@camstack/system 1.2.6 → 1.2.8

package/dist/{dist-aTevP3Nh.mjs → dist-CxM20CkF.mjs}

@@ -2702,7 +2702,6 @@ function expandCapMethods(def) {
 	};
 	return out;
 }
-/** Shorthand to define a method schema */
 function method(input, output, options) {
 	return {
 		input,
@@ -2710,6 +2709,7 @@ function method(input, output, options) {
 		kind: options?.kind ?? "query",
 		auth: options?.auth ?? "protected",
 		...options?.access !== void 0 ? { access: options.access } : {},
+		...options?.caller !== void 0 ? { caller: options.caller } : {},
 		timeoutMs: options?.timeoutMs
 	};
 }
@@ -8365,6 +8365,22 @@ var CameraMetricsSchema = z.object({
 	])
 });
 var CameraMetricsWithDeviceIdSchema = CameraMetricsSchema.extend({ deviceId: z.number() });
+/**
+* Reference to the frame's retained NATIVE surface + the parent crop's placement
+* within the frame, so the executor can re-cut a leaf child ROI at native
+* resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
+*/
+var NativeCropRefSchema = z.object({
+	/** Handle keying the retained native surface (node-pinned to its owner). */
+	handle: FrameHandleSchema,
+	/** The parent crop's padded/clamped rectangle in FRAME-space pixels. */
+	cropFrameSpace: z.object({
+		x: z.number(),
+		y: z.number(),
+		w: z.number(),
+		h: z.number()
+	})
+});
 var ModelFormatSchema$1 = z.enum([
 	"onnx",
 	"coreml",
@@ -8739,7 +8755,22 @@ var pipelineExecutorCapability = {
 			* Omitted ⇒ the runner's default device (current single-engine
 			* behaviour). Selects WHICH device pool of the node runs the call.
 			*/
-			deviceKey: z.string().optional()
+			deviceKey: z.string().optional(),
+			/**
+			* Two-plane NATIVE child-crop reference. Set by `runDetailSubtree` ONLY
+			* when the parent crop was resolved from the frame's retained NATIVE
+			* surface (a frameHandle HIT). Lets the executor re-cut a LEAF crop
+			* child's ROI (plate-ocr, face-embedding, leaf classifiers) at native
+			* resolution from that surface — the SAME quality path faces already
+			* had — instead of the downscaled parent tile. `handle` keys the native
+			* surface (node-pinned to its owner); `cropFrameSpace` is the parent
+			* crop's padded/clamped rectangle in FRAME-space pixels, used to compose
+			* the executor's crop-normalized child ROI back into frame-normalized
+			* coordinates. Auxiliary to the image source (`image`/`frame`/…), NOT one
+			* of the mutually-exclusive image inputs. Absent ⇒ tile-crop children
+			* (today's behaviour on the fallback path).
+			*/
+			nativeCropRef: NativeCropRefSchema.optional()
 		}), PipelineRunResultBridge, { kind: "mutation" }),
 		/**
 		* Batched run — N raw frames packed into one cap call. The provider
@@ -9042,7 +9073,11 @@ var DetailResultSchema = z.object({
 	bbox: NativeCropBboxSchema.optional(),
 	embedding: z.string().optional(),
 	label: z.string().optional(),
-	alignedCropJpeg: z.string().optional()
+	alignedCropJpeg: z.string().optional(),
+	/** Face short side (px) measured on the NATIVE crop surface. The `bbox`
+	*  above is detection-frame px (≈6× smaller on a 4K camera) — min-face-size
+	*  consumers MUST prefer this when present (2026-07-22 native-gate fix). */
+	nativeFaceShortSidePx: z.number().optional()
 });
 /**
 * Per-camera tunable ranges + defaults. Single source of truth used
@@ -15728,6 +15763,247 @@ var notificationOutputCapability = {
 	}
 };
 /**
+* notification-rules — the Notification Center rule surface (P1 core).
