camstack 1.2.210 → 1.2.211

package/dist/server-LHBD6ATG.js

@@ -1,2243 +0,0 @@
-#!/usr/bin/env node
-import {
-  DETECTOR_PERF,
-  acceleratorKindOf,
-  buildViewerLink,
-  classifyInferenceHardware,
-  findHubs
-} from "./chunk-EMTOU2RA.js";
-import "./chunk-LMMQX4CK.js";
-
-// src/mcp/server.ts
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { MutationGate, tryConnectHub } from "@camstack/develop";
-
-// src/mcp/configure-tools.ts
-import {
-  runGated,
-  text as text2
-} from "@camstack/develop";
-import { z as z7 } from "zod";
-
-// src/mcp/ops-tools.ts
-import { z as z6 } from "zod";
-import { jwtClaims, text } from "@camstack/develop";
-
-// src/mcp/ops-hub.ts
-import {
-  isSecretBearing
-} from "@camstack/develop";
-function noSessionResult(outcome) {
-  return {
-    status: "no-session",
-    message: outcome.message,
-    action: outcome.action
-  };
-}
-function reasonOf(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-async function readQuery(client, path, input, schema) {
-  if (isSecretBearing(path)) {
-    return {
-      ok: false,
-      reason: `${path} returns secret material; the ops toolset never reads it`
-    };
-  }
-  let raw;
-  try {
-    raw = await client.call("GET", path, input);
-  } catch (err) {
-    return { ok: false, reason: `${path}: ${reasonOf(err)}` };
-  }
-  const parsed = schema.safeParse(raw);
-  if (!parsed.success) {
-    const first = parsed.error.issues[0];
-    const where = first ? `${first.path.join(".")}: ${first.message}` : "unexpected shape";
-    return {
-      ok: false,
-      reason: `${path}: unexpected answer (${where}) \u2014 the hub and this tool may be on different versions`
-    };
-  }
-  return { ok: true, value: parsed.data };
-}
-async function withHub(ctx, body) {
-  const outcome = await ctx.hub();
-  if (!outcome.ok) return noSessionResult(outcome);
-  return body(outcome.connection);
-}
-function cap(items, max) {
-  return {
-    items: items.slice(0, max),
-    truncated: Math.max(0, items.length - max)
-  };
-}
-var ADMIN_ONLY_NOTE = (path, hint) => `${path} is admin-tier and this credential is not admin-scoped.${hint ? ` ${hint}` : ""}`;
-
-// src/mcp/ops-accelerators.ts
-import { z } from "zod";
-var NodesSchema = z.array(
-  z.looseObject({
-    id: z.string(),
-    isOnline: z.boolean(),
-    name: z.string().optional()
-  })
-);
-var HardwareSchema = z.looseObject({
-  platform: z.enum(["darwin", "linux", "win32"]),
-  arch: z.enum(["arm64", "x64"]),
-  cpuModel: z.string(),
-  cpuCores: z.number(),
-  totalRAM_MB: z.number(),
-  availableRAM_MB: z.number(),
-  gpu: z.looseObject({
-    type: z.enum(["nvidia", "amd", "intel", "apple"]),
-    name: z.string()
-  }).nullable(),
-  npu: z.looseObject({
-    type: z.enum(["apple-ane", "intel-npu", "amd-xdna"])
-  }).nullable()
-});
-var InferenceDevicesSchema = z.looseObject({
-  reachable: z.boolean(),
-  devices: z.array(
-    z.looseObject({
-      key: z.string(),
-      backend: z.string(),
-      device: z.string(),
-      available: z.boolean(),
-      presence: z.enum(["present", "absent", "unknown"]).optional(),
-      enabled: z.boolean(),
-      exclusion: z.string().nullable(),
-      defaultModelId: z.string()
-    })
-  )
-});
-var NODE_LIMIT = 30;
-function benchmarkRowFor(hardwareClass, kind) {
-  if (kind === null) return null;
-  const column = DETECTOR_PERF[hardwareClass]?.[kind];
-  if (column === void 0) return { state: "none" };
-  const cells = Object.values(column);
-  const measured = cells.filter((c) => c.measured).length;
-  const estimated = cells.length - measured;
-  if (measured > 0)
-    return {
-      state: "measured",
-      measuredCells: measured,
-      estimatedCells: estimated
-    };
-  if (estimated > 0) return { state: "estimated-only", estimatedCells: estimated };
-  return { state: "none" };
-}
-async function nodeAccelerators(client, node) {
-  const unavailable = {};
-  if (!node.isOnline) {
-    return {
-      nodeId: node.id,
-      online: false,
-      hardwareClass: null,
-      cpuModel: null,
-      devices: null,
-      unavailable: { node: "node is offline" }
-    };
-  }
-  const [hardwareRead, devicesRead] = await Promise.all([
-    readQuery(client, "platformProbe.getHardware", { nodeId: node.id }, HardwareSchema),
-    readQuery(
-      client,
-      "pipelineOrchestrator.getNodeInferenceDevices",
-      { nodeId: node.id },
-      InferenceDevicesSchema
-    )
-  ]);
-  let hardware = null;
-  let hardwareClass = null;
-  if (hardwareRead.ok) {
-    hardware = {
-      platform: hardwareRead.value.platform,
-      arch: hardwareRead.value.arch,
-      cpuModel: hardwareRead.value.cpuModel,
-      cpuCores: hardwareRead.value.cpuCores,
-      totalRAM_MB: hardwareRead.value.totalRAM_MB,
-      availableRAM_MB: hardwareRead.value.availableRAM_MB,
-      gpu: hardwareRead.value.gpu ? {
-        type: hardwareRead.value.gpu.type,
-        name: hardwareRead.value.gpu.name
-      } : null,
-      npu: hardwareRead.value.npu ? { type: hardwareRead.value.npu.type } : null
-    };
-    hardwareClass = classifyInferenceHardware(hardware).hardwareClass;
-  } else {
-    unavailable["hardware"] = hardwareRead.reason;
-  }
-  let devices = null;
-  if (devicesRead.ok) {
-    if (!devicesRead.value.reachable) {
-      unavailable["devices"] = "the node was unreachable when its devices were probed";
-    } else {
-      devices = devicesRead.value.devices.map((d) => {
-        const kind = hardware ? acceleratorKindOf(d.key, hardware) : null;
-        return {
-          key: d.key,
-          backend: d.backend,
-          device: d.device,
-          available: d.available,
-          presence: d.presence ?? null,
-          enabled: d.enabled,
-          exclusion: d.exclusion,
-          defaultModelId: d.defaultModelId,
-          acceleratorKind: kind,
-          benchmark: hardwareClass ? benchmarkRowFor(hardwareClass, kind) : null
-        };
-      });
-    }
-  } else {
-    unavailable["devices"] = devicesRead.reason;
-  }
-  return {
-    nodeId: node.id,
-    online: true,
-    hardwareClass,
-    cpuModel: hardware?.cpuModel ?? null,
-    devices,
-    unavailable
-  };
-}
-async function opsAccelerators(ctx) {
-  return withHub(ctx, async (connection) => {
-    if (connection.tier !== "admin") {
-      return {
-        status: "refused",
-        reason: `nodes.topology is admin-tier and this credential is not admin-scoped.${connection.adminHint ? ` ${connection.adminHint}` : ""}`
-      };
-    }
-    const nodesRead = await readQuery(connection.client, "nodes.topology", void 0, NodesSchema);
-    if (!nodesRead.ok) {
-      return {
-        status: "ok",
-        nodes: [],
-        nodesTruncated: 0,
-        unavailable: { nodes: nodesRead.reason }
-      };
-    }
-    const capped = cap(nodesRead.value, NODE_LIMIT);
-    const nodes = await Promise.all(capped.items.map((n) => nodeAccelerators(connection.client, n)));
-    return {
-      status: "ok",
-      nodes,
-      nodesTruncated: capped.truncated,
-      unavailable: {}
-    };
-  });
-}
-
-// src/mcp/ops-device.ts
-import { z as z2 } from "zod";
-var DeviceSchema = z2.looseObject({
-  id: z2.number(),
-  name: z2.string(),
-  type: z2.string().optional(),
-  addonId: z2.string().optional(),
-  location: z2.string().nullable().optional(),
-  disabled: z2.boolean().optional(),
-  online: z2.boolean().optional(),
-  isCamera: z2.boolean().optional(),
-  features: z2.array(z2.string()).optional()
-});
-var NullableDeviceSchema = DeviceSchema.nullable();
-var DeviceListSchema = z2.array(DeviceSchema);
-var BindingsSchema = z2.looseObject({
-  entries: z2.array(
-    z2.looseObject({
-      capName: z2.string(),
-      kind: z2.string(),
-      providerAddonId: z2.string(),
-      providerNodeId: z2.string()
-    })
-  )
-});
-var StatusAggregateSchema = z2.record(z2.string(), z2.unknown());
-var DegradationSchema = z2.looseObject({
-  stage: z2.string(),
-  reason: z2.string(),
-  elapsedMs: z2.number().optional()
-});
-var CameraStatusSchema = z2.looseObject({
-  deviceId: z2.number(),
-  assignment: z2.looseObject({
-    detectionNodeId: z2.string().nullable(),
-    decoderNodeId: z2.string().nullable(),
-    sourceNodeId: z2.string().nullable(),
-    /** Why a stage sits where it does; `armed:on-motion` means idle by design. */
-    reasons: z2.record(z2.string(), z2.string().optional()).optional()
-  }),
-  broker: z2.looseObject({
-    profiles: z2.array(
-      z2.looseObject({
-        profile: z2.string(),
-        status: z2.string(),
-        subscribers: z2.number()
-      })
-    )
-  }).nullable(),
-  detection: z2.looseObject({
-    nodeId: z2.string(),
-    phase: z2.string(),
-    actualFps: z2.number(),
-    configuredFps: z2.number(),
-    provisioning: z2.looseObject({
-      state: z2.string(),
-      error: z2.string().optional()
-    })
-  }).nullable(),
-  recording: z2.looseObject({
-    mode: z2.string(),
-    active: z2.boolean(),
-    storageBytes: z2.number()
-  }).nullable(),
-  switchedOff: z2.array(z2.string()),
-  degraded: z2.array(DegradationSchema),
-  fetchedAt: z2.number()
-});
-var CameraStatusListSchema = z2.array(CameraStatusSchema);
-var ObjectEventSchema = z2.looseObject({
-  id: z2.number(),
-  timestamp: z2.number(),
-  className: z2.string().optional(),
-  trackId: z2.string().optional()
-});
-var ObjectEventsSchema = z2.array(ObjectEventSchema);
-var BINDING_LIMIT = 40;
-var EVENT_LIMIT = 5;
-var UNHEALTHY_LIMIT = 50;
-function freshness(aggregate, now) {
-  const fetched = [];
-  let changed = null;
-  for (const [capName, value] of Object.entries(aggregate)) {
-    const parsed = z2.looseObject({
-      lastFetchedAt: z2.number().optional(),
-      lastChangedAt: z2.number().optional()
-    }).safeParse(value);
-    if (!parsed.success) continue;
-    const at = parsed.data.lastFetchedAt;
-    if (at !== void 0 && at > 0) fetched.push(at);
-    if (capName === "device-status" && parsed.data.lastChangedAt !== void 0) {
-      changed = parsed.data.lastChangedAt;
-    }
-  }
-  return {
-    newestFetchAgeMs: fetched.length === 0 ? null : Math.max(0, now - Math.max(...fetched)),
-    oldestFetchAgeMs: fetched.length === 0 ? null : Math.max(0, now - Math.min(...fetched)),
-    statusChangedAgeMs: changed === null || changed <= 0 ? null : now - changed
-  };
-}
-function pipelineOf(status) {
-  return {
-    detectionNodeId: status.assignment.detectionNodeId,
-    decoderNodeId: status.assignment.decoderNodeId,
