camstack 1.2.38 → 1.2.39

package/dist/{chunk-UYHYTS5M.js → chunk-VGIPYXDI.js}

@@ -15926,6 +15926,16 @@ var LabelDefinitionSchema = external_exports.object({
   description: external_exports.string().optional(),
   icon: external_exports.string().optional()
 });
+var CLASS_MAP_MACRO_TARGETS = [
+  "person",
+  "vehicle",
+  "animal",
+  "package"
+];
+var ClassMapDefinitionSchema = external_exports.object({
+  mapping: external_exports.record(external_exports.string(), external_exports.enum(CLASS_MAP_MACRO_TARGETS)),
+  preserveOriginal: external_exports.boolean()
+});
 var MODEL_FORMATS = [
   "onnx",
   "coreml",
@@ -16074,7 +16084,13 @@ var ModelCatalogEntrySchema = external_exports.object({
   * `id` stays the source of truth for resolution/download/persistence; grouping
   * is a presentation overlay resolved back to an `id`.
   */
-  group: ModelVariantGroupSchema.optional()
+  group: ModelVariantGroupSchema.optional(),
+  /**
+  * Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
+  * applies (Frigate / COCO public catalog). Set on a custom model whose raw
+  * labels already ARE the CamStack macros (Scrypted identity map).
+  */
+  classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertTargetSchema = external_exports.discriminatedUnion("format", [external_exports.object({
   format: external_exports.literal("openvino"),
@@ -16103,7 +16119,8 @@ var ModelConvertMetadataSchema = external_exports.object({
     "ocr",
     "segmentation"
   ]),
-  faceAlignment: external_exports.boolean().optional()
+  faceAlignment: external_exports.boolean().optional(),
+  classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertArtifactSchema = external_exports.object({
   format: external_exports.enum(MODEL_FORMATS),
@@ -25370,6 +25387,33 @@ var NativeCropRefSchema = external_exports.object({
     h: external_exports.number()
   })
 });
+external_exports.object({
+  crop: external_exports.object({
+    left: external_exports.number(),
+    top: external_exports.number(),
+    width: external_exports.number().positive(),
+    height: external_exports.number().positive()
+  }).optional(),
+  content: external_exports.object({
+    width: external_exports.number().int().positive(),
+    height: external_exports.number().int().positive()
+  }),
+  fit: external_exports.enum(["stretch", "contain"]),
+  format: external_exports.enum([
+    "rgb",
+    "gray",
+    "jpeg"
+  ])
+});
+var FrameRefSchema = external_exports.object({
+  registryId: external_exports.string().min(1),
+  id: external_exports.string().min(1),
+  width: external_exports.number().int().positive(),
+  height: external_exports.number().int().positive(),
+  format: external_exports.enum(["rgb", "gray"]),
+  timestamp: external_exports.number(),
+  capturedAt: external_exports.number().optional()
+});
 var ModelFormatSchema$1 = external_exports.enum([
   "onnx",
   "coreml",
@@ -25669,7 +25713,7 @@ var pipelineExecutorCapability = {
     * legacy call shape used by existing benchmark code; once all
     * callers pass it explicitly we make it required.
     *
-    * Exactly one of `frame`, `frameHandle`, `imageBase64`,
+    * Exactly one of `frame`, `frameRef`, `frameHandle`, `imageBase64`,
     * `referenceImage` must be provided:
     *  - `frame`: runtime dispatch path (runner → decoded broker frame).
     *    Carries the raw buffer, dimensions, and format; the executor
@@ -25691,6 +25735,12 @@ var pipelineExecutorCapability = {
       steps: external_exports.array(PipelineStepInputSchema).min(1),
       frame: FrameInputSchema.optional(),
       /**
+      * Process-local lazy frame. Valid only when caller and provider resolve
+      * in the same execution-group process; split/cross-node callers use
+      * `frame`/`image` inline compatibility instead.
+      */
+      frameRef: FrameRefSchema.optional(),
+      /**
       * CB5 shm passthrough — a `FrameHandle` naming the same ring slot
       * the decoded pixels live in. One more member of the one-of
       * frame/frameHandle/image/imageBase64/referenceImage group.
