@camstack/addon-provider-rtsp 1.1.19 → 1.1.21

package/dist/addon.mjs

@@ -1,3 +1,4 @@
+import net from "node:net";
 //#region ../../node_modules/zod/v4/core/core.js
 var _a$1;
 function $constructor(name, initializer, params) {
@@ -4641,7 +4642,7 @@ function preprocess(fn, schema) {
 	});
 }
 //#endregion
-//#region ../types/dist/sleep-CZDdRBua.mjs
+//#region ../types/dist/sleep-BC9Yqte7.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -4827,6 +4828,18 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["PipelineCameraUpdated"] = "pipeline.camera-updated";
 	/**
+	* The cluster camera-source OWNER changed (`clusterRoles.ingestNode`).
+	* Emitted by addon-pipeline-orchestrator whenever it (re)derives node
+	* capabilities — at boot, on agent online/offline, and on an ingest-node
+	* flip. Carries the resolved `ownerNodeId`. The stream-broker consumes it to
+	* keep its ingest-owner-gate decision current WITHOUT a per-`ensureBroker`
+	* cross-process `getIngestOwner` query (push the authority's decision instead
+	* of polling it on the hot path). Idempotent state — re-emitted on every
+	* topology change, so a dropped event self-heals on the next one (plus the
+	* broker's long backstop reconcile query).
+	*/
+	EventCategory["PipelineIngestOwnerChanged"] = "pipeline.ingest-owner-changed";
+	/**
 	* Periodic snapshot of per-node pipeline-runner load
 	* (`RunnerLocalLoad`). Emitted ~1Hz by every runner so UI dashboards
 	* subscribe instead of polling `pipelineRunner.getLocalLoad`.
@@ -5350,10 +5363,6 @@ function hydrateField(field, values) {
 		};
 	}
 	const rawValue = storedValue !== void 0 ? storedValue : defaultValue !== void 0 ? defaultValue : null;
-	if (field.type === "password") return {
-		...field,
-		value: ""
-	};
 	const value = field.type === "textarea" && field.isJson && rawValue !== null && typeof rawValue === "object" ? JSON.stringify(rawValue, null, 2) : rawValue;
 	return {
 		...field,
@@ -6737,10 +6746,25 @@ function method(input, output, options) {
 		timeoutMs: options?.timeoutMs
 	};
 }
+/**
+* A wrapper/system-only method: served exclusively by the cap's system-level
+* provider (`InferProvider`), and OPTIONAL on `InferNativeProvider` so per-device
+* driver natives don't stub out a wrapper concern (e.g. a cross-device cache
+* overview). The `systemOnly: true` literal is what `InferNativeProvider` keys on.
+*/
+function systemMethod(input, output, options) {
+	return {
+		...method(input, output, options),
+		systemOnly: true
+	};
+}
 /** Shorthand to define an event schema */
 function event(data) {
 	return { data };
 }
+var StaticDirOutputSchema$1 = object({ staticDir: string() });
+var VersionOutputSchema$1 = object({ version: string() });
+method(_void(), StaticDirOutputSchema$1), method(_void(), VersionOutputSchema$1);
 var StaticDirOutputSchema = object({ staticDir: string() });
 var VersionOutputSchema = object({ version: string() });
 method(_void(), StaticDirOutputSchema), method(_void(), VersionOutputSchema);
@@ -6910,6 +6934,36 @@ var ModelFormatsSchema = object({
 	tflite: ModelFormatEntrySchema.optional(),
 	pt: ModelFormatEntrySchema.optional()
 });
+/**
+* Variant-selector grouping axes. Shared by the full `ModelCatalogEntry` and by
+* the reduced `PipelineModelOption` returned in `pipeline.getSchema()` so the
+* grouped Family→Tier→Variant picker renders identically in the config UI and
+* in the pipeline/device steppers. The flat `id` stays the source of truth for
+* resolution/download/persistence; this is a presentation overlay resolved back
+* to an `id`.
+*/
+var ModelVariantGroupSchema = object({
+	/** Top-level family, e.g. `yolo26` (later `d-fine`, `rf-detr`). */
+	family: string(),
+	/** Size within the family, e.g. `n` | `s` | `m` | `l`. */
+	tier: string(),
+	/** Quantization axis. Omit ⇒ the fp32 base build. */
+	precision: _enum(["fp32", "int8"]).optional(),
+	/**
+	* Speed-optimization axis. Omit ⇒ the standard build. `fast` marks a
+	* latency-optimized export (e.g. ReLU-activation variant) — the slot the
+	* future performance variants plug into.
+	*/
+	optimization: _enum(["standard", "fast"]).optional(),
+	/**
+	* Input-resolution axis (square input side, px). Omit ⇒ the family's native
+	* resolution (640 for yolo26). Reduced-input builds (320 / 256) are a big,
+	* cheap latency lever — especially on Apple ANE and the Intel N100 — at a
+	* small-object accuracy cost. Mirrors the model's `inputSize` but lifted onto
+	* the group so the selector can offer it as a variant axis.
+	*/
+	resolution: number().int().positive().optional()
+});
 var ModelCatalogEntrySchema = object({
 	id: string(),
 	name: string(),
@@ -6939,7 +6993,43 @@ var ModelCatalogEntrySchema = object({
 	* Auxiliary files required at runtime (labels JSON, charset dict, etc.).
 	* Downloaded into the same modelsDir alongside the model file.
 	*/
-	extraFiles: array(ModelExtraFileSchema).readonly().optional()
+	extraFiles: array(ModelExtraFileSchema).readonly().optional(),
+	/**
+	* LEGACY entry — retained in the catalog so a persisted operator selection
+	* still RESOLVES (and can be re-activated), but hidden from the selectable
+	* model list and excluded from the auto format-default pick. Set on the
+	* superseded / consolidated models (older lineages, redundant fp16 IRs) so
+	* the active lineup stays the coherent curated ladder without deleting a
+	* model anyone may still be pinned to. `resolveModelForFormat` keeps honoring
+	* an explicit legacy id that has a build for the node's format.
+	*/
+	legacy: boolean().optional(),
+	/**
+	* Measured quality/latency metadata — populated from the benchmark addon on
+	* the real node classes. Absent = not yet measured (most entries today; the
+	* catalog historically carried only `sizeMB`, a poor cross-architecture
+	* speed proxy). `p95LatencyMs` is keyed by node class (e.g. `n100`, `mac`).
+	*/
+	metrics: object({
+		map50: number().optional(),
+		p95LatencyMs: record(string(), number()).optional()
+	}).optional(),
+	/**
+	* SPDX-ish license id of the model weights (e.g. `AGPL-3.0` for Ultralytics
+	* YOLO26, `GPL-3.0` for YOLOv9, `Apache-2.0` for D-FINE/RF-DETR). Matters for
+	* the retraining addon and any future commercial distribution.
+	*/
+	license: string().optional(),
+	/**
+	* Variant-selector grouping. The UI groups models by `family` + `tier` and
+	* offers `precision` / `optimization` as variant axes WITHIN a tier — so all
+	* of a family's sizes and quantizations collapse into one grouped picker
+	* instead of a flat list of `yolo26s`, `yolo26s-int8`, … Absent ⇒ ungrouped
+	* (legacy / custom models) — never shown in the grouped selector. The flat
+	* `id` stays the source of truth for resolution/download/persistence; grouping
+	* is a presentation overlay resolved back to an `id`.
+	*/
+	group: ModelVariantGroupSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -7000,8 +7090,8 @@ var RecordingModeSchema = _enum([
 	"onAudioThreshold"
 ]);
 /**
-* First-class, authoritative per-camera storage mode — the netta choice the UI
-* reads directly (never inferred from `rules`):
+* First-class, authoritative per-camera storage mode — the explicit choice the
+* UI reads directly (never inferred from `rules`):
 *  - `off`        — not recording.
 *  - `events`     — record only around triggers (motion / audio threshold),
 *                   with pre/post-buffer.
