@camstack/types 0.1.14 → 0.1.16

package/dist/capabilities/toast.cap.d.ts

@@ -0,0 +1,56 @@
+import { z } from 'zod';
+import { type InferProvider } from './capability-definition.js';
+/**
+ * toast — system-scoped singleton capability that streams toast
+ * notifications from the hub to connected admin-UI clients.
+ *
+ * Single push subscription (`onToast`). The provider lives in the
+ * server's `ToastService` (always available after boot) and is
+ * registered from `trpc.router.ts` against that service. No addon
+ * owns this state — toasts are server-broadcasted side-effects of
+ * other admin actions.
+ *
+ * Phase E of the API consolidation: previously a hand-written core
+ * router (re-introduced after a brief detour as a cap years ago).
+ * Cap conversion unifies the codegen pipeline so admin-ui consumers
+ * pick up the standard `useToastOnToast` hook through the same
+ * generator that emits every other system-cap subscription wrapper.
+ */
+declare const ToastSchema: z.ZodObject<{
+    title: z.ZodString;
+    message: z.ZodString;
+    severity: z.ZodEnum<{
+        info: "info";
+        warning: "warning";
+        critical: "critical";
+    }>;
+    duration: z.ZodOptional<z.ZodNumber>;
+    action: z.ZodOptional<z.ZodObject<{
+        label: z.ZodString;
+        url: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const toastCapability: {
+    readonly name: "toast";
+    readonly scope: "system";
+    readonly mode: "singleton";
+    readonly methods: {
+        readonly onToast: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodObject<{
+            title: z.ZodString;
+            message: z.ZodString;
+            severity: z.ZodEnum<{
+                info: "info";
+                warning: "warning";
+                critical: "critical";
+            }>;
+            duration: z.ZodOptional<z.ZodNumber>;
+            action: z.ZodOptional<z.ZodObject<{
+                label: z.ZodString;
+                url: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>, "subscription">;
+    };
+};
+export type IToastProvider = InferProvider<typeof toastCapability>;
+export { ToastSchema };
+//# sourceMappingURL=toast.cap.d.ts.map

package/dist/capabilities/toast.cap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toast.cap.d.ts","sourceRoot":"","sources":["../../src/capabilities/toast.cap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAElG;;;;;;;;;;;;;;;GAeG;AAEH,QAAA,MAAM,WAAW;;;;;;;;;;;;;iBAWf,CAAA;AAEF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;CAOa,CAAA;AAEzC,MAAM,MAAM,cAAc,GAAG,aAAa,CAAC,OAAO,eAAe,CAAC,CAAA;AAElE,OAAO,EAAE,WAAW,EAAE,CAAA"}

package/dist/capabilities/turn-orchestrator.cap.d.ts

@@ -0,0 +1,74 @@
+import { z } from 'zod';
+import { type InferProvider } from './capability-definition.js';
+declare const TurnProviderInfoSchema: z.ZodObject<{
+    addonId: z.ZodString;
+    displayName: z.ZodString;
+    kind: z.ZodEnum<{
+        other: "other";
+        cloudflare: "cloudflare";
+        coturn: "coturn";
+        twilio: "twilio";
+    }>;
+    enabled: z.ZodBoolean;
+    serverCount: z.ZodNumber;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type TurnProviderInfo = z.infer<typeof TurnProviderInfoSchema>;
+/**
+ * `turn-orchestrator` — singleton facade over the `turn-provider`
+ * collection. Provides:
+ *   - listProviders() — admin UI inventory
+ *   - getAllServers() — combined list of TURN/STUN URLs across all
+ *     enabled providers (what the WebRTC layer actually consumes)
+ *
+ * Mirrors `authentication` / `remote-access` — UI consumers go
+ * through the singleton, the singleton walks the collection.
+ *
+ * The WebRTC layer (broker / addon-go2rtc) historically called
+ * `turn-provider` collection methods directly to build the ICE
+ * server list per session. Going through this orchestrator instead
+ * gives a single throughput point + lets the admin disable a
+ * provider without uninstalling it.
+ */
+export declare const turnOrchestratorCapability: {
+    readonly name: "turn-orchestrator";
+    readonly scope: "system";
+    readonly mode: "singleton";
+    readonly methods: {
+        /** All registered TURN providers + per-provider stats. */
+        readonly listProviders: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            addonId: z.ZodString;
+            displayName: z.ZodString;
+            kind: z.ZodEnum<{
+                other: "other";
+                cloudflare: "cloudflare";
+                coturn: "coturn";
+                twilio: "twilio";
+            }>;
+            enabled: z.ZodBoolean;
+            serverCount: z.ZodNumber;
+            error: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>, import("./capability-definition.js").CapabilityMethodKind>;
+        /**
+         * Combined list of TURN/STUN servers from all ENABLED providers.
+         * Consumed by the WebRTC layer at session-creation time —
+         * implementations may fetch fresh short-lived credentials each
+         * call (e.g. Cloudflare API), so consumers SHOULD call per-session.
+         */
+        readonly getAllServers: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            urls: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+            username: z.ZodOptional<z.ZodString>;
+            credential: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>, import("./capability-definition.js").CapabilityMethodKind>;
+        /** Toggle a provider's enabled flag. */
+        readonly setProviderEnabled: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            addonId: z.ZodString;
+            enabled: z.ZodBoolean;
+        }, z.core.$strip>, z.ZodObject<{
+            success: z.ZodLiteral<true>;
+        }, z.core.$strip>, "mutation">;
+    };
+};
+export type ITurnOrchestratorProvider = InferProvider<typeof turnOrchestratorCapability>;
+export { TurnProviderInfoSchema };
+//# sourceMappingURL=turn-orchestrator.cap.d.ts.map