@@ -25993,7 +26043,10 @@ var NativeCropResultSchema = external_exports.object({
   * Which source served this crop, so a quality-sensitive consumer (the native
   * `keyFrame`) can reject a degraded fallback:
   * - `native` — cut from the decode worker's retained NATIVE surface (the
-  *   quality path).
+  *   quality path). A subject-tile serve is also native-resolution and stays
+  *   `native` here: the public enum cannot name `tile` without a breaking cap
+  *   change. Runner telemetry distinguishes lease vs tile via `source` on the
+  *   internal crop result (`nativeHits` vs `tileHits`).
   * - `ram-fullframe` — the native surface MISSED but the request was full-frame,
   *   so the ≤640 RAM `RetainedFrameStore` served it (honest lower-res; legit for
   *   the blank-frame guard / 640-snapshot resolve, NOT for the clean keyFrame).
@@ -26496,12 +26549,41 @@ var RunnerLocalLoadSchema = external_exports.object({
     cpuCores: external_exports.number().optional()
   })
 });
+var FrameLazyCountersSchema = external_exports.object({
+  framesDecoded: external_exports.number(),
+  framesAdmitted: external_exports.number(),
+  framesDroppedPixelFree: external_exports.number(),
+  viewsMaterialized: external_exports.number(),
+  viewsSkipped: external_exports.number(),
+  workerToRunnerBytes: external_exports.number(),
+  runnerToPoolRawBytes: external_exports.number(),
+  runnerToPoolJpegBytes: external_exports.number(),
+  onDemandFullFrameRequests: external_exports.number(),
+  onDemandCropRequests: external_exports.number(),
+  nativeHits: external_exports.number(),
+  nativeMisses: external_exports.number(),
+  tileHits: external_exports.number(),
+  tileMisses: external_exports.number(),
+  fallbackHits: external_exports.number(),
+  fallbackMisses: external_exports.number(),
+  retainedWritesAvoided: external_exports.number(),
+  residentRefs: external_exports.number(),
+  residentBytes: external_exports.number(),
+  releases: external_exports.number(),
+  evictions: external_exports.number(),
+  staleMisses: external_exports.number()
+});
+var FrameLazyMetricsSchema = external_exports.object({
+  node: FrameLazyCountersSchema,
+  cameras: external_exports.array(FrameLazyCountersSchema.extend({ deviceId: external_exports.number() }))
+});
 var RunnerLocalMetricsSchema = external_exports.object({
   nodeId: external_exports.string(),
   activeCameras: external_exports.number(),
   throttledCameras: external_exports.number(),
   avgInferenceTimeMs: external_exports.number(),
-  queueDepth: external_exports.number()
+  queueDepth: external_exports.number(),
+  frameLazy: FrameLazyMetricsSchema.optional()
 });
 var pipelineRunnerCapability = {
   name: "pipeline-runner",
@@ -28288,6 +28370,8 @@ var storageProviderCapability = {
     endDownload: method(EndDownloadInputSchema, external_exports.void(), { kind: "mutation" })
   }
 };
+var ProfileSettingsSchemaBridge = external_exports.unknown().nullable();
+var ProfileSettingsBagSchema = external_exports.record(external_exports.string(), external_exports.unknown());
 var TerminalSessionInfoSchema = external_exports.object({
   /** Opaque session id minted by the provider on `openSession`. */
   sessionId: external_exports.string(),
@@ -28303,7 +28387,14 @@ var TerminalSessionInfoSchema = external_exports.object({
 var TerminalProfileInfoSchema = external_exports.object({
   profileId: external_exports.string(),
   label: external_exports.string(),
-  description: external_exports.string().optional()
+  description: external_exports.string().optional(),
+  /** Spawn defaults the instance form copies on create. */
+  executable: external_exports.string().optional(),
+  args: external_exports.array(external_exports.string()).readonly().optional(),
+  cwd: external_exports.string().optional(),
+  environment: external_exports.array(external_exports.string()).readonly().optional(),
+  /** ConfigUISchema for instance knobs, or null when the profile has none. */
+  settingsSchema: ProfileSettingsSchemaBridge.optional()
 });
 var TerminalInstanceInfoSchema = external_exports.object({
   instanceId: external_exports.string(),
@@ -28312,7 +28403,12 @@ var TerminalInstanceInfoSchema = external_exports.object({
   profileId: external_exports.string(),
   profileLabel: external_exports.string(),
   name: external_exports.string(),
-  enabled: external_exports.boolean()
+  enabled: external_exports.boolean(),
+  executable: external_exports.string(),
