@camstack/types 0.1.26 → 0.1.27

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -760,6 +760,7 @@ function method(input, output, options) {
760
760
  output,
761
761
  kind: options?.kind ?? "query",
762
762
  auth: options?.auth ?? "protected",
763
+ ...options?.access !== void 0 ? { access: options.access } : {},
763
764
  timeoutMs: options?.timeoutMs
764
765
  };
765
766
  }
@@ -3187,17 +3188,17 @@ const storageCapability = {
3187
3188
  upsertLocation: method(
3188
3189
  StorageLocationSchema.omit({ createdAt: true, updatedAt: true }),
3189
3190
  StorageLocationSchema,
3190
- { kind: "mutation", auth: "superAdmin" }
3191
+ { kind: "mutation", auth: "admin" }
3191
3192
  ),
3192
3193
  deleteLocation: method(
3193
3194
  z.object({ id: z.string() }),
3194
3195
  z.void(),
3195
- { kind: "mutation", auth: "superAdmin" }
3196
+ { kind: "mutation", auth: "admin" }
3196
3197
  ),
3197
3198
  testLocation: method(
3198
3199
  z.object({ id: z.string() }),
3199
3200
  z.object({ ok: z.boolean(), error: z.string().optional() }),
3200
- { auth: "superAdmin" }
3201
+ { auth: "admin" }
3201
3202
  ),
3202
3203
  // ── Provider discovery ──────────────────────────────────────────
3203
3204
  // The admin-UI's "Add location" wizard shows one entry per
@@ -3225,7 +3226,7 @@ const storageCapability = {
3225
3226
  config: z.record(z.string(), z.unknown())
3226
3227
  }),
3227
3228
  z.object({ ok: z.boolean(), error: z.string().optional() }),
3228
- { auth: "superAdmin" }
3229
+ { auth: "admin" }
3229
3230
  )
3230
3231
  }
3231
3232
  };
@@ -3278,7 +3279,7 @@ const storageProviderCapability = {
3278
3279
  testLocation: method(
3279
3280
  z.object({ config: z.record(z.string(), z.unknown()) }),
3280
3281
  TestLocationResultSchema,
3281
- { auth: "superAdmin" }
3282
+ { auth: "admin" }
3282
3283
  ),
3283
3284
  // ── Small-file primitives ────────────────────────────────────────
3284
3285
  // The location is passed inline so the orchestrator dispatches
@@ -3416,7 +3417,7 @@ const backupCapability = {
3416
3417
  listDestinations: method(
3417
3418
  z.void(),
3418
3419
  z.array(BackupDestinationInfoSchema).readonly(),
3419
- { auth: "superAdmin" }
3420
+ { auth: "admin" }
3420
3421
  ),
3421
3422
  /**
3422
3423
  * Trigger a backup. Without `destinations` the orchestrator fans
@@ -3431,16 +3432,16 @@ const backupCapability = {
3431
3432
  label: z.string().optional()
3432
3433
  }).optional(),
3433
3434
  z.array(BackupEntrySchema).readonly(),
3434
- { kind: "mutation", auth: "superAdmin" }
3435
+ { kind: "mutation", auth: "admin" }
3435
3436
  ),
3436
3437
  /** Union of every destination's archives, each tagged with `destinationId`. */
3437
- list: method(z.void(), z.array(BackupEntrySchema).readonly(), { auth: "superAdmin" }),
3438
+ list: method(z.void(), z.array(BackupEntrySchema).readonly(), { auth: "admin" }),
3438
3439
  /**
3439
3440
  * Pre-backup snapshot of the well-known locations on disk — sizes
3440
3441
  * + file counts. Powers the opt-in checklist that lets the
3441
3442
  * operator pick which subsections of state get archived.
3442
3443
  */
3443
- listLocations: method(z.void(), z.array(LocationStatSchema).readonly(), { auth: "superAdmin" }),
3444
+ listLocations: method(z.void(), z.array(LocationStatSchema).readonly(), { auth: "admin" }),
3444
3445
  /**
3445
3446
  * Read the embedded `.camstack-backup-manifest.json` from a
3446
3447
  * previously-created archive. The manifest carries the full
@@ -3452,7 +3453,7 @@ const backupCapability = {
3452
3453
  getEntries: method(
3453
3454
  z.object({ destinationId: z.string(), backupId: z.string() }),
3454
3455
  ArchiveManifestSchema.nullable(),
3455
- { auth: "superAdmin" }
3456
+ { auth: "admin" }
3456
3457
  ),
3457
3458
  restore: method(
3458
3459
  z.object({
@@ -3468,12 +3469,12 @@ const backupCapability = {
3468
3469
  locations: z.array(z.string()).optional()
3469
3470
  }),
3470
3471
  z.void(),
3471
- { kind: "mutation", auth: "superAdmin" }
3472
+ { kind: "mutation", auth: "admin" }
3472
3473
  ),
3473
3474
  delete: method(
3474
3475
  z.object({ destinationId: z.string(), backupId: z.string() }),
3475
3476
  z.void(),
3476
- { kind: "mutation", auth: "superAdmin" }
3477
+ { kind: "mutation", auth: "admin" }
3477
3478
  ),
3478
3479
  /**
3479
3480
  * List archives at a single destination. Reads the per-location
@@ -3483,7 +3484,7 @@ const backupCapability = {
3483
3484
  listArchives: method(
3484
3485
  z.object({ destinationId: z.string() }),
3485
3486
  z.array(BackupArchiveEntrySchema).readonly(),
3486
- { auth: "superAdmin" }
3487
+ { auth: "admin" }
3487
3488
  ),
3488
3489
  /**
3489
3490
  * Upsert a per-destination policy row. The `locationId` MUST be
@@ -3506,7 +3507,7 @@ const backupCapability = {
3506
3507
  cron: z.string().optional()
3507
3508
  }),
3508
3509
  z.void(),
3509
- { kind: "mutation", auth: "superAdmin" }
3510
+ { kind: "mutation", auth: "admin" }
3510
3511
  ),
3511
3512
  /**
3512
3513
  * Validate a cron expression and peek the next N firing times.
