indexOf("/");
-      if (slash <= 0 || slash >= rest.length - 1) return null;
-      const addonId = rest.slice(0, slash);
-      const settingsKey = rest.slice(slash + 1);
-      if (addonId.length === 0 || settingsKey.length === 0) return null;
-      return {
-        addonId,
-        settingsKey
-      };
-    }
     function isRecord(value) {
       return typeof value === "object" && value !== null && !Array.isArray(value);
     }
@@ -133306,12 +133080,6 @@ var require_sleep_DKtoyk6X = __commonJS({
         return AUDIO_CHUNK_FORMATS;
       }
     });
-    Object.defineProperty(exports, "AdoptionPendingError", {
-      enumerable: true,
-      get: function() {
-        return AdoptionPendingError;
-      }
-    });
     Object.defineProperty(exports, "AudioChunkFormatSchema", {
       enumerable: true,
       get: function() {
@@ -133828,18 +133596,6 @@ var require_sleep_DKtoyk6X = __commonJS({
         return SECRET_REF_SCHEME;
       }
     });
-    Object.defineProperty(exports, "SETTINGS_ARRAY_ADOPTS_PREFIX", {
-      enumerable: true,
-      get: function() {
-        return SETTINGS_ARRAY_ADOPTS_PREFIX;
-      }
-    });
-    Object.defineProperty(exports, "SETTINGS_BROKERS_ADOPTS_PREFIX", {
-      enumerable: true,
-      get: function() {
-        return SETTINGS_BROKERS_ADOPTS_PREFIX;
-      }
-    });
     Object.defineProperty(exports, "SHARE_VIEW_KINDS", {
       enumerable: true,
       get: function() {
@@ -134422,18 +134178,6 @@ var require_sleep_DKtoyk6X = __commonJS({
         return parseSecretStatePath;
       }
     });
-    Object.defineProperty(exports, "parseSettingsArrayAdoptsFrom", {
-      enumerable: true,
-      get: function() {
-        return parseSettingsArrayAdoptsFrom;
-      }
-    });
-    Object.defineProperty(exports, "parseSettingsBrokersAdoptsFrom", {
-      enumerable: true,
-      get: function() {
-        return parseSettingsBrokersAdoptsFrom;
-      }
-    });
     Object.defineProperty(exports, "readErrorI18n", {
       enumerable: true,
       get: function() {
@@ -134548,18 +134292,6 @@ var require_sleep_DKtoyk6X = __commonJS({
         return selectAssignedProfileSlots;
       }
     });
-    Object.defineProperty(exports, "settingsArrayAdoptsFrom", {
-      enumerable: true,
-      get: function() {
-        return settingsArrayAdoptsFrom;
-      }
-    });
-    Object.defineProperty(exports, "settingsBrokersAdoptsFrom", {
-      enumerable: true,
-      get: function() {
-        return settingsBrokersAdoptsFrom;
-      }
-    });
     Object.defineProperty(exports, "shortSecretRefHash", {
       enumerable: true,
       get: function() {
@@ -134628,7 +134360,7 @@ var require_addon = __commonJS({
   "../types/dist/addon.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_sleep = require_sleep_DKtoyk6X();
+    var require_sleep = require_sleep_gRQc2IoX();
     var require_event_category = require_event_category_eSqkye_K();
     var require_err_msg = require_err_msg_BhVbr0NX();
     var CAP_INPUT_DEFAULTS = Object.freeze({
@@ -136844,7 +136576,6 @@ var require_addon = __commonJS({
         }
       ]
     });
-    exports.AdoptionPendingError = require_sleep.AdoptionPendingError;
     exports.BOOT_RECOVERY_BACKOFF_MS = require_sleep.BOOT_RECOVERY_BACKOFF_MS;
     exports.BaseAddon = require_sleep.BaseAddon;
     exports.BatchTooLargeError = require_sleep.BatchTooLargeError;
@@ -136907,8 +136638,6 @@ var require_addon = __commonJS({
     exports.RevConflictError = require_sleep.RevConflictError;
     exports.SECRET_CLEAR = require_sleep.SECRET_CLEAR;
     exports.SECRET_REF_SCHEME = require_sleep.SECRET_REF_SCHEME;
-    exports.SETTINGS_ARRAY_ADOPTS_PREFIX = require_sleep.SETTINGS_ARRAY_ADOPTS_PREFIX;
-    exports.SETTINGS_BROKERS_ADOPTS_PREFIX = require_sleep.SETTINGS_BROKERS_ADOPTS_PREFIX;
     exports.UnindexedFilterError = require_sleep.UnindexedFilterError;
     exports.UnknownRecordKindError = require_sleep.UnknownRecordKindError;
     exports.addonSliceHandleApi = require_sleep.addonSliceHandleApi;
@@ -136961,8 +136690,6 @@ var require_addon = __commonJS({
     exports.parseJsonUnknown = require_sleep.parseJsonUnknown;
     exports.parseSecretPath = require_sleep.parseSecretPath;
     exports.parseSecretRef = require_sleep.parseSecretRef;
-    exports.parseSettingsArrayAdoptsFrom = require_sleep.parseSettingsArrayAdoptsFrom;
-    exports.parseSettingsBrokersAdoptsFrom = require_sleep.parseSettingsBrokersAdoptsFrom;
     exports.readErrorI18n = require_sleep.readErrorI18n;
     exports.readNodePin = require_sleep.readNodePin;
     exports.recordArrayItemPath = require_sleep.recordArrayItemPath;
@@ -136974,8 +136701,6 @@ var require_addon = __commonJS({
     exports.scopeKey = require_sleep.scopeKey;
     exports.scrubKnownSecrets = require_sleep.scrubKnownSecrets;
     exports.secretArrayPrefixes = require_sleep.secretArrayPrefixes;
-    exports.settingsArrayAdoptsFrom = require_sleep.settingsArrayAdoptsFrom;
-    exports.settingsBrokersAdoptsFrom = require_sleep.settingsBrokersAdoptsFrom;
     exports.shortSecretRefHash = require_sleep.shortSecretRefHash;
     exports.sleep = require_sleep.sleep;
     exports.toSecretFieldView = require_sleep.toSecretFieldView;
@@ -137284,7 +137009,7 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var require_read_all_rows$1 = require_read_all_rows_CVoO1ONM();
     var require_prefix_range = require_prefix_range_D_KueXbQ();
     var require_prefix_walk = require_prefix_walk_Dv6MLZlM();
@@ -143342,12 +143067,10 @@ var require_device_manager_addon = __commonJS({
       retention: {
         owner: "device-manager",
         reason: "90 days (`DEVICE_TOMBSTONE_RETENTION_MS`), pruned whenever a tombstone is written or the list is read"
-      },
-      adoptsFrom: DEVICE_TOMBSTONES_COLLECTION
+      }
     } });
     var deviceManagerRecordKinds = _deviceManagerRecordKinds;
     _deviceManagerRecordKinds.tombstones;
-    var DEVICE_TOMBSTONES_COLLECTION = "device-manager:tombstones";
     var TOMBSTONE_READ_LIMIT = 2e4;
     function rowToTombstone(id, body) {
       const deviceId = Number(id);
@@ -146358,7 +146081,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -146492,7 +146215,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -146855,12 +146578,11 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var require_read_all_rows$1 = require_read_all_rows_CVoO1ONM();
     var require_safe_buffer$1 = require_safe_buffer_D3aoa_7X();
     var require_ms$1 = require_ms_LB3giGoU();
-    var require_device_ca = require_device_ca_BrVK_5s3();
-    var require_phase6_declare_gate = require_phase6_declare_gate_Dag1_WR2();
+    var require_device_ca = require_device_ca_CPTDs_d();
     var zod = require_zod();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
@@ -152855,8 +152577,7 @@ var require_local_auth_addon = __commonJS({
           fields: ["username"],
           unique: true
         }],
-        retention: { none: "row goes only when an operator deletes the user; destructive declareCollection rebuild wipes all accounts" },
-        adoptsFrom: USERS_COLLECTION$1
+        retention: { none: "row goes only when an operator deletes the user; destructive declareCollection rebuild wipes all accounts" }
       },
       "api-keys": {
         schema: ApiKeyBodySchema,
@@ -152868,8 +152589,7 @@ var require_local_auth_addon = __commonJS({
           name: "prefix",
           fields: ["tokenPrefix"]
         }],
-        retention: { none: "explicit revoke only" },
-        adoptsFrom: API_KEYS_COLLECTION
+        retention: { none: "explicit revoke only" }
       },
       "scoped-tokens": {
         schema: ScopedTokenBodySchema,
@@ -152885,8 +152605,7 @@ var require_local_auth_addon = __commonJS({
           name: "user",
           fields: ["userId"]
         }],
-        retention: { none: "the operator drops the legacy rows by hand (D895)" },
-        adoptsFrom: SCOPED_TOKENS_COLLECTION
+        retention: { none: "the operator drops the legacy rows by hand (D895)" }
       },
       "admin-tokens": {
         schema: AdminTokenBodySchema,
@@ -152902,8 +152621,7 @@ var require_local_auth_addon = __commonJS({
           name: "created_by",
           fields: ["createdBy"]
         }],
-        retention: { none: "the operator drops the legacy rows by hand (D895)" },
-        adoptsFrom: ADMIN_TOKENS_COLLECTION
+        retention: { none: "the operator drops the legacy rows by hand (D895)" }
       },
       "login-sessions": {
         schema: LoginSessionBodySchema,
@@ -152921,8 +152639,7 @@ var require_local_auth_addon = __commonJS({
         retention: {
           owner: "local-auth",
           reason: "daily reap: expired >7d and revoked >30d"
-        },
-        adoptsFrom: LOGIN_SESSIONS_COLLECTION
+        }
       },
       "login-session-cutoffs": {
         schema: LoginSessionCutoffBodySchema,
@@ -152930,8 +152647,7 @@ var require_local_auth_addon = __commonJS({
         writeTrigger: "revoke-all-sessions for a user (password change, delete, logout everywhere)",
         device: "none",
         at: "none",
-        retention: { none: "one row per user who ever had all sessions revoked" },
-        adoptsFrom: LOGIN_SESSION_CUTOFFS_COLLECTION
+        retention: { none: "one row per user who ever had all sessions revoked" }
       },
       "oauth-sessions": {
         schema: OauthSessionBodySchema,
@@ -152946,8 +152662,7 @@ var require_local_auth_addon = __commonJS({
         retention: {
           owner: "local-auth",
           reason: "daily reap deletes revoked sessions older than 30 days; active rows never expire"
-        },
-        adoptsFrom: OAUTH_SESSIONS_COLLECTION
+        }
       },
       "user-totp": {
         schema: UserTotpBodySchema,
@@ -152955,8 +152670,7 @@ var require_local_auth_addon = __commonJS({
         writeTrigger: "setup inserts seed (keychain); confirm sets confirmedAt; disable deletes row",
         device: "none",
         at: "none",
-        retention: { none: "disable or replace on re-setup; user delete does not cascade" },
-        adoptsFrom: USER_TOTP_COLLECTION
+        retention: { none: "disable or replace on re-setup; user delete does not cascade" }
       },
       "user-external-identities": {
         schema: ExternalIdentityBodySchema,
@@ -152972,8 +152686,7 @@ var require_local_auth_addon = __commonJS({
           fields: ["provider", "subject"],
           unique: true
         }],
-        retention: { none: "unlink or deleteUser removes rows" },
-        adoptsFrom: USER_EXTERNAL_IDENTITIES_COLLECTION
+        retention: { none: "unlink or deleteUser removes rows" }
       },
       "device-credentials": {
         schema: DeviceCredentialBodySchema,
@@ -152991,8 +152704,7 @@ var require_local_auth_addon = __commonJS({
         retention: {
           owner: "local-auth",
           reason: "daily reap removes revoked/expired rows older than 90 days"
-        },
-        adoptsFrom: DEVICE_CREDENTIALS_COLLECTION
+        }
       },
       "auth-audit": {
         schema: AuthAuditBodySchema,
@@ -153007,8 +152719,7 @@ var require_local_auth_addon = __commonJS({
         retention: {
           ttlMs: 90 * DAY_MS,
           from: "at"
-        },
-        adoptsFrom: AUTH_AUDIT_COLLECTION
+        }
       }
     });
     var localAuthRecordKinds = _localAuthRecordKinds;
@@ -156802,45 +156513,41 @@ var require_local_auth_addon = __commonJS({
         const store = this.ctx.api?.settingsStore;
         const records = this.ctx.records;
         if (store && records) {
-          const useRecords = await require_phase6_declare_gate.resolvePhase6UseRecordsPathForHub(this.ctx, "local-auth", localAuthRecordKinds, LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS);
-          const authStores = useRecords ? localAuthRecordStoresOf(records) : null;
+          await records.declare(localAuthRecordKinds);
+          const authStores = localAuthRecordStoresOf(records);
           await records.declare(localAuthPreferencesRecordKinds);
           this.preferences = new UserPreferencesStore(records.kind(localAuthPreferencesRecordKinds["user-preferences"]));
-          const legacyStoreAccess = { getStore: () => store };
-          await declareAuthSchema(store, { ...useRecords ? { skipCollections: LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS } : {} });
-          this.userManager = authStores === null ? new UserManager(legacyStoreAccess, this.authManager) : new UserManager({
+          await declareAuthSchema(store, { skipCollections: LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS });
+          this.userManager = new UserManager({
             usersKind: authStores.users,
             legacyStore: store
           }, this.authManager);
-          this.apiKeyManager = authStores === null ? new ApiKeyManager(legacyStoreAccess) : new ApiKeyManager({
+          this.apiKeyManager = new ApiKeyManager({
             apiKeysKind: authStores.apiKeys,
             legacyStore: store
           });
-          this.oauthSessionManager = authStores === null ? new OauthSessionManager(store) : new OauthSessionManager({
+          this.oauthSessionManager = new OauthSessionManager({
             oauthSessionsKind: authStores.oauthSessions,
             legacyStore: store
           });
-          this.totpManager = authStores === null ? new TotpManager(store, {
-            secrets: forOwner === null ? null : forOwner("system"),
-            logger: this.ctx.logger
-          }) : new TotpManager({
+          this.totpManager = new TotpManager({
             userTotpKind: authStores.userTotp,
             legacyStore: store
           }, {
             secrets: forOwner === null ? null : forOwner("system"),
             logger: this.ctx.logger
           });
-          this.externalIdentities = authStores === null ? new ExternalIdentityManager(store) : new ExternalIdentityManager({
+          this.externalIdentities = new ExternalIdentityManager({
             identitiesKind: authStores.userExternalIdentities,
             legacyStore: store
           });
-          this.loginSessions = authStores === null ? new LoginSessionManager(store, { logger: this.ctx.logger }) : new LoginSessionManager({
+          this.loginSessions = new LoginSessionManager({
             sessionsKind: authStores.loginSessions,
             cutoffsKind: authStores.loginSessionCutoffs,
             legacyStore: store
           }, { logger: this.ctx.logger });
           await this.loginSessions.load();
-          this.auditLog = authStores === null ? new AuthAuditLog(store, this.ctx.logger) : new AuthAuditLog({
+          this.auditLog = new AuthAuditLog({
             authAuditKind: authStores.authAudit,
             legacyStore: store
           }, this.ctx.logger);
@@ -156860,7 +156567,7 @@ var require_local_auth_addon = __commonJS({
               return user === null ? null : { username: user.username };
             },
             selfEnrollmentAllowed: async () => (await this.readDeviceCertificateSettings()).selfEnrollment === "allowed",
-            deviceCredentialsKind: authStores?.deviceCredentials ?? null,
+            deviceCredentialsKind: authStores.deviceCredentials,
             logger: this.ctx.logger
           });
           await this.deviceCredentials.load();
@@ -157542,7 +157249,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var require_log_read_filter = require_log_read_filter_Bi066jwU();
     var zod = require_zod();
     function sanitizeLabelName(raw) {
@@ -158503,7 +158210,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var node_fs_promises = __require("fs/promises");
     var node_util = __require("util");
     var node_os = __require("os");
@@ -161048,7 +160755,7 @@ var require_device_history_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var FIVE_MINUTES_MS = 5 * 6e4;
     var HOUR_MS = 60 * 6e4;
     var DAY_MS = 24 * HOUR_MS;
@@ -164094,7 +163801,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -165204,12 +164911,12 @@ var require_lib = __commonJS({
   }
 });
 
-// ../system/dist/wal-maintenance-DfSIOj24.js
-var require_wal_maintenance_DfSIOj24 = __commonJS({
-  "../system/dist/wal-maintenance-DfSIOj24.js"(exports) {
+// ../system/dist/wal-maintenance-DUHEp_09.js
+var require_wal_maintenance_DUHEp_09 = __commonJS({
+  "../system/dist/wal-maintenance-DUHEp_09.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var require_prefix_range = require_prefix_range_D_KueXbQ();
     var node_crypto = __require("crypto");
     var node_module = __require("module");
@@ -165495,8 +165202,7 @@ var require_wal_maintenance_DfSIOj24 = __commonJS({
         hasTable: ({ name }) => backend.hasTable(name),
         dropRetiredTable: ({ name }) => backend.dropRetiredTable(name),
         threadId: () => threadId,
-        listPhysicalTables: ({ ownerPrefix }) => backend.listTables(ownerPrefix),
-        readLegacyCollection: (input) => backend.readLegacyCollection(input)
+        listPhysicalTables: ({ ownerPrefix }) => backend.listTables(ownerPrefix)
       };
     }
     function callControl(target, op, input) {
@@ -165614,6 +165320,8 @@ CREATE TABLE IF NOT EXISTS _record_kinds (
   declaration   TEXT NOT NULL,
   state         TEXT NOT NULL,
   orphaned_at   INTEGER,
+  -- RETIRED (D900): the records-migration boot guard's flag. Nothing reads it;
+  -- the column stays so an older build can still open a file this one created.
   adopted_at    INTEGER,
   UNIQUE (owner, kind)
 );
@@ -165677,15 +165385,14 @@ CREATE TABLE IF NOT EXISTS _record_sequences (
         database: asDatabase(row.database),
         hash: row.manifest_hash,
         state: asState(row.state),
-        declaration: require_dist10.RecordKindDeclarationSchema.parse(JSON.parse(row.declaration)),
-        adoptedAt: row.adopted_at
+        declaration: require_dist10.RecordKindDeclarationSchema.parse(JSON.parse(row.declaration))
       };
     }
     function ensureRecordsSchema(db) {
       db.exec(RECORDS_SCHEMA_SQL);
     }
     function loadKinds(db) {
-      return db.prepare("SELECT kind_id, owner, kind, database, manifest_hash, declaration, state, adopted_at FROM _record_kinds ORDER BY kind_id").all().map(toKindRow);
+      return db.prepare("SELECT kind_id, owner, kind, database, manifest_hash, declaration, state FROM _record_kinds ORDER BY kind_id").all().map(toKindRow);
     }
     function physicalIndexSql(db, kindId, name) {
       return db.prepare("SELECT name, sql FROM sqlite_master WHERE type = 'index' AND name = ?").get(indexName(kindId, name))?.sql ?? null;
@@ -165741,8 +165448,7 @@ CREATE TABLE IF NOT EXISTS _record_sequences (
             database: declaration.database,
             hash,
             state: "declared",
-            declaration,
-            adoptedAt: prior?.adoptedAt ?? null
+            declaration
           },
           result: {
             kindId,
@@ -166152,8 +165858,8 @@ CREATE TABLE IF NOT EXISTS _record_sequences (
       }
       /**
       * Boot correction: every kind that ever allocated an id has its counter raised
-      * above the highest numeric id it holds. Adopted legacy rows (or any caller
-      * chosen numeric id) kept ids far above a counter that started at 1, and the
+      * above the highest numeric id it holds. Rows the records migration copied
+      * (or any caller chosen numeric id) kept ids far above a counter that started at 1, and the
       * upsert would have overwritten another device's row on the first collision.
       * Runs on the engine's own connection, over the (kind_id, id) unique index.
