@camstack/system 1.2.371 → 1.2.373

package/dist/{dist-DNEiTrJg.mjs → dist-BzZiW4y2.mjs}

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import "node:crypto";
-//#region ../types/dist/event-category-BGmz_oxW.mjs
+//#region ../types/dist/event-category-B_0XEcLF.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -501,15 +501,6 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["AgentWsDisconnected"] = "agent.ws.disconnected";
 	EventCategory["AgentBackupActivated"] = "agent.backup.activated";
 	EventCategory["OrchestrationSettingsUpdated"] = "orchestration.settings-updated";
-	/**
-	* Per-agent hwaccel preference changed (user override set, cleared, or
-	* re-probed). Observability event — decoders pull the current pref at
-	* `createSession`, so running sessions keep their current backend until
-	* they rotate naturally (camera add/remove, stream restart). Future
-	* work can wire a listener in stream-broker that force-rotates live
-	* sessions; for now this event powers logs + admin-UI toast feedback.
-	*/
-	EventCategory["PipelineAgentHwaccelChanged"] = "pipeline.agent-hwaccel-changed";
 	EventCategory["MotionAnalysis"] = "detection.motion-analysis";
 	/** All raw motion zones from CCL before minArea filter — for UI debug overlay. */
 	EventCategory["MotionZonesRaw"] = "detection.motion-zones-raw";
@@ -710,7 +701,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-DAJ9Er57.mjs
+//#region ../types/dist/sleep-BNeXenvr.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -2100,32 +2091,12 @@ z.object({
 	audioCodec: z.string().optional(),
 	metadata: z.record(z.string(), z.unknown()).readonly().optional()
 });
-var EncodedPacketSchema = z.object({
-	type: z.enum(["video", "audio"]),
-	data: z.instanceof(Uint8Array),
-	pts: z.number(),
-	dts: z.number(),
-	keyframe: z.boolean(),
-	codec: z.string()
-});
-var DecodedFrameSchema = z.object({
-	data: z.instanceof(Uint8Array),
-	width: z.number(),
-	height: z.number(),
-	format: z.enum([
-		"jpeg",
-		"rgb",
-		"bgr",
-		"yuv420",
-		"gray"
-	]),
-	timestamp: z.number()
-});
 /**
 * Wire schema for `FrameHandle` — a zero-pixel, serialisable reference to a
 * frame in a shared-memory ring (Phase 5 / D9). Mirrors the `FrameHandle` TS
-* interface in `interfaces/frame-handle.ts` field-for-field so a decoder cap
-* method (`pullHandles`) can carry handles over tRPC / Moleculer.
+* interface in `interfaces/frame-handle.ts` field-for-field so a cap method
+* (the runner's native-crop and pipeline-executor inputs) can carry handles
+* over tRPC / Moleculer.
 *
 * The `satisfies` assertion below pins this schema to the interface: if a
 * field is added to / removed from `FrameHandle` without a matching schema
@@ -2151,50 +2122,6 @@ var FrameHandleSchema = z.object({
 	slotCount: z.number().int().positive()
 });
 /**
-* Pixel format a frame-handle subscriber can request from the broker
-* (Phase 5 / D9). The packed, raster subset of `FrameFormat` — the formats a
-* `frameSink: 'shm'` decoder session can write into a `FrameRing` slot.
-* `jpeg` is excluded: a variable-length stream is not a fixed-stride ring
-* payload, and no decoded-frame consumer requests it over the shm plane.
-*/
-var FrameHandleFormatSchema = z.enum([
-	"rgb",
-	"bgr",
-	"yuv420",
-	"gray"
-]);
-/**
-* Input for `stream-broker.subscribeFrames` (Phase 5 / D9). A consumer asks the
-* broker for a `FrameHandle` stream of one `format`; the broker maintains one
-* shared-memory ring per `(brokerId, format)` actually requested, so a `gray`
-* subscriber (motion) and an `rgb` subscriber (detection) each read the format
-* they asked for with no broker-side conversion.
