@camstack/addon-auth 1.2.9 → 1.2.11

package/dist/{dist-CF5g7wuw.js → dist-DgIN-Jeh.js}

@@ -1,4 +1,4 @@
-//#region ../types/dist/event-category-Bz24uP1U.mjs
+//#region ../types/dist/event-category-41fKf-q9.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -58,6 +58,26 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AddonRetryScheduled"] = "addon.retry-scheduled";
 	/**
+	* A liveness invariant of this node is false — it has no devices, every
+	* camera is offline, or a camera that was recording has stopped producing
+	* segments. Emitted by the `liveness-monitor` builtin, once per fault (the
+	* `findingId` is stable across ticks), only after its boot grace period.
+	* AlertCenter raises a persistent operator-visible alert.
+	*
+	* It exists because on 2026-08-03 the hub ran four hours with zero devices
+	* and zero recordings while every surface stayed quiet.
+	*
+	* Payload: `{ findingId, severity, title, message, deviceId? }`.
+	*/
+	EventCategory["SystemLivenessFailed"] = "system.liveness-failed";
+	/**
+	* A previously reported liveness fault is true again. AlertCenter dismisses
+	* the matching `SystemLivenessFailed` alert.
+	*
+	* Payload: `{ findingId }`.
+	*/
+	EventCategory["SystemLivenessRecovered"] = "system.liveness-recovered";
+	/**
 	* Monitor is attempting to reload a failed addon NOW. UI uses this
 	* to show a spinner during the retry attempt. Same transient nature
 	* as AddonRetryScheduled.
@@ -7437,14 +7457,7 @@ var RecordingConfigSchema = object({
 	* windows only — existing sheets are immutable, and each window's index
 	* carries its own tile dims so mixed-preset history renders correctly.
 	*/
-	scrubThumbnails: ScrubThumbnailPresetSchema.optional(),
-	/**
-	* OPT-IN thumbnail-strip generation for this camera: every keyframe of the
-	* low recording saved as a JPEG (the fast-drag scrub depth), a derived
-	* cache that eviction reclaims with the footage. Absent/false = no strips
-	* are written and scrub reads exact keyframes at every velocity.
-	*/
-	stripsEnabled: boolean().optional()
+	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
 }).strict();
 /**
 * Ops-log — the durable, append-only operations audit shared by the
@@ -7506,7 +7519,7 @@ var OpsLogQueryInputSchema = object({
 /**
 * Entity-relocation job state (storage entity-routing spec, Phase 4).
 *
-* One shape shared by the recorder's `relocateFootage` (segments + strips) and
+* One shape shared by the recorder's `relocateFootage` (segments) and
 * pipeline-analytics' `relocateMedia` (event media blobs) so the admin Data
 * page renders both movers with one component. Jobs are in-RAM (a restart
 * forgets them — re-running is safe by construction: copy-if-absent, delete
@@ -7528,7 +7541,7 @@ var RelocateJobSchema = object({
 	toLocationId: string(),
 	/** Scoped device, or null = every device. */
 	deviceId: number().nullable(),
-	/** What the job moves (owner-addon specific: segments/strips or media). */
+	/** What the job moves (owner-addon specific: segments or media). */
 	entities: array(string()),
 	filesMoved: number().int(),
 	bytesMoved: number().int(),
@@ -7542,7 +7555,7 @@ var RelocateFootageInputSchema = object({
 	deviceId: number().optional(),
 	fromLocationId: string(),
 	toLocationId: string(),
-	entities: array(_enum(["segments", "strips"])).optional(),
+	entities: array(_enum(["segments"])).optional(),
 	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
 	*  never allowed to starve live writers. */
 	throttleMbps: number().min(1).max(1e3).optional()
@@ -15231,6 +15244,210 @@ method(object({ codec: string() }), boolean()), method(_void(), object({
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* Query filter for settings-store collections.
+*/
+var QueryFilterSchema = object({
+	where: record(string(), unknown()).optional(),
+	whereIn: record(string(), array(unknown())).optional(),
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
+	orderBy: object({
+		field: string(),
+		direction: _enum(["asc", "desc"])
+	}).optional(),
+	limit: number().optional(),
+	offset: number().optional()
+});
+/**
+* The predicate half of a filter, for BULK MUTATIONS.
+*
+* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
+* meaning for a statement that rewrites a set, and accepting them would invite
+* a caller to believe `limit` bounds the damage. Every field is optional here
+* only so the shape stays composable — the implementation REJECTS a filter
+* that compiles to no predicate, because that is the whole collection.
+*/
+var MutationFilterSchema = object({
+	where: record(string(), unknown()).optional(),
+	whereIn: record(string(), array(unknown())).optional(),
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional()
+});
+/** A single stored record: `{ id, data }`. */
+var SettingsRecordSchema = object({
+	id: string(),
+	data: record(string(), unknown())
+});
+/**
+* Column declaration for a structured (SQL-backed) collection.
+*
+* Logical types — the backend translates each to the matching SQLite
+* storage class and handles per-type marshaling:
+*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
+*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
+*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
+*/
+var CollectionColumnSchema = object({
+	name: string(),
+	type: _enum([
+		"TEXT",
+		"INTEGER",
+		"REAL",
+		"JSON",
+		"BOOLEAN"
+	]),
+	primaryKey: boolean().optional(),
+	notNull: boolean().optional(),
+	unique: boolean().optional(),
+	/**
+	* Column DEFAULT. Required for B2: the four `ensureTable` consumers declare
+	* columns like `enabled INTEGER NOT NULL DEFAULT 1`, and without this the
+	* collection surface simply cannot express their existing tables — which is
+	* why they were still on the uncapped `table*` API.
+	*/
+	defaultValue: union([
+		string(),
+		number(),
+		boolean()
+	]).optional()
+});
+var CollectionIndexSchema = object({
+	name: string(),
+	columns: array(string()).readonly(),
+	unique: boolean().optional()
+});
+method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), unknown()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string(),
+	value: unknown()
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), array(SettingsRecordSchema).readonly()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	record: SettingsRecordSchema
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	id: string(),
+	data: record(string(), unknown())
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema
+}), object({ deleted: number().int() }), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema,
+	data: record(string(), unknown())
+}), object({ updated: number().int() }), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), number()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	field: string(),
+	bucketSize: number().int().positive(),
+	origin: number().int(),
+	filter: QueryFilterSchema.optional()
+}), array(object({
+	bucket: number().int(),
+	count: number().int()
+})).readonly()), method(object({
+	namespace: string().optional(),
+	collection: string()
+}), boolean()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	columns: array(CollectionColumnSchema).readonly(),
+	indexes: array(CollectionIndexSchema).readonly().optional()
+}), _void(), { kind: "mutation" });
+/**
+* What one engine says about itself. The orchestrator uses `kind` to pick
+* a registrant for a collection; `engineId` is what a log line names when
+* a call is routed or refused.
+*/
+var EngineInfoSchema = object({
+	engineId: string(),
+	/**
+	* `relational` — rows, columns, indexes, the surface `settings-store`
+	* has always described. `vector` — an embedding store answering
