@camstack/system 1.1.36 → 1.1.37

package/dist/{dist-C7oOY4iL.mjs → dist-CU3lb_Ys.mjs}

@@ -1,5 +1,5 @@
 import { z } from "zod";
-//#region ../types/dist/sleep-DiQ8xW1M.mjs
+//#region ../types/dist/sleep-DJaTV2D7.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -721,10 +721,6 @@ function hydrateField(field, values) {
 		};
 	}
 	const rawValue = storedValue !== void 0 ? storedValue : defaultValue !== void 0 ? defaultValue : null;
-	if (field.type === "password") return {
-		...field,
-		value: ""
-	};
 	const value = field.type === "textarea" && field.isJson && rawValue !== null && typeof rawValue === "object" ? JSON.stringify(rawValue, null, 2) : rawValue;
 	return {
 		...field,
@@ -2606,13 +2602,32 @@ function event(data) {
 function isDeviceConfigCap(def) {
 	return def?.deviceConfig !== void 0;
 }
-var StaticDirOutputSchema = z.object({ staticDir: z.string() });
-var VersionOutputSchema = z.object({ version: z.string() });
+var StaticDirOutputSchema$1 = z.object({ staticDir: z.string() });
+var VersionOutputSchema$1 = z.object({ version: z.string() });
 var adminUiCapability = {
 	name: "admin-ui",
 	scope: "system",
 	mode: "singleton",
 	internal: true,
+	methods: {
+		getStaticDir: method(z.void(), StaticDirOutputSchema$1),
+		getVersion: method(z.void(), VersionOutputSchema$1)
+	}
+};
+var StaticDirOutputSchema = z.object({ staticDir: z.string() });
+var VersionOutputSchema = z.object({ version: z.string() });
+/**
+* viewer-ui — serves the CamStack VIEWER web build (the Expo/React-Native
+* universal client's PWA export) from the hub, alongside admin-ui. Mirrors
+* `admin-ui` exactly: a singleton, server-internal cap exposing the static
+* dist directory + build version so `main.ts` can mount the SPA under a
+* dedicated prefix.
+*/
+var viewerUiCapability = {
+	name: "viewer-ui",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
 	methods: {
 		getStaticDir: method(z.void(), StaticDirOutputSchema),
 		getVersion: method(z.void(), VersionOutputSchema)
@@ -11367,6 +11382,17 @@ var WidgetMetadataSchema = z.object({
 		deviceContext: z.boolean().default(false),
 		integrationContext: z.boolean().default(false)
 	}),
+	/**
+	* Loadable BEFORE authentication. The normal widget registry listing
+	* (`addon-widgets.listWidgets`) is auth-gated, so a pre-auth surface
+	* (the login page) cannot discover a widget through it. A widget that
+	* declares `preAuth: true` marks itself as safe to mount on a pre-auth
+	* screen — it is surfaced through the PUBLIC `auth.listLoginMethods`
+	* login-method contribution channel (see `login-method.cap.ts`) rather
+	* than the authenticated registry, and its bundle is served by the
+	* public `/api/addon-widgets/:addonId/*` static route. Defaults false.
+	*/
+	preAuth: z.boolean().optional().default(false),
 	/** Dashboard placement HINTS (operator can override per instance). */
 	defaultSize: WidgetSizeEnum.default("md"),
 	allowedSizes: z.array(WidgetSizeEnum).readonly().default([
@@ -11805,6 +11831,87 @@ var authProviderCapability = {
 	mount: { kind: "skip" }
 };
 /**
+* `login-method` — collection cap through which auth addons contribute
+* their pre-auth login surfaces to the login page. This is the SINGLE,
+* generic mechanism that supersedes the dead `auth.listProviders` reader:
+* every auth addon (OIDC, magic-link, WebAuthn/passkey) registers a
+* `login-method` provider and the PUBLIC `auth.listLoginMethods`
+* procedure aggregates them for the unauthenticated login page.
+*
+* A contribution is a discriminated union on `kind`:
+*
+*  - `redirect` — a declarative button. The login page renders a generic
+*    button that navigates to `startUrl` (an addon-owned HTTP route).