@@ -8533,6 +8623,72 @@ function shallowEqual(a, b) {
 	for (const k of ak) if (a[k] !== b[k]) return false;
 	return true;
 }
+/** Reject after `ms`; always clears its own timer. */
+async function withTimeout(promise, ms, label) {
+	let timer;
+	const timeout = new Promise((_resolve, reject) => {
+		timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`${label} timed out after ${String(ms)}ms`)), ms);
+	});
+	try {
+		return await Promise.race([promise, timeout]);
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
+	}
+}
+/**
+* Start the reachability poll loop. Returns a handle whose `stop()` clears the
+* timer and prevents any further ticks. Start on device activation, stop on
+* device teardown (`removeDevice`) so no timer leaks.
+*/
+function startReachabilityPoll(options) {
+	const intervalMs = options.intervalMs ?? 3e4;
+	const failuresToOffline = options.failuresToOffline ?? 3;
+	const probeTimeoutMs = options.probeTimeoutMs ?? 1e4;
+	const runImmediately = options.runImmediately ?? true;
+	let stopped = false;
+	let running = false;
+	let consecutiveFailures = 0;
+	let timer;
+	const tick = async () => {
+		if (stopped) return;
+		if (running) return;
+		if (options.isEnabled && !options.isEnabled()) return;
+		running = true;
+		try {
+			const reachable = await withTimeout(Promise.resolve().then(options.probe), probeTimeoutMs, "reachability probe");
+			if (stopped) return;
+			if (reachable) {
+				consecutiveFailures = 0;
+				options.setOnline(true);
+			} else registerFailure("probe resolved unreachable");
+		} catch (error) {
+			if (stopped) return;
+			registerFailure(error instanceof Error ? error.message : "probe threw");
+		} finally {
+			running = false;
+		}
+	};
+	const registerFailure = (reason) => {
+		consecutiveFailures += 1;
+		options.logger?.debug("reachability probe failed", {
+			reason,
+			consecutiveFailures,
+			failuresToOffline
+		});
+		if (consecutiveFailures >= failuresToOffline) options.setOnline(false);
+	};
+	timer = setInterval(() => {
+		tick();
+	}, intervalMs);
+	if (typeof timer === "object" && timer !== null && "unref" in timer) timer.unref();
+	if (runImmediately) tick();
+	return { stop: () => {
+		if (stopped) return;
+		stopped = true;
+		if (timer !== void 0) clearInterval(timer);
+		timer = void 0;
+	} };
+}
 /**
 * Generic device-level status snapshot. Auto-registered by `BaseDevice`
 * for every device, regardless of provider — the kernel needs a uniform
@@ -9196,26 +9352,13 @@ onBrightnessChanged: { data: object({
 	*/
 	runtimeState: BrightnessStatusSchema
 };
+/** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
 var StreamFormatSchema = _enum([
 	"webrtc",
 	"hls",
 	"mjpeg",
 	"rtsp"
 ]);
-var StreamInfoSchema = object({
-	streamId: string(),
-	format: StreamFormatSchema,
-	url: string().nullable(),
-	active: boolean()
-});
-method(object({
-	streamId: string(),
-	sourceUrl: string(),
-	codec: string().optional()
-}), _void(), { kind: "mutation" }), method(object({ streamId: string() }), _void(), { kind: "mutation" }), method(object({
-	streamId: string(),
-	format: StreamFormatSchema
-}), string().nullable()), method(_void(), array(StreamInfoSchema));
 var RtspRestreamEntrySchema = object({
 	brokerId: string(),
 	url: string(),
@@ -10083,37 +10226,7 @@ var consumablesCapability = {
 	scope: "device",
 	deviceNative: true,
 	mode: "singleton",
-	deviceTypes: [
-		DeviceType.Camera,
-		DeviceType.Hub,
-		DeviceType.Light,
-		DeviceType.Siren,
-		DeviceType.Switch,
-		DeviceType.Sensor,
-		DeviceType.Thermostat,
-		DeviceType.Button,
-		DeviceType.EventEmitter,
-		DeviceType.Update,
-		DeviceType.Generic,
-		DeviceType.Notifier,
-		DeviceType.Script,
-		DeviceType.Automation,
-		DeviceType.Lock,
-		DeviceType.Cover,
-		DeviceType.Valve,
-		DeviceType.Humidifier,
-		DeviceType.WaterHeater,
-		DeviceType.Fan,
-		DeviceType.MediaPlayer,
-		DeviceType.AlarmPanel,
-		DeviceType.Control,
-		DeviceType.Presence,
-		DeviceType.Weather,
-		DeviceType.Vacuum,
-		DeviceType.LawnMower,
-		DeviceType.Container,
-		DeviceType.Image
-	],
+	deviceTypes: Object.values(DeviceType),
 	deviceConfig: { ui: {
 		kind: "widget",
 		widgetId: "host/consumables-panel",
@@ -11571,7 +11684,7 @@ var BoundingBoxSchema = object({
 	w: number(),
 	h: number()
 });
-var SpatialDetectionSchema = object({
+object({
 	class: string(),
 	originalClass: string(),
 	score: number(),
@@ -11706,7 +11819,6 @@ var PipelineDefaultStepSchema = lazy(() => object({
 	enabled: boolean(),
 	modelId: string(),
 	children: array(PipelineDefaultStepSchema).readonly(),
-	engine: PipelineEngineChoiceSchema.optional(),
 	group: string().optional(),
 	settings: record(string(), unknown()).optional()
 }));
@@ -11731,7 +11843,9 @@ var PipelineModelOptionSchema = object({
 	formats: record(string(), object({
 		downloaded: boolean(),
 		sizeMB: number()
-	}))
+	})),
+	group: ModelVariantGroupSchema.optional(),
+	legacy: boolean().optional()
 });
 var ConfigFieldBridge = custom();
 var PipelineAddonSchemaSchema = object({
@@ -11745,6 +11859,7 @@ var PipelineAddonSchemaSchema = object({
 	defaultModelId: string(),
 	defaultModelIdByFormat: record(string(), string()).optional(),
 	enabledByDefault: boolean().optional(),
+	backfillIntoExistingOverrides: boolean().optional(),
 	defaultConfidence: number(),
 	group: string().optional(),
 	configSchema: array(ConfigFieldBridge).readonly().optional()
@@ -11761,11 +11876,6 @@ var PipelineSchemaSchema = object({
 	selectedEngine: PipelineEngineChoiceSchema,
 	slots: array(PipelineSlotSchemaSchema).readonly()
 });
-var DetectorOutputSchema = object({
-	detections: array(SpatialDetectionSchema).readonly(),
-	inferenceMs: number(),
-	modelId: string()
-});
 var EngineProvisioningSchema = object({
 	runtimeId: _enum([
 		"onnx",
@@ -11782,15 +11892,42 @@ var EngineProvisioningSchema = object({
 	]),
 	progress: number().optional(),
 	error: string().optional(),
-	nextRetryAt: number().optional()
+	nextRetryAt: number().optional(),
+	/**
+	* Gate A (config-correctness gate at engine change): human-readable
+	* config issues surfaced EAGERLY when the node's engine changes — model
+	* substitutions ("chose X, running Y") and zero-build steps ("no model
+	* has a <format> build"). Additive/optional: informational only, never
+	* enforced here — `assertEngineReady` (readiness) still gates inference.
+	* Absent/empty when the node-default tree resolves cleanly.
