@camstack/server 1.2.454 → 1.2.456

package/THIRD_PARTY_MODELS.md

@@ -30,32 +30,26 @@ under [Non-commercial models](#non-commercial-models).
 
 ## Required attributions
 
-- © Ultralytics, AGPL-3.0. Corresponding source: the upstream Ultralytics checkpoint and scripts/build-camstack-models.py in https://github.com/camstack/server. https://github.com/ultralytics/ultralytics
+- © Ultralytics, AGPL-3.0. Corresponding source: the upstream Ultralytics checkpoint and build-camstack-models.py (with convert_lib.py) published at https://huggingface.co/camstack/camstack-models/tree/main/source. https://github.com/ultralytics/ultralytics
 - Coral Edge TPU models and AIY Vision Birds V1 © Google LLC, Apache-2.0. https://github.com/google-coral/test_data
-- © Ultralytics, AGPL-3.0 (Ultralytics YOLOv9 weights). YOLOv9 architecture: Chien-Yao Wang, I-Hau Yeh, Hong-Yuan Mark Liao, GPL-3.0 (https://github.com/WongKinYiu/yolov9). Corresponding source: the upstream Ultralytics checkpoint and scripts/build-camstack-models.py in https://github.com/camstack/server. https://github.com/ultralytics/ultralytics
-- © Ultralytics, AGPL-3.0 (YOLOv8n base, fine-tuned by CamStack with Ultralytics). The fine-tuning checkpoint is not published yet. https://github.com/ultralytics/ultralytics
+- © Ultralytics, AGPL-3.0 (Ultralytics YOLOv9 weights). YOLOv9 architecture: Chien-Yao Wang, I-Hau Yeh, Hong-Yuan Mark Liao, GPL-3.0 (https://github.com/WongKinYiu/yolov9). Corresponding source: the upstream Ultralytics checkpoint and build-camstack-models.py (with convert_lib.py) published at https://huggingface.co/camstack/camstack-models/tree/main/source. https://github.com/ultralytics/ultralytics
 - RF-DETR © Roboflow, Apache-2.0. https://github.com/roboflow/rf-detr
-- SCRFD © InsightFace. Pretrained models released for non-commercial research purposes only. https://github.com/deepinsight/insightface/tree/master/detection/scrfd
 - YuNet weights Copyright (c) 2020 Shiqi Yu, MIT. Training code: ShiqiYu/libfacedetection.train, BSD-3-Clause. https://github.com/opencv/opencv_zoo/tree/main/models/face_detection_yunet
 - AuraFace v1 by fal.ai, Apache-2.0. https://huggingface.co/fal/AuraFace-v1
-- Scrypted plugin models, Koushik Dutta: repository tagged MIT (licenses/models/MIT-scrypted-plugin-models.txt), no per-model terms. https://huggingface.co/scrypted/plugin-models
 - © Ultralytics, AGPL-3.0 (YOLOv8n base, fine-tuned for plates by an unidentified third party). CamStack holds no training checkpoint; the ONNX file is the only form it has. https://github.com/ultralytics/ultralytics
 - fast-plate-ocr, MIT License, copyright (c) 2024 ankandrew (full notice: licenses/models/MIT-fast-plate-ocr.txt). https://github.com/ankandrew/fast-plate-ocr
-- EasyOCR © JaidedAI, Apache-2.0. https://github.com/JaidedAI/EasyOCR
 - EfficientNet-Lite0 via timm (Ross Wightman), Apache-2.0. Open Images V7 annotations © Google LLC, CC BY 4.0; images listed by Google as CC BY 2.0, without warranty. https://github.com/huggingface/pytorch-image-models
 - torchvision MobileNetV3, BSD-3-Clause. Trained on the Vehicle classification dataset by DrBimmer (https://huggingface.co/datasets/DrBimmer/vehicle-classification), CC BY-NC 4.0. https://github.com/pytorch/vision
-- Apple Machine Learning Research Model is licensed under the Apple Machine Learning Research Model License Agreement. https://github.com/apple/ml-mobileclip
 - SigLIP 2 © Google LLC, Apache-2.0. https://huggingface.co/google/siglip2-base-patch16-224
 - U²-Net © Xuebin Qin et al., Apache-2.0. https://github.com/xuebinqin/U-2-Net
 - YAMNet © Google LLC, Apache-2.0. AudioSet ontology and labels © Google LLC, CC BY 4.0. https://github.com/tensorflow/models/tree/master/research/audioset/yamnet
 - Qwen models © Alibaba Cloud, Apache-2.0. https://huggingface.co/Qwen · https://huggingface.co/unsloth · https://huggingface.co/unsloth/Qwen3.6-35B-A3B-GGUF
 - Built with Llama. Llama 3.2 is licensed under the Llama 3.2 Community License, Copyright © Meta Platforms, Inc. All Rights Reserved. https://huggingface.co/bartowski/Llama-3.2-3B-Instruct-GGUF
-- Scrypted YOLOv9 ReLU detectors, Koushik Dutta (scrypted/plugin-models, repository tagged MIT); trained with the YOLOv9 code of Chien-Yao Wang, I-Hau Yeh, Hong-Yuan Mark Liao, GPL-3.0 (https://github.com/WongKinYiu/yolov9). https://huggingface.co/scrypted/plugin-models
 
 Training data under attribution terms:
 
-- **COCO 2017** (training data of `yolo26n` and 53 more): annotations CC-BY-4.0; images under their Flickr owners' terms. https://cocodataset.org/#termsofuse
-- **WIDER FACE** (training data of `scrfd-2.5g` and 1 more): research-oriented terms; images CC BY-NC-ND. http://shuoyang1213.me/WIDERFACE/
+- **COCO 2017** (training data of `yolo26n` and 50 more): annotations CC-BY-4.0; images under their Flickr owners' terms. https://cocodataset.org/#termsofuse
+- **WIDER FACE** (training data of `yunet-2023mar`): research-oriented terms; images CC BY-NC-ND. http://shuoyang1213.me/WIDERFACE/
 - **Open Images V7** (training data of `animal-classifier`): annotations CC-BY-4.0 (Google LLC); images listed as CC-BY-2.0, no warranty. https://storage.googleapis.com/openimages/web/factsfigures_v7.html
 - **DrBimmer/vehicle-classification** (training data of `vehicle-type-v1`): CC-BY-NC-4.0 — treated as binding the trained weights (conservative reading). https://huggingface.co/datasets/DrBimmer/vehicle-classification
 - **AudioSet ontology/labels** (training data of `yamnet-onnx`): CC-BY-4.0 (Google LLC). https://research.google.com/audioset/
@@ -68,34 +62,34 @@ Training data under attribution terms:
   cards link here instead of repeating it.
 -->
 
