@camstack/types 1.2.374 → 1.2.375

package/dist/capabilities/local-network.cap.d.ts

@@ -953,6 +953,14 @@ export declare const localNetworkCapability: {
             caCertPem: z.ZodNullable<z.ZodString>;
             reissueError: z.ZodNullable<z.ZodString>;
             restartRequired: z.ZodBoolean;
+            caMissing: z.ZodBoolean;
+            localCaConstrained: z.ZodNullable<z.ZodBoolean>;
+            caReplacedAt: z.ZodNullable<z.ZodString>;
+            storedUpload: z.ZodNullable<z.ZodObject<{
+                leafFingerprintSha256: z.ZodString;
+                validTo: z.ZodString;
+                hasCa: z.ZodBoolean;
+            }, z.core.$strip>>;
         }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
         /** Issue a new leaf under the existing local CA. Disabled in uploaded mode. */
         readonly regenerateCertificate: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
@@ -970,8 +978,19 @@ export declare const localNetworkCapability: {
             caCertPem: z.ZodNullable<z.ZodString>;
             reissueError: z.ZodNullable<z.ZodString>;
             restartRequired: z.ZodBoolean;
+            caMissing: z.ZodBoolean;
+            localCaConstrained: z.ZodNullable<z.ZodBoolean>;
+            caReplacedAt: z.ZodNullable<z.ZodString>;
+            storedUpload: z.ZodNullable<z.ZodObject<{
+                leafFingerprintSha256: z.ZodString;
+                validTo: z.ZodString;
+                hasCa: z.ZodBoolean;
+            }, z.core.$strip>>;
         }, z.core.$strip>, "mutation">;
-        /** Replace the served material with operator-supplied PEMs. */
+        /**
+         * Replace the served material with operator-supplied PEMs. A certificate that does not lead
+         * to a public CA must come with its CA certificate, validated and kept for Download CA (D873).
+         */
         readonly uploadCertificate: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             certPem: z.ZodString;
             keyPem: z.ZodString;
@@ -989,12 +1008,45 @@ export declare const localNetworkCapability: {
             caCertPem: z.ZodNullable<z.ZodString>;
             reissueError: z.ZodNullable<z.ZodString>;
             restartRequired: z.ZodBoolean;
+            caMissing: z.ZodBoolean;
+            localCaConstrained: z.ZodNullable<z.ZodBoolean>;
+            caReplacedAt: z.ZodNullable<z.ZodString>;
+            storedUpload: z.ZodNullable<z.ZodObject<{
+                leafFingerprintSha256: z.ZodString;
+                validTo: z.ZodString;
+                hasCa: z.ZodBoolean;
+            }, z.core.$strip>>;
         }, z.core.$strip>, "mutation">;
         /** The local CA PEM, or empty when there is none to download. */
         readonly downloadCa: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodObject<{
             pem: z.ZodString;
         }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
-        /** Drop uploaded material and return to the generated local CA. */
+        /**
+         * Serve the kept upload again after "Revert to generated" (D873). Refused when none is kept.
+         */
+        readonly useStoredUploadedCertificate: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodObject<{
+            mode: z.ZodEnum<{
+                disabled: "disabled";
+                generated: "generated";
+                uploaded: "uploaded";
+            }>;
+            leafFingerprintSha256: z.ZodNullable<z.ZodString>;
+            caFingerprintSha256: z.ZodNullable<z.ZodString>;
+            validTo: z.ZodNullable<z.ZodString>;
+            sans: z.ZodArray<z.ZodString>;
+            caCertPem: z.ZodNullable<z.ZodString>;
+            reissueError: z.ZodNullable<z.ZodString>;
+            restartRequired: z.ZodBoolean;
+            caMissing: z.ZodBoolean;
+            localCaConstrained: z.ZodNullable<z.ZodBoolean>;
+            caReplacedAt: z.ZodNullable<z.ZodString>;
+            storedUpload: z.ZodNullable<z.ZodObject<{
+                leafFingerprintSha256: z.ZodString;
+                validTo: z.ZodString;
+                hasCa: z.ZodBoolean;
+            }, z.core.$strip>>;
+        }, z.core.$strip>, "mutation">;
+        /** Return to the generated local CA. The uploaded certificate stays stored (D873). */
         readonly revertToGeneratedCertificate: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodObject<{
             mode: z.ZodEnum<{
                 disabled: "disabled";
@@ -1008,6 +1060,14 @@ export declare const localNetworkCapability: {
             caCertPem: z.ZodNullable<z.ZodString>;
             reissueError: z.ZodNullable<z.ZodString>;
             restartRequired: z.ZodBoolean;
+            caMissing: z.ZodBoolean;
+            localCaConstrained: z.ZodNullable<z.ZodBoolean>;
+            caReplacedAt: z.ZodNullable<z.ZodString>;
+            storedUpload: z.ZodNullable<z.ZodObject<{
+                leafFingerprintSha256: z.ZodString;
+                validTo: z.ZodString;
+                hasCa: z.ZodBoolean;
+            }, z.core.$strip>>;
         }, z.core.$strip>, "mutation">;
     };
     /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */

