@camstack/addon-pipeline 1.2.603 → 1.2.604

package/dist/audio-analyzer/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-DvXRw_dM.js");
-const require_model_catalogs = require("../model-catalogs-B95QZeYt.js");
-const require_process_memory = require("../process-memory-CmWDOMmE.js");
+const require_dist = require("../dist-DGzDqaBO.js");
+const require_model_catalogs = require("../model-catalogs-BZ7wE3tk.js");
+const require_process_memory = require("../process-memory-C8-aiceH.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_path = require("node:path");

package/dist/audio-analyzer/index.mjs

@@ -1,7 +1,7 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
-import { $ as audioAnalyzerCapability, F as PoolMemoryWatchdog, Gn as hydrateSchema, Lt as mapAudioLabelToMacro, Nn as BaseAddon, Q as audioAnalysisCapability, Rn as audioChunkBytesPerSample, Un as expandAudioChunkToF32le, Zn as nodePin, cn as resolvePoolMemoryPolicy, h as DEFAULT_AUDIO_ANALYZER_CONFIG, jn as errMsg, mr as EventCategory, r as AUDIO_BACKEND_CHOICES } from "../dist-CsCflIM1.mjs";
-import { n as AUDIO_CLASSIFIER_MODELS } from "../model-catalogs-aTwF92Re.mjs";
-import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-1_2L6U3Q.mjs";
+import { $ as audioAnalyzerCapability, F as PoolMemoryWatchdog, Gn as hydrateSchema, Lt as mapAudioLabelToMacro, Nn as BaseAddon, Q as audioAnalysisCapability, Rn as audioChunkBytesPerSample, Un as expandAudioChunkToF32le, Zn as nodePin, cn as resolvePoolMemoryPolicy, h as DEFAULT_AUDIO_ANALYZER_CONFIG, jn as errMsg, mr as EventCategory, r as AUDIO_BACKEND_CHOICES } from "../dist-BZ34hSbo.mjs";
+import { n as AUDIO_CLASSIFIER_MODELS } from "../model-catalogs-EjFqjUfh.mjs";
+import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-BPqkGyDA.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
 import { ensureModel } from "@camstack/system/addon-utils";

package/dist/{custom-model-catalog-Dv09Pvq_.mjs → custom-model-catalog-BWxCwQ1L.mjs}

@@ -1,5 +1,5 @@
-import { b as DEVICE_BACKEND_TO_FORMAT, et as audioKindId, f as COCO_80_LABELS, i as AUDIO_MACRO_LABELS, jt as inferModelProvider, k as LABEL_SUPPLY_VOCABULARIES, mn as stepModelRunsOnFormat, p as COCO_TO_MACRO } from "./dist-CsCflIM1.mjs";
-import { a as FACE_DETECTION_MODELS, c as OBJECT_DETECTION_MODELS, d as PLATE_OCR_MODELS, f as SEGMENTATION_REFINER_MODELS, i as CLIP_EMBEDDING_MODELS, l as PACKAGE_DETECTION_MODELS, n as AUDIO_CLASSIFIER_MODELS, o as FACE_EMBEDDING_MODELS, p as VEHICLE_CLASSIFIER_MODELS, r as BIRD_CLASSIFIER_MODELS, s as INSTANCE_SEGMENTATION_MODELS, t as ANIMAL_CLASSIFIER_MODELS, u as PLATE_DETECTION_MODELS } from "./model-catalogs-aTwF92Re.mjs";
+import { b as DEVICE_BACKEND_TO_FORMAT, et as audioKindId, f as COCO_80_LABELS, i as AUDIO_MACRO_LABELS, jt as inferModelProvider, k as LABEL_SUPPLY_VOCABULARIES, mn as stepModelRunsOnFormat, p as COCO_TO_MACRO } from "./dist-BZ34hSbo.mjs";
+import { a as FACE_DETECTION_MODELS, c as OBJECT_DETECTION_MODELS, d as PLATE_OCR_MODELS, f as SEGMENTATION_REFINER_MODELS, i as CLIP_EMBEDDING_MODELS, l as PACKAGE_DETECTION_MODELS, n as AUDIO_CLASSIFIER_MODELS, o as FACE_EMBEDDING_MODELS, p as VEHICLE_CLASSIFIER_MODELS, r as BIRD_CLASSIFIER_MODELS, s as INSTANCE_SEGMENTATION_MODELS, t as ANIMAL_CLASSIFIER_MODELS, u as PLATE_DETECTION_MODELS } from "./model-catalogs-EjFqjUfh.mjs";
