@camstack/system 1.2.390 → 1.2.391

package/dist/builtins/system-backup/system-backup.service.d.ts

@@ -1,275 +1,275 @@
-import { ArchiveSqliteSnapshot, DatabaseSnapshotResult, IScopedLogger } from '@camstack/types';
-import { BACKUP_ENCRYPTION_SCHEME } from './backup-encryption.js';
+import { type ArchiveSqliteSnapshot, type DatabaseSnapshotResult, type IScopedLogger } from "@camstack/types";
+import { BACKUP_ENCRYPTION_SCHEME } from "./backup-encryption.js";
 /**
- * Thrown when an archive build (or a backup run driving one) is
- * stopped via its `AbortSignal`. Callers use `instanceof` to tell a
- * deliberate operator cancel from a real failure — a cancelled run is
- * an outcome, not an error to alert on. (D342)
- */
+* Thrown when an archive build (or a backup run driving one) is
+* stopped via its `AbortSignal`. Callers use `instanceof` to tell a
+* deliberate operator cancel from a real failure — a cancelled run is
+* an outcome, not an error to alert on. (D342)
+*/
 export declare class BackupCancelledError extends Error {
-    constructor(message?: string);
+	constructor(message?: string);
 }
 /**
- * Thrown when an archive would carry a live database and its owner could not
- * produce a verified snapshot of it (D693). Nothing was built: a run that
- * "succeeded" without the database — or with a torn copy of it — would push
- * the oldest good archive out of every destination's retention.
- */
+* Thrown when an archive would carry a live database and its owner could not
+* produce a verified snapshot of it (D693). Nothing was built: a run that
+* "succeeded" without the database — or with a torn copy of it — would push
+* the oldest good archive out of every destination's retention.
+*/
 export declare class BackupSnapshotRefusedError extends Error {
-    constructor(reason: string);
+	constructor(reason: string);
 }
 /**
- * Default set of paths considered part of a "system backup". Includes
- * everything that isn't pure backend code — config, sqlite, addons
- * (runtime overlay), addons-data (per-addon private dir), TLS certs,
- * auto-update marker.
- *
- * Anything not listed is excluded by omission — recordings/, media/,
- * models/, logs/, cache/ (too large or fully recreatable). Note this
- * covers only TOP-LEVEL trees: bulk nested INSIDE a listed location
- * is excluded via `DEFAULT_BACKUP_EXCLUDES` + the node_modules rule
- * below, enforced in the walk and the tar filter alike.
- */
+* Default set of paths considered part of a "system backup". Includes
+* everything that isn't pure backend code — config, sqlite, addons
+* (runtime overlay), addons-data (per-addon private dir), TLS certs,
+* auto-update marker.
+*
+* Anything not listed is excluded by omission — recordings/, media/,
+* models/, logs/, cache/ (too large or fully recreatable). Note this
+* covers only TOP-LEVEL trees: bulk nested INSIDE a listed location
+* is excluded via `DEFAULT_BACKUP_EXCLUDES` + the node_modules rule
+* below, enforced in the walk and the tar filter alike.
+*/
 export declare const DEFAULT_BACKUP_LOCATIONS: readonly ["config.yaml", "addons", "addons-data", "tls", "auto-update.json"];
 /**
- * Subtrees never captured by a system backup even though they live
- * under a `DEFAULT_BACKUP_LOCATIONS` entry. Paths are dataDir-relative
- * prefixes. Two lessons from the live hub (2026-09-04, D-record
- * "backup excludes"):
- *
- * - `addons-data/backup-orchestrator/staging` — the orchestrator's
- *   LEGACY staging dir (now `<dataDir>/backup-staging`, outside every
- *   location). Before Jul 28 every archive nested all previous
- *   archives (175M → 503M → 4.5G); leaked files from that era must
- *   never be re-swept into new backups.
- * - `addons-data/recorder/exports` — operator-exported clips (8.4 GB
- *   on the hub). Media, not system state; a restore has no use for it.
