@camstack/types 1.2.326 → 1.2.328

package/dist/capabilities/system.cap.d.ts

@@ -124,8 +124,8 @@ declare const SetSiteLocationInputSchema: z.ZodNullable<z.ZodObject<{
  */
 declare const TransportPlaneSchema: z.ZodEnum<{
     unknown: "unknown";
-    mesh: "mesh";
     http: "http";
+    mesh: "mesh";
     ws: "ws";
 }>;
 /**
@@ -152,8 +152,8 @@ declare const TransportPlaneCountsSchema: z.ZodObject<{
 declare const RequestCensusGroupSchema: z.ZodObject<{
     plane: z.ZodEnum<{
         unknown: "unknown";
-        mesh: "mesh";
         http: "http";
+        mesh: "mesh";
         ws: "ws";
     }>;
     procedure: z.ZodString;
@@ -220,8 +220,8 @@ declare const RequestCensusSnapshotSchema: z.ZodObject<{
     groups: z.ZodReadonly<z.ZodArray<z.ZodObject<{
         plane: z.ZodEnum<{
             unknown: "unknown";
-            mesh: "mesh";
             http: "http";
+            mesh: "mesh";
             ws: "ws";
         }>;
         procedure: z.ZodString;
@@ -277,8 +277,8 @@ declare const RequestCensusStatusSchema: z.ZodObject<{
     groups: z.ZodReadonly<z.ZodArray<z.ZodObject<{
         plane: z.ZodEnum<{
             unknown: "unknown";
-            mesh: "mesh";
             http: "http";
+            mesh: "mesh";
             ws: "ws";
         }>;
         procedure: z.ZodString;
@@ -293,9 +293,9 @@ declare const RequestCensusStatusSchema: z.ZodObject<{
 }, z.core.$strip>;
 /** Severity vocabulary. Mirrors `LogLevel` in `interfaces/logging.ts`. */
 declare const LogLevelSchema: z.ZodEnum<{
+    info: "info";
     error: "error";
     debug: "debug";
-    info: "info";
     warn: "warn";
 }>;
 /**
@@ -347,18 +347,18 @@ declare const LoggingLevelLayerSchema: z.ZodObject<{
     nodeId: z.ZodNullable<z.ZodString>;
     component: z.ZodNullable<z.ZodString>;
     level: z.ZodNullable<z.ZodEnum<{
+        info: "info";
         error: "error";
         debug: "debug";
-        info: "info";
         warn: "warn";
     }>>;
 }, z.core.$strip>;
 /** What a line is judged against, and WHICH layer decided it. */
 declare const LoggingEffectiveSchema: z.ZodObject<{
     level: z.ZodEnum<{
+        info: "info";
         error: "error";
         debug: "debug";
-        info: "info";
         warn: "warn";
     }>;
     levelSource: z.ZodEnum<{
@@ -379,9 +379,9 @@ declare const LoggingExplicitSchema: z.ZodObject<{
         nodeId: z.ZodNullable<z.ZodString>;
         component: z.ZodNullable<z.ZodString>;
         level: z.ZodNullable<z.ZodEnum<{
+            info: "info";
             error: "error";
             debug: "debug";
-            info: "info";
             warn: "warn";
         }>>;
     }, z.core.$strip>>>;
@@ -449,9 +449,9 @@ declare const LogChannelWindowPatchSchema: z.ZodObject<{
  */
 declare const LoggingSettingsPatchSchema: z.ZodObject<{
     level: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        info: "info";
         error: "error";
         debug: "debug";
-        info: "info";
         warn: "warn";
     }>>>;
     diagnostics: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
@@ -539,9 +539,9 @@ declare const SetLoggingSettingsInputSchema: z.ZodObject<{
     scopeComponent: z.ZodOptional<z.ZodString>;
     patch: z.ZodObject<{
         level: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            info: "info";
             error: "error";
             debug: "debug";
-            info: "info";
             warn: "warn";
         }>>>;
         diagnostics: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
@@ -573,9 +573,9 @@ declare const LoggingSettingsStateSchema: z.ZodObject<{
     scopeComponent: z.ZodNullable<z.ZodString>;
     effective: z.ZodObject<{
         level: z.ZodEnum<{
+            info: "info";
             error: "error";
             debug: "debug";
-            info: "info";
             warn: "warn";
         }>;
         levelSource: z.ZodEnum<{
@@ -595,9 +595,9 @@ declare const LoggingSettingsStateSchema: z.ZodObject<{
             nodeId: z.ZodNullable<z.ZodString>;
             component: z.ZodNullable<z.ZodString>;
             level: z.ZodNullable<z.ZodEnum<{
