@camstack/core 0.1.34 → 0.1.36

package/dist/index.mjs

@@ -31,7 +31,7 @@ import { promisify } from "node:util";
 import { errMsg, parseJsonObject } from "@camstack/types";
 import * as vm from "node:vm";
 import * as os from "node:os";
-//#region ../types/dist/index-BKnvgAep.mjs
+//#region ../types/dist/index-YnRVILXN.mjs
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -892,7 +892,7 @@ var DecodedFrameSchema = z.object({
 	]),
 	timestamp: z.number()
 });
-var BrokerStatusSchema = z.enum([
+var BrokerStatusSchema$1 = z.enum([
 	"idle",
 	"connecting",
 	"streaming",
@@ -900,7 +900,7 @@ var BrokerStatusSchema = z.enum([
 	"stopped"
 ]);
 var BrokerStatsSchema = z.object({
-	status: BrokerStatusSchema,
+	status: BrokerStatusSchema$1,
 	inputFps: z.number(),
 	decodeFps: z.number(),
 	encodedSubscribers: z.number(),
@@ -1000,6 +1000,37 @@ z.enum([
 	"disabled",
 	"waking"
 ]);
+var VideoCodecTargetSchema = z.enum([
+	"H264",
+	"H265",
+	"auto"
+]);
+var AudioCodecTargetSchema = z.enum([
+	"AAC",
+	"Opus",
+	"PCMU",
+	"none"
+]);
+var MaxResolutionSchema = z.object({
+	width: z.number().int().positive(),
+	height: z.number().int().positive()
+});
+var GetStreamWithCodecInputSchema = z.object({
+	deviceId: z.number().int().nonnegative(),
+	videoCodec: VideoCodecTargetSchema,
+	audioCodec: AudioCodecTargetSchema.optional(),
+	maxResolution: MaxResolutionSchema.optional(),
+	tag: z.string().optional()
+});
+var RtpSourceSchema = z.object({
+	url: z.string(),
+	videoCodec: z.enum(["H264", "H265"]),
+	audioCodec: z.string(),
+	resolution: MaxResolutionSchema,
+	transcoded: z.boolean(),
+	encoder: z.string(),
+	pipelineKey: z.string()
+});
 method(z.object({
 	deviceId: z.number().int().nonnegative(),
 	camStreamId: z.string().min(1),
@@ -1009,28 +1040,8 @@ method(z.object({
 	resolution: CamStreamResolutionSchema.optional(),
 	fps: z.number().positive().optional(),
 	label: z.string().optional(),
-	/**
-	* Device-level features that the broker / manager / snapshot
-	* orchestrator consult to derive per-stream policy (e.g.
-	* `BatteryOperated` → relax stall watchdog, default pre-buffer
-	* to off, raise snapshot rate-limit). Single source of truth —
-	* publishers no longer set per-stream flags like `allowStall`.
-	*/
 	deviceFeatures: z.array(z.string()).optional(),
-	/**
-	* Whether this stream participates in the broker's automatic
-	* profile assignment. Defaults `true`. Publishers set `false` for
-	* streams that should be SELECTABLE but not auto-picked — e.g.
-	* Reolink publishes native Baichuan as eligible and RTSP/RTMP
-	* mirrors as ineligible (still assignable manually via
-	* `assignProfile`).
-	*/
 	autoEligible: z.boolean().optional(),
-	/**
-	* Transport-specific opaque metadata stashed alongside the stream
-	* record. `pull-rfc4571` publishers put the SDP here so the broker
-	* reader can route packets without an in-band DESCRIBE phase.
