@camstack/addon-model-studio 1.1.34 → 1.1.37

package/dist/model-studio.addon.mjs

@@ -11,7 +11,7 @@ import { brotliCompress, gzip } from "node:zlib";
 //#region \0rolldown/runtime.js
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 //#endregion
-//#region ../system/dist/file-data-plane-CuE_hBli.mjs
+//#region ../system/dist/file-data-plane-BhKdxJgf.mjs
 /** Build fetch headers, including HF auth token for huggingface.co URLs */
 function buildHeaders(url) {
 	const headers = { "User-Agent": "CamStack/1.0" };
@@ -19,21 +19,56 @@ function buildHeaders(url) {
 	if (hfToken && url.includes("huggingface.co")) headers["Authorization"] = `Bearer ${hfToken}`;
 	return headers;
 }
-/**
-* Download a single file from a URL to a destination path.
-* Uses native fetch() (Node 22+) which handles redirects natively.
-* Streams to disk with optional progress callback.
-* Returns the destination path. Skips download if file already exists.
-*/
-async function downloadFile(url, destPath, onProgress) {
+var DEFAULT_MAX_REDIRECTS = 5;
+function normalizeDownloadOptions(third) {
+	if (typeof third === "function") return { onProgress: third };
+	return third ?? {};
+}
+function isRedirectStatus(status) {
+	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function resolveRedirectUrl(current, location) {
+	return new URL(location, current);
+}
+async function downloadFile(url, destPath, onProgressOrOptions) {
 	if (fs$1.existsSync(destPath)) return destPath;
+	const opts = normalizeDownloadOptions(onProgressOrOptions);
+	const fetchImpl = opts.fetchImpl ?? fetch;
+	const maxRedirects = opts.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
 	fs$1.mkdirSync(path$1.dirname(destPath), { recursive: true });
 	const tmpPath = destPath + ".downloading";
 	try {
-		const response = await fetch(url, {
-			redirect: "follow",
-			headers: buildHeaders(url)
-		});
+		let current = url;
+		const seen = /* @__PURE__ */ new Set();
+		let response;
+		const manual = opts.redirectPolicy !== void 0;
+		for (let hop = 0; hop <= maxRedirects; hop++) {
+			const parsed = new URL(current);
+			if (opts.redirectPolicy) opts.redirectPolicy(parsed, hop);
+			if (seen.has(parsed.href)) throw new Error(`Redirect loop detected at ${parsed.href}`);
+			seen.add(parsed.href);
+			const controller = opts.timeoutMs !== void 0 ? new AbortController() : void 0;
+			const timer = controller && opts.timeoutMs !== void 0 ? setTimeout(() => controller.abort(), opts.timeoutMs) : void 0;
+			try {
+				response = await fetchImpl(current, {
+					redirect: manual ? "manual" : "follow",
+					headers: buildHeaders(current),
+					...controller ? { signal: controller.signal } : {}
+				});
+			} finally {
+				if (timer) clearTimeout(timer);
+			}
+			if (manual && isRedirectStatus(response.status)) {
+				const location = response.headers.get("location");
+				if (!location) throw new Error(`Redirect ${response.status} missing Location header`);
+				if (hop >= maxRedirects) throw new Error(`Too many redirects (max ${maxRedirects}) downloading ${url}`);
+				current = resolveRedirectUrl(current, location).href;
+				continue;
+			}
+			break;
+		}
+		if (!response) throw new Error(`No response downloading ${url}`);
+		if (manual && isRedirectStatus(response.status)) throw new Error(`Too many redirects (max ${maxRedirects}) downloading ${url}`);
 		if (!response.ok) throw new Error(`HTTP ${response.status} downloading ${url}`);
 		if (!response.body) throw new Error(`No response body from ${url}`);
 		const total = parseInt(response.headers.get("content-length") ?? "0", 10);
@@ -44,9 +79,10 @@ async function downloadFile(url, destPath, onProgress) {
 			for (;;) {
 				const { done, value } = await reader.read();
 				if (done || !value) break;
-				fileStream.write(value);
 				downloaded += value.length;
-				onProgress?.(downloaded, total);
+				if (opts.maxBytes !== void 0 && downloaded > opts.maxBytes) throw new Error(`Downloaded ${downloaded} bytes exceeds the ${opts.maxBytes}-byte limit`);
+				fileStream.write(value);
+				opts.onProgress?.(downloaded, total);
 			}
 		} finally {
 			fileStream.end();
@@ -67,6 +103,495 @@ async function downloadFile(url, destPath, onProgress) {
 promisify(brotliCompress);
 promisify(gzip);
 //#endregion
+//#region src/scrypted/scrypted-download-policy.ts
+/**
+* Strict per-hop allow-list for Scrypted catalog downloads.
+*
+* Hosts are the ones observed from the pinned revision
+* `187402b20a3be0a7fab9bceee21d857ed6ae0064` — not a generic CDN wildcard.
+*/
+var SCRYPTED_DOWNLOAD_REDIRECT_HOSTS = ["huggingface.co", "us.aws.cdn.hf.co"];
+var LOCAL_HOSTS = new Set([
+	"localhost",
+	"127.0.0.1",
+	"::1",
+	"0.0.0.0"
+]);
+var IPV4_RE = /^(?:\d{1,3}\.){3}\d{1,3}$/;
+function assertScryptedDownloadUrl(url, _hop) {
+	if (url.protocol !== "https:") throw new Error(`http downgrade refused: ${url.protocol}`);
+	if (url.username || url.password) throw new Error("userinfo not allowed on download URL");
+	const host = url.hostname.toLowerCase();
+	if (LOCAL_HOSTS.has(host) || IPV4_RE.test(host) || host.includes(":")) throw new Error(`host not allowed: ${host}`);
+	if (!SCRYPTED_DOWNLOAD_REDIRECT_HOSTS.includes(host)) throw new Error(`host not allowed: ${host}`);
+}
+//#endregion
+//#region src/scrypted/scrypted-yolo-manifest-data.json
+var scrypted_yolo_manifest_data_default = /*#__PURE__*/ JSON.parse("[{\"id\":\"scrypted-yolov9t-relu-coreml\",\"label\":\"Scrypted YOLOv9T ReLU CoreML\",\"family\":\"yolov9t\",\"variant\":\"relu\",\"format\":\"coreml\",\"precision\":\"fp16\",\"files\":[{\"relativePath\":\"coreml/scrypted_yolov9t_relu/scrypted_yolov9t_relu.mlpackage/Manifest.json\",\"size\":617,\"sha256\":\"0a8733949d77e3204dba6418e81a11a8cc177015711457ce2c171266f23382d6\"},{\"relativePath\":\"coreml/scrypted_yolov9t_relu/scrypted_yolov9t_relu.mlpackage/Data/com.apple.CoreML/model.mlmodel\",\"size\":322229,\"sha256\":\"f5a62f196f1e72a84efa1637119dffb6501621af9cf6f867bc76b4b59c9242a0\"},{\"relativePath\":\"coreml/scrypted_yolov9t_relu/scrypted_yolov9t_relu.mlpackage/Data/com.apple.CoreML/weights/weight.bin\",\"size\":3797160,\"sha256\":\"b994419b8b68cfd6b89c3c6f3fe6b37458c86cc1d87fcca3df5034476a99dd38\"}],\"sizeMB\":4.12},{\"id\":\"scrypted-yolov9t-relu-onnx\",\"label\":\"Scrypted YOLOv9T ReLU ONNX\",\"family\":\"yolov9t\",\"variant\":\"relu\",\"format\":\"onnx\",\"precision\":\"fp32\",\"files\":[{\"relativePath\":\"onnx/scrypted_yolov9t_relu/scrypted_yolov9t_relu.onnx\",\"size\":8499266,\"sha256\":\"3f11ea2071b27c285b58c16636a44d6a0a27bdd1ca8b64112dfadabd39cfea47\"}],\"sizeMB\":8.5},{\"id\":\"scrypted-yolov9t-relu-test-coreml\",\"label\":\"Scrypted YOLOv9T ReLU test CoreML\",\"family\":\"yolov9t\",\"variant\":\"relu_test\",\"format\":\"coreml\",\"precision\":\"fp16\",\"files\":[{\"relativePath\":\"coreml/scrypted_yolov9t_relu_test/scrypted_yolov9t_relu_test.mlpackage/Manifest.json\",\"size\":617,\"sha256\":\"a5e0128b643f1a66f3e07d4b332f9ccbca97ccab75651c794f0b9f1fb41c8491\"},{\"relativePath\":\"coreml/scrypted_yolov9t_relu_test/scrypted_yolov9t_relu_test.mlpackage/Data/com.apple.CoreML/model.mlmodel\",\"size\":322229,\"sha256\":\"79f4f647f2a0c79db3b560c84251b48c7ba7cbe9c1fecc9674d1a603a389dfa3\"},{\"relativePath\":\"coreml/scrypted_yolov9t_relu_test/scrypted_yolov9t_relu_test.mlpackage/Data/com.apple.CoreML/weights/weight.bin\",\"size\":3797160,\"sha256\":\"72efc9dc6af9241b5e5ee7de24a4f55741f6425d0e279d797f0f223e3d355f84\"}],\"sizeMB\":4.12},{\"id\":\"scrypted-yolov9t-relu-test-onnx\",\"label\":\"Scrypted