@camstack/addon-auth 1.2.114 → 1.2.115

package/dist/{dist-BXU_Vf5d.js → dist-B31pAPUB.js}

@@ -12426,7 +12426,23 @@ var PickStreamRequirementsSchema = object({
 	* This is what lets one picker serve both the bypass and the full source
 	* choice, instead of a consumer scoring privately when the bypass misses.
 	*/
-	allowTranscode: boolean().optional()
+	allowTranscode: boolean().optional(),
+	/**
+	* Consider ONLY streams the broker has bound to a profile slot.
+	*
+	* A consumer that dials the broker — which is every exporter, since none
+	* of them may open the camera's own URL — can do nothing with a source
+	* that has no slot: there is no restream to dial. Without this the picker
+	* can name such a stream, and each consumer discovers the dead end for
+	* itself: Alexa's `profileForCamStream` returns `null` and it quietly
+	* falls back, and HomeKit would have had to grow the same function again.
+	*
+	* Default `false`, and deliberately so: the BROKER itself picks through
+	* here when it decides which source to BIND to a slot
+	* (`computeInitialAssignment`), and it must see the unbound ones or it
+	* could never bind them.
+	*/
+	requireProfileBound: boolean().optional()
 }).readonly();
 var PickStreamPreferencesSchema = object({
 	/**
@@ -12467,7 +12483,43 @@ var PickedCamStreamSchema = object({
 	*/
 	transcodes: boolean(),
 	/** One-line explanation of why this stream won — for logs / debug UI. */
-	reason: string()
+	reason: string(),
+	/**
+	* The broker profile slot this source is bound to, when it is bound.
+	*
+	* Answered HERE because every consumer needs it and none of them can get it
+	* from the `camStreamId` alone. Alexa wrote `profileForCamStream` for it —
+	* a second cap read plus a `null` branch — and HomeKit was about to write
+	* the same function a second time.
+	*
+	* Absent when the source has no slot, which a caller passing
+	* `requireProfileBound` can never see.
+	*/
+	profile: CamProfileSchema.optional(),
+	/** The broker id of that slot, for logs that must name what was dialled. */
+	brokerId: string().optional(),
+	/**
+	* The broker restream URL to dial for this stream.
+	*
+	* An exporter must never open the camera's own URL — the broker is the one
+	* that dials the camera, and every consumer goes through its restream. So
+	* the picker answers with the thing a consumer may actually use, instead of
+	* naming a source and leaving each caller to look the URL up.
+	*/
+	url: string().optional(),
+	/**
+	* Frames per second this stream really delivers, and where the number came
+	* from.
+	*
+	* It is here because getting it wrong is expensive and silent: a HomeKit
+	* accessory advertised 720p at 24 fps while the slot serving it ran at 9,
+	* and the controller rendered nothing at all. The source is carried with the
+	* value for the same reason the bitrate evidence is: `published` is what the
+	* publisher declares and `measured` is what the broker observed, and they
+	* are not interchangeable.
+	*/
+	fps: number().positive().optional(),
+	fpsSource: _enum(["published", "measured"]).optional()
 });
 DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), array(CameraStreamSchema).readonly()), method(object({ deviceId: number().int().nonnegative() }), array(ProfileSlotSchema).readonly()), method(object({
 	deviceId: number().int().nonnegative(),

