@camstack/addon-remote-storage 1.1.21 → 1.1.23

package/dist/s3.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_shared = require("./shared-BTuv4hPh.js");
+const require_shared = require("./shared-BL-GGrW8.js");
 let node_stream = require("node:stream");
 let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
 let _aws_sdk_lib_storage = require("@aws-sdk/lib-storage");

package/dist/s3.addon.mjs

@@ -1,4 +1,4 @@
-import { c as BaseAddon, i as rearmIdleAbort, n as getOptionalBasePath, o as scheduleIdleAbort, s as storageProviderCapability, t as createSessionId } from "./shared-m1upfQvq.mjs";
+import { c as BaseAddon, i as rearmIdleAbort, n as getOptionalBasePath, o as scheduleIdleAbort, s as storageProviderCapability, t as createSessionId } from "./shared-CFMg2pY9.mjs";
 import { PassThrough } from "node:stream";
 import { DeleteObjectCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
 import { Upload } from "@aws-sdk/lib-storage";

package/dist/sftp.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_shared = require("./shared-BTuv4hPh.js");
+const require_shared = require("./shared-BL-GGrW8.js");
 let ssh2 = require("ssh2");
 let node_path = require("node:path");
 node_path = require_shared.__toESM(node_path);

package/dist/sftp.addon.mjs

@@ -1,4 +1,4 @@
-import { a as safeJoinRemotePath, c as BaseAddon, i as rearmIdleAbort, o as scheduleIdleAbort, r as getRequiredBasePath, s as storageProviderCapability, t as createSessionId } from "./shared-m1upfQvq.mjs";
+import { a as safeJoinRemotePath, c as BaseAddon, i as rearmIdleAbort, o as scheduleIdleAbort, r as getRequiredBasePath, s as storageProviderCapability, t as createSessionId } from "./shared-CFMg2pY9.mjs";
 import { Client } from "ssh2";
 import * as path from "node:path";
 //#region src/providers/sftp/sftp-config-schema.ts

package/dist/{shared-BTuv4hPh.js → shared-BL-GGrW8.js}

@@ -4652,7 +4652,7 @@ function _instanceof(cls, params = {}) {
 	return inst;
 }
 //#endregion
-//#region ../types/dist/sleep-DJaTV2D7.mjs
+//#region ../types/dist/sleep-Baang_XW.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -6756,6 +6756,18 @@ function method(input, output, options) {
 		timeoutMs: options?.timeoutMs
 	};
 }
+/**
+* A wrapper/system-only method: served exclusively by the cap's system-level
+* provider (`InferProvider`), and OPTIONAL on `InferNativeProvider` so per-device
+* driver natives don't stub out a wrapper concern (e.g. a cross-device cache
+* overview). The `systemOnly: true` literal is what `InferNativeProvider` keys on.
+*/
+function systemMethod(input, output, options) {
+	return {
+		...method(input, output, options),
+		systemOnly: true
+	};
+}
 var StaticDirOutputSchema$1 = object({ staticDir: string() });
 var VersionOutputSchema$1 = object({ version: string() });
 method(_void(), StaticDirOutputSchema$1), method(_void(), VersionOutputSchema$1);
@@ -10494,6 +10506,7 @@ var PipelineAddonSchemaSchema = object({
 	defaultModelId: string(),
 	defaultModelIdByFormat: record(string(), string()).optional(),
 	enabledByDefault: boolean().optional(),
+	backfillIntoExistingOverrides: boolean().optional(),
 	defaultConfidence: number(),
 	group: string().optional(),
 	configSchema: array(ConfigFieldBridge).readonly().optional()
@@ -10675,7 +10688,15 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	image: _instanceof(Uint8Array).optional(),
 	referenceImage: string().optional(),
 	deviceId: number().optional(),
-	sessionId: string().optional()
+	sessionId: string().optional(),
+	/**
+	* Execution plane. 'full' (default) runs the whole tree — benchmark,
+	* reference-image, and detail-subtree calls. 'frame' is the live
+	* per-frame dispatch: ONLY root-plane steps run; crop children
+	* (inputClasses ≠ null) are skipped and served per-track via
+	* pipelineRunner.runDetailSubtree (two-plane design).