@@ -5377,7 +5378,7 @@ const authenticationCapability = {
5377
5378
  setProviderEnabled: method(
5378
5379
  z.object({ addonId: z.string(), enabled: z.boolean() }),
5379
5380
  z.object({ success: z.literal(true) }),
5380
- { kind: "mutation", auth: "superAdmin" }
5381
+ { kind: "mutation", auth: "admin" }
5381
5382
  )
5382
5383
  }
5383
5384
  };
@@ -5439,13 +5440,13 @@ const remoteAccessCapability = {
5439
5440
  startProvider: method(
5440
5441
  z.object({ addonId: z.string() }),
5441
5442
  RemoteAccessEndpointSchema,
5442
- { kind: "mutation", auth: "superAdmin" }
5443
+ { kind: "mutation", auth: "admin" }
5443
5444
  ),
5444
5445
  /** Stop a specific provider's tunnel (idempotent on already-stopped). */
5445
5446
  stopProvider: method(
5446
5447
  z.object({ addonId: z.string() }),
5447
5448
  z.object({ success: z.literal(true) }),
5448
- { kind: "mutation", auth: "superAdmin" }
5449
+ { kind: "mutation", auth: "admin" }
5449
5450
  )
5450
5451
  }
5451
5452
  };
@@ -5509,7 +5510,7 @@ const turnOrchestratorCapability = {
5509
5510
  setProviderEnabled: method(
5510
5511
  z.object({ addonId: z.string(), enabled: z.boolean() }),
5511
5512
  z.object({ success: z.literal(true) }),
5512
- { kind: "mutation", auth: "superAdmin" }
5513
+ { kind: "mutation", auth: "admin" }
5513
5514
  )
5514
5515
  }
5515
5516
  };
@@ -7182,33 +7183,84 @@ const meshOrchestratorCapability = {
7182
7183
  )
7183
7184
  }
7184
7185
  };
7185
- const UserRoleSchema$1 = z.enum(["super_admin", "admin", "viewer", "agent", "scoped"]);
7186
+ const UserRoleSchema = z.enum(["admin", "viewer", "agent", "scoped"]);
7187
+ const AllowedProviderSchema = z.union([z.literal("*"), z.array(z.string())]);
7188
+ const AllowedDevicesSchema = z.record(z.string(), z.union([z.literal("*"), z.array(z.string())]));
7189
+ const MethodAccessSchema = z.enum(["view", "create", "delete"]);
7190
+ const TokenScopeSchema = z.object({
7191
+ type: z.enum(["addon", "capability"]),
7192
+ target: z.string(),
7193
+ access: z.array(MethodAccessSchema).min(1)
7194
+ });
7195
+ const UserRecordSchema = z.object({
7196
+ id: z.string(),
7197
+ username: z.string(),
7198
+ passwordHash: z.string(),
7199
+ role: UserRoleSchema,
7200
+ allowedProviders: AllowedProviderSchema,
7201
+ allowedDevices: AllowedDevicesSchema,
7202
+ /**
7203
+ * Scopes granted to this user. Admins bypass; their `scopes` is ignored.
7204
+ * Non-admins (`viewer`, `agent`, `scoped`) without scopes are locked out
7205
+ * of every protected call.
7206
+ */
7207
+ scopes: z.array(TokenScopeSchema).default([]),
7208
+ createdAt: z.number(),
7209
+ updatedAt: z.number()
7210
+ });
7211
+ const ApiKeyRecordSchema = z.object({
7212
+ id: z.string(),
7213
+ label: z.string(),
7214
+ role: UserRoleSchema,
7215
+ allowedProviders: AllowedProviderSchema,
7216
+ allowedDevices: AllowedDevicesSchema,
7217
+ tokenHash: z.string(),
7218
+ tokenPrefix: z.string(),
7219
+ createdAt: z.number(),
7220
+ lastUsedAt: z.number().optional()
7221
+ });
7222
+ const ScopedTokenSchema = z.object({
7223
+ id: z.string(),
7224
+ userId: z.string(),
7225
+ name: z.string(),
7226
+ tokenHash: z.string(),
7227
+ tokenPrefix: z.string(),
7228
+ scopes: z.array(TokenScopeSchema),
7229
+ // SQLite/JSON storage round-trips undefined → null. Use `nullish` so the
7230
+ // schema accepts both `null` (read from disk) and `undefined` (in-memory).