- */
+* Subtrees never captured by a system backup even though they live
+* under a `DEFAULT_BACKUP_LOCATIONS` entry. Paths are dataDir-relative
+* prefixes. Two lessons from the live hub (2026-09-04, D-record
+* "backup excludes"):
+*
+* - `addons-data/backup-orchestrator/staging` — the orchestrator's
+*   LEGACY staging dir (now `<dataDir>/backup-staging`, outside every
+*   location). Before Jul 28 every archive nested all previous
+*   archives (175M → 503M → 4.5G); leaked files from that era must
+*   never be re-swept into new backups.
+* - `addons-data/recorder/exports` — operator-exported clips (8.4 GB
+*   on the hub). Media, not system state; a restore has no use for it.
+*/
 export declare const DEFAULT_BACKUP_EXCLUDES: readonly ["addons-data/backup-orchestrator/staging", "addons-data/recorder/exports"];
 /**
- * True when a dataDir-relative path must be omitted from archives,
- * manifests and location stats. Accepts tar-style paths (`./` prefix,
- * trailing `/`) and backslash separators.
- */
+* True when a dataDir-relative path must be omitted from archives,
+* manifests and location stats. Accepts tar-style paths (`./` prefix,
+* trailing `/`) and backslash separators.
+*/
 export declare function isExcludedFromBackup(relPath: string): boolean;
 /**
- * The OWNER of the live databases in a data root (D693): it says which files
- * it snapshots, and writes the snapshot. `backup-orchestrator` answers it with
- * the `database-snapshot` capability, pinned to its own node.
- */
+* The OWNER of the live databases in a data root (D693): it says which files
+* it snapshots, and writes the snapshot. `backup-orchestrator` answers it with
+* the `database-snapshot` capability, pinned to its own node.
+*/
 export interface DatabaseOwner {
-    /** Absolute paths of the databases the owner snapshots. */
-    listDatabases(): Promise<readonly string[]>;
-    writeSnapshot(): Promise<DatabaseSnapshotResult>;
+	/** Absolute paths of the databases the owner snapshots. */
+	listDatabases(): Promise<readonly string[]>;
+	writeSnapshot(): Promise<DatabaseSnapshotResult>;
 }
 /** Path of the manifest file embedded inside every archive. */
 export declare const ARCHIVE_MANIFEST_NAME = ".camstack-backup-manifest.json";
-export type ArchiveEntryKind = 'file' | 'dir' | 'symlink';
+export type ArchiveEntryKind = "file" | "dir" | "symlink";
 export interface ArchiveEntry {
-    /** Path relative to the archive root (== relative to dataDir). */
-    readonly path: string;
-    readonly kind: ArchiveEntryKind;
-    /** Content bytes. 0 for dirs / symlinks. */
-    readonly sizeBytes: number;
-    /** ms epoch from filesystem mtime. */
-    readonly mtime: number;
+	/** Path relative to the archive root (== relative to dataDir). */
+	readonly path: string;
+	readonly kind: ArchiveEntryKind;
+	/** Content bytes. 0 for dirs / symlinks. */
+	readonly sizeBytes: number;
+	/** ms epoch from filesystem mtime. */
+	readonly mtime: number;
 }
 export interface ArchiveManifest {
-    archiveVersion: 1;
-    createdAt: number;
-    dataDir: string;
-    /**
-     * Mutable arrays — same shape as the zod-inferred type returned by
-     * `ArchiveManifestSchema.parse()`. `BaseAddon` providers receive
-     * this exact type via cap inputs, so making the interface readonly
-     * here would force callers to clone before forwarding.
-     */
-    locations: string[];
-    entries: ArchiveEntry[];
-    /** Sum of file `sizeBytes` (uncompressed). */
-    totalBytes: number;
-    totalFiles: number;
-    /**
-     * Live databases carried as their owner's verified snapshot instead of as
-     * files (D693). Paths are archive-relative.
