@camstack/types 0.1.34 → 0.1.36

package/dist/{index-DS7418lf.js → index-BblD92Si.js}

@@ -13,6 +13,7 @@ const WELL_KNOWN_TABS = [
   { id: "osd", label: "OSD", icon: "type", order: 18 },
   { id: "stream-broker", label: "Stream Broker", icon: "radio", order: 20 },
   { id: "streaming", label: "Streaming", icon: "video", order: 35 },
+  { id: "ptz", label: "PTZ", icon: "move", order: 40 },
   { id: "pipeline", label: "Detection Pipeline", icon: "cpu", order: 39 },
   { id: "zones", label: "Detection", icon: "shapes", order: 38 },
   { id: "live-stats", label: "Live Stats", icon: "activity", order: 39 },
@@ -80,6 +81,9 @@ function hydrateField(field, values) {
     return { ...field, value: items };
   }
   const rawValue = storedValue !== void 0 ? storedValue : defaultValue !== void 0 ? defaultValue : null;
+  if (field.type === "password") {
+    return { ...field, value: "" };
+  }
   const value = field.type === "textarea" && field.isJson && rawValue !== null && typeof rawValue === "object" ? JSON.stringify(rawValue, null, 2) : rawValue;
   const hydrated = { ...field, value };
   return hydrated;
@@ -182,7 +186,19 @@ const DecoderSessionConfigSchema = zod.z.object({
    * on every line so `grep tag=broker:5/high` filters one camera
    * profile cleanly.
    */
-  tag: zod.z.string().optional()
+  tag: zod.z.string().optional(),
+  /**
+   * Where the session delivers decoded frames (Phase 5 / D9):
+   *
+   * - `'callback'` (default) — the legacy pixel path: decoded frames are
+   *   buffered as `DecodedFrame`s and drained via `pullFrames`.
+   * - `'shm'` — the shared-memory frame plane: decoded frames are written
+   *   into an OS shared-memory ring and drained as zero-pixel
+   *   `FrameHandle`s via `pullHandles`. A session is one mode or the
+   *   other — `pullFrames` returns nothing for an `'shm'` session and
+   *   `pullHandles` returns nothing for a `'callback'` session.
+   */
+  frameSink: zod.z.enum(["callback", "shm"]).default("callback")
 });
 function errMsg(err) {
   if (err instanceof Error) return err.message;
@@ -768,6 +784,9 @@ function method(input, output, options) {
 function event(data) {
   return { data };
 }
+function isDeviceConfigCap(def) {
+  return def?.deviceConfig !== void 0;
+}
 const AudioClassSummarySchema = zod.z.object({
   className: zod.z.string(),
   /** Number of windows (chunks) where this class was the top hit. */
@@ -1070,6 +1089,53 @@ const DecodedFrameSchema = zod.z.object({
   format: zod.z.enum(["jpeg", "rgb", "bgr", "yuv420", "gray"]),
   timestamp: zod.z.number()
 });
+const FrameHandleSchema = zod.z.object({
+  shmId: zod.z.string(),
+  slot: zod.z.number().int().nonnegative(),
+  seq: zod.z.number().int().nonnegative(),
+  width: zod.z.number().int().positive(),
+  height: zod.z.number().int().positive(),
+  format: zod.z.enum(["jpeg", "rgb", "bgr", "yuv420", "gray"]),
+  pts: zod.z.number(),
+  byteLength: zod.z.number().int().nonnegative(),
+  nodeId: zod.z.string(),
+  slotCount: zod.z.number().int().positive()
+});
+const FrameHandleFormatSchema = zod.z.enum(["rgb", "bgr", "yuv420", "gray"]);
+const SubscribeFramesInputSchema = zod.z.object({
+  brokerId: zod.z.string(),
+  format: FrameHandleFormatSchema,
+  /**
+   * Optional reader-side cadence hint in frames per second. The broker does
+   * NOT throttle — latest-wins ring reads drop frames implicitly for a slow
+   * consumer. The value is echoed back in `SubscribeFramesResult.maxFps` so
+   * the consumer can pace its own `pullFrameHandles` polling.
+   */
+  maxFps: zod.z.number().positive().optional(),
+  /** Short caller-identity tag (`motion`, `detection`, …) for diagnostics. */
+  tag: zod.z.string().optional()
+});
+const SubscribeFramesResultSchema = zod.z.object({
+  /** Opaque id the consumer passes to `pullFrameHandles` / `unsubscribeFrames`. */
+  subscriptionId: zod.z.string(),
+  /** Reader-side cadence hint (frames/s) — echoes `SubscribeFramesInput.maxFps`. */
+  maxFps: zod.z.number().nonnegative()
+});
+const DecodedAudioChunkSchema = zod.z.object({
+  data: zod.z.instanceof(Uint8Array),
+  sampleRate: zod.z.number().int().positive(),
+  channels: zod.z.number().int().positive(),
+  timestamp: zod.z.number()
+});
+const SubscribeAudioChunksInputSchema = zod.z.object({
+  brokerId: zod.z.string(),
+  /** Short caller-identity tag (`audio-analyzer`, …) for `listClients`. */
+  tag: zod.z.string().optional()
+});
+const SubscribeAudioChunksResultSchema = zod.z.object({
+  /** Opaque id passed to `pullAudioChunks` / `unsubscribeAudioChunks`. */
+  subscriptionId: zod.z.string()
+});
 const BrokerStatusSchema$1 = zod.z.enum(["idle", "connecting", "streaming", "error", "stopped"]);
 const BrokerStatsSchema = zod.z.object({
   status: BrokerStatusSchema$1,
@@ -1299,9 +1365,76 @@ const streamBrokerCapability = {
       zod.z.object({ released: zod.z.boolean(), refcount: zod.z.number().int().nonnegative() }),
       { kind: "mutation", auth: "admin" }
     ),
-    getBroker: method(
-      zod.z.object({ brokerId: zod.z.string() }),
-      zod.z.custom()
+    /**
+     * ── Decoded audio-chunk plane (Phase 5 / D9) ──────────────────────
+     *
+     * The serialisable replacement for the live-object `IStreamBroker.
+     * onDecodedAudioChunk` callback path. Unlike the video frame plane,
+     * audio chunks are tiny (a ~500ms PCM window is a few KB) so they ship
+     * their bytes INLINE over tRPC — no shared-memory ring. A consumer:
+     *
+     *   1. `subscribeAudioChunks({ brokerId, tag })` — the broker registers
+     *      a per-subscription bounded FIFO queue and returns a
+     *      `subscriptionId`.
+     *   2. polls `pullAudioChunks({ subscriptionId, maxCount })` — drains
+     *      `DecodedAudioChunk[]` in arrival order (FIFO, no latest-wins
+     *      drop: an audio gap is audible / breaks an analysis window). The
+     *      queue is generously sized; it only drops its oldest chunk if a
+     *      truly stalled consumer lets it overflow.
+     *   3. `unsubscribeAudioChunks({ subscriptionId })` on teardown.
+     */
+    subscribeAudioChunks: method(
+      SubscribeAudioChunksInputSchema,
+      SubscribeAudioChunksResultSchema,
+      { kind: "mutation" }
+    ),
+    pullAudioChunks: method(
+      zod.z.object({
+        subscriptionId: zod.z.string(),
+        maxCount: zod.z.number().int().positive().default(8)
+      }),
+      zod.z.array(DecodedAudioChunkSchema).readonly()
+    ),
+    unsubscribeAudioChunks: method(
+      zod.z.object({ subscriptionId: zod.z.string() }),
+      zod.z.object({ released: zod.z.boolean() }),
+      { kind: "mutation" }
+    ),
+    /**
+     * ── Shared-memory frame plane (Phase 5 / D9) ──────────────────────
+     *
+     * The handle-based replacement for the live-object `IStreamBroker.
+     * onDecodedFrame` callback path. A consumer:
+     *
+     *   1. `subscribeFrames({ brokerId, format })` — the broker spins up
+     *      (or reuses) a `frameSink: 'shm'` decoder session producing that
+     *      `format` and returns a `subscriptionId`.
+     *   2. polls `pullFrameHandles({ subscriptionId, maxCount })` — drains
+     *      zero-pixel `FrameHandle[]`; each handle is fed to a
+     *      `FrameRingReader` that opens the named shm segment and reads the
+     *      pixels back zero-copy.
+     *   3. `unsubscribeFrames({ subscriptionId })` on teardown.
+     *
+     * The broker keeps one shm ring per `(brokerId, format)` actually
+     * requested — no broker-side `sharp` conversion. fps throttling is
+     * implicit (latest-wins ring reads drop frames for a slow consumer).