-The folders `objectDetection/yolo26`, `objectDetection/yolov9`, `packageDetection/yolov8-package`, `plateDetection/yolov8-plate` and `segmentation/yolo26-seg` of the model mirror hold Ultralytics weights,
+The folders `objectDetection/yolo26`, `objectDetection/yolov9`, `plateDetection/yolov8-plate` and `segmentation/yolo26-seg` of the model mirror hold Ultralytics weights,
 modified by CamStack and distributed under AGPL-3.0. Their Corresponding Source
-is the public CamStack source repository, **https://github.com/camstack/server**
-(MIT), together with the upstream checkpoints it starts from:
+is published in the mirror itself, in its **`source/`** folder,
+**https://huggingface.co/camstack/camstack-models/tree/main/source**, together
+with the upstream checkpoints it starts from:
 
 1. **The upstream checkpoints**, published by Ultralytics at
    https://github.com/ultralytics/assets/releases: `yolo26{n,s,m,l,x}.pt`,
    `yolov9{t,s,m,c}.pt`, `yolo26{n,s,m}-seg.pt`.
-2. **The export scripts** in https://github.com/camstack/server:
-   `scripts/build-camstack-models.py` (ONNX with a dynamic batch axis, CoreML
-   FP16, OpenVINO IR, OpenVINO NNCF INT8) and `scripts/export-models.py`. The
-   build instructions (Python environment, invocation, calibration images for
-   INT8) are in each script's header.
-3. **The software** that downloads and runs these weights, CamStack itself, is
-   the same repository.
+2. **The export scripts** in `source/`: `build-camstack-models.py` (ONNX
+   with a dynamic batch axis, CoreML FP16, OpenVINO IR, OpenVINO NNCF INT8),
+   `convert_lib.py` (the ONNX to OpenVINO / INT8 / CoreML converter it imports,
+   the same one CamStack's Model Studio runs), `requirements.txt` and
+   `export-models.py`. The build instructions (Python environment,
+   invocation, calibration images for INT8) are in `source/README.md` and in
+   each script's header. These scripts are CamStack's own code and are offered
+   under the MIT licence; the weights they produce keep their upstream licence.
 
-What the repository does **not** cover yet:
+What the published scripts do **not** cover yet:
 
 - **Some hosted sizes and input resolutions.** The export scripts do not list
   every variant in the mirror (for example the `-320`/`-256` YOLO26 exports,
   `yolov9m`/`yolov9c`, and the `yolo26*-seg` models). Each one is the same
-  Ultralytics `export()` with a different model id or `imgsz`, but no script in
-  the repository reproduces it as-is.
+  Ultralytics `export()` with a different model id or `imgsz`, but no
+  published script reproduces it as-is.
 - **`yolov8n-plate` has no training checkpoint.** It is a third-party model
   (trained 2023-12-05 according to its own metadata, origin not identified).
   The ONNX file is the only form CamStack has.
-- **The `yolov8n-package` checkpoint is not published yet.** CamStack
-  fine-tuned it with Ultralytics.
 
 ## Non-commercial models
 
@@ -104,12 +98,7 @@ commercial use**:
 
 | Model | Used for | Terms |
 | --- | --- | --- |
-| `scrfd-2.5g` | Face detection | LicenseRef-InsightFace-NonCommercial-Research; training data: research-oriented terms; images CC BY-NC-ND ([terms](https://github.com/deepinsight/insightface#license)) |
 | `vehicle-type-v1` (default) | Vehicle classifier | CC-BY-NC-4.0; training data: CC-BY-NC-4.0 — treated as binding the trained weights (conservative reading) ([terms](https://creativecommons.org/licenses/by-nc/4.0/)) |
-| `mobileclip-s1` (default) | Semantic search, image encoders (CLIP) | LicenseRef-Apple-AMLR ([terms](https://github.com/apple/ml-mobileclip/blob/main/LICENSE_MODELS)) |
-| `mobileclip-s2` | Semantic search, image encoders (CLIP) | LicenseRef-Apple-AMLR ([terms](https://github.com/apple/ml-mobileclip/blob/main/LICENSE_MODELS)) |
-| `mobileclip-s1-text` | Semantic search, text encoders (CLIP) | LicenseRef-Apple-AMLR ([terms](https://github.com/apple/ml-mobileclip/blob/main/LICENSE_MODELS)) |
-| `mobileclip-s2-text` | Semantic search, text encoders (CLIP) | LicenseRef-Apple-AMLR ([terms](https://github.com/apple/ml-mobileclip/blob/main/LICENSE_MODELS)) |
 
