camstack 1.2.177 → 1.2.179

package/dist/{launcher-5VFRFS7P.js → launcher-ER4ORH3G.js}

@@ -24024,9 +24024,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-DeGPW01G.js
-var require_dist_DeGPW01G = __commonJS({
-  "../system/dist/dist-DeGPW01G.js"(exports) {
+// ../system/dist/dist-DePB7uwU.js
+var require_dist_DePB7uwU = __commonJS({
+  "../system/dist/dist-DePB7uwU.js"(exports) {
     "use strict";
     var zod = require_zod();
     __require("crypto");
@@ -29287,11 +29287,11 @@ var require_dist_DeGPW01G = __commonJS({
       /** Quantization axis. Omit ⇒ the fp32 base build. */
       precision: zod.z.enum(["fp32", "int8"]).optional(),
       /**
-      * Speed-optimization axis. Omit ⇒ the standard build. `fast` marks a
-      * latency-optimized export (e.g. ReLU-activation variant) — the slot the
-      * future performance variants plug into.
+      * Training / latency-variant axis. Omit ⇒ the standard build. `test` marks
+      * an alternate training of the same family (Scrypted `relu_test`); chip
+      * label is "Test".
       */
-      optimization: zod.z.enum(["standard", "fast"]).optional(),
+      optimization: zod.z.enum(["standard", "test"]).optional(),
       /**
       * Input-resolution axis (square input side, px). Omit ⇒ the family's native
       * resolution (640 for yolo26). Reduced-input builds (320 / 256) are a big,
@@ -37878,7 +37878,7 @@ var require_dist_DeGPW01G = __commonJS({
       mode: "singleton",
       internal: true,
       methods: { distributeModel: method(zod.z.object({
-        nodeId: zod.z.string(),
+        targetNodeId: zod.z.string(),
         modelId: zod.z.string(),
         format: zod.z.enum(MODEL_FORMATS),
         entry: ModelCatalogEntrySchema
@@ -39852,6 +39852,7 @@ var require_dist_DeGPW01G = __commonJS({
       "detection-blind",
       "nodes",
       "addons",
+      "addon-updates",
       "updates"
     ]);
     var NcStateSummaryPreviewSectionSchema = zod.z.object({
@@ -40238,7 +40239,19 @@ var require_dist_DeGPW01G = __commonJS({
       * When this mode may be armed. Absent / null = always allowed (same as a
       * rule with no `schedule`). Evaluated with {@link isScheduleActive}.
       */
-      schedule: NcScheduleSchema.optional()
+      schedule: NcScheduleSchema.optional(),
+      /**
+      * D706: while this mode's ENTRY DELAY runs, do the alarm rules' own pushes go out (as an
+      * intrusion naming the locations)? Absent = false — the entry-delay notification is the
+      * only one, and the matches ride the triggered notification's mosaic (D705).
+      */
+      notifyDuringEntryDelay: zod.z.boolean().optional(),
+      /**
+      * D706: notify "watched again" when a sensor this arm bypassed closes and opens again.
+      * Absent = false (logged, not sent). Even when true it is not sent when that same sensor
+      * is the one that starts the entry delay — the entry-delay notification already names it.
+      */
+      notifySensorRewatched: zod.z.boolean().optional()
     });
     var NcAlarmModeDelaysListSchema = zod.z.array(NcAlarmModeDelaysSchema).max(8).refine(uniqueModes, { message: "modeDelays: at most one entry per arm mode" });
     var NcAlarmModeDelaysEditSchema = zod.z.object({
@@ -40248,7 +40261,11 @@ var require_dist_DeGPW01G = __commonJS({
       triggeredDurationSec: NcAlarmTriggeredSecSchema.nullable().optional(),
       postTriggeredAction: NcAlarmPostTriggeredActionSchema.nullable().optional(),
       /** Set a schedule, or `null` to clear (mode always allowed again). */
-      schedule: NcScheduleSchema.nullable().optional()
+      schedule: NcScheduleSchema.nullable().optional(),
+      /** D706: set the switch, or `null` to clear it (back to the default, false). */
+      notifyDuringEntryDelay: zod.z.boolean().nullable().optional(),
+      /** D706: set the switch, or `null` to clear it (back to the default, false). */
+      notifySensorRewatched: zod.z.boolean().nullable().optional()
     });
     var NcAlarmModeDelaysEditListSchema = zod.z.array(NcAlarmModeDelaysEditSchema).max(8).refine(uniqueModes, { message: "modeDelays: at most one edit per arm mode" });
     var NcAlarmNonBlockingEditSchema = zod.z.object({
@@ -41088,39 +41105,19 @@ var require_dist_DeGPW01G = __commonJS({
       label: "Face recognition model",
       defaultModelId: "auraface-r100",
       indexName: "the enrolled face gallery",
-      options: [
-        {
-          id: "auraface-r100",
-          label: "AuraFace R100"
-        },
-        {
-          id: "arcface-r100",
-          label: "ArcFace (ResNet34)"
-        },
-        {
-          id: "inception-resnet-v1",
-          label: "Inception ResNet V1"
-        }
-      ]
+      options: [{
+        id: "auraface-r100",
+        label: "AuraFace R100"
+      }]
     }, {
       stepId: "clip-embedding",
       label: "Semantic search model",
-      defaultModelId: "mobileclip-s1",
+      defaultModelId: "siglip2-b16-224",
       indexName: "the object semantic-search index",
-      options: [
-        {
-          id: "mobileclip-s1",
-          label: "MobileCLIP S1"
-        },
-        {
-          id: "mobileclip-s2",
-          label: "MobileCLIP S2"
-        },
-        {
-          id: "siglip2-b16-224",
-          label: "SigLIP2 B/16 (Apache-2.0)"
-        }
-      ]
+      options: [{
+        id: "siglip2-b16-224",
+        label: "SigLIP2 B/16 (Apache-2.0)"
+      }]
     }].map((s) => [s.stepId, s.defaultModelId])));
     var CLUSTER_STEP_SETTING_FIELDS = [{
       stepId: "face-embedding",
@@ -44238,6 +44235,11 @@ var require_dist_DeGPW01G = __commonJS({
       "analyzer",
       "device-activity"
     ]);
+    var SessionTriggerSchema = zod.z.object({
+      source: MotionSourceEnum,
+      triggeredBy: MotionTriggeredBySchema,
+      sensorName: zod.z.string().optional()
+    });
     var MotionSourcesSchema = zod.z.array(MotionSourceEnum);
     var MOTION_SOURCE_LABELS = {
       analyzer: "Frame-diff Analyzer (motion addon)",
@@ -44385,6 +44387,14 @@ var require_dist_DeGPW01G = __commonJS({
       */
       motionSources: MotionSourcesSchema.default(["analyzer"]),
       /**
+      * What opened this attach, on a SESSION attach only (see
+      * {@link SessionTriggerSchema}). OPTIONAL with no default: absent on a
+      * standing attach, an occupancy burst, a re-dispatch with no motion event
+      * behind it, and every attach from an orchestrator older than the field — the
+      * runner then names no source on the phase event.
+      */
+      sessionTrigger: SessionTriggerSchema.optional(),
+      /**
       * WHICH root detector runs for this camera. The detection counterpart of
       * {@link motionSources}, same shape and same discipline: a per-camera list
       * of sources the system understands, vendor-agnostic, owned here.
@@ -48125,6 +48135,36 @@ var require_dist_DeGPW01G = __commonJS({
         })
       }
     };
+    var CAMSTACK_APP_LINK_ORIGIN = "https://camstack.zentik.app";
+    function toAppLinkHubOrigin(baseUrl) {
+      let parsed;
+      try {
+        parsed = new URL(baseUrl);
+      } catch {
+        return null;
+      }
+      if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+      if (parsed.username !== "" || parsed.password !== "") return null;
+      if (parsed.hostname === "") return null;
+      return parsed.origin;
+    }
+    function pickAppLinkHub(endpoints) {
+      const rank2 = (e) => {
+        if (e.kind !== "public" || !e.baseUrl.startsWith("https://")) return null;
+        if (e.interfaceKind === "public") return 0;
+        if (e.interfaceKind === "vpn") return 1;
+        return null;
+      };
+      return endpoints.flatMap((e) => {
+        const r = rank2(e);
+        const origin = toAppLinkHubOrigin(e.baseUrl);
+        return r === null || origin === null ? [] : [{
+          r,
+          p: e.priority,
+          origin
+        }];
+      }).toSorted((a, b) => a.r - b.r || a.p - b.p)[0]?.origin ?? null;
+    }
     var webrtcClientHintsSchema = zod.z.object({
       viewportWidth: zod.z.number().int().positive().optional(),
       viewportHeight: zod.z.number().int().positive().optional(),
@@ -51967,7 +52007,7 @@ var require_dist_DeGPW01G = __commonJS({
       name: zod.z.string(),
       family: zod.z.enum(["IPv4", "IPv6"]),
       address: zod.z.string(),
-      /** CIDR shorthand (e.g. `192.168.x.x/24`). Empty when OS doesn't expose. */
+      /** CIDR shorthand (e.g. `192.168.10.10/24`). Empty when OS doesn't expose. */
       cidr: zod.z.string(),
       /** OS netmask. Stable across calls so the SDK can hash on it. */
       netmask: zod.z.string(),
@@ -52016,7 +52056,8 @@ var require_dist_DeGPW01G = __commonJS({
         "lan-ipv4",
         "lan-ipv6",
         "public",
-        "loopback"
+        "loopback",
+        "app-link"
       ]),
       /**
       * Originating-interface kind — `lan`/`wifi`/`docker`/`vpn`/`other`/
@@ -52081,8 +52122,20 @@ var require_dist_DeGPW01G = __commonJS({
     var NotificationEndpointSchema = zod.z.object({
       /** The operator's explicit choice, or null for AUTO. */
       baseUrl: zod.z.string().nullable(),
-      /** What the ranking currently resolves to (null when nothing is reachable). */
-      resolved: zod.z.string().nullable()
+      /**
+      * The effective flagged address: the explicit choice, else (AUTO) the
+      * CamStack app link `https://camstack.zentik.app` (D709). A pre-D709 hub
+      * answered the public tunnel / mesh here, or null.