package/dist/client.js

@@ -27847,6 +27847,7 @@ function createSystemProxy(api) {
 			regenerateCertificate: (input) => dispatch("localNetwork", "regenerateCertificate", "mutation", input),
 			uploadCertificate: (input) => dispatch("localNetwork", "uploadCertificate", "mutation", input),
 			downloadCa: (input) => dispatch("localNetwork", "downloadCa", "query", input),
+			useStoredUploadedCertificate: (input) => dispatch("localNetwork", "useStoredUploadedCertificate", "mutation", input),
 			revertToGeneratedCertificate: (input) => dispatch("localNetwork", "revertToGeneratedCertificate", "mutation", input)
 		},
 		meshNetwork: {

package/dist/client.mjs

@@ -27846,6 +27846,7 @@ function createSystemProxy(api) {
 			regenerateCertificate: (input) => dispatch("localNetwork", "regenerateCertificate", "mutation", input),
 			uploadCertificate: (input) => dispatch("localNetwork", "uploadCertificate", "mutation", input),
 			downloadCa: (input) => dispatch("localNetwork", "downloadCa", "query", input),
+			useStoredUploadedCertificate: (input) => dispatch("localNetwork", "useStoredUploadedCertificate", "mutation", input),
 			revertToGeneratedCertificate: (input) => dispatch("localNetwork", "revertToGeneratedCertificate", "mutation", input)
 		},
 		meshNetwork: {

package/dist/generated/addon-api.d.ts

@@ -4461,6 +4461,13 @@ export type AppRouter = TrpcCoreRouter<{
             output: z.infer<typeof localNetworkCapability.methods.downloadCa.output>;
             meta: object;
         }>;
+        useStoredUploadedCertificate: TRPCMutationProcedure<{
+            input: {
+                nodeId?: string | undefined;
+            } | undefined;
+            output: z.infer<typeof localNetworkCapability.methods.useStoredUploadedCertificate.output>;
+            meta: object;
+        }>;
         revertToGeneratedCertificate: TRPCMutationProcedure<{
             input: {
                 nodeId?: string | undefined;

package/dist/generated/method-access-map.d.ts

@@ -6,7 +6,7 @@
  * scope+access check inside `protectedProcedure` (see
  * `server/backend/src/api/trpc/trpc.middleware.ts`).
  *
- * Coverage: 1337 method paths across 174 capabilities.
+ * Coverage: 1338 method paths across 174 capabilities.
  */
 import type { CapabilityMethodAccess } from '../capabilities/capability-definition.js';
 export interface MethodAccessRecord {

