@camstack/system 1.2.377 → 1.2.379

package/dist/{dist-BWNoS-1S.mjs → dist-B9oFw2jh.mjs}

@@ -708,7 +708,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-Cr5YOk3m.mjs
+//#region ../types/dist/sleep-DujUvOcb.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -1413,6 +1413,23 @@ function projectStore(store, perNodeKeys, nodeId) {
 	}
 	return out;
 }
+/**
+* The address of one keychain value: `secret://<owner>/<scope>/<fieldPath>`.
+*
+* A ref is DETERMINISTIC from where the value lives — the owner addon, the
+* scope (global, one node, one device, one integration, one row of a business
+* collection) and the field path inside that scope — so saving the same field
+* twice updates the same ref, and the ref itself says which settings blob
+* points at it. It is also the AAD of the value's ciphertext: a ciphertext
+* copied onto another ref does not decrypt.
+*
+* Array items are addressed by ITEM ID, never by index
+* (`providers[authentik].clientSecret`), so reordering a list keeps every ref.
+*
+* Pure and browser-safe: no node builtins, no I/O.
+*/
+/** The URI scheme of every keychain ref. */
+var SECRET_REF_SCHEME = "secret://";
 var GLOBAL_SCOPE = { kind: "global" };
 /** The scope every addon-wide (not per-node, not per-device) setting lives in. */
 function globalSecretScope() {
@@ -1454,6 +1471,13 @@ function formatSecretScope(scope) {
 function arrayItemFieldPath(arrayKey, itemId, fieldKey) {
 	return `${arrayKey}[${encodeSegment(itemId)}].${fieldKey}`;
 }
+/** Build a ref. Throws on an empty owner or field path — both are bugs. */
+function buildSecretRef(parts) {
+	const owner = normalizeSecretOwner(parts.owner);
+	if (owner.length === 0) throw new Error("buildSecretRef: owner is empty");
+	if (parts.fieldPath.length === 0) throw new Error("buildSecretRef: fieldPath is empty");
+	return `${SECRET_REF_SCHEME}${encodeSegment(owner)}/${formatSecretScope(parts.scope)}/${parts.fieldPath}`;
+}
 function parseScope(segments) {
 	switch (segments[0]) {
 		case "global": return {
@@ -15006,6 +15030,14 @@ var KeychainAuditEntrySchema = z.object({
 	ref: z.string().nullable(),
 	detail: z.string().nullable()
 });
+var KEYCHAIN_RESET_CONFIRMATION = "RESET KEYCHAIN";
+/**
+* Secrets the HUB itself holds (owner `system`) that no settings form shows:
+* `jwt-signing-key` — the session signing key (D797). It is always "in use",
+* never an orphan; it is generated on a fresh hub and replaced only through
+* {@link keychainAdminCapability.methods.setSystemSecret}.
+*/
+var SystemHeldSecretNameSchema = z.enum(["jwt-signing-key"]);
 var keychainAdminCapability = {
 	name: "keychain-admin",
 	scope: "system",
@@ -15026,6 +15058,24 @@ var keychainAdminCapability = {
 			auth: "admin",
 			caller: "required"
 		}),
+		/**
+		* Replace a system-held secret (no form edits it) with an operator-supplied
+		* value — e.g. importing the session signing key a pre-keychain hub kept in
+		* config.yaml, so the tokens it signed stay valid. Audited as the operator.
+		* Replacing the session signing key invalidates every token signed with the
+		* previous one.
+		*/
+		setSystemSecret: method(z.object({
+			name: SystemHeldSecretNameSchema,
+			value: z.string().min(16)
+		}), z.object({
+			ref: z.string(),
+			version: z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
 		/** Delete refs no owner points at any more. Re-checked here; `unknown` is kept. */
 		deleteOrphans: method(z.object({ refs: z.array(z.string().min(1)).max(1e3) }), z.object({
 			deleted: z.array(z.string()).readonly(),
@@ -15078,7 +15128,7 @@ var keychainAdminCapability = {
 		* key. Every secret field then reads "not set". Requires the typed
 		* confirmation {@link KEYCHAIN_RESET_CONFIRMATION}.