7231
+ expiresAt: z.number().nullish(),
7232
+ lastUsedAt: z.number().nullish(),
7233
+ createdAt: z.number()
7234
+ });
7186
7235
  const UserSummarySchema = z.object({
7187
7236
  id: z.string(),
7188
7237
  username: z.string(),
7189
- role: UserRoleSchema$1,
7238
+ role: UserRoleSchema,
7190
7239
  allowedProviders: z.union([z.array(z.string()), z.literal("*")]),
7191
7240
  allowedDevices: z.record(z.string(), z.union([z.array(z.string()), z.literal("*")])),
7241
+ scopes: z.array(TokenScopeSchema).default([]),
7192
7242
  createdAt: z.number(),
7193
7243
  updatedAt: z.number()
7194
7244
  });
7195
7245
  const CreateUserInputSchema = z.object({
7196
7246
  username: z.string(),
7197
7247
  password: z.string().min(6),
7198
- role: UserRoleSchema$1,
7248
+ role: UserRoleSchema,
7199
7249
  allowedProviders: z.union([z.array(z.string()), z.literal("*")]).optional(),
7200
- allowedDevices: z.record(z.string(), z.union([z.array(z.string()), z.literal("*")])).optional()
7250
+ allowedDevices: z.record(z.string(), z.union([z.array(z.string()), z.literal("*")])).optional(),
7251
+ scopes: z.array(TokenScopeSchema).optional()
7201
7252
  });
7202
7253
  const UpdateUserInputSchema = z.object({
7203
7254
  id: z.string(),
7204
- role: UserRoleSchema$1.optional(),
7255
+ role: UserRoleSchema.optional(),
7205
7256
  allowedProviders: z.union([z.array(z.string()), z.literal("*")]).optional(),
7206
- allowedDevices: z.record(z.string(), z.union([z.array(z.string()), z.literal("*")])).optional()
7257
+ allowedDevices: z.record(z.string(), z.union([z.array(z.string()), z.literal("*")])).optional(),
7258
+ scopes: z.array(TokenScopeSchema).optional()
7207
7259
  });
7208
7260
  const ApiKeySummarySchema = z.object({
7209
7261
  id: z.string(),
7210
7262
  label: z.string(),
7211
- role: UserRoleSchema$1,
7263
+ role: UserRoleSchema,
7212
7264
  allowedProviders: z.union([z.array(z.string()), z.literal("*")]).optional(),
7213
7265
  allowedDevices: z.record(z.string(), z.union([z.array(z.string()), z.literal("*")])).optional(),
7214
7266
  tokenPrefix: z.string(),
@@ -7217,7 +7269,7 @@ const ApiKeySummarySchema = z.object({
7217
7269
  });
7218
7270
  const CreateApiKeyInputSchema = z.object({
7219
7271
  label: z.string(),
7220
- role: UserRoleSchema$1,
7272
+ role: UserRoleSchema,
7221
7273
  allowedProviders: z.union([z.array(z.string()), z.literal("*")]).optional(),
7222
7274
  allowedDevices: z.record(z.string(), z.union([z.array(z.string()), z.literal("*")])).optional()
7223
7275
  });
@@ -7225,16 +7277,12 @@ const CreateApiKeyResultSchema = z.object({
7225
7277
  token: z.string(),
7226
7278
  record: ApiKeySummarySchema
7227
7279
  });
7228
- const TokenScopeSchema$1 = z.object({
7229
- type: z.enum(["addon", "route-prefix", "capability"]),
7230
- target: z.string()
7231
- });
7232
7280
  const ScopedTokenSummarySchema = z.object({
7233
7281
  id: z.string(),
7234
7282
  userId: z.string(),
7235
7283
  name: z.string(),
7236
7284
  tokenPrefix: z.string(),
7237
- scopes: z.array(TokenScopeSchema$1),
7285
+ scopes: z.array(TokenScopeSchema),
7238
7286
  // Mirror the storage schema: `.nullish()` accepts the SQLite-native
7239
7287
  // `null` for absent timestamps as well as in-memory `undefined`.
7240
7288
  expiresAt: z.number().nullish(),
@@ -7247,7 +7295,7 @@ const CreateScopedTokenInputSchema = z.object({
7247
7295
  // its own logged-in `user.id` here.
7248
7296
  userId: z.string(),
7249
7297
  name: z.string(),
7250
- scopes: z.array(TokenScopeSchema$1),
7298
+ scopes: z.array(TokenScopeSchema),
7251
7299
  expiresAt: z.number().optional()
7252
7300
  });
7253
7301
  const CreateScopedTokenResultSchema = z.object({
@@ -7261,13 +7309,22 @@ const userManagementCapability = {
7261
7309
  methods: {
7262
7310
  // ── Users ──────────────────────────────────────────────────────
7263
7311
  listUsers: method(z.void(), z.array(UserSummarySchema), { auth: "admin" }),
7264
- createUser: method(CreateUserInputSchema, UserSummarySchema, { kind: "mutation", auth: "superAdmin" }),
7265
- updateUser: method(UpdateUserInputSchema, z.object({ success: z.literal(true) }), { kind: "mutation", auth: "superAdmin" }),
7266
- deleteUser: method(z.object({ id: z.string() }), z.object({ success: z.literal(true) }), { kind: "mutation", auth: "superAdmin" }),
7312
+ createUser: method(CreateUserInputSchema, UserSummarySchema, { kind: "mutation", auth: "admin" }),
7313
+ updateUser: method(UpdateUserInputSchema, z.object({ success: z.literal(true) }), { kind: "mutation", auth: "admin" }),
7314
+ deleteUser: method(z.object({ id: z.string() }), z.object({ success: z.literal(true) }), { kind: "mutation", auth: "admin" }),
7267
7315
  resetPassword: method(
7268
7316
  z.object({ id: z.string(), newPassword: z.string().min(6) }),
7269
7317
  z.object({ success: z.literal(true) }),
7270
- { kind: "mutation", auth: "superAdmin" }
7318
+ { kind: "mutation", auth: "admin" }
7319
+ ),
7320
+ /**
7321
+ * Replace the scope set on a user. Subset check: the caller's scopes
7322
+ * must include every requested scope+access (admin bypasses).
