@camstack/addon-ai 0.4.16 → 0.4.18

package/dist/addon.mjs

@@ -5990,6 +5990,13 @@ var BaseAddon = class {
 	_readinessGeneration = typeof crypto !== "undefined" && crypto.randomUUID ? crypto.randomUUID() : Math.random().toString(36).slice(2, 14);
 	/** Capability names this addon registered at init — used to emit matching `down` events on shutdown. */
 	_registeredCapNames = [];
+	/**
+	* True only after `readAddonStore` actually answered. Constructor
+	* defaults look like stored config when the store is down — a forked
+	* addon that auto-starts from those defaults (cloudflare-tunnel quick
+	* mode, 2026-08-25) is not "the operator chose this".
+	*/
+	settingsStoreReady = false;
 	/** Default config values. Provided via constructor. */
 	defaults;
 	constructor(defaults) {
@@ -6390,7 +6397,9 @@ var BaseAddon = class {
 		];
 		let lastErr;
 		for (let attempt = 0; attempt <= delaysMs.length; attempt++) try {
-			return await settings.readAddonStore() ?? {};
+			const stored = await settings.readAddonStore() ?? {};
+			this.settingsStoreReady = true;
+			return stored;
 		} catch (err) {
 			lastErr = err;
 			const msg = err instanceof Error ? err.message : String(err);
@@ -6398,6 +6407,7 @@ var BaseAddon = class {
 			if (attempt === delaysMs.length) break;
 			await new Promise((r) => setTimeout(r, delaysMs[attempt]));
 		}
+		this.settingsStoreReady = false;
 		this._ctx?.logger?.warn?.("readAddonStore: settings-store unavailable after retries — using defaults", { meta: { error: lastErr instanceof Error ? lastErr.message : String(lastErr) } });
 		return {};
 	}
@@ -8252,6 +8262,15 @@ var LabelDefinitionSchema = object({
 	description: string().optional(),
 	icon: string().optional()
 });
+var ClassMapDefinitionSchema = object({
+	mapping: record(string(), _enum([
+		"person",
+		"vehicle",
+		"animal",
+		"package"
+	])),
+	preserveOriginal: boolean()
+});
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -8335,6 +8354,12 @@ var ModelVariantGroupSchema = object({
 	*/
 	resolution: number$1().int().positive().optional()
 });
+var ModelProviderIdSchema = _enum([
+	"camstack",
+	"frigate",
+	"scrypted",
+	"custom"
+]);
 var ModelCatalogEntrySchema = object({
 	id: string(),
 	name: string(),
@@ -8430,7 +8455,19 @@ var ModelCatalogEntrySchema = object({
 	* `id` stays the source of truth for resolution/download/persistence; grouping
 	* is a presentation overlay resolved back to an `id`.
 	*/
-	group: ModelVariantGroupSchema.optional()
+	group: ModelVariantGroupSchema.optional(),
+	/**
+	* Catalog source for the pipeline stepper's provider-first picker. Absent on
+	* built-in CamStack entries (treated as `camstack`) and on registry rows
+	* persisted before this field existed (`inferModelProvider` fills those).
+	*/
+	provider: ModelProviderIdSchema.optional(),
+	/**
+	* Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
+	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
+	* labels already ARE the CamStack macros (Scrypted identity map).
+	*/
+	classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -8459,7 +8496,8 @@ var ModelConvertMetadataSchema = object({
 		"ocr",
 		"segmentation"
 	]),
-	faceAlignment: boolean().optional()
+	faceAlignment: boolean().optional(),
+	classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertResultSchema = object({
 	entry: ModelCatalogEntrySchema,
@@ -14679,12 +14717,15 @@ var NcOccupancyConditionSchema = object({
 * there is no second switch that can disagree with the first and every rule
 * authored before the decision migrates for free (`audioModeOf`):
 *
-*  - **LABEL mode — `labels` present.** The rule fires on the FIRST frame the
-*    classifier labels with one of them. No window, no percentage:
-*    `hitPercent` and `samplingSeconds` are ignored, and the rule's own
-*    `throttle` cooldown is the only brake. The per-label confidence floor is
-*    the analyzer's (`classificationMinScore`, per device) — a label only
-*    reaches this condition if the classifier was already confident enough.
