@camstack/addon-provider-velux 0.2.121 → 0.2.123

package/dist/addon.js

@@ -5370,7 +5370,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BNeXenvr.mjs
+//#region ../types/dist/sleep-B0JG7-_F.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -15192,6 +15192,10 @@ var DeviceInfoSchema = object({
 	isCamera: boolean(),
 	/** Current config values — serializable snapshot */
 	config: record(string(), unknown()),
+	/** Paths inside `config` the device's schema declares secret (D783) —
+	*  what the non-admin redaction withholds. Paths, never values. Absent
+	*  when the owning runner has not reported them. */
+	secretConfigPaths: array(string()).optional(),
 	/** Hardware + identity blob (manufacturer / model / firmware / sn /
 	*  uid / mac / …). Populated by drivers; editable via setMetadata. */
 	metadata: record(string(), unknown()).nullable().optional(),
@@ -15397,7 +15401,13 @@ var DeviceRegisterPayloadSchema = object({
 	*  call (workers re-register on init), so probe-driven updates
 	*  (e.g. PTZ flag flipping after the abilities probe) propagate. */
 	features: array(string()).optional(),
-	config: record(string(), unknown())
+	config: record(string(), unknown()),
+	/** Config paths the device's own schema DECLARES secret
+	*  (`.meta({ secret: true })` — dotted, `[]` for array items, e.g.
+	*  `connection.password`). Re-published on every register; the non-admin
+	*  redaction withholds them at any depth (D783). Optional: an older runner
+	*  omits it and the keyword backstop applies. */
+	secretConfigPaths: array(string()).optional()
 });
 var DeviceRemovePayloadSchema = object({ deviceId: number() });
 var DevicePersistConfigPayloadSchema = object({
@@ -17056,7 +17066,14 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		icon: string().optional(),
 		/** Addon-owned HTTP route the button navigates to (GET). */
 		startUrl: string(),
-		stage: LoginStageEnum
+		stage: LoginStageEnum,
+		/**
+		* The provider names an external identity a signed-in user can link to
+		* their own account (D782): `auth.listLinkableProviders` /
+		* `beginExternalLink` offer exactly the redirect methods that set this,
+		* whatever their id. Absent / false — a login button only (magic-link).
+		*/
+		linkable: boolean().optional()
 	}),
 	object({
 		kind: literal("widget"),
@@ -22491,7 +22508,13 @@ var RetrainFrameSchema = object({
 	sizeBytes: number().int(),
 	width: number().int(),
 	height: number().int(),
-	copiedAt: number()
+	copiedAt: number(),
+	/** When the CAMERA captured the frame. Absent on a copy taken before D785. */
+	capturedAt: number().optional(),
+	/** The operator's "every subject in this frame is boxed". Detector
+	*  evaluation keeps only complete frames: an unboxed subject would count as
+	*  a false positive. */
+	complete: boolean()
 });
 /** Why a copy-on-select could not be honoured — named, never a silent skip. */
 var RetrainCopyRefusalSchema = _enum([
@@ -22512,6 +22535,51 @@ var RetrainFrameListSchema = object({
 	/** What the page pre-selects — the native key frame when one survives. */
 	autoPickMediaId: number().int().optional()
 });
+/**
+* Which frames an annotated export carries. Every field narrows; an empty
+* filter is every annotated copy. A dataset VERSION is a frozen `frameIds`
+* list owned by whoever trains (the training orchestrator), so `frameIds` is
+* the primitive a version export uses; `batchId` re-selects what an earlier
+* export carried (`exportedInBatch`).
+*/
+var RetrainExportFilterSchema = object({
+	deviceIds: array(number()).optional(),
+	frameIds: array(string()).max(2e4).optional(),
+	batchId: string().optional(),
+	/** Only frames the operator marked complete (all subjects boxed). */
+	completeOnly: boolean().optional()
+});
+/**
+* `frames`: the full frame copies, boxes in `annotations.json`.
+* `crops`: additionally one JPEG per subject, cut with the runtime detail-crop
+* convention — the classifier layout.