-	*/
 	metadata: z.record(z.string(), z.unknown()).optional()
 }), z.object({ success: z.literal(true) }), {
 	kind: "mutation",
@@ -1074,7 +1085,16 @@ method(z.object({
 }), method(z.object({
 	streamId: z.string(),
 	format: StreamFormatSchema
-}), z.object({ url: z.string() })), method(z.object({ brokerId: z.string() }), z.custom()), method(z.object({
+}), z.object({ url: z.string() })), method(GetStreamWithCodecInputSchema, RtpSourceSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(z.object({ pipelineKey: z.string() }), z.object({
+	released: z.boolean(),
+	refcount: z.number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(z.object({ brokerId: z.string() }), z.custom()), method(z.object({
 	brokerId: z.string(),
 	seconds: z.number().min(0).max(30)
 }), z.void(), {
@@ -2445,14 +2465,25 @@ method(LogEntrySchema, z.void(), { kind: "mutation" }), method(z.object({
 	limit: z.number().optional(),
 	tags: z.record(z.string(), z.string()).optional()
 }), z.array(LogEntrySchema).readonly());
-method(z.void(), z.string()), method(z.void(), z.string());
+var StaticDirOutputSchema = z.object({ staticDir: z.string() });
+var VersionOutputSchema = z.object({ version: z.string() });
+method(z.void(), StaticDirOutputSchema), method(z.void(), VersionOutputSchema);
 var SsoBridgeClaimsSchema = z.object({
 	userId: z.string(),
 	username: z.string(),
 	isAdmin: z.boolean(),
 	provider: z.string(),
 	email: z.string().optional(),
-	displayName: z.string().optional()
+	displayName: z.string().optional(),
+	/**
+	* Public HTTPS URL of the hub that issued this token. Used by
+	* cloud-mode OAuth proxies (Alexa Smart Home Lambda, future Google
+	* Home Lambda) to route a request back to the originating hub
+	* without holding routing state of their own. The Lambda decodes the
+	* JWT WITHOUT verifying the signature — the hub re-verifies on every
+	* inbound call so trust still rests with the signing hub.
+	*/
+	hubUrl: z.string().optional()
 });
 method(z.object({
 	claims: SsoBridgeClaimsSchema,
@@ -2504,7 +2535,7 @@ method(z.object({
 	auth: "admin",
 	access: "delete"
 });
-var EmailAddressSchema = z.string().email();
+var EmailAddressSchema = z.email();
 var SendEmailInputSchema = z.object({
 	to: z.union([EmailAddressSchema, z.array(EmailAddressSchema).min(1)]),
 	cc: z.array(EmailAddressSchema).optional(),
@@ -2546,133 +2577,94 @@ method(SendEmailInputSchema, SendEmailResultSchema, {
 	auth: "admin",
 	access: "view"
 }), method(z.void(), SmtpStatusSchema, { auth: "admin" });
-var QosSchema = z.union([
-	z.literal(0),
-	z.literal(1),
-	z.literal(2)
+var BrokerKindSchema = z.enum(["external", "embedded"]);
+var BrokerStatusSchema = z.enum([
+	"connected",
+	"disconnected",
+	"auth-failed",
+	"unreachable",
+	"tls-error"
 ]);
-var PublishInputSchema = z.object({
-	topic: z.string(),
-	/** UTF-8 payload. Binary payloads must be base64-encoded by the caller. */
-	payload: z.string(),
-	qos: QosSchema.default(0),
-	retain: z.boolean().default(false)
-});
-var SubscribeInputSchema = z.object({
-	/** MQTT topic filter (supports `+` single-level and `#` multi-level wildcards). */
-	topic: z.string(),
-	qos: QosSchema.default(0),
+var BrokerInfoSchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	url: z.string(),
+	kind: BrokerKindSchema,
+	status: BrokerStatusSchema,
+	latencyMs: z.number().nullable(),
+	error: z.string().optional(),
+	/** Embedded brokers only: number of MQTT clients currently connected. */
+	connectedClients: z.number().int().nonnegative().optional(),
+	/** Epoch ms of the last live probe (external) or aedes snapshot (embedded). */
+	lastCheckedAt: z.number().optional()
+});
+var BrokerConnectionDetailsSchema = z.object({
+	url: z.string(),
+	username: z.string().optional(),
+	password: z.string().optional(),
 	/**
-	* Caller-supplied owner tag. Useful for debugging + the
-	* `listSubscriptions` admin view ("which consumer owns this?").
-	* When omitted, the addon synthesizes one from the caller's addon id.
+	* Suggested prefix for `clientId`. Each consumer should suffix this
+	* with its own discriminator (addon id, instance id) so reconnects
+	* don't kick each other off (MQTT spec: clientId must be unique per
+	* broker).
