@camstack/addon-tailscale 1.2.118 → 1.2.119

package/dist/{dist-B5khvoZj.js → auth-key-file-CVMhmHD4.mjs}

@@ -1,5 +1,7 @@
-require("node:crypto");
-//#region ../types/dist/event-category-BGmz_oxW.mjs
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+//#region ../types/dist/event-category-B_0XEcLF.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -500,15 +502,6 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["AgentWsDisconnected"] = "agent.ws.disconnected";
 	EventCategory["AgentBackupActivated"] = "agent.backup.activated";
 	EventCategory["OrchestrationSettingsUpdated"] = "orchestration.settings-updated";
-	/**
-	* Per-agent hwaccel preference changed (user override set, cleared, or
-	* re-probed). Observability event — decoders pull the current pref at
-	* `createSession`, so running sessions keep their current backend until
-	* they rotate naturally (camera add/remove, stream restart). Future
-	* work can wire a listener in stream-broker that force-rotates live
-	* sessions; for now this event powers logs + admin-UI toast feedback.
-	*/
-	EventCategory["PipelineAgentHwaccelChanged"] = "pipeline.agent-hwaccel-changed";
 	EventCategory["MotionAnalysis"] = "detection.motion-analysis";
 	/** All raw motion zones from CCL before minArea filter — for UI debug overlay. */
 	EventCategory["MotionZonesRaw"] = "detection.motion-zones-raw";
@@ -5379,7 +5372,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DXKLNFvA.mjs
+//#region ../types/dist/sleep-B0JG7-_F.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6745,32 +6738,12 @@ object({
 	audioCodec: string().optional(),
 	metadata: record(string(), unknown()).readonly().optional()
 });
-var EncodedPacketSchema = object({
-	type: _enum(["video", "audio"]),
-	data: _instanceof(Uint8Array),
-	pts: number(),
-	dts: number(),
-	keyframe: boolean(),
-	codec: string()
-});
-var DecodedFrameSchema = object({
-	data: _instanceof(Uint8Array),
-	width: number(),
-	height: number(),
-	format: _enum([
-		"jpeg",
-		"rgb",
-		"bgr",
-		"yuv420",
-		"gray"
-	]),
-	timestamp: number()
-});
 /**
 * Wire schema for `FrameHandle` — a zero-pixel, serialisable reference to a
 * frame in a shared-memory ring (Phase 5 / D9). Mirrors the `FrameHandle` TS
-* interface in `interfaces/frame-handle.ts` field-for-field so a decoder cap
-* method (`pullHandles`) can carry handles over tRPC / Moleculer.
+* interface in `interfaces/frame-handle.ts` field-for-field so a cap method
+* (the runner's native-crop and pipeline-executor inputs) can carry handles
+* over tRPC / Moleculer.
 *
 * The `satisfies` assertion below pins this schema to the interface: if a
 * field is added to / removed from `FrameHandle` without a matching schema
@@ -6796,50 +6769,6 @@ var FrameHandleSchema = object({
 	slotCount: number().int().positive()
 });
 /**
-* Pixel format a frame-handle subscriber can request from the broker
-* (Phase 5 / D9). The packed, raster subset of `FrameFormat` — the formats a
-* `frameSink: 'shm'` decoder session can write into a `FrameRing` slot.
-* `jpeg` is excluded: a variable-length stream is not a fixed-stride ring
-* payload, and no decoded-frame consumer requests it over the shm plane.
-*/
-var FrameHandleFormatSchema = _enum([
-	"rgb",
-	"bgr",
-	"yuv420",
-	"gray"
-]);
-/**
-* Input for `stream-broker.subscribeFrames` (Phase 5 / D9). A consumer asks the
-* broker for a `FrameHandle` stream of one `format`; the broker maintains one
-* shared-memory ring per `(brokerId, format)` actually requested, so a `gray`
-* subscriber (motion) and an `rgb` subscriber (detection) each read the format
-* they asked for with no broker-side conversion.
-*/
-var SubscribeFramesInputSchema = object({
-	brokerId: string(),
-	format: FrameHandleFormatSchema,
-	/**
-	* Optional reader-side cadence hint in frames per second. The broker does
-	* NOT throttle — latest-wins ring reads drop frames implicitly for a slow
-	* consumer. The value is echoed back in `SubscribeFramesResult.maxFps` so
-	* the consumer can pace its own `pullFrameHandles` polling.
-	*/
-	maxFps: number().positive().optional(),
-	/** Short caller-identity tag (`motion`, `detection`, …) for diagnostics. */
-	tag: string().optional()
-});
-/**
-* Result of `stream-broker.subscribeFrames`. The consumer then polls
-* `pullFrameHandles({ subscriptionId, maxCount })` and feeds each returned
-* `FrameHandle` to a `FrameRingReader`.
-*/
-var SubscribeFramesResultSchema = object({
-	/** Opaque id the consumer passes to `pullFrameHandles` / `unsubscribeFrames`. */
-	subscriptionId: string(),
-	/** Reader-side cadence hint (frames/s) — echoes `SubscribeFramesInput.maxFps`. */
-	maxFps: number().nonnegative()
-});
-/**
 * Wire schema for a decoded audio chunk (Phase 5 / D9). Mirrors the
 * `DecodedAudioChunk` TS interface in `interfaces/stream-broker.ts`: PCM
 * sample bytes plus the track parameters a consumer needs to interpret them.
@@ -6847,8 +6776,8 @@ var SubscribeFramesResultSchema = object({
 * Audio chunks are tiny (a ~500ms AudioCodecSession window is a few KB of
 * Float32 PCM), so unlike video frames they ship their bytes INLINE over
 * tRPC / Moleculer — no shared-memory plane. `data` is typed `Uint8Array`
-* (the wire-serialisable supertype of `Buffer`) to match `DecodedFrameSchema`
-* / `EncodedPacketSchema`'s precedent; a `Buffer` is assignable to it.
+* (the wire-serialisable supertype of `Buffer`); a `Buffer` is assignable to
+* it.
 */
 var AudioChunkFormatSchema = _enum(AUDIO_CHUNK_FORMATS);
 var DecodedAudioChunkSchema = object({
@@ -6866,11 +6795,10 @@ var DecodedAudioChunkSchema = object({
 	format: AudioChunkFormatSchema.optional()
 });
 /**
-* Input for `stream-broker.subscribeAudioChunks` (Phase 5 / D9). The
-* handle-free, ship-bytes-inline analogue of `subscribeFrames`: a consumer
-* asks the broker for the decoded audio-chunk stream of one broker; the
-* broker keeps a per-subscription bounded FIFO queue the consumer drains via
-* `pullAudioChunks`.
+* Input for `stream-broker.subscribeAudioChunks` (Phase 5 / D9). Audio ships
+* its bytes inline: a consumer asks the broker for the decoded audio-chunk
+* stream of one broker; the broker keeps a per-subscription bounded FIFO queue
+* the consumer drains via `pullAudioChunks`.
 */
 var SubscribeAudioChunksInputSchema = object({
 	brokerId: string(),
@@ -6901,9 +6829,7 @@ var BrokerStatsSchema = object({
 		"stopped"
 	]),
 	inputFps: number(),
-	decodeFps: number(),
 	encodedSubscribers: number(),
-	decodedSubscribers: number(),
 	uptimeMs: number(),
 	bitrateKbps: number(),
 	idrIntervalMs: number(),
@@ -6916,14 +6842,6 @@ var BrokerStatsSchema = object({
 	preBufferMs: number(),
 	preBufferPackets: number(),
 	/**
-	* Moleculer node id of the decoder provider currently servicing this
-	* stream's decoded subscribers. `null` until the deferred decoder is
-	* created (no decoded clients yet, or codec not detected). Surfaces the
-	* runtime decoder placement so the UI can show "Decoder: <agent>" without
-	* a separate cap call per broker.
-	*/
-	decoderNodeId: string().nullable(),
-	/**
 	* Detected audio track parameters from the RTSP DESCRIBE / SDP. `null`
 	* when the stream has no audio track or the broker is in cold start.
 	* `supported = false` means the codec was detected but the local
@@ -10279,70 +10197,6 @@ var StorageLocationDeclarationSchema = object({
 		"backup"
 	]).optional()
 });
-var DecoderStatsSchema = object({
-	inputFps: number(),
-	outputFps: number(),
-	avgDecodeTimeMs: number(),
-	droppedFrames: number(),
-	/**
-	* Pull-mode adaptive-fps telemetry (optional — only pull sessions run the
-	* lag-driven controller; push sessions omit these). `lagMs` is the EWMA of
-	* the decoder's real-time drift (rising = falling behind live); `adaptiveFps`
-	* is the current lag-throttled emit rate (≤ `effectiveFps` ceiling).
-	*/
-	lagMs: number().optional(),
-	effectiveFps: number().optional(),
-	adaptiveFps: number().optional()
-});
-var DecoderSessionConfigSchema = object({
-	codec: string(),
-	maxFps: number().default(0),
-	outputFormat: _enum([
-		"jpeg",
-		"rgb",
-		"bgr",
-		"yuv420",
-		"gray"
-	]).default("jpeg"),
-	scale: number().default(1),
-	width: number().optional(),
-	height: number().optional(),
-	/**
-	* Identifier of the camera this decoder session serves. Optional
-	* because the cap is generic (any caller could request decode), but
-	* stream-broker passes it so decoder logs include `deviceId` for
-	* per-camera filtering when diagnosing failures (e.g. node-av
-	* sendPacket errors on a single hung camera).
-	*/
-	deviceId: number().int().nonnegative().optional(),
-	/**
-	* Free-form tag for log scoping. Stream-broker uses
-	* `broker:<deviceId>/<profile>`. Decoder session logger surfaces it
-	* on every line so `grep tag=broker:5/high` filters one camera
-	* profile cleanly.
-	*/
-	tag: string().optional(),
-	/**
-	* Where the session delivers decoded frames (Phase 5 / D9):
-	*
-	* - `'callback'` (default) — the legacy pixel path: decoded frames are
-	*   buffered as `DecodedFrame`s and drained via `pullFrames`.
-	* - `'shm'` — the shared-memory frame plane: decoded frames are written
-	*   into an OS shared-memory ring and drained as zero-pixel
-	*   `FrameHandle`s via `pullHandles`. A session is one mode or the
-	*   other — `pullFrames` returns nothing for an `'shm'` session and
-	*   `pullHandles` returns nothing for a `'callback'` session.
