@camstack/addon-post-analysis 1.2.143 → 1.2.145

package/dist/{dist-J3TQ_8D1.mjs → dist-3FJkk7Mx.mjs}

@@ -26449,6 +26449,33 @@ var intercomCapability = {
 	deviceNative: true,
 	mode: "singleton",
 	deviceTypes: [DeviceType.Camera],
+	/**
+	* **Auth tier: `protected` on every method — deliberate, and load-bearing.**
+	*
+	* Talking through a camera is an OPERATE action, not a CONFIGURE one. This
+	* cap has no configuration surface at all: all six methods open, feed and
+	* close one live audio session against one `deviceId`. That is the same
+	* authority as `ptz.move` or `snapshot.getSnapshot`, both `protected` — and
+	* the opposite of `ptz.savePreset` / `snapshot.invalidateCache`, which are
+	* `admin` because they change what the device IS.
+	*
+	* `protected` does not mean ungated: `protectedProcedure` runs the
+	* `METHOD_ACCESS_MAP` scope check, and every method here is `scope: 'device'`
+	* with `access: 'create'` and a `deviceId` in its input. So a caller needs a
+	* grant that covers THAT camera at `create` — a `camera-viewer` (`view`
+	* only) still cannot talk, and a grant on camera 5 cannot talk through
+	* camera 7.
+	*
+	* Every method was `auth: 'admin'` from the initial commit, which made the
+	* cap unreachable by every non-admin principal — `adminProcedure` throws
+	* `FORBIDDEN: Admin required` BEFORE the scope check runs, so the scope
+	* machinery generated for this cap (`METHOD_ACCESS_MAP`,
+	* `DEVICE_SCOPED_CAPS`, `METHOD_DEVICE_SELECTORS`) was complete and dead. The
+	* `camera-operator` scope preset has promised "PTZ control, intercom,
+	* snapshots" since that same commit; the promise could not be kept. Recorded
+	* as D289; `scripts/check-scope-preset-promises.ts` now fails the build if a
+	* preset promises a cap no row of that preset can reach.
+	*/
 	methods: {
 		/**
 		* Open a server-side WebRTC audio-only session. Returns an SDP
@@ -26461,7 +26488,7 @@ var intercomCapability = {
 			sdpOffer: string()
 		}), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		handleAnswer: method(object({
 			deviceId: number(),
@@ -26469,7 +26496,7 @@ var intercomCapability = {
 			sdpAnswer: string()
 		}), _void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/** Close explicitly. Server also auto-closes on 30s idle. */
 		stopSession: method(object({
@@ -26477,7 +26504,7 @@ var intercomCapability = {
 			sessionId: string()
 		}), _void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/**
 		* Open a raw-PCM talk session (no WebRTC SDP plumbing). Used by
@@ -26490,7 +26517,7 @@ var intercomCapability = {
 		*/
 		startTalkSession: method(object({ deviceId: number() }), object({ sessionId: string() }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/**
 		* Push one chunk of talk-back audio onto the active talk session.
@@ -26525,12 +26552,12 @@ var intercomCapability = {
 			sequenceNumber: number().int()
 		}), object({ accepted: boolean() }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/** Close the raw-PCM talk session. Idempotent. */
 		endTalkSession: method(object({ deviceId: number() }), _void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		})
 	},
 	events: { onStatusChanged: { data: object({

package/dist/{dist-BBDJh7ln.js → dist-C8RL0Hzy.js}

@@ -26480,6 +26480,33 @@ var intercomCapability = {
 	deviceNative: true,
 	mode: "singleton",
 	deviceTypes: [DeviceType.Camera],
+	/**
+	* **Auth tier: `protected` on every method — deliberate, and load-bearing.**
+	*
+	* Talking through a camera is an OPERATE action, not a CONFIGURE one. This
+	* cap has no configuration surface at all: all six methods open, feed and
+	* close one live audio session against one `deviceId`. That is the same
+	* authority as `ptz.move` or `snapshot.getSnapshot`, both `protected` — and
+	* the opposite of `ptz.savePreset` / `snapshot.invalidateCache`, which are
+	* `admin` because they change what the device IS.
+	*
+	* `protected` does not mean ungated: `protectedProcedure` runs the
+	* `METHOD_ACCESS_MAP` scope check, and every method here is `scope: 'device'`
+	* with `access: 'create'` and a `deviceId` in its input. So a caller needs a
+	* grant that covers THAT camera at `create` — a `camera-viewer` (`view`
+	* only) still cannot talk, and a grant on camera 5 cannot talk through
+	* camera 7.
+	*
+	* Every method was `auth: 'admin'` from the initial commit, which made the
+	* cap unreachable by every non-admin principal — `adminProcedure` throws
+	* `FORBIDDEN: Admin required` BEFORE the scope check runs, so the scope
+	* machinery generated for this cap (`METHOD_ACCESS_MAP`,
+	* `DEVICE_SCOPED_CAPS`, `METHOD_DEVICE_SELECTORS`) was complete and dead. The
+	* `camera-operator` scope preset has promised "PTZ control, intercom,
+	* snapshots" since that same commit; the promise could not be kept. Recorded
+	* as D289; `scripts/check-scope-preset-promises.ts` now fails the build if a
+	* preset promises a cap no row of that preset can reach.
+	*/
 	methods: {
 		/**
 		* Open a server-side WebRTC audio-only session. Returns an SDP
@@ -26492,7 +26519,7 @@ var intercomCapability = {
 			sdpOffer: string()
 		}), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		handleAnswer: method(object({
 			deviceId: number(),
@@ -26500,7 +26527,7 @@ var intercomCapability = {
 			sdpAnswer: string()
 		}), _void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/** Close explicitly. Server also auto-closes on 30s idle. */
 		stopSession: method(object({
@@ -26508,7 +26535,7 @@ var intercomCapability = {
 			sessionId: string()
 		}), _void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/**
 		* Open a raw-PCM talk session (no WebRTC SDP plumbing). Used by
@@ -26521,7 +26548,7 @@ var intercomCapability = {
 		*/
 		startTalkSession: method(object({ deviceId: number() }), object({ sessionId: string() }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/**
 		* Push one chunk of talk-back audio onto the active talk session.
@@ -26556,12 +26583,12 @@ var intercomCapability = {
 			sequenceNumber: number().int()
 		}), object({ accepted: boolean() }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/** Close the raw-PCM talk session. Idempotent. */
 		endTalkSession: method(object({ deviceId: number() }), _void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		})
 	},
 	events: { onStatusChanged: { data: object({