+*
+* Spec: `docs/superpowers/specs/2026-07-22-notification-center-requirements.md`
+* (operator decisions D-1/D-2/D-3 are binding):
+*
+*  - D-2: rule EVALUATION lives in `addon-post-analysis` (the
+*    `notification-center` module), hooked on the durable persistence
+*    moments (object-event insert, TrackCloser.closeExpired) with a
+*    persisted outbox + retry — never the lossy telemetry bus (D8).
+*  - D-3: urgency belongs to the RULE. `delivery: 'immediate'` fires on the
+*    FIRST persisted detection matching the conditions (per-track dedup,
+*    `maxPerTrack` fixed at 1 — see {@link NC_MAX_PER_TRACK_IMMEDIATE});
+*    `delivery: 'track-end'` evaluates the finalized track record at close.
+*  - DISPATCH stays behind `notification-output` (rules reference targets
+*    by id; per-backend params are a passthrough blob capped by the
+*    target kind's own caps/degrade engine).
+*
+* P1 scope: admin-authored rules only (`createdBy` stamped from the
+* server-injected caller identity — the first `caller: 'required'`
+* adopter). The P1 condition subset is: devices, classes(+exclude),
+* minConfidence, admin zones (any/all + exclude), weekly schedule
+* windows, and the optional label/identity/plate matchers. User rules,
+* private zones, per-recipient fan-out and the wider condition table are
+* P2+ (see spec §7).
+*
+* All schemas here are the single source of truth — `NcRule` etc. are
+* `z.infer` exports; no duplicate interfaces (the advanced-notifier
+* schema/interface drift is explicitly not repeated).
+*/
+/** D-3: the urgency of a rule — which persistence moment evaluates it. */
+var NcDeliverySchema = z.enum(["immediate", "track-end"]);
+/** One weekly activation window. `startMinute > endMinute` crosses midnight. */
+var NcScheduleWindowSchema = z.object({
+	/** Days of week the window STARTS on (0 = Sunday … 6 = Saturday). */
+	days: z.array(z.number().int().min(0).max(6)).min(1),
+	startMinute: z.number().int().min(0).max(1439),
+	endMinute: z.number().int().min(0).max(1439)
+});
+/** Weekly schedule — OR of windows; absence on the rule = always active. */
+var NcScheduleSchema = z.object({
+	windows: z.array(NcScheduleWindowSchema).min(1),
+	/** IANA timezone; default = hub host timezone. */
+	timezone: z.string().optional(),
+	/** Active OUTSIDE the windows (e.g. "only outside business hours"). */
+	invert: z.boolean().optional()
+});
+/** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
+var NcPlateMatcherSchema = z.object({
+	values: z.array(z.string().min(1)).min(1),
+	/** Max Levenshtein distance after normalization (uppercase alphanumeric). */
+	maxDistance: z.number().int().min(0).max(3).default(1)
+});
+/** Admin-zone membership condition (zone IDs as stamped by the ZoneEngine). */
+var NcZoneConditionSchema = z.object({
+	ids: z.array(z.string().min(1)).min(1),
+	/** Quantifier over `ids` — at least one / every one visited. */
+	match: z.enum(["any", "all"]).default("any")
+});
+/**
+* The P1 condition set — a flat AND of groups; absent group = pass;
+* membership lists are OR within the list (spec §2.3).
+*/
+var NcConditionsSchema = z.object({
+	/** Device scope — absent = all devices. */
+	devices: z.array(z.number()).optional(),
+	/** Detector class names (any overlap with the record's class set). */
+	classes: z.array(z.string().min(1)).optional(),
+	/** Veto classes — any overlap fails the rule. */
+	classesExclude: z.array(z.string().min(1)).optional(),
+	/** Minimum detection confidence 0–1 (fails when the record has none). */
+	minConfidence: z.number().min(0).max(1).optional(),
+	/** Admin zone membership over event `zones` / track `zonesVisited`. */
+	zones: NcZoneConditionSchema.optional(),
+	/** Veto zones — any hit fails the rule. */
+	zonesExclude: z.array(z.string().min(1)).optional(),
+	/**
+	* Exact (case-insensitive) match on the record's collapsed `label`
+	* (identity name / plate text / subclass).
