@camstack/addon-osd-manager 0.1.187 → 0.1.189

package/dist/index.mjs

@@ -5369,7 +5369,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BNeXenvr.mjs
+//#region ../types/dist/sleep-B0JG7-_F.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -16376,6 +16376,10 @@ var DeviceInfoSchema = object({
 	isCamera: boolean(),
 	/** Current config values — serializable snapshot */
 	config: record(string(), unknown()),
+	/** Paths inside `config` the device's schema declares secret (D783) —
+	*  what the non-admin redaction withholds. Paths, never values. Absent
+	*  when the owning runner has not reported them. */
+	secretConfigPaths: array(string()).optional(),
 	/** Hardware + identity blob (manufacturer / model / firmware / sn /
 	*  uid / mac / …). Populated by drivers; editable via setMetadata. */
 	metadata: record(string(), unknown()).nullable().optional(),
@@ -16596,7 +16600,13 @@ var DeviceRegisterPayloadSchema = object({
 	*  call (workers re-register on init), so probe-driven updates
 	*  (e.g. PTZ flag flipping after the abilities probe) propagate. */
 	features: array(string()).optional(),
-	config: record(string(), unknown())
+	config: record(string(), unknown()),
+	/** Config paths the device's own schema DECLARES secret
+	*  (`.meta({ secret: true })` — dotted, `[]` for array items, e.g.
+	*  `connection.password`). Re-published on every register; the non-admin
+	*  redaction withholds them at any depth (D783). Optional: an older runner
+	*  omits it and the keyword backstop applies. */
+	secretConfigPaths: array(string()).optional()
 });
 var DeviceRemovePayloadSchema = object({ deviceId: number() });
 var DevicePersistConfigPayloadSchema = object({
@@ -19220,7 +19230,14 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		icon: string().optional(),
 		/** Addon-owned HTTP route the button navigates to (GET). */
 		startUrl: string(),
-		stage: LoginStageEnum
+		stage: LoginStageEnum,
+		/**
+		* The provider names an external identity a signed-in user can link to
+		* their own account (D782): `auth.listLinkableProviders` /
+		* `beginExternalLink` offer exactly the redirect methods that set this,
+		* whatever their id. Absent / false — a login button only (magic-link).
+		*/
+		linkable: boolean().optional()
 	}),
 	object({
 		kind: literal("widget"),
@@ -25577,7 +25594,13 @@ var RetrainFrameSchema = object({
 	sizeBytes: number().int(),
 	width: number().int(),
 	height: number().int(),
-	copiedAt: number()
+	copiedAt: number(),
+	/** When the CAMERA captured the frame. Absent on a copy taken before D785. */
+	capturedAt: number().optional(),
+	/** The operator's "every subject in this frame is boxed". Detector
+	*  evaluation keeps only complete frames: an unboxed subject would count as
+	*  a false positive. */
+	complete: boolean()
 });
 /** Why a copy-on-select could not be honoured — named, never a silent skip. */
 var RetrainCopyRefusalSchema = _enum([
@@ -25598,6 +25621,51 @@ var RetrainFrameListSchema = object({
 	/** What the page pre-selects — the native key frame when one survives. */
 	autoPickMediaId: number().int().optional()
 });
+/**
+* Which frames an annotated export carries. Every field narrows; an empty
+* filter is every annotated copy. A dataset VERSION is a frozen `frameIds`
+* list owned by whoever trains (the training orchestrator), so `frameIds` is
+* the primitive a version export uses; `batchId` re-selects what an earlier
+* export carried (`exportedInBatch`).
+*/
+var RetrainExportFilterSchema = object({
+	deviceIds: array(number()).optional(),
+	frameIds: array(string()).max(2e4).optional(),
+	batchId: string().optional(),
+	/** Only frames the operator marked complete (all subjects boxed). */
+	completeOnly: boolean().optional()
+});
+/**
+* `frames`: the full frame copies, boxes in `annotations.json`.
+* `crops`: additionally one JPEG per subject, cut with the runtime detail-crop
+* convention — the classifier layout.
+*/
+var RetrainExportLayoutSchema = _enum(["frames", "crops"]);
+/**