+	*/
+	plane: _enum(["full", "frame"]).optional()
 }), PipelineRunResultBridge, { kind: "mutation" }), method(object({
 	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).min(1),
@@ -10800,6 +10821,47 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(ZoneSchema).read
 	auth: "admin"
 }), object({ zones: array(ZoneSchema).readonly() });
 /**
+* A bounding box in NORMALIZED [0,1] frame coordinates for `getNativeCrop`. The
+* decode worker resolves it against the RETAINED native frame's real pixel dims,
+* so the caller supplies only the detection-res bbox divided by the detection
+* dims — no native resolution to plumb.
+*/
+var NativeCropBboxSchema = object({
+	x: number(),
+	y: number(),
+	w: number(),
+	h: number()
+});
+/** Result of a best-effort native-resolution crop (`getNativeCrop`). */
+var NativeCropResultSchema = object({
+	/** Packed rgb (24-bit) pixels of the crop. */
+	bytes: _instanceof(Uint8Array),
+	width: number().int().positive(),
+	height: number().int().positive()
+});
+/** Parent detection context passed to `runDetailSubtree` — the crop's
+*  originating detection, in FRAME-space coordinates. Reuses
+*  `NativeCropBboxSchema`'s `{x,y,w,h}` shape (same numeric fields; here
+*  the coordinates are frame-space rather than getNativeCrop's
+*  normalized [0,1] convention). */
+var DetailParentSchema = object({
+	bbox: NativeCropBboxSchema,
+	className: string()
+});
+/** One child-step result from `runDetailSubtree` — an embedding, label,
+*  or refined detection produced by running the crop-subtree on a
+*  single tracked detection. */
+var DetailResultSchema = object({
+	stepId: string(),
+	className: string(),
+	score: number(),
+	/** FRAME-space bbox (already mapped back from crop space). */
+	bbox: NativeCropBboxSchema.optional(),
+	embedding: string().optional(),
+	label: string().optional(),
+	alignedCropJpeg: string().optional()
+});
+/**
 * Per-camera tunable ranges + defaults. Single source of truth used
 * by both the Zod data schema (validation + default fallback) and
 * the device settings UI (slider min/max/step). Touch one place and
@@ -11055,7 +11117,17 @@ var RunnerLocalMetricsSchema = object({
 	avgInferenceTimeMs: number(),
 	queueDepth: number()
 });
-method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mutation" }), method(object({ deviceId: number() }), object({ success: literal(true) }), { kind: "mutation" }), method(ReportMotionInputSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), RunnerLocalLoadSchema), method(_void(), RunnerLocalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(_void(), array(CameraMetricsWithDeviceIdSchema).readonly()), method(_void(), array(number()).readonly());
+method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mutation" }), method(object({ deviceId: number() }), object({ success: literal(true) }), { kind: "mutation" }), method(ReportMotionInputSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), RunnerLocalLoadSchema), method(_void(), RunnerLocalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(_void(), array(CameraMetricsWithDeviceIdSchema).readonly()), method(_void(), array(number()).readonly()), method(object({
+	handle: FrameHandleSchema,
+	bbox: NativeCropBboxSchema,
+	maxWidth: number().int().positive().optional()
+}), NativeCropResultSchema.nullable()), method(object({
+	deviceId: number(),
+	frameHandle: FrameHandleSchema.optional(),
+	cropJpeg: string().optional(),
+	parent: DetailParentSchema,
+	steps: array(string()).optional()
+}), object({ details: array(DetailResultSchema) }).nullable(), { kind: "mutation" });
 object({
 	detected: boolean(),
 	/** Ms epoch of the last detected-true observation. Null if never detected. */
@@ -15093,7 +15165,17 @@ var TrackSchema = object({
 	/** Cumulative normalized distance travelled (0..1 units = full frame width). */
 	totalDistance: number(),
 	state: TrackStateSchema,
-	active: boolean()
+	active: boolean(),
+	/** Deterministic key-event importance score in [0,1] (server-computed at
+	*  track expiry, recomputed on late label). Absent on legacy rows written