 import { t as isWorkerReply } from "./worker-protocol-D_NzPcnh.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/detection-pipeline/registry/effective-confidence.ts

package/dist/{custom-model-catalog-BAnOZBOf.js → custom-model-catalog-BmQ6g825.js}

@@ -1,5 +1,5 @@
-const require_dist = require("./dist-DvXRw_dM.js");
-const require_model_catalogs = require("./model-catalogs-B95QZeYt.js");
+const require_dist = require("./dist-DGzDqaBO.js");
+const require_model_catalogs = require("./model-catalogs-BZ7wE3tk.js");
 const require_worker_protocol = require("./worker-protocol-C-G8qmye.js");
 let node_crypto = require("node:crypto");
 //#region src/detection-pipeline/registry/effective-confidence.ts

package/dist/detection-pipeline/index.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-DvXRw_dM.js");
-const require_node = require("../node-DxAtLKEn.js");
-const require_custom_model_catalog = require("../custom-model-catalog-BAnOZBOf.js");
+const require_dist = require("../dist-DGzDqaBO.js");
+const require_node = require("../node-CVbPzQN2.js");
+const require_custom_model_catalog = require("../custom-model-catalog-BmQ6g825.js");
 const require_lazy_sharp = require("../lazy-sharp-BuwKlQLR.js");
-const require_process_memory = require("../process-memory-CmWDOMmE.js");
+const require_process_memory = require("../process-memory-C8-aiceH.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/detection-pipeline/index.mjs

@@ -1,9 +1,9 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
-import { F as PoolMemoryWatchdog, Ft as loadContributionCapability, Gn as hydrateSchema, Gt as overlayClusterStepSettings, Nn as BaseAddon, Nt as linkedLabelStepId, O as LABEL_SUPPLY_MACRO, St as evaluateZoneRules, Ut as modelBindingKey, Wn as hfModelUrl, X as applyModelBoundSettings, Xt as pipelineExecutorCapability, Zn as nodePin, _t as detectionPipelineCapability, cn as resolvePoolMemoryPolicy, ct as containingParentIndex, d as CLUSTER_MODEL_SCOPED_STEPS, dn as rootSuppliesOf, er as sleep, fn as runtimeDevices$1, fr as string, ft as defaultDeviceFor$1, g as DEFAULT_CLUSTER_STEP_SETTINGS, jn as errMsg$1, lr as object, mn as stepModelRunsOnFormat, mr as EventCategory, n as APPLE_SA_TO_MACRO, pr as union, q as YAMNET_TO_MACRO, qt as pickClusterStepSettings, rn as resolveClusterStepModelId, rr as array, st as collectModelBoundKeys, xt as enumerateInferenceDevices, yn as supportedRuntimes$1, zn as createEvent } from "../dist-CsCflIM1.mjs";
-import { c as readProcessCost } from "../node-DAp5MmRJ.mjs";
-import { C as resolveModelDefaultConfidence, S as landmarkPrecisionVerdict, _ as ALL_STEPS, b as getStepDefinition, f as localFrameRegistry, g as ALL_PIPELINE_STEPS, l as resolveDefaultDetectionModel, n as mergeCustomModels, o as deviceKeyOf, r as buildSubtreeCanRun, s as resolveDeviceEngine, t as CustomModelCatalog, u as macroGateVerdict, v as getDefaultModelForFormat, x as resolveModelForFormat, y as getStep } from "../custom-model-catalog-Dv09Pvq_.mjs";
