@camstack/system 1.2.434 → 1.2.436

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { $n as validateCustomAddress, In as resolveNotificationTapAddress, M as HUB_MDNS_SERVICE_TYPE, N as HUB_MDNS_TXT_KEYS, Nn as resolveHubAddressRoles, Sn as pickAppLinkHub, Xt as isDefaultAppConnectionEndpoint, br as BaseAddon, fi as EventCategory, ft as checkRoleAddress, kn as resolveAppConnections, l as CAMSTACK_APP_LINK_ORIGIN, on as localNetworkCapability, qt as isAppLinkBase } from "../../dist-CYcBqnXk.mjs";
+import { An as resolveAppConnections, B as NetworkTunnelStartedDataSchema, Cn as pickAppLinkHub, Jt as isAppLinkBase, Ln as resolveNotificationTapAddress, M as HUB_MDNS_SERVICE_TYPE, N as HUB_MDNS_TXT_KEYS, Pn as resolveHubAddressRoles, Zt as isDefaultAppConnectionEndpoint, di as EventCategory, er as validateCustomAddress, l as CAMSTACK_APP_LINK_ORIGIN, pt as checkRoleAddress, sn as localNetworkCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
 import { C as DEFAULT_LAN_HTTP_PORT, O as readLanHttpState, T as applyLanHttp, a as storeUploadedCertificate, b as ensureTlsCert, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, m as readExtraSans, n as applyCertificateToListener, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans } from "../../hub-mdns-ciao-DJRwtlA8.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
@@ -605,6 +605,8 @@ var LocalNetworkAddon = class extends BaseAddon {
 	/** Optional public hostname tracked from `NetworkTunnelStarted`/
 	*  `Stopped` events on the bus. */
 	publicHostname = "";
+	/** False for a Quick tunnel: shown in the palette, never picked automatically (D860). */
+	publicHostnameStable = true;
 	/**
 	* Mesh-reachable endpoint (Tailscale MagicDNS / 100.x), learned from
 	* the `MeshNetworkChanged` event-tail and refreshed by a pull-reconcile
@@ -780,7 +782,7 @@ var LocalNetworkAddon = class extends BaseAddon {
 			httpPort: this.resolvedHttpPort(),
 			httpsPort,
 			localHostname: this.config.localHostname || null
-		} : null);
+		} : null, this.publicHostnameStable);
 	}
 	async onInitialize() {
 		if (!this.config.bootSeeded) {
@@ -913,11 +915,14 @@ var LocalNetworkAddon = class extends BaseAddon {
 		}, ALLOWLIST_RECONCILE_INTERVAL_MS);
 		this.allowlistTimer.unref?.();
 		this.ctx.eventBus?.subscribe({ category: EventCategory.NetworkTunnelStarted }, (event) => {
-			const data = event.data ?? {};
-			if (typeof data.url === "string") try {
-				const hostname = new URL(data.url).hostname;
-				if (hostname && !hostname.endsWith(".placeholder") && !hostname.startsWith("pending.")) this.setPublicHostname(hostname);
-			} catch {}
+			const parsed = NetworkTunnelStartedDataSchema.safeParse(event.data ?? {});
+			if (parsed.success) {
+				const data = parsed.data;
+				try {
+					const hostname = new URL(data.url).hostname;
+					if (hostname && !hostname.endsWith(".placeholder") && !hostname.startsWith("pending.")) this.setPublicHostname(hostname, data.stable !== false);
+				} catch {}
+			}
 		});
 		this.ctx.eventBus?.subscribe({ category: EventCategory.NetworkTunnelStopped }, () => this.setPublicHostname(""));
 		this.ctx.eventBus?.subscribe({ category: EventCategory.MeshNetworkChanged }, (event) => {
@@ -1028,10 +1033,14 @@ var LocalNetworkAddon = class extends BaseAddon {
 	* `onInitialize`. This setter exists for tests + future direct
 	* callers; cleared by passing an empty string.
