@camstack/system 1.2.381 → 1.2.383

package/dist/builtins/system-backup/system-backup.service.d.ts

@@ -1,4 +1,5 @@
 import { ArchiveSqliteSnapshot, DatabaseSnapshotResult, IScopedLogger } from '@camstack/types';
+import { BACKUP_ENCRYPTION_SCHEME } from './backup-encryption.js';
 /**
  * Thrown when an archive build (or a backup run driving one) is
  * stopped via its `AbortSignal`. Callers use `instanceof` to tell a
@@ -94,11 +95,19 @@ export interface ArchiveManifest {
      */
     sqliteSnapshots?: ArchiveSqliteSnapshot[];
 }
+/** How an archive was encrypted — absent on a plain `.tar.gz`. */
+export interface ArchiveEncryption {
+    readonly scheme: typeof BACKUP_ENCRYPTION_SCHEME;
+    /** The backup key the archive needs to be restored. */
+    readonly keyId: string;
+}
 export interface CreateArchiveResult {
     archivePath: string;
     includedLocations: readonly string[];
-    /** Archive size in bytes (compressed, on disk). */
+    /** Archive size in bytes (compressed — and encrypted, when it is — on disk). */
     sizeBytes: number;
+    /** Present when the archive is encrypted to a backup key. */
+    encryption?: ArchiveEncryption;
     /** Embedded manifest — same shape as `getArchiveManifest()`. */
     manifest: ArchiveManifest;
 }
@@ -197,6 +206,12 @@ export declare class SystemBackupService {
          * because its upload prunes an older archive that HAS it.
          */
         owner?: DatabaseOwner;
+        /**
+         * A backup PUBLIC key: the gzip stream is encrypted to it as it is
+         * written, so no plaintext archive ever touches the staging disk. Parsed
+         * before any work — a bad key builds nothing.
+         */
+        encryptTo?: string;
     }): Promise<CreateArchiveResult>;
     /**
      * Tar `present` (filtered by `excluded`) plus the staged manifest into

package/dist/builtins/system-config/cluster-secret-keeper.d.ts

@@ -17,6 +17,12 @@ export interface ClusterSecretKeeperDeps {
     readonly readSection: () => Promise<Record<string, unknown>>;
     readonly logger: KeeperLogger;
     readonly retryMs?: number;
+    /**
+     * Generate and store a new secret (D802). Called when no marker is stored.
+     * Throws when it cannot (no keychain, locked): the keeper retries on its
+     * timer. Absent → nothing is generated (tests of the D797 states).
+     */
+    readonly generateSecret?: () => Promise<void>;
 }
 export declare class ClusterSecretKeeper {
     private readonly deps;
@@ -29,6 +35,7 @@ export declare class ClusterSecretKeeper {
     stop(): void;
     /** Re-read the row and the keychain; publish the gate. */
     reload(): Promise<void>;
+    private generate;
     private compute;
     private report;
     private scheduleRetry;

package/dist/builtins/system-config/index.d.ts

@@ -1 +1,2 @@
 export { SystemConfigAddon, default } from './system-config.addon.js';
+export { systemConfigMeshActions, systemConfigMeshActions as customActions, } from './mesh-actions.js';

package/dist/builtins/system-config/index.js

@@ -5,4 +5,6 @@ Object.defineProperties(exports, {
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_system_config_system_config_addon = require("./system-config.addon.js");
 exports.SystemConfigAddon = require_builtins_system_config_system_config_addon.SystemConfigAddon;
+exports.customActions = require_builtins_system_config_system_config_addon.systemConfigMeshActions;
 exports.default = require_builtins_system_config_system_config_addon.SystemConfigAddon;
+exports.systemConfigMeshActions = require_builtins_system_config_system_config_addon.systemConfigMeshActions;

package/dist/builtins/system-config/index.mjs

@@ -1,2 +1,2 @@
-import { SystemConfigAddon } from "./system-config.addon.mjs";
-export { SystemConfigAddon, SystemConfigAddon as default };
+import { SystemConfigAddon, t as systemConfigMeshActions } from "./system-config.addon.mjs";
+export { SystemConfigAddon, SystemConfigAddon as default, systemConfigMeshActions as customActions, systemConfigMeshActions };

