@camstack/addon-pipeline-orchestrator 1.1.33 → 1.1.35

package/dist/index.js

@@ -2,6 +2,33 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+let node_fs = require("node:fs");
+node_fs = __toESM(node_fs);
+let node_path = require("node:path");
+node_path = __toESM(node_path);
+let node_url = require("node:url");
 //#region ../../node_modules/zod/v4/core/core.js
 var _a$1;
 function $constructor(name, initializer, params) {
@@ -4631,7 +4658,7 @@ function _instanceof(cls, params = {}) {
 	return inst;
 }
 //#endregion
-//#region ../types/dist/sleep-DiQ8xW1M.mjs
+//#region ../types/dist/sleep-DJaTV2D7.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -5352,10 +5379,6 @@ function hydrateField(field, values) {
 		};
 	}
 	const rawValue = storedValue !== void 0 ? storedValue : defaultValue !== void 0 ? defaultValue : null;
-	if (field.type === "password") return {
-		...field,
-		value: ""
-	};
 	const value = field.type === "textarea" && field.isJson && rawValue !== null && typeof rawValue === "object" ? JSON.stringify(rawValue, null, 2) : rawValue;
 	return {
 		...field,
@@ -7115,9 +7138,28 @@ function method(input, output, options) {
 		timeoutMs: options?.timeoutMs
 	};
 }
+var StaticDirOutputSchema$1 = object({ staticDir: string() });
+var VersionOutputSchema$1 = object({ version: string() });
+method(_void(), StaticDirOutputSchema$1), method(_void(), VersionOutputSchema$1);
 var StaticDirOutputSchema = object({ staticDir: string() });
 var VersionOutputSchema = object({ version: string() });
-method(_void(), StaticDirOutputSchema), method(_void(), VersionOutputSchema);
+/**
+* viewer-ui — serves the CamStack VIEWER web build (the Expo/React-Native
+* universal client's PWA export) from the hub, alongside admin-ui. Mirrors
+* `admin-ui` exactly: a singleton, server-internal cap exposing the static
+* dist directory + build version so `main.ts` can mount the SPA under a
+* dedicated prefix.
+*/
+var viewerUiCapability = {
+	name: "viewer-ui",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		getStaticDir: method(_void(), StaticDirOutputSchema),
+		getVersion: method(_void(), VersionOutputSchema)
+	}
+};
 /**
 * device-ops — device-scoped cap that unifies the per-IDevice operations
 * previously routed through the `.device-ops` Moleculer bridge service.
@@ -13432,6 +13474,17 @@ var WidgetMetadataSchema = object({
 		deviceContext: boolean().default(false),
 		integrationContext: boolean().default(false)
 	}),
+	/**
+	* Loadable BEFORE authentication. The normal widget registry listing
+	* (`addon-widgets.listWidgets`) is auth-gated, so a pre-auth surface
+	* (the login page) cannot discover a widget through it. A widget that
+	* declares `preAuth: true` marks itself as safe to mount on a pre-auth
+	* screen — it is surfaced through the PUBLIC `auth.listLoginMethods`
+	* login-method contribution channel (see `login-method.cap.ts`) rather
+	* than the authenticated registry, and its bundle is served by the
+	* public `/api/addon-widgets/:addonId/*` static route. Defaults false.
+	*/
+	preAuth: boolean().optional().default(false),
 	/** Dashboard placement HINTS (operator can override per instance). */
 	defaultSize: WidgetSizeEnum.default("md"),
 	allowedSizes: array(WidgetSizeEnum).readonly().default([
@@ -13739,6 +13792,66 @@ method(object({
 	password: string()
 }), AuthResultSchema.nullable(), { kind: "mutation" }), method(object({ state: string() }), string()), method(record(string(), string()), AuthResultSchema, { kind: "mutation" }), method(object({ token: string() }), AuthResultSchema.nullable());
 /**
+* `login-method` — collection cap through which auth addons contribute
+* their pre-auth login surfaces to the login page. This is the SINGLE,
+* generic mechanism that supersedes the dead `auth.listProviders` reader:
+* every auth addon (OIDC, magic-link, WebAuthn/passkey) registers a
+* `login-method` provider and the PUBLIC `auth.listLoginMethods`
+* procedure aggregates them for the unauthenticated login page.