-    sourceNodeId: status.assignment.sourceNodeId,
-    detection: status.detection ? {
-      phase: status.detection.phase,
-      actualFps: status.detection.actualFps,
-      provisioning: status.detection.provisioning.state
-    } : null,
-    brokerProfiles: status.broker ? status.broker.profiles.map((p) => ({
-      profile: p.profile,
-      status: p.status
-    })) : null
-  };
-}
-function whyOff(status, deviceDisabled) {
-  const out = [];
-  if (deviceDisabled)
-    out.push({
-      function: "device",
-      reason: "the device is disabled by an operator"
-    });
-  for (const id of status.switchedOff) {
-    out.push({
-      function: id,
-      reason: "switched off by an operator (not a fault)"
-    });
-  }
-  return out;
-}
-async function opsDevice(ctx, deviceId, now = Date.now()) {
-  return withHub(ctx, async ({ client }) => {
-    const unavailable = {};
-    const [deviceRead, bindingsRead, aggregateRead] = await Promise.all([
-      readQuery(client, "deviceManager.getDevice", { deviceId }, NullableDeviceSchema),
-      readQuery(client, "deviceManager.getBindings", { deviceId }, BindingsSchema),
-      readQuery(
-        client,
-        "deviceManager.getDeviceStatusAggregate",
-        { deviceId },
-        StatusAggregateSchema
-      )
-    ]);
-    if (deviceRead.ok && deviceRead.value === null) {
-      return {
-        status: "ok",
-        deviceId,
-        found: false,
-        whyOff: [],
-        unknownStages: [],
-        unavailable
-      };
-    }
-    if (!deviceRead.ok) unavailable["device"] = deviceRead.reason;
-    const device = deviceRead.ok ? deviceRead.value : null;
-    let bindings;
-    let nodes;
-    if (bindingsRead.ok) {
-      const names = [...new Set(bindingsRead.value.entries.map((e) => e.capName))];
-      const capped = cap(names, BINDING_LIMIT);
-      bindings = {
-        count: names.length,
-        caps: capped.items,
-        truncated: capped.truncated
-      };
-      nodes = [...new Set(bindingsRead.value.entries.map((e) => e.providerNodeId))];
-    } else {
-      unavailable["bindings"] = bindingsRead.reason;
-    }
-    let runtimeState;
-    if (aggregateRead.ok) runtimeState = freshness(aggregateRead.value, now);
-    else unavailable["runtimeState"] = aggregateRead.reason;
-    let pipeline;
-    let recording;
-    let switchedOff;
-    let switchedOffKnown;
-    let why = device?.disabled === true ? [
-      {
-        function: "device",
-        reason: "the device is disabled by an operator"
-      }
-    ] : [];
-    let unknownStages = [];
-    let recentEvents;
-    if (device?.isCamera === true) {
-      const [statusRead, eventsRead] = await Promise.all([
-        readQuery(client, "pipelineOrchestrator.getCameraStatus", { deviceId }, CameraStatusSchema),
-        readQuery(
-          client,
-          "pipelineAnalytics.getObjectEvents",
-          { deviceId, limit: EVENT_LIMIT, projection: "slim" },
-          ObjectEventsSchema
-        )
-      ]);
-      if (statusRead.ok) {
-        const status = statusRead.value;
-        pipeline = pipelineOf(status);
-        recording = status.recording ? { mode: status.recording.mode, active: status.recording.active } : null;
-        switchedOff = status.switchedOff;
-        switchedOffKnown = !status.degraded.some((d) => d.stage === "switches");
-        why = whyOff(status, device.disabled === true);
-        unknownStages = status.degraded.map((d) => ({
-          stage: d.stage,
-          reason: d.reason
-        }));
-      } else {
-        unavailable["cameraStatus"] = statusRead.reason;
-      }
-      if (eventsRead.ok) {
-        recentEvents = eventsRead.value.map((e) => ({
-          id: e.id,
-          timestamp: e.timestamp,
-          className: e.className ?? null,
-          trackId: e.trackId ?? null
-        }));
-      } else {
-        unavailable["recentEvents"] = eventsRead.reason;
-      }
-    }
-    return {
-      status: "ok",
-      deviceId,
-      found: device === null ? null : true,
-      ...device ? {
-        device: {
-          name: device.name,
-          type: device.type ?? null,
-          addonId: device.addonId ?? null,
-          location: device.location ?? null,
-          online: device.online ?? null,
-          disabled: device.disabled === true
-        }
-      } : {},
-      ...nodes ? { nodes } : {},
-      ...bindings ? { bindings } : {},
-      ...runtimeState ? { runtimeState } : {},
-      ...pipeline !== void 0 ? { pipeline } : {},
-      ...recording !== void 0 ? { recording } : {},
-      ...switchedOff ? { switchedOff } : {},
-      ...switchedOffKnown !== void 0 ? { switchedOffKnown } : {},
-      whyOff: why,
-      unknownStages,
-      ...recentEvents ? { recentEvents } : {},
-      unavailable
-    };
-  });
-}
-function cameraReasons(status) {
-  const out = [];
-  const readable = (stage) => !status.degraded.some((d) => d.stage === stage);
-  const off = (id) => status.switchedOff.includes(id);
-  if (status.detection?.provisioning.state === "failed" && !off("object-detection")) {
-    out.push({
-      code: "detection-provisioning-failed",
-      detail: status.detection.provisioning.error ?? "detection provisioning failed"
-    });
-  }
-  if (status.assignment.detectionNodeId === null && !(status.assignment.reasons?.["detection"] ?? "").startsWith("armed:") && !off("object-detection") && readable("detection")) {
-    out.push({
-      code: "detection-not-assigned",
-      detail: "no node runs detection for this camera and it is not switched off"
-    });
-  }
-  if (status.recording !== null && status.recording.mode === "continuous" && !status.recording.active && !off("recording") && readable("recording")) {
-    out.push({
-      code: "recording-inactive",
-      detail: "continuous recording is configured but not recording and not switched off"
-    });
-  }
-  return out;
-}
-function readCameraStatuses(client) {
-  return readQuery(client, "pipelineOrchestrator.getCameraStatuses", {}, CameraStatusListSchema);
-}
-async function opsUnhealthyDevices(ctx) {
-  return withHub(ctx, async ({ client }) => {
-    const unavailable = {};
-    const [devicesRead, statusesRead] = await Promise.all([
-      readQuery(client, "deviceManager.listAll", { projection: "slim" }, DeviceListSchema),
-      readCameraStatuses(client)
-    ]);
-    if (!devicesRead.ok) {
-      return {
-        status: "ok",
-        checked: 0,
-        unhealthy: [],
-        truncated: 0,
-        unknown: [],
-        unavailable: { devices: devicesRead.reason }
-      };
-    }
-    if (!statusesRead.ok) unavailable["cameraStatuses"] = statusesRead.reason;
-    const statuses = new Map(
-      statusesRead.ok ? statusesRead.value.map((s) => [s.deviceId, s]) : []
-    );
-    const unhealthy = [];
-    const unknown = [];
-    for (const device of devicesRead.value) {
-      if (device.disabled === true) continue;
-      const reasons = [];
-      if (device.online === false) {
-        reasons.push({
-          code: "offline",
-          detail: "the provider reports the device offline"
-        });
-      }
-      const status = statuses.get(device.id);
-      if (status && device.online !== false) {
-        reasons.push(...cameraReasons(status));
-        if (status.degraded.length > 0) {
-          unknown.push({
-            deviceId: device.id,
-            name: device.name,
-            stages: status.degraded.map((d) => ({
-              stage: d.stage,
-              reason: d.reason
-            }))
-          });
-        }
-      }
-      if (reasons.length > 0) unhealthy.push({ deviceId: device.id, name: device.name, reasons });
-    }
-    const capped = cap(unhealthy, UNHEALTHY_LIMIT);
-    return {
-      status: "ok",
-      checked: devicesRead.value.filter((d) => d.disabled !== true).length,
-      unhealthy: capped.items,
-      truncated: capped.truncated,
-      unknown: unknown.slice(0, UNHEALTHY_LIMIT),
-      unavailable
-    };
-  });
-}
-
-// src/mcp/ops-events.ts
-import {
-  TrackSchema,
-  analyzeTrack
-} from "@camstack/develop";
-import { z as z3 } from "zod";
-var AddressesSchema = z3.looseObject({
-  roles: z3.looseObject({
-    appConnections: z3.looseObject({ resolved: z3.array(z3.string()) })
-  })
-});
-var LOOPBACK = /^(localhost|127\.|\[?::1\]?$|0\.0\.0\.0)/i;
-function isLoopbackUrl(url) {
-  try {
-    return LOOPBACK.test(new URL(url).hostname);
-  } catch {
-    return true;
-  }
-}
-async function resolveLinkBase(client) {
-  const read = await readQuery(client, "localNetwork.getAddresses", void 0, AddressesSchema);
-  if (!read.ok) return { base: null, reason: read.reason };
-  const usable = read.value.roles.appConnections.resolved.find((u) => !isLoopbackUrl(u));
-  if (usable === void 0) {
-    return {
-      base: null,
-      reason: "no non-loopback address is flagged for app connections (Network page)"
-    };
-  }
-  return { base: usable.replace(/\/+$/, "") };
-}
-function linksFor(link, deviceId, atMs) {
-  if (link.base === null) return { admin: null, viewer: null };
-  return {
-    admin: `${link.base}/devices/${String(deviceId)}`,
-    viewer: buildViewerLink({
-      base: { form: "hub", hubBaseUrl: link.base },
-      destination: {
-        kind: "camera",
-        deviceId,
-        ...atMs !== void 0 ? { atMs } : {}
-      }
-    })
-  };
-}
-var DeviceNameSchema = z3.array(
-  z3.looseObject({
-    id: z3.number(),
-    name: z3.string(),
-    disabled: z3.boolean().optional()
-  })
-);
-var SlimTrackSchema = z3.looseObject({
-  trackId: z3.string(),
-  deviceId: z3.number(),
-  className: z3.string(),
-  firstSeen: z3.number(),
-  lastSeen: z3.number(),
-  state: z3.string().optional(),
-  active: z3.boolean().optional(),
-  classes: z3.array(z3.string()).optional(),
-  zonesVisited: z3.array(z3.string()).optional(),
-  bestEventId: z3.string().optional()
-});
-var TracksPageSchema = z3.looseObject({
-  tracks: z3.array(SlimTrackSchema),
-  nextCursor: z3.string().nullable().optional()
-});
-var ObjectEventsSchema2 = z3.array(
-  z3.looseObject({
-    id: z3.number(),
-    timestamp: z3.number(),
-    className: z3.string().optional(),
-    trackId: z3.string().optional()
-  })
-);
-var DEFAULT_EVENT_WINDOW_MINUTES = 60;
-var MAX_EVENT_WINDOW_MINUTES = 7 * 24 * 60;
-var DEFAULT_RESULT_LIMIT = 20;
-var MAX_RESULT_LIMIT = 50;
-var FETCH_TRACKS = 200;
-var matches = (haystack, needle) => {
-  const n = needle.toLowerCase();