-	*/
-	frameSink: _enum(["callback", "shm"]).default("callback"),
-	/**
-	* Per-camera decoder DEBUG facility. When `true`, a pull-mode session emits
-	* a throttled (~1Hz) structured `decoder debug` line (effective/adaptive fps,
-	* real-time lag, dropped-frame delta, avg decode time, hwaccel). Mirrors the
-	* stream-broker's `streamingDebug` gate — off by default so production logs
-	* stay quiet and the emit path pays zero per-frame cost when disabled.
-	*/
-	debug: boolean().optional()
-});
 /**
 * Per-component log CHANNELS — the gate a hot path consults, and the registry
 * an addon declares its channels in.
@@ -10485,6 +10339,26 @@ var ClipSearchStrictnessSchema = _enum([
 	"balanced",
 	"strict"
 ]);
+/** Steps whose effect a root label can BE. */
+var LABEL_SUPPLY_STEP_IDS = [
+	"animal-classifier",
+	"vehicle-classifier",
+	"package-detection"
+];
+/** Steps whose box a root detection can BE. */
+var CROP_SUPPLY_STEP_IDS = ["plate-detection", "face-detection"];
+/**
+* Steps whose per-detection MASK a root detection can carry (D737). The live
+* mask step is `segmentation` — a frame-plane refiner that runs its own model
+* once per detection crop. (`instance-segmentation` is a dormant step id that
+* no camera tree carries.)
+*/
+var MASK_SUPPLY_STEP_IDS = ["segmentation"];
+[
+	...LABEL_SUPPLY_STEP_IDS,
+	...CROP_SUPPLY_STEP_IDS,
+	...MASK_SUPPLY_STEP_IDS
+];
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -10513,7 +10387,53 @@ var ModelFormatEntrySchema = object({
 	/** Multi-file payload (directory members or sibling files). */
 	files: array(string()).readonly().optional(),
 	/** Runtime(s) that can use this format. If omitted, inferred from ModelFormat key */
-	runtimes: array(_enum(["python"])).readonly().optional()
+	runtimes: array(_enum(["python"])).readonly().optional(),
+	/**
+	* Content revision of the artefact, for one hosted OFF the CamStack mirror.
+	* A format on the mirror leaves it unset: its revision (the sha256 of its
+	* weight file) comes from the downloader's generated table, kept in step
+	* with the mirror by `scripts/check-hosted-model-revisions.ts` (D744). A
+	* node records the revision it downloaded next to the file
+	* (`<file>.revision`); a copy with no record or a different one is stale
+	* unless its weight file hashes to the revision, and a stale copy is
+	* downloaded again, the old one serving until the new one is complete. No
+	* revision at all ⇒ a file on disk is current, whatever it holds (D743).
+	*/
+	revision: string().min(1).optional()
+});
+/**
+* What a node holds for one (model, format) (D746). `current` is a complete
+* copy at its catalog revision — exactly what `downloaded: true` means.
+* `stale` is bytes on disk that are not (yet) proven current under D743/D744:
+* no or a different revision record, or a missing sibling. `missing` is no
+* copy. `downloaded` alone folds `stale` into "not downloaded", which hid
+* reclaimable bytes and a copy about to be replaced.
+*/
+var ModelOnDiskStateSchema = _enum([
+	"current",
+	"stale",
+	"missing"
+]);
+/**
+* The numeric precision of one format's BUILD (D746) — reported only when the
+* build states it (file-name token, an INT8 variant, an EdgeTPU compile, a
+* CamStack Core ML export). Absent means "not stated", never "fp32".
+*/
+var ModelFormatPrecisionSchema = _enum([
+	"fp32",
+	"fp16",
+	"int8"
+]);
+/**
+* One format of one model as a node's `pipelineExecutor.getSchema` reports it.
+* `onDisk` / `precision` are optional for version skew: a runner that predates
+* them omits them, and a reader falls back to `downloaded`.
+*/
+var PipelineModelFormatStatusSchema = object({
+	downloaded: boolean(),
+	sizeMB: number(),
+	onDisk: ModelOnDiskStateSchema.optional(),
+	precision: ModelFormatPrecisionSchema.optional()
 });
 /**
 * Extra file that must be downloaded alongside the model (e.g., labels JSON, dict.txt).
@@ -10617,6 +10537,46 @@ var ModelLicenseSchema = preprocess((value) => typeof value === "string" ? { wei
 	/** True when the weights or their data forbid commercial use. */
 	nonCommercial: boolean().optional()
 }));
+/**
+* One step a ROOT detector can supply from its own output (D730) — see
+* `ModelCatalogEntry.suppliesSteps`.
+*
+* - `label`: the root's raw class IS the step's answer. `labelToEffect` maps
+*   the root's label to the step's vocabulary; `uncovered` is the vocabulary
+*   the root cannot produce (shown as unavailable, never a blocker).
+* - `crop`: the root draws the box the step would have found (`license_plate`
+*   for plate-detection, `face` for face-detection). The box becomes a detail
+*   child of the `parentMacro` detection that contains it — never a track.
+* - `mask`: the root's decode emits an instance mask with every detection (a
+*   YOLO26-seg root, D737) — the `segmentation` step's result, carried on the
+*   detection in the shape that step produces. Derived from the model's
+*   postprocessor on read, never stored by an import.
+*/
+var RootStepSupplySchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("label"),
+		stepId: _enum(LABEL_SUPPLY_STEP_IDS),
+		labelToEffect: record(string(), string()),
+		uncovered: array(string()).readonly()
+	}),
+	object({
+		kind: literal("crop"),
+		stepId: _enum(CROP_SUPPLY_STEP_IDS),
+		rootLabels: array(string()).readonly(),
+		parentMacro: _enum(["vehicle", "person"]),
+		childClass: _enum(["plate", "face"]),
+		/**
+		* The root's smaller input side, stamped on read by `rootSuppliesOf` from
+		* the model entry — what a step's `minRootInputPx` gate judges. Never
+		* stored by an import.
+		*/
+		rootInputPx: number().int().positive().optional()
+	}),
+	object({
+		kind: literal("mask"),
+		stepId: _enum(MASK_SUPPLY_STEP_IDS)
+	})
+]);
 var ModelCatalogEntrySchema = object({
 	id: string(),
 	name: string(),
@@ -10682,6 +10642,35 @@ var ModelCatalogEntrySchema = object({
 	*/
 	defaultConfidence: number().min(0).max(1).optional(),
 	/**
+	* Per-MODEL default of the per-class confidence floors (`minConfidence<Macro>`
+	* on a detector step), keyed by macro class: `{ person: 0.45 }`. A class
+	* absent here runs at the step slider's global default. The same row shape
+	* the floor measurement produces (`model-floors.json`: modelId → floors), so
+	* a measured table is copied in as-is. An operator override is bound to the
+	* model it was made for and does not survive a model change (D738). A custom
+	* / imported model may declare it; without it, the global defaults apply.
+	*/
+	defaultClassFloors: record(string(), number().min(0).max(1)).optional(),
+	/**
+	* The inference precision this model's OpenVINO IR needs on an Intel GPU.
+	* Absent ⇒ the device default (f16 on a GPU). Set to `'f32'` for an FP32 IR
+	* that produces invalid output at f16 — measured 2026-10-07 for YOLO26
+	* base IRs (`yolo26s`: 0 true / 146 false positives; `yolo26m*`: NaN
+	* scores) on the Core Ultra iGPU and the N100. Threaded to the pool as
+	* `PoolModelConfig.gpuInferencePrecision`; the pool sets
+	* INFERENCE_PRECISION_HINT on a GPU only. Costs ~60% latency on the GPU.
+	*/
+	gpuInferencePrecision: _enum(["f32", "f16"]).optional(),
+	/**
+	* ROOT detectors only: per supplied step (`animal-classifier`, …), the
+	* minimum DETECTION score from which this root's own fine label (species,
+	* vehicle type — D736 root supply) is taken (D741). Below it the detection
+	* keeps its macro class without the fine label. `1` = never take it from
+	* this root. Absent ⇒ no floor beyond the macro floor. The supplied step's
+	* `minConfidence` slider, bound to the ROOT model, overrides it.
+	*/
+	suppliedLabelFloors: record(string(), number().min(0).max(1)).optional(),
+	/**
 	* When true, the executor produces a landmark-aligned crop (similarity warp
 	* onto the canonical template) before this step runs, instead of a plain
 	* axis-aligned bbox crop. Required for face-recognition embedders (ArcFace):
@@ -10743,6 +10732,16 @@ var ModelCatalogEntrySchema = object({
 	*/
 	classMap: DetectionCatalogClassMapSchema.optional(),
 	/**
+	* The pipeline steps this ROOT detector can supply from its own output
+	* (D730): its labels name a step's effect (`deer` for `animal-classifier`)
+	* or draw a step's box (`license_plate` for `plate-detection`). Computed at
+	* import from THIS model's labelmap by `deriveRootSupplies`, never written
+	* by hand and never assumed per family; a row without it is derived on read
+	* (`rootSuppliesOf`). Whether a camera uses it is the step's own
+	* `useRootModel` flag (`resolveRootSupply`).
+	*/
+	suppliesSteps: array(RootStepSupplySchema).readonly().optional(),
+	/**
 	* The model's CLIP feature-space contract (text encoder, dimension, vector
 	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
 	* CLIP image encoder; its absence is what "not a CLIP model" means to the
@@ -12344,13 +12343,6 @@ var BrokerRtspClientSchema = object({
 	lastRtpAt: number(),
 	bytesSent: number()
 });
-var BrokerDecodedClientSchema = object({
-	tag: string(),
-	subscribedAt: number(),
-	maxFps: number(),
-	framesDelivered: number(),
-	framesDropped: number()
-});
 var BrokerAudioClientSchema = object({
 	tag: string(),
 	subscribedAt: number(),
@@ -12442,7 +12434,6 @@ var BrokerEncodedClientSchema = object({
 });
 var BrokerClientsSchema = object({
 	rtsp: array(BrokerRtspClientSchema).readonly(),
-	decoded: array(BrokerDecodedClientSchema).readonly(),
 	audio: array(BrokerAudioClientSchema).readonly(),
 	encoded: array(BrokerEncodedClientSchema).readonly(),
 	pipeClients: number(),
@@ -12811,11 +12802,7 @@ method(object({
 	auth: "admin"
 }), method(object({ brokerId: string() }), BrokerClientsSchema), method(object({
 	brokerId: string(),
-	channel: _enum([
-		"rtsp",
-		"decoded",
-		"audio"
-	]),
+	channel: _enum(["rtsp", "audio"]),
 	handle: string()
 }), object({ killed: boolean() }), {
 	kind: "mutation",
@@ -12850,10 +12837,7 @@ method(object({
 }), method(SubscribeAudioChunksInputSchema, SubscribeAudioChunksResultSchema, { kind: "mutation" }), method(object({
 	subscriptionId: string(),
 	maxCount: number().int().positive().default(8)
-}), array(DecodedAudioChunkSchema).readonly()), method(object({ subscriptionId: string() }), object({ released: boolean() }), { kind: "mutation" }), method(SubscribeFramesInputSchema, SubscribeFramesResultSchema, { kind: "mutation" }), method(object({
-	subscriptionId: string(),
-	maxCount: number().int().positive().default(4)
-}), array(FrameHandleSchema).readonly()), method(object({ subscriptionId: string() }), object({ released: boolean() }), { kind: "mutation" }), method(object({
+}), array(DecodedAudioChunkSchema).readonly()), method(object({ subscriptionId: string() }), object({ released: boolean() }), { kind: "mutation" }), method(object({
 	brokerId: string(),
 	seconds: number().min(0).max(30)
 }), _void(), {
@@ -14010,54 +13994,12 @@ id: union([string(), number()]) }), {
 	kind: "mutation",
 	auth: "admin"
 });
-/**
-* shm ring usage stats for a `frameSink: 'shm'` decoder session —
-* exposed via `decoder.getShmStats` so downstream consumers can
-* observe ring pressure (slot count, byte budget, hit/miss ratio).
