@camstack/types 1.1.38 → 1.1.40

package/dist/addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-BtS3xMHv.js");
+const require_sleep = require("./sleep-Dqd2OlRi.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
 exports.BaseAddon = require_sleep.BaseAddon;
 exports.DATAPLANE_SECRET_HEADER = require_sleep.DATAPLANE_SECRET_HEADER;

package/dist/addon.mjs

@@ -1,3 +1,3 @@
-import { A as DATAPLANE_SECRET_HEADER, E as asString, F as scopeKey, M as ReadinessTimeoutError, a as viewerUiCapability, bt as DisposerChain, ct as normalizeAddonInitResult, dt as emitReadiness, i as deviceOpsCapability, j as ReadinessRegistry, k as parseJsonUnknown, m as expandCapMethods, o as adminUiCapability, s as createDeviceProxy, st as BaseAddon, t as sleep, w as asJsonObject, x as DeviceType, yt as EventCategory } from "./sleep-DJaTV2D7.mjs";
+import { A as parseJsonUnknown, D as asString, I as scopeKey, M as ReadinessRegistry, N as ReadinessTimeoutError, S as DeviceType, T as asJsonObject, a as viewerUiCapability, bt as EventCategory, ct as BaseAddon, ft as emitReadiness, i as deviceOpsCapability, j as DATAPLANE_SECRET_HEADER, lt as normalizeAddonInitResult, m as expandCapMethods, o as adminUiCapability, s as createDeviceProxy, t as sleep, xt as DisposerChain } from "./sleep-b4Jf2n33.mjs";
 import { t as errMsg } from "./err-msg-IQTHeDzc.mjs";
 export { BaseAddon, DATAPLANE_SECRET_HEADER, DeviceType, DisposerChain, EventCategory, ReadinessRegistry, ReadinessTimeoutError, adminUiCapability, asJsonObject, asString, createDeviceProxy, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods, normalizeAddonInitResult, parseJsonUnknown, scopeKey, sleep, viewerUiCapability };

