@camstack/addon-auth 1.2.100 → 1.2.101

package/dist/{dist-mBKDEzix.js → dist-BoTHwMVe.js}

@@ -16315,6 +16315,7 @@ var NcSystemEventKindSchema = _enum([
 	"addon-crash-loop",
 	"addon-update-available",
 	"server-update-available",
+	"wrapper-update-available",
 	"alarm-triggered",
 	"alarm-armed",
 	"alarm-disarmed",
@@ -21831,6 +21832,53 @@ var ImageContractSchema = object({
 	/** One operator-grade sentence: this node runs image X; the contract says Y. */
 	message: string()
 });
+/**
+* The shell verdict (see {@link WrapperKindSchema}) with the proofs that
+* produced it.
+*
+* There is deliberately NO `canSelfUpdate` and no apply action: a wrapper
+* update is an ANNOUNCEMENT. The notification body carries the exact command
+* for a `docker` shell and says the app restarts into the new build for
+* `electron`, and that sentence is chosen from `kind` alone — a boolean
+* nothing reads is the defect this repo keeps paying for.
+*/
+var WrapperIdentitySchema = object({
+	kind: _enum([
+		"docker",
+		"electron",
+		"native",
+		"contradictory",
+		"unknown"
+	]),
+	/** Every probe that ran, in a stable order. Never empty. */
+	evidence: array(object({
+		/** Which probe this row reports. */
+		fact: _enum([
+			"dockerenv-file",
+			"proc-1-cgroup",
+			"platform",
+			"electron-app-version-env"
+		]),
+		/**
+		* `observed` — this process read it itself. `declared` — the shell told the
+		* process and nothing here can check it. Only the Electron app version is
+		* ever `declared`, and only because a child cannot see its parent.
+		*/
+		mode: _enum(["observed", "declared"]),
+		/** Did the probe support the fact it names? A `false` row is still evidence. */
+		holds: boolean(),
+		/** What was actually read, verbatim enough for an operator to argue with. */
+		detail: string()
+	})),
+	/**
+	* The version of the SHELL, when the shell has one it can state: the
+	* Electron app version it declared, or the baked seed closure that
+	* fingerprints a container / app bundle. `null` for `contradictory` and
+	* `unknown` — which version belongs to the shell is precisely what is not
+	* known there.
+	*/
+	currentVersion: string().nullable()
+});
 var ServerRollbackInfoSchema = object({
 	/** The version that failed (or was manually rolled back). */
 	fromVersion: string(),
@@ -21872,7 +21920,13 @@ var ServerPackageStatusSchema = object({
 	* Seed-vs-contract verdict (see {@link ImageContractSchema}). Optional for
 	* version skew: an older provider's payload simply omits it.
 	*/
-	imageContract: ImageContractSchema.optional()
+	imageContract: ImageContractSchema.optional(),
+	/**
+	* What this node runs INSIDE (see {@link WrapperIdentitySchema}). Optional
+	* for version skew: an older provider's payload simply omits it, and an
+	* absent wrapper is unknown — never `native`.
+	*/
+	wrapper: WrapperIdentitySchema.optional()
 });
 var ServerUpdateCheckResultSchema = object({
 	packageName: string(),

