@camstack/types 1.2.106 → 1.2.108

package/dist/addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_event_category = require("./event-category-EY0GNjV9.js");
-const require_sleep = require("./sleep-CUuoW-kk.js");
+const require_sleep = require("./sleep-OOwhyQIx.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
 //#region src/generated/cap-input-defaults.ts
 /**

package/dist/addon.mjs

@@ -1,5 +1,5 @@
 import { t as EventCategory } from "./event-category-CIa_iT6b.mjs";
-import { B as ReadinessRegistry, E as adminUiCapability, L as nodePin, R as readNodePin, St as emitReadiness, T as DeviceType, V as ReadinessTimeoutError, W as scopeKey, _t as DisposerChain, a as asJsonObject, b as deviceOpsCapability, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, gt as DATAPLANE_SECRET_HEADER, h as createEventBusSliceSource, j as expandCapMethods, m as createDeviceProxy, p as isDeviceScopedCap, s as asString, t as sleep, u as parseJsonUnknown, vt as BaseAddon, x as viewerUiCapability, yt as normalizeAddonInitResult } from "./sleep-BLxqGLY0.mjs";
+import { B as ReadinessRegistry, E as adminUiCapability, L as nodePin, R as readNodePin, St as emitReadiness, T as DeviceType, V as ReadinessTimeoutError, W as scopeKey, _t as DisposerChain, a as asJsonObject, b as deviceOpsCapability, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, gt as DATAPLANE_SECRET_HEADER, h as createEventBusSliceSource, j as expandCapMethods, m as createDeviceProxy, p as isDeviceScopedCap, s as asString, t as sleep, u as parseJsonUnknown, vt as BaseAddon, x as viewerUiCapability, yt as normalizeAddonInitResult } from "./sleep-DCBRhx0s.mjs";
 import { t as errMsg } from "./err-msg-IQTHeDzc.mjs";
 //#region src/generated/cap-input-defaults.ts
 /**

package/dist/capabilities/addon-pages-source.cap.d.ts

@@ -28,6 +28,16 @@ export declare const addonPagesSourceCapability: {
     readonly mode: "collection";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`) — this was reachable on the AppRouter by ANY
+         * authenticated session at the default `auth: 'protected'`. The only
+         * consumer, the `addon-pages-aggregator` builtin, reads it via
+         * `ctx.capabilities.getCollection('addon-pages-source')` — LOCAL-PROCESS
+         * only, never tRPC (per `ctx.capabilities` seeing only the local
+         * process). The public, enriched listing admin-ui actually consumes is
+         * the separate `addon-pages` cap, unaffected by this change.
+         */
         readonly listPages: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodReadonly<z.ZodArray<z.ZodObject<{
             id: z.ZodString;
             label: z.ZodString;

package/dist/capabilities/addon-widgets-source.cap.d.ts

@@ -122,6 +122,18 @@ export declare const addonWidgetsSourceCapability: {
     readonly mode: "collection";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`) — this was reachable on the AppRouter by ANY
+         * authenticated session at the default `auth: 'protected'`. The only
+         * consumer, the `addon-widgets-aggregator` builtin, reads it via
+         * `ctx.capabilities.getCollection('addon-widgets-source')` — LOCAL-PROCESS
+         * only, never tRPC. The public, enriched listing admin-ui actually
+         * consumes is the separate `addon-widgets` cap (`listWidgets` there is
+         * gated separately, and a `preAuth: true` widget is surfaced through the
+         * PUBLIC `auth.listLoginMethods` contribution channel instead) —
+         * neither is affected by this change.
+         */
         readonly listWidgets: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodReadonly<z.ZodArray<z.ZodObject<{
             tab: z.ZodString;
             subTab: z.ZodOptional<z.ZodString>;

package/dist/capabilities/admin-ui.cap.d.ts

@@ -6,6 +6,15 @@ export declare const adminUiCapability: {
     readonly mode: "singleton";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`) — both methods were reachable on the AppRouter
+         * by ANY authenticated session at the default `auth: 'protected'`, and
+         * `getStaticDir` leaks a hub filesystem path. The only caller is
+         * `main.ts`'s static-file bootstrap, via `capRegistry.getSingletonForNode`
+         * — never tRPC — so `auth: 'admin'` costs it nothing. The actual admin-ui
+         * SPA assets are served as plain static files, unaffected by this gate.
+         */
         readonly getStaticDir: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodObject<{
             staticDir: z.ZodString;
         }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;

package/dist/capabilities/custom-model-registry.cap.d.ts

@@ -161,6 +161,15 @@ export declare const customModelRegistryCapability: {
     readonly mode: "collection";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`) — this was reachable on the AppRouter by ANY
+         * authenticated session at the default `auth: 'protected'`. The only
+         * consumer, the detection-pipeline's model resolution
+         * (`addon-pipeline/src/detection-pipeline/provider.ts`), calls
+         * `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
+         * never tRPC — so `auth: 'admin'` costs it nothing.
+         */
         readonly listModels: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodReadonly<z.ZodArray<z.ZodObject<{
             stepId: z.ZodString;
             entry: z.ZodObject<{

