@camstack/addon-matter-broker 0.2.120 → 0.2.122

package/dist/addon.js

@@ -5384,7 +5384,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BNeXenvr.mjs
+//#region ../types/dist/sleep-B0JG7-_F.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -15159,6 +15159,10 @@ var DeviceInfoSchema = object({
 	isCamera: boolean(),
 	/** Current config values — serializable snapshot */
 	config: record(string$2(), unknown()),
+	/** Paths inside `config` the device's schema declares secret (D783) —
+	*  what the non-admin redaction withholds. Paths, never values. Absent
+	*  when the owning runner has not reported them. */
+	secretConfigPaths: array(string$2()).optional(),
 	/** Hardware + identity blob (manufacturer / model / firmware / sn /
 	*  uid / mac / …). Populated by drivers; editable via setMetadata. */
 	metadata: record(string$2(), unknown()).nullable().optional(),
@@ -15364,7 +15368,13 @@ var DeviceRegisterPayloadSchema = object({
 	*  call (workers re-register on init), so probe-driven updates
 	*  (e.g. PTZ flag flipping after the abilities probe) propagate. */
 	features: array(string$2()).optional(),
-	config: record(string$2(), unknown())
+	config: record(string$2(), unknown()),
+	/** Config paths the device's own schema DECLARES secret
+	*  (`.meta({ secret: true })` — dotted, `[]` for array items, e.g.
+	*  `connection.password`). Re-published on every register; the non-admin
+	*  redaction withholds them at any depth (D783). Optional: an older runner
+	*  omits it and the keyword backstop applies. */
+	secretConfigPaths: array(string$2()).optional()
 });
 var DeviceRemovePayloadSchema = object({ deviceId: number() });
 var DevicePersistConfigPayloadSchema = object({
@@ -17023,7 +17033,14 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		icon: string$2().optional(),
 		/** Addon-owned HTTP route the button navigates to (GET). */
 		startUrl: string$2(),
-		stage: LoginStageEnum
+		stage: LoginStageEnum,
+		/**
+		* The provider names an external identity a signed-in user can link to
+		* their own account (D782): `auth.listLinkableProviders` /
+		* `beginExternalLink` offer exactly the redirect methods that set this,
+		* whatever their id. Absent / false — a login button only (magic-link).
+		*/
+		linkable: boolean().optional()
 	}),
 	object({
 		kind: literal("widget"),
@@ -22458,7 +22475,13 @@ var RetrainFrameSchema = object({
 	sizeBytes: number().int(),
 	width: number().int(),
 	height: number().int(),
-	copiedAt: number()
+	copiedAt: number(),
+	/** When the CAMERA captured the frame. Absent on a copy taken before D785. */
+	capturedAt: number().optional(),
+	/** The operator's "every subject in this frame is boxed". Detector
+	*  evaluation keeps only complete frames: an unboxed subject would count as
+	*  a false positive. */
+	complete: boolean()
 });
 /** Why a copy-on-select could not be honoured — named, never a silent skip. */
 var RetrainCopyRefusalSchema = _enum([
@@ -22479,6 +22502,51 @@ var RetrainFrameListSchema = object({
 	/** What the page pre-selects — the native key frame when one survives. */
 	autoPickMediaId: number().int().optional()
 });
+/**
+* Which frames an annotated export carries. Every field narrows; an empty
+* filter is every annotated copy. A dataset VERSION is a frozen `frameIds`
+* list owned by whoever trains (the training orchestrator), so `frameIds` is
+* the primitive a version export uses; `batchId` re-selects what an earlier
+* export carried (`exportedInBatch`).
+*/
+var RetrainExportFilterSchema = object({
+	deviceIds: array(number()).optional(),
+	frameIds: array(string$2()).max(2e4).optional(),
+	batchId: string$2().optional(),
+	/** Only frames the operator marked complete (all subjects boxed). */
+	completeOnly: boolean().optional()
+});
+/**
+* `frames`: the full frame copies, boxes in `annotations.json`.
