@camstack/types 1.2.107 → 1.2.109

package/dist/addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_event_category = require("./event-category-EY0GNjV9.js");
-const require_sleep = require("./sleep-CUuoW-kk.js");
+const require_sleep = require("./sleep-BJTBu5cu.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
 //#region src/generated/cap-input-defaults.ts
 /**

package/dist/addon.mjs

@@ -1,5 +1,5 @@
 import { t as EventCategory } from "./event-category-CIa_iT6b.mjs";
-import { B as ReadinessRegistry, E as adminUiCapability, L as nodePin, R as readNodePin, St as emitReadiness, T as DeviceType, V as ReadinessTimeoutError, W as scopeKey, _t as DisposerChain, a as asJsonObject, b as deviceOpsCapability, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, gt as DATAPLANE_SECRET_HEADER, h as createEventBusSliceSource, j as expandCapMethods, m as createDeviceProxy, p as isDeviceScopedCap, s as asString, t as sleep, u as parseJsonUnknown, vt as BaseAddon, x as viewerUiCapability, yt as normalizeAddonInitResult } from "./sleep-BLxqGLY0.mjs";
+import { B as ReadinessRegistry, E as adminUiCapability, L as nodePin, R as readNodePin, St as emitReadiness, T as DeviceType, V as ReadinessTimeoutError, W as scopeKey, _t as DisposerChain, a as asJsonObject, b as deviceOpsCapability, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, gt as DATAPLANE_SECRET_HEADER, h as createEventBusSliceSource, j as expandCapMethods, m as createDeviceProxy, p as isDeviceScopedCap, s as asString, t as sleep, u as parseJsonUnknown, vt as BaseAddon, x as viewerUiCapability, yt as normalizeAddonInitResult } from "./sleep-Dj1DG9Od.mjs";
 import { t as errMsg } from "./err-msg-IQTHeDzc.mjs";
 //#region src/generated/cap-input-defaults.ts
 /**

package/dist/capabilities/addon-pages-source.cap.d.ts

@@ -28,6 +28,16 @@ export declare const addonPagesSourceCapability: {
     readonly mode: "collection";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`) — this was reachable on the AppRouter by ANY
+         * authenticated session at the default `auth: 'protected'`. The only
+         * consumer, the `addon-pages-aggregator` builtin, reads it via
+         * `ctx.capabilities.getCollection('addon-pages-source')` — LOCAL-PROCESS
+         * only, never tRPC (per `ctx.capabilities` seeing only the local
+         * process). The public, enriched listing admin-ui actually consumes is
+         * the separate `addon-pages` cap, unaffected by this change.
+         */
         readonly listPages: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodReadonly<z.ZodArray<z.ZodObject<{
             id: z.ZodString;
             label: z.ZodString;

package/dist/capabilities/addon-widgets-source.cap.d.ts

@@ -122,6 +122,18 @@ export declare const addonWidgetsSourceCapability: {
     readonly mode: "collection";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`) — this was reachable on the AppRouter by ANY
+         * authenticated session at the default `auth: 'protected'`. The only
+         * consumer, the `addon-widgets-aggregator` builtin, reads it via
+         * `ctx.capabilities.getCollection('addon-widgets-source')` — LOCAL-PROCESS
+         * only, never tRPC. The public, enriched listing admin-ui actually
+         * consumes is the separate `addon-widgets` cap (`listWidgets` there is
+         * gated separately, and a `preAuth: true` widget is surfaced through the
+         * PUBLIC `auth.listLoginMethods` contribution channel instead) —
+         * neither is affected by this change.
+         */
         readonly listWidgets: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodReadonly<z.ZodArray<z.ZodObject<{
             tab: z.ZodString;
             subTab: z.ZodOptional<z.ZodString>;

package/dist/capabilities/admin-ui.cap.d.ts

@@ -6,6 +6,15 @@ export declare const adminUiCapability: {
     readonly mode: "singleton";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`) — both methods were reachable on the AppRouter
+         * by ANY authenticated session at the default `auth: 'protected'`, and
+         * `getStaticDir` leaks a hub filesystem path. The only caller is
+         * `main.ts`'s static-file bootstrap, via `capRegistry.getSingletonForNode`
+         * — never tRPC — so `auth: 'admin'` costs it nothing. The actual admin-ui
+         * SPA assets are served as plain static files, unaffected by this gate.
+         */
         readonly getStaticDir: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodObject<{
             staticDir: z.ZodString;
         }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;

