@camstack/system 1.2.382 → 1.2.384

package/dist/builtins/system-config/mesh-actions.d.ts

@@ -0,0 +1,19 @@
+import { z } from 'zod';
+export declare const systemConfigMeshActions: {
+    mintJoinToken: import('@camstack/types').CustomActionSpec<z.ZodOptional<z.ZodObject<{
+        nodeId: z.ZodOptional<z.ZodString>;
+        hubUrl: z.ZodOptional<z.ZodString>;
+        hubMeshAddress: z.ZodOptional<z.ZodString>;
+        ttlSec: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>, z.ZodObject<{
+        token: z.ZodString;
+        exp: z.ZodNumber;
+        hubUrl: z.ZodString;
+        hubMeshAddress: z.ZodString;
+        caFingerprint: z.ZodString;
+        nodeId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, "mutation", "admin", {
+        readonly kind: "system";
+    }>;
+};
+export type SystemConfigMeshActions = typeof systemConfigMeshActions;

package/dist/builtins/system-config/system-config.addon.d.ts

@@ -4,9 +4,48 @@ export declare const SYSTEM_CONFIG_CLUSTER_SECTION_ID = "system-config-cluster";
 export declare class SystemConfigAddon extends BaseAddon {
     readonly id = "system-config";
     private clusterSecretKeeper;
+    private meshCaKeeper;
     constructor();
-    protected onInitialize(): Promise<void>;
+    protected onInitialize(): Promise<{
+        customActions: {
+            mintJoinToken: import('@camstack/types').CustomActionSpec<import('zod').ZodOptional<import('zod').ZodObject<{
+                nodeId: import('zod').ZodOptional<import('zod').ZodString>;
+                hubUrl: import('zod').ZodOptional<import('zod').ZodString>;
+                hubMeshAddress: import('zod').ZodOptional<import('zod').ZodString>;
+                ttlSec: import('zod').ZodOptional<import('zod').ZodNumber>;
+            }, import('zod/v4/core').$strip>>, import('zod').ZodObject<{
+                token: import('zod').ZodString;
+                exp: import('zod').ZodNumber;
+                hubUrl: import('zod').ZodString;
+                hubMeshAddress: import('zod').ZodString;
+                caFingerprint: import('zod').ZodString;
+                nodeId: import('zod').ZodOptional<import('zod').ZodString>;
+            }, import('zod/v4/core').$strip>, "mutation", "admin", {
+                readonly kind: "system";
+            }>;
+        };
+        actionHandlers: {
+            mintJoinToken: (input: unknown) => Promise<{
+                token: string;
+                exp: number;
+                hubUrl: string;
+                hubMeshAddress: string;
+                caFingerprint: string;
+                nodeId?: string;
+            }>;
+        };
+    }>;
     protected onShutdown(): Promise<void>;
+    /**
+     * Boot: a stored `meshClearPort: off` is the operator's standing choice, so it
+     * is applied WITHOUT the agents gate (nobody is connected yet to be checked).
+     * Default `on` changes nothing.
+     */
+    private applyStoredClearPort;
+    private onMeshCaReady;
+    private mintJoinToken;
+    private resolveHubUrl;
+    private resolveHubMeshAddress;
     /** The keychain handle for owner `system`; `null` where there is no door. */
     private systemSecrets;
     private buildGlobalSchema;
@@ -19,6 +58,12 @@ export declare class SystemConfigAddon extends BaseAddon {
      * is REFUSED — never written inline (D787, P5). `meshAuth` is a plain value.
      */
     private writeClusterSection;
+    /**
+     * `cluster.meshClearPort`: `off` is REFUSED while any online agent still
+     * connects in clear (or the TLS listener is not up); the refusal names them.
+     * Persist, then apply — an `on` save always passes.
+     */
+    private writeMeshClearPort;
     /** `cluster.meshAuth` (D802), then republish it. */
     private writeMeshAuthMode;
     /**