@camstack/types 0.1.26 → 0.1.27

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -761,6 +761,7 @@ function method(input, output, options) {
761
761
  output,
762
762
  kind: options?.kind ?? "query",
763
763
  auth: options?.auth ?? "protected",
764
+ ...options?.access !== void 0 ? { access: options.access } : {},
764
765
  timeoutMs: options?.timeoutMs
765
766
  };
766
767
  }
@@ -3188,17 +3189,17 @@ const storageCapability = {
3188
3189
  upsertLocation: method(
3189
3190
  StorageLocationSchema.omit({ createdAt: true, updatedAt: true }),
3190
3191
  StorageLocationSchema,
3191
- { kind: "mutation", auth: "superAdmin" }
3192
+ { kind: "mutation", auth: "admin" }
3192
3193
  ),
3193
3194
  deleteLocation: method(
3194
3195
  zod.z.object({ id: zod.z.string() }),
3195
3196
  zod.z.void(),
3196
- { kind: "mutation", auth: "superAdmin" }
3197
+ { kind: "mutation", auth: "admin" }
3197
3198
  ),
3198
3199
  testLocation: method(
3199
3200
  zod.z.object({ id: zod.z.string() }),
3200
3201
  zod.z.object({ ok: zod.z.boolean(), error: zod.z.string().optional() }),
3201
- { auth: "superAdmin" }
3202
+ { auth: "admin" }
3202
3203
  ),
3203
3204
  // ── Provider discovery ──────────────────────────────────────────
3204
3205
  // The admin-UI's "Add location" wizard shows one entry per
@@ -3226,7 +3227,7 @@ const storageCapability = {
3226
3227
  config: zod.z.record(zod.z.string(), zod.z.unknown())
3227
3228
  }),
3228
3229
  zod.z.object({ ok: zod.z.boolean(), error: zod.z.string().optional() }),
3229
- { auth: "superAdmin" }
3230
+ { auth: "admin" }
3230
3231
  )
3231
3232
  }
3232
3233
  };
@@ -3279,7 +3280,7 @@ const storageProviderCapability = {
3279
3280
  testLocation: method(
3280
3281
  zod.z.object({ config: zod.z.record(zod.z.string(), zod.z.unknown()) }),
3281
3282
  TestLocationResultSchema,
3282
- { auth: "superAdmin" }
3283
+ { auth: "admin" }
3283
3284
  ),
3284
3285
  // ── Small-file primitives ────────────────────────────────────────
3285
3286
  // The location is passed inline so the orchestrator dispatches
@@ -3417,7 +3418,7 @@ const backupCapability = {
3417
3418
  listDestinations: method(
3418
3419
  zod.z.void(),
3419
3420
  zod.z.array(BackupDestinationInfoSchema).readonly(),
3420
- { auth: "superAdmin" }
3421
+ { auth: "admin" }
3421
3422
  ),
3422
3423
  /**
3423
3424
  * Trigger a backup. Without `destinations` the orchestrator fans
@@ -3432,16 +3433,16 @@ const backupCapability = {
3432
3433
  label: zod.z.string().optional()
3433
3434
  }).optional(),
3434
3435
  zod.z.array(BackupEntrySchema).readonly(),
3435
- { kind: "mutation", auth: "superAdmin" }
3436
+ { kind: "mutation", auth: "admin" }
3436
3437
  ),
3437
3438
  /** Union of every destination's archives, each tagged with `destinationId`. */
3438
- list: method(zod.z.void(), zod.z.array(BackupEntrySchema).readonly(), { auth: "superAdmin" }),
3439
+ list: method(zod.z.void(), zod.z.array(BackupEntrySchema).readonly(), { auth: "admin" }),
3439
3440
  /**
3440
3441
  * Pre-backup snapshot of the well-known locations on disk — sizes
3441
3442
  * + file counts. Powers the opt-in checklist that lets the
3442
3443
  * operator pick which subsections of state get archived.
