@camstack/system 1.2.390 → 1.2.392

package/dist/builtins/system-config/mesh-actions.d.ts

@@ -1,31 +1,3 @@
-import { z } from 'zod';
-export declare const systemConfigMeshActions: {
-    mintJoinToken: import('@camstack/types').CustomActionSpec<z.ZodOptional<z.ZodObject<{
-        nodeId: z.ZodOptional<z.ZodString>;
-        hubUrl: z.ZodOptional<z.ZodString>;
-        hubMeshAddress: z.ZodOptional<z.ZodString>;
-        ttlSec: z.ZodOptional<z.ZodNumber>;
-    }, z.core.$strip>>, z.ZodObject<{
-        token: z.ZodString;
-        exp: z.ZodNumber;
-        hubUrl: z.ZodString;
-        hubMeshAddress: z.ZodString;
-        caFingerprint: z.ZodString;
-        nodeId: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>, "mutation", "admin", {
-        readonly kind: "system";
-    }>;
-    /** Hub admin → short-lived ticket the agent redeems for a tab session (D821). */
-    mintAgentUiUnlockTicket: import('@camstack/types').CustomActionSpec<z.ZodObject<{
-        nodeId: z.ZodString;
-        dashboardBaseUrl: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>, z.ZodObject<{
-        ticket: z.ZodString;
-        exp: z.ZodNumber;
-        nodeId: z.ZodString;
-        dashboardUrl: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>, "mutation", "admin", {
-        readonly kind: "system";
-    }>;
-};
+import { type CustomActionsSpec } from "@camstack/types";
+export declare const systemConfigMeshActions: CustomActionsSpec;
 export type SystemConfigMeshActions = typeof systemConfigMeshActions;