+                info: "info";
                 error: "error";
                 debug: "debug";
-                info: "info";
                 warn: "warn";
             }>>;
         }, z.core.$strip>>>;
@@ -615,8 +615,8 @@ declare const LoggingSettingsStateSchema: z.ZodObject<{
         name: z.ZodString;
         description: z.ZodString;
         defaultLevel: z.ZodEnum<{
-            error: "error";
             info: "info";
+            error: "error";
             warn: "warn";
         }>;
         perDevice: z.ZodBoolean;
@@ -779,8 +779,8 @@ export declare const systemCapability: {
             groups: z.ZodReadonly<z.ZodArray<z.ZodObject<{
                 plane: z.ZodEnum<{
                     unknown: "unknown";
-                    mesh: "mesh";
                     http: "http";
+                    mesh: "mesh";
                     ws: "ws";
                 }>;
                 procedure: z.ZodString;
@@ -879,9 +879,9 @@ export declare const systemCapability: {
             scopeComponent: z.ZodNullable<z.ZodString>;
             effective: z.ZodObject<{
                 level: z.ZodEnum<{
+                    info: "info";
                     error: "error";
                     debug: "debug";
-                    info: "info";
                     warn: "warn";
                 }>;
                 levelSource: z.ZodEnum<{
@@ -901,9 +901,9 @@ export declare const systemCapability: {
                     nodeId: z.ZodNullable<z.ZodString>;
                     component: z.ZodNullable<z.ZodString>;
                     level: z.ZodNullable<z.ZodEnum<{
+                        info: "info";
                         error: "error";
                         debug: "debug";
-                        info: "info";
                         warn: "warn";
                     }>>;
                 }, z.core.$strip>>>;
@@ -921,8 +921,8 @@ export declare const systemCapability: {
                 name: z.ZodString;
                 description: z.ZodString;
                 defaultLevel: z.ZodEnum<{
-                    error: "error";
                     info: "info";
+                    error: "error";
                     warn: "warn";
                 }>;
                 perDevice: z.ZodBoolean;
@@ -951,9 +951,9 @@ export declare const systemCapability: {
             scopeComponent: z.ZodOptional<z.ZodString>;
             patch: z.ZodObject<{
                 level: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+                    info: "info";
                     error: "error";
                     debug: "debug";
-                    info: "info";
                     warn: "warn";
                 }>>>;
                 diagnostics: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
@@ -975,9 +975,9 @@ export declare const systemCapability: {
             scopeComponent: z.ZodNullable<z.ZodString>;
             effective: z.ZodObject<{
                 level: z.ZodEnum<{
+                    info: "info";
                     error: "error";
                     debug: "debug";
-                    info: "info";
                     warn: "warn";
                 }>;
                 levelSource: z.ZodEnum<{
@@ -997,9 +997,9 @@ export declare const systemCapability: {
                     nodeId: z.ZodNullable<z.ZodString>;
                     component: z.ZodNullable<z.ZodString>;
                     level: z.ZodNullable<z.ZodEnum<{
+                        info: "info";
                         error: "error";
                         debug: "debug";
-                        info: "info";
                         warn: "warn";
                     }>>;
                 }, z.core.$strip>>>;
@@ -1017,8 +1017,8 @@ export declare const systemCapability: {
                 name: z.ZodString;
                 description: z.ZodString;
                 defaultLevel: z.ZodEnum<{
-                    error: "error";
                     info: "info";
+                    error: "error";
                     warn: "warn";
                 }>;
                 perDevice: z.ZodBoolean;