package/dist/capabilities/cap-router-predicates.d.ts

@@ -10,7 +10,7 @@
  * makes the two paths provably agree. Each predicate accepts both Zod 4
  * (`_def.type`) and legacy Zod 3 (`_def.typeName` / `constructor.name`) shapes.
  */
-import type { CapabilityDefinition } from './capability-definition.js';
+import type { CapabilityDefinition, CapabilityMethodAuth } from './capability-definition.js';
 /** `z.void()` — input carries no data. */
 export declare function isVoidInput(schema: unknown): boolean;
 /** `z.object()` — supports `.loose()` for out-of-band `nodeId`/`addonId` keys. */
@@ -86,6 +86,43 @@ export declare function extractNestedAddonId(input: unknown): string | undefined
  * for non-object schemas.
  */
 export declare function objectInputDeclaresAddonId(schema: unknown): boolean;
+/**
+ * Effective auth for a cap method — the `internal: true` floor (Task 7.5c).
+ *
+ * `internal: true` on a cap def is a DECLARATION that its methods are for
+ * in-process (`ctx.api`) consumption only. Nothing enforced that:
+ * `resolveCapMount` never reads `internal` (an internal cap still gets a
+ * full tRPC router), and a method that omitted an explicit `auth` used to
+ * default — permanently, at `method()`-call time — to `'protected'`,
+ * reachable by any authenticated session regardless of `internal`. That
+ * silent default is how 45 procedures across 13 internal caps ended up
+ * exposed, including `ssoBridge.signBridgeToken`: it accepted
+ * caller-supplied claims (including `isAdmin`), was reachable by any
+ * authenticated session, and its token is redeemed at
+ * `/api/auth/sso/finish` to mint a session — a full privilege escalation.
+ * See `docs/decisions/adr-0240-an-internal-cap-floors-its-unannotated-methods-to-admin.md`
+ * (D240) for the record.
+ *
+ * The floor, exactly: an `internal` cap's method with NO explicit `auth`
+ * resolves to `'admin'` instead of `'protected'`. A method that DELIBERATELY
+ * declares an explicit `auth` — public, protected, or admin — keeps it
+ * unconditionally; the author already said what they meant, and an
+ * annotation that happens to agree with the floor is documentation, not
+ * redundancy. A non-`internal` cap's un-annotated method is unaffected
+ * (still `'protected'`). This is a FLOOR, not a hard `mount: 'skip'` — that
+ * would also override a deliberate `auth: 'public'`/`'protected'` choice,
+ * which is not the defect being closed.
+ *
+ * `method()` (`capability-definition.ts`) deliberately leaves `auth`
+ * UNSET when the caller omits it (rather than defaulting there) so the
+ * "was this explicit" bit survives to this single resolution point. Single
+ * source of truth shared by the runtime builder (`cap-router-builder.ts`)
+ * and the codegen (`generate-cap-routers.ts`, `gen-api-reference.ts`) — the
+ * two must never disagree, a documented failure mode in this repo.
+ */
+export declare function resolveMethodAuth(def: Pick<CapabilityDefinition, 'internal'>, method: {
+    readonly auth?: CapabilityMethodAuth;
+}): CapabilityMethodAuth;
 /** Auth level → base-procedure key. `superAdmin` collapses to `admin`. */
 export declare function procedureAuthKey(auth: string): 'public' | 'protected' | 'admin';
 /** kebab-case cap name → camelCase router-map key. */

package/dist/capabilities/capability-definition.d.ts

@@ -80,8 +80,21 @@ export interface CapabilityMethodSchema<TInput extends z.ZodType = z.ZodType, TO
     readonly output: TOutput;
     /** tRPC procedure kind. Default: 'query'. */
     readonly kind: TKind;
-    /** Auth level. Default: 'protected'. */
-    readonly auth: CapabilityMethodAuth;
+    /**
+     * Auth level. OPTIONAL and left unset by `method()` when the caller
+     * doesn't pass one — the DEFAULT is resolved later, per-cap, by
+     * {@link resolveMethodAuth} (`cap-router-predicates.ts`), never baked in
+     * here. That deferral is load-bearing: `resolveMethodAuth` floors an
+     * un-set `auth` to `'admin'` on an `internal: true` cap and to
+     * `'protected'` otherwise (Task 7.5c). Baking a `'protected'` default in
+     * at THIS layer would erase the "did the author actually decide this"
+     * bit before it ever reached that floor — which is exactly how 45
+     * procedures across 13 internal caps (including
+     * `ssoBridge.signBridgeToken`, a caller-suppliable-`isAdmin` privilege
+     * escalation) ended up reachable by any authenticated session. An
+     * EXPLICIT `auth` here — of any value — always wins over the floor.
+     */
+    readonly auth?: CapabilityMethodAuth;
     /** Per-method access flavour. When unset, codegen derives it from `kind` + name heuristic. */
     readonly access?: CapabilityMethodAccess;
     /** Moleculer action timeout override (ms). Overrides broker global requestTimeout for this action only. */