package/dist/capabilities/capability-definition.d.ts

@@ -61,6 +61,14 @@ export interface CapabilityMethodSchema<TInput extends z.ZodType = z.ZodType, TO
     readonly access?: CapabilityMethodAccess;
     /** Moleculer action timeout override (ms). Overrides broker global requestTimeout for this action only. */
     readonly timeoutMs?: number;
+    /**
+     * When true the method is served ONLY by the cap's system/wrapper provider —
+     * it is required on `InferProvider` but OPTIONAL on `InferNativeProvider`, so
+     * per-device driver natives (RtspCamera, OnvifCamera, …) don't stub out a
+     * wrapper-only concern (e.g. a cross-device cache-overview batch). Same
+     * rationale as the status-Partial on native providers.
+     */
+    readonly systemOnly?: boolean;
 }
 /** Schema for a capability event (emitted to EventBus) */
 export interface CapabilityEventSchema<TData extends z.ZodType = z.ZodType> {
@@ -659,8 +667,15 @@ export type InferProvider<T extends CapabilityDefinition> = {
  * separate stops every device class (RtspCamera, OnvifCamera, …) from
  * having to stub out three unused methods.
  */
+type NativeMethodFn<M> = M extends CapabilityMethodSchema<infer TIn, infer TOut> ? M['kind'] extends 'subscription' ? (input: z.infer<TIn>, push: (value: z.infer<TOut>) => void) => (() => void) | void : (input: z.infer<TIn>) => Promise<z.infer<TOut>> : never;
 export type InferNativeProvider<T extends CapabilityDefinition> = {
-    readonly [K in keyof T['methods']]: T['methods'][K] extends CapabilityMethodSchema<infer TIn, infer TOut> ? T['methods'][K]['kind'] extends 'subscription' ? (input: z.infer<TIn>, push: (value: z.infer<TOut>) => void) => (() => void) | void : (input: z.infer<TIn>) => Promise<z.infer<TOut>> : never;
+    readonly [K in keyof T['methods'] as T['methods'][K] extends {
+        systemOnly: true;
+    } ? never : K]: NativeMethodFn<T['methods'][K]>;
+} & {
+    readonly [K in keyof T['methods'] as T['methods'][K] extends {
+        systemOnly: true;
+    } ? K : never]?: NativeMethodFn<T['methods'][K]>;
 } & (T extends {
     status: CapabilityStatusSchema;
 } ? Partial<DeviceStatusContribution<InferStatus<T>>> : Record<never, never>);
@@ -736,9 +751,19 @@ export interface CapabilityMethodOptions<TKind extends CapabilityMethodKind = Ca
 }
 /** Shorthand to define a method schema */
 export declare function method<TIn extends z.ZodType, TOut extends z.ZodType, TKind extends CapabilityMethodKind = 'query'>(input: TIn, output: TOut, options?: CapabilityMethodOptions<TKind>): CapabilityMethodSchema<TIn, TOut, TKind>;
+/**
+ * A wrapper/system-only method: served exclusively by the cap's system-level
+ * provider (`InferProvider`), and OPTIONAL on `InferNativeProvider` so per-device
+ * driver natives don't stub out a wrapper concern (e.g. a cross-device cache
+ * overview). The `systemOnly: true` literal is what `InferNativeProvider` keys on.
+ */
+export declare function systemMethod<TIn extends z.ZodType, TOut extends z.ZodType, TKind extends CapabilityMethodKind = 'query'>(input: TIn, output: TOut, options?: CapabilityMethodOptions<TKind>): CapabilityMethodSchema<TIn, TOut, TKind> & {
+    readonly systemOnly: true;
+};
 /** Shorthand to define an event schema */
 export declare function event<TData extends z.ZodType>(data: TData): CapabilityEventSchema<TData>;
 /** Type guard: does this cap declare the D14 device-config archetype? */
 export declare function isDeviceConfigCap(def: CapabilityDefinition | undefined): def is CapabilityDefinition & {
     deviceConfig: DeviceConfigSpec;
 };
+export {};

package/dist/capabilities/snapshot.cap.d.ts

@@ -65,6 +65,23 @@ export declare const snapshotCapability: {
         readonly invalidateCache: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             deviceId: z.ZodNumber;
         }, z.core.$strip>, z.ZodVoid, "mutation">;
+        /**
+         * Cache-only batch overview — answers from the wrapper's in-memory cache in
+         * O(n) and NEVER triggers a capture. Lets a grid skip requesting images for
+         * devices that never produced a frame, and gives it an ETag per device for
+         * conditional (304-able) image fetches. `lastCapturedAt`/`cacheAgeMs`/`etag`
+         * are null for a device with no cached frame.
+         */
+        readonly getSnapshotOverview: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceIds: z.ZodArray<z.ZodNumber>;
+        }, z.core.$strip>, z.ZodArray<z.ZodObject<{
+            deviceId: z.ZodNumber;
+            lastCapturedAt: z.ZodNullable<z.ZodNumber>;
+            cacheAgeMs: z.ZodNullable<z.ZodNumber>;
+            etag: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind> & {
+            readonly systemOnly: true;
+        };
     };
     readonly status: {
         readonly schema: z.ZodObject<{