+import { F as PoolMemoryWatchdog, Ft as loadContributionCapability, Gn as hydrateSchema, Gt as overlayClusterStepSettings, Nn as BaseAddon, Nt as linkedLabelStepId, O as LABEL_SUPPLY_MACRO, St as evaluateZoneRules, Ut as modelBindingKey, Wn as hfModelUrl, X as applyModelBoundSettings, Xt as pipelineExecutorCapability, Zn as nodePin, _t as detectionPipelineCapability, cn as resolvePoolMemoryPolicy, ct as containingParentIndex, d as CLUSTER_MODEL_SCOPED_STEPS, dn as rootSuppliesOf, er as sleep, fn as runtimeDevices$1, fr as string, ft as defaultDeviceFor$1, g as DEFAULT_CLUSTER_STEP_SETTINGS, jn as errMsg$1, lr as object, mn as stepModelRunsOnFormat, mr as EventCategory, n as APPLE_SA_TO_MACRO, pr as union, q as YAMNET_TO_MACRO, qt as pickClusterStepSettings, rn as resolveClusterStepModelId, rr as array, st as collectModelBoundKeys, xt as enumerateInferenceDevices, yn as supportedRuntimes$1, zn as createEvent } from "../dist-BZ34hSbo.mjs";
+import { c as readProcessCost } from "../node-CJPdIMAm.mjs";
+import { C as resolveModelDefaultConfidence, S as landmarkPrecisionVerdict, _ as ALL_STEPS, b as getStepDefinition, f as localFrameRegistry, g as ALL_PIPELINE_STEPS, l as resolveDefaultDetectionModel, n as mergeCustomModels, o as deviceKeyOf, r as buildSubtreeCanRun, s as resolveDeviceEngine, t as CustomModelCatalog, u as macroGateVerdict, v as getDefaultModelForFormat, x as resolveModelForFormat, y as getStep } from "../custom-model-catalog-BWxCwQ1L.mjs";
 import { t as getSharp } from "../lazy-sharp-DXsqwpph.mjs";
-import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-1_2L6U3Q.mjs";
+import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-BPqkGyDA.mjs";
 import * as os$1 from "node:os";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/{dist-CsCflIM1.mjs → dist-BZ34hSbo.mjs}

@@ -7977,6 +7977,12 @@ function normalizeAddonInitResult(result) {
 	if (Array.isArray(result)) return { providers: result };
 	return result;
 }
+/**
+* The share-view scope kinds a `csv_*` share token can carry. The hub mints
+* and validates them (`share-token.service.ts` builds its enum from this
+* list); a data plane names the kinds it ACCEPTS in `share`.
+*/
+var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
 /** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
 var PeerBytesTicketSchema = object({
 	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
@@ -15278,6 +15284,229 @@ var ConvertResultSchema = object({
 		files: array(string()).readonly()
 	})).readonly()
 });
+/**
+* Zod schemas for persisted record types.
+*
+* These schemas serve as the single source of truth for types that are
+* stored in the settings-store backend and retrieved via tRPC. They
+* replace the manual TypeScript interfaces with schema-derived types,
+* enabling runtime validation when reading from the backend.
+*
+* Convention: each schema is named `<Type>Schema`, the inferred TS type
+* keeps the original name for backward compatibility.
+*/
+/**
+* Auth model (v2 — 2026-05-12 caps-only):
+*
+* Two principals:
+*   - `isAdmin: true`  — full bypass. Admin scope set is ignored.
+*   - `isAdmin: false` — every call gated by `scopes` (see TokenScope).
+*
+* No role enum. There used to be `viewer / agent / scoped` and earlier
+* `super_admin` — collapsed onto the single boolean because every
+* non-admin caller is governed by the same scope-check rules; the
+* distinction was only ever used to route role-specific procedures
+* which we no longer have. CLI / webhook integrations are `cst_*` tokens
+* with `isAdmin: false` + an explicit scope list.
