@camstack/types 0.1.32 → 0.1.34

package/dist/{index-BUBhoPUu.js → index-DS7418lf.js}

@@ -3869,10 +3869,30 @@ const mqttBrokerCapability = {
   }
 };
 const LinkStateSchema = zod.z.enum(["unlinked", "linked", "error"]);
+const ExportSetupFieldSchema = zod.z.object({
+  label: zod.z.string(),
+  value: zod.z.string(),
+  /** Mask the value by default + render a reveal toggle (client id, secrets). */
+  secret: zod.z.boolean().optional()
+});
+const ExportSetupSchema = zod.z.object({
+  /** A string to render as a scannable QR — HAP `X-HM://…` URI, a pairing URL, etc. Omitted when there's nothing to scan. */
+  qr: zod.z.string().optional(),
+  /** Label/value rows shown with a copy button (HAP setup code, OAuth URLs, client id, linked-account count, …). */
+  fields: zod.z.array(ExportSetupFieldSchema).readonly().optional(),
+  /** Free-form operator instructions rendered above the fields. */
+  note: zod.z.string().optional()
+});
 const DeviceExportStatusSchema = zod.z.object({
   linkState: LinkStateSchema,
   exposedDeviceCount: zod.z.number(),
-  error: zod.z.string().optional()
+  error: zod.z.string().optional(),
+  /**
+   * Optional pairing/account info the panel renders in a generic
+   * "Setup" section. Addon-agnostic — the addon id identifies the
+   * export target, never an `ecosystem` key here.
+   */
+  setup: ExportSetupSchema.optional()
 });
 const DeviceKindSchema = zod.z.string();
 const ExposedDeviceSchema = zod.z.object({
@@ -7470,7 +7490,9 @@ const MeshPeerSchema = zod.z.object({
   id: zod.z.string(),
   /** Hostname / device name as shown in the mesh dashboard. */
   hostname: zod.z.string(),
-  /** Mesh IP(s). Multiple when the peer is dual-stacked. */
+  /** MagicDNS / mesh DNS name (e.g. `peer-foo.tail-abc.ts.net`). Empty when the provider doesn't support DNS or peer-side resolution is disabled. */
+  magicDns: zod.z.string(),
+  /** Mesh IPv4 / IPv6 addresses combined. Multiple when dual-stacked. */
   addresses: zod.z.array(zod.z.string()).readonly(),
   /** Operating system reported by the peer (informational). */
   os: zod.z.string().optional(),
@@ -7479,7 +7501,32 @@ const MeshPeerSchema = zod.z.object({
   /** Last-seen timestamp (epoch ms). 0 when never seen. */
   lastSeenMs: zod.z.number(),
   /** True for the row representing the current host. */
-  isSelf: zod.z.boolean()
+  isSelf: zod.z.boolean(),
+  /**
+   * Connection mode to this peer:
+   *   - `direct`: NAT-traversed P2P (UDP punched)
+   *   - `relay`: traffic relayed through provider edge (Tailscale DERP)
+   *   - `idle`: peer reachable but no recent traffic / handshake
+   */
+  connection: zod.z.enum(["direct", "relay", "idle"]),
+  /** DERP region / relay node identifier when `connection: relay`. Null otherwise. */
+  relay: zod.z.string().nullable(),
+  /** Last successful handshake timestamp (epoch ms). 0 when never. */
+  lastHandshakeMs: zod.z.number(),
+  /** Bytes received from this peer since the daemon started. */
+  rxBytes: zod.z.number(),
+  /** Bytes transmitted to this peer since the daemon started. */
+  txBytes: zod.z.number(),
+  /** ACL tags this peer carries (e.g. `["tag:server"]`). Empty when human-owned. */
+  tags: zod.z.array(zod.z.string()).readonly(),
+  /** True when the peer advertises itself as an exit-node candidate. */
+  exitNodeOption: zod.z.boolean(),
+  /** Subnet routes the peer advertises (e.g. `["192.168.1.0/24"]`). */
+  advertisedRoutes: zod.z.array(zod.z.string()).readonly(),
+  /** Owner account login (e.g. `foo@example.com`). Null for tagged peers. */