 ## Models
 
@@ -124,32 +113,26 @@ entry kept resolvable for a saved selection but no longer offered.
 | Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
 | --- | --- | --- | --- | --- | --- |
 | `yolo26n` (default), `yolo26s`, `yolo26m`, `yolo26l`, `yolo26x` (hidden), `yolo26n-fp16` (hidden), `yolo26n-int8`, `yolo26s-fp16` (hidden), `yolo26s-int8`, `yolo26m-fp16` (hidden), `yolo26m-int8`, `yolo26l-fp16` (hidden), `yolo26l-int8`, `yolo26n-320`, `yolo26n-320-int8`, `yolo26n-256`, `yolo26n-256-int8`, `yolo26s-320`, `yolo26s-320-int8`, `yolo26s-256`, `yolo26s-256-int8`, `yolo26m-320`, `yolo26m-320-int8`, `yolo26m-256`, `yolo26m-256-int8`, `yolo26l-320`, `yolo26l-320-int8`, `yolo26l-256`, `yolo26l-256-int8`, `yolo26x-fp16` (hidden), `yolo26x-int8` (hidden) | [Ultralytics](https://github.com/ultralytics/ultralytics) | AGPL-3.0 / AGPL-3.0 (`AGPL-3.0.txt`) | COCO 2017: annotations CC-BY-4.0; images under their Flickr owners' terms | exported to ONNX, OpenVINO IR and CoreML (scripts/build-camstack-models.py); OpenVINO FP16 export; exported to OpenVINO IR, then OpenVINO NNCF INT8 post-training quantisation; re-exported at 320×320 to ONNX, OpenVINO IR and CoreML; re-exported at 320×320 to OpenVINO IR; OpenVINO NNCF INT8 post-training quantisation; re-exported at 256×256 to ONNX, OpenVINO IR and CoreML; re-exported at 256×256 to OpenVINO IR; OpenVINO NNCF INT8 post-training quantisation | mirror `objectDetection/yolo26` |
-| `ssd-mobilenet-v2-coco-edgetpu` (default), `efficientdet-lite0-edgetpu` | [Google Coral test_data](https://github.com/google-coral/test_data) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | COCO 2017: annotations CC-BY-4.0; images under their Flickr owners' terms | none | https://github.com/google-coral/test_data |
-| `ssdlite-mobiledet-coco-edgetpu` | [Google Coral test_data](https://github.com/google-coral/test_data) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | COCO 2017: annotations CC-BY-4.0; images under their Flickr owners' terms | none: ssdlite_mobiledet_coco_qat_postprocess_edgetpu.tflite mirrored byte for byte (sha256 b69e508e…434a2e), with the CPU build and coco_labels.txt beside it (scripts/build-ssdlite-mobiledet-model.py) | mirror `objectDetection/ssdlite-mobiledet` |
+| `ssd-mobilenet-v2-coco-edgetpu` (default) | [Google Coral test_data](https://github.com/google-coral/test_data) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | COCO 2017: annotations CC-BY-4.0; images under their Flickr owners' terms | none | https://github.com/google-coral/test_data |
 | `yolov9t-320`, `yolov9t-320-int8`, `yolov9t-640`, `yolov9t-640-int8`, `yolov9s-320`, `yolov9s-320-int8`, `yolov9s-640`, `yolov9s-640-int8`, `yolov9m-320`, `yolov9m-320-int8`, `yolov9m-640`, `yolov9m-640-int8`, `yolov9c-320`, `yolov9c-320-int8`, `yolov9c-640`, `yolov9c-640-int8` | [Ultralytics](https://github.com/ultralytics/ultralytics) | AGPL-3.0 / AGPL-3.0 (`AGPL-3.0.txt`) | COCO 2017: annotations CC-BY-4.0; images under their Flickr owners' terms | exported at 320×320 to ONNX, OpenVINO IR FP16 and CoreML; exported at 320×320 to OpenVINO IR; OpenVINO NNCF INT8 post-training quantisation; exported at 640×640 to ONNX, OpenVINO IR FP16 and CoreML; exported at 640×640 to OpenVINO IR; OpenVINO NNCF INT8 post-training quantisation | mirror `objectDetection/yolov9` |
 
 ### Package detection
 
 | Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
 | --- | --- | --- | --- | --- | --- |
-| `yolov8n-package` | [Ultralytics](https://github.com/ultralytics/ultralytics) | AGPL-3.0 / AGPL-3.0 (`AGPL-3.0.txt`) | Roboflow Universe package-at-front-door (most likely): UNVERIFIED | fine-tuned by CamStack with Ultralytics; exported to ONNX, OpenVINO IR and CoreML | mirror `packageDetection/yolov8-package` |
 | `rfdetr-package` (default) | [Roboflow RF-DETR](https://github.com/roboflow/rf-detr) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | parcel fine-tuning set (not recorded): UNVERIFIED | RF-DETR-M fine-tuned to 2 classes at 576; exported to ONNX, OpenVINO IR and CoreML; training checkpoint .pth also published | mirror `packageDetection/rfdetr-package` |
 
 ### Face detection
 
 | Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
 | --- | --- | --- | --- | --- | --- |
-| `scrfd-2.5g` | [InsightFace SCRFD](https://github.com/deepinsight/insightface/tree/master/detection/scrfd) | MIT / **LicenseRef-InsightFace-NonCommercial-Research** (`InsightFace-terms.txt`) | WIDER FACE: research-oriented terms; images CC BY-NC-ND | obtained via RuteNL/SCRFD-face-detection-ONNX; converted to OpenVINO IR and CoreML FP16 | mirror `faceDetection/scrfd` |
 | `yunet-2023mar` (default) | [OpenCV Zoo YuNet](https://github.com/opencv/opencv_zoo/tree/main/models/face_detection_yunet) | BSD-3-Clause (`BSD-3-Clause.txt`) / MIT (`MIT-yunet-reference.txt`) | WIDER FACE: research-oriented terms; images CC BY-NC-ND | input contract baked into the graph (the pool RGB /255 becomes the upstream BGR 0..255: Mul(255) plus a channel Gather); internal tensor names cleared in the OpenVINO IR; ONNX fp32, OpenVINO IR fp32, CoreML fp16 (scripts/build-yunet-model.py) | mirror `faceDetection/yunet` |
-| `ssd-mobilenet-v2-face-edgetpu` (hidden) | [Google Coral test_data](https://github.com/google-coral/test_data) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | — | none | https://github.com/google-coral/test_data |
 
 ### Face recognition
 
 | Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
 | --- | --- | --- | --- | --- | --- |
-| `arcface-r100` | [onnx-community/arcface-onnx (re-upload of garavv/arcface-onnx)](https://huggingface.co/onnx-community/arcface-onnx) | — / **Unknown** | — | converted to OpenVINO IR and CoreML FP16 | mirror `faceRecognition/arcface` |
 | `auraface-r100` (default) | [fal.ai AuraFace v1 (glintr100.onnx only)](https://huggingface.co/fal/AuraFace-v1) | — / Apache-2.0 (`Apache-2.0.txt`) | — | input scaling y = 2x - 1 baked ahead of the first Conv (scripts/build-auraface-model.py); converted to OpenVINO IR and CoreML FP16 | mirror `faceRecognition/auraface` |
-| `inception-resnet-v1` | [Scrypted plugin-models (repository tagged MIT, no per-model terms)](https://huggingface.co/scrypted/plugin-models) | — / **Unknown** | — | ONNX and CoreML fetched from scrypted/plugin-models; OpenVINO IR converted and re-hosted by CamStack | mirror `faceRecognition/inception-resnet-v1` · https://huggingface.co/scrypted/plugin-models |
 
