@camstack/addon-provider-onvif 1.1.21 → 1.1.22

package/dist/addon.js

@@ -4631,7 +4631,7 @@ function _instanceof(cls, params = {}) {
 	return inst;
 }
 //#endregion
-//#region ../types/dist/sleep-Cc14_yxc.mjs
+//#region ../types/dist/sleep-DJaTV2D7.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -5352,10 +5352,6 @@ function hydrateField(field, values) {
 		};
 	}
 	const rawValue = storedValue !== void 0 ? storedValue : defaultValue !== void 0 ? defaultValue : null;
-	if (field.type === "password") return {
-		...field,
-		value: ""
-	};
 	const value = field.type === "textarea" && field.isJson && rawValue !== null && typeof rawValue === "object" ? JSON.stringify(rawValue, null, 2) : rawValue;
 	return {
 		...field,
@@ -6739,6 +6735,9 @@ function method(input, output, options) {
 		timeoutMs: options?.timeoutMs
 	};
 }
+var StaticDirOutputSchema$1 = object({ staticDir: string() });
+var VersionOutputSchema$1 = object({ version: string() });
+method(_void(), StaticDirOutputSchema$1), method(_void(), VersionOutputSchema$1);
 var StaticDirOutputSchema = object({ staticDir: string() });
 var VersionOutputSchema = object({ version: string() });
 method(_void(), StaticDirOutputSchema), method(_void(), VersionOutputSchema);
@@ -10481,7 +10480,7 @@ var BoundingBoxSchema = object({
 	w: number(),
 	h: number()
 });
-var SpatialDetectionSchema = object({
+object({
 	class: string(),
 	originalClass: string(),
 	score: number(),
@@ -10672,11 +10671,6 @@ var PipelineSchemaSchema = object({
 	selectedEngine: PipelineEngineChoiceSchema,
 	slots: array(PipelineSlotSchemaSchema).readonly()
 });
-var DetectorOutputSchema = object({
-	detections: array(SpatialDetectionSchema).readonly(),
-	inferenceMs: number(),
-	modelId: string()
-});
 var EngineProvisioningSchema = object({
 	runtimeId: _enum([
 		"onnx",
@@ -10801,7 +10795,7 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	auth: "admin"
 }), method(object({ nodeId: string() }), object({
 	success: literal(true),
-	regeneratedModelId: string().nullable()
+	clearedDevices: number()
 }), {
 	kind: "mutation",
 	auth: "admin"
@@ -10822,10 +10816,6 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	modelId: string(),
 	format: ModelFormatSchema$1
 }), object({ success: literal(true) }), { kind: "mutation" }), method(object({
-	addonId: string(),
-	frame: FrameInputSchema,
-	config: record(string(), unknown()).optional()
-}), DetectorOutputSchema), method(object({
 	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).min(1),
 	frame: FrameInputSchema.optional(),
@@ -12814,7 +12804,9 @@ var AddonPageDeclarationSchema$1 = object({
 	icon: string(),
 	path: string(),
 	remoteName: string(),
-	bundle: string()
+	bundle: string(),
+	section: string().optional(),
+	sectionLabel: string().optional()
 });
 var AddonPageInfoSchema = object({
 	addonId: string(),
@@ -12854,7 +12846,18 @@ var AddonPageDeclarationSchema = object({
 	* the static-file route can compute an mtime-based cache-buster URL
 	* without a separate filesystem stat.
 	*/
-	bundle: string()
+	bundle: string(),
+	/**
+	* Sidebar section this page docks into. Well-known ids: `'detection'`,
+	* `'cluster'`, `'administration'` — the page renders inside that group.
+	* Any OTHER string creates (or joins) a custom section rendered after
+	* the built-in groups; its label comes from `sectionLabel` (first
+	* declaration wins), falling back to the id. Absent → the legacy
+	* "Addon Pages" group.
+	*/
+	section: string().optional(),
+	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
+	sectionLabel: string().optional()
 });
 method(_void(), array(AddonPageDeclarationSchema).readonly());
 var AddonHttpRouteSchema = object({
@@ -13070,6 +13073,17 @@ var WidgetMetadataSchema = object({
 		deviceContext: boolean().default(false),
 		integrationContext: boolean().default(false)
 	}),
+	/**
+	* Loadable BEFORE authentication. The normal widget registry listing
+	* (`addon-widgets.listWidgets`) is auth-gated, so a pre-auth surface
+	* (the login page) cannot discover a widget through it. A widget that
+	* declares `preAuth: true` marks itself as safe to mount on a pre-auth
+	* screen — it is surfaced through the PUBLIC `auth.listLoginMethods`
+	* login-method contribution channel (see `login-method.cap.ts`) rather
+	* than the authenticated registry, and its bundle is served by the
+	* public `/api/addon-widgets/:addonId/*` static route. Defaults false.