       */
@@ -166171,16 +165877,12 @@ CREATE TABLE IF NOT EXISTS _record_sequences (
       /** Ids handed out by allocateId and not yet written: their first write is insert-only. */
       pendingAllocated = /* @__PURE__ */ new Set();
       static PENDING_ALLOCATED_MAX = 4096;
-      /** Raise a kind's counter above the numeric ids of a caller-supplied batch (adoption). */
+      /** Raise a kind's counter above the numeric ids of a caller-supplied batch. */
       raiseSequenceFor(k, records) {
         let top = -1;
         for (const r of records) if (/^\d{1,15}$/.test(r.id)) top = Math.max(top, Number(r.id));
         if (top < 0) return;
-        if (k.declaration.adoptsFrom !== void 0) {
-          this.db.prepare("INSERT INTO _record_sequences(kind_id, next) VALUES (?, ?) ON CONFLICT(kind_id) DO UPDATE SET next = MAX(next, excluded.next)").run(k.kindId, top + 1);
-          return;
-        }
-        this.db.prepare("UPDATE _record_sequences SET next = ? WHERE kind_id = ? AND next < ?").run(top + 1, k.kindId, top + 1);
+        this.db.prepare("INSERT INTO _record_sequences(kind_id, next) VALUES (?, ?) ON CONFLICT(kind_id) DO UPDATE SET next = MAX(next, excluded.next)").run(k.kindId, top + 1);
       }
       schemaReady;
       kindOf(owner, kind) {
@@ -166576,32 +166278,6 @@ CREATE TABLE IF NOT EXISTS _record_sequences (
       declarations() {
         return [...this.kinds.values()];
       }
-      async legacyRowCount(input) {
-        if (this.db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(input.table) === void 0) return null;
-        return this.db.prepare(`SELECT COUNT(*) AS n FROM "${input.table.replaceAll('"', '""')}"`).get()?.n ?? 0;
-      }
-      async adoptionState(input) {
-        return { adoptedAt: this.kindOf(input.owner, input.kind).adoptedAt };
-      }
-      async markAdopted(input) {
-        const k = this.kindOf(input.owner, input.kind);
-        if (k.adoptedAt !== null) return;
-        const at = this.now();
-        this.db.prepare("UPDATE _record_kinds SET adopted_at = ? WHERE kind_id = ?").run(at, k.kindId);
-        this.kinds.set(keyOf(k.owner, k.kind), {
-          ...k,
-          adoptedAt: at
-        });
-      }
-      async revokeAdopted(input) {
-        const k = this.kindOf(input.owner, input.kind);
-        if (k.adoptedAt === null) return;
-        this.db.prepare("UPDATE _record_kinds SET adopted_at = NULL WHERE kind_id = ?").run(k.kindId);
-        this.kinds.set(keyOf(k.owner, k.kind), {
-          ...k,
-          adoptedAt: null
-        });
-      }
     };
     var RECORDS_OPS = [
       "declareKinds",
@@ -166621,11 +166297,7 @@ CREATE TABLE IF NOT EXISTS _record_sequences (
       "deleteDevice",
       "allocateId",
       "listKinds",
-      "sweepExpired",
-      "legacyRowCount",
-      "adoptionState",
-      "markAdopted",
-      "revokeAdopted"
+      "sweepExpired"
     ];
     function isRecordsOp(op) {
       return RECORDS_OPS.some((known) => known === op);
@@ -166665,8 +166337,7 @@ CREATE TABLE IF NOT EXISTS _record_sequences (
       "hasTable",
       "dropRetiredTable",
       "threadId",
-      "listPhysicalTables",
-      "readLegacyCollection"
+      "listPhysicalTables"
     ];
     function isDataStoreOp(op) {
       return DATA_STORE_OPS.some((known) => known === op);
@@ -166720,7 +166391,7 @@ CREATE TABLE IF NOT EXISTS _record_sequences (
       livesIn;
       declaredFor;
       constructor(table, livesIn, declaredFor) {
-        super(`table "${table}" is in "${livesIn}", declared for "${declaredFor}"; this hub needs the offline database split \u2014 scripts/ops/split-databases, D853`);
+        super(`table "${table}" is in "${livesIn}", declared for "${declaredFor}"; the engine never moves data (D853) \u2014 the table must be moved offline, with the hub stopped`);
         this.table = table;
         this.livesIn = livesIn;
         this.declaredFor = declaredFor;
@@ -167877,46 +167548,6 @@ CREATE TABLE IF NOT EXISTS _record_sequences (
         }
         return out;
       }
-      /** Storage-admin only: adopted legacy may still be in `declaredThisBoot` from vestigial declares. */
-      forgetDeclaredThisBoot(name) {
-        this.declaredThisBoot.delete(name);
-      }
-      /**
-      * Paginated `(id, data)` read of a physical table. Does not consult
-      * `declareCollection` — for migration scripts only.
-      */
-      readLegacyCollection(input) {
-        const name = input.collection;
-        if (RECORDS_ENGINE_TABLES.includes(name)) throw new Error(`read refused: "${name}" is a table of the records engine`);
-        if (!this.hasTable(name)) return {
-          rows: [],
-          nextCursor: null
-        };
-        const limit = input.limit ?? 1e3;
-        const cursor = input.cursor ?? "";
-        const escaped = name.replaceAll('"', '""');
-        const raw = this.getDb().prepare(`SELECT id, data FROM "${escaped}" WHERE id > ? ORDER BY id ASC LIMIT ?`).all(cursor, limit);
-        const rows = [];
-        for (const row of raw) {
-          let data;
-          try {
-            const parsed = JSON.parse(row.data);
-            if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("not an object");
-            data = parsed;
-          } catch {
-            data = {};
-          }
-          rows.push({
-            id: row.id,
-            data
-          });
-        }
-        const last = rows[rows.length - 1];
-        return {
-          rows,
-          nextCursor: rows.length < limit || last === void 0 ? null : last.id
-        };
-      }
       /**
       * Drop one table nobody owns (D870 migration, one-shot). Refuses a canonical
       * or engine table, one a running addon declared since boot, a table that is
@@ -169459,9 +169090,9 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var require_retired_settings_keys = require_retired_settings_keys_D_VwZiDt();
-    var require_wal_maintenance = require_wal_maintenance_DfSIOj24();
+    var require_wal_maintenance = require_wal_maintenance_DUHEp_09();
     var require_sqlite_snapshot_protocol = require_sqlite_snapshot_protocol_B9OndqZv();
     var require_wal_checkpoint_policy = require_wal_checkpoint_policy_d2z2qPqx();
     var node_fs_promises = __require("fs/promises");
@@ -170347,9 +169978,6 @@ var require_sqlite_settings_addon = __commonJS({
       listPhysicalTables(ownerPrefix) {
         return Promise.resolve(require_wal_maintenance.callControl(require_wal_maintenance.controlTargetOf(this.backend, 0), "listPhysicalTables", { ownerPrefix }));
       }
-      readLegacyCollection(input) {
-        return Promise.resolve(require_wal_maintenance.callControl(require_wal_maintenance.controlTargetOf(this.backend, 0), "readLegacyCollection", input));
-      }
       async dropRetiredTable(name) {
         return require_wal_maintenance.callControl(require_wal_maintenance.controlTargetOf(this.backend, 0), "dropRetiredTable", { name });
       }
@@ -170406,9 +170034,6 @@ var require_sqlite_settings_addon = __commonJS({
       listPhysicalTables(ownerPrefix) {
         return this.client.control("listPhysicalTables", { ownerPrefix });
       }
-      readLegacyCollection(input) {
-        return this.client.control("readLegacyCollection", input);
-      }
       dropRetiredTable(name) {
         return this.client.control("dropRetiredTable", { name });
       }
@@ -170638,50 +170263,6 @@ var require_sqlite_settings_addon = __commonJS({
         return this.route(input.namespace, input.collection, "isEmpty", input);
       }
     };
-    function isRecord$1(value) {
-      return typeof value === "object" && value !== null && !Array.isArray(value);
-    }
-    function unwrapValue$1(raw) {
-      if (isRecord$1(raw) && "value" in raw) return raw["value"];
-      return raw;
-    }
-    function legacyRowId(item) {
-      const id = item["id"];
-      if (typeof id === "string" && id.length > 0) return id;
-      const username = item["username"];
-      if (typeof username === "string" && username.length > 0) return username;
-      return null;
-    }
-    async function countSettingsArrayLegacy(router, addonId, settingsKey) {
-      const list = unwrapValue$1(await router.get({
-        collection: "addon-settings",
-        key: `${addonId}.${settingsKey}`
-      }));
-      if (!Array.isArray(list)) return 0;
-      let n = 0;
-      for (const item of list) {
-        if (!isRecord$1(item)) continue;
-        if (legacyRowId(item) !== null) n += 1;
-      }
-      return n;
-    }
-    function isRecord(value) {
-      return typeof value === "object" && value !== null && !Array.isArray(value);
-    }
-    function unwrapValue(raw) {
-      if (isRecord(raw) && "value" in raw) return raw["value"];
-      return raw;
-    }
-    async function countSettingsBrokersLegacy(router, addonId) {
-      const list = unwrapValue(await router.get({
-        collection: "addon-settings",
-        key: `${addonId}.brokers`
-      }));
-      if (!Array.isArray(list)) return 0;
-      let n = 0;
-      for (const item of list) if (isRecord(item) && typeof item["id"] === "string") n += 1;
-      return n;
-    }
     function recordsCallerOf(input) {
       const raw = input !== null && typeof input === "object" ? Reflect.get(input, "callerAddonId") : void 0;
       if (typeof raw !== "string" || raw.length === 0) throw new require_dist10.NoCallerError("the call carries no caller identity; records are reached through ctx.records");
@@ -170690,6 +170271,12 @@ var require_sqlite_settings_addon = __commonJS({
     function keyOf(owner, kind) {
       return `${owner}\0${kind}`;
     }
+    function withoutRetiredKeys(declaration) {
+      return {
+        ...declaration,
+        adoptsFrom: void 0
+      };
+    }
     var RecordsProvider = class {
       router;
       logger;
@@ -170723,7 +170310,7 @@ var require_sqlite_settings_addon = __commonJS({
         const owner = recordsCallerOf(input);
         const byDatabase = /* @__PURE__ */ new Map();
         const parsed = /* @__PURE__ */ new Map();
-        for (const [kind, raw] of Object.entries(input.kinds)) parsed.set(kind, require_dist10.RecordKindDeclarationSchema.parse(raw));
+        for (const [kind, raw] of Object.entries(input.kinds)) parsed.set(kind, withoutRetiredKeys(require_dist10.RecordKindDeclarationSchema.parse(raw)));
         await this.assertFamiliesInOneFile(owner, parsed);
         for (const [kind, declaration] of parsed) {
           const known = this.placement.get(keyOf(owner, kind));
@@ -170745,22 +170332,7 @@ var require_sqlite_settings_addon = __commonJS({
             merged[kind] = result;
           }
         }
-        return { kinds: await this.withAdoption(owner, input.kinds, merged) };
-      }
-      /**
-      * Rows of a legacy table in EVERY open records-capable file. A legacy table lives
-      * in one file, but which one is the layout's business: the phase-3 NC ledgers moved
-      * to `events.db` with the P5 split, and a guard that asked `camstack.db` alone
-      * answered "no legacy rows" for 522 outbox rows (2026-10-20 audit).
-      */
-      async legacyRowsAnywhere(table) {
-        let total = 0;
-        for (const file of this.router.openFiles()) {
-          if (file.databaseId === "history") continue;
-          const rows = await file.records("legacyRowCount", { table });
-          if (rows !== null) total += rows;
-        }
-        return total;
+        return { kinds: merged };
       }
       /**
       * `transactFamily` (plan risk 8): kinds that must agree through one `transact` sit
@@ -170791,52 +170363,6 @@ var require_sqlite_settings_addon = __commonJS({
           throw new require_dist10.DeclarationRefusedError(`transactFamily "${family}" of "${owner}" is split across files (${[...members.entries()].map(([k, db]) => `${k}@${db}`).join(", ")}); a family lives in ONE file`);
         }
       }
-      /** The boot guard: empty kind + a legacy table that still has rows = adoption pending. */
-      async withAdoption(owner, declared, results) {
-        const out = { ...results };
-        for (const [kind, raw] of Object.entries(declared)) {
-          const legacy = raw.adoptsFrom;
-          const result = results[kind];
-          if (legacy === void 0 || result === void 0) continue;
-          if ((await (await this.fileOf(owner, kind)).records("adoptionState", {
-            owner,
-            kind
-          })).adoptedAt !== null) continue;
-          const settingsBrokersAddon = require_dist10.parseSettingsBrokersAdoptsFrom(legacy);
-          if (settingsBrokersAddon !== null) {
-            const legacyRows2 = await countSettingsBrokersLegacy(this.router, settingsBrokersAddon);
-            if (legacyRows2 > 0) out[kind] = {
-              ...result,
-              adoptionPending: {
-                legacyTable: legacy,
-                legacyRows: legacyRows2
-              }
-            };
-            continue;
-          }
-          const settingsArray = require_dist10.parseSettingsArrayAdoptsFrom(legacy);
-          if (settingsArray !== null) {
-            const legacyRows2 = await countSettingsArrayLegacy(this.router, settingsArray.addonId, settingsArray.settingsKey);
-            if (legacyRows2 > 0) out[kind] = {
-              ...result,
-              adoptionPending: {
-                legacyTable: legacy,
-                legacyRows: legacyRows2
-              }
-            };
-            continue;
-          }
-          const legacyRows = await this.legacyRowsAnywhere(legacy);
-          if (legacyRows > 0) out[kind] = {
-            ...result,
-            adoptionPending: {
-              legacyTable: legacy,
-              legacyRows
-            }
-          };
-        }
-        return out;
-      }
       async get(input) {
         const owner = recordsCallerOf(input);
         return (await this.fileOf(owner, input.kind)).records("get", {
@@ -170970,50 +170496,6 @@ var require_sqlite_settings_addon = __commonJS({
         } });
         return (await this.fileOf(input.owner, input.kind)).records("query", input);
       }
-      /** True when a declared kind lists `collection` as `adoptsFrom` and adoption finished. */
-      async isAdoptedLegacyTable(collection) {
-        const { kinds } = await this.listKinds({ counts: false });
-        for (const k of kinds) {
-          if (k.state === "dropped") continue;
-          if (k.declaration.adoptsFrom !== collection) continue;
-          const { adoptedAt } = await (await this.fileOf(k.owner, k.kind)).records("adoptionState", {
-            owner: k.owner,
-            kind: k.kind
-          });
-          if (adoptedAt !== null) return true;
-        }
-        return false;
-      }
-      async adoptRecords(input) {
-        const file = await this.fileOf(input.owner, input.kind);
-        if (input.records.length > 0) {
-          const { adoptedAt } = await file.records("adoptionState", {
-            owner: input.owner,
-            kind: input.kind
-          });
-          if (adoptedAt !== null) {
-            if ((await file.records("count", {
-              owner: input.owner,
-              kind: input.kind
-            })).count === 0) await file.records("revokeAdopted", {
-              owner: input.owner,
-              kind: input.kind
-            });
-          }
-        }
-        const result = await file.records("putMany", input);
-        if (input.complete === true) await file.records("markAdopted", {
-          owner: input.owner,
-          kind: input.kind
-        });
-        this.logger.warn("records: ADOPTED rows as their declared owner", { meta: {
-          owner: input.owner,
-          kind: input.kind,
-          count: result.count,
-          complete: input.complete === true
-        } });
-        return { adopted: result.count };
-      }
       /** Housekeeping: delete rows past `expires_at` in every file that hosts kinds. */
       async sweepExpired() {
         let deleted = 0;
@@ -171043,32 +170525,6 @@ var require_sqlite_settings_addon = __commonJS({
       readRecords(input) {
         return this.records.readRecords(input);
       }
-      adoptRecords(input) {
-        return this.records.adoptRecords(input);
-      }
-      isAdoptedLegacyTable(input) {
-        return this.records.isAdoptedLegacyTable(input.collection).then((adopted) => ({ adopted }));
-      }
-      async readLegacyCollection(input) {
-        if (this.backend.hasTable(input.collection)) {
-          const page = this.backend.readLegacyCollection(input);
-          return {
-            rows: [...page.rows],
-            nextCursor: page.nextCursor
-          };
-        }
-        for (const file of await this.peerFiles()) if (await file.hasTable(input.collection)) {
-          const page = await file.readLegacyCollection(input);
-          return {
-            rows: [...page.rows],
-            nextCursor: page.nextCursor
-          };
-        }
-        return {
-          rows: [],
-          nextCursor: null
-        };
-      }
       /** May this table be dropped AT ALL? Throws with the reason when not. */
       async assertDroppable(collection) {
         const colon = collection.indexOf(":");
@@ -171080,7 +170536,7 @@ var require_sqlite_settings_addon = __commonJS({
           throw new Error(`drop refused: the installed addons could not be read (${err instanceof Error ? err.message : String(err)})`);
         });
         const owner = collection.slice(0, colon);
-        if (installed.has(owner) && !await this.records.isAdoptedLegacyTable(collection)) throw new Error(`drop refused: "${collection}" belongs to the installed addon "${owner}"`);
+        if (installed.has(owner)) throw new Error(`drop refused: "${collection}" belongs to the installed addon "${owner}"`);
       }
       async listTables(input) {
         const tables = [...this.backend.listTables(input.ownerPrefix)];
@@ -171095,7 +170551,6 @@ var require_sqlite_settings_addon = __commonJS({
       async dropCollection(input) {
         try {
           await this.assertDroppable(input.collection);
-          if (await this.records.isAdoptedLegacyTable(input.collection)) this.backend.forgetDeclaredThisBoot(input.collection);
           const rows = this.backend.dropTable(input.collection, input.expectRows);
           this.logger.warn("storage-admin: DROPPED a table", { meta: {
             collection: input.collection,
@@ -171364,7 +170819,7 @@ var require_sqlite_storage = __commonJS({
     });
     require_chunk_Cek0wNdY();
     var require_builtins_sqlite_storage_filesystem_storage_addon = require_filesystem_storage_addon();
-    var require_wal_maintenance = require_wal_maintenance_DfSIOj24();
+    var require_wal_maintenance = require_wal_maintenance_DUHEp_09();
     var require_builtins_sqlite_storage_sqlite_settings_addon = require_sqlite_settings_addon();
     var ConfigStore = class {
       db;
@@ -171448,7 +170903,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var require_read_all_rows$1 = require_read_all_rows_CVoO1ONM();
     var zod = require_zod();
     var node_crypto = __require("crypto");
@@ -171494,8 +170949,7 @@ var require_storage_orchestrator_addon = __commonJS({
           name: "type",
           fields: ["type"]
         }],
-        retention: { none: "operator delete or declaration prune only" },
-        adoptsFrom: STORAGE_LOCATIONS
+        retention: { none: "operator delete or declaration prune only" }
       },
       "seed-markers": {
         schema: StorageSeedMarkerBodySchema,
@@ -171515,8 +170969,7 @@ var require_storage_orchestrator_addon = __commonJS({
           name: "location_id",
           fields: ["locationId"]
         }],
-        retention: { none: "row deleted when location leaves drain" },
-        adoptsFrom: STORAGE_DRAIN_STATE_LEGACY
+        retention: { none: "row deleted when location leaves drain" }
       }
     });
     var storageOrchestratorRecordKinds = _storageOrchestratorRecordKinds;
@@ -175389,8 +174842,8 @@ var require_storage_orchestrator_addon = __commonJS({
       * restart — the service never hydrates from / persists to SQLite.
