@camstack/system 1.2.382 → 1.2.383

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,6 +1,7 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Vn as userManagementCapability, W as UserRecordSchema, Y as authProviderCapability, r as ApiKeyRecordSchema, ur as BaseAddon, z as ScopedTokenSchema } from "../../dist-CP5TTjwd.mjs";
-import { a as loadJwtSigningKey, i as getProcessJwtSigningKeyState, o as processJwtSigningKey, s as setProcessJwtSigningKey, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-CAbozwvF.mjs";
+import { Vn as userManagementCapability, W as UserRecordSchema, Y as authProviderCapability, r as ApiKeyRecordSchema, ur as BaseAddon, z as ScopedTokenSchema } from "../../dist-osl3bkF0.mjs";
+import { n as require_safe_buffer, t as require_ms } from "../../ms-DlIWNkkk.mjs";
+import { a as loadJwtSigningKey, i as getProcessJwtSigningKeyState, o as processJwtSigningKey, s as setProcessJwtSigningKey, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-MQLxLfgF.mjs";
 import * as crypto$1 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
@@ -1852,46 +1853,6 @@ function _hash(password, salt, callback, progressCallback) {
 	}, progressCallback);
 }
 //#endregion
-//#region ../../node_modules/safe-buffer/index.js
-var require_safe_buffer = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	/*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
-	var buffer = __require("buffer");
-	var Buffer = buffer.Buffer;
-	function copyProps(src, dst) {
-		for (var key in src) dst[key] = src[key];
-	}
-	if (Buffer.from && Buffer.alloc && Buffer.allocUnsafe && Buffer.allocUnsafeSlow) module.exports = buffer;
-	else {
-		copyProps(buffer, exports);
-		exports.Buffer = SafeBuffer;
-	}
-	function SafeBuffer(arg, encodingOrOffset, length) {
-		return Buffer(arg, encodingOrOffset, length);
-	}
-	SafeBuffer.prototype = Object.create(Buffer.prototype);
-	copyProps(Buffer, SafeBuffer);
-	SafeBuffer.from = function(arg, encodingOrOffset, length) {
-		if (typeof arg === "number") throw new TypeError("Argument must not be a number");
-		return Buffer(arg, encodingOrOffset, length);
-	};
-	SafeBuffer.alloc = function(size, fill, encoding) {
-		if (typeof size !== "number") throw new TypeError("Argument must be a number");
-		var buf = Buffer(size);
-		if (fill !== void 0) if (typeof encoding === "string") buf.fill(fill, encoding);
-		else buf.fill(fill);
-		else buf.fill(0);
-		return buf;
-	};
-	SafeBuffer.allocUnsafe = function(size) {
-		if (typeof size !== "number") throw new TypeError("Argument must be a number");
-		return Buffer(size);
-	};
-	SafeBuffer.allocUnsafeSlow = function(size) {
-		if (typeof size !== "number") throw new TypeError("Argument must be a number");
-		return buffer.SlowBuffer(size);
-	};
-}));
-//#endregion
 //#region ../../node_modules/jws/lib/data-stream.js
 var require_data_stream = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var Buffer = require_safe_buffer().Buffer;
@@ -2522,124 +2483,6 @@ var require_TokenExpiredError = /* @__PURE__ */ __commonJSMin(((exports, module)
 	module.exports = TokenExpiredError;
 }));
 //#endregion
-//#region ../../node_modules/ms/index.js
-var require_ms = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	/**
-	* Helpers.
-	*/
-	var s = 1e3;
-	var m = s * 60;
-	var h = m * 60;
-	var d = h * 24;
-	var w = d * 7;
-	var y = d * 365.25;
-	/**
-	* Parse or format the given `val`.
-	*
-	* Options:
-	*
-	*  - `long` verbose formatting [false]
-	*
-	* @param {String|Number} val
-	* @param {Object} [options]
-	* @throws {Error} throw an error if val is not a non-empty string or a number
-	* @return {String|Number}
-	* @api public
-	*/
-	module.exports = function(val, options) {
-		options = options || {};