package/dist/capabilities/turn-orchestrator.cap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-orchestrator.cap.d.ts","sourceRoot":"","sources":["../../src/capabilities/turn-orchestrator.cap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAGlG,QAAA,MAAM,sBAAsB;;;;;;;;;;;;iBAmB1B,CAAA;AAEF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,0BAA0B;;;;;QAKnC,0DAA0D;;;;;;;;;;;;;;QAE1D;;;;;WAKG;;;;;;QAEH,wCAAwC;;;;;;;;CAOH,CAAA;AAEzC,MAAM,MAAM,yBAAyB,GAAG,aAAa,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAExF,OAAO,EAAE,sBAAsB,EAAE,CAAA"}

package/dist/capabilities/turn-provider.cap.d.ts

@@ -0,0 +1,43 @@
+import { z } from 'zod';
+import { type InferProvider } from './capability-definition.js';
+/**
+ * A single ICE TURN/STUN server entry, shape compatible with
+ * `RTCIceServer` in the WebRTC spec.
+ */
+declare const TurnServerSchema: z.ZodObject<{
+    urls: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+    username: z.ZodOptional<z.ZodString>;
+    credential: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * turn-provider — system collection of TURN/STUN server providers.
+ *
+ * Consumed by `webrtc` providers (e.g. addon-go2rtc) when building the
+ * ICE server list for an offer. Multiple providers can coexist
+ * (Cloudflare, self-hosted coturn, Twilio, etc.) — the webrtc layer
+ * concatenates servers from all registered implementations.
+ *
+ * Exposed over tRPC so that out-of-process addons (forked workers or
+ * remote agents) can also enumerate available TURN servers without
+ * requiring in-process access to the capability registry.
+ */
+export declare const turnProviderCapability: {
+    readonly name: "turn-provider";
+    readonly scope: "system";
+    readonly mode: "collection";
+    readonly methods: {
+        /**
+         * Return the current list of TURN/STUN servers with credentials.
+         * Implementations may fetch fresh short-lived credentials on each call
+         * (e.g. Cloudflare API) — consumers SHOULD call this per-session.
+         */
+        readonly getTurnServers: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            urls: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+            username: z.ZodOptional<z.ZodString>;
+            credential: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>, import("./capability-definition.js").CapabilityMethodKind>;
+    };
+};
+export type ITurnProvider = InferProvider<typeof turnProviderCapability>;
+export { TurnServerSchema };
+//# sourceMappingURL=turn-provider.cap.d.ts.map

package/dist/capabilities/turn-provider.cap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-provider.cap.d.ts","sourceRoot":"","sources":["../../src/capabilities/turn-provider.cap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAElG;;;GAGG;AACH,QAAA,MAAM,gBAAgB;;;;iBAKpB,CAAA;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB;;;;;QAK/B;;;;WAIG;;;;;;;CAMkC,CAAA;AAEzC,MAAM,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAExE,OAAO,EAAE,gBAAgB,EAAE,CAAA"}

