@camstack/types 1.2.354 → 1.2.356

package/dist/{sleep-SgkKj2bk.js → sleep-BFVY4_xY.js}

@@ -3821,6 +3821,23 @@ function emitDownForOwnedCaps(registry, owned) {
 	for (const { capName, scope } of owned) registry.emitDown(capName, scope);
 }
 //#endregion
+//#region src/types/model-formats.ts
+/**
+* The model weight formats a catalog entry can ship. Schema-free on purpose:
+* `types/models.ts` builds Zod schemas from it, but a runner-closure consumer
+* (the model downloader in `@camstack/system`) needs only the list and must
+* reach it through `@camstack/types/addon` without building the cap schema
+* graph (D28).
+*/
+var MODEL_FORMATS = [
+	"onnx",
+	"coreml",
+	"openvino",
+	"tflite",
+	"pt",
+	"gguf"
+];
+//#endregion
 //#region src/cap-call-context.ts
 /**
 * Per-call node pinning for `ctx.api` capability calls.
@@ -4337,6 +4354,65 @@ var deviceOpsCapability = {
 	}
 };
 //#endregion
+//#region src/constants.ts
+var HF_REPO = "camstack/camstack-models";
+var HF_BASE_URL = `https://huggingface.co/${HF_REPO}/resolve/main`;
+/**
+* The ONE default session-JWT lifetime.
+*
+* There used to be three, and they disagreed: the `system-config` schema said
+* `30d`, `RUNTIME_DEFAULTS['auth.tokenExpiry']` said `7d`, and
+* `AuthManager.signToken` hardcoded `30d` as its own fallback. Because the
+* production signer (`AuthService extends AuthManager`, wired to
+* `ConfigManager`) resolves through `RUNTIME_DEFAULTS` BEFORE it can ever
+* reach the hardcoded fallback, the value actually in force was `7d` while
+* every surface an operator could read advertised `30d`.
+*
+* `30d` is the value the product documents and the one an operator decided on
+* (2026-07-17: the viewer's silent refresh rotates tokens long before expiry,
+* so a long lifetime only covers devices left unopened for weeks). It is
+* declared here once and imported by the schema, by the runtime defaults and
+* by the signer's fallback — a second default that disagrees with the first is
+* the same defect in miniature.
+*/
+var DEFAULT_TOKEN_EXPIRY = "30d";
+/**
+* Runtime defaults -- used by ConfigManager.get() for backward compatibility
+* until Plan B wires all runtime settings to the system_settings SQL table.
+*
+* Moved from @camstack/system/config-schema to @camstack/types so that
+* @camstack/system can reference it without a cross-package kernel import.
+*/
+var RUNTIME_DEFAULTS = {
+	"features.streaming": true,
+	"features.notifications": true,
+	"features.objectDetection": false,
+	"features.remoteAccess": true,
+	"features.agentCluster": false,
+	"features.smartHome": true,
+	"features.recordings": true,
+	"features.backup": true,
+	"features.repl": true,
+	"retention.detectionEventsDays": 30,
+	"retention.audioLevelsDays": 7,
+	"logging.level": "info",
+	"logging.retentionDays": 30,
+	"eventBus.ringBufferSize": 1e4,
+	"storage.provider": "sqlite-storage",
+	"storage.locations": {
+		data: "camstack-data/data",
+		media: "camstack-data/media",
+		recordings: "camstack-data/recordings",
+		cache: "/tmp/camstack-cache",
+		logs: "camstack-data/logs",
+		models: "camstack-data/models"
+	},
+	providers: [],
+	"ffmpeg.hwAccel": "auto",
+	"ffmpeg.threadCount": 0,
+	"auth.tokenExpiry": "30d"
+};
+//#endregion
 //#region src/device/zod-secret.ts
 /**
 * Secret declaration on a Zod config schema (D783).
@@ -5728,6 +5804,11 @@ var BOOT_RECOVERY_BACKOFF_MS = [
 	90 * 6e4
 ];
 //#endregion
+//#region src/utils/hf-url.ts
+function hfModelUrl(repo, path) {
+	return `https://huggingface.co/${repo}/resolve/main/${path}`;
+}
+//#endregion
 //#region src/utils/json-safe.ts
 /**
 * Type-safe JSON parsing helpers.