package/dist/capabilities/user-management.cap.d.ts

@@ -433,6 +433,18 @@ declare const OauthSessionSummarySchema: z.ZodObject<{
  * delegation, structural caller-scope subset check goes inside the
  * provider.
  */
+declare const ExternalIdentitySchema: z.ZodObject<{
+    provider: z.ZodString;
+    subject: z.ZodString;
+    issuer: z.ZodString;
+    userId: z.ZodString;
+    label: z.ZodOptional<z.ZodString>;
+    linkedAt: z.ZodNumber;
+}, z.core.$strip>;
+declare const ExternalIdentityKeySchema: z.ZodObject<{
+    provider: z.ZodString;
+    subject: z.ZodString;
+}, z.core.$strip>;
 export declare const userManagementCapability: {
     readonly name: "user-management";
     readonly scope: "system";
@@ -1228,6 +1240,46 @@ export declare const userManagementCapability: {
                 includeLinked: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strip>], "type">>>;
         }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
+        readonly listExternalIdentities: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            userId: z.ZodString;
+        }, z.core.$strip>, z.ZodArray<z.ZodObject<{
+            provider: z.ZodString;
+            subject: z.ZodString;
+            issuer: z.ZodString;
+            userId: z.ZodString;
+            label: z.ZodOptional<z.ZodString>;
+            linkedAt: z.ZodNumber;
+        }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
+        /** The user an identity is linked to, or `null`. */
+        readonly findUserByExternalIdentity: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            provider: z.ZodString;
+            subject: z.ZodString;
+        }, z.core.$strip>, z.ZodNullable<z.ZodObject<{
+            userId: z.ZodString;
+            issuer: z.ZodString;
+        }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
+        /**
+         * Link `(provider, subject)` to `userId`. Idempotent for the same user;
+         * REFUSES (throws) an identity already linked to another user, and a
+         * user that does not exist.
+         */
+        readonly linkExternalIdentity: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            provider: z.ZodString;
+            subject: z.ZodString;
+            userId: z.ZodString;
+            issuer: z.ZodString;
+            label: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>, z.ZodObject<{
+            success: z.ZodLiteral<true>;
+        }, z.core.$strip>, "mutation">;
+        /** Remove one link of `userId`. `success: false` when it was not linked to that user. */
+        readonly unlinkExternalIdentity: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            provider: z.ZodString;
+            subject: z.ZodString;
+            userId: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            success: z.ZodBoolean;
+        }, z.core.$strip>, "mutation">;
         readonly listOauthSessions: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodArray<z.ZodObject<{
             id: z.ZodString;
             userId: z.ZodString;
@@ -1293,4 +1345,4 @@ export declare const userManagementCapability: {
     };
 };
 export type IUserManagementProvider = InferProvider<typeof userManagementCapability>;
-export { ApiKeySummarySchema, CreateApiKeyInputSchema, CreateApiKeyResultSchema, CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, CreateUserInputSchema, OauthSessionSummarySchema, ScopedTokenSummarySchema, UpdateUserInputSchema, UserSummarySchema, };
+export { ApiKeySummarySchema, CreateApiKeyInputSchema, CreateApiKeyResultSchema, CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, CreateUserInputSchema, ExternalIdentityKeySchema, ExternalIdentitySchema, OauthSessionSummarySchema, ScopedTokenSummarySchema, UpdateUserInputSchema, UserSummarySchema, };

package/dist/capabilities/webrtc-session.cap.d.ts

@@ -87,8 +87,8 @@ export type WebrtcStreamChoice = z.infer<typeof WebrtcStreamChoiceSchema>;
 export declare const WebrtcLadderDecisionSchema: z.ZodObject<{
     cause: z.ZodEnum<{
         healthy: "healthy";
-        loss: "loss";
         stall: "stall";
+        loss: "loss";
     }>;
     tier: z.ZodNullable<z.ZodEnum<{
         high: "high";
@@ -211,8 +211,8 @@ export declare const WebrtcSessionDebugSchema: z.ZodObject<{
     lastDecision: z.ZodNullable<z.ZodObject<{
         cause: z.ZodEnum<{
             healthy: "healthy";
-            loss: "loss";
             stall: "stall";
+            loss: "loss";
         }>;
         tier: z.ZodNullable<z.ZodEnum<{
             high: "high";
@@ -652,8 +652,8 @@ export declare const webrtcSessionCapability: {
             lastDecision: z.ZodNullable<z.ZodObject<{
                 cause: z.ZodEnum<{
                     healthy: "healthy";
-                    loss: "loss";
                     stall: "stall";
+                    loss: "loss";
                 }>;
                 tier: z.ZodNullable<z.ZodEnum<{
                     high: "high";