+	* similarity queries. A registrant declares exactly one; an engine that
+	* does both registers twice, because "both" would make the routing
+	* decision ambiguous at exactly the point it must not be.
+	*/
+	kind: _enum(["relational", "vector"]),
+	displayName: string()
+});
+method(_void(), EngineInfoSchema), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), unknown()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string(),
+	value: unknown()
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), array(SettingsRecordSchema).readonly()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	record: SettingsRecordSchema
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	id: string(),
+	data: record(string(), unknown())
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema
+}), object({ deleted: number().int() }), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema,
+	data: record(string(), unknown())
+}), object({ updated: number().int() }), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), number()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	field: string(),
+	bucketSize: number().int().positive(),
+	origin: number().int(),
+	filter: QueryFilterSchema.optional()
+}), array(object({
+	bucket: number().int(),
+	count: number().int()
+})).readonly()), method(object({
+	namespace: string().optional(),
+	collection: string()
+}), boolean()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	columns: array(CollectionColumnSchema).readonly(),
+	indexes: array(CollectionIndexSchema).readonly().optional()
+}), _void(), { kind: "mutation" });
 DeviceType.Camera;
 /**
 * `device-adoption` — generic discovery + adoption surface,
@@ -18471,6 +18688,28 @@ var ServerUpdateStateSchema = _enum([
 	"pending-restart",
 	"awaiting-confirmation"
 ]);
+var ImageContractSchema = object({
+	state: _enum([
+		"in-sync",
+		"behind-patch",
+		"behind-series",
+		"ahead",
+		"unknown"
+	]),
+	/** The baked seed closure version — the image/app-bundle fingerprint. */
+	seedVersion: string().nullable(),
+	/** Best-known version the deployment contract delivers today. */
+	contractVersion: string().nullable(),
+	/**
+	* Where `contractVersion` came from: a real registry check (`registry`), or
+	* the node's own running version (`running` — a node can never run code
+	* newer than the newest release, so `seed < running` proves image staleness
+	* even before any registry check has run).
+	*/
+	contractSource: _enum(["registry", "running"]).nullable(),
+	/** One operator-grade sentence: this node runs image X; the contract says Y. */
+	message: string()
+});
 var ServerRollbackInfoSchema = object({
 	/** The version that failed (or was manually rolled back). */
 	fromVersion: string(),
@@ -18507,7 +18746,12 @@ var ServerPackageStatusSchema = object({
 	* versions are being IGNORED. Surfaced as a warning in the UI.
 	*/
 	stateFileCorrupt: boolean(),
-	lastCheckedAtMs: number().nullable()
+	lastCheckedAtMs: number().nullable(),
+	/**
+	* Seed-vs-contract verdict (see {@link ImageContractSchema}). Optional for
+	* version skew: an older provider's payload simply omits it.
+	*/
+	imageContract: ImageContractSchema.optional()
 });
 var ServerUpdateCheckResultSchema = object({
 	packageName: string(),
@@ -18542,101 +18786,6 @@ version: string().optional() }), ServerUpdateActionResultSchema, {
 	auth: "admin"
 });
 /**
-* Query filter for settings-store collections.
-*/
-var QueryFilterSchema = object({
-	where: record(string(), unknown()).optional(),
-	whereIn: record(string(), array(unknown())).optional(),
-	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
-	orderBy: object({
-		field: string(),
-		direction: _enum(["asc", "desc"])
-	}).optional(),
-	limit: number().optional(),
-	offset: number().optional()
-});
-/** A single stored record: `{ id, data }`. */
-var SettingsRecordSchema = object({
-	id: string(),
-	data: record(string(), unknown())
-});
-/**
-* Column declaration for a structured (SQL-backed) collection.
-*
-* Logical types — the backend translates each to the matching SQLite
-* storage class and handles per-type marshaling:
-*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
-*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
-*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
-*/
-var CollectionColumnSchema = object({
-	name: string(),
-	type: _enum([
-		"TEXT",
-		"INTEGER",
-		"REAL",
-		"JSON",
-		"BOOLEAN"
-	]),
-	primaryKey: boolean().optional(),
-	notNull: boolean().optional(),
-	unique: boolean().optional()
-});
-var CollectionIndexSchema = object({
-	name: string(),
-	columns: array(string()).readonly(),
-	unique: boolean().optional()
-});
-method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string()
-}), unknown()), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string(),
-	value: unknown()
-}), _void(), { kind: "mutation" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: QueryFilterSchema.optional()
-}), array(SettingsRecordSchema).readonly()), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	record: SettingsRecordSchema
-}), _void(), { kind: "mutation" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	id: string(),
-	data: record(string(), unknown())
-}), _void(), { kind: "mutation" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string()
-}), _void(), { kind: "mutation" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: QueryFilterSchema.optional()
-}), number()), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	field: string(),
-	bucketSize: number().int().positive(),
-	origin: number().int(),
-	filter: QueryFilterSchema.optional()
-}), array(object({
-	bucket: number().int(),
-	count: number().int()
-})).readonly()), method(object({
-	namespace: string().optional(),
-	collection: string()
-}), boolean()), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	columns: array(CollectionColumnSchema).readonly(),
-	indexes: array(CollectionIndexSchema).readonly().optional()
-}), _void(), { kind: "mutation" });
-/**
 * `smtp-provider` — pluggable email delivery surface.
 *
 * Collection cap: a deployment may install multiple SMTP relays (e.g.
@@ -22552,6 +22701,84 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"dataStoreProvider.count": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.declareCollection": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"dataStoreProvider.delete": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"dataStoreProvider.deleteWhere": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"dataStoreProvider.get": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.getEngineInfo": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.histogram": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.insert": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"dataStoreProvider.isEmpty": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.query": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.set": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"dataStoreProvider.update": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"dataStoreProvider.updateWhere": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dayNight.getOptions": {
 		capName: "day-night",
 		capScope: "device",
@@ -25630,6 +25857,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"settingsStore.deleteWhere": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"settingsStore.get": {
 		capName: "settings-store",
 		capScope: "system",
@@ -25672,6 +25905,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.updateWhere": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"smtpProvider.getStatus": {
 		capName: "smtp-provider",
 		capScope: "system",