YOLOv9T ReLU test ONNX\",\"family\":\"yolov9t\",\"variant\":\"relu_test\",\"format\":\"onnx\",\"precision\":\"fp32\",\"files\":[{\"relativePath\":\"onnx/scrypted_yolov9t_relu_test/scrypted_yolov9t_relu_test.onnx\",\"size\":8499266,\"sha256\":\"d20aa0e6923a3af7f5e84e3a6d28fb00e8ecd592e3225f986f93bd34b634e2f8\"}],\"sizeMB\":8.5},{\"id\":\"scrypted-yolov9s-relu-coreml\",\"label\":\"Scrypted YOLOv9S ReLU CoreML\",\"family\":\"yolov9s\",\"variant\":\"relu\",\"format\":\"coreml\",\"precision\":\"fp16\",\"files\":[{\"relativePath\":\"coreml/scrypted_yolov9s_relu/scrypted_yolov9s_relu.mlpackage/Manifest.json\",\"size\":617,\"sha256\":\"3bcdb820b82f1e89266f2d11bae1604d3ee4ca6d11dc5bd5c57055ff4157e9f3\"},{\"relativePath\":\"coreml/scrypted_yolov9s_relu/scrypted_yolov9s_relu.mlpackage/Data/com.apple.CoreML/model.mlmodel\",\"size\":322664,\"sha256\":\"9a9c3c9cbca406ec2f0418ec867ed6b878ec6d02c16636d30e0bbd83d2ff7c40\"},{\"relativePath\":\"coreml/scrypted_yolov9s_relu/scrypted_yolov9s_relu.mlpackage/Data/com.apple.CoreML/weights/weight.bin\",\"size\":14190120,\"sha256\":\"fd51eda58a993997268f6a2e424b536ba173207ad7974ab8bee2a8ff76d52dab\"}],\"sizeMB\":14.51},{\"id\":\"scrypted-yolov9s-relu-onnx\",\"label\":\"Scrypted YOLOv9S ReLU ONNX\",\"family\":\"yolov9s\",\"variant\":\"relu\",\"format\":\"onnx\",\"precision\":\"fp32\",\"files\":[{\"relativePath\":\"onnx/scrypted_yolov9s_relu/scrypted_yolov9s_relu.onnx\",\"size\":29287339,\"sha256\":\"ca0b5bd98d5f59eb2029c6cb5129d53af59873f62a317a028beda463bbb96399\"}],\"sizeMB\":29.29},{\"id\":\"scrypted-yolov9s-relu-test-coreml\",\"label\":\"Scrypted YOLOv9S ReLU test CoreML\",\"family\":\"yolov9s\",\"variant\":\"relu_test\",\"format\":\"coreml\",\"precision\":\"fp16\",\"files\":[{\"relativePath\":\"coreml/scrypted_yolov9s_relu_test/scrypted_yolov9s_relu_test.mlpackage/Manifest.json\",\"size\":617,\"sha256\":\"e2d24de0ce7e8573f19572029765e55abc714f36a85175ad7fcb95c001a76653\"},{\"relativePath\":\"coreml/scrypted_yolov9s_relu_test/scrypted_yolov9s_relu_test.mlpackage/Data/com.apple.CoreML/model.mlmodel\",\"size\":322664,\"sha256\":\"186b147cdfd15c5ed7a381ec3a426a22cee0b5c52d56f14efd26da06357f5cb0\"},{\"relativePath\":\"coreml/scrypted_yolov9s_relu_test/scrypted_yolov9s_relu_test.mlpackage/Data/com.apple.CoreML/weights/weight.bin\",\"size\":14190120,\"sha256\":\"e50651924c2cbffd56008a8953569e66c3de69f21807fcf7d825390ce30f21f8\"}],\"sizeMB\":14.51},{\"id\":\"scrypted-yolov9s-relu-test-onnx\",\"label\":\"Scrypted YOLOv9S ReLU test ONNX\",\"family\":\"yolov9s\",\"variant\":\"relu_test\",\"format\":\"onnx\",\"precision\":\"fp32\",\"files\":[{\"relativePath\":\"onnx/scrypted_yolov9s_relu_test/scrypted_yolov9s_relu_test.onnx\",\"size\":29287339,\"sha256\":\"115ddb83333762a0f2599421335678696454a5c3571ade5df9bac8e9cb5fb4cf\"}],\"sizeMB\":29.29},{\"id\":\"scrypted-yolov9m-relu-coreml\",\"label\":\"Scrypted YOLOv9M ReLU CoreML\",\"family\":\"yolov9m\",\"variant\":\"relu\",\"format\":\"coreml\",\"precision\":\"fp16\",\"files\":[{\"relativePath\":\"coreml/scrypted_yolov9m_relu/scrypted_yolov9m_relu.mlpackage/Manifest.json\",\"size\":617,\"sha256\":\"c548c6e1ff768b2b01bd71e230aa712a1635ae2baa30e0369557a42fc531ecbf\"},{\"relativePath\":\"coreml/scrypted_yolov9m_relu/scrypted_yolov9m_relu.mlpackage/Data/com.apple.CoreML/model.mlmodel\",\"size\":247061,\"sha256\":\"1c40e02fc2a2559cb906ea6cd9da9c730d4a78f5019290cbb38d2fcaae379fe7\"},{\"relativePath\":\"coreml/scrypted_yolov9m_relu/scrypted_yolov9m_relu.mlpackage/Data/com.apple.CoreML/weights/weight.bin\",\"size\":39880616,\"sha256\":\"4cf938e5bfcc3ee1644813e4eb4702a7de450cc0581df94c719cf43d0ed2e408\"}],\"sizeMB\":40.13},{\"id\":\"scrypted-yolov9m-relu-onnx\",\"label\":\"Scrypted YOLOv9M ReLU ONNX\",\"family\":\"yolov9m\",\"variant\":\"relu\",\"format\":\"onnx\",\"precision\":\"fp32\",\"files\":[{\"relativePath\":\"onnx/scrypted_yolov9m_relu/scrypted_yolov9m_relu.onnx\",\"size\":80380404,\"sha256\":\"e7a81fb33224a0105d2a0a594c3fa43c398c361de623f1d14156ae826e7312d5\"}],\"sizeMB\":80.38},{\"id\":\"scrypted-yolov9m-relu-test-coreml\",\"label\":\"Scrypted YOLOv9M ReLU test CoreML\",\"family\":\"yolov9m\",\"variant\":\"relu_test\",\"format\":\"coreml\",\"precision\":\"fp16\",\"files\":[{\"relativePath\":\"coreml/scrypted_yolov9m_relu_test/scrypted_yolov9m_relu_test.mlpackage/Manifest.json\",\"size\":617,\"sha256\":\"8e2684b286d02b4bdf9db1027c84cb89bf8e4830cfb58269f3ec457c5a010650\"},{\"relativePath\":\"coreml/scrypted_yolov9m_relu_test/scrypted_yolov9m_relu_test.mlpackage/Data/com.apple.CoreML/model.mlmodel\",\"size\":247061,\"sha256\":\"53d5946e74b13b15c5f8616081c9f15e8a95a5df3d5b45b830fc5a7f49561c16\"},{\"relativePath\":\"coreml/scrypted_yolov9m_relu_test/scrypted_yolov9m_relu_test.mlpackage/Data/com.apple.CoreML/weights/weight.bin\",\"size\":39880616,\"sha256\":\"69774bf0032c37707601b8cdc1e1820dbd9f8288eb5d6f3879618a5d34ff5199\"}],\"sizeMB\":40.13},{\"id\":\"scrypted-yolov9m-relu-test-onnx\",\"label\":\"Scrypted YOLOv9M ReLU test ONNX\",\"family\":\"yolov9m\",\"variant\":\"relu_test\",\"format\":\"onnx\",\"precision\":\"fp32\",\"files\":[{\"relativePath\":\"onnx/scrypted_yolov9m_relu_test/scrypted_yolov9m_relu_test.onnx\",\"size\":80380404,\"sha256\":\"8bb054f099295909ec518e2a6598d63db24d3f90edc8105a0f016903f2a205a2\"}],\"sizeMB\":80.38},{\"id\":\"scrypted-yolov9c-relu-coreml\",\"label\":\"Scrypted YOLOv9C ReLU CoreML\",\"family\":\"yolov9c\",\"variant\":\"relu\",\"format\":\"coreml\",\"precision\":\"fp16\",\"files\":[{\"relativePath\":\"coreml/scrypted_yolov9c_relu/scrypted_yolov9c_relu.mlpackage/Manifest.json\",\"size\":617,\"sha256\":\"813a306ebd69cabfd31f00434f5a961feeca7d237833f3e11805dcf4ad120ba9\"},{\"relativePath\":\"coreml/scrypted_yolov9c_relu/scrypted_yolov9c_relu.mlpackage/Data/com.apple.CoreML/model.mlmodel\",\"size\":263210,\"sha256\":\"862f082619075e470738306b0ff0a37ae70a7d08e684ca6a6dfa1971d404e0c3\"},{\"relativePath\":\"coreml/scrypted_yolov9c_relu/scrypted_yolov9c_relu.mlpackage/Data/com.apple.CoreML/weights/weight.bin\",\"size\":50489960,\"sha256\":\"ed89747e58943758e2a87221d1d404f6a4466cbc039c3c6f96e327cadc403d27\"}],\"sizeMB\":50.75},{\"id\":\"scrypted-yolov9c-relu-onnx\",\"label\":\"Scrypted YOLOv9C ReLU ONNX\",\"family\":\"yolov9c\",\"variant\":\"relu\",\"format\":\"onnx\",\"precision\":\"fp32\",\"files\":[{\"relativePath\":\"onnx/scrypted_yolov9c_relu/scrypted_yolov9c_relu.onnx\",\"size\":101631962,\"sha256\":\"b9372c4428daf4cd944c114b1e80d1a9ff0487d743e53a77216a051cfbef7116\"}],\"sizeMB\":101.63},{\"id\":\"scrypted-yolov9c-relu-test-coreml\",\"label\":\"Scrypted YOLOv9C ReLU test CoreML\",\"family\":\"yolov9c\",\"variant\":\"relu_test\",\"format\":\"coreml\",\"precision\":\"fp16\",\"files\":[{\"relativePath\":\"coreml/scrypted_yolov9c_relu_test/scrypted_yolov9c_relu_test.mlpackage/Manifest.json\",\"size\":617,\"sha256\":\"966ef82a93cb0ccf1036a8c9729c065fd372fa9590a97d0945e581cc674f7ad2\"},{\"relativePath\":\"coreml/scrypted_yolov9c_relu_test/scrypted_yolov9c_relu_test.mlpackage/Data/com.apple.CoreML/model.mlmodel\",\"size\":263210,\"sha256\":\"08718ecd3e9552d21a702bd8df60911cad0eec7b2ae382466809550f14634711\"},{\"relativePath\":\"coreml/scrypted_yolov9c_relu_test/scrypted_yolov9c_relu_test.mlpackage/Data/com.apple.CoreML/weights/weight.bin\",\"size\":50489960,\"sha256\":\"fe5936b9430ab4c87f30b148220131d6ec998b2377223d033e2fa2a00e60aada\"}],\"sizeMB\":50.75},{\"id\":\"scrypted-yolov9c-relu-test-onnx\",\"label\":\"Scrypted