+	*/
+	preAuth: boolean().optional().default(false),
 	/** Dashboard placement HINTS (operator can override per instance). */
 	defaultSize: WidgetSizeEnum.default("md"),
 	allowedSizes: array(WidgetSizeEnum).readonly().default([
@@ -13371,6 +13385,66 @@ method(object({
 	password: string()
 }), AuthResultSchema.nullable(), { kind: "mutation" }), method(object({ state: string() }), string()), method(record(string(), string()), AuthResultSchema, { kind: "mutation" }), method(object({ token: string() }), AuthResultSchema.nullable());
 /**
+* `login-method` — collection cap through which auth addons contribute
+* their pre-auth login surfaces to the login page. This is the SINGLE,
+* generic mechanism that supersedes the dead `auth.listProviders` reader:
+* every auth addon (OIDC, magic-link, WebAuthn/passkey) registers a
+* `login-method` provider and the PUBLIC `auth.listLoginMethods`
+* procedure aggregates them for the unauthenticated login page.
+*
+* A contribution is a discriminated union on `kind`:
+*
+*  - `redirect` — a declarative button. The login page renders a generic
+*    button that navigates to `startUrl` (an addon-owned HTTP route).
+*    Covers OIDC (`/addon/auth-oidc/<id>/start`) and magic-link with
+*    ZERO shell-side JS. A future SSO addon plugs in the same way — the
+*    login page needs NO change.
+*
+*  - `widget` — a Module-Federation widget the login page mounts (via
+*    `loadRemoteBundle`) for an in-page ceremony. Covers the passkey
+*    login ceremony, which must run `@simplewebauthn/browser` INSIDE the
+*    addon bundle. The referenced widget also declares `preAuth: true` in
+*    its `addon-widgets-source` catalog entry. `auth.listLoginMethods`
+*    stamps a public `bundleUrl` from `addonId` + `bundle`.
+*
+* Every contribution carries a `stage`:
+*  - `primary`        — shown on the first credentials screen (OIDC /
+*                       magic-link buttons; a future usernameless passkey).
+*  - `second-factor`  — shown AFTER the password leg, gated on the
+*                       returned `factors` (passkey-as-2FA today).
+*
+* `mount: skip` — the cap is read server-side by the core auth router
+* (`registry.getCollection('login-method')`), never mounted as its own
+* tRPC router.
+*/
+/** When a login method renders in the two-phase login flow. */
+var LoginStageEnum = _enum(["primary", "second-factor"]);
+/** One login-method contribution — redirect button OR pre-auth widget. */
+var LoginMethodContributionSchema = discriminatedUnion("kind", [object({
+	kind: literal("redirect"),
+	/** Stable id within the login-method set (e.g. `auth-oidc/google`). */
+	id: string(),
+	/** Operator-facing button label. */
+	label: string(),
+	/** lucide-react icon name. */
+	icon: string().optional(),
+	/** Addon-owned HTTP route the button navigates to (GET). */
+	startUrl: string(),
+	stage: LoginStageEnum
+}), object({
+	kind: literal("widget"),
+	/** Stable id within the login-method set (e.g. `auth-webauthn/passkey-login`). */
+	id: string(),
+	/** Owning addon id — drives the public bundle URL + the MF namespace. */
+	addonId: string(),
+	/** Bundle filename inside the addon's dist dir (`remoteEntry.js`). */
+	bundle: string(),
+	/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
+	remote: WidgetRemoteSchema,
+	stage: LoginStageEnum
+})]);
+method(_void(), array(LoginMethodContributionSchema).readonly());
+/**
 * Orchestrator-side destination metadata. The orchestrator computes
 * `id = <addonId>:<subId>` from its provider lookup so consumers
 * (admin UI, restore flow) see one canonical key.
@@ -15688,7 +15762,12 @@ var AgentPipelineSettingsSchema = object({
 	detectWeight: number().positive().optional(),
 	/** Node is eligible to run the detection pipeline (decode + inference). */
 	detect: boolean().optional(),
-	/** Node is eligible to host decoder sessions. */
+	/**
+	* DEPRECATED AND IGNORED. Decode is always co-located with its frame
+	* consumer, so decode eligibility IS detect eligibility. Kept optional in
+	* the schema ONLY so persisted stores written before the removal still
+	* parse — no code reads it and no write path emits it.
+	*/
 	decode: boolean().optional(),
 	/** Node is eligible to run audio-analyzer sessions. */
 	audio: boolean().optional(),
@@ -15749,25 +15828,6 @@ var PipelineAssignmentSchema = object({
 	assignedAt: number()
 });
 /**
-* Decoder placement record. Symmetric to `PipelineAssignmentSchema` but for
-* the decoder-node placement domain (`balanceDecoder` decision: manual pin
-* → co-located with pipeline → capacity).
-*/
-var DecoderAssignmentSchema = object({
-	deviceId: number(),
-	/** Moleculer node id of the decoder provider currently responsible for this camera. */
-	decoderNodeId: string(),
-	/** True when the assignment was set manually via `assignDecoder`, false when chosen by the balancer. */
-	pinned: boolean(),
-	/** Why this assignment was made — useful for debugging the decoder balancer. */
-	reason: _enum([
-		"manual",
-		"co-located",
-		"capacity",
-		"hardware-affinity"
-	])
-});
-/**
 * Per-agent load summary surfaced to the load balancer + dashboards.
 * Aggregated from each runner's `getLocalLoad` cap call.