+* Where `writeRetrainArchive` streams the tar: one HTTP request whose body is
+* the archive, sent chunk by chunk. Covers a presigned PUT and a provider
+* addon's data-plane upload route alike. Headers are sent verbatim and never
+* logged.
+*/
+var RetrainArchiveTargetSchema = object({
+	kind: literal("http"),
+	method: _enum(["PUT", "POST"]),
+	url: string().url(),
+	headers: record(string(), string()).optional()
+});
+var RetrainArchiveResultSchema = object({
+	batchId: string(),
+	frames: number().int(),
+	crops: number().int(),
+	annotations: number().int(),
+	/** Frames planned but not shipped (unreadable copy, path too long). */
+	missing: number().int(),
+	bytes: number().int(),
+	/** sha256 of the exact bytes sent. */
+	sha256: string(),
+	/** The target's HTTP status. */
+	status: number().int()
+});
 /** What the operator asked the assist to look for. */
 var RetrainAssistSubjectSchema = discriminatedUnion("kind", [object({
 	kind: literal("package"),
@@ -26937,11 +27005,41 @@ var pipelineAnalyticsCapability = {
 		* out, so two crops of the same subject can never end up in one feature
 		* space (D52).
 		*/
-		getRetrainExportUrl: method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
+		getRetrainExportUrl: method(RetrainExportFilterSchema.extend({ layout: RetrainExportLayoutSchema.optional() }), object({ url: string() }), {
 			kind: "query",
 			auth: "admin"
 		}),
 		/**
+		* The operator's "every subject in this frame is boxed" — set and cleared
+		* by hand, never derived: a frame with no box may be a complete hard
+		* negative, and a frame with three boxes may still miss a fourth person.
+		*/
+		setRetrainFrameComplete: method(object({
+			deviceId: number(),
+			trackId: string(),
+			frameId: string(),
+			complete: boolean()
+		}), RetrainFrameSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Stream the annotated archive to a TARGET instead of a browser — the
+		* same tar `getRetrainExportUrl` serves (manifest first, one JPEG in
+		* memory at a time, paced), written chunk by chunk into one HTTP request.
+		* The bytes never cross this cap and never land on the hub's disk; the
+		* answer is what was sent, with its sha256.
+		*/
+		writeRetrainArchive: method(object({
+			filter: RetrainExportFilterSchema,
+			layout: RetrainExportLayoutSchema,
+			target: RetrainArchiveTargetSchema
+		}), RetrainArchiveResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 60 * 6e4
+		}),
+		/**
 		* The media an EVENT owns.
 		*
 		* `ownerType` is REQUIRED, and that is the whole correction (D482). An
@@ -31318,7 +31416,19 @@ var SsoBridgeClaimsSchema = object({
 	* editing a descriptor must not retroactively extend or shorten a link the
 	* operator already consented to.
 	*/
-	refreshTtl: union([number().int().positive(), literal("never")]).optional()
+	refreshTtl: union([number().int().positive(), literal("never")]).optional(),
+	/**
+	* Opaque handle of a hub-side LINK intent (D782). Set by an OIDC callback
+	* that was started from a signed-in user's "Link" button: the finish then
+	* links this identity to the intent's user instead of signing anyone in.
+	* The handle carries no user id — the hub resolves it, single-use.
+	*/
+	linkIntent: string().optional(),
+	/**
+	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
+	* subject is unique only per issuer, so a link is bound to it.
+	*/
+	issuer: string().optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -33847,7 +33957,22 @@ var webrtcSessionCapability = {
 			* field their hints were silently stripped by the schema and the
 			* adaptive ladder started blind on the client's display size.
 			*/
-			hints: webrtcClientHintsSchema.optional()
+			hints: webrtcClientHintsSchema.optional(),
+			/**
+			* Talk-back (D771): relay the PEER's audio to the device's speaker
+			* through the `intercom` cap's push-talk triple. When `true` and the
+			* offer lets the peer send audio, the answer's audio is `sendrecv`
+			* and every inbound frame goes to `intercom.pushTalkAudio` for this
+			* `deviceId`; absent/false answers `sendonly`, as for every viewer.