+*/
+/** Per-method access flavour. Materialised on every cap method via codegen. */
+var MethodAccessSchema = _enum([
+	"view",
+	"create",
+	"delete"
+]);
+/**
+* A single scope grant. Three forms — checked in matcher with OR
+* semantics; the first match decides whether the call passes:
+*
+*   - `category` — broadest. `target: 'device' | 'system'` selects every
+*     cap with the matching `scope` declaration. New caps inherit grants
+*     automatically — adding a device cap to the codebase makes it
+*     reachable to every user with `category:device [...]` without a
+*     re-grant. Use this for "family viewer" / "operator" tiers.
+*
+*   - `addon` — every cap that ships inside a given addon id. Niche;
+*     useful when an integration needs to interact with one specific
+*     addon's surface regardless of how many caps it exports.
+*
+*   - `capability` — the most precise form. Single cap name. Use for
+*     integration tokens where you want to grant `addons.installPackage`
+*     and nothing else.
+*
+* `access` is REQUIRED with min 1 element. `admin` bypass is the
+* "give me everything" escape; there is no wildcard scope.
+*/
+var AllowedProviderSchema = union([literal("*"), array(string())]);
+var AllowedDevicesSchema = record(string(), union([literal("*"), array(string())]));
+var CapScopeSchema = _enum(["device", "system"]);
+/**
+* DeviceSelector (scope model v3 — 2026-08-12).
+*
+* A `device` grant no longer carries a frozen list of deviceIds. It carries
+* a SELECTOR the matcher resolves against the live fleet, so the grant can be
+* DYNAMIC: a `types:['camera']` selector automatically covers a camera added
+* AFTER the grant was minted — no re-grant, no re-login.
+*
+*   - `all`       — every device in the deployment. The broad viewer/operator
+*     lever without a `category` grant (a `category` grant also covers device
+*     caps that carry no deviceId; `all` is specifically the device set).
+*   - `ids`       — an explicit deviceId list. This is what a v2 `device:[…]`
+*     grant migrates to (see {@link TokenScopeSchema}); STATIC — a new camera
+*     is NOT covered until the grant is edited.
+*   - `types`     — every device of a `DeviceType` (e.g. every `camera`).
+*     DYNAMIC. A device that changes type, or a new device of the type,
+*     re-resolves on the next request.
+*   - `locations` — every device whose operator-assigned `location` label is
+*     in the set (e.g. "Garden", "Front door"). DYNAMIC. A device with a
+*     null/unset location matches NO `locations` selector.
+*/
+var DeviceSelectorSchema = discriminatedUnion("kind", [
+	object({ kind: literal("all") }),
+	object({
+		kind: literal("ids"),
+		ids: array(number().int()).min(1)
+	}),
+	object({
+		kind: literal("types"),
+		types: array(_enum(DeviceType)).min(1)
+	}),
+	object({
+		kind: literal("locations"),
+		locations: array(string().min(1)).min(1)
+	})
+]);
+var DeviceTokenScopeSchema = object({
+	type: literal("device"),
+	/** The device SET this grant covers — resolved against the live fleet. */
+	selector: DeviceSelectorSchema,
+	access: array(MethodAccessSchema).min(1),
+	/**
+	* Whether a grant on a PARENT device transparently covers its accessory
+	* CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
+	* Direction is parent → children ONLY.
+	*
+	* Absent → the matcher DERIVES it from the access flavour: `view`
+	* inherits (a camera viewer sees the camera's accessories), `create` /
+	* `delete` do NOT (actuating/removing a child is an explicit act the
+	* operator must grant on the child, not inherit from the parent). Set it
+	* explicitly to override that default per grant.
+	*/
+	includeLinked: boolean().optional()
+});
+/**
+* v2 → v3 lazy migration. A pre-v3 `device` grant carried
+* `targets: string[]` (stringified deviceIds); it rewrites to the equivalent
+* `selector: {kind:'ids', ids}`. Applied as a `preprocess` so it runs on
+* EVERY parse path — stored records AND the JWT-carried scope arrays
+* normalised at the request boundary ({@link normalizeTokenScopes} in
+* `device-selector.ts`). Chosen over a one-time DB migration because a
+* migration cannot reach a JWT already in a client's hands; parse-time
+* migration covers both without a flag day. No cast — the raw object is read
+* through `Reflect.get` (its static type is `unknown`).