+	*/
+	labelEquals: z.array(z.string().min(1)).optional(),
+	/**
+	* Identity matcher. P1 boundary: matched against the record's collapsed
+	* `label` (the identity display name propagated by the face pipeline) —
+	* identity-ID matching rides in P2 when identity ids reach the record.
+	*/
+	identities: z.array(z.string().min(1)).optional(),
+	/** Fuzzy plate matcher against the record's `label` (plate text). */
+	plates: NcPlateMatcherSchema.optional()
+});
+/** One delivery target: a `notification-output` Target ref + passthrough params. */
+var NcRuleTargetSchema = z.object({
+	/** `notification-output` Target id. */
+	targetId: z.string().min(1),
+	/**
+	* Per-backend passthrough. Recognized keys are mapped onto the canonical
+	* Notification (`priority`, `level`, `sound`, `clickUrl`, `ttl`); the
+	* degrade engine drops what the backend can't render.
+	*/
+	params: z.record(z.string(), z.unknown()).optional()
+});
+/**
+* Media attachment policy (P1 still-image subset). `best` = the best
+* AVAILABLE media at dispatch time (D-3); `best-matching` (track-end
+* condition-best) is deferred — operator open point.
+*/
+var NcMediaPolicySchema = z.object({ attach: z.enum([
+	"best",
+	"keyFrame",
+	"none"
+]).default("best") });
+/** Throttle — cooldown survives restarts (rebuilt from the outbox on boot). */
+var NcThrottleSchema = z.object({
+	cooldownSec: z.number().int().min(0).max(86400).default(60),
+	/** `rule` = one shared cooldown; `rule-device` = per-camera cooldown. */
+	scope: z.enum(["rule", "rule-device"]).default("rule-device")
+});
+/** Client-supplied rule fields (server stamps id/createdBy/createdAt/updatedAt). */
+var NcRuleInputSchema = z.object({
+	name: z.string().min(1).max(200),
+	enabled: z.boolean().default(true),
+	delivery: NcDeliverySchema,
+	conditions: NcConditionsSchema.default({}),
+	schedule: NcScheduleSchema.optional(),
+	targets: z.array(NcRuleTargetSchema).min(1),
+	media: NcMediaPolicySchema.default({ attach: "best" }),
+	throttle: NcThrottleSchema.default({
+		cooldownSec: 60,
+		scope: "rule-device"
+	}),
+	/** `{{var}}` templating over camera/class/label/zones/confidence/time. */
+	template: z.object({
+		title: z.string().max(500).optional(),
+		body: z.string().max(2e3).optional()
+	}).optional(),
+	/** Canonical notification priority ordinal (1..5); per-target overridable. */
+	priority: z.number().int().min(1).max(5).default(3)
+});
+/** Partial patch for `updateRule` — any subset of the input fields. */
+var NcRulePatchSchema = NcRuleInputSchema.partial();
+/** A persisted rule. */
+var NcRuleSchema = NcRuleInputSchema.extend({
+	id: z.string(),
+	/** userId of the admin who created the rule (server-stamped caller). */
+	createdBy: z.string(),
+	createdAt: z.number(),
+	updatedAt: z.number()
+});
+var NcTestResultSchema = z.object({
+	recordId: z.string(),
+	recordKind: z.enum(["object-event", "track"]),
+	deviceId: z.number(),
+	timestamp: z.number(),
+	wouldFire: z.boolean(),
+	/** Condition id that failed (first failing group), when `wouldFire` is false. */
+	failedCondition: z.string().optional(),
+	className: z.string().optional(),
+	label: z.string().optional()
+});
+var NcConditionDescriptorSchema = z.object({
+	/** Field id inside `NcConditions` (or `'schedule'` for the rule-level group). */
+	id: z.string(),
+	group: z.enum([
+		"scope",
+		"class",
+		"zones",
+		"quality",
+		"label",
+		"schedule"
+	]),
+	label: z.string(),
+	/** Editor widget the UI renders — never hardcode per-condition forms. */
+	valueType: z.enum([
+		"deviceIdList",
+		"stringList",
+		"number01",
+		"zoneSelection",
+		"zoneIdList",
+		"schedule",
+		"plateMatcher"
+	]),
+	operator: z.enum([
+		"in",
+		"notIn",
+		"anyOf",
+		"allOf",
+		"gte",
+		"fuzzyIn",
+		"withinSchedule"
+	]),
+	/** Which delivery kinds the condition applies to. */
+	appliesTo: z.array(NcDeliverySchema),
+	phase: z.string(),
+	description: z.string().optional()
+});
+var notificationRulesCapability = {
