camstack 1.2.211 → 1.2.212

package/dist/{server-OYJZ5RCY.js → server-2GOCBDEY.js}

@@ -17,7 +17,7 @@ import {
   prepareRecipeUnits,
   unitsForQuantity,
   validateRecipeBounds
-} from "./chunk-NAUJQNCX.js";
+} from "./chunk-MLWXP2SI.js";
 import "./chunk-LMMQX4CK.js";
 
 // src/mcp/server.ts
@@ -27,10 +27,10 @@ import { MutationGate, tryConnectHub } from "@camstack/develop";
 
 // src/mcp/configure-tools.ts
 import {
-  runGated as runGated3,
-  text as text11
+  runGated as runGated4,
+  text as text12
 } from "@camstack/develop";
-import { z as z19 } from "zod";
+import { z as z26 } from "zod";
 
 // src/mcp/configure-automations.ts
 import { z as z4 } from "zod";
@@ -3730,7 +3730,7 @@ function addCameraSpec(client) {
       const plan = await planAdd(client, args);
       if (!plan.ok) throw new Error(plan.problems.join("; "));
       const link = await providerPage(client, args.addonId);
-      const needs = plan.secretNeeds.map((f) => secretRequired(f, link));
+      const needs2 = plan.secretNeeds.map((f) => secretRequired(f, link));
       let raw;
       try {
         raw = await client.call("POST", "deviceManager.createDevice", {
@@ -3742,7 +3742,7 @@ function addCameraSpec(client) {
         return {
           created: false,
           adminUi: link,
-          incompleteUntilSecretSet: needs,
+          incompleteUntilSecretSet: needs2,
           error: reasonOf(err)
         };
       }
@@ -3751,7 +3751,7 @@ function addCameraSpec(client) {
         return {
           created: false,
           adminUi: link,
-          incompleteUntilSecretSet: needs,
+          incompleteUntilSecretSet: needs2,
           error: "the hub answered in an unexpected shape; check the Devices page before retrying"
         };
       }
@@ -3761,7 +3761,7 @@ function addCameraSpec(client) {
         deviceId: created.data.id,
         name: created.data.name,
         adminUi: base.base === null ? null : `${base.base}/devices/${String(created.data.id)}`,
-        incompleteUntilSecretSet: needs
+        incompleteUntilSecretSet: needs2
       };
     }
   };
@@ -4050,12 +4050,12 @@ function testTargetSpec(client) {
       if (view.incomplete.length > 0) {
         const form = kinds.ok ? kinds.value.find((k) => k.kind === target.kind) : void 0;
         const link = await notificationsPage(client);
-        const needs = (form?.fields ?? []).filter((f) => view.incomplete.includes(f.key)).map((f) => secretRequired(f, link));
+        const needs2 = (form?.fields ?? []).filter((f) => view.incomplete.includes(f.key)).map((f) => secretRequired(f, link));
         return {
           confirmable: false,
           describe: {
             problem: `target ${target.id} is incomplete until its secret is set`,
-            secretRequired: needs
+            secretRequired: needs2
           }
         };
       }
@@ -4150,8 +4150,8 @@ function registerNotifierTools(server, ctx) {
 }
 
 // src/mcp/ops-tools.ts
-import { z as z18 } from "zod";
-import { jwtClaims, text as text10 } from "@camstack/develop";
+import { z as z25 } from "zod";
+import { jwtClaims, text as text11 } from "@camstack/develop";
 
 // src/mcp/ops-accelerators.ts
 import { z as z14 } from "zod";
@@ -5040,195 +5040,189 @@ async function opsStatus(ctx) {
   });
 }
 
