@camstack/addon-auth 1.2.89 → 1.2.91

package/dist/{dist-BxpblTri.mjs → dist-BfqWHC_q.mjs}

@@ -18551,11 +18551,30 @@ var SensorEventSchema = object({
 	value: record(string(), unknown()).nullable(),
 	timestamp: number()
 });
+/**
+* One stored sighting on a track's trajectory.
+*
+* The array these live in is returned in TIME order (D399) — it is APPENDED in
+* arrival order, and the two detector passes interleave, so a consumer must not
+* assume the two are the same on a row written by an older build.
+*/
 var TrackPositionSchema = object({
 	x: number(),
 	y: number(),
 	timestamp: number(),
-	bbox: BoundingBoxSchema
+	bbox: BoundingBoxSchema,
+	/**
+	* Which detector pass measured this box (D399): `frame` is the full-frame
+	* pass on the analysis raster, `recovery` is the native-resolution
+	* small-subject second pass (D377/D378). Both write into one array, and until
+	* this field existed the only way to tell them apart was that full-frame boxes
+	* are exact multiples of 1.2 while recovery boxes are full-precision floats.
+	* Absent on rows written before D399.
+	*/
+	source: _enum(["frame", "recovery"]).optional(),
+	/** Detection score of this box, so a position can be weighed and not only
+	*  plotted. Absent on rows written before D399. */
+	score: number().optional()
 });
 var TrackSnapshotSchema = object({
 	timestamp: number(),
@@ -18955,14 +18974,25 @@ var TrackSchema = object({
 	*/
 	hasRider: boolean().optional(),
 	/**
-	* WHY this track ended without a NATIVE best-shot tile
-	* ([D276](../decisions/adr-0276-a-stand-in-tile-is-provisional-and-a-close-says-why.md)) —
+	* WHY this track ended without a NATIVE best-shot FRAME
+	* ([D276](../decisions/adr-0276-a-stand-in-tile-is-provisional-and-a-close-says-why.md),
+	* widened by [D400](../decisions/adr-0400-the-picture-is-judged-on-what-is-delivered.md)) —
 	* a composed token line (`no-key-frame capture=keyframe:native-missx4`,
-	* `derive-returned-null tile=standin`, …) written at close and CLEARED by
-	* the late-keyFrame upgrade when a native tile lands after all. The
-	* operator-facing answer to "perché manca l'immagine?" on a track whose
+	* `derive-returned-null tile=standin`,
+	* `native-tile tile=native no-key-frame-at-close`, …) written at close and
+	* CLEARED by the late-keyFrame upgrade when a native tile lands after all.
+	* The operator-facing answer to "perché manca l'immagine?" on a track whose
 	* tile is a face/plate stand-in, a raster crop, or an icon.
 	*
+	* **`no-key-frame-at-close` (D400).** The line used to be written ONLY when
+	* the TILE ranked below native, so a track whose thumbnail landed natively
+	* while its key frame missed carried no reason at all — three of the four
+	* `MISSING_KEYFRAME` tracks in the 2026-09-07 operator audit were exactly
+	* that shape, and their "niente ultimo" had no cause anywhere on the row.
+	* The key frame is the head of a cascade (`keyFrame ⇒ keyFrameSmall ⇒ the
+	* lastFrame copy source`), so its absence is now on this line whatever the
+	* tile ended up being.
+	*
 	* **Absent ≠ "missed silently"**: a row written before the column, a hub
 	* that predates the field, and every track whose tile landed native all
 	* omit it. Render nothing when absent.
@@ -27305,8 +27335,27 @@ var PrivacyMaskRegionSchema = object({
 });
 object({
 	enabled: boolean(),
-	/** Active zones (normalized 0..1). Length ≤ maxRegions. */
-	regions: array(PrivacyMaskRegionSchema),
+	/**
+	* Active zones (normalized 0..1). Length ≤ maxRegions.
+	*
+	* `null` means "no answer" — the provider has never reached this camera
+	* (a cold `runtimeState` slice, a battery camera asleep) or the read
+	* failed. A consumer must render it as UNKNOWN and never as "this camera
+	* has no zones": those two look identical to an operator right up to the
+	* moment one of them is acted on, and acting on them differs completely.
+	* The switch group turned an unanswered read into *"nothing is set up for
+	* it to act on"* — an instruction to go and draw a zone that already
+	* exists — and this editor seeded an EMPTY canvas from it, one Save away
+	* from deleting the mask it could not read.
+	*
+	* Empty-and-answered is `[]` and stays a real answer: this camera genuinely
+	* has no zones. The distinction is the same one {@link
+	* PrivacyMaskStatusSchema.shape.audioEnabled} already draws for the
+	* microphone, on the very same payload — both planes come from ONE refresh,
+	* so it was never coherent for one of them to be able to say "unknown"
+	* while the other could not.
+	*/
+	regions: array(PrivacyMaskRegionSchema).nullable(),
 	/**
 	* Is the camera capturing sound right now? Read from the camera, never from
 	* a server-side mirror.