+*/
+var RetrainExportLayoutSchema = _enum(["frames", "crops"]);
+/**
+* Where `writeRetrainArchive` streams the tar: one HTTP request whose body is
+* the archive, sent chunk by chunk. Covers a presigned PUT and a provider
+* addon's data-plane upload route alike. Headers are sent verbatim and never
+* logged.
+*/
+var RetrainArchiveTargetSchema = object({
+	kind: literal("http"),
+	method: _enum(["PUT", "POST"]),
+	url: string().url(),
+	headers: record(string(), string()).optional()
+});
+var RetrainArchiveResultSchema = object({
+	batchId: string(),
+	frames: number().int(),
+	crops: number().int(),
+	annotations: number().int(),
+	/** Frames planned but not shipped (unreadable copy, path too long). */
+	missing: number().int(),
+	bytes: number().int(),
+	/** sha256 of the exact bytes sent. */
+	sha256: string(),
+	/** The target's HTTP status. */
+	status: number().int()
+});
 /** What the operator asked the assist to look for. */
 var RetrainAssistSubjectSchema = discriminatedUnion("kind", [object({
 	kind: literal("package"),
@@ -23306,9 +23374,25 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), RetrainTransitionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
+}), method(RetrainExportFilterSchema.extend({ layout: RetrainExportLayoutSchema.optional() }), object({ url: string() }), {
 	kind: "query",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	frameId: string(),
+	complete: boolean()
+}), RetrainFrameSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	filter: RetrainExportFilterSchema,
+	layout: RetrainExportLayoutSchema,
+	target: RetrainArchiveTargetSchema
+}), RetrainArchiveResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 60 * 6e4
 }), method(object({
 	/** Which of the three event tables owns the row. */
 	ownerType: EventOwnerTypeSchema,
@@ -26638,7 +26722,19 @@ var SsoBridgeClaimsSchema = object({
 	* editing a descriptor must not retroactively extend or shorten a link the
 	* operator already consented to.
 	*/
-	refreshTtl: union([number().int().positive(), literal("never")]).optional()
+	refreshTtl: union([number().int().positive(), literal("never")]).optional(),
+	/**
+	* Opaque handle of a hub-side LINK intent (D782). Set by an OIDC callback
+	* that was started from a signed-in user's "Link" button: the finish then
+	* links this identity to the intent's user instead of signing anyone in.
+	* The handle carries no user id — the hub resolves it, single-use.
+	*/
+	linkIntent: string().optional(),
+	/**
+	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
+	* subject is unique only per issuer, so a link is bound to it.
+	*/
+	issuer: string().optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
@@ -28573,7 +28669,22 @@ DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), ar
 	* field their hints were silently stripped by the schema and the
 	* adaptive ladder started blind on the client's display size.
 	*/
-	hints: webrtcClientHintsSchema.optional()
+	hints: webrtcClientHintsSchema.optional(),
+	/**
+	* Talk-back (D771): relay the PEER's audio to the device's speaker
+	* through the `intercom` cap's push-talk triple. When `true` and the
+	* offer lets the peer send audio, the answer's audio is `sendrecv`
+	* and every inbound frame goes to `intercom.pushTalkAudio` for this
+	* `deviceId`; absent/false answers `sendonly`, as for every viewer.
+	*
+	* TRUSTED-CALLER ONLY. Set by the Alexa export for an Echo on a camera
+	* with `intercom`, when the linked user may control that camera. The
+	* hub STRIPS it from every request-bound call (a browser), exactly as
+	* it overwrites `relayOnly` — a viewer's talk permission is the
+	* intercom cap's own surface (share tokens gate it there), and this
+	* flag must not become a second door to the camera's speaker.
+	*/
+	talkback: boolean().optional()
 }), object({
 	sessionId: string(),
 	sdpAnswer: string()
@@ -28875,6 +28986,59 @@ var AddonAutoUpdateSchema = ChannelWithInheritSchema;
 var RestartAddonResultSchema = unknown();
 var InstallPackageResultSchema = unknown();
 var ReloadPackagesResultSchema = unknown();
+/**
+* What an uninstall did on ONE node.
+*  - `uninstalled`       — removed: runner(s) stopped, caps gone, code deleted.
+*  - `not-installed`     — the node did not have it (nothing to do).
+*  - `refused`           — protected / bootstrap package; nothing touched.
+*  - `failed`            — attempted and did not complete; `error` says why.