-// src/mcp/ops-tools.ts
-var IDENTITY_CLAIMS = ["sub", "username", "name", "role"];
-function identityOf(token) {
-  const claims = jwtClaims(token);
-  const out = {};
-  if (claims === null) return out;
-  for (const key of IDENTITY_CLAIMS) {
-    const value = claims[key];
-    if (typeof value === "string" && value !== "") out[key] = value;
-  }
-  return out;
+// src/mcp/ops-update-apply.ts
+import {
+  runGated as runGated3
+} from "@camstack/develop";
+import { z as z23 } from "zod";
+
+// src/mcp/ops-update-model.ts
+import { z as z18 } from "zod";
+var ImageContractShape = z18.looseObject({
+  state: z18.enum(["in-sync", "behind-patch", "behind-series", "ahead", "unknown"]),
+  seedVersion: z18.string().nullable(),
+  contractVersion: z18.string().nullable(),
+  message: z18.string().optional()
+});
+var WrapperShape = z18.looseObject({
+  kind: z18.enum(["docker", "electron", "native", "contradictory", "unknown"]),
+  currentVersion: z18.string().nullable().optional()
+});
+var ServerStatusShape2 = z18.looseObject({
+  runningVersion: z18.string().nullable(),
+  installedVersion: z18.string().nullable().optional(),
+  latestVersion: z18.string().nullable().optional(),
+  pendingVersion: z18.string().nullable().optional(),
+  restartRequired: z18.boolean().optional(),
+  updateAvailable: z18.boolean().optional(),
+  updateState: z18.string().optional(),
+  lastCheckedAtMs: z18.number().nullable().optional(),
+  rolledBack: z18.looseObject({
+    fromVersion: z18.string(),
+    toVersion: z18.string().nullable(),
+    reason: z18.string()
+  }).nullable().optional(),
+  imageContract: ImageContractShape.optional(),
+  wrapper: WrapperShape.optional()
+});
+var AddonUpdateShape = z18.looseObject({
+  name: z18.string(),
+  currentVersion: z18.string(),
+  latestVersion: z18.string(),
+  category: z18.enum(["addon", "core"]),
+  requiresRestart: z18.boolean().optional(),
+  isSystem: z18.boolean()
+});
+var InstallationsShape2 = z18.looseObject({
+  installations: z18.array(
+    z18.looseObject({
+      packageName: z18.string(),
+      nodeId: z18.string(),
+      isHub: z18.boolean(),
+      isOnline: z18.boolean(),
+      version: z18.string().nullable(),
+      onHub: z18.boolean().optional()
+    })
+  ),
+  unreachable: z18.array(z18.looseObject({ nodeId: z18.string(), error: z18.string() }))
+});
+var ServerActionShape = z18.looseObject({
+  accepted: z18.boolean().optional(),
+  outcome: z18.enum(["staged", "restart-scheduled", "already-current", "refused", "failed"]).optional(),
+  reason: z18.string().nullable().optional(),
+  error: z18.string().nullable().optional(),
+  message: z18.string().optional(),
+  blockers: z18.array(z18.looseObject({ addonId: z18.string(), reason: z18.string() })).optional()
+});
+function statusInput(node) {
+  return node.isHub === true ? void 0 : { nodeId: node.id };
 }
-async function whoami(ctx) {
-  const outcome = await ctx.hub();
-  if (!outcome.ok) return noSessionResult(outcome);
-  const c = outcome.connection;
-  return {
-    status: "ok",
-    hub: c.server,
-    tier: c.tier,
-    source: c.source,
-    identity: identityOf(c.token)
-  };
+function readTopology(client) {
+  return readQuery(client, "nodes.topology", void 0, TopologySchema);
 }
-function registerOpsTools(server, ctx) {
-  server.tool(
-    "ops_whoami",
-    "Which hub this MCP talks to and as whom, from the `camstack login` session (no network call). If there is no session, says to run `camstack login <host>` in a terminal.",
-    {},
-    async () => text10(await whoami(ctx))
-  );
-  server.tool(
-    "ops_status",
-    'Cluster summary: every node (online, platform, server version, capability count, "online-but-capless" flag), the active alerts and the addons with an update. A part the hub did not answer is null with its reason in `unavailable`, never zero. Node list and updates need an admin `camstack login`.',
-    {},
-    async () => text10(await opsStatus(ctx))
-  );
-  server.tool(
-    "ops_device",
-    "One device: online state, provider addon and node, bound capabilities, runtime-state age and, for a camera, its pipeline, recording state, the functions an operator switched off (not faults) and its latest object events.",
-    { deviceId: z18.number().int() },
-    async ({ deviceId }) => text10(await opsDevice(ctx, deviceId))
-  );
-  server.tool(
-    "ops_unhealthy_devices",
-    "Every enabled device that is unhealthy, each with a typed reason (offline, detection-provisioning-failed, detection-not-assigned, recording-inactive). A function an operator switched off is never listed; a camera whose status could not be fully read is listed under `unknown`.",
-    {},
-    async () => text10(await opsUnhealthyDevices(ctx))
-  );
-  server.tool(
-    "ops_logs",
-    "Hub logs scoped by deviceId, addon, node, level, window and free text, grouped and deduplicated with counts. Says which tier answered (ring = recent in-RAM; persisted = the default log destination). With `around` (a track or event id) returns `contextLines` lines on each side of its first mention. Needs an admin `camstack login`.",
-    {
-      deviceId: z18.number().int().optional(),
-      addonId: z18.string().optional(),
-      nodeId: z18.string().optional(),
-      level: z18.enum(["debug", "info", "warn", "error"]).optional(),
-      windowMinutes: z18.number().int().min(1).max(1440).optional(),
-      text: z18.string().max(200).optional(),
-      around: z18.string().max(200).optional(),
-      contextLines: z18.number().int().min(1).max(50).optional()
-    },
-    async (args) => text10(
-      await opsLogs(ctx, {
-        ...args.deviceId !== void 0 ? { deviceId: args.deviceId } : {},
-        ...args.addonId ? { addonId: args.addonId } : {},
-        ...args.nodeId ? { nodeId: args.nodeId } : {},
-        ...args.level ? { level: args.level } : {},
-        ...args.windowMinutes !== void 0 ? { windowMinutes: args.windowMinutes } : {},
-        ...args.text ? { text: args.text } : {},
-        ...args.around ? { around: args.around } : {},
-        ...args.contextLines !== void 0 ? { contextLines: args.contextLines } : {}
-      })
-    )
-  );
-  server.tool(
-    "ops_events",
-    "Find tracks (and, for one camera, object events) by camera, class, zone, time window and free text. Each result carries an admin-UI link and a viewer link built on the hub address flagged for app connections.",
-    {
-      deviceId: z18.number().int().optional(),
-      className: z18.string().optional(),
-      zone: z18.string().optional(),
-      text: z18.string().max(200).optional(),
-      windowMinutes: z18.number().int().min(1).max(10080).optional(),
-      limit: z18.number().int().min(1).max(50).optional()
-    },
-    async (args) => text10(
-      await opsEvents(ctx, {
-        ...args.deviceId !== void 0 ? { deviceId: args.deviceId } : {},
-        ...args.className ? { className: args.className } : {},
-        ...args.zone ? { zone: args.zone } : {},
-        ...args.text ? { text: args.text } : {},
-        ...args.windowMinutes !== void 0 ? { windowMinutes: args.windowMinutes } : {},
-        ...args.limit !== void 0 ? { limit: args.limit } : {}
-      })
-    )
-  );
-  server.tool(
-    "ops_track",
-    "One track with its media audit: best shot, keyframes, every missing media kind with the reason the track recorded for it, and the audit findings. Links to the admin UI and the viewer.",
-    { deviceId: z18.number().int(), trackId: z18.string().min(1) },
-    async ({ deviceId, trackId }) => text10(await opsTrack(ctx, { deviceId, trackId }))
-  );
-  server.tool(
-    "ops_accelerators",
-    'Per node: the inference devices it has, the Auto-tune hardware class the node maps to, and whether the measured detector-latency table has a row for that class and accelerator. A node that could not be read is null with a reason, never "no accelerator". Needs an admin `camstack login`.',
-    {},
-    async () => text10(await opsAccelerators(ctx))
+function readNodeStatus(client, node) {
+  return readQuery(
+    client,
+    "serverManagement.getServerPackageStatus",
+    statusInput(node),
+    ServerStatusShape2
   );
 }
-
-// src/mcp/configure-tools.ts
-var CurrentDeviceSchema = z19.object({ name: z19.string() }).nullable();
-var RENAME_DEVICE_TOOL = "configure_rename_device";
-function renameDeviceSpec(client) {
+function readInstallations(client) {
+  return readQuery(client, "addons.listInstallations", {}, InstallationsShape2);
+}
+function serverVerdict(status) {
   return {
-    tool: RENAME_DEVICE_TOOL,
-    async dryRun(args) {
-      const current = CurrentDeviceSchema.safeParse(
-        await client.call("GET", "deviceManager.getDevice", {
-          deviceId: args.deviceId
-        })
-      );
-      if (!current.success || current.data === null) {
-        return {
-          confirmable: false,
-          describe: {
-            problem: `device ${args.deviceId} was not found on the hub`
-          }
-        };
-      }
-      if (current.data.name === args.name) {
-        return {
-          confirmable: false,
-          describe: {
-            problem: `device ${args.deviceId} is already named "${args.name}"`
-          }
-        };
-      }
-      return {
-        confirmable: true,
-        describe: {
-          action: "rename device",
-          deviceId: args.deviceId,
-          from: current.data.name,
-          to: args.name
-        }
-      };
-    },
-    async execute(args) {
-      await client.call("POST", "deviceManager.setName", {
-        deviceId: args.deviceId,
-        name: args.name
-      });
-      return { deviceId: args.deviceId, name: args.name };
-    }
+    running: status.runningVersion,
+    installed: status.installedVersion ?? null,
+    latest: status.latestVersion ?? null,
+    pending: status.pendingVersion ?? null,
+    updateAvailable: status.updateAvailable ?? null,
+    restartRequired: status.restartRequired ?? null,
+    updateState: status.updateState ?? null,
+    rolledBack: status.rolledBack ? {
+      from: status.rolledBack.fromVersion,
+      to: status.rolledBack.toVersion,
+      reason: status.rolledBack.reason
+    } : null,
+    latestCheckedAt: status.lastCheckedAtMs !== void 0 && status.lastCheckedAtMs !== null ? new Date(status.lastCheckedAtMs).toISOString() : null
   };
 }
-async function renameDevice(ctx, args, confirmToken) {
-  const outcome = await ctx.hub();
-  if (!outcome.ok) return noSessionResult(outcome);
-  if (outcome.connection.tier !== "admin") {
+function wrapperInstructions(kind) {
+  switch (kind) {
+    case "docker":
+      return [
+        "The image is replaced, not the closure: pull the new image and RECREATE the container (a plain restart keeps the old image).",
+        "Docker Compose: `docker compose pull` then `docker compose up -d`.",
+        'Unraid: Docker tab, "Check for updates", then apply the update on the CamStack container (it is recreated from the new image; keep the same appdata paths).',
+        'Proxmox LXC: recreate the container the way it was installed; `setup_install_guide` with hostKind "proxmox-lxc" returns the official steps.',
+        "Back up the data volume first; no tool here does it."
+      ];
+    case "electron":
+      return [
+        "Update the CamStack desktop app on that machine: install the new app version (the in-app update, or reinstall from the release) and let the app restart.",
+        "The server closure update does not change the app bundle."
+      ];
+    case "native":
+      return [
+        "This node runs as a bare host process: update the package or service that starts it (the starter is not delivered by the closure update), then restart the service."
+      ];
+    default:
+      return [
+        "The shell this node runs in could not be identified; check how it was installed (`setup_install_guide` lists the routes) and update it that way."
+      ];
+  }
+}
+function wrapperVerdict(status) {
+  const kind = status.wrapper?.kind ?? null;
+  const contract = status.imageContract;
+  if (contract === void 0) {
     return {
-      status: "refused",
-      reason: outcome.connection.adminHint ?? "this credential is not admin-scoped"
+      kind,
+      behind: null,
+      state: null,
+      from: null,
+      to: null,
+      message: "this node reports no image contract (its server predates it); the shell is unverified",
+      instructions: []
     };
   }
-  return runGated3(ctx.gate, renameDeviceSpec(outcome.connection.client), args, confirmToken);
+  const behind = contract.state === "behind-patch" || contract.state === "behind-series" ? true : contract.state === "in-sync" ? false : null;
+  return {
+    kind,
+    behind,
+    state: contract.state,
+    from: contract.seedVersion,
+    to: contract.contractVersion,
+    message: contract.message ?? null,
+    instructions: behind === true ? wrapperInstructions(kind) : []
+  };
 }
-function registerConfigureTools(server, ctx) {
-  server.tool(
-    RENAME_DEVICE_TOOL,
-    "Rename a device. Two steps: call without confirm_token for a preview and a one-shot token, then call again with the SAME arguments and that token to apply. Needs an admin `camstack login` session.",
-    {
-      deviceId: z19.number().int(),
-      name: z19.string().min(1),
-      confirm_token: z19.string().optional()
-    },
-    async ({ deviceId, name, confirm_token }) => text11(await renameDevice(ctx, { deviceId, name }, confirm_token))
-  );
-  registerAddonTools(server, ctx);
-  registerCameraTools(server, ctx);
-  registerNotifierTools(server, ctx);
-  registerConfigureP3bTools(server, ctx);
+function needsServerUpdate(verdict) {
+  return verdict.updateAvailable === true || verdict.restartRequired === true;
+}
+function capState(node) {
+  const count = distinctCaps(node);
+  return { count, capless: isCapless(node, count) };
+}
+function addonDrift(installations) {
+  const hubVersion = /* @__PURE__ */ new Map();
+  for (const row of installations.installations) {
+    if (row.isHub && row.version !== null) hubVersion.set(row.packageName, row.version);
+  }
+  const drift = [];
+  for (const row of installations.installations) {
+    if (row.isHub) continue;
+    const hub = hubVersion.get(row.packageName);
+    if (hub === void 0) continue;
+    if (row.version !== hub) {
+      drift.push({
+        packageName: row.packageName,
+        nodeId: row.nodeId,
+        hubVersion: hub,
+        nodeVersion: row.version
+      });
+    }
+  }
+  return drift;
 }
 
+// src/mcp/ops-update-cli.ts
+import { execFile } from "child_process";
+
 // src/mcp/setup-tools.ts
-import { text as text12 } from "@camstack/develop";
-import { z as z23 } from "zod";
+import { text as text10 } from "@camstack/develop";
+import { z as z22 } from "zod";
 
 // src/mcp/setup-hubs.ts
 import * as https from "https";
@@ -5241,13 +5235,13 @@ import {
   normalizeHubAddress,
   resolveHubTls
 } from "@camstack/develop";
-import { z as z22 } from "zod";
+import { z as z21 } from "zod";
 
 // src/mcp/setup-install.ts
-import { z as z21 } from "zod";
+import { z as z20 } from "zod";
 