package/dist/{dist-CKMxgF_I.js → dist-C_c_p-kP.js}

@@ -18551,11 +18551,30 @@ var SensorEventSchema = object({
 	value: record(string(), unknown()).nullable(),
 	timestamp: number()
 });
+/**
+* One stored sighting on a track's trajectory.
+*
+* The array these live in is returned in TIME order (D399) — it is APPENDED in
+* arrival order, and the two detector passes interleave, so a consumer must not
+* assume the two are the same on a row written by an older build.
+*/
 var TrackPositionSchema = object({
 	x: number(),
 	y: number(),
 	timestamp: number(),
-	bbox: BoundingBoxSchema
+	bbox: BoundingBoxSchema,
+	/**
+	* Which detector pass measured this box (D399): `frame` is the full-frame
+	* pass on the analysis raster, `recovery` is the native-resolution
+	* small-subject second pass (D377/D378). Both write into one array, and until
+	* this field existed the only way to tell them apart was that full-frame boxes
+	* are exact multiples of 1.2 while recovery boxes are full-precision floats.
+	* Absent on rows written before D399.
+	*/
+	source: _enum(["frame", "recovery"]).optional(),
+	/** Detection score of this box, so a position can be weighed and not only
+	*  plotted. Absent on rows written before D399. */
+	score: number().optional()
 });
 var TrackSnapshotSchema = object({
 	timestamp: number(),
@@ -18955,14 +18974,25 @@ var TrackSchema = object({
 	*/
 	hasRider: boolean().optional(),
 	/**
-	* WHY this track ended without a NATIVE best-shot tile
-	* ([D276](../decisions/adr-0276-a-stand-in-tile-is-provisional-and-a-close-says-why.md)) —
+	* WHY this track ended without a NATIVE best-shot FRAME
+	* ([D276](../decisions/adr-0276-a-stand-in-tile-is-provisional-and-a-close-says-why.md),
+	* widened by [D400](../decisions/adr-0400-the-picture-is-judged-on-what-is-delivered.md)) —
 	* a composed token line (`no-key-frame capture=keyframe:native-missx4`,
-	* `derive-returned-null tile=standin`, …) written at close and CLEARED by
-	* the late-keyFrame upgrade when a native tile lands after all. The
-	* operator-facing answer to "perché manca l'immagine?" on a track whose
+	* `derive-returned-null tile=standin`,
+	* `native-tile tile=native no-key-frame-at-close`, …) written at close and
+	* CLEARED by the late-keyFrame upgrade when a native tile lands after all.
+	* The operator-facing answer to "perché manca l'immagine?" on a track whose
 	* tile is a face/plate stand-in, a raster crop, or an icon.
 	*
+	* **`no-key-frame-at-close` (D400).** The line used to be written ONLY when
+	* the TILE ranked below native, so a track whose thumbnail landed natively
+	* while its key frame missed carried no reason at all — three of the four
+	* `MISSING_KEYFRAME` tracks in the 2026-09-07 operator audit were exactly
+	* that shape, and their "niente ultimo" had no cause anywhere on the row.
+	* The key frame is the head of a cascade (`keyFrame ⇒ keyFrameSmall ⇒ the
+	* lastFrame copy source`), so its absence is now on this line whatever the
+	* tile ended up being.
+	*
 	* **Absent ≠ "missed silently"**: a row written before the column, a hub
 	* that predates the field, and every track whose tile landed native all
 	* omit it. Render nothing when absent.
@@ -27305,8 +27335,27 @@ var PrivacyMaskRegionSchema = object({
 });
 object({
 	enabled: boolean(),
-	/** Active zones (normalized 0..1). Length ≤ maxRegions. */
-	regions: array(PrivacyMaskRegionSchema),
+	/**
+	* Active zones (normalized 0..1). Length ≤ maxRegions.
+	*
+	* `null` means "no answer" — the provider has never reached this camera
+	* (a cold `runtimeState` slice, a battery camera asleep) or the read
+	* failed. A consumer must render it as UNKNOWN and never as "this camera
+	* has no zones": those two look identical to an operator right up to the
+	* moment one of them is acted on, and acting on them differs completely.
+	* The switch group turned an unanswered read into *"nothing is set up for
+	* it to act on"* — an instruction to go and draw a zone that already
+	* exists — and this editor seeded an EMPTY canvas from it, one Save away
+	* from deleting the mask it could not read.
+	*
+	* Empty-and-answered is `[]` and stays a real answer: this camera genuinely
+	* has no zones. The distinction is the same one {@link
+	* PrivacyMaskStatusSchema.shape.audioEnabled} already draws for the
+	* microphone, on the very same payload — both planes come from ONE refresh,
+	* so it was never coherent for one of them to be able to say "unknown"
+	* while the other could not.
+	*/
+	regions: array(PrivacyMaskRegionSchema).nullable(),
 	/**
 	* Is the camera capturing sound right now? Read from the camera, never from
 	* a server-side mirror.