 */
@@ -15973,15 +16033,6 @@ method(object({
 }), method(_void(), IngestOwnerSchema), method(object({
 	deviceId: number(),
 	nodeId: string()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), array(DecoderAssignmentSchema).readonly()), method(object({
-	deviceId: number(),
-	nodeId: string()
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
@@ -16000,10 +16051,7 @@ method(object({
 	nodeId: string(),
 	pinned: boolean(),
 	assignedAt: number()
-}))), method(object({
-	deviceId: number(),
-	pipelineNodeId: string().optional()
-}), DecoderAssignmentSchema), method(object({ agentNodeId: string() }), AgentPipelineSettingsSchema.nullable()), method(_void(), array(object({
+}))), method(object({ agentNodeId: string() }), AgentPipelineSettingsSchema.nullable()), method(_void(), array(object({
 	nodeId: string(),
 	settings: AgentPipelineSettingsSchema
 })).readonly()), method(object({
@@ -16033,7 +16081,6 @@ method(object({
 }), method(object({
 	agentNodeId: string(),
 	detect: boolean().nullable().optional(),
-	decode: boolean().nullable().optional(),
 	audio: boolean().nullable().optional(),
 	ingest: boolean().nullable().optional()
 }), object({ success: literal(true) }), {
@@ -16045,6 +16092,15 @@ method(object({
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ agentNodeId: string() }), object({
+	success: literal(true),
+	/** Hardware-aware default detection model now in effect on the node (null when unresolvable). */
+	effectiveModelId: string().nullable(),
+	/** Number of cameras whose node-scoped overrides were cleared. */
+	clearedCameraOverrides: number()
+}), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ deviceId: number() }), CameraPipelineSettingsSchema.nullable()), method(object({
 	deviceId: number(),
 	addonId: string(),
@@ -16090,6 +16146,131 @@ method(object({
 	auth: "admin"
 });
 /**
+* server-management — per-NODE singleton capability for a node's ROOT
+* package lifecycle (runtime-updatable node packages, phase 2: hub + docker
+* agents).
+*
+* Each node's root package (`@camstack/server` on the hub, `@camstack/agent`
+* on agents) carries the whole software stack in its npm dep tree, so ONE
+* version describes the node. Updates install into
+* `<dataDir>/server-root/versions/<v>/` and apply on restart via the baked
+* starter (probation boot + auto-rollback to N-1).
+*
+* Providers:
+*   - HUB: `ServerUpdateService` behind the `server-provided` mount
+*     (`buildServerProviders` in trpc.router.ts) — the default target for
+*     unpinned calls.
+*   - AGENT: `AgentUpdateService` registered by the agent bootstrap under
+*     the synthetic `agent-runtime` addonId and declared in the agent's
+*     `$hub.registerNode` manifest.
+*
+* Node routing: singleton caps get the codegen/runtime-builder `nodeId`
+* injection on every method — `input.nodeId` (or `nodePin(nodeId)` from the
+* SDK) routes the call to that node's provider via the standard remote
+* proxy (`createCapabilityProxy` → `$agent-cap-fwd` → the agent's
+* in-process provider lookup). No `nodeId` → the hub's own provider.
+*
+* Spec: docs/superpowers/specs/2026-07-12-runtime-updatable-node-packages-design.md
+*/
+/**
+* Where the running hub's code was loaded from:
+*  - `workspace` — dev checkout (tsx / workspace dist); the starter defers to
+*    plain resolution and runtime updates are refused.
+*  - `baked`     — the immutable image seed closure (no data-dir root active).
+*  - `data-root` — the runtime-updatable `<dataDir>/server-root` closure.
+*/
+var ServerBootModeSchema = _enum([
+	"workspace",
+	"baked",
+	"data-root"
+]);
+/**
+* Update lifecycle state:
+*  - `idle` / `checking` / `staging` — steady / in-flight registry work.
+*  - `pending-restart` — a version is staged and the node has NOT yet
+*    restarted onto it (still running the OLD version).
+*  - `awaiting-confirmation` — the node HAS restarted onto the staged version
+*    (it is the active probation boot) and is waiting to confirm boot-health.
+*    Apply/rollback are refused in this state and the node must NOT be
+*    manually restarted, or the probation boot auto-rolls-back.
+*/
+var ServerUpdateStateSchema = _enum([
+	"idle",
+	"checking",
+	"staging",
+	"pending-restart",
+	"awaiting-confirmation"
+]);
+var ServerRollbackInfoSchema = object({
+	/** The version that failed (or was manually rolled back). */
+	fromVersion: string(),
+	/** The version rolled back to; null = the baked seed. */
+	toVersion: string().nullable(),
+	atMs: number(),
+	reason: string()
+});
+var ServerPackageStatusSchema = object({
+	/** Root package name (`@camstack/server` on the hub). */
+	packageName: string(),
+	/** Version of the code the running process ACTUALLY loaded. */
+	runningVersion: string().nullable(),
+	/** Node.js runtime version the node's process runs on (`process.versions.node`). */
+	nodeRuntimeVersion: string().nullable(),
+	/** Active data-dir root version; null when booted from seed/workspace. */
+	activeVersion: string().nullable(),
+	/** N-1 version kept for rollback; null when no previous version exists. */
+	previousVersion: string().nullable(),
+	/** Version of the immutable baked seed closure (image fallback). */
+	seedVersion: string().nullable(),
+	/** Latest registry version from the most recent check (null = never checked). */
+	latestVersion: string().nullable(),
+	updateAvailable: boolean(),
+	bootMode: ServerBootModeSchema,
+	updateState: ServerUpdateStateSchema,
+	/** Version staged + awaiting its probation boot, when one is pending. */
+	pendingVersion: string().nullable(),
+	/** Set when the last freshly-activated version failed its boot health-check. */
+	rolledBack: ServerRollbackInfoSchema.nullable(),
+	/**
+	* True when `server-root/state.json` EXISTS but is unreadable/corrupt — the
+	* hub is running from the baked seed (or workspace) while installed data-dir
+	* versions are being IGNORED. Surfaced as a warning in the UI.