-*/
-var ShmRingStatsSchema = object({
-	sessionId: string(),
-	slotCount: number().int(),
-	slotByteLength: number().int(),
-	segmentBytes: number().int(),
-	budgetMb: number().int(),
-	framesWritten: number().int(),
-	getFrameHits: number().int(),
-	getFrameMisses: number().int()
-});
-method(object({ codec: string() }), boolean()), method(_void(), object({
+method(_void(), object({
 	id: string(),
 	name: string(),
-	isPullMode: boolean().optional(),
-	priority: number().optional(),
 	hwaccel: string().optional(),
 	probedBestHwaccel: string().optional()
-})), method(DecoderSessionConfigSchema, object({
-	sessionId: string(),
-	nodeId: string()
-})), method(object({ sessionId: string() }), _void()), method(object({
-	sessionId: string(),
-	packet: EncodedPacketSchema
-}), _void()), method(object({
-	sessionId: string(),
-	url: string()
-}), _void()), method(object({
-	sessionId: string(),
-	maxCount: number().default(1),
-	waitMs: number().optional()
-}), array(DecodedFrameSchema)), method(object({
-	sessionId: string(),
-	maxCount: number().default(1),
-	waitMs: number().optional()
-}), array(FrameHandleSchema)), method(object({ handle: FrameHandleSchema }), DecodedFrameSchema.nullable()), method(object({ sessionId: string() }), ShmRingStatsSchema.nullable()), method(object({
-	sessionId: string(),
-	config: DecoderSessionConfigSchema.partial()
-}), _void()), method(object({ sessionId: string() }), DecoderStatsSchema), method(_void(), array(object({
-	sessionId: string(),
-	codec: string(),
-	outputFormat: string(),
-	createdAtMs: number()
-})).readonly()), method(_void(), object({ backend: string() }), {
+})), method(_void(), object({ backend: string() }), {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -14869,6 +14811,10 @@ var DeviceInfoSchema = object({
 	isCamera: boolean(),
 	/** Current config values — serializable snapshot */
 	config: record(string(), unknown()),
+	/** Paths inside `config` the device's schema declares secret (D783) —
+	*  what the non-admin redaction withholds. Paths, never values. Absent
+	*  when the owning runner has not reported them. */
+	secretConfigPaths: array(string()).optional(),
 	/** Hardware + identity blob (manufacturer / model / firmware / sn /
 	*  uid / mac / …). Populated by drivers; editable via setMetadata. */
 	metadata: record(string(), unknown()).nullable().optional(),
@@ -15074,7 +15020,13 @@ var DeviceRegisterPayloadSchema = object({
 	*  call (workers re-register on init), so probe-driven updates
 	*  (e.g. PTZ flag flipping after the abilities probe) propagate. */
 	features: array(string()).optional(),
-	config: record(string(), unknown())
+	config: record(string(), unknown()),
+	/** Config paths the device's own schema DECLARES secret
+	*  (`.meta({ secret: true })` — dotted, `[]` for array items, e.g.
+	*  `connection.password`). Re-published on every register; the non-admin
+	*  redaction withholds them at any depth (D783). Optional: an older runner
+	*  omits it and the keyword backstop applies. */
+	secretConfigPaths: array(string()).optional()
 });
 var DeviceRemovePayloadSchema = object({ deviceId: number() });
 var DevicePersistConfigPayloadSchema = object({
@@ -15901,6 +15853,12 @@ method(_void(), array(string()).readonly(), { auth: "admin" }), method(object({
 	kind: "mutation",
 	auth: "admin"
 });
+var HUB_ADDRESS_ROLES = [
+	"appConnections",
+	"notificationTaps",
+	"internal",
+	"publicEndpoint"
+];
 /**
 * Transport bounds for AI capability methods.
 *
@@ -16727,7 +16685,14 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		icon: string().optional(),
 		/** Addon-owned HTTP route the button navigates to (GET). */
 		startUrl: string(),
-		stage: LoginStageEnum
+		stage: LoginStageEnum,
+		/**
+		* The provider names an external identity a signed-in user can link to
+		* their own account (D782): `auth.listLinkableProviders` /
+		* `beginExternalLink` offer exactly the redirect methods that set this,
+		* whatever their id. Absent / false — a login button only (magic-link).
+		*/
+		linkable: boolean().optional()
 	}),
 	object({
 		kind: literal("widget"),
@@ -18482,6 +18447,8 @@ var NcSystemEventKindSchema = _enum([
 	"stream-offline",
 	"node-online",
 	"node-offline",
+	"node-restarting",
+	"node-updating",
 	"node-inference-unavailable",
 	"detection-blind",
 	"addon-crash-loop",
@@ -20087,7 +20054,13 @@ var NcAlarmModeDelaysListSchema = array(object({
 	* Absent = false (logged, not sent). Even when true it is not sent when that same sensor
 	* is the one that starts the entry delay — the entry-delay notification already names it.
 	*/
-	notifySensorRewatched: boolean().optional()
+	notifySensorRewatched: boolean().optional(),
+	/**
+	* D735: notify "ignored" when a sensor this arm bypassed really MOVED while armed (its own
+	* change time is after the arm) and set nothing off. Absent = false (logged, not sent). A
+	* re-sync, a recovery from `unavailable` or a duplicate is never announced, switch or not.
+	*/
+	notifySensorIgnored: boolean().optional()
 })).max(8).refine(uniqueModes, { message: "modeDelays: at most one entry per arm mode" });
 var NcAlarmModeDelaysEditListSchema = array(object({
 	mode: AlarmArmModeSchema,
@@ -20100,7 +20073,9 @@ var NcAlarmModeDelaysEditListSchema = array(object({
 	/** D706: set the switch, or `null` to clear it (back to the default, false). */
 	notifyDuringEntryDelay: boolean().nullable().optional(),
 	/** D706: set the switch, or `null` to clear it (back to the default, false). */
-	notifySensorRewatched: boolean().nullable().optional()
+	notifySensorRewatched: boolean().nullable().optional(),
+	/** D735: set the switch, or `null` to clear it (back to the default, false). */
+	notifySensorIgnored: boolean().nullable().optional()
 })).max(8).refine(uniqueModes, { message: "modeDelays: at most one edit per arm mode" });
 /** One switch of the alarm table: put ONE device on, or take it off, ONE mode's list. */
 var NcAlarmNonBlockingEditSchema = object({
@@ -21078,8 +21053,8 @@ Object.freeze(Object.fromEntries([{
 var CLUSTER_STEP_SETTING_FIELDS = [{
 	stepId: "face-embedding",
 	key: "minLandmarkFaceSize",
-	label: "Min face size for recognition (detection px)",
-	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	label: "Min face size to embed (detection-frame px)",
+	description: "Faces smaller than this in the small frame the detector sees are not embedded, so they can never be recognised. Below it the face cannot be aligned reliably and a bad embedding matches everyone. Same value on every node. 0 = no limit.",
 	type: "slider",
 	min: 0,
 	max: 64,
@@ -22131,7 +22106,13 @@ var RetrainFrameSchema = object({
 	sizeBytes: number().int(),
 	width: number().int(),
 	height: number().int(),
-	copiedAt: number()
+	copiedAt: number(),
+	/** When the CAMERA captured the frame. Absent on a copy taken before D785. */
+	capturedAt: number().optional(),
+	/** The operator's "every subject in this frame is boxed". Detector
+	*  evaluation keeps only complete frames: an unboxed subject would count as
+	*  a false positive. */
+	complete: boolean()
 });
 /** Why a copy-on-select could not be honoured — named, never a silent skip. */
 var RetrainCopyRefusalSchema = _enum([
@@ -22152,6 +22133,51 @@ var RetrainFrameListSchema = object({
 	/** What the page pre-selects — the native key frame when one survives. */
 	autoPickMediaId: number().int().optional()
 });
+/**
+* Which frames an annotated export carries. Every field narrows; an empty
+* filter is every annotated copy. A dataset VERSION is a frozen `frameIds`
+* list owned by whoever trains (the training orchestrator), so `frameIds` is
+* the primitive a version export uses; `batchId` re-selects what an earlier
+* export carried (`exportedInBatch`).
+*/
+var RetrainExportFilterSchema = object({
+	deviceIds: array(number()).optional(),
+	frameIds: array(string()).max(2e4).optional(),
+	batchId: string().optional(),
+	/** Only frames the operator marked complete (all subjects boxed). */
+	completeOnly: boolean().optional()
+});
+/**
+* `frames`: the full frame copies, boxes in `annotations.json`.
+* `crops`: additionally one JPEG per subject, cut with the runtime detail-crop
+* convention — the classifier layout.
+*/
+var RetrainExportLayoutSchema = _enum(["frames", "crops"]);
+/**
+* Where `writeRetrainArchive` streams the tar: one HTTP request whose body is
+* the archive, sent chunk by chunk. Covers a presigned PUT and a provider
+* addon's data-plane upload route alike. Headers are sent verbatim and never
+* logged.