 	*/
-	owner: z.string().optional()
+	clientIdPrefix: z.string().optional()
 });
-var SubscribeResultSchema = z.object({
-	success: z.literal(true),
-	/** Server-generated subscription id. Pass to `unsubscribe` to release. */
-	subscriptionId: z.string()
-});
-var UnsubscribeInputSchema = z.object({ 
-/** Subscription id from `subscribe`. */
-subscriptionId: z.string() });
-var MqttStatusSchema = z.object({
-	/** True iff the addon has an active connection to the broker. */
-	connected: z.boolean(),
-	/** Operator-visible host string (e.g. `mqtt://broker.example:1883`). */
-	brokerUrl: z.string(),
-	/** Active subscription count (per-owner, NOT broker-side topic count). */
-	subscriptionCount: z.number().int(),
-	/** Last error reported by the broker. */
-	error: z.string().optional(),
-	/** Last successful connection timestamp (unix ms). */
-	connectedAt: z.number().optional()
-});
-var SubscriptionInfoSchema = z.object({
-	subscriptionId: z.string(),
-	topic: z.string(),
-	qos: QosSchema,
-	owner: z.string(),
-	/** When this individual subscription was created. */
-	createdAt: z.number()
+var AddBrokerInputSchema = z.object({
+	name: z.string().min(1),
+	url: z.string().regex(/^(mqtt|mqtts|ws|wss):\/\//, "URL must start with mqtt(s):// or ws(s)://"),
+	username: z.string().optional(),
+	password: z.string().optional(),
+	clientIdPrefix: z.string().optional()
 });
-method(PublishInputSchema, z.object({ success: z.literal(true) }), {
-	kind: "mutation",
-	auth: "admin",
-	access: "create"
-}), method(SubscribeInputSchema, SubscribeResultSchema, {
-	kind: "mutation",
-	auth: "admin",
-	access: "create"
-}), method(UnsubscribeInputSchema, z.object({ success: z.literal(true) }), {
-	kind: "mutation",
-	auth: "admin",
-	access: "delete"
-}), method(z.void(), z.array(SubscriptionInfoSchema), { auth: "admin" }), method(z.void(), MqttStatusSchema, { auth: "admin" });
-var HaServiceCallSchema = z.object({
-	/** HA domain (e.g. `light`, `switch`, `notify`). */
-	domain: z.string(),
-	/** HA service (e.g. `turn_on`, `toggle`). */
-	service: z.string(),
-	/** Service-specific data payload (e.g. `{entity_id: 'light.kitchen', brightness: 200}`). */
-	serviceData: z.record(z.string(), z.unknown()).optional(),
-	/** Optional target spec (entity_id / device_id / area_id). */
-	target: z.record(z.string(), z.unknown()).optional()
-});
-var HaStateSchema = z.object({
-	entity_id: z.string(),
-	state: z.string(),
-	attributes: z.record(z.string(), z.unknown()).default({}),
-	last_changed: z.string().optional(),
-	last_updated: z.string().optional()
+var AddBrokerResultSchema = z.object({ id: z.string() });
+var IdInputSchema = z.object({ id: z.string() });
+var TestResultSchema = z.discriminatedUnion("ok", [z.object({
+	ok: z.literal(true),
+	latencyMs: z.number()
+}), z.object({
+	ok: z.literal(false),
+	error: z.string()
+})]);
+var StartEmbeddedInputSchema = z.object({
+	port: z.number().int().min(1).max(65535).default(1883),
+	/** Allow anonymous connect (no username/password). Default: false. */
+	allowAnonymous: z.boolean().default(false),
+	/** Optional shared username/password for clients. */
+	username: z.string().optional(),
+	password: z.string().optional()
 });
-var HaStatusSchema = z.object({
-	connected: z.boolean(),
-	host: z.string(),
-	/** Active per-owner subscription count. */
-	subscriptionCount: z.number().int(),
-	/** Last error reported by the WebSocket. */
-	error: z.string().optional(),
-	/** HA version reported during the auth handshake, when reachable. */
-	haVersion: z.string().optional(),
-	connectedAt: z.number().optional()
+var StartEmbeddedResultSchema = z.object({
+	id: z.string(),
+	url: z.string()
 });
-var HaSubscribeInputSchema = z.object({
-	/**
-	* Specific HA event type to subscribe to (`state_changed`,
-	* `service_called`, etc.). Empty string = all events (firehose —
-	* only for debugging).