+	*  before scoring shipped — consumers degrade to absence / compute-on-read. */
+	importance: number().optional(),
+	/** Id of the track's highest-confidence ObjectEvent (its representative
+	*  "best" frame). Absent when the track produced no object events. */
+	bestEventId: string().optional(),
+	/** Tag of the importance sub-signal that dominated the score
+	*  (identity|dwell|proximity|class|confidence|travel|zone). */
+	importanceReason: string().optional()
 });
 var BaseEventFields = {
 	id: string(),
@@ -15158,8 +15240,18 @@ var ObjectEventSchema = object({
 	frameHeight: number().optional(),
 	/** MediaStore key for the crop attached to this event (if any). */
 	mediaKey: string().optional(),
+	/** Design B: MediaStore key of the track's native-resolution key frame (the
+	*  best-detection full frame). Resolve via the event-media data-plane
+	*  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`) for a detail view that
+	*  draws `bbox` over the native frame. Absent on legacy rows / non-decoded
+	*  sources — consumers fall back to `mediaKey` (the tight crop). */
+	keyFrameMediaKey: string().optional(),
 	/** Populated by B5 (recording playback URL for this event). */
-	mediaUrl: string().optional()
+	mediaUrl: string().optional(),
+	/** The parent track's key-event importance [0,1], propagated to every object
+	*  event of the track (so an event row can be sorted by importance without a
+	*  track join). Absent on legacy rows / before the track was scored. */
+	importance: number().optional()
 });
 var AudioEventSchema = object({
 	...BaseEventFields,
@@ -15183,7 +15275,8 @@ var MediaFileKindEnum = _enum([
 	"fullFrame",
 	"fullFrameBoxed",
 	"faceCrop",
-	"plateCrop"
+	"plateCrop",
+	"keyFrame"
 ]);
 var MediaFileSchema = object({
 	key: string(),
@@ -15204,6 +15297,32 @@ var DeviceEventQueryInput = object({
 	projection: _enum(["full", "slim"]).optional()
 });
 var ObjectEventQueryInput = DeviceEventQueryInput.extend({ classFilter: string().optional() });
+var KeyEventQueryInput = object({
+	deviceId: number(),
+	/** Window lower bound (track firstSeen ≥ since). */
+	since: number(),
+	/** Window upper bound (track firstSeen ≤ until). */
+	until: number(),
+	limit: number().int().min(1).max(200).default(50),
+	/** Drop tracks scoring below this importance. */
+	minImportance: number().min(0).max(1).optional(),
+	/** Restrict to a single class (e.g. 'person'). */
+	classFilter: string().optional()
+});
+var KeyEventSchema = object({
+	/** The representative event id (the track's best ObjectEvent, else its trackId). */
+	id: string(),
+	trackId: string(),
+	/** Track start time (firstSeen). */
+	timestamp: number(),
+	className: string(),
+	label: string().optional(),
+	importance: number(),
+	/** Highest-confidence ObjectEvent id for the track (empty when none). */
+	bestEventId: string(),
+	/** Track lifetime in ms (lastSeen - firstSeen). */
+	windowMs: number().optional()
+});
 var TrackedDetectionSchema = object({
 	trackId: string(),
 	className: string(),
@@ -15233,7 +15352,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), array(TrackSchema).readonly()), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({
+}), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(KeyEventQueryInput, array(KeyEventSchema).readonly()), method(object({
 	deviceId: number(),
 	since: number(),
 	until: number(),
@@ -16000,7 +16119,12 @@ DeviceType.Camera, method(object({
 }), SnapshotImageSchema.nullable()), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-});
+}), systemMethod(object({ deviceIds: array(number()).min(1).max(200) }), array(object({
+	deviceId: number(),
+	lastCapturedAt: number().nullable(),
+	cacheAgeMs: number().nullable(),
+	etag: string().nullable()
+})));
 /**
 * `sso-bridge` — internal hub-only cap that lets SSO-style auth
 * providers (OIDC, SAML, magic-link, …) mint an HMAC-signed token
@@ -16296,10 +16420,32 @@ method(_void(), array(TurnServerSchema).readonly());
 *      b. `finishAuthentication({userId, response})` → server verifies
 *         the assertion, bumps the credential counter, returns ok.