package/dist/capabilities/data-store-provider.cap.d.ts

@@ -25,6 +25,23 @@ declare const EngineInfoSchema: z.ZodObject<{
  * go through `settings-store`; they never see this cap, and an engine
  * never sees a caller.
  *
+ * ⚠ **`internal: true` DOES NOT gate the mount, and until 2026-08-26 this
+ * comment claimed otherwise.** `resolveCapMount` never reads the field, so this
+ * cap was live on the AppRouter with every method at the default
+ * `auth: 'protected'` — i.e. readable by ANY authenticated session, admin or
+ * not. Verified against the live hub: `dataStoreProvider.query` returned raw
+ * settings rows including a provider credential, bypassing the secret redaction
+ * that `deviceManager.listAll` and friends go through.
+ *
+ * Every method is now `auth: 'admin'` EXPLICITLY, including the five reads —
+ * they had no options object at all, which is exactly how they kept the
+ * permissive default while the mutations looked deliberate. The explicit
+ * annotation is the fix that works today; making `internal` mean something at
+ * mount time is the systemic one, and it is not free: 22 caps declare it, only
+ * 4 are `mount: 'skip'`, and forcing admin on all of them would change the auth
+ * of surfaces the viewer and admin-ui call as non-admin users. That decision is
+ * the operator's, not a side effect of this file.
+ *
  * Design notes:
  *   - **Stateless dispatch.** Every method carries its own
  *     `namespace` + `collection`, so an engine keeps no per-caller state

package/dist/capabilities/embedding-encoder.cap.d.ts

@@ -22,6 +22,13 @@ export declare const embeddingEncoderCapability: {
     readonly mode: "collection";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`) — every method below was reachable on the
+         * AppRouter by ANY authenticated session at the default
+         * `auth: 'protected'`. Consumers reach the encoder via `ctx.api` from
+         * `addon-post-analysis`, never tRPC.
+         */
         readonly encode: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             crop: z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>;
             width: z.ZodNumber;

package/dist/capabilities/llm-runtime.cap.d.ts

@@ -248,6 +248,19 @@ export declare const llmRuntimeCapability: {
     readonly mode: "singleton";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `complete`, `status`, `listLocalModels` and `getDiskUsage` had NO
+         * `auth` override — `internal: true` did not gate the mount (see the
+         * 2026-08-26 note on `data-store-provider`), so they were reachable on
+         * the AppRouter by ANY authenticated session at the default
+         * `auth: 'protected'`, inconsistent with the rest of this cap (already
+         * `auth: 'admin'`) and with this file's own docblock: "the operator
+         * reaches this only through the `llm` cap's methods." The sole caller,
+         * `addon-ai`'s `runtime-client.ts`, reaches every method here via
+         * `ctx.api` + `nodePin` — never tRPC — so `auth: 'admin'` costs it
+         * nothing; the public `llm` cap (which end users and non-admin sessions
+         * legitimately call for chat/generation) is untouched.
+         */
         readonly complete: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             addonId: z.ZodOptional<z.ZodString>;
             profileId: z.ZodOptional<z.ZodString>;

package/dist/capabilities/oauth-integration.cap.d.ts

@@ -140,6 +140,15 @@ export declare const oauthIntegrationCapability: {
     readonly mode: "collection";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`) — `getDescriptor` was reachable on the AppRouter
+         * by ANY authenticated session at the default `auth: 'protected'`. The
+         * real caller is `/api/oauth2/authorize` and `/api/oauth2/integrations`
+         * (`oauth2-routes.ts`), which resolve the provider directly off the
+         * capability registry — never through tRPC. `auth: 'admin'` closes the
+         * tRPC surface without touching that path.
+         */
         readonly getDescriptor: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodObject<{
             integrationId: z.ZodString;
             displayName: z.ZodString;

package/dist/capabilities/sso-bridge.cap.d.ts

@@ -83,6 +83,20 @@ export declare const ssoBridgeCapability: {
     readonly mode: "singleton";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`) — `signBridgeToken` was reachable on the
+         * AppRouter by ANY authenticated session at the default
+         * `auth: 'protected'`. The claims (including `isAdmin`) are CALLER-
+         * SUPPLIED: an unprivileged session could have minted its own
+         * `isAdmin: true` bridge token and redeemed it at
+         * `/api/auth/sso/finish` to become admin — a full privilege escalation
+         * through the exact surface this cap exists to close (see the module
+         * docblock). Every real caller (`oauth-grants.ts`, `main.ts`
+         * registration, the OIDC/magic-link addons) reaches this through
+         * `ctx.api` / the in-process registry — never through tRPC — so
+         * `auth: 'admin'` costs those callers nothing.
+         */
         readonly signBridgeToken: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             claims: z.ZodObject<{
                 userId: z.ZodString;