-		var type = typeof val;
-		if (type === "string" && val.length > 0) return parse(val);
-		else if (type === "number" && isFinite(val)) return options.long ? fmtLong(val) : fmtShort(val);
-		throw new Error("val is not a non-empty string or a valid number. val=" + JSON.stringify(val));
-	};
-	/**
-	* Parse the given `str` and return milliseconds.
-	*
-	* @param {String} str
-	* @return {Number}
-	* @api private
-	*/
-	function parse(str) {
-		str = String(str);
-		if (str.length > 100) return;
-		var match = /^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(str);
-		if (!match) return;
-		var n = parseFloat(match[1]);
-		switch ((match[2] || "ms").toLowerCase()) {
-			case "years":
-			case "year":
-			case "yrs":
-			case "yr":
-			case "y": return n * y;
-			case "weeks":
-			case "week":
-			case "w": return n * w;
-			case "days":
-			case "day":
-			case "d": return n * d;
-			case "hours":
-			case "hour":
-			case "hrs":
-			case "hr":
-			case "h": return n * h;
-			case "minutes":
-			case "minute":
-			case "mins":
-			case "min":
-			case "m": return n * m;
-			case "seconds":
-			case "second":
-			case "secs":
-			case "sec":
-			case "s": return n * s;
-			case "milliseconds":
-			case "millisecond":
-			case "msecs":
-			case "msec":
-			case "ms": return n;
-			default: return;
-		}
-	}
-	/**
-	* Short format for `ms`.
-	*
-	* @param {Number} ms
-	* @return {String}
-	* @api private
-	*/
-	function fmtShort(ms) {
-		var msAbs = Math.abs(ms);
-		if (msAbs >= d) return Math.round(ms / d) + "d";
-		if (msAbs >= h) return Math.round(ms / h) + "h";
-		if (msAbs >= m) return Math.round(ms / m) + "m";
-		if (msAbs >= s) return Math.round(ms / s) + "s";
-		return ms + "ms";
-	}
-	/**
-	* Long format for `ms`.
-	*
-	* @param {Number} ms
-	* @return {String}
-	* @api private
-	*/
-	function fmtLong(ms) {
-		var msAbs = Math.abs(ms);
-		if (msAbs >= d) return plural(ms, msAbs, d, "day");
-		if (msAbs >= h) return plural(ms, msAbs, h, "hour");
-		if (msAbs >= m) return plural(ms, msAbs, m, "minute");
-		if (msAbs >= s) return plural(ms, msAbs, s, "second");
-		return ms + " ms";
-	}
-	/**
-	* Pluralization helper.
-	*/
-	function plural(ms, msAbs, n, name) {
-		var isPlural = msAbs >= n * 1.5;
-		return Math.round(ms / n) + " " + name + (isPlural ? "s" : "");
-	}
-}));
-//#endregion
 //#region ../../node_modules/jsonwebtoken/lib/timespan.js
 var require_timespan = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var ms = require_ms();
@@ -11273,4 +11116,4 @@ var LocalAuthAddon = class extends BaseAddon {
 	}
 };
 //#endregion
-export { LocalAuthAddon, LocalAuthAddon as default, isSettingsReadUnavailable as _, attachUserManagementInternal as a, ApiKeyManager as b, ADMIN_TOKEN_MAX_LIFETIME_MS as c, LoginSessionManager as d, REFRESH_TOKEN_PREFIX as f, SettingsReadUnavailableError as g, parseTokenExpiry as h, USER_MANAGEMENT_INTERNAL as i, ADMIN_TOKEN_PREFIX as l, AuthManager as m, FIRST_BOOT_ADMIN_USERNAME as n, getUserManagementInternal as o, ScopedTokenManager as p, UserManager as r, AuthAuditLog as s, FIRST_BOOT_ADMIN_PASSWORD as t, AdminTokenManager as u, require_ms as v, require_safe_buffer as y };
+export { LocalAuthAddon, LocalAuthAddon as default, isSettingsReadUnavailable as _, attachUserManagementInternal as a, ADMIN_TOKEN_MAX_LIFETIME_MS as c, LoginSessionManager as d, REFRESH_TOKEN_PREFIX as f, SettingsReadUnavailableError as g, parseTokenExpiry as h, USER_MANAGEMENT_INTERNAL as i, ADMIN_TOKEN_PREFIX as l, AuthManager as m, FIRST_BOOT_ADMIN_USERNAME as n, getUserManagementInternal as o, ScopedTokenManager as p, UserManager as r, AuthAuditLog as s, FIRST_BOOT_ADMIN_PASSWORD as t, AdminTokenManager as u, ApiKeyManager as v };