-*/
-var SubscribeFramesInputSchema = z.object({
-	brokerId: z.string(),
-	format: FrameHandleFormatSchema,
-	/**
-	* Optional reader-side cadence hint in frames per second. The broker does
-	* NOT throttle — latest-wins ring reads drop frames implicitly for a slow
-	* consumer. The value is echoed back in `SubscribeFramesResult.maxFps` so
-	* the consumer can pace its own `pullFrameHandles` polling.
-	*/
-	maxFps: z.number().positive().optional(),
-	/** Short caller-identity tag (`motion`, `detection`, …) for diagnostics. */
-	tag: z.string().optional()
-});
-/**
-* Result of `stream-broker.subscribeFrames`. The consumer then polls
-* `pullFrameHandles({ subscriptionId, maxCount })` and feeds each returned
-* `FrameHandle` to a `FrameRingReader`.
-*/
-var SubscribeFramesResultSchema = z.object({
-	/** Opaque id the consumer passes to `pullFrameHandles` / `unsubscribeFrames`. */
-	subscriptionId: z.string(),
-	/** Reader-side cadence hint (frames/s) — echoes `SubscribeFramesInput.maxFps`. */
-	maxFps: z.number().nonnegative()
-});
-/**
 * Wire schema for a decoded audio chunk (Phase 5 / D9). Mirrors the
 * `DecodedAudioChunk` TS interface in `interfaces/stream-broker.ts`: PCM
 * sample bytes plus the track parameters a consumer needs to interpret them.
@@ -2202,8 +2129,8 @@ var SubscribeFramesResultSchema = z.object({
 * Audio chunks are tiny (a ~500ms AudioCodecSession window is a few KB of
 * Float32 PCM), so unlike video frames they ship their bytes INLINE over
 * tRPC / Moleculer — no shared-memory plane. `data` is typed `Uint8Array`
-* (the wire-serialisable supertype of `Buffer`) to match `DecodedFrameSchema`
-* / `EncodedPacketSchema`'s precedent; a `Buffer` is assignable to it.
+* (the wire-serialisable supertype of `Buffer`); a `Buffer` is assignable to
+* it.
 */
 var AudioChunkFormatSchema = z.enum(AUDIO_CHUNK_FORMATS);
 var DecodedAudioChunkSchema = z.object({
@@ -2221,11 +2148,10 @@ var DecodedAudioChunkSchema = z.object({
 	format: AudioChunkFormatSchema.optional()
 });
 /**
-* Input for `stream-broker.subscribeAudioChunks` (Phase 5 / D9). The
-* handle-free, ship-bytes-inline analogue of `subscribeFrames`: a consumer
-* asks the broker for the decoded audio-chunk stream of one broker; the
-* broker keeps a per-subscription bounded FIFO queue the consumer drains via
-* `pullAudioChunks`.
+* Input for `stream-broker.subscribeAudioChunks` (Phase 5 / D9). Audio ships
+* its bytes inline: a consumer asks the broker for the decoded audio-chunk
+* stream of one broker; the broker keeps a per-subscription bounded FIFO queue
+* the consumer drains via `pullAudioChunks`.
 */
 var SubscribeAudioChunksInputSchema = z.object({
 	brokerId: z.string(),
@@ -2257,9 +2183,7 @@ var BrokerStatusSchema = z.enum([
 var BrokerStatsSchema = z.object({
 	status: BrokerStatusSchema,
 	inputFps: z.number(),
-	decodeFps: z.number(),
 	encodedSubscribers: z.number(),
-	decodedSubscribers: z.number(),
 	uptimeMs: z.number(),
 	bitrateKbps: z.number(),
 	idrIntervalMs: z.number(),
@@ -2272,14 +2196,6 @@ var BrokerStatsSchema = z.object({
 	preBufferMs: z.number(),
 	preBufferPackets: z.number(),
 	/**
-	* Moleculer node id of the decoder provider currently servicing this
-	* stream's decoded subscribers. `null` until the deferred decoder is
-	* created (no decoded clients yet, or codec not detected). Surfaces the
-	* runtime decoder placement so the UI can show "Decoder: <agent>" without
-	* a separate cap call per broker.
