@camstack/types 1.2.326 → 1.2.327

package/dist/index.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-DPar9AHl.js");
+const require_sleep = require("./sleep-az1qiFzK.js");
 const require_event_category = require("./event-category-CtBAl88K.js");
 const require_composition = require("./composition-BLWAivB2.js");
 const require_err_msg = require("./err-msg-Dx2Kor0g.js");
@@ -14084,6 +14084,10 @@ var DeviceInfoSchema = zod.z.object({
 	isCamera: zod.z.boolean(),
 	/** Current config values — serializable snapshot */
 	config: zod.z.record(zod.z.string(), zod.z.unknown()),
+	/** Paths inside `config` the device's schema declares secret (D783) —
+	*  what the non-admin redaction withholds. Paths, never values. Absent
+	*  when the owning runner has not reported them. */
+	secretConfigPaths: zod.z.array(zod.z.string()).optional(),
 	/** Hardware + identity blob (manufacturer / model / firmware / sn /
 	*  uid / mac / …). Populated by drivers; editable via setMetadata. */
 	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).nullable().optional(),
@@ -14304,7 +14308,13 @@ var DeviceRegisterPayloadSchema = zod.z.object({
 	*  call (workers re-register on init), so probe-driven updates
 	*  (e.g. PTZ flag flipping after the abilities probe) propagate. */
 	features: zod.z.array(zod.z.string()).optional(),
-	config: zod.z.record(zod.z.string(), zod.z.unknown())
+	config: zod.z.record(zod.z.string(), zod.z.unknown()),
+	/** Config paths the device's own schema DECLARES secret
+	*  (`.meta({ secret: true })` — dotted, `[]` for array items, e.g.
+	*  `connection.password`). Re-published on every register; the non-admin
+	*  redaction withholds them at any depth (D783). Optional: an older runner
+	*  omits it and the keyword backstop applies. */
+	secretConfigPaths: zod.z.array(zod.z.string()).optional()
 });
 var DeviceRemovePayloadSchema = zod.z.object({ deviceId: zod.z.number() });
 var DevicePersistConfigPayloadSchema = zod.z.object({
@@ -17538,7 +17548,14 @@ var RedirectLoginMethodSchema = zod.z.object({
 	icon: zod.z.string().optional(),
 	/** Addon-owned HTTP route the button navigates to (GET). */
 	startUrl: zod.z.string(),
-	stage: LoginStageEnum
+	stage: LoginStageEnum,
+	/**
+	* The provider names an external identity a signed-in user can link to
+	* their own account (D782): `auth.listLinkableProviders` /
+	* `beginExternalLink` offer exactly the redirect methods that set this,
+	* whatever their id. Absent / false — a login button only (magic-link).
+	*/
+	linkable: zod.z.boolean().optional()
 });
 /**
 * A Module-Federation widget the login page mounts for an in-page
@@ -24768,7 +24785,13 @@ var RetrainFrameSchema = zod.z.object({
 	sizeBytes: zod.z.number().int(),
 	width: zod.z.number().int(),
 	height: zod.z.number().int(),
-	copiedAt: zod.z.number()
+	copiedAt: zod.z.number(),
+	/** When the CAMERA captured the frame. Absent on a copy taken before D785. */
+	capturedAt: zod.z.number().optional(),
+	/** The operator's "every subject in this frame is boxed". Detector
+	*  evaluation keeps only complete frames: an unboxed subject would count as
+	*  a false positive. */
+	complete: zod.z.boolean()
 });
 /** Why a copy-on-select could not be honoured — named, never a silent skip. */
 var RetrainCopyRefusalSchema = zod.z.enum([
@@ -24789,6 +24812,51 @@ var RetrainFrameListSchema = zod.z.object({
 	/** What the page pre-selects — the native key frame when one survives. */
 	autoPickMediaId: zod.z.number().int().optional()
 });
+/**
+* Which frames an annotated export carries. Every field narrows; an empty
+* filter is every annotated copy. A dataset VERSION is a frozen `frameIds`
+* list owned by whoever trains (the training orchestrator), so `frameIds` is
+* the primitive a version export uses; `batchId` re-selects what an earlier
+* export carried (`exportedInBatch`).