package/dist/client.js

@@ -5752,6 +5752,18 @@ function createDeviceProxy(api, binding, opts) {
 		completeRetrainTrack: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "completeRetrainTrack", "mutation", input),
 		restageRetrainTrack: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "restageRetrainTrack", "mutation", input),
 		getRetrainExportUrl: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getRetrainExportUrl", "query", input),
+		setRetrainFrameComplete: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "setRetrainFrameComplete", "mutation", input),
+		writeRetrainArchive: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "writeRetrainArchive", "mutation", input),
+		listRetrainAssistProfiles: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRetrainAssistProfiles", "query", input),
+		proposeRetrainAnnotationsWithLlm: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "proposeRetrainAnnotationsWithLlm", "mutation", input),
+		createRetrainCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "createRetrainCollection", "mutation", input),
+		listRetrainCollections: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRetrainCollections", "query", input),
+		renameRetrainCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "renameRetrainCollection", "mutation", input),
+		deleteRetrainCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "deleteRetrainCollection", "mutation", input),
+		addRetrainFrameFromRecording: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "addRetrainFrameFromRecording", "mutation", input),
+		addRetrainFramesToCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "addRetrainFramesToCollection", "mutation", input),
+		removeRetrainFrameFromCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "removeRetrainFrameFromCollection", "mutation", input),
+		listRetrainCollectionFrames: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRetrainCollectionFrames", "query", input),
 		getEventMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getEventMedia", "query", input),
 		getTrackMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getTrackMedia", "query", input),
 		listTrackMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listTrackMedia", "query", input),
@@ -7210,6 +7222,17 @@ function createSystemProxy(api) {
 			getAvailableTypes: (input) => dispatch("integrations", "getAvailableTypes", "query", input),
 			testConnection: (input) => dispatch("integrations", "testConnection", "mutation", input)
 		},
+		keychainAdmin: {
+			status: (input) => dispatch("keychainAdmin", "status", "query", input),
+			listSecrets: (input) => dispatch("keychainAdmin", "listSecrets", "query", input),
+			listAudit: (input) => dispatch("keychainAdmin", "listAudit", "query", input),
+			reveal: (input) => dispatch("keychainAdmin", "reveal", "mutation", input),
+			deleteOrphans: (input) => dispatch("keychainAdmin", "deleteOrphans", "mutation", input),
+			rotateMasterKey: (input) => dispatch("keychainAdmin", "rotateMasterKey", "mutation", input),
+			purgeRetiredKeys: (input) => dispatch("keychainAdmin", "purgeRetiredKeys", "mutation", input),
+			downloadRecoveryKey: (input) => dispatch("keychainAdmin", "downloadRecoveryKey", "mutation", input),
+			resetKeychain: (input) => dispatch("keychainAdmin", "resetKeychain", "mutation", input)
+		},
 		llm: {
 			generate: (input) => dispatch("llm", "generate", "mutation", input),
 			generateVision: (input) => dispatch("llm", "generateVision", "mutation", input),
@@ -7429,6 +7452,13 @@ function createSystemProxy(api) {
 			suggestShares: (input) => dispatch("pipelineOrchestrator", "suggestShares", "query", input),
 			getEffectiveShares: (input) => dispatch("pipelineOrchestrator", "getEffectiveShares", "query", input),
 			setShareSource: (input) => dispatch("pipelineOrchestrator", "setShareSource", "mutation", input),
+			getNodeBenchmarkPreflight: (input) => dispatch("pipelineOrchestrator", "getNodeBenchmarkPreflight", "query", input),
+			startNodeBenchmark: (input) => dispatch("pipelineOrchestrator", "startNodeBenchmark", "mutation", input),
+			getNodeBenchmarkStatus: (input) => dispatch("pipelineOrchestrator", "getNodeBenchmarkStatus", "query", input),
+			abortNodeBenchmark: (input) => dispatch("pipelineOrchestrator", "abortNodeBenchmark", "mutation", input),
+			getNodeBenchmarkCandidates: (input) => dispatch("pipelineOrchestrator", "getNodeBenchmarkCandidates", "query", input),
+			listNodeBenchmarkResults: (input) => dispatch("pipelineOrchestrator", "listNodeBenchmarkResults", "query", input),
+			deleteNodeBenchmarkResult: (input) => dispatch("pipelineOrchestrator", "deleteNodeBenchmarkResult", "mutation", input),
 			getCameraStatuses: (input) => dispatch("pipelineOrchestrator", "getCameraStatuses", "query", input),
 			setCameraSensors: (input) => dispatch("pipelineOrchestrator", "setCameraSensors", "mutation", input),
 			reconcileFromDisk: (input) => dispatch("pipelineOrchestrator", "reconcileFromDisk", "mutation", input),
@@ -7442,7 +7472,10 @@ function createSystemProxy(api) {
 			getAllCameraMetrics: (input) => dispatch("pipelineRunner", "getAllCameraMetrics", "query", input),
 			getLocalCameras: (input) => dispatch("pipelineRunner", "getLocalCameras", "query", input),
 			getNativeCrop: (input) => dispatch("pipelineRunner", "getNativeCrop", "query", input),
-			runStatelessStep: (input) => dispatch("pipelineRunner", "runStatelessStep", "mutation", input)
+			runStatelessStep: (input) => dispatch("pipelineRunner", "runStatelessStep", "mutation", input),
+			startNodeBench: (input) => dispatch("pipelineRunner", "startNodeBench", "mutation", input),
+			getNodeBenchStatus: (input) => dispatch("pipelineRunner", "getNodeBenchStatus", "query", input),
+			abortNodeBench: (input) => dispatch("pipelineRunner", "abortNodeBench", "mutation", input)
 		},
 		plateGallery: {
 			getPlateMedia: (input) => dispatch("plateGallery", "getPlateMedia", "query", input),
@@ -7636,6 +7669,10 @@ function createSystemProxy(api) {
 			oauthExchangeCode: (input) => dispatch("userManagement", "oauthExchangeCode", "mutation", input),
 			oauthRefresh: (input) => dispatch("userManagement", "oauthRefresh", "mutation", input),
 			oauthVerifyAccessToken: (input) => dispatch("userManagement", "oauthVerifyAccessToken", "query", input),
+			listExternalIdentities: (input) => dispatch("userManagement", "listExternalIdentities", "query", input),
+			findUserByExternalIdentity: (input) => dispatch("userManagement", "findUserByExternalIdentity", "query", input),
+			linkExternalIdentity: (input) => dispatch("userManagement", "linkExternalIdentity", "mutation", input),
+			unlinkExternalIdentity: (input) => dispatch("userManagement", "unlinkExternalIdentity", "mutation", input),
 			listOauthSessions: (input) => dispatch("userManagement", "listOauthSessions", "query", input),
 			revokeOauthSession: (input) => dispatch("userManagement", "revokeOauthSession", "mutation", input)
 		}

