camstack 1.2.211 → 1.2.213

package/dist/{server-OYJZ5RCY.js → server-EFXGQ7FD.js}

@@ -11,13 +11,15 @@ import {
   buildViewerLink,
   capUnitResolver,
   classifyInferenceHardware,
+  convertLegacyWhen,
+  countWhenLeaves,
   findHubs,
   generateAutomationBlock,
   isReadingQuantity,
   prepareRecipeUnits,
   unitsForQuantity,
   validateRecipeBounds
-} from "./chunk-NAUJQNCX.js";
+} from "./chunk-MJJWVAEM.js";
 import "./chunk-LMMQX4CK.js";
 
 // src/mcp/server.ts
@@ -27,10 +29,10 @@ import { MutationGate, tryConnectHub } from "@camstack/develop";
 
 // src/mcp/configure-tools.ts
 import {
-  runGated as runGated3,
-  text as text11
+  runGated as runGated4,
+  text as text13
 } from "@camstack/develop";
-import { z as z19 } from "zod";
+import { z as z28 } from "zod";
 
 // src/mcp/configure-automations.ts
 import { z as z4 } from "zod";
@@ -987,7 +989,7 @@ function toActions(actions) {
 function quantityNotes(recipe) {
   const notes = [];
   const walk = (c, path) => {
-    if (c.kind === "condition" && typeof c.value === "number" && c.unit !== void 0) {
+    if (c.kind === "device-is" && typeof c.value === "number" && c.unit !== void 0) {
       notes.push({
         where: `${path} ${c.cap}.${c.fieldPath}`,
         value: c.value,
@@ -997,7 +999,7 @@ function quantityNotes(recipe) {
     if (c.kind === "not") walk(c.child, path);
     if (c.kind === "all" || c.kind === "any") c.children.forEach((child) => walk(child, path));
   };
-  if (recipe.conditions !== void 0) walk(recipe.conditions, "condition");
+  walk(recipe.when, "condition");
   recipe.actions.forEach((a, i) => {
     if (a.kind !== "cap" || a.args === void 0 || a.argUnits === void 0) return;
     for (const [arg, unit] of Object.entries(a.argUnits)) {
@@ -1085,8 +1087,7 @@ async function interviewAutomation(client, answers) {
   const conditions = answers.conditions ?? [];
   const actions = answers.actions ?? [];
   const draft = {
-    triggers: [outcome.trigger],
-    ...toCondition(conditions) !== void 0 ? { conditions: toCondition(conditions) } : {},
+    when: convertLegacyWhen({ triggers: [outcome.trigger], conditions: toCondition(conditions) }),
     actions: toActions(actions),
     ...answers.cooldownMinutes !== void 0 ? {
       runMode: {
@@ -1184,7 +1185,7 @@ function saveAutomationSpec(client) {
           runsOn: "the hub",
           enabled: args.enabled,
           effect: args.enabled ? "it starts running as soon as it is saved" : "it is saved switched off",
-          triggers: finished.recipe.triggers.length,
+          rows: countWhenLeaves(finished.recipe.when),
           steps: finished.recipe.actions.length,
           quantities: quantityNotes(finished.recipe),
           generatedBytes: code.length
@@ -1217,7 +1218,7 @@ var GATE_HOW = "Two steps: call without confirm_token for a preview and a one-sh
 function registerAutomationTools(server, ctx) {
   server.tool(
     "configure_automation_questionnaire",
-    "Interview for a new automation (a recipe: trigger, conditions, actions). Stateless: send every answer so far in `answers`; it returns the questions still open, with choices read from the hub, or `ready` with a summary and the recipe. A number on a quantity field is { value, unit }. Writes nothing.",
+    "Interview for a new automation (a recipe: ONE `when` tree \u2014 events that start it, states that must hold \u2014 and the actions). Stateless: send every answer so far in `answers`; it returns the questions still open, with choices read from the hub, or `ready` with a summary and the recipe. A number on a quantity field is { value, unit }. Writes nothing.",
     { answers: AutomationAnswersSchema },
     async ({ answers }) => text(await automationQuestionnaire(ctx, answers))
   );
@@ -2345,33 +2346,527 @@ function registerExportTools(server, ctx) {
   );
 }
 