 		*/
-		resetKeychain: method(z.object({ confirm: z.literal("RESET KEYCHAIN") }), z.object({
+		resetKeychain: method(z.object({ confirm: z.literal(KEYCHAIN_RESET_CONFIRMATION) }), z.object({
 			archivedCollection: z.string().nullable(),
 			archived: z.number().int()
 		}), {
@@ -25402,6 +25452,9 @@ var RetrainExportFilterSchema = z.object({
 	frameIds: z.array(z.string()).max(2e4).optional(),
 	/** Only frames in at least one of these named collections. */
 	collectionIds: z.array(z.string()).max(200).optional(),
+	/** Exactly the frames of this dataset version (and its completeOnly). An
+	*  unknown id selects nothing. */
+	datasetVersionId: z.string().optional(),
 	batchId: z.string().optional(),
 	/** Only frames the operator marked complete (all subjects boxed). */
 	completeOnly: z.boolean().optional()
@@ -25569,6 +25622,67 @@ var RetrainLlmAssistResultSchema = z.discriminatedUnion("kind", [z.object({
 	]),
 	detail: z.string().optional()
 })]);
+/** What a dataset version is cut from. Every field narrows. */
+var RetrainDatasetSelectionSchema = z.object({
+	deviceIds: z.array(z.number()).readonly().optional(),
+	collectionIds: z.array(z.string()).max(200).readonly().optional(),
+	frameIds: z.array(z.string()).max(2e4).readonly().optional()
+});
+/** The counts a dataset is judged by. */
+var RetrainDatasetStatsSchema = z.object({
+	frames: z.number().int(),
+	completeFrames: z.number().int(),
+	/** `completeFrames / frames`, 0..1. */
+	completeness: z.number(),
+	/** Boxes to learn (model errors excluded). */
+	subjects: z.number().int(),
+	modelErrors: z.number().int(),
+	/** Complete frames with no subject. */
+	hardNegatives: z.number().int(),
+	/** Subjects per class × camera × day/night. */
+	cells: z.array(z.object({
+		macroClass: z.string(),
+		deviceId: z.number(),
+		lighting: z.enum([
+			"day",
+			"night",
+			"unknown"
+		]),
+		subjects: z.number().int(),
+		frames: z.number().int()
+	})).readonly(),
+	cameras: z.array(z.object({
+		deviceId: z.number(),
+		frames: z.number().int(),
+		completeFrames: z.number().int()
+	})).readonly()
+});
+/** An immutable dataset version, without its frame list. */
+var RetrainDatasetVersionSchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	createdAt: z.number(),
+	selection: RetrainDatasetSelectionSchema,
+	layout: RetrainExportLayoutSchema,
+	completeOnly: z.boolean(),
+	frameCount: z.number().int(),
+	/** sha256 of what the frames taught when the version was frozen. */
+	annotationHash: z.string(),
+	/** The export manifest schema the version was cut under. */
+	manifestSchema: z.string(),
+	stats: RetrainDatasetStatsSchema
+});
+var CreateRetrainDatasetVersionResultSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("created"),
+	version: RetrainDatasetVersionSchema
+}), z.object({
+	kind: z.literal("refused"),
+	reason: z.enum([
+		"empty-name",
+		"duplicate-name",
+		"no-frames"
+	])
+})]);
 /** The outcome of a lifecycle move owned by the retrain page. */
 var RetrainTransitionResultSchema = z.object({
 	trackId: z.string(),
@@ -26919,6 +27033,53 @@ var pipelineAnalyticsCapability = {
 			auth: "admin",
 			timeoutMs: 60 * 6e4
 		}),
+		/** The counts a selection would freeze — class × camera × day/night,
+		*  completeness — without freezing anything. Index reads only. */
+		previewRetrainDataset: method(z.object({
+			selection: RetrainDatasetSelectionSchema,
+			completeOnly: z.boolean().optional()
+		}), RetrainDatasetStatsSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* Freeze a dataset version: the frames the selection yields (the same plan
+		* the annotated export builds), the hash of what they teach, the export
+		* parameters and the counts. Immutable — a different selection is a new
+		* version. Export it with `getRetrainExportUrl({ datasetVersionId })`.