-	*/
-	decoderNodeId: z.string().nullable(),
-	/**
 	* Detected audio track parameters from the RTSP DESCRIBE / SDP. `null`
 	* when the stream has no audio track or the broker is in cold start.
 	* `supported = false` means the codec was detected but the local
@@ -7524,70 +7440,6 @@ var StorageLocationDeclarationSchema = z.object({
 		"backup"
 	]).optional()
 });
-var DecoderStatsSchema = z.object({
-	inputFps: z.number(),
-	outputFps: z.number(),
-	avgDecodeTimeMs: z.number(),
-	droppedFrames: z.number(),
-	/**
-	* Pull-mode adaptive-fps telemetry (optional — only pull sessions run the
-	* lag-driven controller; push sessions omit these). `lagMs` is the EWMA of
-	* the decoder's real-time drift (rising = falling behind live); `adaptiveFps`
-	* is the current lag-throttled emit rate (≤ `effectiveFps` ceiling).
-	*/
-	lagMs: z.number().optional(),
-	effectiveFps: z.number().optional(),
-	adaptiveFps: z.number().optional()
-});
-var DecoderSessionConfigSchema = z.object({
-	codec: z.string(),
-	maxFps: z.number().default(0),
-	outputFormat: z.enum([
-		"jpeg",
-		"rgb",
-		"bgr",
-		"yuv420",
-		"gray"
-	]).default("jpeg"),
-	scale: z.number().default(1),
-	width: z.number().optional(),
-	height: z.number().optional(),
-	/**
-	* Identifier of the camera this decoder session serves. Optional
-	* because the cap is generic (any caller could request decode), but
-	* stream-broker passes it so decoder logs include `deviceId` for
-	* per-camera filtering when diagnosing failures (e.g. node-av
-	* sendPacket errors on a single hung camera).
-	*/
-	deviceId: z.number().int().nonnegative().optional(),
-	/**
-	* Free-form tag for log scoping. Stream-broker uses
-	* `broker:<deviceId>/<profile>`. Decoder session logger surfaces it
-	* on every line so `grep tag=broker:5/high` filters one camera
-	* profile cleanly.
-	*/
-	tag: z.string().optional(),
-	/**
-	* Where the session delivers decoded frames (Phase 5 / D9):
-	*
-	* - `'callback'` (default) — the legacy pixel path: decoded frames are
-	*   buffered as `DecodedFrame`s and drained via `pullFrames`.
-	* - `'shm'` — the shared-memory frame plane: decoded frames are written
-	*   into an OS shared-memory ring and drained as zero-pixel
-	*   `FrameHandle`s via `pullHandles`. A session is one mode or the
-	*   other — `pullFrames` returns nothing for an `'shm'` session and
-	*   `pullHandles` returns nothing for a `'callback'` session.
-	*/
-	frameSink: z.enum(["callback", "shm"]).default("callback"),
-	/**
-	* Per-camera decoder DEBUG facility. When `true`, a pull-mode session emits
-	* a throttled (~1Hz) structured `decoder debug` line (effective/adaptive fps,
-	* real-time lag, dropped-frame delta, avg decode time, hwaccel). Mirrors the
-	* stream-broker's `streamingDebug` gate — off by default so production logs
-	* stay quiet and the emit path pays zero per-frame cost when disabled.
-	*/
-	debug: z.boolean().optional()
-});
 /**
 * Per-component log CHANNELS — the gate a hot path consults, and the registry
 * an addon declares its channels in.