+*/
+var RetrainExportFilterSchema = zod.z.object({
+	deviceIds: zod.z.array(zod.z.number()).optional(),
+	frameIds: zod.z.array(zod.z.string()).max(2e4).optional(),
+	batchId: zod.z.string().optional(),
+	/** Only frames the operator marked complete (all subjects boxed). */
+	completeOnly: zod.z.boolean().optional()
+});
+/**
+* `frames`: the full frame copies, boxes in `annotations.json`.
+* `crops`: additionally one JPEG per subject, cut with the runtime detail-crop
+* convention — the classifier layout.
+*/
+var RetrainExportLayoutSchema = zod.z.enum(["frames", "crops"]);
+/**
+* Where `writeRetrainArchive` streams the tar: one HTTP request whose body is
+* the archive, sent chunk by chunk. Covers a presigned PUT and a provider
+* addon's data-plane upload route alike. Headers are sent verbatim and never
+* logged.
+*/
+var RetrainArchiveTargetSchema = zod.z.object({
+	kind: zod.z.literal("http"),
+	method: zod.z.enum(["PUT", "POST"]),
+	url: zod.z.string().url(),
+	headers: zod.z.record(zod.z.string(), zod.z.string()).optional()
+});
+var RetrainArchiveResultSchema = zod.z.object({
+	batchId: zod.z.string(),
+	frames: zod.z.number().int(),
+	crops: zod.z.number().int(),
+	annotations: zod.z.number().int(),
+	/** Frames planned but not shipped (unreadable copy, path too long). */
+	missing: zod.z.number().int(),
+	bytes: zod.z.number().int(),
+	/** sha256 of the exact bytes sent. */
+	sha256: zod.z.string(),
+	/** The target's HTTP status. */
+	status: zod.z.number().int()
+});
 /** What the operator asked the assist to look for. */
 var RetrainAssistSubjectSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
 	kind: zod.z.literal("package"),
@@ -26177,11 +26245,41 @@ var pipelineAnalyticsCapability = {
 		* out, so two crops of the same subject can never end up in one feature
 		* space (D52).
 		*/
-		getRetrainExportUrl: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), zod.z.object({ url: zod.z.string() }), {
+		getRetrainExportUrl: require_sleep.method(RetrainExportFilterSchema.extend({ layout: RetrainExportLayoutSchema.optional() }), zod.z.object({ url: zod.z.string() }), {
 			kind: "query",
 			auth: "admin"
 		}),
 		/**
+		* The operator's "every subject in this frame is boxed" — set and cleared
+		* by hand, never derived: a frame with no box may be a complete hard
+		* negative, and a frame with three boxes may still miss a fourth person.
+		*/
+		setRetrainFrameComplete: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			frameId: zod.z.string(),
+			complete: zod.z.boolean()
+		}), RetrainFrameSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Stream the annotated archive to a TARGET instead of a browser — the
+		* same tar `getRetrainExportUrl` serves (manifest first, one JPEG in
+		* memory at a time, paced), written chunk by chunk into one HTTP request.
+		* The bytes never cross this cap and never land on the hub's disk; the
+		* answer is what was sent, with its sha256.
+		*/
+		writeRetrainArchive: require_sleep.method(zod.z.object({
+			filter: RetrainExportFilterSchema,
+			layout: RetrainExportLayoutSchema,
+			target: RetrainArchiveTargetSchema
+		}), RetrainArchiveResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 60 * 6e4
+		}),
+		/**
 		* The media an EVENT owns.
 		*
 		* `ownerType` is REQUIRED, and that is the whole correction (D482). An
@@ -30951,7 +31049,19 @@ var SsoBridgeClaimsSchema = zod.z.object({
 	* editing a descriptor must not retroactively extend or shorten a link the
 	* operator already consented to.