       */
       storeWireInFlight = null;
-      /** True while the locations kind is empty and its legacy table still holds rows. */
-      async adoptionIsPending() {
+      /** True while the locations kind cannot be declared: its empty answer is not authoritative. */
+      async locationsKindNotReady() {
         const records = this.ctx.records;
         if (records === void 0 || this.locationsKind === null) return false;
         try {
@@ -175398,7 +174851,7 @@ var require_storage_orchestrator_addon = __commonJS({
           return false;
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
-          this.ctx.logger.warn("storage-orchestrator: persistence NOT wired \u2014 the storage-locations kind is not authoritative yet (adoption pending or the check failed); seeding is deferred", { meta: { error: message } });
+          this.ctx.logger.warn("storage-orchestrator: persistence NOT wired \u2014 the storage-locations kind is not authoritative yet (its declaration failed); seeding is deferred", { meta: { error: message } });
           return true;
         }
       }
@@ -175408,7 +174861,7 @@ var require_storage_orchestrator_addon = __commonJS({
         if (this.storeWireInFlight) return this.storeWireInFlight;
         const store = this.resolveLocationStore(true);
         if (!store) return;
-        if (await this.adoptionIsPending()) return;
+        if (await this.locationsKindNotReady()) return;
         this.ctx.logger.info("storage-orchestrator: data-store engine now available \u2014 wiring persistence");
         this.storeWireInFlight = service.attachStore(store).then(() => this.seedFromDeclarations()).catch((err) => {
           this.ctx.logger.error("storage-orchestrator: attachStore failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
@@ -176037,81 +175490,13 @@ var require_storage_orchestrator = __commonJS({
   }
 });
 
-// ../system/dist/constants-Njka8Cv6.js
-var require_constants_Njka8Cv6 = __commonJS({
-  "../system/dist/constants-Njka8Cv6.js"(exports) {
-    "use strict";
-    var MESH_CA_KEY_REF = require_dist_BZQjLPiz().buildSecretRef({
-      owner: "system",
-      scope: { kind: "global" },
-      fieldPath: "meshCaKey"
-    });
-    var MESH_CA_SETTINGS_KEY = "cluster.meshCa";
-    var MESH_CA_FIELD = "meshCa";
-    var MESH_CA_VALIDITY_DAYS = 3650;
-    var DEFAULT_HUB_TLS_TCP_PORT = 6443;
-    var MESH_CA_COMMON_NAME = "CamStack Mesh CA";
-    var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
-    var CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
-    Object.defineProperty(exports, "CLIENT_AUTH_OID", {
-      enumerable: true,
-      get: function() {
-        return CLIENT_AUTH_OID;
-      }
-    });
-    Object.defineProperty(exports, "DEFAULT_HUB_TLS_TCP_PORT", {
-      enumerable: true,
-      get: function() {
-        return DEFAULT_HUB_TLS_TCP_PORT;
-      }
-    });
-    Object.defineProperty(exports, "MESH_CA_COMMON_NAME", {
-      enumerable: true,
-      get: function() {
-        return MESH_CA_COMMON_NAME;
-      }
-    });
-    Object.defineProperty(exports, "MESH_CA_FIELD", {
-      enumerable: true,
-      get: function() {
-        return MESH_CA_FIELD;
-      }
-    });
-    Object.defineProperty(exports, "MESH_CA_KEY_REF", {
-      enumerable: true,
-      get: function() {
-        return MESH_CA_KEY_REF;
-      }
-    });
-    Object.defineProperty(exports, "MESH_CA_SETTINGS_KEY", {
-      enumerable: true,
-      get: function() {
-        return MESH_CA_SETTINGS_KEY;
-      }
-    });
-    Object.defineProperty(exports, "MESH_CA_VALIDITY_DAYS", {
-      enumerable: true,
-      get: function() {
-        return MESH_CA_VALIDITY_DAYS;
-      }
-    });
-    Object.defineProperty(exports, "SERVER_AUTH_OID", {
-      enumerable: true,
-      get: function() {
-        return SERVER_AUTH_OID;
-      }
-    });
-  }
-});
-
-// ../system/dist/agent-https-DOELEug8.js
-var require_agent_https_DOELEug8 = __commonJS({
-  "../system/dist/agent-https-DOELEug8.js"(exports) {
+// ../system/dist/agent-https-Dnr_nIVx.js
+var require_agent_https_Dnr_nIVx = __commonJS({
+  "../system/dist/agent-https-Dnr_nIVx.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var require_x509_es = require_x509_es_C4cOo48M();
-    var require_constants15 = require_constants_Njka8Cv6();
     var zod = require_zod();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
@@ -176120,566 +175505,6 @@ var require_agent_https_DOELEug8 = __commonJS({
     var node_os = __require("os");
     node_os = require_chunk.__toESM(node_os);
     var node_fs = __require("fs");
-    require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
-    var MS_PER_DAY$2 = 864e5;
-    var MESH_KEY_ALGORITHM = {
-      name: "ECDSA",
-      namedCurve: "P-256"
-    };
-    var MESH_SIGNING_ALGORITHM = {
-      name: "ECDSA",
-      hash: "SHA-256"
-    };
-    var NODE_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,62}$/i;
-    var RESERVED_NODE_IDS = /* @__PURE__ */ new Set(["hub"]);
-    function isValidAgentNodeId(nodeId) {
-      return NODE_ID_PATTERN.test(nodeId) && !RESERVED_NODE_IDS.has(nodeId.toLowerCase());
-    }
-    function freshSerial$1() {
-      return `00${(0, node_crypto.randomBytes)(16).toString("hex")}`;
-    }
-    function toPkcs8Pem$1(pkcs8) {
-      return `${require_x509_es.PemConverter.encode(pkcs8, "PRIVATE KEY")}
-`;
-    }
-    function toCertPem$1(cert) {
-      return `${cert.toString("pem")}
-`;
-    }
-    async function exportKeyPem$1(key) {
-      return toPkcs8Pem$1(await node_crypto.webcrypto.subtle.exportKey("pkcs8", key));
-    }
-    function caFingerprint(certPem) {
-      return new node_crypto.X509Certificate(certPem).fingerprint256;
-    }
-    function caFingerprintCompact(certPem) {
-      return (0, node_crypto.createHash)("sha256").update(new node_crypto.X509Certificate(certPem).raw).digest("hex");
-    }
-    async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
-      const keys = await node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
-      const extensions = [
-        new require_x509_es.BasicConstraintsExtension(true, 0, true),
-        new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.keyCertSign | require_x509_es.KeyUsageFlags.cRLSign, true),
-        await require_x509_es.SubjectKeyIdentifierExtension.create(keys.publicKey)
-      ];
-      const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
-        serialNumber: freshSerial$1(),
-        name: `CN=${require_constants15.MESH_CA_COMMON_NAME}`,
-        notBefore: require_x509_es.backdatedNotBefore(now),
-        notAfter: new Date(now.getTime() + require_constants15.MESH_CA_VALIDITY_DAYS * MS_PER_DAY$2),
-        keys,
-        signingAlgorithm: MESH_SIGNING_ALGORITHM,
-        extensions
-      });
-      return {
-        certPem: toCertPem$1(cert),
-        keyPem: await exportKeyPem$1(keys.privateKey),
-        cert,
-        privateKey: keys.privateKey,
-        publicKey: keys.publicKey
-      };
-    }
-    async function loadMeshCa(certPem, keyPem) {
-      const cert = new require_x509_es.X509Certificate(certPem);
-      return {
-        certPem,
-        keyPem,
-        cert,
-        privateKey: await node_crypto.webcrypto.subtle.importKey("pkcs8", require_x509_es.PemConverter.decodeFirst(keyPem), MESH_KEY_ALGORITHM, true, ["sign"]),
-        publicKey: await cert.publicKey.export(node_crypto.webcrypto)
-      };
-    }
-    async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
-      const csr = new require_x509_es.Pkcs10CertificateRequest(csrPem);
-      if (!await csr.verify(node_crypto.webcrypto)) throw new Error("CSR signature is invalid");
-      const cn = subjectCn(csr.subject);
-      if (cn === null || cn.length === 0) throw new Error("CSR subject has no CN");
-      if (opts.allowReserved !== true && !isValidAgentNodeId(cn)) throw new Error(`CSR CN '${cn}' is not an id an agent may carry`);
-      if (opts.expectedNodeId !== void 0 && opts.expectedNodeId !== cn) throw new Error(`CSR CN '${cn}' does not match the token nodeId '${opts.expectedNodeId}'`);
-      const now = opts.now ?? /* @__PURE__ */ new Date();
-      const validDays = opts.validDays ?? 30;
-      const serialNumber = freshSerial$1();
-      const notAfter = new Date(now.getTime() + validDays * MS_PER_DAY$2);
-      const extensions = [
-        new require_x509_es.BasicConstraintsExtension(false, void 0, true),
-        new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.digitalSignature, true),
-        new require_x509_es.ExtendedKeyUsageExtension([require_constants15.SERVER_AUTH_OID, require_constants15.CLIENT_AUTH_OID]),
-        await require_x509_es.SubjectKeyIdentifierExtension.create(csr.publicKey),
-        await require_x509_es.AuthorityKeyIdentifierExtension.create(ca.cert)
-      ];
-      return {
-        certPem: toCertPem$1(await require_x509_es.X509CertificateGenerator.create({
-          serialNumber,
-          subject: `CN=${cn}`,
-          issuer: ca.cert.subject,
-          notBefore: require_x509_es.backdatedNotBefore(now),
-          notAfter,
-          publicKey: csr.publicKey,
-          signingKey: ca.privateKey,
-          signingAlgorithm: MESH_SIGNING_ALGORITHM,
-          extensions
-        })),
-        serialNumber,
-        notAfter,
-        commonName: cn
-      };
-    }
-    async function issueMeshLeafForNode(ca, nodeId, opts = {}) {
-      const keys = await node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
-      return {
-        ...await issueMeshLeafFromCsr(ca, await createMeshCsrPem(keys, nodeId), {
-          expectedNodeId: nodeId,
-          now: opts.now,
-          validDays: opts.validDays,
-          allowReserved: true
-        }),
-        keyPem: await exportKeyPem$1(keys.privateKey)
-      };
-    }
-    function subjectCn(subject) {
-      return /(?:^|,)\s*CN\s*=\s*([^,]+)/i.exec(subject)?.[1]?.trim() ?? null;
-    }
-    async function createMeshCsrPem(keys, commonName) {
-      return `${(await require_x509_es.Pkcs10CertificateRequestGenerator.create({
-        name: `CN=${commonName}`,
-        keys,
-        signingAlgorithm: MESH_SIGNING_ALGORITHM
-      })).toString("pem")}
-`;
-    }
-    async function generateMeshKeyPair() {
-      return node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
-    }
-    async function exportMeshPrivateKeyPem(key) {
-      return exportKeyPem$1(key);
-    }
-    var MESH_NODE_CERTIFICATES_COLLECTION = "mesh_node_certificates";
-    var MESH_NODE_CERTIFICATES_COLUMNS = [
-      {
-        name: "id",
-        type: "TEXT",
-        primaryKey: true,
-        notNull: true
-      },
-      {
-        name: "nodeId",
-        type: "TEXT",
-        notNull: true
-      },
-      {
-        name: "serial",
-        type: "TEXT",
-        notNull: true
-      },
-      {
-        name: "fingerprint",
-        type: "TEXT",
-        notNull: true
-      },
-      {
-        name: "notBefore",
-        type: "INTEGER",
-        notNull: true
-      },
-      {
-        name: "notAfter",
-        type: "INTEGER",
-        notNull: true
-      },
-      {
-        name: "issuedAt",
-        type: "INTEGER",
-        notNull: true
-      },
-      {
-        name: "issuedVia",
-        type: "TEXT",
-        notNull: true
-      },
-      {
-        name: "revokedAt",
-        type: "INTEGER"
-      },
-      {
-        name: "revokedReason",
-        type: "TEXT"
-      }
-    ];
-    var RETENTION_MS = 90 * 864e5;
-    var RENEWAL_ABANDONED = "renewal-abandoned";
-    var VIAS = [
-      "enroll",
-      "pairing",
-      "renewal",
-      "boot",
-      "observed"
-    ];
-    function describeMeshLeaf(cert) {
-      const x509 = new node_crypto.X509Certificate(cert);
-      return {
-        cn: subjectCn(x509.subject) ?? "",
-        serial: x509.serialNumber,
-        fingerprint: x509.fingerprint256,
-        notBefore: Date.parse(x509.validFrom),
-        notAfter: Date.parse(x509.validTo)
-      };
-    }
-    function normalizeSerial(serial) {
-      return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
-    }
-    function parse$1(data) {
-      const str = (k) => {
-        const v = data[k];
-        return typeof v === "string" && v.length > 0 ? v : null;
-      };
-      const num = (k) => {
-        const v = data[k];
-        return typeof v === "number" && Number.isFinite(v) ? v : null;
-      };
-      const nodeId = str("nodeId");
-      const serial = str("serial");
-      const fingerprint = str("fingerprint");
-      const notBefore = num("notBefore");
-      const notAfter = num("notAfter");
-      const issuedAt = num("issuedAt");
-      if (nodeId === null || serial === null || fingerprint === null || notBefore === null || notAfter === null || issuedAt === null) return null;
-      return {
-        nodeId,
-        serial,
-        fingerprint,
-        notBefore,
-        notAfter,
-        issuedAt,
-        issuedVia: VIAS.find((v) => v === data["issuedVia"]) ?? "observed",
-        revokedAt: num("revokedAt"),
-        revokedReason: str("revokedReason")
-      };
-    }
-    var MeshCertificateRegistry = class {
-      store;
-      deps;
-      rows = /* @__PURE__ */ new Map();
-      constructor(store, deps = {}) {
-        this.store = store;
-        this.deps = deps;
-      }
-      recordToBody(record) {
-        return {
-          nodeId: record.nodeId,
-          serial: record.serial,
-          fingerprint: record.fingerprint,
-          notBefore: record.notBefore,
-          notAfter: record.notAfter,
-          issuedAt: record.issuedAt,
-          issuedVia: record.issuedVia,
-          revokedAt: record.revokedAt,
-          revokedReason: record.revokedReason
-        };
-      }
-      now() {
-        return (this.deps.now ?? Date.now)();
-      }
-      async load() {
-        const kind = this.deps.meshKind ?? null;
-        if (kind !== null) {
-          const page = await kind.query({ limit: 1e4 });
-          for (const row of page.records) {
-            const { fingerprint: _fp, ...body } = row.data;
-            const record = parse$1({
-              ...body,
-              fingerprint: row.id
-            });
-            if (record !== null) this.rows.set(record.fingerprint, record);
-          }
-          return;
-        }
-        const rows = await this.store.query.query({ collection: MESH_NODE_CERTIFICATES_COLLECTION });
-        for (const row of rows) {
-          const record = parse$1(row.data);
-          if (record !== null) this.rows.set(record.fingerprint, record);
-        }
-      }
-      /** Write down a leaf the hub just issued. Idempotent per fingerprint. */
-      async recordIssued(nodeId, certPem, via) {
-        const leaf = describeMeshLeaf(certPem);
-        const existing = this.rows.get(leaf.fingerprint);
-        if (existing !== void 0) return existing;
-        const record = {
-          nodeId,
-          serial: leaf.serial,
-          fingerprint: leaf.fingerprint,
-          notBefore: leaf.notBefore,
-          notAfter: leaf.notAfter,
-          issuedAt: this.now(),
-          issuedVia: via,
-          revokedAt: null,
-          revokedReason: null
-        };
-        await this.insert(record);
-        this.deps.logger?.info("Mesh certificate recorded", {
-          tags: { nodeId },
-          meta: {
-            via,
-            serial: leaf.serial,
-            notAfter: new Date(leaf.notAfter).toISOString()
-          }
-        });
-        return record;
-      }
-      /**
-      * A node was seen presenting `leaf` on its live connection. A leaf the hub already
-      * knows is left alone; an unknown one is recorded `observed` (a node enrolled
-      * before this record existed).
-      */
-      async recordObserved(nodeId, leaf) {
-        const known = this.rows.get(leaf.fingerprint);
-        if (known !== void 0) {
-          if (known.revokedReason !== "renewal-abandoned") return known.revokedAt === null ? this.abandonRenewalsNewerThan(known) : false;
-          const reinstated = {
-            ...known,
-            revokedAt: null,
-            revokedReason: null
-          };
-          this.rows.set(known.fingerprint, reinstated);
-          await this.persist(reinstated);
-          this.deps.logger?.warn("An abandoned renewal leaf is in use - reinstated", {
-            tags: { nodeId },
-            meta: { serial: known.serial }
-          });
-          return true;
-        }
-        const record = {
-          nodeId,
-          serial: leaf.serial,
-          fingerprint: leaf.fingerprint,
-          notBefore: leaf.notBefore,
-          notAfter: leaf.notAfter,
-          issuedAt: this.now(),
-          issuedVia: "observed",
-          revokedAt: null,
-          revokedReason: null
-        };
-        await this.insert(record);
-        this.deps.logger?.info("Mesh certificate observed on a live connection and recorded", {
-          tags: { nodeId },
-          meta: {
-            serial: leaf.serial,
-            fingerprint: leaf.fingerprint
-          }
-        });
-        return true;
-      }
-      list(nodeId) {
-        return [...this.rows.values()].filter((r) => nodeId === void 0 || r.nodeId === nodeId).toSorted((a, b) => b.issuedAt - a.issuedAt);
-      }
-      /** The newest non-revoked leaf of a node, or `undefined`. */
-      currentFor(nodeId) {
-        return this.list(nodeId).find((r) => r.revokedAt === null);
-      }
-      /** Every non-revoked leaf of a node (a renewal in flight has two). */
-      liveFor(nodeId) {
-        return this.list(nodeId).filter((r) => r.revokedAt === null);
-      }
-      /** Stamp a leaf revoked (and mirror it into `crl`). `false` when unknown or already revoked. */
-      async revoke(fingerprint, reason, crl) {
-        const record = this.rows.get(fingerprint);
-        if (record === void 0 || record.revokedAt !== null) return false;
-        const revoked = {
-          ...record,
-          revokedAt: this.now(),
-          revokedReason: reason
-        };
-        this.rows.set(fingerprint, revoked);
-        crl?.revoke(record.serial);
-        await this.persist(revoked);
-        this.deps.logger?.warn("Mesh certificate revoked", {
-          tags: { nodeId: record.nodeId },
-          meta: {
-            serial: record.serial,
-            reason
-          }
-        });
-        return true;
-      }
-      /**
-      * Operator revocation of a whole node: EVERY leaf of the node that is not already on the
-      * CRL goes on it - the current one, an observed one, a renewal one, and a leaf that was set
-      * aside (`renewal-abandoned`: a copy of it may sit on a stolen box, and it must not stay
-      * valid just because the hub once set it aside). Returns the serials put on the CRL.
-      * A leaf revoked this way is never reinstated by `recordObserved`.
-      */
-      async revokeAllForNode(nodeId, reason, crl, keepFingerprint) {
-        const serials = [];
-        for (const record of this.list(nodeId)) {
-          if (keepFingerprint !== void 0 && record.fingerprint === keepFingerprint) continue;
-          if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned") continue;
-          const revoked = {
-            ...record,
-            revokedAt: record.revokedAt ?? this.now(),
-            revokedReason: reason
-          };
-          this.rows.set(record.fingerprint, revoked);
-          crl.revoke(record.serial);
-          await this.persist(revoked);
-          serials.push(record.serial);
-        }
-        if (serials.length > 0) this.deps.logger?.warn("Every mesh certificate of the node revoked", {
-          tags: { nodeId },
-          meta: {
-            serials,
-            reason
-          }
-        });
-        return serials;
-      }
-      /**
-      * At boot: a node with TWO live leaves had a renewal in flight when the hub stopped. The
-      * newer (renewal) one is set aside - it is not the node's current leaf until the node is
-      * seen presenting it, which reinstates it. It is NOT put on the CRL.
-      */
-      async settleInterruptedRenewals() {
-        let settled = 0;
-        const byNode = /* @__PURE__ */ new Map();
-        for (const record of this.rows.values()) {
-          if (record.revokedAt !== null) continue;
-          byNode.set(record.nodeId, [...byNode.get(record.nodeId) ?? [], record]);
-        }
-        for (const records of byNode.values()) {
-          if (records.length < 2) continue;
-          for (const record of records) if (record.issuedVia === "renewal" && await this.abandon(record.fingerprint)) settled += 1;
-        }
-        return settled;
-      }
-      /** Set a never-completed renewal leaf aside (not current, NOT on the CRL). */
-      /** Fingerprints of renewal leaves whose handover is running right now (this process only). */
-      renewalsInFlight = /* @__PURE__ */ new Set();
-      /**
-      * A renewal's leaf is "in flight" from signing until the handover ends. While it is, a node seen
-      * presenting its OLD leaf is simply not swapped yet: the new leaf is not set aside (that would
-      * flap set-aside / reinstate on the node's first connection with it).