package/dist/capabilities/custom-model-registry.cap.d.ts

@@ -161,6 +161,15 @@ export declare const customModelRegistryCapability: {
     readonly mode: "collection";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`) — this was reachable on the AppRouter by ANY
+         * authenticated session at the default `auth: 'protected'`. The only
+         * consumer, the detection-pipeline's model resolution
+         * (`addon-pipeline/src/detection-pipeline/provider.ts`), calls
+         * `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
+         * never tRPC — so `auth: 'admin'` costs it nothing.
+         */
         readonly listModels: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodReadonly<z.ZodArray<z.ZodObject<{
             stepId: z.ZodString;
             entry: z.ZodObject<{

package/dist/capabilities/embedding-encoder.cap.d.ts

@@ -22,6 +22,13 @@ export declare const embeddingEncoderCapability: {
     readonly mode: "collection";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`) — every method below was reachable on the
+         * AppRouter by ANY authenticated session at the default
+         * `auth: 'protected'`. Consumers reach the encoder via `ctx.api` from
+         * `addon-post-analysis`, never tRPC.
+         */
         readonly encode: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             crop: z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>;
             width: z.ZodNumber;

package/dist/capabilities/index.d.ts

@@ -35,7 +35,7 @@ export { ArchiveEntrySchema, ArchiveManifestSchema, BackupDestinationInfoSchema,
 export { BrokerAddInputSchema, BrokerGetStateInputSchema, type BrokerInfo as UnifiedBrokerInfo, BrokerInfoSchema as UnifiedBrokerInfoSchema, type BrokerProviderInfo, BrokerProviderInfoSchema, BrokerPublishInputSchema, BrokerRegistryStatusSchema, type BrokerStatus as UnifiedBrokerStatus, BrokerStatusEnum, BrokerSubscribeInputSchema, BrokerSubscribeResultSchema, BrokerTestConnectionResultSchema, BrokerUnsubscribeInputSchema, brokerCapability, type IBrokerProvider, } from './broker.cap.js';
 export { cameraPipelineConfigCapability, type ICameraPipelineConfigProvider, } from './camera-pipeline-config.cap.js';
 export { cameraStreamsCapability, type ICameraStreamsProvider, type PickedCamStream, PickedCamStreamSchema, PickStreamPreferencesSchema, PickStreamRequirementsSchema, type StreamCodec, StreamCodecSchema, } from './camera-streams.cap.js';
-export { extractNestedAddonId, isArrayOutputSchema, isCollectionArrayMethod, isObjectInput, isVoidInput, kebabToCamel, looseSchema, objectInputDeclaresAddonId, procedureAuthKey, } from './cap-router-predicates.js';
+export { extractNestedAddonId, isArrayOutputSchema, isCollectionArrayMethod, isObjectInput, isVoidInput, kebabToCamel, looseSchema, objectInputDeclaresAddonId, procedureAuthKey, resolveMethodAuth, } from './cap-router-predicates.js';
 export type { CapabilityDefinition, CapabilityEventSchema, CapabilityMethodAuth, CapabilityMethodCaller, CapabilityMethodKind, CapabilityMethodOptions, CapabilityMethodSchema, CapabilityMountHint, CapabilityMountKind, CapabilityStatusItemArray, CapabilityStatusKind, CapabilityStatusSchema, CapCaller, DeviceConfigDerivedFormUi, DeviceConfigSpec, DeviceConfigUiSpec, DeviceConfigWidgetUi, DeviceSettingsContribution, InferDeviceProxyCap, InferEvents, InferName, InferNativeProvider, InferProvider, InferRuntimeState, ProviderKind, RuntimeStateDurability, UiContribution, UiContributionKind, UiContributionRemote, } from './capability-definition.js';
 export { DEFAULT_RUNTIME_STATE_DURABILITY, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, event, expandCapMethods, isDeviceConfigCap, method, resolveCapMount, } from './capability-definition.js';
 export { CORE_BLOCK_ADDON_PREFIX, CORE_BLOCKS_ADDON_ID, type CoreBlock, type CoreBlockCompileResult, CoreBlockCompileResultSchema, type CoreBlockInput, CoreBlockInputSchema, type CoreBlockPlacement, CoreBlockPlacementSchema, CoreBlockSchema, type CoreBlockStatus, CoreBlockStatusSchema, coreBlockAddonId, coreBlockIdFromAddonId, coreBlocksCapability, type ICoreBlocksProvider, } from './core-blocks.cap.js';

