@camstack/addon-auth 1.2.83 → 1.2.85

package/dist/{dist-C0vhhVhZ.mjs → dist-D9EnjAse.mjs}

@@ -8065,13 +8065,28 @@ var RecordingBandSchema = object({
 	end: string().regex(HHMM),
 	mode: RecordingBandModeSchema,
 	triggers: RecordingBandTriggersSchema.optional(),
+	/**
+	* RETIRED (D381). A band no longer carries a pre-buffer of its own.
+	*
+	* It was the retroactive KEEP bound — which already-written segments survive
+	* a trigger — and it had to be at least as wide as the widest pre-roll the
+	* broker could serve, or the gate would delete the seconds the ring had just
+	* handed the writer. That "at least as wide as" is the tell: it was a second
+	* expression of the broker's retention, in different units, in a different
+	* addon, with an invariant the operator had to maintain by hand. The keep
+	* bound is now derived from the one prebuffer ceiling and there is nothing
+	* left to configure here.
+	*
+	* The key survives in the SHAPE so a config written before that record still
+	* parses and can be migrated deliberately — `RecordingBandSchema` is not
+	* strict, so simply deleting it would strip an operator's value in silence on
+	* the next save (the failure D380 came one commit from shipping). Nothing
+	* reads it: {@link stripRetiredBandPreBufferSec} removes it on load.
+	*/
 	preBufferSec: number().min(0).optional(),
 	postBufferSec: number().min(0).optional()
 });
-({
-	preBufferSec: 15,
-	postBufferSec: 30
-}).postBufferSec * 1e3;
+({ postBufferSec: 30 }).postBufferSec * 1e3;
 /**
 * Per-device retention overrides. Every field is optional; an unset or `0`
 * value inherits the node-wide recorder default. Only footage-lifetime limits
@@ -10699,12 +10714,30 @@ var BackupDestinationInfoSchema = object({
 	lastSuccessAt: number().optional(),
 	/** Newest-archive size from `manifests.json`, or undefined. */
 	lastSuccessSizeBytes: number().optional(),
-	/** Per-destination cron expression. Empty = manual-only (no schedule). */
+	/**
+	* Cron cadence(s) of the ENABLED schedules that fan out to this
+	* destination, comma-joined. Absent when no enabled schedule targets it
+	* — a destination nothing is scheduled to write to must not advertise a
+	* cadence (D384). This is never the `backup_destination_policies.cron`
+	* column: that per-location cron has scheduled nothing since 2026-07-28
+	* and reading it made a destination with a DISABLED schedule claim a
+	* nightly run.
+	*/
 	cron: string().optional(),
-	/** ms-epoch of next computed firing for this destination's cron, if any. */
+	/** ms-epoch of the next firing across those schedules (earliest), if any. */
 	nextRunAt: number().optional(),
-	/** ms-epoch of last successful scheduled run (mirrors policy.lastRunAt). */
-	lastRunAt: number().optional()
+	/**
+	* ms-epoch of the last time a run ATTEMPTED to write here — success or
+	* failure. Never a success stamp: pair it with `lastSuccessAt` (the
+	* newest archive that actually landed) and `lastError`.
+	*/
+	lastAttemptAt: number().optional(),
+	/**
+	* Why the last attempt failed, verbatim. Absent when the last attempt
+	* landed the archive. A destination that has never been written to has
+	* neither this nor `lastAttemptAt`.
+	*/
+	lastError: string().optional()
 });
 /**
 * Per-archive entry returned by `backup.listArchives({ destinationId })`.
@@ -10867,8 +10900,16 @@ var BackupScheduleSchema = object({
 	retentionCount: number().int().min(1).max(1e3),
 	/** Optional subset of source locations to include; omitted = all. */
 	dataSources: array(string()).readonly().optional(),
-	/** ms-epoch of last successful run. */
-	lastRunAt: number().optional(),
+	/**
+	* ms-epoch of the last tick that FIRED this schedule. Stamped before the
+	* archive runs (it is the dedupe anchor), so it says "attempted", never
+	* "succeeded" — a run refused by every destination stamps it too.
+	*/
+	lastAttemptAt: number().optional(),
+	/** ms-epoch of the last run of this schedule that landed at ≥1 destination. */
+	lastSuccessAt: number().optional(),
+	/** Why the last fired run failed, verbatim. Absent when it succeeded. */
+	lastError: string().optional(),
 	/** ms-epoch of next computed firing (read-only, filled on list). */
 	nextRunAt: number().optional()
 });
@@ -10917,14 +10958,7 @@ method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }
 	locationId: string(),
 	enabled: boolean(),
 	retentionCount: number().int().min(1).max(1e3),
-	label: string().optional(),
-	/**
-	* Per-destination cron expression. Empty string clears the
-	* schedule (manual-only). Validated server-side via croner;
-	* malformed expressions reject the upsert with an actionable
-	* message.
-	*/
-	cron: string().optional()
+	label: string().optional()
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"