-      */
-      beginRenewal(fingerprint) {
-        this.renewalsInFlight.add(fingerprint);
-      }
-      endRenewal(fingerprint) {
-        this.renewalsInFlight.delete(fingerprint);
-      }
-      async abandonRenewalsNewerThan(presented) {
-        let changed = false;
-        for (const record of this.liveFor(presented.nodeId)) {
-          if (record.fingerprint === presented.fingerprint) continue;
-          if (record.issuedVia !== "renewal" || record.issuedAt <= presented.issuedAt) continue;
-          if (this.renewalsInFlight.has(record.fingerprint)) continue;
-          if (await this.abandon(record.fingerprint)) changed = true;
-        }
-        return changed;
-      }
-      async abandon(fingerprint) {
-        const record = this.rows.get(fingerprint);
-        if (record === void 0 || record.revokedAt !== null) return false;
-        const abandoned = {
-          ...record,
-          revokedAt: this.now(),
-          revokedReason: RENEWAL_ABANDONED
-        };
-        this.rows.set(fingerprint, abandoned);
-        await this.persist(abandoned);
-        this.deps.logger?.warn("Renewal leaf set aside (not current, not on the CRL)", {
-          tags: { nodeId: record.nodeId },
-          meta: { serial: record.serial }
-        });
-        return true;
-      }
-      /** Replay every persisted revocation into `crl` (hub boot). Set-aside leaves are not revocations. */
-      restoreCrl(crl) {
-        let restored = 0;
-        for (const record of this.rows.values()) {
-          if (record.revokedAt === null || record.revokedReason === "renewal-abandoned") continue;
-          crl.revoke(record.serial);
-          restored += 1;
-        }
-        return restored;
-      }
-      /** Is `serial` listed as revoked here? */
-      isRevoked(serial) {
-        const wanted = normalizeSerial(serial);
-        for (const record of this.rows.values()) if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned" && normalizeSerial(record.serial) === wanted) return true;
-        return false;
-      }
-      async reap() {
-        const cutoff = this.now() - RETENTION_MS;
-        const dead = [...this.rows.values()].filter((r) => (r.revokedAt ?? r.notAfter) < cutoff);
-        for (const r of dead) {
-          this.rows.delete(r.fingerprint);
-          await this.deleteRow(r.fingerprint);
-        }
-        return dead.length;
-      }
-      async insert(record) {
-        this.rows.set(record.fingerprint, record);
-        const kind = this.deps.meshKind ?? null;
-        if (kind !== null) {
-          const parsed = systemConfigRecordKinds["mesh-node-certificates"].schema.safeParse(this.recordToBody(record));
-          if (!parsed.success) throw new Error(parsed.error.message);
-          await kind.put({
-            id: record.fingerprint,
-            data: parsed.data
-          });
-          return;
-        }
-        await this.store.insert.mutate({
-          collection: MESH_NODE_CERTIFICATES_COLLECTION,
-          record: {
-            id: record.fingerprint,
-            data: { ...record }
-          }
-        });
-      }
-      async deleteRow(fingerprint) {
-        const kind = this.deps.meshKind ?? null;
-        if (kind !== null) {
-          await kind.delete(fingerprint);
-          return;
-        }
-        await this.store.delete.mutate({
-          collection: MESH_NODE_CERTIFICATES_COLLECTION,
-          key: fingerprint
-        });
-      }
-      async persist(record) {
-        try {
-          const kind = this.deps.meshKind ?? null;
-          if (kind !== null) {
-            const parsed = systemConfigRecordKinds["mesh-node-certificates"].schema.safeParse(this.recordToBody(record));
-            if (!parsed.success) throw new Error(parsed.error.message);
-            await kind.put({
-              id: record.fingerprint,
-              data: parsed.data
-            });
-            return;
-          }
-          await this.store.update.mutate({
-            collection: MESH_NODE_CERTIFICATES_COLLECTION,
-            id: record.fingerprint,
-            data: { ...record }
-          });
-        } catch (error) {
-          this.deps.logger?.error("Mesh certificate write failed - the change holds until restart", {
-            tags: { nodeId: record.nodeId },
-            meta: { error: error instanceof Error ? error.message : String(error) }
-          });
-        }
-      }
-    };
-    var SLOT$1 = /* @__PURE__ */ Symbol.for("camstack.mesh.certificate-registry");
-    function setProcessMeshCertificateRegistry(registry) {
-      if (registry === null) Reflect.deleteProperty(globalThis, SLOT$1);
-      else Reflect.set(globalThis, SLOT$1, registry);
-    }
-    function getProcessMeshCertificateRegistry() {
-      const value = Reflect.get(globalThis, SLOT$1);
-      return value !== null && typeof value === "object" && typeof Reflect.get(value, "recordIssued") === "function" ? value : null;
-    }
     var MeshNodeCertificateBodySchema = zod.z.object({
       nodeId: zod.z.string(),
       serial: zod.z.string(),
@@ -176712,8 +175537,7 @@ var require_agent_https_DOELEug8 = __commonJS({
         retention: {
           owner: "system-config",
           reason: "daily reap removes revoked/expired rows older than 90 days"
-        },
-        adoptsFrom: MESH_NODE_CERTIFICATES_COLLECTION
+        }
       },
       "agent-https-names": {
         schema: AgentHttpsNameBodySchema,
@@ -176721,8 +175545,7 @@ var require_agent_https_DOELEug8 = __commonJS({
         writeTrigger: "agent HTTPS certificate issuance records the CN/SAN set",
         device: "none",
         at: "none",
-        retention: { none: "one row per node id" },
-        adoptsFrom: AGENT_HTTPS_NAMES_COLLECTION
+        retention: { none: "one row per node id" }
       }
     });
     var systemConfigRecordKinds = _systemConfigRecordKinds;
@@ -177529,24 +176352,6 @@ var require_agent_https_DOELEug8 = __commonJS({
         return MAX_LEAF_VALIDITY_DAYS;
       }
     });
-    Object.defineProperty(exports, "MESH_NODE_CERTIFICATES_COLLECTION", {
-      enumerable: true,
-      get: function() {
-        return MESH_NODE_CERTIFICATES_COLLECTION;
-      }
-    });
-    Object.defineProperty(exports, "MESH_NODE_CERTIFICATES_COLUMNS", {
-      enumerable: true,
-      get: function() {
-        return MESH_NODE_CERTIFICATES_COLUMNS;
-      }
-    });
-    Object.defineProperty(exports, "MeshCertificateRegistry", {
-      enumerable: true,
-      get: function() {
-        return MeshCertificateRegistry;
-      }
-    });
     Object.defineProperty(exports, "PERMITTED_DNS_SUFFIXES", {
       enumerable: true,
       get: function() {
@@ -177559,12 +176364,6 @@ var require_agent_https_DOELEug8 = __commonJS({
         return PERMITTED_IP_RANGES;
       }
     });
-    Object.defineProperty(exports, "RENEWAL_ABANDONED", {
-      enumerable: true,
-      get: function() {
-        return RENEWAL_ABANDONED;
-      }
-    });
     Object.defineProperty(exports, "SERVER_AUTH_OID", {
       enumerable: true,
       get: function() {
@@ -177589,18 +176388,6 @@ var require_agent_https_DOELEug8 = __commonJS({
         return buildNameConstraintSet;
       }
     });
-    Object.defineProperty(exports, "caFingerprint", {
-      enumerable: true,
-      get: function() {
-        return caFingerprint;
-      }
-    });
-    Object.defineProperty(exports, "caFingerprintCompact", {
-      enumerable: true,
-      get: function() {
-        return caFingerprintCompact;
-      }
-    });
     Object.defineProperty(exports, "certificateNames", {
       enumerable: true,
       get: function() {
@@ -177625,66 +176412,30 @@ var require_agent_https_DOELEug8 = __commonJS({
         return createAgentHttpsRequest;
       }
     });
-    Object.defineProperty(exports, "createMeshCsrPem", {
-      enumerable: true,
-      get: function() {
-        return createMeshCsrPem;
-      }
-    });
     Object.defineProperty(exports, "describeHttpsLeaf", {
       enumerable: true,
       get: function() {
         return describeHttpsLeaf;
       }
     });
-    Object.defineProperty(exports, "describeMeshLeaf", {
-      enumerable: true,
-      get: function() {
-        return describeMeshLeaf;
-      }
-    });
     Object.defineProperty(exports, "evaluateExistingCert", {
       enumerable: true,
       get: function() {
         return evaluateExistingCert;
       }
     });
-    Object.defineProperty(exports, "exportMeshPrivateKeyPem", {
-      enumerable: true,
-      get: function() {
-        return exportMeshPrivateKeyPem;
-      }
-    });
     Object.defineProperty(exports, "generateCa", {
       enumerable: true,
       get: function() {
         return generateCa;
       }
     });
-    Object.defineProperty(exports, "generateMeshCa", {
-      enumerable: true,
-      get: function() {
-        return generateMeshCa;
-      }
-    });
-    Object.defineProperty(exports, "generateMeshKeyPair", {
-      enumerable: true,
-      get: function() {
-        return generateMeshKeyPair;
-      }
-    });
     Object.defineProperty(exports, "getProcessAgentHttpsNames", {
       enumerable: true,
       get: function() {
         return getProcessAgentHttpsNames;
       }
     });
-    Object.defineProperty(exports, "getProcessMeshCertificateRegistry", {
-      enumerable: true,
-      get: function() {
-        return getProcessMeshCertificateRegistry;
-      }
-    });
     Object.defineProperty(exports, "installAgentHttps", {
       enumerable: true,
       get: function() {
@@ -177715,12 +176466,6 @@ var require_agent_https_DOELEug8 = __commonJS({
         return isPrivateAddress;
       }
     });
-    Object.defineProperty(exports, "isValidAgentNodeId", {
-      enumerable: true,
-      get: function() {
-        return isValidAgentNodeId;
-      }
-    });
     Object.defineProperty(exports, "issueAgentHttpsLeaf", {
       enumerable: true,
       get: function() {
@@ -177733,18 +176478,6 @@ var require_agent_https_DOELEug8 = __commonJS({
         return issueLeaf;
       }
     });
-    Object.defineProperty(exports, "issueMeshLeafForNode", {
-      enumerable: true,
-      get: function() {
-        return issueMeshLeafForNode;
-      }
-    });
-    Object.defineProperty(exports, "issueMeshLeafFromCsr", {
-      enumerable: true,
-      get: function() {
-        return issueMeshLeafFromCsr;
-      }
-    });
     Object.defineProperty(exports, "loadAgentHttps", {
       enumerable: true,
       get: function() {
@@ -177757,12 +176490,6 @@ var require_agent_https_DOELEug8 = __commonJS({
         return loadCa;
       }
     });
-    Object.defineProperty(exports, "loadMeshCa", {
-      enumerable: true,
-      get: function() {
-        return loadMeshCa;
-      }
-    });
     Object.defineProperty(exports, "localCaCommonName", {
       enumerable: true,
       get: function() {
@@ -177811,28 +176538,83 @@ var require_agent_https_DOELEug8 = __commonJS({
         return setProcessAgentHttpsNames;
       }
     });
-    Object.defineProperty(exports, "setProcessMeshCertificateRegistry", {
+    Object.defineProperty(exports, "systemConfigRecordKinds", {
       enumerable: true,
       get: function() {
-        return setProcessMeshCertificateRegistry;
+        return systemConfigRecordKinds;
       }
     });
-    Object.defineProperty(exports, "subjectCn", {
+    Object.defineProperty(exports, "systemHostFacts", {
       enumerable: true,
       get: function() {
-        return subjectCn;
+        return systemHostFacts;
       }
     });
-    Object.defineProperty(exports, "systemConfigRecordKinds", {
+  }
+});
+
+// ../system/dist/constants-6OeJiZgi.js
+var require_constants_6OeJiZgi = __commonJS({
+  "../system/dist/constants-6OeJiZgi.js"(exports) {
+    "use strict";
+    var MESH_CA_KEY_REF = require_dist_Bn_RNanh().buildSecretRef({
+      owner: "system",
+      scope: { kind: "global" },
+      fieldPath: "meshCaKey"
+    });
+    var MESH_CA_SETTINGS_KEY = "cluster.meshCa";
+    var MESH_CA_FIELD = "meshCa";
+    var MESH_CA_VALIDITY_DAYS = 3650;
+    var DEFAULT_HUB_TLS_TCP_PORT = 6443;
+    var MESH_CA_COMMON_NAME = "CamStack Mesh CA";
+    var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
+    var CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
+    Object.defineProperty(exports, "CLIENT_AUTH_OID", {
       enumerable: true,
       get: function() {
-        return systemConfigRecordKinds;
+        return CLIENT_AUTH_OID;
       }
     });
-    Object.defineProperty(exports, "systemHostFacts", {
+    Object.defineProperty(exports, "DEFAULT_HUB_TLS_TCP_PORT", {
       enumerable: true,
       get: function() {
-        return systemHostFacts;
+        return DEFAULT_HUB_TLS_TCP_PORT;
+      }
+    });
+    Object.defineProperty(exports, "MESH_CA_COMMON_NAME", {
+      enumerable: true,
+      get: function() {
+        return MESH_CA_COMMON_NAME;
+      }
+    });
+    Object.defineProperty(exports, "MESH_CA_FIELD", {
+      enumerable: true,
+      get: function() {
+        return MESH_CA_FIELD;
+      }
+    });
+    Object.defineProperty(exports, "MESH_CA_KEY_REF", {
+      enumerable: true,
+      get: function() {
+        return MESH_CA_KEY_REF;
+      }
+    });
+    Object.defineProperty(exports, "MESH_CA_SETTINGS_KEY", {
+      enumerable: true,
+      get: function() {
+        return MESH_CA_SETTINGS_KEY;
+      }
+    });
+    Object.defineProperty(exports, "MESH_CA_VALIDITY_DAYS", {
+      enumerable: true,
+      get: function() {
+        return MESH_CA_VALIDITY_DAYS;
+      }
+    });
+    Object.defineProperty(exports, "SERVER_AUTH_OID", {
+      enumerable: true,
+      get: function() {
+        return SERVER_AUTH_OID;
       }
     });
   }
@@ -194872,11 +193654,11 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var require_safe_buffer$1 = require_safe_buffer_D3aoa_7X();
     var require_x509_es = require_x509_es_C4cOo48M();
-    var require_constants$8 = require_constants_Njka8Cv6();
-    var require_agent_https = require_agent_https_DOELEug8();
+    var require_agent_https = require_agent_https_Dnr_nIVx();
+    var require_constants$8 = require_constants_6OeJiZgi();
     var require_src$1 = require_src_CnAqG6EF();
     var zod = require_zod();
     var node_crypto = __require("crypto");
@@ -195109,7 +193891,140 @@ var require_system_config_addon = __commonJS({
         jti
       };
     }
-    var SLOT$2 = /* @__PURE__ */ Symbol.for("camstack.mesh.ca");
+    require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
+    var MS_PER_DAY = 864e5;
+    var MESH_KEY_ALGORITHM = {
+      name: "ECDSA",
+      namedCurve: "P-256"
+    };
+    var MESH_SIGNING_ALGORITHM = {
+      name: "ECDSA",
+      hash: "SHA-256"
+    };
+    var NODE_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,62}$/i;
+    var RESERVED_NODE_IDS = /* @__PURE__ */ new Set(["hub"]);
+    function isValidAgentNodeId(nodeId) {
+      return NODE_ID_PATTERN.test(nodeId) && !RESERVED_NODE_IDS.has(nodeId.toLowerCase());
+    }
+    function freshSerial() {
+      return `00${(0, node_crypto.randomBytes)(16).toString("hex")}`;
+    }
+    function toPkcs8Pem(pkcs8) {
+      return `${require_x509_es.PemConverter.encode(pkcs8, "PRIVATE KEY")}
+`;
+    }
+    function toCertPem(cert) {
+      return `${cert.toString("pem")}
+`;
+    }
+    async function exportKeyPem(key) {
+      return toPkcs8Pem(await node_crypto.webcrypto.subtle.exportKey("pkcs8", key));
+    }
+    function caFingerprint(certPem) {
+      return new node_crypto.X509Certificate(certPem).fingerprint256;
+    }
+    function caFingerprintCompact(certPem) {
+      return (0, node_crypto.createHash)("sha256").update(new node_crypto.X509Certificate(certPem).raw).digest("hex");
+    }
+    async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
+      const keys = await node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
+      const extensions = [
+        new require_x509_es.BasicConstraintsExtension(true, 0, true),
+        new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.keyCertSign | require_x509_es.KeyUsageFlags.cRLSign, true),
+        await require_x509_es.SubjectKeyIdentifierExtension.create(keys.publicKey)
+      ];
+      const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
+        serialNumber: freshSerial(),
+        name: `CN=${require_constants$8.MESH_CA_COMMON_NAME}`,
+        notBefore: require_x509_es.backdatedNotBefore(now),
+        notAfter: new Date(now.getTime() + require_constants$8.MESH_CA_VALIDITY_DAYS * MS_PER_DAY),
+        keys,
+        signingAlgorithm: MESH_SIGNING_ALGORITHM,
+        extensions
+      });
+      return {
+        certPem: toCertPem(cert),
+        keyPem: await exportKeyPem(keys.privateKey),
+        cert,
+        privateKey: keys.privateKey,
+        publicKey: keys.publicKey
+      };
+    }
+    async function loadMeshCa(certPem, keyPem) {
+      const cert = new require_x509_es.X509Certificate(certPem);
+      return {
+        certPem,
+        keyPem,
+        cert,
+        privateKey: await node_crypto.webcrypto.subtle.importKey("pkcs8", require_x509_es.PemConverter.decodeFirst(keyPem), MESH_KEY_ALGORITHM, true, ["sign"]),
+        publicKey: await cert.publicKey.export(node_crypto.webcrypto)
+      };
+    }
+    async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
+      const csr = new require_x509_es.Pkcs10CertificateRequest(csrPem);
+      if (!await csr.verify(node_crypto.webcrypto)) throw new Error("CSR signature is invalid");
+      const cn = subjectCn(csr.subject);
+      if (cn === null || cn.length === 0) throw new Error("CSR subject has no CN");
+      if (opts.allowReserved !== true && !isValidAgentNodeId(cn)) throw new Error(`CSR CN '${cn}' is not an id an agent may carry`);
+      if (opts.expectedNodeId !== void 0 && opts.expectedNodeId !== cn) throw new Error(`CSR CN '${cn}' does not match the token nodeId '${opts.expectedNodeId}'`);
+      const now = opts.now ?? /* @__PURE__ */ new Date();
+      const validDays = opts.validDays ?? 30;
+      const serialNumber = freshSerial();
+      const notAfter = new Date(now.getTime() + validDays * MS_PER_DAY);
+      const extensions = [
+        new require_x509_es.BasicConstraintsExtension(false, void 0, true),
+        new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.digitalSignature, true),
+        new require_x509_es.ExtendedKeyUsageExtension([require_constants$8.SERVER_AUTH_OID, require_constants$8.CLIENT_AUTH_OID]),
+        await require_x509_es.SubjectKeyIdentifierExtension.create(csr.publicKey),
+        await require_x509_es.AuthorityKeyIdentifierExtension.create(ca.cert)
+      ];
+      return {
+        certPem: toCertPem(await require_x509_es.X509CertificateGenerator.create({
+          serialNumber,
+          subject: `CN=${cn}`,
+          issuer: ca.cert.subject,
+          notBefore: require_x509_es.backdatedNotBefore(now),
+          notAfter,
+          publicKey: csr.publicKey,
+          signingKey: ca.privateKey,
+          signingAlgorithm: MESH_SIGNING_ALGORITHM,
+          extensions
+        })),
+        serialNumber,
+        notAfter,
+        commonName: cn
+      };
+    }
+    async function issueMeshLeafForNode(ca, nodeId, opts = {}) {
+      const keys = await node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
+      return {
+        ...await issueMeshLeafFromCsr(ca, await createMeshCsrPem(keys, nodeId), {
+          expectedNodeId: nodeId,
+          now: opts.now,
+          validDays: opts.validDays,
+          allowReserved: true
+        }),
+        keyPem: await exportKeyPem(keys.privateKey)
+      };
+    }
+    function subjectCn(subject) {
+      return /(?:^|,)\s*CN\s*=\s*([^,]+)/i.exec(subject)?.[1]?.trim() ?? null;
+    }
+    async function createMeshCsrPem(keys, commonName) {
+      return `${(await require_x509_es.Pkcs10CertificateRequestGenerator.create({
+        name: `CN=${commonName}`,
+        keys,
+        signingAlgorithm: MESH_SIGNING_ALGORITHM
+      })).toString("pem")}
+`;
+    }
+    async function generateMeshKeyPair() {
+      return node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
+    }
+    async function exportMeshPrivateKeyPem(key) {
+      return exportKeyPem(key);
+    }
+    var SLOT$3 = /* @__PURE__ */ Symbol.for("camstack.mesh.ca");
     var NOT_LOADED = {
       state: "unavailable",
       reason: "not-loaded"
@@ -195121,10 +194036,10 @@ var require_system_config_addon = __commonJS({