+	*/
+	stateFileCorrupt: boolean(),
+	lastCheckedAtMs: number().nullable()
+});
+var ServerUpdateCheckResultSchema = object({
+	packageName: string(),
+	runningVersion: string().nullable(),
+	latestVersion: string().nullable(),
+	updateAvailable: boolean(),
+	checkedAtMs: number(),
+	/** Non-null when the registry lookup failed (offline, bad registry, …). */
+	error: string().nullable()
+});
+var ServerUpdateActionResultSchema = object({
+	accepted: boolean(),
+	targetVersion: string().nullable(),
+	/** True when a graceful restart was scheduled to apply the change. */
+	restarting: boolean(),
+	message: string()
+});
+method(_void(), ServerPackageStatusSchema, { auth: "admin" }), method(_void(), ServerUpdateCheckResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ 
+/** Explicit target version; omitted = latest from the registry. */
+version: string().optional() }), ServerUpdateActionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), ServerUpdateActionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), ServerUpdateActionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * Query filter for settings-store collections.
 */
 var QueryFilterSchema = object({
@@ -18119,6 +18300,16 @@ var TopologyCategorySchema = object({
 	healthy: number(),
 	addons: array(TopologyCategoryAddonSchema).readonly()
 });
+/**
+* The node's runtime-updatable ROOT package (`@camstack/server` on the hub,
+* `@camstack/agent` on agents) as reported by its `registerNode` manifest —
+* version visibility for the Server management surface. Nullable: offline
+* rows and pre-phase-2 nodes report none.
+*/
+var TopologyRootPackageSchema = object({
+	name: string(),
+	version: string()
+});
 var TopologyNodeSchema = object({
 	id: string(),
 	name: string(),
@@ -18142,7 +18333,8 @@ var TopologyNodeSchema = object({
 		status: string()
 	})).readonly(),
 	processes: array(TopologyProcessSchema).readonly(),
-	categories: array(TopologyCategorySchema).readonly()
+	categories: array(TopologyCategorySchema).readonly(),
+	rootPackage: TopologyRootPackageSchema.nullable()
 });
 var CapUsageEdgeSchema = object({
 	callerAddonId: string(),
@@ -20984,6 +21176,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"loginMethod.getLoginMethods": {
+		capName: "login-method",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"mediaPlayer.next": {
 		capName: "media-player",
 		capScope: "device",
@@ -21614,23 +21812,23 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineExecutor.deleteModel": {
+	"pipelineExecutor.clearDeviceOverrides": {
 		capName: "pipeline-executor",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
-	"pipelineExecutor.deleteTemplate": {
+	"pipelineExecutor.deleteModel": {
 		capName: "pipeline-executor",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
-	"pipelineExecutor.detect": {
+	"pipelineExecutor.deleteTemplate": {
 		capName: "pipeline-executor",
 		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "delete"
 	},
 	"pipelineExecutor.downloadModel": {
 		capName: "pipeline-executor",
@@ -21776,12 +21974,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineExecutor.resetToDefault": {
-		capName: "pipeline-executor",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
 	"pipelineExecutor.runAudioTest": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -21842,12 +22034,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.assignDecoder": {
-		capName: "pipeline-orchestrator",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineOrchestrator.assignPipeline": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -21926,18 +22112,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"pipelineOrchestrator.getDecoderAssignment": {
-		capName: "pipeline-orchestrator",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"pipelineOrchestrator.getDecoderAssignments": {
-		capName: "pipeline-orchestrator",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"pipelineOrchestrator.getGlobalMetrics": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -21986,6 +22160,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineOrchestrator.resetNodePipelineDefaults": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineOrchestrator.resolvePipeline": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -22058,12 +22238,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.unassignDecoder": {
-		capName: "pipeline-orchestrator",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineOrchestrator.unassignPipeline": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -22370,6 +22544,36 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"serverManagement.applyServerUpdate": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"serverManagement.checkServerUpdate": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"serverManagement.getServerPackageStatus": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"serverManagement.restartServer": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"serverManagement.rollbackServerUpdate": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"settingsStore.count": {
 		capName: "settings-store",
 		capScope: "system",
@@ -23234,6 +23438,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"viewerUi.getStaticDir": {
+		capName: "viewer-ui",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"viewerUi.getVersion": {
+		capName: "viewer-ui",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"waterHeater.setAway": {