package/dist/client.mjs

@@ -5751,6 +5751,18 @@ function createDeviceProxy(api, binding, opts) {
 		completeRetrainTrack: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "completeRetrainTrack", "mutation", input),
 		restageRetrainTrack: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "restageRetrainTrack", "mutation", input),
 		getRetrainExportUrl: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getRetrainExportUrl", "query", input),
+		setRetrainFrameComplete: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "setRetrainFrameComplete", "mutation", input),
+		writeRetrainArchive: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "writeRetrainArchive", "mutation", input),
+		listRetrainAssistProfiles: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRetrainAssistProfiles", "query", input),
+		proposeRetrainAnnotationsWithLlm: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "proposeRetrainAnnotationsWithLlm", "mutation", input),
+		createRetrainCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "createRetrainCollection", "mutation", input),
+		listRetrainCollections: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRetrainCollections", "query", input),
+		renameRetrainCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "renameRetrainCollection", "mutation", input),
+		deleteRetrainCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "deleteRetrainCollection", "mutation", input),
+		addRetrainFrameFromRecording: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "addRetrainFrameFromRecording", "mutation", input),
+		addRetrainFramesToCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "addRetrainFramesToCollection", "mutation", input),
+		removeRetrainFrameFromCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "removeRetrainFrameFromCollection", "mutation", input),
+		listRetrainCollectionFrames: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRetrainCollectionFrames", "query", input),
 		getEventMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getEventMedia", "query", input),
 		getTrackMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getTrackMedia", "query", input),
 		listTrackMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listTrackMedia", "query", input),
@@ -7209,6 +7221,17 @@ function createSystemProxy(api) {
 			getAvailableTypes: (input) => dispatch("integrations", "getAvailableTypes", "query", input),
 			testConnection: (input) => dispatch("integrations", "testConnection", "mutation", input)
 		},
+		keychainAdmin: {
+			status: (input) => dispatch("keychainAdmin", "status", "query", input),
+			listSecrets: (input) => dispatch("keychainAdmin", "listSecrets", "query", input),
+			listAudit: (input) => dispatch("keychainAdmin", "listAudit", "query", input),
+			reveal: (input) => dispatch("keychainAdmin", "reveal", "mutation", input),
+			deleteOrphans: (input) => dispatch("keychainAdmin", "deleteOrphans", "mutation", input),
+			rotateMasterKey: (input) => dispatch("keychainAdmin", "rotateMasterKey", "mutation", input),
+			purgeRetiredKeys: (input) => dispatch("keychainAdmin", "purgeRetiredKeys", "mutation", input),
+			downloadRecoveryKey: (input) => dispatch("keychainAdmin", "downloadRecoveryKey", "mutation", input),
+			resetKeychain: (input) => dispatch("keychainAdmin", "resetKeychain", "mutation", input)
+		},
 		llm: {
 			generate: (input) => dispatch("llm", "generate", "mutation", input),
 			generateVision: (input) => dispatch("llm", "generateVision", "mutation", input),