package/dist/magic-link/auth-magic-link.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-CF5g7wuw.js");
+const require_dist = require("../dist-DgIN-Jeh.js");
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.

package/dist/magic-link/auth-magic-link.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist--U_wS5Lg.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-CbLTY-OQ.mjs";
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.

package/dist/oidc/auth-oidc.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-CF5g7wuw.js");
+const require_dist = require("../dist-DgIN-Jeh.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist--U_wS5Lg.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-CbLTY-OQ.mjs";
 import * as crypto$1 from "node:crypto";
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder();

package/dist/webauthn/_stub.js

@@ -1,6 +1,6 @@
 import { n as e, r as t, t as n } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare__react__loadShare__.js-BIIa6vDX.mjs";
 import { n as r, t as i } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-CQ-aEQ9b.mjs";
-import { t as a } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-Bm2udxUh.mjs";
+import { t as a } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-CHvxdwMb.mjs";
 import { n as o, r as s, t as c } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-BL2etuqg.mjs";
 //#region ../../node_modules/lucide-react/dist/esm/shared/src/utils.js
 var l = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase(), u = (e) => e.replace(/^([A-Z])|[\s-_]+(\w)/g, (e, t, n) => n ? n.toUpperCase() : t.toLowerCase()), d = (e) => {

package/dist/webauthn/{_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-CorNj4bz.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-BVb57Rg_.mjs}

@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.20",
+		version: "1.2.24",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.16",
+		version: "1.2.18",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",