3443
3444
  */
3444
- listLocations: method(zod.z.void(), zod.z.array(LocationStatSchema).readonly(), { auth: "superAdmin" }),
3445
+ listLocations: method(zod.z.void(), zod.z.array(LocationStatSchema).readonly(), { auth: "admin" }),
3445
3446
  /**
3446
3447
  * Read the embedded `.camstack-backup-manifest.json` from a
3447
3448
  * previously-created archive. The manifest carries the full
@@ -3453,7 +3454,7 @@ const backupCapability = {
3453
3454
  getEntries: method(
3454
3455
  zod.z.object({ destinationId: zod.z.string(), backupId: zod.z.string() }),
3455
3456
  ArchiveManifestSchema.nullable(),
3456
- { auth: "superAdmin" }
3457
+ { auth: "admin" }
3457
3458
  ),
3458
3459
  restore: method(
3459
3460
  zod.z.object({
@@ -3469,12 +3470,12 @@ const backupCapability = {
3469
3470
  locations: zod.z.array(zod.z.string()).optional()
3470
3471
  }),
3471
3472
  zod.z.void(),
3472
- { kind: "mutation", auth: "superAdmin" }
3473
+ { kind: "mutation", auth: "admin" }
3473
3474
  ),
3474
3475
  delete: method(
3475
3476
  zod.z.object({ destinationId: zod.z.string(), backupId: zod.z.string() }),
3476
3477
  zod.z.void(),
3477
- { kind: "mutation", auth: "superAdmin" }
3478
+ { kind: "mutation", auth: "admin" }
3478
3479
  ),
3479
3480
  /**
3480
3481
  * List archives at a single destination. Reads the per-location
@@ -3484,7 +3485,7 @@ const backupCapability = {
3484
3485
  listArchives: method(
3485
3486
  zod.z.object({ destinationId: zod.z.string() }),
3486
3487
  zod.z.array(BackupArchiveEntrySchema).readonly(),
3487
- { auth: "superAdmin" }
3488
+ { auth: "admin" }
3488
3489
  ),
3489
3490
  /**
3490
3491
  * Upsert a per-destination policy row. The `locationId` MUST be
@@ -3507,7 +3508,7 @@ const backupCapability = {
3507
3508
  cron: zod.z.string().optional()
3508
3509
  }),
3509
3510
  zod.z.void(),
3510
- { kind: "mutation", auth: "superAdmin" }
3511
+ { kind: "mutation", auth: "admin" }
3511
3512
  ),
3512
3513
  /**
3513
3514
  * Validate a cron expression and peek the next N firing times.
@@ -5378,7 +5379,7 @@ const authenticationCapability = {
5378
5379
  setProviderEnabled: method(
5379
5380
  zod.z.object({ addonId: zod.z.string(), enabled: zod.z.boolean() }),
5380
5381
  zod.z.object({ success: zod.z.literal(true) }),
5381
- { kind: "mutation", auth: "superAdmin" }
5382
+ { kind: "mutation", auth: "admin" }
5382
5383
  )
5383
5384
  }
5384
5385
  };
@@ -5440,13 +5441,13 @@ const remoteAccessCapability = {
5440
5441
  startProvider: method(
5441
5442
  zod.z.object({ addonId: zod.z.string() }),
5442
5443
  RemoteAccessEndpointSchema,
5443
- { kind: "mutation", auth: "superAdmin" }
5444
+ { kind: "mutation", auth: "admin" }
5444
5445
  ),
5445
5446
  /** Stop a specific provider's tunnel (idempotent on already-stopped). */
5446
5447
  stopProvider: method(
5447
