@camstack/types 1.2.106 → 1.2.107

package/dist/capabilities/data-store-provider.cap.d.ts

@@ -25,6 +25,23 @@ declare const EngineInfoSchema: z.ZodObject<{
  * go through `settings-store`; they never see this cap, and an engine
  * never sees a caller.
  *
+ * ⚠ **`internal: true` DOES NOT gate the mount, and until 2026-08-26 this
+ * comment claimed otherwise.** `resolveCapMount` never reads the field, so this
+ * cap was live on the AppRouter with every method at the default
+ * `auth: 'protected'` — i.e. readable by ANY authenticated session, admin or
+ * not. Verified against the live hub: `dataStoreProvider.query` returned raw
+ * settings rows including a provider credential, bypassing the secret redaction
+ * that `deviceManager.listAll` and friends go through.
+ *
+ * Every method is now `auth: 'admin'` EXPLICITLY, including the five reads —
+ * they had no options object at all, which is exactly how they kept the
+ * permissive default while the mutations looked deliberate. The explicit
+ * annotation is the fix that works today; making `internal` mean something at
+ * mount time is the systemic one, and it is not free: 22 caps declare it, only
+ * 4 are `mount: 'skip'`, and forcing admin on all of them would change the auth
+ * of surfaces the viewer and admin-ui call as non-admin users. That decision is
+ * the operator's, not a side effect of this file.
+ *
  * Design notes:
  *   - **Stateless dispatch.** Every method carries its own
  *     `namespace` + `collection`, so an engine keeps no per-caller state