@@ -7428,6 +7451,13 @@ function createSystemProxy(api) {
 			suggestShares: (input) => dispatch("pipelineOrchestrator", "suggestShares", "query", input),
 			getEffectiveShares: (input) => dispatch("pipelineOrchestrator", "getEffectiveShares", "query", input),
 			setShareSource: (input) => dispatch("pipelineOrchestrator", "setShareSource", "mutation", input),
+			getNodeBenchmarkPreflight: (input) => dispatch("pipelineOrchestrator", "getNodeBenchmarkPreflight", "query", input),
+			startNodeBenchmark: (input) => dispatch("pipelineOrchestrator", "startNodeBenchmark", "mutation", input),
+			getNodeBenchmarkStatus: (input) => dispatch("pipelineOrchestrator", "getNodeBenchmarkStatus", "query", input),
+			abortNodeBenchmark: (input) => dispatch("pipelineOrchestrator", "abortNodeBenchmark", "mutation", input),
+			getNodeBenchmarkCandidates: (input) => dispatch("pipelineOrchestrator", "getNodeBenchmarkCandidates", "query", input),
+			listNodeBenchmarkResults: (input) => dispatch("pipelineOrchestrator", "listNodeBenchmarkResults", "query", input),
+			deleteNodeBenchmarkResult: (input) => dispatch("pipelineOrchestrator", "deleteNodeBenchmarkResult", "mutation", input),
 			getCameraStatuses: (input) => dispatch("pipelineOrchestrator", "getCameraStatuses", "query", input),
 			setCameraSensors: (input) => dispatch("pipelineOrchestrator", "setCameraSensors", "mutation", input),
 			reconcileFromDisk: (input) => dispatch("pipelineOrchestrator", "reconcileFromDisk", "mutation", input),
@@ -7441,7 +7471,10 @@ function createSystemProxy(api) {
 			getAllCameraMetrics: (input) => dispatch("pipelineRunner", "getAllCameraMetrics", "query", input),
 			getLocalCameras: (input) => dispatch("pipelineRunner", "getLocalCameras", "query", input),
 			getNativeCrop: (input) => dispatch("pipelineRunner", "getNativeCrop", "query", input),
-			runStatelessStep: (input) => dispatch("pipelineRunner", "runStatelessStep", "mutation", input)
+			runStatelessStep: (input) => dispatch("pipelineRunner", "runStatelessStep", "mutation", input),
+			startNodeBench: (input) => dispatch("pipelineRunner", "startNodeBench", "mutation", input),
+			getNodeBenchStatus: (input) => dispatch("pipelineRunner", "getNodeBenchStatus", "query", input),
+			abortNodeBench: (input) => dispatch("pipelineRunner", "abortNodeBench", "mutation", input)
 		},
 		plateGallery: {
 			getPlateMedia: (input) => dispatch("plateGallery", "getPlateMedia", "query", input),
@@ -7635,6 +7668,10 @@ function createSystemProxy(api) {
 			oauthExchangeCode: (input) => dispatch("userManagement", "oauthExchangeCode", "mutation", input),
 			oauthRefresh: (input) => dispatch("userManagement", "oauthRefresh", "mutation", input),
 			oauthVerifyAccessToken: (input) => dispatch("userManagement", "oauthVerifyAccessToken", "query", input),
+			listExternalIdentities: (input) => dispatch("userManagement", "listExternalIdentities", "query", input),
+			findUserByExternalIdentity: (input) => dispatch("userManagement", "findUserByExternalIdentity", "query", input),
+			linkExternalIdentity: (input) => dispatch("userManagement", "linkExternalIdentity", "mutation", input),
+			unlinkExternalIdentity: (input) => dispatch("userManagement", "unlinkExternalIdentity", "mutation", input),
 			listOauthSessions: (input) => dispatch("userManagement", "listOauthSessions", "query", input),
 			revokeOauthSession: (input) => dispatch("userManagement", "revokeOauthSession", "mutation", input)
 		}