+*
+* A contribution is a discriminated union on `kind`:
+*
+*  - `redirect` — a declarative button. The login page renders a generic
+*    button that navigates to `startUrl` (an addon-owned HTTP route).
+*    Covers OIDC (`/addon/auth-oidc/<id>/start`) and magic-link with
+*    ZERO shell-side JS. A future SSO addon plugs in the same way — the
+*    login page needs NO change.
+*
+*  - `widget` — a Module-Federation widget the login page mounts (via
+*    `loadRemoteBundle`) for an in-page ceremony. Covers the passkey
+*    login ceremony, which must run `@simplewebauthn/browser` INSIDE the
+*    addon bundle. The referenced widget also declares `preAuth: true` in
+*    its `addon-widgets-source` catalog entry. `auth.listLoginMethods`
+*    stamps a public `bundleUrl` from `addonId` + `bundle`.
+*
+* Every contribution carries a `stage`:
+*  - `primary`        — shown on the first credentials screen (OIDC /
+*                       magic-link buttons; a future usernameless passkey).
+*  - `second-factor`  — shown AFTER the password leg, gated on the
+*                       returned `factors` (passkey-as-2FA today).
+*
+* `mount: skip` — the cap is read server-side by the core auth router
+* (`registry.getCollection('login-method')`), never mounted as its own
+* tRPC router.
+*/
+/** When a login method renders in the two-phase login flow. */
+var LoginStageEnum = _enum(["primary", "second-factor"]);
+/** One login-method contribution — redirect button OR pre-auth widget. */
+var LoginMethodContributionSchema = discriminatedUnion("kind", [object({
+	kind: literal("redirect"),
+	/** Stable id within the login-method set (e.g. `auth-oidc/google`). */
+	id: string(),
+	/** Operator-facing button label. */
+	label: string(),
+	/** lucide-react icon name. */
+	icon: string().optional(),
+	/** Addon-owned HTTP route the button navigates to (GET). */
+	startUrl: string(),
+	stage: LoginStageEnum
+}), object({
+	kind: literal("widget"),
+	/** Stable id within the login-method set (e.g. `auth-webauthn/passkey-login`). */
+	id: string(),
+	/** Owning addon id — drives the public bundle URL + the MF namespace. */
+	addonId: string(),
+	/** Bundle filename inside the addon's dist dir (`remoteEntry.js`). */
+	bundle: string(),
+	/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
+	remote: WidgetRemoteSchema,
+	stage: LoginStageEnum
+})]);
+method(_void(), array(LoginMethodContributionSchema).readonly());
+/**
 * Orchestrator-side destination metadata. The orchestrator computes
 * `id = <addonId>:<subId>` from its provider lookup so consumers
 * (admin UI, restore flow) see one canonical key.
@@ -16710,6 +16823,131 @@ var pipelineOrchestratorCapability = {
 	}
 };
 /**
+* server-management — per-NODE singleton capability for a node's ROOT
+* package lifecycle (runtime-updatable node packages, phase 2: hub + docker
+* agents).
+*
+* Each node's root package (`@camstack/server` on the hub, `@camstack/agent`
+* on agents) carries the whole software stack in its npm dep tree, so ONE
+* version describes the node. Updates install into
+* `<dataDir>/server-root/versions/<v>/` and apply on restart via the baked
+* starter (probation boot + auto-rollback to N-1).
+*
+* Providers:
+*   - HUB: `ServerUpdateService` behind the `server-provided` mount
+*     (`buildServerProviders` in trpc.router.ts) — the default target for
+*     unpinned calls.
+*   - AGENT: `AgentUpdateService` registered by the agent bootstrap under
+*     the synthetic `agent-runtime` addonId and declared in the agent's
+*     `$hub.registerNode` manifest.