+*/
+function migrateLegacyTokenScope(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
+	if (Reflect.get(raw, "type") !== "device") return raw;
+	if (Reflect.get(raw, "selector") !== void 0) return raw;
+	const targets = Reflect.get(raw, "targets");
+	if (!Array.isArray(targets)) return raw;
+	return {
+		type: "device",
+		selector: {
+			kind: "ids",
+			ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
+		},
+		access: Reflect.get(raw, "access")
+	};
+}
+var TokenScopeSchema = preprocess(migrateLegacyTokenScope, discriminatedUnion("type", [
+	object({
+		type: literal("category"),
+		target: CapScopeSchema,
+		access: array(MethodAccessSchema).min(1)
+	}),
+	object({
+		type: literal("capability"),
+		target: string(),
+		access: array(MethodAccessSchema).min(1)
+	}),
+	object({
+		type: literal("addon"),
+		target: string(),
+		access: array(MethodAccessSchema).min(1)
+	}),
+	DeviceTokenScopeSchema
+]));
+object({
+	id: string(),
+	username: string(),
+	passwordHash: string(),
+	/**
+	* Admin bypass. When true, the middleware skips the scope-access
+	* check entirely. There is no other axis of privilege; the legacy
+	* role enum collapsed onto this boolean in v2.
+	*/
+	isAdmin: boolean().default(false),
+	allowedProviders: AllowedProviderSchema,
+	allowedDevices: AllowedDevicesSchema,
+	/**
+	* Scopes granted to this user. Admins bypass; their `scopes` is
+	* ignored. Non-admins without scopes are locked out of every
+	* protected call.
+	*/
+	scopes: array(TokenScopeSchema).default([]),
+	createdAt: number(),
+	updatedAt: number()
+});
+object({
+	id: string(),
+	label: string(),
+	isAdmin: boolean().default(false),
+	allowedProviders: AllowedProviderSchema,
+	allowedDevices: AllowedDevicesSchema,
+	tokenHash: string(),
+	tokenPrefix: string(),
+	createdAt: number(),
+	lastUsedAt: number().optional()
+});
+object({
+	id: string(),
+	userId: string(),
+	name: string(),
+	tokenHash: string(),
+	tokenPrefix: string(),
+	scopes: array(TokenScopeSchema),
+	expiresAt: number().nullish(),
+	lastUsedAt: number().nullish(),
+	createdAt: number()
+});
+/** What a share-view grant lets its holder see. */
+var ShareViewGrantSchema = object({
+	kind: _enum(SHARE_VIEW_KINDS),
+	deviceIds: array(number().int().nonnegative()).min(1).max(64),
+	/** Talk-back, opt-in at mint time; absent means off. */
+	talk: boolean().optional()
+});
+var ShareViewScopeSchema = object({
+	type: literal("share-view"),
+	grant: ShareViewGrantSchema
+});
+var AddonRoutesScopeSchema = object({
+	type: literal("addon-routes"),
+	access: array(MethodAccessSchema).min(1)
+});
+var CredentialScopeSchema = union([
+	literal("*"),
+	ShareViewScopeSchema,
+	AddonRoutesScopeSchema,
+	TokenScopeSchema
+]);
+object({
+	kind: literal("credential"),
+	sub: string().min(1),
+	jti: string().min(16),
+	scopes: array(CredentialScopeSchema).min(1)
+});
 _enum(["new-session", "step-up"]);
 /** The languages the hub's app landing pages are written in (D858). */
 var AppPageLangSchema = _enum(["en", "it"]);
@@ -47332,202 +47561,6 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 	auth: "admin"
 }), method(NcAlarmSensorsInputSchema, NcAlarmSensorsSchema, { auth: "admin" });
 /**
-* Zod schemas for persisted record types.