+*  - **LABEL mode — `labels` present.** The rule fires when `confirmHits`
+*    labelled frames land inside `confirmWindowSec` (default 2 in 5 s).
+*    `hitPercent` and `samplingSeconds` are still ignored — a percentage of
+*    frames is the wrong question for a classifier that labels 1–3 frames
+*    per episode. The count window is the brake that drops a single-frame
+*    false positive; the rule's own `throttle` cooldown is the other. The
+*    per-label confidence floor is the analyzer's (`classificationMinScore`,
+*    per device) — a label only reaches this condition if the classifier was
+*    already confident enough. `confirmHits: 1` restores first-frame fire.
 *  - **LEVEL mode — `dbThreshold` present, no labels.** The sampling window IS
 *    the condition: at least `hitPercent`% of the samples over
 *    `samplingSeconds` must be at or above `dbThreshold` dBFS (see
@@ -14711,14 +14752,22 @@ var NcOccupancyConditionSchema = object({
 * an operator who typed `dog` mean the same thing.
 */
 var NcAudioConditionSchema = object({
-	/** LABEL MODE: audio macro labels. Present ⇒ fires on the first labelled frame. */
+	/** LABEL MODE: audio macro labels. Present ⇒ count-in-window confirm. */
 	labels: array(string().min(1)).min(1).optional(),
 	/** LEVEL MODE: floor in dBFS (negative-going, `0` = full scale). */
 	dbThreshold: number$1().min(-96).max(0).optional(),
 	/** LEVEL MODE ONLY: percentage of the window's samples that must be hits (1–100). */
 	hitPercent: number$1().int().min(1).max(100).default(60),
 	/** LEVEL MODE ONLY: length of the sampling window in seconds. */
-	samplingSeconds: number$1().int().min(1).max(300).default(10)
+	samplingSeconds: number$1().int().min(1).max(300).default(10),
+	/**
+	* LABEL MODE: how many labelled frames must land inside
+	* {@link NcAudioConditionSchema.shape.confirmWindowSec} before dispatch.
+	* Absent ⇒ 2 (the matcher default). `1` is first-frame fire.
+	*/
+	confirmHits: number$1().int().min(1).max(20).optional(),
+	/** LABEL MODE: the window those frames must share, in seconds. Absent ⇒ 5. */
+	confirmWindowSec: number$1().int().min(1).max(60).optional()
 });
 /**
 * Which zone-crossing DIRECTION a rule accepts (`ObjectEvent.zoneCrossing`).
@@ -17092,6 +17141,46 @@ var RecentTracksPageSchema = object({
 	/** Cursor for the next page, or null when this page is the last. */
 	nextCursor: string().nullable()
 });
+var LIST_GROUPS_DEFAULT_LIMIT = 40;
+var LIST_GROUPS_MAX_LIMIT = 100;
+var AnalyticsGroupRecordSchema = object({
+	id: string(),
+	deviceId: number$1().int(),
+	openedAt: number$1().int(),
+	closedAt: number$1().int(),
+	timestamp: number$1().int(),
+	memberCount: number$1().int(),
+	memberTrackIds: array(string()).readonly(),
+	className: string(),
+	classes: array(string()).readonly(),
+	/** Relative event-media path, or null when the group has no picture yet. */
+	mediaUrl: string().nullable(),
+	singleton: boolean()
+});
+var AnalyticsGroupMemberSchema = object({
+	trackId: string(),
+	deviceId: number$1().int(),
+	className: string(),
+	firstSeen: number$1().int(),
+	lastSeen: number$1().int(),
+	mediaUrl: string().nullable()
+});
+var AnalyticsGroupDetailSchema = AnalyticsGroupRecordSchema.extend({ members: array(AnalyticsGroupMemberSchema).readonly() });
+var ListGroupsQueryInput = object({
+	/** Devices to merge. An empty array yields `{ groups: [], nextCursor: null }`. */
+	deviceIds: array(number$1()),
+	/** Window lower bound on `closedAt` (inclusive). */
+	since: number$1().optional(),
+	/** Window upper bound on `openedAt` (inclusive). */