+  userLogin: zod.z.string().nullable(),
+  /** Pre-auth key / machine-key expiry (epoch ms). Null when keys don't expire. */
+  keyExpiry: zod.z.number().nullable()
 });
 const MeshStatusSchema = zod.z.object({
   /** True when the host is joined and the daemon reports healthy. */
@@ -7493,7 +7540,56 @@ const MeshStatusSchema = zod.z.object({
   /** Every endpoint this provider exposes for the current host. */
   endpoints: zod.z.array(MeshEndpointSchema$1).readonly(),
   /** Last error from the daemon, when not joined. */
-  error: zod.z.string().optional()
+  error: zod.z.string().optional(),
+  // ── Account / tenant identity (generic across providers) ────────
+  /**
+   * Tenant / tailnet / network display name (Tailscale = tailnet
+   * domain, Headscale = namespace, ZeroTier = network name). Empty
+   * pre-join. Per-provider semantics, common slot.
+   */
+  tenantName: zod.z.string(),
+  /**
+   * Mesh DNS suffix when the provider exposes peer-resolvable DNS
+   * (Tailscale MagicDNS, Headscale MagicDNS, …). Empty when the
+   * provider doesn't ship DNS (e.g. ZeroTier).
+   */
+  magicDnsSuffix: zod.z.string(),
+  /**
+   * Authenticated user / account login bound to this host. Null when
+   * the provider authenticates with a long-lived network token rather
+   * than a user account (e.g. ZeroTier API token).
+   */
+  userLogin: zod.z.string().nullable(),
+  /**
+   * Provider control-plane URL (Tailscale SaaS `https://login.tailscale.com`,
+   * self-hosted Headscale, ZeroTier Central, …). Empty when not
+   * applicable (rare).
+   */
+  controlPlaneUrl: zod.z.string(),
+  /**
+   * Machine-key / node-key expiry (epoch ms). Null when the provider
+   * doesn't rotate keys for the bound host. Operator-facing surface
+   * for "your access expires on …" banners.
+   */
+  keyExpiry: zod.z.number().nullable(),
+  // ── Onboard-daemon handoff (Tailscale, generic slot) ────────────
+  /**
+   * When the provider runs its OWN mesh daemon (e.g. the Tailscale
+   * client addon in `onboard` mode spawns a private `tailscaled`),
+   * this carries the local control-socket path. Companion addons that
+   * must drive the SAME daemon — chiefly `tailscale-ingress` for
+   * Serve/Funnel — read it to point their CLI at the right socket
+   * instead of the system default. Empty when the provider uses the
+   * host's system daemon (or doesn't have the concept).
+   */
+  daemonSocket: zod.z.string().optional(),
+  /**
+   * Path to the mesh CLI binary the provider downloaded for onboard
+   * mode. Companion addons reuse it so they don't need a system
+   * install when the operator chose a fully self-contained mesh.
+   * Empty in host mode.
+   */
+  daemonCliPath: zod.z.string().optional()
 });
 const meshNetworkCapability = {
   name: "mesh-network",
@@ -7545,12 +7641,26 @@ const meshNetworkCapability = {
       { kind: "mutation" }
     ),
     /** Leave the mesh. After this the meshIp/magicDnsHostname/etc.
-     *  vanish until the next `join`. */
+     *  vanish until the next `join`. The bound account stays — a
+     *  subsequent `join` reuses it without prompting for a new login. */
     leave: method(
       zod.z.void(),
       zod.z.object({ left: zod.z.literal(true) }),
       { kind: "mutation" }
     ),
+    /**
+     * Sign out of the mesh account entirely. Distinct from `leave`:
+     * `leave` only takes the host off-mesh (`tailscale down`) while the
+     * account binding survives, so the next `join` reconnects silently.