-// src/mcp/configure-nc-rules.ts
-import { z as z9 } from "zod";
+// src/mcp/configure-oidc.ts
 import { text as text6 } from "@camstack/develop";
+import { z as z10 } from "zod";
+
+// src/mcp/configure-oidc-providers.ts
+import { z as z9 } from "zod";
+var OidcProviderSchema = z9.enum([
+  "authentik",
+  "pocket-id",
+  "authelia",
+  "keycloak",
+  "zitadel",
+  "kanidm",
+  "google",
+  "microsoft-entra",
+  "auth0",
+  "okta",
+  "generic"
+]);
+var PIECE_QUESTION = {
+  host: "host: the provider host name, with or without https:// (no path)",
+  application_slug: "application_slug: the application slug (authentik) or client name (kanidm)",
+  realm: "realm: the Keycloak realm name",
+  tenant_id: "tenant_id: the Entra directory (tenant) id, a GUID or a verified domain"
+};
+function pieceQuestion(piece) {
+  return PIECE_QUESTION[piece];
+}
+function hostOrigin(host) {
+  const trimmed = host.trim().replace(/\/+$/, "");
+  return /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+}
+var COMMON_STEPS = [
+  "Create the client as an OpenID Connect / OAuth2 web application, authorization-code flow.",
+  "Paste the redirect URI shown below as the ONLY allowed redirect URI.",
+  "Allow the scopes listed below."
+];
+var OIDC_PROVIDERS = {
+  authentik: {
+    label: "authentik",
+    pieces: ["host", "application_slug"],
+    issuerFormat: "https://<host>/application/o/<application_slug>/",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "Admin interface > Applications > Applications > Create with Provider (OAuth2/OpenID)",
+    steps: [
+      "Create an application with an OAuth2/OpenID provider; its slug is the application_slug.",
+      "Set the client type to Public for PKCE without a secret, or Confidential.",
+      "Add the redirect URI below as a Strict redirect URI."
+    ],
+    build: (p) => `${hostOrigin(p.host)}/application/o/${p.application_slug}/`
+  },
+  "pocket-id": {
+    label: "Pocket ID",
+    pieces: ["host"],
+    issuerFormat: "https://<host>",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "Settings > Administration > OIDC Clients > Add OIDC Client",
+    steps: [
+      "Add an OIDC client and paste the redirect URI below as its callback URL.",
+      'Switch on "Public Client" for PKCE without a secret; leave it off for a confidential client.',
+      "Copy the client ID."
+    ],
+    build: (p) => hostOrigin(p.host)
+  },
+  authelia: {
+    label: "Authelia",
+    pieces: ["host"],
+    issuerFormat: "https://<host>",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "configuration.yml > identity_providers.oidc.clients (a file edit, then a restart)",
+    steps: [
+      "Add a client with its redirect URI below and `authorization_policy` of your choice.",
+      "For PKCE without a secret set `public: true` and `require_pkce: true`.",
+      "Set `token_endpoint_auth_method: client_secret_post` for a confidential client."
+    ],
+    build: (p) => hostOrigin(p.host)
+  },
+  keycloak: {
+    label: "Keycloak",
+    pieces: ["host", "realm"],
+    issuerFormat: "https://<host>/realms/<realm>",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "Admin console > the realm > Clients > Create client",
+    steps: [
+      'Client type OpenID Connect; switch "Client authentication" on for confidential, off for public.',
+      'Under Advanced, set "Proof Key for Code Exchange Code Challenge Method" to S256.',
+      "Add the redirect URI below as a valid redirect URI."
+    ],
+    build: (p) => `${hostOrigin(p.host)}/realms/${p.realm}`
+  },
+  zitadel: {
+    label: "ZITADEL",
+    pieces: ["host"],
+    issuerFormat: "https://<host>",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "Console > Project > Applications > New > Web",
+    steps: [
+      "Choose authentication method PKCE (public) or Basic/Post (confidential).",
+      "Add the redirect URI below.",
+      "Copy the client ID."
+    ],
+    build: (p) => hostOrigin(p.host)
+  },
+  kanidm: {
+    label: "Kanidm",
+    pieces: ["host", "application_slug"],
+    issuerFormat: "https://<host>/oauth2/openid/<application_slug>",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "`kanidm system oauth2 create(-public) <name> <display> <origin>` on the server",
+    steps: [
+      "Use `create-public` for PKCE without a secret, `create` for a confidential client.",
+      "Add the redirect URI below with `add-redirect-url`.",
+      "Grant scopes with `update-scope-map <name> <group> openid profile email`.",
+      "The application_slug is the client name you created."
+    ],
+    build: (p) => `${hostOrigin(p.host)}/oauth2/openid/${p.application_slug}`
+  },
+  google: {
+    label: "Google",
+    pieces: [],
+    issuerFormat: "https://accounts.google.com",
+    scopes: "openid profile email",
+    publicPkce: false,
+    usernameClaim: "email",
+    whereToCreate: "Google Cloud console > APIs & Services > Credentials > Create credentials > OAuth client ID (Web application)",
+    steps: [
+      'Choose "Web application"; Google issues a client secret for it, so the client is confidential.',
+      "Add the redirect URI below as an authorized redirect URI (it must be a public https host)."
+    ],
+    build: () => "https://accounts.google.com"
+  },
+  "microsoft-entra": {
+    label: "Microsoft Entra ID",
+    pieces: ["tenant_id"],
+    issuerFormat: "https://login.microsoftonline.com/<tenant_id>/v2.0",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "Entra admin center > App registrations > New registration",
+    steps: [
+      "Register a Web app (confidential, with a client secret) or a Single-page application (public, PKCE).",
+      "Add the redirect URI below under Authentication.",
+      "Copy the Application (client) ID and the Directory (tenant) ID."
+    ],
+    build: (p) => `https://login.microsoftonline.com/${p.tenant_id}/v2.0`
+  },
+  auth0: {
+    label: "Auth0",
+    pieces: ["host"],
+    issuerFormat: "https://<host>/",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "email",
+    whereToCreate: "Dashboard > Applications > Applications > Create Application",
+    steps: [
+      "Regular Web Application for confidential, Single Page Application for public (PKCE).",
+      "Add the redirect URI below under Allowed Callback URLs.",
+      "host is the tenant domain, for example example.eu.auth0.com."
+    ],
+    build: (p) => `${hostOrigin(p.host)}/`
+  },
+  okta: {
+    label: "Okta",
+    pieces: ["host"],
+    issuerFormat: "https://<host>/oauth2/default",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "Admin console > Applications > Applications > Create App Integration > OIDC",
+    steps: [
+      "Web Application for confidential, Single-Page Application for public (PKCE).",
+      "Add the redirect URI below as a sign-in redirect URI.",
+      "host is your Okta domain; the default authorization server is used."
+    ],
+    build: (p) => `${hostOrigin(p.host)}/oauth2/default`
+  },
+  generic: {
+    label: "Any OpenID Connect provider",
+    pieces: [],
+    issuerFormat: "the `issuer` value of the provider's discovery document",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "the provider's admin interface (create an OIDC web client)",
+    steps: COMMON_STEPS,
+    note: "Pass `issuer` exactly as the provider's /.well-known/openid-configuration reports it.",
+    build: () => ""
+  }
+};
+function resolveIssuer(provider, explicit, pieces) {
+  if (explicit !== void 0 && explicit.trim() !== "") {
+    return { issuer: explicit.trim(), missing: [] };
+  }
+  const spec = OIDC_PROVIDERS[provider];
+  const missing = spec.pieces.filter((k) => (pieces[k] ?? "").trim() === "");
+  if (missing.length > 0 || provider === "generic") return { issuer: null, missing };
+  return {
+    issuer: spec.build({
+      host: pieces.host ?? "",
+      application_slug: pieces.application_slug ?? "",
+      realm: pieces.realm ?? "",
+      tenant_id: pieces.tenant_id ?? ""
+    }),
+    missing: []
+  };
+}
+
+// src/mcp/configure-oidc.ts
+var OIDC_TOOL = "configure_oidc";
+var OIDC_ADMIN_ROUTE = "/system/identity?tab=authentication";
+var DISCOVERY_TIMEOUT_MS = 5e3;
+var ClientTypeSchema = z10.enum(["public", "confidential"]);
+var AddressesSchema3 = z10.looseObject({
+  roles: z10.looseObject({
+    publicEndpoint: z10.looseObject({ resolved: z10.string().nullish() }).optional(),
+    appConnections: z10.looseObject({ resolved: z10.array(z10.string()) }).optional()
+  })
+});
+var LOOPBACK2 = /^(localhost|127\.|\[?::1\]?$|0\.0\.0\.0)/i;
+function isLoopback(url) {
+  try {
+    return LOOPBACK2.test(new URL(url).hostname);
+  } catch {
+    return true;
+  }
+}
+async function resolveHubBase(client) {
+  const read = await readQuery(client, "localNetwork.getAddresses", {}, AddressesSchema3);
+  if (!read.ok) return { base: null, reason: read.reason };
+  const pub = read.value.roles.publicEndpoint?.resolved;
+  if (typeof pub === "string" && pub !== "" && !isLoopback(pub)) {
+    return { base: pub.replace(/\/+$/, ""), source: "publicEndpoint" };
+  }
+  const app = read.value.roles.appConnections?.resolved.find((u) => !isLoopback(u));
+  if (app !== void 0) return { base: app.replace(/\/+$/, ""), source: "appConnections" };
+  return {
+    base: null,
+    reason: "no non-loopback public endpoint or app-connections address is set (Network page)"
+  };
+}
+function callbackPath(connectionId) {
+  return `/addon/auth-oidc/${connectionId}/callback`;
+}
+var DiscoverySchema = z10.looseObject({
+  issuer: z10.string().optional(),
+  authorization_endpoint: z10.string().optional(),
+  token_endpoint: z10.string().optional(),
+  jwks_uri: z10.string().optional(),
+  code_challenge_methods_supported: z10.array(z10.string()).optional(),
+  token_endpoint_auth_methods_supported: z10.array(z10.string()).optional()
+});
+var trimSlash = (s) => s.replace(/\/+$/, "");
+async function checkDiscovery(fetchFn, issuer, clientType) {
+  const url = `${trimSlash(issuer)}/.well-known/openid-configuration`;
+  let body;
+  try {
+    const res = await fetchFn(url, { signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS) });
+    if (!res.ok) {
+      return {
+        checked: false,
+        url,
+        warnings: [`discovery answered ${res.status}: check the issuer URL`]
+      };
+    }
+    body = await res.json();
+  } catch (err) {
+    return {
+      checked: false,
+      url,
+      warnings: [`discovery could not be fetched from this machine (${reasonOf(err)})`]
+    };
+  }
+  const parsed = DiscoverySchema.safeParse(body);
+  if (!parsed.success) {
+    return {
+      checked: false,
+      url,
+      warnings: ["discovery answered something that is not a JSON document"]
+    };
+  }
+  const doc = parsed.data;
+  const warnings = [];
+  const issuerMatches = doc.issuer !== void 0 && trimSlash(doc.issuer) === trimSlash(issuer);
+  if (!issuerMatches) {
+    warnings.push(
+      `the provider reports issuer "${doc.issuer ?? "(none)"}", which differs from "${issuer}"`
+    );
+  }
+  if (doc.authorization_endpoint === void 0 || doc.token_endpoint === void 0) {
+    warnings.push("the discovery document lacks an authorization or token endpoint");
+  }
+  const s256 = doc.code_challenge_methods_supported?.includes("S256") === true;
+  if (!s256)
+    warnings.push("code_challenge_methods_supported does not include S256 (PKCE is always used)");
+  const post = doc.token_endpoint_auth_methods_supported?.includes("client_secret_post") === true;
+  if (clientType === "confidential" && !post) {
+    warnings.push(
+      "token_endpoint_auth_methods_supported does not include client_secret_post, which CamStack uses for a confidential client"
+    );
+  }
+  return {
+    checked: true,
+    url,
+    issuerMatches,
+    ...doc.authorization_endpoint !== void 0 ? { authorizationEndpoint: doc.authorization_endpoint } : {},
+    ...doc.token_endpoint !== void 0 ? { tokenEndpoint: doc.token_endpoint } : {},
+    s256,
+    clientSecretPost: post,
+    warnings
+  };
