@camstack/addon-osd-manager 0.1.19 → 0.1.21

package/dist/index.mjs

@@ -5800,6 +5800,13 @@ var BaseAddon = class {
 	_readinessGeneration = typeof crypto !== "undefined" && crypto.randomUUID ? crypto.randomUUID() : Math.random().toString(36).slice(2, 14);
 	/** Capability names this addon registered at init — used to emit matching `down` events on shutdown. */
 	_registeredCapNames = [];
+	/**
+	* True only after `readAddonStore` actually answered. Constructor
+	* defaults look like stored config when the store is down — a forked
+	* addon that auto-starts from those defaults (cloudflare-tunnel quick
+	* mode, 2026-08-25) is not "the operator chose this".
+	*/
+	settingsStoreReady = false;
 	/** Default config values. Provided via constructor. */
 	defaults;
 	constructor(defaults) {
@@ -6200,7 +6207,9 @@ var BaseAddon = class {
 		];
 		let lastErr;
 		for (let attempt = 0; attempt <= delaysMs.length; attempt++) try {
-			return await settings.readAddonStore() ?? {};
+			const stored = await settings.readAddonStore() ?? {};
+			this.settingsStoreReady = true;
+			return stored;
 		} catch (err) {
 			lastErr = err;
 			const msg = err instanceof Error ? err.message : String(err);
@@ -6208,6 +6217,7 @@ var BaseAddon = class {
 			if (attempt === delaysMs.length) break;
 			await new Promise((r) => setTimeout(r, delaysMs[attempt]));
 		}
+		this.settingsStoreReady = false;
 		this._ctx?.logger?.warn?.("readAddonStore: settings-store unavailable after retries — using defaults", { meta: { error: lastErr instanceof Error ? lastErr.message : String(lastErr) } });
 		return {};
 	}
@@ -8091,6 +8101,15 @@ var LabelDefinitionSchema = object({
 	description: string().optional(),
 	icon: string().optional()
 });
+var ClassMapDefinitionSchema = object({
+	mapping: record(string(), _enum([
+		"person",
+		"vehicle",
+		"animal",
+		"package"
+	])),
+	preserveOriginal: boolean()
+});
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -8174,6 +8193,12 @@ var ModelVariantGroupSchema = object({
 	*/
 	resolution: number().int().positive().optional()
 });
+var ModelProviderIdSchema = _enum([
+	"camstack",
+	"frigate",
+	"scrypted",
+	"custom"
+]);
 var ModelCatalogEntrySchema = object({
 	id: string(),
 	name: string(),
@@ -8269,7 +8294,19 @@ var ModelCatalogEntrySchema = object({
 	* `id` stays the source of truth for resolution/download/persistence; grouping
 	* is a presentation overlay resolved back to an `id`.
 	*/
-	group: ModelVariantGroupSchema.optional()
+	group: ModelVariantGroupSchema.optional(),
+	/**
+	* Catalog source for the pipeline stepper's provider-first picker. Absent on
+	* built-in CamStack entries (treated as `camstack`) and on registry rows
+	* persisted before this field existed (`inferModelProvider` fills those).
+	*/
+	provider: ModelProviderIdSchema.optional(),
+	/**
+	* Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
+	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
+	* labels already ARE the CamStack macros (Scrypted identity map).
+	*/
+	classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -8298,7 +8335,8 @@ var ModelConvertMetadataSchema = object({
 		"ocr",
 		"segmentation"
 	]),
-	faceAlignment: boolean().optional()
+	faceAlignment: boolean().optional(),
+	classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertResultSchema = object({
 	entry: ModelCatalogEntrySchema,
@@ -12864,6 +12902,27 @@ var LinkedDeviceSchema = object({
 	features: array(string()),
 	producesTrackedEvents: boolean().optional()
 });
+/** One camera's resolved linked set, tagged with the camera it belongs to.