 	*/
-	refreshTtl: zod.z.union([zod.z.number().int().positive(), zod.z.literal("never")]).optional()
+	refreshTtl: zod.z.union([zod.z.number().int().positive(), zod.z.literal("never")]).optional(),
+	/**
+	* Opaque handle of a hub-side LINK intent (D782). Set by an OIDC callback
+	* that was started from a signed-in user's "Link" button: the finish then
+	* links this identity to the intent's user instead of signing anyone in.
+	* The handle carries no user id — the hub resolves it, single-use.
+	*/
+	linkIntent: zod.z.string().optional(),
+	/**
+	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
+	* subject is unique only per issuer, so a link is bound to it.
+	*/
+	issuer: zod.z.string().optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -47165,6 +47275,22 @@ var TotpStatusSchema = zod.z.object({
 * delegation, structural caller-scope subset check goes inside the
 * provider.
 */
+var ExternalIdentitySchema = zod.z.object({
+	/** Login-method id of the provider instance, e.g. `auth-oidc/authentik`. */
+	provider: zod.z.string(),
+	/** The IdP's stable subject (`sub`) for this account. */
+	subject: zod.z.string(),
+	/** The verified `iss` of the IdP the identity was linked under — `sub` is unique only per issuer. */
+	issuer: zod.z.string(),
+	userId: zod.z.string(),
+	/** What the IdP called the account at link time (username / email) — display only. */
+	label: zod.z.string().optional(),
+	linkedAt: zod.z.number()
+});
+var ExternalIdentityKeySchema = zod.z.object({
+	provider: zod.z.string().min(1),
+	subject: zod.z.string().min(1)
+});
 var userManagementCapability = {
 	name: "user-management",
 	scope: "system",
@@ -47307,6 +47433,32 @@ var userManagementCapability = {
 			username: zod.z.string(),
 			scopes: zod.z.array(TokenScopeSchema)
 		}).nullable(), { access: "view" }),
+		listExternalIdentities: require_sleep.method(zod.z.object({ userId: zod.z.string() }), zod.z.array(ExternalIdentitySchema), { auth: "admin" }),
+		/** The user an identity is linked to, or `null`. */
+		findUserByExternalIdentity: require_sleep.method(ExternalIdentityKeySchema, zod.z.object({
+			userId: zod.z.string(),
+			issuer: zod.z.string()
+		}).nullable(), { auth: "admin" }),
+		/**
+		* Link `(provider, subject)` to `userId`. Idempotent for the same user;
+		* REFUSES (throws) an identity already linked to another user, and a
+		* user that does not exist.
+		*/
+		linkExternalIdentity: require_sleep.method(ExternalIdentityKeySchema.extend({
+			userId: zod.z.string(),
+			issuer: zod.z.string().min(1),
+			label: zod.z.string().optional()
+		}), zod.z.object({ success: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
+		}),
+		/** Remove one link of `userId`. `success: false` when it was not linked to that user. */
+		unlinkExternalIdentity: require_sleep.method(ExternalIdentityKeySchema.extend({ userId: zod.z.string() }), zod.z.object({ success: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "delete"
+		}),
 		listOauthSessions: require_sleep.method(zod.z.void(), zod.z.array(OauthSessionSummarySchema), { auth: "admin" }),
 		revokeOauthSession: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.object({ success: zod.z.boolean() }), {
 			kind: "mutation",
@@ -56007,6 +56159,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.setRetrainFrameComplete": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -56043,6 +56201,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.writeRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineExecutor.cacheFrameInPool": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -58395,18 +58559,36 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userManagement.findUserByExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.getTotpStatus": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.linkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.listExternalIdentities": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.listOauthSessions": {
 		capName: "user-management",
 		capScope: "system",
@@ -58485,6 +58667,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userManagement.unlinkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"userManagement.updateUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -61350,6 +61538,15 @@ var ENTRY_BY_KEY = new Map(DISPLAY_ICON_VOCABULARY.map((e) => [e.key, e]));
 function isDisplayIconKey(value) {
 	return typeof value === "string" && ENTRY_BY_KEY.has(value);
 }
+/**
+* A stored icon value as a vocabulary key: `value` when it IS one, `fallback`
+* otherwise. For an `icon` settings field (D780) whose stored value may
+* predate the vocabulary (a free-text lucide name) — the field's default is
+* drawn rather than nothing.