package/dist/magic-link/auth-magic-link.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-CKMxgF_I.js");
+const require_dist = require("../dist-C_c_p-kP.js");
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.

package/dist/magic-link/auth-magic-link.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-BxpblTri.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-BfqWHC_q.mjs";
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.

package/dist/oidc/auth-oidc.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-CKMxgF_I.js");
+const require_dist = require("../dist-C_c_p-kP.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-BxpblTri.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-BfqWHC_q.mjs";
 import * as crypto$1 from "node:crypto";
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder();

package/dist/webauthn/{_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-B3y1LFCa.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-DIrCukqB.mjs}

@@ -3,7 +3,7 @@ import "./dist-CYZr2fwk.mjs";
 var e = {
 	"@camstack/sdk": {
 		name: "@camstack/sdk",
-		version: "1.2.85",
+		version: "1.2.87",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.165",
+		version: "1.2.167",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.133",
+		version: "1.2.135",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",

package/dist/webauthn/auth-webauthn.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-CKMxgF_I.js");
+const require_dist = require("../dist-C_c_p-kP.js");
 let stream = require("stream");
 stream = require_chunk.__toESM(stream, 1);
 let http = require("http");

package/dist/webauthn/auth-webauthn.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, d as number, f as object, l as array, n as addonWidgetsSourceCapability, o as userPasskeysCapability, p as string, u as boolean } from "../dist-BxpblTri.mjs";
+import { a as loginMethodCapability, c as BaseAddon, d as number, f as object, l as array, n as addonWidgetsSourceCapability, o as userPasskeysCapability, p as string, u as boolean } from "../dist-BfqWHC_q.mjs";
 import { createRequire } from "node:module";
 import Stream from "stream";
 import http from "http";

package/dist/webauthn/{hostInit-CRL1WL7F.mjs → hostInit-RYq-2Z6H.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.165",
+				version: "1.2.167",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -45,7 +45,7 @@ async function r() {
 				}
 			},
 			"@camstack/sdk": {
-				version: "1.2.85",
+				version: "1.2.87",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -81,7 +81,7 @@ async function r() {
 				}
 			},
 			"@camstack/ui-library": {
-				version: "1.2.133",
+				version: "1.2.135",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/webauthn/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-B3y1LFCa.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-DIrCukqB.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-auth",
-  "version": "1.2.89",
+  "version": "1.2.91",
   "description": "Authentication bundle — magic-link, OIDC, and WebAuthn/passkey. Multi-entry npm package shipping 3 addons under a single bundle; each addon keeps its own id, capabilities, and runner.",
   "keywords": [
     "camstack",