YOLOv9C ReLU test ONNX\",\"family\":\"yolov9c\",\"variant\":\"relu_test\",\"format\":\"onnx\",\"precision\":\"fp32\",\"files\":[{\"relativePath\":\"onnx/scrypted_yolov9c_relu_test/scrypted_yolov9c_relu_test.onnx\",\"size\":101631962,\"sha256\":\"2f4e2031e8efb4cbc871594338b2e875d78ab4af3ee0258d253273b1aac84742\"}],\"sizeMB\":101.63},{\"id\":\"scrypted-yolov9t-relu-openvino-fp32\",\"label\":\"Scrypted YOLOv9T ReLU OpenVINO FP32\",\"family\":\"yolov9t\",\"variant\":\"relu\",\"format\":\"openvino\",\"precision\":\"fp32\",\"files\":[{\"relativePath\":\"openvino/scrypted_yolov9t_relu/best-converted.xml\",\"size\":628222,\"sha256\":\"01b5a9d02a0f281e1aaf4860e1b0ed3a7f16b9d78975be8ff985ae0ee283d877\"},{\"relativePath\":\"openvino/scrypted_yolov9t_relu/best-converted.bin\",\"size\":7542204,\"sha256\":\"4fe9ce8dbdf94514fdd450cbfc907f257153e4898a0c1489a44e4912d8e32cc7\"}],\"sizeMB\":8.17},{\"id\":\"scrypted-yolov9s-relu-openvino-fp32\",\"label\":\"Scrypted YOLOv9S ReLU OpenVINO FP32\",\"family\":\"yolov9s\",\"variant\":\"relu\",\"format\":\"openvino\",\"precision\":\"fp32\",\"files\":[{\"relativePath\":\"openvino/scrypted_yolov9s_relu/best-converted.xml\",\"size\":629249,\"sha256\":\"5b4a229bf7229425698b63bd065a403e440a6151a6ddff0034867659cc4a480d\"},{\"relativePath\":\"openvino/scrypted_yolov9s_relu/best-converted.bin\",\"size\":28329724,\"sha256\":\"c030bd219208ea94082578c81f383d4ef9ec45d7150eec1c2c2ff2569cf49b35\"}],\"sizeMB\":28.96},{\"id\":\"scrypted-yolov9m-relu-openvino-fp32\",\"label\":\"Scrypted YOLOv9M ReLU OpenVINO FP32\",\"family\":\"yolov9m\",\"variant\":\"relu\",\"format\":\"openvino\",\"precision\":\"fp32\",\"files\":[{\"relativePath\":\"openvino/scrypted_yolov9m_relu/best-converted.xml\",\"size\":485439,\"sha256\":\"c66f9f1965bf70fd3635d4dfc3cb94c72c06b344c256713237d77706725b9a0c\"},{\"relativePath\":\"openvino/scrypted_yolov9m_relu/best-converted.bin\",\"size\":79717372,\"sha256\":\"dfc2d8952bbca9ad0e116168e3fd5c754e601c327d78c4f4d0d4cae12f0e1d2a\"}],\"sizeMB\":80.2},{\"id\":\"scrypted-yolov9c-relu-openvino-fp32\",\"label\":\"Scrypted YOLOv9C ReLU OpenVINO FP32\",\"family\":\"yolov9c\",\"variant\":\"relu\",\"format\":\"openvino\",\"precision\":\"fp32\",\"files\":[{\"relativePath\":\"openvino/scrypted_yolov9c_relu/best-converted.xml\",\"size\":535047,\"sha256\":\"836c1e998ebf76108ff64d554fdfa07aa72c42624f1a5448701bb409f27b8d68\"},{\"relativePath\":\"openvino/scrypted_yolov9c_relu/best-converted.bin\",\"size\":100942972,\"sha256\":\"11a1b330ac9843b349927977b3c7c7f17bb42af73a7ff102969132f27ab81814\"}],\"sizeMB\":101.48},{\"id\":\"scrypted-yolov9t-relu-openvino-int8\",\"label\":\"Scrypted YOLOv9T ReLU OpenVINO INT8\",\"family\":\"yolov9t\",\"variant\":\"relu\",\"format\":\"openvino\",\"precision\":\"int8\",\"files\":[{\"relativePath\":\"openvino/scrypted_yolov9t_relu_int8/best-converted.xml\",\"size\":1380379,\"sha256\":\"e5a76bf88ac69fc0ebc50c04b61ff91550dd9c2349af1f6d7e4cac949c640cec\"},{\"relativePath\":\"openvino/scrypted_yolov9t_relu_int8/best-converted.bin\",\"size\":1954956,\"sha256\":\"98fb5b6826d7c6697a585f69ba96754873772d9d61fbed8335aab761e8248659\"}],\"sizeMB\":3.34},{\"id\":\"scrypted-yolov9t-relu-test-openvino-int8\",\"label\":\"Scrypted YOLOv9T ReLU test OpenVINO INT8\",\"family\":\"yolov9t\",\"variant\":\"relu_test\",\"format\":\"openvino\",\"precision\":\"int8\",\"files\":[{\"relativePath\":\"openvino/scrypted_yolov9t_relu_test_int8/best-converted.xml\",\"size\":1380383,\"sha256\":\"9e4119284e923e08c9929e78fd31e2552e602a552ac538ae99bf34a50dd4d172\"},{\"relativePath\":\"openvino/scrypted_yolov9t_relu_test_int8/best-converted.bin\",\"size\":1954960,\"sha256\":\"efe5b0a2fd2f5ddef5923eeb9e592a7ef14719061bb7605c86e05b35c2c58ea9\"}],\"sizeMB\":3.34},{\"id\":\"scrypted-yolov9s-relu-openvino-int8\",\"label\":\"Scrypted YOLOv9S ReLU OpenVINO INT8\",\"family\":\"yolov9s\",\"variant\":\"relu\",\"format\":\"openvino\",\"precision\":\"int8\",\"files\":[{\"relativePath\":\"openvino/scrypted_yolov9s_relu_int8/best-converted.xml\",\"size\":1382088,\"sha256\":\"4e6c24cf24afbab21462f7e1a15bd05b1cbbe5915046000e03c2435d8110bbbf\"},{\"relativePath\":\"openvino/scrypted_yolov9s_relu_int8/best-converted.bin\",\"size\":7197308,\"sha256\":\"23fd3d666a938c41db232d9c6239baec1134716cfb4ed4ddd3d602dd20eb8ac0\"}],\"sizeMB\":8.58},{\"id\":\"scrypted-yolov9s-relu-test-openvino-int8\",\"label\":\"Scrypted YOLOv9S ReLU test OpenVINO INT8\",\"family\":\"yolov9s\",\"variant\":\"relu_test\",\"format\":\"openvino\",\"precision\":\"int8\",\"files\":[{\"relativePath\":\"openvino/scrypted_yolov9s_relu_test_int8/best-converted.xml\",\"size\":1382092,\"sha256\":\"49865bfeafe7576afce089ba6f5c3e25a9192c8b514eb96265c90fe877795641\"},{\"relativePath\":\"openvino/scrypted_yolov9s_relu_test_int8/best-converted.bin\",\"size\":7197312,\"sha256\":\"78e9d36e6b74754db2b624ea3ec0b3ff57ed6dfed59a4f2225e1a271054597de\"}],\"sizeMB\":8.58},{\"id\":\"scrypted-yolov9m-relu-openvino-int8\",\"label\":\"Scrypted YOLOv9M ReLU OpenVINO INT8\",\"family\":\"yolov9m\",\"variant\":\"relu\",\"format\":\"openvino\",\"precision\":\"int8\",\"files\":[{\"relativePath\":\"openvino/scrypted_yolov9m_relu_int8/best-converted.xml\",\"size\":1024595,\"sha256\":\"1242ab8d8c73b2e80c5dd541177ade6e102a2684114b059136acb4cad6efb034\"},{\"relativePath\":\"openvino/scrypted_yolov9m_relu_int8/best-converted.bin\",\"size\":20090516,\"sha256\":\"da8e44af8bee66478e6f359e9504bfb13ab4b76f4bd8a2f1b10cfbc22febcf6e\"}],\"sizeMB\":21.12},{\"id\":\"scrypted-yolov9m-relu-test-openvino-int8\",\"label\":\"Scrypted YOLOv9M ReLU test OpenVINO INT8\",\"family\":\"yolov9m\",\"variant\":\"relu_test\",\"format\":\"openvino\",\"precision\":\"int8\",\"files\":[{\"relativePath\":\"openvino/scrypted_yolov9m_relu_test_int8/best-converted.xml\",\"size\":1024601,\"sha256\":\"24395ae5fdbb321304c865372cd2b905cdc55abb7610520f3963702e2371decb\"},{\"relativePath\":\"openvino/scrypted_yolov9m_relu_test_int8/best-converted.bin\",\"size\":20090520,\"sha256\":\"4360fe0312067f92c49f180c7b8a10271f14d58b8909aa9b96b13af4ab9289aa\"}],\"sizeMB\":21.12},{\"id\":\"scrypted-yolov9c-relu-openvino-int8\",\"label\":\"Scrypted YOLOv9C ReLU OpenVINO INT8\",\"family\":\"yolov9c\",\"variant\":\"relu\",\"format\":\"openvino\",\"precision\":\"int8\",\"files\":[{\"relativePath\":\"openvino/scrypted_yolov9c_relu_int8/best-converted.xml\",\"size\":1092695,\"sha256\":\"a45c62940120c4301d8fff9fb3b275c29e3618f403ea68a785f2f3220cefec7a\"},{\"relativePath\":\"openvino/scrypted_yolov9c_relu_int8/best-converted.bin\",\"size\":25428280,\"sha256\":\"0643403a56178c3ed1e066c7884458d8ea6780115d662bdc38d10754d7a11c79\"}],\"sizeMB\":26.52},{\"id\":\"scrypted-yolov9c-relu-test-openvino-int8\",\"label\":\"Scrypted YOLOv9C ReLU test OpenVINO INT8\",\"family\":\"yolov9c\",\"variant\":\"relu_test\",\"format\":\"openvino\",\"precision\":\"int8\",\"files\":[{\"relativePath\":\"openvino/scrypted_yolov9c_relu_test_int8/best-converted.xml\",\"size\":1092695,\"sha256\":\"a8a1899848ebd060af2326d3c8d3c09ea83354f0bedff6cce6fa08b284ea5519\"},{\"relativePath\":\"openvino/scrypted_yolov9c_relu_test_int8/best-converted.bin\",\"size\":25428280,\"sha256\":\"2eb6bb3d0a03a9b239b6f623f9e7bced62eea61fbe4d8ff89c1b3e2e2b7978a2\"}],\"sizeMB\":26.52},{\"id\":\"scrypted-yolov9s-relu-sep-320-tflite-float16\",\"label\":\"Scrypted YOLOv9s ReLU sep 320 TFLite