+     */
+    subscribeFrames: method(
+      SubscribeFramesInputSchema,
+      SubscribeFramesResultSchema,
+      { kind: "mutation" }
+    ),
+    pullFrameHandles: method(
+      zod.z.object({
+        subscriptionId: zod.z.string(),
+        maxCount: zod.z.number().int().positive().default(4)
+      }),
+      zod.z.array(FrameHandleSchema).readonly()
+    ),
+    unsubscribeFrames: method(
+      zod.z.object({ subscriptionId: zod.z.string() }),
+      zod.z.object({ released: zod.z.boolean() }),
+      { kind: "mutation" }
     ),
     setPreBufferDuration: method(
       zod.z.object({ brokerId: zod.z.string(), seconds: zod.z.number().min(0).max(30) }),
@@ -1357,6 +1490,8 @@ const cameraStreamsCapability = {
   name: "camera-streams",
   scope: "device",
   mode: "singleton",
+  kind: "wrapper",
+  defaultActive: true,
   deviceTypes: [DeviceType.Camera],
   methods: {
     getCameraStreams: method(
@@ -1652,6 +1787,8 @@ const motionDetectionCapability = {
   name: "motion-detection",
   scope: "device",
   mode: "singleton",
+  kind: "wrapper",
+  defaultActive: true,
   exposesDeviceSettings: true,
   methods: {
     analyze: method(
@@ -2523,6 +2660,42 @@ const motionTriggerCapability = {
   },
   runtimeState: MotionTriggerRuntimeStateSchema
 };
+const MotionZoneStatusSchema = zod.z.object({
+  enabled: zod.z.boolean(),
+  sensitivity: zod.z.number(),
+  /** Row-major active-cell grid. Length = gridWidth*gridHeight (see getOptions). */
+  cells: zod.z.array(zod.z.boolean()),
+  lastFetchedAt: zod.z.number()
+});
+const MotionZoneOptionsSchema = zod.z.object({
+  gridWidth: zod.z.number(),
+  gridHeight: zod.z.number(),
+  sensitivity: zod.z.object({ min: zod.z.number(), max: zod.z.number(), step: zod.z.number() })
+});
+const MotionZonePatchSchema = zod.z.object({
+  enabled: zod.z.boolean().optional(),
+  sensitivity: zod.z.number().optional(),
+  cells: zod.z.array(zod.z.boolean()).optional()
+});
+const motionZonesCapability = {
+  name: "motion-zones",
+  scope: "device",
+  mode: "singleton",
+  deviceTypes: [DeviceType.Camera],
+  deviceConfig: {
+    ui: { kind: "widget", widgetId: "host/motion-zones-grid", tab: "motion", label: "Motion Zones" }
+  },
+  methods: {
+    getOptions: method(zod.z.object({ deviceId: zod.z.number() }), MotionZoneOptionsSchema),
+    setZone: method(
+      zod.z.object({ deviceId: zod.z.number(), patch: MotionZonePatchSchema }),
+      zod.z.void(),
+      { kind: "mutation", auth: "admin" }
+    )
+  },
+  status: { schema: MotionZoneStatusSchema, kind: "poll" },
+  runtimeState: MotionZoneStatusSchema
+};
 const AutotrackTargetTypeSchema = zod.z.string().describe("Vendor target string (people/vehicle/pet); empty = camera default");
 const PtzAutotrackSettingsSchema = zod.z.object({
   targetType: AutotrackTargetTypeSchema,
@@ -2561,6 +2734,9 @@ const ptzAutotrackCapability = {
   scope: "device",
   mode: "singleton",
   deviceTypes: [DeviceType.Camera],
+  deviceConfig: {
+    ui: { kind: "widget", widgetId: "host/ptz-autotrack", tab: "ptz", topTab: true, label: "Auto-Tracking", order: 5 }
+  },
   methods: {
     /**
      * Read the current on/off state + last-applied settings.
@@ -2627,6 +2803,111 @@ const ptzAutotrackCapability = {
    */
   runtimeState: PtzAutotrackRuntimeStateSchema
 };
+const StreamProfileSchema = zod.z.enum(["main", "sub", "ext"]);
+const StreamProfileConfigSchema = zod.z.object({
+  width: zod.z.number(),
+  height: zod.z.number(),
+  codec: zod.z.enum(["h264", "h265"]),
+  framerate: zod.z.number(),
+  bitrate: zod.z.number(),
+  // kbps
+  bitrateMode: zod.z.enum(["vbr", "cbr"]).optional(),
+  encoderProfile: zod.z.enum(["high", "main", "baseline"]).optional(),
+  gop: zod.z.number().optional(),
+  audio: zod.z.boolean().optional()
+});
+const StreamParamsStatusSchema = zod.z.object({
+  /** Per-profile current config. A profile absent = the camera doesn't have it. */
+  main: StreamProfileConfigSchema.optional(),
+  sub: StreamProfileConfigSchema.optional(),
+  ext: StreamProfileConfigSchema.optional(),
+  lastFetchedAt: zod.z.number()
+});
+const StreamProfileOptionsSchema = zod.z.object({
+  resolutions: zod.z.array(zod.z.object({ width: zod.z.number(), height: zod.z.number() })),
+  codecs: zod.z.array(zod.z.enum(["h264", "h265"])),
+  framerates: zod.z.array(zod.z.number()),
+  /** Allowed bitrate values (kbps). Empty if the camera takes a free range. */
+  bitrates: zod.z.array(zod.z.number()),
+  /** Optional [min,max] kbps when the camera accepts a continuous range. */
+  bitrateRange: zod.z.tuple([zod.z.number(), zod.z.number()]).optional(),
+  supportsBitrateMode: zod.z.boolean(),
+  supportsEncoderProfile: zod.z.boolean(),
+  supportsGop: zod.z.boolean(),
+  /** Allowed GOP / keyframe-interval range, in seconds — drives the
+   *  I-frame-interval selector. Absent when the camera advertises GOP
+   *  support but no concrete range (callers then fall back to a free
+   *  numeric input). `{ min, max, step }` per the getOptions convention. */
+  gop: zod.z.object({ min: zod.z.number(), max: zod.z.number(), step: zod.z.number() }).optional()
+});
+const StreamParamsOptionsSchema = zod.z.object({
+  main: StreamProfileOptionsSchema.optional(),
+  sub: StreamProfileOptionsSchema.optional(),
+  ext: StreamProfileOptionsSchema.optional()
+});
+const StreamProfilePatchSchema = zod.z.object({
+  width: zod.z.number().optional(),
+  height: zod.z.number().optional(),
+  codec: zod.z.enum(["h264", "h265"]).optional(),
+  framerate: zod.z.number().optional(),
+  bitrate: zod.z.number().optional(),
+  bitrateMode: zod.z.enum(["vbr", "cbr"]).optional(),
+  encoderProfile: zod.z.enum(["high", "main", "baseline"]).optional(),
+  gop: zod.z.number().optional(),
+  audio: zod.z.boolean().optional()
+});
+const streamParamsCapability = {
+  name: "stream-params",
+  scope: "device",
+  mode: "singleton",
+  deviceTypes: [DeviceType.Camera],
+  deviceConfig: {
+    ui: { kind: "derived-form", builderId: "stream-params", tab: "streaming" }
+  },
+  methods: {
+    getOptions: method(
+      zod.z.object({ deviceId: zod.z.number() }),
+      StreamParamsOptionsSchema
+    ),
+    setProfile: method(
+      zod.z.object({
+        deviceId: zod.z.number(),
+        profile: StreamProfileSchema,
+        patch: StreamProfilePatchSchema
+      }),
+      zod.z.void(),
+      { kind: "mutation", auth: "admin" }
+    ),
+    /**
+     * Build the `ConfigUISchema` (admin-ui `ConfigFormBuilder` input
+     * shape) for this camera's stream-encoder settings — one section per
+     * profile (main / sub / ext) with the resolution / codec / framerate
+     * / bitrate / bitrate-mode / encoder-profile / GOP controls the
+     * firmware actually exposes.
+     *
+     * Driven by `getOptions` (camera-probed availability) + `getStatus`
+     * (current per-profile config); each field's `default` is seeded
+     * from the live config so the form renders the camera state in one
+     * pass. Returns `null` when the camera exposes no configurable
+     * stream property — the renderer then shows the unsupported message.