package/dist/index.js

@@ -7374,6 +7374,23 @@ var EngineInfoSchema = zod.z.object({
 * go through `settings-store`; they never see this cap, and an engine
 * never sees a caller.
 *
+* ⚠ **`internal: true` DOES NOT gate the mount, and until 2026-08-26 this
+* comment claimed otherwise.** `resolveCapMount` never reads the field, so this
+* cap was live on the AppRouter with every method at the default
+* `auth: 'protected'` — i.e. readable by ANY authenticated session, admin or
+* not. Verified against the live hub: `dataStoreProvider.query` returned raw
+* settings rows including a provider credential, bypassing the secret redaction
+* that `deviceManager.listAll` and friends go through.
+*
+* Every method is now `auth: 'admin'` EXPLICITLY, including the five reads —
+* they had no options object at all, which is exactly how they kept the
+* permissive default while the mutations looked deliberate. The explicit
+* annotation is the fix that works today; making `internal` mean something at
+* mount time is the systemic one, and it is not free: 22 caps declare it, only
+* 4 are `mount: 'skip'`, and forcing admin on all of them would change the auth
+* of surfaces the viewer and admin-ui call as non-admin users. That decision is
+* the operator's, not a side effect of this file.
+*
 * Design notes:
 *   - **Stateless dispatch.** Every method carries its own
 *     `namespace` + `collection`, so an engine keeps no per-caller state
@@ -7395,20 +7412,23 @@ var dataStoreProviderCapability = {
 	internal: true,
 	methods: {
 		/** Self-description — how the orchestrator picks a registrant. */
-		getEngineInfo: require_sleep.method(zod.z.void(), EngineInfoSchema),
+		getEngineInfo: require_sleep.method(zod.z.void(), EngineInfoSchema, { auth: "admin" }),
 		/** Get a single value by key from a collection. */
 		get: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
 			key: zod.z.string()
-		}), zod.z.unknown()),
+		}), zod.z.unknown(), { auth: "admin" }),
 		/** Set a value by key in a collection (upsert). */
 		set: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
 			key: zod.z.string(),
 			value: zod.z.unknown()
-		}), zod.z.void(), { kind: "mutation" }),
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Get all entries matching an optional filter. */
 		query: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
@@ -7417,52 +7437,80 @@ var dataStoreProviderCapability = {
 			/**
 			* SQL-level column projection — MUST mirror `settings-store.query`.
 			*
-			* This is the second schema the same call passes through, and Zod
-			* objects STRIP what they do not declare: a field present on the door
-			* and absent here does not error, it silently disappears one hop before
-			* the engine, and the caller concludes the projection does nothing.
-			* `data-door-schema-parity.spec.ts` is what keeps the two in step.
+			* ⚠ An earlier version of this comment blamed Zod stripping, and that
+			* was wrong — corrected 2026-08-26 after the hop map
+			* (`docs/design/2026-08-26-mappa-hop-argomenti.md`) traced the path.
+			* There is **no Zod parse at all** between the door and the engine: the
+			* dispatcher forwards the payload verbatim and UDS carries it whole. A
+			* field declared here reaches `SqliteSettingsBackend` either way.
+			*
+			* What actually lost `columns` was the THIRD declaration of this shape:
+			* `SettingsQueryInput` in `interfaces/storage.ts`, a hand-written TS
+			* interface the engine destructures from. The field existed on both
+			* schemas and the engine still never read it, because nothing checks a
+			* registered provider against `InferProvider<cap>` —
+			* `ProviderRegistration.provider` is typed `object`.
+			*
+			* It is declared here anyway, and must stay in step with
+			* `settings-store.query`: a caller reading only the cap definitions has
+			* to be able to see that this call carries a projection.
+			* `data-door-schema-parity.spec.ts` keeps the two aligned.
 			*/
 			columns: zod.z.array(zod.z.string()).readonly().optional()
-		}), zod.z.array(SettingsRecordSchema).readonly()),
+		}), zod.z.array(SettingsRecordSchema).readonly(), { auth: "admin" }),
 		/** Insert a new record. */
 		insert: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
 			record: SettingsRecordSchema
-		}), zod.z.void(), { kind: "mutation" }),
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Update an existing record by ID. */
 		update: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
 			id: zod.z.string(),
 			data: zod.z.record(zod.z.string(), zod.z.unknown())
-		}), zod.z.void(), { kind: "mutation" }),
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Delete a record by key/ID. */
 		delete: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
 			key: zod.z.string()
-		}), zod.z.void(), { kind: "mutation" }),
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Delete every record matching `filter`, in one statement. */
 		deleteWhere: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
 			filter: MutationFilterSchema
-		}), zod.z.object({ deleted: zod.z.number().int() }), { kind: "mutation" }),
+		}), zod.z.object({ deleted: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Apply `data` to every record matching `filter`, in one statement. */
 		updateWhere: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
 			filter: MutationFilterSchema,
 			data: zod.z.record(zod.z.string(), zod.z.unknown())
-		}), zod.z.object({ updated: zod.z.number().int() }), { kind: "mutation" }),
+		}), zod.z.object({ updated: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Count entries in a collection, optionally filtered. */
 		count: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
 			filter: QueryFilterSchema.optional()
-		}), zod.z.number()),
+		}), zod.z.number(), { auth: "admin" }),
 		/** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
 		histogram: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
@@ -7474,19 +7522,22 @@ var dataStoreProviderCapability = {
 		}), zod.z.array(zod.z.object({
 			bucket: zod.z.number().int(),
 			count: zod.z.number().int()
-		})).readonly()),
+		})).readonly(), { auth: "admin" }),
 		/** Check if a collection is empty. */
 		isEmpty: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string()
-		}), zod.z.boolean()),
+		}), zod.z.boolean(), { auth: "admin" }),
 		/** Declare a typed (SQL-backed) collection with columns + indexes. */
 		declareCollection: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
 			columns: zod.z.array(CollectionColumnSchema).readonly(),
 			indexes: zod.z.array(CollectionIndexSchema).readonly().optional()
-		}), zod.z.void(), { kind: "mutation" })
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 //#endregion