+	until: number$1().optional(),
+	limit: number$1().int().min(1).max(LIST_GROUPS_MAX_LIMIT).default(LIST_GROUPS_DEFAULT_LIMIT),
+	/** Opaque continuation cursor from a previous page's `nextCursor`. */
+	cursor: string().optional()
+});
+var ListGroupsPageSchema = object({
+	groups: array(AnalyticsGroupRecordSchema).readonly(),
+	nextCursor: string().nullable()
+});
 var KeyEventQueryInput = object({
 	deviceId: number$1(),
 	/** Window lower bound (track firstSeen ≥ since). */
@@ -17167,7 +17256,9 @@ var TrackCascadeCountsSchema = object({
 	/** Unassigned plate reads removed (best-effort; plate leg deferred to plate-intelligence). */
 	plates: number$1().int(),
 	/** Per-track CLIP search vectors removed (best-effort). */
-	embeddings: number$1().int()
+	embeddings: number$1().int(),
+	/** Group membership + group rows removed with their last member (best-effort). */
+	groups: number$1().int()
 });
 /** Disk-wins reconcile: media rows whose blobs are gone, then empty tracks. */
 var DiskReconcileCountsSchema = object({
@@ -17313,7 +17404,10 @@ DeviceType.Camera, method(object({ deviceId: number$1() }), array(TrackSchema).r
 	*  stationary registry). Default false: the timeline lists passages,
 	*  not parking records (operator decision, 2026-08-15). */
 	includeStationary: boolean().optional()
-}), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(object({ deviceId: number$1() }), _void(), {
+}), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(ListGroupsQueryInput, ListGroupsPageSchema), method(object({
+	deviceId: number$1(),
+	groupId: string().min(1)
+}), AnalyticsGroupDetailSchema.nullable()), method(object({ deviceId: number$1() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number$1() }), array(EventKindDescriptorSchema).readonly()), method(object({ deviceIds: array(number$1()).min(1).max(200) }), array(EventKindsForDeviceSchema).readonly()), method(object({
@@ -17531,6 +17625,33 @@ var NativeCropRefSchema = object({
 		h: number$1()
 	})
 });
+object({
+	crop: object({
+		left: number$1(),
+		top: number$1(),
+		width: number$1().positive(),
+		height: number$1().positive()
+	}).optional(),
+	content: object({
+		width: number$1().int().positive(),
+		height: number$1().int().positive()
+	}),
+	fit: _enum(["stretch", "contain"]),
+	format: _enum([
+		"rgb",
+		"gray",
+		"jpeg"
+	])
+});
+var FrameRefSchema = object({
+	registryId: string().min(1),
+	id: string().min(1),
+	width: number$1().int().positive(),
+	height: number$1().int().positive(),
+	format: _enum(["rgb", "gray"]),
+	timestamp: number$1(),
+	capturedAt: number$1().optional()
+});
 var ModelFormatSchema$1 = _enum([
 	"onnx",
 	"coreml",
@@ -17596,7 +17717,8 @@ var PipelineModelOptionSchema = object({
 		sizeMB: number$1()
 	})),
 	group: ModelVariantGroupSchema.optional(),
-	legacy: boolean().optional()
+	legacy: boolean().optional(),
+	provider: ModelProviderIdSchema.optional()
 });
 var ConfigFieldBridge = custom();
 var PipelineAddonSchemaSchema = object({
@@ -17775,6 +17897,12 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	steps: array(PipelineStepInputSchema).min(1),
 	frame: FrameInputSchema.optional(),
 	/**
+	* Process-local lazy frame. Valid only when caller and provider resolve
+	* in the same execution-group process; split/cross-node callers use
+	* `frame`/`image` inline compatibility instead.
+	*/
+	frameRef: FrameRefSchema.optional(),
+	/**
 	* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
 	* the decoded pixels live in. One more member of the one-of
 	* frame/frameHandle/image/imageBase64/referenceImage group.
