@camstack/system 1.2.375 → 1.2.376

package/dist/{dist-CNbnikIh.js → dist-BcUWQGr9.js}

@@ -701,7 +701,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-BNeXenvr.mjs
+//#region ../types/dist/sleep-B0JG7-_F.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -3078,6 +3078,69 @@ var deviceOpsCapability = {
 		getRawState: method(zod.z.object({ deviceId: zod.z.number() }), RawStateResultSchema.nullable(), { auth: "protected" })
 	}
 };
+function defOf(schema) {
+	return schema._zod?.def ?? {};
+}
+function declaredHere(schema) {
+	return zod.z.globalRegistry.get(schema)?.secret === true;
+}
+/** Wrapper kinds whose `innerType` is the field itself. */
+var WRAPPERS = new Set([
+	"optional",
+	"nullable",
+	"default",
+	"prefault",
+	"catch",
+	"readonly",
+	"nonoptional"
+]);
+/**
+* The schema layers that make up ONE field: the schema itself and every
+* wrapper below it (optional / default / nullable / readonly / catch), plus
+* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
+* `.transform` on `in`).
+*/
+function layersOf(schema) {
+	const out = [];
+	const queue = [schema];
+	while (queue.length > 0) {
+		const s = queue.shift();
+		if (!s || out.includes(s)) continue;
+		out.push(s);
+		const def = defOf(s);
+		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
+		if (def.type === "pipe") {
+			if (def.in) queue.push(def.in);
+			if (def.out) queue.push(def.out);
+		}
+	}
+	return out;
+}
+/** True when any layer of this field declares `.meta({ secret: true })`. */
+function isZodSecret(schema) {
+	return layersOf(schema).some(declaredHere);
+}
+/**
+* Every declared secret path in a config schema: dotted keys, `[]` for "each
+* element of this array" (`connection.password`, `rows[].token`). A declared
+* object or array is reported as one path and not descended into — everything
+* under it is secret.
+*/
+function collectZodSecretPaths(schema, prefix = "") {
+	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
+	const paths = [];
+	for (const layer of layersOf(schema)) {
+		const def = defOf(layer);
+		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
+		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
+		else if (def.type === "intersection") {
+			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
+			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
+		}
+	}
+	return [...new Set(paths)];
+}
 /**
 * Type-safe JSON parsing helpers.
 *
@@ -15146,6 +15209,10 @@ var DeviceInfoSchema = zod.z.object({
 	isCamera: zod.z.boolean(),
 	/** Current config values — serializable snapshot */
 	config: zod.z.record(zod.z.string(), zod.z.unknown()),
+	/** Paths inside `config` the device's schema declares secret (D783) —
+	*  what the non-admin redaction withholds. Paths, never values. Absent
+	*  when the owning runner has not reported them. */
+	secretConfigPaths: zod.z.array(zod.z.string()).optional(),
 	/** Hardware + identity blob (manufacturer / model / firmware / sn /
 	*  uid / mac / …). Populated by drivers; editable via setMetadata. */
 	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).nullable().optional(),
@@ -15366,7 +15433,13 @@ var DeviceRegisterPayloadSchema = zod.z.object({
 	*  call (workers re-register on init), so probe-driven updates
 	*  (e.g. PTZ flag flipping after the abilities probe) propagate. */
 	features: zod.z.array(zod.z.string()).optional(),
-	config: zod.z.record(zod.z.string(), zod.z.unknown())
+	config: zod.z.record(zod.z.string(), zod.z.unknown()),
+	/** Config paths the device's own schema DECLARES secret
+	*  (`.meta({ secret: true })` — dotted, `[]` for array items, e.g.
+	*  `connection.password`). Re-published on every register; the non-admin
+	*  redaction withholds them at any depth (D783). Optional: an older runner
+	*  omits it and the keyword backstop applies. */
+	secretConfigPaths: zod.z.array(zod.z.string()).optional()
 });
 var DeviceRemovePayloadSchema = zod.z.object({ deviceId: zod.z.number() });
 var DevicePersistConfigPayloadSchema = zod.z.object({
@@ -18285,7 +18358,14 @@ var RedirectLoginMethodSchema = zod.z.object({
 	icon: zod.z.string().optional(),
 	/** Addon-owned HTTP route the button navigates to (GET). */
 	startUrl: zod.z.string(),
-	stage: LoginStageEnum
+	stage: LoginStageEnum,
+	/**
+	* The provider names an external identity a signed-in user can link to
+	* their own account (D782): `auth.listLinkableProviders` /
+	* `beginExternalLink` offer exactly the redirect methods that set this,
+	* whatever their id. Absent / false — a login button only (magic-link).