 // src/mcp/setup-install-rules.ts
-import { z as z20 } from "zod";
+import { z as z19 } from "zod";
 var HOST_KINDS = [
   "docker-compose",
   "docker",
@@ -5255,24 +5249,24 @@ var HOST_KINDS = [
   "proxmox-lxc",
   "macos-desktop"
 ];
-var HostKindSchema = z20.enum(HOST_KINDS);
+var HostKindSchema = z19.enum(HOST_KINDS);
 var ROLES = ["hub", "agent"];
-var RoleSchema = z20.enum(ROLES);
+var RoleSchema = z19.enum(ROLES);
 var ACCELERATORS = ["intel", "amd", "coral", "apple", "cpu"];
-var AcceleratorSchema = z20.enum(ACCELERATORS);
-var InstallPathsSchema = z20.object({
-  data: z20.string().min(1),
-  recordings: z20.string().min(1),
-  config: z20.string().min(1).optional(),
-  backups: z20.string().min(1).optional()
+var AcceleratorSchema = z19.enum(ACCELERATORS);
+var InstallPathsSchema = z19.object({
+  data: z19.string().min(1),
+  recordings: z19.string().min(1),
+  config: z19.string().min(1).optional(),
+  backups: z19.string().min(1).optional()
 });
-var InstallGuideInputSchema = z20.object({
+var InstallGuideInputSchema = z19.object({
   hostKind: HostKindSchema.optional(),
   role: RoleSchema.optional(),
   accelerator: AcceleratorSchema.optional(),
   paths: InstallPathsSchema.optional(),
   /** Agents only: the hub the agent should dial (host or IP). */
-  hubAddress: z20.string().min(1).optional()
+  hubAddress: z19.string().min(1).optional()
 });
 var RAW = "https://raw.githubusercontent.com/camstack";
 var TEMPLATE_URLS = {
@@ -5532,9 +5526,9 @@ async function fetchText(url, fetchFn) {
     return { ok: false, failure: { status: "fetch-failed", url, error } };
   }
 }
-var ReleaseSchema = z21.object({
-  tag_name: z21.string(),
-  assets: z21.array(z21.object({ name: z21.string(), browser_download_url: z21.string() }))
+var ReleaseSchema = z20.object({
+  tag_name: z20.string(),
+  assets: z20.array(z20.object({ name: z20.string(), browser_download_url: z20.string() }))
 });
 var DMG = /^CamStack-[0-9][0-9A-Za-z.-]*-(arm64|x64)\.dmg$/;
 function acceleratorEdits(accelerator, role) {
@@ -5825,15 +5819,15 @@ async function connectTool(server, deps) {
     next: session === null ? LOGIN(url) : "a session exists: the ops tools can use it"
   };
 }
-var DiscoveredAgentsSchema = z22.object({
-  agents: z22.array(
-    z22.object({
-      nodeId: z22.string(),
-      host: z22.string(),
-      port: z22.number(),
-      version: z22.string().nullable(),
-      name: z22.string().nullable(),
-      state: z22.enum(["unpaired", "pending", "paired"])
+var DiscoveredAgentsSchema = z21.object({
+  agents: z21.array(
+    z21.object({
+      nodeId: z21.string(),
+      host: z21.string(),
+      port: z21.number(),
+      version: z21.string().nullable(),
+      name: z21.string().nullable(),
+      state: z21.enum(["unpaired", "pending", "paired"])
     })
   )
 });
@@ -5880,7 +5874,7 @@ async function addNodeTool(input, ctx) {
 var SUPPORTED_HOST_KINDS = HOST_KINDS;
 var REGISTRY2 = "https://registry.npmjs.org";
 var REGISTRY_TIMEOUT_MS2 = 5e3;
-var RegistryLatestSchema = z23.object({ version: z23.string() });
+var RegistryLatestSchema = z22.object({ version: z22.string() });
 async function latestOnNpm(name, fetchFn) {
   const url = `${REGISTRY2}/${name.replace("/", "%2f")}/latest`;
   try {
@@ -5914,7 +5908,7 @@ function registerSetupTools(server, ctx, deps = {}) {
     "setup_about",
     "Versions of the camstack CLI (installed and latest on npm), the latest @camstack/server on npm, and the host kinds CamStack supports. Needs no hub and no login.",
     {},
-    async () => text12(await about(ctx))
+    async () => text10(await about(ctx))
   );
   server.tool(
     "setup_install_guide",
@@ -5924,21 +5918,21 @@ function registerSetupTools(server, ctx, deps = {}) {
       role: RoleSchema.optional(),
       accelerator: AcceleratorSchema.optional(),
       paths: InstallPathsSchema.optional(),
-      hubAddress: z23.string().min(1).optional().describe("Agents only: the hub to dial.")
+      hubAddress: z22.string().min(1).optional().describe("Agents only: the hub to dial.")
     },
-    async (input) => text12(await installGuide(input, ctx.fetch))
+    async (input) => text10(await installGuide(input, ctx.fetch))
   );
   server.tool(
     "setup_discover_hubs",
     "Find CamStack hubs on the local network (mDNS) plus the hubs this machine already knows, with host, port, name and version. Needs no login.",
-    { timeoutMs: z23.number().int().min(200).max(15e3).optional() },
-    async ({ timeoutMs }) => text12(await discoverHubsTool(timeoutMs, deps))
+    { timeoutMs: z22.number().int().min(200).max(15e3).optional() },
+    async ({ timeoutMs }) => text10(await discoverHubsTool(timeoutMs, deps))
   );
   server.tool(
     "setup_connect",
     "Check that a hub answers on https://<server>:4443/health, whether its CA is already pinned for TLS, and whether a `camstack login` session exists. Never takes a password: when there is no session it says to run `camstack login <server>` in a terminal.",
-    { server: z23.string().min(1) },
-    async ({ server: address }) => text12(await connectTool(address, deps))
+    { server: z22.string().min(1) },
+    async ({ server: address }) => text10(await connectTool(address, deps))
   );
   server.tool(
     "setup_add_node",
@@ -5947,90 +5941,821 @@ function registerSetupTools(server, ctx, deps = {}) {
       hostKind: HostKindSchema.optional(),
       accelerator: AcceleratorSchema.optional(),
       paths: InstallPathsSchema.optional(),
-      hubAddress: z23.string().min(1).optional()
+      hubAddress: z22.string().min(1).optional()
     },
-    async (input) => text12(await addNodeTool(input, ctx))
+    async (input) => text10(await addNodeTool(input, ctx))
   );
 }
 