+* `crops`: additionally one JPEG per subject, cut with the runtime detail-crop
+* convention — the classifier layout.
+*/
+var RetrainExportLayoutSchema = _enum(["frames", "crops"]);
+/**
+* Where `writeRetrainArchive` streams the tar: one HTTP request whose body is
+* the archive, sent chunk by chunk. Covers a presigned PUT and a provider
+* addon's data-plane upload route alike. Headers are sent verbatim and never
+* logged.
+*/
+var RetrainArchiveTargetSchema = object({
+	kind: literal("http"),
+	method: _enum(["PUT", "POST"]),
+	url: string$2().url(),
+	headers: record(string$2(), string$2()).optional()
+});
+var RetrainArchiveResultSchema = object({
+	batchId: string$2(),
+	frames: number().int(),
+	crops: number().int(),
+	annotations: number().int(),
+	/** Frames planned but not shipped (unreadable copy, path too long). */
+	missing: number().int(),
+	bytes: number().int(),
+	/** sha256 of the exact bytes sent. */
+	sha256: string$2(),
+	/** The target's HTTP status. */
+	status: number().int()
+});
 /** What the operator asked the assist to look for. */
 var RetrainAssistSubjectSchema = discriminatedUnion("kind", [object({
 	kind: literal("package"),
@@ -23273,9 +23341,25 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), RetrainTransitionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceIds: array(number()).optional() }), object({ url: string$2() }), {
+}), method(RetrainExportFilterSchema.extend({ layout: RetrainExportLayoutSchema.optional() }), object({ url: string$2() }), {
 	kind: "query",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string$2(),
+	frameId: string$2(),
+	complete: boolean()
+}), RetrainFrameSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	filter: RetrainExportFilterSchema,
+	layout: RetrainExportLayoutSchema,
+	target: RetrainArchiveTargetSchema
+}), RetrainArchiveResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 60 * 6e4
 }), method(object({
 	/** Which of the three event tables owns the row. */
 	ownerType: EventOwnerTypeSchema,
@@ -26605,7 +26689,19 @@ var SsoBridgeClaimsSchema = object({
 	* editing a descriptor must not retroactively extend or shorten a link the
 	* operator already consented to.
 	*/
-	refreshTtl: union([number().int().positive(), literal("never")]).optional()
+	refreshTtl: union([number().int().positive(), literal("never")]).optional(),
+	/**
+	* Opaque handle of a hub-side LINK intent (D782). Set by an OIDC callback
+	* that was started from a signed-in user's "Link" button: the finish then
+	* links this identity to the intent's user instead of signing anyone in.
+	* The handle carries no user id — the hub resolves it, single-use.
+	*/
+	linkIntent: string$2().optional(),
+	/**
+	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
+	* subject is unique only per issuer, so a link is bound to it.
+	*/
+	issuer: string$2().optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
@@ -28540,7 +28636,22 @@ DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), ar
 	* field their hints were silently stripped by the schema and the
 	* adaptive ladder started blind on the client's display size.
 	*/
-	hints: webrtcClientHintsSchema.optional()
+	hints: webrtcClientHintsSchema.optional(),
+	/**
+	* Talk-back (D771): relay the PEER's audio to the device's speaker
+	* through the `intercom` cap's push-talk triple. When `true` and the
+	* offer lets the peer send audio, the answer's audio is `sendrecv`
+	* and every inbound frame goes to `intercom.pushTalkAudio` for this
+	* `deviceId`; absent/false answers `sendonly`, as for every viewer.
+	*
+	* TRUSTED-CALLER ONLY. Set by the Alexa export for an Echo on a camera
+	* with `intercom`, when the linked user may control that camera. The
+	* hub STRIPS it from every request-bound call (a browser), exactly as
+	* it overwrites `relayOnly` — a viewer's talk permission is the
+	* intercom cap's own surface (share tokens gate it there), and this
+	* flag must not become a second door to the camera's speaker.