+	*/
+	linkable: zod.z.boolean().optional()
 });
 /**
 * A Module-Federation widget the login page mounts for an in-page
@@ -24161,7 +24241,13 @@ var RetrainFrameSchema = zod.z.object({
 	sizeBytes: zod.z.number().int(),
 	width: zod.z.number().int(),
 	height: zod.z.number().int(),
-	copiedAt: zod.z.number()
+	copiedAt: zod.z.number(),
+	/** When the CAMERA captured the frame. Absent on a copy taken before D785. */
+	capturedAt: zod.z.number().optional(),
+	/** The operator's "every subject in this frame is boxed". Detector
+	*  evaluation keeps only complete frames: an unboxed subject would count as
+	*  a false positive. */
+	complete: zod.z.boolean()
 });
 /** Why a copy-on-select could not be honoured — named, never a silent skip. */
 var RetrainCopyRefusalSchema = zod.z.enum([
@@ -24182,6 +24268,51 @@ var RetrainFrameListSchema = zod.z.object({
 	/** What the page pre-selects — the native key frame when one survives. */
 	autoPickMediaId: zod.z.number().int().optional()
 });
+/**
+* Which frames an annotated export carries. Every field narrows; an empty
+* filter is every annotated copy. A dataset VERSION is a frozen `frameIds`
+* list owned by whoever trains (the training orchestrator), so `frameIds` is
+* the primitive a version export uses; `batchId` re-selects what an earlier
+* export carried (`exportedInBatch`).
+*/
+var RetrainExportFilterSchema = zod.z.object({
+	deviceIds: zod.z.array(zod.z.number()).optional(),
+	frameIds: zod.z.array(zod.z.string()).max(2e4).optional(),
+	batchId: zod.z.string().optional(),
+	/** Only frames the operator marked complete (all subjects boxed). */
+	completeOnly: zod.z.boolean().optional()
+});
+/**
+* `frames`: the full frame copies, boxes in `annotations.json`.
+* `crops`: additionally one JPEG per subject, cut with the runtime detail-crop
+* convention — the classifier layout.
+*/
+var RetrainExportLayoutSchema = zod.z.enum(["frames", "crops"]);
+/**
+* Where `writeRetrainArchive` streams the tar: one HTTP request whose body is
+* the archive, sent chunk by chunk. Covers a presigned PUT and a provider
+* addon's data-plane upload route alike. Headers are sent verbatim and never
+* logged.
+*/
+var RetrainArchiveTargetSchema = zod.z.object({
+	kind: zod.z.literal("http"),
+	method: zod.z.enum(["PUT", "POST"]),
+	url: zod.z.string().url(),
+	headers: zod.z.record(zod.z.string(), zod.z.string()).optional()
+});
+var RetrainArchiveResultSchema = zod.z.object({
+	batchId: zod.z.string(),
+	frames: zod.z.number().int(),
+	crops: zod.z.number().int(),
+	annotations: zod.z.number().int(),
+	/** Frames planned but not shipped (unreadable copy, path too long). */
+	missing: zod.z.number().int(),
+	bytes: zod.z.number().int(),
+	/** sha256 of the exact bytes sent. */
+	sha256: zod.z.string(),
+	/** The target's HTTP status. */
+	status: zod.z.number().int()
+});
 /** What the operator asked the assist to look for. */
 var RetrainAssistSubjectSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
 	kind: zod.z.literal("package"),
@@ -25521,11 +25652,41 @@ var pipelineAnalyticsCapability = {
 		* out, so two crops of the same subject can never end up in one feature
 		* space (D52).
 		*/
-		getRetrainExportUrl: method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), zod.z.object({ url: zod.z.string() }), {
+		getRetrainExportUrl: method(RetrainExportFilterSchema.extend({ layout: RetrainExportLayoutSchema.optional() }), zod.z.object({ url: zod.z.string() }), {
 			kind: "query",
 			auth: "admin"
 		}),
 		/**
+		* The operator's "every subject in this frame is boxed" — set and cleared
+		* by hand, never derived: a frame with no box may be a complete hard
+		* negative, and a frame with three boxes may still miss a fourth person.
+		*/
+		setRetrainFrameComplete: method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			frameId: zod.z.string(),
+			complete: zod.z.boolean()
+		}), RetrainFrameSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Stream the annotated archive to a TARGET instead of a browser — the
+		* same tar `getRetrainExportUrl` serves (manifest first, one JPEG in
+		* memory at a time, paced), written chunk by chunk into one HTTP request.
+		* The bytes never cross this cap and never land on the hub's disk; the
+		* answer is what was sent, with its sha256.
+		*/
+		writeRetrainArchive: method(zod.z.object({
+			filter: RetrainExportFilterSchema,
+			layout: RetrainExportLayoutSchema,
+			target: RetrainArchiveTargetSchema
+		}), RetrainArchiveResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 60 * 6e4
+		}),
+		/**
 		* The media an EVENT owns.