-  return haystack.some((h) => h.toLowerCase().includes(n));
-};
-function trackMatches(track, deviceName, args) {
-  const zones = track.zonesVisited ?? [];
-  if (args.zone !== void 0 && args.zone !== "" && !matches(zones, args.zone)) return false;
-  if (args.text !== void 0 && args.text !== "") {
-    const fields = [
-      track.trackId,
-      track.className,
-      ...track.classes ?? [],
-      ...zones,
-      ...deviceName ? [deviceName] : []
-    ];
-    if (!matches(fields, args.text)) return false;
-  }
-  return true;
-}
-async function opsEvents(ctx, args, now = Date.now()) {
-  return withHub(ctx, async ({ client }) => {
-    const unavailable = {};
-    const windowMinutes = Math.min(
-      args.windowMinutes ?? DEFAULT_EVENT_WINDOW_MINUTES,
-      MAX_EVENT_WINDOW_MINUTES
-    );
-    const limit = Math.min(args.limit ?? DEFAULT_RESULT_LIMIT, MAX_RESULT_LIMIT);
-    const since = now - windowMinutes * 6e4;
-    const window = { sinceMs: since, untilMs: now };
-    const [namesRead, link] = await Promise.all([
-      readQuery(
-        client,
-        "deviceManager.listAll",
-        { projection: "slim", isCamera: true },
-        DeviceNameSchema
-      ),
-      resolveLinkBase(client)
-    ]);
-    const names = /* @__PURE__ */ new Map();
-    if (namesRead.ok) for (const d of namesRead.value) names.set(d.id, d.name);
-    else unavailable["cameras"] = namesRead.reason;
-    const deviceIds = args.deviceId !== void 0 ? [args.deviceId] : namesRead.ok ? namesRead.value.filter((d) => d.disabled !== true).map((d) => d.id) : [];
-    if (deviceIds.length === 0 && args.deviceId === void 0) {
-      return {
-        status: "ok",
-        window,
-        tracks: [],
-        tracksTruncated: 0,
-        moreTracksAvailable: null,
-        unavailable
-      };
-    }
-    const tracksRead = await readQuery(
-      client,
-      "pipelineAnalytics.listRecentTracks",
-      {
-        deviceIds,
-        since,
-        until: now,
-        limit: FETCH_TRACKS,
-        projection: "slim",
-        ...args.className ? { classes: [args.className] } : {}
-      },
-      TracksPageSchema
-    );
-    let tracks = [];
-    let tracksTruncated = 0;
-    let more = null;
-    if (tracksRead.ok) {
-      more = tracksRead.value.nextCursor !== null && tracksRead.value.nextCursor !== void 0;
-      const hits = tracksRead.value.tracks.filter((t) => args.className ? t.className === args.className : true).filter((t) => trackMatches(t, names.get(t.deviceId) ?? null, args)).map(
-        (t) => ({
-          deviceId: t.deviceId,
-          deviceName: names.get(t.deviceId) ?? null,
-          trackId: t.trackId,
-          className: t.className,
-          firstSeen: t.firstSeen,
-          lastSeen: t.lastSeen,
-          durationMs: t.lastSeen - t.firstSeen,
-          state: t.state ?? null,
-          active: t.active ?? null,
-          zonesVisited: t.zonesVisited ?? [],
-          links: linksFor(link, t.deviceId, t.firstSeen)
-        })
-      );
-      const capped = cap(hits, limit);
-      tracks = capped.items;
-      tracksTruncated = capped.truncated;
-    } else {
-      unavailable["tracks"] = tracksRead.reason;
-    }
-    let events;
-    if (args.deviceId !== void 0) {
-      const eventsRead = await readQuery(
-        client,
-        "pipelineAnalytics.getObjectEvents",
-        {
-          deviceId: args.deviceId,
-          since,
-          until: now,
-          limit,
-          projection: "slim",
-          ...args.className ? { classFilter: args.className } : {}
-        },
-        ObjectEventsSchema2
-      );
-      if (eventsRead.ok) {
-        events = eventsRead.value.filter(
-          (e) => args.text ? matches([e.trackId ?? "", e.className ?? ""], args.text) : true
-        ).map(
-          (e) => ({
-            id: e.id,
-            timestamp: e.timestamp,
-            className: e.className ?? null,
-            trackId: e.trackId ?? null,
-            links: linksFor(link, args.deviceId ?? 0, e.timestamp)
-          })
-        );
-      } else {
-        unavailable["events"] = eventsRead.reason;
-      }
-    }
-    return {
-      status: "ok",
-      window,
-      tracks,
-      tracksTruncated,
-      moreTracksAvailable: more,
-      ...events ? { events } : {},
-      ...link.base === null && link.reason ? { linksUnavailable: link.reason } : {},
-      unavailable
-    };
-  });
-}
-var TrackExtrasSchema = z3.looseObject({
-  bestEventId: z3.string().optional(),
-  hasFace: z3.boolean().optional(),
-  importance: z3.number().optional(),
-  previewMissReason: z3.string().optional()
-});
-var MediaListSchema = z3.array(
-  z3.looseObject({
-    mediaId: z3.number(),
-    kind: z3.string(),
-    sizeBytes: z3.number(),
-    timestamp: z3.number()
-  })
-);
-var EXPECTED_MEDIA_KINDS = ["keyFrame", "firstFrame", "lastFrame", "thumbnail"];
-var FINDING_LIMIT = 15;
-function auditMedia(track, extras, media) {
-  const kinds = {};
-  for (const m of media) kinds[m.kind] = (kinds[m.kind] ?? 0) + 1;
-  const has = (kind) => (kinds[kind] ?? 0) > 0;
-  const closed = track.active !== true;
-  const missing = [];
-  if (closed) {
-    for (const kind of EXPECTED_MEDIA_KINDS) {
-      if (has(kind)) continue;
-      let reason;
-      if (kind === "keyFrame") {
-        reason = extras.previewMissReason ?? "no reason recorded on the track (it predates the record, or the capture was never attempted)";
-      } else if (!has("keyFrame") && (kind === "lastFrame" || kind === "thumbnail")) {
-        reason = `follows the missing keyFrame: ${extras.previewMissReason ?? "cause not recorded"}`;
-      } else {
-        reason = "no reason recorded for this kind";
-      }
-      missing.push({ kind, reason });
-    }
-  }
-  const findings = analyzeTrack({
-    track,
-    siblings: [],
-    media,
-    ffEqualsLf: null,
-    enrichment: { face: null, plate: null }
-  });
-  const cappedFindings = cap(findings, FINDING_LIMIT);
-  const at = (kind) => media.find((m) => m.kind === kind)?.timestamp ?? null;
-  return {
-    kinds,
-    bestShot: {
-      eventId: extras.bestEventId ?? null,
-      thumbnailAt: at("thumbnail"),
-      keyFrameAt: at("keyFrame")
-    },
-    keyFrames: {
-      keyFrame: has("keyFrame"),
-      keyFrameSmall: has("keyFrameSmall")
-    },
-    missing,
-    findings: cappedFindings.items.map((f) => ({
-      code: f.code,
-      detail: f.detail
-    })),
-    findingsTruncated: cappedFindings.truncated
-  };
-}
-async function opsTrack(ctx, args) {
-  return withHub(ctx, async ({ client }) => {
-    const unavailable = {};
-    const [trackRead, mediaRead, link] = await Promise.all([
-      readQuery(
-        client,
-        "pipelineAnalytics.getTrack",
-        { deviceId: args.deviceId, trackId: args.trackId },
-        z3.unknown()
-      ),
-      readQuery(
-        client,
-        "pipelineAnalytics.listTrackMedia",
-        { deviceId: args.deviceId, trackId: args.trackId },
-        MediaListSchema
-      ),
-      resolveLinkBase(client)
-    ]);
-    const base = {
-      status: "ok",
-      deviceId: args.deviceId,
-      trackId: args.trackId
-    };
-    if (!trackRead.ok) {
-      unavailable["track"] = trackRead.reason;
-      return { ...base, found: null, unavailable };
-    }
-    if (trackRead.value === null) return { ...base, found: false, unavailable };
-    const parsed = TrackSchema.safeParse(trackRead.value);
-    const extras = TrackExtrasSchema.safeParse(trackRead.value);
-    if (!parsed.success || !extras.success) {
-      unavailable["track"] = "pipelineAnalytics.getTrack: unexpected answer shape";
-      return { ...base, found: null, unavailable };
-    }
-    const track = parsed.data;
-    let media = null;
-    if (mediaRead.ok) media = auditMedia(track, extras.data, mediaRead.value);
-    else unavailable["media"] = mediaRead.reason;
-    return {
-      ...base,
-      found: true,
-      track: {
-        className: track.className,
-        state: track.state ?? null,
-        active: track.active ?? null,
-        firstSeen: track.firstSeen,
-        lastSeen: track.lastSeen,
-        durationMs: track.lastSeen - track.firstSeen,
-        hasFace: extras.data.hasFace ?? null,
-        importance: extras.data.importance ?? null
-      },
-      links: linksFor(link, args.deviceId, track.firstSeen),
-      media,
-      ...link.base === null && link.reason ? { linksUnavailable: link.reason } : {},
-      unavailable
-    };
-  });
-}
-
-// src/mcp/ops-logs.ts
-import { z as z4 } from "zod";
-var LevelSchema = z4.enum(["debug", "info", "warn", "error"]);
-var LogEntrySchema = z4.looseObject({
-  timestamp: z4.string(),
-  level: z4.string(),
-  scope: z4.string().optional(),
-  message: z4.string(),
-  tags: z4.record(z4.string(), z4.string().optional()).optional(),
-  meta: z4.record(z4.string(), z4.unknown()).optional()
-});
-var LogPageSchema = z4.looseObject({
-  entries: z4.array(LogEntrySchema),
-  done: z4.boolean(),
-  source: z4.string()
-});
-var LogSourcesSchema = z4.array(
-  z4.looseObject({
-    addonId: z4.string(),
-    readable: z4.boolean(),
-    isDefault: z4.boolean()
-  })
-);
-var RING_SOURCE = "ring";
-var DEFAULT_WINDOW_MINUTES = 15;
-var MAX_WINDOW_MINUTES = 24 * 60;
-var FETCH_LIMIT = 500;
-var GROUP_LIMIT = 40;
-var DEFAULT_CONTEXT_LINES = 10;
-var CONTEXT_RADIUS_MS = 3e4;
-var SEVERITY = ["error", "warn", "info", "debug"];
-var severityRank = (level) => {
-  const i = SEVERITY.indexOf(level);
-  return i === -1 ? SEVERITY.length : i;
-};
-function messageKey(message) {
-  return message.replace(/\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/gi, "<id>").replace(/\b[0-9a-f]{12,}\b/gi, "<id>").replace(/\b(?=[a-z0-9]*\d)(?=[a-z0-9]*[a-z])[a-z0-9]{8,}\b/gi, "<id>").replace(/\d+/g, "#");
-}
-function groupEntries(entries) {
-  const groups = /* @__PURE__ */ new Map();
-  for (const e of entries) {
-    const key = `${e.level}|${e.scope ?? ""}|${e.tags?.["deviceId"] ?? ""}|${messageKey(e.message)}`;
-    const prior = groups.get(key);
-    if (prior) {
-      groups.set(key, {
-        ...prior,
-        count: prior.count + 1,
-        firstAt: e.timestamp < prior.firstAt ? e.timestamp : prior.firstAt,
-        lastAt: e.timestamp > prior.lastAt ? e.timestamp : prior.lastAt
-      });
-    } else {
-      groups.set(key, {
-        count: 1,
-        level: e.level,
-        scope: e.scope ?? null,
-        message: e.message,
-        firstAt: e.timestamp,
-        lastAt: e.timestamp,