 	*/
-	setPublicHostname(hostname) {
-		if (this.publicHostname === hostname) return;
+	setPublicHostname(hostname, stable = true) {
+		if (this.publicHostname === hostname && this.publicHostnameStable === stable) return;
 		this.publicHostname = hostname;
-		this.ctx.logger.info("local-network: public hostname updated", { meta: { hostname: hostname || "(cleared)" } });
+		this.publicHostnameStable = stable;
+		this.ctx.logger.info("local-network: public hostname updated", { meta: {
+			hostname: hostname || "(cleared)",
+			stable
+		} });
 	}
 	/**
 	* Replace the cached mesh endpoint. Set from the `MeshNetworkChanged`
@@ -1360,7 +1369,7 @@ function appLinkEndpoint() {
 		priority: -1
 	};
 }
-function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostname, scheme = "http", meshEndpoint = null, lanHttp = null) {
+function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostname, scheme = "http", meshEndpoint = null, lanHttp = null, publicHostnameStable = true) {
 	const out = [];
 	let priority = 0;
 	const preferred = pickPreferred(interfaces);
@@ -1403,13 +1412,14 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 		emit(iface, "lan-ipv6", `${formatKind(iface.kind)} — ${iface.name} (IPv6)`, `${lanScheme}://[${iface.address}]:${lanPort}`, 10 + priority++);
 	}
 	if (publicHostname) out.push({
-		label: "Public tunnel",
+		label: publicHostnameStable ? "Public tunnel" : "Public tunnel (temporary address)",
 		baseUrl: `https://${publicHostname}`,
 		kind: "public",
 		interfaceKind: "public",
 		plausible: true,
 		plausibleReason: "",
-		priority: 100
+		priority: 100,
+		...publicHostnameStable ? {} : { stable: false }
 	});
 	if (meshEndpoint && meshEndpoint.host) out.push({
 		label: "Mesh (Tailscale)",

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { br as BaseAddon, cn as logDestinationCapability } from "../../dist-CYcBqnXk.mjs";
+import { ln as logDestinationCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { An as resolveBucketMs, Dn as reducePoints, Ir as createEvent, Ut as foldSnapshotByFunction, br as BaseAddon, fi as EventCategory, mn as metricsProviderCapability, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
+import { Lr as createEvent, On as reducePoints, Wt as foldSnapshotByFunction, br as errMsg, di as EventCategory, hn as metricsProviderCapability, jn as resolveBucketMs, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os from "node:os";
 import { platform } from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { Bn as scoreRuntimes, Br as emitReadiness, Pt as enumerateInferenceDevices, br as BaseAddon, fi as EventCategory, wn as platformProbeCapability, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
+import { Ft as enumerateInferenceDevices, Tn as platformProbeCapability, Vn as scoreRuntimes, Vr as emitReadiness, br as errMsg, di as EventCategory, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { br as BaseAddon, fi as EventCategory } from "../../dist-CYcBqnXk.mjs";
+import { di as EventCategory, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Dt as deriveBatteryPresence, Un as snapshotCapability, Yn as streamQualityLabel, Zr as nodePin, br as BaseAddon, fi as EventCategory, gr as DeviceFeature, it as batteryCapability, pn as memoizePinnedFfmpeg, rt as bareAddonId, s as BatteryStatusSchema, vr as DeviceType, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
+import { Ot as deriveBatteryPresence, Wn as snapshotCapability, Xn as streamQualityLabel, Zr as nodePin, _r as DeviceFeature, at as batteryCapability, br as errMsg, di as EventCategory, it as bareAddonId, mn as memoizePinnedFfmpeg, s as BatteryStatusSchema, xr as BaseAddon, yr as DeviceType } from "../../dist-DjD2M79P.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Ht as filesystemBrowseCapability, br as BaseAddon, qn as storageProviderCapability } from "../../dist-CYcBqnXk.mjs";