+	*/
+	configIssues: array(string()).optional()
 });
 var PipelineStepInputSchema = lazy(() => object({
 	addonId: string(),
-	modelId: string(),
+	modelId: string().optional(),
 	enabled: boolean().default(true),
 	children: array(PipelineStepInputSchema).optional(),
 	settings: record(string(), unknown()).optional()
 }));
+var ModelSubstitutionSchema = object({
+	addonId: string(),
+	chosen: string(),
+	running: string(),
+	format: string()
+});
+var PipelineValidationIssueSchema = object({
+	addonId: string(),
+	kind: _enum(["unknown-addon", "no-format-build"]),
+	detail: string()
+});
+var PipelineValidationResultSchema = object({
+	ok: boolean(),
+	issues: array(PipelineValidationIssueSchema).readonly(),
+	substitutions: array(ModelSubstitutionSchema).readonly(),
+	/** The node's `currentEngine.format` this validation ran against. */
+	format: string()
+});
 var ReferenceImageEntrySchema = object({
 	filename: string(),
 	stepIds: array(string()).readonly().optional()
@@ -11861,7 +11998,13 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 })) }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), PipelineSchemaSchema), method(_void(), array(PipelineDefaultStepSchema).readonly().nullable()), method(_void(), PipelineConfigBridge), method(_void(), ConfigUISchemaBridge), method(_void(), array(PipelineTemplateSchema$1).readonly()), method(object({
+}), method(object({ nodeId: string() }), object({
+	success: literal(true),
+	clearedDevices: number()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), PipelineSchemaSchema), method(_void(), array(PipelineDefaultStepSchema).readonly().nullable()), method(_void(), PipelineConfigBridge), method(_void(), ConfigUISchemaBridge), method(object({ steps: array(PipelineStepInputSchema) }), PipelineValidationResultSchema), method(_void(), array(PipelineTemplateSchema$1).readonly()), method(object({
 	name: string(),
 	steps: array(PipelineTemplateStepSchema).readonly(),
 	engine: PipelineEngineChoiceSchema
@@ -11878,10 +12021,6 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	modelId: string(),
 	format: ModelFormatSchema$1
 }), object({ success: literal(true) }), { kind: "mutation" }), method(object({
-	addonId: string(),
-	frame: FrameInputSchema,
-	config: record(string(), unknown()).optional()
-}), DetectorOutputSchema), method(object({
 	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).min(1),
 	frame: FrameInputSchema.optional(),
@@ -12060,6 +12199,25 @@ var zonesCapability = {
 	runtimeState: object({ zones: array(ZoneSchema).readonly() })
 };
 /**
+* A bounding box in NORMALIZED [0,1] frame coordinates for `getNativeCrop`. The
+* decode worker resolves it against the RETAINED native frame's real pixel dims,
+* so the caller supplies only the detection-res bbox divided by the detection
+* dims — no native resolution to plumb.
+*/
+var NativeCropBboxSchema = object({
+	x: number(),
+	y: number(),
+	w: number(),
+	h: number()
+});
+/** Result of a best-effort native-resolution crop (`getNativeCrop`). */
+var NativeCropResultSchema = object({
+	/** Packed rgb (24-bit) pixels of the crop. */
+	bytes: _instanceof(Uint8Array),
+	width: number().int().positive(),
+	height: number().int().positive()
+});
+/**
 * Per-camera tunable ranges + defaults. Single source of truth used
 * by both the Zod data schema (validation + default fallback) and
 * the device settings UI (slider min/max/step). Touch one place and
@@ -12154,6 +12312,13 @@ var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal
 	kind: literal("remote-restream"),
 	/** The camera's source-owner node (slice 1: always the hub). */
 	ownerNodeId: string(),
+	/**
+	* The owner's LAN-reachable host, resolved by the orchestrator from the
+	* per-node `reachableHost` override (Cluster UI). When present the runner
+	* dials THIS host for the owner's restream, in preference to the
+	* `CAMSTACK_HUB_URL`-derived default. Absent → auto-detect fallback.
+	*/
+	ownerReachableHost: string().optional(),
 	/** Operator override for the owner host the runner dials. */
 	hubHostnameOverride: string().optional()
 })]).describe("Per-camera frame-source mode for the runner (P2c)");
@@ -12162,13 +12327,11 @@ var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal
 * specific runner instance via `attachCamera`. Carries everything the
 * runner needs to subscribe to the local broker and execute inference.
 *
-* Stateless-pipeline model: the full pipeline content (`engine`, `steps`,
-* optional `audio`) travels with the attach payload. The runner keeps it
-* in RAM for the lifetime of the attach — on rebalance, edit, or
-* restart the orchestrator re-sends the latest snapshot.
-*
-* `engine`/`steps`/`audio` are optional during the additive migration
-* window; once orchestrator + UI are migrated they become required.
+* Stateless-pipeline model: the pipeline content (`steps`, optional
+* `audio`) travels with the attach payload. The runner keeps it in RAM
+* for the lifetime of the attach — on rebalance, edit, or restart the
+* orchestrator re-sends the latest snapshot. Engine is NOT carried: it is
+* node-local, resolved by the executing runner at dispatch time.
 */
 var RunnerCameraConfigSchema = object({
 	deviceId: number(),
@@ -12219,14 +12382,11 @@ var RunnerCameraConfigSchema = object({
 	*/
 	motionSources: MotionSourcesSchema.default(["analyzer"]),
 	pipelineEnabled: boolean().default(true),
-	/** Engine choice for video steps (runtime+backend+format). */
-	engine: PipelineEngineChoiceSchema.optional(),
 	/** Ordered tree of video steps. Absent → runner skips video detection. */
 	steps: array(PipelineStepInputSchema).readonly().optional(),
 	/** Audio classification branch. `enabled:false` disables, null skips. */
 	audio: object({
-		engine: PipelineEngineChoiceSchema,
-		modelId: string(),
+		modelId: string().optional(),
 		enabled: boolean()
 	}).nullable().optional(),
 	/**
@@ -12313,7 +12473,11 @@ var RunnerLocalMetricsSchema = object({
 	avgInferenceTimeMs: number(),
 	queueDepth: number()
 });
-method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mutation" }), method(object({ deviceId: number() }), object({ success: literal(true) }), { kind: "mutation" }), method(ReportMotionInputSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), RunnerLocalLoadSchema), method(_void(), RunnerLocalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(_void(), array(CameraMetricsWithDeviceIdSchema).readonly()), method(_void(), array(number()).readonly());
+method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mutation" }), method(object({ deviceId: number() }), object({ success: literal(true) }), { kind: "mutation" }), method(ReportMotionInputSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), RunnerLocalLoadSchema), method(_void(), RunnerLocalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(_void(), array(CameraMetricsWithDeviceIdSchema).readonly()), method(_void(), array(number()).readonly()), method(object({
+	handle: FrameHandleSchema,
+	bbox: NativeCropBboxSchema,
+	maxWidth: number().int().positive().optional()
+}), NativeCropResultSchema.nullable());
 /**
 * Hardware / firmware motion sensor cap — binary detected state plus
 * a timestamp of the last observation. Distinct from
@@ -15244,7 +15408,9 @@ var AddonPageDeclarationSchema$1 = object({
 	icon: string(),
 	path: string(),
 	remoteName: string(),
-	bundle: string()
+	bundle: string(),
+	section: string().optional(),
+	sectionLabel: string().optional()
 });
 var AddonPageInfoSchema = object({
 	addonId: string(),
@@ -15284,7 +15450,18 @@ var AddonPageDeclarationSchema = object({
 	* the static-file route can compute an mtime-based cache-buster URL
 	* without a separate filesystem stat.
 	*/
-	bundle: string()
+	bundle: string(),
+	/**
+	* Sidebar section this page docks into. Well-known ids: `'detection'`,
+	* `'cluster'`, `'administration'` — the page renders inside that group.
+	* Any OTHER string creates (or joins) a custom section rendered after
+	* the built-in groups; its label comes from `sectionLabel` (first
+	* declaration wins), falling back to the id. Absent → the legacy
+	* "Addon Pages" group.
+	*/
+	section: string().optional(),
+	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
+	sectionLabel: string().optional()
 });
 method(_void(), array(AddonPageDeclarationSchema).readonly());
 var AddonHttpRouteSchema = object({
@@ -15500,6 +15677,17 @@ var WidgetMetadataSchema = object({
 		deviceContext: boolean().default(false),
 		integrationContext: boolean().default(false)
 	}),
+	/**
+	* Loadable BEFORE authentication. The normal widget registry listing
+	* (`addon-widgets.listWidgets`) is auth-gated, so a pre-auth surface
+	* (the login page) cannot discover a widget through it. A widget that
+	* declares `preAuth: true` marks itself as safe to mount on a pre-auth
+	* screen — it is surfaced through the PUBLIC `auth.listLoginMethods`
+	* login-method contribution channel (see `login-method.cap.ts`) rather
+	* than the authenticated registry, and its bundle is served by the
+	* public `/api/addon-widgets/:addonId/*` static route. Defaults false.