package/dist/builtins/system-config/system-config.addon.d.ts

@@ -1,105 +1,62 @@
-import { ConfigUISchemaWithValues, BaseAddon } from '@camstack/types';
+import type { AddonInitResult, ConfigUISchemaWithValues } from "@camstack/types";
+import { BaseAddon } from "@camstack/types";
+import { systemConfigMeshActions } from "./mesh-actions.js";
 /** The section id of the cluster form — System → Cluster renders only this one. */
 export declare const SYSTEM_CONFIG_CLUSTER_SECTION_ID = "system-config-cluster";
 export declare class SystemConfigAddon extends BaseAddon {
-    readonly id = "system-config";
-    private clusterSecretKeeper;
-    private meshCaKeeper;
-    constructor();
-    protected onInitialize(): Promise<{
-        customActions: {
-            mintJoinToken: import('@camstack/types').CustomActionSpec<import('zod').ZodOptional<import('zod').ZodObject<{
-                nodeId: import('zod').ZodOptional<import('zod').ZodString>;
-                hubUrl: import('zod').ZodOptional<import('zod').ZodString>;
-                hubMeshAddress: import('zod').ZodOptional<import('zod').ZodString>;
-                ttlSec: import('zod').ZodOptional<import('zod').ZodNumber>;
-            }, import('zod/v4/core').$strip>>, import('zod').ZodObject<{
-                token: import('zod').ZodString;
-                exp: import('zod').ZodNumber;
-                hubUrl: import('zod').ZodString;
-                hubMeshAddress: import('zod').ZodString;
-                caFingerprint: import('zod').ZodString;
-                nodeId: import('zod').ZodOptional<import('zod').ZodString>;
-            }, import('zod/v4/core').$strip>, "mutation", "admin", {
-                readonly kind: "system";
-            }>;
-            mintAgentUiUnlockTicket: import('@camstack/types').CustomActionSpec<import('zod').ZodObject<{
-                nodeId: import('zod').ZodString;
-                dashboardBaseUrl: import('zod').ZodOptional<import('zod').ZodString>;
-            }, import('zod/v4/core').$strip>, import('zod').ZodObject<{
-                ticket: import('zod').ZodString;
-                exp: import('zod').ZodNumber;
-                nodeId: import('zod').ZodString;
-                dashboardUrl: import('zod').ZodOptional<import('zod').ZodString>;
-            }, import('zod/v4/core').$strip>, "mutation", "admin", {
-                readonly kind: "system";
-            }>;
-        };
-        actionHandlers: {
-            mintJoinToken: (input: unknown) => Promise<{
-                token: string;
-                exp: number;
-                hubUrl: string;
-                hubMeshAddress: string;
-                caFingerprint: string;
-                nodeId?: string;
-            }>;
-            mintAgentUiUnlockTicket: (input: unknown) => Promise<{
-                ticket: string;
-                exp: number;
-                nodeId: string;
-                dashboardUrl?: string;
-            }>;
-        };
-    }>;
-    protected onShutdown(): Promise<void>;
-    /**
-     * Boot: a stored `meshClearPort: off` is the operator's standing choice, so it
-     * is applied WITHOUT the agents gate (nobody is connected yet to be checked).
-     * Default `on` changes nothing.
-     */
-    private applyStoredClearPort;
-    private onMeshCaReady;
-    private mintJoinToken;
-    /** D821 — short-lived ticket for the agent's `:4444` unlock session. */
-    private mintAgentUiUnlock;
-    private readAgentDashboardOrigins;
-    private resolveHubUrl;
-    private resolveHubMeshAddress;
-    /** The keychain handle for owner `system`; `null` where there is no door. */
-    private systemSecrets;
-    private buildGlobalSchema;
-    getGlobalSettings(): Promise<ConfigUISchemaWithValues>;
-    /**
-     * The admin UI / `addonSettings` cap prefer {@link BaseAddon.updateGlobalSettingsAsOperator}.
-     * That BaseAddon path writes the generic addon store and never reaches
-     * {@link writeClusterSection} / {@link writeMeshClearPort}. Route the operator
-     * write through the same section-aware path as {@link updateGlobalSettings}.
-     */
-    updateGlobalSettingsAsOperator(patch: Record<string, unknown>, _nodeId?: string): Promise<void>;
-    updateGlobalSettings(patch: Record<string, unknown>): Promise<void>;
-    /**
-     * The cluster secret's save path: the value goes to the keychain (owner
-     * `system`), the row gets the marker; `''` / a view keeps. `$secretClear` is
-     * REFUSED: the secret is mandatory (D802). A value the keychain cannot store
-     * is REFUSED — never written inline (D787, P5). Mesh auth mode is always
-     * enforced (D821) — a legacy `meshAuth` in the patch is ignored.
-     */
-    private writeClusterSection;
-    /**
-     * `cluster.meshClearPort`: `off` is REFUSED while any online agent still
-     * connects in clear (or the TLS listener is not up); the refusal names them.
-     * Persist, then apply — an `on` save always passes.
-     */
-    private writeMeshClearPort;
-    /** Persist + publish mesh auth mode (always `enforced` after D821). */
-    private writeMeshAuthMode;
-    /**
-     * First boot, or a keychain reset that cleared the marker (D802): a fresh
-     * random secret, stored like an operator save. Mesh auth stays enforced
-     * (D821) — every agent must present the secret; there is no transition window.
-     */
-    private generateClusterSecret;
-    private storeClusterSecret;
+	readonly id = "system-config";
+	private clusterSecretKeeper;
+	private meshCaKeeper;
+	constructor();
+	protected onInitialize(): Promise<AddonInitResult<typeof systemConfigMeshActions>>;
+	protected onShutdown(): Promise<void>;
+	/**
+	* Boot: a stored `meshClearPort: off` is the operator's standing choice, so it
+	* is applied WITHOUT the agents gate (nobody is connected yet to be checked).
+	* Default `on` changes nothing.
+	*/
+	private applyStoredClearPort;
+	private onMeshCaReady;
+	private mintJoinToken;
+	/** D821 — short-lived ticket for the agent's `:4444` unlock session. */
+	private mintAgentUiUnlock;
+	private readAgentDashboardOrigins;
+	private resolveHubUrl;
+	private resolveHubMeshAddress;
+	/** The keychain handle for owner `system`; `null` where there is no door. */
+	private systemSecrets;
+	private buildGlobalSchema;
+	getGlobalSettings(): Promise<ConfigUISchemaWithValues>;
+	/**
+	* The admin UI / `addonSettings` cap prefer {@link BaseAddon.updateGlobalSettingsAsOperator}.
+	* That BaseAddon path writes the generic addon store and never reaches
+	* {@link writeClusterSection} / {@link writeMeshClearPort}. Route the operator
+	* write through the same section-aware path as {@link updateGlobalSettings}.
+	*/
+	override updateGlobalSettingsAsOperator(patch: Record<string, unknown>, _nodeId?: string): Promise<void>;
+	updateGlobalSettings(patch: Record<string, unknown>): Promise<void>;
+	/**
+	* The cluster secret's save path: the value goes to the keychain (owner
+	* `system`), the row gets the marker; `''` / a view keeps. `$secretClear` is
+	* REFUSED: the secret is mandatory (D802). A value the keychain cannot store
+	* is REFUSED — never written inline (D787, P5). Mesh auth mode is always
+	* enforced (D821) — a legacy `meshAuth` in the patch is ignored.
+	*/
+	private writeClusterSection;
+	/**
+	* `cluster.meshClearPort`: `off` is REFUSED while any online agent still
+	* connects in clear (or the TLS listener is not up); the refusal names them.
+	* Persist, then apply — an `on` save always passes.
+	*/
+	private writeMeshClearPort;
+	/** Persist + publish mesh auth mode (always `enforced` after D821). */
+	private writeMeshAuthMode;
+	/**
+	* First boot, or a keychain reset that cleared the marker (D802): a fresh
+	* random secret, stored like an operator save. Mesh auth stays enforced
+	* (D821) — every agent must present the secret; there is no transition window.
+	*/
+	private generateClusterSecret;
+	private storeClusterSecret;
 }
 export default SystemConfigAddon;