package/dist/capabilities/user-passkeys.cap.d.ts

@@ -40,6 +40,15 @@ import { type InferProvider } from './capability-definition.js';
  *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
  *      - `removePasskey({userId, credentialId})` — revoke one credential.
  *
+ *   4. Second-factor preference (opt-in, default OFF):
+ *      Enrolling a passkey only enables passkey-FIRST sign-in. It is
+ *      demanded as a second factor after a password login ONLY when the
+ *      user explicitly opts in via `setSecondFactorPreference`.
+ *      - `getSecondFactorPreference({userId})` → `{ enabled }` (missing
+ *        row ⇒ `enabled: false`).
+ *      - `setSecondFactorPreference({userId, enabled})` — persisted by
+ *        the providing addon beside its credentials.
+ *
  * Challenges are short-lived (5 min, in-memory). The cap is internal —
  * the admin-ui composes the begin/finish round-trip and never exposes
  * the cap to non-admins.
@@ -107,6 +116,17 @@ export declare const userPasskeysCapability: {
         }, z.core.$strip>, z.ZodObject<{
             success: z.ZodLiteral<true>;
         }, z.core.$strip>, "mutation">;
+        readonly getSecondFactorPreference: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            userId: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            enabled: z.ZodBoolean;
+        }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
+        readonly setSecondFactorPreference: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            userId: z.ZodString;
+            enabled: z.ZodBoolean;
+        }, z.core.$strip>, z.ZodObject<{
+            success: z.ZodLiteral<true>;
+        }, z.core.$strip>, "mutation">;
     };
 };
 export type IUserPasskeysProvider = InferProvider<typeof userPasskeysCapability>;

package/dist/generated/addon-api.d.ts

@@ -848,6 +848,22 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             };
             meta: object;
         }>;
+        getOwnPasskeySecondFactorPreference: import("@trpc/server").TRPCQueryProcedure<{
+            input: void;
+            output: {
+                enabled: boolean;
+            };
+            meta: object;
+        }>;
+        setOwnPasskeySecondFactorPreference: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                enabled: boolean;
+            };
+            output: {
+                success: true;
+            };
+            meta: object;
+        }>;
         createShareToken: import("@trpc/server").TRPCMutationProcedure<{
             input: {
                 scope: {
@@ -12044,6 +12060,19 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             output: void;
             meta: object;
         }>;
+        getSnapshotOverview: import("@trpc/server").TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+                deviceIds: number[];
+            };
+            output: {
+                deviceId: number;
+                lastCapturedAt: number | null;
+                cacheAgeMs: number | null;
+                etag: string | null;
+            }[];
+            meta: object;
+        }>;
     }>>;
     ssoBridge: import("@trpc/server").TRPCBuiltRouter<{
         ctx: TrpcContext;
@@ -14234,6 +14263,27 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             };
             meta: object;
         }>;
+        getSecondFactorPreference: import("@trpc/server").TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+                userId: string;
+            };
+            output: {
+                enabled: boolean;
+            };
+            meta: object;
+        }>;
+        setSecondFactorPreference: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+                userId: string;
+                enabled: boolean;
+            };
+            output: {
+                success: true;
+            };
+            meta: object;
+        }>;
     }>>;
     vacuumControl: import("@trpc/server").TRPCBuiltRouter<{
         ctx: TrpcContext;
@@ -15714,6 +15764,22 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             };
             meta: object;
         }>;
+        getOwnPasskeySecondFactorPreference: import("@trpc/server").TRPCQueryProcedure<{
+            input: void;
+            output: {
+                enabled: boolean;
+            };
+            meta: object;
+        }>;
+        setOwnPasskeySecondFactorPreference: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                enabled: boolean;
+            };
+            output: {
+                success: true;
+            };
+            meta: object;
+        }>;
         createShareToken: import("@trpc/server").TRPCMutationProcedure<{
             input: {
                 scope: {
@@ -26910,6 +26976,19 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             output: void;
             meta: object;
         }>;
+        getSnapshotOverview: import("@trpc/server").TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+                deviceIds: number[];
+            };
+            output: {
+                deviceId: number;
+                lastCapturedAt: number | null;
+                cacheAgeMs: number | null;
+                etag: string | null;
+            }[];
+            meta: object;
+        }>;
     }>>;
     ssoBridge: import("@trpc/server").TRPCBuiltRouter<{
         ctx: TrpcContext;
@@ -29100,6 +29179,27 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             };
             meta: object;
         }>;
+        getSecondFactorPreference: import("@trpc/server").TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+                userId: string;
+            };
+            output: {
+                enabled: boolean;
+            };
+            meta: object;
+        }>;
+        setSecondFactorPreference: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+                userId: string;
+                enabled: boolean;
+            };
+            output: {
+                success: true;
+            };
+            meta: object;
+        }>;
     }>>;
     vacuumControl: import("@trpc/server").TRPCBuiltRouter<{
         ctx: TrpcContext;