+      */
+      resolved: zod.z.string().nullable(),
+      /**
+      * The hub origin an app link carries as `hub=` (D709): the hub's best
+      * public HTTPS address — the tunnel, then the mesh (Tailscale MagicDNS) —
+      * picked from this cap's own palette by `pickAppLinkHub`. `null` when the
+      * hub advertises neither; the app link is then minted without `hub=`.
+      * Absent on a pre-D709 hub.
+      */
+      appLinkHub: zod.z.string().nullable()
     });
     var ViewerEndpointsSchema = zod.z.object({
       /** The operator's explicit race set, or empty for AUTO. */
@@ -52146,7 +52199,7 @@ var require_dist_DeGPW01G = __commonJS({
         * every client a second authority on a socket only the hub binds. A viewer
         * configured with a port-less public URL (`https://camstack.example.top`)
         * infers 443 from the scheme, asks with 443, and was handed
-        * `https://192.168.x.x:443` for a hub listening on 4443. That candidate
+        * `https://192.168.10.9:443` for a hub listening on 4443. That candidate
         * cannot ever answer, and losing its race reads in the log exactly like
         * "the LAN was tried and it was slower" — so an operator sitting on his own
         * WiFi stayed on the public tunnel for weeks, with the LAN candidate born
@@ -52179,13 +52232,21 @@ var require_dist_DeGPW01G = __commonJS({
           *  Pass `'https'` when the caller is itself loaded over HTTPS
           *  to avoid mixed-content blocks in the browser. The public
           *  tunnel always emits `https://` regardless. */
-          scheme: zod.z.enum(["http", "https"]).optional()
+          scheme: zod.z.enum(["http", "https"]).optional(),
+          /** Append the CamStack app link entry (`kind: 'app-link'`, D709) —
+          *  an address notification links can be flagged with, not a hub
+          *  route. Default `false`: racers and rankers never see it. */
+          includeAppLink: zod.z.boolean().optional()
         }), GetConnectionEndpointsResultSchema),
         /**
-        * The endpoint OUTBOUND artifacts must be addressed by — notification
-        * attachment links and deep links. `baseUrl: null` means AUTO: the first
-        * public candidate (a configured origin, then a connected tunnel, then the
-        * LAN), never loopback.
+        * The address notification links are flagged with. `baseUrl: null` means
+        * AUTO, which is the CamStack app link (D709): viewer taps go through
+        * `https://camstack.zentik.app/…?hub=<appLinkHub>` and open the app. Any
+        * hub address the palette lists can be flagged instead; then viewer taps,
+        * attachment links and action buttons all use it. Signed media and
+        * buttons never use the app link — with it flagged (or AUTO) they keep
+        * the ranked hub ladder (a configured origin, a connected tunnel, then
+        * the LAN), never loopback.
         *
         * Why an explicit marker: the automatic ranking cannot know which of
         * several reachable addresses the RECIPIENT can actually open. A link is
@@ -52544,7 +52605,7 @@ var require_dist_DeGPW01G = __commonJS({
       tags: zod.z.array(zod.z.string()).readonly(),
       /** True when the peer advertises itself as an exit-node candidate. */
       exitNodeOption: zod.z.boolean(),
-      /** Subnet routes the peer advertises (e.g. `["192.168.x.x/24"]`). */
+      /** Subnet routes the peer advertises (e.g. `["192.168.10.0/24"]`). */
       advertisedRoutes: zod.z.array(zod.z.string()).readonly(),
       /** Owner account login (e.g. `foo@example.com`). Null for tagged peers. */
       userLogin: zod.z.string().nullable(),
@@ -53693,7 +53754,13 @@ var require_dist_DeGPW01G = __commonJS({
       */
       availablePositions: zod.z.array(OsdPositionEnum).readonly(),
       /** Firmware does not allow editing the `text` field (e.g. timestamp). */
-      readOnly: zod.z.boolean().optional()
+      readOnly: zod.z.boolean().optional(),
+      /**
+      * Firmware text ceiling for this overlay. Absent = no known limit.
+      * The OSD manager truncates here on every write — never stores its own
+      * copy on the binding.
+      */
+      maxCharacters: zod.z.number().int().positive().optional()
     });
     var OsdStatusSchema = zod.z.object({ overlays: zod.z.array(OsdOverlaySchema).readonly() });
     var OsdOverlayPatchSchema = zod.z.object({
@@ -53781,7 +53848,9 @@ var require_dist_DeGPW01G = __commonJS({
       valuePath: zod.z.string().min(1).max(64),
       /** Convert TO this unit at render (`tryConvertUnit`). Absent = source unit. */
       displayUnit: zod.z.string().max(16).optional(),
-      maxDecimals: zod.z.number().int().min(0).max(4).default(1)
+      maxDecimals: zod.z.number().int().min(0).max(4).default(1),
+      /** Raw value → display text (same shape as slot binding). Empty string hides. */
+      valueMap: zod.z.record(zod.z.string(), zod.z.string()).optional()
     });
     var OsdNamedTemplateSchema = zod.z.object({
       id: zod.z.string().min(1).max(64),
@@ -53826,18 +53895,11 @@ var require_dist_DeGPW01G = __commonJS({
       source: OsdSourceSchema,
       /** `${value}` and `${unit}` are substituted; every occurrence. */
       template: zod.z.string().max(96).default("${value}"),
-      /** Truncate with an ellipsis past this length. Absent = no limit. */
-      maxCharacters: zod.z.number().int().min(4).max(64).optional(),
       /**
       * Decimal places for a numeric value. `0` yields an integer — the
       * documented workaround for firmwares that reject `.` in overlay text.
       */
       maxDecimals: zod.z.number().int().min(0).max(4).default(1),
-      /**
-      * Appended via `${unit}` when no unit conversion produces a label.
-      * Prefer `source.displayUnit` for converted device-state values.
-      */
-      unitLabel: zod.z.string().max(8).optional(),
       /** Raw value → display text, e.g. `{"true":"MOTION","false":""}`. */
       valueMap: zod.z.record(zod.z.string(), zod.z.string()).optional(),
       /** Time windows in which the slot is shown. Absent = always. */
@@ -53846,9 +53908,7 @@ var require_dist_DeGPW01G = __commonJS({
       * Display gate, in the notification centre's condition vocabulary.
       * Only the keys reported by `getConditionSupport` are accepted.
       */
-      conditions: NcConditionsSchema.optional(),
-      /** Rendered when the gate is closed or the value unreadable. Empty = hide. */
-      fallbackText: zod.z.string().max(64).default("")
+      conditions: NcConditionsSchema.optional()
     });
     var OsdSlotViewSchema = zod.z.object({
       slotId: zod.z.string(),
@@ -72213,12 +72273,14 @@ var require_dist_DeGPW01G = __commonJS({
       {
         id: "addons",
         family: "system",
-        label: "Addons",
-        kinds: [
-          "addon-crash-loop",
-          "addon-update-available",
-          "addon-updated"
-        ]
+        label: "Addons stopped",
+        kinds: ["addon-crash-loop"]
+      },
+      {
+        id: "addon-updates",
+        family: "system",
+        label: "Addon updates",
+        kinds: ["addon-update-available", "addon-updated"]
       },
       {
         id: "updates",
@@ -72348,13 +72410,15 @@ var require_dist_DeGPW01G = __commonJS({
       },
       {
         name: "summaryAddons",
-        label: "Summary: addons",
-        example: "@camstack/addon-recorder 1.2.3 \u2192 1.2.4",
-        kinds: [
-          "addon-crash-loop",
-          "addon-update-available",
-          "addon-updated"
-        ]
+        label: "Summary: addons stopped",
+        example: "hub \u2014 recorder stopped after repeated crashes",
+        kinds: ["addon-crash-loop"]
+      },
+      {
+        name: "summaryAddonUpdates",
+        label: "Summary: addon updates",
+        example: "hub:\n\u2022 @camstack/addon-recorder 1.2.3 \u2192 1.2.4",
+        kinds: ["addon-update-available", "addon-updated"]
       },
       {
         name: "summaryUpdates",
@@ -72438,6 +72502,7 @@ var require_dist_DeGPW01G = __commonJS({
       [...RULE_BODY_ONLY],
       [...RULE_TEXT],
       ([...RULE_TEXT], [...DEVICE_EVENTS]),
+      ([...RULE_TEXT], [...COMBINED_ALARM]),
       ([...RULE_TEXT], [...DEVICE_EVENTS]),
       ([...RULE_TEXT], [...BATTERY, ...CONSUMABLE]),
       ([...RULE_TEXT], [...CONSUMABLE]),
@@ -72478,6 +72543,8 @@ var require_dist_DeGPW01G = __commonJS({
       [...RULE_TEXT],
       [...RULE_TEXT],
       [...RULE_TEXT],
+      [...RULE_TEXT],
+      [...RULE_TEXT],
       ...STATE_SUMMARY_VARS
     ];
     var TimelapseTemplateSchema = zod.z.object({
@@ -72887,6 +72954,12 @@ var require_dist_DeGPW01G = __commonJS({
         return CAMERA_SWITCH_ORDER;
       }
     });
+    Object.defineProperty(exports, "CAMSTACK_APP_LINK_ORIGIN", {
+      enumerable: true,
+      get: function() {
+        return CAMSTACK_APP_LINK_ORIGIN;
+      }
+    });
     Object.defineProperty(exports, "CAP_NAMES_WITH_STATUS", {
       enumerable: true,
       get: function() {
@@ -73721,6 +73794,12 @@ var require_dist_DeGPW01G = __commonJS({
         return parseStreamParamsFormPatch;
       }
     });
+    Object.defineProperty(exports, "pickAppLinkHub", {
+      enumerable: true,
+      get: function() {
+        return pickAppLinkHub;
+      }
+    });
     Object.defineProperty(exports, "planComposition", {
       enumerable: true,
       get: function() {
@@ -73949,7 +74028,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DeGPW01G();
+    var require_dist10 = require_dist_DePB7uwU();
     function deviceLabelFromEventData(data) {
       const name = stringNonEmpty(data["name"]) ?? stringNonEmpty(data["deviceName"]);
       if (name !== void 0) return name;
@@ -74773,7 +74852,7 @@ var require_calendars_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DeGPW01G();
+    var require_dist10 = require_dist_DePB7uwU();
     var require_settle_sources = require_settle_sources_Bhsy57y();
     var zod = require_zod();
     var CALENDAR_COLOR_PALETTE = [
@@ -74987,11 +75066,11 @@ var require_calendars = __commonJS({
   }
 });
 
-// ../system/dist/composition-sources-CUfM-BYp.js
-var require_composition_sources_CUfM_BYp = __commonJS({
-  "../system/dist/composition-sources-CUfM-BYp.js"(exports) {
+// ../system/dist/composition-sources-0nuWOdNd.js
+var require_composition_sources_0nuWOdNd = __commonJS({
+  "../system/dist/composition-sources-0nuWOdNd.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_DeGPW01G();
