@camstack/system 1.2.394 → 1.2.396

package/dist/builtins/system-config/system-config.addon.d.ts

@@ -7,6 +7,8 @@ export declare class SystemConfigAddon extends BaseAddon {
 	readonly id = "system-config";
 	private clusterSecretKeeper;
 	private meshCaKeeper;
+	/** One warn per process when a retired cutover key is posted with a cluster save. */
+	private retiredClusterCutoverPatchWarned;
 	constructor();
 	protected onInitialize(): Promise<AddonInitResult<typeof systemConfigMeshActions>>;
 	protected onShutdown(): Promise<void>;
@@ -30,7 +32,7 @@ export declare class SystemConfigAddon extends BaseAddon {
 	/**
 	* The admin UI / `addonSettings` cap prefer {@link BaseAddon.updateGlobalSettingsAsOperator}.
 	* That BaseAddon path writes the generic addon store and never reaches
-	* {@link writeClusterSection} / {@link writeMeshClearPort}. Route the operator
+	* {@link writeClusterSection}. Route the operator
 	* write through the same section-aware path as {@link updateGlobalSettings}.
 	*/
 	override updateGlobalSettingsAsOperator(patch: Record<string, unknown>, _nodeId?: string): Promise<void>;
@@ -43,12 +45,8 @@ export declare class SystemConfigAddon extends BaseAddon {
 	* enforced (D821) — a legacy `meshAuth` in the patch is ignored.
 	*/
 	private writeClusterSection;
-	/**
-	* `cluster.meshClearPort`: `off` is REFUSED while any online agent still
-	* connects in clear (or the TLS listener is not up); the refusal names them.
-	* Persist, then apply — an `on` save always passes.
-	*/
-	private writeMeshClearPort;
+	/** Cutover keys were removed from the Cluster form; ignore stray posts from stale clients. */
+	private warnRetiredClusterCutoverPatch;
 	/** Persist + publish mesh auth mode (always `enforced` after D821). */
 	private writeMeshAuthMode;
 	/**

package/dist/builtins/system-config/system-config.addon.js

@@ -88102,6 +88102,8 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 	id = "system-config";
 	clusterSecretKeeper = null;
 	meshCaKeeper = null;
+	/** One warn per process when a retired cutover key is posted with a cluster save. */
+	retiredClusterCutoverPatchWarned = false;
 	constructor() {
 		super({});
 	}
@@ -88337,52 +88339,18 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 				title: SECTION_TITLES["cluster"],
 				description: "Agents joining this hub. Every agent proves the cluster secret when it connects (challenge–response; the secret never crosses the network).",
 				columns: 1,
-				fields: [
-					{
-						type: "password",
-						key: CLUSTER_SECRET_FIELD,
-						label: "Cluster secret",
-						description: "Mandatory — generated by the hub at first boot and stored in the keychain. To pair an agent: Reveal and copy it here, then enter it in the agent (its status page, or the desktop setup window). Saving a new value rotates it: every agent must then be given the new one."
-					},
-					{
-						type: "select",
-						key: MESH_CLEAR_PORT_FIELD,
-						label: "Clear mesh port (:6000)",
-						description: "On keeps the clear TCP port and UDP discovery next to the TLS port (:6443). Off closes both — refused while any connected agent has not enrolled with a join token (the Cluster page shows TLS / clear per node).",
-						default: "on",
-						options: [{
-							value: "on",
-							label: "On — accept clear agents"
-						}, {
-							value: "off",
-							label: "Off — mutual TLS only"
-						}]
-					},
-					{
-						type: "info",
-						key: "meshAuthStatus",
-						label: "Mesh authentication",
-						content: describeMeshStatus(getProcessMeshAuthStatus()),
-						variant: "info"
-					},
-					{
-						type: "text",
-						key: AGENT_DASHBOARD_ORIGINS_FIELD,
-						label: "Agent dashboard origins (NPM)",
-						description: "Extra origins allowed for Continue-with-hub unlock redirects (comma-separated), e.g. https://agent.example.com. LAN agents on :4444 are always allowed."