package/dist/builtins/system-config/mesh-actions.d.ts

@@ -0,0 +1,19 @@
+import { z } from 'zod';
+export declare const systemConfigMeshActions: {
+    mintJoinToken: import('@camstack/types').CustomActionSpec<z.ZodOptional<z.ZodObject<{
+        nodeId: z.ZodOptional<z.ZodString>;
+        hubUrl: z.ZodOptional<z.ZodString>;
+        hubMeshAddress: z.ZodOptional<z.ZodString>;
+        ttlSec: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>, z.ZodObject<{
+        token: z.ZodString;
+        exp: z.ZodNumber;
+        hubUrl: z.ZodString;
+        hubMeshAddress: z.ZodString;
+        caFingerprint: z.ZodString;
+        nodeId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, "mutation", "admin", {
+        readonly kind: "system";
+    }>;
+};
+export type SystemConfigMeshActions = typeof systemConfigMeshActions;

package/dist/builtins/system-config/system-config.addon.d.ts

@@ -4,9 +4,42 @@ export declare const SYSTEM_CONFIG_CLUSTER_SECTION_ID = "system-config-cluster";
 export declare class SystemConfigAddon extends BaseAddon {
     readonly id = "system-config";
     private clusterSecretKeeper;
+    private meshCaKeeper;
     constructor();
-    protected onInitialize(): Promise<void>;
+    protected onInitialize(): Promise<{
+        customActions: {
+            mintJoinToken: import('@camstack/types').CustomActionSpec<import('zod').ZodOptional<import('zod').ZodObject<{
+                nodeId: import('zod').ZodOptional<import('zod').ZodString>;
+                hubUrl: import('zod').ZodOptional<import('zod').ZodString>;
+                hubMeshAddress: import('zod').ZodOptional<import('zod').ZodString>;
+                ttlSec: import('zod').ZodOptional<import('zod').ZodNumber>;
+            }, import('zod/v4/core').$strip>>, import('zod').ZodObject<{
+                token: import('zod').ZodString;
+                exp: import('zod').ZodNumber;
+                hubUrl: import('zod').ZodString;
+                hubMeshAddress: import('zod').ZodString;
+                caFingerprint: import('zod').ZodString;
+                nodeId: import('zod').ZodOptional<import('zod').ZodString>;
+            }, import('zod/v4/core').$strip>, "mutation", "admin", {
+                readonly kind: "system";
+            }>;
+        };
+        actionHandlers: {
+            mintJoinToken: (input: any) => Promise<{
+                token: string;
+                exp: number;
+                hubUrl: string;
+                hubMeshAddress: string;
+                caFingerprint: string;
+                nodeId?: string;
+            }>;
+        };
+    }>;
     protected onShutdown(): Promise<void>;
+    private onMeshCaReady;
+    private mintJoinToken;
+    private resolveHubUrl;
+    private resolveHubMeshAddress;
     /** The keychain handle for owner `system`; `null` where there is no door. */
     private systemSecrets;
     private buildGlobalSchema;
@@ -14,10 +47,20 @@ export declare class SystemConfigAddon extends BaseAddon {
     updateGlobalSettings(patch: Record<string, unknown>): Promise<void>;
     /**
      * The cluster secret's save path: the value goes to the keychain (owner
-     * `system`), the row gets the marker; `''` / a view keeps, `$secretClear`
-     * clears. A value the keychain cannot store is REFUSED — never written
-     * inline (D787, P5).
+     * `system`), the row gets the marker; `''` / a view keeps. `$secretClear` is
+     * REFUSED: the secret is mandatory (D802). A value the keychain cannot store
+     * is REFUSED — never written inline (D787, P5). `meshAuth` is a plain value.
      */
     private writeClusterSection;
+    /** `cluster.meshAuth` (D802), then republish it. */
+    private writeMeshAuthMode;
+    /**
+     * First boot, or a keychain reset that cleared the marker (D802): a fresh
+     * random secret, stored like an operator save. A NEW secret means every
+     * agent must be given it, so the mesh goes (back) to `transition`; on a hub
+     * with no agent yet, the hub's auto-enforce ends it at once.
+     */
+    private generateClusterSecret;
+    private storeClusterSecret;
 }
 export default SystemConfigAddon;