-        deviceId: e.tags?.["deviceId"] ?? null,
-        addonId: e.tags?.["addonId"] ?? null,
-        nodeId: e.tags?.["nodeId"] ?? null
-      });
-    }
-  }
-  return [...groups.values()].sort(
-    (a, b) => severityRank(a.level) - severityRank(b.level) || b.count - a.count
-  );
-}
-function tagsOf(args) {
-  return {
-    ...args.deviceId !== void 0 ? { deviceId: String(args.deviceId) } : {},
-    ...args.addonId ? { addonId: args.addonId } : {},
-    ...args.nodeId ? { nodeId: args.nodeId } : {}
-  };
-}
-function pageInput(q) {
-  const tags = q.tags ?? tagsOf(q.args);
-  return {
-    source: q.source,
-    since: q.since,
-    until: q.until,
-    limit: q.limit,
-    ...q.args.level ? { level: q.args.level } : {},
-    ...Object.keys(tags).length > 0 ? { tags } : {},
-    ...q.text ? { text: q.text } : {}
-  };
-}
-var toMs = (iso) => Date.parse(iso);
-function ringCovers(entries, since, limit) {
-  if (entries.length >= limit) return false;
-  if (entries.length === 0) return false;
-  const oldest = Math.min(...entries.map((e) => toMs(e.timestamp)));
-  return oldest <= since;
-}
-var lineOf = (e) => ({
-  at: e.timestamp,
-  level: e.level,
-  scope: e.scope ?? null,
-  message: e.message,
-  deviceId: e.tags?.["deviceId"] ?? null
-});
-async function opsLogs(ctx, args, now = Date.now()) {
-  return withHub(ctx, async (connection) => {
-    if (connection.tier !== "admin") {
-      return {
-        status: "refused",
-        reason: `logs.query is admin-tier and this credential is not admin-scoped.${connection.adminHint ? ` ${connection.adminHint}` : ""}`
-      };
-    }
-    const client = connection.client;
-    const windowMinutes = Math.min(args.windowMinutes ?? DEFAULT_WINDOW_MINUTES, MAX_WINDOW_MINUTES);
-    const until = now;
-    const since = now - windowMinutes * 6e4;
-    const unavailable = {};
-    const tried = [];
-    const fetchTier = async (source, q) => {
-      tried.push(source === RING_SOURCE ? RING_SOURCE : `persisted:${source}`);
-      const read = await readQuery(client, "logs.query", pageInput({ ...q, source }), LogPageSchema);
-      if (!read.ok) {
-        unavailable[source] = read.reason;
-        return null;
-      }
-      return read.value;
-    };
-    const persistedSource = async () => {
-      const sources = await readQuery(client, "logs.sources", void 0, LogSourcesSchema);
-      if (!sources.ok) {
-        unavailable["logs.sources"] = sources.reason;
-        return null;
-      }
-      return sources.value.find((s) => s.isDefault && s.readable)?.addonId ?? null;
-    };
-    const query = async (q) => {
-      const ring = await fetchTier(RING_SOURCE, q);
-      if (ring && ringCovers(ring.entries, q.since, q.limit))
-        return { tier: RING_SOURCE, page: ring };
-      const persisted = await persistedSource();
-      if (persisted !== null) {
-        const page = await fetchTier(persisted, q);
-        if (page) return { tier: `persisted:${persisted}`, page };
-      }
-      return ring ? { tier: RING_SOURCE, page: ring } : null;
-    };
-    const base = { since, until, args, limit: FETCH_LIMIT };
-    if (args.around !== void 0 && args.around !== "") {
-      const found = await query({ ...base, text: args.around, limit: 20 });
-      if (found === null) {
-        return {
-          status: "ok",
-          tier: "none",
-          tiersTried: tried,
-          window: { sinceMs: since, untilMs: until },
-          scanned: 0,
-          partial: false,
-          unavailable
-        };
-      }
-      const hit = [...found.page.entries].sort((a, b) => toMs(a.timestamp) - toMs(b.timestamp))[0];
-      if (!hit) {
-        return {
-          status: "ok",
-          tier: found.tier,
-          tiersTried: tried,
-          window: { sinceMs: since, untilMs: until },
-          scanned: 0,
-          partial: false,
-          context: { around: args.around, matchedAt: null, lines: [] },
-          unavailable
-        };
-      }
-      const at = toMs(hit.timestamp);
-      const hitTags = hit.tags?.["deviceId"];
-      const around = await query({
-        since: at - CONTEXT_RADIUS_MS,
-        until: at + CONTEXT_RADIUS_MS,
-        args,
-        limit: FETCH_LIMIT,
-        ...args.deviceId === void 0 && hitTags ? { tags: { deviceId: hitTags } } : {}
-      });
-      const n = Math.max(1, args.contextLines ?? DEFAULT_CONTEXT_LINES);
-      const ordered = (around?.page.entries ?? []).sort(
-        (a, b) => toMs(a.timestamp) - toMs(b.timestamp)
-      );
-      const index = ordered.findIndex(
-        (e) => e.timestamp === hit.timestamp && e.message === hit.message
-      );
-      const centre = index === -1 ? 0 : index;
-      const lines = ordered.slice(Math.max(0, centre - n), centre + n + 1).map(lineOf);
-      const out = {
-        status: "ok",
-        tier: around?.tier ?? found.tier,
-        tiersTried: tried,
-        window: { sinceMs: since, untilMs: until },
-        scanned: ordered.length,
-        partial: false,
-        context: {
-          around: args.around,
-          matchedAt: hit.timestamp,
-          lines
-        },
-        unavailable
-      };
-      return out;
-    }
-    const answered = await query({
-      ...base,
-      ...args.text ? { text: args.text } : {}
-    });
-    if (answered === null) {
-      return {
-        status: "ok",
-        tier: "none",
-        tiersTried: tried,
-        window: { sinceMs: since, untilMs: until },
-        scanned: 0,
-        partial: false,
-        unavailable
-      };
-    }
-    const groups = cap(groupEntries(answered.page.entries), GROUP_LIMIT);
-    return {
-      status: "ok",
-      tier: answered.tier,
-      tiersTried: tried,
-      window: { sinceMs: since, untilMs: until },
-      scanned: answered.page.entries.length,
-      partial: !answered.page.done || answered.page.entries.length >= FETCH_LIMIT,
-      groups: groups.items,
-      groupsTruncated: groups.truncated,
-      unavailable
-    };
-  });
-}
-
-// src/mcp/ops-status.ts
-import { z as z5 } from "zod";
-var TopologyNodeSchema = z5.looseObject({
-  id: z5.string(),
-  name: z5.string().optional(),
-  platform: z5.string().optional(),
-  isHub: z5.boolean().optional(),
-  isOnline: z5.boolean(),
-  addons: z5.array(z5.looseObject({ capabilities: z5.array(z5.string()) })).optional(),
-  /** Agents report it; the hub does not. Absent means "not claimed". */
-  capabilitiesRegistered: z5.boolean().optional()
-});
-var TopologySchema = z5.array(TopologyNodeSchema);
-var ServerStatusSchema = z5.looseObject({
-  runningVersion: z5.string(),
-  restartRequired: z5.boolean().optional(),
-  updateAvailable: z5.boolean().optional(),
-  updateState: z5.string().optional()
-});
-var AlertSchema = z5.looseObject({
-  severity: z5.string(),
-  title: z5.string(),
-  message: z5.string().optional(),
-  status: z5.string()
-});
-var AlertsSchema = z5.array(AlertSchema);
-var AddonUpdateSchema = z5.looseObject({
-  name: z5.string(),
-  currentVersion: z5.string(),
-  latestVersion: z5.string()
-});
-var AddonUpdatesSchema = z5.array(AddonUpdateSchema);
-var NODE_LIMIT2 = 40;
-var ALERT_LIMIT = 10;
-var UPDATE_LIMIT = 20;
-function distinctCaps(node) {
-  const names = /* @__PURE__ */ new Set();
-  for (const addon of node.addons ?? []) for (const c of addon.capabilities) names.add(c);
-  return names.size;
-}
-function isCapless(node, count) {
-  if (!node.isOnline) return false;
-  return node.capabilitiesRegistered === false || node.capabilitiesRegistered === void 0 && count === 0;
-}
-async function nodeSummary(connection, node) {
-  const count = distinctCaps(node);
-  const base = {
-    id: node.id,
-    name: node.name ?? null,
-    online: node.isOnline,
-    platform: node.platform ?? null,
-    isHub: node.isHub === true,
-    capabilityCount: count,
-    flags: isCapless(node, count) ? ["online-but-capless"] : []
-  };
-  if (!node.isOnline) {
-    return {
-      ...base,
-      serverVersion: null,
-      versionReason: "node is offline",
-      restartRequired: null,
-      updateAvailable: null
-    };
-  }
-  const input = node.isHub === true ? void 0 : { nodeId: node.id };
-  const status = await readQuery(
-    connection.client,
-    "serverManagement.getServerPackageStatus",
-    input,
-    ServerStatusSchema
-  );
-  if (!status.ok) {
-    return {
-      ...base,
-      serverVersion: null,
-      versionReason: status.reason,
-      restartRequired: null,
-      updateAvailable: null
-    };
-  }
-  return {
-    ...base,
-    serverVersion: status.value.runningVersion,
-    restartRequired: status.value.restartRequired ?? null,
-    updateAvailable: status.value.updateAvailable ?? null
-  };
-}
-function summariseAlerts(alerts) {
-  const active = alerts.filter((a) => a.status === "active");
-  const bySeverity = {};
-  for (const a of active) bySeverity[a.severity] = (bySeverity[a.severity] ?? 0) + 1;
-  const order = ["critical", "error", "warning", "warn", "info"];
-  const rank = (s) => {
-    const i = order.indexOf(s);
-    return i === -1 ? order.length : i;
-  };
-  const sorted = [...active].sort((a, b) => rank(a.severity) - rank(b.severity));
-  const top = cap(sorted, ALERT_LIMIT);
-  return {
-    active: active.length,
-    bySeverity,
-    top: top.items.map((a) => ({ severity: a.severity, title: a.title })),
-    truncated: top.truncated
-  };
-}
-async function opsStatus(ctx) {
-  return withHub(ctx, async (connection) => {
-    const unavailable = {};
-    const admin = connection.tier === "admin";
-    const client = connection.client;
-    const topology = admin ? await readQuery(client, "nodes.topology", void 0, TopologySchema) : {
-      ok: false,
-      reason: ADMIN_ONLY_NOTE("nodes.topology", connection.adminHint)
-    };
-    const [alertsRead, updatesRead] = await Promise.all([
-      readQuery(client, "alerts.list", {}, AlertsSchema),
-      admin ? readQuery(client, "addons.listUpdates", {}, AddonUpdatesSchema) : Promise.resolve({
-        ok: false,
-        reason: ADMIN_ONLY_NOTE("addons.listUpdates", connection.adminHint)
-      })
-    ]);
-    let nodes = null;
-    let nodesTruncated = 0;
-    if (topology.ok) {
-      const capped = cap(topology.value, NODE_LIMIT2);
-      nodesTruncated = capped.truncated;
-      nodes = await Promise.all(capped.items.map((n) => nodeSummary(connection, n)));
-    } else {
-      unavailable["nodes"] = topology.reason;
-    }
-    let alerts = null;