-					},
-					{
-						type: "addon-action-button",
-						key: "mintJoinTokenAction",
-						label: "Add agent",
-						description: "Mint a single-use join token (≤ 1 hour). Paste it into the agent setup instead of copying the cluster secret. The token is shown once in the result.",
-						addonId: "system-config",
-						action: "mintJoinToken",
-						buttonLabel: "Add agent",
-						variant: "primary",
-						successMessage: "Join token (copy now): {token}"
-					}
-				]
+				fields: [{
+					type: "password",
+					key: CLUSTER_SECRET_FIELD,
+					label: "Cluster secret",
+					description: "Mandatory — generated by the hub at first boot and stored in the keychain. To pair an agent: Reveal and copy it here, then enter it in the agent (its status page, or the desktop setup window). Saving a new value rotates it: every agent must then be given the new one."
+				}, {
+					type: "info",
+					key: "meshAuthStatus",
+					label: "Mesh authentication",
+					content: describeMeshStatus(getProcessMeshAuthStatus()),
+					variant: "info"
+				}]
 			}
 		] };
 	}
@@ -88406,7 +88374,7 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 	/**
 	* The admin UI / `addonSettings` cap prefer {@link BaseAddon.updateGlobalSettingsAsOperator}.
 	* That BaseAddon path writes the generic addon store and never reaches
-	* {@link writeClusterSection} / {@link writeMeshClearPort}. Route the operator
+	* {@link writeClusterSection}. Route the operator
 	* write through the same section-aware path as {@link updateGlobalSettings}.
 	*/
 	async updateGlobalSettingsAsOperator(patch, _nodeId) {
@@ -88457,8 +88425,7 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 	*/
 	async writeClusterSection(patch) {
 		const { [MESH_AUTH_MODE_FIELD]: _legacyMode, [MESH_CLEAR_PORT_FIELD]: clearPort, [AGENT_DASHBOARD_ORIGINS_FIELD]: dashboardOrigins, ...secretPatch } = patch;
-		if (clearPort !== void 0) await this.writeMeshClearPort(clearPort);
-		if (dashboardOrigins !== void 0) await this.ctx.settings.setSection("cluster", { [AGENT_DASHBOARD_ORIGINS_FIELD]: typeof dashboardOrigins === "string" ? dashboardOrigins : "" });
+		if (clearPort !== void 0 || dashboardOrigins !== void 0) this.warnRetiredClusterCutoverPatch(clearPort !== void 0, dashboardOrigins !== void 0);
 		await this.writeMeshAuthMode("enforced");
 		if (Object.keys(secretPatch).length === 0) return;
 		if (require_dist.isSecretClear(secretPatch["clusterSecret"])) throw new Error("The cluster secret is mandatory and cannot be cleared — save a new value to rotate it");
@@ -88466,26 +88433,14 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		this.ctx.logger.info("Cluster secret updated");
 		await this.clusterSecretKeeper?.reload();
 	}
-	/**
-	* `cluster.meshClearPort`: `off` is REFUSED while any online agent still
-	* connects in clear (or the TLS listener is not up); the refusal names them.
-	* Persist, then apply — an `on` save always passes.