7323
+ */
7324
+ setUserScopes: method(
7325
+ z.object({ userId: z.string(), scopes: z.array(TokenScopeSchema) }),
7326
+ z.object({ success: z.literal(true) }),
7327
+ { kind: "mutation", auth: "admin" }
7271
7328
  ),
7272
7329
  validateCredentials: method(
7273
7330
  z.object({ username: z.string(), password: z.string() }),
@@ -7323,9 +7380,9 @@ const systemCapability = {
7323
7380
  setRetentionConfig: method(
7324
7381
  z.record(z.string(), z.unknown()),
7325
7382
  z.null(),
7326
- { kind: "mutation", auth: "superAdmin" }
7383
+ { kind: "mutation", auth: "admin" }
7327
7384
  ),
7328
- forceRetentionCleanup: method(z.void(), z.void(), { kind: "mutation", auth: "superAdmin" })
7385
+ forceRetentionCleanup: method(z.void(), z.void(), { kind: "mutation", auth: "admin" })
7329
7386
  }
7330
7387
  };
7331
7388
  const StreamNetworkStatsSchema = z.object({
@@ -7470,45 +7527,45 @@ const nodesCapability = {
7470
7527
  ),
7471
7528
  deployAddon: method(NodeAddonInputSchema, SuccessSchema, {
7472
7529
  kind: "mutation",
7473
- auth: "superAdmin"
7530
+ auth: "admin"
7474
7531
  }),
7475
7532
  undeployAddon: method(NodeAddonInputSchema, SuccessSchema, {
7476
7533
  kind: "mutation",
7477
- auth: "superAdmin"
7534
+ auth: "admin"
7478
7535
  }),
7479
7536
  restartAddon: method(NodeAddonInputSchema, SuccessSchema, {
7480
7537
  kind: "mutation",
7481
- auth: "superAdmin"
7538
+ auth: "admin"
7482
7539
  }),
7483
7540
  restartProcess: method(
7484
7541
  z.object({ nodeId: z.string(), processName: z.string() }),
7485
7542
  RestartProcessResultSchema,
7486
- { kind: "mutation", auth: "superAdmin" }
7543
+ { kind: "mutation", auth: "admin" }
7487
7544
  ),
7488
7545
  restartNode: method(
7489
7546
  z.object({ nodeId: z.string() }),
7490
7547
  RestartNodeResultSchema,
7491
- { kind: "mutation", auth: "superAdmin" }
7548
+ { kind: "mutation", auth: "admin" }
7492
7549
  ),
7493
7550
  shutdownNode: method(
7494
7551
  z.object({ nodeId: z.string() }),
7495
7552
  SuccessSchema,
7496
- { kind: "mutation", auth: "superAdmin" }
7553
+ { kind: "mutation", auth: "admin" }
7497
7554
  ),
7498
7555
  renameNode: method(
7499
7556
  z.object({ nodeId: z.string(), name: z.string().min(1).max(64) }),
7500
7557
  RenameNodeResultSchema,
7501
- { kind: "mutation", auth: "superAdmin" }
7558
+ { kind: "mutation", auth: "admin" }
7502
7559
  ),
7503
7560
  clusterAddonStatus: method(
7504
7561
  z.void(),
7505
7562
  z.record(z.string(), ClusterAddonStatusEntrySchema),
7506
- { auth: "superAdmin" }
7563
+ { auth: "admin" }
7507
7564
  ),
7508
7565
  setProcessLogLevel: method(
7509
7566
  z.object({ nodeId: z.string(), level: z.string() }),
7510
7567
  SuccessSchema,
7511
- { kind: "mutation", auth: "superAdmin" }
7568
+ { kind: "mutation", auth: "admin" }
7512
7569
  ),
7513
7570
  executeQuery: method(
7514
7571
  z.object({
@@ -7518,7 +7575,7 @@ const nodesCapability = {
7518
7575
  params: z.record(z.string(), z.unknown()).optional()
7519
7576
  }),
7520
7577
  z.unknown(),
7521
- { kind: "mutation", auth: "superAdmin" }
7578
+ { kind: "mutation", auth: "admin" }
7522
7579
  )
7523
7580
  }
7524
7581
  };
@@ -7593,12 +7650,12 @@ const integrationsCapability = {
7593
7650
  update: method(
7594
7651
  UpdateIntegrationInputSchema,
7595
7652
  IntegrationLiteSchema,
7596
- { kind: "mutation", auth: "superAdmin" }
7653
+ { kind: "mutation", auth: "admin" }
7597
7654
  ),
7598
7655
  delete: method(
7599
7656
  z.object({ id: z.string() }),
7600
7657
  DeleteIntegrationResultSchema,
7601
- { kind: "mutation", auth: "superAdmin" }
7658
+ { kind: "mutation", auth: "admin" }
7602
7659
  ),
7603
7660
  getSettings: method(
7604
7661
  z.object({ id: z.string() }),
@@ -7611,7 +7668,7 @@ const integrationsCapability = {
7611
7668
  settings: z.record(z.string(), z.unknown())
7612
7669
  }),
7613
7670
  z.object({ success: z.boolean() }),
7614
- { kind: "mutation", auth: "superAdmin" }
7671
+ { kind: "mutation", auth: "admin" }
7615
7672
  ),
7616
7673
  getAvailableTypes: method(
7617
7674
  z.void(),
@@ -7766,7 +7823,7 @@ const addonsCapability = {
7766
7823
  installPackage: method(
7767
7824
  z.object({ packageName: z.string(), version: z.string().optional() }),
7768
7825
  InstallPackageResultSchema,
7769
- { kind: "mutation", auth: "superAdmin" }
7826
+ { kind: "mutation", auth: "admin" }
7770
7827
  ),
7771
7828
  installFromWorkspace: method(
7772
7829
  z.object({ packageName: z.string() }),
@@ -7778,7 +7835,7 @@ const addonsCapability = {
7778
7835
  uninstallPackage: method(
7779
7836