+     * `logout` (`tailscale logout`) wipes the daemon's stored
+     * credentials — the next `startLogin` MUST go through a fresh
+     * browser-redirect flow to bind a new account.
+     */
+    logout: method(
+      zod.z.void(),
+      zod.z.object({ loggedOut: zod.z.literal(true) }),
+      { kind: "mutation" }
+    ),
     /** Enumerate every peer the daemon currently knows about. */
     listPeers: method(zod.z.void(), zod.z.object({
       peers: zod.z.array(MeshPeerSchema).readonly()
@@ -7584,6 +7694,15 @@ const meshNetworkCapability = {
       }),
       { kind: "mutation" }
     )
+    // Provider-specific runtime knobs (accept-routes / advertise-routes /
+    // shields-up / ssh / exit-node, …) live on the addon's own
+    // `getSettingsUISchema` (form-builder), NOT here. Different mesh
+    // providers (Tailscale, Headscale, ZeroTier, Nebula) have very
+    // different config surfaces — picking one shape and forcing all
+    // implementations to honour it would either lose options or
+    // misrepresent them. The Mesh page renders the addon's settings
+    // schema as a "Settings" tab next to the generic Status / Peers
+    // tabs driven by this cap.
   }
 };
 const MeshEndpointSchema = zod.z.object({
@@ -7611,7 +7730,18 @@ const MeshProviderInfoSchema = zod.z.object({
   /** Active endpoints (mesh IP + MagicDNS + optional public Funnel). */
   endpoints: zod.z.array(MeshEndpointSchema).readonly(),
   /** Last error reported by the provider. */
-  error: zod.z.string().optional()
+  error: zod.z.string().optional(),
+  // ── Generic identity fields mirrored from MeshStatus ─────────────
+  /** Tenant / tailnet / network display name. Empty pre-join. */
+  tenantName: zod.z.string(),
+  /** Mesh DNS suffix (e.g. tailXXXX.ts.net). Empty when not configured. */
+  magicDnsSuffix: zod.z.string(),
+  /** Authenticated user / account login. Null for token-only providers. */
+  userLogin: zod.z.string().nullable(),
+  /** Provider control-plane URL. */
+  controlPlaneUrl: zod.z.string(),
+  /** Machine-key expiry (epoch ms). Null when keys don't rotate. */
+  keyExpiry: zod.z.number().nullable()
 });
 const meshOrchestratorCapability = {
   name: "mesh-orchestrator",
@@ -7637,6 +7767,43 @@ const meshOrchestratorCapability = {
       zod.z.object({ addonId: zod.z.string() }),
       zod.z.object({ success: zod.z.literal(true) }),
       { kind: "mutation" }
+    ),
+    /**
+     * Browser-redirect login flow. Forwards to the named provider's
+     * `mesh-network.startLogin` and returns the URL the daemon
+     * prints. UI opens it in a new tab, then polls `listProviders`
+     * for `joined: true`.
+     */
+    startLoginProvider: method(
+      zod.z.object({
+        addonId: zod.z.string(),
+        hostname: zod.z.string().optional()
+      }),
+      zod.z.object({ loginUrl: zod.z.string() }),
+      { kind: "mutation" }
+    ),
+    /**
+     * Sign out of the provider's account entirely (`mesh-network.logout`).
+     * Distinct from `leaveProvider` which only takes the host off-mesh;
+     * `logoutProvider` wipes credentials so the next start requires a
+     * fresh login.
+     */
+    logoutProvider: method(
+      zod.z.object({ addonId: zod.z.string() }),
+      zod.z.object({ loggedOut: zod.z.literal(true) }),
+      { kind: "mutation" }
+    ),
+    /**
+     * Per-provider peer list. Forwards to `mesh-network.listPeers` on
+     * the addressed provider. Separate from `listProviders` because
+     * peer payloads can be large on a heavily-populated tailnet —
+     * fetch only when the operator opens the Peers tab.