+	*/
+	preAuth: boolean().optional().default(false),
 	/** Dashboard placement HINTS (operator can override per instance). */
 	defaultSize: WidgetSizeEnum.default("md"),
 	allowedSizes: array(WidgetSizeEnum).readonly().default([
@@ -15801,6 +15989,66 @@ method(object({
 	password: string()
 }), AuthResultSchema.nullable(), { kind: "mutation" }), method(object({ state: string() }), string()), method(record(string(), string()), AuthResultSchema, { kind: "mutation" }), method(object({ token: string() }), AuthResultSchema.nullable());
 /**
+* `login-method` — collection cap through which auth addons contribute
+* their pre-auth login surfaces to the login page. This is the SINGLE,
+* generic mechanism that supersedes the dead `auth.listProviders` reader:
+* every auth addon (OIDC, magic-link, WebAuthn/passkey) registers a
+* `login-method` provider and the PUBLIC `auth.listLoginMethods`
+* procedure aggregates them for the unauthenticated login page.
+*
+* A contribution is a discriminated union on `kind`:
+*
+*  - `redirect` — a declarative button. The login page renders a generic
+*    button that navigates to `startUrl` (an addon-owned HTTP route).
+*    Covers OIDC (`/addon/auth-oidc/<id>/start`) and magic-link with
+*    ZERO shell-side JS. A future SSO addon plugs in the same way — the
+*    login page needs NO change.
+*
+*  - `widget` — a Module-Federation widget the login page mounts (via
+*    `loadRemoteBundle`) for an in-page ceremony. Covers the passkey
+*    login ceremony, which must run `@simplewebauthn/browser` INSIDE the
+*    addon bundle. The referenced widget also declares `preAuth: true` in
+*    its `addon-widgets-source` catalog entry. `auth.listLoginMethods`
+*    stamps a public `bundleUrl` from `addonId` + `bundle`.
+*
+* Every contribution carries a `stage`:
+*  - `primary`        — shown on the first credentials screen (OIDC /
+*                       magic-link buttons; a future usernameless passkey).
+*  - `second-factor`  — shown AFTER the password leg, gated on the
+*                       returned `factors` (passkey-as-2FA today).
+*
+* `mount: skip` — the cap is read server-side by the core auth router
+* (`registry.getCollection('login-method')`), never mounted as its own
+* tRPC router.
+*/
+/** When a login method renders in the two-phase login flow. */
+var LoginStageEnum = _enum(["primary", "second-factor"]);
+/** One login-method contribution — redirect button OR pre-auth widget. */
+var LoginMethodContributionSchema = discriminatedUnion("kind", [object({
+	kind: literal("redirect"),
+	/** Stable id within the login-method set (e.g. `auth-oidc/google`). */
+	id: string(),
+	/** Operator-facing button label. */
+	label: string(),
+	/** lucide-react icon name. */
+	icon: string().optional(),
+	/** Addon-owned HTTP route the button navigates to (GET). */
+	startUrl: string(),
+	stage: LoginStageEnum
+}), object({
+	kind: literal("widget"),
+	/** Stable id within the login-method set (e.g. `auth-webauthn/passkey-login`). */
+	id: string(),
+	/** Owning addon id — drives the public bundle URL + the MF namespace. */
+	addonId: string(),
+	/** Bundle filename inside the addon's dist dir (`remoteEntry.js`). */
+	bundle: string(),
+	/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
+	remote: WidgetRemoteSchema,
+	stage: LoginStageEnum
+})]);
+method(_void(), array(LoginMethodContributionSchema).readonly());
+/**
 * Orchestrator-side destination metadata. The orchestrator computes
 * `id = <addonId>:<subId>` from its provider lookup so consumers
 * (admin UI, restore flow) see one canonical key.
@@ -17904,7 +18152,17 @@ var TrackSchema = object({
 	/** Cumulative normalized distance travelled (0..1 units = full frame width). */
 	totalDistance: number(),
 	state: TrackStateSchema,
-	active: boolean()
+	active: boolean(),
+	/** Deterministic key-event importance score in [0,1] (server-computed at
+	*  track expiry, recomputed on late label). Absent on legacy rows written
+	*  before scoring shipped — consumers degrade to absence / compute-on-read. */
+	importance: number().optional(),
+	/** Id of the track's highest-confidence ObjectEvent (its representative
+	*  "best" frame). Absent when the track produced no object events. */
+	bestEventId: string().optional(),
+	/** Tag of the importance sub-signal that dominated the score
+	*  (identity|dwell|proximity|class|confidence|travel|zone). */
+	importanceReason: string().optional()
 });
 var BaseEventFields = {
 	id: string(),
@@ -17969,8 +18227,18 @@ var ObjectEventSchema = object({
 	frameHeight: number().optional(),
 	/** MediaStore key for the crop attached to this event (if any). */
 	mediaKey: string().optional(),
+	/** Design B: MediaStore key of the track's native-resolution key frame (the
+	*  best-detection full frame). Resolve via the event-media data-plane
+	*  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`) for a detail view that
+	*  draws `bbox` over the native frame. Absent on legacy rows / non-decoded
+	*  sources — consumers fall back to `mediaKey` (the tight crop). */
+	keyFrameMediaKey: string().optional(),
 	/** Populated by B5 (recording playback URL for this event). */
-	mediaUrl: string().optional()
+	mediaUrl: string().optional(),
+	/** The parent track's key-event importance [0,1], propagated to every object
+	*  event of the track (so an event row can be sorted by importance without a
+	*  track join). Absent on legacy rows / before the track was scored. */
+	importance: number().optional()
 });
 var AudioEventSchema = object({
 	...BaseEventFields,
@@ -17994,7 +18262,8 @@ var MediaFileKindEnum = _enum([
 	"fullFrame",
 	"fullFrameBoxed",
 	"faceCrop",
-	"plateCrop"
+	"plateCrop",
+	"keyFrame"
 ]);
 var MediaFileSchema = object({
 	key: string(),
@@ -18015,6 +18284,32 @@ var DeviceEventQueryInput = object({
 	projection: _enum(["full", "slim"]).optional()
 });
 var ObjectEventQueryInput = DeviceEventQueryInput.extend({ classFilter: string().optional() });
+var KeyEventQueryInput = object({
+	deviceId: number(),
+	/** Window lower bound (track firstSeen ≥ since). */
+	since: number(),
+	/** Window upper bound (track firstSeen ≤ until). */
+	until: number(),
+	limit: number().int().min(1).max(200).default(50),
+	/** Drop tracks scoring below this importance. */
+	minImportance: number().min(0).max(1).optional(),
+	/** Restrict to a single class (e.g. 'person'). */
+	classFilter: string().optional()
+});
+var KeyEventSchema = object({
+	/** The representative event id (the track's best ObjectEvent, else its trackId). */
+	id: string(),
+	trackId: string(),
+	/** Track start time (firstSeen). */
+	timestamp: number(),
+	className: string(),
+	label: string().optional(),
+	importance: number(),
+	/** Highest-confidence ObjectEvent id for the track (empty when none). */
+	bestEventId: string(),
+	/** Track lifetime in ms (lastSeen - firstSeen). */
+	windowMs: number().optional()
+});
 var TrackedDetectionSchema = object({
 	trackId: string(),
 	className: string(),
@@ -18044,7 +18339,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), array(TrackSchema).readonly()), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({
+}), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(KeyEventQueryInput, array(KeyEventSchema).readonly()), method(object({
 	deviceId: number(),
 	since: number(),
 	until: number(),
@@ -18089,11 +18384,11 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	timestamp: number()
 });
 var CameraPipelineConfigSchema = object({
-	engine: PipelineEngineChoiceSchema,
+	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).readonly(),
 	audio: object({
-		engine: PipelineEngineChoiceSchema,
-		modelId: string(),
+		engine: PipelineEngineChoiceSchema.optional(),
+		modelId: string().optional(),
 		enabled: boolean(),
 		settings: record(string(), unknown()).readonly().optional()
 	}).nullable().optional()
@@ -18108,7 +18403,7 @@ var PipelineTemplateSchema = object({
 });
 var AgentAddonConfigSchema = object({
 	enabled: boolean(),
-	modelId: string(),
+	modelId: string().optional(),
 	settings: record(string(), unknown()).readonly()
 });
 var AgentPipelineSettingsSchema = object({
@@ -18118,12 +18413,25 @@ var AgentPipelineSettingsSchema = object({
 	detectWeight: number().positive().optional(),
 	/** Node is eligible to run the detection pipeline (decode + inference). */
 	detect: boolean().optional(),
-	/** Node is eligible to host decoder sessions. */
+	/**
+	* DEPRECATED AND IGNORED. Decode is always co-located with its frame
+	* consumer, so decode eligibility IS detect eligibility. Kept optional in
+	* the schema ONLY so persisted stores written before the removal still
+	* parse — no code reads it and no write path emits it.