+*  - `pending-reconnect` — the node is OFFLINE: its record was pruned so the
+*    back-fill never returns the package, and the stale-addon sweep removes the
+*    copy when the node registers again (only once the hub no longer has it).
+*/
+var UninstallNodeOutcomeSchema = _enum([
+	"uninstalled",
+	"not-installed",
+	"refused",
+	"failed",
+	"pending-reconnect"
+]);
+var UninstallNodeResultSchema = object({
+	nodeId: string(),
+	outcome: UninstallNodeOutcomeSchema,
+	error: string().optional(),
+	addonIds: array(string()).readonly(),
+	runnersStopped: array(string()).readonly(),
+	warnings: array(string()).readonly()
+});
+var UninstallPackageResultSchema = object({
+	/** Every targeted node ended `uninstalled`, `not-installed` or `pending-reconnect`. */
+	success: boolean(),
+	packageName: string(),
+	results: array(UninstallNodeResultSchema).readonly()
+});
+/**
+* `unreachable` lists online agents whose status read FAILED — absence from
+* `installations` is only "not installed" for a node that answered (D315).
+*/
+var PackageInstallationsSchema = object({
+	installations: array(object({
+		packageName: string(),
+		nodeId: string(),
+		nodeName: string(),
+		isHub: boolean(),
+		isOnline: boolean(),
+		version: string().nullable(),
+		addonIds: array(string()).readonly(),
+		source: _enum(["live", "recorded"]),
+		/** The hub installs this package too. `false` on an agent row = an orphan. */
+		onHub: boolean()
+	})).readonly(),
+	unreachable: array(object({
+		nodeId: string(),
+		error: string()
+	})).readonly()
+});
 var BulkUpdateItemStatusSchema = _enum([
 	"queued",
 	"updating",
@@ -28957,10 +29121,14 @@ method(_void(), array(AddonListItemSchema).readonly()), method(object({
 }), method(object({ packageName: string() }), InstallPackageResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), boolean()), method(_void(), array(unknown()).readonly()), method(object({ packageName: string() }), unknown(), {
+}), method(_void(), boolean()), method(_void(), array(unknown()).readonly()), method(object({
+	packageName: string().min(1),
+	nodeId: string().optional(),
+	everywhere: boolean().optional()
+}), UninstallPackageResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), ReloadPackagesResultSchema, {
+}), method(object({ packageName: string().optional() }), PackageInstallationsSchema, { auth: "admin" }), method(_void(), ReloadPackagesResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ query: string().optional() }), array(SearchResultSchema)), method(object({ nodeId: string().optional() }), array(PackageUpdateSchema).readonly(), { auth: "admin" }), method(object({
@@ -38870,6 +39038,32 @@ var TotpStatusSchema = object({
 	/** Null when no row exists OR the row is still pending confirmation. */
 	confirmedAt: number().nullable()
 });
+/**
+* user-management — singleton capability for user accounts, API keys,
+* and scoped tokens.
+*
+* v2 model: every method gated by `auth: 'admin'`. Admin-only delegation
+* — the subset check on `setUserScopes` / `createScopedToken` is moot
+* because non-admins never reach these. If/when we open non-admin
+* delegation, structural caller-scope subset check goes inside the
+* provider.