package/dist/capabilities/user-management.cap.d.ts

@@ -0,0 +1,378 @@
+import { z } from 'zod';
+import { type InferProvider } from './capability-definition.js';
+declare const UserSummarySchema: z.ZodObject<{
+    id: z.ZodString;
+    username: z.ZodString;
+    role: z.ZodEnum<{
+        admin: "admin";
+        viewer: "viewer";
+        super_admin: "super_admin";
+        agent: "agent";
+    }>;
+    allowedProviders: z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>;
+    allowedDevices: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+}, z.core.$strip>;
+declare const CreateUserInputSchema: z.ZodObject<{
+    username: z.ZodString;
+    password: z.ZodString;
+    role: z.ZodEnum<{
+        admin: "admin";
+        viewer: "viewer";
+        super_admin: "super_admin";
+        agent: "agent";
+    }>;
+    allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
+    allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
+}, z.core.$strip>;
+declare const UpdateUserInputSchema: z.ZodObject<{
+    id: z.ZodString;
+    role: z.ZodOptional<z.ZodEnum<{
+        admin: "admin";
+        viewer: "viewer";
+        super_admin: "super_admin";
+        agent: "agent";
+    }>>;
+    allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
+    allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
+}, z.core.$strip>;
+declare const ApiKeySummarySchema: z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    role: z.ZodEnum<{
+        admin: "admin";
+        viewer: "viewer";
+        super_admin: "super_admin";
+        agent: "agent";
+    }>;
+    allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
+    allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
+    tokenPrefix: z.ZodString;
+    createdAt: z.ZodNumber;
+    lastUsedAt: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+declare const CreateApiKeyInputSchema: z.ZodObject<{
+    label: z.ZodString;
+    role: z.ZodEnum<{
+        admin: "admin";
+        viewer: "viewer";
+        super_admin: "super_admin";
+        agent: "agent";
+    }>;
+    allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
+    allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
+}, z.core.$strip>;
+declare const CreateApiKeyResultSchema: z.ZodObject<{
+    token: z.ZodString;
+    record: z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        role: z.ZodEnum<{
+            admin: "admin";
+            viewer: "viewer";
+            super_admin: "super_admin";
+            agent: "agent";
+        }>;
+        allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
+        allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
+        tokenPrefix: z.ZodString;
+        createdAt: z.ZodNumber;
+        lastUsedAt: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+declare const ScopedTokenSummarySchema: z.ZodObject<{
+    id: z.ZodString;
+    userId: z.ZodString;
+    name: z.ZodString;
+    tokenPrefix: z.ZodString;
+    scopes: z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<{
+            addon: "addon";
+            capability: "capability";
+            "route-prefix": "route-prefix";
+        }>;
+        target: z.ZodString;
+    }, z.core.$strip>>;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
+    lastUsedAt: z.ZodOptional<z.ZodNumber>;
+    createdAt: z.ZodNumber;
+}, z.core.$strip>;
+declare const CreateScopedTokenInputSchema: z.ZodObject<{
+    name: z.ZodString;
+    scopes: z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<{
+            addon: "addon";
+            capability: "capability";
+            "route-prefix": "route-prefix";
+        }>;
+        target: z.ZodString;
+    }, z.core.$strip>>;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+declare const CreateScopedTokenResultSchema: z.ZodObject<{
+    token: z.ZodString;
+    record: z.ZodObject<{
+        id: z.ZodString;
+        userId: z.ZodString;
+        name: z.ZodString;
+        tokenPrefix: z.ZodString;
+        scopes: z.ZodArray<z.ZodObject<{
+            type: z.ZodEnum<{
+                addon: "addon";
+                capability: "capability";
+                "route-prefix": "route-prefix";
+            }>;
+            target: z.ZodString;
+        }, z.core.$strip>>;
+        expiresAt: z.ZodOptional<z.ZodNumber>;
+        lastUsedAt: z.ZodOptional<z.ZodNumber>;
+        createdAt: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+/**
+ * user-management — singleton capability for user accounts, API keys,
+ * and scoped tokens.
+ *
+ * Implemented by the `local-auth` addon. Covers all CRUD operations
+ * that were previously hand-written in `users.router.ts` and
+ * `scoped-tokens.router.ts`.
+ *
+ * Login/logout/me stay in the server's core auth router because they
+ * depend on JWT signing (a server-level concern, not an addon concern).
+ *
+ * Extension: the `auth-provider` capability (collection) provides
+ * pluggable authentication mechanisms (local password, OIDC, etc.).
+ * The server's login flow delegates to `auth-provider.validateCredentials()`
+ * and then signs the JWT.
+ */
+export declare const userManagementCapability: {
+    readonly name: "user-management";
+    readonly scope: "system";
+    readonly mode: "singleton";
+    readonly methods: {
+        readonly listUsers: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            username: z.ZodString;
+            role: z.ZodEnum<{
+                admin: "admin";
+                viewer: "viewer";
+                super_admin: "super_admin";
+                agent: "agent";
+            }>;
+            allowedProviders: z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>;
+            allowedDevices: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
+            createdAt: z.ZodNumber;
+            updatedAt: z.ZodNumber;
+        }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
+        readonly createUser: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            username: z.ZodString;
+            password: z.ZodString;
+            role: z.ZodEnum<{
+                admin: "admin";
+                viewer: "viewer";
+                super_admin: "super_admin";
+                agent: "agent";
+            }>;
+            allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
+            allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
+        }, z.core.$strip>, z.ZodObject<{
+            id: z.ZodString;
+            username: z.ZodString;
+            role: z.ZodEnum<{
+                admin: "admin";
+                viewer: "viewer";
+                super_admin: "super_admin";
+                agent: "agent";
+            }>;
+            allowedProviders: z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>;
+            allowedDevices: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
+            createdAt: z.ZodNumber;
+            updatedAt: z.ZodNumber;
+        }, z.core.$strip>, "mutation">;
+        readonly updateUser: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            id: z.ZodString;
+            role: z.ZodOptional<z.ZodEnum<{
+                admin: "admin";
+                viewer: "viewer";
+                super_admin: "super_admin";
+                agent: "agent";
+            }>>;
+            allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
+            allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
+        }, z.core.$strip>, z.ZodObject<{
+            success: z.ZodLiteral<true>;
+        }, z.core.$strip>, "mutation">;