+     *
+     * Output is `z.unknown().nullable()` — the same convention every
+     * other `ConfigUISchema`-returning cap method uses (`device-ops`,
+     * `device-manager`); `ConfigUISchema` is a TS-only type with no
+     * companion Zod schema, and a concrete object would collapse
+     * unrelated AppRouter branches to `unknown` during codegen.
+     */
+    getConfigSchema: method(
+      zod.z.object({ deviceId: zod.z.number() }),
+      zod.z.unknown().nullable()
+    )
+  },
+  status: {
+    schema: StreamParamsStatusSchema,
+    kind: "poll"
+  },
+  runtimeState: StreamParamsStatusSchema
+};
 const SwitchStatusSchema = zod.z.object({
   on: zod.z.boolean(),
   /** Ms epoch of the last state change. Useful for UI "X minutes ago". */
@@ -3631,6 +3912,83 @@ const adminUiCapability = {
     getVersion: method(zod.z.void(), VersionOutputSchema)
   }
 };
+const MethodAccessSchema = zod.z.enum(["view", "create", "delete"]);
+const AllowedProviderSchema = zod.z.union([zod.z.literal("*"), zod.z.array(zod.z.string())]);
+const AllowedDevicesSchema = zod.z.record(zod.z.string(), zod.z.union([zod.z.literal("*"), zod.z.array(zod.z.string())]));
+const CapScopeSchema = zod.z.enum(["device", "system"]);
+const TokenScopeSchema = zod.z.discriminatedUnion("type", [
+  zod.z.object({
+    type: zod.z.literal("category"),
+    target: CapScopeSchema,
+    access: zod.z.array(MethodAccessSchema).min(1)
+  }),
+  zod.z.object({
+    type: zod.z.literal("capability"),
+    target: zod.z.string(),
+    access: zod.z.array(MethodAccessSchema).min(1)
+  }),
+  zod.z.object({
+    type: zod.z.literal("addon"),
+    target: zod.z.string(),
+    access: zod.z.array(MethodAccessSchema).min(1)
+  }),
+  zod.z.object({
+    type: zod.z.literal("device"),
+    /**
+     * One or more deviceIds (serialised as strings for wire-format
+     * consistency with the rest of the union). Matcher accepts if
+     * `input.deviceId` ∈ `targets`. Array shape avoids the row-explosion
+     * of one scope-per-device when granting access to a set of cameras.
+     */
+    targets: zod.z.array(zod.z.string()).min(1),
+    access: zod.z.array(MethodAccessSchema).min(1)
+  })
+]);
+const UserRecordSchema = zod.z.object({
+  id: zod.z.string(),
+  username: zod.z.string(),
+  passwordHash: zod.z.string(),
+  /**
+   * Admin bypass. When true, the middleware skips the scope-access
+   * check entirely. There is no other axis of privilege; the legacy
+   * role enum collapsed onto this boolean in v2.
+   */
+  isAdmin: zod.z.boolean().default(false),
+  allowedProviders: AllowedProviderSchema,
+  allowedDevices: AllowedDevicesSchema,
+  /**
+   * Scopes granted to this user. Admins bypass; their `scopes` is
+   * ignored. Non-admins without scopes are locked out of every
+   * protected call.
+   */
+  scopes: zod.z.array(TokenScopeSchema).default([]),
+  createdAt: zod.z.number(),
+  updatedAt: zod.z.number()
+});
+const ApiKeyRecordSchema = zod.z.object({
+  id: zod.z.string(),
+  label: zod.z.string(),
+  isAdmin: zod.z.boolean().default(false),
+  allowedProviders: AllowedProviderSchema,
+  allowedDevices: AllowedDevicesSchema,
+  tokenHash: zod.z.string(),
+  tokenPrefix: zod.z.string(),
+  createdAt: zod.z.number(),
+  lastUsedAt: zod.z.number().optional()
+});
+const ScopedTokenSchema = zod.z.object({
+  id: zod.z.string(),
+  userId: zod.z.string(),
+  name: zod.z.string(),
+  tokenHash: zod.z.string(),
+  tokenPrefix: zod.z.string(),
+  scopes: zod.z.array(TokenScopeSchema),
+  // SQLite/JSON storage round-trips undefined → null. Use `nullish` so the
+  // schema accepts both `null` (read from disk) and `undefined` (in-memory).
+  expiresAt: zod.z.number().nullish(),
+  lastUsedAt: zod.z.number().nullish(),
+  createdAt: zod.z.number()
+});
 const SsoBridgeClaimsSchema = zod.z.object({
   userId: zod.z.string(),
   username: zod.z.string(),
@@ -3646,7 +4004,18 @@ const SsoBridgeClaimsSchema = zod.z.object({
    * JWT WITHOUT verifying the signature — the hub re-verifies on every
    * inbound call so trust still rests with the signing hub.
    */
-  hubUrl: zod.z.string().optional()
+  hubUrl: zod.z.string().optional(),
+  /** Permission scopes baked into the token. Set by the OAuth
+   *  account-linking grant; absent on ordinary SSO-login tokens. */
+  scopes: zod.z.array(TokenScopeSchema).optional(),
+  /** OAuth authorization-code binding — set only on `oauth-code` tokens. */
+  redirectUri: zod.z.string().optional(),
+  integrationId: zod.z.string().optional(),
+  /** JWT ID — unique per issued code; consumed-set enforces single-use. */
+  jti: zod.z.string().optional(),
+  /** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
+   *  tokens so the verify path can check the session is not revoked. */
+  sessionId: zod.z.string().optional()
 });
 const ssoBridgeCapability = {
   name: "sso-bridge",
@@ -3667,6 +4036,27 @@ const ssoBridgeCapability = {
     )
   }
 };
+const OauthIntegrationDescriptorSchema = zod.z.object({
+  /** Stable id used as the `integration=` query param, e.g. 'export-alexa'. */
+  integrationId: zod.z.string(),
+  /** Human label rendered on the consent page. */
+  displayName: zod.z.string(),
+  /** Scopes baked into every token issued for this integration. */
+  requestedScopes: zod.z.array(TokenScopeSchema),
+  /** Allowed redirect_uri prefixes. /api/oauth2/authorize rejects any
+   *  redirect_uri that does not start with one of these. Required —
+   *  an empty list means the integration can never complete linking. */
+  allowedRedirectPrefixes: zod.z.array(zod.z.string()).min(1)
+});
+const oauthIntegrationCapability = {
+  name: "oauth-integration",
+  scope: "system",
+  mode: "collection",
+  internal: true,
+  methods: {
+    getDescriptor: method(zod.z.void(), OauthIntegrationDescriptorSchema)
+  }
+};
 const PasskeySummarySchema = zod.z.object({
   credentialId: zod.z.string(),
   label: zod.z.string(),
@@ -3982,21 +4372,30 @@ const addonPagesSourceCapability = {
 };
 const WidgetHostEnum = zod.z.enum(["device-tab", "dashboard", "integration-detail"]);
 const WidgetSizeEnum = zod.z.enum(["xs", "sm", "md", "lg", "xl"]);
+const WidgetRemoteSchema = zod.z.object({
+  remoteName: zod.z.string(),
+  exposedModule: zod.z.string(),
+  componentKey: zod.z.string().optional()
+});
 const WidgetMetadataSchema = zod.z.object({
-  /** Stable id within the addon — kebab-case. */
-  stableId: zod.z.string(),
+  // ── UiContribution core (kind:'remote') ──────────────────────────
+  /** Primary host tab — `'dashboard'`, `'device-tab'`, or a device-detail tab id. */
+  tab: zod.z.string(),
+  /** Optional sub-tab within `tab`. */
+  subTab: zod.z.string().optional(),
   /** Operator-facing label. */
   label: zod.z.string(),
+  /** Ordering within `(tab, subTab)`, ascending. */
+  order: zod.z.number().optional(),
+  /** Always `'remote'` — a widget is a Module Federation remote. */
+  kind: zod.z.literal("remote"),
+  /** MF remote descriptor. */
+  remote: WidgetRemoteSchema,
+  // ── Widget-only metadata ─────────────────────────────────────────
+  /** Stable id within the addon — kebab-case. Equals `remote.componentKey`. */
+  stableId: zod.z.string(),
   description: zod.z.string().optional(),
   icon: zod.z.string().optional(),
-  /**
-   * Module Federation remote name — must match the `name` field on the
-   * widget addon's `federation()` plugin config. Used by the host's
-   * `<WidgetRegistryProvider>` to call `loadRemote('<remoteName>/widgets')`.
-   * Conventionally `addon_<addonid>_widgets` (snake_case; MF names
-   * cannot contain hyphens).