package/dist/{dist-DMVRpgKV.js → dist-Ud9rgSkS.js}

@@ -8065,13 +8065,28 @@ var RecordingBandSchema = object({
 	end: string().regex(HHMM),
 	mode: RecordingBandModeSchema,
 	triggers: RecordingBandTriggersSchema.optional(),
+	/**
+	* RETIRED (D381). A band no longer carries a pre-buffer of its own.
+	*
+	* It was the retroactive KEEP bound — which already-written segments survive
+	* a trigger — and it had to be at least as wide as the widest pre-roll the
+	* broker could serve, or the gate would delete the seconds the ring had just
+	* handed the writer. That "at least as wide as" is the tell: it was a second
+	* expression of the broker's retention, in different units, in a different
+	* addon, with an invariant the operator had to maintain by hand. The keep
+	* bound is now derived from the one prebuffer ceiling and there is nothing
+	* left to configure here.
+	*
+	* The key survives in the SHAPE so a config written before that record still
+	* parses and can be migrated deliberately — `RecordingBandSchema` is not
+	* strict, so simply deleting it would strip an operator's value in silence on
+	* the next save (the failure D380 came one commit from shipping). Nothing
+	* reads it: {@link stripRetiredBandPreBufferSec} removes it on load.
+	*/
 	preBufferSec: number().min(0).optional(),
 	postBufferSec: number().min(0).optional()
 });
-({
-	preBufferSec: 15,
-	postBufferSec: 30
-}).postBufferSec * 1e3;
+({ postBufferSec: 30 }).postBufferSec * 1e3;
 /**
 * Per-device retention overrides. Every field is optional; an unset or `0`
 * value inherits the node-wide recorder default. Only footage-lifetime limits
@@ -10699,12 +10714,30 @@ var BackupDestinationInfoSchema = object({
 	lastSuccessAt: number().optional(),
 	/** Newest-archive size from `manifests.json`, or undefined. */
 	lastSuccessSizeBytes: number().optional(),
-	/** Per-destination cron expression. Empty = manual-only (no schedule). */
+	/**
+	* Cron cadence(s) of the ENABLED schedules that fan out to this
+	* destination, comma-joined. Absent when no enabled schedule targets it
+	* — a destination nothing is scheduled to write to must not advertise a
+	* cadence (D384). This is never the `backup_destination_policies.cron`
+	* column: that per-location cron has scheduled nothing since 2026-07-28
+	* and reading it made a destination with a DISABLED schedule claim a
+	* nightly run.
+	*/
 	cron: string().optional(),
-	/** ms-epoch of next computed firing for this destination's cron, if any. */
+	/** ms-epoch of the next firing across those schedules (earliest), if any. */
 	nextRunAt: number().optional(),
-	/** ms-epoch of last successful scheduled run (mirrors policy.lastRunAt). */
-	lastRunAt: number().optional()
+	/**
+	* ms-epoch of the last time a run ATTEMPTED to write here — success or
+	* failure. Never a success stamp: pair it with `lastSuccessAt` (the
+	* newest archive that actually landed) and `lastError`.
+	*/
+	lastAttemptAt: number().optional(),
+	/**
+	* Why the last attempt failed, verbatim. Absent when the last attempt
+	* landed the archive. A destination that has never been written to has
+	* neither this nor `lastAttemptAt`.
+	*/
+	lastError: string().optional()
 });
 /**
 * Per-archive entry returned by `backup.listArchives({ destinationId })`.
@@ -10867,8 +10900,16 @@ var BackupScheduleSchema = object({
 	retentionCount: number().int().min(1).max(1e3),
 	/** Optional subset of source locations to include; omitted = all. */
 	dataSources: array(string()).readonly().optional(),
-	/** ms-epoch of last successful run. */
-	lastRunAt: number().optional(),
+	/**
+	* ms-epoch of the last tick that FIRED this schedule. Stamped before the
+	* archive runs (it is the dedupe anchor), so it says "attempted", never
+	* "succeeded" — a run refused by every destination stamps it too.
+	*/
+	lastAttemptAt: number().optional(),
+	/** ms-epoch of the last run of this schedule that landed at ≥1 destination. */
+	lastSuccessAt: number().optional(),
+	/** Why the last fired run failed, verbatim. Absent when it succeeded. */
+	lastError: string().optional(),
 	/** ms-epoch of next computed firing (read-only, filled on list). */
 	nextRunAt: number().optional()
 });
@@ -10917,14 +10958,7 @@ method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }
 	locationId: string(),
 	enabled: boolean(),
 	retentionCount: number().int().min(1).max(1e3),
-	label: string().optional(),
-	/**
-	* Per-destination cron expression. Empty string clears the
-	* schedule (manual-only). Validated server-side via croner;
-	* malformed expressions reject the upsert with an actionable
-	* message.
-	*/
-	cron: string().optional()
+	label: string().optional()
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"