package/dist/capabilities/llm-runtime.cap.d.ts

@@ -248,6 +248,19 @@ export declare const llmRuntimeCapability: {
     readonly mode: "singleton";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `complete`, `status`, `listLocalModels` and `getDiskUsage` had NO
+         * `auth` override — `internal: true` did not gate the mount (see the
+         * 2026-08-26 note on `data-store-provider`), so they were reachable on
+         * the AppRouter by ANY authenticated session at the default
+         * `auth: 'protected'`, inconsistent with the rest of this cap (already
+         * `auth: 'admin'`) and with this file's own docblock: "the operator
+         * reaches this only through the `llm` cap's methods." The sole caller,
+         * `addon-ai`'s `runtime-client.ts`, reaches every method here via
+         * `ctx.api` + `nodePin` — never tRPC — so `auth: 'admin'` costs it
+         * nothing; the public `llm` cap (which end users and non-admin sessions
+         * legitimately call for chat/generation) is untouched.
+         */
         readonly complete: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             addonId: z.ZodOptional<z.ZodString>;
             profileId: z.ZodOptional<z.ZodString>;

package/dist/capabilities/oauth-integration.cap.d.ts

@@ -140,6 +140,15 @@ export declare const oauthIntegrationCapability: {
     readonly mode: "collection";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`) — `getDescriptor` was reachable on the AppRouter
+         * by ANY authenticated session at the default `auth: 'protected'`. The
+         * real caller is `/api/oauth2/authorize` and `/api/oauth2/integrations`
+         * (`oauth2-routes.ts`), which resolve the provider directly off the
+         * capability registry — never through tRPC. `auth: 'admin'` closes the
+         * tRPC surface without touching that path.
+         */
         readonly getDescriptor: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodObject<{
             integrationId: z.ZodString;
             displayName: z.ZodString;

package/dist/capabilities/sso-bridge.cap.d.ts

@@ -83,6 +83,20 @@ export declare const ssoBridgeCapability: {
     readonly mode: "singleton";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`) — `signBridgeToken` was reachable on the
+         * AppRouter by ANY authenticated session at the default
+         * `auth: 'protected'`. The claims (including `isAdmin`) are CALLER-
+         * SUPPLIED: an unprivileged session could have minted its own
+         * `isAdmin: true` bridge token and redeemed it at
+         * `/api/auth/sso/finish` to become admin — a full privilege escalation
+         * through the exact surface this cap exists to close (see the module
+         * docblock). Every real caller (`oauth-grants.ts`, `main.ts`
+         * registration, the OIDC/magic-link addons) reaches this through
+         * `ctx.api` / the in-process registry — never through tRPC — so
+         * `auth: 'admin'` costs those callers nothing.
+         */
         readonly signBridgeToken: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             claims: z.ZodObject<{
                 userId: z.ZodString;

package/dist/capabilities/storage-evictable.cap.d.ts

@@ -29,6 +29,13 @@ export declare const storageEvictableCapability: {
     readonly mode: "collection";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`) — this was reachable on the AppRouter by ANY
+         * authenticated session at the default `auth: 'protected'`. The only
+         * consumer is the orchestrator's `StoragePressureManager`, which calls
+         * `ctx.api` — never tRPC — so `auth: 'admin'` costs it nothing.
+         */
         /** Bytes this provider holds on the given location — drives proportional fan-out. */
         readonly getEvictableUsage: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             locationId: z.ZodString;