-   */
-  remoteName: zod.z.string(),
   /**
    * Bundle filename inside the addon's `dist/` dir served at
    * `/api/addon-widgets/<addonId>/<bundle>`. With Module Federation
@@ -4005,9 +4404,9 @@ const WidgetMetadataSchema = zod.z.object({
    * cache-buster URL without a separate filesystem stat.
    */
   bundle: zod.z.string(),
-  /** Where the widget makes sense to render. */
+  /** Every host the widget supports. The picker filters on this set. */
   hosts: zod.z.array(WidgetHostEnum).readonly(),
-  /** Required props the host must supply. Validated at <WidgetSlot> mount. */
+  /** Required props the host must supply. Validated at `<WidgetSlot>` mount. */
   requires: zod.z.object({
     deviceContext: zod.z.boolean().default(false),
     integrationContext: zod.z.boolean().default(false)
@@ -4107,6 +4506,16 @@ const DEFAULT_DECODER_HWACCEL_CONFIG = {
   hwaccel: "auto",
   probedBestHwaccel: ""
 };
+const ShmRingStatsSchema = zod.z.object({
+  sessionId: zod.z.string(),
+  slotCount: zod.z.number().int(),
+  slotByteLength: zod.z.number().int(),
+  segmentBytes: zod.z.number().int(),
+  budgetMb: zod.z.number().int(),
+  framesWritten: zod.z.number().int(),
+  getFrameHits: zod.z.number().int(),
+  getFrameMisses: zod.z.number().int()
+});
 const decoderCapability = {
   name: "decoder",
   scope: "system",
@@ -4143,10 +4552,27 @@ const decoderCapability = {
       url: zod.z.string()
     }), zod.z.void()),
     // ── Output — polling-based frame retrieval ────────────────────
+    // `pullFrames` drains the pixel `DecodedFrame[]` of a `frameSink:
+    // 'callback'` session. `pullHandles` (Phase 5 / D9) drains the
+    // zero-pixel `FrameHandle[]` of a `frameSink: 'shm'` session — the
+    // broker hands each handle to a `FrameRingReader` that opens the
+    // named segment and reads the pixels back zero-copy. A session is
+    // one mode or the other; the unmatched method returns an empty
+    // array.
     pullFrames: method(zod.z.object({
       sessionId: zod.z.string(),
       maxCount: zod.z.number().default(1)
     }), zod.z.array(DecodedFrameSchema)),
+    pullHandles: method(zod.z.object({
+      sessionId: zod.z.string(),
+      maxCount: zod.z.number().default(1)
+    }), zod.z.array(FrameHandleSchema)),
+    // ── Frame fetch (Phase 5 / D9 downstream access) ──────────────
+    // Read the pixels a FrameHandle refers to from this node's shm ring.
+    // Returns null when the slot was already recycled (latest-wins).
+    getFrame: method(zod.z.object({ handle: FrameHandleSchema }), DecodedFrameSchema.nullable()),
+    // shm ring usage stats for a session.
+    getShmStats: method(zod.z.object({ sessionId: zod.z.string() }), ShmRingStatsSchema.nullable()),
     // ── Control ───────────────────────────────────────────────────
     updateConfig: method(zod.z.object({
       sessionId: zod.z.string(),
@@ -4299,6 +4725,8 @@ const webrtcSessionCapability = {
   name: "webrtc-session",
   scope: "device",
   mode: "singleton",
+  kind: "wrapper",
+  defaultActive: true,
   deviceTypes: [DeviceType.Camera],
   methods: {
     /**
@@ -4817,6 +5245,8 @@ const audioAnalysisCapability = {
   name: "audio-analysis",
   scope: "device",
   mode: "singleton",
+  kind: "wrapper",
+  defaultActive: true,
   deviceTypes: [DeviceType.Camera],
   exposesDeviceSettings: true,
   methods: {
@@ -5356,8 +5786,8 @@ const deviceManagerCapability = {
     /**
      * Return the addon ids that declared a wrapper provider for `capName`.
      * Backs the device-bindings UI's wrapper-picker dropdown. Entries are
-     * sourced from `CapabilityRegistry.wrapperProviders`, populated at
-     * `ProviderRegistration.kind === 'wrapper'` time.
+     * sourced from `CapabilityRegistry.wrapperProviders`, populated when
+     * the cap definition declares `kind: 'wrapper'`.
      */
     listWrappersForCap: method(
       zod.z.object({ capName: zod.z.string() }),
@@ -5670,54 +6100,6 @@ const authProviderCapability = {
     validateToken: method(zod.z.object({ token: zod.z.string() }), AuthResultSchema.nullable())
   }
 };
-const AuthProviderInfoSchema = zod.z.object({
-  /** Stable id matching the addon id (used for `getLoginUrl({addonId,…})`). */
-  addonId: zod.z.string(),
-  /**
-   * Per-instance id when one addon registers multiple "logical"
-   * providers (e.g. OIDC with Google + Microsoft + custom). The login
-   * URL becomes `/addon/${addonId}/${instanceId}/start` — handler reads
-   * `:instanceId` from the route. Empty/unset means the addon is a
-   * single-instance provider; the URL is `/addon/${addonId}/start`.
-   */
-  instanceId: zod.z.string().optional(),
-  /** Display label shown on the login button + admin row. */
-  displayName: zod.z.string(),
-  /** Optional iconography hint (lucide-react icon name OR emoji). */
-  icon: zod.z.string().optional(),
-  /** When true, the provider exposes a redirect-based login flow
-   *  (`getLoginUrl` returns a URL the browser navigates to). */
-  hasRedirectFlow: zod.z.boolean(),
-  /** When true, the provider exposes a credential-form login flow
-   *  (`validateCredentials` accepts username + password). */
-  hasCredentialFlow: zod.z.boolean(),
-  /** Provider kind, drives admin-UI hint dispatch (oidc / saml / totp / …). */
-  kind: zod.z.string().optional(),
-  /** Operator-facing status string (e.g. "Connected to https://login.acme.com"). */
-  status: zod.z.string().optional(),
-  /** When false, the provider is registered but disabled by config; the
-   *  UI surfaces it as inactive without enumerating it for login. */
-  enabled: zod.z.boolean()
-});
-const authenticationCapability = {
-  name: "authentication",
-  scope: "system",
-  mode: "singleton",
-  methods: {
-    /** All registered auth providers, both enabled and disabled. */
-    listProviders: method(zod.z.void(), zod.z.array(AuthProviderInfoSchema).readonly()),
-    /**
-     * Toggle a provider's enabled flag. Disabled providers stay
-     * registered but aren't surfaced on the login page. The orchestrator
-     * persists the state in `addon-settings` so it survives restarts.
-     */
-    setProviderEnabled: method(
-      zod.z.object({ addonId: zod.z.string(), enabled: zod.z.boolean() }),
-      zod.z.object({ success: zod.z.literal(true) }),
-      { kind: "mutation", auth: "admin" }
-    )
-  }
-};
 const NetworkEndpointSchema = zod.z.object({
   url: zod.z.string(),
   hostname: zod.z.string(),
@@ -5746,7 +6128,6 @@ const networkAccessCapability = {
   name: "network-access",
   scope: "system",
   mode: "collection",
-  internal: true,
   providerKind: "ingress",
   methods: {
     start: method(zod.z.void(), NetworkEndpointSchema, { kind: "mutation" }),
@@ -5754,58 +6135,13 @@ const networkAccessCapability = {
     getEndpoint: method(zod.z.void(), NetworkEndpointSchema.nullable()),
     getStatus: method(zod.z.void(), NetworkAccessStatusSchema),
     /**
-     * Enumerate every active ingress entry. Default implementation (when
-     * the provider omits this method) is derived from `getEndpoint()` —
-     * see the remote-access orchestrator for the fallback path.
+     * Enumerate every active ingress entry. Providers that expose only a
+     * single endpoint may omit this method; callers fall back to
+     * `getEndpoint()` in that case.
