@camstack/system 1.2.7 → 1.2.8

package/dist/index.js

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DEkwmyIj.js");
+const require_dist = require("./dist-CdgScQ3H.js");
 const require_model_download_service = require("./model-download-service-hf0ookyy.js");
-const require_manifest_python_deps = require("./manifest-python-deps-DIrBiAMS.js");
+const require_manifest_python_deps = require("./manifest-python-deps-CUHn5wqq.js");
 const require_resource_monitor = require("./resource-monitor-DNNomR-i.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
@@ -5378,10 +5378,48 @@ function methodsFor(def) {
 			auth: m.auth ?? "protected",
 			schema: m,
 			isVoid: require_dist.isVoidInput(m.input),
-			isObject: require_dist.isObjectInput(m.input)
+			isObject: require_dist.isObjectInput(m.input),
+			callerRequired: m.caller === "required"
 		};
 	});
 }
+/**
+* Extract the authenticated caller identity from the (structurally
+* unknown) tRPC context. The builder cannot import the server's
+* `TrpcContext`, so the read is narrowing-based: `ctx.user.id` (string)
+* + `ctx.user.isAdmin` (boolean) — the stable `AuthenticatedUser` core
+* every context factory produces. Returns null when no authenticated
+* user is present (the caller then fails the call — a fabricated
+* identity is never injected).
+*/
+function extractCallerIdentity(ctx) {
+	if (ctx === null || typeof ctx !== "object" || !("user" in ctx)) return null;
+	const user = ctx.user;
+	if (user === null || typeof user !== "object") return null;
+	if (!("id" in user) || !("isAdmin" in user)) return null;
+	const id = user.id;
+	const isAdmin = user.isAdmin;
+	if (typeof id !== "string" || id.length === 0 || typeof isAdmin !== "boolean") return null;
+	return {
+		userId: id,
+		isAdmin
+	};
+}
+/**
+* Return a NEW input object carrying the server-derived `caller`. The
+* spread-then-set ordering guarantees any client-supplied `caller` key
+* (which survives the `.loose()` wire parse) is overwritten. Raises
+* UNAUTHORIZED (or `badRequest` on a skewed services object without the
+* `unauthorized` raiser) when the context has no authenticated user.
+*/
+function injectCaller(rest, ctx, capName, methodName, services) {
+	const caller = extractCallerIdentity(ctx);
+	if (caller === null) return (services.unauthorized ?? services.badRequest)(`Capability "${capName}.${methodName}" requires an authenticated caller`);
+	return {
+		...rest,
+		caller
+	};
+}
 /** Strip a set of selector keys from an input object, returning a NEW object. */
 function stripKeys(input, keys) {
 	const src = input ?? {};
@@ -5422,6 +5460,9 @@ function requireLocal(capName, getLocal, services) {
 * Build a single capability's router (the runtime equivalent of one
 * codegen'd `createCapRouter_<Cap>`). Each method becomes a typed
 * procedure with the SAME routing branch the codegen emits.
+*
+* Exported for the caller-injection spec (which drives it with synthetic
+* cap defs) — production callers go through {@link buildCapRouters}.
 */
 function buildOneCapRouter(def, primitives, services) {
 	const capName = def.name;
@@ -5430,6 +5471,7 @@ function buildOneCapRouter(def, primitives, services) {
 	const nodeIdData = def.nodeIdMode === "data";
 	const procedures = {};
 	for (const method of methodsFor(def)) {
+		if (method.callerRequired && (method.kind === "subscription" || !method.isObject)) throw new Error(`Cap "${capName}" method "${method.name}": caller: 'required' is only supported on query/mutation methods with an object input schema`);
 		const effectiveMountKind = method.schema.systemOnly === true ? systemMountKind : mount.kind;
 		const isCollection = effectiveMountKind === "collection";
 		const getLocal = (ctx, addonId) => services.getLocalProvider(capName, effectiveMountKind, ctx, addonId);
@@ -5461,17 +5503,25 @@ function buildOneCapRouter(def, primitives, services) {
 		if (method.isObject) {
 			const schema = nodeIdData ? inputSchema : require_dist.looseSchema(inputSchema);
 			procedures[method.name] = base.input(schema)[procKind](({ input, ctx }) => {
-				if (nodeIdData) return requireLocal(capName, () => getLocal(ctx), services)[method.name]?.(input);
+				if (nodeIdData) {
+					const provider = requireLocal(capName, () => getLocal(ctx), services);
+					const payload = method.callerRequired ? injectCaller(stripKeys(input, []).rest, ctx, capName, method.name, services) : input;
+					return provider[method.name]?.(payload);
+				}
 				if (isCollection) {
 					const { rest, picked } = stripKeys(input, ["nodeId", "addonId"]);
 					const nodeId = typeof picked.nodeId === "string" ? picked.nodeId : void 0;
 					const topLevelAddonId = typeof picked.addonId === "string" ? picked.addonId : void 0;
 					const canRecoverNestedAddonId = !require_dist.isArrayOutputSchema(method.schema.output) && !require_dist.objectInputDeclaresAddonId(method.schema.input);
 					const addonId = topLevelAddonId ?? (canRecoverNestedAddonId ? require_dist.extractNestedAddonId(rest) : void 0);
-					return resolveProviderForCall(capName, nodeId, () => getLocal(ctx, addonId), services)[method.name]?.(rest);
+					const provider = resolveProviderForCall(capName, nodeId, () => getLocal(ctx, addonId), services);
+					const payload = method.callerRequired ? injectCaller(rest, ctx, capName, method.name, services) : rest;
+					return provider[method.name]?.(payload);
 				}
 				const { rest, picked } = stripKeys(input, ["nodeId"]);
-				return resolveProviderForCall(capName, typeof picked.nodeId === "string" ? picked.nodeId : void 0, () => getLocal(ctx), services)[method.name]?.(rest);
+				const provider = resolveProviderForCall(capName, typeof picked.nodeId === "string" ? picked.nodeId : void 0, () => getLocal(ctx), services);
+				const payload = method.callerRequired ? injectCaller(rest, ctx, capName, method.name, services) : rest;
+				return provider[method.name]?.(payload);
 			});
 			continue;
 		}