 ### Licence plate detection
 
@@ -162,7 +145,6 @@ entry kept resolvable for a saved selection but no longer offered.
 | Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
 | --- | --- | --- | --- | --- | --- |
 | `cct-s-v2-global` (default) | [ankandrew/fast-plate-ocr](https://github.com/ankandrew/fast-plate-ocr) | MIT / MIT (`MIT-fast-plate-ocr.txt`) | fast-plate-ocr training set: private, not released upstream | input head removed (recorded in the ONNX doc_string); converted to OpenVINO IR and CoreML | mirror `plateRecognition/cct-s-v2-global` |
-| `vgg-english-g2` | [JaidedAI EasyOCR (via Scrypted plugin-models)](https://github.com/JaidedAI/EasyOCR) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | — | ONNX and CoreML fetched from scrypted/plugin-models; OpenVINO IR converted and re-hosted by CamStack | mirror `plateRecognition/vgg_english_g2` · https://huggingface.co/scrypted/plugin-models |
 
 ### Animal classifier
 
@@ -175,7 +157,6 @@ entry kept resolvable for a saved selection but no longer offered.
 | Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
 | --- | --- | --- | --- | --- | --- |
 | `bird-classifier` (default) | [Google AIY Vision birds_V1](https://github.com/google-coral/test_data) | — / Apache-2.0 (`Apache-2.0.txt`) | — | converted from TensorFlow with tf2onnx; OpenVINO IR and CoreML derived from it | mirror `animalClassification/bird-classifier` |
-| `bird-classifier-aiy-edgetpu` (hidden) | [Google Coral test_data](https://github.com/google-coral/test_data) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | — | none | https://github.com/google-coral/test_data |
 
 ### Vehicle classifier
 
@@ -187,16 +168,12 @@ entry kept resolvable for a saved selection but no longer offered.
 
 | Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
 | --- | --- | --- | --- | --- | --- |
-| `mobileclip-s1` (default) | [Apple ml-mobileclip](https://github.com/apple/ml-mobileclip) | MIT / **LicenseRef-Apple-AMLR** (`Apple-AMLR.txt`) | — | model derivative: vision encoders converted to OpenVINO IR and CoreML FP16 | mirror `clip/mobileclip-s1` |
-| `mobileclip-s2` | [Apple ml-mobileclip](https://github.com/apple/ml-mobileclip) | MIT / **LicenseRef-Apple-AMLR** (`Apple-AMLR.txt`) | — | model derivative: vision encoders converted to OpenVINO IR and CoreML FP16 | mirror `clip/mobileclip-s2` |
-| `siglip2-b16-224` | [Google SigLIP 2 (google/siglip2-base-patch16-224)](https://huggingface.co/google/siglip2-base-patch16-224) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | WebLI: Google internal, not released | input scaling y = 2x - 1 baked ahead of the patch embedding; converted to OpenVINO IR and CoreML FP16, an FP32 ONNX hosted as the verification reference (scripts/build-siglip2-model.py) | mirror `clip/siglip2` |
+| `siglip2-b16-224` (default) | [Google SigLIP 2 (google/siglip2-base-patch16-224)](https://huggingface.co/google/siglip2-base-patch16-224) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | WebLI: Google internal, not released | input scaling y = 2x - 1 baked ahead of the patch embedding; converted to OpenVINO IR and CoreML FP16, an FP32 ONNX hosted as the verification reference (scripts/build-siglip2-model.py) | mirror `clip/siglip2` |
 
 ### Semantic search, text encoders (CLIP)
 
 | Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
 | --- | --- | --- | --- | --- | --- |
-| `mobileclip-s1-text` | [Apple ml-mobileclip](https://github.com/apple/ml-mobileclip) | MIT / **LicenseRef-Apple-AMLR** (`Apple-AMLR.txt`) | — | model derivative: text encoders quantised to INT8 ONNX and converted to OpenVINO IR | mirror `clip/mobileclip-s1` |
-| `mobileclip-s2-text` | [Apple ml-mobileclip](https://github.com/apple/ml-mobileclip) | MIT / **LicenseRef-Apple-AMLR** (`Apple-AMLR.txt`) | — | model derivative: text encoders quantised to INT8 ONNX and converted to OpenVINO IR | mirror `clip/mobileclip-s2` |
 | `siglip2-b16-224-text` | [Google SigLIP 2 (google/siglip2-base-patch16-224)](https://huggingface.co/google/siglip2-base-patch16-224) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | WebLI: Google internal, not released | input sliced to the model's 64 positions in the graph; ONNX weights FP16, OpenVINO IR and CoreML FP16; a Lowercase normalizer prepended to the Gemma tokenizer (scripts/build-siglip2-model.py) | mirror `clip/siglip2` |
 
 ### Segmentation
@@ -229,16 +206,13 @@ entry kept resolvable for a saved selection but no longer offered.
 | `llm-qwen3-vl-8b-instruct-q4` | [Qwen3-VL (GGUF by unsloth)](https://huggingface.co/unsloth) | — / Apache-2.0 (`Apache-2.0.txt`) | — | Q4_K_M GGUF quantisation by unsloth (not re-hosted by CamStack) | https://huggingface.co/unsloth/Qwen3-VL-8B-Instruct-GGUF |
 | `llm-qwen3.6-35b-a3b-ud-q4` | [Qwen3.6-35B-A3B (GGUF by unsloth)](https://huggingface.co/unsloth/Qwen3.6-35B-A3B-GGUF) | — / Apache-2.0 (`Apache-2.0.txt`) | — | UD-Q4_K_M GGUF quantisation by unsloth (not re-hosted by CamStack) | https://huggingface.co/unsloth/Qwen3.6-35B-A3B-GGUF |
 