package/dist/generated/method-access-map.d.ts

@@ -6,7 +6,7 @@
  * scope+access check inside `protectedProcedure` (see
  * `server/backend/src/api/trpc/trpc.middleware.ts`).
  *
- * Coverage: 732 method paths across 112 capabilities.
+ * Coverage: 735 method paths across 112 capabilities.
  */
 import type { CapabilityMethodAccess } from '../capabilities/capability-definition.js';
 export interface MethodAccessRecord {

package/dist/index.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-BtS3xMHv.js");
+const require_sleep = require("./sleep-Dqd2OlRi.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
 let zod = require("zod");
 //#region src/health/wiring-health.ts
@@ -18751,7 +18751,20 @@ var snapshotCapability = {
 		invalidateCache: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), {
 			kind: "mutation",
 			auth: "admin"
-		})
+		}),
+		/**
+		* Cache-only batch overview — answers from the wrapper's in-memory cache in
+		* O(n) and NEVER triggers a capture. Lets a grid skip requesting images for
+		* devices that never produced a frame, and gives it an ETag per device for
+		* conditional (304-able) image fetches. `lastCapturedAt`/`cacheAgeMs`/`etag`
+		* are null for a device with no cached frame.
+		*/
+		getSnapshotOverview: require_sleep.systemMethod(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).min(1).max(200) }), zod.z.array(zod.z.object({
+			deviceId: zod.z.number(),
+			lastCapturedAt: zod.z.number().nullable(),
+			cacheAgeMs: zod.z.number().nullable(),
+			etag: zod.z.string().nullable()
+		})))
 	},
 	status: {
 		schema: SnapshotStatusSchema,
@@ -19175,6 +19188,15 @@ getTurnServers: require_sleep.method(zod.z.void(), zod.z.array(TurnServerSchema)
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
 *
+*   4. Second-factor preference (opt-in, default OFF):
+*      Enrolling a passkey only enables passkey-FIRST sign-in. It is
+*      demanded as a second factor after a password login ONLY when the
+*      user explicitly opts in via `setSecondFactorPreference`.
+*      - `getSecondFactorPreference({userId})` → `{ enabled }` (missing
+*        row ⇒ `enabled: false`).
+*      - `setSecondFactorPreference({userId, enabled})` — persisted by
+*        the providing addon beside its credentials.
+*
 * Challenges are short-lived (5 min, in-memory). The cap is internal —
 * the admin-ui composes the begin/finish round-trip and never exposes
 * the cap to non-admins.
@@ -19248,6 +19270,15 @@ response: zod.z.record(zod.z.string(), zod.z.unknown()) }), zod.z.object({
 			kind: "mutation",
 			auth: "admin",
 			access: "delete"
+		}),
+		getSecondFactorPreference: require_sleep.method(zod.z.object({ userId: zod.z.string() }), zod.z.object({ enabled: zod.z.boolean() }), { auth: "admin" }),
+		setSecondFactorPreference: require_sleep.method(zod.z.object({
+			userId: zod.z.string(),
+			enabled: zod.z.boolean()
+		}), zod.z.object({ success: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
 		})
 	}
 };
@@ -27240,6 +27271,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"snapshot.getSnapshotOverview": {
+		capName: "snapshot",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"snapshot.invalidateCache": {
 		capName: "snapshot",
 		capScope: "device",
@@ -27948,6 +27985,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userPasskeys.getSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.listPasskeys": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -27960,6 +28003,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userPasskeys.setSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"vacuumControl.locate": {
 		capName: "vacuum-control",
 		capScope: "device",