package/dist/device/device-context.d.ts

@@ -7,6 +7,11 @@ import type { AddonApi } from '../generated/addon-api.js';
 import type { DeviceProxy } from '../generated/device-proxy.js';
 import type { DeviceMeta, InitialDeviceMeta } from './device-management.js';
 import type { DeviceType } from './device-type.js';
+/** What a device states about the config it persists. */
+export interface DevicePersistConfigOptions {
+    /** Dotted paths its schema declares secret (`collectZodSecretPaths`). */
+    readonly secretConfigPaths?: readonly string[];
+}
 export interface DeviceContext {
     /** Progressive, system-wide unique numeric device id. Injected from the
      *  hub's `device-manager` via `DeviceManagerApi.allocateDeviceId` before
@@ -19,7 +24,12 @@ export interface DeviceContext {
     readonly logger: IScopedLogger;
     readonly api: AddonApi;
     readonly eventBus: IEventBus;
-    readonly persistConfig: (data: unknown) => Promise<void>;
+    /**
+     * Persist the device's config blob. `options.secretConfigPaths` names the
+     * paths its schema declares secret, so the hub's door keeps those values in
+     * the keychain instead of the blob (D787).
+     */
+    readonly persistConfig: (data: unknown, options?: DevicePersistConfigOptions) => Promise<void>;
     /**
      * Snapshot of the persisted runtime-state blob loaded at boot.
      * `BaseDevice` hands this to `DeviceRuntimeState.fromInitial` so

package/dist/device/display-icon-vocabulary.d.ts

@@ -81,6 +81,13 @@ export declare const DISPLAY_ICON_KEYS: readonly string[];
 export declare const DISPLAY_ICON_OFFERED_KEYS: readonly string[];
 /** Is this a key of the shared vocabulary? */
 export declare function isDisplayIconKey(value: unknown): boolean;
+/**
+ * A stored icon value as a vocabulary key: `value` when it IS one, `fallback`
+ * otherwise. For an `icon` settings field (D780) whose stored value may
+ * predate the vocabulary (a free-text lucide name) — the field's default is
+ * drawn rather than nothing.
+ */
+export declare function resolveDisplayIconKey(value: unknown, fallback: string): string;
 /** The entry for a key, or `undefined` — never a guessed one. */
 export declare function displayIconEntry(key: string): DisplayIconEntry | undefined;
 /** The entries of one group, in vocabulary order. */

package/dist/device/index.d.ts

@@ -12,7 +12,7 @@ export type { ExposeBlockDevicesInput, ReconcileBlockDevicesInput, } from './blo
 export { exposeBlockDevices, reconcileBlockDevices } from './block-declared-devices.js';
 export type { IDevice } from './device.js';
 export { DeviceConfig } from './device-config.js';
-export type { DeviceConstructor, DeviceContext, DeviceManagerApi, IDeviceRegistry, IDeviceRegistryReader, } from './device-context.js';
+export type { DeviceConstructor, DeviceContext, DeviceManagerApi, DevicePersistConfigOptions, IDeviceRegistry, IDeviceRegistryReader, } from './device-context.js';
 export type { ChildLayout, ChildLayoutEntry, CreateDeviceSpec, DeviceDiscovery, DeviceManualCreation, DeviceMeta, DiscoveredDevice, InitialDeviceMeta, SavedDevice, } from './device-management.js';
 export type { DeviceProfile, DeviceProfileDefaults, DeviceProfileMatch, PipelinePhaseMode, } from './device-profile.js';
 export { BATTERY_DEVICE_PROFILE, DEVICE_PROFILES, deviceMatchesProfile, resolveDeviceProfile, } from './device-profile.js';
@@ -30,5 +30,6 @@ export type { WireableField } from './schema-fields.js';
 export { enumerateItemArrayFields, enumerateSchemaFields, unwrapSchema } from './schema-fields.js';
 export type { DeviceConfigEntry } from './zod-to-config-ui.js';
 export { zodEntriesToConfigUI } from './zod-to-config-ui.js';
+export { collectZodSecretPaths, isZodSecret, SECRET_META } from './zod-secret.js';
 export type { SiteZone } from './site-zone.js';
 export { SiteZoneSchema, siteZoneKey } from './site-zone.js';