+		*/
+		createRetrainDatasetVersion: method(z.object({
+			name: z.string().max(120),
+			selection: RetrainDatasetSelectionSchema,
+			layout: RetrainExportLayoutSchema,
+			completeOnly: z.boolean()
+		}), CreateRetrainDatasetVersionResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
+		/** Every dataset version, newest first. */
+		listRetrainDatasetVersions: method(z.object({}), z.array(RetrainDatasetVersionSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/** Delete a version. Its frames stay in the dataset. */
+		deleteRetrainDatasetVersion: method(z.object({ id: z.string() }), z.object({ deleted: z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Does the corpus still teach what the version froze? `missingFrames`
+		*  counts frames that left the dataset (or lost every box and tick). */
+		verifyRetrainDatasetVersion: method(z.object({ id: z.string() }), z.object({
+			found: z.boolean(),
+			annotationHash: z.string(),
+			matches: z.boolean(),
+			missingFrames: z.number().int()
+		}), {
+			kind: "query",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
 		/** The enabled, vision-capable LLM profiles, each saying whether a frame
 		*  sent to it leaves the house. */
 		listRetrainAssistProfiles: method(z.object({}), z.array(RetrainAssistProfileSchema).readonly(), {
@@ -52312,6 +52473,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"keychainAdmin.setSystemSecret": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"keychainAdmin.status": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -53758,6 +53925,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.createRetrainDatasetVersion": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -53770,6 +53943,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.deleteRetrainDatasetVersion": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineAnalytics.deleteTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -53992,6 +54171,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRetrainDatasetVersions": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRetrainFrames": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -54034,6 +54219,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.previewRetrainDataset": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.proposeRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -54172,6 +54363,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.verifyRetrainDatasetVersion": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.wipeAllAnalytics": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -62908,4 +63105,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { buildStreamParamsConfigSchema as $, compositionItemFieldPath as $n, looseSchema as $t, MINUTES_PER_DAY as A, scoreRuntimes as An, isSecretMarker as Ar, extractNestedAddonId as At, StorageLocationModeSchema as B, userManagementCapability as Bn, scrubKnownSecrets as Br, isLocationEnabled as Bt, FieldClaimModeSchema as C, resolveHubAddressRoles as Cn, emitDownForOwnedCaps as Cr, enumerateInferenceDevices as Ct, LegacyStorageLocationDefaultSchema as D, runtimeStatePolicyFor as Dn, hydrateSchema as Dr, evictionPolicyOfLocation as Dt, LOG_LEVEL_RANK as E, resolveNotificationTapAddress as En, formatSecretScope as Er, evaluateCompositionField as Et, RecordingStatusSchema as F, storageMigrationCapability as Fn, parseSecretRef as Fr, hfModelUrl as Ft, addonSettingsCapability as G, vectorStoreCapability as Gn, EventCategory as Gr, keychainCapability as Gt, StorageMigrationJobSchema as H, validateCustomAddress as Hn, sleep as Hr, isVoidInput as Ht, STORAGE_ACCESS_FALLBACK as I, storageOccupancyCapability as In, readinessKey as Ir, isAppLinkBase as It, authProviderCapability as J, buildFfmpegArgs as Jn, lifecycleJobSchema as Jt, addonWidgetsCapability as K, withLocationMode as Kn, legacyAutoLinkIds as Kt, STREAM_PROFILE_META as L, storageProviderCapability as Ln, resolveCapMount as Lr, isArrayOutputSchema as Lt, MOTION_CLOSE_AFTER_MS as M, siteZoneKey as Mn, normalizeSecretOwner as Mr, foldSnapshotByFunction as Mt, RECORDING_SOURCE_CAMSTACK_ADDON