+	*/
 	decode: boolean().optional(),
 	/** Node is eligible to run audio-analyzer sessions. */
 	audio: boolean().optional(),
 	/** Node is eligible to be the ingest / source-owner (serve the restream). */
-	ingest: boolean().optional()
+	ingest: boolean().optional(),
+	/**
+	* Operator override for the LAN host a cross-node decoder dials to reach
+	* THIS node's restream (Cluster UI). Absent → auto-detect: a remote runner
+	* falls back to its `CAMSTACK_HUB_URL`-derived host (the Moleculer address
+	* it already uses to reach the hub). Set this only when the auto-detected
+	* address is wrong (multi-homed host, NAT, custom interface).
+	*/
+	reachableHost: string().optional()
 });
 var CameraPipelineForAgentSchema = object({
 	steps: array(PipelineStepInputSchema).readonly(),
@@ -18171,25 +18479,6 @@ var PipelineAssignmentSchema = object({
 	assignedAt: number()
 });
 /**
-* Decoder placement record. Symmetric to `PipelineAssignmentSchema` but for
-* the decoder-node placement domain (`balanceDecoder` decision: manual pin
-* → co-located with pipeline → capacity).
-*/
-var DecoderAssignmentSchema = object({
-	deviceId: number(),
-	/** Moleculer node id of the decoder provider currently responsible for this camera. */
-	decoderNodeId: string(),
-	/** True when the assignment was set manually via `assignDecoder`, false when chosen by the balancer. */
-	pinned: boolean(),
-	/** Why this assignment was made — useful for debugging the decoder balancer. */
-	reason: _enum([
-		"manual",
-		"co-located",
-		"capacity",
-		"hardware-affinity"
-	])
-});
-/**
 * Per-agent load summary surfaced to the load balancer + dashboards.
 * Aggregated from each runner's `getLocalLoad` cap call.
 */
@@ -18229,6 +18518,15 @@ var GlobalMetricsSchema = object({
 * capability providers.
 */
 var CapabilityBindingsSchema = record(string(), string());
+/**
+* The cluster's single camera-source owner (`clusterRoles.ingestNode`) plus
+* its LAN-reachable host, if one is registered. See `getIngestOwner`.
+*/
+var IngestOwnerSchema = object({
+	ownerNodeId: string(),
+	reachableHost: string().optional(),
+	configIssue: string().optional()
+});
 /** Source block — always present; derives from the stream catalog. */
 var CameraSourceStatusSchema = object({ streams: array(object({
 	camStreamId: string(),
@@ -18243,6 +18541,14 @@ var CameraAssignmentStatusSchema = object({
 	detectionNodeId: string().nullable(),
 	decoderNodeId: string().nullable(),
 	audioNodeId: string().nullable(),
+	/**
+	* The node that OWNS this camera's physical source pull (dials the RTSP and
+	* hosts the broker/restream) — the cluster ingest owner today
+	* (`clusterRoles.ingestNode`), per-camera once source assignment lands. Lets
+	* the UI show WHERE a camera is sourced without SSH/logs, and is the node the
+	* broker block below was read from (pinned). Nullable only pre-wiring.
+	*/
+	sourceNodeId: string().nullable(),
 	pinned: object({
 		detection: boolean(),
 		decoder: boolean(),
@@ -18375,16 +18681,7 @@ method(object({
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	nodeId: string()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), array(DecoderAssignmentSchema).readonly()), method(object({
+}), method(_void(), IngestOwnerSchema), method(object({
 	deviceId: number(),
 	nodeId: string()
 }), object({ success: literal(true) }), {
@@ -18405,10 +18702,7 @@ method(object({
 	nodeId: string(),
 	pinned: boolean(),
 	assignedAt: number()
-}))), method(object({
-	deviceId: number(),
-	pipelineNodeId: string().optional()
-}), DecoderAssignmentSchema), method(object({ agentNodeId: string() }), AgentPipelineSettingsSchema.nullable()), method(_void(), array(object({
+}))), method(object({ agentNodeId: string() }), AgentPipelineSettingsSchema.nullable()), method(_void(), array(object({
 	nodeId: string(),
 	settings: AgentPipelineSettingsSchema
 })).readonly()), method(object({
@@ -18438,12 +18732,26 @@ method(object({
 }), method(object({
 	agentNodeId: string(),
 	detect: boolean().nullable().optional(),
-	decode: boolean().nullable().optional(),
 	audio: boolean().nullable().optional(),
 	ingest: boolean().nullable().optional()
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	agentNodeId: string(),
+	reachableHost: string().nullable()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ agentNodeId: string() }), object({
+	success: literal(true),
+	/** Hardware-aware default detection model now in effect on the node (null when unresolvable). */
+	effectiveModelId: string().nullable(),
+	/** Number of cameras whose node-scoped overrides were cleared. */
+	clearedCameraOverrides: number()
+}), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ deviceId: number() }), CameraPipelineSettingsSchema.nullable()), method(object({
 	deviceId: number(),
 	addonId: string(),
@@ -18488,22 +18796,131 @@ method(object({
 	kind: "mutation",
 	auth: "admin"
 });
-var RegisteredStreamSchema = object({
-	streamId: string(),
-	label: string().optional(),
-	codec: string(),
-	type: _enum(["video", "audio"]),
-	sourceUrl: string()
+/**
+* server-management — per-NODE singleton capability for a node's ROOT
+* package lifecycle (runtime-updatable node packages, phase 2: hub + docker
+* agents).
+*
+* Each node's root package (`@camstack/server` on the hub, `@camstack/agent`
+* on agents) carries the whole software stack in its npm dep tree, so ONE
+* version describes the node. Updates install into
+* `<dataDir>/server-root/versions/<v>/` and apply on restart via the baked
+* starter (probation boot + auto-rollback to N-1).
+*
+* Providers:
+*   - HUB: `ServerUpdateService` behind the `server-provided` mount
+*     (`buildServerProviders` in trpc.router.ts) — the default target for
+*     unpinned calls.
+*   - AGENT: `AgentUpdateService` registered by the agent bootstrap under
+*     the synthetic `agent-runtime` addonId and declared in the agent's
+*     `$hub.registerNode` manifest.
+*
+* Node routing: singleton caps get the codegen/runtime-builder `nodeId`
+* injection on every method — `input.nodeId` (or `nodePin(nodeId)` from the
+* SDK) routes the call to that node's provider via the standard remote
+* proxy (`createCapabilityProxy` → `$agent-cap-fwd` → the agent's
+* in-process provider lookup). No `nodeId` → the hub's own provider.
+*
+* Spec: docs/superpowers/specs/2026-07-12-runtime-updatable-node-packages-design.md
+*/
+/**
+* Where the running hub's code was loaded from:
+*  - `workspace` — dev checkout (tsx / workspace dist); the starter defers to
+*    plain resolution and runtime updates are refused.
+*  - `baked`     — the immutable image seed closure (no data-dir root active).
+*  - `data-root` — the runtime-updatable `<dataDir>/server-root` closure.
+*/
+var ServerBootModeSchema = _enum([
+	"workspace",
+	"baked",
+	"data-root"
+]);
+/**
+* Update lifecycle state:
+*  - `idle` / `checking` / `staging` — steady / in-flight registry work.