package/dist/device/zod-secret.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Secret declaration on a Zod config schema (D783).
+ *
+ * A field is a secret because its schema SAYS so — `.meta({ secret: true })`,
+ * spelled {@link SECRET_META} — never because its key looks like a credential.
+ * It is the Zod twin of `secret: true` / `type: 'password'` on a config-UI
+ * field (`isSecretConfigField`), and every consumer that treats secrets
+ * specially reads it: the settings form (`zodEntriesToConfigUI`), the paths a
+ * device advertises at `registerDevice` (`secretConfigPaths`, which the
+ * non-admin redaction withholds at any depth), and the keychain later.
+ *
+ * Zod keeps `.meta()` in `z.globalRegistry`, which lives on `globalThis`, so a
+ * declaration made by an addon's own copy of zod is visible here.
+ */
+import { z } from 'zod';
+/**
+ * `{ secret: true }` — the one spelling of "this field holds a credential".
+ *
+ * Addons write the LITERAL `.meta({ secret: true })` rather than importing
+ * this constant: an addon running against an older `@camstack/types` would
+ * otherwise call `.meta(undefined)`, which in zod v4 is the metadata GETTER
+ * and returns no schema at all.
+ */
+export declare const SECRET_META: {
+    readonly secret: true;
+};
+/** True when any layer of this field declares `.meta({ secret: true })`. */
+export declare function isZodSecret(schema: z.ZodType): boolean;
+/**
+ * Every declared secret path in a config schema: dotted keys, `[]` for "each
+ * element of this array" (`connection.password`, `rows[].token`). A declared
+ * object or array is reported as one path and not descended into — everything
+ * under it is secret.
+ */
+export declare function collectZodSecretPaths(schema: z.ZodType, prefix?: string): readonly string[];

package/dist/enums/event-category.d.ts

@@ -75,6 +75,13 @@ export declare enum EventCategory {
      * Payload: `{ packageName, addonId?, error: { message, stack }, retryCount, nextRetryAt }`.
      */
     AddonLoadFailed = "addon.load-failed",
+    /**
+     * A keychain value was stored or removed (D787). Carries the ref, its
+     * owner and the new version — NEVER the value. A process holding the ref
+     * drops its cached copy and the owning `BaseAddon` re-resolves its config.
+     * Telemetry (D8): a process that misses it still revalidates by version.
+     */
+    KeychainChanged = "keychain.changed",
     /**
      * Addon recovered from a previous failure. Emitted when an addon
      * transitions from `failed` back to `healthy` (typically via the

package/dist/enums.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_event_category = require("./event-category-CtBAl88K.js");
+const require_event_category = require("./event-category-CHduMGvg.js");
 //#region src/enums/event-source-type.ts
 var EventSourceType = /* @__PURE__ */ function(EventSourceType) {
 	EventSourceType["Addon"] = "addon";

package/dist/enums.mjs

@@ -1,4 +1,4 @@
-import { t as EventCategory } from "./event-category-B_0XEcLF.mjs";
+import { t as EventCategory } from "./event-category-DaIZi00R.mjs";
 //#region src/enums/event-source-type.ts
 var EventSourceType = /* @__PURE__ */ function(EventSourceType) {
 	EventSourceType["Addon"] = "addon";

package/dist/{event-category-CtBAl88K.js → event-category-CHduMGvg.js}

@@ -77,6 +77,13 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AddonLoadFailed"] = "addon.load-failed";
 	/**
+	* A keychain value was stored or removed (D787). Carries the ref, its
+	* owner and the new version — NEVER the value. A process holding the ref
+	* drops its cached copy and the owning `BaseAddon` re-resolves its config.
+	* Telemetry (D8): a process that misses it still revalidates by version.
+	*/
+	EventCategory["KeychainChanged"] = "keychain.changed";
+	/**
 	* Addon recovered from a previous failure. Emitted when an addon
 	* transitions from `failed` back to `healthy` (typically via the
 	* monitor's auto-retry loop, or after manual `addons.retryLoad`).

package/dist/{event-category-B_0XEcLF.mjs → event-category-DaIZi00R.mjs}

@@ -77,6 +77,13 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AddonLoadFailed"] = "addon.load-failed";
 	/**
+	* A keychain value was stored or removed (D787). Carries the ref, its
+	* owner and the new version — NEVER the value. A process holding the ref
+	* drops its cached copy and the owning `BaseAddon` re-resolves its config.
+	* Telemetry (D8): a process that misses it still revalidates by version.
+	*/
+	EventCategory["KeychainChanged"] = "keychain.changed";
+	/**
 	* Addon recovered from a previous failure. Emitted when an addon
 	* transitions from `failed` back to `healthy` (typically via the
 	* monitor's auto-retry loop, or after manual `addons.retryLoad`).