+*/
+var RetrainArchiveTargetSchema = object({
+	kind: literal("http"),
+	method: _enum(["PUT", "POST"]),
+	url: string().url(),
+	headers: record(string(), string()).optional()
+});
+var RetrainArchiveResultSchema = object({
+	batchId: string(),
+	frames: number().int(),
+	crops: number().int(),
+	annotations: number().int(),
+	/** Frames planned but not shipped (unreadable copy, path too long). */
+	missing: number().int(),
+	bytes: number().int(),
+	/** sha256 of the exact bytes sent. */
+	sha256: string(),
+	/** The target's HTTP status. */
+	status: number().int()
+});
 /** What the operator asked the assist to look for. */
 var RetrainAssistSubjectSchema = discriminatedUnion("kind", [object({
 	kind: literal("package"),
@@ -22946,9 +22972,25 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), RetrainTransitionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
+}), method(RetrainExportFilterSchema.extend({ layout: RetrainExportLayoutSchema.optional() }), object({ url: string() }), {
 	kind: "query",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	frameId: string(),
+	complete: boolean()
+}), RetrainFrameSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	filter: RetrainExportFilterSchema,
+	layout: RetrainExportLayoutSchema,
+	target: RetrainArchiveTargetSchema
+}), RetrainArchiveResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 60 * 6e4
 }), method(object({
 	/** Which of the three event tables owns the row. */
 	ownerType: EventOwnerTypeSchema,
@@ -22999,6 +23041,34 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	timestamp: number()
 });
 /**
+* A root model's boxes standing in for one crop-kind step's own inference
+* (D730) — see `runPipeline.suppliedRoot`.
+*/
+var SuppliedRootOutputSchema = object({
+	stepId: string(),
+	/** The root model that drew the boxes — stamped on the result. */
+	modelId: string(),
+	detections: array(object({
+		/** `[x1, y1, x2, y2]` in the pixels of the call's image. */
+		bbox: tuple([
+			number(),
+			number(),
+			number(),
+			number()
+		]),
+		score: number(),
+		/**
+		* Five facial landmarks in the same pixels — a face the step's own
+		* detector already re-found inside a root face box (D730), so its
+		* embedder child aligns it exactly as it aligns any detected face.
+		*/
+		landmarks: array(object({
+			x: number(),
+			y: number()
+		})).optional()
+	})).min(1)
+});
+/**
 * Reference to the frame's retained NATIVE surface + the parent crop's placement
 * within the frame, so the executor can re-cut a leaf child ROI at native
 * resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
@@ -23046,7 +23116,7 @@ var FrameRefSchema = object({
 	timestamp: number(),
 	capturedAt: number().optional()
 });
-var ModelFormatSchema$1 = _enum([
+var ModelFormatSchema$2 = _enum([
 	"onnx",
 	"coreml",
 	"openvino",
@@ -23064,7 +23134,7 @@ var PipelineSlotSchema = _enum([
 var PipelineEngineChoiceSchema = object({
 	runtime: literal("python"),
 	backend: string(),
-	format: ModelFormatSchema$1,
+	format: ModelFormatSchema$2,
 	device: string().optional()
 });
 /**
@@ -23103,32 +23173,15 @@ var PipelineDefaultStepSchema = lazy(() => object({
 	group: string().optional(),
 	settings: record(string(), unknown()).optional()
 }));
-var PipelineTemplateStepSchema = lazy(() => object({
-	addonId: string(),
-	enabled: boolean(),
-	modelId: string(),
-	children: array(PipelineTemplateStepSchema).readonly(),
-	settings: record(string(), unknown()).optional()
-}));
-var PipelineTemplateSchema$1 = object({
-	id: string(),
-	name: string(),
-	createdAt: string(),
-	updatedAt: string(),
-	engine: PipelineEngineChoiceSchema,
-	steps: array(PipelineTemplateStepSchema).readonly()
-});
 var PipelineModelOptionSchema = object({
 	id: string(),
 	name: string(),
-	formats: record(string(), object({
-		downloaded: boolean(),
-		sizeMB: number()
-	})),
+	formats: record(string(), PipelineModelFormatStatusSchema),
 	group: ModelVariantGroupSchema.optional(),
 	legacy: boolean().optional(),
 	provider: ModelProviderIdSchema.optional(),
-	defaultConfidence: number().optional()
+	defaultConfidence: number().optional(),
+	suppliesSteps: array(RootStepSupplySchema).readonly().optional()
 });
 var ConfigFieldBridge = custom();
 var PipelineAddonSchemaSchema = object({
@@ -23290,6 +23343,22 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	nodeId: string(),
+	deviceIds: array(number()).readonly().optional(),
+	dryRun: boolean()
+}), object({
+	entries: array(object({
+		deviceId: number(),
+		keys: array(string()).readonly()
+	})).readonly(),
+	refused: array(object({
+		deviceId: number(),
+		reason: string()
+	})).readonly()
+}), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ nodeId: string() }), object({ unhealthy: array(object({
 	/** `<backend>:<device>`, e.g. `openvino:gpu`. */
 	deviceKey: string(),
@@ -23315,22 +23384,14 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 }), method(_void(), PipelineSchemaSchema), method(_void(), array(PipelineDefaultStepSchema).readonly().nullable()), method(_void(), PipelineConfigBridge), method(_void(), ConfigUISchemaBridge), method(object({
 	steps: array(PipelineStepInputSchema),
 	deviceKey: string().optional()
-}), PipelineValidationResultSchema), method(_void(), array(PipelineTemplateSchema$1).readonly()), method(object({
-	name: string(),
-	steps: array(PipelineTemplateStepSchema).readonly(),
-	engine: PipelineEngineChoiceSchema
-}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({
-	id: string(),
-	name: string().optional(),
-	steps: array(PipelineTemplateStepSchema).readonly().optional()
-}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({ id: string() }), _void(), { kind: "mutation" }), method(_void(), InferenceCapabilitiesBridge), method(object({ addonId: string() }), ModelAvailabilityListBridge), method(object({
+}), PipelineValidationResultSchema), method(_void(), InferenceCapabilitiesBridge), method(object({ addonId: string() }), ModelAvailabilityListBridge), method(object({
 	addonId: string(),
 	modelId: string(),
-	format: ModelFormatSchema$1
+	format: ModelFormatSchema$2
 }), DownloadModelResultSchema, { kind: "mutation" }), method(object({
 	addonId: string(),
 	modelId: string(),
-	format: ModelFormatSchema$1
+	format: ModelFormatSchema$2
 }), object({ success: literal(true) }), { kind: "mutation" }), method(object({
 	steps: array(PipelineStepInputSchema).min(1),
 	frame: FrameInputSchema.optional(),
@@ -23396,7 +23457,16 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	* `device-not-servable`), and nothing reaches the camera's live
 	* trace stream. Absent ⇒ unchanged behaviour.
 	*/
-	replay: literal(true).optional()
+	replay: literal(true).optional(),
+	/**
+	* Root-supplied detections for the tree's ROOT step (D730). Set by
+	* `runDetailSubtree` when the camera's root model supplies a crop-kind
+	* step (a Frigate+ `license_plate` for `plate-detection`): the step is
+	* NOT inferred, these boxes are its output, and its children (the plate
+	* reader) run on them through their own crop policy. Boxes are in the
+	* PIXELS of the image this call carries. Absent ⇒ the root step runs.
+	*/
+	suppliedRoot: SuppliedRootOutputSchema.optional()
 }), PipelineRunResultBridge, { kind: "mutation" }), method(object({
 	steps: array(PipelineStepInputSchema).min(1),
 	frames: array(FrameInputSchema).min(1).max(255),
@@ -23478,6 +23548,375 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	filename: string().optional(),
 	settings: record(string(), unknown()).optional()
 }), AudioTestResultSchema, { kind: "mutation" }), method(_void(), ConfigUISchemaNullableBridge);
+/**
+* The wire shapes of the Auto tune plan and apply (D745), used by the
+* `pipeline-orchestrator` cap. The recommender's own types
+* (`recommend.ts`) are the TS face of the same data; these
+* schemas are what crosses the cap boundary.
+*/
+var ModelFormatSchema$1 = _enum(MODEL_FORMATS);
+/** The operator's range for it. */
+var MIN_SESSIONS_PER_DEVICE_RANGE = {
+	min: 1,
+	max: 8
+};
+var HardwareClassIdSchema = _enum([
+	"intel-core-ultra",
+	"intel-n-series",
+	"apple-m-base",
+	"apple-m-pro",
+	"unknown"
+]);
+var AcceleratorKindSchema = _enum([
+	"intel-npu",
+	"intel-igpu",
+	"x86-cpu",
+	"arm-cpu",
+	"apple-ane",
+	"coral"
+]);
+var RecommendationReasonSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("capacity"),
+		sessions: number(),
+		minSessions: number()
+	}),
+	object({
+		kind: literal("tie-faster"),
+		over: string(),
+		recallDelta: number()
+	}),
+	object({
+		kind: literal("stepped-down"),
+		from: string(),
+		to: string(),
+		limitedBy: string()
+	}),
+	object({
+		kind: literal("no-fit-lightest"),
+		sessions: number(),
+		minSessions: number()
+	}),
+	object({
+		kind: literal("derived-latency"),
+		modelId: string()
+	}),
+	object({ kind: literal("cpu-device") }),
+	object({ kind: literal("coral-untouched") }),
+	object({ kind: literal("device-disabled") }),
+	object({ kind: literal("device-unavailable") }),
+	object({ kind: literal("node-offline") }),
+	object({ kind: literal("no-hardware-facts") }),
+	object({
+		kind: literal("no-measured-data"),
+		hardwareClass: HardwareClassIdSchema
+	}),
+	object({
+		kind: literal("no-family-build"),
+		format: ModelFormatSchema$1
+	})
+]);
+var DeviceModelChoiceSchema = object({
+	modelId: string(),
+	p50Ms: number(),
+	fps: number(),
+	measured: boolean(),
+	/** Parallel sessions at the camera rate with the headroom kept free: ⌊fps × (1 − headroom) / camera fps⌋. */
+	capacitySessions: number(),
+	personRecall: number()
+});
+var DeviceRecommendationSchema = object({
+	deviceKey: string(),
+	accelerator: AcceleratorKindSchema.nullable(),
+	enabled: boolean(),
+	available: boolean(),
+	chosen: DeviceModelChoiceSchema.nullable(),
+	reasons: array(RecommendationReasonSchema).readonly()
+});
+var NodeRecommendationSchema = object({
+	nodeId: string(),
+	reachable: boolean(),
+	hardwareClass: HardwareClassIdSchema.nullable(),
+	cpuModel: string().nullable(),
+	skipped: boolean(),
+	acceleratorModelId: string().nullable(),
+	devices: array(DeviceRecommendationSchema).readonly(),
+	reasons: array(RecommendationReasonSchema).readonly()
+});
+var ModelPinChangeSchema = object({
+	stepId: string(),
+	before: string().nullable(),
+	after: string().nullable()
+});
+var NodeDeviceChangeSchema = object({
+	nodeId: string(),
+	deviceKey: string(),
+	madeExplicit: boolean(),
+	modelPins: array(ModelPinChangeSchema).readonly(),
+	thresholds: array(object({
+		stepId: string(),
+		keys: array(string()).readonly()
+	})).readonly()
+});
+var CameraOverrideClearSchema = object({
+	deviceId: number(),
+	source: _enum(["step-override", "wholesale"]),
+	nodeId: string(),
+	deviceKey: string().nullable(),
+	stepId: string(),
+	modelIdBefore: string().nullable(),
+	keys: array(string()).readonly()
+});
+var DetectorStoreClearSchema = object({
+	deviceId: number(),
+	keys: array(string()).readonly()
+});
+var AutoTuneWarningSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("detector-store-cluster-wide"),
+		skippedNodes: array(string()).readonly()
+	}),
+	object({
+		kind: literal("detector-store-unreadable"),
+		error: string()
+	}),
+	object({
+		kind: literal("coral-enabled"),
+		nodeId: string(),
+		deviceKey: string()
+	})
+]);
+var AutoTuneOptionsSchema = object({
+	/** Share of each accelerator's throughput kept free (0.3–0.5). */
+	headroom: number().min(.3).max(.5).default(.4),
+	/**
+	* The least number of parallel sessions every device must sustain at the
+	* camera rate with the headroom kept free (D755). The most accurate model
+	* that reaches it wins.