+     */
+    listProviderPeers: method(
+      zod.z.object({ addonId: zod.z.string() }),
+      zod.z.object({
+        peers: zod.z.array(MeshPeerSchema).readonly()
+      })
     )
   }
 };
@@ -7724,6 +7891,13 @@ const UserSummarySchema = zod.z.object({
   allowedProviders: zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")]),
   allowedDevices: zod.z.record(zod.z.string(), zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")])),
   scopes: zod.z.array(TokenScopeSchema).default([]),
+  /**
+   * True iff this user has a CONFIRMED TOTP enrollment. Surfaced on
+   * `listUsers` so the admin Users page can render the "Remove 2FA"
+   * action conditionally without firing one `getTotpStatus` query per
+   * row. Self-service enrollment lives on the user's profile page.
+   */
+  totpEnabled: zod.z.boolean().default(false),
   createdAt: zod.z.number(),
   updatedAt: zod.z.number()
 });
@@ -8022,6 +8196,12 @@ const NodeAddonInputSchema = zod.z.object({
   nodeId: zod.z.string(),
   addonId: zod.z.string()
 });
+const NodeAddonEntrySchema = zod.z.object({
+  id: zod.z.string(),
+  status: zod.z.string(),
+  version: zod.z.string().optional(),
+  packageName: zod.z.string().optional()
+});
 const SuccessSchema = zod.z.object({ success: zod.z.boolean() });
 const RestartProcessResultSchema = zod.z.object({
   success: zod.z.boolean(),
@@ -8039,6 +8219,7 @@ const nodesCapability = {
   name: "nodes",
   scope: "system",
   mode: "singleton",
+  nodeIdMode: "data",
   methods: {
     topology: method(
       zod.z.void(),
@@ -8082,6 +8263,19 @@ const nodesCapability = {
       zod.z.record(zod.z.string(), ClusterAddonStatusEntrySchema),
       { auth: "admin" }
     ),
+    /**
+     * Direct per-node addon listing — calls `$agent.status` on the target
+     * node (or returns the hub registry for `nodeId === 'hub'`) and surfaces
+     * the full addon roster including `version` + `packageName`. The
+     * `topology` cap also includes addons but strips them down to
+     * `{id, capabilities, status}` for the cluster diagram; this method
+     * is the one the per-node "Addons" tab should call.
+     */
+    getNodeAddons: method(
+      zod.z.object({ nodeId: zod.z.string() }),
+      zod.z.array(NodeAddonEntrySchema).readonly(),
+      { auth: "admin" }
+    ),
     setProcessLogLevel: method(
       zod.z.object({ nodeId: zod.z.string(), level: zod.z.string() }),
       SuccessSchema,
@@ -8307,6 +8501,21 @@ const AddonAutoUpdateSchema = ChannelWithInheritSchema;
 const RestartAddonResultSchema = zod.z.unknown();
 const InstallPackageResultSchema = zod.z.unknown();
 const ReloadPackagesResultSchema = zod.z.unknown();
+const UpdateFrameworkPackageResultSchema = zod.z.object({
+  packageName: zod.z.string(),
+  fromVersion: zod.z.string(),
+  toVersion: zod.z.string(),
+  /** Ms-epoch the server scheduled its self-restart. */
+  restartingAt: zod.z.number()
+});
+const FrameworkPackageStatusSchema = zod.z.object({
+  packageName: zod.z.string(),
+  currentVersion: zod.z.string(),
+  latestVersion: zod.z.string().nullable(),
+  hasUpdate: zod.z.boolean(),
+  /** Optional manifest description for the row tooltip. */
+  description: zod.z.string().optional()
+});
 const LogStreamEntrySchema = zod.z.object({
   timestamp: zod.z.string(),
   level: zod.z.string(),
@@ -8323,6 +8532,7 @@ const addonsCapability = {
   name: "addons",
   scope: "system",
   mode: "singleton",
+  nodeIdMode: "data",
   methods: {
     // ── Listing ──────────────────────────────────────────────────────
     list: method(zod.z.void(), zod.z.array(AddonListItemSchema).readonly()),
@@ -8369,13 +8579,29 @@ const addonsCapability = {
       zod.z.object({ query: zod.z.string().optional() }),
       zod.z.array(SearchResultSchema)
     ),
+    /**
+     * Available package updates for a node. `nodeId` omitted (or
+     * `'hub'`) checks the hub's own installed packages; an agent
+     * `nodeId` checks that agent's installed roster against npm
+     * (the hub does the npm lookups + diff — agents stay npm-free).
