@camstack/types 1.2.374 → 1.2.376

package/dist/index.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-rqlHXgwb.js");
+const require_sleep = require("./sleep-Dq0Uyeh0.js");
 const require_event_category = require("./event-category-T43rdQWR.js");
 const require_composition = require("./composition-DIp0uE_b.js");
 const require_node_color = require("./node-color.js");
@@ -5660,11 +5660,12 @@ function describeModelVariant(models, modelId) {
 * for a user-supplied CLIP model: its registry row carries the same block.
 */
 /**
-* `object-clip` (the historical MobileCLIP index, 512-d) or
 * `object-clip-<model>`. Lower-case and dash-only so the sqlite-vec table name
 * derived from it (`vec_` + non-word → `_`) cannot collide with another index's.
+* The bare `object-clip` — the retired MobileCLIP index — is NOT accepted (D871):
+* a model that names it is a catalog defect, not a model.
 */
-var CLIP_VECTOR_INDEX_PATTERN = /^object-clip(-[a-z0-9][a-z0-9-]*)?$/;
+var CLIP_VECTOR_INDEX_PATTERN = /^object-clip-[a-z0-9][a-z0-9-]*$/;
 var ClipModelMetaSchema = zod.z.object({
 	/** The paired text encoder's catalog id (the embedding-encoder's text catalog). */
 	textModelId: zod.z.string().min(1),
@@ -5673,9 +5674,8 @@ var ClipModelMetaSchema = zod.z.object({
 	/**
 	* The `vector-store` index this model's vectors live in. ONE feature space
 	* per index: two models share an index only when their vectors are ranked
-	* against each other, which for CLIP means never across families. MobileCLIP
-	* S1 and S2 share `object-clip` for history (separated by the row's
-	* `modelId`); any other model gets its own.
+	* against each other, which for CLIP means never across families. Every
+	* model gets its own.
 	*/
 	vectorIndex: zod.z.string().regex(CLIP_VECTOR_INDEX_PATTERN),
 	/**
@@ -13900,6 +13900,91 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
 	}
 };
 //#endregion
+//#region src/capabilities/storage-admin.cap.ts
+/** One table of the settings database. */
+var StorageTableSchema = zod.z.object({
+	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
+	name: zod.z.string(),
+	/** The owner prefix of a scoped name (`recorder` for `recorder:addon-settings`), else null. */
+	owner: zod.z.string().nullable(),
+	rows: zod.z.number().int().nonnegative(),
+	/** Bytes the table's pages occupy (`dbstat`); null when the engine cannot measure. */
+	bytes: zod.z.number().int().nonnegative().nullable(),
+	/** Declared by an addon since this engine process started (a running addon claims it). */
+	declaredThisBoot: zod.z.boolean()
+});
+/**
+* The collections retired by exact name: the D870 ones (their data became keys
+* of the camera's settings) and the three D871 leftovers (the `stats-5m` tables
+* superseded by `stats-5m-v2`, and the unread `vec_object_clip`). No addon
+* declares any of them any more; the engine still refuses one a running addon
+* declared this boot. `dropCollection` may remove these, the
+* per-addon scoped `addon-settings` / `addon-devices` / `sections` tables, and
+* the tables of owners that are no longer installed - nothing else.
+*/
+var STORAGE_ADMIN_MOVED_COLLECTIONS = [
+	"stream-broker:probe-snapshots",
+	"stream-broker:profile-map",
+	"stream-broker:rtsp-tokens",
+	"notification-center:device-mutes",
+	"recorder:recording-configs",
+	"pipeline-orchestrator:device-features",
+	"pipeline-analytics:stats-5m",
+	"pipeline-orchestrator:stats-5m",
+	"vec_object_clip"
+];
+/** The per-addon blob tables a scoped name may carry. */
+var STORAGE_ADMIN_SCOPED_BASES = [
+	"addon-settings",
+	"addon-devices",
+	"sections"
+];
+/**
+* storage-admin - the operator's maintenance reach into the settings database:
+* list its tables, drop one that nothing owns any more (D870).