  z.object({ packageName: z.string() }),
7780
7837
  z.unknown(),
7781
- { kind: "mutation", auth: "superAdmin" }
7838
+ { kind: "mutation", auth: "admin" }
7782
7839
  ),
7783
7840
  reloadPackages: method(z.void(), ReloadPackagesResultSchema, {
7784
7841
  kind: "mutation",
@@ -7800,7 +7857,7 @@ const addonsCapability = {
7800
7857
  updatePackage: method(
7801
7858
  z.object({ name: z.string().min(1), version: z.string().optional() }),
7802
7859
  z.unknown(),
7803
- { kind: "mutation", auth: "superAdmin" }
7860
+ { kind: "mutation", auth: "admin" }
7804
7861
  ),
7805
7862
  /**
7806
7863
  * Roll back an addon to the version it had before the most recent
@@ -7817,13 +7874,13 @@ const addonsCapability = {
7817
7874
  rollbackPackage: method(
7818
7875
  z.object({ name: z.string().min(1) }),
7819
7876
  z.object({ rolledBackTo: z.string().nullable() }),
7820
- { kind: "mutation", auth: "superAdmin" }
7877
+ { kind: "mutation", auth: "admin" }
7821
7878
  ),
7822
7879
  forceRefresh: method(z.void(), z.unknown(), { kind: "mutation", auth: "admin" }),
7823
7880
  restartServer: method(
7824
7881
  z.object({ confirm: z.literal(true) }),
7825
7882
  z.unknown(),
7826
- { kind: "mutation", auth: "superAdmin" }
7883
+ { kind: "mutation", auth: "admin" }
7827
7884
  ),
7828
7885
  getVersions: method(
7829
7886
  z.object({ name: z.string() }),
@@ -7832,7 +7889,7 @@ const addonsCapability = {
7832
7889
  restartAddon: method(
7833
7890
  z.object({ addonId: z.string() }),
7834
7891
  RestartAddonResultSchema,
7835
- { kind: "mutation", auth: "superAdmin" }
7892
+ { kind: "mutation", auth: "admin" }
7836
7893
  ),
7837
7894
  /**
7838
7895
  * Force-retry a failed addon NOW. Resets the retry counter so the
@@ -7843,7 +7900,7 @@ const addonsCapability = {
7843
7900
  retryLoad: method(
7844
7901
  z.object({ packageName: z.string() }),
7845
7902
  z.object({ success: z.literal(true) }),
7846
- { kind: "mutation", auth: "superAdmin" }
7903
+ { kind: "mutation", auth: "admin" }
7847
7904
  ),
7848
7905
  // ── Auto-update ─────────────────────────────────────────────────
7849
7906
  getAutoUpdateSettings: method(
@@ -7857,7 +7914,7 @@ const addonsCapability = {
7857
7914
  intervalSeconds: z.number().min(300).max(86400).optional()
7858
7915
  }),
7859
7916
  z.unknown(),
7860
- { kind: "mutation", auth: "superAdmin" }
7917
+ { kind: "mutation", auth: "admin" }
7861
7918
  ),
7862
7919
  getAddonAutoUpdate: method(
7863
7920
  z.object({ addonId: z.string() }),
@@ -7872,7 +7929,7 @@ const addonsCapability = {
7872
7929
  applyAutoUpdateToAll: method(
7873
7930
  z.object({ channel: ChannelSchema }),
7874
7931
  z.object({ success: z.literal(true) }),
7875
- { kind: "mutation", auth: "superAdmin" }
7932
+ { kind: "mutation", auth: "admin" }
7876
7933
  ),
7877
7934
  // ── Custom action dispatcher ────────────────────────────────────
7878
7935
  // Generic dispatcher used by `bindAddonActions`. Per-action auth
@@ -7904,47 +7961,6 @@ const PIPELINE_OWNER_CAPABILITY_NAMES = [
7904
7961
  "pipeline-orchestrator",
7905
7962
  "pipeline-runner"
7906
7963
  ];
7907
- const UserRoleSchema = z.enum(["super_admin", "admin", "viewer", "agent", "scoped"]);
7908
- const AllowedProviderSchema = z.union([z.literal("*"), z.array(z.string())]);
7909
- const AllowedDevicesSchema = z.record(z.string(), z.union([z.literal("*"), z.array(z.string())]));
7910
- const UserRecordSchema = z.object({
7911
- id: z.string(),
7912
- username: z.string(),
7913
- passwordHash: z.string(),
7914
- role: UserRoleSchema,
7915
- allowedProviders: AllowedProviderSchema,
7916
- allowedDevices: AllowedDevicesSchema,
7917
- createdAt: z.number(),
7918
- updatedAt: z.number()
7919
- });
7920
- const ApiKeyRecordSchema = z.object({
7921
- id: z.string(),
7922
- label: z.string(),
7923
- role: UserRoleSchema,
7924
- allowedProviders: AllowedProviderSchema,
7925
- allowedDevices: AllowedDevicesSchema,
7926
- tokenHash: z.string(),
7927
- tokenPrefix: z.string(),
7928
- createdAt: z.number(),
7929
- lastUsedAt: z.number().optional()
7930
- });
7931
- const TokenScopeSchema = z.object({
7932
- type: z.enum(["addon", "route-prefix", "capability"]),
7933
- target: z.string()
7934
- });
7935
- const ScopedTokenSchema = z.object({
7936
- id: z.string(),
7937
- userId: z.string(),
7938
- name: z.string(),
7939
- tokenHash: z.string(),
7940
- tokenPrefix: z.string(),
7941
- scopes: z.array(TokenScopeSchema),
7942
- // SQLite/JSON storage round-trips undefined → null. Use `nullish` so the
7943
- // schema accepts both `null` (read from disk) and `undefined` (in-memory).