@@ -18030,7 +18158,10 @@ var NativeCropResultSchema = object({
 	* Which source served this crop, so a quality-sensitive consumer (the native
 	* `keyFrame`) can reject a degraded fallback:
 	* - `native` — cut from the decode worker's retained NATIVE surface (the
-	*   quality path).
+	*   quality path). A subject-tile serve is also native-resolution and stays
+	*   `native` here: the public enum cannot name `tile` without a breaking cap
+	*   change. Runner telemetry distinguishes lease vs tile via `source` on the
+	*   internal crop result (`nativeHits` vs `tileHits`).
 	* - `ram-fullframe` — the native surface MISSED but the request was full-frame,
 	*   so the ≤640 RAM `RetainedFrameStore` served it (honest lower-res; legit for
 	*   the blank-frame guard / 640-snapshot resolve, NOT for the clean keyFrame).
@@ -18521,12 +18652,41 @@ var RunnerLocalLoadSchema = object({
 * legacy `OrchestratorMetricsSchema` shape so existing dashboards keep
 * working unchanged when they switch to reading from the runner cap.
 */
+var FrameLazyCountersSchema = object({
+	framesDecoded: number$1(),
+	framesAdmitted: number$1(),
+	framesDroppedPixelFree: number$1(),
+	viewsMaterialized: number$1(),
+	viewsSkipped: number$1(),
+	workerToRunnerBytes: number$1(),
+	runnerToPoolRawBytes: number$1(),
+	runnerToPoolJpegBytes: number$1(),
+	onDemandFullFrameRequests: number$1(),
+	onDemandCropRequests: number$1(),
+	nativeHits: number$1(),
+	nativeMisses: number$1(),
+	tileHits: number$1(),
+	tileMisses: number$1(),
+	fallbackHits: number$1(),
+	fallbackMisses: number$1(),
+	retainedWritesAvoided: number$1(),
+	residentRefs: number$1(),
+	residentBytes: number$1(),
+	releases: number$1(),
+	evictions: number$1(),
+	staleMisses: number$1()
+});
+var FrameLazyMetricsSchema = object({
+	node: FrameLazyCountersSchema,
+	cameras: array(FrameLazyCountersSchema.extend({ deviceId: number$1() }))
+});
 var RunnerLocalMetricsSchema = object({
 	nodeId: string(),
 	activeCameras: number$1(),
 	throttledCameras: number$1(),
 	avgInferenceTimeMs: number$1(),
-	queueDepth: number$1()
+	queueDepth: number$1(),
+	frameLazy: FrameLazyMetricsSchema.optional()
 });
 method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mutation" }), method(object({ deviceId: number$1() }), object({ success: literal(true) }), { kind: "mutation" }), method(ReportMotionInputSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), RunnerLocalLoadSchema), method(_void(), RunnerLocalMetricsSchema), method(object({ deviceId: number$1() }), CameraMetricsSchema.nullable()), method(_void(), array(CameraMetricsWithDeviceIdSchema).readonly()), method(_void(), array(number$1()).readonly()), method(object({
 	handle: FrameHandleSchema,
@@ -19826,6 +19986,9 @@ method(_void(), ProviderInfoSchema), method(object({ config: record(string(), un
 	location: StorageLocationSchema,
 	relativePath: string()
 }), _void(), { kind: "mutation" }), method(object({ location: StorageLocationSchema }), number$1().nullable()), method(BeginUploadInputSchema, BeginUploadResultSchema, { kind: "mutation" }), method(WriteChunkInputSchema, _void(), { kind: "mutation" }), method(FinalizeUploadInputSchema, _void(), { kind: "mutation" }), method(AbortUploadInputSchema, _void(), { kind: "mutation" }), method(BeginDownloadInputSchema, BeginDownloadResultSchema, { kind: "mutation" }), method(ReadChunkInputSchema, _instanceof(Uint8Array)), method(EndDownloadInputSchema, _void(), { kind: "mutation" });
+/** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
+var ProfileSettingsSchemaBridge = unknown().nullable();
+var ProfileSettingsBagSchema = record(string(), unknown());
 /**
 * A live terminal session hosted by the provider addon. Output and input do
 * NOT flow through the capability — they use the addon data plane
@@ -19855,7 +20018,14 @@ var TerminalSessionInfoSchema = object({
 var TerminalProfileInfoSchema = object({
 	profileId: string(),
 	label: string(),
-	description: string().optional()