 		capName: "water-heater",
 		capScope: "device",

package/dist/addon.mjs

@@ -4632,7 +4632,7 @@ function _instanceof(cls, params = {}) {
 	return inst;
 }
 //#endregion
-//#region ../types/dist/sleep-Cc14_yxc.mjs
+//#region ../types/dist/sleep-DJaTV2D7.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -5353,10 +5353,6 @@ function hydrateField(field, values) {
 		};
 	}
 	const rawValue = storedValue !== void 0 ? storedValue : defaultValue !== void 0 ? defaultValue : null;
-	if (field.type === "password") return {
-		...field,
-		value: ""
-	};
 	const value = field.type === "textarea" && field.isJson && rawValue !== null && typeof rawValue === "object" ? JSON.stringify(rawValue, null, 2) : rawValue;
 	return {
 		...field,
@@ -6740,6 +6736,9 @@ function method(input, output, options) {
 		timeoutMs: options?.timeoutMs
 	};
 }
+var StaticDirOutputSchema$1 = object({ staticDir: string() });
+var VersionOutputSchema$1 = object({ version: string() });
+method(_void(), StaticDirOutputSchema$1), method(_void(), VersionOutputSchema$1);
 var StaticDirOutputSchema = object({ staticDir: string() });
 var VersionOutputSchema = object({ version: string() });
 method(_void(), StaticDirOutputSchema), method(_void(), VersionOutputSchema);
@@ -10482,7 +10481,7 @@ var BoundingBoxSchema = object({
 	w: number(),
 	h: number()
 });
-var SpatialDetectionSchema = object({
+object({
 	class: string(),
 	originalClass: string(),
 	score: number(),
@@ -10673,11 +10672,6 @@ var PipelineSchemaSchema = object({
 	selectedEngine: PipelineEngineChoiceSchema,
 	slots: array(PipelineSlotSchemaSchema).readonly()
 });
-var DetectorOutputSchema = object({
-	detections: array(SpatialDetectionSchema).readonly(),
-	inferenceMs: number(),
-	modelId: string()
-});
 var EngineProvisioningSchema = object({
 	runtimeId: _enum([
 		"onnx",
@@ -10802,7 +10796,7 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	auth: "admin"
 }), method(object({ nodeId: string() }), object({
 	success: literal(true),
-	regeneratedModelId: string().nullable()
+	clearedDevices: number()
 }), {
 	kind: "mutation",
 	auth: "admin"
@@ -10823,10 +10817,6 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	modelId: string(),
 	format: ModelFormatSchema$1
 }), object({ success: literal(true) }), { kind: "mutation" }), method(object({
-	addonId: string(),
-	frame: FrameInputSchema,
-	config: record(string(), unknown()).optional()
-}), DetectorOutputSchema), method(object({
 	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).min(1),
 	frame: FrameInputSchema.optional(),
@@ -12815,7 +12805,9 @@ var AddonPageDeclarationSchema$1 = object({
 	icon: string(),
 	path: string(),
 	remoteName: string(),
-	bundle: string()
+	bundle: string(),
+	section: string().optional(),
+	sectionLabel: string().optional()
 });
 var AddonPageInfoSchema = object({
 	addonId: string(),
@@ -12855,7 +12847,18 @@ var AddonPageDeclarationSchema = object({
 	* the static-file route can compute an mtime-based cache-buster URL
 	* without a separate filesystem stat.
 	*/
-	bundle: string()
+	bundle: string(),
+	/**
+	* Sidebar section this page docks into. Well-known ids: `'detection'`,
+	* `'cluster'`, `'administration'` — the page renders inside that group.
+	* Any OTHER string creates (or joins) a custom section rendered after
+	* the built-in groups; its label comes from `sectionLabel` (first
+	* declaration wins), falling back to the id. Absent → the legacy
+	* "Addon Pages" group.
+	*/
+	section: string().optional(),
+	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
+	sectionLabel: string().optional()
 });
 method(_void(), array(AddonPageDeclarationSchema).readonly());
 var AddonHttpRouteSchema = object({
@@ -13071,6 +13074,17 @@ var WidgetMetadataSchema = object({
 		deviceContext: boolean().default(false),
 		integrationContext: boolean().default(false)
 	}),
+	/**
+	* Loadable BEFORE authentication. The normal widget registry listing
+	* (`addon-widgets.listWidgets`) is auth-gated, so a pre-auth surface
+	* (the login page) cannot discover a widget through it. A widget that
+	* declares `preAuth: true` marks itself as safe to mount on a pre-auth
+	* screen — it is surfaced through the PUBLIC `auth.listLoginMethods`
+	* login-method contribution channel (see `login-method.cap.ts`) rather
+	* than the authenticated registry, and its bundle is served by the
+	* public `/api/addon-widgets/:addonId/*` static route. Defaults false.
+	*/
+	preAuth: boolean().optional().default(false),
 	/** Dashboard placement HINTS (operator can override per instance). */
 	defaultSize: WidgetSizeEnum.default("md"),
 	allowedSizes: array(WidgetSizeEnum).readonly().default([
@@ -13372,6 +13386,66 @@ method(object({
 	password: string()
 }), AuthResultSchema.nullable(), { kind: "mutation" }), method(object({ state: string() }), string()), method(record(string(), string()), AuthResultSchema, { kind: "mutation" }), method(object({ token: string() }), AuthResultSchema.nullable());
 /**
+* `login-method` — collection cap through which auth addons contribute
+* their pre-auth login surfaces to the login page. This is the SINGLE,
+* generic mechanism that supersedes the dead `auth.listProviders` reader:
+* every auth addon (OIDC, magic-link, WebAuthn/passkey) registers a
+* `login-method` provider and the PUBLIC `auth.listLoginMethods`
+* procedure aggregates them for the unauthenticated login page.