      */
     listEndpoints: method(zod.z.void(), zod.z.array(NetworkEndpointEntrySchema).readonly())
   }
 };
-const RemoteAccessEndpointSchema = zod.z.object({
-  url: zod.z.string(),
-  hostname: zod.z.string(),
-  port: zod.z.number(),
-  protocol: zod.z.enum(["http", "https"])
-});
-const RemoteAccessProviderInfoSchema = zod.z.object({
-  /** Stable id matching the addon id. */
-  addonId: zod.z.string(),
-  /** Display label shown on the admin row — sourced from the addon manifest. */
-  displayName: zod.z.string(),
-  /** When false, the provider is registered but disabled. */
-  enabled: zod.z.boolean(),
-  /** True when the underlying tunnel/connection is up. */
-  connected: zod.z.boolean(),
-  /** Public-facing endpoint, when connected. Null otherwise. */
-  endpoint: RemoteAccessEndpointSchema.nullable(),
-  /** Last error message (when connected=false), if available. */
-  error: zod.z.string().optional()
-});
-const remoteAccessCapability = {
-  name: "remote-access",
-  scope: "system",
-  mode: "singleton",
-  methods: {
-    /** All registered remote-access providers + their live status. */
-    listProviders: method(zod.z.void(), zod.z.array(RemoteAccessProviderInfoSchema).readonly()),
-    /**
-     * Start a specific provider's tunnel. Per-provider config still
-     * lives on the addon's settings panel; this is just the on/off
-     * trigger so the admin UI can manage the lifecycle from one place.
-     */
-    startProvider: method(
-      zod.z.object({ addonId: zod.z.string() }),
-      RemoteAccessEndpointSchema,
-      { kind: "mutation", auth: "admin" }
-    ),
-    /** Stop a specific provider's tunnel (idempotent on already-stopped). */
-    stopProvider: method(
-      zod.z.object({ addonId: zod.z.string() }),
-      zod.z.object({ success: zod.z.literal(true) }),
-      { kind: "mutation", auth: "admin" }
-    )
-  }
-};
 const TurnServerSchema = zod.z.object({
   /** Single URL or list of URLs (e.g. "turn:turn.example.com:3478?transport=udp"). */
   urls: zod.z.union([zod.z.string(), zod.z.array(zod.z.string())]),
@@ -5828,48 +6164,6 @@ const turnProviderCapability = {
     )
   }
 };
-const TurnProviderInfoSchema = zod.z.object({
-  /** Stable id matching the addon id. */
-  addonId: zod.z.string(),
-  /** Display label shown on the admin row — sourced from the addon manifest. */
-  displayName: zod.z.string(),
-  /** When false, the provider is registered but disabled. */
-  enabled: zod.z.boolean(),
-  /** Number of servers this provider is currently exposing. */
-  serverCount: zod.z.number(),
-  /**
-   * Flat list of every TURN/STUN URL this provider currently exposes.
-   * One row per URL (multi-URL ICE server entries are flattened). The
-   * admin UI shows this in a compact per-provider list so operators
-   * can verify what's actually being negotiated without having to dig
-   * into the combined `getAllServers` output.
-   */
-  urls: zod.z.array(zod.z.string()).readonly(),
-  /** Last fetch error (when serverCount=0 due to API failure), if any. */
-  error: zod.z.string().optional()
-});
-const turnOrchestratorCapability = {
-  name: "turn-orchestrator",
-  scope: "system",
-  mode: "singleton",
-  methods: {
-    /** All registered TURN providers + per-provider stats. */
-    listProviders: method(zod.z.void(), zod.z.array(TurnProviderInfoSchema).readonly()),
-    /**
-     * Combined list of TURN/STUN servers from all ENABLED providers.
-     * Consumed by the WebRTC layer at session-creation time —
-     * implementations may fetch fresh short-lived credentials each
-     * call (e.g. Cloudflare API), so consumers SHOULD call per-session.
-     */
-    getAllServers: method(zod.z.void(), zod.z.array(TurnServerSchema).readonly()),
-    /** Toggle a provider's enabled flag. */
-    setProviderEnabled: method(
-      zod.z.object({ addonId: zod.z.string(), enabled: zod.z.boolean() }),
-      zod.z.object({ success: zod.z.literal(true) }),
-      { kind: "mutation", auth: "admin" }
-    )
-  }
-};
 const SnapshotImageSchema = zod.z.object({
   base64: zod.z.string(),
   contentType: zod.z.string()
@@ -5888,6 +6182,8 @@ const snapshotCapability = {
   name: "snapshot",
   scope: "device",
   mode: "singleton",
+  kind: "wrapper",
+  defaultActive: true,
   deviceTypes: [DeviceType.Camera],
   // Owns per-device snapshot settings (preferred stream, debug logging).
   // The three DeviceSettingsContribution methods are auto-added to the
@@ -6237,6 +6533,8 @@ const detectionPipelineCapability = {
   name: "detection-pipeline",
   scope: "device",
   mode: "singleton",
+  kind: "wrapper",
+  defaultActive: true,
   deviceTypes: [DeviceType.Camera],
   exposesDeviceSettings: true,
   methods: {}
@@ -6345,6 +6643,8 @@ const pipelineAnalyticsCapability = {
   name: "pipeline-analytics",
   scope: "device",
   mode: "singleton",
+  kind: "wrapper",
+  defaultActive: true,
   deviceTypes: [DeviceType.Camera],
   exposesDeviceSettings: true,
   methods: {
@@ -6634,11 +6934,26 @@ const PtzMoveCommandSchema = zod.z.object({
   zoom: zod.z.number().optional(),
   speed: zod.z.number().optional()
 });
+const PtzStatusSchema = PtzPositionSchema.extend({ autofocus: zod.z.boolean() });
+const PtzOptionsSchema = zod.z.object({
+  hasPan: zod.z.boolean(),
+  hasTilt: zod.z.boolean(),
+  hasZoom: zod.z.boolean(),
+  supportsPresets: zod.z.boolean(),
+  /** Max number of named presets the camera supports, when known. */
+  maxPresets: zod.z.number().optional(),
+  /** Whether the camera exposes a controllable autofocus toggle
+   *  (boolean `hasX` per the getOptions availability convention). */
+  hasAutofocus: zod.z.boolean()
+});
 const ptzCapability = {
   name: "ptz",
   scope: "device",
   mode: "singleton",
   deviceTypes: [DeviceType.Camera],
+  deviceConfig: {
+    ui: { kind: "widget", widgetId: "host/ptz-panel", tab: "ptz", topTab: true, label: "PTZ", order: 0 }
+  },
   methods: {
     move: method(
       PtzMoveCommandSchema.extend({ deviceId: zod.z.number() }),
@@ -6664,6 +6979,20 @@ const ptzCapability = {
       zod.z.void(),
       { kind: "mutation" }
     ),
+    savePreset: method(
+      zod.z.object({ deviceId: zod.z.number(), presetId: zod.z.string(), name: zod.z.string() }),
+      zod.z.void(),
+      { kind: "mutation", auth: "admin" }
+    ),
+    deletePreset: method(
+      zod.z.object({ deviceId: zod.z.number(), presetId: zod.z.string() }),
+      zod.z.void(),
+      { kind: "mutation", auth: "admin" }
+    ),
+    getOptions: method(
+      zod.z.object({ deviceId: zod.z.number() }),
+      PtzOptionsSchema
+    ),
     goHome: method(
       zod.z.object({ deviceId: zod.z.number() }),
       zod.z.void(),
@@ -6678,10 +7007,17 @@ const ptzCapability = {
     getPosition: method(
       zod.z.object({ deviceId: zod.z.number() }),
       PtzPositionSchema
+    ),
+    /** Toggle the camera's autofocus. Only meaningful when
+     *  `getOptions().hasAutofocus` is true. */
+    setAutofocus: method(
+      zod.z.object({ deviceId: zod.z.number(), enabled: zod.z.boolean() }),
+      zod.z.void(),
+      { kind: "mutation" }
     )
   },
   status: {
-    schema: PtzPositionSchema,
+    schema: PtzStatusSchema,
     kind: "command-driven"
   }
 };
@@ -7465,7 +7801,7 @@ const localNetworkCapability = {
     )
   }
 };
-const MeshEndpointSchema$1 = zod.z.object({
+const MeshEndpointSchema = zod.z.object({
   /** Stable identifier within the provider (e.g. `mesh-ipv4`, `magicdns`, `funnel`). */
   id: zod.z.string(),
   /** Operator-facing label (e.g. "Mesh IPv4", "MagicDNS"). */
@@ -7538,7 +7874,7 @@ const MeshStatusSchema = zod.z.object({
   /** Number of peers visible to this host (excluding self). */
   peerCount: zod.z.number(),
   /** Every endpoint this provider exposes for the current host. */
-  endpoints: zod.z.array(MeshEndpointSchema$1).readonly(),
+  endpoints: zod.z.array(MeshEndpointSchema).readonly(),
   /** Last error from the daemon, when not joined. */
   error: zod.z.string().optional(),
   // ── Account / tenant identity (generic across providers) ────────
@@ -7705,185 +8041,6 @@ const meshNetworkCapability = {
     // tabs driven by this cap.