float16\",\"family\":\"yolov9s\",\"variant\":\"relu\",\"format\":\"tflite\",\"precision\":\"float16\",\"files\":[{\"relativePath\":\"tflite/scrypted_yolov9s_relu_sep_320/best_float16.tflite\",\"size\":14482836,\"sha256\":\"04889db3b81af361c361e41ffa99327330d37b71d680a2f889e6cdf1e94c0d8c\"}],\"sizeMB\":14.48},{\"id\":\"scrypted-yolov9s-relu-sep-320-tflite-float32\",\"label\":\"Scrypted YOLOv9s ReLU sep 320 TFLite float32\",\"family\":\"yolov9s\",\"variant\":\"relu\",\"format\":\"tflite\",\"precision\":\"float32\",\"files\":[{\"relativePath\":\"tflite/scrypted_yolov9s_relu_sep_320/best_float32.tflite\",\"size\":28777068,\"sha256\":\"f5d7d08fc1d8f2262633d2df4391638e0481740331aaa1837880a47c33001a96\"}],\"sizeMB\":28.78},{\"id\":\"scrypted-yolov9s-relu-sep-320-tflite-int8\",\"label\":\"Scrypted YOLOv9s ReLU sep 320 TFLite int8\",\"family\":\"yolov9s\",\"variant\":\"relu\",\"format\":\"tflite\",\"precision\":\"int8\",\"files\":[{\"relativePath\":\"tflite/scrypted_yolov9s_relu_sep_320/best_int8.tflite\",\"size\":7325616,\"sha256\":\"1e9866b16fe80931383bf3c94dc629fe93a37ba3dc1465ea019eb0a50bd428df\"}],\"sizeMB\":7.33},{\"id\":\"scrypted-yolov9s-relu-sep-320-tflite-integer_quant\",\"label\":\"Scrypted YOLOv9s ReLU sep 320 TFLite integer_quant\",\"family\":\"yolov9s\",\"variant\":\"relu\",\"format\":\"tflite\",\"precision\":\"integer_quant\",\"files\":[{\"relativePath\":\"tflite/scrypted_yolov9s_relu_sep_320/best_integer_quant.tflite\",\"size\":7342552,\"sha256\":\"bc1c902e9a9865637ee2403f70c6bf5c29c695d9163e58ad658feb29bb097ebc\"}],\"sizeMB\":7.34},{\"id\":\"scrypted-yolov9s-relu-sep-320-tflite-full_integer_quant\",\"label\":\"Scrypted YOLOv9s ReLU sep 320 TFLite full_integer_quant\",\"family\":\"yolov9s\",\"variant\":\"relu\",\"format\":\"tflite\",\"precision\":\"full_integer_quant\",\"files\":[{\"relativePath\":\"tflite/scrypted_yolov9s_relu_sep_320/best_full_integer_quant.tflite\",\"size\":7341704,\"sha256\":\"483ce38dbe33ee5a35f40a82f56c77629a44fa5d95efd8ade9fa97e4d2a261fd\"}],\"sizeMB\":7.34},{\"id\":\"scrypted-yolov9s-relu-sep-320-tflite-edgetpu\",\"label\":\"Scrypted YOLOv9s ReLU sep 320 TFLite edgetpu\",\"family\":\"yolov9s\",\"variant\":\"relu\",\"format\":\"tflite\",\"precision\":\"edgetpu\",\"files\":[{\"relativePath\":\"tflite/scrypted_yolov9s_relu_sep_320/best_full_integer_quant_edgetpu.tflite\",\"size\":8164480,\"sha256\":\"e1e6b074a3b9fdf19a171baf615553ad375a046aa7de2a3fef9a1950175fab22\"}],\"sizeMB\":8.16}]");
+//#endregion
+//#region src/scrypted/scrypted-yolo-manifest.ts
+var SCRYPTED_SHA256_RE = /^[0-9a-f]{64}$/;
+var SCRYPTED_HF_HOST = "https://huggingface.co";
+var SCRYPTED_HF_REPO = "scrypted/plugin-models";
+var SCRYPTED_HF_REVISION = "187402b20a3be0a7fab9bceee21d857ed6ae0064";
+var SCRYPTED_YOLO_LABELS = [
+	"person",
+	"vehicle",
+	"animal"
+];
+var SCRYPTED_IDENTITY_CLASS_MAP = {
+	mapping: {
+		person: "person",
+		vehicle: "vehicle",
+		animal: "animal"
+	},
+	preserveOriginal: false
+};
+var SCRYPTED_LABEL_DEFS = SCRYPTED_YOLO_LABELS.map((id) => ({
+	id,
+	name: id
+}));
+var MLPACKAGE_INNER_FILES = [
+	"Manifest.json",
+	"Data/com.apple.CoreML/model.mlmodel",
+	"Data/com.apple.CoreML/weights/weight.bin"
+];
+var INPUT_SIZE = {
+	width: 320,
+	height: 320
+};
+function assertScryptedFileSha256(value, relativePath) {
+	if (value === void 0 || !SCRYPTED_SHA256_RE.test(value)) throw new Error(`Invalid sha256 for ${relativePath}: expected 64 lowercase hex`);
+	return value;
+}
+function assertScryptedRelativePath(value) {
+	if (value.length === 0 || value.startsWith("/") || value.includes("\\") || value.includes("\0")) throw new Error(`Unsafe Scrypted relative path: ${value}`);
+	if (value.split("/").some((segment) => segment.length === 0 || segment === "." || segment === "..")) throw new Error(`Unsafe Scrypted relative path: ${value}`);
+	return value;
+}
+function buildScryptedResolveUrl(relativePath) {
+	return `${SCRYPTED_HF_HOST}/${SCRYPTED_HF_REPO}/resolve/${SCRYPTED_HF_REVISION}/${assertScryptedRelativePath(relativePath).split("/").map((segment) => encodeURIComponent(segment)).join("/")}`;
+}
+function packageDirectory(files) {
+	const manifest = files.find((file) => file.relativePath.endsWith("/Manifest.json"));
+	if (!manifest) throw new Error("CoreML entry is missing Manifest.json");
+	return assertScryptedRelativePath(manifest.relativePath.replace(/\/Manifest\.json$/, ""));
+}
+function buildModel(spec) {
+	const group = {
+		family: "yolov9",
+		tier: spec.family.slice(-1),
+		resolution: 320,
+		...spec.variant === "relu_test" ? { optimization: "fast" } : {},
+		...spec.precision === "int8" ? { precision: "int8" } : {}
+	};
+	if (spec.format === "coreml") {
+		const dir = packageDirectory(spec.files);
+		return {
+			id: spec.id,
+			name: spec.label,
+			description: `${spec.label} — imported from the local Scrypted YOLO catalog.`,
+			formats: { coreml: {
+				url: buildScryptedResolveUrl(dir),
+				sizeMB: spec.sizeMB,
+				isDirectory: true,
+				files: [...MLPACKAGE_INNER_FILES],
+				runtimes: ["python"]
+			} },
+			inputSize: INPUT_SIZE,
+			labels: SCRYPTED_LABEL_DEFS,
+			preprocessMode: "resize",
+			classMap: SCRYPTED_IDENTITY_CLASS_MAP,
+			group
+		};
+	}
+	if (spec.format === "openvino") {
+		const xml = spec.files.find((file) => file.relativePath.endsWith(".xml"));
+		const bin = spec.files.find((file) => file.relativePath.endsWith(".bin"));
+		if (!xml || !bin) throw new Error(`OpenVINO entry ${spec.id} is missing xml/bin`);
+		const binName = bin.relativePath.split("/").pop() ?? "best-converted.bin";
+		return {
+			id: spec.id,
+			name: spec.label,
+			description: `${spec.label} — imported from the local Scrypted YOLO catalog.`,
+			formats: { openvino: {
+				url: buildScryptedResolveUrl(xml.relativePath),
+				sizeMB: spec.sizeMB,
+				files: [binName],
+				runtimes: ["python"]
+			} },
+			inputSize: INPUT_SIZE,
+			labels: SCRYPTED_LABEL_DEFS,
+			preprocessMode: "resize",
+			classMap: SCRYPTED_IDENTITY_CLASS_MAP,
+			group
+		};
+	}
+	const main = spec.files[0];
+	if (!main) throw new Error(`Entry ${spec.id} has no files`);
+	return {
+		id: spec.id,
+		name: spec.label,
+		description: `${spec.label} — imported from the local Scrypted YOLO catalog.`,
+		formats: { [spec.format]: {
+			url: buildScryptedResolveUrl(main.relativePath),
+			sizeMB: spec.sizeMB,
+			runtimes: spec.format === "tflite" ? ["python"] : void 0
+		} },
+		inputSize: INPUT_SIZE,
+		labels: SCRYPTED_LABEL_DEFS,
+		preprocessMode: "resize",
+		classMap: SCRYPTED_IDENTITY_CLASS_MAP,
+		group
+	};
+}
+function freezeEntry(spec) {
+	const files = spec.files.map((file) => Object.freeze({
+		relativePath: assertScryptedRelativePath(file.relativePath),
+		size: file.size,
+		sha256: assertScryptedFileSha256(file.sha256, file.relativePath)
+	}));
+	return Object.freeze({
+		id: spec.id,
+		label: spec.label,
+		family: spec.family,
+		variant: spec.variant,
+		format: spec.format,
+		precision: spec.precision,
+		inputSize: INPUT_SIZE,
+		files: Object.freeze(files),
+		model: buildModel({
+			...spec,
+			files
+		})
+	});
+}
+var SCRYPTED_YOLO_MANIFEST = Object.freeze(scrypted_yolo_manifest_data_default.map(freezeEntry));
+function getScryptedManifestEntry(manifestId) {
+	return SCRYPTED_YOLO_MANIFEST.find((entry) => entry.id === manifestId);
+}
+//#endregion
+//#region src/scrypted/scrypted-tree-drift.ts
+/**
+* Read-only drift check: compare the local Scrypted YOLO manifest to a
+* Hugging Face tree. Never mutates the manifest and never auto-imports
+* remote-only files.