-     */
-    sqliteSnapshots?: ArchiveSqliteSnapshot[];
+	archiveVersion: 1;
+	createdAt: number;
+	dataDir: string;
+	/**
+	* Mutable arrays — same shape as the zod-inferred type returned by
+	* `ArchiveManifestSchema.parse()`. `BaseAddon` providers receive
+	* this exact type via cap inputs, so making the interface readonly
+	* here would force callers to clone before forwarding.
+	*/
+	locations: string[];
+	entries: ArchiveEntry[];
+	/** Sum of file `sizeBytes` (uncompressed). */
+	totalBytes: number;
+	totalFiles: number;
+	/**
+	* Live databases carried as their owner's verified snapshot instead of as
+	* files (D693). Paths are archive-relative.
+	*/
+	sqliteSnapshots?: ArchiveSqliteSnapshot[];
 }
 /** How an archive was encrypted — absent on a plain `.tar.gz`. */
 export interface ArchiveEncryption {
-    readonly scheme: typeof BACKUP_ENCRYPTION_SCHEME;
-    /** The backup key the archive needs to be restored. */
-    readonly keyId: string;
+	readonly scheme: typeof BACKUP_ENCRYPTION_SCHEME;
+	/** The backup key the archive needs to be restored. */
+	readonly keyId: string;
 }
 export interface CreateArchiveResult {
-    archivePath: string;
-    includedLocations: readonly string[];
-    /** Archive size in bytes (compressed — and encrypted, when it is — on disk). */
-    sizeBytes: number;
-    /** Present when the archive is encrypted to a backup key. */
-    encryption?: ArchiveEncryption;
-    /** Embedded manifest — same shape as `getArchiveManifest()`. */
-    manifest: ArchiveManifest;
+	archivePath: string;
+	includedLocations: readonly string[];
+	/** Archive size in bytes (compressed — and encrypted, when it is — on disk). */
+	sizeBytes: number;
+	/** Present when the archive is encrypted to a backup key. */
+	encryption?: ArchiveEncryption;
+	/** Embedded manifest — same shape as `getArchiveManifest()`. */
+	manifest: ArchiveManifest;
 }
 export interface RestoreMarker {
-    archivePath: string;
-    requestedAt: number;
-    /** Caller-supplied identifier (e.g. backup id) for traceability. */
-    source: string;
-    /**
-     * Optional whitelist of top-level locations to restore from the
-     * archive. When omitted the boot-time hook applies everything in
-     * the archive (full restore — same as the legacy behavior).
-     */
-    locations?: readonly string[];
+	archivePath: string;
+	requestedAt: number;
+	/** Caller-supplied identifier (e.g. backup id) for traceability. */
+	source: string;
+	/**
+	* Optional whitelist of top-level locations to restore from the
+	* archive. When omitted the boot-time hook applies everything in
+	* the archive (full restore — same as the legacy behavior).
+	*/
+	locations?: readonly string[];
 }
 export interface LocationStat {
-    readonly name: string;
-    readonly sizeBytes: number;
-    readonly fileCount: number;
-    /** False when the location doesn't exist under dataDir. */
-    readonly present: boolean;
+	readonly name: string;
+	readonly sizeBytes: number;
+	readonly fileCount: number;
+	/** False when the location doesn't exist under dataDir. */
+	readonly present: boolean;
 }
 export interface SystemBackupServiceOptions {
-    /**
-     * How long a `statLocations` walk result stays fresh. The `addons`
-     * location holds tens of thousands of files; without a cache every
-     * admin-UI visit re-walks it.
-     */
-    readonly statCacheTtlMs?: number;
+	/**
+	* How long a `statLocations` walk result stays fresh. The `addons`
+	* location holds tens of thousands of files; without a cache every
+	* admin-UI visit re-walks it.
+	*/
+	readonly statCacheTtlMs?: number;
 }
 /**
- * System-level archive primitives. Construct one per server boot;
- * methods are pure I/O.
- */
+* System-level archive primitives. Construct one per server boot;
+* methods are pure I/O.