@@ -5788,6 +5869,81 @@ function parseJsonArray(text) {
 	}
 }
 //#endregion
+//#region src/utils/mask-url.ts
+/**
+* Names that, when used as URL query parameters, almost certainly carry
+* a secret. Matching is case-insensitive and anchored to the full param
+* name to avoid false positives like `user_id` (an entity reference, not
+* a credential) or `topic=password-reset` (a value happens to contain
+* the substring "password" but the param name is unrelated).
+*
+* Add new patterns here as we encounter cameras/APIs that leak through
+* the existing list.
+*/
+var CREDENTIAL_PARAM_PATTERNS = [
+	/^user$/i,
+	/^usr$/i,
+	/^username$/i,
+	/^password$/i,
+	/^pwd$/i,
+	/^pass$/i,
+	/^passwd$/i,
+	/^secret$/i,
+	/^token$/i,
+	/^auth$/i,
+	/^auth[_-]?token$/i,
+	/^bearer$/i,
+	/^api[_-]?key$/i,
+	/^access[_-]?token$/i,
+	/^refresh[_-]?token$/i,
+	/^bridge$/i,
+	/^code$/i,
+	/^state$/i,
+	/^challenge$/i,
+	/^link$/i
+];
+function isCredentialParam(name) {
+	return CREDENTIAL_PARAM_PATTERNS.some((re) => re.test(name));
+}
+/**
+* Redact secrets we may surface in logs or telemetry:
+*   1. `userinfo` (`user:password@host`) — the classic RTSP shape.
+*   2. Query-string credential params (`?user=...&password=...`) — the
+*      Reolink RTMP shape and several HTTP-pushed-stream APIs.
+*
+* Returns the original string verbatim when the input is not a parseable
+* URL — a log helper must never throw. Param values are replaced with
+* `***` so an operator reading logs still sees WHICH credential was
+* present (useful for debugging "wrong password" issues) without
+* exposing the value.
+*
+* The credential-name match is case-insensitive but anchored to the
+* whole param name; values like `user_id=42` or `topic=password-reset`
+* are NOT masked (those are entity references, not credentials).
+*/
+function maskUrlCredentials(rawUrl) {
+	if (rawUrl.startsWith("/") && !rawUrl.startsWith("//")) {
+		const masked = maskUrlCredentials(`http://relative.invalid${rawUrl}`);
+		return masked.startsWith("http://relative.invalid") ? masked.slice(23) : rawUrl;
+	}
+	try {
+		const u = new URL(rawUrl);
+		let touched = false;
+		if (u.username || u.password) {
+			u.username = "";
+			u.password = "";
+			touched = true;
+		}
+		for (const key of Array.from(u.searchParams.keys())) if (isCredentialParam(key)) {
+			u.searchParams.set(key, "***");
+			touched = true;
+		}
+		return touched ? u.toString() : rawUrl;
+	} catch {
+		return rawUrl;
+	}
+}
+//#endregion
 //#region src/utils/sleep.ts
 /**
 * Promise-based timer helpers — used everywhere the codebase needs to
@@ -5931,6 +6087,12 @@ Object.defineProperty(exports, "DEFAULT_RUNTIME_STATE_DURABILITY", {
 		return DEFAULT_RUNTIME_STATE_DURABILITY;
 	}
 });
+Object.defineProperty(exports, "DEFAULT_TOKEN_EXPIRY", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_TOKEN_EXPIRY;
+	}
+});
 Object.defineProperty(exports, "DEVICE_CHILDREN_BATCH_MAX", {
 	enumerable: true,
 	get: function() {
@@ -5973,6 +6135,18 @@ Object.defineProperty(exports, "FrameHandleSchema", {
 		return FrameHandleSchema;
 	}
 });
+Object.defineProperty(exports, "HF_BASE_URL", {
+	enumerable: true,
+	get: function() {
+		return HF_BASE_URL;
+	}
+});
+Object.defineProperty(exports, "HF_REPO", {
+	enumerable: true,
+	get: function() {
+		return HF_REPO;
+	}
+});
 Object.defineProperty(exports, "KeychainWriteRefusedError", {
 	enumerable: true,
 	get: function() {
@@ -5985,6 +6159,12 @@ Object.defineProperty(exports, "MIN_SCRUBBED_LENGTH", {
 		return MIN_SCRUBBED_LENGTH;
 	}
 });