as N, snapshotCapability as Nn, parseJsonObject as Nr, formatMinutes as Nt, LocationIconIdSchema as O, scopesAllowAddon as On, isDeviceConfigCap as Or, expandContainer as Ot, RUNTIME_DEFAULTS as P, storageCapability as Pn, parseJsonUnknown as Pr, gbToBytes as Pt, buildCapabilityLookup as Q, compositionFeatureEnabled as Qn, logLevelAtMost as Qt, ScopedTokenSchema as R, streamCatalogCapability as Rn, resolveSecretMarkers as Rr, isCollectionArrayMethod as Rt, FIRST_LEVEL_MACRO_CLASSES as S, resolveCoreBlockFiles as Sn, createEvent as Sr, deviceStatusCapability as St, HF_REPO as T, resolveMethodAuth as Tn, expandCapMethods as Tr, enumerateSchemaFields as Tt, UserRecordSchema as U, vectorDimFromBase64 as Un, toNodeId as Ur, kebabToCamel as Ut, StorageLocationTypeSchema as V, validateComposition as Vn, secretTreeFromPaths as Vr, isObjectInput as Vt, addonPagesCapability as W, vectorIndexDimConflictError as Wn, transformSecretWrite as Wr, keychainAdminCapability as Wt, bareAddonId as X, composedDeviceRef as Xn, locationIconKey as Xt, backupCapability as Y, cloneStatefulExpressionMemory as Yn, localNetworkCapability as Yt, batteryCapability as Z, composedDeviceStableId as Zn, logDestinationCapability as Zt, DATABASE_SNAPSHOT_TIMEOUT_MS as _, reducePoints as _n, asJsonObject as _r, deriveBatteryPresence as _t, BatteryStatusSchema as a, modeMayWrite as an, DeviceFeature as ar, compositionSourceRefs as at, DeclaredDevices as b, resolveBucketMs as bn, collectSecretConfigKeys as br, deviceManagerCapability as bt, CAP_NAMES_WITH_STATUS as c, normalizeUnit as cn, errMsg as cr, coreBlockIdFromAddonId as ct, CORE_BLOCKS_ADDON_ID as d, parseStreamParamsFormPatch as dn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as dr, createDeviceExtensionProvider as dt, maskUrlCredentials as en, compositionSliceKey as er, calendarsCapability as et, CORE_BLOCK_ADDON_PREFIX as f, pickAppLinkHub as fn, DEVICE_STATUS_METHOD as fr, dataStoreProviderCapability as ft, DATABASE_SNAPSHOT_SUFFIX as g, ptzAutotrackCapability as gn, WELL_KNOWN_TAB_MAP as gr, defineExtensionSlotProvider as gt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as h, procedureAuthKey as hn, ReadinessTimeoutError as hr, decodeVectorBase64 as ht, BaseDevice as i, metricsProviderCapability as in, toExpressionValue as ir, compositionFieldKey as it, MODEL_FORMATS as j, settingsStoreCapability as jn, nodePin as jr, filesystemBrowseCapability as jt, METHOD_ACCESS_MAP as k, scopesAllowDeviceCap as kn, isEvent as kr, expressionContainsBuiltinCall as kt, COMPOSED_ITEM_FIXED_FIELDS as l, objectInputDeclaresAddonId as ln, BaseAddon as lr, coreBlockSourceKind as lt, CoreBlockSchema as m, platformProbeCapability as mn, ReadinessRegistry as mr, declarationOwnerNodeId as mt, AlertSchema as n, mayWriteToLocation as nn, createStatefulExpressionMemory as nr, checkRoleAddress as nt, CAMERA_SWITCH_ORDER as o, motionCapability as on, DeviceRole as or, coreBlockAddonId as ot, CalendarPreferencesSchema as p, planComposition as pn, REDACTED_SECRET as pr, databaseSnapshotCapability as pt, alertsCapability as q, COMPOSER_ADDON_ID as qn, legacyModeOf as qt, ApiKeyRecordSchema as r, memoizePinnedFfmpeg as rn, disarmRoseMemory as rr, composerCapability as rt, CAMSTACK_APP_LINK_ORIGIN as s, normalizeCoreBlockWrite as sn, DeviceType as sr, coreBlockComposition as st, ALL_CAPABILITY_DEFINITIONS as t, mayReadLocation as tn, compositionSourceKey as tr, cameraGridLayoutCapability as tt, COMPOSER_RUNNER_ID as u, objectInputDeclaresRequiredDeviceId as un, DATAPLANE_SECRET_HEADER as ur, coreBlocksCapability as ut, DAY_NAMES as v, replacedFieldKeys as vn, asNumber as vr, describeComposableCaps as vt, FieldClaimSchema as w, resolveLocationMode as wn, emitReadiness as wr, enumerateItemArrayFields as wt, DeviceStatusSchema as x, resolveCoreBlockEntry as xn, collectZodSecretPaths as xr, deviceStateCapability as xt, DERIVED_CAMERA_SILENCED_CAP_NAMES as y, resolveAppConnections as yn, asString$1 as yr, deviceExtensionCapability as yt, StorageCleanupJobSchema as z, streamQualityLabel as zn, scopeKey as zr, isDefaultAppConnectionEndpoint as zt };