-    if (alertsRead.ok) alerts = summariseAlerts(alertsRead.value);
-    else unavailable["alerts"] = alertsRead.reason;
-    let addonsNeedingUpdate = null;
-    if (updatesRead.ok) {
-      const capped = cap(updatesRead.value, UPDATE_LIMIT);
-      addonsNeedingUpdate = {
-        items: capped.items.map((u) => ({
-          name: u.name,
-          from: u.currentVersion,
-          to: u.latestVersion
-        })),
-        truncated: capped.truncated
-      };
-    } else {
-      unavailable["addonsNeedingUpdate"] = updatesRead.reason;
-    }
-    return {
-      status: "ok",
-      hub: connection.server,
-      tier: connection.tier,
-      nodes,
-      nodesTruncated,
-      alerts,
-      addonsNeedingUpdate,
-      unavailable
-    };
-  });
-}
-
-// src/mcp/ops-tools.ts
-var IDENTITY_CLAIMS = ["sub", "username", "name", "role"];
-function identityOf(token) {
-  const claims = jwtClaims(token);
-  const out = {};
-  if (claims === null) return out;
-  for (const key of IDENTITY_CLAIMS) {
-    const value = claims[key];
-    if (typeof value === "string" && value !== "") out[key] = value;
-  }
-  return out;
-}
-async function whoami(ctx) {
-  const outcome = await ctx.hub();
-  if (!outcome.ok) return noSessionResult(outcome);
-  const c = outcome.connection;
-  return {
-    status: "ok",
-    hub: c.server,
-    tier: c.tier,
-    source: c.source,
-    identity: identityOf(c.token)
-  };
-}
-function registerOpsTools(server, ctx) {
-  server.tool(
-    "ops_whoami",
-    "Which hub this MCP talks to and as whom, from the `camstack login` session (no network call). If there is no session, says to run `camstack login <host>` in a terminal.",
-    {},
-    async () => text(await whoami(ctx))
-  );
-  server.tool(
-    "ops_status",
-    'Cluster summary: every node (online, platform, server version, capability count, "online-but-capless" flag), the active alerts and the addons with an update. A part the hub did not answer is null with its reason in `unavailable`, never zero. Node list and updates need an admin `camstack login`.',
-    {},
-    async () => text(await opsStatus(ctx))
-  );
-  server.tool(
-    "ops_device",
-    "One device: online state, provider addon and node, bound capabilities, runtime-state age and, for a camera, its pipeline, recording state, the functions an operator switched off (not faults) and its latest object events.",
-    { deviceId: z6.number().int() },
-    async ({ deviceId }) => text(await opsDevice(ctx, deviceId))
-  );
-  server.tool(
-    "ops_unhealthy_devices",
-    "Every enabled device that is unhealthy, each with a typed reason (offline, detection-provisioning-failed, detection-not-assigned, recording-inactive). A function an operator switched off is never listed; a camera whose status could not be fully read is listed under `unknown`.",
-    {},
-    async () => text(await opsUnhealthyDevices(ctx))
-  );
-  server.tool(
-    "ops_logs",
-    "Hub logs scoped by deviceId, addon, node, level, window and free text, grouped and deduplicated with counts. Says which tier answered (ring = recent in-RAM; persisted = the default log destination). With `around` (a track or event id) returns `contextLines` lines on each side of its first mention. Needs an admin `camstack login`.",
-    {
-      deviceId: z6.number().int().optional(),
-      addonId: z6.string().optional(),
-      nodeId: z6.string().optional(),
-      level: z6.enum(["debug", "info", "warn", "error"]).optional(),
-      windowMinutes: z6.number().int().min(1).max(1440).optional(),
-      text: z6.string().max(200).optional(),
-      around: z6.string().max(200).optional(),
-      contextLines: z6.number().int().min(1).max(50).optional()
-    },
-    async (args) => text(
-      await opsLogs(ctx, {
-        ...args.deviceId !== void 0 ? { deviceId: args.deviceId } : {},
-        ...args.addonId ? { addonId: args.addonId } : {},
-        ...args.nodeId ? { nodeId: args.nodeId } : {},
-        ...args.level ? { level: args.level } : {},
-        ...args.windowMinutes !== void 0 ? { windowMinutes: args.windowMinutes } : {},
-        ...args.text ? { text: args.text } : {},
-        ...args.around ? { around: args.around } : {},
-        ...args.contextLines !== void 0 ? { contextLines: args.contextLines } : {}
-      })
-    )
-  );
-  server.tool(
-    "ops_events",
-    "Find tracks (and, for one camera, object events) by camera, class, zone, time window and free text. Each result carries an admin-UI link and a viewer link built on the hub address flagged for app connections.",
-    {
-      deviceId: z6.number().int().optional(),
-      className: z6.string().optional(),
-      zone: z6.string().optional(),
-      text: z6.string().max(200).optional(),
-      windowMinutes: z6.number().int().min(1).max(10080).optional(),
-      limit: z6.number().int().min(1).max(50).optional()
-    },
-    async (args) => text(
-      await opsEvents(ctx, {
-        ...args.deviceId !== void 0 ? { deviceId: args.deviceId } : {},
-        ...args.className ? { className: args.className } : {},
-        ...args.zone ? { zone: args.zone } : {},
-        ...args.text ? { text: args.text } : {},
-        ...args.windowMinutes !== void 0 ? { windowMinutes: args.windowMinutes } : {},
-        ...args.limit !== void 0 ? { limit: args.limit } : {}
-      })
-    )
-  );
-  server.tool(
-    "ops_track",
-    "One track with its media audit: best shot, keyframes, every missing media kind with the reason the track recorded for it, and the audit findings. Links to the admin UI and the viewer.",
-    { deviceId: z6.number().int(), trackId: z6.string().min(1) },
-    async ({ deviceId, trackId }) => text(await opsTrack(ctx, { deviceId, trackId }))
-  );
-  server.tool(
-    "ops_accelerators",
-    'Per node: the inference devices it has, the Auto-tune hardware class the node maps to, and whether the measured detector-latency table has a row for that class and accelerator. A node that could not be read is null with a reason, never "no accelerator". Needs an admin `camstack login`.',
-    {},
-    async () => text(await opsAccelerators(ctx))
-  );
-}
-
-// src/mcp/configure-tools.ts
-var CurrentDeviceSchema = z7.object({ name: z7.string() }).nullable();
-var RENAME_DEVICE_TOOL = "configure_rename_device";
-function renameDeviceSpec(client) {
-  return {
-    tool: RENAME_DEVICE_TOOL,
-    async dryRun(args) {
-      const current = CurrentDeviceSchema.safeParse(
-        await client.call("GET", "deviceManager.getDevice", { deviceId: args.deviceId })
-      );
-      if (!current.success || current.data === null) {
-        return {
-          confirmable: false,
-          describe: { problem: `device ${args.deviceId} was not found on the hub` }
-        };
-      }
-      if (current.data.name === args.name) {
-        return {
-          confirmable: false,
-          describe: { problem: `device ${args.deviceId} is already named "${args.name}"` }
-        };
-      }
-      return {
-        confirmable: true,
-        describe: {
-          action: "rename device",
-          deviceId: args.deviceId,
-          from: current.data.name,
-          to: args.name
-        }
-      };
-    },
-    async execute(args) {
-      await client.call("POST", "deviceManager.setName", {
-        deviceId: args.deviceId,
-        name: args.name
-      });
-      return { deviceId: args.deviceId, name: args.name };
-    }
-  };
-}
-async function renameDevice(ctx, args, confirmToken) {
-  const outcome = await ctx.hub();
-  if (!outcome.ok) return noSessionResult(outcome);
-  if (outcome.connection.tier !== "admin") {
-    return {
-      status: "refused",
-      reason: outcome.connection.adminHint ?? "this credential is not admin-scoped"
-    };
-  }
-  return runGated(ctx.gate, renameDeviceSpec(outcome.connection.client), args, confirmToken);
-}
-function registerConfigureTools(server, ctx) {
-  server.tool(
-    RENAME_DEVICE_TOOL,
-    "Rename a device. Two steps: call without confirm_token for a preview and a one-shot token, then call again with the SAME arguments and that token to apply. Needs an admin `camstack login` session.",
-    {
-      deviceId: z7.number().int(),
-      name: z7.string().min(1),
-      confirm_token: z7.string().optional()
-    },
-    async ({ deviceId, name, confirm_token }) => text2(await renameDevice(ctx, { deviceId, name }, confirm_token))
-  );
-}
-
-// src/mcp/setup-tools.ts
-import { text as text3 } from "@camstack/develop";
-import { z as z11 } from "zod";
-
-// src/mcp/setup-hubs.ts
-import * as https from "https";
-import {
-  createHubAgent,
-  explainTlsFailure,
-  HubAddressError,
-  hubCaFileForServer,
-  loadSession,
-  normalizeHubAddress,
-  resolveHubTls
-} from "@camstack/develop";
-import { z as z10 } from "zod";
-
-// src/mcp/setup-install.ts
-import { z as z9 } from "zod";
-
-// src/mcp/setup-install-rules.ts
-import { z as z8 } from "zod";
-var HOST_KINDS = [
-  "docker-compose",
-  "docker",
-  "unraid",
-  "proxmox-lxc",
-  "macos-desktop"
-];
-var HostKindSchema = z8.enum(HOST_KINDS);
-var ROLES = ["hub", "agent"];
-var RoleSchema = z8.enum(ROLES);
-var ACCELERATORS = ["intel", "amd", "coral", "apple", "cpu"];
-var AcceleratorSchema = z8.enum(ACCELERATORS);
-var InstallPathsSchema = z8.object({
-  data: z8.string().min(1),
-  recordings: z8.string().min(1),
-  config: z8.string().min(1).optional(),
-  backups: z8.string().min(1).optional()
-});
-var InstallGuideInputSchema = z8.object({
-  hostKind: HostKindSchema.optional(),
-  role: RoleSchema.optional(),
-  accelerator: AcceleratorSchema.optional(),
-  paths: InstallPathsSchema.optional(),
-  /** Agents only: the hub the agent should dial (host or IP). */
-  hubAddress: z8.string().min(1).optional()
-});
-var RAW = "https://raw.githubusercontent.com/camstack";
-var TEMPLATE_URLS = {
-  compose: {
-    hub: `${RAW}/proxmox/main/compose/hub.yml`,
-    agent: `${RAW}/proxmox/main/compose/agent.yml`
-  },
-  proxmoxInstaller: `${RAW}/proxmox/main/install-camstack-proxmox.sh`,
-  unraid: {
-    hub: `${RAW}/unraid-templates/main/templates/camstack.xml`,
-    agent: `${RAW}/unraid-templates/main/templates/camstack-agent.xml`
-  },
-  latestRelease: "https://api.github.com/repos/camstack/server/releases/latest"
-};
-var IMAGE_REPOSITORY = "ghcr.io/camstack/camstack";
-var IMAGE_TAG_BY_ACCELERATOR = {
-  intel: "intel-latest",
-  amd: "amd-latest",
-  // No Coral- or CPU-specific image: Intel hosts and the Unraid templates track intel-latest.