+	*/
+	minSessionsPerDevice: number().int().min(MIN_SESSIONS_PER_DEVICE_RANGE.min).max(MIN_SESSIONS_PER_DEVICE_RANGE.max).default(2)
+});
+var AutoTunePlanSchema = object({
+	/** Hash of everything the apply will write — the apply refuses a different one. */
+	planHash: string(),
+	family: literal("yolov9"),
+	headroom: number(),
+	minSessionsPerDevice: number(),
+	/** The detection rate a session is counted at (the fastest camera running the pipeline root). */
+	cameraFps: number(),
+	generatedAt: number(),
+	nodes: array(NodeRecommendationSchema).readonly(),
+	nodeChanges: array(NodeDeviceChangeSchema).readonly(),
+	cameraClears: array(CameraOverrideClearSchema).readonly(),
+	detectorStoreClears: array(DetectorStoreClearSchema).readonly(),
+	warnings: array(AutoTuneWarningSchema).readonly()
+});
+var AutoTuneApplyInputSchema = object({
+	planHash: string(),
+	headroom: number().min(.3).max(.5).default(.4),
+	minSessionsPerDevice: number().int().min(MIN_SESSIONS_PER_DEVICE_RANGE.min).max(MIN_SESSIONS_PER_DEVICE_RANGE.max).default(2)
+});
+var AutoTunePhaseResultSchema = object({
+	phase: _enum([
+		"download",
+		"camera-overrides",
+		"detector-thresholds",
+		"node-models",
+		"redispatch"
+	]),
+	ok: boolean(),
+	detail: string()
+});
+var AutoTuneApplyResultSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("applied"),
+		planHash: string(),
+		phases: array(AutoTunePhaseResultSchema).readonly()
+	}),
+	object({
+		kind: literal("aborted"),
+		phases: array(AutoTunePhaseResultSchema).readonly()
+	}),
+	object({
+		kind: literal("stale"),
+		plan: AutoTunePlanSchema
+	}),
+	object({
+		kind: literal("refused"),
+		reason: _enum(["apply-in-progress"])
+	})
+]);
+/**
+* Wire shapes of the Load balancing surface (D748): the session placement
+* policy, the atomic share write, the observed placement statistics, the
+* hardware share suggestion and the stale device pins.
+*/
+/**
+* How a new detection session picks its node and device.
+*  - `least-loaded` — the historical rule: lowest `attached / weight`, a
+*    constant node order at a tie (D37). An idle node always ties at 0, so a
+*    weight only bites once a node already holds a session.
+*  - `share` — the share of PARALLEL sessions is held to the weights, and a
+*    full or drowning node yields to a free one (D748).
+*/
+var SessionPlacementPolicySchema = _enum(["least-loaded", "share"]);
+var LoadBalancingSharesInputSchema = object({
+	/** nodeId → share (> 0). A node left out keeps its weight. */
+	nodes: record(string(), number().positive()).default({}),
+	/** nodeId → deviceKey → share (> 0). A device left out keeps its weight. */
+	devices: record(string(), record(string(), number().positive())).default({})
+});
+var PlacementStatsInputSchema = object({ 
+/** Window the observed shares are averaged over (default 1 h, max 24 h). */
+windowMs: number().int().min(6e4).max(1440 * 60 * 1e3).default(3600 * 1e3) });
+var PlacementDeviceStatsSchema = object({
+	deviceKey: string(),
+	/** Sessions running on this device now. */
+	sessionsNow: number(),
+	/** Sessions started on this device inside the window. */
+	sessionsStarted: number(),
+	/** Time-weighted share of the node's parallel sessions over the window (0–1); null = no session ran. */
+	observedShare: number().nullable()
+});
+var PlacementNodeStatsSchema = object({
+	nodeId: string(),
+	sessionsNow: number(),
+	sessionsStarted: number(),
+	/** Time-weighted share of the cluster's parallel sessions over the window (0–1); null = none ran. */
+	observedShare: number().nullable(),
+	/** Most sessions this node ran at once inside the window. */
+	peakSessions: number(),
+	/** Sessions a share election handed elsewhere because this node was full or drowning. */
+	yieldsAway: number(),
+	devices: array(PlacementDeviceStatsSchema).readonly()
+});
+/** A camera's device pin that the session path cannot honour. */
+var StaleDevicePinSchema = object({
+	deviceId: number(),
+	deviceKey: string(),
+	/** `disabled` — the key exists on some node but is not enabled anywhere; `absent` — no node has it. */
+	reason: _enum(["disabled", "absent"])
+});
+var PlacementStatsSchema = object({
+	policy: SessionPlacementPolicySchema,
+	windowMs: number(),
+	/** How much of the window was actually observed (the hub keeps it in memory). */
+	observedForMs: number(),
+	sessionsNow: number(),
+	/** Most parallel sessions across the cluster inside the window. */
+	clusterPeakSessions: number(),
+	nodes: array(PlacementNodeStatsSchema).readonly(),
+	stalePins: array(StaleDevicePinSchema).readonly()
+});
+/**
+* Where an automatic share's capacity comes from (D755).
+*  - `hardware` — the static capacity of each device at its Auto tune model:
+*    the measured latency table for the node's hardware class.
+*  - `benchmark` — the node's own measured capacity (node benchmark results).
+*    A node with no results falls back to `hardware`, and says so.
+*/
+var CapacitySourceSchema = _enum(["hardware", "benchmark"]);
+/** Why a node under the `benchmark` source was sized from hardware instead. */
+var CapacityFallbackSchema = _enum(["no-benchmark-results", "partial-benchmark-results"]);
+var SuggestSharesInputSchema = object({
+	headroom: number().min(.3).max(.5).default(.4),
+	/** Default `hardware`. */
+	source: CapacitySourceSchema.default("hardware")
+});
+var SuggestedDeviceShareSchema = object({
+	deviceKey: string(),
+	/** Share of the node (0–100, rounded). */
+	share: number(),
+	modelId: string().nullable(),
+	/** Inferences per second at that model, from the measured table; null when sized by a benchmark. */
+	fps: number().nullable(),
+	/** False for a table cell derived from another chip; true for a measured cell or a benchmark. */
+	measured: boolean(),
+	/**
+	* Advisory session cap: ⌊fps × (1 − headroom) / camera fps⌋ from the table,
+	* or the benchmark's measured max sessions. Never enforced.
+	*/
+	suggestedMaxSessions: number().nullable()
+});
+var SuggestedNodeShareSchema = object({
+	nodeId: string(),
+	/** Share of the cluster (0–100, rounded); null = node skipped (offline, unknown hardware). */
+	share: number().nullable(),
+	/** Parallel sessions the node sustains at the suggested models with the headroom kept free. */
+	capacitySessions: number(),
+	devices: array(SuggestedDeviceShareSchema).readonly(),
+	skippedReason: string().nullable(),
+	/** What this node's capacity was read from; null when the node is skipped. */
+	capacitySource: CapacitySourceSchema.nullable(),
+	/** Set when the `benchmark` source was asked for and this node used `hardware`. */
+	capacityFallback: CapacityFallbackSchema.nullable()
+});
+var SuggestSharesResultSchema = object({
+	headroom: number(),
+	/** The source asked for; each node says what it actually used. */
+	source: CapacitySourceSchema,
+	/** Camera detection rate the capacity is counted in (the fastest camera's fps). */
+	cameraFps: number(),
+	/** The Auto tune capacity floor the models were picked at. */
+	minSessionsPerDevice: number(),
+	nodes: array(SuggestedNodeShareSchema).readonly()
+});
+/**
+* Where the node and device shares come from (D750, D755).
+*  - `hardware` (default) — computed by the system from each node's static
+*    capacity (its accelerators at their Auto tune models, from the measured
+*    latency table), recomputed whenever a node or device joins, leaves, is
+*    switched on or off, or changes model. No load input.
+*  - `benchmark` — the same, from each node's measured capacity (node
+*    benchmark results); a node without results falls back to `hardware`.
+*  - `manual` — the operator's stored sliders.
+* Either way a node or device that cannot take sessions gives its share to
+* the others in proportion; the stored values are never rewritten for that.
+*/
+var ShareSourceSchema = _enum([
+	"hardware",
+	"benchmark",
+	"manual"
+]);
+var SetShareSourceInputSchema = object({ source: ShareSourceSchema });
+object({
+	nodes: record(string(), number()),
+	devices: record(string(), record(string(), number()))
+});
+var EffectiveDeviceShareSchema = object({
+	deviceKey: string(),
+	/** Can take sessions now (enabled, available, can run the root). */
+	eligible: boolean(),
+	/** The share the source assigns, as a percentage of the node's devices. */
+	configuredPct: number(),
+	/** The share actually used, after an ineligible device's share went to the others. */
+	effectivePct: number()
+});
+var EffectiveNodeShareSchema = object({
+	nodeId: string(),
+	eligible: boolean(),
+	configuredPct: number(),
+	effectivePct: number(),
+	/** Automatic sources: what this node's share was computed from; null under `manual` or before the first answer. */
+	capacitySource: CapacitySourceSchema.nullable(),
+	/** Automatic `benchmark`: why this node used `hardware` instead. */
+	capacityFallback: CapacityFallbackSchema.nullable(),
+	devices: array(EffectiveDeviceShareSchema).readonly()
+});
+var EffectiveSharesSchema = object({
+	source: ShareSourceSchema,
+	policy: SessionPlacementPolicySchema,
+	/** An automatic source with no computed answer yet: the stored sliders are used meanwhile. */
+	autoPending: boolean(),
+	/** When the automatic shares were last computed (ms epoch); null = never. */
+	computedAt: number().nullable(),
+	/** What made the system recompute them last. */
+	trigger: string().nullable(),
+	nodes: array(EffectiveNodeShareSchema).readonly(),
+	/** The relative weights the election reads (before eligibility). */
+	nodeWeights: record(string(), number()),
+	deviceWeights: record(string(), record(string(), number()))
+});
 object({
 	activeCameras: number(),
 	throttledCameras: number(),
@@ -24355,14 +24794,15 @@ var RunnerLocalLoadSchema = object({
 	* Per-inference-device live load (multi-device C4). One entry per deviceKey
 	* this runner currently has attached cameras on, so the orchestrator's second
 	* `balance()` pass (over a node's devices) weights on real per-pool session
-	* counts. Empty on single-device / pre-multi-device runners. `queueDepthTotal`
-	* per device is 0 until the pool backlog gets a public accessor (follow-up).