+	*/
+	talkback: boolean().optional()
 }), object({
 	sessionId: string$2(),
 	sdpAnswer: string$2()
@@ -28842,6 +28953,59 @@ var AddonAutoUpdateSchema = ChannelWithInheritSchema;
 var RestartAddonResultSchema = unknown();
 var InstallPackageResultSchema = unknown();
 var ReloadPackagesResultSchema = unknown();
+/**
+* What an uninstall did on ONE node.
+*  - `uninstalled`       — removed: runner(s) stopped, caps gone, code deleted.
+*  - `not-installed`     — the node did not have it (nothing to do).
+*  - `refused`           — protected / bootstrap package; nothing touched.
+*  - `failed`            — attempted and did not complete; `error` says why.
+*  - `pending-reconnect` — the node is OFFLINE: its record was pruned so the
+*    back-fill never returns the package, and the stale-addon sweep removes the
+*    copy when the node registers again (only once the hub no longer has it).
+*/
+var UninstallNodeOutcomeSchema = _enum([
+	"uninstalled",
+	"not-installed",
+	"refused",
+	"failed",
+	"pending-reconnect"
+]);
+var UninstallNodeResultSchema = object({
+	nodeId: string$2(),
+	outcome: UninstallNodeOutcomeSchema,
+	error: string$2().optional(),
+	addonIds: array(string$2()).readonly(),
+	runnersStopped: array(string$2()).readonly(),
+	warnings: array(string$2()).readonly()
+});
+var UninstallPackageResultSchema = object({
+	/** Every targeted node ended `uninstalled`, `not-installed` or `pending-reconnect`. */
+	success: boolean(),
+	packageName: string$2(),
+	results: array(UninstallNodeResultSchema).readonly()
+});
+/**
+* `unreachable` lists online agents whose status read FAILED — absence from
+* `installations` is only "not installed" for a node that answered (D315).
+*/
+var PackageInstallationsSchema = object({
+	installations: array(object({
+		packageName: string$2(),
+		nodeId: string$2(),
+		nodeName: string$2(),
+		isHub: boolean(),
+		isOnline: boolean(),
+		version: string$2().nullable(),
+		addonIds: array(string$2()).readonly(),
+		source: _enum(["live", "recorded"]),
+		/** The hub installs this package too. `false` on an agent row = an orphan. */
+		onHub: boolean()
+	})).readonly(),
+	unreachable: array(object({
+		nodeId: string$2(),
+		error: string$2()
+	})).readonly()
+});
 var BulkUpdateItemStatusSchema = _enum([
 	"queued",
 	"updating",
@@ -28924,10 +29088,14 @@ method(_void(), array(AddonListItemSchema).readonly()), method(object({
 }), method(object({ packageName: string$2() }), InstallPackageResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), boolean()), method(_void(), array(unknown()).readonly()), method(object({ packageName: string$2() }), unknown(), {
+}), method(_void(), boolean()), method(_void(), array(unknown()).readonly()), method(object({
+	packageName: string$2().min(1),
+	nodeId: string$2().optional(),
+	everywhere: boolean().optional()
+}), UninstallPackageResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), ReloadPackagesResultSchema, {
+}), method(object({ packageName: string$2().optional() }), PackageInstallationsSchema, { auth: "admin" }), method(_void(), ReloadPackagesResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ query: string$2().optional() }), array(SearchResultSchema)), method(object({ nodeId: string$2().optional() }), array(PackageUpdateSchema).readonly(), { auth: "admin" }), method(object({
@@ -38854,6 +39022,32 @@ var TotpStatusSchema = object({
 	/** Null when no row exists OR the row is still pending confirmation. */
 	confirmedAt: number().nullable()
 });
+/**
+* user-management — singleton capability for user accounts, API keys,
+* and scoped tokens.
+*
+* v2 model: every method gated by `auth: 'admin'`. Admin-only delegation
+* — the subset check on `setUserScopes` / `createScopedToken` is moot
+* because non-admins never reach these. If/when we open non-admin
+* delegation, structural caller-scope subset check goes inside the
+* provider.