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { $ as SubscribeAudioChunksInputSchema, A as DATAPLANE_SECRET_HEADER, B as CamStreamKindSchema, C as asJsonArray, D as parseJsonArray, E as asString, F as scopeKey, G as EncodedPacketSchema, H as CameraStreamSchema, I as BrokerStatsSchema, J as ProfileRtspEntrySchema, K as FrameHandleFormatSchema, L as BrokerStatusSchema, M as ReadinessTimeoutError, N as emitDownForOwnedCaps, O as parseJsonObject, P as readinessKey, Q as StreamSourceSchema, R as CAM_PROFILE_ORDER, S as asBoolean, T as asNumber, U as DecodedAudioChunkSchema, V as CamStreamResolutionSchema, W as DecodedFrameSchema, X as ProfileSlotStatusSchema, Y as ProfileSlotSchema, Z as StreamSourceEntrySchema, _ as resolveCapMount, _t as hydrateSchema, a as viewerUiCapability, at as parseProfileBrokerId, b as DeviceRole, bt as DisposerChain, c as createLazyTrpcSource, ct as normalizeAddonInitResult, d as DEVICE_SETTINGS_CONTRIBUTION_METHODS, dt as emitReadiness, et as SubscribeAudioChunksResultSchema, f as DEVICE_STATUS_METHOD, ft as isEvent, g as method, gt as collectHydratedFieldValues, h as isDeviceConfigCap, ht as collectHydratedFieldEntries, i as deviceOpsCapability, it as makeSourceBrokerId, j as ReadinessRegistry, k as parseJsonUnknown, l as createMirrorSource, lt as createDurableState, m as expandCapMethods, mt as WELL_KNOWN_TAB_MAP, n as sleepCancellable, nt as SubscribeFramesResultSchema, o as adminUiCapability, ot as selectAssignedProfileSlots, p as event, pt as WELL_KNOWN_TABS, q as FrameHandleSchema, r as RawStateResultSchema, rt as makeProfileBrokerId, s as createDeviceProxy, st as BaseAddon, t as sleep, tt as SubscribeFramesInputSchema, u as createSliceHandle, ut as createEvent, v as ChargingStatus, vt as resolveHydratedFieldValue, w as asJsonObject, x as DeviceType, y as DeviceFeature, yt as EventCategory, z as CamProfileSchema } from "./sleep-DJaTV2D7.mjs";
+import { $ as StreamSourceSchema, A as parseJsonUnknown, B as CamProfileSchema, C as asBoolean, D as asString, E as asNumber, F as readinessKey, G as DecodedFrameSchema, H as CamStreamResolutionSchema, I as scopeKey, J as FrameHandleSchema, K as EncodedPacketSchema, L as BrokerStatsSchema, M as ReadinessRegistry, N as ReadinessTimeoutError, O as parseJsonArray, P as emitDownForOwnedCaps, Q as StreamSourceEntrySchema, R as BrokerStatusSchema, S as DeviceType, T as asJsonObject, U as CameraStreamSchema, V as CamStreamKindSchema, W as DecodedAudioChunkSchema, X as ProfileSlotSchema, Y as ProfileRtspEntrySchema, Z as ProfileSlotStatusSchema, _ as resolveCapMount, _t as collectHydratedFieldValues, a as viewerUiCapability, at as makeSourceBrokerId, b as DeviceFeature, bt as EventCategory, c as createLazyTrpcSource, ct as BaseAddon, d as DEVICE_SETTINGS_CONTRIBUTION_METHODS, dt as createEvent, et as SubscribeAudioChunksInputSchema, f as DEVICE_STATUS_METHOD, ft as emitReadiness, g as method, gt as collectHydratedFieldEntries, h as isDeviceConfigCap, ht as WELL_KNOWN_TAB_MAP, i as deviceOpsCapability, it as makeProfileBrokerId, j as DATAPLANE_SECRET_HEADER, k as parseJsonObject, l as createMirrorSource, lt as normalizeAddonInitResult, m as expandCapMethods, mt as WELL_KNOWN_TABS, n as sleepCancellable, nt as SubscribeFramesInputSchema, o as adminUiCapability, ot as parseProfileBrokerId, p as event, pt as isEvent, q as FrameHandleFormatSchema, r as RawStateResultSchema, rt as SubscribeFramesResultSchema, s as createDeviceProxy, st as selectAssignedProfileSlots, t as sleep, tt as SubscribeAudioChunksResultSchema, u as createSliceHandle, ut as createDurableState, v as systemMethod, vt as hydrateSchema, w as asJsonArray, x as DeviceRole, xt as DisposerChain, y as ChargingStatus, yt as resolveHydratedFieldValue, z as CAM_PROFILE_ORDER } from "./sleep-b4Jf2n33.mjs";