-	*/
-	eventType: z.string().optional(),
-	/** Caller-supplied tag for listSubscriptions debugging. */
-	owner: z.string().optional()
+var StatusSchema = z.object({
+	brokerCount: z.number(),
+	embeddedRunning: z.boolean()
 });
-var HaSubscribeResultSchema = z.object({
-	success: z.literal(true),
-	subscriptionId: z.string()
-});
-var HaUnsubscribeInputSchema = z.object({ subscriptionId: z.string() });
-var HaSubscriptionInfoSchema = z.object({
-	subscriptionId: z.string(),
-	/** Empty string when subscribed to ALL events. */
-	eventType: z.string(),
-	owner: z.string(),
-	createdAt: z.number()
+method(z.void(), z.array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema), method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }), method(IdInputSchema, z.void(), { kind: "mutation" }), method(IdInputSchema, TestResultSchema, { kind: "mutation" }), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }), method(IdInputSchema, z.void(), { kind: "mutation" }), method(z.void(), StatusSchema);
+var LinkStateSchema = z.enum([
+	"unlinked",
+	"linked",
+	"error"
+]);
+var DeviceExportStatusSchema = z.object({
+	linkState: LinkStateSchema,
+	exposedDeviceCount: z.number(),
+	error: z.string().optional()
 });
-method(HaSubscribeInputSchema, HaSubscribeResultSchema, {
-	kind: "mutation",
-	auth: "admin",
-	access: "create"
-}), method(HaUnsubscribeInputSchema, z.object({ success: z.literal(true) }), {
-	kind: "mutation",
-	auth: "admin",
-	access: "delete"
-}), method(HaServiceCallSchema, z.object({ result: z.unknown() }), {
-	kind: "mutation",
-	auth: "admin",
-	access: "create"
-}), method(z.void(), z.array(HaStateSchema).readonly(), { auth: "admin" }), method(z.object({ entityId: z.string() }), HaStateSchema.nullable(), { auth: "admin" }), method(z.void(), z.array(HaSubscriptionInfoSchema).readonly(), { auth: "admin" }), method(z.void(), HaStatusSchema, { auth: "admin" });
+var DeviceKindSchema = z.string();
+var ExposedDeviceSchema = z.object({
+	deviceId: z.string(),
+	exposedAs: z.string().optional(),
+	capabilities: z.array(z.string()).optional()
+});
+var ExposeInputSchema = z.object({
+	deviceId: z.string(),
+	capabilities: z.array(z.string()).optional()
+});
+var UnexposeInputSchema = z.object({ deviceId: z.string() });
+method(z.void(), DeviceExportStatusSchema), method(z.void(), z.array(DeviceKindSchema)), method(z.void(), z.array(ExposedDeviceSchema)), method(ExposeInputSchema, z.void(), { kind: "mutation" }), method(UnexposeInputSchema, z.void(), { kind: "mutation" });
 var AddonPageDeclarationSchema$1 = z.object({
 	id: z.string(),
 	label: z.string(),
@@ -2928,6 +2920,14 @@ DeviceType$1.Camera, method(z.object({ deviceId: z.number().int().nonnegative()
 }), z.object({
 	sessionId: z.string(),
 	sdpOffer: z.string()
+}), { kind: "mutation" }), method(z.object({
+	deviceId: z.number().int().nonnegative(),
+	target: WebrtcStreamTargetSchema.optional(),
+	sdpOffer: z.string(),
+	sessionId: z.string().optional()
+}), z.object({
+	sessionId: z.string(),
+	sdpAnswer: z.string()
 }), { kind: "mutation" }), method(z.object({
 	deviceId: z.number().int().nonnegative(),
 	sessionId: z.string(),
@@ -3266,12 +3266,12 @@ method(z.void(), z.array(AudioCodecInfoSchema).readonly()), method(z.object({
 }), z.array(AudioEncodedChunkSchema), { kind: "mutation" }), method(z.void(), z.array(SessionInventoryEntrySchema).readonly());
 var EmbeddingResultSchema = z.object({
 	embedding: z.array(z.number()),
-	dimensions: z.number()
+	inferenceMs: z.number()
 });
 var EmbeddingInfoSchema = z.object({
 	modelId: z.string(),
-	dimensions: z.number(),
-	inputSize: z.number()
+	embeddingDim: z.number(),
+	ready: z.boolean()
 });
 method(z.object({
 	crop: z.instanceof(Uint8Array),
@@ -3612,7 +3612,20 @@ var NetworkAccessStatusSchema = z.object({
 	endpoint: NetworkEndpointSchema.nullable(),
 	error: z.string().optional()
 });
-method(z.void(), NetworkEndpointSchema, { kind: "mutation" }), method(z.void(), z.void(), { kind: "mutation" }), method(z.void(), NetworkEndpointSchema.nullable()), method(z.void(), NetworkAccessStatusSchema);
+var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
+	/**
+	* Stable id within the provider — typically `<mode>-<sourcePort>` so
+	* the orchestrator can dedupe across `listEndpoints` polls.