 *
+*   2b. Usernameless (discoverable-credential) authentication — the
+*       passkey IS the primary factor, no password leg:
+*       a. `beginDiscoverableAuthentication({})` → assertion options with
+*          EMPTY `allowCredentials` (the browser offers every resident
+*          passkey it holds for this RP) + `userVerification: 'required'`
+*          (the passkey replaces both factors, so UV is mandatory).
+*          The challenge is stored server-side, NOT bound to any user.
+*       b. `finishDiscoverableAuthentication({response})` → the provider
+*          resolves the credential by the response's credential id,
+*          verifies the assertion against the stored challenge + that
+*          credential's public key/counter, and returns the OWNING
+*          `userId` — the caller (core auth router) mints the session.
+*
 *   3. Management:
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
 *
+*   4. Second-factor preference (opt-in, default OFF):
+*      Enrolling a passkey only enables passkey-FIRST sign-in. It is
+*      demanded as a second factor after a password login ONLY when the
+*      user explicitly opts in via `setSecondFactorPreference`.
+*      - `getSecondFactorPreference({userId})` → `{ enabled }` (missing
+*        row ⇒ `enabled: false`).
+*      - `setSecondFactorPreference({userId, enabled})` — persisted by
+*        the providing addon beside its credentials.
+*
 * Challenges are short-lived (5 min, in-memory). The cap is internal —
 * the admin-ui composes the begin/finish round-trip and never exposes
 * the cap to non-admins.
@@ -16342,6 +16488,17 @@ method(object({
 }), object({ verified: boolean() }), {
 	kind: "mutation",
 	access: "view"
+}), method(object({}), object({ optionsJSON: record(string(), unknown()) }), {
+	kind: "mutation",
+	access: "view"
+}), method(object({ 
+/** AuthenticationResponseJSON from the browser. */
+response: record(string(), unknown()) }), object({
+	verified: boolean(),
+	userId: string().nullable()
+}), {
+	kind: "mutation",
+	access: "view"
 }), method(object({ userId: string() }), array(PasskeySummarySchema), { auth: "admin" }), method(object({
 	userId: string(),
 	credentialId: string()
@@ -16349,6 +16506,13 @@ method(object({
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
+}), method(object({ userId: string() }), object({ enabled: boolean() }), { auth: "admin" }), method(object({
+	userId: string(),
+	enabled: boolean()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "create"
 });
 /**
 * `videoclips` — the unified, navigable-clip surface for a camera.
@@ -17150,7 +17314,17 @@ var FaceInfoSchema = object({
 	recognizedIdentityId: string().optional(),
 	identityName: string().optional(),
 	assigned: boolean(),
-	base64: string().optional()
+	base64: string().optional(),
+	/** Design B: the face bbox (pixel space) on the key frame — lets a detail
+	*  view draw the box over the native `keyFrameMediaKey` frame. Absent on
+	*  legacy rows written before design B. */
+	faceBbox: BoundingBoxSchema.optional(),
+	/** Design B: MediaStore key of the track's native-resolution key frame.