+     */
     listUpdates: method(
-      zod.z.void(),
+      zod.z.object({ nodeId: zod.z.string().optional() }),
       zod.z.array(PackageUpdateSchema).readonly(),
       { auth: "admin" }
     ),
+    /**
+     * Update one package on a node. `nodeId` omitted (or `'hub'`)
+     * installs on the hub via npm; an agent `nodeId` makes the hub
+     * pack the resolved version and push the tarball to that agent
+     * (`$agent.deploy` + `$agent.reload`) — agents need no npm runtime.
+     */
     updatePackage: method(
-      zod.z.object({ name: zod.z.string().min(1), version: zod.z.string().optional() }),
+      zod.z.object({
+        name: zod.z.string().min(1),
+        version: zod.z.string().optional(),
+        nodeId: zod.z.string().optional()
+      }),
       zod.z.unknown(),
       { kind: "mutation", auth: "admin" }
     ),
@@ -8396,12 +8622,105 @@ const addonsCapability = {
       zod.z.object({ rolledBackTo: zod.z.string().nullable() }),
       { kind: "mutation", auth: "admin" }
     ),
-    forceRefresh: method(zod.z.void(), zod.z.unknown(), { kind: "mutation", auth: "admin" }),
+    /** Re-check updates for a node, bypassing any cache. `nodeId`
+     *  omitted (or `'hub'`) refreshes the hub; an agent `nodeId`
+     *  re-checks that agent's roster. */
+    forceRefresh: method(
+      zod.z.object({ nodeId: zod.z.string().optional() }),
+      zod.z.unknown(),
+      { kind: "mutation", auth: "admin" }
+    ),
     restartServer: method(
       zod.z.object({ confirm: zod.z.literal(true) }),
       zod.z.unknown(),
       { kind: "mutation", auth: "admin" }
     ),
+    /**
+     * Most-recent restart marker (kind / packageName / from→to versions
+     * / requestedBy / requestedAt). Returns `null` when this process
+     * didn't boot from a tracked restart, or when the
+     * post-boot retention window (5 min) has elapsed.
+     *
+     * Drives the admin-UI reconnect overlay's success toast — the
+     * `system.restart-completed` event itself is fired before the
+     * client has time to re-subscribe, so the client queries this on
+     * first reconnect instead.
+     */
+    getLastRestart: method(
+      zod.z.void(),
+      zod.z.object({
+        kind: zod.z.enum(["framework-update", "manual", "system"]),
+        packageName: zod.z.string().optional(),
+        fromVersion: zod.z.string().optional(),
+        toVersion: zod.z.string().optional(),
+        requestedBy: zod.z.string().optional(),
+        requestedAt: zod.z.number()
+      }).nullable(),
+      { auth: "admin" }
+    ),
+    /**
+     * Snapshot of the framework packages installed under the hub's
+     * `<appRoot>/node_modules/`. Each row carries the currently
+     * installed version and (best-effort) the latest version
+     * available on npm. Drives the admin-UI "System packages" panel.