+*  The batch answer needs the tag; the single-device answer already has it
+*  from the input, which is why `getLinkedDevices` keeps the untagged shape. */
+var LinkedDevicesForDeviceSchema = object({
+	deviceId: number(),
+	mode: LinkedDevicesModeSchema,
+	devices: array(LinkedDeviceSchema)
+});
+/** One device's binding map — the shape `getBindings`, `getBindingsBatch` and
+*  `getAllBindings` all answer in. Declared once: three copies of the same
+*  object literal is exactly how the three drift apart. */
+var DeviceBindingsForDeviceSchema = object({
+	deviceId: number(),
+	entries: array(object({
+		capName: string(),
+		kind: _enum(["native", "wrapped"]),
+		providerAddonId: string(),
+		providerNodeId: string(),
+		nativeAddonId: string()
+	}))
+});
 var SavedDeviceRowSchema = object({
 	/** Numeric id reserved at allocateDeviceId time. */
 	id: number(),
@@ -13226,7 +13285,21 @@ var deviceManagerCapability = {
 			projection: _enum(["full", "slim"]).optional(),
 			/** Return only camera devices. Filtering server-side instead of
 			*  shipping 293 rows to find 12. */
-			isCamera: boolean().optional()
+			isCamera: boolean().optional(),
+			/**
+			* Return only these device ids. For the caller that already KNOWS the
+			* handful it wants and needs a field the id-bearing answer does not
+			* carry — the viewer's linked-devices panel joins `type` and `online`
+			* onto ~8 linked ids and, unfiltered, dragged the fleet across to do
+			* it: 433 KB slim / 958 KB full for 967 devices, on a query that
+			* refetches on the reconcile interval, on a phone.
+			*
+			* Safe to send at a hub that predates it: Zod STRIPS unknown input
+			* keys rather than rejecting them (verified against the live hub
+			* 2026-08-25 — 967 rows came back), so an old hub answers exactly what
+			* it answers today and the caller filters as it already does.
+			*/
+			deviceIds: array(number()).optional()
 		}), array(DeviceInfoSchema)),
 		/** Get a single device by numeric deviceId. */
 		getDevice: method(object({ deviceId: number() }), DeviceInfoSchema.nullable()),
@@ -13245,6 +13318,23 @@ var deviceManagerCapability = {
 			mode: LinkedDevicesModeSchema,
 			devices: array(LinkedDeviceSchema)
 		})),
+		/**
+		* `getLinkedDevices` for MANY cameras, in one call.
+		*
+		* Not a convenience wrapper — a cost fix. Resolving one camera's linked set
+		* needs the whole fleet as candidates (children ∪ same-location), so the
+		* single-device path runs a full `listAll` per call. Asked per camera that
+		* is N full-fleet sweeps of device-manager's event loop, and they do not
+		* overlap: measured on the live hub 2026-08-25, 30 concurrent
+		* `getLinkedDevices` took 4110 ms wall (median 4060 ms each) to return
+		* 7260 bytes in total. The batch takes ONE sweep and one settings read per
+		* camera.
+		*
+		* A device id that resolves to nothing still gets a row (`devices: []`) —
+		* a caller that asked for thirty and got twenty-eight cannot tell which two
+		* are missing, or that any are.
+		*/
+		getLinkedDevicesBatch: method(object({ deviceIds: array(number()) }), array(LinkedDevicesForDeviceSchema)),
 		/** Get stream sources for a camera device. */
 		getStreamSources: method(object({ deviceId: number() }), array(StreamSourceEntrySchema$1)),
 		/** Get config entries (key + value + description) for a device. */
@@ -13302,16 +13392,22 @@ var deviceManagerCapability = {
 		* currently-active provider (native or wrapper) + the underlying native
 		* addon id, so consumers can decide routing without re-running discovery.
 		*/
-		getBindings: method(object({ deviceId: number() }), object({
-			deviceId: number(),
-			entries: array(object({
-				capName: string(),
-				kind: _enum(["native", "wrapped"]),
-				providerAddonId: string(),
-				providerNodeId: string(),
-				nativeAddonId: string()
-			}))
-		})),
+		getBindings: method(object({ deviceId: number() }), DeviceBindingsForDeviceSchema),
+		/**
+		* `getBindings` for a NAMED set of devices, in one call.