+*
+* A contribution is a discriminated union on `kind`:
+*
+*  - `redirect` — a declarative button. The login page renders a generic
+*    button that navigates to `startUrl` (an addon-owned HTTP route).
+*    Covers OIDC (`/addon/auth-oidc/<id>/start`) and magic-link with
+*    ZERO shell-side JS. A future SSO addon plugs in the same way — the
+*    login page needs NO change.
+*
+*  - `widget` — a Module-Federation widget the login page mounts (via
+*    `loadRemoteBundle`) for an in-page ceremony. Covers the passkey
+*    login ceremony, which must run `@simplewebauthn/browser` INSIDE the
+*    addon bundle. The referenced widget also declares `preAuth: true` in
+*    its `addon-widgets-source` catalog entry. `auth.listLoginMethods`
+*    stamps a public `bundleUrl` from `addonId` + `bundle`.
+*
+* Every contribution carries a `stage`:
+*  - `primary`        — shown on the first credentials screen (OIDC /
+*                       magic-link buttons; a future usernameless passkey).
+*  - `second-factor`  — shown AFTER the password leg, gated on the
+*                       returned `factors` (passkey-as-2FA today).
+*
+* `mount: skip` — the cap is read server-side by the core auth router
+* (`registry.getCollection('login-method')`), never mounted as its own
+* tRPC router.
+*/
+/** When a login method renders in the two-phase login flow. */
+var LoginStageEnum = _enum(["primary", "second-factor"]);
+/** One login-method contribution — redirect button OR pre-auth widget. */
+var LoginMethodContributionSchema = discriminatedUnion("kind", [object({
+	kind: literal("redirect"),
+	/** Stable id within the login-method set (e.g. `auth-oidc/google`). */
+	id: string(),
+	/** Operator-facing button label. */
+	label: string(),
+	/** lucide-react icon name. */
+	icon: string().optional(),
+	/** Addon-owned HTTP route the button navigates to (GET). */
+	startUrl: string(),
+	stage: LoginStageEnum
+}), object({
+	kind: literal("widget"),
+	/** Stable id within the login-method set (e.g. `auth-webauthn/passkey-login`). */
+	id: string(),
+	/** Owning addon id — drives the public bundle URL + the MF namespace. */
+	addonId: string(),
+	/** Bundle filename inside the addon's dist dir (`remoteEntry.js`). */
+	bundle: string(),
+	/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
+	remote: WidgetRemoteSchema,
+	stage: LoginStageEnum
+})]);
+method(_void(), array(LoginMethodContributionSchema).readonly());
+/**
 * Orchestrator-side destination metadata. The orchestrator computes
 * `id = <addonId>:<subId>` from its provider lookup so consumers
 * (admin UI, restore flow) see one canonical key.
@@ -15689,7 +15763,12 @@ var AgentPipelineSettingsSchema = object({
 	detectWeight: number().positive().optional(),
 	/** Node is eligible to run the detection pipeline (decode + inference). */
 	detect: boolean().optional(),
-	/** Node is eligible to host decoder sessions. */
+	/**
+	* DEPRECATED AND IGNORED. Decode is always co-located with its frame
+	* consumer, so decode eligibility IS detect eligibility. Kept optional in
+	* the schema ONLY so persisted stores written before the removal still
+	* parse — no code reads it and no write path emits it.
+	*/
 	decode: boolean().optional(),
 	/** Node is eligible to run audio-analyzer sessions. */
 	audio: boolean().optional(),
@@ -15750,25 +15829,6 @@ var PipelineAssignmentSchema = object({
 	assignedAt: number()
 });
 /**
-* Decoder placement record. Symmetric to `PipelineAssignmentSchema` but for
-* the decoder-node placement domain (`balanceDecoder` decision: manual pin
-* → co-located with pipeline → capacity).
-*/
-var DecoderAssignmentSchema = object({
-	deviceId: number(),
-	/** Moleculer node id of the decoder provider currently responsible for this camera. */
-	decoderNodeId: string(),
-	/** True when the assignment was set manually via `assignDecoder`, false when chosen by the balancer. */
-	pinned: boolean(),
-	/** Why this assignment was made — useful for debugging the decoder balancer. */
-	reason: _enum([
-		"manual",
-		"co-located",
-		"capacity",
-		"hardware-affinity"
-	])
-});
-/**
 * Per-agent load summary surfaced to the load balancer + dashboards.
 * Aggregated from each runner's `getLocalLoad` cap call.