+*  - `pending-restart` — a version is staged and the node has NOT yet
+*    restarted onto it (still running the OLD version).
+*  - `awaiting-confirmation` — the node HAS restarted onto the staged version
+*    (it is the active probation boot) and is waiting to confirm boot-health.
+*    Apply/rollback are refused in this state and the node must NOT be
+*    manually restarted, or the probation boot auto-rolls-back.
+*/
+var ServerUpdateStateSchema = _enum([
+	"idle",
+	"checking",
+	"staging",
+	"pending-restart",
+	"awaiting-confirmation"
+]);
+var ServerRollbackInfoSchema = object({
+	/** The version that failed (or was manually rolled back). */
+	fromVersion: string(),
+	/** The version rolled back to; null = the baked seed. */
+	toVersion: string().nullable(),
+	atMs: number(),
+	reason: string()
 });
-var ExposedResourceSchema = object({
-	streamId: string(),
-	format: string(),
-	value: string()
+var ServerPackageStatusSchema = object({
+	/** Root package name (`@camstack/server` on the hub). */
+	packageName: string(),
+	/** Version of the code the running process ACTUALLY loaded. */
+	runningVersion: string().nullable(),
+	/** Node.js runtime version the node's process runs on (`process.versions.node`). */
+	nodeRuntimeVersion: string().nullable(),
+	/** Active data-dir root version; null when booted from seed/workspace. */
+	activeVersion: string().nullable(),
+	/** N-1 version kept for rollback; null when no previous version exists. */
+	previousVersion: string().nullable(),
+	/** Version of the immutable baked seed closure (image fallback). */
+	seedVersion: string().nullable(),
+	/** Latest registry version from the most recent check (null = never checked). */
+	latestVersion: string().nullable(),
+	updateAvailable: boolean(),
+	bootMode: ServerBootModeSchema,
+	updateState: ServerUpdateStateSchema,
+	/** Version staged + awaiting its probation boot, when one is pending. */
+	pendingVersion: string().nullable(),
+	/** Set when the last freshly-activated version failed its boot health-check. */
+	rolledBack: ServerRollbackInfoSchema.nullable(),
+	/**
+	* True when `server-root/state.json` EXISTS but is unreadable/corrupt — the
+	* hub is running from the baked seed (or workspace) while installed data-dir
+	* versions are being IGNORED. Surfaced as a warning in the UI.
+	*/
+	stateFileCorrupt: boolean(),
+	lastCheckedAtMs: number().nullable()
+});
+var ServerUpdateCheckResultSchema = object({
+	packageName: string(),
+	runningVersion: string().nullable(),
+	latestVersion: string().nullable(),
+	updateAvailable: boolean(),
+	checkedAtMs: number(),
+	/** Non-null when the registry lookup failed (offline, bad registry, …). */
+	error: string().nullable()
+});
+var ServerUpdateActionResultSchema = object({
+	accepted: boolean(),
+	targetVersion: string().nullable(),
+	/** True when a graceful restart was scheduled to apply the change. */
+	restarting: boolean(),
+	message: string()
+});
+method(_void(), ServerPackageStatusSchema, { auth: "admin" }), method(_void(), ServerUpdateCheckResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ 
+/** Explicit target version; omitted = latest from the registry. */
+version: string().optional() }), ServerUpdateActionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), ServerUpdateActionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), ServerUpdateActionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
 });
-method(object({
-	deviceId: number(),
-	streams: array(RegisteredStreamSchema).readonly()
-}), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), array(ExposedResourceSchema).readonly());
 /**
 * Query filter for settings-store collections.
 */
@@ -18656,9 +19073,9 @@ method(SendEmailInputSchema, SendEmailResultSchema, {
 /**
 * A single device snapshot returned as base64 JPEG/PNG.
 *
-* Shared with the `snapshot-provider` collection cap — the orchestrator
-* receives the same shape from each native provider and from the
-* broker-based fallback.
+* The `SnapshotAddon` wrapper returns this shape whether the frame came from
+* the device-native provider (onboard capture) or from the stream-broker
+* prebuffer fallback.
 */
 var SnapshotImageSchema = object({
 	base64: string(),
@@ -18726,17 +19143,26 @@ var snapshotCapability = {
 		invalidateCache: method(object({ deviceId: number() }), _void(), {
 			kind: "mutation",
 			auth: "admin"
-		})
+		}),
+		/**
+		* Cache-only batch overview — answers from the wrapper's in-memory cache in
+		* O(n) and NEVER triggers a capture. Lets a grid skip requesting images for
+		* devices that never produced a frame, and gives it an ETag per device for
+		* conditional (304-able) image fetches. `lastCapturedAt`/`cacheAgeMs`/`etag`
+		* are null for a device with no cached frame.
+		*/
+		getSnapshotOverview: systemMethod(object({ deviceIds: array(number()).min(1).max(200) }), array(object({
+			deviceId: number(),
+			lastCapturedAt: number().nullable(),
+			cacheAgeMs: number().nullable(),
+			etag: string().nullable()
+		})))
 	},
 	status: {
 		schema: SnapshotStatusSchema,
 		kind: "poll"
 	}
 };
-method(object({ deviceId: number() }), boolean()), method(object({
-	deviceId: number(),
-	streamId: string().optional()
-}), SnapshotImageSchema.nullable());
 /**
 * `sso-bridge` — internal hub-only cap that lets SSO-style auth
 * providers (OIDC, SAML, magic-link, …) mint an HMAC-signed token
@@ -18987,10 +19413,32 @@ method(_void(), array(TurnServerSchema).readonly());
 *      b. `finishAuthentication({userId, response})` → server verifies
 *         the assertion, bumps the credential counter, returns ok.
 *
+*   2b. Usernameless (discoverable-credential) authentication — the
+*       passkey IS the primary factor, no password leg:
+*       a. `beginDiscoverableAuthentication({})` → assertion options with
+*          EMPTY `allowCredentials` (the browser offers every resident
+*          passkey it holds for this RP) + `userVerification: 'required'`
+*          (the passkey replaces both factors, so UV is mandatory).
+*          The challenge is stored server-side, NOT bound to any user.
+*       b. `finishDiscoverableAuthentication({response})` → the provider
+*          resolves the credential by the response's credential id,
+*          verifies the assertion against the stored challenge + that
+*          credential's public key/counter, and returns the OWNING
+*          `userId` — the caller (core auth router) mints the session.
+*
 *   3. Management:
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
 *
+*   4. Second-factor preference (opt-in, default OFF):
+*      Enrolling a passkey only enables passkey-FIRST sign-in. It is
+*      demanded as a second factor after a password login ONLY when the
+*      user explicitly opts in via `setSecondFactorPreference`.
+*      - `getSecondFactorPreference({userId})` → `{ enabled }` (missing
+*        row ⇒ `enabled: false`).
+*      - `setSecondFactorPreference({userId, enabled})` — persisted by
+*        the providing addon beside its credentials.
+*
 * Challenges are short-lived (5 min, in-memory). The cap is internal —
 * the admin-ui composes the begin/finish round-trip and never exposes
 * the cap to non-admins.
@@ -19033,6 +19481,17 @@ method(object({
 }), object({ verified: boolean() }), {
 	kind: "mutation",
 	access: "view"
+}), method(object({}), object({ optionsJSON: record(string(), unknown()) }), {
+	kind: "mutation",
+	access: "view"
+}), method(object({ 
+/** AuthenticationResponseJSON from the browser. */
+response: record(string(), unknown()) }), object({
+	verified: boolean(),
+	userId: string().nullable()
+}), {
+	kind: "mutation",
+	access: "view"
 }), method(object({ userId: string() }), array(PasskeySummarySchema), { auth: "admin" }), method(object({
 	userId: string(),
 	credentialId: string()
@@ -19040,6 +19499,13 @@ method(object({
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
+}), method(object({ userId: string() }), object({ enabled: boolean() }), { auth: "admin" }), method(object({
+	userId: string(),
+	enabled: boolean()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "create"
 });
 /**
 * `videoclips` — the unified, navigable-clip surface for a camera.