+}
+var ConnectionListSchema = z10.array(
+  z10.looseObject({ id: z10.string(), displayName: z10.string().optional() })
+);
+function connectionIdOf(args) {
+  return args.connection_id ?? args.provider;
+}
+function questionnaire(spec, args, redirectUri) {
+  const questions = [
+    ...spec.pieces.map(pieceQuestion),
+    ...args.provider === "generic" ? ["issuer: the exact issuer from the discovery document"] : [],
+    "client_id: the client id the provider shows after you create the client",
+    `client_type: "public" (PKCE, no secret${spec.publicPkce ? "" : " - NOT supported by this provider"}) or "confidential" (a secret you type into the admin UI)`,
+    "display_name (optional): the text of the login button",
+    "connection_id (optional): to update an existing connection instead of creating one"
+  ];
+  return {
+    status: "questions",
+    provider: args.provider,
+    label: spec.label,
+    questions,
+    issuerFormat: spec.issuerFormat,
+    defaultScopes: spec.scopes,
+    publicClientSupported: spec.publicPkce,
+    whereToCreateTheClient: spec.whereToCreate,
+    providerSideSteps: spec.steps,
+    ...spec.note !== void 0 ? { note: spec.note } : {},
+    redirectUri,
+    ...redirectUri === null ? {
+      redirectUriNote: "the hub address could not be resolved; set a public endpoint on the Network page"
+    } : {},
+    next: `Call ${OIDC_TOOL} again with the answers; it previews the connection and gives a confirm_token.`,
+    secretRule: "A client secret is never a tool argument. For a confidential client you type it in the admin UI."
+  };
+}
+function oidcSpec(client, fetchFn) {
+  return {
+    tool: OIDC_TOOL,
+    async dryRun(args) {
+      const spec = OIDC_PROVIDERS[args.provider];
+      const clientType = args.client_type ?? "public";
+      const resolved = resolveIssuer(args.provider, args.issuer, args);
+      if (resolved.issuer === null || args.client_id === void 0 || args.client_id.trim() === "") {
+        return { confirmable: false, describe: { problem: "issuer and client_id are required" } };
+      }
+      if (clientType === "public" && !spec.publicPkce) {
+        return {
+          confirmable: false,
+          describe: {
+            problem: `${spec.label} does not issue public clients; use client_type "confidential"`
+          }
+        };
+      }
+      const id = connectionIdOf(args);
+      const list = await readQuery(
+        client,
+        "oidcConnections.listConnections",
+        {},
+        ConnectionListSchema
+      );
+      if (!list.ok) return { confirmable: false, describe: { problem: list.reason } };
+      const exists = list.value.some((c) => c.id === id);
+      if (exists && args.connection_id === void 0) {
+        return {
+          confirmable: false,
+          describe: {
+            problem: `a connection "${id}" already exists; pass connection_id "${id}" to update it, or another id to create a new one`
+          }
+        };
+      }
+      const base = await resolveHubBase(client);
+      const discovery = await checkDiscovery(fetchFn, resolved.issuer, clientType);
+      const link = await adminLink(client, OIDC_ADMIN_ROUTE);
+      return {
+        confirmable: true,
+        describe: {
+          action: exists ? "update OIDC connection" : "create OIDC connection",
+          connection: {
+            id,
+            displayName: args.display_name ?? spec.label,
+            issuerUrl: resolved.issuer,
+            clientId: args.client_id.trim(),
+            clientType,
+            scopes: spec.scopes,
+            usernameClaim: spec.usernameClaim,
+            clientSecret: clientType === "public" ? "none (public PKCE client)" : "entered in the admin UI"
+          },
+          redirectUri: base.base !== null ? `${base.base}${callbackPath(id)}` : null,
+          ...base.base === null ? { redirectUriProblem: base.reason } : {},
+          discovery,
+          warnings: discovery.warnings,
+          ...secretStep(clientType, link.url)
+        }
+      };
+    },
+    async execute(args) {
+      const spec = OIDC_PROVIDERS[args.provider];
+      const clientType = args.client_type ?? "public";
+      const resolved = resolveIssuer(args.provider, args.issuer, args);
+      const id = connectionIdOf(args);
+      const displayName = args.display_name ?? spec.label;
+      const list = await readQuery(
+        client,
+        "oidcConnections.listConnections",
+        {},
+        ConnectionListSchema
+      );
+      const exists = list.ok && list.value.some((c) => c.id === id);
+      if (!exists) {
+        await client.call("POST", "oidcConnections.createConnection", { id, displayName });
+      }
+      await client.call("POST", "oidcConnections.updateConnection", {
+        id,
+        displayName,
+        issuerUrl: resolved.issuer ?? "",
+        clientId: (args.client_id ?? "").trim(),
+        scopes: spec.scopes,
+        usernameClaim: spec.usernameClaim,
+        ...exists && clientType === "public" ? { clientSecret: { $secretClear: true } } : {}
+      });
+      const link = await adminLink(client, OIDC_ADMIN_ROUTE);
+      return {
+        connectionId: id,
+        applied: exists ? "updated" : "created",
+        ...secretStep(clientType, link.url)
+      };
+    }
+  };
+}
+function secretStep(clientType, url) {
+  if (clientType === "public") return {};
+  return {
+    secretStep: {
+      required: true,
+      how: url !== null ? `open ${url}, edit the connection and type the client secret in the Client Secret field` : `open ${OIDC_ADMIN_ROUTE} in the admin UI, edit the connection and type the client secret in the Client Secret field`,
+      note: "The secret is never a tool argument and is not shown here."
+    }
+  };
+}
+async function configureOidc(ctx, args, confirmToken) {
+  const spec = OIDC_PROVIDERS[args.provider];
+  const resolved = resolveIssuer(args.provider, args.issuer, args);
+  const asking = resolved.issuer === null || (args.client_id ?? "").trim() === "";
+  if (asking) {
+    const base = await withHub(ctx, async ({ client }) => resolveHubBase(client));
+    const redirect = "status" in base || base.base === null ? null : `${base.base}${callbackPath(connectionIdOf(args))}`;
+    return questionnaire(spec, args, redirect);
+  }
+  return adminGated(ctx, (client) => oidcSpec(client, ctx.fetch), args, confirmToken);
+}
+var OIDC_TOOL_SHAPE = {
+  provider: OidcProviderSchema,
+  issuer: z10.string().optional(),
+  host: z10.string().optional(),
+  application_slug: z10.string().optional(),
+  realm: z10.string().optional(),
+  tenant_id: z10.string().optional(),
+  client_id: z10.string().optional(),
+  client_type: ClientTypeSchema.optional(),
+  display_name: z10.string().optional(),
+  connection_id: z10.string().optional(),
+  confirm_token: ConfirmTokenSchema
+};
+function registerOidcTools(server, ctx) {
+  server.tool(
+    OIDC_TOOL,
+    "Connect an OpenID Connect identity provider (authentik, pocket-id, authelia, keycloak, zitadel, kanidm, google, microsoft-entra, auth0, okta, generic). Call with only `provider` for the questions, the provider-side setup steps and the redirect URI to paste into the provider. With the answers it previews the connection and checks the provider discovery document (warnings, never a crash); call again with the SAME arguments and the confirm_token to create or update it. A client secret is NEVER an argument or output: a confidential client is finished by typing the secret in the admin UI (the route is given); a public PKCE client needs none. Needs an admin `camstack login` session for the write.",
+    OIDC_TOOL_SHAPE,
+    async ({ confirm_token, ...args }) => text6(await configureOidc(ctx, args, confirm_token))
+  );
+}
+
+// src/mcp/configure-nc-rules.ts
+import { z as z11 } from "zod";
+import { text as text7 } from "@camstack/develop";
 var TIME = /^\d{1,2}:\d{2}$/;
 var ALL_DAYS = [0, 1, 2, 3, 4, 5, 6];
-var QuietHoursAnswerSchema = z9.object({
+var QuietHoursAnswerSchema = z11.object({
   /** Notifications are muted from this time … */
-  from: z9.string().regex(TIME),
+  from: z11.string().regex(TIME),
   /** … until this one (HH:MM, hub time zone). A window may cross midnight. */
-  to: z9.string().regex(TIME),
+  to: z11.string().regex(TIME),
   /** Days the quiet window STARTS on (0 = Sunday); absent = every day. */
-  days: z9.array(z9.number().int().min(0).max(6)).min(1).optional()
+  days: z11.array(z11.number().int().min(0).max(6)).min(1).optional()
 });
-var NcRuleAnswersSchema = z9.object({
-  name: z9.string().min(1).max(200).optional(),
-  delivery: z9.enum(["immediate", "track-end"]).optional(),
+var NcRuleAnswersSchema = z11.object({
+  name: z11.string().min(1).max(200).optional(),
+  delivery: z11.enum(["immediate", "track-end"]).optional(),
   /** Camera ids; `[]` means every camera. */
-  cameras: z9.array(z9.number().int().nonnegative()).optional(),
-  classes: z9.array(z9.string().min(1)).optional(),
+  cameras: z11.array(z11.number().int().nonnegative()).optional(),
+  classes: z11.array(z11.string().min(1)).optional(),
   /** Zone ids or names; `[]` means anywhere in view. */
-  zones: z9.array(z9.string().min(1)).optional(),
-  minConfidence: z9.number().min(0).max(1).optional(),
+  zones: z11.array(z11.string().min(1)).optional(),
+  minConfidence: z11.number().min(0).max(1).optional(),
   /** `null` states "no quiet hours"; absent means not asked yet. */
   quietHours: QuietHoursAnswerSchema.nullable().optional(),
   /** Target ids or names. */
-  targets: z9.array(z9.string().min(1)).optional(),
-  cooldownSeconds: z9.number().int().min(0).max(86400).optional()
+  targets: z11.array(z11.string().min(1)).optional(),
+  cooldownSeconds: z11.number().int().min(0).max(86400).optional()
 });
 var SAVE_RULE_TOOL = "configure_notification_rule_save";
 var DELIVERY_CHOICES = [
@@ -2557,11 +3052,11 @@ async function interviewNcRule(client, answers) {
 async function ncRuleQuestionnaire(ctx, answers) {
   return withHub(ctx, ({ client }) => interviewNcRule(client, answers));
 }
-var StoredRuleSchema = z9.looseObject({
-  id: z9.string().optional(),
-  name: z9.string().optional(),
-  conditions: z9.record(z9.string(), z9.unknown()).optional(),
-  schedule: z9.unknown().optional()
+var StoredRuleSchema = z11.looseObject({
+  id: z11.string().optional(),
+  name: z11.string().optional(),
+  conditions: z11.record(z11.string(), z11.unknown()).optional(),
+  schedule: z11.unknown().optional()
 });
 var AUTHORED_CONDITION_KEYS = [
   "devices",
@@ -2693,17 +3188,17 @@ function registerNcRuleTools(server, ctx) {
     "configure_notification_rule_questionnaire",
     "Interview for a detection notification rule (cameras, classes, zones, quiet hours, targets). Stateless: send every answer so far in `answers`; it returns the questions still open, with choices read from the hub, or `ready` with a summary and the rule. Writes nothing.",
     { answers: NcRuleAnswersSchema },
-    async ({ answers }) => text6(await ncRuleQuestionnaire(ctx, answers))
+    async ({ answers }) => text7(await ncRuleQuestionnaire(ctx, answers))
   );
   server.tool(
     SAVE_RULE_TOOL,
     `Create a notification rule (the \`rule\` of a ready questionnaire), or update the one named by ruleId (the full conditions are sent, so keys the interview does not author are kept). ${GATE_HOW4}`,
     {
       rule: NcRuleInputSchema,
-      ruleId: z9.string().optional(),
+      ruleId: z11.string().optional(),
       confirm_token: ConfirmTokenSchema
     },
-    async ({ rule, ruleId, confirm_token }) => text6(
+    async ({ rule, ruleId, confirm_token }) => text7(
       await saveRule(ctx, { rule, ...ruleId !== void 0 ? { ruleId } : {} }, confirm_token)
     )
   );
@@ -2716,20 +3211,21 @@ function registerConfigureP3bTools(server, ctx) {
   registerCalibrateTools(server, ctx);
   registerExportTools(server, ctx);
   registerNetworkTools(server, ctx);
+  registerOidcTools(server, ctx);
   registerZonesAlarmTools(server, ctx);
 }
 