-### Model Studio catalogs (object detection, imported on request)
-
-| Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
-| --- | --- | --- | --- | --- | --- |
-| `scrypted-yolov9t-relu-coreml`, `scrypted-yolov9t-relu-onnx`, `scrypted-yolov9t-relu-test-coreml`, `scrypted-yolov9t-relu-test-onnx`, `scrypted-yolov9s-relu-coreml`, `scrypted-yolov9s-relu-onnx`, `scrypted-yolov9s-relu-test-coreml`, `scrypted-yolov9s-relu-test-onnx`, `scrypted-yolov9m-relu-coreml`, `scrypted-yolov9m-relu-onnx`, `scrypted-yolov9m-relu-test-coreml`, `scrypted-yolov9m-relu-test-onnx`, `scrypted-yolov9c-relu-coreml`, `scrypted-yolov9c-relu-onnx`, `scrypted-yolov9c-relu-test-coreml`, `scrypted-yolov9c-relu-test-onnx`, `scrypted-yolov9t-relu-openvino-fp32`, `scrypted-yolov9s-relu-openvino-fp32`, `scrypted-yolov9m-relu-openvino-fp32`, `scrypted-yolov9c-relu-openvino-fp32`, `scrypted-yolov9t-relu-openvino-int8`, `scrypted-yolov9t-relu-test-openvino-int8`, `scrypted-yolov9s-relu-openvino-int8`, `scrypted-yolov9s-relu-test-openvino-int8`, `scrypted-yolov9m-relu-openvino-int8`, `scrypted-yolov9m-relu-test-openvino-int8`, `scrypted-yolov9c-relu-openvino-int8`, `scrypted-yolov9c-relu-test-openvino-int8`, `scrypted-yolov9s-relu-sep-320-tflite-float16`, `scrypted-yolov9s-relu-sep-320-tflite-float32`, `scrypted-yolov9s-relu-sep-320-tflite-int8`, `scrypted-yolov9s-relu-sep-320-tflite-integer_quant`, `scrypted-yolov9s-relu-sep-320-tflite-full_integer_quant`, `scrypted-yolov9s-relu-sep-320-tflite-edgetpu` | [Scrypted plugin-models (repository tagged MIT, no per-model terms)](https://huggingface.co/scrypted/plugin-models) | GPL-3.0 (`GPL-3.0.txt`) / **Unknown** | not stated by Scrypted: UNKNOWN | none: downloaded as published, at a pinned revision | https://huggingface.co/scrypted/plugin-models |
-| `frigate-mobiledet-edgetpu` | [Google Coral test_data](https://github.com/google-coral/test_data) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | COCO 2017: annotations CC-BY-4.0; images under their Flickr owners' terms | none | https://github.com/google-coral/test_data |
-
 ### Your own models
 
-The Scrypted and Frigate catalogs that Model Studio offers are listed above. A
-model you upload or convert yourself, or pull from your own Frigate+ account,
-keeps whatever licence its author published. CamStack does not change it and
-does not record it.
+Model Studio can import third-party models (for example community
+object-detection catalogs) on request. They are downloaded from their
+publishers, are not hosted or redistributed by CamStack, and keep their
+publishers' licences; Model Studio shows the licence where the source declares
+one. A model you upload or convert
+yourself, or pull from your own Frigate+ account, likewise keeps whatever
+licence its author published. CamStack does not change it and does not record
+it.