+*/
 export declare class SystemBackupService {
-    private readonly dataDir;
-    private readonly logger;
-    private readonly statCacheTtlMs;
-    private readonly statCache;
-    constructor(dataDir: string, logger: IScopedLogger, opts?: SystemBackupServiceOptions);
-    /**
-     * Snapshot the current size + file count of each well-known
-     * location. Used by the admin UI to render an opt-in checklist
-     * before triggering a backup, and by `createArchive` to derive the
-     * embedded manifest.
-     *
-     * The walk is async (yields to the event loop per directory) and
-     * per-location results are cached + single-flighted: the service
-     * runs in-process in the hub, and a synchronous walk of the 70k+
-     * file `addons` location blocked the event loop long enough to kill
-     * WS keepalives cluster-wide.
-     */
-    statLocations(locations?: readonly string[]): Promise<readonly LocationStat[]>;
-    private statLocationCached;
-    private statLocation;
-    /**
-     * Create a tar.gz of the given locations. Uses the `tar` npm package
-     * (used by npm itself) instead of shelling out — gives us:
-     *
-     *   - Symlink dereference (`follow: true`) so dev mode's
-     *     `addons/<name> → packages/<name>` overlay archives content,
-     *     not just link stubs.
-     *   - Programmatic walk → we build a manifest of every entry while
-     *     copying so the archive can self-describe.
-     *
-     * Locations that don't exist are silently skipped. Throws if zero
-     * locations would be included.
-     *
-     * Cancellation: `signal` aborts the build IN FLIGHT — the manifest
-     * walk checks it per filesystem node and the tar phase runs through
-     * `stream.pipeline(..., { signal })`, which destroys the pack and
-     * the file sink immediately. On abort the half-written archive is
-     * deleted here (never left for the caller to remember) and the call
-     * rejects with {@link BackupCancelledError}. (D342)
-     *
-     * Progress: `onArchiveBytes` receives the cumulative compressed
-     * bytes written to `archivePath` — the live "how large has staging
-     * grown" counter `backup.listRuns` exposes.
-     */
-    createArchive(opts: {
-        archivePath: string;
-        locations?: readonly string[];
-        signal?: AbortSignal;
-        onArchiveBytes?: (bytesWritten: number) => void;
-        /**
-         * The OWNER of the data root's live databases (D693). Asked only when the
-         * walk finds a SQLite file: which databases it owns (authoritative — a
-         * cleanly closed database has no sidecar and is just as owned), then for
-         * one verified snapshot. Each owned database in scope is archived as that
-         * snapshot in place of its `.db` / `-wal` / `-shm` / `-journal`, and the
-         * snapshot is deleted once the archive is built.
-         *
-         * Nothing is built — {@link BackupSnapshotRefusedError} — when the owner
-         * fails, or when a live database (one with a sidecar) has no owner: an
-         * archive without the settings database must never reach a destination,
-         * because its upload prunes an older archive that HAS it.
-         */
-        owner?: DatabaseOwner;
-        /**
-         * A backup PUBLIC key: the gzip stream is encrypted to it as it is
-         * written, so no plaintext archive ever touches the staging disk. Parsed
-         * before any work — a bad key builds nothing.
-         */
-        encryptTo?: string;
-    }): Promise<CreateArchiveResult>;
-    /**
-     * Tar `present` (filtered by `excluded`) plus the staged manifest into
-     * `archivePath`.
-     */
-    private writeArchive;
-    /**
-     * without extracting payload files. Streams the tar.gz, parses the
-     * one entry we care about, then aborts.
-     */
-    readArchiveManifest(archivePath: string): Promise<ArchiveManifest | null>;
-    /**
-     * Schedule a restore for the next boot by writing a marker file.
-     * `locations` (optional) carries through to the launcher's boot-time
-     * restore (`server/backend/src/launcher.ts`, the only restore there is)
-     * so the operator's "restore only X and Y" choice survives the process
-     * restart.