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { At as EventCategory$1, Dt as resolveCapMount, Et as readinessKey, F as kebabToCamel, I as lifecycleJobSchema, K as procedureAuthKey, M as isCollectionArrayMethod, N as isObjectInput, O as extractNestedAddonId, Ot as scopeKey, P as isVoidInput, Tt as parseJsonUnknown$1, U as objectInputDeclaresAddonId, _t as asString$1, ct as DEVICE_STATUS_METHOD, ft as ReadinessRegistry, gt as asNumber, ht as asJsonObject$1, it as errMsg$1, j as isArrayOutputSchema, o as METHOD_ACCESS_MAP, ot as DATAPLANE_SECRET_HEADER$1, p as addonSettingsCapability, pt as ReadinessTimeoutError, s as RUNTIME_DEFAULTS, st as DEVICE_SETTINGS_CONTRIBUTION_METHODS, t as ALL_CAPABILITY_DEFINITIONS, vt as createEvent, wt as parseJsonObject, xt as expandCapMethods, yt as emitDownForOwnedCaps, z as looseSchema } from "./dist-CfcmjXSI.mjs";
+import { At as EventCategory$1, Dt as resolveCapMount, Et as readinessKey, F as kebabToCamel, I as lifecycleJobSchema, K as procedureAuthKey, M as isCollectionArrayMethod, N as isObjectInput, O as extractNestedAddonId, Ot as scopeKey, P as isVoidInput, Tt as parseJsonUnknown$1, U as objectInputDeclaresAddonId, _t as asString$1, ct as DEVICE_STATUS_METHOD, ft as ReadinessRegistry, gt as asNumber, ht as asJsonObject$1, it as errMsg$1, j as isArrayOutputSchema, o as METHOD_ACCESS_MAP, ot as DATAPLANE_SECRET_HEADER$1, p as addonSettingsCapability, pt as ReadinessTimeoutError, s as RUNTIME_DEFAULTS, st as DEVICE_SETTINGS_CONTRIBUTION_METHODS, t as ALL_CAPABILITY_DEFINITIONS, vt as createEvent, wt as parseJsonObject, xt as expandCapMethods, yt as emitDownForOwnedCaps, z as looseSchema } from "./dist-CxM20CkF.mjs";
 import { a as downloadModel, c as getModelFilePath, d as contentTypeFor, f as createAuthenticatedFileServer, h as resolveFilePath, i as downloadFile, l as isModelDownloaded, m as parseTokenizedUrl, n as collectModelFiles, o as ensureModel, p as parseRangeHeader, r as deleteModelFromDisk, s as fetchJson, t as ModelDownloadService, u as createFileDataPlaneHandler } from "./model-download-service-Cp9f4dk6.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-QqIGHGMJ.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-CcW0WpfS.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Le3l0qS2.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
 import { SqliteSettingsAddon, t as SqliteSettingsBackend } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
@@ -5370,10 +5370,48 @@ function methodsFor(def) {
 			auth: m.auth ?? "protected",
 			schema: m,
 			isVoid: isVoidInput(m.input),
-			isObject: isObjectInput(m.input)
+			isObject: isObjectInput(m.input),
+			callerRequired: m.caller === "required"
 		};
 	});
 }
+/**
+* Extract the authenticated caller identity from the (structurally
+* unknown) tRPC context. The builder cannot import the server's
+* `TrpcContext`, so the read is narrowing-based: `ctx.user.id` (string)
+* + `ctx.user.isAdmin` (boolean) — the stable `AuthenticatedUser` core
+* every context factory produces. Returns null when no authenticated
+* user is present (the caller then fails the call — a fabricated
+* identity is never injected).
+*/
+function extractCallerIdentity(ctx) {
+	if (ctx === null || typeof ctx !== "object" || !("user" in ctx)) return null;
+	const user = ctx.user;
+	if (user === null || typeof user !== "object") return null;
+	if (!("id" in user) || !("isAdmin" in user)) return null;
+	const id = user.id;
+	const isAdmin = user.isAdmin;
+	if (typeof id !== "string" || id.length === 0 || typeof isAdmin !== "boolean") return null;
+	return {
+		userId: id,
+		isAdmin
+	};
+}
+/**
+* Return a NEW input object carrying the server-derived `caller`. The
+* spread-then-set ordering guarantees any client-supplied `caller` key
+* (which survives the `.loose()` wire parse) is overwritten. Raises