 		*
 		* `ownerType` is REQUIRED, and that is the whole correction (D482). An
@@ -30001,7 +30162,19 @@ var SsoBridgeClaimsSchema = zod.z.object({
 	* editing a descriptor must not retroactively extend or shorten a link the
 	* operator already consented to.
 	*/
-	refreshTtl: zod.z.union([zod.z.number().int().positive(), zod.z.literal("never")]).optional()
+	refreshTtl: zod.z.union([zod.z.number().int().positive(), zod.z.literal("never")]).optional(),
+	/**
+	* Opaque handle of a hub-side LINK intent (D782). Set by an OIDC callback
+	* that was started from a signed-in user's "Link" button: the finish then
+	* links this identity to the intent's user instead of signing anyone in.
+	* The handle carries no user id — the hub resolves it, single-use.
+	*/
+	linkIntent: zod.z.string().optional(),
+	/**
+	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
+	* subject is unique only per issuer, so a link is bound to it.
+	*/
+	issuer: zod.z.string().optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -44870,6 +45043,22 @@ var TotpStatusSchema = zod.z.object({
 * delegation, structural caller-scope subset check goes inside the
 * provider.
 */
+var ExternalIdentitySchema = zod.z.object({
+	/** Login-method id of the provider instance, e.g. `auth-oidc/authentik`. */
+	provider: zod.z.string(),
+	/** The IdP's stable subject (`sub`) for this account. */
+	subject: zod.z.string(),
+	/** The verified `iss` of the IdP the identity was linked under — `sub` is unique only per issuer. */
+	issuer: zod.z.string(),
+	userId: zod.z.string(),
+	/** What the IdP called the account at link time (username / email) — display only. */
+	label: zod.z.string().optional(),
+	linkedAt: zod.z.number()
+});
+var ExternalIdentityKeySchema = zod.z.object({
+	provider: zod.z.string().min(1),
+	subject: zod.z.string().min(1)
+});
 var userManagementCapability = {
 	name: "user-management",
 	scope: "system",
@@ -45012,6 +45201,32 @@ var userManagementCapability = {
 			username: zod.z.string(),
 			scopes: zod.z.array(TokenScopeSchema)
 		}).nullable(), { access: "view" }),
+		listExternalIdentities: method(zod.z.object({ userId: zod.z.string() }), zod.z.array(ExternalIdentitySchema), { auth: "admin" }),
+		/** The user an identity is linked to, or `null`. */
+		findUserByExternalIdentity: method(ExternalIdentityKeySchema, zod.z.object({
+			userId: zod.z.string(),
+			issuer: zod.z.string()
+		}).nullable(), { auth: "admin" }),
+		/**
+		* Link `(provider, subject)` to `userId`. Idempotent for the same user;
+		* REFUSES (throws) an identity already linked to another user, and a
+		* user that does not exist.
+		*/
+		linkExternalIdentity: method(ExternalIdentityKeySchema.extend({
+			userId: zod.z.string(),
+			issuer: zod.z.string().min(1),
+			label: zod.z.string().optional()
+		}), zod.z.object({ success: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
+		}),
+		/** Remove one link of `userId`. `success: false` when it was not linked to that user. */
+		unlinkExternalIdentity: method(ExternalIdentityKeySchema.extend({ userId: zod.z.string() }), zod.z.object({ success: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "delete"
+		}),
 		listOauthSessions: method(zod.z.void(), zod.z.array(OauthSessionSummarySchema), { auth: "admin" }),
 		revokeOauthSession: method(zod.z.object({ id: zod.z.string() }), zod.z.object({ success: zod.z.boolean() }), {
 			kind: "mutation",
@@ -51973,6 +52188,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.setRetrainFrameComplete": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -52009,6 +52230,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.writeRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineExecutor.cacheFrameInPool": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -54361,18 +54588,36 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userManagement.findUserByExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.getTotpStatus": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.linkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.listExternalIdentities": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.listOauthSessions": {
 		capName: "user-management",
 		capScope: "system",
@@ -54451,6 +54696,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userManagement.unlinkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"userManagement.updateUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -58045,6 +58296,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.setRetrainFrameComplete": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.setTrackFlags": [{
 		name: "deviceId",
 		form: "single",
@@ -61012,6 +61268,12 @@ Object.defineProperty(exports, "collectSecretConfigKeys", {
 		return collectSecretConfigKeys;
 	}
 });
+Object.defineProperty(exports, "collectZodSecretPaths", {
+	enumerable: true,
+	get: function() {
+		return collectZodSecretPaths;
+	}
+});
 Object.defineProperty(exports, "composedDeviceRef", {
 	enumerable: true,
 	get: function() {