package/dist/{dist-tq4aH2OI.mjs → dist-CDgUEnCG.mjs}

@@ -12426,7 +12426,23 @@ var PickStreamRequirementsSchema = object({
 	* This is what lets one picker serve both the bypass and the full source
 	* choice, instead of a consumer scoring privately when the bypass misses.
 	*/
-	allowTranscode: boolean().optional()
+	allowTranscode: boolean().optional(),
+	/**
+	* Consider ONLY streams the broker has bound to a profile slot.
+	*
+	* A consumer that dials the broker — which is every exporter, since none
+	* of them may open the camera's own URL — can do nothing with a source
+	* that has no slot: there is no restream to dial. Without this the picker
+	* can name such a stream, and each consumer discovers the dead end for
+	* itself: Alexa's `profileForCamStream` returns `null` and it quietly
+	* falls back, and HomeKit would have had to grow the same function again.
+	*
+	* Default `false`, and deliberately so: the BROKER itself picks through
+	* here when it decides which source to BIND to a slot
+	* (`computeInitialAssignment`), and it must see the unbound ones or it
+	* could never bind them.
+	*/
+	requireProfileBound: boolean().optional()
 }).readonly();
 var PickStreamPreferencesSchema = object({
 	/**
@@ -12467,7 +12483,43 @@ var PickedCamStreamSchema = object({
 	*/
 	transcodes: boolean(),
 	/** One-line explanation of why this stream won — for logs / debug UI. */
-	reason: string()
+	reason: string(),
+	/**
+	* The broker profile slot this source is bound to, when it is bound.
+	*
+	* Answered HERE because every consumer needs it and none of them can get it
+	* from the `camStreamId` alone. Alexa wrote `profileForCamStream` for it —
+	* a second cap read plus a `null` branch — and HomeKit was about to write
+	* the same function a second time.
+	*
+	* Absent when the source has no slot, which a caller passing
+	* `requireProfileBound` can never see.
+	*/
+	profile: CamProfileSchema.optional(),
+	/** The broker id of that slot, for logs that must name what was dialled. */
+	brokerId: string().optional(),
+	/**
+	* The broker restream URL to dial for this stream.
+	*
+	* An exporter must never open the camera's own URL — the broker is the one
+	* that dials the camera, and every consumer goes through its restream. So
+	* the picker answers with the thing a consumer may actually use, instead of
+	* naming a source and leaving each caller to look the URL up.
+	*/
+	url: string().optional(),
+	/**
+	* Frames per second this stream really delivers, and where the number came
+	* from.
+	*
+	* It is here because getting it wrong is expensive and silent: a HomeKit
+	* accessory advertised 720p at 24 fps while the slot serving it ran at 9,
+	* and the controller rendered nothing at all. The source is carried with the
+	* value for the same reason the bitrate evidence is: `published` is what the
+	* publisher declares and `measured` is what the broker observed, and they
+	* are not interchangeable.
+	*/
+	fps: number().positive().optional(),
+	fpsSource: _enum(["published", "measured"]).optional()
 });
 DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), array(CameraStreamSchema).readonly()), method(object({ deviceId: number().int().nonnegative() }), array(ProfileSlotSchema).readonly()), method(object({
 	deviceId: number().int().nonnegative(),

package/dist/magic-link/auth-magic-link.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-BXU_Vf5d.js");
+const require_dist = require("../dist-B31pAPUB.js");
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.

package/dist/magic-link/auth-magic-link.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-tq4aH2OI.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-CDgUEnCG.mjs";
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.

package/dist/oidc/auth-oidc.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-BXU_Vf5d.js");
+const require_dist = require("../dist-B31pAPUB.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-tq4aH2OI.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-CDgUEnCG.mjs";
 import * as crypto$1 from "node:crypto";
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder();

package/dist/webauthn/{_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-B0p6CRdT.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-D-fGZare.mjs}

@@ -3,7 +3,7 @@ import "./dist-CYZr2fwk.mjs";
 var e = {
 	"@camstack/sdk": {
 		name: "@camstack/sdk",
-		version: "1.2.110",
+		version: "1.2.111",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.204",
+		version: "1.2.205",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.169",
+		version: "1.2.170",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",

package/dist/webauthn/auth-webauthn.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-BXU_Vf5d.js");
+const require_dist = require("../dist-B31pAPUB.js");
 let stream = require("stream");
 stream = require_chunk.__toESM(stream, 1);
 let http = require("http");

package/dist/webauthn/auth-webauthn.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, d as number, f as object, l as array, n as addonWidgetsSourceCapability, o as userPasskeysCapability, p as string, u as boolean } from "../dist-tq4aH2OI.mjs";
+import { a as loginMethodCapability, c as BaseAddon, d as number, f as object, l as array, n as addonWidgetsSourceCapability, o as userPasskeysCapability, p as string, u as boolean } from "../dist-CDgUEnCG.mjs";
 import { createRequire } from "node:module";
 import Stream from "stream";
 import http from "http";

package/dist/webauthn/{hostInit-BUDgc0Hc.mjs → hostInit-Dxoo47_A.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.204",
+				version: "1.2.205",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -45,7 +45,7 @@ async function r() {
 				}
 			},
 			"@camstack/sdk": {
-				version: "1.2.110",
+				version: "1.2.111",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -81,7 +81,7 @@ async function r() {
 				}
 			},
 			"@camstack/ui-library": {
-				version: "1.2.169",
+				version: "1.2.170",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/webauthn/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-B0p6CRdT.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-D-fGZare.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-auth",
-  "version": "1.2.114",
+  "version": "1.2.115",
   "description": "Authentication bundle — magic-link, OIDC, and WebAuthn/passkey. Multi-entry npm package shipping 3 addons under a single bundle; each addon keeps its own id, capabilities, and runner.",
   "keywords": [
     "camstack",