package/dist/generated/system-proxy.d.ts

@@ -85,7 +85,7 @@ export interface SystemProxy {
     readonly integrations: Pick<InferProvider<typeof integrationsCapability>, 'list' | 'get' | 'getByAddonId' | 'create' | 'update' | 'delete' | 'getSettings' | 'setSettings' | 'getAvailableTypes' | 'testConnection'>;
     readonly keychainAdmin: Pick<InferProvider<typeof keychainAdminCapability>, 'status' | 'listSecrets' | 'listAudit' | 'reveal' | 'setSystemSecret' | 'deleteOrphans' | 'rotateMasterKey' | 'purgeRetiredKeys' | 'downloadRecoveryKey' | 'resetKeychain' | 'resetReport' | 'acknowledgeReset'>;
     readonly llm: Pick<InferProvider<typeof llmCapability>, 'generate' | 'generateVision' | 'cancel' | 'listProfileKinds' | 'listProfiles' | 'upsertProfile' | 'deleteProfile' | 'testProfile' | 'listModels' | 'getDefaults' | 'setDefault' | 'getUsage' | 'listModelCatalog' | 'listRuntimeNodes' | 'listNodeModels' | 'resolveModelRef' | 'installModel' | 'deleteModel' | 'getRuntimeStatus' | 'startRuntime' | 'stopRuntime'>;
-    readonly localNetwork: Pick<InferProvider<typeof localNetworkCapability>, 'list' | 'getPreferred' | 'getConnectionEndpoints' | 'getNotificationEndpoint' | 'setNotificationEndpoint' | 'getViewerEndpoints' | 'setViewerEndpoints' | 'getAddresses' | 'addCustomAddress' | 'removeCustomAddress' | 'setAddressRole' | 'getHubAddresses' | 'getAllowedAddresses' | 'setAllowedAddresses' | 'resetAllowlistToBestMatch' | 'getTlsStatus' | 'regenerateCertificate' | 'uploadCertificate' | 'downloadCa' | 'revertToGeneratedCertificate'>;
+    readonly localNetwork: Pick<InferProvider<typeof localNetworkCapability>, 'list' | 'getPreferred' | 'getConnectionEndpoints' | 'getNotificationEndpoint' | 'setNotificationEndpoint' | 'getViewerEndpoints' | 'setViewerEndpoints' | 'getAddresses' | 'addCustomAddress' | 'removeCustomAddress' | 'setAddressRole' | 'getHubAddresses' | 'getAllowedAddresses' | 'setAllowedAddresses' | 'resetAllowlistToBestMatch' | 'getTlsStatus' | 'regenerateCertificate' | 'uploadCertificate' | 'downloadCa' | 'useStoredUploadedCertificate' | 'revertToGeneratedCertificate'>;
     readonly meshNetwork: Pick<InferProvider<typeof meshNetworkCapability>, 'getStatus' | 'join' | 'startLogin' | 'leave' | 'logout' | 'listPeers' | 'testConnection'>;
     readonly metricsProvider: Pick<InferProvider<typeof metricsProviderCapability>, 'collectSnapshot' | 'getCached' | 'getCurrent' | 'getDiskSpace' | 'getGpuInfo' | 'getCpuTemperature' | 'getProcessStats' | 'listAddonInstances' | 'getAddonStats' | 'listNodeProcesses' | 'getLoadSeries'>;
     readonly mqttBroker: Pick<InferProvider<typeof mqttBrokerCapability>, 'listBrokers' | 'getBrokerConfig' | 'addBroker' | 'removeBroker' | 'testConnection' | 'startEmbeddedBroker' | 'stopEmbeddedBroker' | 'getStatus'>;