+  args: external_exports.array(external_exports.string()).readonly(),
+  cwd: external_exports.string(),
+  environment: external_exports.array(external_exports.string()).readonly(),
+  profileSettings: ProfileSettingsBagSchema
 });
 var TerminalLegacyCameraSchema = external_exports.object({
   stableId: external_exports.string(),
@@ -28351,7 +28447,24 @@ var terminalSessionCapability = {
     createInstance: method(external_exports.object({
       targetNodeId: external_exports.string().min(1),
       profileId: external_exports.string().min(1),
-      name: external_exports.string().trim().min(1).max(160).optional()
+      name: external_exports.string().trim().min(1).max(160).optional(),
+      executable: external_exports.string().max(1024).optional(),
+      args: external_exports.array(external_exports.string().max(2048)).max(64).optional(),
+      cwd: external_exports.string().max(1024).optional(),
+      environment: external_exports.array(external_exports.string().max(4096)).max(64).optional(),
+      profileSettings: ProfileSettingsBagSchema.optional()
+    }), TerminalInstanceInfoSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    updateInstance: method(external_exports.object({
+      instanceId: external_exports.string().min(1),
+      name: external_exports.string().trim().min(1).max(160).optional(),
+      executable: external_exports.string().max(1024).optional(),
+      args: external_exports.array(external_exports.string().max(2048)).max(64).optional(),
+      cwd: external_exports.string().max(1024).optional(),
+      environment: external_exports.array(external_exports.string().max(4096)).max(64).optional(),
+      profileSettings: ProfileSettingsBagSchema.optional()
     }), TerminalInstanceInfoSchema, {
       kind: "mutation",
       auth: "admin"
@@ -28386,7 +28499,11 @@ var terminalSessionCapability = {
     openSession: method(external_exports.object({
       profileId: external_exports.string(),
       cols: external_exports.number().int().positive(),
-      rows: external_exports.number().int().positive()
+      rows: external_exports.number().int().positive(),
+      executable: external_exports.string().max(1024).optional(),
+      args: external_exports.array(external_exports.string().max(2048)).max(64).optional(),
+      cwd: external_exports.string().max(1024).optional(),
+      environment: external_exports.array(external_exports.string().max(4096)).max(64).optional()
     }), TerminalSessionInfoSchema, {
       kind: "mutation",
       auth: "admin"
@@ -32109,6 +32226,12 @@ var NotificationEndpointSchema = external_exports.object({
   /** What the ranking currently resolves to (null when nothing is reachable). */
   resolved: external_exports.string().nullable()
 });
+var ViewerEndpointsSchema = external_exports.object({
+  /** The operator's explicit race set, or empty for AUTO. */
+  baseUrls: external_exports.array(external_exports.string()).readonly(),
+  /** What the ranking currently resolves to (may be empty if nothing is up). */
+  resolved: external_exports.array(external_exports.string()).readonly()
+});
 var AllowedAddressesSchema = external_exports.object({
   /**
   * Allowlist of interface addresses operators have explicitly opted
@@ -32118,6 +32241,20 @@ var AllowedAddressesSchema = external_exports.object({
   */
   addresses: external_exports.array(external_exports.string()).readonly()
 });
+var TlsStatusSchema = external_exports.object({
+  mode: external_exports.enum([
+    "generated",
+    "uploaded",
+    "disabled"
+  ]),
+  leafFingerprintSha256: external_exports.string().nullable(),
+  caFingerprintSha256: external_exports.string().nullable(),
+  validTo: external_exports.string().nullable(),
+  sans: external_exports.array(external_exports.string()),
+  caCertPem: external_exports.string().nullable(),
+  reissueError: external_exports.string().nullable(),
+  restartRequired: external_exports.boolean()
+});
 var localNetworkCapability = {
   name: "local-network",
   scope: "system",
@@ -32137,13 +32274,13 @@ var localNetworkCapability = {
     */
     getPreferred: method(external_exports.void(), PreferredSchema),
     /**
-    * Ordered candidate base URLs the SDK should try on connect.
-    * Includes LAN IPs (one per non-internal interface), the public
-    * tunnel hostname (when active), and loopback as a last-resort
-    * fallback. Filterable by `includeLoopback` / `ipv4Only`.