5448
  zod.z.object({ addonId: zod.z.string() }),
5448
5449
  zod.z.object({ success: zod.z.literal(true) }),
5449
- { kind: "mutation", auth: "superAdmin" }
5450
+ { kind: "mutation", auth: "admin" }
5450
5451
  )
5451
5452
  }
5452
5453
  };
@@ -5510,7 +5511,7 @@ const turnOrchestratorCapability = {
5510
5511
  setProviderEnabled: method(
5511
5512
  zod.z.object({ addonId: zod.z.string(), enabled: zod.z.boolean() }),
5512
5513
  zod.z.object({ success: zod.z.literal(true) }),
5513
- { kind: "mutation", auth: "superAdmin" }
5514
+ { kind: "mutation", auth: "admin" }
5514
5515
  )
5515
5516
  }
5516
5517
  };
@@ -7183,33 +7184,84 @@ const meshOrchestratorCapability = {
7183
7184
  )
7184
7185
  }
7185
7186
  };
7186
- const UserRoleSchema$1 = zod.z.enum(["super_admin", "admin", "viewer", "agent", "scoped"]);
7187
+ const UserRoleSchema = zod.z.enum(["admin", "viewer", "agent", "scoped"]);
7188
+ const AllowedProviderSchema = zod.z.union([zod.z.literal("*"), zod.z.array(zod.z.string())]);
7189
+ const AllowedDevicesSchema = zod.z.record(zod.z.string(), zod.z.union([zod.z.literal("*"), zod.z.array(zod.z.string())]));
7190
+ const MethodAccessSchema = zod.z.enum(["view", "create", "delete"]);
7191
+ const TokenScopeSchema = zod.z.object({
7192
+ type: zod.z.enum(["addon", "capability"]),
7193
+ target: zod.z.string(),
7194
+ access: zod.z.array(MethodAccessSchema).min(1)
7195
+ });
7196
+ const UserRecordSchema = zod.z.object({
7197
+ id: zod.z.string(),
7198
+ username: zod.z.string(),
7199
+ passwordHash: zod.z.string(),
7200
+ role: UserRoleSchema,
7201
+ allowedProviders: AllowedProviderSchema,
7202
+ allowedDevices: AllowedDevicesSchema,
7203
+ /**
7204
+ * Scopes granted to this user. Admins bypass; their `scopes` is ignored.
7205
+ * Non-admins (`viewer`, `agent`, `scoped`) without scopes are locked out
7206
+ * of every protected call.
7207
+ */
7208
+ scopes: zod.z.array(TokenScopeSchema).default([]),
7209
+ createdAt: zod.z.number(),
7210
+ updatedAt: zod.z.number()
7211
+ });
7212
+ const ApiKeyRecordSchema = zod.z.object({
7213
+ id: zod.z.string(),
7214
+ label: zod.z.string(),
7215
+ role: UserRoleSchema,
7216
+ allowedProviders: AllowedProviderSchema,
7217
+ allowedDevices: AllowedDevicesSchema,
7218
+ tokenHash: zod.z.string(),
7219
+ tokenPrefix: zod.z.string(),
7220
+ createdAt: zod.z.number(),
7221
+ lastUsedAt: zod.z.number().optional()
7222
+ });
7223
+ const ScopedTokenSchema = zod.z.object({
7224
+ id: zod.z.string(),
7225
+ userId: zod.z.string(),
7226
+ name: zod.z.string(),
7227
+ tokenHash: zod.z.string(),
7228
+ tokenPrefix: zod.z.string(),
7229
+ scopes: zod.z.array(TokenScopeSchema),
7230
+ // SQLite/JSON storage round-trips undefined → null. Use `nullish` so the
7231
+ // schema accepts both `null` (read from disk) and `undefined` (in-memory).