+	name: "notification-rules",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		listRules: method(z.object({}), z.object({ rules: z.array(NcRuleSchema) }), { auth: "admin" }),
+		getRule: method(z.object({ ruleId: z.string() }), z.object({ rule: NcRuleSchema.nullable() }), { auth: "admin" }),
+		createRule: method(z.object({ rule: NcRuleInputSchema }), z.object({ rule: NcRuleSchema }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		updateRule: method(z.object({
+			ruleId: z.string(),
+			patch: NcRulePatchSchema
+		}), z.object({ rule: NcRuleSchema }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		deleteRule: method(z.object({ ruleId: z.string() }), z.object({ success: z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setRuleEnabled: method(z.object({
+			ruleId: z.string(),
+			enabled: z.boolean()
+		}), z.object({ success: z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Dry-run a rule against recently persisted records (object events for
+		* `immediate`, closed tracks for `track-end`). Mutation kind only to
+		* carry the full rule object safely; no side effects.
+		*/
+		testRule: method(z.object({
+			rule: NcRuleInputSchema,
+			lookbackMinutes: z.number().int().min(1).max(1440).default(60)
+		}), z.object({ results: z.array(NcTestResultSchema) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getConditionCatalog: method(z.object({}), z.object({ catalog: z.array(NcConditionDescriptorSchema) }))
+	}
+};
+/**
 * Shared LLM generate contracts — imported by BOTH `llm.cap.ts` (consumer
 * surface) and `llm-runtime.cap.ts` (node-side managed executor) so the two
 * caps stay wire-compatible without a circular cap→cap import.
@@ -22573,6 +22849,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	networkQualityCapability,
 	nodesCapability,
 	notificationOutputCapability,
+	notificationRulesCapability,
 	notifierCapability,
 	numericSensorCapability,
 	oauthIntegrationCapability,
@@ -25314,6 +25591,54 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.createRule": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"notificationRules.deleteRule": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"notificationRules.getConditionCatalog": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationRules.getRule": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationRules.listRules": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationRules.setRuleEnabled": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"notificationRules.testRule": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"notificationRules.updateRule": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notifier.cancel": {
 		capName: "notifier",
 		capScope: "device",

package/dist/index.js

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DIlYZWEp.js");
+const require_dist = require("./dist-CdgScQ3H.js");
 const require_model_download_service = require("./model-download-service-hf0ookyy.js");
-const require_manifest_python_deps = require("./manifest-python-deps-BznC09O4.js");
+const require_manifest_python_deps = require("./manifest-python-deps-CUHn5wqq.js");
 const require_resource_monitor = require("./resource-monitor-DNNomR-i.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
@@ -5378,10 +5378,48 @@ function methodsFor(def) {
 			auth: m.auth ?? "protected",
 			schema: m,
 			isVoid: require_dist.isVoidInput(m.input),
-			isObject: require_dist.isObjectInput(m.input)
+			isObject: require_dist.isObjectInput(m.input),
+			callerRequired: m.caller === "required"
 		};
 	});
 }
+/**
+* Extract the authenticated caller identity from the (structurally
+* unknown) tRPC context. The builder cannot import the server's
+* `TrpcContext`, so the read is narrowing-based: `ctx.user.id` (string)
+* + `ctx.user.isAdmin` (boolean) — the stable `AuthenticatedUser` core
+* every context factory produces. Returns null when no authenticated
+* user is present (the caller then fails the call — a fabricated
+* identity is never injected).