-  coral: "intel-latest",
-  cpu: "intel-latest",
-  apple: "intel-latest"
-};
-var NO_BARE_LATEST = "There is no bare :latest tag: use intel-<version>/intel-latest or amd-<version>/amd-latest, and never mix them across vendors.";
-var MUST_NOT_OMIT = [
-  "--pids-limit=8192 (pids_limit: 8192): the default 2048 counts threads and silently stops media on a busy hub.",
-  "CAMSTACK_MEDIA_ROOT=/recordings: without it recordings land in /data and fill the cache drive.",
-  "/config mapped: it is a VOLUME, so an unmapped path mints an anonymous volume on every re-create.",
-  "--restart unless-stopped: the NVR must come back after a host reboot.",
-  "CAMSTACK_MOLECULER_USE_HOSTNAME=false: otherwise a multi-machine cluster never forms.",
-  "Coral USB: /dev/bus/usb AND the device-cgroup rule c 189:* rmw."
-];
-var COMPOSE_MARKERS_BY_ACCELERATOR = {
-  intel: ["devices", "dri", "accel"],
-  amd: ["devices", "dri"],
-  coral: ["devices", "usb"],
-  cpu: [],
-  apple: []
-};
-function firstRunHub(host) {
-  return [
-    `Open https://${host}:4443 (a self-signed certificate: accept the browser warning).`,
-    "Sign in as admin / changeme; CamStack asks for a new password at once. Change it now.",
-    `Then, where your MCP client runs: camstack login ${host}`
-  ];
-}
-
-// src/mcp/setup-compose.ts
-var MARKER_LINE = /^(\s*)# (.*#@([A-Za-z0-9_]+)\s*)$/;
-var VOLUME_HOST_PATHS = [
-  { container: "/data", key: "data" },
-  { container: "/recordings", key: "recordings" },
-  { container: "/config", key: "config" },
-  { container: "/backups", key: "backups" }
-];
-function swapImageTag(body, imageTag) {
-  const escaped = IMAGE_REPOSITORY.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  return body.replace(new RegExp(`(${escaped}):[A-Za-z0-9._-]+`), `$1:${imageTag}`);
-}
-function enableMarkers(body, markers) {
-  return body.split("\n").map((line) => {
-    const match = MARKER_LINE.exec(line);
-    if (match === null) return line;
-    const tag = match[3];
-    return tag !== void 0 && markers.includes(tag) ? `${match[1] ?? ""}${match[2] ?? ""}` : line;
-  }).join("\n");
-}
-function setVolumeHosts(body, paths) {
-  const edits = [];
-  let out = body;
-  for (const { container, key } of VOLUME_HOST_PATHS) {
-    const wanted = paths?.[key];
-    const volume = new RegExp(`^(\\s*- )([^\\s:]+)(:${container}\\s*)$`, "m");
-    if (!volume.test(out)) {
-      if (wanted !== void 0) {
-        edits.push(
-          `${container}: no volume line found in the template; map ${wanted} to it yourself`
-        );
-      }
-      continue;
-    }
-    if (wanted === void 0) {
-      edits.push(
-        `${container}: left at the template's host path, change it if that is not where you want it`
-      );
-      continue;
-    }
-    out = out.replace(
-      volume,
-      (_m, pre, _host, post) => `${pre}${wanted}${post}`
-    );
-  }
-  return { body: out, edits };
-}
-function setHubAddress(body, hubAddress) {
-  const line = /^(\s*- CAMSTACK_HUB_ADDRESS=).*$/m;
-  if (!line.test(body)) return { body, edits: [] };
-  if (hubAddress === void 0) {
-    return {
-      body,
-      edits: [
-        "CAMSTACK_HUB_ADDRESS: export it before `docker compose up` (or edit the line) with the hub IP or hostname"
-      ]
-    };
-  }
-  return {
-    body: body.replace(line, (_m, pre) => `${pre}${hubAddress}`),
-    edits: []
-  };
-}
-function customizeCompose(source, c) {
-  const tagged = enableMarkers(swapImageTag(source, c.imageTag), c.markers);
-  const volumes = setVolumeHosts(tagged, c.paths);
-  const hub = setHubAddress(volumes.body, c.hubAddress);
-  return { body: hub.body, edits: [...volumes.edits, ...hub.edits] };
-}
-function unquote(value) {
-  const v = value.trim();
-  if (v.length >= 2 && (v.startsWith('"') || v.startsWith("'")) && v.endsWith(v[0] ?? "")) {
-    return v.slice(1, -1);
-  }
-  return v;
-}
-function stripComment(line) {
-  return line.replace(/\s+#.*$/, "");
-}
-function readService(body) {
-  const fields = {
-    scalars: /* @__PURE__ */ new Map(),
-    lists: /* @__PURE__ */ new Map(),
-    maps: /* @__PURE__ */ new Map()
-  };
-  let key = null;
-  let sub = null;
-  for (const raw of body.split("\n")) {
-    if (raw.trim() === "" || raw.trim().startsWith("#")) continue;
-    const line = stripComment(raw);
-    const indent = line.length - line.trimStart().length;
-    const text4 = line.trim();
-    if (indent === 4) {
-      sub = null;
-      const m = /^([A-Za-z_]+):\s*(.*)$/.exec(text4);
-      if (m === null) continue;
-      key = m[1] ?? null;
-      if (key !== null && (m[2] ?? "") !== "") fields.scalars.set(key, unquote(m[2] ?? ""));
-    } else if (indent === 6 && key !== null) {
-      if (text4.startsWith("- ")) {
-        const list = fields.lists.get(key) ?? [];
-        list.push(unquote(text4.slice(2)));
-        fields.lists.set(key, list);
-      } else {
-        const m = /^([A-Za-z_-]+):\s*(.*)$/.exec(text4);
-        if (m === null) continue;
-        sub = m[1] ?? null;
-        const map = fields.maps.get(key) ?? /* @__PURE__ */ new Map();
-        if ((m[2] ?? "") !== "" && sub !== null) map.set(sub, unquote(m[2] ?? ""));
-        fields.maps.set(key, map);
-      }
-    } else if (indent === 8 && key !== null && sub !== null) {
-      const m = /^([A-Za-z_-]+):\s*(.*)$/.exec(text4);
-      if (m === null) continue;
-      const map = fields.maps.get(`${key}.${sub}`) ?? /* @__PURE__ */ new Map();
-      map.set(m[1] ?? "", unquote(m[2] ?? ""));
-      fields.maps.set(`${key}.${sub}`, map);
-    }
-  }
-  return fields;
-}
-function shellQuote(value) {
-  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
-}
-function composeToDockerRun(body) {
-  const f = readService(body);
-  const image = f.scalars.get("image");
-  if (image === void 0) return null;
-  const args = ["docker run -d"];
-  const name = f.scalars.get("container_name");
-  if (name !== void 0) args.push(`--name ${shellQuote(name)}`);
-  const restart = f.scalars.get("restart");
-  if (restart !== void 0) args.push(`--restart ${shellQuote(restart)}`);
-  const network = f.scalars.get("network_mode");
-  if (network !== void 0) args.push(`--network ${shellQuote(network)}`);
-  const pids = f.scalars.get("pids_limit");
-  if (pids !== void 0) args.push(`--pids-limit=${pids}`);
-  for (const d of f.lists.get("devices") ?? []) args.push(`--device ${shellQuote(d)}`);
-  for (const r of f.lists.get("device_cgroup_rules") ?? []) {
-    args.push(`--device-cgroup-rule ${shellQuote(r)}`);
-  }
-  for (const g of f.lists.get("group_add") ?? []) args.push(`--group-add ${shellQuote(g)}`);
-  for (const v of f.lists.get("volumes") ?? []) args.push(`-v ${shellQuote(v)}`);
-  for (const e of f.lists.get("environment") ?? []) {
-    if (!e.includes("${")) args.push(`-e ${shellQuote(e)}`);
-  }
-  const driver = f.maps.get("logging")?.get("driver");
-  if (driver !== void 0) args.push(`--log-driver ${shellQuote(driver)}`);
-  for (const [k, v] of f.maps.get("logging.options") ?? []) {
-    args.push(`--log-opt ${shellQuote(`${k}=${v}`)}`);
-  }
-  args.push(shellQuote(image));
-  return args.join(" \\\n  ");
-}
-
-// src/mcp/setup-install.ts
-var FETCH_TIMEOUT_MS = 1e4;
-var CONTAINER_ROUTES = ["docker-compose", "docker"];
-var Q_HOST = {
-  id: "hostKind",
-  question: "Where will CamStack run?",
-  options: ["docker-compose", "docker", "unraid", "proxmox-lxc", "macos-desktop"]
-};
-var Q_ROLE = {
-  id: "role",
-  question: "Which role? Start with a hub; an agent only adds a second machine to an existing hub.",
-  options: ["hub", "agent"]
-};
-var Q_ACCEL = {
-  id: "accelerator",
-  question: "Which accelerator does this host have?",
-  options: ["intel", "amd", "coral", "cpu"]
-};
-var Q_PATHS = {
-  id: "paths",
-  question: "Host paths as {data, recordings} (optionally config, backups). Recordings is the one that grows: put it on a roomy disk.",
-  options: []
-};
-function missingQuestions(input) {