+*
+* Node routing: singleton caps get the codegen/runtime-builder `nodeId`
+* injection on every method — `input.nodeId` (or `nodePin(nodeId)` from the
+* SDK) routes the call to that node's provider via the standard remote
+* proxy (`createCapabilityProxy` → `$agent-cap-fwd` → the agent's
+* in-process provider lookup). No `nodeId` → the hub's own provider.
+*
+* Spec: docs/superpowers/specs/2026-07-12-runtime-updatable-node-packages-design.md
+*/
+/**
+* Where the running hub's code was loaded from:
+*  - `workspace` — dev checkout (tsx / workspace dist); the starter defers to
+*    plain resolution and runtime updates are refused.
+*  - `baked`     — the immutable image seed closure (no data-dir root active).
+*  - `data-root` — the runtime-updatable `<dataDir>/server-root` closure.
+*/
+var ServerBootModeSchema = _enum([
+	"workspace",
+	"baked",
+	"data-root"
+]);
+/**
+* Update lifecycle state:
+*  - `idle` / `checking` / `staging` — steady / in-flight registry work.
+*  - `pending-restart` — a version is staged and the node has NOT yet
+*    restarted onto it (still running the OLD version).
+*  - `awaiting-confirmation` — the node HAS restarted onto the staged version
+*    (it is the active probation boot) and is waiting to confirm boot-health.
+*    Apply/rollback are refused in this state and the node must NOT be
+*    manually restarted, or the probation boot auto-rolls-back.
+*/
+var ServerUpdateStateSchema = _enum([
+	"idle",
+	"checking",
+	"staging",
+	"pending-restart",
+	"awaiting-confirmation"
+]);
+var ServerRollbackInfoSchema = object({
+	/** The version that failed (or was manually rolled back). */
+	fromVersion: string(),
+	/** The version rolled back to; null = the baked seed. */
+	toVersion: string().nullable(),
+	atMs: number(),
+	reason: string()
+});
+var ServerPackageStatusSchema = object({
+	/** Root package name (`@camstack/server` on the hub). */
+	packageName: string(),
+	/** Version of the code the running process ACTUALLY loaded. */
+	runningVersion: string().nullable(),
+	/** Node.js runtime version the node's process runs on (`process.versions.node`). */
+	nodeRuntimeVersion: string().nullable(),
+	/** Active data-dir root version; null when booted from seed/workspace. */
+	activeVersion: string().nullable(),
+	/** N-1 version kept for rollback; null when no previous version exists. */
+	previousVersion: string().nullable(),
+	/** Version of the immutable baked seed closure (image fallback). */
+	seedVersion: string().nullable(),
+	/** Latest registry version from the most recent check (null = never checked). */
+	latestVersion: string().nullable(),
+	updateAvailable: boolean(),
+	bootMode: ServerBootModeSchema,
+	updateState: ServerUpdateStateSchema,
+	/** Version staged + awaiting its probation boot, when one is pending. */
+	pendingVersion: string().nullable(),
+	/** Set when the last freshly-activated version failed its boot health-check. */
+	rolledBack: ServerRollbackInfoSchema.nullable(),
+	/**
+	* True when `server-root/state.json` EXISTS but is unreadable/corrupt — the
+	* hub is running from the baked seed (or workspace) while installed data-dir
+	* versions are being IGNORED. Surfaced as a warning in the UI.
+	*/
+	stateFileCorrupt: boolean(),
+	lastCheckedAtMs: number().nullable()
+});
+var ServerUpdateCheckResultSchema = object({
+	packageName: string(),
+	runningVersion: string().nullable(),
+	latestVersion: string().nullable(),
+	updateAvailable: boolean(),
+	checkedAtMs: number(),
+	/** Non-null when the registry lookup failed (offline, bad registry, …). */
+	error: string().nullable()
+});
+var ServerUpdateActionResultSchema = object({
+	accepted: boolean(),
+	targetVersion: string().nullable(),
+	/** True when a graceful restart was scheduled to apply the change. */
+	restarting: boolean(),
+	message: string()
+});
+method(_void(), ServerPackageStatusSchema, { auth: "admin" }), method(_void(), ServerUpdateCheckResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ 
+/** Explicit target version; omitted = latest from the registry. */
+version: string().optional() }), ServerUpdateActionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), ServerUpdateActionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), ServerUpdateActionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * Query filter for settings-store collections.