+			*
+			* TRUSTED-CALLER ONLY. Set by the Alexa export for an Echo on a camera
+			* with `intercom`, when the linked user may control that camera. The
+			* hub STRIPS it from every request-bound call (a browser), exactly as
+			* it overwrites `relayOnly` — a viewer's talk permission is the
+			* intercom cap's own surface (share tokens gate it there), and this
+			* flag must not become a second door to the camera's speaker.
+			*/
+			talkback: boolean().optional()
 		}), object({
 			sessionId: string(),
 			sdpAnswer: string()
@@ -34287,6 +34412,59 @@ var AddonAutoUpdateSchema = ChannelWithInheritSchema;
 var RestartAddonResultSchema = unknown();
 var InstallPackageResultSchema = unknown();
 var ReloadPackagesResultSchema = unknown();
+/**
+* What an uninstall did on ONE node.
+*  - `uninstalled`       — removed: runner(s) stopped, caps gone, code deleted.
+*  - `not-installed`     — the node did not have it (nothing to do).
+*  - `refused`           — protected / bootstrap package; nothing touched.
+*  - `failed`            — attempted and did not complete; `error` says why.
+*  - `pending-reconnect` — the node is OFFLINE: its record was pruned so the
+*    back-fill never returns the package, and the stale-addon sweep removes the
+*    copy when the node registers again (only once the hub no longer has it).
+*/
+var UninstallNodeOutcomeSchema = _enum([
+	"uninstalled",
+	"not-installed",
+	"refused",
+	"failed",
+	"pending-reconnect"
+]);
+var UninstallNodeResultSchema = object({
+	nodeId: string(),
+	outcome: UninstallNodeOutcomeSchema,
+	error: string().optional(),
+	addonIds: array(string()).readonly(),
+	runnersStopped: array(string()).readonly(),
+	warnings: array(string()).readonly()
+});
+var UninstallPackageResultSchema = object({
+	/** Every targeted node ended `uninstalled`, `not-installed` or `pending-reconnect`. */
+	success: boolean(),
+	packageName: string(),
+	results: array(UninstallNodeResultSchema).readonly()
+});
+/**
+* `unreachable` lists online agents whose status read FAILED — absence from
+* `installations` is only "not installed" for a node that answered (D315).
+*/
+var PackageInstallationsSchema = object({
+	installations: array(object({
+		packageName: string(),
+		nodeId: string(),
+		nodeName: string(),
+		isHub: boolean(),
+		isOnline: boolean(),
+		version: string().nullable(),
+		addonIds: array(string()).readonly(),
+		source: _enum(["live", "recorded"]),
+		/** The hub installs this package too. `false` on an agent row = an orphan. */
+		onHub: boolean()
+	})).readonly(),
+	unreachable: array(object({
+		nodeId: string(),
+		error: string()
+	})).readonly()
+});
 var BulkUpdateItemStatusSchema = _enum([
 	"queued",
 	"updating",
@@ -34395,10 +34573,31 @@ var addonsCapability = {
 		}),
 		isWorkspaceAvailable: method(_void(), boolean()),
 		listWorkspacePackages: method(_void(), array(unknown()).readonly()),
-		uninstallPackage: method(object({ packageName: string() }), unknown(), {
+		/**
+		* Uninstall a package. `nodeId` omitted (or `'hub'`) uninstalls on the hub
+		* — the original behaviour, which still THROWS on failure. An agent
+		* `nodeId` removes it from that agent through `$agent.undeploy`
+		* (runners stopped, caps deregistered, code deleted) and prunes the node's
+		* declared roster so the back-fill never returns it. `everywhere: true`
+		* does both for every node that has it (agents first, hub last); offline
+		* nodes answer `pending-reconnect`. Node-level failures in those two modes
+		* are REPORTED per node, never thrown. Protected packages are refused.
+		*/
+		uninstallPackage: method(object({
+			packageName: string().min(1),
+			nodeId: string().optional(),
+			everywhere: boolean().optional()
+		}), UninstallPackageResultSchema, {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* Which nodes have a package (or, with no `packageName`, every package on
+		* every node). Hub from its installer, online agents from `$agent.status`
+		* (in parallel, bounded), offline agents from their declared roster.