+	*  Fetch the native JPEG via the event-media data-plane
+	*  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`). Absent when the
+	*  track produced no key frame (e.g. native/onboard source) — the UI falls
+	*  back to the inline `base64` face crop. */
+	keyFrameMediaKey: string().optional()
 });
 var FaceFilterEnum = _enum([
 	"unassigned",
@@ -21269,6 +21443,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getKeyEvents": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getMotionEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -21797,12 +21977,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineRunner.getNativeCrop": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineRunner.reportMotion": {
 		capName: "pipeline-runner",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.runDetailSubtree": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"plateGallery.correctPlateText": {
 		capName: "plate-gallery",
 		capScope: "system",
@@ -22163,6 +22355,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"snapshot.getSnapshotOverview": {
+		capName: "snapshot",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"snapshot.invalidateCache": {
 		capName: "snapshot",
 		capScope: "device",
@@ -22841,6 +23039,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.beginDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.beginRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -22853,12 +23057,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.finishDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.finishRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"userPasskeys.getSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.listPasskeys": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -22871,6 +23087,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userPasskeys.setSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"vacuumControl.locate": {
 		capName: "vacuum-control",
 		capScope: "device",

package/dist/{shared-m1upfQvq.mjs → shared-CFMg2pY9.mjs}

@@ -4629,7 +4629,7 @@ function _instanceof(cls, params = {}) {
 	return inst;
 }
 //#endregion
-//#region ../types/dist/sleep-DJaTV2D7.mjs
+//#region ../types/dist/sleep-Baang_XW.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -6733,6 +6733,18 @@ function method(input, output, options) {
 		timeoutMs: options?.timeoutMs
 	};
 }
+/**
+* A wrapper/system-only method: served exclusively by the cap's system-level
+* provider (`InferProvider`), and OPTIONAL on `InferNativeProvider` so per-device
+* driver natives don't stub out a wrapper concern (e.g. a cross-device cache
+* overview). The `systemOnly: true` literal is what `InferNativeProvider` keys on.
+*/
+function systemMethod(input, output, options) {
+	return {
+		...method(input, output, options),
+		systemOnly: true
+	};
+}
 var StaticDirOutputSchema$1 = object({ staticDir: string() });
 var VersionOutputSchema$1 = object({ version: string() });
 method(_void(), StaticDirOutputSchema$1), method(_void(), VersionOutputSchema$1);
@@ -10471,6 +10483,7 @@ var PipelineAddonSchemaSchema = object({
 	defaultModelId: string(),
 	defaultModelIdByFormat: record(string(), string()).optional(),
 	enabledByDefault: boolean().optional(),
+	backfillIntoExistingOverrides: boolean().optional(),
 	defaultConfidence: number(),
 	group: string().optional(),
 	configSchema: array(ConfigFieldBridge).readonly().optional()
@@ -10652,7 +10665,15 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	image: _instanceof(Uint8Array).optional(),
 	referenceImage: string().optional(),
 	deviceId: number().optional(),
-	sessionId: string().optional()
+	sessionId: string().optional(),
+	/**
+	* Execution plane. 'full' (default) runs the whole tree — benchmark,
+	* reference-image, and detail-subtree calls. 'frame' is the live
+	* per-frame dispatch: ONLY root-plane steps run; crop children
+	* (inputClasses ≠ null) are skipped and served per-track via
+	* pipelineRunner.runDetailSubtree (two-plane design).
+	*/
+	plane: _enum(["full", "frame"]).optional()
 }), PipelineRunResultBridge, { kind: "mutation" }), method(object({
 	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).min(1),
@@ -10777,6 +10798,47 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(ZoneSchema).read
 	auth: "admin"
 }), object({ zones: array(ZoneSchema).readonly() });
 /**
+* A bounding box in NORMALIZED [0,1] frame coordinates for `getNativeCrop`. The
+* decode worker resolves it against the RETAINED native frame's real pixel dims,
+* so the caller supplies only the detection-res bbox divided by the detection
+* dims — no native resolution to plumb.