+	* counts. Empty on single-device / pre-multi-device runners. There is no
+	* per-device queue depth: the inference pool's backlog has no accessor, and
+	* a field that always read 0 was removed rather than shown as a measurement
+	* (D762).
 	*/
 	devices: array(object({
 		deviceKey: string(),
 		backend: string(),
-		attachedCameras: number(),
-		queueDepthTotal: number()
+		attachedCameras: number()
 	})).default([]),
 	/** Hardware capability flags reported by this node. */
 	hardware: object({
@@ -24498,7 +24938,22 @@ method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mu
 	*/
 	cropJpeg: string().optional(),
 	parent: DetailParentSchema,
-	steps: array(string()).optional()
+	steps: array(string()).optional(),
+	/**
+	* The camera's root model already drew this step's boxes (D730): a
+	* `license_plate` inside the parent vehicle. The named step is NOT
+	* inferred — these FRAME-space boxes are its output — and its
+	* requested children (the plate reader) run on them. Absent ⇒ every
+	* requested step infers as before.
+	*/
+	supplied: object({
+		stepId: string(),
+		modelId: string(),
+		boxes: array(object({
+			bbox: NativeCropBboxSchema,
+			score: number()
+		})).min(1)
+	}).optional()
 }), object({ details: array(DetailResultSchema) }).nullable(), { kind: "mutation" }), method(object({
 	/** Catalog step id, e.g. `clip-embedding`. */
 	stepId: string(),
@@ -24561,14 +25016,6 @@ var CameraPipelineConfigSchema = object({
 		settings: record(string(), unknown()).readonly().optional()
 	}).nullable().optional()
 });
-var PipelineTemplateSchema = object({
-	id: string(),
-	name: string(),
-	description: string().optional(),
-	config: CameraPipelineConfigSchema,
-	createdAt: string(),
-	updatedAt: string()
-});
 var DeviceStepConfigSchema = object({
 	modelId: string().optional(),
 	settings: record(string(), unknown()).optional(),
@@ -24642,9 +25089,10 @@ var CameraStepOverridePatchSchema = object({
 	modelId: string().optional(),
 	settings: record(string(), unknown()).readonly().optional()
 });
+var CameraStepSettingsSchema = record(string(), record(string(), unknown()).readonly());
 var CameraPipelineSettingsSchema = object({
-	pinnedAgentNodeId: string().optional(),
 	stepToggles: record(string(), boolean()).optional(),
+	stepSettings: CameraStepSettingsSchema.optional(),
 	stepOverridesByDevice: record(string(), record(string(), record(string(), CameraStepOverridePatchSchema))).optional(),
 	pipelineByAgent: record(string(), CameraPipelineForAgentSchema).optional()
 });
@@ -24677,7 +25125,10 @@ var PipelineAssignmentSchema = object({
 });
 /**
 * Per-agent load summary surfaced to the load balancer + dashboards.
-* Aggregated from each runner's `getLocalLoad` cap call.
+* Aggregated from each runner's `getLocalLoad` cap call. In the
+* `getAgentLoad` report, a single-device node's default-pool sessions (no
+* `deviceKey`) are credited to its one eligible device in `load.devices` —
+* the default pool IS that device (D745); the balancer's census stays raw.
 */
 var AgentLoadSummarySchema = object({
 	nodeId: string(),
@@ -24766,26 +25217,27 @@ var CameraBrokerStatusSchema = object({
 		width: number(),
 		height: number(),
 		subscribers: number(),
-		inFps: number(),
-		outFps: number()
+		/**
+		* Encoded packets/s the broker receives from the camera. null when the
+		* broker's stats read failed — unknown, never 0 (a 0 here reads as a stall).
+		* There is no output rate: decoding runs in the session decode workers, not
+		* in the broker, so the broker's own decoded-frame rate is 0 on every live
+		* camera and is not served (D758).
+		*/
+		inFps: number().nullable()
 	})).readonly(),
 	webrtcSessions: number(),
 	rtspRestream: boolean()
 });
-/** Shared-memory ring statistics within the decoder block. */
-var CameraDecoderShmSchema = object({
-	framesWritten: number(),
-	getFrameHits: number(),
-	getFrameMisses: number(),
-	budgetMb: number()
-});
-/** Decoder block — null when the decoder stage is unreachable or inactive. */
-var CameraDecoderStatusSchema = object({
-	nodeId: string(),
-	formats: array(string()).readonly(),
-	sessionCount: number(),
-	shm: CameraDecoderShmSchema
-});
+/**
+* Decoder block — WHERE decode runs (co-located with the detection node by
+* construction); null when the camera has no detection node. It carries no
+* frame counter: the shared-memory plane whose counters it used to serve is
+* gone, and those fields read 0 forever. Whether frames actually flow is read
+* from `detection.actualFps` (frames delivered to and processed by the
+* detector), never from a counter nothing feeds.
+*/
+var CameraDecoderStatusSchema = object({ nodeId: string() });
 /** Motion block — null when motion detection is not active for this device. */
 var CameraMotionStatusSchema = object({
 	enabled: boolean(),
@@ -25142,12 +25594,6 @@ method(object({
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	agentNodeId: string(),
-	detectWeight: number().positive().nullable()
-}), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
 }), method(object({
 	agentNodeId: string(),
 	detect: boolean().nullable().optional(),
@@ -25189,6 +25635,15 @@ method(object({
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(AutoTuneOptionsSchema, AutoTunePlanSchema, { auth: "admin" }), method(AutoTuneApplyInputSchema, AutoTuneApplyResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(LoadBalancingSharesInputSchema, object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(PlacementStatsInputSchema, PlacementStatsSchema, { auth: "admin" }), method(SuggestSharesInputSchema, SuggestSharesResultSchema, { auth: "admin" }), method(_void(), EffectiveSharesSchema, { auth: "admin" }), method(SetShareSourceInputSchema, object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ deviceId: number() }), CameraPipelineSettingsSchema.nullable()), method(object({
 	deviceId: number(),
 	addonId: string(),
@@ -25205,6 +25660,13 @@ method(object({
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	addonId: string(),
+	settings: record(string(), unknown()).nullable()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	agentNodeId: string(),
@@ -25228,25 +25690,7 @@ method(object({
 }), method(_void(), DiskReconcileJobSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), DiskReconcileJobSchema, { auth: "admin" }), method(_void(), array(PipelineTemplateSchema).readonly()), method(object({
-	name: string(),
-	description: string().optional(),
-	config: CameraPipelineConfigSchema
-}), PipelineTemplateSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	id: string(),
-	name: string().optional(),
-	description: string().optional(),
-	config: CameraPipelineConfigSchema.optional()
-}), PipelineTemplateSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ id: string() }), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-});
+}), method(_void(), DiskReconcileJobSchema, { auth: "admin" });
 /**
 * Cap → event-kind mapping for the SENSOR / CONTROL cap families — the table
 * `pipeline-analytics.listEventKinds` uses to turn a linked device's bound
@@ -25836,7 +26280,19 @@ var SsoBridgeClaimsSchema = object({
 	* editing a descriptor must not retroactively extend or shorten a link the
 	* operator already consented to.
 	*/
-	refreshTtl: union([number().int().positive(), literal("never")]).optional()
+	refreshTtl: union([number().int().positive(), literal("never")]).optional(),
+	/**
+	* Opaque handle of a hub-side LINK intent (D782). Set by an OIDC callback
+	* that was started from a signed-in user's "Link" button: the finish then
+	* links this identity to the intent's user instead of signing anyone in.
+	* The handle carries no user id — the hub resolves it, single-use.
+	*/
+	linkIntent: string().optional(),
+	/**
+	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
+	* subject is unique only per issuer, so a link is bound to it.
+	*/
+	issuer: string().optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
@@ -27466,8 +27922,6 @@ var WebrtcStreamChoiceSchema = object({
 	]).nullable(),
 	/** Input FPS from the camera (null for adaptive). */
 	inputFps: number().nullable(),
-	/** Decoded FPS (null for adaptive). */
-	decodeFps: number().nullable(),
 	/** Bitrate in kbps (null for adaptive). */
 	bitrateKbps: number().nullable()
 });
@@ -27744,7 +28198,22 @@ DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), ar
 	* field their hints were silently stripped by the schema and the
 	* adaptive ladder started blind on the client's display size.
 	*/
-	hints: webrtcClientHintsSchema.optional()
+	hints: webrtcClientHintsSchema.optional(),
+	/**
+	* Talk-back (D771): relay the PEER's audio to the device's speaker
+	* through the `intercom` cap's push-talk triple. When `true` and the
+	* offer lets the peer send audio, the answer's audio is `sendrecv`
+	* and every inbound frame goes to `intercom.pushTalkAudio` for this
+	* `deviceId`; absent/false answers `sendonly`, as for every viewer.
+	*
+	* TRUSTED-CALLER ONLY. Set by the Alexa export for an Echo on a camera
+	* with `intercom`, when the linked user may control that camera. The
+	* hub STRIPS it from every request-bound call (a browser), exactly as
+	* it overwrites `relayOnly` — a viewer's talk permission is the
+	* intercom cap's own surface (share tokens gate it there), and this
+	* flag must not become a second door to the camera's speaker.