+    var require_dist10 = require_dist_DePB7uwU();
     function normalizedNativeOwner(owner) {
       const trimmed = owner?.trim();
       return trimmed ? trimmed : null;
@@ -75106,8 +75185,8 @@ var require_composer_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DeGPW01G();
-    var require_composition_sources = require_composition_sources_CUfM_BYp();
+    var require_dist10 = require_dist_DePB7uwU();
+    var require_composition_sources = require_composition_sources_0nuWOdNd();
     var zod = require_zod();
     function isRecord$2(value) {
       return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -76157,6 +76236,10 @@ var require_composer_addon = __commonJS({
         value: outcome.value
       };
     }
+    function hasObservedRoseLevel(memory) {
+      for (const call of memory.calls.values()) if (call.kind === "rose" && call.priorLevel !== void 0) return true;
+      return false;
+    }
     function strictFiniteAdvance(previous, next) {
       return typeof next === "number" && Number.isFinite(next) && (previous === null || next > previous);
     }
@@ -76196,7 +76279,7 @@ var require_composer_addon = __commonJS({
           const record = next.get(key);
           if (record === void 0) continue;
           const candidateMemory = require_dist10.cloneStatefulExpressionMemory(record.expressionMemory);
-          if (record.outcome?.state === "unavailable") require_dist10.disarmRoseMemory(candidateMemory);
+          if (record.outcome?.state === "unavailable" && hasObservedRoseLevel(record.expressionMemory)) require_dist10.disarmRoseMemory(candidateMemory);
           const outcome = require_dist10.evaluateCompositionField({
             source: record.plan.source,
             read,
@@ -78890,7 +78973,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DeGPW01G();
+    var require_dist10 = require_dist_DePB7uwU();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -82959,8 +83042,8 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DeGPW01G();
-    var require_composition_sources = require_composition_sources_CUfM_BYp();
+    var require_dist10 = require_dist_DePB7uwU();
+    var require_composition_sources = require_composition_sources_0nuWOdNd();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var node_fs_promises = __require("fs/promises");
@@ -84832,11 +84915,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-D8G5o4Fc.js
-var require_retired_settings_keys_D8G5o4Fc = __commonJS({
-  "../system/dist/retired-settings-keys-D8G5o4Fc.js"(exports) {
+// ../system/dist/retired-settings-keys-BTKZdPn6.js
+var require_retired_settings_keys_BTKZdPn6 = __commonJS({
+  "../system/dist/retired-settings-keys-BTKZdPn6.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_DeGPW01G();
+    var require_dist10 = require_dist_DePB7uwU();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -85125,8 +85208,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DeGPW01G();
-    var require_retired_settings_keys = require_retired_settings_keys_D8G5o4Fc();
+    var require_dist10 = require_dist_DePB7uwU();
+    var require_retired_settings_keys = require_retired_settings_keys_BTKZdPn6();
     var zod = require_zod();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
@@ -93321,7 +93404,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DeGPW01G();
+    var require_dist10 = require_dist_DePB7uwU();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -93458,7 +93541,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DeGPW01G();
+    var require_dist10 = require_dist_DePB7uwU();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -93674,7 +93757,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DeGPW01G();
+    var require_dist10 = require_dist_DePB7uwU();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -101528,7 +101611,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DeGPW01G();
+    var require_dist10 = require_dist_DePB7uwU();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -102231,7 +102314,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DeGPW01G();
+    var require_dist10 = require_dist_DePB7uwU();
     var require_proc_stat = require_proc_stat_DL_WUOhl();
     var node_fs_promises = __require("fs/promises");
     var node_os = __require("os");
@@ -105071,7 +105154,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DeGPW01G();
+    var require_dist10 = require_dist_DePB7uwU();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -106353,8 +106436,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DeGPW01G();
-    var require_retired_settings_keys = require_retired_settings_keys_D8G5o4Fc();
+    var require_dist10 = require_dist_DePB7uwU();
+    var require_retired_settings_keys = require_retired_settings_keys_BTKZdPn6();
     var require_sqlite_snapshot_protocol = require_sqlite_snapshot_protocol_B9OndqZv();
     var require_wal_checkpoint_policy = require_wal_checkpoint_policy_d2z2qPqx();
     var node_crypto = __require("crypto");
@@ -109550,7 +109633,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DeGPW01G();
+    var require_dist10 = require_dist_DePB7uwU();
     var require_hub_cap_forward = require_hub_cap_forward_DmHNjbB0();
     var zod = require_zod();
     var node_crypto = __require("crypto");
@@ -113277,7 +113360,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DeGPW01G();
+    var require_dist10 = require_dist_DePB7uwU();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -131338,7 +131421,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DeGPW01G();
+    var require_dist10 = require_dist_DePB7uwU();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -148227,8 +148310,7 @@ var require_addon = __commonJS({
         "setSlotBinding": { "binding": { "__nested__": {
           "enabled": true,
           "template": "${value}",
-          "maxDecimals": 1,
-          "fallbackText": ""
+          "maxDecimals": 1
         } } },
         "upsertTemplate": { "template": { "__nested__": {
           "bindings": [],
@@ -155004,12 +155086,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/child-cap-dispatch-B_0-zpI6.js
-var require_child_cap_dispatch_B_0_zpI6 = __commonJS({
-  "../system/dist/child-cap-dispatch-B_0-zpI6.js"(exports) {
+// ../system/dist/child-cap-dispatch-CRqYKHAb.js
+var require_child_cap_dispatch_CRqYKHAb = __commonJS({
+  "../system/dist/child-cap-dispatch-CRqYKHAb.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DeGPW01G();
+    var require_dist10 = require_dist_DePB7uwU();
     var require_proc_stat = require_proc_stat_DL_WUOhl();
     require_hub_cap_forward_DmHNjbB0();
     var node_crypto = __require("crypto");
@@ -169548,7 +169630,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DeGPW01G();
+    var require_dist10 = require_dist_DePB7uwU();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_builtins_calendars_calendars_addon = require_calendars_addon();
@@ -169579,7 +169661,7 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_event_loop_stall_monitor = require_event_loop_stall_monitor_ey4mbofz();
     var require_tls$1 = require_tls_ue_Xefmv();
-    var require_child_cap_dispatch = require_child_cap_dispatch_B_0_zpI6();
+    var require_child_cap_dispatch = require_child_cap_dispatch_CRqYKHAb();
     var require_resource_monitor = require_resource_monitor_BgWGRxN5();
     var require_custom_action_registry = require_custom_action_registry_acBY3mHA();
     var zod = require_zod();
@@ -169894,6 +169976,29 @@ var require_dist3 = __commonJS({
     function canServeDataPlane(state) {
       return state.hasEntry && state.isForked && state.childKnown;
     }
+    function edgeOwnedResponseHeaders(upRes, clientRes) {
+      const out = {};
+      for (const [name2, value] of Object.entries(upRes.headers)) {
+        if (value === void 0) continue;
+        const lower = name2.toLowerCase();
+        if (lower.startsWith("access-control-")) continue;
+        out[lower] = value;
+      }
+      const edgeVary = clientRes.getHeader("vary");
+      const upVary = out["vary"];
+      if (typeof edgeVary === "string" && edgeVary.length > 0 && upVary !== void 0) {
+        const tokens = /* @__PURE__ */ new Set();
+        const merged = [];
+        for (const part of [edgeVary, String(upVary)].join(",").split(",")) {
+          const token2 = part.trim();
+          if (token2.length === 0 || tokens.has(token2.toLowerCase())) continue;
+          tokens.add(token2.toLowerCase());
+          merged.push(token2);
+        }
+        out["vary"] = merged.join(", ");
+      }
+      return out;
+    }
     function proxyToUpstream(opts) {
       const { baseUrl, secret, upstreamPath, clientReq, clientRes, replayBody } = opts;
       const base = new URL(baseUrl);
@@ -169911,17 +170016,11 @@ var require_dist3 = __commonJS({
         path: upstreamPath,
         headers
       }, (upRes) => {
-        clientRes.writeHead(upRes.statusCode ?? 502, {
-          "access-control-allow-origin": "*",
-          ...upRes.headers
-        });
+        clientRes.writeHead(upRes.statusCode ?? 502, edgeOwnedResponseHeaders(upRes, clientRes));
         upRes.pipe(clientRes);
       });
       upstream.on("error", (err) => {
-        if (!clientRes.headersSent) clientRes.writeHead(502, {
-          "content-type": "application/json",
-          "access-control-allow-origin": "*"
-        });
+        if (!clientRes.headersSent) clientRes.writeHead(502, { "content-type": "application/json" });
         clientRes.end(JSON.stringify({
           error: "data-plane upstream error",
           detail: String(err)
@@ -176159,10 +176258,19 @@ var require_dist3 = __commonJS({
       };
     }
     var DEFAULT_DATA_PATH = "camstack-data";
+    var originListSchema = zod.z.preprocess((value) => typeof value === "string" ? value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) : value, zod.z.array(zod.z.string()));
     var serverSchema = zod.z.object({
       port: zod.z.number().default(4443),
       host: zod.z.string().default("0.0.0.0"),
-      dataPath: zod.z.string().default(DEFAULT_DATA_PATH)
+      dataPath: zod.z.string().default(DEFAULT_DATA_PATH),
+      /**
+      * EXTRA browser origins allowed to call this hub cross-origin (D707), on
+      * top of the built-ins: the hub's own origin, the hosted viewer PWA and the
+      * native app's opaque `null` origin. Bootstrap-owned on purpose — widening
+      * who may read hub responses in a browser is a security decision, and the
+      * policy is live from the first request, before the settings store exists.