+*/
+var ExternalIdentitySchema = object({
+	/** Login-method id of the provider instance, e.g. `auth-oidc/authentik`. */
+	provider: string(),
+	/** The IdP's stable subject (`sub`) for this account. */
+	subject: string(),
+	/** The verified `iss` of the IdP the identity was linked under — `sub` is unique only per issuer. */
+	issuer: string(),
+	userId: string(),
+	/** What the IdP called the account at link time (username / email) — display only. */
+	label: string().optional(),
+	linkedAt: number()
+});
+var ExternalIdentityKeySchema = object({
+	provider: string().min(1),
+	subject: string().min(1)
+});
 method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserInputSchema, UserSummarySchema, {
 	kind: "mutation",
 	auth: "admin",
@@ -38983,7 +39177,22 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	userId: string(),
 	username: string(),
 	scopes: array(TokenScopeSchema)
-}).nullable(), { access: "view" }), method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }), method(object({ id: string() }), object({ success: boolean() }), {
+}).nullable(), { access: "view" }), method(object({ userId: string() }), array(ExternalIdentitySchema), { auth: "admin" }), method(ExternalIdentityKeySchema, object({
+	userId: string(),
+	issuer: string()
+}).nullable(), { auth: "admin" }), method(ExternalIdentityKeySchema.extend({
+	userId: string(),
+	issuer: string().min(1),
+	label: string().optional()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "create"
+}), method(ExternalIdentityKeySchema.extend({ userId: string() }), object({ success: boolean() }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "delete"
+}), method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }), method(object({ id: string() }), object({ success: boolean() }), {
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
@@ -41393,6 +41602,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"addons.listInstallations": {
+		capName: "addons",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"addons.listJobs": {
 		capName: "addons",
 		capScope: "system",
@@ -45617,6 +45832,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.setRetrainFrameComplete": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -45653,6 +45874,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.writeRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineExecutor.cacheFrameInPool": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -48005,18 +48232,36 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userManagement.findUserByExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.getTotpStatus": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.linkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.listExternalIdentities": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.listOauthSessions": {
 		capName: "user-management",
 		capScope: "system",
@@ -48095,6 +48340,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userManagement.unlinkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"userManagement.updateUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -51434,6 +51685,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.setRetrainFrameComplete": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.setTrackFlags": [{
 		name: "deviceId",
 		form: "single",
@@ -53496,7 +53752,7 @@ var MB = 1024 * 1024;
 */
 var veluxConnectionSchema = object({
 	host: string().min(1).describe("KLF-200 host name or IP address"),
-	password: string().default("").describe("KLF-200 WiFi/web password (printed on the back of the unit)"),
+	password: string().default("").describe("KLF-200 WiFi/web password (printed on the back of the unit)").meta({ secret: true }),
 	pollIntervalMs: preprocess((v) => v === "" || v === null ? void 0 : v, number().int().min(2e3).max(36e5).default(3e4)).describe("Node-state poll interval (ms)")
 });
 /**

package/dist/addon.mjs

@@ -5369,7 +5369,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BNeXenvr.mjs
+//#region ../types/dist/sleep-B0JG7-_F.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -15191,6 +15191,10 @@ var DeviceInfoSchema = object({
 	isCamera: boolean(),
 	/** Current config values — serializable snapshot */
 	config: record(string(), unknown()),
+	/** Paths inside `config` the device's schema declares secret (D783) —
+	*  what the non-admin redaction withholds. Paths, never values. Absent
+	*  when the owning runner has not reported them. */
+	secretConfigPaths: array(string()).optional(),
 	/** Hardware + identity blob (manufacturer / model / firmware / sn /
 	*  uid / mac / …). Populated by drivers; editable via setMetadata. */
 	metadata: record(string(), unknown()).nullable().optional(),
@@ -15396,7 +15400,13 @@ var DeviceRegisterPayloadSchema = object({
 	*  call (workers re-register on init), so probe-driven updates
 	*  (e.g. PTZ flag flipping after the abilities probe) propagate. */
 	features: array(string()).optional(),
-	config: record(string(), unknown())
+	config: record(string(), unknown()),
+	/** Config paths the device's own schema DECLARES secret
+	*  (`.meta({ secret: true })` — dotted, `[]` for array items, e.g.
+	*  `connection.password`). Re-published on every register; the non-admin
+	*  redaction withholds them at any depth (D783). Optional: an older runner
+	*  omits it and the keyword backstop applies. */
+	secretConfigPaths: array(string()).optional()
 });
 var DeviceRemovePayloadSchema = object({ deviceId: number() });
 var DevicePersistConfigPayloadSchema = object({
@@ -17055,7 +17065,14 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		icon: string().optional(),
 		/** Addon-owned HTTP route the button navigates to (GET). */
 		startUrl: string(),
-		stage: LoginStageEnum
+		stage: LoginStageEnum,
+		/**
+		* The provider names an external identity a signed-in user can link to
+		* their own account (D782): `auth.listLinkableProviders` /
+		* `beginExternalLink` offer exactly the redirect methods that set this,
+		* whatever their id. Absent / false — a login button only (magic-link).
