@camstack/types 1.2.402 → 1.2.403

package/dist/interfaces/api-responses.d.ts

@@ -48,7 +48,7 @@ export interface SafeUser {
      * for non-admins until an admin assigns scopes via `setUserScopes`.
      * Wire-side default `[]` from the Zod schema.
      */
-    readonly scopes: readonly import('../schemas/auth-records.js').TokenScope[];
+    readonly scopes: readonly import('../schemas/auth-records.js').UserScope[];
     /**
      * True iff a confirmed TOTP enrollment exists for this user — surfaced
      * by `listUsers` so the admin UI can render the "Remove 2FA" action

package/dist/interfaces/auth.d.ts

@@ -1,5 +1,5 @@
 export { type UserRecord, type TokenScope } from '../schemas/auth-records.js';
-import type { TokenScope } from '../schemas/auth-records.js';
+import type { UserScope } from '../schemas/auth-records.js';
 export interface UserPermissions {
     isAdmin: boolean;
     allowedProviders: string[] | '*';
@@ -34,7 +34,7 @@ export interface TokenPayload {
      * user's NEXT login — existing JWTs carry the snapshot from
      * issue-time. Re-issue on the client by logging out and back in.
      */
-    scopes?: readonly TokenScope[];
+    scopes?: readonly UserScope[];
     iat?: number;
     exp?: number;
 }

package/dist/interfaces/birth-decision-ledger.d.ts

@@ -84,6 +84,18 @@ export declare const BirthDecisionVerdictSchema: z.ZodEnum<{
     suppressed: "suppressed";
 }>;
 export type BirthDecisionVerdict = z.infer<typeof BirthDecisionVerdictSchema>;
+/**
+ * Which pixels a gate verdict was taken on (D379): `native` is a full-resolution
+ * crop of the birth's own frame and the ONLY source that may suppress;
+ * `carried` is that instant at analysis resolution and `fallback` a later
+ * instant — both may only confirm.
+ */
+export declare const BirthDecisionCropSourceSchema: z.ZodEnum<{
+    carried: "carried";
+    fallback: "fallback";
+    native: "native";
+}>;
+export type BirthDecisionCropSource = z.infer<typeof BirthDecisionCropSourceSchema>;
 /** One birth decision, as it is kept. */
 export declare const BirthDecisionRecordSchema: z.ZodObject<{
     id: z.ZodString;
@@ -97,6 +109,11 @@ export declare const BirthDecisionRecordSchema: z.ZodObject<{
         suppressed: "suppressed";
     }>;
     reason: z.ZodNullable<z.ZodString>;
+    cropSource: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+        carried: "carried";
+        fallback: "fallback";
+        native: "native";
+    }>>>;
     attempts: z.ZodNumber;
     deferredForMs: z.ZodNumber;
     decidedOnCoastedFrame: z.ZodBoolean;