 // src/mcp/configure-addons.ts
 import {
-  text as text7
+  text as text8
 } from "@camstack/develop";
-import { z as z11 } from "zod";
+import { z as z13 } from "zod";
 
 // src/mcp/configure-support.ts
 import {
   runGated as runGated2
 } from "@camstack/develop";
-import { z as z10 } from "zod";
+import { z as z12 } from "zod";
 async function runGatedAdmin(ctx, makeSpec, args, confirmToken) {
   const outcome = await ctx.hub();
   if (!outcome.ok) return noSessionResult(outcome);
@@ -2752,28 +3248,28 @@ async function withAdminHub(ctx, body) {
   }
   return body(outcome.connection);
 }
-var FormOptionSchema = z10.looseObject({
-  value: z10.union([z10.string(), z10.number(), z10.boolean()]),
-  label: z10.string().optional()
+var FormOptionSchema = z12.looseObject({
+  value: z12.union([z12.string(), z12.number(), z12.boolean()]),
+  label: z12.string().optional()
 });
-var FormFieldSchema = z10.looseObject({
-  type: z10.string().optional(),
-  key: z10.string().optional(),
-  label: z10.string().optional(),
-  description: z10.string().optional(),
-  required: z10.boolean().optional(),
-  secret: z10.boolean().optional(),
-  default: z10.unknown().optional(),
-  options: z10.array(FormOptionSchema).optional(),
-  itemFields: z10.array(
-    z10.looseObject({
-      type: z10.string().optional(),
-      key: z10.string().optional()
+var FormFieldSchema = z12.looseObject({
+  type: z12.string().optional(),
+  key: z12.string().optional(),
+  label: z12.string().optional(),
+  description: z12.string().optional(),
+  required: z12.boolean().optional(),
+  secret: z12.boolean().optional(),
+  default: z12.unknown().optional(),
+  options: z12.array(FormOptionSchema).optional(),
+  itemFields: z12.array(
+    z12.looseObject({
+      type: z12.string().optional(),
+      key: z12.string().optional()
     })
   ).optional()
 });
-var FormSchemaShape = z10.looseObject({
-  sections: z10.array(z10.looseObject({ fields: z10.array(FormFieldSchema) }))
+var FormSchemaShape = z12.looseObject({
+  sections: z12.array(z12.looseObject({ fields: z12.array(FormFieldSchema) }))
 });
 var NON_INPUT_TYPES = /* @__PURE__ */ new Set(["info", "divider", "heading", "button"]);
 var CREDENTIAL_NAME = /pass(word|wd|phrase)?|token|secret|api[_-]?key|credential|private[_-]?key/i;
@@ -2874,21 +3370,21 @@ function splitConfig(fields, config) {
 function fieldValidator(field) {
   switch (field.type) {
     case "number":
-      return z10.number();
+      return z12.number();
     case "boolean":
     case "switch":
     case "checkbox":
     case "toggle":
-      return z10.boolean();
+      return z12.boolean();
     case "tags":
-      return z10.array(z10.string());
+      return z12.array(z12.string());
     case "editable-array":
-      return z10.array(z10.record(z10.string(), z10.unknown()));
+      return z12.array(z12.record(z12.string(), z12.unknown()));
     case "select":
     case "radio": {
-      if (field.options === null || field.options.length === 0) return z10.unknown();
+      if (field.options === null || field.options.length === 0) return z12.unknown();
       const values = field.options.map((o) => o.value);
-      return z10.custom(
+      return z12.custom(
         (v) => values.some((allowed) => allowed === v),
         `one of: ${values.map(String).join(", ")}`
       );
@@ -2898,9 +3394,9 @@ function fieldValidator(field) {
     case "textarea":
     case "url":
     case "email":
-      return z10.string();
+      return z12.string();
     default:
-      return z10.unknown();
+      return z12.unknown();
   }
 }
 function formValidator(fields) {
@@ -2910,7 +3406,7 @@ function formValidator(fields) {
     const base = fieldValidator(field);
     shape[field.key] = field.required ? base : base.optional();
   }
-  return z10.object(shape);
+  return z12.object(shape);
 }
 function validationProblems(error) {
   return error.issues.map((issue) => {
@@ -2942,64 +3438,64 @@ function viewConfig(fields, config) {
 var REGISTRY = "https://registry.npmjs.org";
 var REGISTRY_TIMEOUT_MS = 5e3;
 var MAX_RESULTS = 15;
-var PackageName = z11.string().min(1).regex(/^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/, "not an npm package name");
-var CatalogShape = z11.looseObject({
-  name: z11.string(),
-  version: z11.string(),
-  description: z11.string(),
-  keywords: z11.array(z11.string()).optional(),
-  installed: z11.boolean(),
-  capabilities: z11.array(z11.string()).nullable()
+var PackageName = z13.string().min(1).regex(/^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/, "not an npm package name");
+var CatalogShape = z13.looseObject({
+  name: z13.string(),
+  version: z13.string(),
+  description: z13.string(),
+  keywords: z13.array(z13.string()).optional(),
+  installed: z13.boolean(),
+  capabilities: z13.array(z13.string()).nullable()
 });
-var ListedAddonShape = z11.looseObject({
-  manifest: z11.looseObject({
-    id: z11.string(),
-    packageName: z11.string(),
-    packageVersion: z11.string(),
+var ListedAddonShape = z13.looseObject({
+  manifest: z13.looseObject({
+    id: z13.string(),
+    packageName: z13.string(),
+    packageVersion: z13.string(),
     // The hub answers null, not absent, for a manifest without the flag.
-    protected: z11.boolean().nullish(),
-    removable: z11.boolean().nullish()
+    protected: z13.boolean().nullish(),
+    removable: z13.boolean().nullish()
   })
 });
-var UpdateShape = z11.looseObject({
-  name: z11.string(),
-  currentVersion: z11.string(),
-  latestVersion: z11.string(),
-  category: z11.enum(["addon", "core"]),
-  requiresRestart: z11.boolean(),
-  isSystem: z11.boolean()
+var UpdateShape = z13.looseObject({
+  name: z13.string(),
+  currentVersion: z13.string(),
+  latestVersion: z13.string(),
+  category: z13.enum(["addon", "core"]),
+  requiresRestart: z13.boolean(),
+  isSystem: z13.boolean()
 });
-var InstallationsShape = z11.looseObject({
-  installations: z11.array(
-    z11.looseObject({
-      nodeId: z11.string(),
-      isHub: z11.boolean(),
-      isOnline: z11.boolean(),
-      version: z11.string().nullable(),
-      source: z11.string()
+var InstallationsShape = z13.looseObject({
+  installations: z13.array(
+    z13.looseObject({
+      nodeId: z13.string(),
+      isHub: z13.boolean(),
+      isOnline: z13.boolean(),
+      version: z13.string().nullable(),
+      source: z13.string()
     })
   ),
-  unreachable: z11.array(z11.looseObject({ nodeId: z11.string(), error: z11.string() }))
+  unreachable: z13.array(z13.looseObject({ nodeId: z13.string(), error: z13.string() }))
 });
-var VersionsShape = z11.array(
-  z11.looseObject({ version: z11.string(), deprecated: z11.string().optional() })
+var VersionsShape = z13.array(
+  z13.looseObject({ version: z13.string(), deprecated: z13.string().optional() })
 );
-var UninstallShape = z11.looseObject({
-  success: z11.boolean(),
-  packageName: z11.string(),
-  results: z11.array(
-    z11.looseObject({
-      nodeId: z11.string(),
-      outcome: z11.string(),
-      error: z11.string().optional()
+var UninstallShape = z13.looseObject({
+  success: z13.boolean(),
+  packageName: z13.string(),
+  results: z13.array(
+    z13.looseObject({
+      nodeId: z13.string(),
+      outcome: z13.string(),
+      error: z13.string().optional()
     })
   )
 });
-var ServerStatusShape = z11.looseObject({
-  runningVersion: z11.string().nullable().optional()
+var ServerStatusShape = z13.looseObject({
+  runningVersion: z13.string().nullable().optional()
 });
 async function readProtection(client, packageName) {
-  const list = await readQuery(client, "addons.list", {}, z11.array(ListedAddonShape));
+  const list = await readQuery(client, "addons.list", {}, z13.array(ListedAddonShape));
   if (!list.ok) return null;
   const mine = list.value.filter((a) => a.manifest.packageName === packageName);
   return {
@@ -3010,13 +3506,13 @@ async function readProtection(client, packageName) {
 }
 var PROTECTED_REASON = (name) => `${name} is a protected package (manifest protected / removable:false): the kernel needs it, so it is never installed over, updated or removed here`;
 var UNREADABLE_PROTECTION_REASON = (name) => `could not read whether ${name} is protected (addons.list did not answer with the expected shape); nothing is changed until it does`;
-var PackumentShape = z11.looseObject({
-  peerDependencies: z11.record(z11.string(), z11.string()).optional(),
-  engines: z11.record(z11.string(), z11.string()).optional(),
-  camstack: z11.looseObject({
-    addons: z11.array(
-      z11.looseObject({
-        execution: z11.looseObject({ placement: z11.string().optional() }).optional()
+var PackumentShape = z13.looseObject({
+  peerDependencies: z13.record(z13.string(), z13.string()).optional(),
+  engines: z13.record(z13.string(), z13.string()).optional(),
+  camstack: z13.looseObject({
+    addons: z13.array(
+      z13.looseObject({
+        execution: z13.looseObject({ placement: z13.string().optional() }).optional()
       })
     ).optional()
   }).optional()
@@ -3068,10 +3564,10 @@ async function configureAddonsSearch(ctx, args) {
           ...args.query !== void 0 ? { query: args.query } : {},
           ...args.capability !== void 0 ? { capability: args.capability } : {}
         },
-        z11.array(CatalogShape)
+        z13.array(CatalogShape)
       ),
-      readQuery(client, "addons.list", {}, z11.array(ListedAddonShape)),
-      readQuery(client, "addons.listUpdates", {}, z11.array(UpdateShape)),
+      readQuery(client, "addons.list", {}, z13.array(ListedAddonShape)),
+      readQuery(client, "addons.listUpdates", {}, z13.array(UpdateShape)),
       readQuery(client, "serverManagement.getServerPackageStatus", void 0, ServerStatusShape)
     ]);
     if (!catalog.ok) return { status: "unavailable", reason: catalog.reason };
@@ -3150,7 +3646,7 @@ function installAddonSpec(client, fetchFn) {
         client,
         "addons.searchAvailable",
         { query: args.packageName },
-        z11.array(CatalogShape)
+        z13.array(CatalogShape)
       );
       if (!catalog.ok) return { confirmable: false, describe: { problem: catalog.reason } };
       const entry = catalog.value.find((c) => c.name === args.packageName);
@@ -3253,7 +3749,7 @@ function updateAddonSpec(client) {
         client,
         "addons.listUpdates",
         args.nodeId !== void 0 ? { nodeId: args.nodeId } : {},
-        z11.array(UpdateShape)
+        z13.array(UpdateShape)
       );
       if (!updates.ok) return { confirmable: false, describe: { problem: updates.reason } };
       const entry = updates.value.find((u) => u.name === args.packageName);
@@ -3374,10 +3870,10 @@ function registerAddonTools(server, ctx) {
     "configure_addons_search",
     "Search the addon store (the catalog the admin UI uses) with the installed version, an available update, whether the package is protected, and compatibility (placement, @camstack/types peer range, node engine; no addon declares a minimum server version).",
     {
-      query: z11.string().max(100).optional(),
-      capability: z11.string().max(100).optional()
+      query: z13.string().max(100).optional(),
+      capability: z13.string().max(100).optional()
     },
-    async ({ query, capability }) => text7(
+    async ({ query, capability }) => text8(
       await configureAddonsSearch(ctx, {
         ...query !== void 0 ? { query } : {},
         ...capability !== void 0 ? { capability } : {}
@@ -3389,10 +3885,10 @@ function registerAddonTools(server, ctx) {
     `Install an addon package on the hub from the store. ${TWO_STEP} Agents reconcile later; the result says so.`,
     {
       packageName: PackageName,
-      version: z11.string().max(64).optional(),
-      confirm_token: z11.string().optional()
+      version: z13.string().max(64).optional(),
+      confirm_token: z13.string().optional()
     },
-    async ({ packageName, version, confirm_token }) => text7(
+    async ({ packageName, version, confirm_token }) => text8(
       await installAddon(
         ctx,
         { packageName, ...version !== void 0 ? { version } : {} },
@@ -3405,11 +3901,11 @@ function registerAddonTools(server, ctx) {
     `Update an installed addon package (hub by default, or one node). Protected and framework packages are refused in the preview. ${TWO_STEP}`,
     {
       packageName: PackageName,
-      version: z11.string().max(64).optional(),
-      nodeId: z11.string().max(100).optional(),
-      confirm_token: z11.string().optional()
+      version: z13.string().max(64).optional(),
+      nodeId: z13.string().max(100).optional(),
+      confirm_token: z13.string().optional()
     },
-    async ({ packageName, version, nodeId, confirm_token }) => text7(
+    async ({ packageName, version, nodeId, confirm_token }) => text8(
       await updateAddon(
         ctx,
         {
@@ -3426,11 +3922,11 @@ function registerAddonTools(server, ctx) {
     `Uninstall an addon package from the hub, one node, or everywhere. Protected packages (manifest protected / removable:false) are refused in the preview with the reason. ${TWO_STEP}`,
     {
       packageName: PackageName,
-      nodeId: z11.string().max(100).optional(),
-      everywhere: z11.boolean().optional(),
-      confirm_token: z11.string().optional()
+      nodeId: z13.string().max(100).optional(),
+      everywhere: z13.boolean().optional(),
+      confirm_token: z13.string().optional()
     },
-    async ({ packageName, nodeId, everywhere, confirm_token }) => text7(
+    async ({ packageName, nodeId, everywhere, confirm_token }) => text8(
       await uninstallAddon(
         ctx,
         {
@@ -3446,9 +3942,9 @@ function registerAddonTools(server, ctx) {
 