+		*
+		* Between `getBindings` (one device) and `getAllBindings` (all 988) there
+		* was nothing, so a caller that needs seventy-five either pays
+		* seventy-five round-trips or drags the whole fleet across. Measured on
+		* the live hub 2026-08-25: 75 concurrent `getBindings` = 1211 ms / 118 KB,
+		* `getAllBindings({})` = 511 ms / 679 KB. Neither is the right answer to
+		* "these seventy-five".
+		*
+		* Same resolver, same routing rules, same per-device shape as
+		* `getBindings`; ids are deduped and a device with no bindings answers
+		* `entries: []` rather than dropping out.
+		*/
+		getBindingsBatch: method(object({ deviceIds: array(number()) }), array(DeviceBindingsForDeviceSchema)),
 		/**
 		* Return the binding map for every device known to the hub. Used by
 		* `SystemManager` warm-boot: a single round-trip resolves the
@@ -13320,16 +13416,7 @@ var deviceManagerCapability = {
 		* device add/remove) — clients invalidate via the
 		* `capability.binding-changed` event.
 		*/
-		getAllBindings: method(object({}), array(object({
-			deviceId: number(),
-			entries: array(object({
-				capName: string(),
-				kind: _enum(["native", "wrapped"]),
-				providerAddonId: string(),
-				providerNodeId: string(),
-				nativeAddonId: string()
-			}))
-		}))),
+		getAllBindings: method(object({}), array(DeviceBindingsForDeviceSchema)),
 		/**
 		* Activate (or deactivate) a wrapper addon for a (device, cap) pair.
 		* Persists the binding via ctx.settings. active=false clears the wrapper
@@ -16217,12 +16304,15 @@ var NcOccupancyConditionSchema = object({
 * there is no second switch that can disagree with the first and every rule
 * authored before the decision migrates for free (`audioModeOf`):
 *
-*  - **LABEL mode — `labels` present.** The rule fires on the FIRST frame the
-*    classifier labels with one of them. No window, no percentage:
-*    `hitPercent` and `samplingSeconds` are ignored, and the rule's own
-*    `throttle` cooldown is the only brake. The per-label confidence floor is
-*    the analyzer's (`classificationMinScore`, per device) — a label only
-*    reaches this condition if the classifier was already confident enough.
+*  - **LABEL mode — `labels` present.** The rule fires when `confirmHits`
+*    labelled frames land inside `confirmWindowSec` (default 2 in 5 s).
+*    `hitPercent` and `samplingSeconds` are still ignored — a percentage of
+*    frames is the wrong question for a classifier that labels 1–3 frames
+*    per episode. The count window is the brake that drops a single-frame
+*    false positive; the rule's own `throttle` cooldown is the other. The
+*    per-label confidence floor is the analyzer's (`classificationMinScore`,
+*    per device) — a label only reaches this condition if the classifier was
+*    already confident enough. `confirmHits: 1` restores first-frame fire.
 *  - **LEVEL mode — `dbThreshold` present, no labels.** The sampling window IS
 *    the condition: at least `hitPercent`% of the samples over
 *    `samplingSeconds` must be at or above `dbThreshold` dBFS (see
@@ -16249,14 +16339,22 @@ var NcOccupancyConditionSchema = object({
 * an operator who typed `dog` mean the same thing.
 */
 var NcAudioConditionSchema = object({
-	/** LABEL MODE: audio macro labels. Present ⇒ fires on the first labelled frame. */
+	/** LABEL MODE: audio macro labels. Present ⇒ count-in-window confirm. */
 	labels: array(string().min(1)).min(1).optional(),
 	/** LEVEL MODE: floor in dBFS (negative-going, `0` = full scale). */
 	dbThreshold: number().min(-96).max(0).optional(),
 	/** LEVEL MODE ONLY: percentage of the window's samples that must be hits (1–100). */
 	hitPercent: number().int().min(1).max(100).default(60),
 	/** LEVEL MODE ONLY: length of the sampling window in seconds. */
-	samplingSeconds: number().int().min(1).max(300).default(10)
+	samplingSeconds: number().int().min(1).max(300).default(10),
+	/**
+	* LABEL MODE: how many labelled frames must land inside
+	* {@link NcAudioConditionSchema.shape.confirmWindowSec} before dispatch.
+	* Absent ⇒ 2 (the matcher default). `1` is first-frame fire.