-*
-* These schemas serve as the single source of truth for types that are
-* stored in the settings-store backend and retrieved via tRPC. They
-* replace the manual TypeScript interfaces with schema-derived types,
-* enabling runtime validation when reading from the backend.
-*
-* Convention: each schema is named `<Type>Schema`, the inferred TS type
-* keeps the original name for backward compatibility.
-*/
-/**
-* Auth model (v2 — 2026-05-12 caps-only):
-*
-* Two principals:
-*   - `isAdmin: true`  — full bypass. Admin scope set is ignored.
-*   - `isAdmin: false` — every call gated by `scopes` (see TokenScope).
-*
-* No role enum. There used to be `viewer / agent / scoped` and earlier
-* `super_admin` — collapsed onto the single boolean because every
-* non-admin caller is governed by the same scope-check rules; the
-* distinction was only ever used to route role-specific procedures
-* which we no longer have. CLI / webhook integrations are `cst_*` tokens
-* with `isAdmin: false` + an explicit scope list.
-*/
-/** Per-method access flavour. Materialised on every cap method via codegen. */
-var MethodAccessSchema = _enum([
-	"view",
-	"create",
-	"delete"
-]);
-/**
-* A single scope grant. Three forms — checked in matcher with OR
-* semantics; the first match decides whether the call passes:
-*
-*   - `category` — broadest. `target: 'device' | 'system'` selects every
-*     cap with the matching `scope` declaration. New caps inherit grants
-*     automatically — adding a device cap to the codebase makes it
-*     reachable to every user with `category:device [...]` without a
-*     re-grant. Use this for "family viewer" / "operator" tiers.
-*
-*   - `addon` — every cap that ships inside a given addon id. Niche;
-*     useful when an integration needs to interact with one specific
-*     addon's surface regardless of how many caps it exports.
-*
-*   - `capability` — the most precise form. Single cap name. Use for
-*     integration tokens where you want to grant `addons.installPackage`
-*     and nothing else.
-*
-* `access` is REQUIRED with min 1 element. `admin` bypass is the
-* "give me everything" escape; there is no wildcard scope.
-*/
-var AllowedProviderSchema = union([literal("*"), array(string())]);
-var AllowedDevicesSchema = record(string(), union([literal("*"), array(string())]));
-var CapScopeSchema = _enum(["device", "system"]);
-/**
-* DeviceSelector (scope model v3 — 2026-08-12).
-*
-* A `device` grant no longer carries a frozen list of deviceIds. It carries
-* a SELECTOR the matcher resolves against the live fleet, so the grant can be
-* DYNAMIC: a `types:['camera']` selector automatically covers a camera added
-* AFTER the grant was minted — no re-grant, no re-login.
-*
-*   - `all`       — every device in the deployment. The broad viewer/operator
-*     lever without a `category` grant (a `category` grant also covers device
-*     caps that carry no deviceId; `all` is specifically the device set).
-*   - `ids`       — an explicit deviceId list. This is what a v2 `device:[…]`
-*     grant migrates to (see {@link TokenScopeSchema}); STATIC — a new camera
-*     is NOT covered until the grant is edited.
-*   - `types`     — every device of a `DeviceType` (e.g. every `camera`).
-*     DYNAMIC. A device that changes type, or a new device of the type,
-*     re-resolves on the next request.
-*   - `locations` — every device whose operator-assigned `location` label is
-*     in the set (e.g. "Garden", "Front door"). DYNAMIC. A device with a
-*     null/unset location matches NO `locations` selector.
-*/
-var DeviceSelectorSchema = discriminatedUnion("kind", [
-	object({ kind: literal("all") }),
-	object({
-		kind: literal("ids"),
-		ids: array(number().int()).min(1)
-	}),
-	object({
-		kind: literal("types"),
-		types: array(_enum(DeviceType)).min(1)
-	}),
-	object({
-		kind: literal("locations"),
-		locations: array(string().min(1)).min(1)
-	})
-]);
-var DeviceTokenScopeSchema = object({
-	type: literal("device"),
-	/** The device SET this grant covers — resolved against the live fleet. */
-	selector: DeviceSelectorSchema,
-	access: array(MethodAccessSchema).min(1),
-	/**
-	* Whether a grant on a PARENT device transparently covers its accessory
-	* CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
-	* Direction is parent → children ONLY.