+		* Drives the uninstall confirm and the Addons page's "not on the hub" list.
+		*/
+		listInstallations: method(object({ packageName: string().optional() }), PackageInstallationsSchema, { auth: "admin" }),
 		reloadPackages: method(_void(), ReloadPackagesResultSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -45579,6 +45778,22 @@ var TotpStatusSchema = object({
 * delegation, structural caller-scope subset check goes inside the
 * provider.
 */
+var ExternalIdentitySchema = object({
+	/** Login-method id of the provider instance, e.g. `auth-oidc/authentik`. */
+	provider: string(),
+	/** The IdP's stable subject (`sub`) for this account. */
+	subject: string(),
+	/** The verified `iss` of the IdP the identity was linked under — `sub` is unique only per issuer. */
+	issuer: string(),
+	userId: string(),
+	/** What the IdP called the account at link time (username / email) — display only. */
+	label: string().optional(),
+	linkedAt: number()
+});
+var ExternalIdentityKeySchema = object({
+	provider: string().min(1),
+	subject: string().min(1)
+});
 var userManagementCapability = {
 	name: "user-management",
 	scope: "system",
@@ -45721,6 +45936,32 @@ var userManagementCapability = {
 			username: string(),
 			scopes: array(TokenScopeSchema)
 		}).nullable(), { access: "view" }),
+		listExternalIdentities: method(object({ userId: string() }), array(ExternalIdentitySchema), { auth: "admin" }),
+		/** The user an identity is linked to, or `null`. */
+		findUserByExternalIdentity: method(ExternalIdentityKeySchema, object({
+			userId: string(),
+			issuer: string()
+		}).nullable(), { auth: "admin" }),
+		/**
+		* Link `(provider, subject)` to `userId`. Idempotent for the same user;
+		* REFUSES (throws) an identity already linked to another user, and a
+		* user that does not exist.
+		*/
+		linkExternalIdentity: method(ExternalIdentityKeySchema.extend({
+			userId: string(),
+			issuer: string().min(1),
+			label: string().optional()
+		}), object({ success: literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
+		}),
+		/** Remove one link of `userId`. `success: false` when it was not linked to that user. */
+		unlinkExternalIdentity: method(ExternalIdentityKeySchema.extend({ userId: string() }), object({ success: boolean() }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "delete"
+		}),
 		listOauthSessions: method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }),
 		revokeOauthSession: method(object({ id: string() }), object({ success: boolean() }), {
 			kind: "mutation",
@@ -46926,6 +47167,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"addons.listInstallations": {
+		capName: "addons",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"addons.listJobs": {
 		capName: "addons",
 		capScope: "system",
@@ -51150,6 +51397,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.setRetrainFrameComplete": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -51186,6 +51439,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.writeRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineExecutor.cacheFrameInPool": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -53538,18 +53797,36 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userManagement.findUserByExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.getTotpStatus": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.linkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.listExternalIdentities": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.listOauthSessions": {
 		capName: "user-management",
 		capScope: "system",
@@ -53628,6 +53905,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userManagement.unlinkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"userManagement.updateUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -57143,6 +57426,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.setRetrainFrameComplete": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.setTrackFlags": [{
 		name: "deviceId",
 		form: "single",