-  const out = [];
-  if (input.hostKind === void 0) out.push(Q_HOST);
-  if (input.role === void 0) out.push(Q_ROLE);
-  const desktop = input.hostKind === "macos-desktop";
-  if (!desktop && (input.accelerator === void 0 || input.accelerator === "apple")) {
-    out.push(Q_ACCEL);
-  }
-  if (input.hostKind !== void 0 && CONTAINER_ROUTES.includes(input.hostKind) && input.paths === void 0) {
-    out.push(Q_PATHS);
-  }
-  return out;
-}
-async function fetchText(url, fetchFn) {
-  try {
-    const res = await fetchFn(url, {
-      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
-    });
-    if (!res.ok) {
-      return {
-        ok: false,
-        failure: {
-          status: "fetch-failed",
-          url,
-          error: `answered ${res.status}`
-        }
-      };
-    }
-    return { ok: true, body: await res.text() };
-  } catch (err) {
-    const error = err instanceof Error ? err.message : String(err);
-    return { ok: false, failure: { status: "fetch-failed", url, error } };
-  }
-}
-var ReleaseSchema = z9.object({
-  tag_name: z9.string(),
-  assets: z9.array(z9.object({ name: z9.string(), browser_download_url: z9.string() }))
-});
-var DMG = /^CamStack-[0-9][0-9A-Za-z.-]*-(arm64|x64)\.dmg$/;
-function acceleratorEdits(accelerator, role) {
-  const note = `Image tag ${IMAGE_TAG_BY_ACCELERATOR[accelerator]} for ${accelerator}. ${NO_BARE_LATEST}`;
-  return role === "agent" ? [note, "Do not run a hub and an agent on the same host."] : [note];
-}
-async function composeGuide(input, fetchFn, asDockerRun) {
-  const url = TEMPLATE_URLS.compose[input.role];
-  const fetched = await fetchText(url, fetchFn);
-  if (!fetched.ok) return fetched.failure;
-  const imageTag = IMAGE_TAG_BY_ACCELERATOR[input.accelerator];
-  const custom = customizeCompose(fetched.body, {
-    imageTag,
-    markers: COMPOSE_MARKERS_BY_ACCELERATOR[input.accelerator],
-    paths: input.paths,
-    hubAddress: input.hubAddress
-  });
-  const edits = [...custom.edits, ...acceleratorEdits(input.accelerator, input.role)];
-  const first = firstRun(input);
-  if (!asDockerRun) {
-    return ready(input, imageTag, {
-      steps: [
-        "Save docker-compose.yml (below) in an empty directory on the host.",
-        "docker compose up -d && docker compose logs -f camstack",
-        "The first boot seeds addons and pulls models: allow a few minutes.",
-        ...first
-      ],
-      files: [{ path: "docker-compose.yml", body: custom.body, source: url }],
-      edits
-    });
-  }
-  const run = composeToDockerRun(custom.body);
-  if (run === null) {
-    return {
-      status: "fetch-failed",
-      url,
-      error: "the official compose file has no image line; cannot derive docker run"
-    };
-  }
-  return ready(input, imageTag, {
-    steps: [
-      "Create the host directories named by the -v lines, then run the file below as a shell script.",
-      "docker logs -f camstack (the first boot seeds addons and pulls models).",
-      ...first
-    ],
-    files: [{ path: "run-camstack.sh", body: `#!/bin/sh
-${run}
-`, source: url }],
-    edits
-  });
-}
-async function unraidGuide(input, fetchFn) {
-  const url = TEMPLATE_URLS.unraid[input.role];
-  const fetched = await fetchText(url, fetchFn);
-  if (!fetched.ok) return fetched.failure;
-  const imageTag = IMAGE_TAG_BY_ACCELERATOR[input.accelerator];
-  const edits = [
-    `In the template form, set Repository to ${IMAGE_REPOSITORY}:${imageTag} (the template ships intel-latest). ${NO_BARE_LATEST}`,
-    "Recordings: point it at a roomy array share, not the cache; leave Media root as /recordings.",
-    "Keep ExtraParams as shipped: --device-cgroup-rule and --pids-limit=8192.",
-    ...unraidDeviceEdits(input.accelerator)
-  ];
-  const first = firstRun(input);
-  return ready(input, imageTag, {
-    steps: [
-      `Unraid: Docker > Add Container > Template, paste ${url}`,
-      "Review the paths and Repository (edits below), then Apply.",
-      ...first
-    ],
-    files: [{ path: urlName(url), body: fetched.body, source: url }],
-    edits
-  });
-}
-function unraidDeviceEdits(accelerator) {
-  if (accelerator === "intel" || accelerator === "amd") {
-    return ["Intel/AMD iGPU: enter /dev/dri in that field. Intel NPU: enter /dev/accel."];
-  }
-  if (accelerator === "coral") {
-    return ["Coral USB: enter /dev/bus/usb (the whole bus). Coral PCIe/M.2: /dev/apex_0 (and _1)."];
-  }
-  return [];
-}
-function urlName(url) {
-  return url.slice(url.lastIndexOf("/") + 1);
-}
-async function proxmoxGuide(input, fetchFn) {
-  const url = TEMPLATE_URLS.proxmoxInstaller;
-  const fetched = await fetchText(url, fetchFn);
-  if (!fetched.ok) return fetched.failure;
-  const imageTag = IMAGE_TAG_BY_ACCELERATOR[input.accelerator];
-  const vars = [`ROLE=${input.role}`];
-  vars.push(`IMAGE_TAG=${IMAGE_REPOSITORY}:${imageTag}`);
-  if (input.accelerator === "cpu") vars.push("PASS_ACCEL=none");
-  if (input.role === "agent") vars.push(`CAMSTACK_HUB_ADDRESS=${input.hubAddress ?? "<hub-ip>"}`);
-  if (input.paths !== void 0) vars.push(`RECORDINGS_HOST_PATH=${input.paths.recordings}`);
-  const header = fetched.body.split("\n").slice(1, 20).filter((l) => l.startsWith("#")).join("\n");
-  const first = firstRun(input);
-  return ready(input, imageTag, {
-    steps: [
-      "Run on the Proxmox HOST (needs `pct`), not inside a container. It asks nothing: everything is an environment variable (defaults: VMID 200 hub / 201 agent, 8 cores, 8 GB, 64 GB disk, bridge vmbr0).",
-      `${vars.join(" ")} bash -c "$(curl -fsSL ${url})"`,
-      "It builds an Ubuntu 24.04 LXC with Docker, passes through the accelerators the host has (PASS_ACCEL=none skips it) and starts CamStack.",
-      ...first
-    ],
-    files: [
-      {
-        path: "install-camstack-proxmox.sh (header)",
-        body: header,
-        source: url
-      }
-    ],
-    edits: [
-      `The script defaults to the amd image; IMAGE_TAG above sets ${imageTag}. ${NO_BARE_LATEST}`,
-      "A hub and an agent on one machine need two CTs (host networking collides otherwise)."
-    ]
-  });
-}
-async function macGuide(input, fetchFn) {
-  const url = TEMPLATE_URLS.latestRelease;
-  const fetched = await fetchText(url, fetchFn);
-  if (!fetched.ok) return fetched.failure;
-  let release;
-  try {
-    const parsed = ReleaseSchema.safeParse(JSON.parse(fetched.body));
-    if (!parsed.success) {
-      return {
-        status: "fetch-failed",
-        url,
-        error: "the release answer had no assets"
-      };
-    }
-    release = parsed.data;
-  } catch {
-    return {
-      status: "fetch-failed",
-      url,
-      error: "the release answer was not JSON"
-    };
-  }
-  const dmgs = release.assets.filter((a) => DMG.test(a.name));
-  const first = firstRun(input);
-  return ready(input, null, {
-    steps: [
-      `Download the disk image for your Mac from release ${release.tag_name}: ${dmgs.map((a) => `${a.name} (${a.browser_download_url})`).join(" or ")}. Apple silicon (M1 and later) takes arm64; Intel takes x64. The CamStackViewer files are a different app.`,
-      "Drag CamStack into Applications and open it.",
-      `The setup window asks what this Mac should be: choose ${input.role === "hub" ? "Hub (full server)" : "Agent (worker)"}, then Save and start.`,
-      ...first
-    ],
-    files: [],
-    edits: ["A Mac uses the app, not Docker: a container there cannot reach the Neural Engine."]
-  });
-}
-function firstRun(input) {
-  const host = input.hostKind === "macos-desktop" ? "localhost" : "<host>";
-  if (input.role === "hub") return firstRunHub(host);
-  return [
-    "The agent status dashboard answers on http://<agent-host>:4444.",
-    "Pair it from the hub: run setup_add_node (it lists agents found on the network), then in the admin UI Cluster > Nodes > Agents found on the network. Type the six digits shown on the other screen on BOTH sides."