+*/
+var SCRYPTED_KNOWN_DRIFT_STATUSES = [
+	"ok",
+	"missing",
+	"size-changed",
+	"unavailable"
+];
+/** Fail-closed: a future/unknown status is never treated as `ok`. */
+function normalizeScryptedDrift(row) {
+	if (SCRYPTED_KNOWN_DRIFT_STATUSES.includes(row.status)) return {
+		manifestId: row.manifestId,
+		status: row.status,
+		...row.details !== void 0 ? { details: row.details } : {}
+	};
+	return {
+		manifestId: row.manifestId,
+		status: "unavailable",
+		details: row.details ?? `unknown drift status: ${row.status}`
+	};
+}
+function remoteSize(file) {
+	return file.lfs?.size ?? file.size;
+}
+function compareScryptedManifestDrift(manifest, tree) {
+	const byPath = new Map(tree.map((file) => [file.path, file]));
+	return manifest.map((entry) => {
+		const missing = [];
+		const changed = [];
+		for (const file of entry.files) {
+			const remote = byPath.get(file.relativePath);
+			if (!remote) {
+				missing.push(file.relativePath);
+				continue;
+			}
+			if (remoteSize(remote) !== file.size) changed.push(`${file.relativePath} declared ${file.size} remote ${remoteSize(remote)}`);
+		}
+		if (missing.length > 0) return {
+			manifestId: entry.id,
+			status: "missing",
+			details: `missing: ${missing.join(", ")}`
+		};
+		if (changed.length > 0) return {
+			manifestId: entry.id,
+			status: "size-changed",
+			details: `size-changed: ${changed.join(", ")}`
+		};
+		return {
+			manifestId: entry.id,
+			status: "ok"
+		};
+	});
+}
+var ScryptedTreeLinkError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ScryptedTreeLinkError";
+	}
+};
+function assertScryptedTreePageUrl(url, revision) {
+	if (url.protocol !== "https:") throw new ScryptedTreeLinkError(`Refusing non-https tree link: ${url.protocol}`);
+	if (url.username || url.password) throw new ScryptedTreeLinkError("Refusing tree link with userinfo");
+	if (url.origin !== `https://huggingface.co`) throw new ScryptedTreeLinkError(`Refusing tree link origin ${url.origin}`);
+	const expectedPath = `/api/models/${SCRYPTED_HF_REPO}/tree/${revision}`;
+	if (url.pathname !== expectedPath) throw new ScryptedTreeLinkError(`Refusing tree link path/revision ${url.pathname} (expected ${expectedPath})`);
+}
+/**
+* Parse `Link: <...>; rel="next"` and accept only an HTTPS huggingface.co
+* tree URL for the same repo + revision. Relative hrefs resolve against the
+* current page URL. Never returns a URL that failed validation.
+*/
+function resolveScryptedTreeNextLink(header, currentUrl, revision) {
+	if (!header) return void 0;
+	const match = /<([^>]+)>;\s*rel="next"/.exec(header);
+	if (!match?.[1]) return void 0;
+	let resolved;
+	try {
+		resolved = new URL(match[1], currentUrl);
+	} catch {
+		throw new ScryptedTreeLinkError(`Refusing unparsable tree next link: ${match[1]}`);
+	}
+	assertScryptedTreePageUrl(resolved, revision);
+	return resolved.href;
+}
+async function sleep(ms) {
+	if (ms <= 0) return;
+	await new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function fetchScryptedRemoteTree(opts) {
+	const revision = opts.revision ?? "main";
+	const maxRetries = opts.maxRetries ?? 4;
+	const retryDelayMs = opts.retryDelayMs ?? 200;
+	let lastError = /* @__PURE__ */ new Error("Scrypted Hugging Face tree unavailable");
+	for (let attempt = 0; attempt < maxRetries; attempt++) try {
+		const files = [];
+		let url = `${SCRYPTED_HF_HOST}/api/models/${SCRYPTED_HF_REPO}/tree/${encodeURIComponent(revision)}?recursive=true&expand=true`;
+		let pages = 0;
+		while (url) {
+			pages += 1;
+			if (pages > 50) throw new Error("Scrypted Hugging Face tree pagination exceeded the bound");
+			assertScryptedTreePageUrl(new URL(url), revision);
+			const response = await opts.fetchImpl(url, {
+				redirect: "manual",
+				headers: { "User-Agent": "CamStack/1.0" }
+			});
+			if (response.status === 301 || response.status === 302 || response.status === 303 || response.status === 307 || response.status === 308) throw new ScryptedTreeLinkError(`Refusing tree API redirect ${response.status} (fail-closed, no follow)`);
+			if (!response.ok) throw new Error(`HTTP ${response.status} fetching Scrypted Hugging Face tree`);
+			const payload = await response.json();
+			for (const entry of payload) {
+				if (entry.type !== "file" || !entry.path) continue;
+				files.push({
+					path: entry.path,
+					size: entry.size ?? entry.lfs?.size ?? 0,
+					...entry.lfs !== void 0 ? { lfs: entry.lfs } : {}
+				});
+			}
+			url = resolveScryptedTreeNextLink(response.headers.get("link") ?? "", url, revision);
+		}
+		return files;
+	} catch (err) {
+		if (err instanceof ScryptedTreeLinkError) throw err;
+		lastError = err instanceof Error ? err : new Error(String(err));
+		await sleep(Math.min(retryDelayMs * 2 ** attempt, 3e3));
+	}
+	throw new Error(`Scrypted Hugging Face tree unavailable: ${lastError.message}`);
+}
+//#endregion
+//#region src/scrypted/scrypted-import.ts
+/**
+* Server-owned Scrypted catalog import. The only client input is `manifestId`.
+* Downloads use the pinned host/repo/revision, a bounded staging dir, LFS /
+* size / checksum checks, and atomic finalize with cleanup on every failure.
+*/
+var SCRYPTED_IMPORT_MAX_FILE_BYTES = 256 * 1024 * 1024;
+/** Deterministic bundle digest: sorted `path\\0sha256` lines, never the primary file alone. */
+function scryptedBundleFingerprint(entry) {
+	const hash = createHash("sha256");
+	const lines = entry.files.map((file) => `${file.relativePath}\0${file.sha256}`).toSorted();
+	hash.update(lines.join("\n"));
+	return hash.digest("hex");
+}
+var LFS_POINTER_PREFIX = "version https://git-lfs.github.com/spec/v1";
+var SIZE_TOLERANCE = .01;
+function isLfsPointer(filePath) {
+	const fd = fs$1.openSync(filePath, "r");
+	try {
+		const buf = Buffer.alloc(128);
+		const n = fs$1.readSync(fd, buf, 0, buf.length, 0);
+		return buf.subarray(0, n).toString("utf8").startsWith(LFS_POINTER_PREFIX);
+	} finally {
+		fs$1.closeSync(fd);
+	}
+}
+async function hashFileSha256(filePath) {
+	const hash = createHash("sha256");
+	await new Promise((resolve, reject) => {
+		fs$1.createReadStream(filePath).on("data", (chunk) => hash.update(chunk)).on("end", () => resolve()).on("error", reject);
+	});
+	return hash.digest("hex");
+}
+function assertInside(root, dest) {
+	const rootResolved = path$1.resolve(root);
+	const destResolved = path$1.resolve(dest);
+	const prefix = rootResolved.endsWith(path$1.sep) ? rootResolved : `${rootResolved}${path$1.sep}`;
+	if (destResolved !== rootResolved && !destResolved.startsWith(prefix)) throw new Error(`Refusing to write outside the destination root: ${dest}`);
+	return destResolved;
+}
+function rejectSymlink(filePath) {
+	try {
+		if (fs$1.lstatSync(filePath).isSymbolicLink()) throw new Error(`Refusing symlink at ${filePath}`);
+	} catch (err) {
+		if (err.code === "ENOENT") return;
+		throw err;
+	}
+}
+function sizeOutOfTolerance(actual, declared) {
+	if (declared <= 0) return true;
+	return Math.abs(actual - declared) / declared > SIZE_TOLERANCE;
+}
+function localBasename(entry) {
+	if (entry.format === "coreml") return (entry.files.find((file) => file.relativePath.endsWith("/Manifest.json"))?.relativePath.replace(/\/Manifest\.json$/, "") ?? `${entry.id}.mlpackage`).split("/").pop() ?? `${entry.id}.mlpackage`;
+	if (entry.format === "openvino") return `${entry.id}.xml`;
+	if (entry.format === "tflite") return `${entry.id}.tflite`;
+	return entry.files[0]?.relativePath.split("/").pop() ?? `${entry.id}.onnx`;
+}
+function buildImportedDescriptor(entry, localName) {
+	const catalog = {
+		...entry.model,
+		classMap: SCRYPTED_IDENTITY_CLASS_MAP,
+		formats: { ...entry.model.formats }
+	};
+	const format = entry.format;
+	const previous = catalog.formats[format];
+	if (format === "coreml") catalog.formats = {
+		...catalog.formats,
+		coreml: {
+			url: `camstack-local://${entry.id}/${localName}`,
+			sizeMB: previous?.sizeMB ?? entry.files.reduce((sum, file) => sum + file.size, 0) / 1e6,
+			isDirectory: true,
+			files: previous?.files ?? [
+				"Manifest.json",
+				"Data/com.apple.CoreML/model.mlmodel",
+				"Data/com.apple.CoreML/weights/weight.bin"
+			],
+			runtimes: ["python"]
+		}
+	};
+	else if (format === "openvino") catalog.formats = {
+		...catalog.formats,
+		openvino: {
+			url: `camstack-local://${entry.id}/${localName}`,
+			sizeMB: previous?.sizeMB ?? entry.files.reduce((sum, file) => sum + file.size, 0) / 1e6,
+			files: [`${entry.id}.bin`],
+			runtimes: ["python"]
+		}
+	};
+	else catalog.formats = {
+		...catalog.formats,
+		[format]: {
+			url: `camstack-local://${entry.id}/${localName}`,
+			sizeMB: previous?.sizeMB ?? entry.files.reduce((sum, file) => sum + file.size, 0) / 1e6,
+			...previous?.runtimes !== void 0 ? { runtimes: previous.runtimes } : {}
+		}
+	};
+	return {
+		stepId: "object-detection",
+		entry: catalog
+	};