7944
- expiresAt: z.number().nullish(),
7945
- lastUsedAt: z.number().nullish(),
7946
- createdAt: z.number()
7947
- });
7948
7964
  export {
7949
7965
  networkQualityCapability as $,
7950
7966
  adminUiCapability as A,
@@ -8105,7 +8121,7 @@ export {
8105
8121
  CreateApiKeyInputSchema as by,
8106
8122
  CreateApiKeyResultSchema as bz,
8107
8123
  motionCapability as c,
8108
- PolygonPointSchema as c$,
8124
+ PlaceholderReasonSchema as c$,
8109
8125
  EmbeddingInfoSchema as c0,
8110
8126
  EmbeddingResultSchema as c1,
8111
8127
  EncodedPacketSchema as c2,
@@ -8116,33 +8132,33 @@ export {
8116
8132
  FeatureManifestSchema as c7,
8117
8133
  FeatureProbeStatusSchema as c8,
8118
8134
  FrameInputSchema as c9,
8119
- NativeObjectClassEnum as cA,
8120
- NativeObjectDetectionStatusSchema as cB,
8121
- NetworkAccessStatusSchema as cC,
8122
- NetworkAddressSchema as cD,
8123
- NetworkEndpointSchema as cE,
8124
- NotificationHistoryEntrySchema as cF,
8125
- NotificationRuleSchema as cG,
8126
- NotificationSchema as cH,
8127
- ObjectEventSchema as cI,
8128
- OrchestratorMetricsSchema as cJ,
8129
- OsdOverlayKindEnum as cK,
8130
- OsdOverlayPatchSchema as cL,
8131
- OsdOverlaySchema as cM,
8132
- OsdPositionEnum as cN,
8133
- OsdStatusSchema as cO,
8134
- PIPELINE_FLOW_CAPABILITY_NAMES as cP,
8135
- PIPELINE_OWNER_CAPABILITY_NAMES as cQ,
8136
- PackageUpdateSchema as cR,
8137
- PackageVersionInfoSchema as cS,
8138
- PcmSampleFormatSchema as cT,
8139
- PerScopeBreakdownSchema as cU,
8140
- PipelineAssignmentSchema as cV,
8141
- PipelineDefaultStepSchema as cW,
8142
- PipelineEngineChoiceSchema as cX,
8143
- PipelineRunResultBridge as cY,
8144
- PipelineStepInputSchema as cZ,
8145
- PlaceholderReasonSchema as c_,
8135
+ NativeDetectionSchema as cA,
8136
+ NativeObjectClassEnum as cB,
8137
+ NativeObjectDetectionStatusSchema as cC,
8138
+ NetworkAccessStatusSchema as cD,
8139
+ NetworkAddressSchema as cE,
8140
+ NetworkEndpointSchema as cF,
8141
+ NotificationHistoryEntrySchema as cG,
8142
+ NotificationRuleSchema as cH,
8143
+ NotificationSchema as cI,
8144
+ ObjectEventSchema as cJ,
8145
+ OrchestratorMetricsSchema as cK,
8146
+ OsdOverlayKindEnum as cL,
8147
+ OsdOverlayPatchSchema as cM,
8148
+ OsdOverlaySchema as cN,
8149
+ OsdPositionEnum as cO,
8150
+ OsdStatusSchema as cP,
8151
+ PIPELINE_FLOW_CAPABILITY_NAMES as cQ,
8152
+ PIPELINE_OWNER_CAPABILITY_NAMES as cR,
8153
+ PackageUpdateSchema as cS,
8154
+ PackageVersionInfoSchema as cT,
8155
+ PcmSampleFormatSchema as cU,
8156
+ PerScopeBreakdownSchema as cV,
8157
+ PipelineAssignmentSchema as cW,
8158
+ PipelineDefaultStepSchema as cX,
8159
+ PipelineEngineChoiceSchema as cY,
8160
+ PipelineRunResultBridge as cZ,
8161
+ PipelineStepInputSchema as c_,
8146
8162
  GlobalMetricsSchema as ca,
8147
8163
  HWACCEL_OPTIONS as cb,
8148
8164
  HealthStatusSchema as cc,
@@ -8159,110 +8175,111 @@ export {
8159
8175
  LogStreamEntrySchema as cn,
8160
8176
  MODEL_FORMATS as co,
8161
8177
  MediaFileSchema as cp,
8162
- MotionAnalysisResultSchema as cq,
8163
- MotionEventSchema as cr,
8164
- MotionOnMotionChangedDataSchema as cs,
8165
- MotionRegionSchema as ct,
8166
- MotionSourceEnum as cu,
8167
- MotionSourcesSchema as cv,
8168
- MotionStatusSchema as cw,
8169
- MotionTriggerRuntimeStateSchema as cx,
8170
- MotionTriggerStatusSchema as cy,
8171
- NativeDetectionSchema as cz,
8178
+ MethodAccessSchema as cq,
8179
+ MotionAnalysisResultSchema as cr,
8180
+ MotionEventSchema as cs,
8181
+ MotionOnMotionChangedDataSchema as ct,
8182
+ MotionRegionSchema as cu,