+	*/
+	confirmHits: number().int().min(1).max(20).optional(),
+	/** LABEL MODE: the window those frames must share, in seconds. Absent ⇒ 5. */
+	confirmWindowSec: number().int().min(1).max(60).optional()
 });
 /**
 * Which zone-crossing DIRECTION a rule accepts (`ObjectEvent.zoneCrossing`).
@@ -19181,6 +19279,46 @@ var RecentTracksPageSchema = object({
 	/** Cursor for the next page, or null when this page is the last. */
 	nextCursor: string().nullable()
 });
+var LIST_GROUPS_DEFAULT_LIMIT = 40;
+var LIST_GROUPS_MAX_LIMIT = 100;
+var AnalyticsGroupRecordSchema = object({
+	id: string(),
+	deviceId: number().int(),
+	openedAt: number().int(),
+	closedAt: number().int(),
+	timestamp: number().int(),
+	memberCount: number().int(),
+	memberTrackIds: array(string()).readonly(),
+	className: string(),
+	classes: array(string()).readonly(),
+	/** Relative event-media path, or null when the group has no picture yet. */
+	mediaUrl: string().nullable(),
+	singleton: boolean()
+});
+var AnalyticsGroupMemberSchema = object({
+	trackId: string(),
+	deviceId: number().int(),
+	className: string(),
+	firstSeen: number().int(),
+	lastSeen: number().int(),
+	mediaUrl: string().nullable()
+});
+var AnalyticsGroupDetailSchema = AnalyticsGroupRecordSchema.extend({ members: array(AnalyticsGroupMemberSchema).readonly() });
+var ListGroupsQueryInput = object({
+	/** Devices to merge. An empty array yields `{ groups: [], nextCursor: null }`. */
+	deviceIds: array(number()),
+	/** Window lower bound on `closedAt` (inclusive). */
+	since: number().optional(),
+	/** Window upper bound on `openedAt` (inclusive). */
+	until: number().optional(),
+	limit: number().int().min(1).max(LIST_GROUPS_MAX_LIMIT).default(LIST_GROUPS_DEFAULT_LIMIT),
+	/** Opaque continuation cursor from a previous page's `nextCursor`. */
+	cursor: string().optional()
+});
+var ListGroupsPageSchema = object({
+	groups: array(AnalyticsGroupRecordSchema).readonly(),
+	nextCursor: string().nullable()
+});
 var KeyEventQueryInput = object({
 	deviceId: number(),
 	/** Window lower bound (track firstSeen ≥ since). */
@@ -19256,7 +19394,9 @@ var TrackCascadeCountsSchema = object({
 	/** Unassigned plate reads removed (best-effort; plate leg deferred to plate-intelligence). */
 	plates: number().int(),
 	/** Per-track CLIP search vectors removed (best-effort). */
-	embeddings: number().int()
+	embeddings: number().int(),
+	/** Group membership + group rows removed with their last member (best-effort). */
+	groups: number().int()
 });
 /** Disk-wins reconcile: media rows whose blobs are gone, then empty tracks. */
 var DiskReconcileCountsSchema = object({
@@ -19428,6 +19568,16 @@ var pipelineAnalyticsCapability = {
 		* are not included (same contract as `listTracks`).
 		*/
 		listRecentTracks: method(RecentTracksQueryInput, RecentTracksPageSchema),
+		/**
+		* Batched co-moving group listing — the Groups feed. Same merge/cursor
+		* contract as {@link listRecentTracks}. A group is a sealed partition of
+		* one session; `getGroup` is the detail with members.