-     */
-    scheduleRestoreMarker(opts: {
-        archivePath: string;
-        source: string;
-        locations?: readonly string[];
-    }): string;
-    /** Read the pending-restore marker if one is present. */
-    readPendingMarker(): RestoreMarker | null;
-    /** Drop the marker after a successful boot-time restore. */
-    clearPendingMarker(): void;
-    /**
-     * The databases the owner declares, archive-relative, that this walk found.
-     * One outside this data root is not in scope. An owner that cannot answer
-     * stops the archive: without the answer, nothing says which file is live.
-     */
-    private ownedDatabasesInScope;
-    /**
-     * Ask the owner for its snapshot, and place it in this archive. The snapshot
-     * must sit on THIS data root — the call is pinned to this node, so a path
-     * elsewhere means it reached another host, and that file is not ours to
-     * read — beside an owned database in scope, and it must cover EVERY owned
-     * database in scope. Anything else is refused.
-     *
-     * Only ever DELETED here: `<owned db>.backup-snapshot` under this data root,
-     * a name this process derives itself. A path the owner ANSWERS is never
-     * deleted on its word — answering the live database as the snapshot would
-     * otherwise delete the live database. A file at any other path is left to
-     * the owner's own sweep.
-     *
-     * A cancel is honoured while the owner is still copying; the copy it may
-     * finish afterwards is removed when that call settles.
-     */
-    private takeOwnerSnapshot;
-    private removeSnapshot;
-    /** `abs` relative to the data root, or null when it lies outside it. */
-    private archiveRelative;
-    private getRestoreMarkerPath;
-    /**
-     * Absolute-path form of {@link isExcludedFromBackup}, anchored on
-     * this service's dataDir. Shared by the manifest walk and the location
-     * stats so both agree with the tar filter about what a backup contains.
-     */
-    private exclusionPredicate;
+	private readonly dataDir;
+	private readonly logger;
+	private readonly statCacheTtlMs;
+	private readonly statCache;
+	constructor(dataDir: string, logger: IScopedLogger, opts?: SystemBackupServiceOptions);
+	/**
+	* Snapshot the current size + file count of each well-known
+	* location. Used by the admin UI to render an opt-in checklist
+	* before triggering a backup, and by `createArchive` to derive the
+	* embedded manifest.
+	*
+	* The walk is async (yields to the event loop per directory) and
+	* per-location results are cached + single-flighted: the service
+	* runs in-process in the hub, and a synchronous walk of the 70k+
+	* file `addons` location blocked the event loop long enough to kill
+	* WS keepalives cluster-wide.
+	*/
+	statLocations(locations?: readonly string[]): Promise<readonly LocationStat[]>;
+	private statLocationCached;
+	private statLocation;
+	/**
+	* Create a tar.gz of the given locations. Uses the `tar` npm package
+	* (used by npm itself) instead of shelling out — gives us:
+	*
+	*   - Symlink dereference (`follow: true`) so dev mode's
+	*     `addons/<name> → packages/<name>` overlay archives content,
+	*     not just link stubs.
+	*   - Programmatic walk → we build a manifest of every entry while
+	*     copying so the archive can self-describe.
+	*
+	* Locations that don't exist are silently skipped. Throws if zero
+	* locations would be included.
+	*
+	* Cancellation: `signal` aborts the build IN FLIGHT — the manifest
+	* walk checks it per filesystem node and the tar phase runs through
+	* `stream.pipeline(..., { signal })`, which destroys the pack and
+	* the file sink immediately. On abort the half-written archive is
+	* deleted here (never left for the caller to remember) and the call
+	* rejects with {@link BackupCancelledError}. (D342)
+	*
+	* Progress: `onArchiveBytes` receives the cumulative compressed
+	* bytes written to `archivePath` — the live "how large has staging
+	* grown" counter `backup.listRuns` exposes.
+	*/
+	createArchive(opts: {
+		archivePath: string;
+		locations?: readonly string[];
+		signal?: AbortSignal;
+		onArchiveBytes?: (bytesWritten: number) => void;
+		/**
+		* The OWNER of the data root's live databases (D693). Asked only when the
+		* walk finds a SQLite file: which databases it owns (authoritative — a
+		* cleanly closed database has no sidecar and is just as owned), then for
+		* one verified snapshot. Each owned database in scope is archived as that
+		* snapshot in place of its `.db` / `-wal` / `-shm` / `-journal`, and the
+		* snapshot is deleted once the archive is built.