 */
@@ -15974,15 +16034,6 @@ method(object({
 }), method(_void(), IngestOwnerSchema), method(object({
 	deviceId: number(),
 	nodeId: string()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), array(DecoderAssignmentSchema).readonly()), method(object({
-	deviceId: number(),
-	nodeId: string()
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
@@ -16001,10 +16052,7 @@ method(object({
 	nodeId: string(),
 	pinned: boolean(),
 	assignedAt: number()
-}))), method(object({
-	deviceId: number(),
-	pipelineNodeId: string().optional()
-}), DecoderAssignmentSchema), method(object({ agentNodeId: string() }), AgentPipelineSettingsSchema.nullable()), method(_void(), array(object({
+}))), method(object({ agentNodeId: string() }), AgentPipelineSettingsSchema.nullable()), method(_void(), array(object({
 	nodeId: string(),
 	settings: AgentPipelineSettingsSchema
 })).readonly()), method(object({
@@ -16034,7 +16082,6 @@ method(object({
 }), method(object({
 	agentNodeId: string(),
 	detect: boolean().nullable().optional(),
-	decode: boolean().nullable().optional(),
 	audio: boolean().nullable().optional(),
 	ingest: boolean().nullable().optional()
 }), object({ success: literal(true) }), {
@@ -16046,6 +16093,15 @@ method(object({
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ agentNodeId: string() }), object({
+	success: literal(true),
+	/** Hardware-aware default detection model now in effect on the node (null when unresolvable). */
+	effectiveModelId: string().nullable(),
+	/** Number of cameras whose node-scoped overrides were cleared. */
+	clearedCameraOverrides: number()
+}), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ deviceId: number() }), CameraPipelineSettingsSchema.nullable()), method(object({
 	deviceId: number(),
 	addonId: string(),
@@ -16091,6 +16147,131 @@ method(object({
 	auth: "admin"
 });
 /**
+* server-management — per-NODE singleton capability for a node's ROOT
+* package lifecycle (runtime-updatable node packages, phase 2: hub + docker
+* agents).
+*
+* Each node's root package (`@camstack/server` on the hub, `@camstack/agent`
+* on agents) carries the whole software stack in its npm dep tree, so ONE
+* version describes the node. Updates install into
+* `<dataDir>/server-root/versions/<v>/` and apply on restart via the baked
+* starter (probation boot + auto-rollback to N-1).
+*
+* Providers:
+*   - HUB: `ServerUpdateService` behind the `server-provided` mount
+*     (`buildServerProviders` in trpc.router.ts) — the default target for
+*     unpinned calls.
+*   - AGENT: `AgentUpdateService` registered by the agent bootstrap under
+*     the synthetic `agent-runtime` addonId and declared in the agent's
+*     `$hub.registerNode` manifest.
+*
+* Node routing: singleton caps get the codegen/runtime-builder `nodeId`
+* injection on every method — `input.nodeId` (or `nodePin(nodeId)` from the
+* SDK) routes the call to that node's provider via the standard remote
+* proxy (`createCapabilityProxy` → `$agent-cap-fwd` → the agent's
+* in-process provider lookup). No `nodeId` → the hub's own provider.
+*
+* Spec: docs/superpowers/specs/2026-07-12-runtime-updatable-node-packages-design.md
+*/
+/**
+* Where the running hub's code was loaded from:
+*  - `workspace` — dev checkout (tsx / workspace dist); the starter defers to
+*    plain resolution and runtime updates are refused.
+*  - `baked`     — the immutable image seed closure (no data-dir root active).
+*  - `data-root` — the runtime-updatable `<dataDir>/server-root` closure.
+*/
+var ServerBootModeSchema = _enum([
+	"workspace",
+	"baked",
+	"data-root"
+]);
+/**
+* Update lifecycle state:
+*  - `idle` / `checking` / `staging` — steady / in-flight registry work.
+*  - `pending-restart` — a version is staged and the node has NOT yet
+*    restarted onto it (still running the OLD version).
+*  - `awaiting-confirmation` — the node HAS restarted onto the staged version
+*    (it is the active probation boot) and is waiting to confirm boot-health.
+*    Apply/rollback are refused in this state and the node must NOT be
+*    manually restarted, or the probation boot auto-rolls-back.
+*/
+var ServerUpdateStateSchema = _enum([
+	"idle",
+	"checking",
+	"staging",
+	"pending-restart",
+	"awaiting-confirmation"
+]);
+var ServerRollbackInfoSchema = object({
+	/** The version that failed (or was manually rolled back). */
+	fromVersion: string(),
+	/** The version rolled back to; null = the baked seed. */
+	toVersion: string().nullable(),
+	atMs: number(),
+	reason: string()
+});
+var ServerPackageStatusSchema = object({
+	/** Root package name (`@camstack/server` on the hub). */
+	packageName: string(),
+	/** Version of the code the running process ACTUALLY loaded. */
+	runningVersion: string().nullable(),
+	/** Node.js runtime version the node's process runs on (`process.versions.node`). */
+	nodeRuntimeVersion: string().nullable(),
+	/** Active data-dir root version; null when booted from seed/workspace. */
+	activeVersion: string().nullable(),
+	/** N-1 version kept for rollback; null when no previous version exists. */
+	previousVersion: string().nullable(),
+	/** Version of the immutable baked seed closure (image fallback). */
+	seedVersion: string().nullable(),
+	/** Latest registry version from the most recent check (null = never checked). */
+	latestVersion: string().nullable(),
+	updateAvailable: boolean(),
+	bootMode: ServerBootModeSchema,
+	updateState: ServerUpdateStateSchema,
+	/** Version staged + awaiting its probation boot, when one is pending. */
+	pendingVersion: string().nullable(),
+	/** Set when the last freshly-activated version failed its boot health-check. */
+	rolledBack: ServerRollbackInfoSchema.nullable(),
+	/**
+	* True when `server-root/state.json` EXISTS but is unreadable/corrupt — the
+	* hub is running from the baked seed (or workspace) while installed data-dir
+	* versions are being IGNORED. Surfaced as a warning in the UI.