+*
+* Hub-only, internal and `auth: 'admin'` explicitly (`internal` does not gate
+* the mount, see `data-store-provider`). Both methods are LOGGED by the engine
+* with the table and the counts. `dropCollection` is a ONE-SHOT of the D870
+* migration and is marked for removal once the last hub has run it.
+*
+* `listTables` is READ-ONLY: it never creates a table, which `count` and `get`
+* on an undeclared scoped name used to do.
+*/
+var storageAdminCapability = {
+	name: "storage-admin",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		/**
+		* Every table of the settings database with its row count and size,
+		* optionally only those owned by `ownerPrefix`. Reads only.
+		*/
+		listTables: require_sleep.method(zod.z.object({ ownerPrefix: zod.z.string().min(1).optional() }), zod.z.object({ tables: zod.z.array(StorageTableSchema) }), { auth: "admin" }),
+		/**
+		* Drop one table. REFUSES when an addon declared it since the engine
+		* started (a running addon still owns it), when it is an engine or
+		* canonical table, when it does not exist, or when its row count is not
+		* `expectRows` - the caller states what it believes it is deleting. The
+		* engine also refuses anything but `<owner>:(addon-settings|addon-devices|
+		* sections)`, the retired collections by name, and tables of owners that
+		* are not installed (and refuses when it cannot read the installed list).
+		* Removed with the D870 migration script once the last hub ran it.
+		*/
+		dropCollection: require_sleep.method(zod.z.object({
+			collection: zod.z.string().min(1),
+			expectRows: zod.z.number().int().nonnegative()
+		}), zod.z.object({
+			dropped: zod.z.literal(true),
+			rows: zod.z.number().int().nonnegative()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+//#endregion
 //#region src/capabilities/keychain.cap.ts
 /**
 * `keychain` — the hub's encrypted store of secret values (D787).
@@ -14647,6 +14732,24 @@ var keychainAdminCapability = {
 			auth: "admin",
 			caller: "required"
 		}),
+		/**
+		* Store a value an operator tool carries over from a retired store at an
+		* addon's own ref (`secret://<owner>/<scope>/<path>`) and answer the ref -
+		* the D870 migration moves a camera's restream tokens this way, so they
+		* never sit in a settings row as plaintext. Audited as the operator; the
+		* caller then writes the MARKER of the ref where the value used to be.
+		*/
+		importSecret: require_sleep.method(zod.z.object({
+			ref: zod.z.string().min(1),
+			value: zod.z.string().min(1)
+		}), zod.z.object({
+			ref: zod.z.string(),
+			version: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
 		/** Delete refs no owner points at any more. Re-checked here; `unknown` is kept. */
 		deleteOrphans: require_sleep.method(zod.z.object({ refs: zod.z.array(zod.z.string().min(1)).max(1e3) }), zod.z.object({
 			deleted: zod.z.array(zod.z.string()).readonly(),
@@ -62599,7 +62702,19 @@ var TlsStatusSchema = zod.z.object({
 	sans: zod.z.array(zod.z.string()),
 	caCertPem: zod.z.string().nullable(),
 	reissueError: zod.z.string().nullable(),
-	restartRequired: zod.z.boolean()
+	restartRequired: zod.z.boolean(),
+	/** An uploaded certificate is served but no CA is kept for it and it is not publicly signed (D873). */
+	caMissing: zod.z.boolean(),
+	/** Does the hub's own generated CA carry a critical name constraint? `null` while it has none. */
+	localCaConstrained: zod.z.boolean().nullable(),
+	/** ISO time the generated CA was replaced by a constrained one; devices must re-download it. */
+	caReplacedAt: zod.z.string().nullable(),
+	/** The uploaded certificate kept on disk, selectable again after "Revert to generated". */
+	storedUpload: zod.z.object({
+		leafFingerprintSha256: zod.z.string(),
+		validTo: zod.z.string(),
+		hasCa: zod.z.boolean()
+	}).nullable()
 });
 var localNetworkCapability = {
 	name: "local-network",
@@ -62793,7 +62908,10 @@ var localNetworkCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Replace the served material with operator-supplied PEMs. */
+		/**
+		* Replace the served material with operator-supplied PEMs. A certificate that does not lead
+		* to a public CA must come with its CA certificate, validated and kept for Download CA (D873).