8183
+ MotionSourceEnum as cv,
8184
+ MotionSourcesSchema as cw,
8185
+ MotionStatusSchema as cx,
8186
+ MotionTriggerRuntimeStateSchema as cy,
8187
+ MotionTriggerStatusSchema as cz,
8172
8188
  doorbellCapability as d,
8173
- TurnServerSchema as d$,
8174
- ProfileSlotSchema as d0,
8175
- ProfileSlotStatusSchema as d1,
8176
- ProviderStatusSchema as d2,
8177
- PtzAutotrackRuntimeStateSchema as d3,
8178
- PtzAutotrackSettingsSchema as d4,
8179
- PtzAutotrackStatusSchema as d5,
8180
- PtzAutotrackTargetOptionSchema as d6,
8181
- PtzMoveCommandSchema as d7,
8182
- PtzPositionSchema as d8,
8183
- PtzPresetSchema as d9,
8184
- BeginUploadResultSchema as dA,
8185
- EndDownloadInputSchema as dB,
8186
- FinalizeUploadInputSchema as dC,
8187
- StorageLocationRefSchema as dD,
8188
- StorageLocationSchema as dE,
8189
- StorageLocationTypeSchema as dF,
8190
- ProviderInfoSchema as dG,
8191
- ReadChunkInputSchema as dH,
8192
- TestLocationResultSchema as dI,
8193
- WriteChunkInputSchema as dJ,
8194
- StreamFormatSchema as dK,
8195
- StreamInfoSchema as dL,
8196
- StreamNetworkStatsSchema as dM,
8197
- StreamSourceEntrySchema$1 as dN,
8198
- StreamSourceSchema as dO,
8199
- SwitchStatusSchema as dP,
8200
- SystemMetricsSchema as dQ,
8201
- TestConnectionResultSchema as dR,
8202
- ToastSchema as dS,
8203
- TokenScopeSchema as dT,
8204
- TopologyNodeSchema as dU,
8205
- TopologyProcessSchema as dV,
8206
- TopologyServiceSchema as dW,
8207
- TrackSchema as dX,
8208
- TrackStateSchema as dY,
8209
- TrackedDetectionSchema as dZ,
8210
- TurnProviderInfoSchema as d_,
8211
- QueryFilterSchema as da,
8212
- RegisteredStreamSchema as db,
8213
- RemoteAccessEndpointSchema as dc,
8214
- RemoteAccessProviderInfoSchema as dd,
8215
- ReportMotionInputSchema as de,
8216
- RtspRestreamEntrySchema as df,
8217
- RunnerCameraConfigSchema as dg,
8218
- RunnerCameraDeviceUIFields as dh,
8219
- RunnerLocalLoadSchema as di,
8220
- RunnerLocalMetricsSchema as dj,
8221
- STORAGE_LOCATION_CARDINALITY as dk,
8222
- ScopedTokenSchema as dl,
8223
- ScopedTokenSummarySchema as dm,
8224
- SearchResultSchema as dn,
8225
- SegmentSchema as dp,
8226
- SettingsPatchSchema as dq,
8227
- SettingsRecordSchema as dr,
8228
- SettingsSchemaWithValuesSchema as ds,
8229
- SettingsUpdateResultSchema as dt,
8230
- SnapshotImageSchema as du,
8231
- SpatialDetectionSchema as dv,
8232
- AbortUploadInputSchema as dw,
8233
- BeginDownloadInputSchema as dx,
8234
- BeginDownloadResultSchema as dy,
8235
- BeginUploadInputSchema as dz,
8189
+ TurnProviderInfoSchema as d$,
8190
+ PolygonPointSchema as d0,
8191
+ ProfileSlotSchema as d1,
8192
+ ProfileSlotStatusSchema as d2,
8193
+ ProviderStatusSchema as d3,
8194
+ PtzAutotrackRuntimeStateSchema as d4,
8195
+ PtzAutotrackSettingsSchema as d5,
8196
+ PtzAutotrackStatusSchema as d6,
8197
+ PtzAutotrackTargetOptionSchema as d7,
8198
+ PtzMoveCommandSchema as d8,
8199
+ PtzPositionSchema as d9,
8200
+ BeginUploadInputSchema as dA,
8201
+ BeginUploadResultSchema as dB,
8202
+ EndDownloadInputSchema as dC,
8203
+ FinalizeUploadInputSchema as dD,
8204
+ StorageLocationRefSchema as dE,
8205
+ StorageLocationSchema as dF,
8206
+ StorageLocationTypeSchema as dG,
8207
+ ProviderInfoSchema as dH,
8208
+ ReadChunkInputSchema as dI,
8209
+ TestLocationResultSchema as dJ,
8210
+ WriteChunkInputSchema as dK,
8211
+ StreamFormatSchema as dL,
8212
+ StreamInfoSchema as dM,
8213
+ StreamNetworkStatsSchema as dN,
8214
+ StreamSourceEntrySchema$1 as dO,
8215
+ StreamSourceSchema as dP,
8216