@@ -19097,9 +19563,10 @@ method(object({
 	auth: "admin"
 });
 /**
-* Optional client-side hints sent at session creation to help the
-* provider pick the best native source. All fields are optional —
-* a viewer that knows nothing still gets a sane default.
+* Optional client-side hints sent at session creation to help the provider
+* pick the best native source. All fields optional — a viewer that knows
+* nothing still gets a sane default. (Relocated from the retired `webrtc`
+* collection cap; this `webrtc-session` cap is the live signaling surface.)
 */
 var webrtcClientHintsSchema = object({
 	viewportWidth: number().int().positive().optional(),
@@ -19110,22 +19577,6 @@ var webrtcClientHintsSchema = object({
 	/** Hard tier override; takes precedence over scoring when registered. */
 	prefersTier: string().optional()
 }).partial();
-method(object({
-	streamId: string(),
-	sdpOffer: string()
-}), string(), { kind: "mutation" }), method(object({ streamId: string() }), boolean()), method(object({
-	streamId: string(),
-	codec: string()
-}), _void(), { kind: "mutation" }), method(object({ streamId: string() }), _void(), { kind: "mutation" }), method(object({
-	streamId: string(),
-	hints: webrtcClientHintsSchema.optional()
-}), object({
-	sessionId: string(),
-	sdpOffer: string()
-}), { kind: "mutation" }), method(object({
-	sessionId: string(),
-	sdpAnswer: string()
-}), _void(), { kind: "mutation" }), method(object({ sessionId: string() }), _void(), { kind: "mutation" }), method(object({ streamId: string() }), boolean());
 /**
 * Discriminated target for a WebRTC session. The client sends this
 * structured object instead of building / parsing brokerId strings;
@@ -19856,7 +20307,17 @@ var FaceInfoSchema = object({
 	recognizedIdentityId: string().optional(),
 	identityName: string().optional(),
 	assigned: boolean(),
-	base64: string().optional()
+	base64: string().optional(),
+	/** Design B: the face bbox (pixel space) on the key frame — lets a detail
+	*  view draw the box over the native `keyFrameMediaKey` frame. Absent on
+	*  legacy rows written before design B. */
+	faceBbox: BoundingBoxSchema.optional(),
+	/** Design B: MediaStore key of the track's native-resolution key frame.
+	*  Fetch the native JPEG via the event-media data-plane
+	*  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`). Absent when the
+	*  track produced no key frame (e.g. native/onboard source) — the UI falls
+	*  back to the inline `base64` face crop. */
+	keyFrameMediaKey: string().optional()
 });
 var FaceFilterEnum = _enum([
 	"unassigned",
@@ -20553,6 +21014,16 @@ var TopologyCategorySchema = object({
 	healthy: number(),
 	addons: array(TopologyCategoryAddonSchema).readonly()
 });
+/**
+* The node's runtime-updatable ROOT package (`@camstack/server` on the hub,
+* `@camstack/agent` on agents) as reported by its `registerNode` manifest —
+* version visibility for the Server management surface. Nullable: offline
+* rows and pre-phase-2 nodes report none.
+*/
+var TopologyRootPackageSchema = object({
+	name: string(),
+	version: string()
+});
 var TopologyNodeSchema = object({
 	id: string(),
 	name: string(),
@@ -20576,7 +21047,8 @@ var TopologyNodeSchema = object({
 		status: string()
 	})).readonly(),
 	processes: array(TopologyProcessSchema).readonly(),
-	categories: array(TopologyCategorySchema).readonly()
+	categories: array(TopologyCategorySchema).readonly(),
+	rootPackage: TopologyRootPackageSchema.nullable()
 });
 var CapUsageEdgeSchema = object({
 	callerAddonId: string(),
@@ -23389,6 +23861,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"loginMethod.getLoginMethods": {
+		capName: "login-method",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"mediaPlayer.next": {
 		capName: "media-player",
 		capScope: "device",
@@ -23971,6 +24449,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getKeyEvents": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getMotionEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -24019,23 +24503,23 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineExecutor.deleteModel": {
+	"pipelineExecutor.clearDeviceOverrides": {
 		capName: "pipeline-executor",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
-	"pipelineExecutor.deleteTemplate": {
+	"pipelineExecutor.deleteModel": {
 		capName: "pipeline-executor",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
-	"pipelineExecutor.detect": {
+	"pipelineExecutor.deleteTemplate": {
 		capName: "pipeline-executor",
 		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "delete"
 	},
 	"pipelineExecutor.downloadModel": {
 		capName: "pipeline-executor",
@@ -24229,13 +24713,13 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.assignAudio": {
-		capName: "pipeline-orchestrator",
+	"pipelineExecutor.validatePipeline": {
+		capName: "pipeline-executor",
 		capScope: "system",
 		addonId: null,
-		access: "create"
+		access: "view"
 	},
-	"pipelineOrchestrator.assignDecoder": {
+	"pipelineOrchestrator.assignAudio": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
@@ -24319,19 +24803,13 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"pipelineOrchestrator.getDecoderAssignment": {
-		capName: "pipeline-orchestrator",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"pipelineOrchestrator.getDecoderAssignments": {
+	"pipelineOrchestrator.getGlobalMetrics": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"pipelineOrchestrator.getGlobalMetrics": {
+	"pipelineOrchestrator.getIngestOwner": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
@@ -24373,6 +24851,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineOrchestrator.resetNodePipelineDefaults": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineOrchestrator.resolvePipeline": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -24409,37 +24893,37 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.setCameraPipelineForAgent": {
+	"pipelineOrchestrator.setAgentReachableHost": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.setCameraStepOverride": {
+	"pipelineOrchestrator.setCameraPipelineForAgent": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.setCameraStepToggle": {
+	"pipelineOrchestrator.setCameraStepOverride": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.setCapabilityBinding": {
+	"pipelineOrchestrator.setCameraStepToggle": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.unassignAudio": {
+	"pipelineOrchestrator.setCapabilityBinding": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.unassignDecoder": {
+	"pipelineOrchestrator.unassignAudio": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
@@ -24499,6 +24983,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineRunner.getNativeCrop": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineRunner.reportMotion": {
 		capName: "pipeline-runner",
 		capScope: "system",
@@ -24739,33 +25229,45 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"restreamer.getExposedResources": {
-		capName: "restreamer",
+	"scriptRunner.run": {
+		capName: "script-runner",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"scriptRunner.stop": {
+		capName: "script-runner",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"serverManagement.applyServerUpdate": {
+		capName: "server-management",
 		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "create"
 	},
-	"restreamer.registerDevice": {
-		capName: "restreamer",
+	"serverManagement.checkServerUpdate": {
+		capName: "server-management",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"restreamer.unregisterDevice": {
-		capName: "restreamer",
+	"serverManagement.getServerPackageStatus": {
+		capName: "server-management",
 		capScope: "system",
 		addonId: null,
-		access: "delete"
+		access: "view"
 	},
-	"scriptRunner.run": {
-		capName: "script-runner",
-		capScope: "device",
+	"serverManagement.restartServer": {
+		capName: "server-management",
+		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"scriptRunner.stop": {
-		capName: "script-runner",
-		capScope: "device",
+	"serverManagement.rollbackServerUpdate": {
+		capName: "server-management",
+		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
@@ -24853,23 +25355,17 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"snapshot.invalidateCache": {
+	"snapshot.getSnapshotOverview": {
 		capName: "snapshot",
 		capScope: "device",
 		addonId: null,
-		access: "create"
-	},
-	"snapshotProvider.getSnapshot": {
-		capName: "snapshot-provider",
-		capScope: "system",
-		addonId: null,
 		access: "view"
 	},
-	"snapshotProvider.supportsDevice": {
-		capName: "snapshot-provider",
-		capScope: "system",
+	"snapshot.invalidateCache": {
+		capName: "snapshot",
+		capScope: "device",
 		addonId: null,
-		access: "view"
+		access: "create"
 	},
 	"ssoBridge.signBridgeToken": {
 		capName: "sso-bridge",
@@ -25297,30 +25793,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"streamingEngine.getStreamUrl": {
-		capName: "streaming-engine",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"streamingEngine.listStreams": {
-		capName: "streaming-engine",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"streamingEngine.registerStream": {
-		capName: "streaming-engine",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
-	"streamingEngine.unregisterStream": {
-		capName: "streaming-engine",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
 	"streamParams.getConfigSchema": {
 		capName: "stream-params",
 		capScope: "device",
@@ -25567,6 +26039,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.beginDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.beginRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -25579,12 +26057,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.finishDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.finishRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"userPasskeys.getSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.listPasskeys": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -25597,6 +26087,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userPasskeys.setSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"vacuumControl.locate": {
 		capName: "vacuum-control",
 		capScope: "device",
@@ -25669,6 +26165,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"viewerUi.getStaticDir": {
+		capName: "viewer-ui",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"viewerUi.getVersion": {
+		capName: "viewer-ui",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"waterHeater.setAway": {
 		capName: "water-heater",
 		capScope: "device",
@@ -25687,54 +26195,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"webrtc.closeSession": {
-		capName: "webrtc",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
-	"webrtc.createSession": {
-		capName: "webrtc",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
-	"webrtc.handleAnswer": {
-		capName: "webrtc",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
-	"webrtc.handleOffer": {
-		capName: "webrtc",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
-	"webrtc.hasAdaptiveBitrate": {
-		capName: "webrtc",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"webrtc.registerStream": {
-		capName: "webrtc",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
-	"webrtc.supportsStream": {
-		capName: "webrtc",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"webrtc.unregisterStream": {
-		capName: "webrtc",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
 	"webrtcSession.addIceCandidate": {
 		capName: "webrtc-session",
 		capScope: "device",
@@ -25948,6 +26408,72 @@ function maskUrlCredentials(rawUrl) {
 		return rawUrl;
 	}
 }
+//#endregion
+//#region src/rtsp-reachability.ts
+/**
+* Control-plane reachability probe for a generic RTSP camera.