+	*/
+	id: z.string(),
+	/** Operator-facing label (mirrors `MeshEndpoint.label`). */
+	label: z.string(),
+	/** Optional provider-specific mode tag, used for icon/colour in admin UI. */
+	mode: z.string().optional(),
+	/** Originating local port the ingress fronts (informational). */
+	sourcePort: z.number().optional()
+});
+method(z.void(), NetworkEndpointSchema, { kind: "mutation" }), method(z.void(), z.void(), { kind: "mutation" }), method(z.void(), NetworkEndpointSchema.nullable()), method(z.void(), NetworkAccessStatusSchema), method(z.void(), z.array(NetworkEndpointEntrySchema).readonly());
 var RemoteAccessEndpointSchema = z.object({
 	url: z.string(),
 	hostname: z.string(),
@@ -3725,28 +3738,78 @@ method(z.object({
 	success: z.boolean(),
 	error: z.string().optional()
 }), { kind: "mutation" });
+var NotificationRuleConditionsSchema = z.object({
+	deviceIds: z.array(z.number()).readonly().optional(),
+	classNames: z.array(z.string()).readonly().optional(),
+	zoneIds: z.array(z.string()).readonly().optional(),
+	minConfidence: z.number().optional(),
+	source: z.enum([
+		"pipeline",
+		"onboard",
+		"any"
+	]).optional(),
+	schedule: z.object({
+		days: z.array(z.number()).readonly(),
+		startHour: z.number(),
+		endHour: z.number()
+	}).optional(),
+	cooldownSeconds: z.number().optional(),
+	minDwellSeconds: z.number().optional()
+});
+var NotificationRuleTemplateSchema = z.object({
+	title: z.string(),
+	body: z.string(),
+	imageMode: z.enum([
+		"crop",
+		"annotated",
+		"full",
+		"none"
+	])
+});
 var NotificationRuleSchema = z.object({
 	id: z.string(),
 	name: z.string(),
 	enabled: z.boolean(),
-	conditions: z.record(z.string(), z.unknown()),
-	actions: z.array(z.record(z.string(), z.unknown()))
+	eventTypes: z.array(z.string()).readonly(),
+	conditions: NotificationRuleConditionsSchema,
+	outputs: z.array(z.string()).readonly(),
+	template: NotificationRuleTemplateSchema.optional(),
+	priority: z.enum([
+		"low",
+		"normal",
+		"high",
+		"critical"
+	])
+});
+var NotificationTestResultSchema = z.object({
+	ruleId: z.string(),
+	eventId: z.string(),
+	timestamp: z.number(),
+	wouldFire: z.boolean(),
+	reason: z.string().optional()
 });
 var NotificationHistoryEntrySchema = z.object({
 	id: z.string(),
 	ruleId: z.string(),
+	ruleName: z.string(),
+	eventId: z.string(),
 	timestamp: z.number(),
-	deviceId: z.number().optional(),
+	outputs: z.array(z.string()).readonly(),
 	success: z.boolean(),
-	error: z.string().optional()
+	error: z.string().optional(),
+	deviceId: z.number().optional()
 });
-method(z.void(), z.array(NotificationRuleSchema).readonly()), method(NotificationRuleSchema, z.void(), { kind: "mutation" }), method(z.object({ ruleId: z.string() }), z.void(), { kind: "mutation" }), method(z.object({
-	ruleId: z.string(),
-	lookbackMinutes: z.number()
-}), z.array(z.record(z.string(), z.unknown())), { kind: "mutation" }), method(z.object({
+var NotificationHistoryFilterSchema = z.object({
 	ruleId: z.string().optional(),
+	deviceId: z.number().optional(),
+	from: z.number().optional(),
+	to: z.number().optional(),
 	limit: z.number().optional()
-}), z.array(NotificationHistoryEntrySchema));
+});
+method(z.void(), z.object({ rules: z.array(NotificationRuleSchema).readonly() })), method(z.object({ rule: NotificationRuleSchema }), z.object({ success: z.literal(true) }), { kind: "mutation" }), method(z.object({ ruleId: z.string() }), z.object({ success: z.literal(true) }), { kind: "mutation" }), method(z.object({