+*/
+function extractCallerIdentity(ctx) {
+	if (ctx === null || typeof ctx !== "object" || !("user" in ctx)) return null;
+	const user = ctx.user;
+	if (user === null || typeof user !== "object") return null;
+	if (!("id" in user) || !("isAdmin" in user)) return null;
+	const id = user.id;
+	const isAdmin = user.isAdmin;
+	if (typeof id !== "string" || id.length === 0 || typeof isAdmin !== "boolean") return null;
+	return {
+		userId: id,
+		isAdmin
+	};
+}
+/**
+* Return a NEW input object carrying the server-derived `caller`. The
+* spread-then-set ordering guarantees any client-supplied `caller` key
+* (which survives the `.loose()` wire parse) is overwritten. Raises
+* UNAUTHORIZED (or `badRequest` on a skewed services object without the
+* `unauthorized` raiser) when the context has no authenticated user.
+*/
+function injectCaller(rest, ctx, capName, methodName, services) {
+	const caller = extractCallerIdentity(ctx);
+	if (caller === null) return (services.unauthorized ?? services.badRequest)(`Capability "${capName}.${methodName}" requires an authenticated caller`);
+	return {
+		...rest,
+		caller
+	};
+}
 /** Strip a set of selector keys from an input object, returning a NEW object. */
 function stripKeys(input, keys) {
 	const src = input ?? {};
@@ -5422,6 +5460,9 @@ function requireLocal(capName, getLocal, services) {
 * Build a single capability's router (the runtime equivalent of one
 * codegen'd `createCapRouter_<Cap>`). Each method becomes a typed
 * procedure with the SAME routing branch the codegen emits.
+*
+* Exported for the caller-injection spec (which drives it with synthetic
+* cap defs) — production callers go through {@link buildCapRouters}.
 */
 function buildOneCapRouter(def, primitives, services) {
 	const capName = def.name;
@@ -5430,6 +5471,7 @@ function buildOneCapRouter(def, primitives, services) {
 	const nodeIdData = def.nodeIdMode === "data";
 	const procedures = {};
 	for (const method of methodsFor(def)) {
+		if (method.callerRequired && (method.kind === "subscription" || !method.isObject)) throw new Error(`Cap "${capName}" method "${method.name}": caller: 'required' is only supported on query/mutation methods with an object input schema`);
 		const effectiveMountKind = method.schema.systemOnly === true ? systemMountKind : mount.kind;
 		const isCollection = effectiveMountKind === "collection";
 		const getLocal = (ctx, addonId) => services.getLocalProvider(capName, effectiveMountKind, ctx, addonId);
@@ -5461,17 +5503,25 @@ function buildOneCapRouter(def, primitives, services) {
 		if (method.isObject) {
 			const schema = nodeIdData ? inputSchema : require_dist.looseSchema(inputSchema);
 			procedures[method.name] = base.input(schema)[procKind](({ input, ctx }) => {
-				if (nodeIdData) return requireLocal(capName, () => getLocal(ctx), services)[method.name]?.(input);
+				if (nodeIdData) {
+					const provider = requireLocal(capName, () => getLocal(ctx), services);
+					const payload = method.callerRequired ? injectCaller(stripKeys(input, []).rest, ctx, capName, method.name, services) : input;
+					return provider[method.name]?.(payload);
+				}
 				if (isCollection) {
 					const { rest, picked } = stripKeys(input, ["nodeId", "addonId"]);
 					const nodeId = typeof picked.nodeId === "string" ? picked.nodeId : void 0;
 					const topLevelAddonId = typeof picked.addonId === "string" ? picked.addonId : void 0;
 					const canRecoverNestedAddonId = !require_dist.isArrayOutputSchema(method.schema.output) && !require_dist.objectInputDeclaresAddonId(method.schema.input);
 					const addonId = topLevelAddonId ?? (canRecoverNestedAddonId ? require_dist.extractNestedAddonId(rest) : void 0);
-					return resolveProviderForCall(capName, nodeId, () => getLocal(ctx, addonId), services)[method.name]?.(rest);
+					const provider = resolveProviderForCall(capName, nodeId, () => getLocal(ctx, addonId), services);