+	description: string().optional(),
+	/** Spawn defaults the instance form copies on create. */
+	executable: string().optional(),
+	args: array(string()).readonly().optional(),
+	cwd: string().optional(),
+	environment: array(string()).readonly().optional(),
+	/** ConfigUISchema for instance knobs, or null when the profile has none. */
+	settingsSchema: ProfileSettingsSchemaBridge.optional()
 });
 /**
 * A durable operator-created Terminal instance. Profiles are templates; only
@@ -19868,7 +20038,12 @@ var TerminalInstanceInfoSchema = object({
 	profileId: string(),
 	profileLabel: string(),
 	name: string(),
-	enabled: boolean()
+	enabled: boolean(),
+	executable: string(),
+	args: array(string()).readonly(),
+	cwd: string(),
+	environment: array(string()).readonly(),
+	profileSettings: ProfileSettingsBagSchema
 });
 var TerminalLegacyCameraSchema = object({
 	stableId: string(),
@@ -19898,7 +20073,23 @@ var TerminalOutputBatchSchema = object({
 method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }), method(_void(), array(TerminalInstanceInfoSchema).readonly(), { auth: "admin" }), method(object({
 	targetNodeId: string().min(1),
 	profileId: string().min(1),
-	name: string().trim().min(1).max(160).optional()
+	name: string().trim().min(1).max(160).optional(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional(),
+	profileSettings: ProfileSettingsBagSchema.optional()
+}), TerminalInstanceInfoSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	instanceId: string().min(1),
+	name: string().trim().min(1).max(160).optional(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional(),
+	profileSettings: ProfileSettingsBagSchema.optional()
 }), TerminalInstanceInfoSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -19920,7 +20111,11 @@ method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }),
 }), method(_void(), array(TerminalSessionInfoSchema).readonly(), { auth: "admin" }), method(object({
 	profileId: string(),
 	cols: number$1().int().positive(),
-	rows: number$1().int().positive()
+	rows: number$1().int().positive(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional()
 }), TerminalSessionInfoSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -22702,10 +22897,10 @@ DeviceType.LawnMower, method(object({ deviceId: number$1().int().nonnegative() }
 *
 *  • The SDK (mobile / web client) consumes `getConnectionEndpoints()`
 *    to receive an ordered list of candidate base URLs it should race
-*    on connect — LAN IPv4 first (lowest latency when on same network),
-*    then public hostname (if a tunnel is up), then IPv6. The SDK can
-*    race them with short timeouts and stick with the winner for the
-*    session.
+*    on connect — LAN IPv4 and stable LAN IPv6 first (lowest latency
+*    when on the same network), then public hostname (if a tunnel is
+*    up). The SDK can race them with short timeouts and stick with the
+*    winner for the session.
 *
 * Why hub-only: agents are not directly addressable by the operator's
 * clients — they reverse-connect to the hub. Exposing their interfaces
@@ -22860,6 +23055,17 @@ var NotificationEndpointSchema = object({
 	/** What the ranking currently resolves to (null when nothing is reachable). */
 	resolved: string().nullable()
 });
+/**
+* The URLs the SDK / viewer should race for API access. `baseUrls` empty =
+* AUTO (every LAN IPv4 + the public tunnel). `resolved` is what that choice
+* currently expands to, so the UI can show the effective set either way.
+*/
+var ViewerEndpointsSchema = object({
+	/** The operator's explicit race set, or empty for AUTO. */
+	baseUrls: array(string()).readonly(),
+	/** What the ranking currently resolves to (may be empty if nothing is up). */
+	resolved: array(string()).readonly()
+});
 var AllowedAddressesSchema = object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -22868,6 +23074,20 @@ var AllowedAddressesSchema = object({
 * Network Addresses admin page and persisted by the addon.