 // src/mcp/configure-cameras.ts
 import {
-  text as text8
+  text as text9
 } from "@camstack/develop";
-import { z as z12 } from "zod";
+import { z as z14 } from "zod";
 var UNSUPPORTED_HINT = "use support_diagnose_camera / support_draft_issue";
 var MAX_PROVIDERS = 40;
 var MAX_CANDIDATES = 50;
@@ -3461,34 +3957,34 @@ function unsupported(reason, provider) {
     hint: UNSUPPORTED_HINT
   };
 }
-var CapabilityEntry = z12.union([z12.string(), z12.looseObject({ name: z12.string() })]);
-var InstalledAddonShape = z12.looseObject({
-  manifest: z12.looseObject({
-    id: z12.string(),
-    name: z12.string().optional(),
-    description: z12.string().optional(),
-    packageName: z12.string(),
-    packageVersion: z12.string(),
-    capabilities: z12.array(CapabilityEntry).optional()
+var CapabilityEntry = z14.union([z14.string(), z14.looseObject({ name: z14.string() })]);
+var InstalledAddonShape = z14.looseObject({
+  manifest: z14.looseObject({
+    id: z14.string(),
+    name: z14.string().optional(),
+    description: z14.string().optional(),
+    packageName: z14.string(),
+    packageVersion: z14.string(),
+    capabilities: z14.array(CapabilityEntry).optional()
   })
 });
-var CatalogShape2 = z12.looseObject({
-  name: z12.string(),
-  version: z12.string(),
-  description: z12.string(),
-  keywords: z12.array(z12.string()),
-  installed: z12.boolean(),
-  capabilities: z12.array(z12.string()).nullable()
+var CatalogShape2 = z14.looseObject({
+  name: z14.string(),
+  version: z14.string(),
+  description: z14.string(),
+  keywords: z14.array(z14.string()),
+  installed: z14.boolean(),
+  capabilities: z14.array(z14.string()).nullable()
 });
-var DiscoveryProvidersShape = z12.looseObject({
-  providers: z12.array(z12.looseObject({ addonId: z12.string(), label: z12.string() }))
+var DiscoveryProvidersShape = z14.looseObject({
+  providers: z14.array(z14.looseObject({ addonId: z14.string(), label: z14.string() }))
 });
 function capabilityName(entry) {
   return typeof entry === "string" ? entry : entry.name;
 }
 async function readInstalledProviders(client) {
   const [list, discovery] = await Promise.all([
-    readQuery(client, "addons.list", {}, z12.array(InstalledAddonShape)),
+    readQuery(client, "addons.list", {}, z14.array(InstalledAddonShape)),
     readQuery(client, "deviceManager.discoveryProviders", {}, DiscoveryProvidersShape)
   ]);
   if (!list.ok) return list;
@@ -3519,7 +4015,7 @@ async function configureCameraProviders(ctx, query) {
         client,
         "addons.searchAvailable",
         { capability: DEVICE_PROVIDER },
-        z12.array(CatalogShape2)
+        z14.array(CatalogShape2)
       )
     ]);
     if (!installed.ok) return { status: "unavailable", reason: installed.reason };
@@ -3553,13 +4049,13 @@ async function configureCameraProviders(ctx, query) {
     };
   });
 }
-var CandidateShape = z12.looseObject({
-  stableId: z12.string(),
-  type: z12.string(),
-  suggestedName: z12.string(),
-  prefilledConfig: z12.record(z12.string(), z12.unknown())
+var CandidateShape = z14.looseObject({
+  stableId: z14.string(),
+  type: z14.string(),
+  suggestedName: z14.string(),
+  prefilledConfig: z14.record(z14.string(), z14.unknown())
 });
-var DiscoverShape = z12.looseObject({ candidates: z12.array(CandidateShape) });
+var DiscoverShape = z14.looseObject({ candidates: z14.array(CandidateShape) });
 async function configureCameraDiscover(ctx, args) {
   return withAdminHub(ctx, async ({ client }) => {
     const providers = await readQuery(
@@ -3645,7 +4141,7 @@ async function planAdd(client, args) {
     client,
     "deviceManager.getCreationSchema",
     { addonId: args.addonId, type: "camera" },
-    z12.unknown()
+    z14.unknown()
   );
   if (!schema.ok) return { ok: false, problems: [schema.reason] };
   if (schema.value === null || schema.value === void 0) {
@@ -3696,7 +4192,7 @@ async function providerPage(client, addonId) {
   const link = await resolveLinkBase(client);
   return link.base === null ? null : `${link.base}/integrations/${addonId}`;
 }
-var CreatedShape = z12.looseObject({ id: z12.number(), name: z12.string() });
+var CreatedShape = z14.looseObject({ id: z14.number(), name: z14.string() });
 function addCameraSpec(client) {
   return {
     tool: ADD_CAMERA_TOOL,
@@ -3730,7 +4226,7 @@ function addCameraSpec(client) {
       const plan = await planAdd(client, args);
       if (!plan.ok) throw new Error(plan.problems.join("; "));
       const link = await providerPage(client, args.addonId);
-      const needs = plan.secretNeeds.map((f) => secretRequired(f, link));
+      const needs2 = plan.secretNeeds.map((f) => secretRequired(f, link));
       let raw;
       try {
         raw = await client.call("POST", "deviceManager.createDevice", {
@@ -3742,7 +4238,7 @@ function addCameraSpec(client) {
         return {
           created: false,
           adminUi: link,
-          incompleteUntilSecretSet: needs,
+          incompleteUntilSecretSet: needs2,
           error: reasonOf(err)
         };
       }
@@ -3751,7 +4247,7 @@ function addCameraSpec(client) {
         return {
           created: false,
           adminUi: link,
-          incompleteUntilSecretSet: needs,
+          incompleteUntilSecretSet: needs2,
           error: "the hub answered in an unexpected shape; check the Devices page before retrying"
         };
       }
@@ -3761,7 +4257,7 @@ function addCameraSpec(client) {
         deviceId: created.data.id,
         name: created.data.name,
         adminUi: base.base === null ? null : `${base.base}/devices/${String(created.data.id)}`,
-        incompleteUntilSecretSet: needs
+        incompleteUntilSecretSet: needs2
       };
     }
   };
@@ -3773,17 +4269,17 @@ function registerCameraTools(server, ctx) {
   server.tool(
     "configure_camera_providers",
     "Installed camera-provider addons and the published ones not yet installed. A manifest declares no brand/model list, so `query` matches on name, description and keywords; a brand nothing matches is `unsupported` with a pointer to support_diagnose_camera / support_draft_issue.",
-    { query: z12.string().max(100).optional() },
-    async ({ query }) => text8(await configureCameraProviders(ctx, query))
+    { query: z14.string().max(100).optional() },
+    async ({ query }) => text9(await configureCameraProviders(ctx, query))
   );
   server.tool(
     "configure_camera_discover",
     'Scan the network through one camera provider (the admin UI "add camera" discovery) and list the candidates with the non-secret fields to pass to configure_camera_add. Changes nothing on the hub. A credential in `params` is refused (`secret-required`). Needs an admin `camstack login`.',
     {
-      addonId: z12.string().min(1),
-      params: z12.record(z12.string(), z12.unknown()).optional()
+      addonId: z14.string().min(1),
+      params: z14.record(z14.string(), z14.unknown()).optional()
     },
-    async ({ addonId, params }) => text8(
+    async ({ addonId, params }) => text9(
       await configureCameraDiscover(ctx, {
         addonId,
         ...params !== void 0 ? { params } : {}
@@ -3794,46 +4290,46 @@ function registerCameraTools(server, ctx) {
     ADD_CAMERA_TOOL,
     "Add a camera through a provider's creation form (the fields are the provider's own schema). Two steps: call without confirm_token for a preview and a one-shot token, then again with the SAME arguments and that token. `config` takes NON-secret fields only; a password is refused and the answer carries the admin-UI link where the operator types it (`secret-required`). A provider that is not installed or has no manual form is `unsupported`.",
     {
-      addonId: z12.string().min(1),
-      config: z12.record(z12.string(), z12.unknown()),
-      confirm_token: z12.string().optional()
+      addonId: z14.string().min(1),
+      config: z14.record(z14.string(), z14.unknown()),
+      confirm_token: z14.string().optional()
     },
-    async ({ addonId, config, confirm_token }) => text8(await addCamera(ctx, { addonId, config }, confirm_token))
+    async ({ addonId, config, confirm_token }) => text9(await addCamera(ctx, { addonId, config }, confirm_token))
   );
 }
 
 // src/mcp/configure-notifiers.ts
 import {
-  text as text9
+  text as text10
 } from "@camstack/develop";
-import { z as z13 } from "zod";
+import { z as z15 } from "zod";
 var MAX_TARGETS = 50;
-var TargetKindShape = z13.looseObject({
-  kind: z13.string(),
-  label: z13.string(),
-  addonId: z13.string(),
-  supportsDiscovery: z13.boolean().optional(),
-  configSchema: z13.unknown(),
-  destinationKeys: z13.array(z13.string()).optional()
+var TargetKindShape = z15.looseObject({
+  kind: z15.string(),
+  label: z15.string(),
+  addonId: z15.string(),
+  supportsDiscovery: z15.boolean().optional(),
+  configSchema: z15.unknown(),
+  destinationKeys: z15.array(z15.string()).optional()
 });
-var TargetShape = z13.looseObject({
-  id: z13.string(),
-  name: z13.string(),
-  kind: z13.string(),
-  addonId: z13.string(),
-  enabled: z13.boolean(),
-  config: z13.record(z13.string(), z13.unknown())
+var TargetShape = z15.looseObject({
+  id: z15.string(),
+  name: z15.string(),
+  kind: z15.string(),
+  addonId: z15.string(),
+  enabled: z15.boolean(),
+  config: z15.record(z15.string(), z15.unknown())
 });
-var SendResultShape = z13.looseObject({
-  success: z13.boolean(),
-  error: z13.string().optional()
+var SendResultShape = z15.looseObject({
+  success: z15.boolean(),
+  error: z15.string().optional()
 });
 async function readKinds(client) {
   const read = await readQuery(
     client,
     "notificationOutput.listTargetKinds",
     {},
-    z13.array(TargetKindShape)
+    z15.array(TargetKindShape)
   );
   if (!read.ok) return read;
   return {
@@ -3888,7 +4384,7 @@ async function configureNotificationTargets(ctx) {
   return withAdminHub(ctx, async ({ client }) => {
     const [kinds, targets] = await Promise.all([
       readKinds(client),
-      readQuery(client, "notificationOutput.listTargets", {}, z13.array(TargetShape))
+      readQuery(client, "notificationOutput.listTargets", {}, z15.array(TargetShape))
     ]);
     if (!targets.ok) return { status: "unavailable", reason: targets.reason };
     const forms = kinds.ok ? kinds.value : [];
@@ -3929,7 +4425,7 @@ async function planUpsert(client, args) {
   const fields = form.fields;
   let existing = null;
   if (args.targetId !== void 0) {
-    const list = await readQuery(client, "notificationOutput.listTargets", {}, z13.array(TargetShape));
+    const list = await readQuery(client, "notificationOutput.listTargets", {}, z15.array(TargetShape));
     if (!list.ok) return { ok: false, problems: [list.reason] };
     existing = list.value.find((t) => t.id === args.targetId) ?? null;
     if (existing === null) return { ok: false, problems: [`target ${args.targetId} was not found`] };
@@ -4036,7 +4532,7 @@ function testTargetSpec(client) {
     async dryRun(args) {
       const [kinds, targets] = await Promise.all([
         readKinds(client),
-        readQuery(client, "notificationOutput.listTargets", {}, z13.array(TargetShape))
+        readQuery(client, "notificationOutput.listTargets", {}, z15.array(TargetShape))
       ]);
       if (!targets.ok) return { confirmable: false, describe: { problem: targets.reason } };
       const target = targets.value.find((t) => t.id === args.targetId);
@@ -4050,12 +4546,12 @@ function testTargetSpec(client) {
       if (view.incomplete.length > 0) {
         const form = kinds.ok ? kinds.value.find((k) => k.kind === target.kind) : void 0;
         const link = await notificationsPage(client);
-        const needs = (form?.fields ?? []).filter((f) => view.incomplete.includes(f.key)).map((f) => secretRequired(f, link));
+        const needs2 = (form?.fields ?? []).filter((f) => view.incomplete.includes(f.key)).map((f) => secretRequired(f, link));
         return {
           confirmable: false,
           describe: {
             problem: `target ${target.id} is incomplete until its secret is set`,
-            secretRequired: needs
+            secretRequired: needs2
           }
         };
       }
@@ -4108,26 +4604,26 @@ function registerNotifierTools(server, ctx) {
     "configure_notifiers",
     "The notifier kinds a target can be created from (ntfy, telegram, email, \u2026), each with its settings fields, which are required and which are SECRETS. Secrets are never tool arguments. Needs an admin `camstack login`.",
     {},
-    async () => text9(await configureNotifiers(ctx))
+    async () => text10(await configureNotifiers(ctx))
   );
   server.tool(
     "configure_notification_targets",
     "Existing notification targets with their non-secret settings. A secret is shown only as set/unset, and a target missing a required secret is listed under `incomplete`. Needs an admin `camstack login`.",
     {},
-    async () => text9(await configureNotificationTargets(ctx))
+    async () => text10(await configureNotificationTargets(ctx))
   );
   server.tool(
     UPSERT_TARGET_TOOL,
     "Create (no targetId) or edit (targetId) a notification target from its notifier schema (see configure_notifiers). Two steps: call without confirm_token for a preview and a one-shot token, then again with the SAME arguments and that token. `config` takes NON-secret fields only; a secret field is refused, and the target is saved incomplete with the admin-UI link where the operator types the secret (`secret-required`).",
     {
-      targetId: z13.string().min(1).optional(),
-      kind: z13.string().min(1),
-      name: z13.string().min(1),
-      config: z13.record(z13.string(), z13.unknown()),
-      enabled: z13.boolean().optional(),
-      confirm_token: z13.string().optional()
+      targetId: z15.string().min(1).optional(),
+      kind: z15.string().min(1),
+      name: z15.string().min(1),
+      config: z15.record(z15.string(), z15.unknown()),
+      enabled: z15.boolean().optional(),
+      confirm_token: z15.string().optional()
     },
-    async ({ targetId, kind, name, config, enabled, confirm_token }) => text9(
+    async ({ targetId, kind, name, config, enabled, confirm_token }) => text10(
       await upsertNotificationTarget(
         ctx,
         {
@@ -4144,51 +4640,51 @@ function registerNotifierTools(server, ctx) {
   server.tool(
     TEST_TARGET_TOOL,
     "Send a test notification to one target. Two steps: the preview checks the target exists and has every required secret, and only the confirmed call delivers a real message.",
-    { targetId: z13.string().min(1), confirm_token: z13.string().optional() },
-    async ({ targetId, confirm_token }) => text9(await testNotificationTarget(ctx, { targetId }, confirm_token))
+    { targetId: z15.string().min(1), confirm_token: z15.string().optional() },
+    async ({ targetId, confirm_token }) => text10(await testNotificationTarget(ctx, { targetId }, confirm_token))
   );
 }
 