+	ruleId: z.string(),
+	lookbackMinutes: z.number()
+}), z.object({ results: z.array(NotificationTestResultSchema).readonly() }), { kind: "mutation" }), method(z.object({ filter: NotificationHistoryFilterSchema.optional() }), z.object({ entries: z.array(NotificationHistoryEntrySchema).readonly() }));
 var RecordingModeSchema = z.enum([
 	"continuous",
 	"motion",
@@ -4434,6 +4497,22 @@ DeviceType$1.Camera, method(z.object({ deviceId: z.number() }), z.object({
 }), z.void(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(z.object({ deviceId: z.number() }), z.object({ sessionId: z.string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(z.object({
+	deviceId: z.number(),
+	/** PCM frames as little-endian s16, mono. Base64-encoded so
+	*  the payload survives tRPC JSON serialization. */
+	pcmBase64: z.string(),
+	/** Sequence number for ordering / dropping out-of-order frames. */
+	sequenceNumber: z.number().int()
+}), z.object({ accepted: z.boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(z.object({ deviceId: z.number() }), z.void(), {
+	kind: "mutation",
+	auth: "admin"
 }), z.object({
 	deviceId: z.number(),
 	status: IntercomStatusSchema
@@ -4485,6 +4564,40 @@ var HwAccelBackendInputSchema = z.enum([
 	"none"
 ]).nullable().optional();
 var HwAccelResolutionSchema = z.object({ preferred: z.array(z.string()).readonly() });
+var HardwareEncoderIdSchema = z.enum([
+	"h264_videotoolbox",
+	"hevc_videotoolbox",
+	"h264_vaapi",
+	"hevc_vaapi",
+	"h264_nvenc",
+	"hevc_nvenc",
+	"h264_qsv",
+	"hevc_qsv",
+	"h264_amf",
+	"hevc_amf",
+	"libx264",
+	"libx265"
+]);
+var HardwareEncoderProbeSchema = z.object({
+	encoder: HardwareEncoderIdSchema,
+	codec: z.enum(["H264", "H265"]),
+	family: z.enum([
+		"videotoolbox",
+		"vaapi",
+		"nvenc",
+		"qsv",
+		"amf",
+		"software"
+	]),
+	available: z.boolean(),
+	reason: z.string().optional()
+});
+var HardwareEncodersSchema = z.object({
+	encoders: z.array(HardwareEncoderProbeSchema).readonly(),
+	defaultH264: HardwareEncoderIdSchema,
+	defaultH265: HardwareEncoderIdSchema,
+	probedAt: z.number()
+});
 var HardwarePlatformSchema = z.enum([
 	"darwin",
 	"linux",
@@ -4547,7 +4660,10 @@ var ResolvedInferenceConfigSchema = z.object({
 method(z.void(), PlatformCapabilitiesSchema), method(z.void(), HardwareInfoSchema), method(z.object({ requirements: z.array(ModelRequirementSchema).readonly() }), ResolvedInferenceConfigSchema), method(z.object({
 	prefer: HwAccelBackendInputSchema,
 	nodeId: z.string().optional()
-}), HwAccelResolutionSchema);
+}), HwAccelResolutionSchema), method(z.void(), HardwareEncodersSchema), method(z.void(), HardwareEncodersSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 var InterfaceKindEnum = z.enum([
 	"lan",
 	"wifi",
@@ -4692,7 +4808,9 @@ var MeshPeerSchema = z.object({
 	id: z.string(),
 	/** Hostname / device name as shown in the mesh dashboard. */
 	hostname: z.string(),
-	/** Mesh IP(s). Multiple when the peer is dual-stacked. */
+	/** MagicDNS / mesh DNS name (e.g. `peer-foo.tail-abc.ts.net`). Empty when the provider doesn't support DNS or peer-side resolution is disabled. */
+	magicDns: z.string(),
+	/** Mesh IPv4 / IPv6 addresses combined. Multiple when dual-stacked. */
 	addresses: z.array(z.string()).readonly(),
 	/** Operating system reported by the peer (informational). */
 	os: z.string().optional(),
@@ -4701,7 +4819,36 @@ var MeshPeerSchema = z.object({
 	/** Last-seen timestamp (epoch ms). 0 when never seen. */
 	lastSeenMs: z.number(),