package/dist/embedding-encoder/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-BBDJh7ln.js");
+const require_dist = require("../dist-C8RL0Hzy.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs);
 let node_path = require("node:path");

package/dist/embedding-encoder/index.mjs

@@ -1,4 +1,4 @@
-import { Dt as BaseAddon, P as PoolMemoryWatchdog, ct as hfModelUrl, it as embeddingEncoderCapability, pt as parseProcStatus, yt as resolvePoolMemoryPolicy } from "../dist-J3TQ_8D1.mjs";
+import { Dt as BaseAddon, P as PoolMemoryWatchdog, ct as hfModelUrl, it as embeddingEncoderCapability, pt as parseProcStatus, yt as resolvePoolMemoryPolicy } from "../dist-3FJkk7Mx.mjs";
 import { createRequire } from "node:module";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/pipeline-analytics/{_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-BjletSHg.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-Bb5cXFSY.mjs}

@@ -3,7 +3,7 @@ import "./dist-CYZr2fwk.mjs";
 var e = {
 	"@camstack/sdk": {
 		name: "@camstack/sdk",
-		version: "1.2.44",
+		version: "1.2.45",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_pipeline_analytics_widgets",
@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.122",
+		version: "1.2.123",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_pipeline_analytics_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.85",
+		version: "1.2.86",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_pipeline_analytics_widgets",