       return state === "unavailable" && typeof Reflect.get(value, "reason") === "string";
     }
     function setProcessMeshCa(state) {
-      Reflect.set(globalThis, SLOT$2, state);
+      Reflect.set(globalThis, SLOT$3, state);
     }
     function getProcessMeshCaState() {
-      const value = Reflect.get(globalThis, SLOT$2);
+      const value = Reflect.get(globalThis, SLOT$3);
       return isState(value) ? value : NOT_LOADED;
     }
     function requireProcessMeshCa() {
@@ -195232,7 +194147,7 @@ var require_system_config_addon = __commonJS({
           try {
             return {
               state: "ready",
-              ca: await require_agent_https.loadMeshCa(certPem, entry.value)
+              ca: await loadMeshCa(certPem, entry.value)
             };
           } catch (err) {
             return {
@@ -195243,12 +194158,12 @@ var require_system_config_addon = __commonJS({
         }
         case "missing":
           try {
-            const generated = await require_agent_https.generateMeshCa();
+            const generated = await generateMeshCa();
             await deps.secrets.put(require_constants$8.MESH_CA_KEY_REF, generated.keyPem);
             await deps.writeMeshCaCert(generated.certPem);
             return {
               state: "ready",
-              ca: await require_agent_https.loadMeshCa(generated.certPem, generated.keyPem)
+              ca: await loadMeshCa(generated.certPem, generated.keyPem)
             };
           } catch (err) {
             return {
@@ -195261,10 +194176,10 @@ var require_system_config_addon = __commonJS({
     var MeshCrl = class {
       serials = /* @__PURE__ */ new Set();
       revoke(serialNumber) {
-        this.serials.add(normalizeSerial(serialNumber));
+        this.serials.add(normalizeSerial$1(serialNumber));
       }
       isRevoked(serialNumber) {
-        return this.serials.has(normalizeSerial(serialNumber));
+        return this.serials.has(normalizeSerial$1(serialNumber));
       }
       list() {
         return [...this.serials];
@@ -195272,20 +194187,447 @@ var require_system_config_addon = __commonJS({
       /** Restore from persisted serials (system-settings). */
       replaceAll(serials) {
         this.serials.clear();
-        for (const s of serials) this.serials.add(normalizeSerial(s));
+        for (const s of serials) this.serials.add(normalizeSerial$1(s));
       }
     };
-    function normalizeSerial(serial) {
+    function normalizeSerial$1(serial) {
       return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
     }
-    var SLOT$1 = /* @__PURE__ */ Symbol.for("camstack.mesh.crl");
+    var SLOT$2 = /* @__PURE__ */ Symbol.for("camstack.mesh.crl");
     function processMeshCrl() {
-      const existing = Reflect.get(globalThis, SLOT$1);
+      const existing = Reflect.get(globalThis, SLOT$2);
       if (existing instanceof MeshCrl) return existing;
       const crl = new MeshCrl();
-      Reflect.set(globalThis, SLOT$1, crl);
+      Reflect.set(globalThis, SLOT$2, crl);
       return crl;
     }
+    var MESH_NODE_CERTIFICATES_COLLECTION = "mesh_node_certificates";
+    var MESH_NODE_CERTIFICATES_COLUMNS = [
+      {
+        name: "id",
+        type: "TEXT",
+        primaryKey: true,
+        notNull: true
+      },
+      {
+        name: "nodeId",
+        type: "TEXT",
+        notNull: true
+      },
+      {
+        name: "serial",
+        type: "TEXT",
+        notNull: true
+      },
+      {
+        name: "fingerprint",
+        type: "TEXT",
+        notNull: true
+      },
+      {
+        name: "notBefore",
+        type: "INTEGER",
+        notNull: true
+      },
+      {
+        name: "notAfter",
+        type: "INTEGER",
+        notNull: true
+      },
+      {
+        name: "issuedAt",
+        type: "INTEGER",
+        notNull: true
+      },
+      {
+        name: "issuedVia",
+        type: "TEXT",
+        notNull: true
+      },
+      {
+        name: "revokedAt",
+        type: "INTEGER"
+      },
+      {
+        name: "revokedReason",
+        type: "TEXT"
+      }
+    ];
+    var RETENTION_MS = 90 * 864e5;
+    var RENEWAL_ABANDONED = "renewal-abandoned";
+    var VIAS = [
+      "enroll",
+      "pairing",
+      "renewal",
+      "boot",
+      "observed"
+    ];
+    function describeMeshLeaf(cert) {
+      const x509 = new node_crypto.X509Certificate(cert);
+      return {
+        cn: subjectCn(x509.subject) ?? "",
+        serial: x509.serialNumber,
+        fingerprint: x509.fingerprint256,
+        notBefore: Date.parse(x509.validFrom),
+        notAfter: Date.parse(x509.validTo)
+      };
+    }
+    function normalizeSerial(serial) {
+      return serial.replace(/^0x/i, "").replace(/:/g, "").toLowerCase();
+    }
+    function parse$1(data) {
+      const str = (k2) => {
+        const v2 = data[k2];
+        return typeof v2 === "string" && v2.length > 0 ? v2 : null;
+      };
+      const num = (k2) => {
+        const v2 = data[k2];
+        return typeof v2 === "number" && Number.isFinite(v2) ? v2 : null;
+      };
+      const nodeId = str("nodeId");
+      const serial = str("serial");
+      const fingerprint = str("fingerprint");
+      const notBefore = num("notBefore");
+      const notAfter = num("notAfter");
+      const issuedAt = num("issuedAt");
+      if (nodeId === null || serial === null || fingerprint === null || notBefore === null || notAfter === null || issuedAt === null) return null;
+      return {
+        nodeId,
+        serial,
+        fingerprint,
+        notBefore,
+        notAfter,
+        issuedAt,
+        issuedVia: VIAS.find((v2) => v2 === data["issuedVia"]) ?? "observed",
+        revokedAt: num("revokedAt"),
+        revokedReason: str("revokedReason")
+      };
+    }
+    var MeshCertificateRegistry = class {
+      store;
+      deps;
+      rows = /* @__PURE__ */ new Map();
+      constructor(store, deps = {}) {
+        this.store = store;
+        this.deps = deps;
+      }
+      recordToBody(record) {
+        return {
+          nodeId: record.nodeId,
+          serial: record.serial,
+          fingerprint: record.fingerprint,
+          notBefore: record.notBefore,
+          notAfter: record.notAfter,
+          issuedAt: record.issuedAt,
+          issuedVia: record.issuedVia,
+          revokedAt: record.revokedAt,
+          revokedReason: record.revokedReason
+        };
+      }
+      now() {
+        return (this.deps.now ?? Date.now)();
+      }
+      async load() {
+        const kind = this.deps.meshKind ?? null;
+        if (kind !== null) {
+          const page = await kind.query({ limit: 1e4 });
+          for (const row of page.records) {
+            const { fingerprint: _fp, ...body } = row.data;
+            const record = parse$1({
+              ...body,
+              fingerprint: row.id
+            });
+            if (record !== null) this.rows.set(record.fingerprint, record);
+          }
+          return;
+        }
+        const rows = await this.store.query.query({ collection: MESH_NODE_CERTIFICATES_COLLECTION });
+        for (const row of rows) {
+          const record = parse$1(row.data);
+          if (record !== null) this.rows.set(record.fingerprint, record);
+        }
+      }
+      /** Write down a leaf the hub just issued. Idempotent per fingerprint. */
+      async recordIssued(nodeId, certPem, via) {
+        const leaf = describeMeshLeaf(certPem);
+        const existing = this.rows.get(leaf.fingerprint);
+        if (existing !== void 0) return existing;
+        const record = {
+          nodeId,
+          serial: leaf.serial,
+          fingerprint: leaf.fingerprint,
+          notBefore: leaf.notBefore,
+          notAfter: leaf.notAfter,
+          issuedAt: this.now(),
+          issuedVia: via,
+          revokedAt: null,
+          revokedReason: null
+        };
+        await this.insert(record);
+        this.deps.logger?.info("Mesh certificate recorded", {
+          tags: { nodeId },
+          meta: {
+            via,
+            serial: leaf.serial,
+            notAfter: new Date(leaf.notAfter).toISOString()
+          }
+        });
+        return record;
+      }
+      /**
+      * A node was seen presenting `leaf` on its live connection. A leaf the hub already
+      * knows is left alone; an unknown one is recorded `observed` (a node enrolled
+      * before this record existed).
+      */
+      async recordObserved(nodeId, leaf) {
+        const known = this.rows.get(leaf.fingerprint);
+        if (known !== void 0) {
+          if (known.revokedReason !== "renewal-abandoned") return known.revokedAt === null ? this.abandonRenewalsNewerThan(known) : false;
+          const reinstated = {
+            ...known,
+            revokedAt: null,
+            revokedReason: null
+          };
+          this.rows.set(known.fingerprint, reinstated);
+          await this.persist(reinstated);
+          this.deps.logger?.warn("An abandoned renewal leaf is in use - reinstated", {
+            tags: { nodeId },
+            meta: { serial: known.serial }
+          });
+          return true;
+        }
+        const record = {
+          nodeId,
+          serial: leaf.serial,
+          fingerprint: leaf.fingerprint,
+          notBefore: leaf.notBefore,
+          notAfter: leaf.notAfter,
+          issuedAt: this.now(),
+          issuedVia: "observed",
+          revokedAt: null,
+          revokedReason: null
+        };
+        await this.insert(record);
+        this.deps.logger?.info("Mesh certificate observed on a live connection and recorded", {
+          tags: { nodeId },
+          meta: {
+            serial: leaf.serial,
+            fingerprint: leaf.fingerprint
+          }
+        });
+        return true;
+      }
+      list(nodeId) {
+        return [...this.rows.values()].filter((r) => nodeId === void 0 || r.nodeId === nodeId).toSorted((a, b) => b.issuedAt - a.issuedAt);
+      }
+      /** The newest non-revoked leaf of a node, or `undefined`. */
+      currentFor(nodeId) {
+        return this.list(nodeId).find((r) => r.revokedAt === null);
+      }
+      /** Every non-revoked leaf of a node (a renewal in flight has two). */
+      liveFor(nodeId) {
+        return this.list(nodeId).filter((r) => r.revokedAt === null);
+      }
+      /** Stamp a leaf revoked (and mirror it into `crl`). `false` when unknown or already revoked. */
+      async revoke(fingerprint, reason, crl) {
+        const record = this.rows.get(fingerprint);
+        if (record === void 0 || record.revokedAt !== null) return false;
+        const revoked = {
+          ...record,
+          revokedAt: this.now(),
+          revokedReason: reason
+        };
+        this.rows.set(fingerprint, revoked);
+        crl?.revoke(record.serial);
+        await this.persist(revoked);
+        this.deps.logger?.warn("Mesh certificate revoked", {
+          tags: { nodeId: record.nodeId },
+          meta: {
+            serial: record.serial,
+            reason
+          }
+        });
+        return true;
+      }
+      /**
+      * Operator revocation of a whole node: EVERY leaf of the node that is not already on the
+      * CRL goes on it - the current one, an observed one, a renewal one, and a leaf that was set
+      * aside (`renewal-abandoned`: a copy of it may sit on a stolen box, and it must not stay
+      * valid just because the hub once set it aside). Returns the serials put on the CRL.
+      * A leaf revoked this way is never reinstated by `recordObserved`.
+      */
+      async revokeAllForNode(nodeId, reason, crl, keepFingerprint) {
+        const serials = [];
+        for (const record of this.list(nodeId)) {
+          if (keepFingerprint !== void 0 && record.fingerprint === keepFingerprint) continue;
+          if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned") continue;
+          const revoked = {
+            ...record,
+            revokedAt: record.revokedAt ?? this.now(),
+            revokedReason: reason
+          };
+          this.rows.set(record.fingerprint, revoked);
+          crl.revoke(record.serial);
+          await this.persist(revoked);
+          serials.push(record.serial);
+        }
+        if (serials.length > 0) this.deps.logger?.warn("Every mesh certificate of the node revoked", {
+          tags: { nodeId },
+          meta: {
+            serials,
+            reason
+          }
+        });
+        return serials;
+      }
+      /**
+      * At boot: a node with TWO live leaves had a renewal in flight when the hub stopped. The
+      * newer (renewal) one is set aside - it is not the node's current leaf until the node is
+      * seen presenting it, which reinstates it. It is NOT put on the CRL.
+      */
+      async settleInterruptedRenewals() {
+        let settled = 0;
+        const byNode = /* @__PURE__ */ new Map();
+        for (const record of this.rows.values()) {
+          if (record.revokedAt !== null) continue;
+          byNode.set(record.nodeId, [...byNode.get(record.nodeId) ?? [], record]);
+        }
+        for (const records of byNode.values()) {
+          if (records.length < 2) continue;
+          for (const record of records) if (record.issuedVia === "renewal" && await this.abandon(record.fingerprint)) settled += 1;
+        }
+        return settled;
+      }
+      /** Set a never-completed renewal leaf aside (not current, NOT on the CRL). */
+      /** Fingerprints of renewal leaves whose handover is running right now (this process only). */
+      renewalsInFlight = /* @__PURE__ */ new Set();
+      /**
+      * A renewal's leaf is "in flight" from signing until the handover ends. While it is, a node seen
+      * presenting its OLD leaf is simply not swapped yet: the new leaf is not set aside (that would
+      * flap set-aside / reinstate on the node's first connection with it).
+      */
+      beginRenewal(fingerprint) {
+        this.renewalsInFlight.add(fingerprint);
+      }
+      endRenewal(fingerprint) {
+        this.renewalsInFlight.delete(fingerprint);
+      }
+      async abandonRenewalsNewerThan(presented) {
+        let changed = false;
+        for (const record of this.liveFor(presented.nodeId)) {
+          if (record.fingerprint === presented.fingerprint) continue;
+          if (record.issuedVia !== "renewal" || record.issuedAt <= presented.issuedAt) continue;
+          if (this.renewalsInFlight.has(record.fingerprint)) continue;
+          if (await this.abandon(record.fingerprint)) changed = true;
+        }
+        return changed;
+      }
+      async abandon(fingerprint) {
+        const record = this.rows.get(fingerprint);
+        if (record === void 0 || record.revokedAt !== null) return false;
+        const abandoned = {
+          ...record,
+          revokedAt: this.now(),
+          revokedReason: RENEWAL_ABANDONED
+        };
+        this.rows.set(fingerprint, abandoned);
+        await this.persist(abandoned);
+        this.deps.logger?.warn("Renewal leaf set aside (not current, not on the CRL)", {
+          tags: { nodeId: record.nodeId },
+          meta: { serial: record.serial }
+        });
+        return true;
+      }
+      /** Replay every persisted revocation into `crl` (hub boot). Set-aside leaves are not revocations. */
+      restoreCrl(crl) {
+        let restored = 0;
+        for (const record of this.rows.values()) {
+          if (record.revokedAt === null || record.revokedReason === "renewal-abandoned") continue;
+          crl.revoke(record.serial);
+          restored += 1;
+        }
+        return restored;
+      }
+      /** Is `serial` listed as revoked here? */
+      isRevoked(serial) {
+        const wanted = normalizeSerial(serial);
+        for (const record of this.rows.values()) if (record.revokedAt !== null && record.revokedReason !== "renewal-abandoned" && normalizeSerial(record.serial) === wanted) return true;
+        return false;
+      }
+      async reap() {
+        const cutoff = this.now() - RETENTION_MS;
+        const dead = [...this.rows.values()].filter((r) => (r.revokedAt ?? r.notAfter) < cutoff);
+        for (const r of dead) {
+          this.rows.delete(r.fingerprint);
+          await this.deleteRow(r.fingerprint);
+        }
+        return dead.length;
+      }
+      async insert(record) {
+        this.rows.set(record.fingerprint, record);
+        const kind = this.deps.meshKind ?? null;
+        if (kind !== null) {
+          const parsed = require_agent_https.systemConfigRecordKinds["mesh-node-certificates"].schema.safeParse(this.recordToBody(record));
+          if (!parsed.success) throw new Error(parsed.error.message);
+          await kind.put({
+            id: record.fingerprint,
+            data: parsed.data
+          });
+          return;
+        }
+        await this.store.insert.mutate({
+          collection: MESH_NODE_CERTIFICATES_COLLECTION,
+          record: {
+            id: record.fingerprint,
+            data: { ...record }
+          }
+        });
+      }
+      async deleteRow(fingerprint) {
+        const kind = this.deps.meshKind ?? null;
+        if (kind !== null) {
+          await kind.delete(fingerprint);
+          return;
+        }
+        await this.store.delete.mutate({
+          collection: MESH_NODE_CERTIFICATES_COLLECTION,
+          key: fingerprint
+        });
+      }
+      async persist(record) {
+        try {
+          const kind = this.deps.meshKind ?? null;
+          if (kind !== null) {
+            const parsed = require_agent_https.systemConfigRecordKinds["mesh-node-certificates"].schema.safeParse(this.recordToBody(record));
+            if (!parsed.success) throw new Error(parsed.error.message);
+            await kind.put({
+              id: record.fingerprint,
+              data: parsed.data
+            });
+            return;
+          }
+          await this.store.update.mutate({
+            collection: MESH_NODE_CERTIFICATES_COLLECTION,
+            id: record.fingerprint,
+            data: { ...record }
+          });
+        } catch (error) {
+          this.deps.logger?.error("Mesh certificate write failed - the change holds until restart", {
+            tags: { nodeId: record.nodeId },
+            meta: { error: error instanceof Error ? error.message : String(error) }
+          });
+        }
+      }
+    };
+    var SLOT$1 = /* @__PURE__ */ Symbol.for("camstack.mesh.certificate-registry");
+    function setProcessMeshCertificateRegistry(registry) {
+      if (registry === null) Reflect.deleteProperty(globalThis, SLOT$1);
+      else Reflect.set(globalThis, SLOT$1, registry);
+    }
+    function getProcessMeshCertificateRegistry() {
+      const value = Reflect.get(globalThis, SLOT$1);
+      return value !== null && typeof value === "object" && typeof Reflect.get(value, "recordIssued") === "function" ? value : null;
+    }
     var STATE_SLOT = /* @__PURE__ */ Symbol.for("camstack.mesh.tls-listener-state");
     function setProcessMeshTlsListenerState(state) {
       if (state === null) Reflect.deleteProperty(globalThis, STATE_SLOT);
@@ -195420,7 +194762,7 @@ var require_system_config_addon = __commonJS({
       }
       let issued;
       try {
-        issued = await require_agent_https.issueMeshLeafFromCsr(deps.ca, csrPem, { expectedNodeId: nodeId });
+        issued = await issueMeshLeafFromCsr(deps.ca, csrPem, { expectedNodeId: nodeId });
         await deps.registry.recordIssued(nodeId, issued.certPem, "renewal");
         log.info("Mesh renewal: new leaf signed and recorded", {
           tags,
@@ -195432,7 +194774,7 @@ var require_system_config_addon = __commonJS({
       } catch (error) {
         return fail2("issue", message(error), true);
       }
-      const newLeaf = require_agent_https.describeMeshLeaf(issued.certPem);
+      const newLeaf = describeMeshLeaf(issued.certPem);
       deps.registry.beginRenewal(newLeaf.fingerprint);
       inFlight.fingerprint = newLeaf.fingerprint;
       let resolveRegistered = () => void 0;
@@ -267394,7 +266736,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       if (cert == null || typeof cert !== "object" || !("raw" in cert) || !cert.raw) return null;
       try {
         const x509 = new node_crypto.X509Certificate(cert.raw);
-        const cn = require_agent_https.subjectCn(x509.subject) ?? require_agent_https.subjectCn(`CN=${cert.subject?.CN ?? ""}`);
+        const cn = subjectCn(x509.subject) ?? subjectCn(`CN=${cert.subject?.CN ?? ""}`);
         if (cn === null || cn.length === 0) return null;