+		*/
+		listGroups: method(ListGroupsQueryInput, ListGroupsPageSchema),
+		getGroup: method(object({
+			deviceId: number(),
+			groupId: string().min(1)
+		}), AnalyticsGroupDetailSchema.nullable()),
 		clearTracks: method(object({ deviceId: number() }), _void(), {
 			kind: "mutation",
 			auth: "admin"
@@ -20021,6 +20171,33 @@ var NativeCropRefSchema = object({
 		h: number()
 	})
 });
+object({
+	crop: object({
+		left: number(),
+		top: number(),
+		width: number().positive(),
+		height: number().positive()
+	}).optional(),
+	content: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	fit: _enum(["stretch", "contain"]),
+	format: _enum([
+		"rgb",
+		"gray",
+		"jpeg"
+	])
+});
+var FrameRefSchema = object({
+	registryId: string().min(1),
+	id: string().min(1),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum(["rgb", "gray"]),
+	timestamp: number(),
+	capturedAt: number().optional()
+});
 var ModelFormatSchema$1 = _enum([
 	"onnx",
 	"coreml",
@@ -20086,7 +20263,8 @@ var PipelineModelOptionSchema = object({
 		sizeMB: number()
 	})),
 	group: ModelVariantGroupSchema.optional(),
-	legacy: boolean().optional()
+	legacy: boolean().optional(),
+	provider: ModelProviderIdSchema.optional()
 });
 var ConfigFieldBridge = custom();
 var PipelineAddonSchemaSchema = object({
@@ -20341,7 +20519,7 @@ var pipelineExecutorCapability = {
 		* legacy call shape used by existing benchmark code; once all
 		* callers pass it explicitly we make it required.
 		*
-		* Exactly one of `frame`, `frameHandle`, `imageBase64`,
+		* Exactly one of `frame`, `frameRef`, `frameHandle`, `imageBase64`,
 		* `referenceImage` must be provided:
 		*  - `frame`: runtime dispatch path (runner → decoded broker frame).
 		*    Carries the raw buffer, dimensions, and format; the executor
@@ -20363,6 +20541,12 @@ var pipelineExecutorCapability = {
 			steps: array(PipelineStepInputSchema).min(1),
 			frame: FrameInputSchema.optional(),
 			/**
+			* Process-local lazy frame. Valid only when caller and provider resolve
+			* in the same execution-group process; split/cross-node callers use
+			* `frame`/`image` inline compatibility instead.
+			*/
+			frameRef: FrameRefSchema.optional(),
+			/**
 			* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
 			* the decoded pixels live in. One more member of the one-of
 			* frame/frameHandle/image/imageBase64/referenceImage group.
@@ -20712,7 +20896,10 @@ var NativeCropResultSchema = object({
 	* Which source served this crop, so a quality-sensitive consumer (the native
 	* `keyFrame`) can reject a degraded fallback:
 	* - `native` — cut from the decode worker's retained NATIVE surface (the
-	*   quality path).
+	*   quality path). A subject-tile serve is also native-resolution and stays
+	*   `native` here: the public enum cannot name `tile` without a breaking cap
+	*   change. Runner telemetry distinguishes lease vs tile via `source` on the
+	*   internal crop result (`nativeHits` vs `tileHits`).
 	* - `ram-fullframe` — the native surface MISSED but the request was full-frame,
 	*   so the ≤640 RAM `RetainedFrameStore` served it (honest lower-res; legit for
 	*   the blank-frame guard / 640-snapshot resolve, NOT for the clean keyFrame).
@@ -21203,12 +21390,41 @@ var RunnerLocalLoadSchema = object({
 * legacy `OrchestratorMetricsSchema` shape so existing dashboards keep
 * working unchanged when they switch to reading from the runner cap.
 */
+var FrameLazyCountersSchema = object({
+	framesDecoded: number(),
+	framesAdmitted: number(),
+	framesDroppedPixelFree: number(),
+	viewsMaterialized: number(),
+	viewsSkipped: number(),
+	workerToRunnerBytes: number(),
+	runnerToPoolRawBytes: number(),
+	runnerToPoolJpegBytes: number(),
+	onDemandFullFrameRequests: number(),
+	onDemandCropRequests: number(),
+	nativeHits: number(),
+	nativeMisses: number(),
+	tileHits: number(),
+	tileMisses: number(),
+	fallbackHits: number(),
+	fallbackMisses: number(),
+	retainedWritesAvoided: number(),
+	residentRefs: number(),
+	residentBytes: number(),
+	releases: number(),
+	evictions: number(),
+	staleMisses: number()
+});
+var FrameLazyMetricsSchema = object({
+	node: FrameLazyCountersSchema,
+	cameras: array(FrameLazyCountersSchema.extend({ deviceId: number() }))
+});
 var RunnerLocalMetricsSchema = object({
 	nodeId: string(),
 	activeCameras: number(),
 	throttledCameras: number(),
 	avgInferenceTimeMs: number(),
-	queueDepth: number()
+	queueDepth: number(),
+	frameLazy: FrameLazyMetricsSchema.optional()
 });
 /**
 * Pipeline Runner capability — runtime detection workhorse.