+        readonly deleteUser: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            id: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            success: z.ZodLiteral<true>;
+        }, z.core.$strip>, "mutation">;
+        readonly resetPassword: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            id: z.ZodString;
+            newPassword: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            success: z.ZodLiteral<true>;
+        }, z.core.$strip>, "mutation">;
+        readonly validateCredentials: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            username: z.ZodString;
+            password: z.ZodString;
+        }, z.core.$strip>, z.ZodNullable<z.ZodObject<{
+            id: z.ZodString;
+            username: z.ZodString;
+            role: z.ZodEnum<{
+                admin: "admin";
+                viewer: "viewer";
+                super_admin: "super_admin";
+                agent: "agent";
+            }>;
+            allowedProviders: z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>;
+            allowedDevices: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
+            createdAt: z.ZodNumber;
+            updatedAt: z.ZodNumber;
+            passwordHash: z.ZodString;
+        }, z.core.$strip>>, "mutation">;
+        readonly listApiKeys: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            label: z.ZodString;
+            role: z.ZodEnum<{
+                admin: "admin";
+                viewer: "viewer";
+                super_admin: "super_admin";
+                agent: "agent";
+            }>;
+            allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
+            allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
+            tokenPrefix: z.ZodString;
+            createdAt: z.ZodNumber;
+            lastUsedAt: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
+        readonly createApiKey: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            label: z.ZodString;
+            role: z.ZodEnum<{
+                admin: "admin";
+                viewer: "viewer";
+                super_admin: "super_admin";
+                agent: "agent";
+            }>;
+            allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
+            allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
+        }, z.core.$strip>, z.ZodObject<{
+            token: z.ZodString;
+            record: z.ZodObject<{
+                id: z.ZodString;
+                label: z.ZodString;
+                role: z.ZodEnum<{
+                    admin: "admin";
+                    viewer: "viewer";
+                    super_admin: "super_admin";
+                    agent: "agent";
+                }>;
+                allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
+                allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
+                tokenPrefix: z.ZodString;
+                createdAt: z.ZodNumber;
+                lastUsedAt: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>;
+        }, z.core.$strip>, "mutation">;
+        readonly revokeApiKey: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            id: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            success: z.ZodLiteral<true>;
+        }, z.core.$strip>, "mutation">;
+        readonly validateApiKey: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            token: z.ZodString;
+        }, z.core.$strip>, z.ZodNullable<z.ZodObject<{
+            id: z.ZodString;
+            label: z.ZodString;
+            role: z.ZodEnum<{
+                admin: "admin";
+                viewer: "viewer";
+                super_admin: "super_admin";
+                agent: "agent";
+            }>;
+            allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
+            allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
+            tokenPrefix: z.ZodString;
+            createdAt: z.ZodNumber;
+            lastUsedAt: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>, "mutation">;
+        readonly createScopedToken: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            name: z.ZodString;
+            scopes: z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<{
+                    addon: "addon";
+                    capability: "capability";
+                    "route-prefix": "route-prefix";
+                }>;
+                target: z.ZodString;
+            }, z.core.$strip>>;
+            expiresAt: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>, z.ZodObject<{
+            token: z.ZodString;
+            record: z.ZodObject<{
+                id: z.ZodString;
+                userId: z.ZodString;
+                name: z.ZodString;
+                tokenPrefix: z.ZodString;
+                scopes: z.ZodArray<z.ZodObject<{
+                    type: z.ZodEnum<{
+                        addon: "addon";
+                        capability: "capability";
+                        "route-prefix": "route-prefix";
+                    }>;
+                    target: z.ZodString;
+                }, z.core.$strip>>;
+                expiresAt: z.ZodOptional<z.ZodNumber>;
+                lastUsedAt: z.ZodOptional<z.ZodNumber>;
+                createdAt: z.ZodNumber;
+            }, z.core.$strip>;
+        }, z.core.$strip>, "mutation">;
+        readonly revokeScopedToken: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            id: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            success: z.ZodLiteral<true>;
+        }, z.core.$strip>, "mutation">;
+        readonly validateScopedToken: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            token: z.ZodString;
+        }, z.core.$strip>, z.ZodNullable<z.ZodObject<{
+            id: z.ZodString;
+            userId: z.ZodString;
+            name: z.ZodString;
+            tokenPrefix: z.ZodString;
+            scopes: z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<{
+                    addon: "addon";
+                    capability: "capability";
+                    "route-prefix": "route-prefix";
+                }>;
+                target: z.ZodString;
+            }, z.core.$strip>>;
+            expiresAt: z.ZodOptional<z.ZodNumber>;
+            lastUsedAt: z.ZodOptional<z.ZodNumber>;
+            createdAt: z.ZodNumber;
+        }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
+        readonly listScopedTokens: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            userId: z.ZodString;
+        }, z.core.$strip>, z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            userId: z.ZodString;
+            name: z.ZodString;
+            tokenPrefix: z.ZodString;
+            scopes: z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<{
+                    addon: "addon";
+                    capability: "capability";
+                    "route-prefix": "route-prefix";
+                }>;
+                target: z.ZodString;
+            }, z.core.$strip>>;
+            expiresAt: z.ZodOptional<z.ZodNumber>;
+            lastUsedAt: z.ZodOptional<z.ZodNumber>;
+            createdAt: z.ZodNumber;
+        }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
+    };
+};
+export type IUserManagementProvider = InferProvider<typeof userManagementCapability>;
+export { UserSummarySchema, CreateUserInputSchema, UpdateUserInputSchema, ApiKeySummarySchema, CreateApiKeyInputSchema, CreateApiKeyResultSchema, ScopedTokenSummarySchema, CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, };
+//# sourceMappingURL=user-management.cap.d.ts.map