         return {
           cn,
@@ -267885,7 +267227,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       return (0, node_crypto.randomBytes)(16).toString("base64url");
     }
     function computePairingCommitment(caCertPem, hubNonce) {
-      return (0, node_crypto.createHash)("sha256").update(`${PAIRING_DOMAIN}|commit|${require_agent_https.caFingerprintCompact(caCertPem)}|${hubNonce}`, "utf8").digest("hex");
+      return (0, node_crypto.createHash)("sha256").update(`${PAIRING_DOMAIN}|commit|${caFingerprintCompact(caCertPem)}|${hubNonce}`, "utf8").digest("hex");
     }
     function commitmentsEqual(expected, presented) {
       return constantTimeEqual(expected, presented);
@@ -267894,7 +267236,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       const value = (0, node_crypto.createHash)("sha256").update([
         PAIRING_DOMAIN,
         "sas",
-        require_agent_https.caFingerprintCompact(input.caCertPem),
+        caFingerprintCompact(input.caCertPem),
         input.agentPublicKeySpki,
         input.hubNonce,
         input.agentNonce
@@ -267910,7 +267252,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     async function describeCsr(csrPem) {
       const csr = new require_x509_es.Pkcs10CertificateRequest(csrPem);
       if (!await csr.verify(node_crypto.webcrypto)) throw new Error("the agent CSR signature is invalid");
-      const cn = require_agent_https.subjectCn(csr.subject);
+      const cn = subjectCn(csr.subject);
       if (cn === null || cn.length === 0) throw new Error("the agent CSR has no CN");
       return {
         commonName: cn,
@@ -267970,14 +267312,14 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       const hubNonce = str("hubNonce");
       const agentNonce = str("agentNonce");
       const leafFingerprint = str("leafFingerprint");
-      const caFingerprint = str("caFingerprint");
+      const caFingerprint2 = str("caFingerprint");
       const hubMeshAddress = str("hubMeshAddress");
       const hubUrl = str("hubUrl");
       const exp = Reflect.get(value, "exp");
       const iat = Reflect.get(value, "iat");
       if (Reflect.get(value, "v") !== 1) return null;
       if (Reflect.get(value, "use") !== "pairing-complete") return null;
-      if (pairingId === null || nodeId === null || hubNonce === null || agentNonce === null || leafFingerprint === null || caFingerprint === null || hubMeshAddress === null || hubUrl === null || typeof exp !== "number" || !Number.isFinite(exp) || typeof iat !== "number" || !Number.isFinite(iat)) return null;
+      if (pairingId === null || nodeId === null || hubNonce === null || agentNonce === null || leafFingerprint === null || caFingerprint2 === null || hubMeshAddress === null || hubUrl === null || typeof exp !== "number" || !Number.isFinite(exp) || typeof iat !== "number" || !Number.isFinite(iat)) return null;
       return {
         v: 1,
         use: PAIRING_PROOF_USE,
@@ -267986,7 +267328,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         hubNonce,
         agentNonce,
         leafFingerprint,
-        caFingerprint,
+        caFingerprint: caFingerprint2,
         hubMeshAddress,
         hubUrl,
         iat,
@@ -268038,18 +267380,18 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       const iat = Reflect.get(payload, "iat");
       const agentNodeId = str("agentNodeId");
       const hubNodeId = str("hubNodeId");
-      const caFingerprint = str("caFingerprint");
+      const caFingerprint2 = str("caFingerprint");
       const commitment = str("commitment");
       const hubUrl = str("hubUrl");
       const hubMeshAddress = str("hubMeshAddress");
       if (Reflect.get(payload, "use") !== "pairing-offer") return null;
       if (typeof iat !== "number" || !Number.isFinite(iat)) return null;
-      if (agentNodeId === null || hubNodeId === null || caFingerprint === null || commitment === null || hubUrl === null || hubMeshAddress === null) return null;
+      if (agentNodeId === null || hubNodeId === null || caFingerprint2 === null || commitment === null || hubUrl === null || hubMeshAddress === null) return null;
       return {
         use: PAIRING_OFFER_USE,
         agentNodeId,
         hubNodeId,
-        caFingerprint,
+        caFingerprint: caFingerprint2,
         commitment,
         hubUrl,
         hubMeshAddress,
@@ -268181,23 +267523,23 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       async offer(body) {
         this.expireIfDue();
         if (this.deps.isPaired()) return fail(409, "already-paired", "this agent is paired \u2014 unpair it first (from the hub or here)");
-        if (!require_agent_https.isValidAgentNodeId(this.deps.nodeId)) return fail(409, "invalid-node-id", `this agent's node id "${this.deps.nodeId}" cannot be paired - rename the agent`);
+        if (!isValidAgentNodeId(this.deps.nodeId)) return fail(409, "invalid-node-id", `this agent's node id "${this.deps.nodeId}" cannot be paired - rename the agent`);
         const request = parseOffer(body);
         if (request === null) return fail(400, "bad-offer", "the offer is malformed");
         if (request.protocol !== 1) return fail(400, "unsupported-protocol", `pairing protocol ${String(request.protocol)} is not supported`);
         if (readCaCertificate(request.hubCaCertPem, this.now()) === null) return fail(400, "bad-ca", "the offered CA is not a valid self-signed CA certificate");
         if (!/^[0-9a-f]{64}$/.test(request.commitment)) return fail(400, "bad-offer", "the commitment is malformed");
         if (!isHttpUrl(request.hubUrl)) return fail(400, "bad-offer", "hubUrl is not an http(s) URL");
-        const caFingerprint = require_agent_https.caFingerprintCompact(request.hubCaCertPem);
-        const refused = this.checkOfferSignature(request, caFingerprint);
+        const caFingerprint2 = caFingerprintCompact(request.hubCaCertPem);
+        const refused = this.checkOfferSignature(request, caFingerprint2);
         if (refused !== null) return refused;
-        const rationed = this.rationOffer(caFingerprint);
+        const rationed = this.rationOffer(caFingerprint2);
         if (rationed !== null) return rationed;
-        for (const existing of [...this.sessions.values()]) if (existing.hub.caFingerprint === caFingerprint) this.end(existing, "failed");
+        for (const existing of [...this.sessions.values()]) if (existing.hub.caFingerprint === caFingerprint2) this.end(existing, "failed");
         if (this.sessions.size >= 4 && !this.makeRoom()) return fail(409, "too-many-pending", "too many pairings are pending on this agent");
-        const keys = await require_agent_https.generateMeshKeyPair();
-        const csrPem = await require_agent_https.createMeshCsrPem(keys, this.deps.nodeId);
-        const keyPem = await require_agent_https.exportMeshPrivateKeyPem(keys.privateKey);
+        const keys = await generateMeshKeyPair();
+        const csrPem = await createMeshCsrPem(keys, this.deps.nodeId);
+        const keyPem = await exportMeshPrivateKeyPem(keys.privateKey);
         const publicKeySpki = Buffer.from(await node_crypto.webcrypto.subtle.exportKey("spki", keys.publicKey)).toString("base64");
         if (this.sessions.size >= 4 && !this.makeRoom()) return fail(409, "too-many-pending", "too many pairings are pending on this agent");
         const session = {
@@ -268205,7 +267547,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
           hub: {
             nodeId: request.hubNodeId,
             caCertPem: request.hubCaCertPem,
-            caFingerprint,
+            caFingerprint: caFingerprint2,
             commitment: request.commitment,
             url: request.hubUrl,
             meshAddress: request.hubMeshAddress
@@ -268427,10 +267769,10 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         return { ok: true };
       }
       /** Verify the CA-key signature of an offer and spend its commitment. */
-      checkOfferSignature(request, caFingerprint) {
+      checkOfferSignature(request, caFingerprint2) {
         const claims = verifyPairingOffer(request.hubCaCertPem, request.signature);
         const at2 = this.now();
-        if (claims === null || claims.use !== "pairing-offer" || claims.agentNodeId !== this.deps.nodeId || claims.hubNodeId !== request.hubNodeId || claims.caFingerprint !== caFingerprint || claims.commitment !== request.commitment || claims.hubUrl !== request.hubUrl || claims.hubMeshAddress !== request.hubMeshAddress || claims.iat > at2 + 6e4 || at2 - claims.iat > 12e4) {
+        if (claims === null || claims.use !== "pairing-offer" || claims.agentNodeId !== this.deps.nodeId || claims.hubNodeId !== request.hubNodeId || claims.caFingerprint !== caFingerprint2 || claims.commitment !== request.commitment || claims.hubUrl !== request.hubUrl || claims.hubMeshAddress !== request.hubMeshAddress || claims.iat > at2 + 6e4 || at2 - claims.iat > 12e4) {
           this.deps.log?.("an offer without a valid CA signature was refused", {});
           return fail(403, "bad-offer-signature", "the offer is not signed by the CA it presents");
         }
@@ -268451,16 +267793,16 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         return true;
       }
       /** Offers that never reached local confirmation are rationed - globally and per hub CA. */
-      rationOffer(caFingerprint) {
+      rationOffer(caFingerprint2) {
         const at2 = this.now();
         if (at2 < this.lockedUntil) {
           this.deps.log?.("offer refused: the budget of abandoned pairings is spent", { retryAfterMs: this.lockedUntil - at2 });
           return fail(429, "offer-budget", "too many pairings were abandoned recently - try again later", this.lockedUntil - at2);
         }
-        const ca = this.perCa.get(caFingerprint);
+        const ca = this.perCa.get(caFingerprint2);
         if (ca !== void 0 && at2 < ca.until) {
           this.deps.log?.("offer refused: this hub abandoned a pairing a moment ago", {
-            caFingerprint,
+            caFingerprint: caFingerprint2,
             retryAfterMs: ca.until - at2
           });
           return fail(429, "offer-backoff", "this hub abandoned a pairing a moment ago - wait before offering again", ca.until - at2);
@@ -268537,7 +267879,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
           const leaf = new node_crypto.X509Certificate(leafPem);
           const ca = new node_crypto.X509Certificate(session.hub.caCertPem);
           if (!leaf.verify(ca.publicKey)) return fail(400, "bad-leaf", "the certificate is not signed by the offered CA");
-          if (require_agent_https.subjectCn(leaf.subject.replaceAll("\n", ",")) !== this.deps.nodeId) return fail(400, "bad-leaf", `the certificate is not issued for "${this.deps.nodeId}"`);
+          if (subjectCn(leaf.subject.replaceAll("\n", ",")) !== this.deps.nodeId) return fail(400, "bad-leaf", `the certificate is not issued for "${this.deps.nodeId}"`);
           if (!leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(session.keyPem))) return fail(400, "bad-leaf", "the certificate does not match this agent's private key");
           if (Date.parse(leaf.validTo) <= this.now()) return fail(400, "bad-leaf", "the certificate is already expired");
         } catch {
@@ -268595,7 +267937,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     }
     function caFingerprintOf(pem) {
       try {
-        return require_agent_https.caFingerprintCompact(pem);
+        return caFingerprintCompact(pem);
       } catch {
         return null;
       }
@@ -268672,7 +268014,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
             use: PAIRING_OFFER_USE,
             agentNodeId: hello.nodeId,
             hubNodeId: this.deps.hubNodeId,
-            caFingerprint: require_agent_https.caFingerprintCompact(ca.certPem),
+            caFingerprint: caFingerprintCompact(ca.certPem),
             commitment,
             hubUrl,
             hubMeshAddress,
@@ -268789,14 +268131,14 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       }
       async complete(session) {
         const ca = this.deps.ca();
-        if (ca === null || require_agent_https.caFingerprintCompact(ca.certPem) !== require_agent_https.caFingerprintCompact(session.caCertPem)) {
+        if (ca === null || caFingerprintCompact(ca.certPem) !== caFingerprintCompact(session.caCertPem)) {
           await this.cancel(session, "failed", "the mesh CA changed during the pairing");
           return;
         }
         session.state = "completing";
         let issuedPem = null;
         try {
-          const leaf = await require_agent_https.issueMeshLeafFromCsr(ca, session.csrPem, { expectedNodeId: session.nodeId });
+          const leaf = await issueMeshLeafFromCsr(ca, session.csrPem, { expectedNodeId: session.nodeId });
           issuedPem = leaf.certPem;
           await this.deps.recordIssued(session.nodeId, leaf.certPem);
           session.issued = true;
@@ -268808,7 +268150,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
             hubNonce: session.hubNonce,
             agentNonce: session.agentNonce,
             leafFingerprint: leafFingerprintCompact(leaf.certPem),
-            caFingerprint: require_agent_https.caFingerprintCompact(ca.certPem),
+            caFingerprint: caFingerprintCompact(ca.certPem),
             hubMeshAddress: session.hubMeshAddress,
             hubUrl: session.hubUrl,
             iat: this.now(),
@@ -268862,7 +268204,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         }
       }
       assertNodeIdUsable(nodeId) {
-        if (!require_agent_https.isValidAgentNodeId(nodeId)) throw new Error(`"${nodeId}" cannot be an agent node id (letters, digits, . _ - ; not "hub"; at most 63 characters)`);
+        if (!isValidAgentNodeId(nodeId)) throw new Error(`"${nodeId}" cannot be an agent node id (letters, digits, . _ - ; not "hub"; at most 63 characters)`);
         if (this.deps.isNodeConnected(nodeId)) throw new Error(`a node called "${nodeId}" is already connected to this hub \u2014 unpair it first`);
         const lower = nodeId.toLowerCase();
         const clash = (this.deps.knownNodeIds?.() ?? []).find((known) => known !== nodeId && known.toLowerCase() === lower);
@@ -268983,7 +268325,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         };
       }
       async onShutdown() {
-        require_agent_https.setProcessMeshCertificateRegistry(null);
+        setProcessMeshCertificateRegistry(null);
         setProcessMeshTlsListenerState(null);
         require_agent_https.setProcessAgentHttpsNames(null);
         this.stoppedMesh = true;
@@ -269014,14 +268356,14 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         this.loadAgentHttpsNames(store, records);
         try {
           if (records === void 0) await store.declareCollection.mutate({
-            collection: require_agent_https.MESH_NODE_CERTIFICATES_COLLECTION,
-            columns: require_agent_https.MESH_NODE_CERTIFICATES_COLUMNS,
+            collection: MESH_NODE_CERTIFICATES_COLLECTION,
+            columns: MESH_NODE_CERTIFICATES_COLUMNS,
             indexes: [{
               name: "idx_mesh_node_certificates_node",
               columns: ["nodeId"]
             }]
           });
-          const registry = new require_agent_https.MeshCertificateRegistry(store, {
+          const registry = new MeshCertificateRegistry(store, {
             logger: this.ctx.logger,
             meshKind
           });
@@ -269029,7 +268371,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
           const restored = registry.restoreCrl(processMeshCrl());
           const settled = await registry.settleInterruptedRenewals();
           if (settled > 0) this.ctx.logger.warn("A mesh renewal was interrupted by a hub restart - its new leaf was set aside", { meta: { settled } });
-          require_agent_https.setProcessMeshCertificateRegistry(registry);
+          setProcessMeshCertificateRegistry(registry);
           if (restored > 0) this.ctx.logger.info("Mesh revocations restored into the CRL", { meta: { restored } });
           return registry;
         } catch (err) {
@@ -269063,7 +268405,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         await openMeshTlsWhenRevocationsLoaded({
           loadRegistry: () => this.initMeshCertificateRegistry(),
           open: async (registry) => {
-            const hubLeaf = await require_agent_https.issueMeshLeafForNode(ca, "hub");
+            const hubLeaf = await issueMeshLeafForNode(ca, "hub");
             await registry.recordIssued("hub", hubLeaf.certPem, "boot").catch((err) => {
               this.ctx.logger.warn("Hub mesh leaf could not be recorded", { meta: { error: err instanceof Error ? err.message : String(err) } });
             });
@@ -269368,8 +268710,11 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.AgentPairing = AgentPairing;
     exports.Errors = Errors;
     exports.HubPairing = HubPairing;
+    exports.MESH_NODE_CERTIFICATES_COLLECTION = MESH_NODE_CERTIFICATES_COLLECTION;
+    exports.MESH_NODE_CERTIFICATES_COLUMNS = MESH_NODE_CERTIFICATES_COLUMNS;
     exports.MESH_TLS_PORT_HELLO_FIELD = MESH_TLS_PORT_HELLO_FIELD;
     exports.MeshCaKeeper = MeshCaKeeper;
+    exports.MeshCertificateRegistry = MeshCertificateRegistry;
     exports.MeshCrl = MeshCrl;
     exports.PAIRING_CODE_DIGITS = PAIRING_CODE_DIGITS;
     exports.PAIRING_MAX_CODE_ATTEMPTS = PAIRING_MAX_CODE_ATTEMPTS;
@@ -269379,26 +268724,39 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.PAIRING_PROTOCOL = PAIRING_PROTOCOL;
     exports.PAIRING_TTL_MS = PAIRING_TTL_MS;
     exports.PairingHttpError = PairingHttpError;
+    exports.RENEWAL_ABANDONED = RENEWAL_ABANDONED;
     exports.SYSTEM_CONFIG_CLUSTER_SECTION_ID = SYSTEM_CONFIG_CLUSTER_SECTION_ID;
     exports.ServiceBroker = ServiceBroker;
     exports.SystemConfigAddon = SystemConfigAddon;
     exports.default = SystemConfigAddon;
     exports.TlsTcpTransporter = TlsTcpTransporter;
     exports.UnlockTicketJtiStore = UnlockTicketJtiStore;
+    exports.caFingerprint = caFingerprint;
+    exports.caFingerprintCompact = caFingerprintCompact;
     exports.computePairingCommitment = computePairingCommitment;
     exports.computePairingSas = computePairingSas;
     exports.createCidrMatcher = createCidrMatcher;
+    exports.createMeshCsrPem = createMeshCsrPem;
     exports.describeCsr = describeCsr;
+    exports.describeMeshLeaf = describeMeshLeaf;
     exports.dropProcessPeer = dropProcessPeer;
     exports.emitProcessNodeRegistered = emitProcessNodeRegistered;
+    exports.exportMeshPrivateKeyPem = exportMeshPrivateKeyPem;
+    exports.generateMeshCa = generateMeshCa;
+    exports.generateMeshKeyPair = generateMeshKeyPair;
     exports.getProcessMeshCaState = getProcessMeshCaState;
+    exports.getProcessMeshCertificateRegistry = getProcessMeshCertificateRegistry;
     exports.getProcessMeshTlsListenerState = getProcessMeshTlsListenerState;
     exports.getProcessNodeMeshTransport = getProcessNodeMeshTransport;
     exports.getProcessPeerLeaf = getProcessPeerLeaf;
     exports.hubHostFromMeshAddress = hubHostFromMeshAddress;
     exports.isAllowedAgentDashboardReturnTo = isAllowedAgentDashboardReturnTo;
     exports.isProcessVerifiedMeshPeer = isProcessVerifiedMeshPeer;
+    exports.isValidAgentNodeId = isValidAgentNodeId;
+    exports.issueMeshLeafForNode = issueMeshLeafForNode;
+    exports.issueMeshLeafFromCsr = issueMeshLeafFromCsr;
     exports.keyFingerprintShort = keyFingerprintShort;
+    exports.loadMeshCa = loadMeshCa;
     exports.mintAgentUiUnlockTicket = mintAgentUiUnlockTicket;
     exports.normalizeIp = normalizeIp;
     exports.onProcessNodeRegistered = onProcessNodeRegistered;
@@ -269410,6 +268768,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.renewMeshCertificate = renewMeshCertificate;
     exports.requireProcessMeshCa = requireProcessMeshCa;
     exports.revokeMeshCertificate = revokeMeshCertificate;
+    exports.setProcessMeshCertificateRegistry = setProcessMeshCertificateRegistry;
     exports.setProcessMeshPeerTransportLookup = setProcessMeshPeerTransportLookup;
     exports.setProcessMeshTlsEnabler = setProcessMeshTlsEnabler;
     exports.setProcessMeshTlsListenerState = setProcessMeshTlsListenerState;
@@ -275351,7 +274710,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var require_formatter = require_formatter_DqAKDlvN();
     var require_log_file_read_protocol = require_log_file_read_protocol_D0WcLbIV();
     var node_path = __require("path");