 import { t as errMsg } from "./err-msg-IQTHeDzc.mjs";
 import { z } from "zod";
 //#region src/health/wiring-health.ts
@@ -18750,7 +18750,20 @@ var snapshotCapability = {
 		invalidateCache: method(z.object({ deviceId: z.number() }), z.void(), {
 			kind: "mutation",
 			auth: "admin"
-		})
+		}),
+		/**
+		* Cache-only batch overview — answers from the wrapper's in-memory cache in
+		* O(n) and NEVER triggers a capture. Lets a grid skip requesting images for
+		* devices that never produced a frame, and gives it an ETag per device for
+		* conditional (304-able) image fetches. `lastCapturedAt`/`cacheAgeMs`/`etag`
+		* are null for a device with no cached frame.
+		*/
+		getSnapshotOverview: systemMethod(z.object({ deviceIds: z.array(z.number()).min(1).max(200) }), z.array(z.object({
+			deviceId: z.number(),
+			lastCapturedAt: z.number().nullable(),
+			cacheAgeMs: z.number().nullable(),
+			etag: z.string().nullable()
+		})))
 	},
 	status: {
 		schema: SnapshotStatusSchema,
@@ -19174,6 +19187,15 @@ getTurnServers: method(z.void(), z.array(TurnServerSchema).readonly()) }
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
 *
+*   4. Second-factor preference (opt-in, default OFF):
+*      Enrolling a passkey only enables passkey-FIRST sign-in. It is
+*      demanded as a second factor after a password login ONLY when the
+*      user explicitly opts in via `setSecondFactorPreference`.
+*      - `getSecondFactorPreference({userId})` → `{ enabled }` (missing
+*        row ⇒ `enabled: false`).
+*      - `setSecondFactorPreference({userId, enabled})` — persisted by
+*        the providing addon beside its credentials.
+*
 * Challenges are short-lived (5 min, in-memory). The cap is internal —
 * the admin-ui composes the begin/finish round-trip and never exposes
 * the cap to non-admins.
@@ -19247,6 +19269,15 @@ response: z.record(z.string(), z.unknown()) }), z.object({
 			kind: "mutation",
 			auth: "admin",
 			access: "delete"
+		}),
+		getSecondFactorPreference: method(z.object({ userId: z.string() }), z.object({ enabled: z.boolean() }), { auth: "admin" }),
+		setSecondFactorPreference: method(z.object({
+			userId: z.string(),
+			enabled: z.boolean()
+		}), z.object({ success: z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
 		})
 	}
 };
@@ -27239,6 +27270,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"snapshot.getSnapshotOverview": {
+		capName: "snapshot",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"snapshot.invalidateCache": {
 		capName: "snapshot",
 		capScope: "device",
@@ -27947,6 +27984,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userPasskeys.getSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.listPasskeys": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -27959,6 +28002,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userPasskeys.setSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"vacuumControl.locate": {
 		capName: "vacuum-control",
 		capScope: "device",