   }
 };
-const MeshEndpointSchema = zod.z.object({
-  id: zod.z.string(),
-  label: zod.z.string(),
-  scope: zod.z.enum(["mesh", "public"]),
-  url: zod.z.string(),
-  hostname: zod.z.string(),
-  port: zod.z.number(),
-  protocol: zod.z.enum(["http", "https"])
-});
-const MeshProviderInfoSchema = zod.z.object({
-  /** Stable id matching the addon id. */
-  addonId: zod.z.string(),
-  /** Display label shown on the admin row — sourced from the addon manifest. */
-  displayName: zod.z.string(),
-  /** True when the host is joined to this provider's mesh. */
-  joined: zod.z.boolean(),
-  /** Local mesh IP (empty when not joined). */
-  meshIp: zod.z.string(),
-  /** MagicDNS / mesh hostname (empty when not configured). */
-  magicDnsHostname: zod.z.string(),
-  /** Peer count (excluding self). */
-  peerCount: zod.z.number(),
-  /** Active endpoints (mesh IP + MagicDNS + optional public Funnel). */
-  endpoints: zod.z.array(MeshEndpointSchema).readonly(),
-  /** Last error reported by the provider. */
-  error: zod.z.string().optional(),
-  // ── Generic identity fields mirrored from MeshStatus ─────────────
-  /** Tenant / tailnet / network display name. Empty pre-join. */
-  tenantName: zod.z.string(),
-  /** Mesh DNS suffix (e.g. tailXXXX.ts.net). Empty when not configured. */
-  magicDnsSuffix: zod.z.string(),
-  /** Authenticated user / account login. Null for token-only providers. */
-  userLogin: zod.z.string().nullable(),
-  /** Provider control-plane URL. */
-  controlPlaneUrl: zod.z.string(),
-  /** Machine-key expiry (epoch ms). Null when keys don't rotate. */
-  keyExpiry: zod.z.number().nullable()
-});
-const meshOrchestratorCapability = {
-  name: "mesh-orchestrator",
-  scope: "system",
-  mode: "singleton",
-  methods: {
-    /** All registered mesh-network providers + live status. */
-    listProviders: method(zod.z.void(), zod.z.array(MeshProviderInfoSchema).readonly()),
-    /**
-     * Join the mesh of a specific provider. Per-provider config still
-     * lives on its settings panel; the orchestrator forwards.
-     */
-    joinProvider: method(
-      zod.z.object({
-        addonId: zod.z.string(),
-        authKey: zod.z.string().min(8),
-        hostname: zod.z.string().optional()
-      }),
-      zod.z.object({ joined: zod.z.literal(true) }),
-      { kind: "mutation" }
-    ),
-    leaveProvider: method(
-      zod.z.object({ addonId: zod.z.string() }),
-      zod.z.object({ success: zod.z.literal(true) }),
-      { kind: "mutation" }
-    ),
-    /**
-     * Browser-redirect login flow. Forwards to the named provider's
-     * `mesh-network.startLogin` and returns the URL the daemon
-     * prints. UI opens it in a new tab, then polls `listProviders`
-     * for `joined: true`.
-     */
-    startLoginProvider: method(
-      zod.z.object({
-        addonId: zod.z.string(),
-        hostname: zod.z.string().optional()
-      }),
-      zod.z.object({ loginUrl: zod.z.string() }),
-      { kind: "mutation" }
-    ),
-    /**
-     * Sign out of the provider's account entirely (`mesh-network.logout`).
-     * Distinct from `leaveProvider` which only takes the host off-mesh;
-     * `logoutProvider` wipes credentials so the next start requires a
-     * fresh login.
-     */
-    logoutProvider: method(
-      zod.z.object({ addonId: zod.z.string() }),
-      zod.z.object({ loggedOut: zod.z.literal(true) }),
-      { kind: "mutation" }
-    ),
-    /**
-     * Per-provider peer list. Forwards to `mesh-network.listPeers` on
-     * the addressed provider. Separate from `listProviders` because
-     * peer payloads can be large on a heavily-populated tailnet —
-     * fetch only when the operator opens the Peers tab.
-     */
-    listProviderPeers: method(
-      zod.z.object({ addonId: zod.z.string() }),
-      zod.z.object({
-        peers: zod.z.array(MeshPeerSchema).readonly()
-      })
-    )
-  }
-};
-const MethodAccessSchema = zod.z.enum(["view", "create", "delete"]);
-const AllowedProviderSchema = zod.z.union([zod.z.literal("*"), zod.z.array(zod.z.string())]);
-const AllowedDevicesSchema = zod.z.record(zod.z.string(), zod.z.union([zod.z.literal("*"), zod.z.array(zod.z.string())]));
-const CapScopeSchema = zod.z.enum(["device", "system"]);
-const TokenScopeSchema = zod.z.discriminatedUnion("type", [
-  zod.z.object({
-    type: zod.z.literal("category"),
-    target: CapScopeSchema,
-    access: zod.z.array(MethodAccessSchema).min(1)
-  }),
-  zod.z.object({
-    type: zod.z.literal("capability"),
-    target: zod.z.string(),
-    access: zod.z.array(MethodAccessSchema).min(1)
-  }),
-  zod.z.object({
-    type: zod.z.literal("addon"),
-    target: zod.z.string(),
-    access: zod.z.array(MethodAccessSchema).min(1)
-  }),
-  zod.z.object({
-    type: zod.z.literal("device"),
-    /**
-     * One or more deviceIds (serialised as strings for wire-format
-     * consistency with the rest of the union). Matcher accepts if
-     * `input.deviceId` ∈ `targets`. Array shape avoids the row-explosion
-     * of one scope-per-device when granting access to a set of cameras.
-     */
-    targets: zod.z.array(zod.z.string()).min(1),
-    access: zod.z.array(MethodAccessSchema).min(1)
-  })
-]);
-const UserRecordSchema = zod.z.object({
-  id: zod.z.string(),
-  username: zod.z.string(),
-  passwordHash: zod.z.string(),
-  /**
-   * Admin bypass. When true, the middleware skips the scope-access
-   * check entirely. There is no other axis of privilege; the legacy
-   * role enum collapsed onto this boolean in v2.
-   */
-  isAdmin: zod.z.boolean().default(false),
-  allowedProviders: AllowedProviderSchema,
-  allowedDevices: AllowedDevicesSchema,
-  /**
-   * Scopes granted to this user. Admins bypass; their `scopes` is
-   * ignored. Non-admins without scopes are locked out of every
-   * protected call.
-   */
-  scopes: zod.z.array(TokenScopeSchema).default([]),
-  createdAt: zod.z.number(),
-  updatedAt: zod.z.number()
-});
-const ApiKeyRecordSchema = zod.z.object({
-  id: zod.z.string(),
-  label: zod.z.string(),
-  isAdmin: zod.z.boolean().default(false),
-  allowedProviders: AllowedProviderSchema,
-  allowedDevices: AllowedDevicesSchema,
-  tokenHash: zod.z.string(),
-  tokenPrefix: zod.z.string(),
-  createdAt: zod.z.number(),
-  lastUsedAt: zod.z.number().optional()
-});
-const ScopedTokenSchema = zod.z.object({
-  id: zod.z.string(),
-  userId: zod.z.string(),
-  name: zod.z.string(),
-  tokenHash: zod.z.string(),
-  tokenPrefix: zod.z.string(),
-  scopes: zod.z.array(TokenScopeSchema),
-  // SQLite/JSON storage round-trips undefined → null. Use `nullish` so the
-  // schema accepts both `null` (read from disk) and `undefined` (in-memory).
-  expiresAt: zod.z.number().nullish(),
-  lastUsedAt: zod.z.number().nullish(),
-  createdAt: zod.z.number()
-});
 const UserSummarySchema = zod.z.object({
   id: zod.z.string(),
   username: zod.z.string(),
@@ -7956,6 +8113,16 @@ const CreateScopedTokenResultSchema = zod.z.object({
   token: zod.z.string(),
   record: ScopedTokenSummarySchema
 });
+const OauthSessionSummarySchema = zod.z.object({
+  id: zod.z.string(),
+  userId: zod.z.string(),
+  username: zod.z.string(),
+  integrationId: zod.z.string(),
+  scopes: zod.z.array(TokenScopeSchema),
+  createdAt: zod.z.number(),
+  lastUsedAt: zod.z.number(),
+  revokedAt: zod.z.number().nullable()
+});
 const TotpSetupResultSchema = zod.z.object({
   secret: zod.z.string(),
   otpauthUrl: zod.z.string()
@@ -8034,6 +8201,66 @@ const userManagementCapability = {
       zod.z.object({ userId: zod.z.string(), code: zod.z.string() }),
       zod.z.object({ valid: zod.z.boolean() }),
       { kind: "mutation", access: "view" }
+    ),
+    // ── OAuth account-linking grant ────────────────────────────────
+    //
+    // Core's /oauth2/* endpoints delegate here. Tokens are sso-bridge
+    // JWTs (kinds oauth-code / oauth-access / oauth-refresh) and ALWAYS
+    // carry isAdmin:false — the operator login proves hub control; the
+    // issued token is minimal (device scope only).