7232
+ expiresAt: zod.z.number().nullish(),
7233
+ lastUsedAt: zod.z.number().nullish(),
7234
+ createdAt: zod.z.number()
7235
+ });
7187
7236
  const UserSummarySchema = zod.z.object({
7188
7237
  id: zod.z.string(),
7189
7238
  username: zod.z.string(),
7190
- role: UserRoleSchema$1,
7239
+ role: UserRoleSchema,
7191
7240
  allowedProviders: zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")]),
7192
7241
  allowedDevices: zod.z.record(zod.z.string(), zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")])),
7242
+ scopes: zod.z.array(TokenScopeSchema).default([]),
7193
7243
  createdAt: zod.z.number(),
7194
7244
  updatedAt: zod.z.number()
7195
7245
  });
7196
7246
  const CreateUserInputSchema = zod.z.object({
7197
7247
  username: zod.z.string(),
7198
7248
  password: zod.z.string().min(6),
7199
- role: UserRoleSchema$1,
7249
+ role: UserRoleSchema,
7200
7250
  allowedProviders: zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")]).optional(),
7201
- allowedDevices: zod.z.record(zod.z.string(), zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")])).optional()
7251
+ allowedDevices: zod.z.record(zod.z.string(), zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")])).optional(),
7252
+ scopes: zod.z.array(TokenScopeSchema).optional()
7202
7253
  });
7203
7254
  const UpdateUserInputSchema = zod.z.object({
7204
7255
  id: zod.z.string(),
7205
- role: UserRoleSchema$1.optional(),
7256
+ role: UserRoleSchema.optional(),
7206
7257
  allowedProviders: zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")]).optional(),
7207
- allowedDevices: zod.z.record(zod.z.string(), zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")])).optional()
7258
+ allowedDevices: zod.z.record(zod.z.string(), zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")])).optional(),
7259
+ scopes: zod.z.array(TokenScopeSchema).optional()
7208
7260
  });
7209
7261
  const ApiKeySummarySchema = zod.z.object({
7210
7262
  id: zod.z.string(),
7211
7263
  label: zod.z.string(),
7212
- role: UserRoleSchema$1,
7264
+ role: UserRoleSchema,
7213
7265
  allowedProviders: zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")]).optional(),
7214
7266
  allowedDevices: zod.z.record(zod.z.string(), zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")])).optional(),
7215
7267
  tokenPrefix: zod.z.string(),
@@ -7218,7 +7270,7 @@ const ApiKeySummarySchema = zod.z.object({
7218
7270
  });
7219
7271
  const CreateApiKeyInputSchema = zod.z.object({
7220
7272
  label: zod.z.string(),
7221
- role: UserRoleSchema$1,
7273
+ role: UserRoleSchema,
7222
7274
  allowedProviders: zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")]).optional(),
7223
7275
  allowedDevices: zod.z.record(zod.z.string(), zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")])).optional()
7224
7276
  });
@@ -7226,16 +7278,12 @@ const CreateApiKeyResultSchema = zod.z.object({
7226
7278
  token: zod.z.string(),
7227
7279
  record: ApiKeySummarySchema
7228
7280
  });
7229
- const TokenScopeSchema$1 = zod.z.object({
7230
- type: zod.z.enum(["addon", "route-prefix", "capability"]),
7231
- target: zod.z.string()
7232
- });
7233
7281
  const ScopedTokenSummarySchema = zod.z.object({
7234
7282
  id: zod.z.string(),
7235
7283
  userId: zod.z.string(),
7236
7284
  name: zod.z.string(),
7237
7285
  tokenPrefix: zod.z.string(),
7238
- scopes: zod.z.array(TokenScopeSchema$1),
7286
+ scopes: zod.z.array(TokenScopeSchema),
7239
7287
  // Mirror the storage schema: `.nullish()` accepts the SQLite-native
7240
7288
  // `null` for absent timestamps as well as in-memory `undefined`.
7241
7289
  expiresAt: zod.z.number().nullish(),
@@ -7248,7 +7296,7 @@ const CreateScopedTokenInputSchema = zod.z.object({
7248
7296
  // its own logged-in `user.id` here.