-	*/
-	async writeMeshClearPort(value) {
-		if (!isMeshClearPortMode(value)) throw new Error(`system-config: meshClearPort must be 'on' or 'off'`);
-		const stored = (await this.ctx.settings.getSection("cluster"))[MESH_CLEAR_PORT_FIELD];
-		if (parseMeshClearPortMode(stored) === value) return;
-		const decision = checkProcessMeshClearPort(value);
-		if (!decision.allowed) {
-			this.ctx.logger.warn("mesh clear port switch-off refused", { meta: {
-				blocking: decision.blocking,
-				error: decision.error
-			} });
-			throw new Error(decision.error);
-		}
-		await this.ctx.settings.setSection("cluster", { [MESH_CLEAR_PORT_FIELD]: value });
-		await applyProcessMeshClearPort(value);
-		this.ctx.logger.info("Mesh clear port switched", { meta: { mode: value } });
+	/** Cutover keys were removed from the Cluster form; ignore stray posts from stale clients. */
+	warnRetiredClusterCutoverPatch(hadMeshClearPort, hadAgentDashboardOrigins) {
+		if (this.retiredClusterCutoverPatchWarned) return;
+		this.retiredClusterCutoverPatchWarned = true;
+		this.ctx.logger.warn("cluster save ignored retired cutover field(s) — use Pipeline → Cluster / Nodes", { meta: {
+			meshClearPort: hadMeshClearPort,
+			agentDashboardOrigins: hadAgentDashboardOrigins
+		} });
 	}
 	/** Persist + publish mesh auth mode (always `enforced` after D821). */
 	async writeMeshAuthMode(mode) {

package/dist/builtins/system-config/system-config.addon.mjs

@@ -88092,6 +88092,8 @@ var SystemConfigAddon = class extends BaseAddon {
 	id = "system-config";
 	clusterSecretKeeper = null;
 	meshCaKeeper = null;
+	/** One warn per process when a retired cutover key is posted with a cluster save. */
+	retiredClusterCutoverPatchWarned = false;
 	constructor() {
 		super({});
 	}
@@ -88327,52 +88329,18 @@ var SystemConfigAddon = class extends BaseAddon {
 				title: SECTION_TITLES["cluster"],
 				description: "Agents joining this hub. Every agent proves the cluster secret when it connects (challenge–response; the secret never crosses the network).",
 				columns: 1,
-				fields: [
-					{
-						type: "password",
-						key: CLUSTER_SECRET_FIELD,
-						label: "Cluster secret",
-						description: "Mandatory — generated by the hub at first boot and stored in the keychain. To pair an agent: Reveal and copy it here, then enter it in the agent (its status page, or the desktop setup window). Saving a new value rotates it: every agent must then be given the new one."
-					},
-					{
-						type: "select",
-						key: MESH_CLEAR_PORT_FIELD,
-						label: "Clear mesh port (:6000)",
-						description: "On keeps the clear TCP port and UDP discovery next to the TLS port (:6443). Off closes both — refused while any connected agent has not enrolled with a join token (the Cluster page shows TLS / clear per node).",
-						default: "on",
-						options: [{
-							value: "on",
-							label: "On — accept clear agents"
-						}, {
-							value: "off",
-							label: "Off — mutual TLS only"
-						}]
-					},
-					{
-						type: "info",
-						key: "meshAuthStatus",
-						label: "Mesh authentication",
-						content: describeMeshStatus(getProcessMeshAuthStatus()),
-						variant: "info"
-					},
-					{
-						type: "text",
-						key: AGENT_DASHBOARD_ORIGINS_FIELD,
-						label: "Agent dashboard origins (NPM)",
-						description: "Extra origins allowed for Continue-with-hub unlock redirects (comma-separated), e.g. https://agent.example.com. LAN agents on :4444 are always allowed."
-					},
-					{
-						type: "addon-action-button",
-						key: "mintJoinTokenAction",
-						label: "Add agent",
-						description: "Mint a single-use join token (≤ 1 hour). Paste it into the agent setup instead of copying the cluster secret. The token is shown once in the result.",
-						addonId: "system-config",
-						action: "mintJoinToken",
-						buttonLabel: "Add agent",
-						variant: "primary",
-						successMessage: "Join token (copy now): {token}"
-					}
-				]
+				fields: [{
+					type: "password",
+					key: CLUSTER_SECRET_FIELD,
+					label: "Cluster secret",
+					description: "Mandatory — generated by the hub at first boot and stored in the keychain. To pair an agent: Reveal and copy it here, then enter it in the agent (its status page, or the desktop setup window). Saving a new value rotates it: every agent must then be given the new one."