-  ];
-}
-function ready(input, imageTag, body) {
-  return {
-    status: "ready",
-    hostKind: input.hostKind,
-    role: input.role,
-    imageTag,
-    steps: body.steps,
-    files: body.files,
-    edits: body.edits,
-    mustNotOmit: input.hostKind === "macos-desktop" ? [] : MUST_NOT_OMIT
-  };
-}
-async function installGuide(input, fetchFn) {
-  const questions = missingQuestions(input);
-  if (questions.length > 0) return { status: "need-answers", questions };
-  const { hostKind, role } = input;
-  if (hostKind === void 0 || role === void 0) {
-    return { status: "need-answers", questions: missingQuestions({}) };
-  }
-  const resolved = {
-    hostKind,
-    role,
-    accelerator: hostKind === "macos-desktop" ? "apple" : input.accelerator ?? "cpu",
-    paths: input.paths,
-    hubAddress: input.hubAddress
-  };
-  switch (hostKind) {
-    case "docker-compose":
-      return composeGuide(resolved, fetchFn, false);
-    case "docker":
-      return composeGuide(resolved, fetchFn, true);
-    case "unraid":
-      return unraidGuide(resolved, fetchFn);
-    case "proxmox-lxc":
-      return proxmoxGuide(resolved, fetchFn);
-    case "macos-desktop":
-      return macGuide(resolved, fetchFn);
-  }
-}
-
-// src/mcp/setup-hubs.ts
-var DEFAULT_DISCOVER_TIMEOUT_MS = 2500;
-var MAX_DISCOVER_TIMEOUT_MS = 15e3;
-var HEALTH_TIMEOUT_MS = 5e3;
-var LOGIN = (server) => `run \`camstack login ${server}\` in a terminal`;
-var httpsHealth = (url, tls) => new Promise((resolve) => {
-  const req = https.get(
-    `${url}/health`,
-    { agent: createHubAgent(tls), timeout: HEALTH_TIMEOUT_MS },
-    (res) => {
-      res.resume();
-      resolve({ ok: true, status: res.statusCode ?? 0 });
-    }
-  );
-  req.on("timeout", () => req.destroy(new Error("timed out")));
-  req.on("error", (err) => {
-    resolve({
-      ok: false,
-      error: err.message,
-      tlsHint: explainTlsFailure(url, err)
-    });
-  });
-});
-async function discoverHubsTool(timeoutMs, deps) {
-  const wait = Math.min(timeoutMs ?? DEFAULT_DISCOVER_TIMEOUT_MS, MAX_DISCOVER_TIMEOUT_MS);
-  const finder = deps.findHubs ?? ((ms) => findHubs({
-    mdnsTimeoutMs: ms,
-    ...deps.sessionDir !== void 0 ? { sessionDir: deps.sessionDir } : {},
-    ...deps.env !== void 0 ? { env: deps.env } : {}
-  }));
-  const found = await finder(wait);
-  const hubs = found.map((h) => ({
-    host: h.host,
-    port: h.port,
-    name: h.nodeId,
-    version: h.version,
-    sources: h.sources
-  }));
-  return {
-    status: "ok",
-    hubs,
-    next: hubs.length === 0 ? "no hub answered: install one with setup_install_guide, or pass its address to setup_connect" : "pass the host of the hub you want to setup_connect"
-  };
-}
-function pinnedTls(url, deps) {
-  const caFile = hubCaFileForServer(url, deps.sessionDir);
-  try {
-    return {
-      tls: resolveHubTls(url, deps.env ?? process.env, deps.sessionDir),
-      caFile
-    };
-  } catch {
-    return { tls: {}, caFile };
-  }
-}
-async function connectTool(server, deps) {
-  let url;
-  try {
-    url = normalizeHubAddress(server);
-  } catch (err) {
-    const message = err instanceof HubAddressError ? err.message : String(err);
-    return { status: "invalid-address", server, message };
-  }
-  const { tls, caFile } = pinnedTls(url, deps);
-  const outcome = await (deps.health ?? httpsHealth)(url, tls);
-  const caPinned = tls.ca !== void 0;
-  const session = loadSession(url, deps.sessionDir);
-  const sessionInfo = {
-    exists: session !== null,
-    username: session?.username ?? null
-  };
-  if (!outcome.ok) {
-    return {
-      status: "unreachable",
-      server: url,
-      message: outcome.error,
-      tls: { caPinned, caFile, hint: outcome.tlsHint },
-      session: sessionInfo,
-      next: outcome.tlsHint === null ? "check the host, that the hub is running, and that port 4443 is reachable" : `the hub answers but its certificate is not trusted: ${LOGIN(url)}; login pins the CA (never disable verification)`
-    };
-  }
-  return {
-    status: "reachable",
-    server: url,
-    health: { status: outcome.status },
-    tls: { caPinned, caFile, hint: null },
-    session: sessionInfo,
-    next: session === null ? LOGIN(url) : "a session exists: the ops tools can use it"
-  };
-}
-var DiscoveredAgentsSchema = z10.object({
-  agents: z10.array(
-    z10.object({
-      nodeId: z10.string(),
-      host: z10.string(),
-      port: z10.number(),
-      version: z10.string().nullable(),
-      name: z10.string().nullable(),
-      state: z10.enum(["unpaired", "pending", "paired"])
-    })
-  )
-});
-var PAIRING_STEPS = [
-  "Pairing is started from the HUB (D857): admin UI, Cluster > Nodes > Agents found on the network. Pick the agent, or add it by address (host and port 4444).",
-  "Both screens now show six digits. Type the digits shown on the OTHER screen, on BOTH sides: the hub operator types the code the agent shows, and the agent operator confirms on the agent.",
-  "The agent installs its certificate only after its own operator confirmed. Nothing here (and no tool of this MCP) confirms a pairing for you.",
-  "The agent then appears under Cluster > Nodes."
-];
-async function addNodeTool(input, ctx) {
-  const guide = await installGuide({ ...input, role: "agent" }, ctx.fetch);
-  const outcome = await ctx.hub();
-  if (!outcome.ok) {
-    return {
-      guide,
-      pairing: PAIRING_STEPS,
-      agentsOnNetwork: { status: "no-session", action: outcome.action }
-    };
-  }
-  try {
-    const raw = await outcome.connection.client.call("GET", "agentPairing.listDiscoveredAgents", {});
-    const parsed = DiscoveredAgentsSchema.safeParse(raw);
-    return {
-      guide,
-      pairing: PAIRING_STEPS,
-      agentsOnNetwork: parsed.success ? { status: "ok", agents: parsed.data.agents } : {
-        status: "unavailable",
-        error: "the hub answered in an unexpected shape"
-      }
-    };
-  } catch (err) {
-    return {
-      guide,
-      pairing: PAIRING_STEPS,
-      agentsOnNetwork: {
-        status: "unavailable",
-        error: err instanceof Error ? err.message : String(err)
-      }
-    };
-  }
-}
-
-// src/mcp/setup-tools.ts
-var SUPPORTED_HOST_KINDS = HOST_KINDS;
-var REGISTRY = "https://registry.npmjs.org";
-var REGISTRY_TIMEOUT_MS = 5e3;
-var RegistryLatestSchema = z11.object({ version: z11.string() });
-async function latestOnNpm(name, fetchFn) {
-  const url = `${REGISTRY}/${name.replace("/", "%2f")}/latest`;
-  try {
-    const res = await fetchFn(url, {
-      signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS)
-    });
-    if (!res.ok) return { latest: null, error: `registry answered ${res.status}` };
-    const parsed = RegistryLatestSchema.safeParse(await res.json());
-    if (!parsed.success) return { latest: null, error: "registry answer had no version" };
-    return { latest: parsed.data.version };
-  } catch (err) {
-    return {
-      latest: null,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
-async function about(ctx) {
-  const [cli, server] = await Promise.all([
-    latestOnNpm("camstack", ctx.fetch),
-    latestOnNpm("@camstack/server", ctx.fetch)
-  ]);
-  return {
-    cli: { installed: ctx.cliVersion, ...cli },
-    server,
-    supportedHostKinds: SUPPORTED_HOST_KINDS
-  };
-}
-function registerSetupTools(server, ctx, deps = {}) {
-  server.tool(
-    "setup_about",
-    "Versions of the camstack CLI (installed and latest on npm), the latest @camstack/server on npm, and the host kinds CamStack supports. Needs no hub and no login.",
-    {},
-    async () => text3(await about(ctx))
-  );
-  server.tool(
-    "setup_install_guide",
-    'Interview-style install guide. Call it with whatever you know; while an answer is missing it returns {status:"need-answers", questions} listing only what is still unknown. When complete it returns the steps and the OFFICIAL template files (fetched live) for that route: docker-compose, docker, unraid, proxmox-lxc or macos-desktop. Start with a hub.',
-    {
-      hostKind: HostKindSchema.optional(),
-      role: RoleSchema.optional(),
-      accelerator: AcceleratorSchema.optional(),
-      paths: InstallPathsSchema.optional(),
-      hubAddress: z11.string().min(1).optional().describe("Agents only: the hub to dial.")
-    },
-    async (input) => text3(await installGuide(input, ctx.fetch))
-  );
-  server.tool(
-    "setup_discover_hubs",
-    "Find CamStack hubs on the local network (mDNS) plus the hubs this machine already knows, with host, port, name and version. Needs no login.",
-    { timeoutMs: z11.number().int().min(200).max(15e3).optional() },
-    async ({ timeoutMs }) => text3(await discoverHubsTool(timeoutMs, deps))
-  );
-  server.tool(
-    "setup_connect",
-    "Check that a hub answers on https://<server>:4443/health, whether its CA is already pinned for TLS, and whether a `camstack login` session exists. Never takes a password: when there is no session it says to run `camstack login <server>` in a terminal.",
-    { server: z11.string().min(1) },
-    async ({ server: address }) => text3(await connectTool(address, deps))
-  );
-  server.tool(
-    "setup_add_node",
-    "Guide to add an AGENT (a second machine) to a hub: the install route for that host, then the pairing flow where the operator types the six digits shown on the other screen on both sides. With a login session it also lists the agents found on the network. It never confirms a pairing.",
-    {
-      hostKind: HostKindSchema.optional(),
-      accelerator: AcceleratorSchema.optional(),
-      paths: InstallPathsSchema.optional(),
-      hubAddress: z11.string().min(1).optional()
-    },
-    async (input) => text3(await addNodeTool(input, ctx))
-  );
-}
-
-// src/mcp/server.ts
-function createPublicServer(options) {
-  const server = new McpServer({ name: "camstack", version: options.context.cliVersion });
-  const { toolsets, context } = options;
-  if (toolsets.includes("setup")) registerSetupTools(server, context);
-  if (toolsets.includes("ops")) registerOpsTools(server, context);
-  if (toolsets.includes("configure")) registerConfigureTools(server, context);
-  if (toolsets.includes("develop") && options.registerDevelop) options.registerDevelop(server);
-  return server;
-}
-function sessionHub(options) {
-  return () => tryConnectHub({
-    workspaceRoot: process.cwd(),
-    ...options.server ? { server: options.server } : {},
-    ...options.tokenFile ? { tokenFile: options.tokenFile } : {}
-  });
-}
-var registryFetch = (url, init) => fetch(url, init);
-async function runPublicMcp(options) {
-  const gate = new MutationGate({ allowMutations: true });
-  const context = {
-    cliVersion: options.cliVersion,
-    hub: sessionHub(options),
-    gate,
-    fetch: registryFetch
-  };
-  const registerDevelop = options.toolsets.includes("develop") ? (await import("@camstack/mcp-develop")).registerDevelopTools : void 0;
-  const server = createPublicServer({
-    toolsets: options.toolsets,
-    context,
-    ...registerDevelop ? { registerDevelop } : {}
-  });
-  await server.connect(new StdioServerTransport());
-}
-export {
-  createPublicServer,
-  runPublicMcp
-};