-    * Honours `getAllowedAddresses()` when set — addresses outside
-    * the allowlist are dropped (the public tunnel + loopback are
-    * always included as escape hatches).
+    * Ordered candidate base URLs (the palette the Network tab shows).
+    * Includes LAN IPv4, stable LAN IPv6, the public tunnel, and mesh when
+    * joined. Loopback is off by default. The SDK races the subset from
+    * `getViewerEndpoints`, not this full list — IPv6 stays here because
+    * WebRTC ICE gathers dual-stack regardless of the HTTP race. Honours
+    * `getAllowedAddresses()` when set — addresses outside the allowlist
+    * are dropped (the public tunnel is still included as an escape hatch).
     *
     * **The port is the hub's, not the caller's** (D62 — a function's fact
     * belongs to whoever already owns it). This method used to take a `port`
@@ -32174,10 +32311,11 @@ var localNetworkCapability = {
       */
       port: external_exports.number().int().min(1).max(65535).optional(),
       /** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
-      *  candidate. Default `true`. */
+      *  candidate. Default `false` — loopback is not a client route. */
       includeLoopback: external_exports.boolean().optional(),
-      /** Skip IPv6 entries. Some legacy clients can't parse them.
-      *  Default `false`. */
+      /** Skip IPv6 entries. Default `false` — the palette includes stable
+      *  LAN IPv6 (ICE/WebRTC uses dual-stack regardless). Pass `true` to
+      *  hide them. The viewer HTTP/WS race is `getViewerEndpoints`. */
       ipv4Only: external_exports.boolean().optional(),
       /** Scheme to emit for LAN/loopback URLs. Default `'http'`.
       *  Pass `'https'` when the caller is itself loaded over HTTPS
@@ -32206,6 +32344,19 @@ var localNetworkCapability = {
     */
     setNotificationEndpoint: method(external_exports.object({ baseUrl: external_exports.string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }),
     /**
+    * The endpoints the SDK / viewer races for API access. Empty `baseUrls`
+    * means AUTO: every LAN IPv4 address plus the public tunnel, never IPv6,
+    * never mesh, never loopback. `resolved` is that set (or the operator's
+    * explicit subset) as it stands right now.
+    */
+    getViewerEndpoints: method(external_exports.void(), ViewerEndpointsSchema),
+    /**
+    * Replace the viewer race set. Empty `baseUrls` restores AUTO. Stored
+    * verbatim (not indices) so a temporarily-down tunnel is not silently
+    * dropped from the operator's choice.
+    */
+    setViewerEndpoints: method(external_exports.object({ baseUrls: external_exports.array(external_exports.string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }),
+    /**
     * Read the operator's allowlist. Empty = "auto" (no filter). Used
     * by the admin UI's address selector to seed its checkbox state.
     */
@@ -32223,7 +32374,34 @@ var localNetworkCapability = {
     * when the operator wants to wipe their manual edits and start
     * over from the auto-detected best matches.
     */
-    resetAllowlistToBestMatch: method(external_exports.void(), AllowedAddressesSchema, { kind: "mutation" })
+    resetAllowlistToBestMatch: method(external_exports.void(), AllowedAddressesSchema, { kind: "mutation" }),
+    /**
+    * Live TLS material for the Network → Local access certificate card.
+    * LAN HTTP / hostname are addon settings (`globalSettingsSchema`), not
+    * a second store — this query is status, not configuration.