+}
+/** Availability/format selection uses the manifesto format, never key order. */
+function resolveScryptedImportedFormat(manifestId, descriptor) {
+	const entry = getScryptedManifestEntry(manifestId);
+	if (!entry) throw new Error(`resolveScryptedImportedFormat: unknown manifest id "${manifestId}"`);
+	const format = entry.format;
+	if (!descriptor.entry.formats[format]) throw new Error(`resolveScryptedImportedFormat: descriptor for "${manifestId}" is missing manifesto format ${format}`);
+	return format;
+}
+async function verifyScryptedStagedFile(destPath, file, deps) {
+	const maxBytes = deps.maxFileBytes ?? 268435456;
+	if (file.size > maxBytes) throw new Error(`Declared size ${file.size} exceeds the ${maxBytes}-byte limit`);
+	if (!fs$1.existsSync(destPath)) throw new Error(`missing downloaded file for ${file.relativePath}`);
+	rejectSymlink(destPath);
+	const actual = fs$1.statSync(destPath).size;
+	if (actual > maxBytes) throw new Error(`Downloaded ${actual} bytes exceeds the ${maxBytes}-byte limit`);
+	if (isLfsPointer(destPath)) throw new Error(`Downloaded an LFS pointer instead of the artifact (${file.relativePath})`);
+	if (sizeOutOfTolerance(actual, file.size)) throw new Error(`Downloaded size ${actual} is outside tolerance of declared ${file.size} for ${file.relativePath}`);
+	const expected = assertScryptedFileSha256(file.sha256, file.relativePath);
+	if (await (deps.fileSha256 ?? hashFileSha256)(destPath) !== expected) throw new Error(`sha256 checksum mismatch for ${file.relativePath}`);
+}
+async function importScryptedCatalogModel(input, deps) {
+	const entry = (deps.resolveEntry ?? getScryptedManifestEntry)(input.manifestId);
+	if (!entry) throw new Error(`importScryptedCatalogModel: unknown manifest id "${input.manifestId}"`);
+	for (const file of entry.files) assertScryptedFileSha256(file.sha256, file.relativePath);
+	const drift = normalizeScryptedDrift(await deps.driftFor(entry.id));
+	if (drift.status !== "ok") throw new Error(`importScryptedCatalogModel: entry "${entry.id}" is blocked by drift (${drift.status}${drift.details ? `: ${drift.details}` : ""})`);
+	fs$1.mkdirSync(deps.stagingDir, { recursive: true });
+	fs$1.mkdirSync(deps.modelsDir, { recursive: true });
+	const stagingRoot = path$1.join(deps.stagingDir, `imp-${randomUUID()}`);
+	fs$1.mkdirSync(stagingRoot, { recursive: true });
+	try {
+		const staged = [];
+		for (const file of entry.files) {
+			const relative = assertScryptedRelativePath(file.relativePath);
+			const dest = assertInside(stagingRoot, path$1.join(stagingRoot, ...relative.split("/")));
+			const url = buildScryptedResolveUrl(relative);
+			await deps.downloadFile(url, dest);
+			await verifyScryptedStagedFile(dest, file, deps);
+			staged.push({
+				file,
+				dest
+			});
+		}
+		if (entry.format === "coreml") {
+			const hasManifest = staged.some((row) => row.file.relativePath.endsWith("Manifest.json"));
+			const hasModel = staged.some((row) => row.file.relativePath.endsWith("model.mlmodel"));
+			const hasWeight = staged.some((row) => row.file.relativePath.endsWith("weight.bin"));
+			if (!hasManifest || !hasModel || !hasWeight || staged.length < 3) throw new Error("CoreML payload is incomplete — Manifest.json, model and weights are required");
+		}
+		if (entry.format === "openvino") {
+			const hasXml = staged.some((row) => row.file.relativePath.endsWith(".xml"));
+			const hasBin = staged.some((row) => row.file.relativePath.endsWith(".bin"));
+			if (!hasXml || !hasBin) throw new Error("OpenVINO payload is incomplete — xml and bin siblings are required");
+		}
+		const localName = localBasename(entry);
+		const finalMain = assertInside(deps.modelsDir, path$1.join(deps.modelsDir, localName));
+		rejectSymlink(finalMain);
+		if (entry.format === "coreml") {
+			const pkgRel = staged.find((row) => row.file.relativePath.endsWith("Manifest.json"))?.file.relativePath.replace(/\/Manifest\.json$/, "");
+			if (!pkgRel) throw new Error("CoreML payload is incomplete — Manifest.json missing");
+			const stagedPkg = path$1.join(stagingRoot, ...pkgRel.split("/"));
+			fs$1.rmSync(finalMain, {
+				recursive: true,
+				force: true
+			});
+			fs$1.renameSync(stagedPkg, finalMain);
+		} else if (entry.format === "openvino") {
+			const xml = staged.find((row) => row.file.relativePath.endsWith(".xml"));
+			const bin = staged.find((row) => row.file.relativePath.endsWith(".bin"));
+			if (!xml || !bin) throw new Error("OpenVINO payload is incomplete");
+			const xmlDest = finalMain;
+			const binDest = assertInside(deps.modelsDir, path$1.join(deps.modelsDir, `${entry.id}.bin`));
+			fs$1.renameSync(xml.dest, xmlDest);
+			fs$1.renameSync(bin.dest, binDest);
+		} else {
+			const only = staged[0];
+			if (!only) throw new Error("payload is incomplete");
+			fs$1.renameSync(only.dest, finalMain);
+		}
+		return buildImportedDescriptor(entry, localName);
+	} finally {
+		fs$1.rmSync(stagingRoot, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+//#endregion
 //#region ../types/dist/event-category-CIa_iT6b.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
@@ -8131,6 +8656,15 @@ var LabelDefinitionSchema = object({
 	description: string().optional(),
 	icon: string().optional()
 });
+var ClassMapDefinitionSchema = object({
+	mapping: record(string(), _enum([
+		"person",
+		"vehicle",
+		"animal",
+		"package"
+	])),
+	preserveOriginal: boolean()
+});
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -8309,7 +8843,13 @@ var ModelCatalogEntrySchema = object({
 	* `id` stays the source of truth for resolution/download/persistence; grouping
 	* is a presentation overlay resolved back to an `id`.
 	*/
-	group: ModelVariantGroupSchema.optional()
+	group: ModelVariantGroupSchema.optional(),
+	/**
+	* Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
+	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
+	* labels already ARE the CamStack macros (Scrypted identity map).
+	*/
+	classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -8338,7 +8878,8 @@ var ModelConvertMetadataSchema = object({
 		"ocr",
 		"segmentation"
 	]),
-	faceAlignment: boolean().optional()
+	faceAlignment: boolean().optional(),
+	classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertArtifactSchema = object({
 	format: _enum(MODEL_FORMATS),
@@ -14518,12 +15059,15 @@ var NcOccupancyConditionSchema = object({
 * there is no second switch that can disagree with the first and every rule
 * authored before the decision migrates for free (`audioModeOf`):
 *
-*  - **LABEL mode — `labels` present.** The rule fires on the FIRST frame the
-*    classifier labels with one of them. No window, no percentage:
-*    `hitPercent` and `samplingSeconds` are ignored, and the rule's own
-*    `throttle` cooldown is the only brake. The per-label confidence floor is
-*    the analyzer's (`classificationMinScore`, per device) — a label only
-*    reaches this condition if the classifier was already confident enough.
+*  - **LABEL mode — `labels` present.** The rule fires when `confirmHits`
+*    labelled frames land inside `confirmWindowSec` (default 2 in 5 s).
+*    `hitPercent` and `samplingSeconds` are still ignored — a percentage of
+*    frames is the wrong question for a classifier that labels 1–3 frames
+*    per episode. The count window is the brake that drops a single-frame
+*    false positive; the rule's own `throttle` cooldown is the other. The
+*    per-label confidence floor is the analyzer's (`classificationMinScore`,
+*    per device) — a label only reaches this condition if the classifier was
+*    already confident enough. `confirmHits: 1` restores first-frame fire.
 *  - **LEVEL mode — `dbThreshold` present, no labels.** The sampling window IS
 *    the condition: at least `hitPercent`% of the samples over
 *    `samplingSeconds` must be at or above `dbThreshold` dBFS (see
@@ -14550,14 +15094,22 @@ var NcOccupancyConditionSchema = object({
 * an operator who typed `dog` mean the same thing.
 */
 var NcAudioConditionSchema = object({
-	/** LABEL MODE: audio macro labels. Present ⇒ fires on the first labelled frame. */
+	/** LABEL MODE: audio macro labels. Present ⇒ count-in-window confirm. */
 	labels: array(string().min(1)).min(1).optional(),
 	/** LEVEL MODE: floor in dBFS (negative-going, `0` = full scale). */
 	dbThreshold: number().min(-96).max(0).optional(),
 	/** LEVEL MODE ONLY: percentage of the window's samples that must be hits (1–100). */
 	hitPercent: number().int().min(1).max(100).default(60),
 	/** LEVEL MODE ONLY: length of the sampling window in seconds. */
-	samplingSeconds: number().int().min(1).max(300).default(10)
+	samplingSeconds: number().int().min(1).max(300).default(10),
+	/**
+	* LABEL MODE: how many labelled frames must land inside
+	* {@link NcAudioConditionSchema.shape.confirmWindowSec} before dispatch.