+*    Covers OIDC (`/addon/auth-oidc/<id>/start`) and magic-link with
+*    ZERO shell-side JS. A future SSO addon plugs in the same way — the
+*    login page needs NO change.
+*
+*  - `widget` — a Module-Federation widget the login page mounts (via
+*    `loadRemoteBundle`) for an in-page ceremony. Covers the passkey
+*    login ceremony, which must run `@simplewebauthn/browser` INSIDE the
+*    addon bundle. The referenced widget also declares `preAuth: true` in
+*    its `addon-widgets-source` catalog entry. `auth.listLoginMethods`
+*    stamps a public `bundleUrl` from `addonId` + `bundle`.
+*
+* Every contribution carries a `stage`:
+*  - `primary`        — shown on the first credentials screen (OIDC /
+*                       magic-link buttons; a future usernameless passkey).
+*  - `second-factor`  — shown AFTER the password leg, gated on the
+*                       returned `factors` (passkey-as-2FA today).
+*
+* `mount: skip` — the cap is read server-side by the core auth router
+* (`registry.getCollection('login-method')`), never mounted as its own
+* tRPC router.
+*/
+/** When a login method renders in the two-phase login flow. */
+var LoginStageEnum = z.enum(["primary", "second-factor"]);
+/**
+* A declarative redirect button — the login page navigates to `startUrl`.
+* OIDC and magic-link contribute this; a future SSO addon does too.
+*/
+var RedirectLoginMethodSchema = z.object({
+	kind: z.literal("redirect"),
+	/** Stable id within the login-method set (e.g. `auth-oidc/google`). */
+	id: z.string(),
+	/** Operator-facing button label. */
+	label: z.string(),
+	/** lucide-react icon name. */
+	icon: z.string().optional(),
+	/** Addon-owned HTTP route the button navigates to (GET). */
+	startUrl: z.string(),
+	stage: LoginStageEnum
+});
+/**
+* A Module-Federation widget the login page mounts for an in-page
+* ceremony. `bundle` + `addonId` let `auth.listLoginMethods` stamp a
+* public `bundleUrl`; `remote` is the MF descriptor `loadRemoteBundle`
+* consumes. No `bundleUrl` here — it is server-stamped on the public
+* output so the addon never encodes the static-route scheme.
+*/
+var WidgetLoginMethodSchema = z.object({
+	kind: z.literal("widget"),
+	/** Stable id within the login-method set (e.g. `auth-webauthn/passkey-login`). */
+	id: z.string(),
+	/** Owning addon id — drives the public bundle URL + the MF namespace. */
+	addonId: z.string(),
+	/** Bundle filename inside the addon's dist dir (`remoteEntry.js`). */
+	bundle: z.string(),
+	/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
+	remote: WidgetRemoteSchema,
+	stage: LoginStageEnum
+});
+/** One login-method contribution — redirect button OR pre-auth widget. */
+var LoginMethodContributionSchema = z.discriminatedUnion("kind", [RedirectLoginMethodSchema, WidgetLoginMethodSchema]);
+var loginMethodCapability = {
+	name: "login-method",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { getLoginMethods: method(z.void(), z.array(LoginMethodContributionSchema).readonly()) },
+	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+	mount: { kind: "skip" }
+};
+/**
 * Orchestrator-side destination metadata. The orchestrator computes
 * `id = <addonId>:<subId>` from its provider lookup so consumers
 * (admin UI, restore flow) see one canonical key.
@@ -15640,6 +15747,151 @@ var pipelineOrchestratorCapability = {
 	}
 };
 /**
+* server-management — per-NODE singleton capability for a node's ROOT
+* package lifecycle (runtime-updatable node packages, phase 2: hub + docker
+* agents).
+*
+* Each node's root package (`@camstack/server` on the hub, `@camstack/agent`
+* on agents) carries the whole software stack in its npm dep tree, so ONE
+* version describes the node. Updates install into
+* `<dataDir>/server-root/versions/<v>/` and apply on restart via the baked
+* starter (probation boot + auto-rollback to N-1).