 */
 var QueryFilterSchema = object({
@@ -18696,6 +18934,16 @@ var TopologyCategorySchema = object({
 	healthy: number(),
 	addons: array(TopologyCategoryAddonSchema).readonly()
 });
+/**
+* The node's runtime-updatable ROOT package (`@camstack/server` on the hub,
+* `@camstack/agent` on agents) as reported by its `registerNode` manifest —
+* version visibility for the Server management surface. Nullable: offline
+* rows and pre-phase-2 nodes report none.
+*/
+var TopologyRootPackageSchema = object({
+	name: string(),
+	version: string()
+});
 var TopologyNodeSchema = object({
 	id: string(),
 	name: string(),
@@ -18719,7 +18967,8 @@ var TopologyNodeSchema = object({
 		status: string()
 	})).readonly(),
 	processes: array(TopologyProcessSchema).readonly(),
-	categories: array(TopologyCategorySchema).readonly()
+	categories: array(TopologyCategorySchema).readonly(),
+	rootPackage: TopologyRootPackageSchema.nullable()
 });
 var CapUsageEdgeSchema = object({
 	callerAddonId: string(),
@@ -21519,6 +21768,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"loginMethod.getLoginMethods": {
+		capName: "login-method",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"mediaPlayer.next": {
 		capName: "media-player",
 		capScope: "device",
@@ -22881,6 +23136,36 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"serverManagement.applyServerUpdate": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"serverManagement.checkServerUpdate": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"serverManagement.getServerPackageStatus": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"serverManagement.restartServer": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"serverManagement.rollbackServerUpdate": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"settingsStore.count": {
 		capName: "settings-store",
 		capScope: "system",
@@ -23745,6 +24030,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"viewerUi.getStaticDir": {
+		capName: "viewer-ui",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"viewerUi.getVersion": {
+		capName: "viewer-ui",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"waterHeater.setAway": {
 		capName: "water-heater",
 		capScope: "device",
@@ -26499,7 +26796,7 @@ var DetectionWiringController = class {
 	* the motion stream id.
 	*
 	* Public — `PlacementService`'s `buildWatchdogCamera` closure (wired in
-	* `index.ts`) calls straight through to this method.
+	* `orchestrator-bootstrap.ts`) calls straight through to this method.
 	*/
 	buildWatchdogCamera(config, deviceName) {
 		const continuousStages = /* @__PURE__ */ new Map();
@@ -26523,8 +26820,8 @@ var DetectionWiringController = class {
 	* source refresh on ITS OWN stream so a dropped rfc4571 source
 	* re-materializes and the runner's frame poller resumes.
 	*
-	* Public — `PipelineWatchdog`'s `recover` closure (wired in `index.ts`)
-	* calls straight through to this method.
+	* Public — `PipelineWatchdog`'s `recover` closure (wired in
+	* `orchestrator-bootstrap.ts`) calls straight through to this method.