+		*/
+		linkable: boolean().optional()
 	}),
 	object({
 		kind: literal("widget"),
@@ -22490,7 +22507,13 @@ var RetrainFrameSchema = object({
 	sizeBytes: number().int(),
 	width: number().int(),
 	height: number().int(),
-	copiedAt: number()
+	copiedAt: number(),
+	/** When the CAMERA captured the frame. Absent on a copy taken before D785. */
+	capturedAt: number().optional(),
+	/** The operator's "every subject in this frame is boxed". Detector
+	*  evaluation keeps only complete frames: an unboxed subject would count as
+	*  a false positive. */
+	complete: boolean()
 });
 /** Why a copy-on-select could not be honoured — named, never a silent skip. */
 var RetrainCopyRefusalSchema = _enum([
@@ -22511,6 +22534,51 @@ var RetrainFrameListSchema = object({
 	/** What the page pre-selects — the native key frame when one survives. */
 	autoPickMediaId: number().int().optional()
 });
+/**
+* Which frames an annotated export carries. Every field narrows; an empty
+* filter is every annotated copy. A dataset VERSION is a frozen `frameIds`
+* list owned by whoever trains (the training orchestrator), so `frameIds` is
+* the primitive a version export uses; `batchId` re-selects what an earlier
+* export carried (`exportedInBatch`).
+*/
+var RetrainExportFilterSchema = object({
+	deviceIds: array(number()).optional(),
+	frameIds: array(string()).max(2e4).optional(),
+	batchId: string().optional(),
+	/** Only frames the operator marked complete (all subjects boxed). */
+	completeOnly: boolean().optional()
+});
+/**
+* `frames`: the full frame copies, boxes in `annotations.json`.
+* `crops`: additionally one JPEG per subject, cut with the runtime detail-crop
+* convention — the classifier layout.
+*/
+var RetrainExportLayoutSchema = _enum(["frames", "crops"]);
+/**
+* Where `writeRetrainArchive` streams the tar: one HTTP request whose body is
+* the archive, sent chunk by chunk. Covers a presigned PUT and a provider
+* addon's data-plane upload route alike. Headers are sent verbatim and never
+* logged.
+*/
+var RetrainArchiveTargetSchema = object({
+	kind: literal("http"),
+	method: _enum(["PUT", "POST"]),
+	url: string().url(),
+	headers: record(string(), string()).optional()
+});
+var RetrainArchiveResultSchema = object({
+	batchId: string(),
+	frames: number().int(),
+	crops: number().int(),
+	annotations: number().int(),
+	/** Frames planned but not shipped (unreadable copy, path too long). */
+	missing: number().int(),
+	bytes: number().int(),
+	/** sha256 of the exact bytes sent. */
+	sha256: string(),
+	/** The target's HTTP status. */
+	status: number().int()
+});
 /** What the operator asked the assist to look for. */
 var RetrainAssistSubjectSchema = discriminatedUnion("kind", [object({
 	kind: literal("package"),
@@ -23305,9 +23373,25 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), RetrainTransitionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
+}), method(RetrainExportFilterSchema.extend({ layout: RetrainExportLayoutSchema.optional() }), object({ url: string() }), {
 	kind: "query",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	frameId: string(),
+	complete: boolean()
+}), RetrainFrameSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	filter: RetrainExportFilterSchema,
+	layout: RetrainExportLayoutSchema,
+	target: RetrainArchiveTargetSchema
+}), RetrainArchiveResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 60 * 6e4
 }), method(object({
 	/** Which of the three event tables owns the row. */
 	ownerType: EventOwnerTypeSchema,
@@ -26637,7 +26721,19 @@ var SsoBridgeClaimsSchema = object({
 	* editing a descriptor must not retroactively extend or shorten a link the
 	* operator already consented to.
 	*/
-	refreshTtl: union([number().int().positive(), literal("never")]).optional()
+	refreshTtl: union([number().int().positive(), literal("never")]).optional(),
+	/**
+	* Opaque handle of a hub-side LINK intent (D782). Set by an OIDC callback
+	* that was started from a signed-in user's "Link" button: the finish then
+	* links this identity to the intent's user instead of signing anyone in.
+	* The handle carries no user id — the hub resolves it, single-use.