-// src/mcp/support-tools.ts
-import { text as text13 } from "@camstack/develop";
-import { z as z28 } from "zod";
-
-// src/mcp/support-accelerator.ts
-import { z as z24 } from "zod";
-var EXPECTED_ACCELERATORS = [
-  "intel-igpu",
-  "intel-npu",
-  "amd-webgpu",
-  "amd-vaapi",
-  "amd-npu",
-  "coral-usb",
-  "coral-pcie",
-  "apple-ane",
-  "nvidia"
-];
-var ExpectedAcceleratorSchema = z24.enum(EXPECTED_ACCELERATORS);
-var HardwareSchema2 = z24.looseObject({
-  platform: z24.enum(["darwin", "linux", "win32"]),
-  arch: z24.enum(["arm64", "x64"]),
-  cpuModel: z24.string(),
-  gpu: z24.looseObject({ type: z24.string(), name: z24.string() }).nullable(),
-  npu: z24.looseObject({ type: z24.string() }).nullable()
-});
-var InferenceDevicesSchema2 = z24.looseObject({
-  reachable: z24.boolean(),
-  devices: z24.array(
-    z24.looseObject({
-      key: z24.string(),
-      available: z24.boolean(),
-      presence: z24.enum(["present", "absent", "unknown"]).optional(),
-      enabled: z24.boolean(),
-      exclusion: z24.string().nullable()
-    })
-  )
+// src/mcp/ops-update-cli.ts
+var CLI_PACKAGE = "camstack";
+var NPM_GLOBAL = /[\\/]lib[\\/]node_modules[\\/]camstack[\\/]|[\\/]npm[\\/]node_modules[\\/]camstack[\\/]/;
+var OTHER_MANAGER = /[\\/]\.bun[\\/]|[\\/]pnpm[\\/]|[\\/]\.yarn[\\/]|[\\/]yarn[\\/]|[\\/]\.volta[\\/]/;
+function detectCliInstall(entryPath) {
+  const manual = `Update it with the package manager it was installed with, for example \`npm install -g ${CLI_PACKAGE}@latest\` (no sudo: fix the npm prefix permissions instead).`;
+  if (/[\\/]_npx[\\/]/.test(entryPath)) {
+    return {
+      method: "npx",
+      command: null,
+      instructions: `The CLI runs through npx: there is nothing installed to update. Start it as \`npx ${CLI_PACKAGE}@latest mcp\` (or clear the npx cache), then restart the MCP in your client.`
+    };
+  }
+  if (OTHER_MANAGER.test(entryPath) || !NPM_GLOBAL.test(entryPath)) {
+    return { method: "unknown", command: null, instructions: manual };
+  }
+  return {
+    method: "npm-global",
+    command: ["npm", "install", "-g", `${CLI_PACKAGE}@latest`],
+    instructions: `npm install -g ${CLI_PACKAGE}@latest`
+  };
+}
+var runCommand = (file, args) => new Promise((resolve) => {
+  execFile(file, [...args], { timeout: 5 * 6e4 }, (err, stdout, stderr) => {
+    const out = `${stdout}${stderr}`.trim().slice(-600);
+    resolve({
+      ok: err === null,
+      output: err ? `${err.message} ${out}`.trim() : out
+    });
+  });
 });
-var CORAL_OPT_IN = [
-  "A Coral is never picked automatically (D39): it must be enabled by an operator.",
-  "In the admin UI open the node, Inference devices, and enable the Coral (edgetpu) device; Auto tune only sizes devices that are already enabled."
-];
-var EXPECTATIONS = {
-  "intel-igpu": {
-    deviceKeys: (k) => k === "openvino:gpu",
-    probe: (hw) => hw.gpu?.type === "intel",
-    image: "intel",
-    steps: [
-      'Pass the render node into the container: --device /dev/dri (Compose: devices: ["/dev/dri:/dev/dri"]).',
-      "On the host, `ls -l /dev/dri` must list renderD128; if it does not, the i915/xe driver is not loaded on the host.",
-      "Use the intel-latest (or intel-<version>) image: the AMD image carries no OpenVINO GPU runtime."
-    ]
-  },
-  "intel-npu": {
-    deviceKeys: (k) => k === "openvino:npu",
-    probe: (hw) => hw.npu?.type === "intel-npu",
-    image: "intel",
-    steps: [
-      'Pass the accelerator node into the container: --device /dev/accel (Compose: devices: ["/dev/accel:/dev/accel"]).',
-      "On the host, `ls -l /dev/accel` must list accel0; if it does not, the intel_vpu kernel driver is missing (needs kernel 6.6 or newer and the NPU firmware).",
-      "Use the intel-latest (or intel-<version>) image."
-    ]
-  },
-  "amd-webgpu": {
-    deviceKeys: (k) => k === "onnx:webgpu",
-    probe: (hw) => hw.gpu?.type === "amd",
-    image: "amd",
-    steps: [
-      "Pass the render node into the container: --device /dev/dri.",
-      "On the host, `ls -l /dev/dri` must list renderD128; the amdgpu driver and Vulkan (Mesa RADV) must be present.",
-      "Use the amd-latest (or amd-<version>) image: the Intel image does not carry the WebGPU runtime."
-    ]
-  },
-  "amd-vaapi": {
-    deviceKeys: () => false,
-    probe: (hw) => hw.gpu?.type === "amd",
-    image: "amd",
-    steps: [
-      "VAAPI is a hardware DECODE path, not an inference device: this check can only prove the GPU is visible.",
+function parts(v) {
+  return v.split("-")[0].split(".").map((n) => Number.parseInt(n, 10) || 0);
+}
+function isOlder(a, b) {
+  const x = parts(a);
+  const y = parts(b);
+  for (let i = 0; i < 3; i++) {
+    const d = (x[i] ?? 0) - (y[i] ?? 0);
+    if (d !== 0) return d < 0;
+  }
+  return false;
+}
+async function cliVerdict(installed, fetchFn, entryPath) {
+  const latest = await latestOnNpm(CLI_PACKAGE, fetchFn);
+  return {
+    installed,
+    latest: latest.latest,
+    updateAvailable: latest.latest === null ? null : isOlder(installed, latest.latest),
+    ...latest.error !== void 0 ? { error: latest.error } : {},
+    install: detectCliInstall(entryPath)
+  };
+}
+
+// src/mcp/ops-update-apply.ts
+var UPDATE_APPLY_TOOL = "ops_update_apply";
+function timing(deps) {
+  return {
+    sleep: deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))),
+    now: deps.now ?? Date.now,
+    pollMs: deps.pollMs ?? 5e3,
+    hubTimeoutMs: deps.hubTimeoutMs ?? 10 * 6e4,
+    agentTimeoutMs: deps.agentTimeoutMs ?? 10 * 6e4,
+    addonTimeoutMs: deps.addonTimeoutMs ?? 5 * 6e4
+  };
+}
+function needs(p, target, restart) {
+  return restart || p.running !== null && isOlder(p.running, target);
+}
+async function readPlan(client, args, ctx, deps) {
+  const topology = await readTopology(client);
+  if (!topology.ok) return { ok: false, problem: topology.reason };
+  const hubNode = topology.value.find((n) => n.isHub === true);
+  if (hubNode === void 0) return { ok: false, problem: "the topology lists no hub node" };
+  const hubStatus = await readNodeStatus(client, hubNode);
+  if (!hubStatus.ok) return { ok: false, problem: hubStatus.reason };
+  const target = args.version ?? hubStatus.value.latestVersion ?? null;
+  if (target === null) {
+    return {
+      ok: false,
+      problem: "the hub has no registry check yet (latestVersion is null); run a check in the admin UI Cluster page or pass `version`"
+    };
+  }
+  const restartFlags = /* @__PURE__ */ new Map();
+  const plans = [];
+  const offline = [];
+  const unreadable = [];
+  for (const node of topology.value) {
+    if (!node.isOnline) {
+      offline.push(node.id);
+      continue;
+    }
+    const status = node.isHub === true ? hubStatus : await readNodeStatus(client, node);
+    if (!status.ok) {
+      unreadable.push({ nodeId: node.id, reason: status.reason });
+      continue;
+    }
+    const v = serverVerdict(status.value);
+    restartFlags.set(node.id, v.restartRequired === true);
+    plans.push({
+      node,
+      running: v.running,
+      busy: v.updateState !== null && v.updateState !== "idle" ? v.updateState : null,
+      wrapper: wrapperVerdict(status.value)
+    });
+  }
+  const updates = args.addons === false ? null : await readQuery(client, "addons.listUpdates", {}, z23.array(AddonUpdateShape));
+  const cli = args.cli === false ? null : await cliVerdict(ctx.cliVersion, ctx.fetch, deps.entryPath ?? process.argv[1] ?? "");
+  const hub = plans.find((p) => p.node.isHub === true) ?? null;
+  return {
+    ok: true,
+    plan: {
+      target,
+      hub,
+      agents: plans.filter((p) => p.node.isHub !== true),
+      offline,
+      unreadable,
+      addons: updates !== null && updates.ok ? updates.value.filter((u) => !u.isSystem && u.category === "addon") : [],
+      cli
+    }
+  };
+}
+function serverSteps(plan, restartOf) {
+  const out = [];
+  if (plan.hub !== null && needs(plan.hub, plan.target, restartOf(plan.hub))) out.push(plan.hub);
+  for (const a of plan.agents) if (needs(a, plan.target, restartOf(a))) out.push(a);
+  return out;
+}
+async function waitUntil(t, timeoutMs, check) {
+  const deadline = t.now() + timeoutMs;
+  let last = "not checked";
+  for (; ; ) {
+    const why = await check();
+    if (why === null) return { ok: true };
+    last = why;
+    if (t.now() >= deadline)
+      return {
+        ok: false,
+        why: `timed out after ${Math.round(timeoutMs / 1e3)}s: ${last}`
+      };
+    await t.sleep(t.pollMs);
+  }
+}
+async function nodeReady(client, nodeId, isHub, target) {
+  const status = await readNodeStatus(client, { id: nodeId, isHub });
+  if (!status.ok) return `status unreadable (${status.reason})`;
+  const v = serverVerdict(status.value);
+  if (v.running !== target) return `still running ${v.running ?? "unknown"}, target ${target}`;
+  if (v.restartRequired === true) return "restart still required";
+  if (v.updateState !== "idle") return `update state ${v.updateState ?? "unknown"}`;
+  const topology = await readTopology(client);
+  if (!topology.ok) return `topology unreadable (${topology.reason})`;
+  const node = topology.value.find((n) => n.id === nodeId);
+  if (node === void 0) return "node absent from the topology";
+  if (!node.isOnline) return "node is not online yet";
+  if (capState(node).capless) return "node is online but registered no capabilities";
+  return null;
+}
+async function applyServer(client, p, target, t) {
+  const isHub = p.node.isHub === true;
+  const step = isHub ? "hub-server" : "agent-server";
+  const nodeId = p.node.id;
+  let note = "";
+  try {
+    const raw = await client.call("POST", "serverManagement.applyServerUpdate", {
+      version: target,
+      ...statusInput(p.node)
+    });
+    const parsed = ServerActionShape.safeParse(raw);
+    if (parsed.success) {
+      const r = parsed.data;
+      if (r.outcome === "refused" || r.outcome === "failed" || r.accepted === false && r.outcome !== "already-current") {
+        const blockers = (r.blockers ?? []).map((b) => `${b.addonId}: ${b.reason}`).join("; ");
+        return {
+          step,
+          nodeId,
+          status: "failed",
+          detail: `${nodeId} refused the update (${r.outcome ?? "not accepted"}): ${r.reason ?? r.error ?? r.message ?? "no reason given"}${blockers ? ` [would refuse to start: ${blockers}]` : ""}`
+        };
+      }
+      note = r.outcome ?? "";
+    }
+  } catch (err) {
+    note = `no reply (${reasonOf(err)}); expected while the node restarts`;
+  }
+  const wait = await waitUntil(
+    t,
+    isHub ? t.hubTimeoutMs : t.agentTimeoutMs,
+    () => nodeReady(client, nodeId, isHub, target)
+  );
+  if (!wait.ok) {
+    return {
+      step,
+      nodeId,
+      status: "failed",
+      detail: `${nodeId} did not reach ${target}: ${wait.why}`
+    };
+  }
+  return {
+    step,
+    nodeId,
+    status: "ok",
+    detail: `${nodeId} runs ${target}, capabilities registered${note ? ` (${note})` : ""}`
+  };
+}
+async function applyAddons(client, addons, t) {
+  const done = [];
+  for (const u of addons) {
+    try {
+      await client.call("POST", "addons.updatePackage", {
+        name: u.name,
+        version: u.latestVersion
+      });
+      done.push(u);
+    } catch (err) {
+      return [
+        {
+          step: "addons",
+          status: "failed",
+          detail: `hub failed to update ${u.name} to ${u.latestVersion}: ${reasonOf(err)}${done.length > 0 ? `; already updated: ${done.map((d) => d.name).join(", ")}` : ""}`
+        }
+      ];
+    }
+  }
+  const names = new Set(done.map((d) => d.name));
+  const wait = await waitUntil(t, t.addonTimeoutMs, async () => {
+    const inst = await readInstallations(client);
+    if (!inst.ok) return `installations unreadable (${inst.reason})`;
+    for (const u of done) {
+      const hub = inst.value.installations.find((i) => i.isHub && i.packageName === u.name);
+      if (hub === void 0 || hub.version !== u.latestVersion) {
+        return `${u.name} is ${hub?.version ?? "absent"} on the hub, expected ${u.latestVersion}`;
+      }
+    }
+    const behind = addonDrift({
+      ...inst.value,
+      installations: inst.value.installations.filter((i) => names.has(i.packageName) && i.isOnline)
+    });
+    if (behind.length > 0) {
+      return `agents behind the hub: ${behind.map((d) => `${d.nodeId}/${d.packageName}=${d.nodeVersion ?? "absent"}`).join(", ")}`;
+    }
+    return null;
+  });
+  return [
+    {
+      step: "addons",
+      status: wait.ok ? "ok" : "unverified",
+      detail: wait.ok ? `${done.length} addon(s) updated on the hub and matched on every online agent` : `${done.length} addon(s) updated on the hub; verification: ${wait.why}`
+    }
+  ];
+}
+async function applyCli(cli, run) {
+  const restart = "Restart the MCP server in your client to load the new version; a running stdio MCP cannot swap itself.";
+  if (cli.install.command === null) {
+    return {
+      step: "cli",
+      status: "instructions",
+      detail: `${cli.install.instructions} ${restart}`
+    };
+  }
+  const [file, ...rest] = cli.install.command;
+  const result = await run(file ?? "", rest);
+  if (!result.ok) {
+    return {
+      step: "cli",
+      status: "failed",
+      detail: `\`${cli.install.command.join(" ")}\` failed: ${result.output}`
+    };
+  }
+  return {
+    step: "cli",
+    status: "ok",
+    detail: `ran \`${cli.install.command.join(" ")}\` (${cli.installed} to ${cli.latest ?? "latest"}). ${restart}`
+  };
+}
+function updateApplySpec(client, ctx, deps = {}) {
+  const t = timing(deps);
+  return {
+    tool: UPDATE_APPLY_TOOL,
+    async dryRun(args) {
+      const read = await readPlan(client, args, ctx, deps);
+      if (!read.ok) return { confirmable: false, describe: { problem: read.problem } };
+      const plan = read.plan;
+      const steps = serverSteps(plan, () => false);
+      const busy = [plan.hub, ...plan.agents].filter(
+        (p) => p !== null && p.busy !== null
+      );
+      if (busy.length > 0) {
+        return {
+          confirmable: false,
+          describe: {
+            problem: `a node is mid-update: ${busy.map((p) => `${p.node.id} (${p.busy})`).join(", ")}; wait for it to settle`
+          }
+        };
+      }
+      const cliNeeded = plan.cli?.updateAvailable === true;
+      if (steps.length === 0 && plan.addons.length === 0 && !cliNeeded) {
+        return {
+          confirmable: false,
+          describe: {
+            problem: "nothing to apply: every online node runs the target, no addon update is pending and the CLI is current",
+            target: plan.target,
+            wrapperUpdates: wrapperReport(plan)
+          }
+        };
+      }
+      return {
+        confirmable: true,
+        describe: {
+          action: "update the cluster, in this order, verifying each step",
+          target: plan.target,
+          order: [
+            ...steps.map((p, i) => ({
+              order: i + 1,
+              step: p.node.isHub === true ? "hub-server" : "agent-server",
+              nodeId: p.node.id,
+              from: p.running,
+              to: plan.target
+            })),
+            ...args.addons === false ? [] : [
+              {
+                step: "addons",
+                packages: plan.addons.map(
+                  (a) => `${a.name} ${a.currentVersion} -> ${a.latestVersion}`
+                )
+              }
+            ],
+            ...cliNeeded && plan.cli ? [
+              {
+                step: "cli",
+                from: plan.cli.installed,
+                to: plan.cli.latest,
+                method: plan.cli.install.method,
+                command: plan.cli.install.command?.join(" ") ?? null,
+                instructions: plan.cli.install.command === null ? plan.cli.install.instructions : null
+              }
+            ] : []
+          ],
+          skippedOffline: plan.offline,
+          skippedUnreadable: plan.unreadable,
+          wrapperUpdates: wrapperReport(plan),
+          timeouts: {
+            hubS: t.hubTimeoutMs / 1e3,
+            agentS: t.agentTimeoutMs / 1e3,
+            addonsS: t.addonTimeoutMs / 1e3
+          },
+          notes: [
+            "The hub restarts during step 1: this connection drops for a minute or two; that is expected.",
+            "A failed step stops the chain and says which node and why; addons are not touched if a server step failed.",
+            "Wrapper (image / app) updates are NEVER performed here; the instructions are listed.",
+            ...cliNeeded ? ["The CLI update is the last step; afterwards restart the MCP in your client."] : []
+          ]
+        }
+      };
+    },
+    async execute(args) {
+      const read = await readPlan(client, args, ctx, deps);
+      if (!read.ok) return { outcome: "failed", problem: read.problem, steps: [] };
+      const plan = read.plan;
+      const results = [];
+      const ok = () => results.every((r) => r.status === "ok" || r.status === "skipped");
+      for (const p of serverSteps(plan, () => false)) {
+        if (!ok()) break;
+        results.push(await applyServer(client, p, plan.target, t));
+      }
+      const serverOk = ok();
+      if (serverOk && args.addons !== false && plan.addons.length > 0) {
+        results.push(...await applyAddons(client, plan.addons, t));
+      }
+      const clusterOk = results.every((r) => r.status === "ok");
+      if (clusterOk && plan.cli?.updateAvailable === true) {
+        results.push(await applyCli(plan.cli, deps.runCommand ?? runCommand));
+      } else if (plan.cli?.updateAvailable === true) {
+        results.push({
+          step: "cli",
+          status: "skipped",
+          detail: "not run: a cluster step did not succeed"
+        });
+      }
+      const failed = results.find((r) => r.status === "failed");
+      return {