package/dist/pipeline-analytics/{hostInit-jM_s99eg.mjs → hostInit-Btr3CZPD.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.122",
+				version: "1.2.123",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -45,7 +45,7 @@ async function r() {
 				}
 			},
 			"@camstack/sdk": {
-				version: "1.2.44",
+				version: "1.2.45",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -81,7 +81,7 @@ async function r() {
 				}
 			},
 			"@camstack/ui-library": {
-				version: "1.2.85",
+				version: "1.2.86",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-BBDJh7ln.js");
+const require_dist = require("../dist-C8RL0Hzy.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as buildEventKindDescriptor, A as NcSnoozeSuppressedSchema, At as hydrateSchema, B as SCENE_DIVERGED, Bt as object, C as NcRuleInputSchema, Ct as vectorDimFromBase64, D as NcScheduleSchema, Dt as BaseAddon, E as NcRuleTargetSchema, Et as errMsg, F as RECORDING_EXPORT_MAX_READ_BYTES, Ft as array, G as TimelapseRuleSchema, Gt as EventCategory, H as TIMELAPSE_DENSE_FLOOR_SEC, Ht as record, I as RetrainStatusSchema, It as boolean, J as addonWidgetsSourceCapability, K as TrackSourceSchema, Lt as discriminatedUnion, M as NcTaxonomySchema, Mt as nodePin, N as OpsLogEntrySchema, Nt as sleep, O as NcSnoozeInputSchema, Ot as DeviceType, Pt as _enum, Q as audioModeOf, R as SCENE_DEFAULT_ANCHOR_THRESHOLD, Rt as literal, S as NcConditionDescriptorSchema, St as systemEventFilterApplies, T as NcRuleSchema, Tt as zoneAnalyticsCapability, U as TimelapseRuleInputSchema, Ut as string, V as SceneMonitorSchema, Vt as partialRecord, W as TimelapseRulePatchSchema, Wt as unknown, X as assertTimelapseCadences, Y as alarmPanelCapability, Z as audioMetricsCapability, _ as NC_ALARM_SYSTEM_EVENT_KINDS, _t as readDeviceStateFrom, a as COCO_TO_MACRO, at as encodeVectorBase64, bt as sceneMonitorCapability, c as DETECTION_MACRO_CLASSES, d as EVENT_KIND_BY_CAP, dt as kebabToCamel, et as cosineSimilarity$1, f as EVENT_PAD_MS, ft as notificationRulesCapability, g as MACRO_LABELS, gt as plateGalleryCapability, h as LabelAttributionSchema, ht as pipelineAnalyticsCapability, i as CLUSTER_MODEL_SCOPED_STEPS, j as NcSystemEventKindSchema, jt as isDeviceScopedCap, k as NcSnoozeSchema, kt as createEvent, lt as isDetectionMacroClass, m as FailureCounters, mt as pickClusterStepModels, n as AnalyticsGroupRecordSchema, nt as defineCustomActions, o as DEFAULT_EVENT_COLOR, ot as faceGalleryCapability, p as FULL_IMAGE_BBOX, q as VISIT_MERGE_GAP_MS, r as BaseDevice, rt as deriveRecordingMode, st as failureContributionCapability, t as AnalyticsGroupDetailSchema, tt as customAction, u as DeclaredDevices, ut as isScheduleActive, v as NC_CONDITION_CATALOG, vt as readTimelapseGeneratedAt, w as NcRulePatchSchema, wt as videoclipsCapability, x as NC_TAXONOMY, xt as subKindsOf, y as NC_DEFAULT_SNOOZE_MINUTES, z as SCENE_DEFAULT_UNCOVERED_POLICY, zt as number } from "../dist-J3TQ_8D1.mjs";
+import { $ as buildEventKindDescriptor, A as NcSnoozeSuppressedSchema, At as hydrateSchema, B as SCENE_DIVERGED, Bt as object, C as NcRuleInputSchema, Ct as vectorDimFromBase64, D as NcScheduleSchema, Dt as BaseAddon, E as NcRuleTargetSchema, Et as errMsg, F as RECORDING_EXPORT_MAX_READ_BYTES, Ft as array, G as TimelapseRuleSchema, Gt as EventCategory, H as TIMELAPSE_DENSE_FLOOR_SEC, Ht as record, I as RetrainStatusSchema, It as boolean, J as addonWidgetsSourceCapability, K as TrackSourceSchema, Lt as discriminatedUnion, M as NcTaxonomySchema, Mt as nodePin, N as OpsLogEntrySchema, Nt as sleep, O as NcSnoozeInputSchema, Ot as DeviceType, Pt as _enum, Q as audioModeOf, R as SCENE_DEFAULT_ANCHOR_THRESHOLD, Rt as literal, S as NcConditionDescriptorSchema, St as systemEventFilterApplies, T as NcRuleSchema, Tt as zoneAnalyticsCapability, U as TimelapseRuleInputSchema, Ut as string, V as SceneMonitorSchema, Vt as partialRecord, W as TimelapseRulePatchSchema, Wt as unknown, X as assertTimelapseCadences, Y as alarmPanelCapability, Z as audioMetricsCapability, _ as NC_ALARM_SYSTEM_EVENT_KINDS, _t as readDeviceStateFrom, a as COCO_TO_MACRO, at as encodeVectorBase64, bt as sceneMonitorCapability, c as DETECTION_MACRO_CLASSES, d as EVENT_KIND_BY_CAP, dt as kebabToCamel, et as cosineSimilarity$1, f as EVENT_PAD_MS, ft as notificationRulesCapability, g as MACRO_LABELS, gt as plateGalleryCapability, h as LabelAttributionSchema, ht as pipelineAnalyticsCapability, i as CLUSTER_MODEL_SCOPED_STEPS, j as NcSystemEventKindSchema, jt as isDeviceScopedCap, k as NcSnoozeSchema, kt as createEvent, lt as isDetectionMacroClass, m as FailureCounters, mt as pickClusterStepModels, n as AnalyticsGroupRecordSchema, nt as defineCustomActions, o as DEFAULT_EVENT_COLOR, ot as faceGalleryCapability, p as FULL_IMAGE_BBOX, q as VISIT_MERGE_GAP_MS, r as BaseDevice, rt as deriveRecordingMode, st as failureContributionCapability, t as AnalyticsGroupDetailSchema, tt as customAction, u as DeclaredDevices, ut as isScheduleActive, v as NC_CONDITION_CATALOG, vt as readTimelapseGeneratedAt, w as NcRulePatchSchema, wt as videoclipsCapability, x as NC_TAXONOMY, xt as subKindsOf, y as NC_DEFAULT_SNOOZE_MINUTES, z as SCENE_DEFAULT_UNCOVERED_POLICY, zt as number } from "../dist-3FJkk7Mx.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";

package/dist/pipeline-analytics/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-BjletSHg.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-Bb5cXFSY.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-post-analysis",
-  "version": "1.2.143",
+  "version": "1.2.145",
   "description": "Post-Analysis bundle — enrichment, embedding-encoder, pipeline-analytics. Multi-entry npm package shipping addons that consume pipeline output.",
   "keywords": [
     "camstack",