+*/
+var ExternalIdentitySchema = object({
+	/** Login-method id of the provider instance, e.g. `auth-oidc/authentik`. */
+	provider: string$2(),
+	/** The IdP's stable subject (`sub`) for this account. */
+	subject: string$2(),
+	/** The verified `iss` of the IdP the identity was linked under — `sub` is unique only per issuer. */
+	issuer: string$2(),
+	userId: string$2(),
+	/** What the IdP called the account at link time (username / email) — display only. */
+	label: string$2().optional(),
+	linkedAt: number()
+});
+var ExternalIdentityKeySchema = object({
+	provider: string$2().min(1),
+	subject: string$2().min(1)
+});
 method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserInputSchema, UserSummarySchema, {
 	kind: "mutation",
 	auth: "admin",
@@ -38967,7 +39161,22 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	userId: string$2(),
 	username: string$2(),
 	scopes: array(TokenScopeSchema)
-}).nullable(), { access: "view" }), method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }), method(object({ id: string$2() }), object({ success: boolean() }), {
+}).nullable(), { access: "view" }), method(object({ userId: string$2() }), array(ExternalIdentitySchema), { auth: "admin" }), method(ExternalIdentityKeySchema, object({
+	userId: string$2(),
+	issuer: string$2()
+}).nullable(), { auth: "admin" }), method(ExternalIdentityKeySchema.extend({
+	userId: string$2(),
+	issuer: string$2().min(1),
+	label: string$2().optional()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "create"
+}), method(ExternalIdentityKeySchema.extend({ userId: string$2() }), object({ success: boolean() }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "delete"
+}), method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }), method(object({ id: string$2() }), object({ success: boolean() }), {
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
@@ -41377,6 +41586,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"addons.listInstallations": {
+		capName: "addons",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"addons.listJobs": {
 		capName: "addons",
 		capScope: "system",
@@ -45601,6 +45816,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.setRetrainFrameComplete": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -45637,6 +45858,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.writeRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineExecutor.cacheFrameInPool": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -47989,18 +48216,36 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userManagement.findUserByExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.getTotpStatus": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.linkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.listExternalIdentities": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.listOauthSessions": {
 		capName: "user-management",
 		capScope: "system",
@@ -48079,6 +48324,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userManagement.unlinkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"userManagement.updateUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -51418,6 +51669,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.setRetrainFrameComplete": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.setTrackFlags": [{
 		name: "deviceId",
 		form: "single",
@@ -163416,11 +163672,11 @@ var MatterBrokerRegistry = class {
 */
 var matterConnectionSchema = object({
 	/** Optional Thread operational dataset (hex) for Thread device onboarding. */
-	threadDataset: string$2().default("").describe("Thread operational dataset (hex) — required only for Thread devices"),
+	threadDataset: string$2().default("").describe("Thread operational dataset (hex) — required only for Thread devices").meta({ secret: true }),
 	/** Optional Wi-Fi SSID for Wi-Fi device onboarding over BLE. */
 	wifiSsid: string$2().default("").describe("Wi-Fi SSID — required only for BLE Wi-Fi onboarding"),
 	/** Optional Wi-Fi password for Wi-Fi device onboarding over BLE. */
-	wifiPassword: string$2().default("").describe("Wi-Fi password (optional)"),
+	wifiPassword: string$2().default("").describe("Wi-Fi password (optional)").meta({ secret: true }),
 	/** PULL-reconcile interval for the commissioned-node inventory. */