+     *
+     * Spec: docs/superpowers/specs/2026-05-14-framework-live-update-design.md
+     */
+    listFrameworkPackages: method(
+      zod.z.void(),
+      zod.z.array(FrameworkPackageStatusSchema).readonly(),
+      { auth: "admin" }
+    ),
+    /**
+     * Cluster-wide capability-provider discovery. Returns the list of
+     * `{ addonId, mode, isActive }` tuples for whatever addon(s)
+     * currently provide the requested capability across the cluster.
+     *
+     * Why this lives on `addons` (and not on a `capabilities` cap of
+     * its own): the hub's main-process `CapabilityRegistry` already
+     * aggregates registrations from every forked group-runner and
+     * remote agent via Moleculer event propagation — there's no
+     * cross-process registry mirror to build, just an introspection
+     * shim.
+     *
+     * Use this from addon code when you need to know whether another
+     * addon has registered a specific cap (e.g. `tailscale-ingress`
+     * checking `tailscale-client` is up before calling `tailscale
+     * serve`). Don't reach for `ctx.capabilities.getCollectionEntries`
+     * — that reads the LOCAL registry of the calling addon's group
+     * runner and never sees providers in other processes. See
+     * `CLAUDE.md` → Critical rules → ctx.api vs ctx.capabilities.
+     */
+    listCapabilityProviders: method(
+      zod.z.object({ capName: zod.z.string().min(1) }),
+      zod.z.array(zod.z.object({
+        addonId: zod.z.string(),
+        mode: zod.z.enum(["singleton", "collection"]),
+        isActive: zod.z.boolean()
+      })).readonly()
+    ),
+    /**
+     * Live-update one of the framework packages marked
+     * `camstack.system: true` (`@camstack/types|kernel|core|sdk|ui-library`).
+     * Runs `npm install --prefix <appRoot> <name>@<version> --no-save`,
+     * writes a `.restart-pending` marker, emits `system.restarting`
+     * and schedules a graceful process exit. The supervisor (Docker /
+     * Electron / systemd) brings the hub back up; on first boot after
+     * the restart the marker fires `system.restart-completed`.
+     *
+     * `version` defaults to `'latest'`. The allow-list of valid
+     * `packageName` values is enforced server-side.
+     *
+     * Spec: docs/superpowers/specs/2026-05-14-framework-live-update-design.md
+     */
+    updateFrameworkPackage: method(
+      zod.z.object({
+        packageName: zod.z.string().min(1),
+        version: zod.z.string().optional()
+      }),
+      UpdateFrameworkPackageResultSchema,
+      { kind: "mutation", auth: "admin" }
+    ),
     getVersions: method(
       zod.z.object({ name: zod.z.string() }),
       zod.z.array(PackageVersionInfoSchema).readonly()
@@ -8598,6 +8917,8 @@ exports.EndDownloadInputSchema = EndDownloadInputSchema;
 exports.EnrichedWidgetMetadataSchema = EnrichedWidgetMetadataSchema;
 exports.EventItemSchema = EventItemSchema;
 exports.EventKindSchema = EventKindSchema;
+exports.ExportSetupFieldSchema = ExportSetupFieldSchema;
+exports.ExportSetupSchema = ExportSetupSchema;
 exports.ExposeInputSchema = ExposeInputSchema;
 exports.ExposedDeviceSchema = ExposedDeviceSchema;
 exports.ExposedResourceSchema = ExposedResourceSchema;
@@ -8841,4 +9162,4 @@ exports.webrtcSessionCapability = webrtcSessionCapability;
 exports.zoneAnalyticsCapability = zoneAnalyticsCapability;
 exports.zoneRulesCapability = zoneRulesCapability;
 exports.zonesCapability = zonesCapability;
-//# sourceMappingURL=index-BUBhoPUu.js.map
+//# sourceMappingURL=index-DS7418lf.js.map