@camstack/types 1.2.331 → 1.2.333

package/dist/interfaces/addon-routes.d.ts

@@ -39,11 +39,18 @@ export interface AddonHttpReply {
 /**
  * A single HTTP route registered by an addon.
  */
+/**
+ * Per-client-IP limiting the HUB applies before a route's handler runs.
+ * `'auth'` — a public sign-in leg (an IdP start or callback): 30 per minute
+ * per client address. The address is the real client behind a trusted proxy.
+ */
+export type RouteRateLimit = 'auth';
 export interface IAddonHttpRoute {
     readonly method: 'GET' | 'POST' | 'PUT' | 'DELETE';
     readonly path: string;
     readonly access: RouteAccess;
     readonly description?: string;
+    readonly rateLimit?: RouteRateLimit;
     readonly handler: (request: AddonHttpRequest, reply: AddonHttpReply) => Promise<void>;
 }
 /**

package/dist/interfaces/addon.d.ts

@@ -475,6 +475,14 @@ export interface AddonContext<TConfig = Record<string, unknown>> {
      * getDeviceSettings` on `ICamstackAddon`. There is no defaults
      * injection or cross-level merge at this layer.
      *
+     * KEYCHAIN (D798): the view a `BaseAddon` reaches as `this.ctx.settings`
+     * answers keychain VALUES on every read — `readAddonStore`,
+     * `readAddonStoreResult`, `readAddonStoreKeyResult`, `readDeviceStore`,
+     * `readDeviceStoreBatch` — never `{ $secret }` markers. A value the keychain
+     * cannot serve right now stays a marker ("stored, unavailable"), never `''`.
+     * Writing a resolved read back is a no-op for every unchanged secret.
+     * The marker-bearing blob is private to `BaseAddon`.
+     *
      * Cleanup note: the earlier `getGlobal / getDevice / updateGlobal /
      * updateDevice` trio (with a polymorphic `getGlobal({ section })`
      * overload) was removed after every caller migrated. The only

package/dist/interfaces/auth.d.ts

@@ -6,8 +6,12 @@ export interface UserPermissions {
     allowedDevices: Record<string, string[] | '*'>;
 }
 export interface TokenPayload {
-    type?: 'api_key' | 'service';
-    keyId?: string;
+    /**
+     * The server-side login session this token belongs to. Every session token
+     * minted since sessions exist carries one; the hub refuses the token once
+     * the session is revoked or expired. A token without it predates sessions.
+     */
+    sid?: string;
     userId?: string;
     username?: string;
     /**
@@ -16,7 +20,6 @@ export interface TokenPayload {
      * in v2.
      */
     isAdmin: boolean;
-    agentId?: string;
     allowedProviders: string[] | '*';
     allowedDevices: Record<string, string[] | '*'>;
     /**

package/dist/schemas/auth-records.d.ts

@@ -22,8 +22,7 @@ import { DeviceType } from '../device/device-type.js';
  * `super_admin` — collapsed onto the single boolean because every
  * non-admin caller is governed by the same scope-check rules; the
  * distinction was only ever used to route role-specific procedures
- * which we no longer have. Agents are admin sessions issued via
- * `createServiceToken`; CLI / webhook integrations are `cst_*` tokens
+ * which we no longer have. CLI / webhook integrations are `cst_*` tokens
  * with `isAdmin: false` + an explicit scope list.
  */
 /** Per-method access flavour. Materialised on every cap method via codegen. */