 	*/
 	recoverPipelineStage(deviceId, stage, streamId) {
 		if (stage === "audio") {
@@ -26958,7 +27255,7 @@ function selectRunnerFrameSource(input) {
 }
 //#endregion
 //#region src/placement-service.ts
-/** Key under which the orchestrator stores its per-device manual pin — shared with `readPipelinePin`/`handleNodeDisconnect` in index.ts. */
+/** Key under which the orchestrator stores its per-device manual pin — shared with `readPipelinePin` (index.ts) and `handleNodeDisconnect` (`node-lifecycle-handler.ts`). */
 var PREFERRED_AGENT_SETTING = "preferredAgent";
 var PlacementService = class {
 	deps;
@@ -28739,6 +29036,8 @@ var PipelineSettingsStore = class PipelineSettingsStore {
 	dispose() {
 		this.disposed = true;
 	}
+	blobWriteLock = new KeyedAsyncLock({ isShuttingDown: () => this.disposed });
+	static AGENT_SETTINGS_LOCK_KEY = "agentSettings";
 	_nodeBindingsState = null;
 	_templatesState = null;
 	_agentSettingsState = null;
@@ -28800,28 +29099,47 @@ var PipelineSettingsStore = class PipelineSettingsStore {
 	async readAgentSettingsMap() {
 		return { ...await this.agentSettingsState.get() };
 	}
-	/** Overwrite one agent's settings. Does NOT touch other agents' entries. */
+	/**
+	* Overwrite one agent's settings. Does NOT touch other agents' entries.
+	* The read-modify-write runs under {@link blobWriteLock}, so a concurrent
+	* write for a DIFFERENT node can never be dropped (both re-read the fresh
+	* blob when their turn comes and only overlay their own node's entry).
+	*/
 	async writeAgentSettings(nodeId, settings) {
 		if (typeof nodeId !== "string" || nodeId.length === 0 || nodeId === "undefined" || nodeId === "null") {
 			this.deps.logger.warn("writeAgentSettings: refusing to persist malformed nodeId", { meta: { nodeId } });
 			return;
 		}
-		const all = await this.readAgentSettingsMap();
-		const existing = all[nodeId];
-		all[nodeId] = {
-			...existing,
-			...settings,
-			maxCameras: settings.maxCameras !== void 0 ? settings.maxCameras ?? null : existing?.maxCameras ?? null
-		};
-		await this.agentSettingsState.set(all);
+		await this.blobWriteLock.run(PipelineSettingsStore.AGENT_SETTINGS_LOCK_KEY, async () => {
+			const all = await this.readAgentSettingsMap();
+			const existing = all[nodeId];
+			const merged = {
+				...existing,
+				...settings,
+				maxCameras: settings.maxCameras !== void 0 ? settings.maxCameras ?? null : existing?.maxCameras ?? null
+			};
+			await this.agentSettingsState.set({
+				...all,
+				[nodeId]: merged
+			});
+		});
 	}
-	/** Drop one agent's persisted settings entry. Returns whether an entry existed. */
+	/**
+	* Drop one agent's persisted settings entry. Returns whether an entry
+	* existed (`false` also when the store is already disposed — the locked
+	* section becomes a no-op then). Serialized via {@link blobWriteLock} for
+	* the same lost-write reason as {@link writeAgentSettings}.
+	*/
 	async removeAgentSettings(nodeId) {
-		const all = await this.readAgentSettingsMap();
-		if (!(nodeId in all)) return false;
-		const { [nodeId]: _drop, ...rest } = all;
-		await this.agentSettingsState.set(rest);
-		return true;
+		let removed = false;
+		await this.blobWriteLock.run(PipelineSettingsStore.AGENT_SETTINGS_LOCK_KEY, async () => {
+			const all = await this.readAgentSettingsMap();
+			if (!(nodeId in all)) return;
+			const { [nodeId]: _drop, ...rest } = all;
+			await this.agentSettingsState.set(rest);
+			removed = true;
+		});
+		return removed;
 	}
 	/** Read the `cameraSettings` map (keyed on `deviceId` as string) via the durable handle. */
 	async readCameraSettingsMap() {
@@ -29964,9 +30282,10 @@ var SessionDispatchController = class {
 		this.sessionRegistry.setTeardownTimer(deviceId, timer);
 	}
 	/**
-	* The session + motion-watch teardown half of the addon's `stopDetection`
-	* (the other half — `releaseCamera` + `audio.stopForDevice` — stays on
-	* `index.ts`, which calls this AFTER those run, same as before).