+*
+* Providers:
+*   - HUB: `ServerUpdateService` behind the `server-provided` mount
+*     (`buildServerProviders` in trpc.router.ts) — the default target for
+*     unpinned calls.
+*   - AGENT: `AgentUpdateService` registered by the agent bootstrap under
+*     the synthetic `agent-runtime` addonId and declared in the agent's
+*     `$hub.registerNode` manifest.
+*
+* Node routing: singleton caps get the codegen/runtime-builder `nodeId`
+* injection on every method — `input.nodeId` (or `nodePin(nodeId)` from the
+* SDK) routes the call to that node's provider via the standard remote
+* proxy (`createCapabilityProxy` → `$agent-cap-fwd` → the agent's
+* in-process provider lookup). No `nodeId` → the hub's own provider.
+*
+* Spec: docs/superpowers/specs/2026-07-12-runtime-updatable-node-packages-design.md
+*/
+/**
+* Where the running hub's code was loaded from:
+*  - `workspace` — dev checkout (tsx / workspace dist); the starter defers to
+*    plain resolution and runtime updates are refused.
+*  - `baked`     — the immutable image seed closure (no data-dir root active).
+*  - `data-root` — the runtime-updatable `<dataDir>/server-root` closure.
+*/
+var ServerBootModeSchema = z.enum([
+	"workspace",
+	"baked",
+	"data-root"
+]);
+/**
+* Update lifecycle state:
+*  - `idle` / `checking` / `staging` — steady / in-flight registry work.
+*  - `pending-restart` — a version is staged and the node has NOT yet
+*    restarted onto it (still running the OLD version).
+*  - `awaiting-confirmation` — the node HAS restarted onto the staged version
+*    (it is the active probation boot) and is waiting to confirm boot-health.
+*    Apply/rollback are refused in this state and the node must NOT be
+*    manually restarted, or the probation boot auto-rolls-back.
+*/
+var ServerUpdateStateSchema = z.enum([
+	"idle",
+	"checking",
+	"staging",
+	"pending-restart",
+	"awaiting-confirmation"
+]);
+var ServerRollbackInfoSchema = z.object({
+	/** The version that failed (or was manually rolled back). */
+	fromVersion: z.string(),
+	/** The version rolled back to; null = the baked seed. */
+	toVersion: z.string().nullable(),
+	atMs: z.number(),
+	reason: z.string()
+});
+var ServerPackageStatusSchema = z.object({
+	/** Root package name (`@camstack/server` on the hub). */
+	packageName: z.string(),
+	/** Version of the code the running process ACTUALLY loaded. */
+	runningVersion: z.string().nullable(),
+	/** Node.js runtime version the node's process runs on (`process.versions.node`). */
+	nodeRuntimeVersion: z.string().nullable(),
+	/** Active data-dir root version; null when booted from seed/workspace. */
+	activeVersion: z.string().nullable(),
+	/** N-1 version kept for rollback; null when no previous version exists. */
+	previousVersion: z.string().nullable(),
+	/** Version of the immutable baked seed closure (image fallback). */
+	seedVersion: z.string().nullable(),
+	/** Latest registry version from the most recent check (null = never checked). */
+	latestVersion: z.string().nullable(),
+	updateAvailable: z.boolean(),
+	bootMode: ServerBootModeSchema,
+	updateState: ServerUpdateStateSchema,
+	/** Version staged + awaiting its probation boot, when one is pending. */
+	pendingVersion: z.string().nullable(),
+	/** Set when the last freshly-activated version failed its boot health-check. */
+	rolledBack: ServerRollbackInfoSchema.nullable(),
+	/**
+	* True when `server-root/state.json` EXISTS but is unreadable/corrupt — the
+	* hub is running from the baked seed (or workspace) while installed data-dir
+	* versions are being IGNORED. Surfaced as a warning in the UI.