+	*/
+	linkIntent: string().optional(),
+	/**
+	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
+	* subject is unique only per issuer, so a link is bound to it.
+	*/
+	issuer: string().optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
@@ -28572,7 +28668,22 @@ DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), ar
 	* field their hints were silently stripped by the schema and the
 	* adaptive ladder started blind on the client's display size.
 	*/
-	hints: webrtcClientHintsSchema.optional()
+	hints: webrtcClientHintsSchema.optional(),
+	/**
+	* Talk-back (D771): relay the PEER's audio to the device's speaker
+	* through the `intercom` cap's push-talk triple. When `true` and the
+	* offer lets the peer send audio, the answer's audio is `sendrecv`
+	* and every inbound frame goes to `intercom.pushTalkAudio` for this
+	* `deviceId`; absent/false answers `sendonly`, as for every viewer.
+	*
+	* TRUSTED-CALLER ONLY. Set by the Alexa export for an Echo on a camera
+	* with `intercom`, when the linked user may control that camera. The
+	* hub STRIPS it from every request-bound call (a browser), exactly as
+	* it overwrites `relayOnly` — a viewer's talk permission is the
+	* intercom cap's own surface (share tokens gate it there), and this
+	* flag must not become a second door to the camera's speaker.
+	*/
+	talkback: boolean().optional()
 }), object({
 	sessionId: string(),
 	sdpAnswer: string()
@@ -28874,6 +28985,59 @@ var AddonAutoUpdateSchema = ChannelWithInheritSchema;
 var RestartAddonResultSchema = unknown();
 var InstallPackageResultSchema = unknown();
 var ReloadPackagesResultSchema = unknown();
+/**
+* What an uninstall did on ONE node.
+*  - `uninstalled`       — removed: runner(s) stopped, caps gone, code deleted.
+*  - `not-installed`     — the node did not have it (nothing to do).
+*  - `refused`           — protected / bootstrap package; nothing touched.
+*  - `failed`            — attempted and did not complete; `error` says why.
+*  - `pending-reconnect` — the node is OFFLINE: its record was pruned so the
+*    back-fill never returns the package, and the stale-addon sweep removes the
+*    copy when the node registers again (only once the hub no longer has it).
+*/
+var UninstallNodeOutcomeSchema = _enum([
+	"uninstalled",
+	"not-installed",
+	"refused",
+	"failed",
+	"pending-reconnect"
+]);
+var UninstallNodeResultSchema = object({
+	nodeId: string(),
+	outcome: UninstallNodeOutcomeSchema,
+	error: string().optional(),
+	addonIds: array(string()).readonly(),
+	runnersStopped: array(string()).readonly(),
+	warnings: array(string()).readonly()
+});
+var UninstallPackageResultSchema = object({
+	/** Every targeted node ended `uninstalled`, `not-installed` or `pending-reconnect`. */
+	success: boolean(),
+	packageName: string(),
+	results: array(UninstallNodeResultSchema).readonly()
+});
+/**
+* `unreachable` lists online agents whose status read FAILED — absence from
+* `installations` is only "not installed" for a node that answered (D315).
+*/
+var PackageInstallationsSchema = object({
+	installations: array(object({
+		packageName: string(),
+		nodeId: string(),
+		nodeName: string(),
+		isHub: boolean(),
+		isOnline: boolean(),
+		version: string().nullable(),
+		addonIds: array(string()).readonly(),
+		source: _enum(["live", "recorded"]),
+		/** The hub installs this package too. `false` on an agent row = an orphan. */
+		onHub: boolean()
+	})).readonly(),
+	unreachable: array(object({
+		nodeId: string(),
+		error: string()
+	})).readonly()
+});
 var BulkUpdateItemStatusSchema = _enum([
 	"queued",
 	"updating",
@@ -28956,10 +29120,14 @@ method(_void(), array(AddonListItemSchema).readonly()), method(object({
 }), method(object({ packageName: string() }), InstallPackageResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), boolean()), method(_void(), array(unknown()).readonly()), method(object({ packageName: string() }), unknown(), {
+}), method(_void(), boolean()), method(_void(), array(unknown()).readonly()), method(object({
+	packageName: string().min(1),
+	nodeId: string().optional(),
+	everywhere: boolean().optional()
+}), UninstallPackageResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), ReloadPackagesResultSchema, {
+}), method(object({ packageName: string().optional() }), PackageInstallationsSchema, { auth: "admin" }), method(_void(), ReloadPackagesResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ query: string().optional() }), array(SearchResultSchema)), method(object({ nodeId: string().optional() }), array(PackageUpdateSchema).readonly(), { auth: "admin" }), method(object({
@@ -38869,6 +39037,32 @@ var TotpStatusSchema = object({
 	/** Null when no row exists OR the row is still pending confirmation. */
 	confirmedAt: number().nullable()
 });
+/**
+* user-management — singleton capability for user accounts, API keys,
+* and scoped tokens.