 	reconcileIntervalMs: preprocess((v) => v === "" || v === null ? void 0 : v, number().int().min(1e4).max(864e5).default(3e5)).describe("Node-inventory reconcile interval (ms)")
 });
@@ -163451,6 +163707,7 @@ function buildConnectionFormSchema() {
 			{
 				type: "text",
 				key: "threadDataset",
+				secret: true,
 				label: "Thread operational dataset (hex, optional)",
 				placeholder: "0e08000000000001…"
 			},

package/dist/addon.mjs

@@ -5382,7 +5382,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BNeXenvr.mjs
+//#region ../types/dist/sleep-B0JG7-_F.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -15157,6 +15157,10 @@ var DeviceInfoSchema = object({
 	isCamera: boolean(),
 	/** Current config values — serializable snapshot */
 	config: record(string$2(), unknown()),
+	/** Paths inside `config` the device's schema declares secret (D783) —
+	*  what the non-admin redaction withholds. Paths, never values. Absent
+	*  when the owning runner has not reported them. */
+	secretConfigPaths: array(string$2()).optional(),
 	/** Hardware + identity blob (manufacturer / model / firmware / sn /
 	*  uid / mac / …). Populated by drivers; editable via setMetadata. */
 	metadata: record(string$2(), unknown()).nullable().optional(),
@@ -15362,7 +15366,13 @@ var DeviceRegisterPayloadSchema = object({
 	*  call (workers re-register on init), so probe-driven updates
 	*  (e.g. PTZ flag flipping after the abilities probe) propagate. */
 	features: array(string$2()).optional(),
-	config: record(string$2(), unknown())
+	config: record(string$2(), unknown()),
+	/** Config paths the device's own schema DECLARES secret
+	*  (`.meta({ secret: true })` — dotted, `[]` for array items, e.g.
+	*  `connection.password`). Re-published on every register; the non-admin
+	*  redaction withholds them at any depth (D783). Optional: an older runner
+	*  omits it and the keyword backstop applies. */
+	secretConfigPaths: array(string$2()).optional()
 });
 var DeviceRemovePayloadSchema = object({ deviceId: number() });
 var DevicePersistConfigPayloadSchema = object({
@@ -17021,7 +17031,14 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		icon: string$2().optional(),
 		/** Addon-owned HTTP route the button navigates to (GET). */
 		startUrl: string$2(),
-		stage: LoginStageEnum
+		stage: LoginStageEnum,
+		/**
+		* The provider names an external identity a signed-in user can link to
+		* their own account (D782): `auth.listLinkableProviders` /
+		* `beginExternalLink` offer exactly the redirect methods that set this,
+		* whatever their id. Absent / false — a login button only (magic-link).
+		*/
+		linkable: boolean().optional()
 	}),
 	object({
 		kind: literal("widget"),
@@ -22456,7 +22473,13 @@ var RetrainFrameSchema = object({
 	sizeBytes: number().int(),
 	width: number().int(),
 	height: number().int(),
-	copiedAt: number()
+	copiedAt: number(),
+	/** When the CAMERA captured the frame. Absent on a copy taken before D785. */
+	capturedAt: number().optional(),
+	/** The operator's "every subject in this frame is boxed". Detector
+	*  evaluation keeps only complete frames: an unboxed subject would count as
+	*  a false positive. */
+	complete: boolean()
 });
 /** Why a copy-on-select could not be honoured — named, never a silent skip. */
 var RetrainCopyRefusalSchema = _enum([
@@ -22477,6 +22500,51 @@ var RetrainFrameListSchema = object({
 	/** What the page pre-selects — the native key frame when one survives. */
 	autoPickMediaId: number().int().optional()
 });
+/**
+* Which frames an annotated export carries. Every field narrows; an empty
+* filter is every annotated copy. A dataset VERSION is a frozen `frameIds`
+* list owned by whoever trains (the training orchestrator), so `frameIds` is
+* the primitive a version export uses; `batchId` re-selects what an earlier
+* export carried (`exportedInBatch`).
+*/
+var RetrainExportFilterSchema = object({
+	deviceIds: array(number()).optional(),
+	frameIds: array(string$2()).max(2e4).optional(),
+	batchId: string$2().optional(),
+	/** Only frames the operator marked complete (all subjects boxed). */
+	completeOnly: boolean().optional()
+});
+/**
+* `frames`: the full frame copies, boxes in `annotations.json`.
+* `crops`: additionally one JPEG per subject, cut with the runtime detail-crop
+* convention — the classifier layout.