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tnAO12ak.js");
-const require_tls = require("../../tls-CljF057D.js");
+const require_dist = require("../../dist-CUNGH0fs.js");
+const require_tls = require("../../tls-BWpwU-d5.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { Bt as isDefaultAppConnectionEndpoint, Dn as resolveNotificationTapAddress, Lt as isAppLinkBase, Un as validateCustomAddress, Xt as localNetworkCapability, bn as resolveAppConnections, ei as EventCategory, pn as pickAppLinkHub, rt as checkRoleAddress, s as CAMSTACK_APP_LINK_ORIGIN, ur as BaseAddon, wn as resolveHubAddressRoles } from "../../dist-CP5TTjwd.mjs";
-import { P as readLanHttpState, _ as writeExtraSans, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readTlsAccessStatus, n as regenerateCertificate, p as readExtraSans, r as revertToGeneratedCertificate, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, y as ensureTlsCert } from "../../tls-4cRH24Id.mjs";
+import { Bt as isDefaultAppConnectionEndpoint, Dn as resolveNotificationTapAddress, Lt as isAppLinkBase, Un as validateCustomAddress, Xt as localNetworkCapability, bn as resolveAppConnections, ni as EventCategory, pn as pickAppLinkHub, rt as checkRoleAddress, s as CAMSTACK_APP_LINK_ORIGIN, ur as BaseAddon, wn as resolveHubAddressRoles } from "../../dist-osl3bkF0.mjs";
+import { P as readLanHttpState, _ as writeExtraSans, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readTlsAccessStatus, n as regenerateCertificate, p as readExtraSans, r as revertToGeneratedCertificate, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, y as ensureTlsCert } from "../../tls-C2NT-Orr.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tnAO12ak.js");
+const require_dist = require("../../dist-CUNGH0fs.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Qt as logDestinationCapability, ur as BaseAddon } from "../../dist-CP5TTjwd.mjs";
+import { Qt as logDestinationCapability, ur as BaseAddon } from "../../dist-osl3bkF0.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tnAO12ak.js");
+const require_dist = require("../../dist-CUNGH0fs.js");
 const require_proc_stat = require("../../proc-stat-DL-WUOhl.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Nt as foldSnapshotByFunction, Tr as createEvent, an as metricsProviderCapability, ei as EventCategory, lr as errMsg, ur as BaseAddon, vn as reducePoints, xn as resolveBucketMs } from "../../dist-CP5TTjwd.mjs";
+import { Nt as foldSnapshotByFunction, Tr as createEvent, an as metricsProviderCapability, lr as errMsg, ni as EventCategory, ur as BaseAddon, vn as reducePoints, xn as resolveBucketMs } from "../../dist-osl3bkF0.mjs";
 import { a as parseProcStat, i as nodeProcReader, n as elapsedSecSince, o as parseProcStatusRss, r as lifetimeCpuPercent, t as commandFromCmdline } from "../../proc-stat-CbC55Kqi.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tnAO12ak.js");
+const require_dist = require("../../dist-CUNGH0fs.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Dr as emitReadiness, ei as EventCategory, hn as platformProbeCapability, jn as scoreRuntimes, lr as errMsg, ur as BaseAddon, wt as enumerateInferenceDevices } from "../../dist-CP5TTjwd.mjs";
+import { hn as platformProbeCapability, jn as scoreRuntimes, kr as emitReadiness, lr as errMsg, ni as EventCategory, ur as BaseAddon, wt as enumerateInferenceDevices } from "../../dist-osl3bkF0.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tnAO12ak.js");