 */
 addresses: array(string()).readonly() });
+var TlsStatusSchema = object({
+	mode: _enum([
+		"generated",
+		"uploaded",
+		"disabled"
+	]),
+	leafFingerprintSha256: string().nullable(),
+	caFingerprintSha256: string().nullable(),
+	validTo: string().nullable(),
+	sans: array(string()),
+	caCertPem: string().nullable(),
+	reissueError: string().nullable(),
+	restartRequired: boolean()
+});
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
 	/**
 	* LEGACY HINT — do not send from new code. Kept optional so clients
@@ -22877,17 +23097,31 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*/
 	port: number$1().int().min(1).max(65535).optional(),
 	/** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
-	*  candidate. Default `true`. */
+	*  candidate. Default `false` — loopback is not a client route. */
 	includeLoopback: boolean().optional(),
-	/** Skip IPv6 entries. Some legacy clients can't parse them.
-	*  Default `false`. */
+	/** Skip IPv6 entries. Default `false` — the palette includes stable
+	*  LAN IPv6 (ICE/WebRTC uses dual-stack regardless). Pass `true` to
+	*  hide them. The viewer HTTP/WS race is `getViewerEndpoints`. */
 	ipv4Only: boolean().optional(),
 	/** Scheme to emit for LAN/loopback URLs. Default `'http'`.
 	*  Pass `'https'` when the caller is itself loaded over HTTPS
 	*  to avoid mixed-content blocks in the browser. The public
 	*  tunnel always emits `https://` regardless. */
 	scheme: _enum(["http", "https"]).optional()
-}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" });
+}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), ViewerEndpointsSchema), method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	certPem: string().min(1),
+	keyPem: string().min(1),
+	caPem: string().optional()
+}), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), object({ pem: string() })), method(_void(), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 object({
 	/** Lifecycle state of the lock. `jammed` means the motor reported
 	*  failure to reach the target — operator intervention required. */
@@ -24068,7 +24302,12 @@ var PlateInfoSchema = object({
 	plateBbox: BoundingBoxSchema.optional(),
 	/** keyFrame parity: MediaStore key of the track's native-resolution key frame. */
 	keyFrameMediaKey: string().optional(),
-	base64: string().optional()
+	base64: string().optional(),
+	/**
+	* Same crop as a data-plane URL. `getPlateByTrack` returns this and
+	* never inlines JPEG; `listPlates` still inlines for the admin-ui.
+	*/
+	cropUrl: string().optional()
 });
 var MediaFileLiteSchema = object({
 	key: string(),
@@ -28650,6 +28889,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.downloadCa": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -28674,18 +28919,42 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getTlsStatus": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"localNetwork.getViewerEndpoints": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.list": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.regenerateCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.resetAllowlistToBestMatch": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"localNetwork.revertToGeneratedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.setAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -28698,6 +28967,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.setViewerEndpoints": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"localNetwork.uploadCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -29496,6 +29777,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getGroup": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getKeyEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29580,6 +29867,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listGroups": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listOpsLog": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -31578,6 +31871,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.updateInstance": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.writeInput": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -32993,6 +33292,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.getGroup": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.getKeyEvents": [{
 		name: "deviceId",
 		form: "single",
@@ -33048,6 +33352,11 @@ Object.freeze({
 		form: "array",
 		optional: false
 	}],
+	"pipelineAnalytics.listGroups": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"pipelineAnalytics.listOpsLog": [{
 		name: "deviceId",
 		form: "single",
@@ -34065,6 +34374,35 @@ Object.freeze(Object.fromEntries([{
 	}]
 }].map((s) => [s.stepId, s.defaultModelId])));
 string().min(1);
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = number$1().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -71741,7 +72079,7 @@ function entryForRef(ref) {
 	};
 }
 //#endregion
-//#region ../system/dist/file-data-plane-CuE_hBli.mjs
+//#region ../system/dist/file-data-plane-BhKdxJgf.mjs
 function isNonEmptyFile(filePath) {
 	return fs.existsSync(filePath) && fs.statSync(filePath).size > 0;
 }
@@ -71763,21 +72101,56 @@ function buildHeaders(url) {
 	if (hfToken && url.includes("huggingface.co")) headers["Authorization"] = `Bearer ${hfToken}`;
 	return headers;
 }
-/**
-* Download a single file from a URL to a destination path.