@@ -23240,6 +23456,9 @@ var storageProviderCapability = {
 		endDownload: method(EndDownloadInputSchema, _void(), { kind: "mutation" })
 	}
 };
+/** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
+var ProfileSettingsSchemaBridge = unknown().nullable();
+var ProfileSettingsBagSchema = record(string(), unknown());
 /**
 * A live terminal session hosted by the provider addon. Output and input do
 * NOT flow through the capability — they use the addon data plane
@@ -23269,7 +23488,14 @@ var TerminalSessionInfoSchema = object({
 var TerminalProfileInfoSchema = object({
 	profileId: string(),
 	label: string(),
-	description: string().optional()
+	description: string().optional(),
+	/** Spawn defaults the instance form copies on create. */
+	executable: string().optional(),
+	args: array(string()).readonly().optional(),
+	cwd: string().optional(),
+	environment: array(string()).readonly().optional(),
+	/** ConfigUISchema for instance knobs, or null when the profile has none. */
+	settingsSchema: ProfileSettingsSchemaBridge.optional()
 });
 /**
 * A durable operator-created Terminal instance. Profiles are templates; only
@@ -23282,7 +23508,12 @@ var TerminalInstanceInfoSchema = object({
 	profileId: string(),
 	profileLabel: string(),
 	name: string(),
-	enabled: boolean()
+	enabled: boolean(),
+	executable: string(),
+	args: array(string()).readonly(),
+	cwd: string(),
+	environment: array(string()).readonly(),
+	profileSettings: ProfileSettingsBagSchema
 });
 var TerminalLegacyCameraSchema = object({
 	stableId: string(),
@@ -23328,7 +23559,24 @@ var terminalSessionCapability = {
 		createInstance: method(object({
 			targetNodeId: string().min(1),
 			profileId: string().min(1),
-			name: string().trim().min(1).max(160).optional()
+			name: string().trim().min(1).max(160).optional(),
+			executable: string().max(1024).optional(),
+			args: array(string().max(2048)).max(64).optional(),
+			cwd: string().max(1024).optional(),
+			environment: array(string().max(4096)).max(64).optional(),
+			profileSettings: ProfileSettingsBagSchema.optional()
+		}), TerminalInstanceInfoSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateInstance: method(object({
+			instanceId: string().min(1),
+			name: string().trim().min(1).max(160).optional(),
+			executable: string().max(1024).optional(),
+			args: array(string().max(2048)).max(64).optional(),
+			cwd: string().max(1024).optional(),
+			environment: array(string().max(4096)).max(64).optional(),
+			profileSettings: ProfileSettingsBagSchema.optional()
 		}), TerminalInstanceInfoSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -23363,7 +23611,11 @@ var terminalSessionCapability = {
 		openSession: method(object({
 			profileId: string(),
 			cols: number().int().positive(),
-			rows: number().int().positive()
+			rows: number().int().positive(),
+			executable: string().max(1024).optional(),
+			args: array(string().max(2048)).max(64).optional(),
+			cwd: string().max(1024).optional(),
+			environment: array(string().max(4096)).max(64).optional()
 		}), TerminalSessionInfoSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -27741,10 +27993,10 @@ var lawnMowerControlCapability = {
 *
 *  • The SDK (mobile / web client) consumes `getConnectionEndpoints()`
 *    to receive an ordered list of candidate base URLs it should race
-*    on connect — LAN IPv4 first (lowest latency when on same network),
-*    then public hostname (if a tunnel is up), then IPv6. The SDK can
-*    race them with short timeouts and stick with the winner for the
-*    session.
+*    on connect — LAN IPv4 and stable LAN IPv6 first (lowest latency
+*    when on the same network), then public hostname (if a tunnel is
+*    up). The SDK can race them with short timeouts and stick with the
+*    winner for the session.