+	*/
+	talkback: boolean().optional()
 }), object({
 	sessionId: string(),
 	sdpAnswer: string()
@@ -27799,6 +28268,14 @@ DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), ar
 	*/
 	alive: boolean()
 })), method(object({
+	deviceId: number().int().nonnegative(),
+	sessionId: string(),
+	downlinkMbps: number().nonnegative()
+}), object({
+	outcome: _enum(["switching", "held"]),
+	tier: CamProfileSchema.nullable(),
+	reason: string()
+}), { kind: "mutation" }), method(object({
 	deviceId: number().int().nonnegative(),
 	sessionId: string()
 }), WebrtcSessionDebugSchema, { kind: "query" });
@@ -28038,6 +28515,59 @@ var AddonAutoUpdateSchema = ChannelWithInheritSchema;
 var RestartAddonResultSchema = unknown();
 var InstallPackageResultSchema = unknown();
 var ReloadPackagesResultSchema = unknown();
+/**
+* What an uninstall did on ONE node.
+*  - `uninstalled`       — removed: runner(s) stopped, caps gone, code deleted.
+*  - `not-installed`     — the node did not have it (nothing to do).
+*  - `refused`           — protected / bootstrap package; nothing touched.
+*  - `failed`            — attempted and did not complete; `error` says why.
+*  - `pending-reconnect` — the node is OFFLINE: its record was pruned so the
+*    back-fill never returns the package, and the stale-addon sweep removes the
+*    copy when the node registers again (only once the hub no longer has it).
+*/
+var UninstallNodeOutcomeSchema = _enum([
+	"uninstalled",
+	"not-installed",
+	"refused",
+	"failed",
+	"pending-reconnect"
+]);
+var UninstallNodeResultSchema = object({
+	nodeId: string(),
+	outcome: UninstallNodeOutcomeSchema,
+	error: string().optional(),
+	addonIds: array(string()).readonly(),
+	runnersStopped: array(string()).readonly(),
+	warnings: array(string()).readonly()
+});
+var UninstallPackageResultSchema = object({
+	/** Every targeted node ended `uninstalled`, `not-installed` or `pending-reconnect`. */
+	success: boolean(),
+	packageName: string(),
+	results: array(UninstallNodeResultSchema).readonly()
+});
+/**
+* `unreachable` lists online agents whose status read FAILED — absence from
+* `installations` is only "not installed" for a node that answered (D315).
+*/
+var PackageInstallationsSchema = object({
+	installations: array(object({
+		packageName: string(),
+		nodeId: string(),
+		nodeName: string(),
+		isHub: boolean(),
+		isOnline: boolean(),
+		version: string().nullable(),
+		addonIds: array(string()).readonly(),
+		source: _enum(["live", "recorded"]),
+		/** The hub installs this package too. `false` on an agent row = an orphan. */
+		onHub: boolean()
+	})).readonly(),
+	unreachable: array(object({
+		nodeId: string(),
+		error: string()
+	})).readonly()
+});
 var BulkUpdateItemStatusSchema = _enum([
 	"queued",
 	"updating",
@@ -28120,10 +28650,14 @@ method(_void(), array(AddonListItemSchema).readonly()), method(object({
 }), method(object({ packageName: string() }), InstallPackageResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), boolean()), method(_void(), array(unknown()).readonly()), method(object({ packageName: string() }), unknown(), {
+}), method(_void(), boolean()), method(_void(), array(unknown()).readonly()), method(object({
+	packageName: string().min(1),
+	nodeId: string().optional(),
+	everywhere: boolean().optional()
+}), UninstallPackageResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), ReloadPackagesResultSchema, {
+}), method(object({ packageName: string().optional() }), PackageInstallationsSchema, { auth: "admin" }), method(_void(), ReloadPackagesResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ query: string().optional() }), array(SearchResultSchema)), method(object({ nodeId: string().optional() }), array(PackageUpdateSchema).readonly(), { auth: "admin" }), method(object({
@@ -30474,7 +31008,8 @@ var ConnectionEndpointSchema = object({
 		"lan-ipv6",
 		"public",
 		"loopback",
-		"app-link"
+		"app-link",
+		"custom"
 	]),
 	/**
 	* Originating-interface kind — `lan`/`wifi`/`docker`/`vpn`/`other`/
@@ -30543,7 +31078,7 @@ var GetConnectionEndpointsResultSchema = object({
 	localPort: AdvertisedLocalPortSchema
 });
 /**
-* The address flagged for notification links. `baseUrl: null` = AUTO, which
+* The address flagged for notification taps (`notificationTaps`). `baseUrl: null` = AUTO, which
 * since D709 is the CamStack app link; `resolved` reports the effective value,
 * so the UI can show it either way.
 */
@@ -30576,6 +31111,72 @@ var ViewerEndpointsSchema = object({
 	/** What the ranking currently resolves to (may be empty if nothing is up). */
 	resolved: array(string()).readonly()
 });
+/**
+* DEPRECATED compatibility shape of `getHubAddresses` (D729 amendment, kept
+* for addons built against it): `cluster` is the `internal` role, `browser`
+* the `publicEndpoint` role; `override` is the flagged address.
+*/
+var HubAddressSnapshotSchema = object({
+	override: string().nullable(),
+	resolved: string().nullable(),
+	source: _enum([
+		"override",
+		"auto",
+		"none"
+	])
+});
+var HubAddressesSchema = object({
+	cluster: HubAddressSnapshotSchema,
+	browser: HubAddressSnapshotSchema
+});
+/**
+* What an address is used for (`hub-address.ts`, D734). `appConnections` is
+* many-valued; `notificationTaps`, `publicEndpoint` and `internal` are carried
+* by at most one address.
+*/
+var HubAddressRoleSchema = _enum(HUB_ADDRESS_ROLES);
+var RoleSourceSchema = _enum([
+	"flagged",
+	"auto",
+	"none"
+]);
+/** One single-valued role: the flagged address, the one in use, and why. */
+var HubAddressRoleResolutionSchema = object({
+	/** The address carrying the flag, or null = automatic. */
+	flagged: string().nullable(),
+	/** The address in use, or null when nothing qualifies (never loopback). */
+	resolved: string().nullable(),
+	source: RoleSourceSchema
+});
+var HubAppConnectionsResolutionSchema = object({
+	/** The addresses flagged `appConnections`, or empty = automatic. */
+	flagged: array(string()).readonly(),
+	/** What the apps race right now. */
+	resolved: array(string()).readonly(),
+	source: RoleSourceSchema
+});
+var HubAddressBookSchema = object({
+	rows: array(ConnectionEndpointSchema.extend({
+		/** In the hub's detected palette right now. */
+		detected: boolean(),
+		/** Entered by the operator (removable). */
+		custom: boolean(),
+		/** The roles explicitly flagged on this address. */
+		flags: array(HubAddressRoleSchema).readonly(),
+		/** The roles this address serves right now — flagged or automatic. */
+		inUse: array(HubAddressRoleSchema).readonly(),
+		/** The roles this address may be flagged with. */
+		eligible: array(HubAddressRoleSchema).readonly()
+	})).readonly(),
+	roles: object({
+		appConnections: HubAppConnectionsResolutionSchema,
+		notificationTaps: HubAddressRoleResolutionSchema,
+		internal: HubAddressRoleResolutionSchema,
+		publicEndpoint: HubAddressRoleResolutionSchema
+	}),
+	/** The `hub=` an app link carries (D709), or null. */
+	appLinkHub: string().nullable()
+});
 var AllowedAddressesSchema = object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -30619,10 +31220,27 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*  tunnel always emits `https://` regardless. */
 	scheme: _enum(["http", "https"]).optional(),
 	/** Append the CamStack app link entry (`kind: 'app-link'`, D709) —
-	*  an address notification links can be flagged with, not a hub
+	*  an address notification taps can be flagged with, not a hub
 	*  route. Default `false`: racers and rankers never see it. */
 	includeAppLink: boolean().optional()
-}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), ViewerEndpointsSchema), method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
+}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), ViewerEndpointsSchema), method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }), method(object({ scheme: _enum(["http", "https"]).optional() }).optional(), HubAddressBookSchema), method(object({
+	baseUrl: string(),
+	label: string().max(80)
+}), HubAddressBookSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ baseUrl: string() }), HubAddressBookSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	role: HubAddressRoleSchema,
+	baseUrl: string().nullable(),
+	enabled: boolean(),
+	acceptInsecureHttp: boolean().optional()
+}), HubAddressBookSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), HubAddressesSchema), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
@@ -31073,7 +31691,8 @@ object({
 	*   writes this slice (not even a boot seed), and neither does the runner's
 	*   phase machine: its phase is "a session is attached" for every on-motion
 	*   session, not motion, and it now has its own `DetectionPhaseTransition`.
-	*   A provider's `isDetected` answers from the hub's slice.
+	*   A provider's `isDetected` and `getStatus` answer from the hub's slice
+	*   (`hubMotionNativeProvider`).
 	* - **Sensors** (Home Assistant binary sensors, Homematic, Matter, Alexa
 	*   imports) — the provider pushes both edges itself, from the upstream
 	*   system's own state change. That is the sensor's own fact.
@@ -35699,6 +36318,32 @@ var TotpStatusSchema = object({
 	/** Null when no row exists OR the row is still pending confirmation. */
 	confirmedAt: number().nullable()
 });
+/**
+* user-management — singleton capability for user accounts, API keys,
+* and scoped tokens.
+*
+* v2 model: every method gated by `auth: 'admin'`. Admin-only delegation
+* — the subset check on `setUserScopes` / `createScopedToken` is moot
+* because non-admins never reach these. If/when we open non-admin
+* delegation, structural caller-scope subset check goes inside the
+* provider.
+*/
+var ExternalIdentitySchema = object({
+	/** Login-method id of the provider instance, e.g. `auth-oidc/authentik`. */
+	provider: string(),
+	/** The IdP's stable subject (`sub`) for this account. */
+	subject: string(),
+	/** The verified `iss` of the IdP the identity was linked under — `sub` is unique only per issuer. */
+	issuer: string(),
+	userId: string(),
+	/** What the IdP called the account at link time (username / email) — display only. */
+	label: string().optional(),
+	linkedAt: number()
+});
+var ExternalIdentityKeySchema = object({
+	provider: string().min(1),
+	subject: string().min(1)
+});
 method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserInputSchema, UserSummarySchema, {
 	kind: "mutation",
 	auth: "admin",
@@ -35812,7 +36457,22 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	userId: string(),
 	username: string(),
 	scopes: array(TokenScopeSchema)
-}).nullable(), { access: "view" }), method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }), method(object({ id: string() }), object({ success: boolean() }), {
+}).nullable(), { access: "view" }), method(object({ userId: string() }), array(ExternalIdentitySchema), { auth: "admin" }), method(ExternalIdentityKeySchema, object({
+	userId: string(),
+	issuer: string()
+}).nullable(), { auth: "admin" }), method(ExternalIdentityKeySchema.extend({
+	userId: string(),
+	issuer: string().min(1),
+	label: string().optional()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "create"
+}), method(ExternalIdentityKeySchema.extend({ userId: string() }), object({ success: boolean() }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "delete"
+}), method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }), method(object({ id: string() }), object({ success: boolean() }), {
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
@@ -36204,6 +36864,16 @@ DeviceType.Camera, method(object({
 	package: array(ZoneRuleSchema).readonly()
 });
 SOURCE_CAPS.filter((cap) => cap !== "switch" && cap !== "motion");
+Object.freeze({
+	person: .5,
+	vehicle: .5,
+	animal: .5
+});
+Object.freeze({
+	person: .65,
+	vehicle: .65,
+	animal: .65
+});
 /**
 * Accessory device helpers — shared across drivers.