+      */
+      corsOrigins: originListSchema.default([])
     });
     var authSchema = zod.z.object({
       jwtSecret: zod.z.string().nullable().default(null),
@@ -178632,7 +178740,8 @@ var require_dist3 = __commonJS({
       CAMSTACK_DATA: "server.dataPath",
       CAMSTACK_JWT_SECRET: "auth.jwtSecret",
       CAMSTACK_ADMIN_USER: "auth.adminUsername",
-      CAMSTACK_ADMIN_PASS: "auth.adminPassword"
+      CAMSTACK_ADMIN_PASS: "auth.adminPassword",
+      CAMSTACK_CORS_ORIGINS: "server.corsOrigins"
     };
     function loadBootstrapConfig(configPath) {
       const merged = applyEnvOverrides((0, _camstack_types_addon.asJsonObject)(loadYaml(configPath)) ?? {});
@@ -254255,7 +254364,7 @@ var require_dist4 = __commonJS({
     }
     function variantLabel(precision, optimization) {
       const parts = [];
-      if (optimization === "fast") parts.push("Fast");
+      if (optimization === "test") parts.push("Test");
       parts.push(precision === "int8" ? "Int8" : "Standard");
       return parts.join(" \xB7 ");
     }
@@ -254305,7 +254414,7 @@ var require_dist4 = __commonJS({
             };
           }).toSorted((a, b) => {
             if (a.resolution !== b.resolution) return (b.resolution ?? Infinity) - (a.resolution ?? Infinity);
-            if (a.optimization !== b.optimization) return a.optimization === "fast" ? 1 : -1;
+            if (a.optimization !== b.optimization) return a.optimization === "test" ? 1 : -1;
             return PRECISION_ORDER.indexOf(a.precision) - PRECISION_ORDER.indexOf(b.precision);
           });
           const base = options.find((o) => o.precision === "fp32" && o.optimization === "standard") ?? options[0];
@@ -254441,11 +254550,11 @@ var require_dist4 = __commonJS({
       /** Quantization axis. Omit ⇒ the fp32 base build. */
       precision: zod.z.enum(["fp32", "int8"]).optional(),
       /**
-      * Speed-optimization axis. Omit ⇒ the standard build. `fast` marks a
-      * latency-optimized export (e.g. ReLU-activation variant) — the slot the
-      * future performance variants plug into.
+      * Training / latency-variant axis. Omit ⇒ the standard build. `test` marks
+      * an alternate training of the same family (Scrypted `relu_test`); chip
+      * label is "Test".
       */
-      optimization: zod.z.enum(["standard", "fast"]).optional(),
+      optimization: zod.z.enum(["standard", "test"]).optional(),
       /**
       * Input-resolution axis (square input side, px). Omit ⇒ the family's native
       * resolution (640 for yolo26). Reduced-input builds (320 / 256) are a big,
@@ -263788,7 +263897,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       }) }
     };
     var ModelDistributeInputSchema = zod.z.object({
-      nodeId: zod.z.string(),
+      targetNodeId: zod.z.string(),
       modelId: zod.z.string(),
       format: zod.z.enum(MODEL_FORMATS),
       entry: ModelCatalogEntrySchema
@@ -266149,6 +266258,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "detection-blind",
       "nodes",
       "addons",
+      "addon-updates",
       "updates"
     ]);
     var NcStateSummaryPreviewSectionSchema = zod.z.object({
@@ -267071,7 +267181,19 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * When this mode may be armed. Absent / null = always allowed (same as a
       * rule with no `schedule`). Evaluated with {@link isScheduleActive}.
       */
-      schedule: NcScheduleSchema.optional()
+      schedule: NcScheduleSchema.optional(),
+      /**
+      * D706: while this mode's ENTRY DELAY runs, do the alarm rules' own pushes go out (as an
+      * intrusion naming the locations)? Absent = false — the entry-delay notification is the
+      * only one, and the matches ride the triggered notification's mosaic (D705).
+      */
+      notifyDuringEntryDelay: zod.z.boolean().optional(),
+      /**
+      * D706: notify "watched again" when a sensor this arm bypassed closes and opens again.
+      * Absent = false (logged, not sent). Even when true it is not sent when that same sensor
+      * is the one that starts the entry delay — the entry-delay notification already names it.
+      */
+      notifySensorRewatched: zod.z.boolean().optional()
     });
     var NcAlarmModeDelaysListSchema = zod.z.array(NcAlarmModeDelaysSchema).max(8).refine(uniqueModes, { message: "modeDelays: at most one entry per arm mode" });
     var NcAlarmModeDelaysEditSchema = zod.z.object({
@@ -267081,7 +267203,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       triggeredDurationSec: NcAlarmTriggeredSecSchema.nullable().optional(),
       postTriggeredAction: NcAlarmPostTriggeredActionSchema.nullable().optional(),
       /** Set a schedule, or `null` to clear (mode always allowed again). */
-      schedule: NcScheduleSchema.nullable().optional()
+      schedule: NcScheduleSchema.nullable().optional(),
+      /** D706: set the switch, or `null` to clear it (back to the default, false). */
+      notifyDuringEntryDelay: zod.z.boolean().nullable().optional(),
+      /** D706: set the switch, or `null` to clear it (back to the default, false). */
+      notifySensorRewatched: zod.z.boolean().nullable().optional()
     });
     var NcAlarmModeDelaysEditListSchema = zod.z.array(NcAlarmModeDelaysEditSchema).max(8).refine(uniqueModes, { message: "modeDelays: at most one edit per arm mode" });
     var NcAlarmNonBlockingEditSchema = zod.z.object({
@@ -267939,39 +268065,19 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       label: "Face recognition model",
       defaultModelId: "auraface-r100",
       indexName: "the enrolled face gallery",
-      options: [
-        {
-          id: "auraface-r100",
-          label: "AuraFace R100"
-        },
-        {
-          id: "arcface-r100",
-          label: "ArcFace (ResNet34)"
-        },
-        {
-          id: "inception-resnet-v1",
-          label: "Inception ResNet V1"
-        }
-      ]
+      options: [{
+        id: "auraface-r100",
+        label: "AuraFace R100"
+      }]
     }, {
       stepId: "clip-embedding",
       label: "Semantic search model",
-      defaultModelId: "mobileclip-s1",
+      defaultModelId: "siglip2-b16-224",
       indexName: "the object semantic-search index",
-      options: [
-        {
-          id: "mobileclip-s1",
-          label: "MobileCLIP S1"
-        },
-        {
-          id: "mobileclip-s2",
-          label: "MobileCLIP S2"
-        },
-        {
-          id: "siglip2-b16-224",
-          label: "SigLIP2 B/16 (Apache-2.0)"
-        }
-      ]
+      options: [{
+        id: "siglip2-b16-224",
+        label: "SigLIP2 B/16 (Apache-2.0)"
+      }]
     }];
     var CLUSTER_MODEL_SECTION_ID = "cluster-step-models";
     function clusterModelSettingKey(stepId) {
@@ -271188,6 +271294,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "analyzer",
       "device-activity"
     ]);
+    var SessionTriggerSchema = zod.z.object({
+      source: MotionSourceEnum,
+      triggeredBy: MotionTriggeredBySchema,
+      sensorName: zod.z.string().optional()
+    });
     var MotionSourcesSchema = zod.z.array(MotionSourceEnum);
     var MOTION_SOURCE_LABELS = {
       analyzer: "Frame-diff Analyzer (motion addon)",
@@ -271339,6 +271450,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       */
       motionSources: MotionSourcesSchema.default(["analyzer"]),
       /**
+      * What opened this attach, on a SESSION attach only (see
+      * {@link SessionTriggerSchema}). OPTIONAL with no default: absent on a
+      * standing attach, an occupancy burst, a re-dispatch with no motion event
+      * behind it, and every attach from an orchestrator older than the field — the
+      * runner then names no source on the phase event.
+      */
+      sessionTrigger: SessionTriggerSchema.optional(),
+      /**
       * WHICH root detector runs for this camera. The detection counterpart of
       * {@link motionSources}, same shape and same discipline: a per-camera list
       * of sources the system understands, vendor-agnostic, owned here.