 // src/mcp/ops-tools.ts
-import { z as z18 } from "zod";
-import { jwtClaims, text as text10 } from "@camstack/develop";
+import { z as z27 } from "zod";
+import { jwtClaims, text as text12 } from "@camstack/develop";
 
 // src/mcp/ops-accelerators.ts
-import { z as z14 } from "zod";
-var NodesSchema = z14.array(
-  z14.looseObject({
-    id: z14.string(),
-    isOnline: z14.boolean(),
-    name: z14.string().optional()
+import { z as z16 } from "zod";
+var NodesSchema = z16.array(
+  z16.looseObject({
+    id: z16.string(),
+    isOnline: z16.boolean(),
+    name: z16.string().optional()
   })
 );
-var HardwareSchema = z14.looseObject({
-  platform: z14.enum(["darwin", "linux", "win32"]),
-  arch: z14.enum(["arm64", "x64"]),
-  cpuModel: z14.string(),
-  cpuCores: z14.number(),
-  totalRAM_MB: z14.number(),
-  availableRAM_MB: z14.number(),
-  gpu: z14.looseObject({
-    type: z14.enum(["nvidia", "amd", "intel", "apple"]),
-    name: z14.string()
+var HardwareSchema = z16.looseObject({
+  platform: z16.enum(["darwin", "linux", "win32"]),
+  arch: z16.enum(["arm64", "x64"]),
+  cpuModel: z16.string(),
+  cpuCores: z16.number(),
+  totalRAM_MB: z16.number(),
+  availableRAM_MB: z16.number(),
+  gpu: z16.looseObject({
+    type: z16.enum(["nvidia", "amd", "intel", "apple"]),
+    name: z16.string()
   }).nullable(),
-  npu: z14.looseObject({
-    type: z14.enum(["apple-ane", "intel-npu", "amd-xdna"])
+  npu: z16.looseObject({
+    type: z16.enum(["apple-ane", "intel-npu", "amd-xdna"])
   }).nullable()
 });
-var InferenceDevicesSchema = z14.looseObject({
-  reachable: z14.boolean(),
-  devices: z14.array(
-    z14.looseObject({
-      key: z14.string(),
-      backend: z14.string(),
-      device: z14.string(),
-      available: z14.boolean(),
-      presence: z14.enum(["present", "absent", "unknown"]).optional(),
-      enabled: z14.boolean(),
-      exclusion: z14.string().nullable(),
-      defaultModelId: z14.string()
+var InferenceDevicesSchema = z16.looseObject({
+  reachable: z16.boolean(),
+  devices: z16.array(
+    z16.looseObject({
+      key: z16.string(),
+      backend: z16.string(),
+      device: z16.string(),
+      available: z16.boolean(),
+      presence: z16.enum(["present", "absent", "unknown"]).optional(),
+      enabled: z16.boolean(),
+      exclusion: z16.string().nullable(),
+      defaultModelId: z16.string()
     })
   )
 });
@@ -4312,81 +4808,81 @@ async function opsAccelerators(ctx) {
 }
 
 // src/mcp/ops-device.ts
-import { z as z15 } from "zod";
-var DeviceSchema = z15.looseObject({
-  id: z15.number(),
-  name: z15.string(),
-  type: z15.string().optional(),
-  addonId: z15.string().optional(),
-  location: z15.string().nullable().optional(),
-  disabled: z15.boolean().optional(),
-  online: z15.boolean().optional(),
-  isCamera: z15.boolean().optional(),
-  features: z15.array(z15.string()).optional()
+import { z as z17 } from "zod";
+var DeviceSchema = z17.looseObject({
+  id: z17.number(),
+  name: z17.string(),
+  type: z17.string().optional(),
+  addonId: z17.string().optional(),
+  location: z17.string().nullable().optional(),
+  disabled: z17.boolean().optional(),
+  online: z17.boolean().optional(),
+  isCamera: z17.boolean().optional(),
+  features: z17.array(z17.string()).optional()
 });
 var NullableDeviceSchema = DeviceSchema.nullable();
-var DeviceListSchema = z15.array(DeviceSchema);
-var BindingsSchema2 = z15.looseObject({
-  entries: z15.array(
-    z15.looseObject({
-      capName: z15.string(),
-      kind: z15.string(),
-      providerAddonId: z15.string(),
-      providerNodeId: z15.string()
+var DeviceListSchema = z17.array(DeviceSchema);
+var BindingsSchema2 = z17.looseObject({
+  entries: z17.array(
+    z17.looseObject({
+      capName: z17.string(),
+      kind: z17.string(),
+      providerAddonId: z17.string(),
+      providerNodeId: z17.string()
     })
   )
 });
-var StatusAggregateSchema = z15.record(z15.string(), z15.unknown());
-var DegradationSchema = z15.looseObject({
-  stage: z15.string(),
-  reason: z15.string(),
-  elapsedMs: z15.number().optional()
+var StatusAggregateSchema = z17.record(z17.string(), z17.unknown());
+var DegradationSchema = z17.looseObject({
+  stage: z17.string(),
+  reason: z17.string(),
+  elapsedMs: z17.number().optional()
 });
-var CameraStatusSchema = z15.looseObject({
-  deviceId: z15.number(),
-  assignment: z15.looseObject({
-    detectionNodeId: z15.string().nullable(),
-    decoderNodeId: z15.string().nullable(),
-    sourceNodeId: z15.string().nullable(),
+var CameraStatusSchema = z17.looseObject({
+  deviceId: z17.number(),
+  assignment: z17.looseObject({
+    detectionNodeId: z17.string().nullable(),
+    decoderNodeId: z17.string().nullable(),
+    sourceNodeId: z17.string().nullable(),
     /** Why a stage sits where it does; `armed:on-motion` means idle by design. */
-    reasons: z15.record(z15.string(), z15.string().optional()).optional()
+    reasons: z17.record(z17.string(), z17.string().optional()).optional()
   }),
-  broker: z15.looseObject({
-    profiles: z15.array(
-      z15.looseObject({
-        profile: z15.string(),
-        status: z15.string(),
-        subscribers: z15.number()
+  broker: z17.looseObject({
+    profiles: z17.array(
+      z17.looseObject({
+        profile: z17.string(),
+        status: z17.string(),
+        subscribers: z17.number()
       })
     )
   }).nullable(),
-  detection: z15.looseObject({
-    nodeId: z15.string(),
-    phase: z15.string(),
-    actualFps: z15.number(),
-    configuredFps: z15.number(),
-    provisioning: z15.looseObject({
-      state: z15.string(),
-      error: z15.string().optional()
+  detection: z17.looseObject({
+    nodeId: z17.string(),
+    phase: z17.string(),
+    actualFps: z17.number(),
+    configuredFps: z17.number(),
+    provisioning: z17.looseObject({
+      state: z17.string(),
+      error: z17.string().optional()
     })
   }).nullable(),
-  recording: z15.looseObject({
-    mode: z15.string(),
-    active: z15.boolean(),
-    storageBytes: z15.number()
+  recording: z17.looseObject({
+    mode: z17.string(),
+    active: z17.boolean(),
+    storageBytes: z17.number()
   }).nullable(),
-  switchedOff: z15.array(z15.string()),
-  degraded: z15.array(DegradationSchema),
-  fetchedAt: z15.number()
+  switchedOff: z17.array(z17.string()),
+  degraded: z17.array(DegradationSchema),
+  fetchedAt: z17.number()
 });
-var CameraStatusListSchema = z15.array(CameraStatusSchema);
-var ObjectEventSchema = z15.looseObject({
-  id: z15.number(),
-  timestamp: z15.number(),
-  className: z15.string().optional(),
-  trackId: z15.string().optional()
+var CameraStatusListSchema = z17.array(CameraStatusSchema);
+var ObjectEventSchema = z17.looseObject({
+  id: z17.number(),
+  timestamp: z17.number(),
+  className: z17.string().optional(),
+  trackId: z17.string().optional()
 });
-var ObjectEventsSchema2 = z15.array(ObjectEventSchema);
+var ObjectEventsSchema2 = z17.array(ObjectEventSchema);
 var BINDING_LIMIT = 40;
 var EVENT_LIMIT = 5;
 var UNHEALTHY_LIMIT = 50;
@@ -4394,9 +4890,9 @@ function freshness(aggregate, now) {
   const fetched = [];
   let changed = null;
   for (const [capName, value] of Object.entries(aggregate)) {
-    const parsed = z15.looseObject({
-      lastFetchedAt: z15.number().optional(),
-      lastChangedAt: z15.number().optional()
+    const parsed = z17.looseObject({
+      lastFetchedAt: z17.number().optional(),
+      lastChangedAt: z17.number().optional()
     }).safeParse(value);
     if (!parsed.success) continue;
     const at = parsed.data.lastFetchedAt;
@@ -4647,26 +5143,26 @@ async function opsUnhealthyDevices(ctx) {
 }
 