package/dist/capabilities/storage-evictable.cap.d.ts

@@ -29,6 +29,13 @@ export declare const storageEvictableCapability: {
     readonly mode: "collection";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`) — this was reachable on the AppRouter by ANY
+         * authenticated session at the default `auth: 'protected'`. The only
+         * consumer is the orchestrator's `StoragePressureManager`, which calls
+         * `ctx.api` — never tRPC — so `auth: 'admin'` costs it nothing.
+         */
         /** Bytes this provider holds on the given location — drives proportional fan-out. */
         readonly getEvictableUsage: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             locationId: z.ZodString;

package/dist/capabilities/storage-provider.cap.d.ts

@@ -112,6 +112,21 @@ export declare const storageProviderCapability: {
     readonly mode: "collection";
     readonly internal: true;
     readonly methods: {
+        /**
+         * Every method below except `testLocation` had NO `auth` override —
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`), so this was reachable on the AppRouter by ANY
+         * authenticated session at the default `auth: 'protected'`: arbitrary
+         * read/write/delete/list against any storage location the operator has
+         * configured, keyed only by a caller-supplied `location` + `relativePath`
+         * — the same "public consumers never see this cap" claim that was false
+         * for `data-store-provider`, here gating raw file I/O instead of raw
+         * settings rows. The only legitimate caller,
+         * `addon-registry.service.ts`'s `activeStorageProvider`, calls the
+         * provider object directly (in-process) — never tRPC — so `auth: 'admin'`
+         * on every method costs it nothing. Public consumers already go through
+         * the separate `storage` singleton cap.
+         */
         /** Self-description for the "Add location" wizard. */
         readonly getProviderInfo: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodDiscriminatedUnion<[z.ZodObject<{
             providerId: z.ZodString;

package/dist/capabilities/user-passkeys.cap.d.ts

@@ -81,6 +81,24 @@ export declare const userPasskeysCapability: {
             success: z.ZodLiteral<true>;
             credentialId: z.ZodString;
         }, z.core.$strip>, "mutation">;
+        /**
+         * The four methods below had NO `auth` override — `internal: true` did
+         * not gate the mount (see the 2026-08-26 note on `data-store-provider`),
+         * so they were reachable on the AppRouter at the default
+         * `auth: 'protected'` (any authenticated session), inconsistent with
+         * every other method on this cap (all already `auth: 'admin'`).
+         *
+         * ⚠ Checked before gating: these are also the PRE-AUTH login-ceremony
+         * methods, so admin-gating them here must not break login for an
+         * unauthenticated principal. It doesn't — the real login path is the
+         * PUBLIC `auth.beginAuthentication` / `auth.finishAuthentication` /
+         * `auth.beginDiscoverableAuthentication` / `auth.finishDiscoverableAuthentication`
+         * procedures in `server/backend/src/api/core/auth.router.ts`, which call
+         * `provider.beginAuthentication(...)` etc. directly against the
+         * capability-registry-resolved provider — never through this cap's own
+         * tRPC route. `auth: 'admin'` here only closes a redundant, unused
+         * second entry point onto the same ceremony.
+         */
         readonly beginAuthentication: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             userId: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>, z.ZodObject<{

package/dist/capabilities/vector-store.cap.d.ts

@@ -164,6 +164,14 @@ export declare const VectorStatsResultSchema: z.ZodObject<{
     bytes: z.ZodOptional<z.ZodNumber>;
     exact: z.ZodBoolean;
 }, z.core.$strip>;
+/**
+ * `internal: true` did not gate the mount (see the 2026-08-26 note on
+ * `data-store-provider`) — every method below was reachable on the AppRouter
+ * by ANY authenticated session at the default `auth: 'protected'`. The only
+ * consumers (`addon-post-analysis`'s embedding stores) reach this cap via
+ * `ctx.api` — UDS/Moleculer, never tRPC — so `auth: 'admin'` on every method
+ * costs them nothing. No client (viewer or admin-ui) calls `vectorStore.*`.
+ */
 export declare const vectorStoreCapability: {
     readonly name: "vector-store";
     readonly scope: "system";

package/dist/capabilities/viewer-ui.cap.d.ts

@@ -13,6 +13,21 @@ export declare const viewerUiCapability: {
     readonly mode: "singleton";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`) — both methods were reachable on the AppRouter
+         * by ANY authenticated session at the default `auth: 'protected'`, and
+         * `getStaticDir` leaks a hub filesystem path.
+         *
+         * ⚠ Checked before gating: the VIEWER app IS used by a non-admin user
+         * (`roberta`), but it never calls `viewerUi.*` over tRPC. The static SPA
+         * it loads is served by the plain `GET /viewer/*` Fastify route in
+         * `main.ts`, which reads `staticDir`/`indexPath` from a module-level
+         * cache populated ONCE at boot via `capRegistry.getSingletonForNode`
+         * (in-process, not tRPC) — the cap's tRPC procedure is never on that
+         * request path. `auth: 'admin'` here does not block a single viewer
+         * user from loading the app.
+         */
         readonly getStaticDir: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodObject<{
             staticDir: z.ZodString;
         }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;