+		*
+		* Nothing is built — {@link BackupSnapshotRefusedError} — when the owner
+		* fails, or when a live database (one with a sidecar) has no owner: an
+		* archive without the settings database must never reach a destination,
+		* because its upload prunes an older archive that HAS it.
+		*/
+		owner?: DatabaseOwner;
+		/**
+		* A backup PUBLIC key: the gzip stream is encrypted to it as it is
+		* written, so no plaintext archive ever touches the staging disk. Parsed
+		* before any work — a bad key builds nothing.
+		*/
+		encryptTo?: string;
+	}): Promise<CreateArchiveResult>;
+	/**
+	* Tar `present` (filtered by `excluded`) plus the staged manifest into
+	* `archivePath`.
+	*/
+	private writeArchive;
+	/**
+	* without extracting payload files. Streams the tar.gz, parses the
+	* one entry we care about, then aborts.
+	*/
+	readArchiveManifest(archivePath: string): Promise<ArchiveManifest | null>;
+	/**
+	* Schedule a restore for the next boot by writing a marker file.
+	* `locations` (optional) carries through to the launcher's boot-time
+	* restore (`server/backend/src/launcher.ts`, the only restore there is)
+	* so the operator's "restore only X and Y" choice survives the process
+	* restart.
+	*/
+	scheduleRestoreMarker(opts: {
+		archivePath: string;
+		source: string;
+		locations?: readonly string[];
+	}): string;
+	/** Read the pending-restore marker if one is present. */
+	readPendingMarker(): RestoreMarker | null;
+	/** Drop the marker after a successful boot-time restore. */
+	clearPendingMarker(): void;
+	/**
+	* The databases the owner declares, archive-relative, that this walk found.
+	* One outside this data root is not in scope. An owner that cannot answer
+	* stops the archive: without the answer, nothing says which file is live.
+	*/
+	private ownedDatabasesInScope;
+	/**
+	* Ask the owner for its snapshot, and place it in this archive. The snapshot
+	* must sit on THIS data root — the call is pinned to this node, so a path
+	* elsewhere means it reached another host, and that file is not ours to
+	* read — beside an owned database in scope, and it must cover EVERY owned
+	* database in scope. Anything else is refused.
+	*
+	* Only ever DELETED here: `<owned db>.backup-snapshot` under this data root,
+	* a name this process derives itself. A path the owner ANSWERS is never
+	* deleted on its word — answering the live database as the snapshot would
+	* otherwise delete the live database. A file at any other path is left to
+	* the owner's own sweep.
+	*
+	* A cancel is honoured while the owner is still copying; the copy it may
+	* finish afterwards is removed when that call settles.
+	*/
+	private takeOwnerSnapshot;
+	private removeSnapshot;
+	/** `abs` relative to the data root, or null when it lies outside it. */
+	private archiveRelative;
+	private getRestoreMarkerPath;
+	/**
+	* Absolute-path form of {@link isExcludedFromBackup}, anchored on
+	* this service's dataDir. Shared by the manifest walk and the location
+	* stats so both agree with the tar filter about what a backup contains.
+	*/
+	private exclusionPredicate;
 }

package/dist/builtins/system-config/cluster-secret-keeper.d.ts

@@ -1,43 +1,63 @@
-import { SecretsAccess } from '@camstack/types';
+/**
+* Keeps the hub's cluster-secret gate in step with System → Cluster (D797,
+* D802).