+	* The session + motion-watch teardown half of `stopDetection` (the other
+	* half — `releaseCamera` + `audio.stopForDevice` — lives in
+	* `DetectionWiringController.stopDetection` since S11 Task 3, which calls
+	* this AFTER those run, same ordering as before).
 	*
 	* Stopping/disabling/removing an on-motion camera must also close any
 	* ACTIVE detection session and release the motion-watch attach.
@@ -30431,7 +30750,6 @@ async function buildOrchestratorControllers(deps) {
 		},
 		listZones: async (deviceId) => await zonesProvider?.listZones({ deviceId }) ?? [],
 		readPipelinePin: (deviceId) => deps.readPipelinePin(deviceId),
-		eventBus: deps.ctx().eventBus,
 		logger: deps.ctx().logger
 	});
 	const deviceConfig = new DeviceConfigContributions({
@@ -30685,10 +31003,51 @@ async function buildOrchestratorControllers(deps) {
 	};
 }
 //#endregion
+//#region src/viewer-ui-provider.ts
+/**
+* viewer-ui provider — the pipeline-orchestrator serves the CamStack viewer web
+* SPA (mirrors what the now-removed standalone addon-viewer-ui used to do).
+*
+* Why here: the orchestrator is a hub bootstrap addon (always installed + baked),
+* so folding the viewer serving into it avoids a second addon whose only job was
+* to hold static files. The viewer's Expo web export is COPIED into this addon's
+* `assets/viewer/` locally by the viewer repo's `scripts/copy-dist-to-orchestrator.js`
+* (run from a checkout that HAS the `camstack/` submodule + Expo toolchain — the
+* publish/image CI does not, which is exactly why we copy a pre-built dist rather
+* than build it here). vite emits only into `dist/`, so `assets/viewer` survives
+* the addon build; `assets` is in the package `files`, so it ships on
+* `camstack deploy`. The hub's `main.ts` resolves the `viewer-ui` singleton at
+* boot and mounts the SPA at `/viewer/camstack`.
+*
+* `index.js` runs from `dist/`, so the SPA root is one level up + `assets/viewer`.
+*/
+var __dirname$1 = node_path.default.dirname((0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href));
+/** Absolute path to the staged viewer web SPA (`<addon-root>/assets/viewer`). */
+function resolveViewerDistDir() {
+	return node_path.default.resolve(__dirname$1, "..", "assets", "viewer");
+}
+/** Version of the staged viewer, written by the copy script; 'unknown' if absent. */
+function readViewerVersion() {
+	try {
+		const raw = node_fs.default.readFileSync(node_path.default.join(resolveViewerDistDir(), ".viewer-version"), "utf-8").trim();
+		if (raw) return raw;
+	} catch {}
+	return "unknown";
+}
+/** Build the viewer-ui provider. Serves whatever dist was staged into
+*  `assets/viewer`; when nothing is staged the hub's mount cleanly 404s. */
+function createViewerUiProvider() {
+	return {
+		getStaticDir: async () => ({ staticDir: resolveViewerDistDir() }),
+		getVersion: async () => ({ version: readViewerVersion() })
+	};
+}
+//#endregion
 //#region src/widget-catalog.ts
 var pipelineOrchestratorWidgets = [{
 	tab: "device-tab",
 	label: "Pipeline Quick Stats",
+	preAuth: false,
 	kind: "remote",
 	remote: {
 		remoteName: "addon_pipeline_orchestrator_widgets",
@@ -30715,6 +31074,7 @@ var pipelineOrchestratorWidgets = [{
 }, {
 	tab: "device-tab",
 	label: "Zone Editor",
+	preAuth: false,
 	kind: "remote",
 	remote: {
 		remoteName: "addon_pipeline_orchestrator_widgets",
@@ -31382,6 +31742,10 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 				{
 					capability: addonWidgetsSourceCapability,
 					provider: { listWidgets: async () => pipelineOrchestratorWidgets }
+				},
+				{
+					capability: viewerUiCapability,
+					provider: createViewerUiProvider()
 				}
 			],
 			customActions: pipelineOrchestratorActions,