@@ -10388,13 +10240,6 @@ var BrokerRtspClientSchema = z.object({
 	lastRtpAt: z.number(),
 	bytesSent: z.number()
 });
-var BrokerDecodedClientSchema = z.object({
-	tag: z.string(),
-	subscribedAt: z.number(),
-	maxFps: z.number(),
-	framesDelivered: z.number(),
-	framesDropped: z.number()
-});
 var BrokerAudioClientSchema = z.object({
 	tag: z.string(),
 	subscribedAt: z.number(),
@@ -10494,7 +10339,6 @@ var BrokerEncodedClientSchema = z.object({
 });
 var BrokerClientsSchema = z.object({
 	rtsp: z.array(BrokerRtspClientSchema).readonly(),
-	decoded: z.array(BrokerDecodedClientSchema).readonly(),
 	audio: z.array(BrokerAudioClientSchema).readonly(),
 	encoded: z.array(BrokerEncodedClientSchema).readonly(),
 	pipeClients: z.number(),
@@ -10986,11 +10830,7 @@ var streamBrokerCapability = {
 		listClients: method(z.object({ brokerId: z.string() }), BrokerClientsSchema),
 		killClient: method(z.object({
 			brokerId: z.string(),
-			channel: z.enum([
-				"rtsp",
-				"decoded",
-				"audio"
-			]),
+			channel: z.enum(["rtsp", "audio"]),
 			handle: z.string()
 		}), z.object({ killed: z.boolean() }), {
 			kind: "mutation",
@@ -11089,31 +10929,6 @@ var streamBrokerCapability = {
 			maxCount: z.number().int().positive().default(8)
 		}), z.array(DecodedAudioChunkSchema).readonly()),
 		unsubscribeAudioChunks: method(z.object({ subscriptionId: z.string() }), z.object({ released: z.boolean() }), { kind: "mutation" }),
-		/**
-		* ── Shared-memory frame plane (Phase 5 / D9) ──────────────────────
-		*
-		* The handle-based replacement for the live-object `IStreamBroker.
-		* onDecodedFrame` callback path. A consumer:
-		*
-		*   1. `subscribeFrames({ brokerId, format })` — the broker spins up
-		*      (or reuses) a `frameSink: 'shm'` decoder session producing that
-		*      `format` and returns a `subscriptionId`.
-		*   2. polls `pullFrameHandles({ subscriptionId, maxCount })` — drains
-		*      zero-pixel `FrameHandle[]`; each handle is fed to a
-		*      `FrameRingReader` that opens the named shm segment and reads the
-		*      pixels back zero-copy.
-		*   3. `unsubscribeFrames({ subscriptionId })` on teardown.
-		*
-		* The broker keeps one shm ring per `(brokerId, format)` actually
-		* requested — no broker-side `sharp` conversion. fps throttling is
-		* implicit (latest-wins ring reads drop frames for a slow consumer).
-		*/
-		subscribeFrames: method(SubscribeFramesInputSchema, SubscribeFramesResultSchema, { kind: "mutation" }),
-		pullFrameHandles: method(z.object({
-			subscriptionId: z.string(),
-			maxCount: z.number().int().positive().default(4)
-		}), z.array(FrameHandleSchema).readonly()),
-		unsubscribeFrames: method(z.object({ subscriptionId: z.string() }), z.object({ released: z.boolean() }), { kind: "mutation" }),
 		setPreBufferDuration: method(z.object({
 			brokerId: z.string(),
 			seconds: z.number().min(0).max(30)
@@ -14147,72 +13962,18 @@ id: z.union([z.string(), z.number()]) }), {
 		})
 	}
 };
-/**
-* shm ring usage stats for a `frameSink: 'shm'` decoder session —
-* exposed via `decoder.getShmStats` so downstream consumers can
-* observe ring pressure (slot count, byte budget, hit/miss ratio).