+*/
+var RetrainExportLayoutSchema = _enum(["frames", "crops"]);
+/**
+* Where `writeRetrainArchive` streams the tar: one HTTP request whose body is
+* the archive, sent chunk by chunk. Covers a presigned PUT and a provider
+* addon's data-plane upload route alike. Headers are sent verbatim and never
+* logged.
+*/
+var RetrainArchiveTargetSchema = object({
+	kind: literal("http"),
+	method: _enum(["PUT", "POST"]),
+	url: string$2().url(),
+	headers: record(string$2(), string$2()).optional()
+});
+var RetrainArchiveResultSchema = object({
+	batchId: string$2(),
+	frames: number().int(),
+	crops: number().int(),
+	annotations: number().int(),
+	/** Frames planned but not shipped (unreadable copy, path too long). */
+	missing: number().int(),
+	bytes: number().int(),
+	/** sha256 of the exact bytes sent. */
+	sha256: string$2(),
+	/** The target's HTTP status. */
+	status: number().int()
+});
 /** What the operator asked the assist to look for. */
 var RetrainAssistSubjectSchema = discriminatedUnion("kind", [object({
 	kind: literal("package"),
@@ -23271,9 +23339,25 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), RetrainTransitionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceIds: array(number()).optional() }), object({ url: string$2() }), {
+}), method(RetrainExportFilterSchema.extend({ layout: RetrainExportLayoutSchema.optional() }), object({ url: string$2() }), {
 	kind: "query",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string$2(),
+	frameId: string$2(),
+	complete: boolean()
+}), RetrainFrameSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	filter: RetrainExportFilterSchema,
+	layout: RetrainExportLayoutSchema,
+	target: RetrainArchiveTargetSchema
+}), RetrainArchiveResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 60 * 6e4
 }), method(object({
 	/** Which of the three event tables owns the row. */
 	ownerType: EventOwnerTypeSchema,
@@ -26603,7 +26687,19 @@ var SsoBridgeClaimsSchema = object({
 	* editing a descriptor must not retroactively extend or shorten a link the
 	* operator already consented to.
 	*/
-	refreshTtl: union([number().int().positive(), literal("never")]).optional()
+	refreshTtl: union([number().int().positive(), literal("never")]).optional(),
+	/**
+	* Opaque handle of a hub-side LINK intent (D782). Set by an OIDC callback
+	* that was started from a signed-in user's "Link" button: the finish then
+	* links this identity to the intent's user instead of signing anyone in.
+	* The handle carries no user id — the hub resolves it, single-use.
+	*/
+	linkIntent: string$2().optional(),
+	/**
+	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
+	* subject is unique only per issuer, so a link is bound to it.
+	*/
+	issuer: string$2().optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
@@ -28538,7 +28634,22 @@ DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), ar
 	* field their hints were silently stripped by the schema and the
 	* adaptive ladder started blind on the client's display size.
 	*/
-	hints: webrtcClientHintsSchema.optional()
+	hints: webrtcClientHintsSchema.optional(),
+	/**
+	* Talk-back (D771): relay the PEER's audio to the device's speaker
+	* through the `intercom` cap's push-talk triple. When `true` and the
+	* offer lets the peer send audio, the answer's audio is `sendrecv`
+	* and every inbound frame goes to `intercom.pushTalkAudio` for this
+	* `deviceId`; absent/false answers `sendonly`, as for every viewer.
+	*
+	* TRUSTED-CALLER ONLY. Set by the Alexa export for an Echo on a camera
+	* with `intercom`, when the linked user may control that camera. The
+	* hub STRIPS it from every request-bound call (a browser), exactly as
+	* it overwrites `relayOnly` — a viewer's talk permission is the
+	* intercom cap's own surface (share tokens gate it there), and this
+	* flag must not become a second door to the camera's speaker.
+	*/
+	talkback: boolean().optional()
 }), object({
 	sessionId: string$2(),
 	sdpAnswer: string$2()
@@ -28840,6 +28951,59 @@ var AddonAutoUpdateSchema = ChannelWithInheritSchema;
 var RestartAddonResultSchema = unknown();
 var InstallPackageResultSchema = unknown();
 var ReloadPackagesResultSchema = unknown();
+/**
+* What an uninstall did on ONE node.