+Object.defineProperty(exports, "MODEL_FORMATS", {
+	enumerable: true,
+	get: function() {
+		return MODEL_FORMATS;
+	}
+});
 Object.defineProperty(exports, "PEER_BYTES_CHUNK_BYTES", {
 	enumerable: true,
 	get: function() {
@@ -6051,6 +6231,12 @@ Object.defineProperty(exports, "REVALIDATE_AFTER_MS", {
 		return REVALIDATE_AFTER_MS;
 	}
 });
+Object.defineProperty(exports, "RUNTIME_DEFAULTS", {
+	enumerable: true,
+	get: function() {
+		return RUNTIME_DEFAULTS;
+	}
+});
 Object.defineProperty(exports, "RawStateResultSchema", {
 	enumerable: true,
 	get: function() {
@@ -6357,6 +6543,12 @@ Object.defineProperty(exports, "globalSecretScope", {
 		return globalSecretScope;
 	}
 });
+Object.defineProperty(exports, "hfModelUrl", {
+	enumerable: true,
+	get: function() {
+		return hfModelUrl;
+	}
+});
 Object.defineProperty(exports, "hydrateSchema", {
 	enumerable: true,
 	get: function() {
@@ -6459,6 +6651,12 @@ Object.defineProperty(exports, "makeSourceBrokerId", {
 		return makeSourceBrokerId;
 	}
 });
+Object.defineProperty(exports, "maskUrlCredentials", {
+	enumerable: true,
+	get: function() {
+		return maskUrlCredentials;
+	}
+});
 Object.defineProperty(exports, "mergeSecretStatePaths", {
 	enumerable: true,
 	get: function() {

package/dist/{sleep-Tkp9dHXv.mjs → sleep-vWTnHq9G.mjs}

@@ -3821,6 +3821,23 @@ function emitDownForOwnedCaps(registry, owned) {
 	for (const { capName, scope } of owned) registry.emitDown(capName, scope);
 }
 //#endregion
+//#region src/types/model-formats.ts
+/**
+* The model weight formats a catalog entry can ship. Schema-free on purpose:
+* `types/models.ts` builds Zod schemas from it, but a runner-closure consumer
+* (the model downloader in `@camstack/system`) needs only the list and must
+* reach it through `@camstack/types/addon` without building the cap schema
+* graph (D28).
+*/
+var MODEL_FORMATS = [
+	"onnx",
+	"coreml",
+	"openvino",
+	"tflite",
+	"pt",
+	"gguf"
+];
+//#endregion
 //#region src/cap-call-context.ts
 /**
 * Per-call node pinning for `ctx.api` capability calls.
@@ -4337,6 +4354,65 @@ var deviceOpsCapability = {
 	}
 };
 //#endregion
+//#region src/constants.ts
+var HF_REPO = "camstack/camstack-models";
+var HF_BASE_URL = `https://huggingface.co/${HF_REPO}/resolve/main`;
+/**
+* The ONE default session-JWT lifetime.
+*
+* There used to be three, and they disagreed: the `system-config` schema said
+* `30d`, `RUNTIME_DEFAULTS['auth.tokenExpiry']` said `7d`, and
+* `AuthManager.signToken` hardcoded `30d` as its own fallback. Because the
+* production signer (`AuthService extends AuthManager`, wired to
+* `ConfigManager`) resolves through `RUNTIME_DEFAULTS` BEFORE it can ever
+* reach the hardcoded fallback, the value actually in force was `7d` while
+* every surface an operator could read advertised `30d`.
+*
+* `30d` is the value the product documents and the one an operator decided on
+* (2026-07-17: the viewer's silent refresh rotates tokens long before expiry,
+* so a long lifetime only covers devices left unopened for weeks). It is
+* declared here once and imported by the schema, by the runtime defaults and
+* by the signer's fallback — a second default that disagrees with the first is
+* the same defect in miniature.
+*/
+var DEFAULT_TOKEN_EXPIRY = "30d";
+/**
+* Runtime defaults -- used by ConfigManager.get() for backward compatibility
+* until Plan B wires all runtime settings to the system_settings SQL table.
+*
+* Moved from @camstack/system/config-schema to @camstack/types so that
+* @camstack/system can reference it without a cross-package kernel import.