 	/** True for the row representing the current host. */
-	isSelf: z.boolean()
+	isSelf: z.boolean(),
+	/**
+	* Connection mode to this peer:
+	*   - `direct`: NAT-traversed P2P (UDP punched)
+	*   - `relay`: traffic relayed through provider edge (Tailscale DERP)
+	*   - `idle`: peer reachable but no recent traffic / handshake
+	*/
+	connection: z.enum([
+		"direct",
+		"relay",
+		"idle"
+	]),
+	/** DERP region / relay node identifier when `connection: relay`. Null otherwise. */
+	relay: z.string().nullable(),
+	/** Last successful handshake timestamp (epoch ms). 0 when never. */
+	lastHandshakeMs: z.number(),
+	/** Bytes received from this peer since the daemon started. */
+	rxBytes: z.number(),
+	/** Bytes transmitted to this peer since the daemon started. */
+	txBytes: z.number(),
+	/** ACL tags this peer carries (e.g. `["tag:server"]`). Empty when human-owned. */
+	tags: z.array(z.string()).readonly(),
+	/** True when the peer advertises itself as an exit-node candidate. */
+	exitNodeOption: z.boolean(),
+	/** Subnet routes the peer advertises (e.g. `["192.168.1.0/24"]`). */
+	advertisedRoutes: z.array(z.string()).readonly(),
+	/** Owner account login (e.g. `foo@example.com`). Null for tagged peers. */
+	userLogin: z.string().nullable(),
+	/** Pre-auth key / machine-key expiry (epoch ms). Null when keys don't expire. */
+	keyExpiry: z.number().nullable()
 });
 var MeshStatusSchema = z.object({
 	/** True when the host is joined and the daemon reports healthy. */
@@ -4715,22 +4862,37 @@ var MeshStatusSchema = z.object({
 	/** Every endpoint this provider exposes for the current host. */
 	endpoints: z.array(MeshEndpointSchema$1).readonly(),
 	/** Last error from the daemon, when not joined. */
-	error: z.string().optional()
-});
-var PublicIngressConfigSchema = z.object({
-	/** Whether the provider should expose CamStack via its public
-	*  ingress (Tailscale Funnel, etc.). */
-	enabled: z.boolean(),
-	/** Local port to forward. Auto-detected from the hub HTTP port
-	*  when omitted. */
-	port: z.number().int().min(1).max(65535).optional()
-});
-var MeshIngressConfigSchema = z.object({
-	/** Whether the provider should expose CamStack inside the mesh
-	*  via HTTPS (Tailscale Serve, etc.) instead of just raw IP. */
-	enabled: z.boolean(),
-	/** Local port to forward. Auto-detected when omitted. */
-	port: z.number().int().min(1).max(65535).optional()
+	error: z.string().optional(),
+	/**
+	* Tenant / tailnet / network display name (Tailscale = tailnet
+	* domain, Headscale = namespace, ZeroTier = network name). Empty
+	* pre-join. Per-provider semantics, common slot.
+	*/
+	tenantName: z.string(),
+	/**
+	* Mesh DNS suffix when the provider exposes peer-resolvable DNS
+	* (Tailscale MagicDNS, Headscale MagicDNS, …). Empty when the
+	* provider doesn't ship DNS (e.g. ZeroTier).
+	*/
+	magicDnsSuffix: z.string(),
+	/**
+	* Authenticated user / account login bound to this host. Null when
+	* the provider authenticates with a long-lived network token rather
+	* than a user account (e.g. ZeroTier API token).
+	*/
+	userLogin: z.string().nullable(),
+	/**
+	* Provider control-plane URL (Tailscale SaaS `https://login.tailscale.com`,
+	* self-hosted Headscale, ZeroTier Central, …). Empty when not
+	* applicable (rare).
+	*/
+	controlPlaneUrl: z.string(),
+	/**
+	* Machine-key / node-key expiry (epoch ms). Null when the provider
+	* doesn't rotate keys for the bound host. Operator-facing surface
+	* for "your access expires on …" banners.