+*
+* The field is a `password` of `system-config`: its `system-settings` row
+* (`cluster.clusterSecret`) holds a keychain marker, the value lives in the
+* keychain (owner `system`). The gate the mesh join reads:
+*
+*  - no marker            → the secret is MANDATORY (D802): the keeper asks
+*                           its owner to generate one (`generateSecret`), and
+*                           until that succeeds the gate is `off` — no node can
+*                           authenticate (mesh auth is always enforced, D821);
+*  - marker + value       → `on`  — nodes prove the secret;
+*  - marker, no answer    → `unknown` — refused, retryably, and retried here.
+*    A locked keychain or a value lost to a reset NEVER opens the gate, and
+*    never triggers a generation (the operator decides what replaces a value
+*    the keychain lost).
+*
+* It also publishes the mesh mode (`cluster.meshAuth`, `mesh-auth-mode.ts`).
+*/
+import { type SecretsAccess } from "@camstack/types";
 /** The field key inside the `cluster` section. */
 export declare const CLUSTER_SECRET_FIELD = "clusterSecret";
-export declare const CLUSTER_SECRET_RETRY_MS = 30000;
+export declare const CLUSTER_SECRET_RETRY_MS = 3e4;
 interface KeeperLogger {
-    info(message: string, meta?: {
-        meta?: Record<string, unknown>;
-    }): void;
-    error(message: string, meta?: {
-        meta?: Record<string, unknown>;
-    }): void;
+	info(message: string, meta?: {
+		meta?: Record<string, unknown>;
+	}): void;
+	error(message: string, meta?: {
+		meta?: Record<string, unknown>;
+	}): void;
 }
 export interface ClusterSecretKeeperDeps {
-    /** Keychain handle for owner `system`; `null` without a keychain door. */
-    readonly secrets: SecretsAccess | null;
-    /** The stored `cluster` section (markers, never values). Throws when unreadable. */
-    readonly readSection: () => Promise<Record<string, unknown>>;
-    readonly logger: KeeperLogger;
-    readonly retryMs?: number;
-    /**
-     * Generate and store a new secret (D802). Called when no marker is stored.
-     * Throws when it cannot (no keychain, locked): the keeper retries on its
-     * timer. Absent → nothing is generated (tests of the D797 states).
-     */
-    readonly generateSecret?: () => Promise<void>;
+	/** Keychain handle for owner `system`; `null` without a keychain door. */
+	readonly secrets: SecretsAccess | null;
+	/** The stored `cluster` section (markers, never values). Throws when unreadable. */
+	readonly readSection: () => Promise<Record<string, unknown>>;
+	readonly logger: KeeperLogger;
+	readonly retryMs?: number;
+	/**
+	* Generate and store a new secret (D802). Called when no marker is stored.
+	* Throws when it cannot (no keychain, locked): the keeper retries on its
+	* timer. Absent → nothing is generated (tests of the D797 states).
+	*/
+	readonly generateSecret?: () => Promise<void>;
 }
 export declare class ClusterSecretKeeper {
-    private readonly deps;
-    private retryTimer;
-    private unsubscribe;
-    private stopped;
-    private last;
-    constructor(deps: ClusterSecretKeeperDeps);
-    start(): Promise<void>;
-    stop(): void;
-    /** Re-read the row and the keychain; publish the gate. */
-    reload(): Promise<void>;
-    private generate;
-    private compute;
-    private report;
-    private scheduleRetry;
+	private readonly deps;
+	private retryTimer;
+	private unsubscribe;
+	private stopped;
+	private last;
+	constructor(deps: ClusterSecretKeeperDeps);
+	start(): Promise<void>;
+	stop(): void;
+	/** Re-read the row and the keychain; publish the gate. */
+	reload(): Promise<void>;
+	private generate;
+	private compute;
+	private report;
+	private scheduleRetry;
 }
 export {};

package/dist/builtins/system-config/index.d.ts

@@ -1,2 +1,2 @@
-export { SystemConfigAddon, default } from './system-config.addon.js';
-export { systemConfigMeshActions, systemConfigMeshActions as customActions, } from './mesh-actions.js';
+export { SystemConfigAddon, default } from "./system-config.addon.js";
+export { systemConfigMeshActions, systemConfigMeshActions as customActions } from "./mesh-actions.js";