+*
+* Unlike Hikvision/Amcrest/ONVIF, an RTSP source exposes NO management API —
+* we only have an `rtsp://` URL. Reachability is therefore probed at the RTSP
+* control channel itself:
+*
+*   1. open a TCP connection to the RTSP `host:port` (default 554);
+*   2. best-effort send an RTSP `OPTIONS` request;
+*   3. treat an `RTSP/…` response OR a successful TCP handshake (even without
+*      a response before the deadline) as REACHABLE.
+*
+* A successful TCP handshake already proves the camera's RTSP port is live —
+* the `OPTIONS` round-trip is a stronger confirmation when the server answers
+* promptly, but we deliberately fall back to the bare connect so a camera that
+* gates `OPTIONS` behind auth (or is simply slow to answer) is not wrongly
+* marked offline.
+*
+* The socket is always destroyed; the probe never throws and resolves within
+* `timeoutMs`.
+*/
+var DEFAULT_RTSP_PORT = 554;
+/** Parse `host` + `port` out of an `rtsp://` URL. Credentials/path ignored. */
+function parseRtspTarget(url) {
+	try {
+		const parsed = new URL(url);
+		if (!parsed.hostname) return null;
+		const port = parsed.port ? Number.parseInt(parsed.port, 10) : DEFAULT_RTSP_PORT;
+		if (!Number.isFinite(port) || port <= 0 || port > 65535) return null;
+		return {
+			host: parsed.hostname,
+			port
+		};
+	} catch {
+		return null;
+	}
+}
+async function probeRtspReachable(url, timeoutMs) {
+	const target = parseRtspTarget(url);
+	if (!target) return false;
+	return new Promise((resolve) => {
+		let settled = false;
+		let connected = false;
+		const socket = new net.Socket();
+		const finish = (reachable) => {
+			if (settled) return;
+			settled = true;
+			socket.destroy();
+			resolve(reachable);
+		};
+		socket.setTimeout(timeoutMs);
+		socket.once("timeout", () => finish(connected));
+		socket.once("error", () => finish(false));
+		socket.once("connect", () => {
+			connected = true;
+			const request = `OPTIONS ${url} RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: camstack-reachability\r\n\r\n`;
+			socket.write(request, () => {});
+		});
+		socket.once("data", (buf) => {
+			finish(buf.toString("latin1").startsWith("RTSP/") || connected);
+		});
+		socket.connect(target.port, target.host);
+	});
+}
 var rtspCameraSchema = object({
 	streams: preprocess((raw) => {
 		if (!Array.isArray(raw)) return raw;
@@ -25985,15 +26511,44 @@ var legacyStreamSchema = object({
 	label: CamProfileSchema,
 	url: string()
 });
-var RtspCamera = class extends BaseDevice {
+var RtspCamera = class RtspCamera extends BaseDevice {
 	type = DeviceType.Camera;
 	features = [];
+	/** Control-plane reachability poll — an RTSP `OPTIONS`/TCP-connect probe to
+	*  the camera's RTSP port every 30s drives `device.online`, decoupled from
+	*  stream-broker video health. Started in `onActivate`, stopped in
+	*  `removeDevice`. */
+	reachabilityPoll = null;
 	constructor(ctx) {
 		super(ctx, rtspCameraSchema, { type: DeviceType.Camera });
 		this.migrateLegacyStreamsIfNeeded(ctx.persistedConfig ?? {});
 		this.registerSnapshotProvider();
 		this.registerStreamCatalogProvider();
 	}
+	/** Phase 5 — device is live: begin the control-plane reachability poll. */
+	async onActivate() {
+		this.startReachabilityPolling();
+	}
+	/** Start the RTSP reachability poll: a lightweight `OPTIONS`/TCP-connect
+	*  probe to the first configured stream's `host:port` every 30s drives
+	*  `device.online`, with hysteresis. Idempotent. */
+	startReachabilityPolling() {
+		if (this.reachabilityPoll) return;
+		this.reachabilityPoll = startReachabilityPoll({
+			probe: async () => {
+				const url = this.config.get("streams")[0]?.url;
+				if (!url) return false;
+				return probeRtspReachable(url, RtspCamera.RTSP_PROBE_TIMEOUT_MS);
+			},
+			setOnline: (online) => {
+				this.markOnline(online);
+			},
+			isEnabled: () => !this.disabled,
+			logger: this.ctx.logger
+		});
+	}
+	/** Per-probe TCP/RTSP round-trip budget — a dead host resolves as a miss. */
+	static RTSP_PROBE_TIMEOUT_MS = 5e3;
 	/**
 	* Build this camera's pull-able stream catalog — the descriptors the
 	* stream-broker needs to dial. Single source of truth feeding the
@@ -26084,6 +26639,8 @@ var RtspCamera = class extends BaseDevice {
 	}
 	async removeDevice() {
 		this.ctx.logger.info("Removing RTSP camera", { meta: { stableId: this.stableId } });
+		this.reachabilityPoll?.stop();
+		this.reachabilityPoll = null;
 		const streams = this.config.get("streams");
 		await Promise.all(streams.map((s) => this.ctx.api.streamBroker.retractCameraStream.mutate({
 			deviceId: this.id,
@@ -26361,21 +26918,7 @@ var RtspProviderAddon = class extends BaseDeviceProvider {
 		super({});
 	}
 	async onInitialize() {
-		const regs = await super.onInitialize();
-		this.subscribe({ category: EventCategory.DeviceStateChanged }, (event) => {
-			const data = event.data;
-			if (data.capName !== "camera-streams") return;
-			const deviceId = data.deviceId;
-			if (typeof deviceId !== "number") return;
-			const registry = this.ctx.kernel.deviceRegistry;
-			if (!registry) return;
-			if (registry.getAddonId(deviceId) !== this.addonId) return;
-			const device = registry.getById(deviceId);
-			if (!device) return;
-			const online = data.slice?.online === true;
-			if (device.online !== online) device.online = online;
-		});
-		return regs;
+		return await super.onInitialize();
 	}
 	async onGetCreationSchema(type) {
 		if (type !== DeviceType.Camera) return null;