+*/
+var RUNTIME_DEFAULTS = {
+	"features.streaming": true,
+	"features.notifications": true,
+	"features.objectDetection": false,
+	"features.remoteAccess": true,
+	"features.agentCluster": false,
+	"features.smartHome": true,
+	"features.recordings": true,
+	"features.backup": true,
+	"features.repl": true,
+	"retention.detectionEventsDays": 30,
+	"retention.audioLevelsDays": 7,
+	"logging.level": "info",
+	"logging.retentionDays": 30,
+	"eventBus.ringBufferSize": 1e4,
+	"storage.provider": "sqlite-storage",
+	"storage.locations": {
+		data: "camstack-data/data",
+		media: "camstack-data/media",
+		recordings: "camstack-data/recordings",
+		cache: "/tmp/camstack-cache",
+		logs: "camstack-data/logs",
+		models: "camstack-data/models"
+	},
+	providers: [],
+	"ffmpeg.hwAccel": "auto",
+	"ffmpeg.threadCount": 0,
+	"auth.tokenExpiry": "30d"
+};
+//#endregion
 //#region src/device/zod-secret.ts
 /**
 * Secret declaration on a Zod config schema (D783).
@@ -5728,6 +5804,11 @@ var BOOT_RECOVERY_BACKOFF_MS = [
 	90 * 6e4
 ];
 //#endregion
+//#region src/utils/hf-url.ts
+function hfModelUrl(repo, path) {
+	return `https://huggingface.co/${repo}/resolve/main/${path}`;
+}
+//#endregion
 //#region src/utils/json-safe.ts
 /**
 * Type-safe JSON parsing helpers.
@@ -5788,6 +5869,81 @@ function parseJsonArray(text) {
 	}
 }
 //#endregion
+//#region src/utils/mask-url.ts
+/**
+* Names that, when used as URL query parameters, almost certainly carry
+* a secret. Matching is case-insensitive and anchored to the full param
+* name to avoid false positives like `user_id` (an entity reference, not
+* a credential) or `topic=password-reset` (a value happens to contain
+* the substring "password" but the param name is unrelated).
+*
+* Add new patterns here as we encounter cameras/APIs that leak through
+* the existing list.
+*/
+var CREDENTIAL_PARAM_PATTERNS = [
+	/^user$/i,
+	/^usr$/i,
+	/^username$/i,
+	/^password$/i,
+	/^pwd$/i,
+	/^pass$/i,
+	/^passwd$/i,
+	/^secret$/i,
+	/^token$/i,
+	/^auth$/i,
+	/^auth[_-]?token$/i,
+	/^bearer$/i,
+	/^api[_-]?key$/i,
+	/^access[_-]?token$/i,
+	/^refresh[_-]?token$/i,
+	/^bridge$/i,
+	/^code$/i,
+	/^state$/i,
+	/^challenge$/i,
+	/^link$/i
+];
+function isCredentialParam(name) {
+	return CREDENTIAL_PARAM_PATTERNS.some((re) => re.test(name));
+}
+/**
+* Redact secrets we may surface in logs or telemetry:
+*   1. `userinfo` (`user:password@host`) — the classic RTSP shape.
+*   2. Query-string credential params (`?user=...&password=...`) — the
+*      Reolink RTMP shape and several HTTP-pushed-stream APIs.
+*
+* Returns the original string verbatim when the input is not a parseable
+* URL — a log helper must never throw. Param values are replaced with
+* `***` so an operator reading logs still sees WHICH credential was
+* present (useful for debugging "wrong password" issues) without
+* exposing the value.
+*
+* The credential-name match is case-insensitive but anchored to the
+* whole param name; values like `user_id=42` or `topic=password-reset`
+* are NOT masked (those are entity references, not credentials).