+		*/
 		uploadCertificate: require_sleep.method(zod.z.object({
 			certPem: zod.z.string().min(1),
 			keyPem: zod.z.string().min(1),
@@ -62804,7 +62922,14 @@ var localNetworkCapability = {
 		}),
 		/** The local CA PEM, or empty when there is none to download. */
 		downloadCa: require_sleep.method(zod.z.void(), zod.z.object({ pem: zod.z.string() })),
-		/** Drop uploaded material and return to the generated local CA. */
+		/**
+		* Serve the kept upload again after "Revert to generated" (D873). Refused when none is kept.
+		*/
+		useStoredUploadedCertificate: require_sleep.method(zod.z.void(), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Return to the generated local CA. The uploaded certificate stays stored (D873). */
 		revertToGeneratedCertificate: require_sleep.method(zod.z.void(), TlsStatusSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -79377,6 +79502,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"keychainAdmin.importSecret": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"keychainAdmin.listAudit": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -79773,6 +79904,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.useStoredUploadedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.getStatus": {
 		capName: "lock-control",
 		capScope: "device",
@@ -83157,6 +83294,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"storageAdmin.dropCollection": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"storageAdmin.listTables": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageEvictable.evict": {
 		capName: "storage-evictable",
 		capScope: "system",
@@ -84712,6 +84861,7 @@ var KNOWN_CAP_NAMES = [
 	"snapshot",
 	"sso-bridge",
 	"storage",
+	"storage-admin",
 	"storage-evictable",
 	"storage-migration",
 	"storage-occupancy",
@@ -84909,6 +85059,7 @@ var SYSTEM_CAP_NAMES = [
 	"smtp-provider",
 	"sso-bridge",
 	"storage",
+	"storage-admin",
 	"storage-evictable",
 	"storage-migration",
 	"storage-occupancy",
@@ -86984,6 +87135,7 @@ var CAPABILITY_NAMES = {
 	snapshot: "snapshot",
 	ssoBridge: "sso-bridge",
 	storage: "storage",
+	storageAdmin: "storage-admin",
 	storageEvictable: "storage-evictable",
 	storageMigration: "storage-migration",
 	storageOccupancy: "storage-occupancy",
@@ -87587,6 +87739,10 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "storage",
 		name: "storage"
 	},
+	{
+		key: "storageAdmin",
+		name: "storage-admin"
+	},
 	{
 		key: "storageEvictable",
 		name: "storage-evictable"
@@ -87868,6 +88024,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	snapshotCapability,
 	ssoBridgeCapability,
 	storageCapability,
+	storageAdminCapability,
 	storageEvictableCapability,
 	storageMigrationCapability,
 	storageOccupancyCapability,
@@ -91926,6 +92083,7 @@ function createSystemProxy(api) {
 			listAudit: (input) => dispatch("keychainAdmin", "listAudit", "query", input),
 			reveal: (input) => dispatch("keychainAdmin", "reveal", "mutation", input),
 			setSystemSecret: (input) => dispatch("keychainAdmin", "setSystemSecret", "mutation", input),
+			importSecret: (input) => dispatch("keychainAdmin", "importSecret", "mutation", input),
 			deleteOrphans: (input) => dispatch("keychainAdmin", "deleteOrphans", "mutation", input),