+	*/
+	keyExpiry: z.number().nullable()
 });
 method(z.void(), MeshStatusSchema), method(z.object({
 	/** Provider-specific auth key. For Tailscale this is the
@@ -4738,7 +4900,11 @@ method(z.void(), MeshStatusSchema), method(z.object({
 	authKey: z.string().min(8),
 	/** Optional hostname override the host should advertise. */
 	hostname: z.string().optional()
-}), z.object({ joined: z.literal(true) }), { kind: "mutation" }), method(z.void(), z.object({ left: z.literal(true) }), { kind: "mutation" }), method(z.void(), z.object({ peers: z.array(MeshPeerSchema).readonly() })), method(PublicIngressConfigSchema, z.object({ success: z.literal(true) }), { kind: "mutation" }), method(MeshIngressConfigSchema, z.object({ success: z.literal(true) }), { kind: "mutation" }), method(z.object({ 
+}), z.object({ joined: z.literal(true) }), { kind: "mutation" }), method(z.object({ 
+/** Optional hostname override the host should advertise once joined. */
+hostname: z.string().optional() }), z.object({ 
+/** Authentication URL the operator should open in a browser. */
+loginUrl: z.string() }), { kind: "mutation" }), method(z.void(), z.object({ left: z.literal(true) }), { kind: "mutation" }), method(z.void(), z.object({ loggedOut: z.literal(true) }), { kind: "mutation" }), method(z.void(), z.object({ peers: z.array(MeshPeerSchema).readonly() })), method(z.object({ 
 /** Optional auth key — when provided, probes the key validity
 *  against the provider's API. Omit when already joined to
 *  just ping the daemon. */
@@ -4777,13 +4943,26 @@ var MeshProviderInfoSchema = z.object({
 	/** Active endpoints (mesh IP + MagicDNS + optional public Funnel). */
 	endpoints: z.array(MeshEndpointSchema).readonly(),
 	/** Last error reported by the provider. */
-	error: z.string().optional()
+	error: z.string().optional(),
+	/** Tenant / tailnet / network display name. Empty pre-join. */
+	tenantName: z.string(),
+	/** Mesh DNS suffix (e.g. tailXXXX.ts.net). Empty when not configured. */
+	magicDnsSuffix: z.string(),
+	/** Authenticated user / account login. Null for token-only providers. */
+	userLogin: z.string().nullable(),
+	/** Provider control-plane URL. */
+	controlPlaneUrl: z.string(),
+	/** Machine-key expiry (epoch ms). Null when keys don't rotate. */
+	keyExpiry: z.number().nullable()
 });
 method(z.void(), z.array(MeshProviderInfoSchema).readonly()), method(z.object({
 	addonId: z.string(),
 	authKey: z.string().min(8),
 	hostname: z.string().optional()
-}), z.object({ joined: z.literal(true) }), { kind: "mutation" }), method(z.object({ addonId: z.string() }), z.object({ success: z.literal(true) }), { kind: "mutation" });
+}), z.object({ joined: z.literal(true) }), { kind: "mutation" }), method(z.object({ addonId: z.string() }), z.object({ success: z.literal(true) }), { kind: "mutation" }), method(z.object({
+	addonId: z.string(),
+	hostname: z.string().optional()
+}), z.object({ loginUrl: z.string() }), { kind: "mutation" }), method(z.object({ addonId: z.string() }), z.object({ loggedOut: z.literal(true) }), { kind: "mutation" }), method(z.object({ addonId: z.string() }), z.object({ peers: z.array(MeshPeerSchema).readonly() }));
 var MethodAccessSchema = z.enum([
 	"view",
 	"create",
@@ -4870,6 +5049,13 @@ var UserSummarySchema = z.object({
 	allowedProviders: z.union([z.array(z.string()), z.literal("*")]),
 	allowedDevices: z.record(z.string(), z.union([z.array(z.string()), z.literal("*")])),
 	scopes: z.array(TokenScopeSchema).default([]),
+	/**
+	* True iff this user has a CONFIRMED TOTP enrollment. Surfaced on
+	* `listUsers` so the admin Users page can render the "Remove 2FA"
+	* action conditionally without firing one `getTotpStatus` query per
+	* row. Self-service enrollment lives on the user's profile page.
+	*/
+	totpEnabled: z.boolean().default(false),
 	createdAt: z.number(),
 	updatedAt: z.number()
 });
@@ -5132,6 +5318,12 @@ var NodeAddonInputSchema = z.object({
 	nodeId: z.string(),
 	addonId: z.string()
 });
+var NodeAddonEntrySchema = z.object({
+	id: z.string(),
+	status: z.string(),
+	version: z.string().optional(),
+	packageName: z.string().optional()
+});
 var SuccessSchema = z.object({ success: z.boolean() });
 var RestartProcessResultSchema = z.object({
 	success: z.boolean(),
@@ -5172,7 +5364,7 @@ method(z.void(), z.array(TopologyNodeSchema).readonly(), { auth: "admin" }), met
 }), RenameNodeResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(z.void(), z.record(z.string(), ClusterAddonStatusEntrySchema), { auth: "admin" }), method(z.object({
+}), method(z.void(), z.record(z.string(), ClusterAddonStatusEntrySchema), { auth: "admin" }), method(z.object({ nodeId: z.string() }), z.array(NodeAddonEntrySchema).readonly(), { auth: "admin" }), method(z.object({
 	nodeId: z.string(),
 	level: z.string()
 }), SuccessSchema, {