package/dist/{sleep-BtS3xMHv.js → sleep-Dqd2OlRi.js}

@@ -2853,6 +2853,18 @@ function method(input, output, options) {
 		timeoutMs: options?.timeoutMs
 	};
 }
+/**
+* A wrapper/system-only method: served exclusively by the cap's system-level
+* provider (`InferProvider`), and OPTIONAL on `InferNativeProvider` so per-device
+* driver natives don't stub out a wrapper concern (e.g. a cross-device cache
+* overview). The `systemOnly: true` literal is what `InferNativeProvider` keys on.
+*/
+function systemMethod(input, output, options) {
+	return {
+		...method(input, output, options),
+		systemOnly: true
+	};
+}
 /** Shorthand to define an event schema */
 function event(data) {
 	return { data };
@@ -3443,6 +3455,7 @@ function createDeviceProxy(api, binding, opts) {
 		snapshot: {
 			getSnapshot: (input) => dispatch("snapshot", "snapshot", "getSnapshot", "query", input),
 			invalidateCache: (input) => dispatch("snapshot", "snapshot", "invalidateCache", "mutation", input),
+			getSnapshotOverview: (input) => dispatch("snapshot", "snapshot", "getSnapshotOverview", "query", input),
 			getStatus: (input) => dispatch("snapshot", "snapshot", "getStatus", "query", input),
 			getDeviceSettingsContribution: (input) => dispatch("snapshot", "snapshot", "getDeviceSettingsContribution", "query", input),
 			getDeviceLiveContribution: (input) => dispatch("snapshot", "snapshot", "getDeviceLiveContribution", "query", input),
@@ -4290,6 +4303,12 @@ Object.defineProperty(exports, "sleepCancellable", {
 		return sleepCancellable;
 	}
 });
+Object.defineProperty(exports, "systemMethod", {
+	enumerable: true,
+	get: function() {
+		return systemMethod;
+	}
+});
 Object.defineProperty(exports, "viewerUiCapability", {
 	enumerable: true,
 	get: function() {