+    oauthIssueCode: method(
+      zod.z.object({
+        integrationId: zod.z.string(),
+        userId: zod.z.string(),
+        username: zod.z.string(),
+        scopes: zod.z.array(TokenScopeSchema),
+        redirectUri: zod.z.string(),
+        hubUrl: zod.z.string()
+      }),
+      zod.z.object({ code: zod.z.string() }),
+      { kind: "mutation", access: "create" }
+    ),
+    oauthExchangeCode: method(
+      zod.z.object({ code: zod.z.string(), redirectUri: zod.z.string() }),
+      zod.z.object({
+        accessToken: zod.z.string(),
+        refreshToken: zod.z.string(),
+        expiresIn: zod.z.number()
+      }).nullable(),
+      { kind: "mutation", access: "view" }
+    ),
+    oauthRefresh: method(
+      zod.z.object({ refreshToken: zod.z.string() }),
+      zod.z.object({
+        accessToken: zod.z.string(),
+        refreshToken: zod.z.string(),
+        expiresIn: zod.z.number()
+      }).nullable(),
+      { kind: "mutation", access: "view" }
+    ),
+    oauthVerifyAccessToken: method(
+      zod.z.object({ token: zod.z.string() }),
+      zod.z.object({
+        userId: zod.z.string(),
+        username: zod.z.string(),
+        scopes: zod.z.array(TokenScopeSchema)
+      }).nullable(),
+      { access: "view" }
+    ),
+    // ── OAuth linked-session management (Phase D) ──────────────────
+    //
+    // The admin UI lists active account-linking sessions and revokes
+    // them; revocation makes the linked integration's tokens fail
+    // verification immediately.
+    listOauthSessions: method(
+      zod.z.void(),
+      zod.z.array(OauthSessionSummarySchema),
+      { auth: "admin" }
+    ),
+    revokeOauthSession: method(
+      zod.z.object({ id: zod.z.string() }),
+      zod.z.object({ success: zod.z.boolean() }),
+      { kind: "mutation", auth: "admin", access: "delete" }
     )
   }
 };
@@ -8263,6 +8490,19 @@ const nodesCapability = {
       zod.z.record(zod.z.string(), ClusterAddonStatusEntrySchema),
       { auth: "admin" }
     ),
+    getCapUsageGraph: method(
+      zod.z.object({
+        windowSeconds: zod.z.number().int().positive().max(300).default(60)
+      }),
+      zod.z.array(zod.z.object({
+        callerAddonId: zod.z.string(),
+        providerAddonId: zod.z.string(),
+        capName: zod.z.string(),
+        callsPerMin: zod.z.number(),
+        lastCallAtMs: zod.z.number()
+      })).readonly(),
+      { auth: "admin" }
+    ),
     /**
      * Direct per-node addon listing — calls `$agent.status` on the target
      * node (or returns the hub registry for `nodeId === 'hub'`) and surfaces
@@ -8699,6 +8939,29 @@ const addonsCapability = {
         isActive: zod.z.boolean()
       })).readonly()
     ),
+    /**
+     * Toggle a single collection-cap provider on/off. Generic write-side
+     * counterpart of `listCapabilityProviders` — drives the per-provider
+     * Enable/Disable affordance in admin pages (TURN servers, etc.)
+     * without needing a bespoke orchestrator cap.
+     *
+     * Reaches the hub's `CapabilityRegistry` directly:
+     * `enableCollectionProvider` / `disableCollectionProvider` flip the
+     * registry-level `disabledProviders` set. `getCollectionEntries`
+     * already filters disabled providers out, so a disabled provider
+     * drops out of every collection aggregate immediately. Only valid
+     * for `mode: 'collection'` caps — the registry no-ops + warns for
+     * singletons.
+     */
+    setCapabilityProviderEnabled: method(
+      zod.z.object({
+        capName: zod.z.string().min(1),
+        addonId: zod.z.string().min(1),
+        enabled: zod.z.boolean()
+      }),
+      zod.z.object({ success: zod.z.literal(true) }),
+      { kind: "mutation", auth: "admin" }
+    ),
     /**
      * Live-update one of the framework packages marked
      * `camstack.system: true` (`@camstack/types|kernel|core|sdk|ui-library`).
@@ -8837,7 +9100,6 @@ exports.AudioMetricsHistoryPointSchema = AudioMetricsHistoryPointSchema;
 exports.AudioMetricsHistorySchema = AudioMetricsHistorySchema;
 exports.AudioMetricsSnapshotSchema = AudioMetricsSnapshotSchema;
 exports.AudioPcmChunkSchema = AudioPcmChunkSchema;
-exports.AuthProviderInfoSchema = AuthProviderInfoSchema;
 exports.AuthResultSchema = AuthResultSchema;
 exports.AutoUpdateSettingsSchema = AutoUpdateSettingsSchema;
 exports.AvailableIntegrationTypeSchema = AvailableIntegrationTypeSchema;
@@ -8891,6 +9153,7 @@ exports.DEFAULT_DECODER_HWACCEL_CONFIG = DEFAULT_DECODER_HWACCEL_CONFIG;
 exports.DEVICE_PROFILES = DEVICE_PROFILES;
 exports.DEVICE_SETTINGS_CONTRIBUTION_METHODS = DEVICE_SETTINGS_CONTRIBUTION_METHODS;
 exports.DEVICE_STATUS_METHOD = DEVICE_STATUS_METHOD;
+exports.DecodedAudioChunkSchema = DecodedAudioChunkSchema;
 exports.DecodedFrameSchema = DecodedFrameSchema;
 exports.DecoderAssignmentSchema = DecoderAssignmentSchema;
 exports.DecoderSessionConfigSchema = DecoderSessionConfigSchema;
@@ -8925,6 +9188,8 @@ exports.ExposedResourceSchema = ExposedResourceSchema;
 exports.FeatureManifestSchema = FeatureManifestSchema;
 exports.FeatureProbeStatusSchema = FeatureProbeStatusSchema;
 exports.FinalizeUploadInputSchema = FinalizeUploadInputSchema;
+exports.FrameHandleFormatSchema = FrameHandleFormatSchema;
+exports.FrameHandleSchema = FrameHandleSchema;
 exports.FrameInputSchema = FrameInputSchema;
 exports.GetStreamWithCodecInputSchema = GetStreamWithCodecInputSchema;
 exports.GlobalMetricsSchema = GlobalMetricsSchema;
@@ -8943,6 +9208,8 @@ exports.LogLevelSchema = LogLevelSchema$1;
 exports.LogStreamEntrySchema = LogStreamEntrySchema;
 exports.MODEL_FORMATS = MODEL_FORMATS;
 exports.MediaFileSchema = MediaFileSchema;
+exports.MeshPeerSchema = MeshPeerSchema;
+exports.MeshStatusSchema = MeshStatusSchema;
 exports.MethodAccessSchema = MethodAccessSchema;
 exports.MotionAnalysisResultSchema = MotionAnalysisResultSchema;
 exports.MotionEventSchema = MotionEventSchema;
@@ -8953,6 +9220,9 @@ exports.MotionSourcesSchema = MotionSourcesSchema;
 exports.MotionStatusSchema = MotionStatusSchema;
 exports.MotionTriggerRuntimeStateSchema = MotionTriggerRuntimeStateSchema;
 exports.MotionTriggerStatusSchema = MotionTriggerStatusSchema;
+exports.MotionZoneOptionsSchema = MotionZoneOptionsSchema;
+exports.MotionZonePatchSchema = MotionZonePatchSchema;
+exports.MotionZoneStatusSchema = MotionZoneStatusSchema;
 exports.NativeDetectionSchema = NativeDetectionSchema;
 exports.NativeObjectClassEnum = NativeObjectClassEnum;
 exports.NativeObjectDetectionStatusSchema = NativeObjectDetectionStatusSchema;
@@ -8962,6 +9232,7 @@ exports.NetworkEndpointSchema = NetworkEndpointSchema;
 exports.NotificationHistoryEntrySchema = NotificationHistoryEntrySchema;
 exports.NotificationRuleSchema = NotificationRuleSchema;
 exports.NotificationSchema = NotificationSchema;
+exports.OauthIntegrationDescriptorSchema = OauthIntegrationDescriptorSchema;