+*/
+var NativeCropBboxSchema = object({
+	x: number(),
+	y: number(),
+	w: number(),
+	h: number()
+});
+/** Result of a best-effort native-resolution crop (`getNativeCrop`). */
+var NativeCropResultSchema = object({
+	/** Packed rgb (24-bit) pixels of the crop. */
+	bytes: _instanceof(Uint8Array),
+	width: number().int().positive(),
+	height: number().int().positive()
+});
+/** Parent detection context passed to `runDetailSubtree` — the crop's
+*  originating detection, in FRAME-space coordinates. Reuses
+*  `NativeCropBboxSchema`'s `{x,y,w,h}` shape (same numeric fields; here
+*  the coordinates are frame-space rather than getNativeCrop's
+*  normalized [0,1] convention). */
+var DetailParentSchema = object({
+	bbox: NativeCropBboxSchema,
+	className: string()
+});
+/** One child-step result from `runDetailSubtree` — an embedding, label,
+*  or refined detection produced by running the crop-subtree on a
+*  single tracked detection. */
+var DetailResultSchema = object({
+	stepId: string(),
+	className: string(),
+	score: number(),
+	/** FRAME-space bbox (already mapped back from crop space). */
+	bbox: NativeCropBboxSchema.optional(),
+	embedding: string().optional(),
+	label: string().optional(),
+	alignedCropJpeg: string().optional()
+});
+/**
 * Per-camera tunable ranges + defaults. Single source of truth used
 * by both the Zod data schema (validation + default fallback) and
 * the device settings UI (slider min/max/step). Touch one place and
@@ -11032,7 +11094,17 @@ var RunnerLocalMetricsSchema = object({
 	avgInferenceTimeMs: number(),
 	queueDepth: number()
 });
-method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mutation" }), method(object({ deviceId: number() }), object({ success: literal(true) }), { kind: "mutation" }), method(ReportMotionInputSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), RunnerLocalLoadSchema), method(_void(), RunnerLocalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(_void(), array(CameraMetricsWithDeviceIdSchema).readonly()), method(_void(), array(number()).readonly());
+method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mutation" }), method(object({ deviceId: number() }), object({ success: literal(true) }), { kind: "mutation" }), method(ReportMotionInputSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), RunnerLocalLoadSchema), method(_void(), RunnerLocalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(_void(), array(CameraMetricsWithDeviceIdSchema).readonly()), method(_void(), array(number()).readonly()), method(object({
+	handle: FrameHandleSchema,
+	bbox: NativeCropBboxSchema,
+	maxWidth: number().int().positive().optional()
+}), NativeCropResultSchema.nullable()), method(object({
+	deviceId: number(),
+	frameHandle: FrameHandleSchema.optional(),
+	cropJpeg: string().optional(),
+	parent: DetailParentSchema,
+	steps: array(string()).optional()
+}), object({ details: array(DetailResultSchema) }).nullable(), { kind: "mutation" });
 object({
 	detected: boolean(),
 	/** Ms epoch of the last detected-true observation. Null if never detected. */
@@ -15070,7 +15142,17 @@ var TrackSchema = object({
 	/** Cumulative normalized distance travelled (0..1 units = full frame width). */
 	totalDistance: number(),
 	state: TrackStateSchema,
-	active: boolean()
+	active: boolean(),
+	/** Deterministic key-event importance score in [0,1] (server-computed at
+	*  track expiry, recomputed on late label). Absent on legacy rows written
+	*  before scoring shipped — consumers degrade to absence / compute-on-read. */
+	importance: number().optional(),
+	/** Id of the track's highest-confidence ObjectEvent (its representative
+	*  "best" frame). Absent when the track produced no object events. */
+	bestEventId: string().optional(),
+	/** Tag of the importance sub-signal that dominated the score
+	*  (identity|dwell|proximity|class|confidence|travel|zone). */
+	importanceReason: string().optional()
 });
 var BaseEventFields = {
 	id: string(),
@@ -15135,8 +15217,18 @@ var ObjectEventSchema = object({
 	frameHeight: number().optional(),
 	/** MediaStore key for the crop attached to this event (if any). */
 	mediaKey: string().optional(),
+	/** Design B: MediaStore key of the track's native-resolution key frame (the
+	*  best-detection full frame). Resolve via the event-media data-plane
+	*  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`) for a detail view that
+	*  draws `bbox` over the native frame. Absent on legacy rows / non-decoded
+	*  sources — consumers fall back to `mediaKey` (the tight crop). */
+	keyFrameMediaKey: string().optional(),