package/dist/api/cors/cors-policy.js

@@ -0,0 +1,193 @@
+"use strict";
+/**
+ * cors-policy — which browser origins may READ this hub's responses (D707).
+ *
+ * The viewer PWA is hosted at {@link VIEWER_PWA_ORIGIN} and talks to each
+ * operator's own hub straight from the browser — no proxy, no cloud. Before
+ * D707 the hub answered every request with `Access-Control-Allow-Origin: *`,
+ * which let ANY web page a user visited read any hub response its script could
+ * reach (an unauthenticated probe of a LAN hub, for one). The policy is now an
+ * allowlist:
+ *
+ *  - the hub's OWN origin — the `Origin` whose host is the request's `Host`
+ *    (or `X-Forwarded-Host`, which a relay such as the Home Assistant panel
+ *    proxy sets to ITS origin). Same-origin calls never needed CORS; this
+ *    entry exists for the WebSocket check, where a browser always sends
+ *    `Origin` and the native clients send their target's;
+ *  - {@link VIEWER_PWA_ORIGIN}, the hosted viewer;
+ *  - {@link OPAQUE_ORIGIN} (`null`): the native app's OTA-bundled embed is a
+ *    `file://` page inside a WKWebView, whose origin is opaque. Removing it
+ *    breaks live view on iOS;
+ *  - `CAMSTACK_PUBLIC_ORIGIN`, when set, and the operator's extras
+ *    (`server.corsOrigins` in config.yaml / `CAMSTACK_CORS_ORIGINS`).
+ *
+ * The answer to an allowed origin REFLECTS it exactly — never `*` — and never
+ * carries `Access-Control-Allow-Credentials`. The cross-origin viewer
+ * authenticates with a bearer token in `Authorization` (or tRPC
+ * `connectionParams` on the socket), which needs no credentials mode; the
+ * httpOnly session cookie therefore never rides a cross-origin request, so the
+ * cookie-gated surfaces (`auth.exchangeSession`, `/api/embed-auth`, the
+ * admin-ui) stay same-origin by construction.
+ *
+ * Pure: no Fastify, no I/O — `register-cors-policy.ts` is the glue.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CORS_PREFLIGHT_MAX_AGE_SEC = exports.CORS_EXPOSED_HEADERS = exports.CORS_ALLOWED_HEADERS = exports.CORS_ALLOWED_METHODS = exports.OPAQUE_ORIGIN = exports.VIEWER_PWA_ORIGIN = void 0;
+exports.normalizeOrigin = normalizeOrigin;
+exports.parseConfiguredOrigins = parseConfiguredOrigins;
+exports.builtInOrigins = builtInOrigins;
+exports.judgeCorsOrigin = judgeCorsOrigin;
+exports.corsResponseHeaders = corsResponseHeaders;
+exports.appendVary = appendVary;
+/** The hosted viewer PWA (operator decision 2026-10-06). */
+exports.VIEWER_PWA_ORIGIN = 'https://camstack.zentik.app';
+/**
+ * The serialisation of an opaque origin. The native app's OTA embed
+ * (`assets/embed/camstack-embed.html`, loaded from `file://`) sends it.
+ */
+exports.OPAQUE_ORIGIN = 'null';
+/** Every method a hub route answers. */
+exports.CORS_ALLOWED_METHODS = 'GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS';
+/**
+ * Request headers a cross-origin caller may send. `authorization` is the
+ * whole point; `range` is recorded-media seeking; the `trpc-*` / `x-trpc-*`
+ * names are what `@trpc/client` links may add. NOT `x-camstack-exchange`:
+ * the cookie→bearer exchange is a same-origin mechanism and a cross-origin
+ * page has no business asking for it.
+ */
+exports.CORS_ALLOWED_HEADERS = 'authorization, content-type, range, if-range, if-none-match, cache-control, trpc-accept, x-trpc-source, x-trpc-batch-mode';
+/**
+ * Response headers a cross-origin script may read. The byte-range trio is
+ * recorded playback (a seek reads `content-range`); `content-disposition` is
+ * export downloads; `retry-after` is the rate limiter; the `x-camstack-*`
+ * trio is the clip-still contract (a 204 that says WHY there is no image).
+ */
+exports.CORS_EXPOSED_HEADERS = 'content-range, accept-ranges, content-length, content-disposition, etag, retry-after, x-camstack-reason, x-camstack-reason-code, x-camstack-disposition';
+/** Preflight cache. Chromium caps at 7200 s; Firefox honours up to 86400. */
+exports.CORS_PREFLIGHT_MAX_AGE_SEC = 7200;
+/**
+ * The canonical serialisation of an origin (`scheme://host[:port]`, lower
+ * case, default port dropped), or `null` when `raw` is not an http(s) origin.
+ * `null` (the opaque origin) is accepted verbatim.
+ */
+function normalizeOrigin(raw) {
+    const trimmed = raw.trim();
+    if (trimmed === exports.OPAQUE_ORIGIN)
+        return exports.OPAQUE_ORIGIN;
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:')
+        return null;
+    // An origin has no path, query, fragment or credentials. Accept a bare
+    // trailing slash (a common paste), refuse anything that names more.
+    if (url.username !== '' || url.password !== '')
+        return null;
+    if ((url.pathname !== '/' && url.pathname !== '') || url.search !== '' || url.hash !== '') {
+        return null;
+    }
+    return url.origin;
+}
+/** Read the configured value (array from YAML, already split from env). */
+function parseConfiguredOrigins(value) {
+    if (!Array.isArray(value))
+        return { origins: [], rejected: [] };
+    const origins = [];
+    const rejected = [];
+    for (const entry of value) {
+        if (typeof entry !== 'string') {
+            rejected.push(String(entry));
+            continue;
+        }
+        const normalized = normalizeOrigin(entry);
+        if (normalized === null)
+            rejected.push(entry);
+        else
+            origins.push(normalized);
+    }
+    return { origins, rejected };
+}
+/** The built-in entries plus the optional public origin. */
+function builtInOrigins(publicOrigin) {
+    const entries = [exports.VIEWER_PWA_ORIGIN, exports.OPAQUE_ORIGIN];
+    const pub = publicOrigin !== undefined ? normalizeOrigin(publicOrigin) : null;
+    if (pub !== null && pub !== exports.OPAQUE_ORIGIN)
+        entries.push(pub);
+    return entries;
+}
+/** The first value of a possibly comma-joined forwarding header, lower case. */
+function firstHost(value) {
+    if (value === undefined)
+        return null;
+    const first = value.split(',')[0]?.trim().toLowerCase() ?? '';
+    return first.length > 0 ? first : null;
+}
+/** `host[:port]` of an http(s) origin, or null. */
+function hostOfOrigin(origin) {
+    if (origin === exports.OPAQUE_ORIGIN)
+        return null;
+    try {
+        return new URL(origin).host.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Judge one request's `Origin`. `listed` is the full allowlist (built-ins and
+ * the operator's extras), already normalised.
+ */
+function judgeCorsOrigin(facts, listed) {
+    const raw = facts.origin;
+    if (raw === undefined || raw.length === 0)
+        return { kind: 'no-origin' };
+    const normalized = normalizeOrigin(raw);
+    if (normalized === null)
+        return { kind: 'denied', origin: raw };
+    if (listed.has(normalized))
+        return { kind: 'allowed', origin: raw, reason: 'listed' };
+    const originHost = hostOfOrigin(normalized);
+    if (originHost !== null) {
+        const ownHosts = [firstHost(facts.host), firstHost(facts.forwardedHost)];
+        if (ownHosts.includes(originHost))
+            return { kind: 'allowed', origin: raw, reason: 'own-host' };
+    }
+    return { kind: 'denied', origin: raw };
+}
+/**
+ * The headers an ALLOWED origin gets. `preflight` adds the method/header
+ * grants and the cache lifetime. The origin is the exact one the browser
+ * sent — reflecting it is what lets the browser hand the response to the
+ * page, and `Vary: Origin` (set by the glue on every response) keeps a cache
+ * from serving one origin's answer to another.
+ */
+function corsResponseHeaders(origin, preflight) {
+    const base = {
+        'access-control-allow-origin': origin,
+        'access-control-expose-headers': exports.CORS_EXPOSED_HEADERS,
+    };
+    if (preflight === null)
+        return base;
+    return {
+        ...base,
+        'access-control-allow-methods': exports.CORS_ALLOWED_METHODS,
+        'access-control-allow-headers': exports.CORS_ALLOWED_HEADERS,
+        'access-control-max-age': String(exports.CORS_PREFLIGHT_MAX_AGE_SEC),
+        // A public origin (the PWA) calling a LAN hub is a "private network"
+        // request to Chromium; its preflight must be answered explicitly.
+        ...(preflight.requestPrivateNetwork ? { 'access-control-allow-private-network': 'true' } : {}),
+    };
+}
+/** Append `token` to a `Vary` value unless it is already there. */
+function appendVary(existing, token) {
+    if (existing === undefined || existing.trim().length === 0)
+        return token;
+    const parts = existing.split(',').map((p) => p.trim().toLowerCase());
+    if (parts.includes('*') || parts.includes(token.toLowerCase()))
+        return existing;
+    return `${existing}, ${token}`;
+}