-* Uses native fetch() (Node 22+) which handles redirects natively.
-* Streams to disk with optional progress callback.
-* Returns the destination path. Skips download if file already exists.
-*/
-async function downloadFile(url, destPath, onProgress) {
+var DEFAULT_MAX_REDIRECTS = 5;
+function normalizeDownloadOptions(third) {
+	if (typeof third === "function") return { onProgress: third };
+	return third ?? {};
+}
+function isRedirectStatus(status) {
+	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function resolveRedirectUrl(current, location) {
+	return new URL(location, current);
+}
+async function downloadFile(url, destPath, onProgressOrOptions) {
 	if (fs.existsSync(destPath)) return destPath;
+	const opts = normalizeDownloadOptions(onProgressOrOptions);
+	const fetchImpl = opts.fetchImpl ?? fetch;
+	const maxRedirects = opts.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
 	fs.mkdirSync(path$1.dirname(destPath), { recursive: true });
 	const tmpPath = destPath + ".downloading";
 	try {
-		const response = await fetch(url, {
-			redirect: "follow",
-			headers: buildHeaders(url)
-		});
+		let current = url;
+		const seen = /* @__PURE__ */ new Set();
+		let response;
+		const manual = opts.redirectPolicy !== void 0;
+		for (let hop = 0; hop <= maxRedirects; hop++) {
+			const parsed = new URL(current);
+			if (opts.redirectPolicy) opts.redirectPolicy(parsed, hop);
+			if (seen.has(parsed.href)) throw new Error(`Redirect loop detected at ${parsed.href}`);
+			seen.add(parsed.href);
+			const controller = opts.timeoutMs !== void 0 ? new AbortController() : void 0;
+			const timer = controller && opts.timeoutMs !== void 0 ? setTimeout(() => controller.abort(), opts.timeoutMs) : void 0;
+			try {
+				response = await fetchImpl(current, {
+					redirect: manual ? "manual" : "follow",
+					headers: buildHeaders(current),
+					...controller ? { signal: controller.signal } : {}
+				});
+			} finally {
+				if (timer) clearTimeout(timer);
+			}
+			if (manual && isRedirectStatus(response.status)) {
+				const location = response.headers.get("location");
+				if (!location) throw new Error(`Redirect ${response.status} missing Location header`);
+				if (hop >= maxRedirects) throw new Error(`Too many redirects (max ${maxRedirects}) downloading ${url}`);
+				current = resolveRedirectUrl(current, location).href;
+				continue;
+			}
+			break;
+		}
+		if (!response) throw new Error(`No response downloading ${url}`);
+		if (manual && isRedirectStatus(response.status)) throw new Error(`Too many redirects (max ${maxRedirects}) downloading ${url}`);
 		if (!response.ok) throw new Error(`HTTP ${response.status} downloading ${url}`);
 		if (!response.body) throw new Error(`No response body from ${url}`);
 		const total = parseInt(response.headers.get("content-length") ?? "0", 10);
@@ -71788,9 +72161,10 @@ async function downloadFile(url, destPath, onProgress) {
 			for (;;) {
 				const { done, value } = await reader.read();
 				if (done || !value) break;
-				fileStream.write(value);
 				downloaded += value.length;
-				onProgress?.(downloaded, total);
+				if (opts.maxBytes !== void 0 && downloaded > opts.maxBytes) throw new Error(`Downloaded ${downloaded} bytes exceeds the ${opts.maxBytes}-byte limit`);
+				fileStream.write(value);
+				opts.onProgress?.(downloaded, total);
 			}
 		} finally {
 			fileStream.end();