 *
 * Why hub-only: agents are not directly addressable by the operator's
 * clients — they reverse-connect to the hub. Exposing their interfaces
@@ -27899,6 +28151,17 @@ var NotificationEndpointSchema = object({
 	/** What the ranking currently resolves to (null when nothing is reachable). */
 	resolved: string().nullable()
 });
+/**
+* The URLs the SDK / viewer should race for API access. `baseUrls` empty =
+* AUTO (every LAN IPv4 + the public tunnel). `resolved` is what that choice
+* currently expands to, so the UI can show the effective set either way.
+*/
+var ViewerEndpointsSchema = object({
+	/** The operator's explicit race set, or empty for AUTO. */
+	baseUrls: array(string()).readonly(),
+	/** What the ranking currently resolves to (may be empty if nothing is up). */
+	resolved: array(string()).readonly()
+});
 var AllowedAddressesSchema = object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -27907,6 +28170,20 @@ var AllowedAddressesSchema = object({
 * Network Addresses admin page and persisted by the addon.
 */
 addresses: array(string()).readonly() });
+var TlsStatusSchema = object({
+	mode: _enum([
+		"generated",
+		"uploaded",
+		"disabled"
+	]),
+	leafFingerprintSha256: string().nullable(),
+	caFingerprintSha256: string().nullable(),
+	validTo: string().nullable(),
+	sans: array(string()),
+	caCertPem: string().nullable(),
+	reissueError: string().nullable(),
+	restartRequired: boolean()
+});
 var localNetworkCapability = {
 	name: "local-network",
 	scope: "system",
@@ -27926,13 +28203,13 @@ var localNetworkCapability = {
 		*/
 		getPreferred: method(_void(), PreferredSchema),
 		/**
-		* Ordered candidate base URLs the SDK should try on connect.
-		* Includes LAN IPs (one per non-internal interface), the public
-		* tunnel hostname (when active), and loopback as a last-resort
-		* fallback. Filterable by `includeLoopback` / `ipv4Only`.
-		* Honours `getAllowedAddresses()` when set — addresses outside
-		* the allowlist are dropped (the public tunnel + loopback are
-		* always included as escape hatches).
+		* Ordered candidate base URLs (the palette the Network tab shows).
+		* Includes LAN IPv4, stable LAN IPv6, the public tunnel, and mesh when
+		* joined. Loopback is off by default. The SDK races the subset from
+		* `getViewerEndpoints`, not this full list — IPv6 stays here because
+		* WebRTC ICE gathers dual-stack regardless of the HTTP race. Honours
+		* `getAllowedAddresses()` when set — addresses outside the allowlist
+		* are dropped (the public tunnel is still included as an escape hatch).
 		*
 		* **The port is the hub's, not the caller's** (D62 — a function's fact
 		* belongs to whoever already owns it). This method used to take a `port`
@@ -27963,10 +28240,11 @@ var localNetworkCapability = {
 			*/
 			port: number().int().min(1).max(65535).optional(),
 			/** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
-			*  candidate. Default `true`. */
+			*  candidate. Default `false` — loopback is not a client route. */
 			includeLoopback: boolean().optional(),
-			/** Skip IPv6 entries. Some legacy clients can't parse them.
-			*  Default `false`. */
+			/** Skip IPv6 entries. Default `false` — the palette includes stable
+			*  LAN IPv6 (ICE/WebRTC uses dual-stack regardless). Pass `true` to
+			*  hide them. The viewer HTTP/WS race is `getViewerEndpoints`. */
 			ipv4Only: boolean().optional(),
 			/** Scheme to emit for LAN/loopback URLs. Default `'http'`.
 			*  Pass `'https'` when the caller is itself loaded over HTTPS
@@ -27995,6 +28273,19 @@ var localNetworkCapability = {
 		*/
 		setNotificationEndpoint: method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }),
 		/**
+		* The endpoints the SDK / viewer races for API access. Empty `baseUrls`
+		* means AUTO: every LAN IPv4 address plus the public tunnel, never IPv6,
+		* never mesh, never loopback. `resolved` is that set (or the operator's
+		* explicit subset) as it stands right now.
+		*/
+		getViewerEndpoints: method(_void(), ViewerEndpointsSchema),
+		/**
+		* Replace the viewer race set. Empty `baseUrls` restores AUTO. Stored
+		* verbatim (not indices) so a temporarily-down tunnel is not silently
+		* dropped from the operator's choice.