+*  - `uninstalled`       — removed: runner(s) stopped, caps gone, code deleted.
+*  - `not-installed`     — the node did not have it (nothing to do).
+*  - `refused`           — protected / bootstrap package; nothing touched.
+*  - `failed`            — attempted and did not complete; `error` says why.
+*  - `pending-reconnect` — the node is OFFLINE: its record was pruned so the
+*    back-fill never returns the package, and the stale-addon sweep removes the
+*    copy when the node registers again (only once the hub no longer has it).
+*/
+var UninstallNodeOutcomeSchema = _enum([
+	"uninstalled",
+	"not-installed",
+	"refused",
+	"failed",
+	"pending-reconnect"
+]);
+var UninstallNodeResultSchema = object({
+	nodeId: string$2(),
+	outcome: UninstallNodeOutcomeSchema,
+	error: string$2().optional(),
+	addonIds: array(string$2()).readonly(),
+	runnersStopped: array(string$2()).readonly(),
+	warnings: array(string$2()).readonly()
+});
+var UninstallPackageResultSchema = object({
+	/** Every targeted node ended `uninstalled`, `not-installed` or `pending-reconnect`. */
+	success: boolean(),
+	packageName: string$2(),
+	results: array(UninstallNodeResultSchema).readonly()
+});
+/**
+* `unreachable` lists online agents whose status read FAILED — absence from
+* `installations` is only "not installed" for a node that answered (D315).
+*/
+var PackageInstallationsSchema = object({
+	installations: array(object({
+		packageName: string$2(),
+		nodeId: string$2(),
+		nodeName: string$2(),
+		isHub: boolean(),
+		isOnline: boolean(),
+		version: string$2().nullable(),
+		addonIds: array(string$2()).readonly(),
+		source: _enum(["live", "recorded"]),
+		/** The hub installs this package too. `false` on an agent row = an orphan. */
+		onHub: boolean()
+	})).readonly(),
+	unreachable: array(object({
+		nodeId: string$2(),
+		error: string$2()
+	})).readonly()
+});
 var BulkUpdateItemStatusSchema = _enum([
 	"queued",
 	"updating",
@@ -28922,10 +29086,14 @@ method(_void(), array(AddonListItemSchema).readonly()), method(object({
 }), method(object({ packageName: string$2() }), InstallPackageResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), boolean()), method(_void(), array(unknown()).readonly()), method(object({ packageName: string$2() }), unknown(), {
+}), method(_void(), boolean()), method(_void(), array(unknown()).readonly()), method(object({
+	packageName: string$2().min(1),
+	nodeId: string$2().optional(),
+	everywhere: boolean().optional()
+}), UninstallPackageResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), ReloadPackagesResultSchema, {
+}), method(object({ packageName: string$2().optional() }), PackageInstallationsSchema, { auth: "admin" }), method(_void(), ReloadPackagesResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ query: string$2().optional() }), array(SearchResultSchema)), method(object({ nodeId: string$2().optional() }), array(PackageUpdateSchema).readonly(), { auth: "admin" }), method(object({
@@ -38852,6 +39020,32 @@ var TotpStatusSchema = object({
 	/** Null when no row exists OR the row is still pending confirmation. */
 	confirmedAt: number().nullable()
 });
+/**
+* user-management — singleton capability for user accounts, API keys,
+* and scoped tokens.
+*
+* v2 model: every method gated by `auth: 'admin'`. Admin-only delegation
+* — the subset check on `setUserScopes` / `createScopedToken` is moot
+* because non-admins never reach these. If/when we open non-admin
+* delegation, structural caller-scope subset check goes inside the
+* provider.