+				}, {
+					type: "info",
+					key: "meshAuthStatus",
+					label: "Mesh authentication",
+					content: describeMeshStatus(getProcessMeshAuthStatus()),
+					variant: "info"
+				}]
 			}
 		] };
 	}
@@ -88396,7 +88364,7 @@ var SystemConfigAddon = class extends BaseAddon {
 	/**
 	* The admin UI / `addonSettings` cap prefer {@link BaseAddon.updateGlobalSettingsAsOperator}.
 	* That BaseAddon path writes the generic addon store and never reaches
-	* {@link writeClusterSection} / {@link writeMeshClearPort}. Route the operator
+	* {@link writeClusterSection}. Route the operator
 	* write through the same section-aware path as {@link updateGlobalSettings}.
 	*/
 	async updateGlobalSettingsAsOperator(patch, _nodeId) {
@@ -88447,8 +88415,7 @@ var SystemConfigAddon = class extends BaseAddon {
 	*/
 	async writeClusterSection(patch) {
 		const { [MESH_AUTH_MODE_FIELD]: _legacyMode, [MESH_CLEAR_PORT_FIELD]: clearPort, [AGENT_DASHBOARD_ORIGINS_FIELD]: dashboardOrigins, ...secretPatch } = patch;
-		if (clearPort !== void 0) await this.writeMeshClearPort(clearPort);
-		if (dashboardOrigins !== void 0) await this.ctx.settings.setSection("cluster", { [AGENT_DASHBOARD_ORIGINS_FIELD]: typeof dashboardOrigins === "string" ? dashboardOrigins : "" });
+		if (clearPort !== void 0 || dashboardOrigins !== void 0) this.warnRetiredClusterCutoverPatch(clearPort !== void 0, dashboardOrigins !== void 0);
 		await this.writeMeshAuthMode("enforced");
 		if (Object.keys(secretPatch).length === 0) return;
 		if (isSecretClear(secretPatch["clusterSecret"])) throw new Error("The cluster secret is mandatory and cannot be cleared — save a new value to rotate it");
@@ -88456,26 +88423,14 @@ var SystemConfigAddon = class extends BaseAddon {
 		this.ctx.logger.info("Cluster secret updated");
 		await this.clusterSecretKeeper?.reload();
 	}
-	/**
-	* `cluster.meshClearPort`: `off` is REFUSED while any online agent still
-	* connects in clear (or the TLS listener is not up); the refusal names them.
-	* Persist, then apply — an `on` save always passes.
-	*/
-	async writeMeshClearPort(value) {
-		if (!isMeshClearPortMode(value)) throw new Error(`system-config: meshClearPort must be 'on' or 'off'`);
-		const stored = (await this.ctx.settings.getSection("cluster"))[MESH_CLEAR_PORT_FIELD];
-		if (parseMeshClearPortMode(stored) === value) return;
-		const decision = checkProcessMeshClearPort(value);
-		if (!decision.allowed) {
-			this.ctx.logger.warn("mesh clear port switch-off refused", { meta: {
-				blocking: decision.blocking,
-				error: decision.error
-			} });
-			throw new Error(decision.error);
-		}
-		await this.ctx.settings.setSection("cluster", { [MESH_CLEAR_PORT_FIELD]: value });
-		await applyProcessMeshClearPort(value);
-		this.ctx.logger.info("Mesh clear port switched", { meta: { mode: value } });
+	/** Cutover keys were removed from the Cluster form; ignore stray posts from stale clients. */
+	warnRetiredClusterCutoverPatch(hadMeshClearPort, hadAgentDashboardOrigins) {
+		if (this.retiredClusterCutoverPatchWarned) return;
+		this.retiredClusterCutoverPatchWarned = true;
+		this.ctx.logger.warn("cluster save ignored retired cutover field(s) — use Pipeline → Cluster / Nodes", { meta: {
+			meshClearPort: hadMeshClearPort,
+			agentDashboardOrigins: hadAgentDashboardOrigins
+		} });
 	}
 	/** Persist + publish mesh auth mode (always `enforced` after D821). */
 	async writeMeshAuthMode(mode) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.394",
+  "version": "1.2.396",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",