package/dist/{dist-BYBXKrVA.mjs → dist-ojq_iNdv.mjs}

@@ -16315,6 +16315,7 @@ var NcSystemEventKindSchema = _enum([
 	"addon-crash-loop",
 	"addon-update-available",
 	"server-update-available",
+	"wrapper-update-available",
 	"alarm-triggered",
 	"alarm-armed",
 	"alarm-disarmed",
@@ -21831,6 +21832,53 @@ var ImageContractSchema = object({
 	/** One operator-grade sentence: this node runs image X; the contract says Y. */
 	message: string()
 });
+/**
+* The shell verdict (see {@link WrapperKindSchema}) with the proofs that
+* produced it.
+*
+* There is deliberately NO `canSelfUpdate` and no apply action: a wrapper
+* update is an ANNOUNCEMENT. The notification body carries the exact command
+* for a `docker` shell and says the app restarts into the new build for
+* `electron`, and that sentence is chosen from `kind` alone — a boolean
+* nothing reads is the defect this repo keeps paying for.
+*/
+var WrapperIdentitySchema = object({
+	kind: _enum([
+		"docker",
+		"electron",
+		"native",
+		"contradictory",
+		"unknown"
+	]),
+	/** Every probe that ran, in a stable order. Never empty. */
+	evidence: array(object({
+		/** Which probe this row reports. */
+		fact: _enum([
+			"dockerenv-file",
+			"proc-1-cgroup",
+			"platform",
+			"electron-app-version-env"
+		]),
+		/**
+		* `observed` — this process read it itself. `declared` — the shell told the
+		* process and nothing here can check it. Only the Electron app version is
+		* ever `declared`, and only because a child cannot see its parent.
+		*/
+		mode: _enum(["observed", "declared"]),
+		/** Did the probe support the fact it names? A `false` row is still evidence. */
+		holds: boolean(),
+		/** What was actually read, verbatim enough for an operator to argue with. */
+		detail: string()
+	})),
+	/**
+	* The version of the SHELL, when the shell has one it can state: the
+	* Electron app version it declared, or the baked seed closure that
+	* fingerprints a container / app bundle. `null` for `contradictory` and
+	* `unknown` — which version belongs to the shell is precisely what is not
+	* known there.
+	*/
+	currentVersion: string().nullable()
+});
 var ServerRollbackInfoSchema = object({
 	/** The version that failed (or was manually rolled back). */
 	fromVersion: string(),
@@ -21872,7 +21920,13 @@ var ServerPackageStatusSchema = object({
 	* Seed-vs-contract verdict (see {@link ImageContractSchema}). Optional for
 	* version skew: an older provider's payload simply omits it.
 	*/
-	imageContract: ImageContractSchema.optional()
+	imageContract: ImageContractSchema.optional(),
+	/**
+	* What this node runs INSIDE (see {@link WrapperIdentitySchema}). Optional
+	* for version skew: an older provider's payload simply omits it, and an
+	* absent wrapper is unknown — never `native`.
+	*/
+	wrapper: WrapperIdentitySchema.optional()
 });
 var ServerUpdateCheckResultSchema = object({
 	packageName: string(),

package/dist/magic-link/auth-magic-link.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-mBKDEzix.js");
+const require_dist = require("../dist-BoTHwMVe.js");
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.

package/dist/magic-link/auth-magic-link.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-BYBXKrVA.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-ojq_iNdv.mjs";
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.

package/dist/oidc/auth-oidc.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-mBKDEzix.js");
+const require_dist = require("../dist-BoTHwMVe.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-BYBXKrVA.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-ojq_iNdv.mjs";
 import * as crypto$1 from "node:crypto";
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder();

package/dist/webauthn/{_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-0AyzvnQW.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-I_Gns-Yt.mjs}

@@ -3,7 +3,7 @@ import "./dist-CYZr2fwk.mjs";
 var e = {
 	"@camstack/sdk": {
 		name: "@camstack/sdk",
-		version: "1.2.96",
+		version: "1.2.97",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.176",
+		version: "1.2.177",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.144",
+		version: "1.2.145",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",

package/dist/webauthn/auth-webauthn.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-mBKDEzix.js");
+const require_dist = require("../dist-BoTHwMVe.js");
 let stream = require("stream");
 stream = require_chunk.__toESM(stream, 1);
 let http = require("http");

package/dist/webauthn/auth-webauthn.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, d as number, f as object, l as array, n as addonWidgetsSourceCapability, o as userPasskeysCapability, p as string, u as boolean } from "../dist-BYBXKrVA.mjs";
+import { a as loginMethodCapability, c as BaseAddon, d as number, f as object, l as array, n as addonWidgetsSourceCapability, o as userPasskeysCapability, p as string, u as boolean } from "../dist-ojq_iNdv.mjs";
 import { createRequire } from "node:module";
 import Stream from "stream";
 import http from "http";

package/dist/webauthn/{hostInit-C4I_wxPQ.mjs → hostInit-Dy8lL7a0.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.176",
+				version: "1.2.177",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -45,7 +45,7 @@ async function r() {
 				}
 			},
 			"@camstack/sdk": {
-				version: "1.2.96",
+				version: "1.2.97",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -81,7 +81,7 @@ async function r() {
 				}
 			},
 			"@camstack/ui-library": {
-				version: "1.2.144",
+				version: "1.2.145",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/webauthn/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-0AyzvnQW.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-I_Gns-Yt.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-auth",
-  "version": "1.2.100",
+  "version": "1.2.101",
   "description": "Authentication bundle — magic-link, OIDC, and WebAuthn/passkey. Multi-entry npm package shipping 3 addons under a single bundle; each addon keeps its own id, capabilities, and runner.",
   "keywords": [
     "camstack",