 	/** Populated by B5 (recording playback URL for this event). */
-	mediaUrl: string().optional()
+	mediaUrl: string().optional(),
+	/** The parent track's key-event importance [0,1], propagated to every object
+	*  event of the track (so an event row can be sorted by importance without a
+	*  track join). Absent on legacy rows / before the track was scored. */
+	importance: number().optional()
 });
 var AudioEventSchema = object({
 	...BaseEventFields,
@@ -15160,7 +15252,8 @@ var MediaFileKindEnum = _enum([
 	"fullFrame",
 	"fullFrameBoxed",
 	"faceCrop",
-	"plateCrop"
+	"plateCrop",
+	"keyFrame"
 ]);
 var MediaFileSchema = object({
 	key: string(),
@@ -15181,6 +15274,32 @@ var DeviceEventQueryInput = object({
 	projection: _enum(["full", "slim"]).optional()
 });
 var ObjectEventQueryInput = DeviceEventQueryInput.extend({ classFilter: string().optional() });
+var KeyEventQueryInput = object({
+	deviceId: number(),
+	/** Window lower bound (track firstSeen ≥ since). */
+	since: number(),
+	/** Window upper bound (track firstSeen ≤ until). */
+	until: number(),
+	limit: number().int().min(1).max(200).default(50),
+	/** Drop tracks scoring below this importance. */
+	minImportance: number().min(0).max(1).optional(),
+	/** Restrict to a single class (e.g. 'person'). */
+	classFilter: string().optional()
+});
+var KeyEventSchema = object({
+	/** The representative event id (the track's best ObjectEvent, else its trackId). */
+	id: string(),
+	trackId: string(),
+	/** Track start time (firstSeen). */
+	timestamp: number(),
+	className: string(),
+	label: string().optional(),
+	importance: number(),
+	/** Highest-confidence ObjectEvent id for the track (empty when none). */
+	bestEventId: string(),
+	/** Track lifetime in ms (lastSeen - firstSeen). */
+	windowMs: number().optional()
+});
 var TrackedDetectionSchema = object({
 	trackId: string(),
 	className: string(),
@@ -15210,7 +15329,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), array(TrackSchema).readonly()), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({
+}), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(KeyEventQueryInput, array(KeyEventSchema).readonly()), method(object({
 	deviceId: number(),
 	since: number(),
 	until: number(),
@@ -15977,7 +16096,12 @@ DeviceType.Camera, method(object({
 }), SnapshotImageSchema.nullable()), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-});
+}), systemMethod(object({ deviceIds: array(number()).min(1).max(200) }), array(object({
+	deviceId: number(),
+	lastCapturedAt: number().nullable(),
+	cacheAgeMs: number().nullable(),
+	etag: string().nullable()
+})));
 /**
 * `sso-bridge` — internal hub-only cap that lets SSO-style auth
 * providers (OIDC, SAML, magic-link, …) mint an HMAC-signed token
@@ -16273,10 +16397,32 @@ method(_void(), array(TurnServerSchema).readonly());
 *      b. `finishAuthentication({userId, response})` → server verifies
 *         the assertion, bumps the credential counter, returns ok.
 *
+*   2b. Usernameless (discoverable-credential) authentication — the
+*       passkey IS the primary factor, no password leg:
+*       a. `beginDiscoverableAuthentication({})` → assertion options with
+*          EMPTY `allowCredentials` (the browser offers every resident
+*          passkey it holds for this RP) + `userVerification: 'required'`
+*          (the passkey replaces both factors, so UV is mandatory).
+*          The challenge is stored server-side, NOT bound to any user.
+*       b. `finishDiscoverableAuthentication({response})` → the provider
+*          resolves the credential by the response's credential id,
+*          verifies the assertion against the stored challenge + that
+*          credential's public key/counter, and returns the OWNING
+*          `userId` — the caller (core auth router) mints the session.
+*
 *   3. Management:
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
 *
+*   4. Second-factor preference (opt-in, default OFF):
+*      Enrolling a passkey only enables passkey-FIRST sign-in. It is
+*      demanded as a second factor after a password login ONLY when the
+*      user explicitly opts in via `setSecondFactorPreference`.
+*      - `getSecondFactorPreference({userId})` → `{ enabled }` (missing
+*        row ⇒ `enabled: false`).
+*      - `setSecondFactorPreference({userId, enabled})` — persisted by
+*        the providing addon beside its credentials.
+*
 * Challenges are short-lived (5 min, in-memory). The cap is internal —
 * the admin-ui composes the begin/finish round-trip and never exposes
 * the cap to non-admins.