package/dist/index.mjs

@@ -7373,6 +7373,23 @@ var EngineInfoSchema = z.object({
 * go through `settings-store`; they never see this cap, and an engine
 * never sees a caller.
 *
+* ⚠ **`internal: true` DOES NOT gate the mount, and until 2026-08-26 this
+* comment claimed otherwise.** `resolveCapMount` never reads the field, so this
+* cap was live on the AppRouter with every method at the default
+* `auth: 'protected'` — i.e. readable by ANY authenticated session, admin or
+* not. Verified against the live hub: `dataStoreProvider.query` returned raw
+* settings rows including a provider credential, bypassing the secret redaction
+* that `deviceManager.listAll` and friends go through.
+*
+* Every method is now `auth: 'admin'` EXPLICITLY, including the five reads —
+* they had no options object at all, which is exactly how they kept the
+* permissive default while the mutations looked deliberate. The explicit
+* annotation is the fix that works today; making `internal` mean something at
+* mount time is the systemic one, and it is not free: 22 caps declare it, only
+* 4 are `mount: 'skip'`, and forcing admin on all of them would change the auth
+* of surfaces the viewer and admin-ui call as non-admin users. That decision is
+* the operator's, not a side effect of this file.
+*
 * Design notes:
 *   - **Stateless dispatch.** Every method carries its own
 *     `namespace` + `collection`, so an engine keeps no per-caller state
@@ -7394,20 +7411,23 @@ var dataStoreProviderCapability = {
 	internal: true,
 	methods: {
 		/** Self-description — how the orchestrator picks a registrant. */
-		getEngineInfo: method(z.void(), EngineInfoSchema),
+		getEngineInfo: method(z.void(), EngineInfoSchema, { auth: "admin" }),
 		/** Get a single value by key from a collection. */
 		get: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			key: z.string()
-		}), z.unknown()),
+		}), z.unknown(), { auth: "admin" }),
 		/** Set a value by key in a collection (upsert). */
 		set: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			key: z.string(),
 			value: z.unknown()
-		}), z.void(), { kind: "mutation" }),
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Get all entries matching an optional filter. */
 		query: method(z.object({
 			namespace: z.string().optional(),
@@ -7416,52 +7436,80 @@ var dataStoreProviderCapability = {
 			/**
 			* SQL-level column projection — MUST mirror `settings-store.query`.
 			*
-			* This is the second schema the same call passes through, and Zod
-			* objects STRIP what they do not declare: a field present on the door
-			* and absent here does not error, it silently disappears one hop before
-			* the engine, and the caller concludes the projection does nothing.
-			* `data-door-schema-parity.spec.ts` is what keeps the two in step.
+			* ⚠ An earlier version of this comment blamed Zod stripping, and that
+			* was wrong — corrected 2026-08-26 after the hop map
+			* (`docs/design/2026-08-26-mappa-hop-argomenti.md`) traced the path.
+			* There is **no Zod parse at all** between the door and the engine: the
+			* dispatcher forwards the payload verbatim and UDS carries it whole. A
+			* field declared here reaches `SqliteSettingsBackend` either way.
+			*
+			* What actually lost `columns` was the THIRD declaration of this shape:
+			* `SettingsQueryInput` in `interfaces/storage.ts`, a hand-written TS
+			* interface the engine destructures from. The field existed on both
+			* schemas and the engine still never read it, because nothing checks a
+			* registered provider against `InferProvider<cap>` —
+			* `ProviderRegistration.provider` is typed `object`.
+			*
+			* It is declared here anyway, and must stay in step with
+			* `settings-store.query`: a caller reading only the cap definitions has
+			* to be able to see that this call carries a projection.
+			* `data-door-schema-parity.spec.ts` keeps the two aligned.
 			*/
 			columns: z.array(z.string()).readonly().optional()
-		}), z.array(SettingsRecordSchema).readonly()),
+		}), z.array(SettingsRecordSchema).readonly(), { auth: "admin" }),
 		/** Insert a new record. */
 		insert: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			record: SettingsRecordSchema
-		}), z.void(), { kind: "mutation" }),
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Update an existing record by ID. */
 		update: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			id: z.string(),
 			data: z.record(z.string(), z.unknown())
-		}), z.void(), { kind: "mutation" }),
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Delete a record by key/ID. */
 		delete: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			key: z.string()
-		}), z.void(), { kind: "mutation" }),
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Delete every record matching `filter`, in one statement. */
 		deleteWhere: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			filter: MutationFilterSchema
-		}), z.object({ deleted: z.number().int() }), { kind: "mutation" }),
+		}), z.object({ deleted: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Apply `data` to every record matching `filter`, in one statement. */
 		updateWhere: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			filter: MutationFilterSchema,
 			data: z.record(z.string(), z.unknown())
-		}), z.object({ updated: z.number().int() }), { kind: "mutation" }),
+		}), z.object({ updated: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Count entries in a collection, optionally filtered. */
 		count: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			filter: QueryFilterSchema.optional()
-		}), z.number()),
+		}), z.number(), { auth: "admin" }),
 		/** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
 		histogram: method(z.object({
 			namespace: z.string().optional(),
@@ -7473,19 +7521,22 @@ var dataStoreProviderCapability = {
 		}), z.array(z.object({
 			bucket: z.number().int(),
 			count: z.number().int()
-		})).readonly()),
+		})).readonly(), { auth: "admin" }),
 		/** Check if a collection is empty. */
 		isEmpty: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string()
-		}), z.boolean()),
+		}), z.boolean(), { auth: "admin" }),
 		/** Declare a typed (SQL-backed) collection with columns + indexes. */
 		declareCollection: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			columns: z.array(CollectionColumnSchema).readonly(),
 			indexes: z.array(CollectionIndexSchema).readonly().optional()
-		}), z.void(), { kind: "mutation" })
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/types",
-  "version": "1.2.106",
+  "version": "1.2.107",
   "description": "Shared types, interfaces, and model catalogs for the CamStack detection ecosystem",
   "keywords": [
     "camstack",