+*/
+function resolveDisplayIconKey(value, fallback) {
+	return typeof value === "string" && isDisplayIconKey(value) ? value : fallback;
+}
 /** The entry for a key, or `undefined` — never a guessed one. */
 function displayIconEntry(key) {
 	return ENTRY_BY_KEY.get(key);
@@ -62438,6 +62635,11 @@ function zodToConfigField(key, schema, description) {
 		description,
 		default: defaultValue
 	};
+	if (inner instanceof zod.z.ZodString && require_sleep.isZodSecret(schema)) return {
+		...base,
+		type: "password",
+		showToggle: true
+	};
 	if (inner instanceof zod.z.ZodString) return buildStringField(key, base);
 	if (inner instanceof zod.z.ZodNumber) return buildNumberField(inner, base);
 	if (inner instanceof zod.z.ZodBoolean) return {
@@ -62445,12 +62647,16 @@ function zodToConfigField(key, schema, description) {
 		type: "boolean"
 	};
 	if (inner instanceof zod.z.ZodEnum) return buildEnumField(inner, base);
-	if (inner instanceof zod.z.ZodArray || inner instanceof zod.z.ZodObject) return {
-		...base,
-		type: "textarea",
-		rows: 6,
-		isJson: true
-	};
+	if (inner instanceof zod.z.ZodArray || inner instanceof zod.z.ZodObject) {
+		const holdsSecret = require_sleep.isZodSecret(schema) || require_sleep.collectZodSecretPaths(schema).length > 0;
+		return {
+			...base,
+			type: "textarea",
+			rows: 6,
+			isJson: true,
+			...holdsSecret ? { secret: true } : {}
+		};
+	}
 	return {
 		...base,
 		type: "text"
@@ -65176,6 +65382,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.setRetrainFrameComplete": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.setTrackFlags": [{
 		name: "deviceId",
 		form: "single",
@@ -67512,6 +67723,10 @@ function createSystemProxy(api) {
 			oauthExchangeCode: (input) => dispatch("userManagement", "oauthExchangeCode", "mutation", input),
 			oauthRefresh: (input) => dispatch("userManagement", "oauthRefresh", "mutation", input),
 			oauthVerifyAccessToken: (input) => dispatch("userManagement", "oauthVerifyAccessToken", "query", input),
+			listExternalIdentities: (input) => dispatch("userManagement", "listExternalIdentities", "query", input),
+			findUserByExternalIdentity: (input) => dispatch("userManagement", "findUserByExternalIdentity", "query", input),
+			linkExternalIdentity: (input) => dispatch("userManagement", "linkExternalIdentity", "mutation", input),
+			unlinkExternalIdentity: (input) => dispatch("userManagement", "unlinkExternalIdentity", "mutation", input),
 			listOauthSessions: (input) => dispatch("userManagement", "listOauthSessions", "query", input),
 			revokeOauthSession: (input) => dispatch("userManagement", "revokeOauthSession", "mutation", input)
 		}
@@ -76051,6 +76266,8 @@ exports.ExtensionSlotValueSchema = ExtensionSlotValueSchema;
 exports.ExtensionSourceAvailabilitySchema = ExtensionSourceAvailabilitySchema;
 exports.ExtensionSourceHealthSchema = ExtensionSourceHealthSchema;
 exports.ExtensionSourceSchema = ExtensionSourceSchema;
+exports.ExternalIdentityKeySchema = ExternalIdentityKeySchema;