+* UNAUTHORIZED (or `badRequest` on a skewed services object without the
+* `unauthorized` raiser) when the context has no authenticated user.
+*/
+function injectCaller(rest, ctx, capName, methodName, services) {
+	const caller = extractCallerIdentity(ctx);
+	if (caller === null) return (services.unauthorized ?? services.badRequest)(`Capability "${capName}.${methodName}" requires an authenticated caller`);
+	return {
+		...rest,
+		caller
+	};
+}
 /** Strip a set of selector keys from an input object, returning a NEW object. */
 function stripKeys(input, keys) {
 	const src = input ?? {};
@@ -5414,6 +5452,9 @@ function requireLocal(capName, getLocal, services) {
 * Build a single capability's router (the runtime equivalent of one
 * codegen'd `createCapRouter_<Cap>`). Each method becomes a typed
 * procedure with the SAME routing branch the codegen emits.
+*
+* Exported for the caller-injection spec (which drives it with synthetic
+* cap defs) — production callers go through {@link buildCapRouters}.
 */
 function buildOneCapRouter(def, primitives, services) {
 	const capName = def.name;
@@ -5422,6 +5463,7 @@ function buildOneCapRouter(def, primitives, services) {
 	const nodeIdData = def.nodeIdMode === "data";
 	const procedures = {};
 	for (const method of methodsFor(def)) {
+		if (method.callerRequired && (method.kind === "subscription" || !method.isObject)) throw new Error(`Cap "${capName}" method "${method.name}": caller: 'required' is only supported on query/mutation methods with an object input schema`);
 		const effectiveMountKind = method.schema.systemOnly === true ? systemMountKind : mount.kind;
 		const isCollection = effectiveMountKind === "collection";
 		const getLocal = (ctx, addonId) => services.getLocalProvider(capName, effectiveMountKind, ctx, addonId);
@@ -5453,17 +5495,25 @@ function buildOneCapRouter(def, primitives, services) {
 		if (method.isObject) {
 			const schema = nodeIdData ? inputSchema : looseSchema(inputSchema);
 			procedures[method.name] = base.input(schema)[procKind](({ input, ctx }) => {
-				if (nodeIdData) return requireLocal(capName, () => getLocal(ctx), services)[method.name]?.(input);
+				if (nodeIdData) {
+					const provider = requireLocal(capName, () => getLocal(ctx), services);
+					const payload = method.callerRequired ? injectCaller(stripKeys(input, []).rest, ctx, capName, method.name, services) : input;
+					return provider[method.name]?.(payload);
+				}
 				if (isCollection) {
 					const { rest, picked } = stripKeys(input, ["nodeId", "addonId"]);
 					const nodeId = typeof picked.nodeId === "string" ? picked.nodeId : void 0;
 					const topLevelAddonId = typeof picked.addonId === "string" ? picked.addonId : void 0;
 					const canRecoverNestedAddonId = !isArrayOutputSchema(method.schema.output) && !objectInputDeclaresAddonId(method.schema.input);
 					const addonId = topLevelAddonId ?? (canRecoverNestedAddonId ? extractNestedAddonId(rest) : void 0);
-					return resolveProviderForCall(capName, nodeId, () => getLocal(ctx, addonId), services)[method.name]?.(rest);
+					const provider = resolveProviderForCall(capName, nodeId, () => getLocal(ctx, addonId), services);
+					const payload = method.callerRequired ? injectCaller(rest, ctx, capName, method.name, services) : rest;
+					return provider[method.name]?.(payload);
 				}
 				const { rest, picked } = stripKeys(input, ["nodeId"]);
-				return resolveProviderForCall(capName, typeof picked.nodeId === "string" ? picked.nodeId : void 0, () => getLocal(ctx), services)[method.name]?.(rest);
+				const provider = resolveProviderForCall(capName, typeof picked.nodeId === "string" ? picked.nodeId : void 0, () => getLocal(ctx), services);
+				const payload = method.callerRequired ? injectCaller(rest, ctx, capName, method.name, services) : rest;
+				return provider[method.name]?.(payload);
 			});
 			continue;
 		}