 *
@@ -36378,6 +37048,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"addons.listInstallations": {
+		capName: "addons",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"addons.listJobs": {
 		capName: "addons",
 		capScope: "system",
@@ -37560,90 +38236,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"decoder.createSession": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.destroySession": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
-	"decoder.getFrame": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"decoder.getInfo": {
 		capName: "decoder",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"decoder.getShmStats": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.getStats": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.listActiveSessions": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.openStream": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.pullFrames": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.pullHandles": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.pushPacket": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"decoder.reprobeHwaccel": {
 		capName: "decoder",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"decoder.supportsCodec": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.updateConfig": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"detectionPipeline.applyDeviceSettingsPatch": {
 		capName: "detection-pipeline",
 		capScope: "device",
@@ -39132,12 +39736,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.addCustomAddress": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.downloadCa": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getAddresses": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -39150,6 +39766,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getHubAddresses": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getNotificationEndpoint": {
 		capName: "local-network",
 		capScope: "system",
@@ -39186,6 +39808,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.removeCustomAddress": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"localNetwork.resetAllowlistToBestMatch": {
 		capName: "local-network",
 		capScope: "system",
@@ -39198,6 +39826,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.setAddressRole": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.setAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -40644,6 +41278,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.setRetrainFrameComplete": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -40680,6 +41320,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.writeRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineExecutor.cacheFrameInPool": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -40692,13 +41338,13 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
-	"pipelineExecutor.deleteModel": {
+	"pipelineExecutor.clearModelBoundDeviceOverrides": {
 		capName: "pipeline-executor",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
-	"pipelineExecutor.deleteTemplate": {
+	"pipelineExecutor.deleteModel": {
 		capName: "pipeline-executor",
 		capScope: "system",
 		addonId: null,
@@ -40842,12 +41488,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"pipelineExecutor.listTemplates": {
-		capName: "pipeline-executor",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"pipelineExecutor.rearmInferenceDevice": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -40872,12 +41512,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineExecutor.saveTemplate": {
-		capName: "pipeline-executor",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineExecutor.setVideoPipelineSteps": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -40896,41 +41530,35 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineExecutor.updateTemplate": {
-		capName: "pipeline-executor",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineExecutor.validatePipeline": {
 		capName: "pipeline-executor",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"pipelineOrchestrator.applyDeviceSettingsPatch": {
+	"pipelineOrchestrator.applyAutoTune": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.assignAudio": {
+	"pipelineOrchestrator.applyDeviceSettingsPatch": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.assignPipeline": {
+	"pipelineOrchestrator.assignAudio": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.deleteTemplate": {
+	"pipelineOrchestrator.assignPipeline": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
-		access: "delete"
+		access: "create"
 	},
 	"pipelineOrchestrator.getAgentLoad": {
 		capName: "pipeline-orchestrator",
@@ -41022,6 +41650,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getEffectiveShares": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getGlobalMetrics": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -41058,19 +41692,19 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"pipelineOrchestrator.getReconcileFromDiskStatus": {
+	"pipelineOrchestrator.getPlacementStats": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"pipelineOrchestrator.listAgentSettings": {
+	"pipelineOrchestrator.getReconcileFromDiskStatus": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"pipelineOrchestrator.listTemplates": {
+	"pipelineOrchestrator.listAgentSettings": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
@@ -41082,6 +41716,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.planAutoTune": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.rebalance": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -41124,12 +41764,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.saveTemplate": {
-		capName: "pipeline-orchestrator",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineOrchestrator.setAgentCapabilities": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -41142,12 +41776,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.setAgentDetectWeight": {
-		capName: "pipeline-orchestrator",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineOrchestrator.setAgentInferenceDevices": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -41184,6 +41812,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraStepSettings": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCameraStepToggle": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -41202,25 +41836,37 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setLoadBalancingShares": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setPipelineDevicePin": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.unassignAudio": {
+	"pipelineOrchestrator.setShareSource": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.unassignPipeline": {
+	"pipelineOrchestrator.suggestShares": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineOrchestrator.unassignAudio": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.updateTemplate": {
+	"pipelineOrchestrator.unassignPipeline": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
@@ -42660,12 +43306,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"streamBroker.pullFrameHandles": {
-		capName: "stream-broker",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"streamBroker.regenerateRtspToken": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -42732,12 +43372,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"streamBroker.subscribeFrames": {
-		capName: "stream-broker",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"streamBroker.unassignProfile": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -42750,12 +43384,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"streamBroker.unsubscribeFrames": {
-		capName: "stream-broker",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"streamCatalog.getCatalog": {
 		capName: "stream-catalog",
 		capScope: "device",
@@ -43050,18 +43678,36 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userManagement.findUserByExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.getTotpStatus": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.linkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.listExternalIdentities": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.listOauthSessions": {
 		capName: "user-management",
 		capScope: "system",
@@ -43140,6 +43786,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userManagement.unlinkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"userManagement.updateUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -43452,6 +44104,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"webrtcSession.applyDownlinkProbe": {
+		capName: "webrtc-session",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"webrtcSession.closeSession": {
 		capName: "webrtc-session",
 		capScope: "device",
@@ -45263,11 +45921,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"decoder.createSession": [{
-		name: "deviceId",
-		form: "single",
-		optional: true
-	}],
 	"detectionPipeline.applyDeviceSettingsPatch": [{
 		name: "deviceId",
 		form: "single",
@@ -46478,6 +47131,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.setRetrainFrameComplete": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.setTrackFlags": [{
 		name: "deviceId",
 		form: "single",
@@ -46498,6 +47156,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineExecutor.clearModelBoundDeviceOverrides": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
 	"pipelineExecutor.runPipeline": [{
 		name: "deviceId",
 		form: "single",
@@ -46603,6 +47266,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.setCameraStepSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.setCameraStepToggle": [{
 		name: "deviceId",
 		form: "single",
@@ -47374,6 +48042,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"webrtcSession.applyDownlinkProbe": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"webrtcSession.closeSession": [{
 		name: "deviceId",
 		form: "single",
@@ -47603,6 +48276,8 @@ new Map(Object.entries({
 	"detection-blind": "device-events",
 	"node-online": "system",
 	"node-offline": "system",
+	"node-restarting": "system",
+	"node-updating": "system",
 	"node-inference-unavailable": "system",
 	"addon-crash-loop": "system",
 	"addon-update-available": "system",
@@ -47680,6 +48355,7 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 		kinds: [
 			"node-offline",
 			"node-online",
+			"node-restarting",
 			"node-inference-unavailable"
 		]
 	},
@@ -47701,6 +48377,7 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 		label: "Server & container updates",
 		kinds: [
 			"server-update-available",
+			"node-updating",
 			"server-updated",
 			"wrapper-update-available"
 		]
@@ -47848,6 +48525,7 @@ var STATE_SUMMARY_SECTION_VARS = [
 		kinds: [
 			"node-offline",
 			"node-online",
+			"node-restarting",
 			"node-inference-unavailable"
 		]
 	},
@@ -47869,6 +48547,7 @@ var STATE_SUMMARY_SECTION_VARS = [
 		example: "server 1.2.377 → 1.2.378",
 		kinds: [
 			"server-update-available",
+			"node-updating",
 			"server-updated",
 			"wrapper-update-available"
 		]
@@ -47901,7 +48580,7 @@ var STATE_SUMMARY_VARS = [
 	{
 		name: "summarySection",
 		label: "Summary: this section",
-		description: "The section a per-section summary row is about (D698); on a summary sent as one message, every section it reports, comma-separated.",
+		description: "The section a per-section summary row is about; on a summary sent as one message, every section it reports, comma-separated.",
 		example: "Batterie scariche",
 		group: "system",
 		families: ["rule"],
@@ -48508,33 +49187,36 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
-Object.defineProperty(exports, "BOOT_RECOVERY_BACKOFF_MS", {
-	enumerable: true,
-	get: function() {
-		return BOOT_RECOVERY_BACKOFF_MS;
-	}
-});
-Object.defineProperty(exports, "BaseAddon", {
-	enumerable: true,
-	get: function() {
-		return BaseAddon;
-	}
-});
-Object.defineProperty(exports, "EventCategory", {
-	enumerable: true,
-	get: function() {
-		return EventCategory;
-	}
-});
-Object.defineProperty(exports, "meshNetworkCapability", {
-	enumerable: true,
-	get: function() {
-		return meshNetworkCapability;
-	}
-});
-Object.defineProperty(exports, "networkAccessCapability", {
-	enumerable: true,
-	get: function() {
-		return networkAccessCapability;
+//#region src/auth-key-file.ts
+/**
+* Hand the Tailscale auth key to `tailscale up` without putting it on argv
+* or in the environment (D783).
+*
+* The CLI accepts `--auth-key=file:<path>` and reads the key from that file.
+* The key is written owner-only (0600) into a fresh owner-only (0700) temp
+* dir, the flag is handed to `run`, and the dir is removed when `run`
+* settles — success or failure. Error text is passed through
+* {@link scrubSecret} so a `Command failed: …` message can never carry it.
+*/
+var REDACTED = "‹redacted›";
+async function withAuthKeyFile(authKey, run) {
+	const dir = await fs.mkdtemp(path.join(os.tmpdir(), "camstack-ts-"));
+	try {
+		await fs.chmod(dir, 448);
+		const file = path.join(dir, "authkey");
+		await fs.writeFile(file, authKey, { mode: 384 });
+		return await run(`--auth-key=file:${file}`);
+	} finally {
+		await fs.rm(dir, {
+			recursive: true,
+			force: true
+		});
 	}
-});
+}
+/** Replace every occurrence of `secret` in `text`. Empty secrets are a no-op. */
+function scrubSecret(text, secret) {
+	if (!secret) return text;
+	return text.split(secret).join(REDACTED);
+}
+//#endregion
+export { BOOT_RECOVERY_BACKOFF_MS as a, networkAccessCapability as i, withAuthKeyFile as n, BaseAddon as o, meshNetworkCapability as r, EventCategory as s, scrubSecret as t };