+	* Absent ⇒ 2 (the matcher default). `1` is first-frame fire.
+	*/
+	confirmHits: number().int().min(1).max(20).optional(),
+	/** LABEL MODE: the window those frames must share, in seconds. Absent ⇒ 5. */
+	confirmWindowSec: number().int().min(1).max(60).optional()
 });
 /**
 * Which zone-crossing DIRECTION a rule accepts (`ObjectEvent.zoneCrossing`).
@@ -17006,7 +17558,9 @@ var TrackCascadeCountsSchema = object({
 	/** Unassigned plate reads removed (best-effort; plate leg deferred to plate-intelligence). */
 	plates: number().int(),
 	/** Per-track CLIP search vectors removed (best-effort). */
-	embeddings: number().int()
+	embeddings: number().int(),
+	/** Group membership + group rows removed with their last member (best-effort). */
+	groups: number().int()
 });
 /** Disk-wins reconcile: media rows whose blobs are gone, then empty tracks. */
 var DiskReconcileCountsSchema = object({
@@ -17370,6 +17924,33 @@ var NativeCropRefSchema = object({
 		h: number()
 	})
 });
+object({
+	crop: object({
+		left: number(),
+		top: number(),
+		width: number().positive(),
+		height: number().positive()
+	}).optional(),
+	content: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	fit: _enum(["stretch", "contain"]),
+	format: _enum([
+		"rgb",
+		"gray",
+		"jpeg"
+	])
+});
+var FrameRefSchema = object({
+	registryId: string().min(1),
+	id: string().min(1),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum(["rgb", "gray"]),
+	timestamp: number(),
+	capturedAt: number().optional()
+});
 var ModelFormatSchema$1 = _enum([
 	"onnx",
 	"coreml",
@@ -17614,6 +18195,12 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	steps: array(PipelineStepInputSchema).min(1),
 	frame: FrameInputSchema.optional(),
 	/**
+	* Process-local lazy frame. Valid only when caller and provider resolve
+	* in the same execution-group process; split/cross-node callers use
+	* `frame`/`image` inline compatibility instead.
+	*/
+	frameRef: FrameRefSchema.optional(),
+	/**
 	* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
 	* the decoded pixels live in. One more member of the one-of
 	* frame/frameHandle/image/imageBase64/referenceImage group.
@@ -17869,7 +18456,10 @@ var NativeCropResultSchema = object({
 	* Which source served this crop, so a quality-sensitive consumer (the native
 	* `keyFrame`) can reject a degraded fallback:
 	* - `native` — cut from the decode worker's retained NATIVE surface (the
-	*   quality path).
+	*   quality path). A subject-tile serve is also native-resolution and stays
+	*   `native` here: the public enum cannot name `tile` without a breaking cap
+	*   change. Runner telemetry distinguishes lease vs tile via `source` on the
+	*   internal crop result (`nativeHits` vs `tileHits`).
 	* - `ram-fullframe` — the native surface MISSED but the request was full-frame,
 	*   so the ≤640 RAM `RetainedFrameStore` served it (honest lower-res; legit for
 	*   the blank-frame guard / 640-snapshot resolve, NOT for the clean keyFrame).
@@ -18360,12 +18950,41 @@ var RunnerLocalLoadSchema = object({
 * legacy `OrchestratorMetricsSchema` shape so existing dashboards keep
 * working unchanged when they switch to reading from the runner cap.
 */
+var FrameLazyCountersSchema = object({
+	framesDecoded: number(),
+	framesAdmitted: number(),
+	framesDroppedPixelFree: number(),
+	viewsMaterialized: number(),
+	viewsSkipped: number(),
+	workerToRunnerBytes: number(),
+	runnerToPoolRawBytes: number(),
+	runnerToPoolJpegBytes: number(),
+	onDemandFullFrameRequests: number(),
+	onDemandCropRequests: number(),
+	nativeHits: number(),
+	nativeMisses: number(),
+	tileHits: number(),
+	tileMisses: number(),
+	fallbackHits: number(),
+	fallbackMisses: number(),
+	retainedWritesAvoided: number(),
+	residentRefs: number(),
+	residentBytes: number(),
+	releases: number(),
+	evictions: number(),
+	staleMisses: number()
+});
+var FrameLazyMetricsSchema = object({
+	node: FrameLazyCountersSchema,
+	cameras: array(FrameLazyCountersSchema.extend({ deviceId: number() }))
+});
 var RunnerLocalMetricsSchema = object({
 	nodeId: string(),
 	activeCameras: number(),
 	throttledCameras: number(),
 	avgInferenceTimeMs: number(),
-	queueDepth: number()
+	queueDepth: number(),
+	frameLazy: FrameLazyMetricsSchema.optional()
 });
 method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mutation" }), method(object({ deviceId: number() }), object({ success: literal(true) }), { kind: "mutation" }), method(ReportMotionInputSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), RunnerLocalLoadSchema), method(_void(), RunnerLocalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(_void(), array(CameraMetricsWithDeviceIdSchema).readonly()), method(_void(), array(number()).readonly()), method(object({
 	handle: FrameHandleSchema,
@@ -19665,6 +20284,9 @@ method(_void(), ProviderInfoSchema), method(object({ config: record(string(), un
 	location: StorageLocationSchema,
 	relativePath: string()
 }), _void(), { kind: "mutation" }), method(object({ location: StorageLocationSchema }), number().nullable()), method(BeginUploadInputSchema, BeginUploadResultSchema, { kind: "mutation" }), method(WriteChunkInputSchema, _void(), { kind: "mutation" }), method(FinalizeUploadInputSchema, _void(), { kind: "mutation" }), method(AbortUploadInputSchema, _void(), { kind: "mutation" }), method(BeginDownloadInputSchema, BeginDownloadResultSchema, { kind: "mutation" }), method(ReadChunkInputSchema, _instanceof(Uint8Array)), method(EndDownloadInputSchema, _void(), { kind: "mutation" });
+/** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
+var ProfileSettingsSchemaBridge = unknown().nullable();
+var ProfileSettingsBagSchema = record(string(), unknown());
 /**
 * A live terminal session hosted by the provider addon. Output and input do
 * NOT flow through the capability — they use the addon data plane
@@ -19694,7 +20316,14 @@ var TerminalSessionInfoSchema = object({
 var TerminalProfileInfoSchema = object({
 	profileId: string(),
 	label: string(),
-	description: string().optional()
+	description: string().optional(),
+	/** Spawn defaults the instance form copies on create. */
+	executable: string().optional(),
+	args: array(string()).readonly().optional(),
+	cwd: string().optional(),
+	environment: array(string()).readonly().optional(),
+	/** ConfigUISchema for instance knobs, or null when the profile has none. */
+	settingsSchema: ProfileSettingsSchemaBridge.optional()
 });
 /**
 * A durable operator-created Terminal instance. Profiles are templates; only
@@ -19707,7 +20336,12 @@ var TerminalInstanceInfoSchema = object({
 	profileId: string(),
 	profileLabel: string(),
 	name: string(),
-	enabled: boolean()
+	enabled: boolean(),
+	executable: string(),
+	args: array(string()).readonly(),
+	cwd: string(),
+	environment: array(string()).readonly(),
+	profileSettings: ProfileSettingsBagSchema
 });
 var TerminalLegacyCameraSchema = object({
 	stableId: string(),
@@ -19737,7 +20371,23 @@ var TerminalOutputBatchSchema = object({
 method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }), method(_void(), array(TerminalInstanceInfoSchema).readonly(), { auth: "admin" }), method(object({
 	targetNodeId: string().min(1),
 	profileId: string().min(1),
-	name: string().trim().min(1).max(160).optional()
+	name: string().trim().min(1).max(160).optional(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional(),
+	profileSettings: ProfileSettingsBagSchema.optional()
+}), TerminalInstanceInfoSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	instanceId: string().min(1),
+	name: string().trim().min(1).max(160).optional(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional(),
+	profileSettings: ProfileSettingsBagSchema.optional()
 }), TerminalInstanceInfoSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -19759,7 +20409,11 @@ method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }),
 }), method(_void(), array(TerminalSessionInfoSchema).readonly(), { auth: "admin" }), method(object({
 	profileId: string(),
 	cols: number().int().positive(),
-	rows: number().int().positive()
+	rows: number().int().positive(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional()
 }), TerminalSessionInfoSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -22541,10 +23195,10 @@ DeviceType.LawnMower, method(object({ deviceId: number().int().nonnegative() }),
 *
 *  • The SDK (mobile / web client) consumes `getConnectionEndpoints()`
 *    to receive an ordered list of candidate base URLs it should race
-*    on connect — LAN IPv4 first (lowest latency when on same network),
-*    then public hostname (if a tunnel is up), then IPv6. The SDK can
-*    race them with short timeouts and stick with the winner for the
-*    session.
+*    on connect — LAN IPv4 and stable LAN IPv6 first (lowest latency
+*    when on the same network), then public hostname (if a tunnel is
+*    up). The SDK can race them with short timeouts and stick with the
+*    winner for the session.
 *
 * Why hub-only: agents are not directly addressable by the operator's
 * clients — they reverse-connect to the hub. Exposing their interfaces
@@ -22699,6 +23353,17 @@ var NotificationEndpointSchema = object({
 	/** What the ranking currently resolves to (null when nothing is reachable). */
 	resolved: string().nullable()
 });
+/**
+* The URLs the SDK / viewer should race for API access. `baseUrls` empty =
+* AUTO (every LAN IPv4 + the public tunnel). `resolved` is what that choice
+* currently expands to, so the UI can show the effective set either way.