+        outcome: failed ? "failed" : results.every((r) => r.status === "ok") ? "complete" : "partial",
+        target: plan.target,
+        steps: results,
+        ...failed ? { stoppedAt: failed.nodeId ?? failed.step, reason: failed.detail } : {},
+        skippedOffline: plan.offline,
+        wrapperUpdates: wrapperReport(plan),
+        mcpRestartNeeded: results.some(
+          (r) => r.step === "cli" && (r.status === "ok" || r.status === "instructions")
+        ),
+        next: "Run ops_update_check to confirm; nodes still offline were not touched."
+      };
+    }
+  };
+}
+function wrapperReport(plan) {
+  return [plan.hub, ...plan.agents].filter((p) => p !== null && p.wrapper.behind === true).map((p) => ({
+    nodeId: p.node.id,
+    kind: p.wrapper.kind,
+    from: p.wrapper.from,
+    to: p.wrapper.to,
+    instructions: p.wrapper.instructions
+  }));
+}
+async function opsUpdateApply(ctx, args, confirmToken, deps = {}) {
+  const outcome = await ctx.hub();
+  if (!outcome.ok) return noSessionResult(outcome);
+  if (outcome.connection.tier !== "admin") {
+    return {
+      status: "refused",
+      reason: outcome.connection.adminHint ?? "this credential is not admin-scoped"
+    };
+  }
+  return runGated3(
+    ctx.gate,
+    updateApplySpec(outcome.connection.client, ctx, deps),
+    args,
+    confirmToken
+  );
+}
+
+// src/mcp/ops-update-check.ts
+import { z as z24 } from "zod";
+var ADDON_LIMIT = 30;
+async function opsUpdateCheck(ctx, deps = {}) {
+  return withAdminHub(ctx, async ({ client, server }) => {
+    const unavailable = {};
+    const [topology, updates, installs, cli] = await Promise.all([
+      readTopology(client),
+      readQuery(client, "addons.listUpdates", {}, z24.array(AddonUpdateShape)),
+      readInstallations(client),
+      cliVerdict(ctx.cliVersion, ctx.fetch, deps.entryPath ?? process.argv[1] ?? "")
+    ]);
+    if (!topology.ok) {
+      return { status: "unavailable", reason: topology.reason, cli };
+    }
+    const drift = installs.ok ? addonDrift(installs.value) : [];
+    if (!installs.ok) unavailable["addonVersionsPerNode"] = installs.reason;
+    else if (installs.value.unreachable.length > 0) {
+      unavailable["addonVersionsPerNode"] = `no answer from ${installs.value.unreachable.map((u) => u.nodeId).join(", ")}`;
+    }
+    const nodes = await Promise.all(topology.value.map((n) => checkNode(client, n, drift)));
+    let hubAddons = null;
+    if (updates.ok) {
+      const capped = cap(updates.value, ADDON_LIMIT);
+      hubAddons = {
+        items: capped.items.map((u) => ({
+          name: u.name,
+          from: u.currentVersion,
+          to: u.latestVersion,
+          framework: u.isSystem || u.category === "core"
+        })),
+        truncated: capped.truncated
+      };
+    } else unavailable["hubAddonUpdates"] = updates.reason;
+    return {
+      status: "ok",
+      hub: server,
+      nodes,
+      hubAddons,
+      cli,
+      viewer: {
+        status: "not-exposed",
+        note: "No hub API reports the viewer version; the web viewer is served by the hub and the mobile apps update through their stores."
+      },
+      summary: {
+        serverUpdateNeeded: nodes.filter((n) => n.serverNeedsUpdate === true).map((n) => n.id),
+        wrapperUpdateNeeded: nodes.filter((n) => n.wrapper?.behind === true).map((n) => n.id),
+        offline: nodes.filter((n) => !n.online).map((n) => n.id),
+        capless: nodes.filter((n) => n.flags.length > 0).map((n) => n.id),
+        nodesWithAddonDrift: [...new Set(drift.map((d) => d.nodeId))],
+        cliUpdateNeeded: cli.updateAvailable
+      },
+      unavailable,
+      note: "Latest versions come from the hub's last registry check (`latestCheckedAt`), not a fresh one; a version just published may not show yet."
+    };
+  });
+}
+async function checkNode(client, node, drift) {
+  const caps = capState(node);
+  const base = {
+    id: node.id,
+    name: node.name ?? null,
+    isHub: node.isHub === true,
+    online: node.isOnline,
+    platform: node.platform ?? null,
+    capabilityCount: caps.count,
+    flags: caps.capless && node.isOnline ? ["online-but-capless"] : [],
+    addonsBehindHub: drift.filter((d) => d.nodeId === node.id)
+  };
+  if (!node.isOnline) {
+    return {
+      ...base,
+      server: null,
+      serverNeedsUpdate: null,
+      wrapper: null,
+      unreadable: "node is offline"
+    };
+  }
+  const status = await readNodeStatus(client, node);
+  if (!status.ok) {
+    return {
+      ...base,
+      server: null,
+      serverNeedsUpdate: null,
+      wrapper: null,
+      unreadable: status.reason
+    };
+  }
+  const server = serverVerdict(status.value);
+  return {
+    ...base,
+    server,
+    serverNeedsUpdate: needsServerUpdate(server),
+    wrapper: wrapperVerdict(status.value)
+  };
+}
+
+// src/mcp/ops-tools.ts
+var IDENTITY_CLAIMS = ["sub", "username", "name", "role"];
+function identityOf(token) {
+  const claims = jwtClaims(token);
+  const out = {};
+  if (claims === null) return out;
+  for (const key of IDENTITY_CLAIMS) {
+    const value = claims[key];
+    if (typeof value === "string" && value !== "") out[key] = value;
+  }
+  return out;
+}
+async function whoami(ctx) {
+  const outcome = await ctx.hub();
+  if (!outcome.ok) return noSessionResult(outcome);
+  const c = outcome.connection;
+  return {
+    status: "ok",
+    hub: c.server,
+    tier: c.tier,
+    source: c.source,
+    identity: identityOf(c.token)
+  };
+}
+function registerOpsTools(server, ctx) {
+  server.tool(
+    "ops_whoami",
+    "Which hub this MCP talks to and as whom, from the `camstack login` session (no network call). If there is no session, says to run `camstack login <host>` in a terminal.",
+    {},
+    async () => text11(await whoami(ctx))
+  );
+  server.tool(
+    "ops_status",
+    'Cluster summary: every node (online, platform, server version, capability count, "online-but-capless" flag), the active alerts and the addons with an update. A part the hub did not answer is null with its reason in `unavailable`, never zero. Node list and updates need an admin `camstack login`.',
+    {},
+    async () => text11(await opsStatus(ctx))
+  );
+  server.tool(
+    "ops_device",
+    "One device: online state, provider addon and node, bound capabilities, runtime-state age and, for a camera, its pipeline, recording state, the functions an operator switched off (not faults) and its latest object events.",
+    { deviceId: z25.number().int() },
+    async ({ deviceId }) => text11(await opsDevice(ctx, deviceId))
+  );
+  server.tool(
+    "ops_unhealthy_devices",
+    "Every enabled device that is unhealthy, each with a typed reason (offline, detection-provisioning-failed, detection-not-assigned, recording-inactive). A function an operator switched off is never listed; a camera whose status could not be fully read is listed under `unknown`.",
+    {},
+    async () => text11(await opsUnhealthyDevices(ctx))
+  );
+  server.tool(
+    "ops_logs",
+    "Hub logs scoped by deviceId, addon, node, level, window and free text, grouped and deduplicated with counts. Says which tier answered (ring = recent in-RAM; persisted = the default log destination). With `around` (a track or event id) returns `contextLines` lines on each side of its first mention. Needs an admin `camstack login`.",
+    {
+      deviceId: z25.number().int().optional(),
+      addonId: z25.string().optional(),
+      nodeId: z25.string().optional(),
+      level: z25.enum(["debug", "info", "warn", "error"]).optional(),
+      windowMinutes: z25.number().int().min(1).max(1440).optional(),
+      text: z25.string().max(200).optional(),
+      around: z25.string().max(200).optional(),
+      contextLines: z25.number().int().min(1).max(50).optional()
+    },
+    async (args) => text11(
+      await opsLogs(ctx, {
+        ...args.deviceId !== void 0 ? { deviceId: args.deviceId } : {},
+        ...args.addonId ? { addonId: args.addonId } : {},
+        ...args.nodeId ? { nodeId: args.nodeId } : {},
+        ...args.level ? { level: args.level } : {},
+        ...args.windowMinutes !== void 0 ? { windowMinutes: args.windowMinutes } : {},
+        ...args.text ? { text: args.text } : {},
+        ...args.around ? { around: args.around } : {},
+        ...args.contextLines !== void 0 ? { contextLines: args.contextLines } : {}
+      })
+    )
+  );
+  server.tool(
+    "ops_events",
+    "Find tracks (and, for one camera, object events) by camera, class, zone, time window and free text. Each result carries an admin-UI link and a viewer link built on the hub address flagged for app connections.",
+    {
+      deviceId: z25.number().int().optional(),
+      className: z25.string().optional(),
+      zone: z25.string().optional(),
+      text: z25.string().max(200).optional(),
+      windowMinutes: z25.number().int().min(1).max(10080).optional(),
+      limit: z25.number().int().min(1).max(50).optional()
+    },
+    async (args) => text11(
+      await opsEvents(ctx, {
+        ...args.deviceId !== void 0 ? { deviceId: args.deviceId } : {},
+        ...args.className ? { className: args.className } : {},
+        ...args.zone ? { zone: args.zone } : {},
+        ...args.text ? { text: args.text } : {},
+        ...args.windowMinutes !== void 0 ? { windowMinutes: args.windowMinutes } : {},
+        ...args.limit !== void 0 ? { limit: args.limit } : {}
+      })
+    )
+  );
+  server.tool(
+    "ops_track",
+    "One track with its media audit: best shot, keyframes, every missing media kind with the reason the track recorded for it, and the audit findings. Links to the admin UI and the viewer.",
+    { deviceId: z25.number().int(), trackId: z25.string().min(1) },
+    async ({ deviceId, trackId }) => text11(await opsTrack(ctx, { deviceId, trackId }))
+  );
+  server.tool(
+    "ops_accelerators",
+    'Per node: the inference devices it has, the Auto-tune hardware class the node maps to, and whether the measured detector-latency table has a row for that class and accelerator. A node that could not be read is null with a reason, never "no accelerator". Needs an admin `camstack login`.',
+    {},
+    async () => text11(await opsAccelerators(ctx))
+  );
+  server.tool(
+    "ops_update_check",
+    'Read-only update report for the whole cluster. Every node from the topology: running vs installed vs latest @camstack/server, restartRequired / updateState / rolledBack, the wrapper (Docker image / desktop app) verdict, and whether its addon versions match the hub; the hub\'s addon updates; the viewer (not exposed by any API, said so); and this CLI/MCP against npm. A node that cannot be read is null with a reason, never "up to date". Needs an admin `camstack login`.',
+    {},
+    async () => text11(await opsUpdateCheck(ctx))
+  );
+  server.tool(
+    UPDATE_APPLY_TOOL,
+    "Bring the cluster up to date, verified step by step: hub server closure, wait until the hub runs it, then each online agent, then addons (agents follow by reconciliation, verified), then this CLI last. Two steps: call without confirm_token for a preview (order, versions, wrapper instructions, timeouts) and a one-shot token, then again with the SAME arguments and that token. A failed step stops the chain and names the node. Wrapper (image/app) updates are only reported with instructions. Needs an admin `camstack login`.",
+    {
+      version: z25.string().min(1).optional().describe("Server target; default = the hub's latest."),
+      addons: z25.boolean().optional().describe("Update addons too (default true)."),
+      cli: z25.boolean().optional().describe("Update this CLI last (default true)."),
+      confirm_token: z25.string().optional()
+    },
+    async ({ version, addons, cli, confirm_token }) => text11(
+      await opsUpdateApply(
+        ctx,
+        {
+          ...version !== void 0 ? { version } : {},
+          ...addons !== void 0 ? { addons } : {},
+          ...cli !== void 0 ? { cli } : {}
+        },
+        confirm_token
+      )
+    )
+  );
+}
+
+// src/mcp/configure-tools.ts
+var CurrentDeviceSchema = z26.object({ name: z26.string() }).nullable();
+var RENAME_DEVICE_TOOL = "configure_rename_device";
+function renameDeviceSpec(client) {
+  return {
+    tool: RENAME_DEVICE_TOOL,
+    async dryRun(args) {
+      const current = CurrentDeviceSchema.safeParse(
+        await client.call("GET", "deviceManager.getDevice", {
+          deviceId: args.deviceId
+        })
+      );
+      if (!current.success || current.data === null) {
+        return {
+          confirmable: false,
+          describe: {
+            problem: `device ${args.deviceId} was not found on the hub`
+          }
+        };
+      }
+      if (current.data.name === args.name) {
+        return {
+          confirmable: false,
+          describe: {
+            problem: `device ${args.deviceId} is already named "${args.name}"`
+          }
+        };
+      }
+      return {
+        confirmable: true,
+        describe: {
+          action: "rename device",
+          deviceId: args.deviceId,
+          from: current.data.name,
+          to: args.name
+        }
+      };
+    },
+    async execute(args) {
+      await client.call("POST", "deviceManager.setName", {
+        deviceId: args.deviceId,
+        name: args.name
+      });
+      return { deviceId: args.deviceId, name: args.name };
+    }
+  };
+}
+async function renameDevice(ctx, args, confirmToken) {
+  const outcome = await ctx.hub();
+  if (!outcome.ok) return noSessionResult(outcome);
+  if (outcome.connection.tier !== "admin") {
+    return {
+      status: "refused",
+      reason: outcome.connection.adminHint ?? "this credential is not admin-scoped"
+    };
+  }
+  return runGated4(ctx.gate, renameDeviceSpec(outcome.connection.client), args, confirmToken);
+}
+function registerConfigureTools(server, ctx) {
+  server.tool(
+    RENAME_DEVICE_TOOL,
+    "Rename a device. Two steps: call without confirm_token for a preview and a one-shot token, then call again with the SAME arguments and that token to apply. Needs an admin `camstack login` session.",
+    {
+      deviceId: z26.number().int(),
+      name: z26.string().min(1),
+      confirm_token: z26.string().optional()
+    },
+    async ({ deviceId, name, confirm_token }) => text12(await renameDevice(ctx, { deviceId, name }, confirm_token))
+  );
+  registerAddonTools(server, ctx);
+  registerCameraTools(server, ctx);
+  registerNotifierTools(server, ctx);
+  registerConfigureP3bTools(server, ctx);
+}
+
+// src/mcp/support-tools.ts
+import { text as text13 } from "@camstack/develop";
+import { z as z31 } from "zod";
+
+// src/mcp/support-accelerator.ts
+import { z as z27 } from "zod";
+var EXPECTED_ACCELERATORS = [
+  "intel-igpu",
+  "intel-npu",
+  "amd-webgpu",
+  "amd-vaapi",
+  "amd-npu",
+  "coral-usb",
+  "coral-pcie",
+  "apple-ane",
+  "nvidia"
+];
+var ExpectedAcceleratorSchema = z27.enum(EXPECTED_ACCELERATORS);
+var HardwareSchema2 = z27.looseObject({
+  platform: z27.enum(["darwin", "linux", "win32"]),
+  arch: z27.enum(["arm64", "x64"]),
+  cpuModel: z27.string(),
+  gpu: z27.looseObject({ type: z27.string(), name: z27.string() }).nullable(),
+  npu: z27.looseObject({ type: z27.string() }).nullable()
+});
+var InferenceDevicesSchema2 = z27.looseObject({
+  reachable: z27.boolean(),
+  devices: z27.array(
+    z27.looseObject({
+      key: z27.string(),
+      available: z27.boolean(),
+      presence: z27.enum(["present", "absent", "unknown"]).optional(),
+      enabled: z27.boolean(),
+      exclusion: z27.string().nullable()
+    })
+  )
+});
+var CORAL_OPT_IN = [
+  "A Coral is never picked automatically (D39): it must be enabled by an operator.",
+  "In the admin UI open the node, Inference devices, and enable the Coral (edgetpu) device; Auto tune only sizes devices that are already enabled."
+];
+var EXPECTATIONS = {
+  "intel-igpu": {
+    deviceKeys: (k) => k === "openvino:gpu",
+    probe: (hw) => hw.gpu?.type === "intel",
+    image: "intel",
+    steps: [
+      'Pass the render node into the container: --device /dev/dri (Compose: devices: ["/dev/dri:/dev/dri"]).',
+      "On the host, `ls -l /dev/dri` must list renderD128; if it does not, the i915/xe driver is not loaded on the host.",
+      "Use the intel-latest (or intel-<version>) image: the AMD image carries no OpenVINO GPU runtime."
+    ]
+  },
+  "intel-npu": {
+    deviceKeys: (k) => k === "openvino:npu",
+    probe: (hw) => hw.npu?.type === "intel-npu",
+    image: "intel",
+    steps: [
+      'Pass the accelerator node into the container: --device /dev/accel (Compose: devices: ["/dev/accel:/dev/accel"]).',
+      "On the host, `ls -l /dev/accel` must list accel0; if it does not, the intel_vpu kernel driver is missing (needs kernel 6.6 or newer and the NPU firmware).",
+      "Use the intel-latest (or intel-<version>) image."
+    ]
+  },
+  "amd-webgpu": {
+    deviceKeys: (k) => k === "onnx:webgpu",
+    probe: (hw) => hw.gpu?.type === "amd",
+    image: "amd",
+    steps: [
+      "Pass the render node into the container: --device /dev/dri.",
+      "On the host, `ls -l /dev/dri` must list renderD128; the amdgpu driver and Vulkan (Mesa RADV) must be present.",
+      "Use the amd-latest (or amd-<version>) image: the Intel image does not carry the WebGPU runtime."
+    ]
+  },
+  "amd-vaapi": {
+    deviceKeys: () => false,
+    probe: (hw) => hw.gpu?.type === "amd",
+    image: "amd",
+    steps: [
+      "VAAPI is a hardware DECODE path, not an inference device: this check can only prove the GPU is visible.",
       "Pass the render node into the container: --device /dev/dri, and check `vainfo` on the host.",
       "Use the amd-latest (or amd-<version>) image."
     ]
@@ -6263,9 +6988,9 @@ async function supportDiagnoseAccelerator(ctx, args) {
 