@@ -275351,6 +275470,94 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         rates: CLIP_BROKER_PACED_RATES
       }
     };
+    var CAMSTACK_APP_LINK_ORIGIN = "https://camstack.zentik.app";
+    var HUB_VIEWER_MOUNT = "/viewer/camstack";
+    function isAppLinkBase(baseUrl) {
+      if (baseUrl === null || baseUrl === void 0 || baseUrl === "") return false;
+      try {
+        return new URL(baseUrl).origin === CAMSTACK_APP_LINK_ORIGIN;
+      } catch {
+        return false;
+      }
+    }
+    function viewerLinkBaseOf(endpoint) {
+      const flagged = endpoint.baseUrl ?? endpoint.resolved;
+      return isAppLinkBase(flagged) ? {
+        form: "app",
+        hubBaseUrl: endpoint.appLinkHub ?? null
+      } : {
+        form: "hub",
+        hubBaseUrl: flagged
+      };
+    }
+    function toAppLinkHubOrigin(baseUrl) {
+      let parsed;
+      try {
+        parsed = new URL(baseUrl);
+      } catch {
+        return null;
+      }
+      if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+      if (parsed.username !== "" || parsed.password !== "") return null;
+      if (parsed.hostname === "") return null;
+      return parsed.origin;
+    }
+    function pickAppLinkHub(endpoints) {
+      const rank2 = (e) => {
+        if (e.kind !== "public" || !e.baseUrl.startsWith("https://")) return null;
+        if (e.interfaceKind === "public") return 0;
+        if (e.interfaceKind === "vpn") return 1;
+        return null;
+      };
+      return endpoints.flatMap((e) => {
+        const r = rank2(e);
+        const origin = toAppLinkHubOrigin(e.baseUrl);
+        return r === null || origin === null ? [] : [{
+          r,
+          p: e.priority,
+          origin
+        }];
+      }).toSorted((a, b) => a.r - b.r || a.p - b.p)[0]?.origin ?? null;
+    }
+    function viewerRoute(destination) {
+      switch (destination.kind) {
+        case "camera": {
+          if (!Number.isInteger(destination.deviceId) || destination.deviceId <= 0) return null;
+          const at = destination.atMs;
+          return {
+            path: `/camera/${String(destination.deviceId)}`,
+            query: at !== void 0 && Number.isFinite(at) ? [["at", String(Math.trunc(at))]] : []
+          };
+        }
+        case "events":
+          return {
+            path: "/events",
+            query: []
+          };
+        case "notifications":
+          return {
+            path: "/notifications",
+            query: []
+          };
+      }
+    }
+    function encodeQuery(query) {
+      if (query.length === 0) return "";
+      return `?${query.map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&")}`;
+    }
+    function buildViewerLink(input) {
+      const route = viewerRoute(input.destination);
+      if (route === null) return null;
+      const raw = input.base.hubBaseUrl;
+      const base = raw === null ? "" : raw.replace(/\/+$/, "");
+      if (input.base.form === "app") {
+        const origin = base === "" ? null : toAppLinkHubOrigin(base);
+        const query = origin === null ? route.query : [...route.query, ["hub", origin]];
+        return `${CAMSTACK_APP_LINK_ORIGIN}${route.path}${encodeQuery(query)}`;
+      }
+      if (base === "" || isAppLinkBase(base)) return null;
+      return `${base}${HUB_VIEWER_MOUNT}${route.path}${encodeQuery(route.query)}`;
+    }
     var webrtcClientHintsSchema = zod.z.object({
       viewportWidth: zod.z.number().int().positive().optional(),
       viewportHeight: zod.z.number().int().positive().optional(),
@@ -279212,7 +279419,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       name: zod.z.string(),
       family: zod.z.enum(["IPv4", "IPv6"]),
       address: zod.z.string(),
-      /** CIDR shorthand (e.g. `192.168.x.x/24`). Empty when OS doesn't expose. */
+      /** CIDR shorthand (e.g. `192.168.10.10/24`). Empty when OS doesn't expose. */
       cidr: zod.z.string(),
       /** OS netmask. Stable across calls so the SDK can hash on it. */
       netmask: zod.z.string(),
@@ -279261,7 +279468,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         "lan-ipv4",
         "lan-ipv6",
         "public",
-        "loopback"
+        "loopback",
+        "app-link"
       ]),
       /**
       * Originating-interface kind — `lan`/`wifi`/`docker`/`vpn`/`other`/
@@ -279326,8 +279534,20 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     var NotificationEndpointSchema = zod.z.object({
       /** The operator's explicit choice, or null for AUTO. */
       baseUrl: zod.z.string().nullable(),
-      /** What the ranking currently resolves to (null when nothing is reachable). */
-      resolved: zod.z.string().nullable()
+      /**
+      * The effective flagged address: the explicit choice, else (AUTO) the
+      * CamStack app link `https://camstack.zentik.app` (D709). A pre-D709 hub
+      * answered the public tunnel / mesh here, or null.
+      */
+      resolved: zod.z.string().nullable(),
+      /**
+      * The hub origin an app link carries as `hub=` (D709): the hub's best
+      * public HTTPS address — the tunnel, then the mesh (Tailscale MagicDNS) —
+      * picked from this cap's own palette by `pickAppLinkHub`. `null` when the
+      * hub advertises neither; the app link is then minted without `hub=`.
+      * Absent on a pre-D709 hub.
+      */
+      appLinkHub: zod.z.string().nullable()
     });
     var ViewerEndpointsSchema = zod.z.object({
       /** The operator's explicit race set, or empty for AUTO. */
@@ -279391,7 +279611,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * every client a second authority on a socket only the hub binds. A viewer
         * configured with a port-less public URL (`https://camstack.example.top`)
         * infers 443 from the scheme, asks with 443, and was handed
-        * `https://192.168.x.x:443` for a hub listening on 4443. That candidate
+        * `https://192.168.10.9:443` for a hub listening on 4443. That candidate
         * cannot ever answer, and losing its race reads in the log exactly like
         * "the LAN was tried and it was slower" — so an operator sitting on his own
         * WiFi stayed on the public tunnel for weeks, with the LAN candidate born
@@ -279424,13 +279644,21 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           *  Pass `'https'` when the caller is itself loaded over HTTPS
           *  to avoid mixed-content blocks in the browser. The public
           *  tunnel always emits `https://` regardless. */
-          scheme: zod.z.enum(["http", "https"]).optional()
+          scheme: zod.z.enum(["http", "https"]).optional(),
+          /** Append the CamStack app link entry (`kind: 'app-link'`, D709) —
+          *  an address notification links can be flagged with, not a hub
+          *  route. Default `false`: racers and rankers never see it. */
+          includeAppLink: zod.z.boolean().optional()
         }), GetConnectionEndpointsResultSchema),
         /**
-        * The endpoint OUTBOUND artifacts must be addressed by — notification
-        * attachment links and deep links. `baseUrl: null` means AUTO: the first
-        * public candidate (a configured origin, then a connected tunnel, then the
-        * LAN), never loopback.
+        * The address notification links are flagged with. `baseUrl: null` means
+        * AUTO, which is the CamStack app link (D709): viewer taps go through
+        * `https://camstack.zentik.app/…?hub=<appLinkHub>` and open the app. Any
+        * hub address the palette lists can be flagged instead; then viewer taps,
+        * attachment links and action buttons all use it. Signed media and
+        * buttons never use the app link — with it flagged (or AUTO) they keep
+        * the ranked hub ladder (a configured origin, a connected tunnel, then
+        * the LAN), never loopback.
         *
         * Why an explicit marker: the automatic ranking cannot know which of
         * several reachable addresses the RECIPIENT can actually open. A link is
@@ -279789,7 +280017,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       tags: zod.z.array(zod.z.string()).readonly(),
       /** True when the peer advertises itself as an exit-node candidate. */
       exitNodeOption: zod.z.boolean(),
-      /** Subnet routes the peer advertises (e.g. `["192.168.x.x/24"]`). */
+      /** Subnet routes the peer advertises (e.g. `["192.168.10.0/24"]`). */
       advertisedRoutes: zod.z.array(zod.z.string()).readonly(),
       /** Owner account login (e.g. `foo@example.com`). Null for tagged peers. */
       userLogin: zod.z.string().nullable(),
@@ -281077,7 +281305,13 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       */
       availablePositions: zod.z.array(OsdPositionEnum).readonly(),
       /** Firmware does not allow editing the `text` field (e.g. timestamp). */
-      readOnly: zod.z.boolean().optional()
+      readOnly: zod.z.boolean().optional(),
+      /**
+      * Firmware text ceiling for this overlay. Absent = no known limit.
+      * The OSD manager truncates here on every write — never stores its own
+      * copy on the binding.
+      */
+      maxCharacters: zod.z.number().int().positive().optional()
     });
     var OsdStatusSchema = zod.z.object({ overlays: zod.z.array(OsdOverlaySchema).readonly() });
     var OsdOverlayPatchSchema = zod.z.object({
@@ -281165,7 +281399,9 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       valuePath: zod.z.string().min(1).max(64),
       /** Convert TO this unit at render (`tryConvertUnit`). Absent = source unit. */
       displayUnit: zod.z.string().max(16).optional(),
-      maxDecimals: zod.z.number().int().min(0).max(4).default(1)
+      maxDecimals: zod.z.number().int().min(0).max(4).default(1),
+      /** Raw value → display text (same shape as slot binding). Empty string hides. */
+      valueMap: zod.z.record(zod.z.string(), zod.z.string()).optional()
     });
     var OsdNamedTemplateSchema = zod.z.object({
       id: zod.z.string().min(1).max(64),
@@ -281210,18 +281446,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       source: OsdSourceSchema,
       /** `${value}` and `${unit}` are substituted; every occurrence. */
       template: zod.z.string().max(96).default("${value}"),
-      /** Truncate with an ellipsis past this length. Absent = no limit. */
-      maxCharacters: zod.z.number().int().min(4).max(64).optional(),
       /**
       * Decimal places for a numeric value. `0` yields an integer — the
       * documented workaround for firmwares that reject `.` in overlay text.