-	*
-	* Absent → the matcher DERIVES it from the access flavour: `view`
-	* inherits (a camera viewer sees the camera's accessories), `create` /
-	* `delete` do NOT (actuating/removing a child is an explicit act the
-	* operator must grant on the child, not inherit from the parent). Set it
-	* explicitly to override that default per grant.
-	*/
-	includeLinked: boolean().optional()
-});
-/**
-* v2 → v3 lazy migration. A pre-v3 `device` grant carried
-* `targets: string[]` (stringified deviceIds); it rewrites to the equivalent
-* `selector: {kind:'ids', ids}`. Applied as a `preprocess` so it runs on
-* EVERY parse path — stored records AND the JWT-carried scope arrays
-* normalised at the request boundary ({@link normalizeTokenScopes} in
-* `device-selector.ts`). Chosen over a one-time DB migration because a
-* migration cannot reach a JWT already in a client's hands; parse-time
-* migration covers both without a flag day. No cast — the raw object is read
-* through `Reflect.get` (its static type is `unknown`).
-*/
-function migrateLegacyTokenScope(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
-	if (Reflect.get(raw, "type") !== "device") return raw;
-	if (Reflect.get(raw, "selector") !== void 0) return raw;
-	const targets = Reflect.get(raw, "targets");
-	if (!Array.isArray(targets)) return raw;
-	return {
-		type: "device",
-		selector: {
-			kind: "ids",
-			ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
-		},
-		access: Reflect.get(raw, "access")
-	};
-}
-var TokenScopeSchema = preprocess(migrateLegacyTokenScope, discriminatedUnion("type", [
-	object({
-		type: literal("category"),
-		target: CapScopeSchema,
-		access: array(MethodAccessSchema).min(1)
-	}),
-	object({
-		type: literal("capability"),
-		target: string(),
-		access: array(MethodAccessSchema).min(1)
-	}),
-	object({
-		type: literal("addon"),
-		target: string(),
-		access: array(MethodAccessSchema).min(1)
-	}),
-	DeviceTokenScopeSchema
-]));
-object({
-	id: string(),
-	username: string(),
-	passwordHash: string(),
-	/**
-	* Admin bypass. When true, the middleware skips the scope-access
-	* check entirely. There is no other axis of privilege; the legacy
-	* role enum collapsed onto this boolean in v2.
-	*/
-	isAdmin: boolean().default(false),
-	allowedProviders: AllowedProviderSchema,
-	allowedDevices: AllowedDevicesSchema,
-	/**
-	* Scopes granted to this user. Admins bypass; their `scopes` is
-	* ignored. Non-admins without scopes are locked out of every
-	* protected call.
-	*/
-	scopes: array(TokenScopeSchema).default([]),
-	createdAt: number(),
-	updatedAt: number()
-});
-object({
-	id: string(),
-	label: string(),
-	isAdmin: boolean().default(false),
-	allowedProviders: AllowedProviderSchema,
-	allowedDevices: AllowedDevicesSchema,
-	tokenHash: string(),
-	tokenPrefix: string(),
-	createdAt: number(),
-	lastUsedAt: number().optional()
-});
-object({
-	id: string(),
-	userId: string(),
-	name: string(),
-	tokenHash: string(),
-	tokenPrefix: string(),
-	scopes: array(TokenScopeSchema),
-	expiresAt: number().nullish(),
-	lastUsedAt: number().nullish(),
-	createdAt: number()
-});
-/**
 * `oauth-integration` — a collection cap by which an addon declares
 * itself a linkable OAuth client of the hub's core `/oauth2/*` server.
 * Each provider returns a static descriptor; the core enumerates them