+					const payload = method.callerRequired ? injectCaller(rest, ctx, capName, method.name, services) : rest;
+					return provider[method.name]?.(payload);
 				}
 				const { rest, picked } = stripKeys(input, ["nodeId"]);
-				return resolveProviderForCall(capName, typeof picked.nodeId === "string" ? picked.nodeId : void 0, () => getLocal(ctx), services)[method.name]?.(rest);
+				const provider = resolveProviderForCall(capName, typeof picked.nodeId === "string" ? picked.nodeId : void 0, () => getLocal(ctx), services);
+				const payload = method.callerRequired ? injectCaller(rest, ctx, capName, method.name, services) : rest;
+				return provider[method.name]?.(payload);
 			});
 			continue;
 		}

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { At as EventCategory$1, Dt as resolveCapMount, Et as readinessKey, F as kebabToCamel, I as lifecycleJobSchema, K as procedureAuthKey, M as isCollectionArrayMethod, N as isObjectInput, O as extractNestedAddonId, Ot as scopeKey, P as isVoidInput, Tt as parseJsonUnknown$1, U as objectInputDeclaresAddonId, _t as asString$1, ct as DEVICE_STATUS_METHOD, ft as ReadinessRegistry, gt as asNumber, ht as asJsonObject$1, it as errMsg$1, j as isArrayOutputSchema, o as METHOD_ACCESS_MAP, ot as DATAPLANE_SECRET_HEADER$1, p as addonSettingsCapability, pt as ReadinessTimeoutError, s as RUNTIME_DEFAULTS, st as DEVICE_SETTINGS_CONTRIBUTION_METHODS, t as ALL_CAPABILITY_DEFINITIONS, vt as createEvent, wt as parseJsonObject, xt as expandCapMethods, yt as emitDownForOwnedCaps, z as looseSchema } from "./dist-aTevP3Nh.mjs";
+import { At as EventCategory$1, Dt as resolveCapMount, Et as readinessKey, F as kebabToCamel, I as lifecycleJobSchema, K as procedureAuthKey, M as isCollectionArrayMethod, N as isObjectInput, O as extractNestedAddonId, Ot as scopeKey, P as isVoidInput, Tt as parseJsonUnknown$1, U as objectInputDeclaresAddonId, _t as asString$1, ct as DEVICE_STATUS_METHOD, ft as ReadinessRegistry, gt as asNumber, ht as asJsonObject$1, it as errMsg$1, j as isArrayOutputSchema, o as METHOD_ACCESS_MAP, ot as DATAPLANE_SECRET_HEADER$1, p as addonSettingsCapability, pt as ReadinessTimeoutError, s as RUNTIME_DEFAULTS, st as DEVICE_SETTINGS_CONTRIBUTION_METHODS, t as ALL_CAPABILITY_DEFINITIONS, vt as createEvent, wt as parseJsonObject, xt as expandCapMethods, yt as emitDownForOwnedCaps, z as looseSchema } from "./dist-CxM20CkF.mjs";
 import { a as downloadModel, c as getModelFilePath, d as contentTypeFor, f as createAuthenticatedFileServer, h as resolveFilePath, i as downloadFile, l as isModelDownloaded, m as parseTokenizedUrl, n as collectModelFiles, o as ensureModel, p as parseRangeHeader, r as deleteModelFromDisk, s as fetchJson, t as ModelDownloadService, u as createFileDataPlaneHandler } from "./model-download-service-Cp9f4dk6.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-Czja13st.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-CcW0WpfS.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Le3l0qS2.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
 import { SqliteSettingsAddon, t as SqliteSettingsBackend } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
@@ -5370,10 +5370,48 @@ function methodsFor(def) {
 			auth: m.auth ?? "protected",
 			schema: m,
 			isVoid: isVoidInput(m.input),
-			isObject: isObjectInput(m.input)
+			isObject: isObjectInput(m.input),
+			callerRequired: m.caller === "required"
 		};
 	});
 }
+/**
+* Extract the authenticated caller identity from the (structurally
+* unknown) tRPC context. The builder cannot import the server's
+* `TrpcContext`, so the read is narrowing-based: `ctx.user.id` (string)
+* + `ctx.user.isAdmin` (boolean) — the stable `AuthenticatedUser` core
+* every context factory produces. Returns null when no authenticated
+* user is present (the caller then fails the call — a fabricated
+* identity is never injected).