       */
       maxDecimals: zod.z.number().int().min(0).max(4).default(1),
-      /**
-      * Appended via `${unit}` when no unit conversion produces a label.
-      * Prefer `source.displayUnit` for converted device-state values.
-      */
-      unitLabel: zod.z.string().max(8).optional(),
       /** Raw value → display text, e.g. `{"true":"MOTION","false":""}`. */
       valueMap: zod.z.record(zod.z.string(), zod.z.string()).optional(),
       /** Time windows in which the slot is shown. Absent = always. */
@@ -281230,9 +281459,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * Display gate, in the notification centre's condition vocabulary.
       * Only the keys reported by `getConditionSupport` are accepted.
       */
-      conditions: NcConditionsSchema.optional(),
-      /** Rendered when the gate is closed or the value unreadable. Empty = hide. */
-      fallbackText: zod.z.string().max(64).default("")
+      conditions: NcConditionsSchema.optional()
     });
     var OsdSlotViewSchema = zod.z.object({
       slotId: zod.z.string(),
@@ -305299,12 +305526,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       {
         id: "addons",
         family: "system",
-        label: "Addons",
-        kinds: [
-          "addon-crash-loop",
-          "addon-update-available",
-          "addon-updated"
-        ]
+        label: "Addons stopped",
+        kinds: ["addon-crash-loop"]
+      },
+      {
+        id: "addon-updates",
+        family: "system",
+        label: "Addon updates",
+        kinds: ["addon-update-available", "addon-updated"]
       },
       {
         id: "updates",
@@ -305914,6 +306143,15 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "entryDelaySec",
       "triggeredDurationSec"
     ];
+    var NC_ALARM_DEFAULT_TRIGGERED_DURATION_SEC = 30;
+    var NC_ALARM_NOTIFY_FIELDS = ["notifyDuringEntryDelay", "notifySensorRewatched"];
+    function resolveModeNotifyPolicy(settings, mode) {
+      const entry = (settings.modeDelays ?? []).find((e) => e.mode === mode);
+      return {
+        notifyDuringEntryDelay: entry?.notifyDuringEntryDelay === true,
+        notifySensorRewatched: entry?.notifySensorRewatched === true
+      };
+    }
     function derivePostTriggeredAction(action, triggeredDurationSec) {
       if (action !== void 0) return action;
       return triggeredDurationSec > 0 ? "rearmAfter" : "doNothing";
@@ -305956,6 +306194,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       if (edit === void 0) return current;
       return edit === null ? void 0 : edit;
     }
+    function editedFlag(current, edit) {
+      if (edit === void 0) return current;
+      return edit === null ? void 0 : edit;
+    }
     function editedSchedule(current, edit) {
       if (edit === void 0) return current;
       return edit === null ? void 0 : edit;
@@ -305986,15 +306228,19 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         const triggered = edited(base.triggeredDurationSec, edit.triggeredDurationSec);
         const action = editedAction(base.postTriggeredAction, edit.postTriggeredAction);
         const schedule = editedSchedule(base.schedule, edit.schedule);
+        const duringEntry = editedFlag(base.notifyDuringEntryDelay, edit.notifyDuringEntryDelay);
+        const rewatched = editedFlag(base.notifySensorRewatched, edit.notifySensorRewatched);
         if (exit !== void 0) next.exitDelaySec = exit;
         if (entry !== void 0) next.entryDelaySec = entry;
         if (triggered !== void 0) next.triggeredDurationSec = triggered;
         if (action !== void 0) next.postTriggeredAction = action;
         if (schedule !== void 0) next.schedule = schedule;
+        if (duringEntry !== void 0) next.notifyDuringEntryDelay = duringEntry;
+        if (rewatched !== void 0) next.notifySensorRewatched = rewatched;
         if (at >= 0) out[at] = next;
         else out.push(next);
       }
-      return out.filter((e) => e.exitDelaySec !== void 0 || e.entryDelaySec !== void 0 || e.triggeredDurationSec !== void 0 || e.postTriggeredAction !== void 0 || e.schedule !== void 0);
+      return out.filter((e) => e.exitDelaySec !== void 0 || e.entryDelaySec !== void 0 || e.triggeredDurationSec !== void 0 || e.postTriggeredAction !== void 0 || e.schedule !== void 0 || e.notifyDuringEntryDelay !== void 0 || e.notifySensorRewatched !== void 0);
     }
     function applyModeDeviceListEdit(lists, edit) {
       const copy2 = lists.map((l) => ({
@@ -306121,6 +306367,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           const got = entry?.postTriggeredAction;
           if (edit.postTriggeredAction === null ? got !== void 0 : got !== edit.postTriggeredAction) return false;
         }
+        for (const field of NC_ALARM_NOTIFY_FIELDS) {
+          const want = edit[field];
+          if (want === void 0) continue;
+          const got = entry?.[field];
+          if (want === null ? got !== void 0 : got !== want) return false;
+        }
         if (edit.schedule !== void 0) {
           const got = entry?.schedule;
           if (edit.schedule === null ? got !== void 0 : !sameSchedule(got, edit.schedule)) return false;
@@ -306459,13 +306711,15 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       },
       {
         name: "summaryAddons",
-        label: "Summary: addons",
-        example: "@camstack/addon-recorder 1.2.3 \u2192 1.2.4",
-        kinds: [
-          "addon-crash-loop",
-          "addon-update-available",
-          "addon-updated"
-        ]
+        label: "Summary: addons stopped",
+        example: "hub \u2014 recorder stopped after repeated crashes",
+        kinds: ["addon-crash-loop"]
+      },
+      {
+        name: "summaryAddonUpdates",
+        label: "Summary: addon updates",
+        example: "hub:\n\u2022 @camstack/addon-recorder 1.2.3 \u2192 1.2.4",
+        kinds: ["addon-update-available", "addon-updated"]
       },
       {
         name: "summaryUpdates",
@@ -306806,6 +307060,16 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         kinds: ["system"],
         systemEventKinds: [...DEVICE_EVENTS]
       },
+      {
+        name: "locations",
+        label: "Intrusion locations",
+        example: "Ingresso, Corridoio, Salone",
+        group: "system",
+        families: ["rule"],
+        fields: [...RULE_TEXT],
+        kinds: ["system"],
+        systemEventKinds: [...COMBINED_ALARM]
+      },
       {
         name: "deviceId",
         label: "Device id",
@@ -306895,7 +307159,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       {
         name: "devices",
         label: "Devices",
-        description: "node-inference-unavailable: the affected cameras, comma-joined. Alarm arm / refusal: HOW MANY devices are armed (or open).",
+        description: "node-inference-unavailable: the affected cameras, comma-joined. Alarm arm / arming / refusal: HOW MANY devices are armed (or open).",
         example: "Ingresso, Garage",
         group: "system",
         families: ["rule"],
@@ -306904,6 +307168,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         systemEventKinds: [
           "node-inference-unavailable",
           "alarm-armed",
+          "alarm-arming",
           "alarm-arm-refused"
         ]
       },
@@ -307124,18 +307389,18 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       {
         name: "rules",
         label: "Covering rules",
-        description: "How many enabled rules the armed mode gates.",
+        description: "How many enabled rules the armed / arming mode gates.",
         example: "2",
         group: "system",
         families: ["rule"],
         fields: [...RULE_TEXT],
         kinds: ["system"],
-        systemEventKinds: ["alarm-armed"]
+        systemEventKinds: ["alarm-armed", "alarm-arming"]
       },
       {
         name: "names",
         label: "Device names",
-        description: "Armed: the devices armed. Arming: the devices this mode cannot arm. Refusal: the open sensors.",
+        description: "Armed / arming: the Active devices (or every skipped name when none are Active). Refusal: the open sensors.",
         example: "Ingresso, Garage",
         group: "system",
         families: ["rule"],
@@ -307156,7 +307421,29 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         families: ["rule"],
         fields: [...RULE_TEXT],
         kinds: ["system"],
-        systemEventKinds: ["alarm-armed"]
+        systemEventKinds: ["alarm-armed", "alarm-arming"]
+      },
+      {
+        name: "active",
+        label: "Active count",
+        description: "How many named devices the armed / arming mode is watching (title: n attivi / n active).",
+        example: "3",
+        group: "system",
+        families: ["rule"],
+        fields: [...RULE_TEXT],
+        kinds: ["system"],
+        systemEventKinds: ["alarm-armed", "alarm-arming"]
+      },
+      {
+        name: "skipped",
+        label: "Skipped count",
+        description: "How many named devices the mode cannot arm \u2014 muted, detection off, offline (title: m saltati).",
+        example: "1",
+        group: "system",
+        families: ["rule"],
+        fields: [...RULE_TEXT],
+        kinds: ["system"],
+        systemEventKinds: ["alarm-armed", "alarm-arming"]
       },
       {
         name: "bypassedNames",
@@ -307405,7 +307692,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         approximated: times.length > 0
       };
     }
-    var SUMMARY_CONTENT_VAR = /\{\{\s*summary(?:Text|Devices|Streams|Battery|Consumables|Tanks|Detection|Nodes|Addons|Updates)\s*\}\}/;
+    var SUMMARY_CONTENT_VAR = /\{\{\s*summary(?:Text|Devices|Streams|Battery|Consumables|Tanks|Detection|Nodes|Addons|AddonUpdates|Updates)\s*\}\}/;
     function templateCarriesSummary(body) {
       if (body === void 0 || body.trim().length === 0) return true;
       return SUMMARY_CONTENT_VAR.test(body);
@@ -309773,6 +310060,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.CAMERA_SWITCH_CATALOG = CAMERA_SWITCH_CATALOG;
     exports.CAMERA_SWITCH_ORDER = CAMERA_SWITCH_ORDER;
     exports.CAMERA_TRIGGER = CAMERA_TRIGGER;
+    exports.CAMSTACK_APP_LINK_ORIGIN = CAMSTACK_APP_LINK_ORIGIN;
     exports.CAM_PROFILE_ORDER = require_sleep.CAM_PROFILE_ORDER;
     exports.CAPABILITY_NAMES = CAPABILITY_NAMES;
     exports.CAPABILITY_ROUTER_KEYS = CAPABILITY_ROUTER_KEYS;
@@ -310209,6 +310497,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.HF_BASE_URL = HF_BASE_URL;
     exports.HF_REPO = HF_REPO;