+    */
+    getTlsStatus: method(external_exports.void(), TlsStatusSchema),
+    /** Issue a new leaf under the existing local CA. Disabled in uploaded mode. */
+    regenerateCertificate: method(external_exports.object({ reason: external_exports.string().optional() }), TlsStatusSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** Replace the served material with operator-supplied PEMs. */
+    uploadCertificate: method(external_exports.object({
+      certPem: external_exports.string().min(1),
+      keyPem: external_exports.string().min(1),
+      caPem: external_exports.string().optional()
+    }), TlsStatusSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** The local CA PEM, or empty when there is none to download. */
+    downloadCa: method(external_exports.void(), external_exports.object({ pem: external_exports.string() })),
+    /** Drop uploaded material and return to the generated local CA. */
+    revertToGeneratedCertificate: method(external_exports.void(), TlsStatusSchema, {
+      kind: "mutation",
+      auth: "admin"
+    })
   },
   /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
   mount: { kind: "hub-only" }
@@ -38897,6 +39075,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "localNetwork.downloadCa": {
+    capName: "local-network",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "localNetwork.getAllowedAddresses": {
     capName: "local-network",
     capScope: "system",
@@ -38921,18 +39105,42 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "localNetwork.getTlsStatus": {
+    capName: "local-network",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "localNetwork.getViewerEndpoints": {
+    capName: "local-network",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "localNetwork.list": {
     capName: "local-network",
     capScope: "system",
     addonId: null,
     access: "view"
   },
+  "localNetwork.regenerateCertificate": {
+    capName: "local-network",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "localNetwork.resetAllowlistToBestMatch": {
     capName: "local-network",
     capScope: "system",
     addonId: null,
     access: "delete"
   },
+  "localNetwork.revertToGeneratedCertificate": {
+    capName: "local-network",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "localNetwork.setAllowedAddresses": {
     capName: "local-network",
     capScope: "system",
@@ -38945,6 +39153,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "localNetwork.setViewerEndpoints": {
+    capName: "local-network",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "localNetwork.uploadCertificate": {
+    capName: "local-network",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "lockControl.lock": {
     capName: "lock-control",
     capScope: "device",
@@ -41825,6 +42045,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "terminalSession.updateInstance": {
+    capName: "terminal-session",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "terminalSession.writeInput": {
     capName: "terminal-session",
     capScope: "system",
@@ -44196,6 +44422,35 @@ var CLUSTER_MODEL_SCOPED_STEPS = [{
 }];
 var DEFAULT_CLUSTER_STEP_MODELS = Object.freeze(Object.fromEntries(CLUSTER_MODEL_SCOPED_STEPS.map((s) => [s.stepId, s.defaultModelId])));
 var ChosenModelIdSchema = external_exports.string().min(1);
+var CLUSTER_STEP_SETTING_FIELDS = [{
+  stepId: "face-embedding",
+  key: "minLandmarkFaceSize",
+  label: "Min face size for recognition (detection px)",
+  description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node \u2014 the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+  type: "slider",
+  min: 0,
+  max: 64,
+  step: 2,
+  default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+  return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = external_exports.number().finite();
+function readClusterStepSettings(config2) {
+  const out = {};
+  for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+    const parsed = ClusterSettingNumberSchema.safeParse(config2[clusterStepSettingKey(field.stepId, field.key)]);
+    const value = parsed.success ? parsed.data : field.default;
+    const existing = out[field.stepId] ?? {};
+    out[field.stepId] = {
+      ...existing,
+      [field.key]: value
+    };
+  }
+  return out;
+}
+var DEFAULT_CLUSTER_STEP_SETTINGS = readClusterStepSettings({});
 var DetailCropConventionSchema = external_exports.object({
   /**
   * Fraction of the box's own size added on EACH side before cutting.

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runDiscover
-} from "./chunk-UYHYTS5M.js";
+} from "./chunk-VGIPYXDI.js";
 import "./chunk-LMMQX4CK.js";
 
 // src/cli.ts
@@ -38,7 +38,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-SCKDFMNR.js");
+  await import("./launcher-ZGFW4X34.js");
 }
 
 // src/commands/agent.ts
@@ -83,7 +83,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-SCKDFMNR.js");
+  await import("./launcher-ZGFW4X34.js");
 }
 
 // src/commands/setup.ts
@@ -1130,7 +1130,7 @@ function isUnknown(_value) {
   return true;
 }
 async function resolveServerInteractive(presetNamespace) {
-  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-5NNX7OG3.js");
+  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-PWDC46ET.js");
   if (presetNamespace) {
     const spinner4 = clack.spinner();
     spinner4.start(`Discovering hub on LAN (namespace "${presetNamespace}")`);

package/dist/{discover-5NNX7OG3.js → discover-PWDC46ET.js}

@@ -5,7 +5,7 @@ import {
   filterHubNodes,
   resolveHubFromDiscovered,
   runDiscover
-} from "./chunk-UYHYTS5M.js";
+} from "./chunk-VGIPYXDI.js";
 import "./chunk-LMMQX4CK.js";
 export {
   DEFAULT_HUB_HTTPS_PORT,