+export { buildStreamParamsConfigSchema as $, compositionItemFieldPath as $n, looseSchema as $t, MINUTES_PER_DAY as A, scoreRuntimes as An, isEvent as Ar, extractNestedAddonId as At, StorageLocationModeSchema as B, userManagementCapability as Bn, scopeKey as Br, isLocationEnabled as Bt, FieldClaimModeSchema as C, resolveHubAddressRoles as Cn, createEvent as Cr, enumerateInferenceDevices as Ct, LegacyStorageLocationDefaultSchema as D, runtimeStatePolicyFor as Dn, formatSecretScope as Dr, evictionPolicyOfLocation as Dt, LOG_LEVEL_RANK as E, resolveNotificationTapAddress as En, expandCapMethods as Er, evaluateCompositionField as Et, RecordingStatusSchema as F, storageMigrationCapability as Fn, parseJsonUnknown as Fr, hfModelUrl as Ft, addonSettingsCapability as G, vectorStoreCapability as Gn, toNodeId as Gr, keychainCapability as Gt, StorageMigrationJobSchema as H, validateCustomAddress as Hn, secretTreeFromPaths as Hr, isVoidInput as Ht, STORAGE_ACCESS_FALLBACK as I, storageOccupancyCapability as In, parseSecretRef as Ir, isAppLinkBase as It, authProviderCapability as J, buildFfmpegArgs as Jn, lifecycleJobSchema as Jt, addonWidgetsCapability as K, withLocationMode as Kn, transformSecretWrite as Kr, legacyAutoLinkIds as Kt, STREAM_PROFILE_META as L, storageProviderCapability as Ln, readinessKey as Lr, isArrayOutputSchema as Lt, MOTION_CLOSE_AFTER_MS as M, siteZoneKey as Mn, nodePin as Mr, foldSnapshotByFunction as Mt, RECORDING_SOURCE_CAMSTACK_ADDON as N, snapshotCapability as Nn, normalizeSecretOwner as Nr, formatMinutes as Nt, LocationIconIdSchema as O, scopesAllowAddon as On, hydrateSchema as Or, expandContainer as Ot, RUNTIME_DEFAULTS as P, storageCapability as Pn, parseJsonObject as Pr, gbToBytes as Pt, buildCapabilityLookup as Q, compositionFeatureEnabled as Qn, logLevelAtMost as Qt, ScopedTokenSchema as R, streamCatalogCapability as Rn, resolveCapMount as Rr, isCollectionArrayMethod as Rt, FIRST_LEVEL_MACRO_CLASSES as S, resolveCoreBlockFiles as Sn, collectZodSecretPaths as Sr, deviceStatusCapability as St, HF_REPO as T, resolveMethodAuth as Tn, emitReadiness as Tr, enumerateSchemaFields as Tt, UserRecordSchema as U, vectorDimFromBase64 as Un, secretTreeFromSchema as Ur, kebabToCamel as Ut, StorageLocationTypeSchema as V, validateComposition as Vn, scrubKnownSecrets as Vr, isObjectInput as Vt, addonPagesCapability as W, vectorIndexDimConflictError as Wn, sleep as Wr, keychainAdminCapability as Wt, bareAddonId as X, composedDeviceRef as Xn, locationIconKey as Xt, backupCapability as Y, cloneStatefulExpressionMemory as Yn, localNetworkCapability as Yt, batteryCapability as Z, composedDeviceStableId as Zn, logDestinationCapability as Zt, DATABASE_SNAPSHOT_TIMEOUT_MS as _, reducePoints as _n, asJsonObject as _r, deriveBatteryPresence as _t, BatteryStatusSchema as a, modeMayWrite as an, DeviceFeature as ar, compositionSourceRefs as at, DeclaredDevices as b, resolveBucketMs as bn, buildSecretRef as br, deviceManagerCapability as bt, CAP_NAMES_WITH_STATUS as c, normalizeUnit as cn, errMsg as cr, coreBlockIdFromAddonId as ct, CORE_BLOCKS_ADDON_ID as d, parseStreamParamsFormPatch as dn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as dr, createDeviceExtensionProvider as dt, maskUrlCredentials as en, compositionSliceKey as er, calendarsCapability as et, CORE_BLOCK_ADDON_PREFIX as f, pickAppLinkHub as fn, DEVICE_STATUS_METHOD as fr, dataStoreProviderCapability as ft, DATABASE_SNAPSHOT_SUFFIX as g, ptzAutotrackCapability as gn, WELL_KNOWN_TAB_MAP as gr, defineExtensionSlotProvider as gt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as h, procedureAuthKey as hn, ReadinessTimeoutError as hr, decodeVectorBase64 as ht, BaseDevice as i, metricsProviderCapability as in, toExpressionValue as ir, compositionFieldKey as it, MODEL_FORMATS as j, settingsStoreCapability as jn, isSecretMarker as jr, filesystemBrowseCapability as jt, METHOD_ACCESS_MAP as k, scopesAllowDeviceCap as kn, isDeviceConfigCap as kr, expressionContainsBuiltinCall as kt, COMPOSED_ITEM_FIXED_FIELDS