+const require_dist = require("../../dist-CUNGH0fs.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { ei as EventCategory, ur as BaseAddon } from "../../dist-CP5TTjwd.mjs";
+import { ni as EventCategory, ur as BaseAddon } from "../../dist-osl3bkF0.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tnAO12ak.js");
+const require_dist = require("../../dist-CUNGH0fs.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Bn as streamQualityLabel, Pn as snapshotCapability, Q as batteryCapability, Rr as nodePin, Z as bareAddonId, a as BatteryStatusSchema, cr as DeviceType, ei as EventCategory, in as memoizePinnedFfmpeg, lr as errMsg, or as DeviceFeature, ur as BaseAddon, vt as deriveBatteryPresence } from "../../dist-CP5TTjwd.mjs";
+import { Bn as streamQualityLabel, Br as nodePin, Pn as snapshotCapability, Q as batteryCapability, Z as bareAddonId, a as BatteryStatusSchema, cr as DeviceType, in as memoizePinnedFfmpeg, lr as errMsg, ni as EventCategory, or as DeviceFeature, ur as BaseAddon, vt as deriveBatteryPresence } from "../../dist-osl3bkF0.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tnAO12ak.js");
+const require_dist = require("../../dist-CUNGH0fs.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as filesystemBrowseCapability, Rn as storageProviderCapability, ur as BaseAddon } from "../../dist-CP5TTjwd.mjs";
+import { Mt as filesystemBrowseCapability, Rn as storageProviderCapability, ur as BaseAddon } from "../../dist-osl3bkF0.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tnAO12ak.js");
+const require_dist = require("../../dist-CUNGH0fs.js");
 const require_hub_cap_forward = require("../../hub-cap-forward-W8oEm4ME.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { $r as transformSecretWrite, B as StorageCleanupJobSchema, Br as parseJsonObject, Cr as collectSecretConfigKeys, Fn as storageCapability, Fr as isSecretMarker, Ft as gbToBytes, Gr as resolveSecretMarkers, H as StorageLocationTypeSchema, In as storageMigrationCapability, Jr as secretTreeFromPaths, Jt as legacyModeOf, Mn as settingsStoreCapability, O as LegacyStorageLocationDefaultSchema, Ot as evictionPolicyOfLocation, Tn as resolveLocationMode, U as StorageMigrationJobSchema, V as StorageLocationModeSchema, Vt as isLocationEnabled, ei as EventCategory, mr as REDACTED_SECRET, nn as mayReadLocation, on as modeMayWrite, qn as withLocationMode, rn as mayWriteToLocation, ur as BaseAddon } from "../../dist-CP5TTjwd.mjs";
+import { B as StorageCleanupJobSchema, Cr as collectSecretConfigKeys, Fn as storageCapability, Ft as gbToBytes, H as StorageLocationTypeSchema, Hr as parseJsonObject, In as storageMigrationCapability, Jt as legacyModeOf, Lr as isSecretMarker, Mn as settingsStoreCapability, O as LegacyStorageLocationDefaultSchema, Ot as evictionPolicyOfLocation, Tn as resolveLocationMode, U as StorageMigrationJobSchema, V as StorageLocationModeSchema, Vt as isLocationEnabled, Xr as secretTreeFromPaths, mr as REDACTED_SECRET, ni as EventCategory, nn as mayReadLocation, on as modeMayWrite, qn as withLocationMode, qr as resolveSecretMarkers, rn as mayWriteToLocation, ti as transformSecretWrite, ur as BaseAddon } from "../../dist-osl3bkF0.mjs";
 import { t as HUB_CAP_FWD_ACTION } from "../../hub-cap-forward-CDiN1p98.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/system-config/index.d.ts