7249
7297
  userId: zod.z.string(),
7250
7298
  name: zod.z.string(),
7251
- scopes: zod.z.array(TokenScopeSchema$1),
7299
+ scopes: zod.z.array(TokenScopeSchema),
7252
7300
  expiresAt: zod.z.number().optional()
7253
7301
  });
7254
7302
  const CreateScopedTokenResultSchema = zod.z.object({
@@ -7262,13 +7310,22 @@ const userManagementCapability = {
7262
7310
  methods: {
7263
7311
  // ── Users ──────────────────────────────────────────────────────
7264
7312
  listUsers: method(zod.z.void(), zod.z.array(UserSummarySchema), { auth: "admin" }),
7265
- createUser: method(CreateUserInputSchema, UserSummarySchema, { kind: "mutation", auth: "superAdmin" }),
7266
- updateUser: method(UpdateUserInputSchema, zod.z.object({ success: zod.z.literal(true) }), { kind: "mutation", auth: "superAdmin" }),
7267
- deleteUser: method(zod.z.object({ id: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), { kind: "mutation", auth: "superAdmin" }),
7313
+ createUser: method(CreateUserInputSchema, UserSummarySchema, { kind: "mutation", auth: "admin" }),
7314
+ updateUser: method(UpdateUserInputSchema, zod.z.object({ success: zod.z.literal(true) }), { kind: "mutation", auth: "admin" }),
7315
+ deleteUser: method(zod.z.object({ id: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), { kind: "mutation", auth: "admin" }),
7268
7316
  resetPassword: method(
7269
7317
  zod.z.object({ id: zod.z.string(), newPassword: zod.z.string().min(6) }),
7270
7318
  zod.z.object({ success: zod.z.literal(true) }),
7271
- { kind: "mutation", auth: "superAdmin" }
7319
+ { kind: "mutation", auth: "admin" }
7320
+ ),
7321
+ /**
7322
+ * Replace the scope set on a user. Subset check: the caller's scopes
7323
+ * must include every requested scope+access (admin bypasses).
7324
+ */
7325
+ setUserScopes: method(
7326
+ zod.z.object({ userId: zod.z.string(), scopes: zod.z.array(TokenScopeSchema) }),
7327
+ zod.z.object({ success: zod.z.literal(true) }),
7328
+ { kind: "mutation", auth: "admin" }
7272
7329
  ),
7273
7330
  validateCredentials: method(
7274
7331
  zod.z.object({ username: zod.z.string(), password: zod.z.string() }),
@@ -7324,9 +7381,9 @@ const systemCapability = {
7324
7381
  setRetentionConfig: method(
7325
7382
  zod.z.record(zod.z.string(), zod.z.unknown()),
7326
7383
  zod.z.null(),
7327
- { kind: "mutation", auth: "superAdmin" }
7384
+ { kind: "mutation", auth: "admin" }
7328
7385
  ),
7329
- forceRetentionCleanup: method(zod.z.void(), zod.z.void(), { kind: "mutation", auth: "superAdmin" })
7386
+ forceRetentionCleanup: method(zod.z.void(), zod.z.void(), { kind: "mutation", auth: "admin" })
7330
7387
  }
7331
7388
  };
7332
7389
  const StreamNetworkStatsSchema = zod.z.object({
@@ -7471,45 +7528,45 @@ const nodesCapability = {
7471
7528
  ),
7472
7529
  deployAddon: method(NodeAddonInputSchema, SuccessSchema, {
7473
7530
  kind: "mutation",
7474
- auth: "superAdmin"
7531
+ auth: "admin"
7475
7532
  }),
7476
7533
  undeployAddon: method(NodeAddonInputSchema, SuccessSchema, {
7477
7534
  kind: "mutation",
7478
- auth: "superAdmin"
7535
+ auth: "admin"
7479
7536
  }),
7480
7537
  restartAddon: method(NodeAddonInputSchema, SuccessSchema, {