+*/
+function extractCallerIdentity(ctx) {
+	if (ctx === null || typeof ctx !== "object" || !("user" in ctx)) return null;
+	const user = ctx.user;
+	if (user === null || typeof user !== "object") return null;
+	if (!("id" in user) || !("isAdmin" in user)) return null;
+	const id = user.id;
+	const isAdmin = user.isAdmin;
+	if (typeof id !== "string" || id.length === 0 || typeof isAdmin !== "boolean") return null;
+	return {
+		userId: id,
+		isAdmin
+	};
+}
+/**
+* Return a NEW input object carrying the server-derived `caller`. The
+* spread-then-set ordering guarantees any client-supplied `caller` key
+* (which survives the `.loose()` wire parse) is overwritten. Raises
+* UNAUTHORIZED (or `badRequest` on a skewed services object without the
+* `unauthorized` raiser) when the context has no authenticated user.
+*/
+function injectCaller(rest, ctx, capName, methodName, services) {
+	const caller = extractCallerIdentity(ctx);
+	if (caller === null) return (services.unauthorized ?? services.badRequest)(`Capability "${capName}.${methodName}" requires an authenticated caller`);
+	return {
+		...rest,
+		caller
+	};
+}
 /** Strip a set of selector keys from an input object, returning a NEW object. */
 function stripKeys(input, keys) {
 	const src = input ?? {};
@@ -5414,6 +5452,9 @@ function requireLocal(capName, getLocal, services) {
 * Build a single capability's router (the runtime equivalent of one
 * codegen'd `createCapRouter_<Cap>`). Each method becomes a typed
 * procedure with the SAME routing branch the codegen emits.
+*
+* Exported for the caller-injection spec (which drives it with synthetic
+* cap defs) — production callers go through {@link buildCapRouters}.
 */
 function buildOneCapRouter(def, primitives, services) {
 	const capName = def.name;
@@ -5422,6 +5463,7 @@ function buildOneCapRouter(def, primitives, services) {
 	const nodeIdData = def.nodeIdMode === "data";
 	const procedures = {};
 	for (const method of methodsFor(def)) {
+		if (method.callerRequired && (method.kind === "subscription" || !method.isObject)) throw new Error(`Cap "${capName}" method "${method.name}": caller: 'required' is only supported on query/mutation methods with an object input schema`);
 		const effectiveMountKind = method.schema.systemOnly === true ? systemMountKind : mount.kind;
 		const isCollection = effectiveMountKind === "collection";
 		const getLocal = (ctx, addonId) => services.getLocalProvider(capName, effectiveMountKind, ctx, addonId);
@@ -5453,17 +5495,25 @@ function buildOneCapRouter(def, primitives, services) {
 		if (method.isObject) {
 			const schema = nodeIdData ? inputSchema : looseSchema(inputSchema);
 			procedures[method.name] = base.input(schema)[procKind](({ input, ctx }) => {
-				if (nodeIdData) return requireLocal(capName, () => getLocal(ctx), services)[method.name]?.(input);
+				if (nodeIdData) {
+					const provider = requireLocal(capName, () => getLocal(ctx), services);
+					const payload = method.callerRequired ? injectCaller(stripKeys(input, []).rest, ctx, capName, method.name, services) : input;
+					return provider[method.name]?.(payload);
+				}
 				if (isCollection) {
 					const { rest, picked } = stripKeys(input, ["nodeId", "addonId"]);
 					const nodeId = typeof picked.nodeId === "string" ? picked.nodeId : void 0;
 					const topLevelAddonId = typeof picked.addonId === "string" ? picked.addonId : void 0;
 					const canRecoverNestedAddonId = !isArrayOutputSchema(method.schema.output) && !objectInputDeclaresAddonId(method.schema.input);