     exports.HOURS_PER_DAY = HOURS_PER_DAY;
+    exports.HUB_VIEWER_MOUNT = HUB_VIEWER_MOUNT;
     exports.HWACCEL_OPTIONS = HWACCEL_OPTIONS;
     exports.HealthStatusSchema = HealthStatusSchema;
     exports.HfModelResolutionSchema = HfModelResolutionSchema;
@@ -310426,9 +310715,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.NC_ALARM_CONTROLLABLE_CAPS = NC_ALARM_CONTROLLABLE_CAPS;
     exports.NC_ALARM_DEFAULT_PROFILE_ID = NC_ALARM_DEFAULT_PROFILE_ID;
     exports.NC_ALARM_DEFAULT_PROFILE_NAME = NC_ALARM_DEFAULT_PROFILE_NAME;
+    exports.NC_ALARM_DEFAULT_TRIGGERED_DURATION_SEC = NC_ALARM_DEFAULT_TRIGGERED_DURATION_SEC;
     exports.NC_ALARM_DELAY_FIELDS = NC_ALARM_DELAY_FIELDS;
     exports.NC_ALARM_DELAY_MAX_SEC = NC_ALARM_DELAY_MAX_SEC;
     exports.NC_ALARM_NONBLOCKING_MAX = NC_ALARM_NONBLOCKING_MAX;
+    exports.NC_ALARM_NOTIFY_FIELDS = NC_ALARM_NOTIFY_FIELDS;
     exports.NC_ALARM_OPENING_EVENT_KINDS = NC_ALARM_OPENING_EVENT_KINDS;
     exports.NC_ALARM_SENSORS_MAX = NC_ALARM_SENSORS_MAX;
     exports.NC_ALARM_SYSTEM_DEFAULT_DELAYS = NC_ALARM_SYSTEM_DEFAULT_DELAYS;
@@ -310904,6 +311195,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.ServerUpdateCheckResultSchema = ServerUpdateCheckResultSchema;
     exports.ServerUpdateOutcomeSchema = ServerUpdateOutcomeSchema;
     exports.ServerUpdateStateSchema = ServerUpdateStateSchema;
+    exports.SessionTriggerSchema = SessionTriggerSchema;
     exports.SetCameraSensorsInputSchema = SetCameraSensorsInputSchema;
     exports.SetLoggingSettingsInputSchema = SetLoggingSettingsInputSchema;
     exports.SetSiteLocationInputSchema = SetSiteLocationInputSchema;
@@ -311187,6 +311479,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.buildRoleScopes = buildRoleScopes;
     exports.buildStreamParamsConfigSchema = buildStreamParamsConfigSchema;
     exports.buildVideoArgs = require_composition.buildVideoArgs;
+    exports.buildViewerLink = buildViewerLink;
     exports.builtCapabilityBlockers = builtCapabilityBlockers;
     exports.buttonCapability = buttonCapability;
     exports.calendarSourceCapability = calendarSourceCapability;
@@ -311416,6 +311709,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.invocationFromEncodeProfile = require_composition.invocationFromEncodeProfile;
     exports.isAgentOnlyPlacement = isAgentOnlyPlacement;
     exports.isAlarmControllableCap = isAlarmControllableCap;
+    exports.isAppLinkBase = isAppLinkBase;
     exports.isArrayOutputSchema = isArrayOutputSchema;
     exports.isAudioChunkFormat = require_sleep.isAudioChunkFormat;
     exports.isAudioClassName = isAudioClassName;
@@ -311562,6 +311856,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.patchAudio = patchAudio;
     exports.petFeederCapability = petFeederCapability;
     exports.pickAccessoryControl = pickAccessoryControl;
+    exports.pickAppLinkHub = pickAppLinkHub;
     exports.pickClusterStepModels = pickClusterStepModels;
     exports.pickClusterStepSettings = pickClusterStepSettings;
     exports.pickDetailCropConvention = pickDetailCropConvention;
@@ -311641,6 +311936,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.resolveLocationMode = resolveLocationMode;
     exports.resolveMethodAuth = resolveMethodAuth;
     exports.resolveModeDelays = resolveModeDelays;
+    exports.resolveModeNotifyPolicy = resolveModeNotifyPolicy;
     exports.resolveMutate = resolveMutate;
     exports.resolvePoolMemoryPolicy = resolvePoolMemoryPolicy;
     exports.resolveRecordingProfiles = resolveRecordingProfiles;
@@ -311749,6 +312045,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.terminalSessionCapability = terminalSessionCapability;
     exports.textToHtml = textToHtml;
     exports.timeOfDayToMinutes = timeOfDayToMinutes;
+    exports.toAppLinkHubOrigin = toAppLinkHubOrigin;
     exports.toDeviceSummary = toDeviceSummary;
     exports.toExpressionValue = require_composition.toExpressionValue;
     exports.toNodeId = require_sleep.toNodeId;
@@ -311776,6 +312073,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.vectorStoreCapability = vectorStoreCapability;
     exports.vibrationCapability = vibrationCapability;
     exports.videoclipsCapability = videoclipsCapability;
+    exports.viewerLinkBaseOf = viewerLinkBaseOf;
     exports.viewerUiCapability = require_sleep.viewerUiCapability;
     exports.waterHeaterCapability = waterHeaterCapability;
     exports.weatherCapability = weatherCapability;
@@ -468362,8 +468660,8 @@ var require_model_distributor = __commonJS({
       });
     }
     async function distributeModelWith(seam, input) {
-      const { nodeId, modelId, format: format2, entry } = input;
-      if (nodeId === "hub") {
+      const { targetNodeId, modelId, format: format2, entry } = input;
+      if (targetNodeId === "hub") {
         return { ok: true, sha256: "", bytes: 0, path: seam.modelsDir };
       }
       if (!seam.isPresent(entry, format2)) {
@@ -468375,7 +468673,7 @@ var require_model_distributor = __commonJS({
       }
       const tgz = await seam.tar(files);
       const source = seam.stage(tgz);
-      const res = await seam.callAgent(nodeId, { modelId, format: format2, source });
+      const res = await seam.callAgent(targetNodeId, { modelId, format: format2, source });
       return { ok: true, sha256: source.sha256, bytes: source.bytes, path: res.path ?? "" };
     }
     function buildModelDistributorProvider(moleculer, loggingService) {
@@ -468401,7 +468699,7 @@ var require_model_distributor = __commonJS({
       return {
         distributeModel: async (input) => {
           logger.info("Distributing model to node", {
-            meta: { modelId: input.modelId, format: input.format, nodeId: input.nodeId }
+            meta: { modelId: input.modelId, format: input.format, nodeId: input.targetNodeId }
           });
           return distributeModelWith(seam, input);
         }
@@ -469430,6 +469728,224 @@ var require_frame_policy = __commonJS({
   }
 });
 
+// ../../server/backend/dist/api/cors/cors-policy.js
+var require_cors_policy = __commonJS({
+  "../../server/backend/dist/api/cors/cors-policy.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.CORS_PREFLIGHT_MAX_AGE_SEC = exports.CORS_EXPOSED_HEADERS = exports.CORS_ALLOWED_HEADERS = exports.CORS_ALLOWED_METHODS = exports.OPAQUE_ORIGIN = exports.VIEWER_PWA_ORIGIN = void 0;
+    exports.normalizeOrigin = normalizeOrigin;
+    exports.parseConfiguredOrigins = parseConfiguredOrigins;
+    exports.builtInOrigins = builtInOrigins;
+    exports.judgeCorsOrigin = judgeCorsOrigin;
+    exports.corsResponseHeaders = corsResponseHeaders;
+    exports.appendVary = appendVary;
+    exports.VIEWER_PWA_ORIGIN = "https://camstack.zentik.app";
+    exports.OPAQUE_ORIGIN = "null";
+    exports.CORS_ALLOWED_METHODS = "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS";
+    exports.CORS_ALLOWED_HEADERS = "authorization, content-type, range, if-range, if-none-match, cache-control, trpc-accept, x-trpc-source, x-trpc-batch-mode";
+    exports.CORS_EXPOSED_HEADERS = "content-range, accept-ranges, content-length, content-disposition, etag, retry-after, x-camstack-reason, x-camstack-reason-code, x-camstack-disposition";
+    exports.CORS_PREFLIGHT_MAX_AGE_SEC = 7200;
+    function normalizeOrigin(raw) {
+      const trimmed = raw.trim();
+      if (trimmed === exports.OPAQUE_ORIGIN)
+        return exports.OPAQUE_ORIGIN;
+      let url;
+      try {
+        url = new URL(trimmed);
+      } catch {
+        return null;
+      }
+      if (url.protocol !== "https:" && url.protocol !== "http:")
+        return null;
+      if (url.username !== "" || url.password !== "")
+        return null;
+      if (url.pathname !== "/" && url.pathname !== "" || url.search !== "" || url.hash !== "") {
+        return null;
+      }
+      return url.origin;
+    }
+    function parseConfiguredOrigins(value) {
+      if (!Array.isArray(value))
+        return { origins: [], rejected: [] };
+      const origins = [];
+      const rejected = [];
+      for (const entry of value) {
+        if (typeof entry !== "string") {
+          rejected.push(String(entry));
+          continue;
+        }
+        const normalized = normalizeOrigin(entry);
+        if (normalized === null)
+          rejected.push(entry);
+        else
+          origins.push(normalized);
+      }
+      return { origins, rejected };
+    }
+    function builtInOrigins(publicOrigin) {
+      const entries = [exports.VIEWER_PWA_ORIGIN, exports.OPAQUE_ORIGIN];
+      const pub = publicOrigin !== void 0 ? normalizeOrigin(publicOrigin) : null;
+      if (pub !== null && pub !== exports.OPAQUE_ORIGIN)
+        entries.push(pub);
+      return entries;
+    }
+    function firstHost(value) {
+      if (value === void 0)
+        return null;
+      const first = value.split(",")[0]?.trim().toLowerCase() ?? "";
+      return first.length > 0 ? first : null;
+    }
+    function hostOfOrigin(origin) {
+      if (origin === exports.OPAQUE_ORIGIN)
+        return null;
+      try {
+        return new URL(origin).host.toLowerCase();
+      } catch {
+        return null;
+      }
+    }
+    function judgeCorsOrigin(facts, listed) {
+      const raw = facts.origin;
+      if (raw === void 0 || raw.length === 0)
+        return { kind: "no-origin" };
+      const normalized = normalizeOrigin(raw);
+      if (normalized === null)
+        return { kind: "denied", origin: raw };
+      if (listed.has(normalized))
+        return { kind: "allowed", origin: raw, reason: "listed" };
+      const originHost = hostOfOrigin(normalized);
+      if (originHost !== null) {
+        const ownHosts = [firstHost(facts.host), firstHost(facts.forwardedHost)];
+        if (ownHosts.includes(originHost))
+          return { kind: "allowed", origin: raw, reason: "own-host" };
+      }
+      return { kind: "denied", origin: raw };
+    }
+    function corsResponseHeaders(origin, preflight) {
+      const base = {
+        "access-control-allow-origin": origin,
+        "access-control-expose-headers": exports.CORS_EXPOSED_HEADERS
+      };
+      if (preflight === null)
+        return base;
+      return {
+        ...base,
+        "access-control-allow-methods": exports.CORS_ALLOWED_METHODS,
+        "access-control-allow-headers": exports.CORS_ALLOWED_HEADERS,
+        "access-control-max-age": String(exports.CORS_PREFLIGHT_MAX_AGE_SEC),
+        // A public origin (the PWA) calling a LAN hub is a "private network"
+        // request to Chromium; its preflight must be answered explicitly.