@@ -283152,14 +282511,14 @@ var require_lib_8oZrELLm = __commonJS({
   }
 });
 
-// ../system/dist/hub-mdns-ciao-nce3TXs_.js
-var require_hub_mdns_ciao_nce3TXs = __commonJS({
-  "../system/dist/hub-mdns-ciao-nce3TXs_.js"(exports) {
+// ../system/dist/hub-mdns-ciao-CTBTlia4.js
+var require_hub_mdns_ciao_CTBTlia4 = __commonJS({
+  "../system/dist/hub-mdns-ciao-CTBTlia4.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var require_x509_es = require_x509_es_C4cOo48M();
-    var require_agent_https = require_agent_https_DOELEug8();
+    var require_agent_https = require_agent_https_Dnr_nIVx();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var node_fs_promises = __require("fs/promises");
@@ -284171,13 +283530,12 @@ var require_platform_key_source_Di7HrlGR = __commonJS({
   }
 });
 
-// ../system/dist/restore-archive-FyfZ8YMC.js
-var require_restore_archive_FyfZ8YMC = __commonJS({
-  "../system/dist/restore-archive-FyfZ8YMC.js"(exports) {
+// ../system/dist/restore-archive-DM1OBYq4.js
+var require_restore_archive_DM1OBYq4 = __commonJS({
+  "../system/dist/restore-archive-DM1OBYq4.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
-    var require_read_all_rows$1 = require_read_all_rows_CVoO1ONM();
+    var require_dist10 = require_dist_Bn_RNanh();
     var zod = require_zod();
     var node_crypto = __require("crypto");
     var buffer = __require("buffer");
@@ -284209,6 +283567,87 @@ var require_restore_archive_FyfZ8YMC = __commonJS({
     var node_stream_promises = __require("stream/promises");
     var node_assert = __require("assert");
     node_assert = require_chunk.__toESM(node_assert, 1);
+    var BackupScheduleBodySchema = zod.z.object({
+      label: zod.z.string(),
+      cron: zod.z.string(),
+      enabled: zod.z.boolean(),
+      locationIds: zod.z.array(zod.z.string()).readonly(),
+      retentionCount: zod.z.number(),
+      dataSources: zod.z.array(zod.z.string()).readonly().optional(),
+      databases: zod.z.array(require_dist10.DataStoreDatabaseSchema).readonly().optional(),
+      lastAttemptAt: zod.z.number().optional(),
+      lastSuccessAt: zod.z.number().optional(),
+      lastError: zod.z.string().optional()
+    });
+    var BackupDestinationPolicyBodySchema = zod.z.object({
+      enabled: zod.z.boolean(),
+      retentionCount: zod.z.number(),
+      label: zod.z.string().optional(),
+      lastAttemptAt: zod.z.number().optional(),
+      lastError: zod.z.string().optional()
+    });
+    var BackupEncryptionKeyBodySchema = zod.z.object({
+      keyId: zod.z.string(),
+      publicKey: zod.z.string(),
+      createdAt: zod.z.number(),
+      retiredAt: zod.z.number().nullable()
+    });
+    var BackupSeedMarkerBodySchema = zod.z.object({ seededAt: zod.z.number() });
+    var _backupOrchestratorRecordKinds = require_dist10.defineRecordKinds({
+      schedules: {
+        schema: BackupScheduleBodySchema,
+        class: "config",
+        writeTrigger: "operator upsert/delete; orchestrator stamps lastAttempt/success/error",
+        device: "none",
+        at: "none",
+        indexes: [{
+          name: "enabled",
+          fields: ["enabled"]
+        }],
+        retention: { none: "operator delete only" },
+        entry: {
+          title: "Backup schedules",
+          nameField: "label"
+        }
+      },
+      "destination-policies": {
+        schema: BackupDestinationPolicyBodySchema,
+        class: "config",
+        writeTrigger: "ensureDefault, operator upsert, recordAttempt after each archive write",
+        device: "none",
+        at: "none",
+        retention: { none: "row outlives location; ensureDefault recreates" }
+      },
+      "encryption-keys": {
+        schema: BackupEncryptionKeyBodySchema,
+        class: "config",
+        writeTrigger: "setupEncryption activate; disableEncryption retires active row",
+        device: "none",
+        at: "none",
+        retention: { none: "retired keys kept for archive decryption hints" }
+      },
+      "seed-markers": {
+        schema: BackupSeedMarkerBodySchema,
+        class: "config",
+        writeTrigger: "mark() once per seed id after seed landed",
+        device: "none",
+        at: "none",
+        retention: { none: "one row per seed id ever" }
+      }
+    });
+    var backupOrchestratorRecordKinds = _backupOrchestratorRecordKinds;
+    var backupSchedulesRecordKind = _backupOrchestratorRecordKinds.schedules;
+    var backupDestinationPoliciesRecordKind = _backupOrchestratorRecordKinds["destination-policies"];
+    var backupEncryptionKeysRecordKind = _backupOrchestratorRecordKinds["encryption-keys"];
+    var backupSeedMarkersRecordKind = _backupOrchestratorRecordKinds["seed-markers"];
+    function backupRecordStoresOf(records) {
+      return {
+        schedules: records.kind(backupSchedulesRecordKind),
+        destinationPolicies: records.kind(backupDestinationPoliciesRecordKind),
+        encryptionKeys: records.kind(backupEncryptionKeysRecordKind),
+        seedMarkers: records.kind(backupSeedMarkersRecordKind)
+      };
+    }
     var BACKUP_ENCRYPTION_SCHEME = "x25519-hkdf-aes256gcm-stream-v1";
     var ENCRYPTED_BACKUP_SUFFIX = ".csbk";
     var MAGIC = Buffer.from("CSBKENC1", "ascii");
@@ -284523,314 +283962,6 @@ var require_restore_archive_FyfZ8YMC = __commonJS({
         throw err;
       }
     }
-    var import_read_all_rows = require_read_all_rows$1.require_read_all_rows();
-    var BACKUP_ENCRYPTION_KEYS_COLLECTION = "backup_encryption_keys";
-    var COLUMNS$1 = [
-      {
-        name: "key_id",
-        type: "TEXT",
-        primaryKey: true
-      },
-      {
-        name: "public_key",
-        type: "TEXT",
-        notNull: true
-      },
-      {
-        name: "created_at",
-        type: "INTEGER",
-        notNull: true
-      },
-      {
-        name: "retired_at",
-        type: "INTEGER"
-      }
-    ];
-    var BackupEncryptionKeyStore = class {
-      store;
-      now;
-      declared = false;
-      keysKind;
-      constructor(store, now = Date.now, keysKind = null) {
-        this.store = store;
-        this.now = now;
-        this.keysKind = keysKind;
-      }
-      async ensureDeclared() {
-        if (this.keysKind !== null) return;
-        if (this.declared) return;
-        await this.store.declareCollection({
-          collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
-          columns: COLUMNS$1
-        });
-        this.declared = true;
-      }
-      /** Every key, newest first. */
-      async list() {
-        await this.ensureDeclared();
-        const kind = this.keysKind;
-        if (kind !== null) {
-          const rows2 = await (0, import_read_all_rows.readAllRows)(kind);
-          rows2.sort((a, b2) => b2.data.createdAt - a.data.createdAt);
-          const out2 = [];
-          for (const row of rows2) {
-            const record = bodyToRecord(row.id, row.data);
-            if (record !== null) out2.push(record);
-          }
-          return out2;
-        }
-        const rows = await this.store.query({
-          collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
-          filter: { orderBy: {
-            field: "created_at",
-            direction: "desc"
-          } }
-        });
-        const out = [];
-        for (const row of rows) {
-          const record = toRecord(row.data);
-          if (record !== null) out.push(record);
-        }
-        return out;
-      }
-      /** The key new archives are encrypted to; `null` = encryption off. */
-      async active() {
-        return (await this.list()).find((k) => k.retiredAt === null) ?? null;
-      }
-      /** Make `publicKey` the active key; the previous one is retired, kept listed. */
-      async activate(input) {
-        const parsed = parseBackupPublicKey(input.publicKey);
-        const t = this.now();
-        await this.retireActive(t);
-        const record = {
-          keyId: parsed.keyId,
-          publicKey: input.publicKey.trim(),
-          createdAt: t,
-          retiredAt: null
-        };
-        await this.write(record);
-        return record;
-      }
-      /** Encryption off: the active key is retired. Archives already made keep needing it. */
-      async disable() {
-        await this.retireActive(this.now());
-      }
-      async retireActive(at2) {
-        for (const key of await this.list()) if (key.retiredAt === null) await this.write({
-          ...key,
-          retiredAt: at2
-        });
-      }
-      async write(record) {
-        await this.ensureDeclared();
-        const kind = this.keysKind;
-        if (kind !== null) {
-          const body = {
-            keyId: record.keyId,
-            publicKey: record.publicKey,
-            createdAt: record.createdAt,
-            retiredAt: record.retiredAt
-          };
-          const data = backupOrchestratorRecordKinds["encryption-keys"].schema.parse(body);
-          await kind.put({
-            id: record.keyId,
-            data
-          });
-          return;
-        }
-        await this.store.deleteWhere({
-          collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
-          filter: { where: { key_id: record.keyId } }
-        });
-        await this.store.insert({
-          collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
-          record: {
-            id: record.keyId,
-            data: {
-              key_id: record.keyId,
-              public_key: record.publicKey,
-              created_at: record.createdAt,
-              retired_at: record.retiredAt
-            }
-          }
-        });
-      }
-    };
-    function bodyToRecord(keyId, body) {
-      if (!keyId) return null;
-      return {
-        keyId: body.keyId,
-        publicKey: body.publicKey,
-        createdAt: body.createdAt,
-        retiredAt: body.retiredAt
-      };
-    }
-    function toRecord(row) {
-      const keyId = row["key_id"];
-      const publicKey = row["public_key"];
-      const createdAt = row["created_at"];
-      if (typeof keyId !== "string" || typeof publicKey !== "string") return null;
-      const retired = row["retired_at"];
-      return {
-        keyId,
-        publicKey,
-        createdAt: typeof createdAt === "number" ? createdAt : Number(createdAt ?? 0),
-        retiredAt: typeof retired === "number" ? retired : null
-      };
-    }
-    var BACKUP_SEED_MARKERS_COLLECTION = "backup_seed_markers";
-    var COLUMNS = [{
-      name: "seed_id",
-      type: "TEXT",
-      primaryKey: true
-    }, {
-      name: "seeded_at",
-      type: "INTEGER",
-      notNull: true
-    }];
-    var BackupSeedMarkerStore = class {
-      store;
-      now;
-      declared = false;
-      markersKind;
-      constructor(store, now = Date.now, markersKind = null) {
-        this.store = store;
-        this.now = now;
-        this.markersKind = markersKind;
-      }
-      async ensureDeclared() {
-        if (this.markersKind !== null) return;
-        if (this.declared) return;
-        await this.store.declareCollection({
-          collection: BACKUP_SEED_MARKERS_COLLECTION,
-          columns: COLUMNS
-        });
-        this.declared = true;
-      }
-      async has(seedId) {
-        await this.ensureDeclared();
-        const kind = this.markersKind;
-        if (kind !== null) return await kind.get(seedId) !== null;
-        return (await this.store.query({
-          collection: BACKUP_SEED_MARKERS_COLLECTION,
-          filter: {
-            where: { seed_id: seedId },
-            limit: 1
-          }
-        })).length > 0;
-      }
-      async mark(seedId) {
-        await this.ensureDeclared();
-        if (await this.has(seedId)) return;
-        const kind = this.markersKind;
-        if (kind !== null) {
-          const body = { seededAt: this.now() };
-          const data = backupOrchestratorRecordKinds["seed-markers"].schema.parse(body);
-          await kind.put({
-            id: seedId,
-            data
-          });
-          return;
-        }
-        await this.store.insert({
-          collection: BACKUP_SEED_MARKERS_COLLECTION,
-          record: {
-            id: seedId,
-            data: {
-              seed_id: seedId,
-              seeded_at: this.now()
-            }
-          }
-        });
-      }
-    };
-    var BACKUP_SCHEDULES_LEGACY = "backup_schedules";
-    var BACKUP_DESTINATION_POLICIES_LEGACY = "backup_destination_policies";
-    var BackupScheduleBodySchema = zod.z.object({
-      label: zod.z.string(),
-      cron: zod.z.string(),
-      enabled: zod.z.boolean(),
-      locationIds: zod.z.array(zod.z.string()).readonly(),
-      retentionCount: zod.z.number(),
-      dataSources: zod.z.array(zod.z.string()).readonly().optional(),
-      databases: zod.z.array(require_dist10.DataStoreDatabaseSchema).readonly().optional(),
-      lastAttemptAt: zod.z.number().optional(),
-      lastSuccessAt: zod.z.number().optional(),
-      lastError: zod.z.string().optional()
-    });
-    var BackupDestinationPolicyBodySchema = zod.z.object({
-      enabled: zod.z.boolean(),
-      retentionCount: zod.z.number(),
-      label: zod.z.string().optional(),
-      lastAttemptAt: zod.z.number().optional(),
-      lastError: zod.z.string().optional()
-    });
-    var BackupEncryptionKeyBodySchema = zod.z.object({
-      keyId: zod.z.string(),
-      publicKey: zod.z.string(),
-      createdAt: zod.z.number(),
-      retiredAt: zod.z.number().nullable()
-    });
-    var BackupSeedMarkerBodySchema = zod.z.object({ seededAt: zod.z.number() });
-    var _backupOrchestratorRecordKinds = require_dist10.defineRecordKinds({
-      schedules: {
-        schema: BackupScheduleBodySchema,
-        class: "config",
-        writeTrigger: "operator upsert/delete; orchestrator stamps lastAttempt/success/error",
-        device: "none",
-        at: "none",
-        indexes: [{
-          name: "enabled",
-          fields: ["enabled"]
-        }],
-        retention: { none: "operator delete only" },
-        adoptsFrom: BACKUP_SCHEDULES_LEGACY,
-        entry: {
-          title: "Backup schedules",
-          nameField: "label"
-        }
-      },
-      "destination-policies": {
-        schema: BackupDestinationPolicyBodySchema,
-        class: "config",
-        writeTrigger: "ensureDefault, operator upsert, recordAttempt after each archive write",
-        device: "none",
-        at: "none",
-        retention: { none: "row outlives location; ensureDefault recreates" },
-        adoptsFrom: BACKUP_DESTINATION_POLICIES_LEGACY
-      },
-      "encryption-keys": {
-        schema: BackupEncryptionKeyBodySchema,
-        class: "config",
-        writeTrigger: "setupEncryption activate; disableEncryption retires active row",
-        device: "none",
-        at: "none",
-        retention: { none: "retired keys kept for archive decryption hints" },
-        adoptsFrom: BACKUP_ENCRYPTION_KEYS_COLLECTION
-      },
-      "seed-markers": {
-        schema: BackupSeedMarkerBodySchema,
-        class: "config",
-        writeTrigger: "mark() once per seed id after seed landed",
-        device: "none",
-        at: "none",
-        retention: { none: "one row per seed id ever" },
-        adoptsFrom: BACKUP_SEED_MARKERS_COLLECTION
-      }
-    });
-    var backupOrchestratorRecordKinds = _backupOrchestratorRecordKinds;
-    var backupSchedulesRecordKind = _backupOrchestratorRecordKinds.schedules;
-    var backupDestinationPoliciesRecordKind = _backupOrchestratorRecordKinds["destination-policies"];
-    var backupEncryptionKeysRecordKind = _backupOrchestratorRecordKinds["encryption-keys"];
-    var backupSeedMarkersRecordKind = _backupOrchestratorRecordKinds["seed-markers"];
-    function backupRecordStoresOf(records) {
-      return {
-        schedules: records.kind(backupSchedulesRecordKind),
-        destinationPolicies: records.kind(backupDestinationPoliciesRecordKind),
-        encryptionKeys: records.kind(backupEncryptionKeysRecordKind),
-        seedMarkers: records.kind(backupSeedMarkersRecordKind)
-      };
-    }
     var Mr = Object.defineProperty;
     var Br = (s, t) => {
       for (var e in t) Mr(s, e, {
@@ -288806,12 +287937,6 @@ var require_restore_archive_FyfZ8YMC = __commonJS({
         return BackupDecryptError;
       }
     });
-    Object.defineProperty(exports, "BackupEncryptionKeyStore", {
-      enumerable: true,
-      get: function() {
-        return BackupEncryptionKeyStore;
-      }
-    });
     Object.defineProperty(exports, "BackupKeyFormatError", {
       enumerable: true,
       get: function() {
@@ -288830,12 +287955,6 @@ var require_restore_archive_FyfZ8YMC = __commonJS({
         return BackupKeyRequiredError;
       }
     });
-    Object.defineProperty(exports, "BackupSeedMarkerStore", {
-      enumerable: true,
-      get: function() {
-        return BackupSeedMarkerStore;
-      }
-    });
     Object.defineProperty(exports, "BackupSnapshotRefusedError", {
       enumerable: true,
       get: function() {
@@ -288878,6 +287997,12 @@ var require_restore_archive_FyfZ8YMC = __commonJS({
         return generateBackupKeyPair;
       }
     });
+    Object.defineProperty(exports, "parseBackupPublicKey", {
+      enumerable: true,
+      get: function() {
+        return parseBackupPublicKey;
+      }
+    });
     Object.defineProperty(exports, "parseBackupSecretKey", {
       enumerable: true,
       get: function() {
@@ -295642,9 +294767,9 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BZQjLPiz();
+    var require_dist10 = require_dist_Bn_RNanh();
     var require_read_all_rows$1 = require_read_all_rows_CVoO1ONM();
-    var require_device_ca = require_device_ca_BrVK_5s3();
+    var require_device_ca = require_device_ca_CPTDs_d();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_builtins_calendars_calendars_addon = require_calendars_addon();
@@ -295670,21 +294795,21 @@ var require_dist3 = __commonJS({
     var require_builtins_native_metrics_native_metrics_addon = require_native_metrics_addon();
     var require_builtins_device_history_device_history_addon = require_device_history_addon();
     var require_builtins_sqlite_storage_filesystem_storage_addon = require_filesystem_storage_addon();
-    var require_wal_maintenance = require_wal_maintenance_DfSIOj24();
+    var require_wal_maintenance = require_wal_maintenance_DUHEp_09();
     var require_builtins_sqlite_storage_sqlite_settings_addon = require_sqlite_settings_addon();
     var require_builtins_sqlite_storage_index = require_sqlite_storage();
     var require_builtins_storage_orchestrator_storage_orchestrator_addon = require_storage_orchestrator_addon();
     require_storage_orchestrator();
-    var require_constants15 = require_constants_Njka8Cv6();
-    var require_agent_https = require_agent_https_DOELEug8();
+    var require_agent_https = require_agent_https_Dnr_nIVx();
+    var require_constants15 = require_constants_6OeJiZgi();
     var require_builtins_system_config_system_config_addon = require_system_config_addon();
     require_system_config();
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_custom_action_registry = require_custom_action_registry_COyb49zm();
-    var require_hub_mdns_ciao = require_hub_mdns_ciao_nce3TXs();
+    var require_hub_mdns_ciao = require_hub_mdns_ciao_CTBTlia4();
     var require_platform_key_source = require_platform_key_source_Di7HrlGR();
     var require_resource_monitor = require_resource_monitor_mio9dSCT();
-    var require_restore_archive = require_restore_archive_FyfZ8YMC();
+    var require_restore_archive = require_restore_archive_DM1OBYq4();
     var require_coral_accelerators = require_coral_accelerators_Bi_c3Rft();
     var zod = require_zod();
     var node_crypto = __require("crypto");
@@ -299676,8 +298801,7 @@ var require_dist3 = __commonJS({
           name: "addon_id",
           fields: ["addonId"]
         }],
-        retention: { none: "deleteIntegration only" },
-        adoptsFrom: INTEGRATIONS_LEGACY
+        retention: { none: "deleteIntegration only" }
       },
       "integration-settings": {
         schema: IntegrationSettingBodySchema,
@@ -299689,8 +298813,7 @@ var require_dist3 = __commonJS({
           name: "integration_id",
           fields: ["integrationId"]
         }],
-        retention: { none: "cascade on deleteIntegration" },
-        adoptsFrom: INTEGRATION_SETTINGS_LEGACY
+        retention: { none: "cascade on deleteIntegration" }
       }
     });
     var integrationRegistryRecordKinds = _integrationRegistryRecordKinds;