package/dist/index.js

@@ -5660,11 +5660,12 @@ function describeModelVariant(models, modelId) {
 * for a user-supplied CLIP model: its registry row carries the same block.
 */
 /**
-* `object-clip` (the historical MobileCLIP index, 512-d) or
 * `object-clip-<model>`. Lower-case and dash-only so the sqlite-vec table name
 * derived from it (`vec_` + non-word → `_`) cannot collide with another index's.
+* The bare `object-clip` — the retired MobileCLIP index — is NOT accepted (D871):
+* a model that names it is a catalog defect, not a model.
 */
-var CLIP_VECTOR_INDEX_PATTERN = /^object-clip(-[a-z0-9][a-z0-9-]*)?$/;
+var CLIP_VECTOR_INDEX_PATTERN = /^object-clip-[a-z0-9][a-z0-9-]*$/;
 var ClipModelMetaSchema = zod.z.object({
 	/** The paired text encoder's catalog id (the embedding-encoder's text catalog). */
 	textModelId: zod.z.string().min(1),
@@ -5673,9 +5674,8 @@ var ClipModelMetaSchema = zod.z.object({
 	/**
 	* The `vector-store` index this model's vectors live in. ONE feature space
 	* per index: two models share an index only when their vectors are ranked
-	* against each other, which for CLIP means never across families. MobileCLIP
-	* S1 and S2 share `object-clip` for history (separated by the row's
-	* `modelId`); any other model gets its own.
+	* against each other, which for CLIP means never across families. Every
+	* model gets its own.
 	*/
 	vectorIndex: zod.z.string().regex(CLIP_VECTOR_INDEX_PATTERN),
 	/**
@@ -62599,7 +62599,19 @@ var TlsStatusSchema = zod.z.object({
 	sans: zod.z.array(zod.z.string()),
 	caCertPem: zod.z.string().nullable(),
 	reissueError: zod.z.string().nullable(),
-	restartRequired: zod.z.boolean()
+	restartRequired: zod.z.boolean(),
+	/** An uploaded certificate is served but no CA is kept for it and it is not publicly signed (D873). */
+	caMissing: zod.z.boolean(),
+	/** Does the hub's own generated CA carry a critical name constraint? `null` while it has none. */
+	localCaConstrained: zod.z.boolean().nullable(),
+	/** ISO time the generated CA was replaced by a constrained one; devices must re-download it. */
+	caReplacedAt: zod.z.string().nullable(),
+	/** The uploaded certificate kept on disk, selectable again after "Revert to generated". */
+	storedUpload: zod.z.object({
+		leafFingerprintSha256: zod.z.string(),
+		validTo: zod.z.string(),
+		hasCa: zod.z.boolean()
+	}).nullable()
 });
 var localNetworkCapability = {
 	name: "local-network",
@@ -62793,7 +62805,10 @@ var localNetworkCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Replace the served material with operator-supplied PEMs. */
+		/**
+		* Replace the served material with operator-supplied PEMs. A certificate that does not lead
+		* to a public CA must come with its CA certificate, validated and kept for Download CA (D873).
+		*/
 		uploadCertificate: require_sleep.method(zod.z.object({
 			certPem: zod.z.string().min(1),
 			keyPem: zod.z.string().min(1),
@@ -62804,7 +62819,14 @@ var localNetworkCapability = {
 		}),
 		/** The local CA PEM, or empty when there is none to download. */
 		downloadCa: require_sleep.method(zod.z.void(), zod.z.object({ pem: zod.z.string() })),
-		/** Drop uploaded material and return to the generated local CA. */
+		/**
+		* Serve the kept upload again after "Revert to generated" (D873). Refused when none is kept.
+		*/
+		useStoredUploadedCertificate: require_sleep.method(zod.z.void(), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Return to the generated local CA. The uploaded certificate stays stored (D873). */
 		revertToGeneratedCertificate: require_sleep.method(zod.z.void(), TlsStatusSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -79773,6 +79795,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.useStoredUploadedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.getStatus": {
 		capName: "lock-control",
 		capScope: "device",
@@ -91977,6 +92005,7 @@ function createSystemProxy(api) {
 			regenerateCertificate: (input) => dispatch("localNetwork", "regenerateCertificate", "mutation", input),
 			uploadCertificate: (input) => dispatch("localNetwork", "uploadCertificate", "mutation", input),
 			downloadCa: (input) => dispatch("localNetwork", "downloadCa", "query", input),
+			useStoredUploadedCertificate: (input) => dispatch("localNetwork", "useStoredUploadedCertificate", "mutation", input),
 			revertToGeneratedCertificate: (input) => dispatch("localNetwork", "revertToGeneratedCertificate", "mutation", input)
 		},
 		meshNetwork: {
@@ -97243,7 +97272,11 @@ var REMOVED_MODEL_IDS = {
 	"face-embedding": ["arcface-r100", "inception-resnet-v1"],
 	"plate-detection": ["yolov8n-plate"],
 	"plate-ocr": ["vgg-english-g2"],
-	"clip-embedding": ["mobileclip-s1", "mobileclip-s2"],
+	"clip-embedding": [
+		"mobileclip-s0",
+		"mobileclip-s1",
+		"mobileclip-s2"
+	],
 	"package-detection": ["yolov8n-package"],
 	"bird-classifier": ["bird-classifier-aiy-edgetpu", "bird-nabirds-404"],
 	"animal-classifier": ["animals-10"],