7481
7538
  kind: "mutation",
7482
- auth: "superAdmin"
7539
+ auth: "admin"
7483
7540
  }),
7484
7541
  restartProcess: method(
7485
7542
  zod.z.object({ nodeId: zod.z.string(), processName: zod.z.string() }),
7486
7543
  RestartProcessResultSchema,
7487
- { kind: "mutation", auth: "superAdmin" }
7544
+ { kind: "mutation", auth: "admin" }
7488
7545
  ),
7489
7546
  restartNode: method(
7490
7547
  zod.z.object({ nodeId: zod.z.string() }),
7491
7548
  RestartNodeResultSchema,
7492
- { kind: "mutation", auth: "superAdmin" }
7549
+ { kind: "mutation", auth: "admin" }
7493
7550
  ),
7494
7551
  shutdownNode: method(
7495
7552
  zod.z.object({ nodeId: zod.z.string() }),
7496
7553
  SuccessSchema,
7497
- { kind: "mutation", auth: "superAdmin" }
7554
+ { kind: "mutation", auth: "admin" }
7498
7555
  ),
7499
7556
  renameNode: method(
7500
7557
  zod.z.object({ nodeId: zod.z.string(), name: zod.z.string().min(1).max(64) }),
7501
7558
  RenameNodeResultSchema,
7502
- { kind: "mutation", auth: "superAdmin" }
7559
+ { kind: "mutation", auth: "admin" }
7503
7560
  ),
7504
7561
  clusterAddonStatus: method(
7505
7562
  zod.z.void(),
7506
7563
  zod.z.record(zod.z.string(), ClusterAddonStatusEntrySchema),
7507
- { auth: "superAdmin" }
7564
+ { auth: "admin" }
7508
7565
  ),
7509
7566
  setProcessLogLevel: method(
7510
7567
  zod.z.object({ nodeId: zod.z.string(), level: zod.z.string() }),
7511
7568
  SuccessSchema,
7512
- { kind: "mutation", auth: "superAdmin" }
7569
+ { kind: "mutation", auth: "admin" }
7513
7570
  ),
7514
7571
  executeQuery: method(
7515
7572
  zod.z.object({
@@ -7519,7 +7576,7 @@ const nodesCapability = {
7519
7576
  params: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
7520
7577
  }),
7521
7578
  zod.z.unknown(),
7522
- { kind: "mutation", auth: "superAdmin" }
7579
+ { kind: "mutation", auth: "admin" }
7523
7580
  )
7524
7581
  }
7525
7582
  };
@@ -7594,12 +7651,12 @@ const integrationsCapability = {
7594
7651
  update: method(
7595
7652
  UpdateIntegrationInputSchema,
7596
7653
  IntegrationLiteSchema,
7597
- { kind: "mutation", auth: "superAdmin" }
7654
+ { kind: "mutation", auth: "admin" }
7598
7655
  ),
7599
7656
  delete: method(
7600
7657
  zod.z.object({ id: zod.z.string() }),
7601
7658
  DeleteIntegrationResultSchema,
7602
- { kind: "mutation", auth: "superAdmin" }
7659
+ { kind: "mutation", auth: "admin" }
7603
7660
  ),
7604
7661
  getSettings: method(
7605
7662
  zod.z.object({ id: zod.z.string() }),
@@ -7612,7 +7669,7 @@ const integrationsCapability = {
7612
7669
  settings: zod.z.record(zod.z.string(), zod.z.unknown())
7613
7670
  }),
7614
7671
  zod.z.object({ success: zod.z.boolean() }),
7615
- { kind: "mutation", auth: "superAdmin" }
7672
+ { kind: "mutation", auth: "admin" }
7616
7673
  ),
7617
7674
  getAvailableTypes: method(
7618
7675
  zod.z.void(),
@@ -7767,7 +7824,7 @@ const addonsCapability = {
7767
7824
  installPackage: method(
7768
7825
  zod.z.object({ packageName: zod.z.string(), version: zod.z.string().optional() }),
7769
7826
  InstallPackageResultSchema,
7770
- { kind: "mutation", auth: "superAdmin" }
7827