as l, objectInputDeclaresAddonId as ln, BaseAddon as lr, coreBlockSourceKind as lt, CoreBlockSchema as m, platformProbeCapability as mn, ReadinessRegistry as mr, declarationOwnerNodeId as mt, AlertSchema as n, mayWriteToLocation as nn, createStatefulExpressionMemory as nr, checkRoleAddress as nt, CAMERA_SWITCH_ORDER as o, motionCapability as on, DeviceRole as or, coreBlockAddonId as ot, CalendarPreferencesSchema as p, planComposition as pn, REDACTED_SECRET as pr, databaseSnapshotCapability as pt, alertsCapability as q, COMPOSER_ADDON_ID as qn, EventCategory as qr, legacyModeOf as qt, ApiKeyRecordSchema as r, memoizePinnedFfmpeg as rn, disarmRoseMemory as rr, composerCapability as rt, CAMSTACK_APP_LINK_ORIGIN as s, normalizeCoreBlockWrite as sn, DeviceType as sr, coreBlockComposition as st, ALL_CAPABILITY_DEFINITIONS as t, mayReadLocation as tn, compositionSourceKey as tr, cameraGridLayoutCapability as tt, COMPOSER_RUNNER_ID as u, objectInputDeclaresRequiredDeviceId as un, DATAPLANE_SECRET_HEADER as ur, coreBlocksCapability as ut, DAY_NAMES as v, replacedFieldKeys as vn, asNumber as vr, describeComposableCaps as vt, FieldClaimSchema as w, resolveLocationMode as wn, emitDownForOwnedCaps as wr, enumerateItemArrayFields as wt, DeviceStatusSchema as x, resolveCoreBlockEntry as xn, collectSecretConfigKeys as xr, deviceStateCapability as xt, DERIVED_CAMERA_SILENCED_CAP_NAMES as y, resolveAppConnections as yn, asString$1 as yr, deviceExtensionCapability as yt, StorageCleanupJobSchema as z, streamQualityLabel as zn, resolveSecretMarkers as zr, isDefaultAppConnectionEndpoint as zt };

package/dist/{dist-D_a9mUiM.js → dist-Cc6KOdY-.js}

@@ -708,7 +708,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-Cr5YOk3m.mjs
+//#region ../types/dist/sleep-DujUvOcb.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -1413,6 +1413,23 @@ function projectStore(store, perNodeKeys, nodeId) {
 	}
 	return out;
 }
+/**
+* The address of one keychain value: `secret://<owner>/<scope>/<fieldPath>`.
+*
+* A ref is DETERMINISTIC from where the value lives — the owner addon, the
+* scope (global, one node, one device, one integration, one row of a business
+* collection) and the field path inside that scope — so saving the same field
+* twice updates the same ref, and the ref itself says which settings blob
+* points at it. It is also the AAD of the value's ciphertext: a ciphertext
+* copied onto another ref does not decrypt.
+*
+* Array items are addressed by ITEM ID, never by index
+* (`providers[authentik].clientSecret`), so reordering a list keeps every ref.
+*
+* Pure and browser-safe: no node builtins, no I/O.
+*/
+/** The URI scheme of every keychain ref. */
+var SECRET_REF_SCHEME = "secret://";
 var GLOBAL_SCOPE = { kind: "global" };
 /** The scope every addon-wide (not per-node, not per-device) setting lives in. */
 function globalSecretScope() {
@@ -1454,6 +1471,13 @@ function formatSecretScope(scope) {
 function arrayItemFieldPath(arrayKey, itemId, fieldKey) {
 	return `${arrayKey}[${encodeSegment(itemId)}].${fieldKey}`;
 }
+/** Build a ref. Throws on an empty owner or field path — both are bugs. */
+function buildSecretRef(parts) {
+	const owner = normalizeSecretOwner(parts.owner);
+	if (owner.length === 0) throw new Error("buildSecretRef: owner is empty");
+	if (parts.fieldPath.length === 0) throw new Error("buildSecretRef: fieldPath is empty");
+	return `${SECRET_REF_SCHEME}${encodeSegment(owner)}/${formatSecretScope(parts.scope)}/${parts.fieldPath}`;
+}
 function parseScope(segments) {
 	switch (segments[0]) {
 		case "global": return {
@@ -15006,6 +15030,14 @@ var KeychainAuditEntrySchema = zod.z.object({
 	ref: zod.z.string().nullable(),
 	detail: zod.z.string().nullable()
 });
+var KEYCHAIN_RESET_CONFIRMATION = "RESET KEYCHAIN";
+/**
+* Secrets the HUB itself holds (owner `system`) that no settings form shows:
+* `jwt-signing-key` — the session signing key (D797). It is always "in use",
+* never an orphan; it is generated on a fresh hub and replaced only through
+* {@link keychainAdminCapability.methods.setSystemSecret}.