 			rotateMasterKey: (input) => dispatch("keychainAdmin", "rotateMasterKey", "mutation", input),
 			purgeRetiredKeys: (input) => dispatch("keychainAdmin", "purgeRetiredKeys", "mutation", input),
@@ -91977,6 +92135,7 @@ function createSystemProxy(api) {
 			regenerateCertificate: (input) => dispatch("localNetwork", "regenerateCertificate", "mutation", input),
 			uploadCertificate: (input) => dispatch("localNetwork", "uploadCertificate", "mutation", input),
 			downloadCa: (input) => dispatch("localNetwork", "downloadCa", "query", input),
+			useStoredUploadedCertificate: (input) => dispatch("localNetwork", "useStoredUploadedCertificate", "mutation", input),
 			revertToGeneratedCertificate: (input) => dispatch("localNetwork", "revertToGeneratedCertificate", "mutation", input)
 		},
 		meshNetwork: {
@@ -97243,7 +97402,11 @@ var REMOVED_MODEL_IDS = {
 	"face-embedding": ["arcface-r100", "inception-resnet-v1"],
 	"plate-detection": ["yolov8n-plate"],
 	"plate-ocr": ["vgg-english-g2"],
-	"clip-embedding": ["mobileclip-s1", "mobileclip-s2"],
+	"clip-embedding": [
+		"mobileclip-s0",
+		"mobileclip-s1",
+		"mobileclip-s2"
+	],
 	"package-detection": ["yolov8n-package"],
 	"bird-classifier": ["bird-classifier-aiy-edgetpu", "bird-nabirds-404"],
 	"animal-classifier": ["animals-10"],
@@ -102557,6 +102720,8 @@ exports.STATE_LABELS = STATE_LABELS;
 exports.STATE_LABEL_KEYS = STATE_LABEL_KEYS;
 exports.STATIONARY_OVERLAY_STYLE = STATIONARY_OVERLAY_STYLE;
 exports.STORAGE_ACCESS_FALLBACK = STORAGE_ACCESS_FALLBACK;
+exports.STORAGE_ADMIN_MOVED_COLLECTIONS = STORAGE_ADMIN_MOVED_COLLECTIONS;
+exports.STORAGE_ADMIN_SCOPED_BASES = STORAGE_ADMIN_SCOPED_BASES;
 exports.STORAGE_BYTES_PER_GB = STORAGE_BYTES_PER_GB;
 exports.STORAGE_LOCATION_MODES = STORAGE_LOCATION_MODES;
 exports.STREAM_PROFILE_META = STREAM_PROFILE_META;
@@ -102664,6 +102829,7 @@ exports.StorageMigrationSourcesSchema = StorageMigrationSourcesSchema;
 exports.StorageOccupancyReportSchema = StorageOccupancyReportSchema;
 exports.StorageProviderInfoSchema = ProviderInfoSchema;
 exports.StorageReadChunkInputSchema = ReadChunkInputSchema;
+exports.StorageTableSchema = StorageTableSchema;
 exports.StorageTestLocationResultSchema = TestLocationResultSchema;
 exports.StorageWriteChunkInputSchema = WriteChunkInputSchema;
 exports.StreamCodecSchema = StreamCodecSchema;
@@ -102966,6 +103132,7 @@ exports.classifyCamerasForBenchmark = classifyCamerasForBenchmark;
 exports.classifyInferenceHardware = classifyInferenceHardware;
 exports.classifyRetrainReview = classifyRetrainReview;
 exports.classifySecretWrite = require_sleep.classifySecretWrite;
+exports.classifyStoreError = require_sleep.classifyStoreError;
 exports.classifyStream = classifyStream;
 exports.classifyStreams = classifyStreams;
 exports.clearKnownSecrets = require_sleep.clearKnownSecrets;
@@ -103591,6 +103758,7 @@ exports.stateLabel = stateLabel;
 exports.stateVocabularyFor = stateVocabularyFor;
 exports.stepModelRunsOnFormat = stepModelRunsOnFormat;
 exports.stepSettingSource = stepSettingSource;
+exports.storageAdminCapability = storageAdminCapability;
 exports.storageCapability = storageCapability;
 exports.storageEvictableCapability = storageEvictableCapability;
 exports.storageMigrationCapability = storageMigrationCapability;