package/dist/schemas/auth-records.d.ts

@@ -1,14 +1,3 @@
-/**
- * Zod schemas for persisted record types.
- *
- * These schemas serve as the single source of truth for types that are
- * stored in the settings-store backend and retrieved via tRPC. They
- * replace the manual TypeScript interfaces with schema-derived types,
- * enabling runtime validation when reading from the backend.
- *
- * Convention: each schema is named `<Type>Schema`, the inferred TS type
- * keeps the original name for backward compatibility.
- */
 import { z } from 'zod';
 import { DeviceType } from '../device/device-type.js';
 /**
@@ -141,6 +130,71 @@ export declare const TokenScopeSchema: z.ZodPreprocess<z.ZodDiscriminatedUnion<[
     includeLinked: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>], "type">>;
 export type TokenScope = z.infer<typeof TokenScopeSchema>;
+/**
+ * What a PERSON's grant set holds (D921): the capability rows above (legacy
+ * users, integration-style tokens) or the viewer row, which is decided by its
+ * own rules alone. Kept apart from {@link TokenScope} so every surface that
+ * edits capability rows (the scope picker, token minting) keeps its shape.
+ */
+export declare const UserScopeSchema: z.ZodUnion<readonly [z.ZodObject<{
+    type: z.ZodLiteral<"viewer">;
+    allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodNumber>]>;
+    block: z.ZodArray<z.ZodNumber>;
+    features: z.ZodArray<z.ZodEnum<{
+        "face-assignment": "face-assignment";
+        "plate-assignment": "plate-assignment";
+        retrain: "retrain";
+        scenes: "scenes";
+    }>>;
+}, z.core.$strip>, z.ZodPreprocess<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"category">;
+    target: z.ZodEnum<{
+        device: "device";
+        system: "system";
+    }>;
+    access: z.ZodArray<z.ZodEnum<{
+        create: "create";
+        delete: "delete";
+        view: "view";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"capability">;
+    target: z.ZodString;
+    access: z.ZodArray<z.ZodEnum<{
+        create: "create";
+        delete: "delete";
+        view: "view";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"addon">;
+    target: z.ZodString;
+    access: z.ZodArray<z.ZodEnum<{
+        create: "create";
+        delete: "delete";
+        view: "view";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"device">;
+    selector: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"all">;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"ids">;
+        ids: z.ZodArray<z.ZodNumber>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"types">;
+        types: z.ZodArray<z.ZodEnum<typeof DeviceType>>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"locations">;
+        locations: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>], "kind">;
+    access: z.ZodArray<z.ZodEnum<{
+        create: "create";
+        delete: "delete";
+        view: "view";
+    }>>;
+    includeLinked: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>], "type">>]>;
+export type UserScope = z.infer<typeof UserScopeSchema>;
 /** The `device`-typed member of {@link TokenScope}, narrowed for matchers. */
 export type DeviceTokenScope = z.infer<typeof DeviceTokenScopeSchema>;
 export declare const UserRecordSchema: z.ZodObject<{
@@ -150,7 +204,17 @@ export declare const UserRecordSchema: z.ZodObject<{
     isAdmin: z.ZodDefault<z.ZodBoolean>;
     allowedProviders: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
     allowedDevices: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>>;
-    scopes: z.ZodDefault<z.ZodArray<z.ZodPreprocess<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    scopes: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        type: z.ZodLiteral<"viewer">;
+        allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodNumber>]>;
+        block: z.ZodArray<z.ZodNumber>;
+        features: z.ZodArray<z.ZodEnum<{
+            "face-assignment": "face-assignment";
+            "plate-assignment": "plate-assignment";
+            retrain: "retrain";
+            scenes: "scenes";
+        }>>;
+    }, z.core.$strip>, z.ZodPreprocess<z.ZodDiscriminatedUnion<[z.ZodObject<{
         type: z.ZodLiteral<"category">;
         target: z.ZodEnum<{
             device: "device";
@@ -197,7 +261,7 @@ export declare const UserRecordSchema: z.ZodObject<{
             view: "view";
         }>>;
         includeLinked: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$strip>], "type">>>>;
+    }, z.core.$strip>], "type">>]>>>;
     createdAt: z.ZodNumber;
     updatedAt: z.ZodNumber;
 }, z.core.$strip>;