 exports.ObjectEventSchema = ObjectEventSchema;
 exports.OrchestratorMetricsSchema = OrchestratorMetricsSchema;
 exports.OsdOverlayKindEnum = OsdOverlayKindEnum;
@@ -8994,11 +9265,10 @@ exports.PtzAutotrackTargetOptionSchema = PtzAutotrackTargetOptionSchema;
 exports.PtzMoveCommandSchema = PtzMoveCommandSchema;
 exports.PtzPositionSchema = PtzPositionSchema;
 exports.PtzPresetSchema = PtzPresetSchema;
+exports.PtzStatusSchema = PtzStatusSchema;
 exports.QueryFilterSchema = QueryFilterSchema;
 exports.ReadChunkInputSchema = ReadChunkInputSchema;
 exports.RegisteredStreamSchema = RegisteredStreamSchema;
-exports.RemoteAccessEndpointSchema = RemoteAccessEndpointSchema;
-exports.RemoteAccessProviderInfoSchema = RemoteAccessProviderInfoSchema;
 exports.ReportMotionInputSchema = ReportMotionInputSchema;
 exports.RtpSourceSchema = RtpSourceSchema;
 exports.RtspRestreamEntrySchema = RtspRestreamEntrySchema;
@@ -9017,6 +9287,7 @@ exports.SettingsPatchSchema = SettingsPatchSchema;
 exports.SettingsRecordSchema = SettingsRecordSchema;
 exports.SettingsSchemaWithValuesSchema = SettingsSchemaWithValuesSchema;
 exports.SettingsUpdateResultSchema = SettingsUpdateResultSchema;
+exports.ShmRingStatsSchema = ShmRingStatsSchema;
 exports.SmtpStatusSchema = SmtpStatusSchema;
 exports.SnapshotImageSchema = SnapshotImageSchema;
 exports.SpatialDetectionSchema = SpatialDetectionSchema;
@@ -9029,8 +9300,18 @@ exports.StorageLocationTypeSchema = StorageLocationTypeSchema;
 exports.StreamFormatSchema = StreamFormatSchema;
 exports.StreamInfoSchema = StreamInfoSchema;
 exports.StreamNetworkStatsSchema = StreamNetworkStatsSchema;
+exports.StreamParamsOptionsSchema = StreamParamsOptionsSchema;
+exports.StreamParamsStatusSchema = StreamParamsStatusSchema;
+exports.StreamProfileConfigSchema = StreamProfileConfigSchema;
+exports.StreamProfileOptionsSchema = StreamProfileOptionsSchema;
+exports.StreamProfilePatchSchema = StreamProfilePatchSchema;
+exports.StreamProfileSchema = StreamProfileSchema;
 exports.StreamSourceEntrySchema = StreamSourceEntrySchema$1;
 exports.StreamSourceSchema = StreamSourceSchema;
+exports.SubscribeAudioChunksInputSchema = SubscribeAudioChunksInputSchema;
+exports.SubscribeAudioChunksResultSchema = SubscribeAudioChunksResultSchema;
+exports.SubscribeFramesInputSchema = SubscribeFramesInputSchema;
+exports.SubscribeFramesResultSchema = SubscribeFramesResultSchema;
 exports.SwitchStatusSchema = SwitchStatusSchema;
 exports.SystemMetricsSchema = SystemMetricsSchema;
 exports.TestConnectionResultSchema = TestConnectionResultSchema;
@@ -9043,7 +9324,6 @@ exports.TopologyServiceSchema = TopologyServiceSchema;
 exports.TrackSchema = TrackSchema;
 exports.TrackStateSchema = TrackStateSchema;
 exports.TrackedDetectionSchema = TrackedDetectionSchema;
-exports.TurnProviderInfoSchema = TurnProviderInfoSchema;
 exports.TurnServerSchema = TurnServerSchema;
 exports.UnexposeInputSchema = UnexposeInputSchema;
 exports.UpdateIntegrationInputSchema = UpdateIntegrationInputSchema;
@@ -9056,6 +9336,7 @@ exports.WebrtcStreamChoiceSchema = WebrtcStreamChoiceSchema;
 exports.WebrtcStreamTargetSchema = WebrtcStreamTargetSchema;
 exports.WidgetHostEnum = WidgetHostEnum;
 exports.WidgetMetadataSchema = WidgetMetadataSchema;
+exports.WidgetRemoteSchema = WidgetRemoteSchema;
 exports.WidgetSizeEnum = WidgetSizeEnum;
 exports.WriteChunkInputSchema = WriteChunkInputSchema;
 exports.YAMNET_TO_MACRO = YAMNET_TO_MACRO;
@@ -9083,7 +9364,6 @@ exports.audioAnalyzerCapability = audioAnalyzerCapability;
 exports.audioCodecCapability = audioCodecCapability;
 exports.audioMetricsCapability = audioMetricsCapability;
 exports.authProviderCapability = authProviderCapability;
-exports.authenticationCapability = authenticationCapability;
 exports.backupCapability = backupCapability;
 exports.batteryCapability = batteryCapability;
 exports.brightnessCapability = brightnessCapability;
@@ -9110,22 +9390,24 @@ exports.getAudioMacroClassIds = getAudioMacroClassIds;
 exports.hydrateSchema = hydrateSchema;
 exports.integrationsCapability = integrationsCapability;
 exports.intercomCapability = intercomCapability;
+exports.isDeviceConfigCap = isDeviceConfigCap;
 exports.localNetworkCapability = localNetworkCapability;
 exports.logDestinationCapability = logDestinationCapability;
 exports.mapAudioLabelToMacro = mapAudioLabelToMacro;
 exports.meshNetworkCapability = meshNetworkCapability;
-exports.meshOrchestratorCapability = meshOrchestratorCapability;
 exports.method = method;
 exports.metricsProviderCapability = metricsProviderCapability;
 exports.motionCapability = motionCapability;
 exports.motionDetectionCapability = motionDetectionCapability;
 exports.motionTriggerCapability = motionTriggerCapability;
+exports.motionZonesCapability = motionZonesCapability;
 exports.mqttBrokerCapability = mqttBrokerCapability;
 exports.nativeObjectDetectionCapability = nativeObjectDetectionCapability;
 exports.networkAccessCapability = networkAccessCapability;
 exports.networkQualityCapability = networkQualityCapability;
 exports.nodesCapability = nodesCapability;
 exports.notificationOutputCapability = notificationOutputCapability;
+exports.oauthIntegrationCapability = oauthIntegrationCapability;
 exports.osdCapability = osdCapability;
 exports.pipelineAnalyticsCapability = pipelineAnalyticsCapability;
 exports.pipelineExecutorCapability = pipelineExecutorCapability;
@@ -9137,7 +9419,6 @@ exports.ptzCapability = ptzCapability;
 exports.rebootCapability = rebootCapability;
 exports.recordingCapability = recordingCapability;
 exports.recordingEngineCapability = recordingEngineCapability;
-exports.remoteAccessCapability = remoteAccessCapability;
 exports.resolveDeviceProfile = resolveDeviceProfile;
 exports.restreamerCapability = restreamerCapability;
 exports.settingsStoreCapability = settingsStoreCapability;
@@ -9148,11 +9429,11 @@ exports.ssoBridgeCapability = ssoBridgeCapability;
 exports.storageCapability = storageCapability;
 exports.storageProviderCapability = storageProviderCapability;
 exports.streamBrokerCapability = streamBrokerCapability;
+exports.streamParamsCapability = streamParamsCapability;
 exports.streamingEngineCapability = streamingEngineCapability;
 exports.switchCapability = switchCapability;
 exports.systemCapability = systemCapability;
 exports.toastCapability = toastCapability;
-exports.turnOrchestratorCapability = turnOrchestratorCapability;
 exports.turnProviderCapability = turnProviderCapability;
 exports.userManagementCapability = userManagementCapability;
 exports.userPasskeysCapability = userPasskeysCapability;
@@ -9162,4 +9443,4 @@ exports.webrtcSessionCapability = webrtcSessionCapability;
 exports.zoneAnalyticsCapability = zoneAnalyticsCapability;
 exports.zoneRulesCapability = zoneRulesCapability;
 exports.zonesCapability = zonesCapability;
-//# sourceMappingURL=index-DS7418lf.js.map
+//# sourceMappingURL=index-BblD92Si.js.map