 // src/mcp/support-benchmark.ts
 import {
-  runGated as runGated4
+  runGated as runGated5
 } from "@camstack/develop";
-import { z as z25 } from "zod";
+import { z as z28 } from "zod";
 var BENCHMARK_RUN_TOOL = "support_benchmark_run";
 var AUTO_TUNE_MODELS = [
   "yolov9t-320",
@@ -6287,64 +7012,64 @@ var CONTRIBUTE_HOW = [
   "The measured medians belong in the Auto-tune latency table: docs/benchmarks/detector-latency.json and packages/types/src/pipeline/auto-tune/detector-performance.ts, changed together (detector-performance.spec.ts fails until they agree), in the camstack/server repository.",
   'Use support_draft_pr with kind "benchmark", the column ("<hardwareClass>/<accelerator>") and these cells to get the branch plan and the `gh pr create` command.'
 ];
-var HardwareSchema3 = z25.looseObject({
-  platform: z25.enum(["darwin", "linux", "win32"]),
-  arch: z25.enum(["arm64", "x64"]),
-  cpuModel: z25.string(),
-  cpuCores: z25.number(),
-  totalRAM_MB: z25.number(),
-  availableRAM_MB: z25.number(),
-  gpu: z25.looseObject({
-    type: z25.enum(["nvidia", "amd", "intel", "apple"]),
-    name: z25.string()
+var HardwareSchema3 = z28.looseObject({
+  platform: z28.enum(["darwin", "linux", "win32"]),
+  arch: z28.enum(["arm64", "x64"]),
+  cpuModel: z28.string(),
+  cpuCores: z28.number(),
+  totalRAM_MB: z28.number(),
+  availableRAM_MB: z28.number(),
+  gpu: z28.looseObject({
+    type: z28.enum(["nvidia", "amd", "intel", "apple"]),
+    name: z28.string()
   }).nullable(),
-  npu: z25.looseObject({ type: z25.enum(["apple-ane", "intel-npu", "amd-xdna"]) }).nullable()
+  npu: z28.looseObject({ type: z28.enum(["apple-ane", "intel-npu", "amd-xdna"]) }).nullable()
 });
-var InferenceDevicesSchema3 = z25.looseObject({
-  reachable: z25.boolean(),
-  devices: z25.array(
-    z25.looseObject({
-      key: z25.string(),
-      backend: z25.string(),
-      available: z25.boolean(),
-      enabled: z25.boolean()
+var InferenceDevicesSchema3 = z28.looseObject({
+  reachable: z28.boolean(),
+  devices: z28.array(
+    z28.looseObject({
+      key: z28.string(),
+      backend: z28.string(),
+      available: z28.boolean(),
+      enabled: z28.boolean()
     })
   )
 });
-var RunStatusSchema = z25.looseObject({
-  run: z25.looseObject({
-    runId: z25.string(),
-    nodeId: z25.string(),
-    state: z25.string(),
-    endReason: z25.string().nullable().optional(),
-    error: z25.string().nullable().optional()
+var RunStatusSchema = z28.looseObject({
+  run: z28.looseObject({
+    runId: z28.string(),
+    nodeId: z28.string(),
+    state: z28.string(),
+    endReason: z28.string().nullable().optional(),
+    error: z28.string().nullable().optional()
   }).nullable()
 });
-var ModelListSchema = z25.array(
-  z25.looseObject({
-    id: z25.string(),
-    formats: z25.record(z25.string(), z25.looseObject({ downloaded: z25.boolean().optional() })).optional()
+var ModelListSchema = z28.array(
+  z28.looseObject({
+    id: z28.string(),
+    formats: z28.record(z28.string(), z28.looseObject({ downloaded: z28.boolean().optional() })).optional()
   })
 );
-var PipelineTestSchema = z25.looseObject({
-  kind: z25.string().optional(),
-  detections: z25.array(
-    z25.looseObject({
-      debug: z25.looseObject({
-        stepLatencyMs: z25.record(z25.string(), z25.number()).optional()
+var PipelineTestSchema = z28.looseObject({
+  kind: z28.string().optional(),
+  detections: z28.array(
+    z28.looseObject({
+      debug: z28.looseObject({
+        stepLatencyMs: z28.record(z28.string(), z28.number()).optional()
       }).optional()
     })
   ).optional(),
-  discarded: z25.array(z25.unknown()).optional(),
-  debug: z25.looseObject({
-    stepTimings: z25.array(
-      z25.looseObject({
-        source: z25.string().optional(),
-        ms: z25.number().optional()
+  discarded: z28.array(z28.unknown()).optional(),
+  debug: z28.looseObject({
+    stepTimings: z28.array(
+      z28.looseObject({
+        source: z28.string().optional(),
+        ms: z28.number().optional()
       })
     ).optional(),
-    predictMs: z25.number().optional(),
-    totalInferenceMs: z25.number().optional()
+    predictMs: z28.number().optional(),
+    totalInferenceMs: z28.number().optional()
   }).optional()
 });
 var FORMAT_BY_BACKEND = {
@@ -6371,10 +7096,10 @@ function inferMsOf(raw) {
   if (!parsed.success) return { inferMs: null, shed: false };
   const r = parsed.data;
   const fromDetection = r.detections?.[0]?.debug?.stepLatencyMs?.[DETECTOR_STEP];
-  const timing = r.debug?.stepTimings?.find(
+  const timing2 = r.debug?.stepTimings?.find(
     (t) => t.source === DETECTOR_STEP && typeof t.ms === "number"
   );
-  const candidates = [fromDetection, timing?.ms, r.debug?.predictMs, r.debug?.totalInferenceMs];
+  const candidates = [fromDetection, timing2?.ms, r.debug?.predictMs, r.debug?.totalInferenceMs];
   const inferMs = candidates.find((c) => typeof c === "number" && c > 0) ?? null;
   const shedReason = (r.discarded ?? []).some(
     (d) => /deadline|shed/i.test(String(JSON.stringify(d)))
@@ -6629,17 +7354,17 @@ async function supportBenchmarkRun(ctx, deps, args, confirmToken) {
       reason: outcome.connection.adminHint ?? "this credential is not admin-scoped"
     };
   }
-  return runGated4(ctx.gate, benchmarkRunSpec(outcome.connection.client, deps), args, confirmToken);
-}
-var ResultsSchema = z25.array(
-  z25.looseObject({
-    nodeId: z25.string(),
-    cell: z25.looseObject({
-      phase: z25.string(),
-      deviceKey: z25.string(),
-      modelId: z25.string(),
-      p50Ms: z25.number().optional(),
-      fps: z25.number().optional()
+  return runGated5(ctx.gate, benchmarkRunSpec(outcome.connection.client, deps), args, confirmToken);
+}
+var ResultsSchema = z28.array(
+  z28.looseObject({
+    nodeId: z28.string(),
+    cell: z28.looseObject({
+      phase: z28.string(),
+      deviceKey: z28.string(),
+      modelId: z28.string(),
+      p50Ms: z28.number().optional(),
+      fps: z28.number().optional()
     })
   })
 );
@@ -6692,20 +7417,20 @@ async function supportBenchmarkStatus(ctx, args) {
 }
 