 // src/mcp/ops-logs.ts
-import { z as z16 } from "zod";
-var LevelSchema = z16.enum(["debug", "info", "warn", "error"]);
-var LogEntrySchema = z16.looseObject({
-  timestamp: z16.string(),
-  level: z16.string(),
-  scope: z16.string().optional(),
-  message: z16.string(),
-  tags: z16.record(z16.string(), z16.string().optional()).optional(),
-  meta: z16.record(z16.string(), z16.unknown()).optional()
+import { z as z18 } from "zod";
+var LevelSchema = z18.enum(["debug", "info", "warn", "error"]);
+var LogEntrySchema = z18.looseObject({
+  timestamp: z18.string(),
+  level: z18.string(),
+  scope: z18.string().optional(),
+  message: z18.string(),
+  tags: z18.record(z18.string(), z18.string().optional()).optional(),
+  meta: z18.record(z18.string(), z18.unknown()).optional()
 });
-var LogPageSchema = z16.looseObject({
-  entries: z16.array(LogEntrySchema),
-  done: z16.boolean(),
-  source: z16.string()
+var LogPageSchema = z18.looseObject({
+  entries: z18.array(LogEntrySchema),
+  done: z18.boolean(),
+  source: z18.string()
 });
-var LogSourcesSchema = z16.array(
-  z16.looseObject({
-    addonId: z16.string(),
-    readable: z16.boolean(),
-    isDefault: z16.boolean()
+var LogSourcesSchema = z18.array(
+  z18.looseObject({
+    addonId: z18.string(),
+    readable: z18.boolean(),
+    isDefault: z18.boolean()
   })
 );
 var RING_SOURCE = "ring";
@@ -4881,37 +5377,37 @@ async function opsLogs(ctx, args, now = Date.now()) {
 }
 
 // src/mcp/ops-status.ts
-import { z as z17 } from "zod";
-var TopologyNodeSchema = z17.looseObject({
-  id: z17.string(),
-  name: z17.string().optional(),
-  platform: z17.string().optional(),
-  isHub: z17.boolean().optional(),
-  isOnline: z17.boolean(),
-  addons: z17.array(z17.looseObject({ capabilities: z17.array(z17.string()) })).optional(),
+import { z as z19 } from "zod";
+var TopologyNodeSchema = z19.looseObject({
+  id: z19.string(),
+  name: z19.string().optional(),
+  platform: z19.string().optional(),
+  isHub: z19.boolean().optional(),
+  isOnline: z19.boolean(),
+  addons: z19.array(z19.looseObject({ capabilities: z19.array(z19.string()) })).optional(),
   /** Agents report it; the hub does not. Absent means "not claimed". */
-  capabilitiesRegistered: z17.boolean().optional()
+  capabilitiesRegistered: z19.boolean().optional()
 });
-var TopologySchema = z17.array(TopologyNodeSchema);
-var ServerStatusSchema = z17.looseObject({
-  runningVersion: z17.string(),
-  restartRequired: z17.boolean().optional(),
-  updateAvailable: z17.boolean().optional(),
-  updateState: z17.string().optional()
+var TopologySchema = z19.array(TopologyNodeSchema);
+var ServerStatusSchema = z19.looseObject({
+  runningVersion: z19.string(),
+  restartRequired: z19.boolean().optional(),
+  updateAvailable: z19.boolean().optional(),
+  updateState: z19.string().optional()
 });
-var AlertSchema = z17.looseObject({
-  severity: z17.string(),
-  title: z17.string(),
-  message: z17.string().optional(),
-  status: z17.string()
+var AlertSchema = z19.looseObject({
+  severity: z19.string(),
+  title: z19.string(),
+  message: z19.string().optional(),
+  status: z19.string()
 });
-var AlertsSchema = z17.array(AlertSchema);
-var AddonUpdateSchema = z17.looseObject({
-  name: z17.string(),
-  currentVersion: z17.string(),
-  latestVersion: z17.string()
+var AlertsSchema = z19.array(AlertSchema);
+var AddonUpdateSchema = z19.looseObject({
+  name: z19.string(),
+  currentVersion: z19.string(),
+  latestVersion: z19.string()
 });
-var AddonUpdatesSchema = z17.array(AddonUpdateSchema);
+var AddonUpdatesSchema = z19.array(AddonUpdateSchema);
 var NODE_LIMIT2 = 40;
 var ALERT_LIMIT = 10;
 var UPDATE_LIMIT = 20;
@@ -5040,195 +5536,189 @@ async function opsStatus(ctx) {
   });
 }
 