-*/
-var ShmRingStatsSchema = z.object({
-	sessionId: z.string(),
-	slotCount: z.number().int(),
-	slotByteLength: z.number().int(),
-	segmentBytes: z.number().int(),
-	budgetMb: z.number().int(),
-	framesWritten: z.number().int(),
-	getFrameHits: z.number().int(),
-	getFrameMisses: z.number().int()
-});
 var decoderCapability = {
 	name: "decoder",
 	scope: "system",
 	mode: "singleton",
 	preferredProvider: "decoder-nodeav",
 	methods: {
-		supportsCodec: method(z.object({ codec: z.string() }), z.boolean()),
 		getInfo: method(z.void(), z.object({
 			id: z.string(),
 			name: z.string(),
-			isPullMode: z.boolean().optional(),
-			priority: z.number().optional(),
 			hwaccel: z.string().optional(),
 			probedBestHwaccel: z.string().optional()
 		})),
-		createSession: method(DecoderSessionConfigSchema, z.object({
-			sessionId: z.string(),
-			nodeId: z.string()
-		})),
-		destroySession: method(z.object({ sessionId: z.string() }), z.void()),
-		pushPacket: method(z.object({
-			sessionId: z.string(),
-			packet: EncodedPacketSchema
-		}), z.void()),
-		openStream: method(z.object({
-			sessionId: z.string(),
-			url: z.string()
-		}), z.void()),
-		pullFrames: method(z.object({
-			sessionId: z.string(),
-			maxCount: z.number().default(1),
-			waitMs: z.number().optional()
-		}), z.array(DecodedFrameSchema)),
-		pullHandles: method(z.object({
-			sessionId: z.string(),
-			maxCount: z.number().default(1),
-			waitMs: z.number().optional()
-		}), z.array(FrameHandleSchema)),
-		getFrame: method(z.object({ handle: FrameHandleSchema }), DecodedFrameSchema.nullable()),
-		getShmStats: method(z.object({ sessionId: z.string() }), ShmRingStatsSchema.nullable()),
-		updateConfig: method(z.object({
-			sessionId: z.string(),
-			config: DecoderSessionConfigSchema.partial()
-		}), z.void()),
-		getStats: method(z.object({ sessionId: z.string() }), DecoderStatsSchema),
-		listActiveSessions: method(z.void(), z.array(z.object({
-			sessionId: z.string(),
-			codec: z.string(),
-			outputFormat: z.string(),
-			createdAtMs: z.number()
-		})).readonly()),
 		/**
 		* Re-run the host platform-probe for the decoder's hwaccel backend
 		* and write the detected value into the addon's own global
@@ -23339,8 +23100,8 @@ Object.freeze(Object.fromEntries([{
 var CLUSTER_STEP_SETTING_FIELDS = [{
 	stepId: "face-embedding",
 	key: "minLandmarkFaceSize",
-	label: "Min face size for recognition (detection px)",
-	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	label: "Min face size to embed (detection-frame px)",
+	description: "Faces smaller than this in the small frame the detector sees are not embedded, so they can never be recognised. Below it the face cannot be aligned reliably and a bad embedding matches everyone. Same value on every node. 0 = no limit.",
 	type: "slider",
 	min: 0,
 	max: 64,
@@ -27924,14 +27685,15 @@ var RunnerLocalLoadSchema = z.object({
 	* Per-inference-device live load (multi-device C4). One entry per deviceKey
 	* this runner currently has attached cameras on, so the orchestrator's second
 	* `balance()` pass (over a node's devices) weights on real per-pool session
-	* counts. Empty on single-device / pre-multi-device runners. `queueDepthTotal`
-	* per device is 0 until the pool backlog gets a public accessor (follow-up).
+	* counts. Empty on single-device / pre-multi-device runners. There is no
+	* per-device queue depth: the inference pool's backlog has no accessor, and
+	* a field that always read 0 was removed rather than shown as a measurement
+	* (D762).