@@ -16319,6 +16465,17 @@ method(object({
 }), object({ verified: boolean() }), {
 	kind: "mutation",
 	access: "view"
+}), method(object({}), object({ optionsJSON: record(string(), unknown()) }), {
+	kind: "mutation",
+	access: "view"
+}), method(object({ 
+/** AuthenticationResponseJSON from the browser. */
+response: record(string(), unknown()) }), object({
+	verified: boolean(),
+	userId: string().nullable()
+}), {
+	kind: "mutation",
+	access: "view"
 }), method(object({ userId: string() }), array(PasskeySummarySchema), { auth: "admin" }), method(object({
 	userId: string(),
 	credentialId: string()
@@ -16326,6 +16483,13 @@ method(object({
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
+}), method(object({ userId: string() }), object({ enabled: boolean() }), { auth: "admin" }), method(object({
+	userId: string(),
+	enabled: boolean()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "create"
 });
 /**
 * `videoclips` — the unified, navigable-clip surface for a camera.
@@ -17127,7 +17291,17 @@ var FaceInfoSchema = object({
 	recognizedIdentityId: string().optional(),
 	identityName: string().optional(),
 	assigned: boolean(),
-	base64: string().optional()
+	base64: string().optional(),
+	/** Design B: the face bbox (pixel space) on the key frame — lets a detail
+	*  view draw the box over the native `keyFrameMediaKey` frame. Absent on
+	*  legacy rows written before design B. */
+	faceBbox: BoundingBoxSchema.optional(),
+	/** Design B: MediaStore key of the track's native-resolution key frame.
+	*  Fetch the native JPEG via the event-media data-plane
+	*  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`). Absent when the
+	*  track produced no key frame (e.g. native/onboard source) — the UI falls
+	*  back to the inline `base64` face crop. */
+	keyFrameMediaKey: string().optional()
 });
 var FaceFilterEnum = _enum([
 	"unassigned",
@@ -21246,6 +21420,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getKeyEvents": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getMotionEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -21774,12 +21954,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineRunner.getNativeCrop": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineRunner.reportMotion": {
 		capName: "pipeline-runner",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.runDetailSubtree": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"plateGallery.correctPlateText": {
 		capName: "plate-gallery",
 		capScope: "system",
@@ -22140,6 +22332,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"snapshot.getSnapshotOverview": {
+		capName: "snapshot",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"snapshot.invalidateCache": {
 		capName: "snapshot",
 		capScope: "device",
@@ -22818,6 +23016,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.beginDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.beginRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -22830,12 +23034,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.finishDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.finishRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"userPasskeys.getSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.listPasskeys": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -22848,6 +23064,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userPasskeys.setSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"vacuumControl.locate": {
 		capName: "vacuum-control",
 		capScope: "device",

package/dist/webdav.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_shared = require("./shared-BTuv4hPh.js");
+const require_shared = require("./shared-BL-GGrW8.js");
 let node_stream = require("node:stream");
 let webdav = require("webdav");
 //#region src/providers/webdav/webdav-config-schema.ts

package/dist/webdav.addon.mjs

@@ -1,4 +1,4 @@
-import { a as safeJoinRemotePath, c as BaseAddon, i as rearmIdleAbort, o as scheduleIdleAbort, r as getRequiredBasePath, s as storageProviderCapability, t as createSessionId } from "./shared-m1upfQvq.mjs";
+import { a as safeJoinRemotePath, c as BaseAddon, i as rearmIdleAbort, o as scheduleIdleAbort, r as getRequiredBasePath, s as storageProviderCapability, t as createSessionId } from "./shared-CFMg2pY9.mjs";
 import { PassThrough } from "node:stream";
 import { AuthType, createClient } from "webdav";
 //#region src/providers/webdav/webdav-config-schema.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-remote-storage",
-  "version": "1.1.21",
+  "version": "1.1.23",
   "description": "Remote storage providers (SFTP, S3, WebDAV) — unifies remote backends behind the storage-provider cap",
   "keywords": [
     "camstack",