 // src/mcp/support-camera.ts
-import { z as z26 } from "zod";
-var DeviceSchema2 = z26.looseObject({
-  id: z26.number(),
-  name: z26.string(),
-  addonId: z26.string().optional(),
-  disabled: z26.boolean().optional(),
-  online: z26.boolean().optional()
+import { z as z29 } from "zod";
+var DeviceSchema2 = z29.looseObject({
+  id: z29.number(),
+  name: z29.string(),
+  addonId: z29.string().optional(),
+  disabled: z29.boolean().optional(),
+  online: z29.boolean().optional()
 }).nullable();
 var GENERIC = /onvif|rtsp/i;
 function words(text14) {
   return text14.toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length >= 3);
 }
-function isGeneric(parts) {
-  return parts.some((p) => GENERIC.test(p));
+function isGeneric(parts2) {
+  return parts2.some((p) => GENERIC.test(p));
 }
 function installedPick(p) {
   return {
@@ -6726,9 +7451,9 @@ function availablePick(p) {
 var MATCHING_NOTE = "A provider manifest declares no brand or model list: matching is on provider name, description and keywords, so a brand that is supported under another name can be missed.";
 function matchIn(pools, tokens) {
   if (tokens.length === 0) return null;
-  const hit = (parts) => {
-    if (isGeneric(parts)) return false;
-    const joined = parts.join(" ").toLowerCase();
+  const hit = (parts2) => {
+    if (isGeneric(parts2)) return false;
+    const joined = parts2.join(" ").toLowerCase();
     return tokens.some((t) => joined.includes(t));
   };
   const installed = pools.installed.find(
@@ -6864,10 +7589,10 @@ async function supportDiagnoseCamera(ctx, args) {
 }
 