 	*/
 	devices: z.array(z.object({
 		deviceKey: z.string(),
 		backend: z.string(),
-		attachedCameras: z.number(),
-		queueDepthTotal: z.number()
+		attachedCameras: z.number()
 	})).default([]),
 	/** Hardware capability flags reported by this node. */
 	hardware: z.object({
@@ -28446,7 +28208,10 @@ var PipelineAssignmentSchema = z.object({
 });
 /**
 * Per-agent load summary surfaced to the load balancer + dashboards.
-* Aggregated from each runner's `getLocalLoad` cap call.
+* Aggregated from each runner's `getLocalLoad` cap call. In the
+* `getAgentLoad` report, a single-device node's default-pool sessions (no
+* `deviceKey`) are credited to its one eligible device in `load.devices` —
+* the default pool IS that device (D745); the balancer's census stays raw.
 */
 var AgentLoadSummarySchema = z.object({
 	nodeId: z.string(),
@@ -28536,8 +28301,14 @@ var CameraBrokerProfileSchema = z.object({
 	width: z.number(),
 	height: z.number(),
 	subscribers: z.number(),
-	inFps: z.number(),
-	outFps: z.number()
+	/**
+	* Encoded packets/s the broker receives from the camera. null when the
+	* broker's stats read failed — unknown, never 0 (a 0 here reads as a stall).
+	* There is no output rate: decoding runs in the session decode workers, not
+	* in the broker, so the broker's own decoded-frame rate is 0 on every live
+	* camera and is not served (D758).
+	*/
+	inFps: z.number().nullable()
 });
 /** Broker block — null when the broker stage is unreachable or inactive. */
 var CameraBrokerStatusSchema = z.object({
@@ -32445,8 +32216,6 @@ var WebrtcStreamChoiceSchema = z.object({
 	]).nullable(),
 	/** Input FPS from the camera (null for adaptive). */
 	inputFps: z.number().nullable(),
-	/** Decoded FPS (null for adaptive). */
-	decodeFps: z.number().nullable(),
 	/** Bitrate in kbps (null for adaptive). */
 	bitrateKbps: z.number().nullable()
 });
@@ -33215,6 +32984,65 @@ var AddonAutoUpdateSchema = ChannelWithInheritSchema;
 var RestartAddonResultSchema = z.unknown();
 var InstallPackageResultSchema = z.unknown();
 var ReloadPackagesResultSchema = z.unknown();
+/**
+* What an uninstall did on ONE node.
+*  - `uninstalled`       — removed: runner(s) stopped, caps gone, code deleted.
+*  - `not-installed`     — the node did not have it (nothing to do).
+*  - `refused`           — protected / bootstrap package; nothing touched.
+*  - `failed`            — attempted and did not complete; `error` says why.
+*  - `pending-reconnect` — the node is OFFLINE: its record was pruned so the
+*    back-fill never returns the package, and the stale-addon sweep removes the
+*    copy when the node registers again (only once the hub no longer has it).
+*/
+var UninstallNodeOutcomeSchema = z.enum([
+	"uninstalled",
+	"not-installed",
+	"refused",
+	"failed",
+	"pending-reconnect"
+]);
+var UninstallNodeResultSchema = z.object({
+	nodeId: z.string(),
+	outcome: UninstallNodeOutcomeSchema,
+	error: z.string().optional(),
+	addonIds: z.array(z.string()).readonly(),
+	runnersStopped: z.array(z.string()).readonly(),
+	warnings: z.array(z.string()).readonly()
+});
+var UninstallPackageResultSchema = z.object({
+	/** Every targeted node ended `uninstalled`, `not-installed` or `pending-reconnect`. */
+	success: z.boolean(),
+	packageName: z.string(),
+	results: z.array(UninstallNodeResultSchema).readonly()
+});
+/**
+* One node that has a package. `source: 'live'` = the node answered now (the
+* hub's installer, or an agent's `$agent.status`); `'recorded'` = an offline
+* node's last declared roster — the copy may or may not still be on disk.