package/dist/{player-overlays-BIS82ltZ.mjs → player-overlays-00L4bzaL.mjs}

@@ -1,5 +1,5 @@
 import { _ as e, l as t, u as n, x as r } from "./_virtual_mf___mfe_internal__addon_osd_manager_page__loadShare__react__loadShare__.js-D7xZfSHZ.mjs";
-import { c as i, s as a } from "./responsive-B3EaDJYd.mjs";
+import { c as i, s as a } from "./responsive-BazUqbVY.mjs";
 import { n as o, r as s, t as c } from "./_virtual_mf___mfe_internal__addon_osd_manager_page__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-DalfdIDw.mjs";
 var l = i("chevron-down", [["path", {
 	d: "m6 9 6 6 6-6",

package/dist/remoteEntry.js

@@ -1,2 +1,2 @@
-import { n as e, t } from "./virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_osd_manager_page__remoteEntry_js-CbqzvZt_.mjs";
+import { n as e, t } from "./virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_osd_manager_page__remoteEntry_js-BD4P2kRn.mjs";
 export { t as get, e as init };

package/dist/{responsive-B3EaDJYd.mjs → responsive-BazUqbVY.mjs}

@@ -1,6 +1,6 @@
 import { _ as e, c as t, h as n, l as r, n as i, r as a, t as o, u as s, v as c, x as l } from "./_virtual_mf___mfe_internal__addon_osd_manager_page__loadShare__react__loadShare__.js-D7xZfSHZ.mjs";
 import "./_virtual_mf___mfe_internal__addon_osd_manager_page__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-DalfdIDw.mjs";
-import { i as u } from "./_virtual_mf___mfe_internal__addon_osd_manager_page__loadShare___mf_0_camstack_mf_1_types__loadShare__.js-xwBgquo5.mjs";
+import { i as u } from "./_virtual_mf___mfe_internal__addon_osd_manager_page__loadShare___mf_0_camstack_mf_1_types__loadShare__.js-ClWLIzft.mjs";
 //#region ../../node_modules/lucide-react/dist/esm/shared/src/utils/mergeClasses.js
 l();
 var d = (...e) => e.filter((e, t, n) => !!e && e.trim() !== "" && n.indexOf(e) === t).join(" ").trim(), f = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase(), p = (e) => e.replace(/^([A-Z])|[\s-_]+(\w)/g, (e, t, n) => n ? n.toUpperCase() : t.toLowerCase()), m = (e) => {

package/dist/{scene-monitor-copy-b6ZWnJc9.mjs → scene-monitor-copy-BMxLX_wC.mjs}

@@ -1,5 +1,5 @@
 import { _ as e, c as t, h as n, x as r } from "./_virtual_mf___mfe_internal__addon_osd_manager_page__loadShare__react__loadShare__.js-D7xZfSHZ.mjs";
-import { c as i } from "./responsive-B3EaDJYd.mjs";
+import { c as i } from "./responsive-BazUqbVY.mjs";
 var a = i("camera", [["path", {
 	d: "M13.997 4a2 2 0 0 1 1.76 1.05l.486.9A2 2 0 0 0 18.003 7H20a2 2 0 0 1 2 2v9a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V9a2 2 0 0 1 2-2h1.997a2 2 0 0 0 1.759-1.048l.489-.904A2 2 0 0 1 10.004 4z",
 	key: "18u6gg"

package/dist/{square-DnMZ8-h0.mjs → square-C-PPPKSF.mjs}

@@ -1,4 +1,4 @@
-import { c as e } from "./responsive-B3EaDJYd.mjs";
+import { c as e } from "./responsive-BazUqbVY.mjs";
 var t = e("eye-off", [
 	["path", {
 		d: "M10.733 5.076a10.744 10.744 0 0 1 11.205 6.575 1 1 0 0 1 0 .696 10.747 10.747 0 0 1-1.444 2.49",

package/dist/{trash-2-Cd7WoJCB.mjs → trash-2-DD0_NJPI.mjs}

@@ -1,4 +1,4 @@
-import { c as e } from "./responsive-B3EaDJYd.mjs";
+import { c as e } from "./responsive-BazUqbVY.mjs";
 var t = e("trash-2", [
 	["path", {
 		d: "M10 11v6",

package/dist/{virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_osd_manager_page__remoteEntry_js-CbqzvZt_.mjs → virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_osd_manager_page__remoteEntry_js-BD4P2kRn.mjs}

@@ -2753,7 +2753,7 @@ async function rr(e) {
 	}
 }
 async function ir() {
-	return tr ||= rr(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_osd_manager_page-CqKqHB_X.mjs")).catch((e) => {
+	return tr ||= rr(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_osd_manager_page-Ee0XGOd5.mjs")).catch((e) => {
 		throw tr = void 0, e;
 	}), tr;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-osd-manager",
-  "version": "0.1.187",
+  "version": "0.1.189",
   "description": "Binds camera on-screen-display slots to live state and recognitions",
   "keywords": [
     "camstack",