package/dist/builtins/system-config/system-config.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-8LQ4lDEB.js");
+const require_dist = require("../../dist-XTkzsnz-.js");
 const require_ms$1 = require("../../ms-t68_FaqE.js");
-const require_constants$8 = require("../../constants-Ca-Sgcl8.js");
+const require_constants$8 = require("../../constants-D4lxxip7.js");
 const require_x509_es = require("../../x509.es-BhTzcFhZ.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -87476,7 +87476,7 @@ import_moleculer.default.Validators;
 * 6000. On a TLS socket, any packet whose `sender` ≠ the peer certificate CN
 * is dropped.
 */
-var TcpTransporter = Transporters.TCP;
+var TcpTransporterBase = Transporters.TCP;
 /**
 * Extract `sender` from a Moleculer TCP packet without fully trusting it —
 * used only to compare against the TLS peer CN.
@@ -87509,7 +87509,7 @@ function peerIdentity(socket) {
 		};
 	}
 }
-var TlsTcpTransporter = class extends TcpTransporter {
+var TlsTcpTransporter = class extends TcpTransporterBase {
 	tlsServer = null;
 	meshTls;
 	crl;
@@ -87966,41 +87966,45 @@ function errText(err) {
 * System → Cluster — mint a single-use mesh join token (Release A) and
 * agent-ui unlock tickets (D821).
 */
+var mintJoinTokenInputSchema = zod.z.object({
+	/** Optional pinned node id for the CSR CN. */
+	nodeId: zod.z.string().min(1).optional(),
+	/** Override hub HTTPS base (default: local-network publicEndpoint). */
+	hubUrl: zod.z.string().url().optional(),
+	/** Override `host:6000` clear mesh address carried in the token. */
+	hubMeshAddress: zod.z.string().min(3).optional(),
+	/** Seconds until expiry; capped at 1 h. */
+	ttlSec: zod.z.number().int().positive().max(3600).optional()
+}).optional();
+var mintJoinTokenOutputSchema = zod.z.object({
+	token: zod.z.string().min(1),
+	exp: zod.z.number().int(),
+	hubUrl: zod.z.string(),
+	hubMeshAddress: zod.z.string(),
+	caFingerprint: zod.z.string(),
+	nodeId: zod.z.string().optional()
+});
+var mintAgentUiUnlockInputSchema = zod.z.object({
+	nodeId: zod.z.string().min(1),
+	/**
+	* Preferred agent dashboard base (`http://host:4444`). When set, the
+	* answer includes `dashboardUrl` with `?ticket=` already attached.
+	*/
+	dashboardBaseUrl: zod.z.string().url().optional()
+});
+var mintAgentUiUnlockOutputSchema = zod.z.object({
+	ticket: zod.z.string().min(1),
+	exp: zod.z.number().int(),
+	nodeId: zod.z.string().min(1),
+	dashboardUrl: zod.z.string().url().optional()
+});
 var systemConfigMeshActions = require_dist.defineCustomActions({
-	mintJoinToken: require_dist.customAction(zod.z.object({
-		/** Optional pinned node id for the CSR CN. */
-		nodeId: zod.z.string().min(1).optional(),
-		/** Override hub HTTPS base (default: local-network publicEndpoint). */
-		hubUrl: zod.z.string().url().optional(),
-		/** Override `host:6000` clear mesh address carried in the token. */
-		hubMeshAddress: zod.z.string().min(3).optional(),
-		/** Seconds until expiry; capped at 1 h. */
-		ttlSec: zod.z.number().int().positive().max(3600).optional()
-	}).optional(), zod.z.object({
-		token: zod.z.string().min(1),
-		exp: zod.z.number().int(),
-		hubUrl: zod.z.string(),
-		hubMeshAddress: zod.z.string(),
-		caFingerprint: zod.z.string(),
-		nodeId: zod.z.string().optional()
-	}), {
+	mintJoinToken: require_dist.customAction(mintJoinTokenInputSchema, mintJoinTokenOutputSchema, {
 		kind: "mutation",
 		auth: "admin"
 	}),
 	/** Hub admin → short-lived ticket the agent redeems for a tab session (D821). */
-	mintAgentUiUnlockTicket: require_dist.customAction(zod.z.object({
-		nodeId: zod.z.string().min(1),
-		/**
-		* Preferred agent dashboard base (`http://host:4444`). When set, the
-		* answer includes `dashboardUrl` with `?ticket=` already attached.
-		*/
-		dashboardBaseUrl: zod.z.string().url().optional()
-	}), zod.z.object({
-		ticket: zod.z.string().min(1),
-		exp: zod.z.number().int(),
-		nodeId: zod.z.string().min(1),
-		dashboardUrl: zod.z.string().url().optional()
-	}), {
+	mintAgentUiUnlockTicket: require_dist.customAction(mintAgentUiUnlockInputSchema, mintAgentUiUnlockOutputSchema, {
 		kind: "mutation",
 		auth: "admin"
 	})
@@ -88362,7 +88366,7 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 						variant: "info"
 					},
 					{
-						type: "string",
+						type: "text",
 						key: AGENT_DASHBOARD_ORIGINS_FIELD,
 						label: "Agent dashboard origins (NPM)",
 						description: "Extra origins allowed for Continue-with-hub unlock redirects (comma-separated), e.g. https://agent.example.com. LAN agents on :4444 are always allowed."