+exports.ExternalIdentitySchema = ExternalIdentitySchema;
 exports.FEEDER_EXAMPLE_ADDON_ID = FEEDER_EXAMPLE_ADDON_ID;
 exports.FEEDER_EXAMPLE_HA_DEVICE_ID = FEEDER_EXAMPLE_HA_DEVICE_ID;
 exports.FFMPEG_PATH_ENV = require_composition.FFMPEG_PATH_ENV;
@@ -76741,9 +76958,13 @@ exports.RetrainAnnotationDraftSchema = RetrainAnnotationDraftSchema;
 exports.RetrainAnnotationKindSchema = RetrainAnnotationKindSchema;
 exports.RetrainAnnotationSchema = RetrainAnnotationSchema;
 exports.RetrainAnnotationSourceSchema = RetrainAnnotationSourceSchema;
+exports.RetrainArchiveResultSchema = RetrainArchiveResultSchema;
+exports.RetrainArchiveTargetSchema = RetrainArchiveTargetSchema;
 exports.RetrainAssistResultSchema = RetrainAssistResultSchema;
 exports.RetrainAssistSubjectSchema = RetrainAssistSubjectSchema;
 exports.RetrainCopyRefusalSchema = RetrainCopyRefusalSchema;
+exports.RetrainExportFilterSchema = RetrainExportFilterSchema;
+exports.RetrainExportLayoutSchema = RetrainExportLayoutSchema;
 exports.RetrainFrameCandidateSchema = RetrainFrameCandidateSchema;
 exports.RetrainFrameListSchema = RetrainFrameListSchema;
 exports.RetrainFrameSchema = RetrainFrameSchema;
@@ -76774,6 +76995,7 @@ exports.SCENE_DEFAULT_UNCOVERED_POLICY = SCENE_DEFAULT_UNCOVERED_POLICY;
 exports.SCENE_DIVERGED = SCENE_DIVERGED;
 exports.SCENE_RESET_RECAPTURES = SCENE_RESET_RECAPTURES;
 exports.SCOPE_PRESETS = SCOPE_PRESETS;
+exports.SECRET_META = require_sleep.SECRET_META;
 exports.SENSOR_FEATURES = SENSOR_FEATURES;
 exports.SENSOR_MAP = SENSOR_MAP;
 exports.SESSION_PLACEMENT_SETTING_KEY = SESSION_PLACEMENT_SETTING_KEY;
@@ -77160,6 +77382,7 @@ exports.collectHydratedFieldEntries = require_sleep.collectHydratedFieldEntries;
 exports.collectHydratedFieldValues = require_sleep.collectHydratedFieldValues;
 exports.collectModelBoundKeys = collectModelBoundKeys;
 exports.collectSecretConfigKeys = collectSecretConfigKeys;
+exports.collectZodSecretPaths = require_sleep.collectZodSecretPaths;
 exports.colorCapability = colorCapability;
 exports.colorForKind = colorForKind;
 exports.commitWatchdogRestart = commitWatchdogRestart;
@@ -77430,6 +77653,7 @@ exports.isSystemEventSummaryRule = isSystemEventSummaryRule;
 exports.isSystemRuleKind = isSystemRuleKind;
 exports.isVectorIndexDimConflict = isVectorIndexDimConflict;
 exports.isVoidInput = isVoidInput;
+exports.isZodSecret = require_sleep.isZodSecret;
 exports.ituDbfsFromPreEpoch = ituDbfsFromPreEpoch;
 exports.jobKindSchema = jobKindSchema;
 exports.kebabToCamel = kebabToCamel;
@@ -77611,6 +77835,7 @@ exports.resolveCoreBlockFiles = resolveCoreBlockFiles;
 exports.resolveCreateExportSubject = resolveCreateExportSubject;
 exports.resolveDeviceControlKind = resolveDeviceControlKind;
 exports.resolveDeviceProfile = resolveDeviceProfile;
+exports.resolveDisplayIconKey = resolveDisplayIconKey;
 exports.resolveEffectiveShares = resolveEffectiveShares;
 exports.resolveEgressDecodeHwAccel = resolveEgressDecodeHwAccel;
 exports.resolveExportProfiles = resolveExportProfiles;