package/dist/capabilities/storage-provider.cap.d.ts

@@ -112,6 +112,21 @@ export declare const storageProviderCapability: {
     readonly mode: "collection";
     readonly internal: true;
     readonly methods: {
+        /**
+         * Every method below except `testLocation` had NO `auth` override —
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`), so this was reachable on the AppRouter by ANY
+         * authenticated session at the default `auth: 'protected'`: arbitrary
+         * read/write/delete/list against any storage location the operator has
+         * configured, keyed only by a caller-supplied `location` + `relativePath`
+         * — the same "public consumers never see this cap" claim that was false
+         * for `data-store-provider`, here gating raw file I/O instead of raw
+         * settings rows. The only legitimate caller,
+         * `addon-registry.service.ts`'s `activeStorageProvider`, calls the
+         * provider object directly (in-process) — never tRPC — so `auth: 'admin'`
+         * on every method costs it nothing. Public consumers already go through
+         * the separate `storage` singleton cap.
+         */
         /** Self-description for the "Add location" wizard. */
         readonly getProviderInfo: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodDiscriminatedUnion<[z.ZodObject<{
             providerId: z.ZodString;

package/dist/capabilities/user-passkeys.cap.d.ts

@@ -81,6 +81,24 @@ export declare const userPasskeysCapability: {
             success: z.ZodLiteral<true>;
             credentialId: z.ZodString;
         }, z.core.$strip>, "mutation">;
+        /**
+         * The four methods below had NO `auth` override — `internal: true` did
+         * not gate the mount (see the 2026-08-26 note on `data-store-provider`),
+         * so they were reachable on the AppRouter at the default
+         * `auth: 'protected'` (any authenticated session), inconsistent with
+         * every other method on this cap (all already `auth: 'admin'`).
+         *
+         * ⚠ Checked before gating: these are also the PRE-AUTH login-ceremony
+         * methods, so admin-gating them here must not break login for an
+         * unauthenticated principal. It doesn't — the real login path is the
+         * PUBLIC `auth.beginAuthentication` / `auth.finishAuthentication` /
+         * `auth.beginDiscoverableAuthentication` / `auth.finishDiscoverableAuthentication`
+         * procedures in `server/backend/src/api/core/auth.router.ts`, which call
+         * `provider.beginAuthentication(...)` etc. directly against the
+         * capability-registry-resolved provider — never through this cap's own
+         * tRPC route. `auth: 'admin'` here only closes a redundant, unused
+         * second entry point onto the same ceremony.
+         */
         readonly beginAuthentication: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             userId: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>, z.ZodObject<{

package/dist/capabilities/vector-store.cap.d.ts

@@ -164,6 +164,14 @@ export declare const VectorStatsResultSchema: z.ZodObject<{
     bytes: z.ZodOptional<z.ZodNumber>;
     exact: z.ZodBoolean;
 }, z.core.$strip>;
+/**
+ * `internal: true` did not gate the mount (see the 2026-08-26 note on
+ * `data-store-provider`) — every method below was reachable on the AppRouter
+ * by ANY authenticated session at the default `auth: 'protected'`. The only
+ * consumers (`addon-post-analysis`'s embedding stores) reach this cap via
+ * `ctx.api` — UDS/Moleculer, never tRPC — so `auth: 'admin'` on every method
+ * costs them nothing. No client (viewer or admin-ui) calls `vectorStore.*`.
+ */
 export declare const vectorStoreCapability: {
     readonly name: "vector-store";
     readonly scope: "system";

package/dist/capabilities/viewer-ui.cap.d.ts

@@ -13,6 +13,21 @@ export declare const viewerUiCapability: {
     readonly mode: "singleton";
     readonly internal: true;
     readonly methods: {
+        /**
+         * `internal: true` did not gate the mount (see the 2026-08-26 note on
+         * `data-store-provider`) — both methods were reachable on the AppRouter
+         * by ANY authenticated session at the default `auth: 'protected'`, and
+         * `getStaticDir` leaks a hub filesystem path.
+         *
+         * ⚠ Checked before gating: the VIEWER app IS used by a non-admin user
+         * (`roberta`), but it never calls `viewerUi.*` over tRPC. The static SPA
+         * it loads is served by the plain `GET /viewer/*` Fastify route in
+         * `main.ts`, which reads `staticDir`/`indexPath` from a module-level
+         * cache populated ONCE at boot via `capRegistry.getSingletonForNode`
+         * (in-process, not tRPC) — the cap's tRPC procedure is never on that
+         * request path. `auth: 'admin'` here does not block a single viewer
+         * user from loading the app.
+         */
         readonly getStaticDir: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodObject<{
             staticDir: z.ZodString;
         }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;