package/dist/index.mjs

@@ -5659,11 +5659,12 @@ function describeModelVariant(models, modelId) {
 * for a user-supplied CLIP model: its registry row carries the same block.
 */
 /**
-* `object-clip` (the historical MobileCLIP index, 512-d) or
 * `object-clip-<model>`. Lower-case and dash-only so the sqlite-vec table name
 * derived from it (`vec_` + non-word → `_`) cannot collide with another index's.
+* The bare `object-clip` — the retired MobileCLIP index — is NOT accepted (D871):
+* a model that names it is a catalog defect, not a model.
 */
-var CLIP_VECTOR_INDEX_PATTERN = /^object-clip(-[a-z0-9][a-z0-9-]*)?$/;
+var CLIP_VECTOR_INDEX_PATTERN = /^object-clip-[a-z0-9][a-z0-9-]*$/;
 var ClipModelMetaSchema = z.object({
 	/** The paired text encoder's catalog id (the embedding-encoder's text catalog). */
 	textModelId: z.string().min(1),
@@ -5672,9 +5673,8 @@ var ClipModelMetaSchema = z.object({
 	/**
 	* The `vector-store` index this model's vectors live in. ONE feature space
 	* per index: two models share an index only when their vectors are ranked
-	* against each other, which for CLIP means never across families. MobileCLIP
-	* S1 and S2 share `object-clip` for history (separated by the row's
-	* `modelId`); any other model gets its own.
+	* against each other, which for CLIP means never across families. Every
+	* model gets its own.
 	*/
 	vectorIndex: z.string().regex(CLIP_VECTOR_INDEX_PATTERN),
 	/**
@@ -62598,7 +62598,19 @@ var TlsStatusSchema = z.object({
 	sans: z.array(z.string()),
 	caCertPem: z.string().nullable(),
 	reissueError: z.string().nullable(),
-	restartRequired: z.boolean()
+	restartRequired: z.boolean(),
+	/** An uploaded certificate is served but no CA is kept for it and it is not publicly signed (D873). */
+	caMissing: z.boolean(),
+	/** Does the hub's own generated CA carry a critical name constraint? `null` while it has none. */
+	localCaConstrained: z.boolean().nullable(),
+	/** ISO time the generated CA was replaced by a constrained one; devices must re-download it. */
+	caReplacedAt: z.string().nullable(),
+	/** The uploaded certificate kept on disk, selectable again after "Revert to generated". */
+	storedUpload: z.object({
+		leafFingerprintSha256: z.string(),
+		validTo: z.string(),
+		hasCa: z.boolean()
+	}).nullable()
 });
 var localNetworkCapability = {
 	name: "local-network",
@@ -62792,7 +62804,10 @@ var localNetworkCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Replace the served material with operator-supplied PEMs. */
+		/**
+		* Replace the served material with operator-supplied PEMs. A certificate that does not lead
+		* to a public CA must come with its CA certificate, validated and kept for Download CA (D873).
+		*/
 		uploadCertificate: method(z.object({
 			certPem: z.string().min(1),
 			keyPem: z.string().min(1),
@@ -62803,7 +62818,14 @@ var localNetworkCapability = {
 		}),
 		/** The local CA PEM, or empty when there is none to download. */
 		downloadCa: method(z.void(), z.object({ pem: z.string() })),
-		/** Drop uploaded material and return to the generated local CA. */
+		/**
+		* Serve the kept upload again after "Revert to generated" (D873). Refused when none is kept.
+		*/
+		useStoredUploadedCertificate: method(z.void(), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Return to the generated local CA. The uploaded certificate stays stored (D873). */
 		revertToGeneratedCertificate: method(z.void(), TlsStatusSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -79772,6 +79794,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.useStoredUploadedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.getStatus": {
 		capName: "lock-control",
 		capScope: "device",
@@ -91976,6 +92004,7 @@ function createSystemProxy(api) {
 			regenerateCertificate: (input) => dispatch("localNetwork", "regenerateCertificate", "mutation", input),
 			uploadCertificate: (input) => dispatch("localNetwork", "uploadCertificate", "mutation", input),
 			downloadCa: (input) => dispatch("localNetwork", "downloadCa", "query", input),
+			useStoredUploadedCertificate: (input) => dispatch("localNetwork", "useStoredUploadedCertificate", "mutation", input),
 			revertToGeneratedCertificate: (input) => dispatch("localNetwork", "revertToGeneratedCertificate", "mutation", input)
 		},
 		meshNetwork: {
@@ -97242,7 +97271,11 @@ var REMOVED_MODEL_IDS = {
 	"face-embedding": ["arcface-r100", "inception-resnet-v1"],
 	"plate-detection": ["yolov8n-plate"],
 	"plate-ocr": ["vgg-english-g2"],
-	"clip-embedding": ["mobileclip-s1", "mobileclip-s2"],
+	"clip-embedding": [
+		"mobileclip-s0",
+		"mobileclip-s1",
+		"mobileclip-s2"
+	],
 	"package-detection": ["yolov8n-package"],
 	"bird-classifier": ["bird-classifier-aiy-edgetpu", "bird-nabirds-404"],
 	"animal-classifier": ["animals-10"],

package/dist/types/clip-model.d.ts

@@ -20,9 +20,10 @@
  */
 import { z } from 'zod';
 /**
- * `object-clip` (the historical MobileCLIP index, 512-d) or
  * `object-clip-<model>`. Lower-case and dash-only so the sqlite-vec table name
  * derived from it (`vec_` + non-word → `_`) cannot collide with another index's.
+ * The bare `object-clip` — the retired MobileCLIP index — is NOT accepted (D871):
+ * a model that names it is a catalog defect, not a model.
  */
 export declare const CLIP_VECTOR_INDEX_PATTERN: RegExp;
 export declare const ClipModelMetaSchema: z.ZodObject<{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/types",
-  "version": "1.2.374",
+  "version": "1.2.375",
   "description": "Shared types, interfaces, and model catalogs for the CamStack detection ecosystem",
   "keywords": [
     "camstack",