package/dist/{sleep-DJaTV2D7.mjs → sleep-b4Jf2n33.mjs}

@@ -2853,6 +2853,18 @@ function method(input, output, options) {
 		timeoutMs: options?.timeoutMs
 	};
 }
+/**
+* A wrapper/system-only method: served exclusively by the cap's system-level
+* provider (`InferProvider`), and OPTIONAL on `InferNativeProvider` so per-device
+* driver natives don't stub out a wrapper concern (e.g. a cross-device cache
+* overview). The `systemOnly: true` literal is what `InferNativeProvider` keys on.
+*/
+function systemMethod(input, output, options) {
+	return {
+		...method(input, output, options),
+		systemOnly: true
+	};
+}
 /** Shorthand to define an event schema */
 function event(data) {
 	return { data };
@@ -3443,6 +3455,7 @@ function createDeviceProxy(api, binding, opts) {
 		snapshot: {
 			getSnapshot: (input) => dispatch("snapshot", "snapshot", "getSnapshot", "query", input),
 			invalidateCache: (input) => dispatch("snapshot", "snapshot", "invalidateCache", "mutation", input),
+			getSnapshotOverview: (input) => dispatch("snapshot", "snapshot", "getSnapshotOverview", "query", input),
 			getStatus: (input) => dispatch("snapshot", "snapshot", "getStatus", "query", input),
 			getDeviceSettingsContribution: (input) => dispatch("snapshot", "snapshot", "getDeviceSettingsContribution", "query", input),
 			getDeviceLiveContribution: (input) => dispatch("snapshot", "snapshot", "getDeviceLiveContribution", "query", input),
@@ -3852,4 +3865,4 @@ function sleepCancellable(ms, signal) {
 	});
 }
 //#endregion
-export { SubscribeAudioChunksInputSchema as $, DATAPLANE_SECRET_HEADER as A, CamStreamKindSchema as B, asJsonArray as C, parseJsonArray as D, asString as E, scopeKey as F, EncodedPacketSchema as G, CameraStreamSchema as H, BrokerStatsSchema as I, ProfileRtspEntrySchema as J, FrameHandleFormatSchema as K, BrokerStatusSchema as L, ReadinessTimeoutError as M, emitDownForOwnedCaps as N, parseJsonObject as O, readinessKey as P, StreamSourceSchema as Q, CAM_PROFILE_ORDER as R, asBoolean as S, asNumber as T, DecodedAudioChunkSchema as U, CamStreamResolutionSchema as V, DecodedFrameSchema as W, ProfileSlotStatusSchema as X, ProfileSlotSchema as Y, StreamSourceEntrySchema$1 as Z, resolveCapMount as _, hydrateSchema as _t, viewerUiCapability as a, parseProfileBrokerId as at, DeviceRole as b, DisposerChain as bt, createLazyTrpcSource as c, normalizeAddonInitResult as ct, DEVICE_SETTINGS_CONTRIBUTION_METHODS as d, emitReadiness as dt, SubscribeAudioChunksResultSchema as et, DEVICE_STATUS_METHOD as f, isEvent as ft, method as g, collectHydratedFieldValues as gt, isDeviceConfigCap as h, collectHydratedFieldEntries as ht, deviceOpsCapability as i, makeSourceBrokerId as it, ReadinessRegistry as j, parseJsonUnknown as k, createMirrorSource as l, createDurableState as lt, expandCapMethods as m, WELL_KNOWN_TAB_MAP as mt, sleepCancellable as n, SubscribeFramesResultSchema as nt, adminUiCapability as o, selectAssignedProfileSlots as ot, event as p, WELL_KNOWN_TABS as pt, FrameHandleSchema as q, RawStateResultSchema as r, makeProfileBrokerId as rt, createDeviceProxy as s, BaseAddon as st, sleep as t, SubscribeFramesInputSchema as tt, createSliceHandle as u, createEvent as ut, ChargingStatus as v, resolveHydratedFieldValue as vt, asJsonObject as w, DeviceType as x, DeviceFeature as y, EventCategory as yt, CamProfileSchema as z };
+export { StreamSourceSchema as $, parseJsonUnknown as A, CamProfileSchema as B, asBoolean as C, asString as D, asNumber as E, readinessKey as F, DecodedFrameSchema as G, CamStreamResolutionSchema as H, scopeKey as I, FrameHandleSchema as J, EncodedPacketSchema as K, BrokerStatsSchema as L, ReadinessRegistry as M, ReadinessTimeoutError as N, parseJsonArray as O, emitDownForOwnedCaps as P, StreamSourceEntrySchema$1 as Q, BrokerStatusSchema as R, DeviceType as S, asJsonObject as T, CameraStreamSchema as U, CamStreamKindSchema as V, DecodedAudioChunkSchema as W, ProfileSlotSchema as X, ProfileRtspEntrySchema as Y, ProfileSlotStatusSchema as Z, resolveCapMount as _, collectHydratedFieldValues as _t, viewerUiCapability as a, makeSourceBrokerId as at, DeviceFeature as b, EventCategory as bt, createLazyTrpcSource as c, BaseAddon as ct, DEVICE_SETTINGS_CONTRIBUTION_METHODS as d, createEvent as dt, SubscribeAudioChunksInputSchema as et, DEVICE_STATUS_METHOD as f, emitReadiness as ft, method as g, collectHydratedFieldEntries as gt, isDeviceConfigCap as h, WELL_KNOWN_TAB_MAP as ht, deviceOpsCapability as i, makeProfileBrokerId as it, DATAPLANE_SECRET_HEADER as j, parseJsonObject as k, createMirrorSource as l, normalizeAddonInitResult as lt, expandCapMethods as m, WELL_KNOWN_TABS as mt, sleepCancellable as n, SubscribeFramesInputSchema as nt, adminUiCapability as o, parseProfileBrokerId as ot, event as p, isEvent as pt, FrameHandleFormatSchema as q, RawStateResultSchema as r, SubscribeFramesResultSchema as rt, createDeviceProxy as s, selectAssignedProfileSlots as st, sleep as t, SubscribeAudioChunksResultSchema as tt, createSliceHandle as u, createDurableState as ut, systemMethod as v, hydrateSchema as vt, asJsonArray as w, DeviceRole as x, DisposerChain as xt, ChargingStatus as y, resolveHydratedFieldValue as yt, CAM_PROFILE_ORDER as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/types",
-  "version": "1.1.38",
+  "version": "1.1.40",
   "description": "Shared types, interfaces, and model catalogs for the CamStack detection ecosystem",
   "keywords": [
     "camstack",