+*
+* v2 model: every method gated by `auth: 'admin'`. Admin-only delegation
+* — the subset check on `setUserScopes` / `createScopedToken` is moot
+* because non-admins never reach these. If/when we open non-admin
+* delegation, structural caller-scope subset check goes inside the
+* provider.
+*/
+var ExternalIdentitySchema = object({
+	/** Login-method id of the provider instance, e.g. `auth-oidc/authentik`. */
+	provider: string(),
+	/** The IdP's stable subject (`sub`) for this account. */
+	subject: string(),
+	/** The verified `iss` of the IdP the identity was linked under — `sub` is unique only per issuer. */
+	issuer: string(),
+	userId: string(),
+	/** What the IdP called the account at link time (username / email) — display only. */
+	label: string().optional(),
+	linkedAt: number()
+});
+var ExternalIdentityKeySchema = object({
+	provider: string().min(1),
+	subject: string().min(1)
+});
 method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserInputSchema, UserSummarySchema, {
 	kind: "mutation",
 	auth: "admin",
@@ -38982,7 +39176,22 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	userId: string(),
 	username: string(),
 	scopes: array(TokenScopeSchema)
-}).nullable(), { access: "view" }), method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }), method(object({ id: string() }), object({ success: boolean() }), {
+}).nullable(), { access: "view" }), method(object({ userId: string() }), array(ExternalIdentitySchema), { auth: "admin" }), method(ExternalIdentityKeySchema, object({
+	userId: string(),
+	issuer: string()
+}).nullable(), { auth: "admin" }), method(ExternalIdentityKeySchema.extend({
+	userId: string(),
+	issuer: string().min(1),
+	label: string().optional()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "create"
+}), method(ExternalIdentityKeySchema.extend({ userId: string() }), object({ success: boolean() }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "delete"
+}), method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }), method(object({ id: string() }), object({ success: boolean() }), {
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
@@ -41392,6 +41601,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"addons.listInstallations": {
+		capName: "addons",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"addons.listJobs": {
 		capName: "addons",
 		capScope: "system",
@@ -45616,6 +45831,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.setRetrainFrameComplete": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -45652,6 +45873,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.writeRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineExecutor.cacheFrameInPool": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -48004,18 +48231,36 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userManagement.findUserByExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.getTotpStatus": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.linkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.listExternalIdentities": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.listOauthSessions": {
 		capName: "user-management",
 		capScope: "system",
@@ -48094,6 +48339,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userManagement.unlinkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"userManagement.updateUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -51433,6 +51684,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.setRetrainFrameComplete": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.setTrackFlags": [{
 		name: "deviceId",
 		form: "single",
@@ -53495,7 +53751,7 @@ var MB = 1024 * 1024;
 */
 var veluxConnectionSchema = object({
 	host: string().min(1).describe("KLF-200 host name or IP address"),
-	password: string().default("").describe("KLF-200 WiFi/web password (printed on the back of the unit)"),
+	password: string().default("").describe("KLF-200 WiFi/web password (printed on the back of the unit)").meta({ secret: true }),
 	pollIntervalMs: preprocess((v) => v === "" || v === null ? void 0 : v, number().int().min(2e3).max(36e5).default(3e4)).describe("Node-state poll interval (ms)")
 });
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-velux",
-  "version": "0.2.121",
+  "version": "0.2.123",
   "description": "Velux KLF-200 device-provider addon for CamStack — local-gateway window + shutter covers (positional, no tilt)",
   "keywords": [
     "camstack",