+*/
+var ExternalIdentitySchema = object({
+	/** Login-method id of the provider instance, e.g. `auth-oidc/authentik`. */
+	provider: string$2(),
+	/** The IdP's stable subject (`sub`) for this account. */
+	subject: string$2(),
+	/** The verified `iss` of the IdP the identity was linked under — `sub` is unique only per issuer. */
+	issuer: string$2(),
+	userId: string$2(),
+	/** What the IdP called the account at link time (username / email) — display only. */
+	label: string$2().optional(),
+	linkedAt: number()
+});
+var ExternalIdentityKeySchema = object({
+	provider: string$2().min(1),
+	subject: string$2().min(1)
+});
 method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserInputSchema, UserSummarySchema, {
 	kind: "mutation",
 	auth: "admin",
@@ -38965,7 +39159,22 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	userId: string$2(),
 	username: string$2(),
 	scopes: array(TokenScopeSchema)
-}).nullable(), { access: "view" }), method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }), method(object({ id: string$2() }), object({ success: boolean() }), {
+}).nullable(), { access: "view" }), method(object({ userId: string$2() }), array(ExternalIdentitySchema), { auth: "admin" }), method(ExternalIdentityKeySchema, object({
+	userId: string$2(),
+	issuer: string$2()
+}).nullable(), { auth: "admin" }), method(ExternalIdentityKeySchema.extend({
+	userId: string$2(),
+	issuer: string$2().min(1),
+	label: string$2().optional()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "create"
+}), method(ExternalIdentityKeySchema.extend({ userId: string$2() }), object({ success: boolean() }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "delete"
+}), method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }), method(object({ id: string$2() }), object({ success: boolean() }), {
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
@@ -41375,6 +41584,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"addons.listInstallations": {
+		capName: "addons",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"addons.listJobs": {
 		capName: "addons",
 		capScope: "system",
@@ -45599,6 +45814,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.setRetrainFrameComplete": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -45635,6 +45856,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.writeRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineExecutor.cacheFrameInPool": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -47987,18 +48214,36 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userManagement.findUserByExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.getTotpStatus": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.linkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.listExternalIdentities": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.listOauthSessions": {
 		capName: "user-management",
 		capScope: "system",
@@ -48077,6 +48322,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userManagement.unlinkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"userManagement.updateUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -51416,6 +51667,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.setRetrainFrameComplete": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.setTrackFlags": [{
 		name: "deviceId",
 		form: "single",
@@ -163414,11 +163670,11 @@ var MatterBrokerRegistry = class {
 */
 var matterConnectionSchema = object({
 	/** Optional Thread operational dataset (hex) for Thread device onboarding. */
-	threadDataset: string$2().default("").describe("Thread operational dataset (hex) — required only for Thread devices"),
+	threadDataset: string$2().default("").describe("Thread operational dataset (hex) — required only for Thread devices").meta({ secret: true }),
 	/** Optional Wi-Fi SSID for Wi-Fi device onboarding over BLE. */
 	wifiSsid: string$2().default("").describe("Wi-Fi SSID — required only for BLE Wi-Fi onboarding"),
 	/** Optional Wi-Fi password for Wi-Fi device onboarding over BLE. */
-	wifiPassword: string$2().default("").describe("Wi-Fi password (optional)"),
+	wifiPassword: string$2().default("").describe("Wi-Fi password (optional)").meta({ secret: true }),
 	/** PULL-reconcile interval for the commissioned-node inventory. */
 	reconcileIntervalMs: preprocess((v) => v === "" || v === null ? void 0 : v, number().int().min(1e4).max(864e5).default(3e5)).describe("Node-inventory reconcile interval (ms)")
 });
@@ -163449,6 +163705,7 @@ function buildConnectionFormSchema() {
 			{
 				type: "text",
 				key: "threadDataset",
+				secret: true,
 				label: "Thread operational dataset (hex, optional)",
 				placeholder: "0e08000000000001…"
 			},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-matter-broker",
-  "version": "0.2.120",
+  "version": "0.2.122",
   "description": "Matter broker addon for CamStack — owns a Matter fabric (commissioning + the long-lived controller) via the matter.js controller and brokers commissioned Matter nodes into CamStack",
   "keywords": [
     "camstack",