 // src/mcp/support-deps.ts
-import { execFile } from "child_process";
+import { execFile as execFile2 } from "child_process";
 var RUN_TIMEOUT_MS = 6e4;
 var spawnRunner = (command, args) => new Promise((resolve) => {
-  execFile(
+  execFile2(
     command,
     [...args],
     { timeout: RUN_TIMEOUT_MS, maxBuffer: 1e6 },
@@ -6897,9 +7622,9 @@ import { tmpdir } from "os";
 import { join } from "path";
 import {
   digestArgs,
-  runGated as runGated5
+  runGated as runGated6
 } from "@camstack/develop";
-import { z as z27 } from "zod";
+import { z as z30 } from "zod";
 
 // src/mcp/support-scrub.ts
 import { redactToolArgs, scrubSecrets } from "@camstack/develop";
@@ -6908,10 +7633,10 @@ var IPV6 = /\b(?:[0-9a-fA-F]{1,4}:){4,7}[0-9a-fA-F]{1,4}(?![\w:])|\b[0-9a-fA-F]{
 var MAC = /\b(?:[0-9a-fA-F]{2}[:-]){5}[0-9a-fA-F]{2}\b/g;
 var HOME_DIR = /(\/Users|\/home)\/[^/\s'"]+/g;
 function octets(ip) {
-  const parts = ip.split(".").map((p) => Number(p));
-  if (parts.length !== 4) return null;
-  if (parts.some((p) => !Number.isInteger(p) || p < 0 || p > 255)) return null;
-  return parts;
+  const parts2 = ip.split(".").map((p) => Number(p));
+  if (parts2.length !== 4) return null;
+  if (parts2.some((p) => !Number.isInteger(p) || p < 0 || p > 255)) return null;
+  return parts2;
 }
 function maskIpv4(ip) {
   const o = octets(ip);
@@ -6952,16 +7677,16 @@ var INFERENCE_PACKAGE = "@camstack/addon-pipeline";
 var TITLE_MAX = 140;
 var DIAGNOSIS_MAX = 4e3;
 var DRAFT_KINDS = ["accelerator", "camera", "benchmark", "other"];
-var DraftKindSchema = z27.enum(DRAFT_KINDS);
-var BenchmarkCellsSchema = z27.record(
-  z27.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/),
-  z27.object({ p50Ms: z27.number().positive(), fps: z27.number().positive() })
+var DraftKindSchema = z30.enum(DRAFT_KINDS);
+var BenchmarkCellsSchema = z30.record(
+  z30.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/),
+  z30.object({ p50Ms: z30.number().positive(), fps: z30.number().positive() })
 );
 var PackageNameRe = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
 var GithubRepoRe = /github\.com[:/]([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?(?:[/#?].*)?$/;
 var ShorthandRe = /^(?:github:)?([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/;
-var RegistryDocSchema = z27.looseObject({
-  repository: z27.union([z27.string(), z27.looseObject({ url: z27.string() })]).optional()
+var RegistryDocSchema = z30.looseObject({
+  repository: z30.union([z30.string(), z30.looseObject({ url: z30.string() })]).optional()
 });
 function githubRepoOf(value) {
   const url = GithubRepoRe.exec(value);
@@ -7003,7 +7728,7 @@ async function resolveRepo(ctx, packageName) {
     reason: null
   };
 }
-var ServerStatusSchema2 = z27.looseObject({ runningVersion: z27.string() });
+var ServerStatusSchema2 = z30.looseObject({ runningVersion: z30.string() });
 async function serverVersion(client, nodeId) {
   const status = await readQuery(
     client,
@@ -7262,27 +7987,27 @@ function prSpec(ctx) {
   };
 }
 async function supportDraftIssue(ctx, deps, args, confirmToken) {
-  return runGated5(ctx.gate, issueSpec({ ctx, deps }), args, confirmToken);
+  return runGated6(ctx.gate, issueSpec({ ctx, deps }), args, confirmToken);
 }
 async function supportDraftPr(ctx, args, confirmToken) {
-  return runGated5(ctx.gate, prSpec(ctx), args, confirmToken);
+  return runGated6(ctx.gate, prSpec(ctx), args, confirmToken);
 }
 
 // src/mcp/support-tools.ts
-var ModelId = z28.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/);
+var ModelId = z31.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/);
 var DraftShape = {
   kind: DraftKindSchema,
-  title: z28.string().min(3).max(300),
-  summary: z28.string().min(3).max(4e3),
-  nodeId: z28.string().max(100).optional(),
+  title: z31.string().min(3).max(300),
+  summary: z31.string().min(3).max(4e3),
+  nodeId: z31.string().max(100).optional(),
   expected: ExpectedAcceleratorSchema.optional(),
-  brand: z28.string().max(100).optional(),
-  model: z28.string().max(100).optional(),
-  deviceId: z28.number().int().optional(),
-  packageName: z28.string().max(214).optional(),
-  column: z28.string().max(100).optional(),
+  brand: z31.string().max(100).optional(),
+  model: z31.string().max(100).optional(),
+  deviceId: z31.number().int().optional(),
+  packageName: z31.string().max(214).optional(),
+  column: z31.string().max(100).optional(),
   cells: BenchmarkCellsSchema.optional(),
-  confirm_token: z28.string().optional()
+  confirm_token: z31.string().optional()
 };
 function draftArgs(input) {
   return {
@@ -7303,18 +8028,18 @@ function registerSupportTools(server, ctx, deps = defaultSupportDeps) {
   server.tool(
     "support_benchmark_status",
     "The hub's own node-benchmark state: the active or last run and the per-device latency cells it stored. Read-only. The Auto-tune latency table is filled with support_benchmark_run. Needs an admin `camstack login`.",
-    { nodeId: z28.string().max(100).optional() },
+    { nodeId: z31.string().max(100).optional() },
     async ({ nodeId }) => text13(await supportBenchmarkStatus(ctx, nodeId !== void 0 ? { nodeId } : {}))
   );
   server.tool(
     BENCHMARK_RUN_TOOL,
     "Measure detector latency on a node x device (cold run, then warm median per model, via runPipelineTest) and return it next to the Auto-tune table cell for the same hardware, plus how to contribute it. LOADS THE NODE: the detection pool restarts between models. Pick the node and deviceKey from ops_accelerators. Two steps: call without confirm_token for the plan and a one-shot token, then again with the SAME arguments and that token. Needs an admin `camstack login`.",
     {
-      nodeId: z28.string().min(1).max(100),
-      deviceKey: z28.string().min(1).max(60),
-      models: z28.array(ModelId).min(1).max(MAX_MODELS).optional(),
-      warmRuns: z28.number().int().min(1).max(MAX_WARM_RUNS).optional(),
-      confirm_token: z28.string().optional()
+      nodeId: z31.string().min(1).max(100),
+      deviceKey: z31.string().min(1).max(60),
+      models: z31.array(ModelId).min(1).max(MAX_MODELS).optional(),
+      warmRuns: z31.number().int().min(1).max(MAX_WARM_RUNS).optional(),
+      confirm_token: z31.string().optional()
     },
     async ({ nodeId, deviceKey, models, warmRuns, confirm_token }) => text13(
       await supportBenchmarkRun(
@@ -7333,16 +8058,16 @@ function registerSupportTools(server, ctx, deps = defaultSupportDeps) {
   server.tool(
     "support_diagnose_accelerator",
     "A node should have an accelerator (Intel iGPU/NPU, AMD WebGPU/VAAPI/NPU, Coral USB/PCIe, Apple Neural Engine, NVIDIA) and the hub does not offer it. Reads what the platform probe saw and what the node's inference runtime offers, and answers ok | misconfigured (with fix steps: passthrough, driver, image tag, opt-in) | unsupported (which addon would need extending) | unknown (a read failed). A Coral is never auto-picked: the answer says how to opt in. Read-only.",
-    { nodeId: z28.string().min(1).max(100), expected: ExpectedAcceleratorSchema },
+    { nodeId: z31.string().min(1).max(100), expected: ExpectedAcceleratorSchema },
     async ({ nodeId, expected }) => text13(await supportDiagnoseAccelerator(ctx, { nodeId, expected }))
   );
   server.tool(
     "support_diagnose_camera",
     "A camera brand or model, or an existing device that fails: which provider addons could serve it (installed, then published), and a verdict use-provider | generic-fallback (ONVIF / RTSP) | unsupported | unknown, with the next steps. Give a brand and/or model, or a deviceId. Read-only.",
     {
-      brand: z28.string().max(100).optional(),
-      model: z28.string().max(100).optional(),
-      deviceId: z28.number().int().optional()
+      brand: z31.string().max(100).optional(),
+      model: z31.string().max(100).optional(),
+      deviceId: z31.number().int().optional()
     },
     async ({ brand, model, deviceId }) => text13(
       await supportDiagnoseCamera(ctx, {