+        ...preflight.requestPrivateNetwork ? { "access-control-allow-private-network": "true" } : {}
+      };
+    }
+    function appendVary(existing, token2) {
+      if (existing === void 0 || existing.trim().length === 0)
+        return token2;
+      const parts = existing.split(",").map((p) => p.trim().toLowerCase());
+      if (parts.includes("*") || parts.includes(token2.toLowerCase()))
+        return existing;
+      return `${existing}, ${token2}`;
+    }
+  }
+});
+
+// ../../server/backend/dist/api/cors/register-cors-policy.js
+var require_register_cors_policy = __commonJS({
+  "../../server/backend/dist/api/cors/register-cors-policy.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.createCorsPolicy = createCorsPolicy;
+    exports.registerCorsPolicy = registerCorsPolicy;
+    exports.refuseForeignWsUpgrade = refuseForeignWsUpgrade;
+    var cors_policy_js_1 = require_cors_policy();
+    var MAX_LOGGED_DENIALS = 256;
+    function headerValue(value) {
+      if (Array.isArray(value))
+        return value[0];
+      return value;
+    }
+    function varyText(value) {
+      if (typeof value === "string")
+        return value;
+      if (Array.isArray(value))
+        return value.filter((v) => typeof v === "string").join(", ");
+      return void 0;
+    }
+    function createCorsPolicy(deps) {
+      const builtIns = (0, cors_policy_js_1.builtInOrigins)(deps.publicOrigin);
+      let lastConfigured = /* @__PURE__ */ Symbol("unset");
+      let listed = new Set(builtIns);
+      const loggedDenials = /* @__PURE__ */ new Set();
+      const currentList = () => {
+        const configured = deps.configuredOrigins();
+        if (configured === lastConfigured)
+          return listed;
+        lastConfigured = configured;
+        const parsed = (0, cors_policy_js_1.parseConfiguredOrigins)(configured);
+        if (parsed.rejected.length > 0) {
+          deps.logger.warn("cors: ignored configured origins that are not http(s) origins", {
+            meta: { rejected: parsed.rejected, setting: "server.corsOrigins" }
+          });
+        }
+        listed = /* @__PURE__ */ new Set([...builtIns, ...parsed.origins]);
+        return listed;
+      };
+      return {
+        judge(headers) {
+          const verdict = (0, cors_policy_js_1.judgeCorsOrigin)({
+            origin: headerValue(headers.origin),
+            host: headerValue(headers.host),
+            forwardedHost: headerValue(headers["x-forwarded-host"])
+          }, currentList());
+          if (verdict.kind === "denied" && !loggedDenials.has(verdict.origin)) {
+            if (loggedDenials.size < MAX_LOGGED_DENIALS)
+              loggedDenials.add(verdict.origin);
+            deps.logger.warn("cors: refused a cross-origin caller not on the allowlist", {
+              meta: {
+                origin: verdict.origin,
+                host: headerValue(headers.host) ?? null,
+                hint: "add it to server.corsOrigins (config.yaml) or CAMSTACK_CORS_ORIGINS"
+              }
+            });
+          }
+          return verdict;
+        }
+      };
+    }
+    function registerCorsPolicy(fastify, policy) {
+      fastify.addHook("onRequest", async (request, reply) => {
+        const vary = (0, cors_policy_js_1.appendVary)(varyText(reply.getHeader("vary")), "Origin");
+        reply.header("vary", vary);
+        reply.raw.setHeader("vary", vary);
+        const verdict = policy.judge(request.headers);
+        const isPreflight = request.method === "OPTIONS" && request.headers["access-control-request-method"] !== void 0;
+        if (verdict.kind === "allowed") {
+          const headers = (0, cors_policy_js_1.corsResponseHeaders)(verdict.origin, isPreflight ? {
+            requestPrivateNetwork: headerValue(request.headers["access-control-request-private-network"]) === "true"
+          } : null);
+          for (const [name, value] of Object.entries(headers)) {
+            reply.header(name, value);
+            reply.raw.setHeader(name, value);
+          }
+        }
+        if (request.method === "OPTIONS") {
+          return reply.code(204).send();
+        }
+        return void 0;
+      });
+    }
+    function refuseForeignWsUpgrade(policy, headers, socket) {
+      const verdict = policy.judge(headers);
+      if (verdict.kind !== "denied")
+        return false;
+      socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
+      socket.destroy();
+      return true;
+    }
+  }
+});
+
 // ../../server/backend/dist/boot/integration-id-backfill.js
 var require_integration_id_backfill = __commonJS({
   "../../server/backend/dist/boot/integration-id-backfill.js"(exports) {
@@ -485915,16 +486431,6 @@ var require_manual_boot = __commonJS({
         getHttpAdapter() {
           return { getInstance: () => fastify };
         },
-        enableCors() {
-          fastify.addHook("onRequest", async (request, reply) => {
-            reply.header("access-control-allow-origin", "*");
-            reply.header("access-control-allow-methods", "GET,POST,PUT,DELETE,OPTIONS,PATCH");
-            reply.header("access-control-allow-headers", "content-type,authorization");
-            if (request.method === "OPTIONS") {
-              reply.status(204).send();
-            }
-          });
-        },
         enableShutdownHooks() {
           if (shutdownHooksRegistered)
             return;
@@ -486035,6 +486541,7 @@ var require_main4 = __commonJS({
     var spa_static_1 = require_spa_static();
     var spa_mount_1 = require_spa_mount();
     var frame_policy_1 = require_frame_policy();
+    var register_cors_policy_1 = require_register_cors_policy();
     var cap_providers_1 = require_cap_providers();
     var logging_settings_1 = require_logging_settings();
     var request_census_settings_1 = require_request_census_settings();
@@ -486201,8 +486708,14 @@ var require_main4 = __commonJS({
       const fastifyOpts = tlsOptions ? { https: tlsOptions } : {};
       const app = await (0, manual_boot_1.bootManual)({ infra, fastifyOpts });
       app.enableShutdownHooks();
-      app.enableCors();
       const fastify = app.getHttpAdapter().getInstance();
+      const corsConfig = app.get(config_service_1.ConfigService);
+      const corsPolicy = (0, register_cors_policy_1.createCorsPolicy)({
+        configuredOrigins: () => corsConfig.get("server.corsOrigins"),
+        publicOrigin: process.env.CAMSTACK_PUBLIC_ORIGIN,
+        logger: app.get(logging_service_1.LoggingService).createLogger("cors")
+      });
+      (0, register_cors_policy_1.registerCorsPolicy)(fastify, corsPolicy);
       await fastify.register(cookie_1.default);
       (0, frame_policy_1.registerFramePolicy)(fastify);
       fastify.addHook("onRequest", async (request) => {
@@ -486785,6 +487298,8 @@ var require_main4 = __commonJS({
         httpServer.on("upgrade", (request, socket, head) => {
           const pathname = (request.url ?? "").split("?")[0];
           if (pathname === "/trpc") {
+            if ((0, register_cors_policy_1.refuseForeignWsUpgrade)(corsPolicy, request.headers, socket))
+              return;
             wss.handleUpgrade(request, socket, head, (ws) => {
               wss.emit("connection", ws, request);
             });