@@ -300128,8 +299251,7 @@ var require_dist3 = __commonJS({
         name: "last_active",
         fields: ["at"]
       }],
-      retention: { none: "rows removed only by operator forget(nodeId)" },
-      adoptsFrom: CLUSTER_NODE_HISTORY_COLLECTION
+      retention: { none: "rows removed only by operator forget(nodeId)" }
     } });
     var clusterAgentRecordKinds = _clusterAgentRecordKinds;
     var clusterNodeHistoryRecordKind = _clusterAgentRecordKinds["node-history"];
@@ -318502,14 +317624,14 @@ var require_dist3 = __commonJS({
     exports.MESH_CA_FIELD = require_constants15.MESH_CA_FIELD;
     exports.MESH_CA_KEY_REF = require_constants15.MESH_CA_KEY_REF;
     exports.MESH_CA_SETTINGS_KEY = require_constants15.MESH_CA_SETTINGS_KEY;
-    exports.MESH_NODE_CERTIFICATES_COLLECTION = require_agent_https.MESH_NODE_CERTIFICATES_COLLECTION;
-    exports.MESH_NODE_CERTIFICATES_COLUMNS = require_agent_https.MESH_NODE_CERTIFICATES_COLUMNS;
+    exports.MESH_NODE_CERTIFICATES_COLLECTION = require_builtins_system_config_system_config_addon.MESH_NODE_CERTIFICATES_COLLECTION;
+    exports.MESH_NODE_CERTIFICATES_COLUMNS = require_builtins_system_config_system_config_addon.MESH_NODE_CERTIFICATES_COLUMNS;
     exports.MESH_NODE_UNAUTHENTICATED_TYPE = MESH_NODE_UNAUTHENTICATED_TYPE;
     exports.MESH_QUEUE_TOP_N = MESH_QUEUE_TOP_N;
     exports.MESH_TLS_PORT_HELLO_FIELD = require_builtins_system_config_system_config_addon.MESH_TLS_PORT_HELLO_FIELD;
     exports.METHOD_ACCESS_MAP = require_dist10.METHOD_ACCESS_MAP;
     exports.MeshCaKeeper = require_builtins_system_config_system_config_addon.MeshCaKeeper;
-    exports.MeshCertificateRegistry = require_agent_https.MeshCertificateRegistry;
+    exports.MeshCertificateRegistry = require_builtins_system_config_system_config_addon.MeshCertificateRegistry;
     exports.MeshCrl = require_builtins_system_config_system_config_addon.MeshCrl;
     exports.MeshIdentityGate = MeshIdentityGate;
     exports.ModelDownloadService = require_custom_action_registry.ModelDownloadService;
@@ -318546,7 +317668,7 @@ var require_dist3 = __commonJS({
     exports.PythonEnvManager = PythonEnvManager;
     exports.QUARANTINE_DIRNAME = QUARANTINE_DIRNAME;
     exports.REFRESH_TOKEN_PREFIX = require_builtins_local_auth_local_auth_addon.REFRESH_TOKEN_PREFIX;
-    exports.RENEWAL_ABANDONED = require_agent_https.RENEWAL_ABANDONED;
+    exports.RENEWAL_ABANDONED = require_builtins_system_config_system_config_addon.RENEWAL_ABANDONED;
     exports.RESTART_MARKER_FILE = RESTART_MARKER_FILE;
     exports.RSS_BUDGET_REANNOUNCE_MIN_MS = RSS_BUDGET_REANNOUNCE_MIN_MS;
     exports.RSS_BUDGET_RELEASE_RATIO = RSS_BUDGET_RELEASE_RATIO;
@@ -318636,8 +317758,8 @@ var require_dist3 = __commonJS({
     exports.buildStorageLocationRegistry = require_builtins_storage_orchestrator_storage_orchestrator_addon.buildStorageLocationRegistry;
     exports.buildTransporter = buildTransporter;
     exports.builderMountedCapNames = builderMountedCapNames;
-    exports.caFingerprint = require_agent_https.caFingerprint;
-    exports.caFingerprintCompact = require_agent_https.caFingerprintCompact;
+    exports.caFingerprint = require_builtins_system_config_system_config_addon.caFingerprint;
+    exports.caFingerprintCompact = require_builtins_system_config_system_config_addon.caFingerprintCompact;
     exports.caReplacementMarkerFile = require_hub_mdns_ciao.caReplacementMarkerFile;
     exports.callRegisterNodeWithRetry = callRegisterNodeWithRetry;
     exports.callWithServiceDiscovery = callWithServiceDiscovery;
@@ -318699,7 +317821,7 @@ var require_dist3 = __commonJS({
     exports.createLocalTransport = createLocalTransport;
     exports.createLoopDelayMeter = createLoopDelayMeter;
     exports.createMeshAccessMiddleware = createMeshAccessMiddleware;
-    exports.createMeshCsrPem = require_agent_https.createMeshCsrPem;
+    exports.createMeshCsrPem = require_builtins_system_config_system_config_addon.createMeshCsrPem;
     exports.createMeshQueueReader = createMeshQueueReader;
     exports.createOutboundQueueGate = createOutboundQueueGate;
     exports.createParentUnownedCallHandler = createParentUnownedCallHandler;
@@ -318722,7 +317844,7 @@ var require_dist3 = __commonJS({
     exports.deriveAgentListenPort = deriveAgentListenPort;
     exports.describeCsr = require_builtins_system_config_system_config_addon.describeCsr;
     exports.describeHttpsLeaf = require_agent_https.describeHttpsLeaf;
-    exports.describeMeshLeaf = require_agent_https.describeMeshLeaf;
+    exports.describeMeshLeaf = require_builtins_system_config_system_config_addon.describeMeshLeaf;
     exports.describeProviderKindDrift = describeProviderKindDrift;
     exports.describeRss = describeRss;
     exports.detectWorkspacePackagesDir = detectWorkspacePackagesDir;
@@ -318771,7 +317893,7 @@ var require_dist3 = __commonJS({
     exports.ensureTlsCert = require_hub_mdns_ciao.ensureTlsCert;
     exports.evaluateExistingCert = require_agent_https.evaluateExistingCert;
     exports.expandCapMethods = require_dist10.expandCapMethods;
-    exports.exportMeshPrivateKeyPem = require_agent_https.exportMeshPrivateKeyPem;
+    exports.exportMeshPrivateKeyPem = require_builtins_system_config_system_config_addon.exportMeshPrivateKeyPem;
     exports.fetchJson = require_custom_action_registry.fetchJson;
     exports.filterIsEmpty = require_log_read_filter.filterIsEmpty;
     exports.findAddonRefusal = findAddonRefusal;
@@ -318790,8 +317912,8 @@ var require_dist3 = __commonJS({
     exports.formatSocketPlane = formatSocketPlane;
     exports.generateBackupKeyPair = require_restore_archive.generateBackupKeyPair;
     exports.generateDeviceCa = require_device_ca.generateDeviceCa;
-    exports.generateMeshCa = require_agent_https.generateMeshCa;
-    exports.generateMeshKeyPair = require_agent_https.generateMeshKeyPair;
+    exports.generateMeshCa = require_builtins_system_config_system_config_addon.generateMeshCa;
+    exports.generateMeshKeyPair = require_builtins_system_config_system_config_addon.generateMeshKeyPair;
     exports.getBrokerEventBus = getBrokerEventBus;
     exports.getBrokerTlsTransporter = getBrokerTlsTransporter;
     exports.getCapUsageRegistry = getCapUsageRegistry;
@@ -318818,7 +317940,7 @@ var require_dist3 = __commonJS({
     exports.getProcessAgentHttpsNames = require_agent_https.getProcessAgentHttpsNames;
     exports.getProcessJwtSigningKeyState = require_device_ca.getProcessJwtSigningKeyState;
     exports.getProcessMeshCaState = require_builtins_system_config_system_config_addon.getProcessMeshCaState;
-    exports.getProcessMeshCertificateRegistry = require_agent_https.getProcessMeshCertificateRegistry;
+    exports.getProcessMeshCertificateRegistry = require_builtins_system_config_system_config_addon.getProcessMeshCertificateRegistry;
     exports.getProcessMeshTlsListenerState = require_builtins_system_config_system_config_addon.getProcessMeshTlsListenerState;
     exports.getProcessNodeMeshTransport = require_builtins_system_config_system_config_addon.getProcessNodeMeshTransport;
     exports.getProcessPeerLeaf = require_builtins_system_config_system_config_addon.getProcessPeerLeaf;
@@ -318876,12 +317998,12 @@ var require_dist3 = __commonJS({
     exports.isRemoteForbiddenOnAgent = isRemoteForbiddenOnAgent;
     exports.isSettingsReadUnavailable = require_builtins_local_auth_local_auth_addon.isSettingsReadUnavailable;
     exports.isSourceNewer = isSourceNewer;
-    exports.isValidAgentNodeId = require_agent_https.isValidAgentNodeId;
+    exports.isValidAgentNodeId = require_builtins_system_config_system_config_addon.isValidAgentNodeId;
     exports.isolatedBuiltinPhase = isolatedBuiltinPhase;
     exports.issueAgentHttpsLeaf = require_agent_https.issueAgentHttpsLeaf;
     exports.issueDeviceLeaf = require_device_ca.issueDeviceLeaf;
-    exports.issueMeshLeafForNode = require_agent_https.issueMeshLeafForNode;
-    exports.issueMeshLeafFromCsr = require_agent_https.issueMeshLeafFromCsr;
+    exports.issueMeshLeafForNode = require_builtins_system_config_system_config_addon.issueMeshLeafForNode;
+    exports.issueMeshLeafFromCsr = require_builtins_system_config_system_config_addon.issueMeshLeafFromCsr;
     exports.keyFingerprintShort = require_builtins_system_config_system_config_addon.keyFingerprintShort;
     exports.leafFingerprintOf = require_hub_mdns_ciao.leafFingerprintOf;
     exports.levelRank = require_log_read_filter.levelRank;
@@ -318889,7 +318011,7 @@ var require_dist3 = __commonJS({
     exports.lineMatches = require_log_read_filter.lineMatches;
     exports.loadAgentHttps = require_agent_https.loadAgentHttps;
     exports.loadDeviceCa = require_device_ca.loadDeviceCa;
-    exports.loadMeshCa = require_agent_https.loadMeshCa;
+    exports.loadMeshCa = require_builtins_system_config_system_config_addon.loadMeshCa;
     exports.loadTlsCert = require_hub_mdns_ciao.loadTlsCert;
     exports.localCaCommonName = require_agent_https.localCaCommonName;
     exports.localEndpointPath = localEndpointPath;
@@ -318981,7 +318103,7 @@ var require_dist3 = __commonJS({
     exports.setNodeEventInterest = setNodeEventInterest;
     exports.setPlatformKeychainKey = require_platform_key_source.setPlatformKeychainKey;
     exports.setProcessAgentHttpsNames = require_agent_https.setProcessAgentHttpsNames;
-    exports.setProcessMeshCertificateRegistry = require_agent_https.setProcessMeshCertificateRegistry;
+    exports.setProcessMeshCertificateRegistry = require_builtins_system_config_system_config_addon.setProcessMeshCertificateRegistry;
     exports.setProcessMeshPeerTransportLookup = require_builtins_system_config_system_config_addon.setProcessMeshPeerTransportLookup;
     exports.setProcessMeshTlsEnabler = require_builtins_system_config_system_config_addon.setProcessMeshTlsEnabler;
     exports.setProcessMeshTlsListenerState = require_builtins_system_config_system_config_addon.setProcessMeshTlsListenerState;
@@ -319241,7 +318363,7 @@ var require_dist4 = __commonJS({
   "../types/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_sleep = require_sleep_DKtoyk6X();
+    var require_sleep = require_sleep_gRQc2IoX();
     var require_event_category = require_event_category_eSqkye_K();
     var require_composition = require_composition_eoYYVfOp();
     var require_node_color2 = require_node_color();
@@ -329582,11 +328704,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       kindId: zod.z.number().int(),
       state: RecordKindStateSchema,
       createdIndexes: zod.z.array(zod.z.string()),
-      /** The boot guard: the kind is empty while its legacy table still holds rows. */
-      adoptionPending: zod.z.object({
-        legacyTable: zod.z.string(),
-        legacyRows: zod.z.number().int()
-      }).nullable()
+      /**
+      * RETIRED (D900): always `null`. It carried the records-migration boot guard;
+      * it stays on the wire, null, because an addon built before the removal reads
+      * an ABSENT field as "adoption pending" and refuses to start.
+      */
+      adoptionPending: zod.z.null()
     });
     var SecretRefsList = zod.z.array(zod.z.string());
     var RecordSecretRefsSchema = zod.z.record(zod.z.string(), zod.z.record(zod.z.string(), zod.z.string()));
@@ -329776,19 +328899,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "stream-broker:rtsp-tokens",
       "notification-center:device-mutes",
       "recorder:recording-configs",
-      "pipeline-orchestrator:device-features",
-      "pipeline-analytics:stats-5m",
-      "pipeline-orchestrator:stats-5m",
-      "vec_object_clip",
-      "addon-devices",
-      "sections",
-      "provider-settings",
-      "device-settings",
-      "ai:budgets",
-      "pipeline-analytics:retrain-dataset-versions",
-      "training:dataset-versions",
-      "benchmark:replay-runs",
-      "viewer-settings-snapshots"
+      "pipeline-orchestrator:device-features"
     ];
     var STORAGE_ADMIN_SCOPED_BASES = [
       "addon-settings",
@@ -329839,42 +328950,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         readRecords: require_sleep.method(RecordQueryInputSchema.extend({
           owner: zod.z.string().min(1),
           kind: require_sleep.RecordKindNameSchema
-        }), RecordQueryResultSchema, { auth: "admin" }),
-        /**
-        * The migration copy path (D881): write rows into a kind AS ITS DECLARED
-        * OWNER. Refused when that owner's manifest does not declare the kind.
-        * Idempotent (a put by id, so a re-run resumes). A secret field carries a
-        * keychain marker bound to the row's own ref - the operator script imports
-        * the value first - and a plain string there is refused.
-        */
-        adoptRecords: require_sleep.method(zod.z.object({
-          owner: zod.z.string().min(1),
-          kind: require_sleep.RecordKindNameSchema,
-          records: zod.z.array(RecordInputSchema).max(require_sleep.RECORD_BATCH_MAX),
-          /** The LAST batch: the copy is complete, the boot guard stops asking. */
-          complete: zod.z.boolean().optional()
-        }).refine((input) => input.records.length > 0 || input.complete === true, { message: "records must be non-empty unless complete is true" }), zod.z.object({ adopted: zod.z.number().int() }), {
-          kind: "mutation",
-          auth: "admin"
-        }),
-        /**
-        * Read rows from a legacy KV table by physical name, without a running
-        * `declareCollection`. Used by `records-adopt.ts` when the owner already
-        * moved to records and the collection door refuses the name.
-        */
-        readLegacyCollection: require_sleep.method(zod.z.object({
-          collection: zod.z.string().min(1),
-          cursor: zod.z.string().optional(),
-          limit: zod.z.number().int().min(1).max(1e3).optional()
-        }), zod.z.object({
-          rows: zod.z.array(zod.z.object({
-            id: zod.z.string(),
-            data: zod.z.record(zod.z.string(), zod.z.unknown())
-          })),
-          nextCursor: zod.z.string().nullable()
-        }), { auth: "admin" }),
-        /** True when a declared kind lists `collection` as `adoptsFrom` and adoption finished. */
-        isAdoptedLegacyTable: require_sleep.method(zod.z.object({ collection: zod.z.string().min(1) }), zod.z.object({ adopted: zod.z.boolean() }), { auth: "admin" })
+        }), RecordQueryResultSchema, { auth: "admin" })
       }
     };
     var EntryKindInfoSchema = zod.z.object({
@@ -385590,6 +384666,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "deviceHistory.queryMany": {
+        capName: "device-history",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "deviceHistory.queryNode": {
         capName: "device-history",
         capScope: "system",
@@ -390810,24 +389892,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
-      "storageAdmin.adoptRecords": {
-        capName: "storage-admin",
-        capScope: "system",
-        addonId: null,
-        access: "create"
-      },
       "storageAdmin.dropCollection": {
         capName: "storage-admin",
         capScope: "system",
         addonId: null,
         access: "delete"
       },
-      "storageAdmin.isAdoptedLegacyTable": {
-        capName: "storage-admin",
-        capScope: "system",
-        addonId: null,
-        access: "view"
-      },
       "storageAdmin.listKinds": {
         capName: "storage-admin",
         capScope: "system",
@@ -390840,12 +389910,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
-      "storageAdmin.readLegacyCollection": {
-        capName: "storage-admin",
-        capScope: "system",
-        addonId: null,
-        access: "view"
-      },
       "storageAdmin.readRecords": {
         capName: "storage-admin",
         capScope: "system",
@@ -397815,12 +396879,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         form: "single",
         optional: false
       }],
-      "storageAdmin.adoptRecords": [{
-        name: "records",
-        form: "object-array",
-        optional: false,
-        itemField: "deviceId"
-      }],
       "storageAdmin.readRecords": [{
         name: "deviceId",
         form: "single",
@@ -398359,7 +397417,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "records.histogram",
       "records.putMany",
       "records.query",
-      "storageAdmin.adoptRecords",
       "storageAdmin.readRecords",
       "streamBroker.acquireEgressTranscode",
       "streamBroker.applyDeviceSettingsPatch",
@@ -407092,7 +406149,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.AdoptionListCandidatesInputSchema = ListCandidatesInputSchema;
     exports.AdoptionListCandidatesOutputSchema = ListCandidatesOutputSchema;
     exports.AdoptionOutcomeSchema = AdoptionOutcomeSchema;
-    exports.AdoptionPendingError = require_sleep.AdoptionPendingError;
     exports.AdoptionReleaseInputSchema = ReleaseInputSchema;
     exports.AdoptionStatusSchema = AdoptionStatusSchema;
     exports.AgentLoadSummarySchema = AgentLoadSummarySchema;
@@ -408633,8 +407689,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.SERVER_NAME_MAX_LENGTH = SERVER_NAME_MAX_LENGTH;
     exports.SERVER_NAME_SETTING_KEY = SERVER_NAME_SETTING_KEY;
     exports.SESSION_PLACEMENT_SETTING_KEY = SESSION_PLACEMENT_SETTING_KEY;
-    exports.SETTINGS_ARRAY_ADOPTS_PREFIX = require_sleep.SETTINGS_ARRAY_ADOPTS_PREFIX;
-    exports.SETTINGS_BROKERS_ADOPTS_PREFIX = require_sleep.SETTINGS_BROKERS_ADOPTS_PREFIX;
     exports.SHARE_SOURCE_SETTING_KEY = SHARE_SOURCE_SETTING_KEY;
     exports.SHARE_VIEW_KINDS = require_sleep.SHARE_VIEW_KINDS;
     exports.SHARE_VIEW_MAX_DEVICES = SHARE_VIEW_MAX_DEVICES;
@@ -409544,8 +408598,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.parseSecretRef = require_sleep.parseSecretRef;
     exports.parseSecretStatePath = require_sleep.parseSecretStatePath;
     exports.parseSessionPlacementPolicy = parseSessionPlacementPolicy;
-    exports.parseSettingsArrayAdoptsFrom = require_sleep.parseSettingsArrayAdoptsFrom;
-    exports.parseSettingsBrokersAdoptsFrom = require_sleep.parseSettingsBrokersAdoptsFrom;
     exports.parseShareSource = parseShareSource;
     exports.parseStreamParamsFormPatch = parseStreamParamsFormPatch;
     exports.parseTrainingEventLine = parseTrainingEventLine;
@@ -409724,9 +408776,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.serverManagementCapability = serverManagementCapability;
     exports.setByPath = setByPath;
     exports.settingValuesEqual = settingValuesEqual;
-    exports.settingsArrayAdoptsFrom = require_sleep.settingsArrayAdoptsFrom;
     exports.settingsBelow = settingsBelow;
-    exports.settingsBrokersAdoptsFrom = require_sleep.settingsBrokersAdoptsFrom;
     exports.settingsStoreCapability = settingsStoreCapability;
     exports.shareViewGrantOf = shareViewGrantOf;
     exports.shortHostname = shortHostname;
@@ -575335,7 +574385,7 @@ var require_cap_providers = __commonJS({
             integrationId: input.id,
             forOwner,
             ...secretKeys !== void 0 ? { secretKeys } : {},
-            onSuspectSecret: (suspect) => logger.error(suspect.kind === "coerced-marker" ? 'integration secret is "[object Object]" \u2014 a keychain marker was coerced to text; the addon is sending it as the credential (repair: scripts/hub/repair-integration-secret-markers.ts, or re-type it)' : "integration secret stored as PLAINTEXT under a keychain-declared key \u2014 withheld from the form; re-type it to move it into the keychain", {
+            onSuspectSecret: (suspect) => logger.error(suspect.kind === "coerced-marker" ? 'integration secret is "[object Object]" \u2014 a keychain marker was coerced to text; the addon is sending it as the credential; re-type it' : "integration secret stored as PLAINTEXT under a keychain-declared key \u2014 withheld from the form; re-type it to move it into the keychain", {
               tags: { integrationId: input.id, addonId: integration.addonId },
               meta: { phase: "getSettings", key: suspect.key, kind: suspect.kind, forOwner }
             })
@@ -588671,8 +587721,7 @@ var require_record_kinds = __commonJS({
           { name: "hash", fields: ["tokenHash"], unique: true },
           { name: "user", fields: ["userId"] }
         ],
-        retention: { none: "operator drops the legacy rows by hand (D895)" },
-        adoptsFrom: exports.SHARE_VIEW_TOKENS_LEGACY
+        retention: { none: "operator drops the legacy rows by hand (D895)" }
       },
       "credential-tokens": {
         schema: CredentialTokenBodySchema,