+		*/
+		setViewerEndpoints: method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }),
+		/**
 		* Read the operator's allowlist. Empty = "auto" (no filter). Used
 		* by the admin UI's address selector to seed its checkbox state.
 		*/
@@ -28012,7 +28303,34 @@ var localNetworkCapability = {
 		* when the operator wants to wipe their manual edits and start
 		* over from the auto-detected best matches.
 		*/
-		resetAllowlistToBestMatch: method(_void(), AllowedAddressesSchema, { kind: "mutation" })
+		resetAllowlistToBestMatch: method(_void(), AllowedAddressesSchema, { kind: "mutation" }),
+		/**
+		* Live TLS material for the Network → Local access certificate card.
+		* LAN HTTP / hostname are addon settings (`globalSettingsSchema`), not
+		* a second store — this query is status, not configuration.
+		*/
+		getTlsStatus: method(_void(), TlsStatusSchema),
+		/** Issue a new leaf under the existing local CA. Disabled in uploaded mode. */
+		regenerateCertificate: method(object({ reason: string().optional() }), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Replace the served material with operator-supplied PEMs. */
+		uploadCertificate: method(object({
+			certPem: string().min(1),
+			keyPem: string().min(1),
+			caPem: string().optional()
+		}), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The local CA PEM, or empty when there is none to download. */
+		downloadCa: method(_void(), object({ pem: string() })),
+		/** Drop uploaded material and return to the generated local CA. */
+		revertToGeneratedCertificate: method(_void(), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
 	},
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
 	mount: { kind: "hub-only" }
@@ -29784,7 +30102,12 @@ var PlateInfoSchema = object({
 	plateBbox: BoundingBoxSchema.optional(),
 	/** keyFrame parity: MediaStore key of the track's native-resolution key frame. */
 	keyFrameMediaKey: string().optional(),
-	base64: string().optional()
+	base64: string().optional(),
+	/**
+	* Same crop as a data-plane URL. `getPlateByTrack` returns this and
+	* never inlines JPEG; `listPlates` still inlines for the admin-ui.
+	*/
+	cropUrl: string().optional()
 });
 var MediaFileLiteSchema = object({
 	key: string(),
@@ -34814,6 +35137,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getBindingsBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getChildren": {
 		capName: "device-manager",
 		capScope: "system",
@@ -34874,6 +35203,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getLinkedDevicesBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getRoleDisplayDefaults": {
 		capName: "device-manager",
 		capScope: "system",
@@ -35756,6 +36091,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.downloadCa": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -35780,18 +36121,42 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getTlsStatus": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"localNetwork.getViewerEndpoints": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.list": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.regenerateCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.resetAllowlistToBestMatch": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"localNetwork.revertToGeneratedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.setAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -35804,6 +36169,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.setViewerEndpoints": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"localNetwork.uploadCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -36602,6 +36979,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getGroup": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getKeyEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -36686,6 +37069,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listGroups": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listOpsLog": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -38684,6 +39073,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.updateInstance": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.writeInput": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -39461,6 +39856,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.getBindingsBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"deviceManager.getChildren": [{
 		name: "parentDeviceId",
 		form: "single",
@@ -39506,6 +39906,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.getLinkedDevicesBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"deviceManager.getSettingsSchema": [{
 		name: "deviceId",
 		form: "single",
@@ -39526,6 +39931,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.listAll": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
 	"deviceManager.loadConfig": [{
 		name: "deviceId",
 		form: "single",
@@ -40099,6 +40509,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.getGroup": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.getKeyEvents": [{
 		name: "deviceId",
 		form: "single",
@@ -40154,6 +40569,11 @@ Object.freeze({
 		form: "array",
 		optional: false
 	}],
+	"pipelineAnalytics.listGroups": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"pipelineAnalytics.listOpsLog": [{
 		name: "deviceId",
 		form: "single",
@@ -41231,6 +41651,35 @@ Object.freeze(Object.fromEntries([{
 	}]
 }].map((s) => [s.stepId, s.defaultModelId])));
 string().min(1);
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.