package/dist/capabilities/user-management.cap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-management.cap.d.ts","sourceRoot":"","sources":["../../src/capabilities/user-management.cap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAIlG,QAAA,MAAM,iBAAiB;;;;;;;;;;;;;iBAQrB,CAAA;AAEF,QAAA,MAAM,qBAAqB;;;;;;;;;;;iBAMzB,CAAA;AAEF,QAAA,MAAM,qBAAqB;;;;;;;;;;iBAKzB,CAAA;AAEF,QAAA,MAAM,mBAAmB;;;;;;;;;;;;;;iBASvB,CAAA;AAEF,QAAA,MAAM,uBAAuB;;;;;;;;;;iBAK3B,CAAA;AAEF,QAAA,MAAM,wBAAwB;;;;;;;;;;;;;;;;;iBAG5B,CAAA;AAOF,QAAA,MAAM,wBAAwB;;;;;;;;;;;;;;;;iBAS5B,CAAA;AAEF,QAAA,MAAM,4BAA4B;;;;;;;;;;;iBAIhC,CAAA;AAEF,QAAA,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;iBAGjC,CAAA;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCI,CAAA;AAEzC,MAAM,MAAM,uBAAuB,GAAG,aAAa,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAEpF,OAAO,EACL,iBAAiB,EAAE,qBAAqB,EAAE,qBAAqB,EAC/D,mBAAmB,EAAE,uBAAuB,EAAE,wBAAwB,EACtE,wBAAwB,EAAE,4BAA4B,EAAE,6BAA6B,GACtF,CAAA"}