+import { Jn as storageProviderCapability, Ut as filesystemBrowseCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-LZYd8iT-.js");
+const require_wal_maintenance = require("../../wal-maintenance-Br60onAQ.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_PAGE_CACHE_CEILING_KIB, B as sqliteEngineStorm, D as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_FLOOR_MS, I as SQLITE_PROFILE_REPORT_INTERVAL_MS, L as SQLITE_PROFILE_TOP_N, M as sqliteMmapSizeFor, N as sqlitePageCacheKibFor, O as SQLITE_MMAP_CEILING_BYTES, P as SQLITE_ENGINE_STORM_WALL_SHARE, R as SQLITE_SLOW_CALL_MS, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_FLOOR_KIB, k as SQLITE_MMAP_FLOOR_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SqliteOpProfiler } from "../../wal-maintenance-DgLLPK14.mjs";
+import { A as SQLITE_PAGE_CACHE_CEILING_KIB, B as sqliteEngineStorm, D as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_FLOOR_MS, I as SQLITE_PROFILE_REPORT_INTERVAL_MS, L as SQLITE_PROFILE_TOP_N, M as sqliteMmapSizeFor, N as sqlitePageCacheKibFor, O as SQLITE_MMAP_CEILING_BYTES, P as SQLITE_ENGINE_STORM_WALL_SHARE, R as SQLITE_SLOW_CALL_MS, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_FLOOR_KIB, k as SQLITE_MMAP_FLOOR_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SqliteOpProfiler } from "../../wal-maintenance-CaDsrJM_.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-CEiCaI_j.js");
-const require_wal_maintenance = require("../../wal-maintenance-LZYd8iT-.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-CYP5IZJ5.js");
+const require_wal_maintenance = require("../../wal-maintenance-Br60onAQ.js");
 const require_sqlite_snapshot_protocol = require("../../sqlite-snapshot-protocol-B9OndqZv.js");
 const require_wal_checkpoint_policy = require("../../wal-checkpoint-policy-d2z2qPqx.js");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,6 +1,6 @@
-import { Ct as databaseSnapshotCapability, St as dataStoreProviderCapability, Tr as RUNTIME_DEFAULTS, _ as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, b as DATA_STORE_DATABASES, br as BaseAddon, nr as vectorStoreCapability, rt as bareAddonId, v as DATABASE_SNAPSHOT_SUFFIX, y as DATABASE_SNAPSHOT_TIMEOUT_MS, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
-import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-CyDdyjLP.mjs";
-import { C as callControl, E as controlTargetOf, S as trustResult, T as callVector, _ as collectTransferables, a as WalMaintenance, c as SqliteSettingsBackend, d as CrossDatabaseTransactError, f as DatabaseBusyError, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callData } from "../../wal-maintenance-DgLLPK14.mjs";
+import { Ct as dataStoreProviderCapability, Er as RUNTIME_DEFAULTS, _ as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, b as DATA_STORE_DATABASES, br as errMsg, it as bareAddonId, rr as vectorStoreCapability, v as DATABASE_SNAPSHOT_SUFFIX, wt as databaseSnapshotCapability, xr as BaseAddon, y as DATABASE_SNAPSHOT_TIMEOUT_MS } from "../../dist-DjD2M79P.mjs";
+import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-CQaknvx1.mjs";
+import { C as callControl, E as controlTargetOf, S as trustResult, T as callVector, _ as collectTransferables, a as WalMaintenance, c as SqliteSettingsBackend, d as CrossDatabaseTransactError, f as DatabaseBusyError, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callData } from "../../wal-maintenance-CaDsrJM_.mjs";
 import { r as isSnapshotWorkerMessage } from "../../sqlite-snapshot-protocol-2QaTouWV.mjs";
 import { a as isWorkerMessage, t as WAL_CHECKPOINT_LARGE_PASS_FRAMES } from "../../wal-checkpoint-policy-BahrTtyD.mjs";