+*/
+var SystemHeldSecretNameSchema = zod.z.enum(["jwt-signing-key"]);
 var keychainAdminCapability = {
 	name: "keychain-admin",
 	scope: "system",
@@ -15026,6 +15058,24 @@ var keychainAdminCapability = {
 			auth: "admin",
 			caller: "required"
 		}),
+		/**
+		* Replace a system-held secret (no form edits it) with an operator-supplied
+		* value — e.g. importing the session signing key a pre-keychain hub kept in
+		* config.yaml, so the tokens it signed stay valid. Audited as the operator.
+		* Replacing the session signing key invalidates every token signed with the
+		* previous one.
+		*/
+		setSystemSecret: method(zod.z.object({
+			name: SystemHeldSecretNameSchema,
+			value: zod.z.string().min(16)
+		}), zod.z.object({
+			ref: zod.z.string(),
+			version: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
 		/** Delete refs no owner points at any more. Re-checked here; `unknown` is kept. */
 		deleteOrphans: method(zod.z.object({ refs: zod.z.array(zod.z.string().min(1)).max(1e3) }), zod.z.object({
 			deleted: zod.z.array(zod.z.string()).readonly(),
@@ -15078,7 +15128,7 @@ var keychainAdminCapability = {
 		* key. Every secret field then reads "not set". Requires the typed
 		* confirmation {@link KEYCHAIN_RESET_CONFIRMATION}.
 		*/
-		resetKeychain: method(zod.z.object({ confirm: zod.z.literal("RESET KEYCHAIN") }), zod.z.object({
+		resetKeychain: method(zod.z.object({ confirm: zod.z.literal(KEYCHAIN_RESET_CONFIRMATION) }), zod.z.object({
 			archivedCollection: zod.z.string().nullable(),
 			archived: zod.z.number().int()
 		}), {
@@ -25402,6 +25452,9 @@ var RetrainExportFilterSchema = zod.z.object({
 	frameIds: zod.z.array(zod.z.string()).max(2e4).optional(),
 	/** Only frames in at least one of these named collections. */
 	collectionIds: zod.z.array(zod.z.string()).max(200).optional(),
+	/** Exactly the frames of this dataset version (and its completeOnly). An
+	*  unknown id selects nothing. */
+	datasetVersionId: zod.z.string().optional(),
 	batchId: zod.z.string().optional(),
 	/** Only frames the operator marked complete (all subjects boxed). */
 	completeOnly: zod.z.boolean().optional()
@@ -25569,6 +25622,67 @@ var RetrainLlmAssistResultSchema = zod.z.discriminatedUnion("kind", [zod.z.objec
 	]),
 	detail: zod.z.string().optional()
 })]);
+/** What a dataset version is cut from. Every field narrows. */
+var RetrainDatasetSelectionSchema = zod.z.object({
+	deviceIds: zod.z.array(zod.z.number()).readonly().optional(),
+	collectionIds: zod.z.array(zod.z.string()).max(200).readonly().optional(),
+	frameIds: zod.z.array(zod.z.string()).max(2e4).readonly().optional()
+});
+/** The counts a dataset is judged by. */
+var RetrainDatasetStatsSchema = zod.z.object({
+	frames: zod.z.number().int(),
+	completeFrames: zod.z.number().int(),
+	/** `completeFrames / frames`, 0..1. */
+	completeness: zod.z.number(),
+	/** Boxes to learn (model errors excluded). */
+	subjects: zod.z.number().int(),
+	modelErrors: zod.z.number().int(),
+	/** Complete frames with no subject. */
+	hardNegatives: zod.z.number().int(),
+	/** Subjects per class × camera × day/night. */
+	cells: zod.z.array(zod.z.object({
+		macroClass: zod.z.string(),
+		deviceId: zod.z.number(),
+		lighting: zod.z.enum([
+			"day",
+			"night",
+			"unknown"
+		]),
+		subjects: zod.z.number().int(),
+		frames: zod.z.number().int()
+	})).readonly(),
+	cameras: zod.z.array(zod.z.object({
+		deviceId: zod.z.number(),
+		frames: zod.z.number().int(),
+		completeFrames: zod.z.number().int()
+	})).readonly()
+});
+/** An immutable dataset version, without its frame list. */
+var RetrainDatasetVersionSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	createdAt: zod.z.number(),
+	selection: RetrainDatasetSelectionSchema,
+	layout: RetrainExportLayoutSchema,
+	completeOnly: zod.z.boolean(),
+	frameCount: zod.z.number().int(),
+	/** sha256 of what the frames taught when the version was frozen. */
+	annotationHash: zod.z.string(),
+	/** The export manifest schema the version was cut under. */
+	manifestSchema: zod.z.string(),
+	stats: RetrainDatasetStatsSchema
+});
+var CreateRetrainDatasetVersionResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("created"),
+	version: RetrainDatasetVersionSchema
+}), zod.z.object({
+	kind: zod.z.literal("refused"),
+	reason: zod.z.enum([