+*/
+var ViewerEndpointsSchema = object({
+	/** The operator's explicit race set, or empty for AUTO. */
+	baseUrls: array(string()).readonly(),
+	/** What the ranking currently resolves to (may be empty if nothing is up). */
+	resolved: array(string()).readonly()
+});
 var AllowedAddressesSchema = object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -22707,6 +23372,20 @@ var AllowedAddressesSchema = object({
 * Network Addresses admin page and persisted by the addon.
 */
 addresses: array(string()).readonly() });
+var TlsStatusSchema = object({
+	mode: _enum([
+		"generated",
+		"uploaded",
+		"disabled"
+	]),
+	leafFingerprintSha256: string().nullable(),
+	caFingerprintSha256: string().nullable(),
+	validTo: string().nullable(),
+	sans: array(string()),
+	caCertPem: string().nullable(),
+	reissueError: string().nullable(),
+	restartRequired: boolean()
+});
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
 	/**
 	* LEGACY HINT — do not send from new code. Kept optional so clients
@@ -22716,17 +23395,31 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*/
 	port: number().int().min(1).max(65535).optional(),
 	/** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
-	*  candidate. Default `true`. */
+	*  candidate. Default `false` — loopback is not a client route. */
 	includeLoopback: boolean().optional(),
-	/** Skip IPv6 entries. Some legacy clients can't parse them.
-	*  Default `false`. */
+	/** Skip IPv6 entries. Default `false` — the palette includes stable
+	*  LAN IPv6 (ICE/WebRTC uses dual-stack regardless). Pass `true` to
+	*  hide them. The viewer HTTP/WS race is `getViewerEndpoints`. */
 	ipv4Only: boolean().optional(),
 	/** Scheme to emit for LAN/loopback URLs. Default `'http'`.
 	*  Pass `'https'` when the caller is itself loaded over HTTPS
 	*  to avoid mixed-content blocks in the browser. The public
 	*  tunnel always emits `https://` regardless. */
 	scheme: _enum(["http", "https"]).optional()
-}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" });
+}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), ViewerEndpointsSchema), method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	certPem: string().min(1),
+	keyPem: string().min(1),
+	caPem: string().optional()
+}), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), object({ pem: string() })), method(_void(), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 object({
 	/** Lifecycle state of the lock. `jammed` means the motor reported
 	*  failure to reach the target — operator intervention required. */
@@ -28489,6 +29182,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.downloadCa": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -28513,18 +29212,42 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getTlsStatus": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"localNetwork.getViewerEndpoints": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.list": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.regenerateCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.resetAllowlistToBestMatch": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"localNetwork.revertToGeneratedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.setAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -28537,6 +29260,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.setViewerEndpoints": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"localNetwork.uploadCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -31417,6 +32152,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.updateInstance": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.writeInput": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -33904,6 +34645,35 @@ Object.freeze(Object.fromEntries([{
 	}]
 }].map((s) => [s.stepId, s.defaultModelId])));
 string().min(1);
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -34153,7 +34923,8 @@ function buildEntry(metadata, artifacts) {
 		...metadata.inputLayout !== void 0 ? { inputLayout: metadata.inputLayout } : {},
 		...metadata.inputNormalization !== void 0 ? { inputNormalization: metadata.inputNormalization } : {},
 		...metadata.preprocessMode !== void 0 ? { preprocessMode: metadata.preprocessMode } : {},
-		...metadata.faceAlignment !== void 0 ? { faceAlignment: metadata.faceAlignment } : {}
+		...metadata.faceAlignment !== void 0 ? { faceAlignment: metadata.faceAlignment } : {},
+		...metadata.classMap !== void 0 ? { classMap: metadata.classMap } : {}
 	};
 }
 function buildModelConvertProvider(deps) {
@@ -34690,6 +35461,45 @@ var ModelNodeAvailabilitySchema = object({
 });
 /** `modelId → nodeId → availability`. */
 var ModelAvailabilityMapSchema = record(string(), record(string(), ModelNodeAvailabilitySchema));
+var ScryptedManifestFileSchema = object({
+	relativePath: string(),
+	size: number(),
+	sha256: string().regex(/^[0-9a-f]{64}$/)
+});
+var ScryptedManifestEntrySchema = object({
+	id: string(),
+	label: string(),
+	family: _enum([
+		"yolov9t",
+		"yolov9s",
+		"yolov9m",
+		"yolov9c"
+	]),
+	variant: _enum(["relu", "relu_test"]),
+	format: _enum([
+		"coreml",
+		"onnx",
+		"openvino",
+		"tflite"
+	]),
+	precision: string(),
+	inputSize: object({
+		width: number(),
+		height: number()
+	}),
+	files: array(ScryptedManifestFileSchema).readonly(),
+	model: ModelCatalogEntrySchema
+});
+var ScryptedCatalogDriftSchema = object({
+	manifestId: string(),
+	status: _enum([
+		"ok",
+		"missing",
+		"size-changed",
+		"unavailable"
+	]),
+	details: string().optional()
+});
 var modelStudioActions = defineCustomActions({
 	registerCustomModel: customAction(CustomModelDescriptorSchema, object({ ok: literal(true) }), { kind: "mutation" }),
 	removeCustomModel: customAction(object({ modelId: string() }), object({ removed: boolean() }), { kind: "mutation" }),
@@ -34756,6 +35566,16 @@ var modelStudioActions = defineCustomActions({
 		bytes: number()
 	}), { kind: "mutation" }),
 	/**
+	* Local Scrypted YOLO catalog (Task 7B). Listing is a projection of the
+	* revision-pinned manifesto plus a read-only HF drift check. Import accepts
+	* ONLY `manifestId` — host/repo/revision/path/labels/checksum stay server-owned.
+	*/
+	listScryptedCatalog: customAction(_void(), object({
+		entries: array(ScryptedManifestEntrySchema).readonly(),
+		drift: array(ScryptedCatalogDriftSchema).readonly()
+	})),
+	importScryptedCatalogModel: customAction(object({ manifestId: string() }), CustomModelDescriptorSchema, { kind: "mutation" }),
+	/**
 	* Frigate+ personal models. The API key lives in the addon's SETTINGS
 	* (password field) and never leaves the hub: list / test / import all run
 	* server-side against api.frigate.video. Status deliberately reveals only
@@ -35020,6 +35840,8 @@ var ModelStudioAddon = class ModelStudioAddon extends BaseAddon {
 					notes: c.notes
 				})),
 				importFrigateCatalogModel: async (input) => this.importFrigateCatalogModel(input),
+				listScryptedCatalog: async () => this.listScryptedCatalog(),
+				importScryptedCatalogModel: async (input) => this.importScryptedCatalogFromManifest(input),
 				tfliteSupport: async () => {
 					const api = this.ctx.api;
 					if (!api) return { nodes: [] };
@@ -35212,6 +36034,78 @@ var ModelStudioAddon = class ModelStudioAddon extends BaseAddon {
 		return hash.digest("hex");
 	}
 	/**
+	* Projection of the local Scrypted YOLO manifesto plus a read-only HF drift
+	* check. Network errors become `unavailable` rows — the manifesto is never
+	* mutated and nothing is auto-imported.
+	*/
+	async listScryptedCatalog() {
+		try {
+			return {
+				entries: SCRYPTED_YOLO_MANIFEST,
+				drift: compareScryptedManifestDrift(SCRYPTED_YOLO_MANIFEST, await fetchScryptedRemoteTree({ fetchImpl: fetch })).map(normalizeScryptedDrift)
+			};
+		} catch (err) {
+			const details = err instanceof Error ? err.message : "Hugging Face tree unavailable";
+			return {
+				entries: SCRYPTED_YOLO_MANIFEST,
+				drift: SCRYPTED_YOLO_MANIFEST.map((entry) => ({
+					manifestId: entry.id,
+					status: "unavailable",
+					details
+				}))
+			};
+		}
+	}
+	/**
+	* Import one manifesto entry by id. Host/repo/revision/path stay server-owned.
+	*/
+	async importScryptedCatalogFromManifest(input) {
+		const modelsDir = await this.resolveModelsDir();
+		const descriptor = await importScryptedCatalogModel(input, {
+			stagingDir: path.join(this.ctx.dataDir ?? os.tmpdir(), "scrypted-import"),
+			modelsDir,
+			downloadFile: (url, destPath) => downloadFile(url, destPath, {
+				redirectPolicy: assertScryptedDownloadUrl,
+				maxBytes: SCRYPTED_IMPORT_MAX_FILE_BYTES,
+				timeoutMs: 6e4
+			}),
+			driftFor: async (manifestId) => {
+				try {
+					const tree = await fetchScryptedRemoteTree({ fetchImpl: fetch });
+					const row = compareScryptedManifestDrift(SCRYPTED_YOLO_MANIFEST.filter((entry) => entry.id === manifestId), tree)[0];
+					return normalizeScryptedDrift(row ?? {
+						manifestId,
+						status: "missing",
+						details: "entry missing from manifesto"
+					});
+				} catch (err) {
+					return {
+						manifestId,
+						status: "unavailable",
+						details: err instanceof Error ? err.message : "Hugging Face tree unavailable"
+					};
+				}
+			}
+		});
+		await this.registerCustomModel(descriptor);
+		const format = resolveScryptedImportedFormat(input.manifestId, descriptor);
+		const manifestEntry = getScryptedManifestEntry(input.manifestId);
+		if (!manifestEntry) throw new Error(`Imported Scrypted catalog model is missing manifesto entry ${input.manifestId}`);
+		const bytes = Math.round((descriptor.entry.formats[format]?.sizeMB ?? 0) * 1e6);
+		await this.availability_.update((prev) => upsertAvailability(prev, descriptor.entry.id, "hub", {
+			format,
+			sha256: scryptedBundleFingerprint(manifestEntry),
+			bytes,
+			at: Date.now()
+		}));
+		this.ctx.logger.info("Imported Scrypted catalog model", { meta: {
+			manifestId: input.manifestId,
+			modelId: descriptor.entry.id,
+			bytes
+		} });
+		return descriptor;
+	}
+	/**
 	* Import a curated PUBLIC Frigate catalog model: download SERVER-SIDE into
 	* the hub's modelsDir (size-verified against the curated declaration),
 	* register the descriptor with the PUBLIC url (nodes download on demand),