+*/
+var PackageInstallationSchema = z.object({
+	packageName: z.string(),
+	nodeId: z.string(),
+	nodeName: z.string(),
+	isHub: z.boolean(),
+	isOnline: z.boolean(),
+	version: z.string().nullable(),
+	addonIds: z.array(z.string()).readonly(),
+	source: z.enum(["live", "recorded"]),
+	/** The hub installs this package too. `false` on an agent row = an orphan. */
+	onHub: z.boolean()
+});
+/**
+* `unreachable` lists online agents whose status read FAILED — absence from
+* `installations` is only "not installed" for a node that answered (D315).
+*/
+var PackageInstallationsSchema = z.object({
+	installations: z.array(PackageInstallationSchema).readonly(),
+	unreachable: z.array(z.object({
+		nodeId: z.string(),
+		error: z.string()
+	})).readonly()
+});
 var BulkUpdateItemStatusSchema = z.enum([
 	"queued",
 	"updating",
@@ -33323,10 +33151,31 @@ var addonsCapability = {
 		}),
 		isWorkspaceAvailable: method(z.void(), z.boolean()),
 		listWorkspacePackages: method(z.void(), z.array(z.unknown()).readonly()),
-		uninstallPackage: method(z.object({ packageName: z.string() }), z.unknown(), {
+		/**
+		* Uninstall a package. `nodeId` omitted (or `'hub'`) uninstalls on the hub
+		* — the original behaviour, which still THROWS on failure. An agent
+		* `nodeId` removes it from that agent through `$agent.undeploy`
+		* (runners stopped, caps deregistered, code deleted) and prunes the node's
+		* declared roster so the back-fill never returns it. `everywhere: true`
+		* does both for every node that has it (agents first, hub last); offline
+		* nodes answer `pending-reconnect`. Node-level failures in those two modes
+		* are REPORTED per node, never thrown. Protected packages are refused.
+		*/
+		uninstallPackage: method(z.object({
+			packageName: z.string().min(1),
+			nodeId: z.string().optional(),
+			everywhere: z.boolean().optional()
+		}), UninstallPackageResultSchema, {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* Which nodes have a package (or, with no `packageName`, every package on
+		* every node). Hub from its installer, online agents from `$agent.status`
+		* (in parallel, bounded), offline agents from their declared roster.
+		* Drives the uninstall confirm and the Addons page's "not on the hub" list.
+		*/
+		listInstallations: method(z.object({ packageName: z.string().optional() }), PackageInstallationsSchema, { auth: "admin" }),
 		reloadPackages: method(z.void(), ReloadPackagesResultSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -47879,6 +47728,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"addons.listInstallations": {
+		capName: "addons",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"addons.listJobs": {
 		capName: "addons",
 		capScope: "system",
@@ -49061,90 +48916,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"decoder.createSession": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.destroySession": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
-	"decoder.getFrame": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"decoder.getInfo": {
 		capName: "decoder",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"decoder.getShmStats": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.getStats": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.listActiveSessions": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.openStream": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.pullFrames": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.pullHandles": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.pushPacket": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"decoder.reprobeHwaccel": {
 		capName: "decoder",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"decoder.supportsCodec": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.updateConfig": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"detectionPipeline.applyDeviceSettingsPatch": {
 		capName: "detection-pipeline",
 		capScope: "device",
@@ -54191,12 +53974,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"streamBroker.pullFrameHandles": {
-		capName: "stream-broker",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"streamBroker.regenerateRtspToken": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -54263,12 +54040,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"streamBroker.subscribeFrames": {
-		capName: "stream-broker",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"streamBroker.unassignProfile": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -54281,12 +54052,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"streamBroker.unsubscribeFrames": {
-		capName: "stream-broker",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"streamCatalog.getCatalog": {
 		capName: "stream-catalog",
 		capScope: "device",
@@ -57055,11 +56820,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"decoder.createSession": [{
-		name: "deviceId",
-		form: "single",
-		optional: true
-	}],
 	"detectionPipeline.applyDeviceSettingsPatch": [{
 		name: "deviceId",
 		form: "single",