+		"empty-name",
+		"duplicate-name",
+		"no-frames"
+	])
+})]);
 /** The outcome of a lifecycle move owned by the retrain page. */
 var RetrainTransitionResultSchema = zod.z.object({
 	trackId: zod.z.string(),
@@ -26919,6 +27033,53 @@ var pipelineAnalyticsCapability = {
 			auth: "admin",
 			timeoutMs: 60 * 6e4
 		}),
+		/** The counts a selection would freeze — class × camera × day/night,
+		*  completeness — without freezing anything. Index reads only. */
+		previewRetrainDataset: method(zod.z.object({
+			selection: RetrainDatasetSelectionSchema,
+			completeOnly: zod.z.boolean().optional()
+		}), RetrainDatasetStatsSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* Freeze a dataset version: the frames the selection yields (the same plan
+		* the annotated export builds), the hash of what they teach, the export
+		* parameters and the counts. Immutable — a different selection is a new
+		* version. Export it with `getRetrainExportUrl({ datasetVersionId })`.
+		*/
+		createRetrainDatasetVersion: method(zod.z.object({
+			name: zod.z.string().max(120),
+			selection: RetrainDatasetSelectionSchema,
+			layout: RetrainExportLayoutSchema,
+			completeOnly: zod.z.boolean()
+		}), CreateRetrainDatasetVersionResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
+		/** Every dataset version, newest first. */
+		listRetrainDatasetVersions: method(zod.z.object({}), zod.z.array(RetrainDatasetVersionSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/** Delete a version. Its frames stay in the dataset. */
+		deleteRetrainDatasetVersion: method(zod.z.object({ id: zod.z.string() }), zod.z.object({ deleted: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Does the corpus still teach what the version froze? `missingFrames`
+		*  counts frames that left the dataset (or lost every box and tick). */
+		verifyRetrainDatasetVersion: method(zod.z.object({ id: zod.z.string() }), zod.z.object({
+			found: zod.z.boolean(),
+			annotationHash: zod.z.string(),
+			matches: zod.z.boolean(),
+			missingFrames: zod.z.number().int()
+		}), {
+			kind: "query",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
 		/** The enabled, vision-capable LLM profiles, each saying whether a frame
 		*  sent to it leaves the house. */
 		listRetrainAssistProfiles: method(zod.z.object({}), zod.z.array(RetrainAssistProfileSchema).readonly(), {
@@ -52312,6 +52473,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"keychainAdmin.setSystemSecret": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"keychainAdmin.status": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -53758,6 +53925,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.createRetrainDatasetVersion": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -53770,6 +53943,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.deleteRetrainDatasetVersion": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineAnalytics.deleteTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -53992,6 +54171,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRetrainDatasetVersions": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRetrainFrames": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -54034,6 +54219,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.previewRetrainDataset": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.proposeRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -54172,6 +54363,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.verifyRetrainDatasetVersion": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.wipeAllAnalytics": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -63322,6 +63519,12 @@ Object.defineProperty(exports, "buildFfmpegArgs", {
 		return buildFfmpegArgs;
 	}
 });
+Object.defineProperty(exports, "buildSecretRef", {
+	enumerable: true,
+	get: function() {
+		return buildSecretRef;
+	}
+});
 Object.defineProperty(exports, "buildStreamParamsConfigSchema", {
 	enumerable: true,
 	get: function() {
@@ -64030,6 +64233,12 @@ Object.defineProperty(exports, "secretTreeFromPaths", {
 		return secretTreeFromPaths;
 	}
 });
+Object.defineProperty(exports, "secretTreeFromSchema", {
+	enumerable: true,
+	get: function() {
+		return secretTreeFromSchema;
+	}
+});
 Object.defineProperty(exports, "settingsStoreCapability", {
 	enumerable: true,
 	get: function() {