+	*/
+	stateFileCorrupt: z.boolean(),
+	lastCheckedAtMs: z.number().nullable()
+});
+var ServerUpdateCheckResultSchema = z.object({
+	packageName: z.string(),
+	runningVersion: z.string().nullable(),
+	latestVersion: z.string().nullable(),
+	updateAvailable: z.boolean(),
+	checkedAtMs: z.number(),
+	/** Non-null when the registry lookup failed (offline, bad registry, …). */
+	error: z.string().nullable()
+});
+var ServerUpdateActionResultSchema = z.object({
+	accepted: z.boolean(),
+	targetVersion: z.string().nullable(),
+	/** True when a graceful restart was scheduled to apply the change. */
+	restarting: z.boolean(),
+	message: z.string()
+});
+var serverManagementCapability = {
+	name: "server-management",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		getServerPackageStatus: method(z.void(), ServerPackageStatusSchema, { auth: "admin" }),
+		checkServerUpdate: method(z.void(), ServerUpdateCheckResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		applyServerUpdate: method(z.object({ 
+		/** Explicit target version; omitted = latest from the registry. */
+version: z.string().optional() }), ServerUpdateActionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		rollbackServerUpdate: method(z.void(), ServerUpdateActionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Plain process restart of the node's root process — no version change.
+		* The supervisor (docker restart policy / launchd / Electron main)
+		* relaunches and the starter loads the SAME active version. Refused while
+		* a stage is in flight or a version is already staged awaiting restart
+		* (use apply/rollback instead, so the pending version is not skipped).
+		*/
+		restartServer: method(z.void(), ServerUpdateActionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+	mount: { kind: "server-provided" }
+};
+/**
 * Query filter for settings-store collections.
 */
 var QueryFilterSchema = z.object({
@@ -18505,6 +18757,16 @@ var TopologyCategorySchema = z.object({
 	healthy: z.number(),
 	addons: z.array(TopologyCategoryAddonSchema).readonly()
 });
+/**
+* The node's runtime-updatable ROOT package (`@camstack/server` on the hub,
+* `@camstack/agent` on agents) as reported by its `registerNode` manifest —
+* version visibility for the Server management surface. Nullable: offline
+* rows and pre-phase-2 nodes report none.
+*/
+var TopologyRootPackageSchema = z.object({
+	name: z.string(),
+	version: z.string()
+});
 var TopologyNodeSchema = z.object({
 	id: z.string(),
 	name: z.string(),
@@ -18528,7 +18790,8 @@ var TopologyNodeSchema = z.object({
 		status: z.string()
 	})).readonly(),
 	processes: z.array(TopologyProcessSchema).readonly(),
-	categories: z.array(TopologyCategorySchema).readonly()
+	categories: z.array(TopologyCategorySchema).readonly(),
+	rootPackage: TopologyRootPackageSchema.nullable()
 });
 var CapUsageEdgeSchema = z.object({
 	callerAddonId: z.string(),
@@ -19991,6 +20254,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	localNetworkCapability,
 	lockControlCapability,
 	logDestinationCapability,
+	loginMethodCapability,
 	mediaPlayerCapability,
 	meshNetworkCapability,
 	metricsProviderCapability,
@@ -20026,6 +20290,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	rebootCapability,
 	recordingCapability,
 	scriptRunnerCapability,
+	serverManagementCapability,
 	settingsStoreCapability,
 	smokeCapability,
 	smtpProviderCapability,
@@ -20050,6 +20315,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	valveCapability,
 	vibrationCapability,
 	videoclipsCapability,
+	viewerUiCapability,
 	waterHeaterCapability,
 	weatherCapability,
 	webrtcSessionCapability,
@@ -22106,6 +22372,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"loginMethod.getLoginMethods": {
+		capName: "login-method",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"mediaPlayer.next": {
 		capName: "media-player",
 		capScope: "device",
@@ -23468,6 +23740,36 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"serverManagement.applyServerUpdate": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"serverManagement.checkServerUpdate": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"serverManagement.getServerPackageStatus": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"serverManagement.restartServer": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"serverManagement.rollbackServerUpdate": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"settingsStore.count": {
 		capName: "settings-store",
 		capScope: "system",
@@ -24332,6 +24634,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"viewerUi.getStaticDir": {
+		capName: "viewer-ui",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"viewerUi.getVersion": {
+		capName: "viewer-ui",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"waterHeater.setAway": {
 		capName: "water-heater",
 		capScope: "device",