 					const addonId = topLevelAddonId ?? (canRecoverNestedAddonId ? extractNestedAddonId(rest) : void 0);
-					return resolveProviderForCall(capName, nodeId, () => getLocal(ctx, addonId), services)[method.name]?.(rest);
+					const provider = resolveProviderForCall(capName, nodeId, () => getLocal(ctx, addonId), services);
+					const payload = method.callerRequired ? injectCaller(rest, ctx, capName, method.name, services) : rest;
+					return provider[method.name]?.(payload);
 				}
 				const { rest, picked } = stripKeys(input, ["nodeId"]);
-				return resolveProviderForCall(capName, typeof picked.nodeId === "string" ? picked.nodeId : void 0, () => getLocal(ctx), services)[method.name]?.(rest);
+				const provider = resolveProviderForCall(capName, typeof picked.nodeId === "string" ? picked.nodeId : void 0, () => getLocal(ctx), services);
+				const payload = method.callerRequired ? injectCaller(rest, ctx, capName, method.name, services) : rest;
+				return provider[method.name]?.(payload);
 			});
 			continue;
 		}

package/dist/kernel/cap-router-builder.d.ts

@@ -1,4 +1,4 @@
-import { CapabilityMountKind } from '@camstack/types';
+import { CapabilityDefinition, CapabilityMountKind } from '@camstack/types';
 /**
  * A tRPC-procedure-like builder. Mirrors the chainable surface the
  * codegen emits (`procedure.input(...).output(...).query(...)`), kept
@@ -64,7 +64,24 @@ export interface CapRouterServices {
     readonly noNodeRouting: (capName: string) => never;
     /** Raise the canonical "bad request: missing field" error. */
     readonly badRequest: (message: string) => never;
+    /**
+     * Raise the canonical UNAUTHORIZED error — used by `caller: 'required'`
+     * methods when the context carries no authenticated user. OPTIONAL for
+     * framework-live-update version skew (an older server may hand a
+     * services object without it to a newer builder); the builder falls
+     * back to `badRequest` in that case so the call still fails closed.
+     */
+    readonly unauthorized?: (message: string) => never;
 }
+/**
+ * Build a single capability's router (the runtime equivalent of one
+ * codegen'd `createCapRouter_<Cap>`). Each method becomes a typed
+ * procedure with the SAME routing branch the codegen emits.
+ *
+ * Exported for the caller-injection spec (which drives it with synthetic
+ * cap defs) — production callers go through {@link buildCapRouters}.
+ */
+export declare function buildOneCapRouter(def: CapabilityDefinition, primitives: CapRouterPrimitives, services: CapRouterServices): unknown;
 /**
  * Build the runtime cap-router map: `{ <camelCapName>: <router> }` for
  * every capability the builder owns. Caps with `mount.kind` `custom` /

package/dist/{manifest-python-deps-BznC09O4.js → manifest-python-deps-CUHn5wqq.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DIlYZWEp.js");
+const require_dist = require("./dist-CdgScQ3H.js");
 let _camstack_types_node = require("@camstack/types/node");
 let node_http = require("node:http");
 let node_fs = require("node:fs");

package/dist/{manifest-python-deps-Czja13st.mjs → manifest-python-deps-CcW0WpfS.mjs}

@@ -1,4 +1,4 @@
-import { q as readNodePin } from "./dist-aTevP3Nh.mjs";
+import { q as readNodePin } from "./dist-CxM20CkF.mjs";
 import { ensureBinary, ensureFfmpeg, ensurePython, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
 import { createServer } from "node:http";
 import * as fs from "node:fs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.6",
+  "version": "1.2.8",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",