package/dist/magic-link/auth-magic-link.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-DMVRpgKV.js");
+const require_dist = require("../dist-Ud9rgSkS.js");
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.

package/dist/magic-link/auth-magic-link.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-C0vhhVhZ.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-D9EnjAse.mjs";
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.

package/dist/oidc/auth-oidc.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-DMVRpgKV.js");
+const require_dist = require("../dist-Ud9rgSkS.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-C0vhhVhZ.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-D9EnjAse.mjs";
 import * as crypto$1 from "node:crypto";
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder();

package/dist/webauthn/{_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-BNNjXTd1.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-CIf4k9xj.mjs}

@@ -3,7 +3,7 @@ import "./dist-CYZr2fwk.mjs";
 var e = {
 	"@camstack/sdk": {
 		name: "@camstack/sdk",
-		version: "1.2.79",
+		version: "1.2.81",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.159",
+		version: "1.2.161",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.127",
+		version: "1.2.129",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",

package/dist/webauthn/auth-webauthn.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-DMVRpgKV.js");
+const require_dist = require("../dist-Ud9rgSkS.js");
 let stream = require("stream");
 stream = require_chunk.__toESM(stream, 1);
 let http = require("http");

package/dist/webauthn/auth-webauthn.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, d as number, f as object, l as array, n as addonWidgetsSourceCapability, o as userPasskeysCapability, p as string, u as boolean } from "../dist-C0vhhVhZ.mjs";
+import { a as loginMethodCapability, c as BaseAddon, d as number, f as object, l as array, n as addonWidgetsSourceCapability, o as userPasskeysCapability, p as string, u as boolean } from "../dist-D9EnjAse.mjs";
 import { createRequire } from "node:module";
 import Stream from "stream";
 import http from "http";

package/dist/webauthn/{hostInit-D6--ELG7.mjs → hostInit-DaIsdolf.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.159",
+				version: "1.2.161",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -45,7 +45,7 @@ async function r() {
 				}
 			},
 			"@camstack/sdk": {
-				version: "1.2.79",
+				version: "1.2.81",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -81,7 +81,7 @@ async function r() {
 				}
 			},
 			"@camstack/ui-library": {
-				version: "1.2.127",
+				version: "1.2.129",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/webauthn/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-BNNjXTd1.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-CIf4k9xj.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-auth",
-  "version": "1.2.83",
+  "version": "1.2.85",
   "description": "Authentication bundle — magic-link, OIDC, and WebAuthn/passkey. Multi-entry npm package shipping 3 addons under a single bundle; each addon keeps its own id, capabilities, and runner.",
   "keywords": [
     "camstack",