package/dist/schemas/device-selector.d.ts

@@ -13,7 +13,14 @@
  *
  * No I/O, no registry — the fleet + parentage are passed in.
  */
-import type { DeviceSelector, DeviceTokenScope, MethodAccess, TokenScope } from './auth-records.js';
+import type { DeviceSelector, DeviceTokenScope, MethodAccess, TokenScope, UserScope } from './auth-records.js';
+import { type ViewerFeatureId, type ViewerTokenScope } from '../auth/viewer-access.js';
+/**
+ * The viewer grant that decides this principal, or `null`. A set holding one
+ * is decided by it ALONE (D921): the first viewer row wins, the rest of the
+ * set is ignored, so a leftover grant can never widen a viewer.
+ */
+export declare function viewerScopeOf(scopes: readonly UserScope[]): ViewerTokenScope | null;
 /** The minimal device shape selectors resolve against. */
 export interface DeviceMetaLike {
     readonly id: number;
@@ -39,7 +46,12 @@ export declare function scopeInherits(scope: DeviceTokenScope, access: MethodAcc
  * grant inherits) against an ancestor, so a parent grant covers its
  * accessories.
  */
-export declare function resolveViewableDeviceIds(scopes: readonly TokenScope[], fleet: readonly DeviceMetaLike[], access: MethodAccess): Set<number>;
+export declare function resolveViewableDeviceIds(scopes: readonly UserScope[], fleet: readonly DeviceMetaLike[], access: MethodAccess): Set<number>;
+/**
+ * The capability rows of a set — a viewer row (D921) dropped. For surfaces
+ * that edit or display capability rows and have no meaning for a viewer row.
+ */
+export declare function grantRowsOf(scopes: readonly UserScope[]): TokenScope[];
 /**
  * Normalise a raw scope array read off a JWT payload or a stored record into
  * validated v3 `TokenScope`s, migrating any v2 `device:targets` grant on the
@@ -51,7 +63,7 @@ export declare function resolveViewableDeviceIds(scopes: readonly TokenScope[],
  * a lockout, and a lockout reads as broken. A non-array input yields `[]`
  * (fail closed).
  */
-export declare function normalizeTokenScopes(raw: unknown): TokenScope[];
+export declare function normalizeTokenScopes(raw: unknown): UserScope[];
 /** A capability/addon grant flattened for the UI. */
 export interface ScopeGrantSummary {
     readonly name: string;
@@ -70,6 +82,13 @@ export interface DeviceReachSummary {
  */
 export interface EffectiveScope {
     readonly isAdmin: boolean;
+    /**
+     * `admin`, `viewer` (D921), or `scoped` — a legacy grant set decided by the
+     * pre-D921 matcher until the operator converts it.
+     */
+    readonly role: 'admin' | 'viewer' | 'scoped';
+    /** The features granted to a viewer; empty for every other role. */
+    readonly features: readonly ViewerFeatureId[];
     /** true iff every device is viewable (admin, `category:device[view]`, or a
      *  device grant with an `all` selector). */
     readonly allDevicesViewable: boolean;
@@ -85,4 +104,4 @@ export interface EffectiveScope {
     readonly addons: readonly ScopeGrantSummary[];
 }
 /** Build the {@link EffectiveScope} for a caller from their scopes + the fleet. */
-export declare function summarizeEffectiveScope(scopes: readonly TokenScope[], fleet: readonly DeviceMetaLike[], isAdmin: boolean): EffectiveScope;
+export declare function summarizeEffectiveScope(scopes: readonly UserScope[], fleet: readonly DeviceMetaLike[], isAdmin: boolean): EffectiveScope;

package/dist/{sleep-CUp20JkO.mjs → sleep-6AqUnQIT.mjs}

@@ -6175,6 +6175,7 @@ function method(input, output, options) {
 		kind: options?.kind ?? "query",
 		...options?.auth !== void 0 ? { auth: options.auth } : {},
 		...options?.access !== void 0 ? { access: options.access } : {},
+		...options?.role !== void 0 ? { role: options.role } : {},
 		...options?.caller !== void 0 ? { caller: options.caller } : {},
 		timeoutMs: options?.timeoutMs
 	};

package/dist/{sleep-DVovpDRU.js → sleep-Ch67uumJ.js}

@@ -6175,6 +6175,7 @@ function method(input, output, options) {
 		kind: options?.kind ?? "query",
 		...options?.auth !== void 0 ? { auth: options.auth } : {},
 		...options?.access !== void 0 ? { access: options.access } : {},
+		...options?.role !== void 0 ? { role: options.role } : {},
 		...options?.caller !== void 0 ? { caller: options.caller } : {},
 		timeoutMs: options?.timeoutMs
 	};

package/dist/types/detection.d.ts

@@ -545,6 +545,15 @@ export interface FrameResult {
      * track keeps it so a later replay can name the original model (D646).
      */
     readonly rootModelId?: string;
+    /**
+     * The inference DEVICE the root ran on (`openvino:npu`, `edgetpu:pci`,
+     * `onnx:webgpu` …) — the pool the dispatch actually used, stamped beside
+     * {@link rootModelId}. A session can hop node or device between on-motion
+     * sessions (D916), so a stored track keeps the device of the frame that
+     * opened it and of the sighting that closed it. Absent on a frame no
+     * pipeline root produced, and from a runner older than the field.
+     */
+    readonly rootDeviceKey?: string;
     /**
      * The `package-detection` root RAN on this frame and was not shed — the
      * motion-settle governor dispatched it. The only way a consumer can tell

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/types",
-  "version": "1.2.402",
+  "version": "1.2.403",
   "description": "Shared types, interfaces, and model catalogs for the CamStack detection ecosystem",
   "keywords": [
     "camstack",