+ { kind: "mutation", auth: "admin" }
7771
7828
  ),
7772
7829
  installFromWorkspace: method(
7773
7830
  zod.z.object({ packageName: zod.z.string() }),
@@ -7779,7 +7836,7 @@ const addonsCapability = {
7779
7836
  uninstallPackage: method(
7780
7837
  zod.z.object({ packageName: zod.z.string() }),
7781
7838
  zod.z.unknown(),
7782
- { kind: "mutation", auth: "superAdmin" }
7839
+ { kind: "mutation", auth: "admin" }
7783
7840
  ),
7784
7841
  reloadPackages: method(zod.z.void(), ReloadPackagesResultSchema, {
7785
7842
  kind: "mutation",
@@ -7801,7 +7858,7 @@ const addonsCapability = {
7801
7858
  updatePackage: method(
7802
7859
  zod.z.object({ name: zod.z.string().min(1), version: zod.z.string().optional() }),
7803
7860
  zod.z.unknown(),
7804
- { kind: "mutation", auth: "superAdmin" }
7861
+ { kind: "mutation", auth: "admin" }
7805
7862
  ),
7806
7863
  /**
7807
7864
  * Roll back an addon to the version it had before the most recent
@@ -7818,13 +7875,13 @@ const addonsCapability = {
7818
7875
  rollbackPackage: method(
7819
7876
  zod.z.object({ name: zod.z.string().min(1) }),
7820
7877
  zod.z.object({ rolledBackTo: zod.z.string().nullable() }),
7821
- { kind: "mutation", auth: "superAdmin" }
7878
+ { kind: "mutation", auth: "admin" }
7822
7879
  ),
7823
7880
  forceRefresh: method(zod.z.void(), zod.z.unknown(), { kind: "mutation", auth: "admin" }),
7824
7881
  restartServer: method(
7825
7882
  zod.z.object({ confirm: zod.z.literal(true) }),
7826
7883
  zod.z.unknown(),
7827
- { kind: "mutation", auth: "superAdmin" }
7884
+ { kind: "mutation", auth: "admin" }
7828
7885
  ),
7829
7886
  getVersions: method(
7830
7887
  zod.z.object({ name: zod.z.string() }),
@@ -7833,7 +7890,7 @@ const addonsCapability = {
7833
7890
  restartAddon: method(
7834
7891
  zod.z.object({ addonId: zod.z.string() }),
7835
7892
  RestartAddonResultSchema,
7836
- { kind: "mutation", auth: "superAdmin" }
7893
+ { kind: "mutation", auth: "admin" }
7837
7894
  ),
7838
7895
  /**
7839
7896
  * Force-retry a failed addon NOW. Resets the retry counter so the
@@ -7844,7 +7901,7 @@ const addonsCapability = {
7844
7901
  retryLoad: method(
7845
7902
  zod.z.object({ packageName: zod.z.string() }),
7846
7903
  zod.z.object({ success: zod.z.literal(true) }),
7847
- { kind: "mutation", auth: "superAdmin" }
7904
+ { kind: "mutation", auth: "admin" }
7848
7905
  ),
7849
7906
  // ── Auto-update ─────────────────────────────────────────────────
7850
7907
  getAutoUpdateSettings: method(
@@ -7858,7 +7915,7 @@ const addonsCapability = {
7858
7915
  intervalSeconds: zod.z.number().min(300).max(86400).optional()
7859
7916
  }),
7860
7917
  zod.z.unknown(),
7861
- { kind: "mutation", auth: "superAdmin" }
7918
+ { kind: "mutation", auth: "admin" }
7862
7919
  ),
7863
7920
  getAddonAutoUpdate: method(
7864
7921
  zod.z.object({ addonId: zod.z.string() }),
@@ -7873,7 +7930,7 @@ const addonsCapability = {
7873
7930
  applyAutoUpdateToAll: method(
7874
7931
  zod.z.object({ channel: ChannelSchema }),
7875
7932
  zod.z.object({ success: zod.z.literal(true) }),
7876
- { kind: "mutation", auth: "superAdmin" }
7933
+ { kind: "mutation", auth: "admin" }
7877