+*/
+function maskUrlCredentials(rawUrl) {
+	if (rawUrl.startsWith("/") && !rawUrl.startsWith("//")) {
+		const masked = maskUrlCredentials(`http://relative.invalid${rawUrl}`);
+		return masked.startsWith("http://relative.invalid") ? masked.slice(23) : rawUrl;
+	}
+	try {
+		const u = new URL(rawUrl);
+		let touched = false;
+		if (u.username || u.password) {
+			u.username = "";
+			u.password = "";
+			touched = true;
+		}
+		for (const key of Array.from(u.searchParams.keys())) if (isCredentialParam(key)) {
+			u.searchParams.set(key, "***");
+			touched = true;
+		}
+		return touched ? u.toString() : rawUrl;
+	} catch {
+		return rawUrl;
+	}
+}
+//#endregion
 //#region src/utils/sleep.ts
 /**
 * Promise-based timer helpers — used everywhere the codebase needs to
@@ -5841,4 +5997,4 @@ function sleepCancellable(ms, signal) {
 	});
 }
 //#endregion
-export { BrokerStatsSchema as $, normalizeSecretOwner as $t, adminUiCapability as A, PEER_BYTES_MAX_OUTSTANDING as At, resolveCapMount as B, parseSecretStatePath as Bt, deviceOpsCapability as C, isKeychainStoredField as Cn, clearKnownSecrets as Ct, defineCustomActions as D, audioChunkBytesPerSample as Dn, scrubKnownSecrets as Dt, customAction as E, AUDIO_CHUNK_FORMATS as En, registerKnownSecret as Et, event as F, SHARE_VIEW_KINDS as Ft, toNodeId as G, resolveSecretMarkers as Gt, CAP_NODE_PIN_CONTEXT_KEY as H, secretTreeFromSchema as Ht, expandCapMethods as I, DisposerChain as It, emitDownForOwnedCaps as J, arrayItemFieldPath as Jt, ReadinessRegistry as K, transformSecretWrite as Kt, isDeviceConfigCap as L, BaseAddon as Lt, DEVICE_SETTINGS_CONTRIBUTION_METHODS as M, PEER_BYTES_TICKET_TTL_MS as Mt, DEVICE_STATUS_METHOD as N, PeerBytesTicketSchema as Nt, describeCustomActions as O, expandAudioChunkToF32le as On, shortSecretRefHash as Ot, PROVIDER_PIN_FIELD as P, DATAPLANE_SECRET_HEADER as Pt, AudioStreamPickSchema as Q, isSecretRef as Qt, method as R, normalizeAddonInitResult as Rt, RawStateResultSchema as S, collectSecretConfigKeys as Sn, MIN_SCRUBBED_LENGTH as St, DEVICE_CHILDREN_BATCH_MAX as T, schemaDeclaresAnyField as Tn, knownSecretCount as Tt, nodePin as U, KeychainWriteRefusedError as Ut, systemMethod as V, secretTreeFromPaths as Vt, readNodePin as W, collectSecretMarkerRefs as Wt, scopeKey as X, formatSecretScope as Xt, readinessKey as Y, buildSecretRef as Yt, AudioChunkFormatSchema as Z, globalSecretScope as Zt, createMirrorSource as _, isSecretMarkerLike as _n, parseProfileBrokerId as _t, asJsonObject as a, isEvent as an, CameraStreamSchema as at, collectZodSecretPaths as b, REDACTED_SECRET as bn, REVALIDATE_AFTER_MS as bt, parseJsonArray as c, collectHydratedFieldEntries as cn, ProfileRtspEntrySchema as ct, BOOT_RECOVERY_BACKOFF_MS as d, resolveHydratedFieldValue as dn, StreamSourceEntrySchema$1 as dt, parseSecretRef as en, BrokerStatusSchema as et, DEVICE_SCOPED_CAPS as f, SECRET_CLEAR as fn, StreamSourceSchema as ft, createLazyTrpcSource as g, isSecretMarker as gn, makeSourceBrokerId as gt, createEventBusSliceSource as h, isSecretFieldView as hn, makeProfileBrokerId as ht, asJsonArray as i, emitReadiness as in, CamStreamResolutionSchema as it, DEFAULT_RUNTIME_STATE_DURABILITY as j, PEER_BYTES_STALL_MS as jt, deviceCustomAction as k, isAudioChunkFormat as kn, PEER_BYTES_CHUNK_BYTES as kt, parseJsonObject as l, collectHydratedFieldValues as ln, ProfileSlotSchema as lt, createDeviceProxy as m, isSecretClear as mn, SubscribeAudioChunksResultSchema as mt, sleepCancellable as n, createDurableState as nn, CamProfileSchema as nt, asNumber as o, WELL_KNOWN_TABS as on, DecodedAudioChunkSchema as ot, isDeviceScopedCap as p, classifySecretWrite as pn, SubscribeAudioChunksInputSchema as pt, ReadinessTimeoutError as q, SECRET_REF_SCHEME as qt, asBoolean as r, createEvent as rn, CamStreamKindSchema as rt, asString as s, WELL_KNOWN_TAB_MAP as sn, FrameHandleSchema as st, sleep as t, normalizeNodeId as tn, CAM_PROFILE_ORDER as tt, parseJsonUnknown as u, hydrateSchema as un, ProfileSlotStatusSchema as ut, createSliceHandle as v, makeSecretMarker as vn, selectAssignedProfileSlots as vt, viewerUiCapability as w, isSecretConfigField as wn, forgetKnownSecret as wt, isZodSecret as x, collectKeychainStoredKeys as xn, createSecretsAccess as xt, SECRET_META as y, toSecretFieldView as yn, resolveSecretViewsIn as yt, optionalMethod as z, mergeSecretStatePaths as zt };