@@ -1 +1,2 @@
 export { SystemConfigAddon, default } from './system-config.addon.js';
+export { systemConfigMeshActions, systemConfigMeshActions as customActions, } from './mesh-actions.js';

package/dist/builtins/system-config/index.js

@@ -5,4 +5,6 @@ Object.defineProperties(exports, {
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_system_config_system_config_addon = require("./system-config.addon.js");
 exports.SystemConfigAddon = require_builtins_system_config_system_config_addon.SystemConfigAddon;
+exports.customActions = require_builtins_system_config_system_config_addon.systemConfigMeshActions;
 exports.default = require_builtins_system_config_system_config_addon.SystemConfigAddon;
+exports.systemConfigMeshActions = require_builtins_system_config_system_config_addon.systemConfigMeshActions;

package/dist/builtins/system-config/index.mjs

@@ -1,2 +1,2 @@
-import { SystemConfigAddon } from "./system-config.addon.mjs";
-export { SystemConfigAddon, SystemConfigAddon as default };
+import { SystemConfigAddon, t as systemConfigMeshActions } from "./system-config.addon.mjs";
+export { SystemConfigAddon, SystemConfigAddon as default, systemConfigMeshActions as customActions, systemConfigMeshActions };

package/dist/builtins/system-config/mesh-actions.d.ts

@@ -0,0 +1,19 @@
+import { z } from 'zod';
+export declare const systemConfigMeshActions: {
+    mintJoinToken: import('@camstack/types').CustomActionSpec<z.ZodOptional<z.ZodObject<{
+        nodeId: z.ZodOptional<z.ZodString>;
+        hubUrl: z.ZodOptional<z.ZodString>;
+        hubMeshAddress: z.ZodOptional<z.ZodString>;
+        ttlSec: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>, z.ZodObject<{
+        token: z.ZodString;
+        exp: z.ZodNumber;
+        hubUrl: z.ZodString;
+        hubMeshAddress: z.ZodString;
+        caFingerprint: z.ZodString;
+        nodeId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, "mutation", "admin", {
+        readonly kind: "system";
+    }>;
+};
+export type SystemConfigMeshActions = typeof systemConfigMeshActions;

package/dist/builtins/system-config/system-config.addon.d.ts

@@ -4,9 +4,42 @@ export declare const SYSTEM_CONFIG_CLUSTER_SECTION_ID = "system-config-cluster";
 export declare class SystemConfigAddon extends BaseAddon {
     readonly id = "system-config";
     private clusterSecretKeeper;
+    private meshCaKeeper;
     constructor();
-    protected onInitialize(): Promise<void>;
+    protected onInitialize(): Promise<{
+        customActions: {
+            mintJoinToken: import('@camstack/types').CustomActionSpec<import('zod').ZodOptional<import('zod').ZodObject<{
+                nodeId: import('zod').ZodOptional<import('zod').ZodString>;
+                hubUrl: import('zod').ZodOptional<import('zod').ZodString>;
+                hubMeshAddress: import('zod').ZodOptional<import('zod').ZodString>;
+                ttlSec: import('zod').ZodOptional<import('zod').ZodNumber>;
+            }, import('zod/v4/core').$strip>>, import('zod').ZodObject<{
+                token: import('zod').ZodString;
+                exp: import('zod').ZodNumber;
+                hubUrl: import('zod').ZodString;
+                hubMeshAddress: import('zod').ZodString;
+                caFingerprint: import('zod').ZodString;
+                nodeId: import('zod').ZodOptional<import('zod').ZodString>;
+            }, import('zod/v4/core').$strip>, "mutation", "admin", {
+                readonly kind: "system";
+            }>;
+        };
+        actionHandlers: {
+            mintJoinToken: (input: any) => Promise<{
+                token: string;
+                exp: number;
+                hubUrl: string;
+                hubMeshAddress: string;
+                caFingerprint: string;
+                nodeId?: string;
+            }>;
+        };
+    }>;
     protected onShutdown(): Promise<void>;
+    private onMeshCaReady;
+    private mintJoinToken;
+    private resolveHubUrl;
+    private resolveHubMeshAddress;
     /** The keychain handle for owner `system`; `null` where there is no door. */
     private systemSecrets;
     private buildGlobalSchema;