+ SwitchStatusSchema as dQ,
8217
+ SystemMetricsSchema as dR,
8218
+ TestConnectionResultSchema as dS,
8219
+ ToastSchema as dT,
8220
+ TokenScopeSchema as dU,
8221
+ TopologyNodeSchema as dV,
8222
+ TopologyProcessSchema as dW,
8223
+ TopologyServiceSchema as dX,
8224
+ TrackSchema as dY,
8225
+ TrackStateSchema as dZ,
8226
+ TrackedDetectionSchema as d_,
8227
+ PtzPresetSchema as da,
8228
+ QueryFilterSchema as db,
8229
+ RegisteredStreamSchema as dc,
8230
+ RemoteAccessEndpointSchema as dd,
8231
+ RemoteAccessProviderInfoSchema as de,
8232
+ ReportMotionInputSchema as df,
8233
+ RtspRestreamEntrySchema as dg,
8234
+ RunnerCameraConfigSchema as dh,
8235
+ RunnerCameraDeviceUIFields as di,
8236
+ RunnerLocalLoadSchema as dj,
8237
+ RunnerLocalMetricsSchema as dk,
8238
+ STORAGE_LOCATION_CARDINALITY as dl,
8239
+ ScopedTokenSchema as dm,
8240
+ ScopedTokenSummarySchema as dn,
8241
+ SearchResultSchema as dp,
8242
+ SegmentSchema as dq,
8243
+ SettingsPatchSchema as dr,
8244
+ SettingsRecordSchema as ds,
8245
+ SettingsSchemaWithValuesSchema as dt,
8246
+ SettingsUpdateResultSchema as du,
8247
+ SnapshotImageSchema as dv,
8248
+ SpatialDetectionSchema as dw,
8249
+ AbortUploadInputSchema as dx,
8250
+ BeginDownloadInputSchema as dy,
8251
+ BeginDownloadResultSchema as dz,
8236
8252
  errMsg as e,
8237
- UpdateIntegrationInputSchema as e0,
8238
- UpdateUserInputSchema as e1,
8239
- UserRecordSchema as e2,
8240
- UserRoleSchema as e3,
8241
- UserSummarySchema as e4,
8242
- WELL_KNOWN_TABS as e5,
8243
- WELL_KNOWN_TAB_MAP as e6,
8244
- WebrtcStreamChoiceSchema as e7,
8245
- WebrtcStreamTargetSchema as e8,
8246
- WidgetHostEnum as e9,
8247
- WidgetMetadataSchema as ea,
8248
- WidgetSizeEnum as eb,
8249
- YAMNET_TO_MACRO as ec,
8250
- ZoneKindEnum as ed,
8251
- ZoneRuleModeEnum as ee,
8252
- ZoneRuleSchema as ef,
8253
- ZoneRuleStageEnum as eg,
8254
- ZoneRulesArraySchema as eh,
8255
- ZoneSchema as ei,
8256
- ZoneScopeBreakdownSchema as ej,
8257
- accessoryStableId as ek,
8258
- deviceMatchesProfile as el,
8259
- event as em,
8260
- expandCapMethods as en,
8261
- getAudioMacroClassIds as eo,
8262
- mapAudioLabelToMacro as ep,
8263
- method as eq,
8264
- resolveDeviceProfile as er,
8265
- webrtcClientHintsSchema as es,
8253
+ TurnServerSchema as e0,
8254
+ UpdateIntegrationInputSchema as e1,
8255
+ UpdateUserInputSchema as e2,
8256
+ UserRecordSchema as e3,
8257
+ UserRoleSchema as e4,
8258
+ UserSummarySchema as e5,
8259
+ WELL_KNOWN_TABS as e6,
8260
+ WELL_KNOWN_TAB_MAP as e7,
8261
+ WebrtcStreamChoiceSchema as e8,
8262
+ WebrtcStreamTargetSchema as e9,
8263
+ WidgetHostEnum as ea,
8264
+ WidgetMetadataSchema as eb,
8265
+ WidgetSizeEnum as ec,
8266
+ YAMNET_TO_MACRO as ed,
8267
+ ZoneKindEnum as ee,
8268
+ ZoneRuleModeEnum as ef,
8269
+ ZoneRuleSchema as eg,
8270
+ ZoneRuleStageEnum as eh,
8271
+ ZoneRulesArraySchema as ei,
8272
+ ZoneSchema as ej,
8273
+ ZoneScopeBreakdownSchema as ek,
8274
+ accessoryStableId as el,
8275
+ deviceMatchesProfile as em,
8276
+ event as en,
8277
+ expandCapMethods as eo,
8278
+ getAudioMacroClassIds as ep,
8279
+ mapAudioLabelToMacro as eq,
8280
+ method as er,
8281
+ resolveDeviceProfile as es,
8282
+ webrtcClientHintsSchema as et,
8266
8283
  featureProbeCapability as f,
8267
8284
  deviceStatusCapability as g,
8268
8285
  hydrateSchema as h,
@@ -8285,4 +8302,4 @@ export {
8285
8302
  addonsCapability as y,
8286
8303
  zonesCapability as z
8287
8304
  };
8288
- //# sourceMappingURL=auth-records-wKlyGWdW.mjs.map
8305
+ //# sourceMappingURL=index-DVKPWMwv.mjs.map