+export { ReadinessRegistry as $, transformSecretWrite as $t, viewerUiCapability as A, isKeychainStoredField as An, clearKnownSecrets as At, PROVIDER_PIN_FIELD as B, PeerBytesTicketSchema as Bt, isZodSecret as C, isSecretMarker as Cn, makeSourceBrokerId as Ct, RUNTIME_DEFAULTS as D, REDACTED_SECRET as Dn, REVALIDATE_AFTER_MS as Dt, HF_REPO as E, toSecretFieldView as En, resolveSecretViewsIn as Et, deviceCustomAction as F, expandAudioChunkToF32le as Fn, shortSecretRefHash as Ft, optionalMethod as G, normalizeAddonInitResult as Gt, expandCapMethods as H, SHARE_VIEW_KINDS as Ht, adminUiCapability as I, isAudioChunkFormat as In, PEER_BYTES_CHUNK_BYTES as It, CAP_NODE_PIN_CONTEXT_KEY as J, secretTreeFromPaths as Jt, resolveCapMount as K, mergeSecretStatePaths as Kt, DEFAULT_RUNTIME_STATE_DURABILITY as L, PEER_BYTES_MAX_OUTSTANDING as Lt, customAction as M, schemaDeclaresAnyField as Mn, knownSecretCount as Mt, defineCustomActions as N, AUDIO_CHUNK_FORMATS as Nn, registerKnownSecret as Nt, RawStateResultSchema as O, collectKeychainStoredKeys as On, createSecretsAccess as Ot, describeCustomActions as P, audioChunkBytesPerSample as Pn, scrubKnownSecrets as Pt, MODEL_FORMATS as Q, resolveSecretMarkers as Qt, DEVICE_SETTINGS_CONTRIBUTION_METHODS as R, PEER_BYTES_STALL_MS as Rt, collectZodSecretPaths as S, isSecretFieldView as Sn, makeProfileBrokerId as St, HF_BASE_URL as T, makeSecretMarker as Tn, selectAssignedProfileSlots as Tt, isDeviceConfigCap as U, DisposerChain as Ut, event as V, DATAPLANE_SECRET_HEADER as Vt, method as W, BaseAddon as Wt, readNodePin as X, KeychainWriteRefusedError as Xt, nodePin as Y, secretTreeFromSchema as Yt, toNodeId as Z, collectSecretMarkerRefs as Zt, createEventBusSliceSource as _, hydrateSchema as _n, ProfileSlotStatusSchema as _t, asJsonArray as a, isSecretRef as an, AudioStreamPickSchema as at, createSliceHandle as b, classifySecretWrite as bn, SubscribeAudioChunksInputSchema as bt, asString as c, normalizeNodeId as cn, CAM_PROFILE_ORDER as ct, parseJsonUnknown as d, emitReadiness as dn, CamStreamResolutionSchema as dt, SECRET_REF_SCHEME as en, ReadinessTimeoutError as et, hfModelUrl as f, isEvent as fn, CameraStreamSchema as ft, createDeviceProxy as g, collectHydratedFieldValues as gn, ProfileSlotSchema as gt, isDeviceScopedCap as h, collectHydratedFieldEntries as hn, ProfileRtspEntrySchema as ht, asBoolean as i, globalSecretScope as in, AudioChunkFormatSchema as it, DEVICE_CHILDREN_BATCH_MAX as j, isSecretConfigField as jn, forgetKnownSecret as jt, deviceOpsCapability as k, collectSecretConfigKeys as kn, MIN_SCRUBBED_LENGTH as kt, parseJsonArray as l, createDurableState as ln, CamProfileSchema as lt, DEVICE_SCOPED_CAPS as m, WELL_KNOWN_TAB_MAP as mn, FrameHandleSchema as mt, sleepCancellable as n, buildSecretRef as nn, readinessKey as nt, asJsonObject as o, normalizeSecretOwner as on, BrokerStatsSchema as ot, BOOT_RECOVERY_BACKOFF_MS as p, WELL_KNOWN_TABS as pn, DecodedAudioChunkSchema as pt, systemMethod as q, parseSecretStatePath as qt, maskUrlCredentials as r, formatSecretScope as rn, scopeKey as rt, asNumber as s, parseSecretRef as sn, BrokerStatusSchema as st, sleep as t, arrayItemFieldPath as tn, emitDownForOwnedCaps as tt, parseJsonObject as u, createEvent as un, CamStreamKindSchema as ut, createLazyTrpcSource as v, resolveHydratedFieldValue as vn, StreamSourceEntrySchema$1 as vt, DEFAULT_TOKEN_EXPIRY as w, isSecretMarkerLike as wn, parseProfileBrokerId as wt, SECRET_META as x, isSecretClear as xn, SubscribeAudioChunksResultSchema as xt, createMirrorSource as y, SECRET_CLEAR as yn, StreamSourceSchema as yt, DEVICE_STATUS_METHOD as z, PEER_BYTES_TICKET_TTL_MS as zt };

package/dist/types/model-formats.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The model weight formats a catalog entry can ship. Schema-free on purpose:
+ * `types/models.ts` builds Zod schemas from it, but a runner-closure consumer
+ * (the model downloader in `@camstack/system`) needs only the list and must
+ * reach it through `@camstack/types/addon` without building the cap schema
+ * graph (D28).