package/dist/kernel/cap-router-builder.d.ts

@@ -1,4 +1,4 @@
-import { CapabilityMountKind } from '@camstack/types';
+import { CapabilityDefinition, CapabilityMountKind } from '@camstack/types';
 /**
  * A tRPC-procedure-like builder. Mirrors the chainable surface the
  * codegen emits (`procedure.input(...).output(...).query(...)`), kept
@@ -64,7 +64,24 @@ export interface CapRouterServices {
     readonly noNodeRouting: (capName: string) => never;
     /** Raise the canonical "bad request: missing field" error. */
     readonly badRequest: (message: string) => never;
+    /**
+     * Raise the canonical UNAUTHORIZED error — used by `caller: 'required'`
+     * methods when the context carries no authenticated user. OPTIONAL for
+     * framework-live-update version skew (an older server may hand a
+     * services object without it to a newer builder); the builder falls
+     * back to `badRequest` in that case so the call still fails closed.
+     */
+    readonly unauthorized?: (message: string) => never;
 }
+/**
+ * Build a single capability's router (the runtime equivalent of one
+ * codegen'd `createCapRouter_<Cap>`). Each method becomes a typed
+ * procedure with the SAME routing branch the codegen emits.
+ *
+ * Exported for the caller-injection spec (which drives it with synthetic
+ * cap defs) — production callers go through {@link buildCapRouters}.
+ */
+export declare function buildOneCapRouter(def: CapabilityDefinition, primitives: CapRouterPrimitives, services: CapRouterServices): unknown;
 /**
  * Build the runtime cap-router map: `{ <camelCapName>: <router> }` for
  * every capability the builder owns. Caps with `mount.kind` `custom` /

package/dist/{manifest-python-deps-DIrBiAMS.js → manifest-python-deps-CUHn5wqq.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DEkwmyIj.js");
+const require_dist = require("./dist-CdgScQ3H.js");
 let _camstack_types_node = require("@camstack/types/node");
 let node_http = require("node:http");
 let node_fs = require("node:fs");

package/dist/{manifest-python-deps-QqIGHGMJ.mjs → manifest-python-deps-CcW0WpfS.mjs}

@@ -1,4 +1,4 @@
-import { q as readNodePin } from "./dist-CfcmjXSI.mjs";
+import { q as readNodePin } from "./dist-CxM20CkF.mjs";
 import { ensureBinary, ensureFfmpeg, ensurePython, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
 import { createServer } from "node:http";
 import * as fs from "node:fs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.7",
+  "version": "1.2.8",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",