+	*/
+	stateFileCorrupt: boolean(),
+	lastCheckedAtMs: number().nullable()
+});
+var ServerUpdateCheckResultSchema = object({
+	packageName: string(),
+	runningVersion: string().nullable(),
+	latestVersion: string().nullable(),
+	updateAvailable: boolean(),
+	checkedAtMs: number(),
+	/** Non-null when the registry lookup failed (offline, bad registry, …). */
+	error: string().nullable()
+});
+var ServerUpdateActionResultSchema = object({
+	accepted: boolean(),
+	targetVersion: string().nullable(),
+	/** True when a graceful restart was scheduled to apply the change. */
+	restarting: boolean(),
+	message: string()
+});
+method(_void(), ServerPackageStatusSchema, { auth: "admin" }), method(_void(), ServerUpdateCheckResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ 
+/** Explicit target version; omitted = latest from the registry. */
+version: string().optional() }), ServerUpdateActionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), ServerUpdateActionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), ServerUpdateActionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * Query filter for settings-store collections.
 */
 var QueryFilterSchema = object({
@@ -18120,6 +18301,16 @@ var TopologyCategorySchema = object({
 	healthy: number(),
 	addons: array(TopologyCategoryAddonSchema).readonly()
 });
+/**
+* The node's runtime-updatable ROOT package (`@camstack/server` on the hub,
+* `@camstack/agent` on agents) as reported by its `registerNode` manifest —
+* version visibility for the Server management surface. Nullable: offline
+* rows and pre-phase-2 nodes report none.
+*/
+var TopologyRootPackageSchema = object({
+	name: string(),
+	version: string()
+});
 var TopologyNodeSchema = object({
 	id: string(),
 	name: string(),
@@ -18143,7 +18334,8 @@ var TopologyNodeSchema = object({
 		status: string()
 	})).readonly(),
 	processes: array(TopologyProcessSchema).readonly(),
-	categories: array(TopologyCategorySchema).readonly()
+	categories: array(TopologyCategorySchema).readonly(),
+	rootPackage: TopologyRootPackageSchema.nullable()
 });
 var CapUsageEdgeSchema = object({
 	callerAddonId: string(),
@@ -20985,6 +21177,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"loginMethod.getLoginMethods": {
+		capName: "login-method",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"mediaPlayer.next": {
 		capName: "media-player",
 		capScope: "device",
@@ -21615,23 +21813,23 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineExecutor.deleteModel": {
+	"pipelineExecutor.clearDeviceOverrides": {
 		capName: "pipeline-executor",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
-	"pipelineExecutor.deleteTemplate": {
+	"pipelineExecutor.deleteModel": {
 		capName: "pipeline-executor",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
-	"pipelineExecutor.detect": {
+	"pipelineExecutor.deleteTemplate": {
 		capName: "pipeline-executor",
 		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "delete"
 	},
 	"pipelineExecutor.downloadModel": {
 		capName: "pipeline-executor",
@@ -21777,12 +21975,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineExecutor.resetToDefault": {
-		capName: "pipeline-executor",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
 	"pipelineExecutor.runAudioTest": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -21843,12 +22035,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.assignDecoder": {
-		capName: "pipeline-orchestrator",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineOrchestrator.assignPipeline": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -21927,18 +22113,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"pipelineOrchestrator.getDecoderAssignment": {
-		capName: "pipeline-orchestrator",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"pipelineOrchestrator.getDecoderAssignments": {
-		capName: "pipeline-orchestrator",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"pipelineOrchestrator.getGlobalMetrics": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -21987,6 +22161,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineOrchestrator.resetNodePipelineDefaults": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineOrchestrator.resolvePipeline": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -22059,12 +22239,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.unassignDecoder": {
-		capName: "pipeline-orchestrator",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineOrchestrator.unassignPipeline": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -22371,6 +22545,36 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"serverManagement.applyServerUpdate": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"serverManagement.checkServerUpdate": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"serverManagement.getServerPackageStatus": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"serverManagement.restartServer": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"serverManagement.rollbackServerUpdate": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"settingsStore.count": {
 		capName: "settings-store",
 		capScope: "system",
@@ -23235,6 +23439,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"viewerUi.getStaticDir": {
+		capName: "viewer-ui",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"viewerUi.getVersion": {
+		capName: "viewer-ui",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"waterHeater.setAway": {
 		capName: "water-heater",
 		capScope: "device",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-onvif",
-  "version": "1.1.21",
+  "version": "1.1.22",
   "description": "ONVIF camera device provider addon for CamStack",
   "keywords": [
     "camstack",
@@ -47,6 +47,9 @@
           }
         ]
       }
+    ],
+    "runtimeDependencies": [
+      "onvif"
     ]
   },
   "files": [