 import { createRequire } from "node:module";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { $r as parseJsonObject, Gn as storageMigrationCapability, I as LegacyStorageLocationDefaultSchema, J as StorageLocationTypeSchema, Jr as isSecretMarker, K as StorageCleanupJobSchema, Kt as gbToBytes, Pn as resolveLocationMode, Pr as collectSecretConfigKeys, Rt as evictionPolicyOfLocation, Vn as settingsStoreCapability, Wn as storageCapability, Y as StorageMigrationJobSchema, Zt as isLocationEnabled, br as BaseAddon, di as transformSecretWrite, dn as mayReadLocation, fi as EventCategory, fn as mayWriteToLocation, hn as modeMayWrite, ii as resolveSecretMarkers, in as legacyModeOf, oi as secretTreeFromPaths, q as StorageLocationModeSchema, rr as withLocationMode, wr as REDACTED_SECRET } from "../../dist-CYcBqnXk.mjs";
+import { $r as parseJsonObject, Fn as resolveLocationMode, Fr as collectSecretConfigKeys, Gn as storageCapability, Hn as settingsStoreCapability, I as LegacyStorageLocationDefaultSchema, J as StorageLocationModeSchema, Kn as storageMigrationCapability, Qt as isLocationEnabled, Tr as REDACTED_SECRET, X as StorageMigrationJobSchema, Y as StorageLocationTypeSchema, Yr as isSecretMarker, an as legacyModeOf, di as EventCategory, fn as mayReadLocation, gn as modeMayWrite, ii as resolveSecretMarkers, ir as withLocationMode, oi as secretTreeFromPaths, pn as mayWriteToLocation, q as StorageCleanupJobSchema, qt as gbToBytes, ui as transformSecretWrite, xr as BaseAddon, zt as evictionPolicyOfLocation } from "../../dist-DjD2M79P.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { containsOrEquals, physicalRootOf } from "@camstack/types/node";

package/dist/builtins/system-config/system-config.addon.d.ts

@@ -5,7 +5,6 @@ import { systemConfigMeshActions } from "./mesh-actions.js";
 export declare const SYSTEM_CONFIG_CLUSTER_SECTION_ID = "system-config-cluster";
 export declare class SystemConfigAddon extends BaseAddon {
 	readonly id = "system-config";
-	private clusterSecretKeeper;
 	private meshCaKeeper;
 	private meshReapTimer;
 	private readonly meshGateTimers;
@@ -29,40 +28,20 @@ export declare class SystemConfigAddon extends BaseAddon {
 	* empty CRL would accept a revoked leaf. Retries until the settings store answers.
 	*/
 	private onMeshCaReady;
-	private mintJoinToken;
 	/** D821 — short-lived ticket for the agent's `:4444` unlock session. */
 	private mintAgentUiUnlock;
 	private readAgentDashboardOrigins;
-	private resolveHubUrl;
-	private resolveHubMeshAddress;
 	/** The keychain handle for owner `system`; `null` where there is no door. */
 	private systemSecrets;
 	private buildGlobalSchema;
 	getGlobalSettings(): Promise<ConfigUISchemaWithValues>;
 	/**
 	* The admin UI / `addonSettings` cap prefer {@link BaseAddon.updateGlobalSettingsAsOperator}.
-	* That BaseAddon path writes the generic addon store and never reaches
-	* {@link writeClusterSection}. Route the operator write through the same
-	* section-aware path as {@link updateGlobalSettings}.
+	* That BaseAddon path writes the generic addon store and never reaches the
+	* yml sections. Route the operator write through the same section-aware path
+	* as {@link updateGlobalSettings}.
 	*/
 	override updateGlobalSettingsAsOperator(patch: Record<string, unknown>, _nodeId?: string): Promise<void>;
 	updateGlobalSettings(patch: Record<string, unknown>): Promise<void>;
-	/**
-	* The cluster secret's save path: the value goes to the keychain (owner
-	* `system`), the row gets the marker; `''` / a view keeps. `$secretClear` is
-	* REFUSED: the secret is mandatory (D802). A value the keychain cannot store
-	* is REFUSED — never written inline (D787, P5). Mesh auth mode is always
-	* enforced (D821) — a legacy `meshAuth` in the patch is ignored.
-	*/
-	private writeClusterSection;
-	/** Persist + publish mesh auth mode (always `enforced` after D821). */
-	private writeMeshAuthMode;
-	/**
-	* First boot, or a keychain reset that cleared the marker (D802): a fresh
-	* random secret, stored like an operator save. Mesh auth stays enforced
-	* (D821) — every agent must present the secret; there is no transition window.
-	*/
-	private generateClusterSecret;
-	private storeClusterSecret;
 }
 export default SystemConfigAddon;