package/dist/api/cors/register-cors-policy.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCorsPolicy = createCorsPolicy;
+exports.registerCorsPolicy = registerCorsPolicy;
+exports.refuseForeignWsUpgrade = refuseForeignWsUpgrade;
+const cors_policy_js_1 = require("./cors-policy.js");
+/** Distinct refused origins remembered for log de-duplication. */
+const MAX_LOGGED_DENIALS = 256;
+function headerValue(value) {
+    if (Array.isArray(value))
+        return value[0];
+    return value;
+}
+function varyText(value) {
+    if (typeof value === 'string')
+        return value;
+    if (Array.isArray(value))
+        return value.filter((v) => typeof v === 'string').join(', ');
+    return undefined;
+}
+function createCorsPolicy(deps) {
+    const builtIns = (0, cors_policy_js_1.builtInOrigins)(deps.publicOrigin);
+    let lastConfigured = Symbol('unset');
+    let listed = new Set(builtIns);
+    const loggedDenials = new Set();
+    const currentList = () => {
+        const configured = deps.configuredOrigins();
+        if (configured === lastConfigured)
+            return listed;
+        lastConfigured = configured;
+        const parsed = (0, cors_policy_js_1.parseConfiguredOrigins)(configured);
+        if (parsed.rejected.length > 0) {
+            deps.logger.warn('cors: ignored configured origins that are not http(s) origins', {
+                meta: { rejected: parsed.rejected, setting: 'server.corsOrigins' },
+            });
+        }
+        listed = new Set([...builtIns, ...parsed.origins]);
+        return listed;
+    };
+    return {
+        judge(headers) {
+            const verdict = (0, cors_policy_js_1.judgeCorsOrigin)({
+                origin: headerValue(headers.origin),
+                host: headerValue(headers.host),
+                forwardedHost: headerValue(headers['x-forwarded-host']),
+            }, currentList());
+            if (verdict.kind === 'denied' && !loggedDenials.has(verdict.origin)) {
+                if (loggedDenials.size < MAX_LOGGED_DENIALS)
+                    loggedDenials.add(verdict.origin);
+                deps.logger.warn('cors: refused a cross-origin caller not on the allowlist', {
+                    meta: {
+                        origin: verdict.origin,
+                        host: headerValue(headers.host) ?? null,
+                        hint: 'add it to server.corsOrigins (config.yaml) or CAMSTACK_CORS_ORIGINS',
+                    },
+                });
+            }
+            return verdict;
+        },
+    };
+}
+/**
+ * Install the policy on the hub's Fastify instance. Every `OPTIONS` is
+ * answered here with 204 (as before D707) — with grants only for an allowed
+ * origin, so a refused preflight fails in the browser.
+ */
+function registerCorsPolicy(fastify, policy) {
+    fastify.addHook('onRequest', async (request, reply) => {
+        // The answer depends on Origin for every route, so every response says so
+        // — a cached same-origin answer must never be replayed to another origin.
+        const vary = (0, cors_policy_js_1.appendVary)(varyText(reply.getHeader('vary')), 'Origin');
+        reply.header('vary', vary);
+        reply.raw.setHeader('vary', vary);
+        const verdict = policy.judge(request.headers);
+        const isPreflight = request.method === 'OPTIONS' && request.headers['access-control-request-method'] !== undefined;
+        if (verdict.kind === 'allowed') {
+            const headers = (0, cors_policy_js_1.corsResponseHeaders)(verdict.origin, isPreflight
+                ? {
+                    requestPrivateNetwork: headerValue(request.headers['access-control-request-private-network']) === 'true',
+                }
+                : null);
+            for (const [name, value] of Object.entries(headers)) {
+                reply.header(name, value);
+                // Hijacked replies (the data-plane proxy) skip Fastify's header
+                // write; Node merges these into their `writeHead`.
+                reply.raw.setHeader(name, value);
+            }
+        }
+        if (request.method === 'OPTIONS') {
+            return reply.code(204).send();
+        }
+        return undefined;
+    });
+}
+/**
+ * Refuse a WebSocket upgrade whose `Origin` is not on the allowlist. Returns
+ * `true` when it refused (the socket is answered 403 and destroyed); the
+ * caller must then do nothing else with it. A request with no `Origin` (a
+ * Node client, an agent) passes — Origin is the browser's signal, and auth is
+ * the bearer in `connectionParams` either way.
+ */
+function refuseForeignWsUpgrade(policy, headers, socket) {
+    const verdict = policy.judge(headers);
+    if (verdict.kind !== 'denied')
+        return false;
+    socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');
+    socket.destroy();
+    return true;
+}

package/dist/api/model-distributor.js

@@ -75,8 +75,8 @@ function tarModelFiles(cwd, files) {
  * `nodeId === 'hub'` is a no-op (the artifact is already resident).
  */
 async function distributeModelWith(seam, input) {
-    const { nodeId, modelId, format, entry } = input;
-    if (nodeId === 'hub') {
+    const { targetNodeId, modelId, format, entry } = input;
+    if (targetNodeId === 'hub') {
         return { ok: true, sha256: '', bytes: 0, path: seam.modelsDir };
     }
     if (!seam.isPresent(entry, format)) {
@@ -88,7 +88,7 @@ async function distributeModelWith(seam, input) {
     }
     const tgz = await seam.tar(files);
     const source = seam.stage(tgz);
-    const res = await seam.callAgent(nodeId, { modelId, format, source });
+    const res = await seam.callAgent(targetNodeId, { modelId, format, source });
     return { ok: true, sha256: source.sha256, bytes: source.bytes, path: res.path ?? '' };
 }
 /**
@@ -120,7 +120,7 @@ function buildModelDistributorProvider(moleculer, loggingService) {
     return {
         distributeModel: async (input) => {
             logger.info('Distributing model to node', {
-                meta: { modelId: input.modelId, format: input.format, nodeId: input.nodeId },
+                meta: { modelId: input.modelId, format: input.format, nodeId: input.targetNodeId },
             });
             return distributeModelWith(seam, input);
         },

package/dist/api/oauth2/private-host.js

@@ -4,7 +4,7 @@
  *
  * Used by `/api/oauth2/authorize` to admit a `redirect_uri` whose host the hub
  * cannot know in advance — a self-hosted Home Assistant at
- * `http://192.168.x.x:8123/auth/external/callback`. Pairing "private host" with
+ * `http://192.168.10.40:8123/auth/external/callback`. Pairing "private host" with
  * "exact path" is what keeps that from being a wildcard prefix: a public host
  * never satisfies it, so the worst an attacker can aim a code at is a machine
  * they already need LAN presence to read.