+ */
+export declare const MODEL_FORMATS: readonly ['onnx', 'coreml', 'openvino', 'tflite', 'pt', 'gguf'];
+export type ModelFormat = (typeof MODEL_FORMATS)[number];

package/dist/types/models.d.ts

@@ -1,8 +1,10 @@
 import { z } from 'zod';
 import type { ClassMapDefinition, LabelDefinition } from './labels.js';
 import type { PostprocessorType } from './pipeline-step.js';
-export declare const MODEL_FORMATS: readonly ['onnx', 'coreml', 'openvino', 'tflite', 'pt', 'gguf'];
-export type ModelFormat = (typeof MODEL_FORMATS)[number];
+import { MODEL_FORMATS } from './model-formats.js';
+import type { ModelFormat } from './model-formats.js';
+export { MODEL_FORMATS };
+export type { ModelFormat };
 export type ModelOutputFormat = 'yolo' | 'ssd' | 'embedding' | 'classification' | 'ocr' | 'segmentation';
 /**
  * Multi-file format payload.

package/dist/util/owner-only-file.d.ts

@@ -0,0 +1,28 @@
+export declare class OwnerOnlyError extends Error {
+    readonly target: string;
+    constructor(target: string, detail: string);
+}
+/** Everything the Windows branch touches, injectable so a Mac can test it. */
+export interface OwnerOnlyDeps {
+    readonly platform: NodeJS.Platform;
+    readonly exec: (file: string, args: readonly string[]) => void;
+    /** `DOMAIN\\user` or `user` — the principal that keeps access. */
+    readonly principal: () => string;
+    readonly systemRoot: string | undefined;
+}
+/** The icacls argv for one path: no inheritance, owner + SYSTEM only. */
+export declare function icaclsArgs(target: string, principal: string, isDirectory: boolean): readonly string[];
+/** Restrict an existing file to its owner (chmod 0600 / owner+SYSTEM ACL). */
+export declare function restrictFileToOwnerSync(target: string, overrides?: Partial<OwnerOnlyDeps>): void;
+/** Restrict an existing directory to its owner (chmod 0700 / owner+SYSTEM, inherited). */
+export declare function restrictDirToOwnerSync(target: string, overrides?: Partial<OwnerOnlyDeps>): void;
+/** Create `dir` (and parents) readable by its owner only. */
+export declare function mkdirOwnerOnlySync(dir: string, overrides?: Partial<OwnerOnlyDeps>): void;
+/**
+ * Atomically write a secret-bearing file that only its owner can read.
+ *
+ * Order matters: the temp file is created EMPTY, restricted, and only then
+ * given its content, so there is no moment at which the secret exists under a
+ * permissive ACL. The rename carries the (already restricted) ACL with it.
+ */
+export declare function writeOwnerOnlyFileSync(target: string, data: string | Uint8Array, overrides?: Partial<OwnerOnlyDeps>): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/types",
-  "version": "1.2.354",
+  "version": "1.2.356",
   "description": "Shared types, interfaces, and model catalogs for the CamStack detection ecosystem",
   "keywords": [
     "camstack",