7934
  ),
7878
7935
  // ── Custom action dispatcher ────────────────────────────────────
7879
7936
  // Generic dispatcher used by `bindAddonActions`. Per-action auth
@@ -7905,47 +7962,6 @@ const PIPELINE_OWNER_CAPABILITY_NAMES = [
7905
7962
  "pipeline-orchestrator",
7906
7963
  "pipeline-runner"
7907
7964
  ];
7908
- const UserRoleSchema = zod.z.enum(["super_admin", "admin", "viewer", "agent", "scoped"]);
7909
- const AllowedProviderSchema = zod.z.union([zod.z.literal("*"), zod.z.array(zod.z.string())]);
7910
- const AllowedDevicesSchema = zod.z.record(zod.z.string(), zod.z.union([zod.z.literal("*"), zod.z.array(zod.z.string())]));
7911
- const UserRecordSchema = zod.z.object({
7912
- id: zod.z.string(),
7913
- username: zod.z.string(),
7914
- passwordHash: zod.z.string(),
7915
- role: UserRoleSchema,
7916
- allowedProviders: AllowedProviderSchema,
7917
- allowedDevices: AllowedDevicesSchema,
7918
- createdAt: zod.z.number(),
7919
- updatedAt: zod.z.number()
7920
- });
7921
- const ApiKeyRecordSchema = zod.z.object({
7922
- id: zod.z.string(),
7923
- label: zod.z.string(),
7924
- role: UserRoleSchema,
7925
- allowedProviders: AllowedProviderSchema,
7926
- allowedDevices: AllowedDevicesSchema,
7927
- tokenHash: zod.z.string(),
7928
- tokenPrefix: zod.z.string(),
7929
- createdAt: zod.z.number(),
7930
- lastUsedAt: zod.z.number().optional()
7931
- });
7932
- const TokenScopeSchema = zod.z.object({
7933
- type: zod.z.enum(["addon", "route-prefix", "capability"]),
7934
- target: zod.z.string()
7935
- });
7936
- const ScopedTokenSchema = zod.z.object({
7937
- id: zod.z.string(),
7938
- userId: zod.z.string(),
7939
- name: zod.z.string(),
7940
- tokenHash: zod.z.string(),
7941
- tokenPrefix: zod.z.string(),
7942
- scopes: zod.z.array(TokenScopeSchema),
7943
- // SQLite/JSON storage round-trips undefined → null. Use `nullish` so the
7944
- // schema accepts both `null` (read from disk) and `undefined` (in-memory).
7945
- expiresAt: zod.z.number().nullish(),
7946
- lastUsedAt: zod.z.number().nullish(),
7947
- createdAt: zod.z.number()
7948
- });
7949
7965
  exports.ACCESSORY_LABEL = ACCESSORY_LABEL;
7950
7966
  exports.APPLE_SA_TO_MACRO = APPLE_SA_TO_MACRO;
7951
7967
  exports.AUDIO_BACKEND_CHOICES = AUDIO_BACKEND_CHOICES;
@@ -8079,6 +8095,7 @@ exports.LogLevelSchema = LogLevelSchema$1;
8079
8095
  exports.LogStreamEntrySchema = LogStreamEntrySchema;
8080
8096
  exports.MODEL_FORMATS = MODEL_FORMATS;
8081
8097
  exports.MediaFileSchema = MediaFileSchema;
8098
+ exports.MethodAccessSchema = MethodAccessSchema;
8082
8099
  exports.MotionAnalysisResultSchema = MotionAnalysisResultSchema;
8083
8100
  exports.MotionEventSchema = MotionEventSchema;
8084
8101
  exports.MotionOnMotionChangedDataSchema = MotionOnMotionChangedDataSchema;
@@ -8284,4 +8301,4 @@ exports.webrtcSessionCapability = webrtcSessionCapability;
8284
8301
  exports.zoneAnalyticsCapability = zoneAnalyticsCapability;
8285
8302
  exports.zoneRulesCapability = zoneRulesCapability;
8286
8303
  exports.zonesCapability = zonesCapability;
8287
- //# sourceMappingURL=auth-records-U1Xok3iP.js.map
8304
+ //# sourceMappingURL=index-s8uJNgNs.js.map