package/dist/api/trpc/client-ip.js

@@ -101,7 +101,7 @@ function extractUserAgent(req) {
     return null;
 }
 /**
- * Strip an IPv4-mapped IPv6 prefix (`::ffff:192.168.x.x` → `192.168.x.x`)
+ * Strip an IPv4-mapped IPv6 prefix (`::ffff:192.168.10.5` → `192.168.10.5`)
  * and any zone id (`fe80::1%en0` → `fe80::1`) so the range checks below
  * see a clean address.
  */
@@ -216,13 +216,13 @@ function isPrivateIpv4(ip) {
     if (a === undefined || b === undefined)
         return false;
     if (a === 10)
-        return true; // 10.x.x.x/8
+        return true; // 10.0.0.0/8
     if (a === 127)
         return true; // 127.0.0.0/8 loopback
     if (a === 172 && b >= 16 && b <= 31)
         return true; // 172.16.0.0/12
     if (a === 192 && b === 168)
-        return true; // 192.168.x.x/16
+        return true; // 192.168.0.0/16
     if (a === 169 && b === 254)
         return true; // 169.254.0.0/16 link-local
     return false;

package/dist/api/trpc/device-config-secret-redaction.js

@@ -347,7 +347,7 @@ function redactConfigEntries(data) {
  *
  * The stream surfaces (`cameraStreams.getRtspEntries`,
  * `streamBroker.getRtspEntry`, `deviceOps.getStreamSources`, …) hand a
- * non-admin caller `rtsp://admin:hunter2@192.168.x.x/…` verbatim: a
+ * non-admin caller `rtsp://admin:hunter2@192.168.10.139/…` verbatim: a
  * read-only token can open every camera by copy-pasting the string. These
  * are NOT config blobs, so {@link redactRecord} never sees them — the leak
  * lives in a plain `url` / `mutedUrl` string field.

package/dist/main.js

@@ -70,6 +70,7 @@ const precompressed_asset_js_1 = require("./api/static/precompressed-asset.js");
 const spa_static_1 = require("./api/static/spa-static");
 const spa_mount_1 = require("./api/static/spa-mount");
 const frame_policy_1 = require("./api/static/frame-policy");
+const register_cors_policy_1 = require("./api/cors/register-cors-policy");
 const cap_providers_1 = require("./api/core/cap-providers");
 const logging_settings_1 = require("./api/core/logging-settings");
 const request_census_settings_1 = require("./api/core/request-census-settings");
@@ -347,8 +348,18 @@ async function bootstrap() {
     const fastifyOpts = tlsOptions ? { https: tlsOptions } : {};
     const app = await (0, manual_boot_1.bootManual)({ infra, fastifyOpts });
     app.enableShutdownHooks();
-    app.enableCors();
     const fastify = app.getHttpAdapter().getInstance();
+    // Which browser origins may read hub responses, and open the /trpc socket
+    // (D707): the hub's own, the hosted viewer PWA, the native embed's opaque
+    // `null`, and the operator's `server.corsOrigins`. First hook on the
+    // instance so every route — and every OPTIONS — is judged.
+    const corsConfig = app.get(config_service_1.ConfigService);
+    const corsPolicy = (0, register_cors_policy_1.createCorsPolicy)({
+        configuredOrigins: () => corsConfig.get('server.corsOrigins'),
+        publicOrigin: process.env.CAMSTACK_PUBLIC_ORIGIN,
+        logger: app.get(logging_service_1.LoggingService).createLogger('cors'),
+    });
+    (0, register_cors_policy_1.registerCorsPolicy)(fastify, corsPolicy);
     await fastify.register(cookie_1.default);
     // Every HTML document the hub serves may be framed by its own origin only
     // (D425). Stamped here, on the one instance, so no shell-send site added
@@ -1239,6 +1250,9 @@ async function bootstrap() {
         httpServer.on('upgrade', (request, socket, head) => {
             const pathname = (request.url ?? '').split('?')[0];
             if (pathname === '/trpc') {
+                // CORS does not cover a WebSocket: refuse a foreign page here (D707).
+                if ((0, register_cors_policy_1.refuseForeignWsUpgrade)(corsPolicy, request.headers, socket))
+                    return;
                 wss.handleUpgrade(request, socket, head, (ws) => {
                     wss.emit('connection', ws, request);
                 });

package/dist/manual-boot.js

@@ -394,16 +394,6 @@ async function bootManual(opts) {
         getHttpAdapter() {
             return { getInstance: () => fastify };
         },
-        enableCors() {
-            fastify.addHook('onRequest', async (request, reply) => {
-                reply.header('access-control-allow-origin', '*');
-                reply.header('access-control-allow-methods', 'GET,POST,PUT,DELETE,OPTIONS,PATCH');
-                reply.header('access-control-allow-headers', 'content-type,authorization');
-                if (request.method === 'OPTIONS') {
-                    reply.status(204).send();
-                }
-            });
-        },
         enableShutdownHooks() {
             if (shutdownHooksRegistered)
                 return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.454",
+  "version": "1.2.456",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.328",
-    "@camstack/addon-agent-ui": "1.2.172",
+    "@camstack/addon-admin-ui": "1.2.330",
+    "@camstack/addon-agent-ui": "1.2.174",
     "@camstack/addon-auth": "1.2.126",
     "@camstack/addon-decoder-nodeav": "1.2.119",
-    "@camstack/addon-notifiers": "1.2.126",
-    "@camstack/addon-pipeline": "1.2.325",
-    "@camstack/addon-pipeline-orchestrator": "1.2.280",
-    "@camstack/addon-post-analysis": "1.2.331",
-    "@camstack/sdk": "1.2.120",
-    "@camstack/system": "1.2.352",
-    "@camstack/types": "1.2.303",
-    "@camstack/ui-library": "1.2.230",
+    "@camstack/addon-notifiers": "1.2.128",
+    "@camstack/addon-pipeline": "1.2.327",
+    "@camstack/addon-pipeline-orchestrator": "1.2.281",
+    "@camstack/addon-post-analysis": "1.2.333",
+    "@camstack/sdk": "1.2.121",
+    "@camstack/system": "1.2.354",
+    "@camstack/types": "1.2.305",
+    "@camstack/ui-library": "1.2.232",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",