-// src/mcp/ops-tools.ts
-var IDENTITY_CLAIMS = ["sub", "username", "name", "role"];
-function identityOf(token) {
-  const claims = jwtClaims(token);
-  const out = {};
-  if (claims === null) return out;
-  for (const key of IDENTITY_CLAIMS) {
-    const value = claims[key];
-    if (typeof value === "string" && value !== "") out[key] = value;
+// src/mcp/ops-update-apply.ts
+import {
+  runGated as runGated3
+} from "@camstack/develop";
+import { z as z25 } from "zod";
+
+// src/mcp/ops-update-model.ts
+import { z as z20 } from "zod";
+var ImageContractShape = z20.looseObject({
+  state: z20.enum(["in-sync", "behind-patch", "behind-series", "ahead", "unknown"]),
+  seedVersion: z20.string().nullable(),
+  contractVersion: z20.string().nullable(),
+  message: z20.string().optional()
+});
+var WrapperShape = z20.looseObject({
+  kind: z20.enum(["docker", "electron", "native", "contradictory", "unknown"]),
+  currentVersion: z20.string().nullable().optional()
+});
+var ServerStatusShape2 = z20.looseObject({
+  runningVersion: z20.string().nullable(),
+  installedVersion: z20.string().nullable().optional(),
+  latestVersion: z20.string().nullable().optional(),
+  pendingVersion: z20.string().nullable().optional(),
+  restartRequired: z20.boolean().optional(),
+  updateAvailable: z20.boolean().optional(),
+  updateState: z20.string().optional(),
+  lastCheckedAtMs: z20.number().nullable().optional(),
+  rolledBack: z20.looseObject({
+    fromVersion: z20.string(),
+    toVersion: z20.string().nullable(),
+    reason: z20.string()
+  }).nullable().optional(),
+  imageContract: ImageContractShape.optional(),
+  wrapper: WrapperShape.optional()
+});
+var AddonUpdateShape = z20.looseObject({
+  name: z20.string(),
+  currentVersion: z20.string(),
+  latestVersion: z20.string(),
+  category: z20.enum(["addon", "core"]),
+  requiresRestart: z20.boolean().optional(),
+  isSystem: z20.boolean()
+});
+var InstallationsShape2 = z20.looseObject({
+  installations: z20.array(
+    z20.looseObject({
+      packageName: z20.string(),
+      nodeId: z20.string(),
+      isHub: z20.boolean(),
+      isOnline: z20.boolean(),
+      version: z20.string().nullable(),
+      onHub: z20.boolean().optional()
+    })
+  ),
+  unreachable: z20.array(z20.looseObject({ nodeId: z20.string(), error: z20.string() }))
+});
+var ServerActionShape = z20.looseObject({
+  accepted: z20.boolean().optional(),
+  outcome: z20.enum(["staged", "restart-scheduled", "already-current", "refused", "failed"]).optional(),
+  reason: z20.string().nullable().optional(),
+  error: z20.string().nullable().optional(),
+  message: z20.string().optional(),
+  blockers: z20.array(z20.looseObject({ addonId: z20.string(), reason: z20.string() })).optional()
+});
+function statusInput(node) {
+  return node.isHub === true ? void 0 : { nodeId: node.id };
+}
+function readTopology(client) {
+  return readQuery(client, "nodes.topology", void 0, TopologySchema);
+}
+function readNodeStatus(client, node) {
+  return readQuery(
+    client,
+    "serverManagement.getServerPackageStatus",
+    statusInput(node),
+    ServerStatusShape2
+  );
+}
+function readInstallations(client) {
+  return readQuery(client, "addons.listInstallations", {}, InstallationsShape2);
+}
+function serverVerdict(status) {
+  return {
+    running: status.runningVersion,
+    installed: status.installedVersion ?? null,
+    latest: status.latestVersion ?? null,
+    pending: status.pendingVersion ?? null,
+    updateAvailable: status.updateAvailable ?? null,
+    restartRequired: status.restartRequired ?? null,
+    updateState: status.updateState ?? null,
+    rolledBack: status.rolledBack ? {
+      from: status.rolledBack.fromVersion,
+      to: status.rolledBack.toVersion,
+      reason: status.rolledBack.reason
+    } : null,
+    latestCheckedAt: status.lastCheckedAtMs !== void 0 && status.lastCheckedAtMs !== null ? new Date(status.lastCheckedAtMs).toISOString() : null
+  };
+}
+function wrapperInstructions(kind) {
+  switch (kind) {
+    case "docker":
+      return [
+        "The image is replaced, not the closure: pull the new image and RECREATE the container (a plain restart keeps the old image).",
+        "Docker Compose: `docker compose pull` then `docker compose up -d`.",
+        'Unraid: Docker tab, "Check for updates", then apply the update on the CamStack container (it is recreated from the new image; keep the same appdata paths).',
+        'Proxmox LXC: recreate the container the way it was installed; `setup_install_guide` with hostKind "proxmox-lxc" returns the official steps.',
+        "Back up the data volume first; no tool here does it."
+      ];
+    case "electron":
+      return [
+        "Update the CamStack desktop app on that machine: install the new app version (the in-app update, or reinstall from the release) and let the app restart.",
+        "The server closure update does not change the app bundle."
+      ];
+    case "native":
+      return [
+        "This node runs as a bare host process: update the package or service that starts it (the starter is not delivered by the closure update), then restart the service."
+      ];
+    default:
+      return [
+        "The shell this node runs in could not be identified; check how it was installed (`setup_install_guide` lists the routes) and update it that way."
+      ];
   }
-  return out;
 }
-async function whoami(ctx) {
-  const outcome = await ctx.hub();
-  if (!outcome.ok) return noSessionResult(outcome);
-  const c = outcome.connection;
+function wrapperVerdict(status) {
+  const kind = status.wrapper?.kind ?? null;
+  const contract = status.imageContract;
+  if (contract === void 0) {
+    return {
+      kind,
+      behind: null,
+      state: null,
+      from: null,
+      to: null,
+      message: "this node reports no image contract (its server predates it); the shell is unverified",
+      instructions: []
+    };
+  }
+  const behind = contract.state === "behind-patch" || contract.state === "behind-series" ? true : contract.state === "in-sync" ? false : null;
   return {
-    status: "ok",
-    hub: c.server,
-    tier: c.tier,
-    source: c.source,
-    identity: identityOf(c.token)
+    kind,
+    behind,
+    state: contract.state,
+    from: contract.seedVersion,
+    to: contract.contractVersion,
+    message: contract.message ?? null,
+    instructions: behind === true ? wrapperInstructions(kind) : []
   };
 }
-function registerOpsTools(server, ctx) {
-  server.tool(
-    "ops_whoami",
-    "Which hub this MCP talks to and as whom, from the `camstack login` session (no network call). If there is no session, says to run `camstack login <host>` in a terminal.",
-    {},
-    async () => text10(await whoami(ctx))
-  );
-  server.tool(
-    "ops_status",
-    'Cluster summary: every node (online, platform, server version, capability count, "online-but-capless" flag), the active alerts and the addons with an update. A part the hub did not answer is null with its reason in `unavailable`, never zero. Node list and updates need an admin `camstack login`.',
-    {},
-    async () => text10(await opsStatus(ctx))
-  );
-  server.tool(
-    "ops_device",
-    "One device: online state, provider addon and node, bound capabilities, runtime-state age and, for a camera, its pipeline, recording state, the functions an operator switched off (not faults) and its latest object events.",
-    { deviceId: z18.number().int() },
-    async ({ deviceId }) => text10(await opsDevice(ctx, deviceId))
-  );
-  server.tool(
-    "ops_unhealthy_devices",
-    "Every enabled device that is unhealthy, each with a typed reason (offline, detection-provisioning-failed, detection-not-assigned, recording-inactive). A function an operator switched off is never listed; a camera whose status could not be fully read is listed under `unknown`.",
-    {},
-    async () => text10(await opsUnhealthyDevices(ctx))
-  );
-  server.tool(
-    "ops_logs",
-    "Hub logs scoped by deviceId, addon, node, level, window and free text, grouped and deduplicated with counts. Says which tier answered (ring = recent in-RAM; persisted = the default log destination). With `around` (a track or event id) returns `contextLines` lines on each side of its first mention. Needs an admin `camstack login`.",
-    {
-      deviceId: z18.number().int().optional(),
-      addonId: z18.string().optional(),
-      nodeId: z18.string().optional(),
-      level: z18.enum(["debug", "info", "warn", "error"]).optional(),
-      windowMinutes: z18.number().int().min(1).max(1440).optional(),
-      text: z18.string().max(200).optional(),
-      around: z18.string().max(200).optional(),
-      contextLines: z18.number().int().min(1).max(50).optional()
-    },
-    async (args) => text10(
-      await opsLogs(ctx, {
-        ...args.deviceId !== void 0 ? { deviceId: args.deviceId } : {},
-        ...args.addonId ? { addonId: args.addonId } : {},
-        ...args.nodeId ? { nodeId: args.nodeId } : {},
-        ...args.level ? { level: args.level } : {},
-        ...args.windowMinutes !== void 0 ? { windowMinutes: args.windowMinutes } : {},
-        ...args.text ? { text: args.text } : {},
-        ...args.around ? { around: args.around } : {},
-        ...args.contextLines !== void 0 ? { contextLines: args.contextLines } : {}
-      })
-    )
-  );
-  server.tool(
-    "ops_events",
-    "Find tracks (and, for one camera, object events) by camera, class, zone, time window and free text. Each result carries an admin-UI link and a viewer link built on the hub address flagged for app connections.",
-    {
-      deviceId: z18.number().int().optional(),
-      className: z18.string().optional(),
-      zone: z18.string().optional(),
-      text: z18.string().max(200).optional(),
-      windowMinutes: z18.number().int().min(1).max(10080).optional(),
-      limit: z18.number().int().min(1).max(50).optional()
-    },
-    async (args) => text10(
-      await opsEvents(ctx, {
-        ...args.deviceId !== void 0 ? { deviceId: args.deviceId } : {},
-        ...args.className ? { className: args.className } : {},
-        ...args.zone ? { zone: args.zone } : {},
-        ...args.text ? { text: args.text } : {},
-        ...args.windowMinutes !== void 0 ? { windowMinutes: args.windowMinutes } : {},
-        ...args.limit !== void 0 ? { limit: args.limit } : {}
-      })
-    )
-  );
-  server.tool(
-    "ops_track",
-    "One track with its media audit: best shot, keyframes, every missing media kind with the reason the track recorded for it, and the audit findings. Links to the admin UI and the viewer.",
-    { deviceId: z18.number().int(), trackId: z18.string().min(1) },
-    async ({ deviceId, trackId }) => text10(await opsTrack(ctx, { deviceId, trackId }))
-  );
-  server.tool(
-    "ops_accelerators",
-    'Per node: the inference devices it has, the Auto-tune hardware class the node maps to, and whether the measured detector-latency table has a row for that class and accelerator. A node that could not be read is null with a reason, never "no accelerator". Needs an admin `camstack login`.',
-    {},
-    async () => text10(await opsAccelerators(ctx))
-  );
+function needsServerUpdate(verdict) {
+  return verdict.updateAvailable === true || verdict.restartRequired === true;
 }
-
-// src/mcp/configure-tools.ts
-var CurrentDeviceSchema = z19.object({ name: z19.string() }).nullable();
-var RENAME_DEVICE_TOOL = "configure_rename_device";
-function renameDeviceSpec(client) {
-  return {
-    tool: RENAME_DEVICE_TOOL,
-    async dryRun(args) {
-      const current = CurrentDeviceSchema.safeParse(
-        await client.call("GET", "deviceManager.getDevice", {
-          deviceId: args.deviceId
-        })
-      );
-      if (!current.success || current.data === null) {
-        return {
-          confirmable: false,
-          describe: {
-            problem: `device ${args.deviceId} was not found on the hub`
-          }
-        };
-      }
-      if (current.data.name === args.name) {
-        return {
-          confirmable: false,
-          describe: {
-            problem: `device ${args.deviceId} is already named "${args.name}"`
-          }
-        };
-      }
-      return {
-        confirmable: true,
-        describe: {
-          action: "rename device",
-          deviceId: args.deviceId,
-          from: current.data.name,
-          to: args.name
-        }
-      };
-    },
-    async execute(args) {
-      await client.call("POST", "deviceManager.setName", {
-        deviceId: args.deviceId,
-        name: args.name
+function capState(node) {
+  const count = distinctCaps(node);
+  return { count, capless: isCapless(node, count) };
+}
+function addonDrift(installations) {
+  const hubVersion = /* @__PURE__ */ new Map();
+  for (const row of installations.installations) {
+    if (row.isHub && row.version !== null) hubVersion.set(row.packageName, row.version);
+  }
+  const drift = [];
+  for (const row of installations.installations) {
+    if (row.isHub) continue;
+    const hub = hubVersion.get(row.packageName);
+    if (hub === void 0) continue;
+    if (row.version !== hub) {
+      drift.push({
+        packageName: row.packageName,
+        nodeId: row.nodeId,
+        hubVersion: hub,
+        nodeVersion: row.version
       });
-      return { deviceId: args.deviceId, name: args.name };
     }
-  };
-}
-async function renameDevice(ctx, args, confirmToken) {
-  const outcome = await ctx.hub();
-  if (!outcome.ok) return noSessionResult(outcome);
-  if (outcome.connection.tier !== "admin") {
-    return {
-      status: "refused",
-      reason: outcome.connection.adminHint ?? "this credential is not admin-scoped"
-    };
   }
-  return runGated3(ctx.gate, renameDeviceSpec(outcome.connection.client), args, confirmToken);
-}
-function registerConfigureTools(server, ctx) {
-  server.tool(
-    RENAME_DEVICE_TOOL,
-    "Rename a device. Two steps: call without confirm_token for a preview and a one-shot token, then call again with the SAME arguments and that token to apply. Needs an admin `camstack login` session.",
-    {
-      deviceId: z19.number().int(),
-      name: z19.string().min(1),
-      confirm_token: z19.string().optional()
-    },
-    async ({ deviceId, name, confirm_token }) => text11(await renameDevice(ctx, { deviceId, name }, confirm_token))
-  );
-  registerAddonTools(server, ctx);
-  registerCameraTools(server, ctx);
-  registerNotifierTools(server, ctx);
-  registerConfigureP3bTools(server, ctx);
+  return drift;
 }
 
+// src/mcp/ops-update-cli.ts
+import { execFile } from "child_process";
+
 // src/mcp/setup-tools.ts
-import { text as text12 } from "@camstack/develop";
-import { z as z23 } from "zod";
+import { text as text11 } from "@camstack/develop";
+import { z as z24 } from "zod";
 
 // src/mcp/setup-hubs.ts
 import * as https from "https";
@@ -5241,13 +5731,13 @@ import {
   normalizeHubAddress,
   resolveHubTls
 } from "@camstack/develop";
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 
 // src/mcp/setup-install.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 
 // src/mcp/setup-install-rules.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 var HOST_KINDS = [
   "docker-compose",
   "docker",
@@ -5255,24 +5745,24 @@ var HOST_KINDS = [
   "proxmox-lxc",
   "macos-desktop"
 ];
-var HostKindSchema = z20.enum(HOST_KINDS);
+var HostKindSchema = z21.enum(HOST_KINDS);
 var ROLES = ["hub", "agent"];
-var RoleSchema = z20.enum(ROLES);
+var RoleSchema = z21.enum(ROLES);
 var ACCELERATORS = ["intel", "amd", "coral", "apple", "cpu"];
-var AcceleratorSchema = z20.enum(ACCELERATORS);
-var InstallPathsSchema = z20.object({
-  data: z20.string().min(1),
-  recordings: z20.string().min(1),
-  config: z20.string().min(1).optional(),
-  backups: z20.string().min(1).optional()
+var AcceleratorSchema = z21.enum(ACCELERATORS);
+var InstallPathsSchema = z21.object({
+  data: z21.string().min(1),
+  recordings: z21.string().min(1),
+  config: z21.string().min(1).optional(),
+  backups: z21.string().min(1).optional()
 });
-var InstallGuideInputSchema = z20.object({
+var InstallGuideInputSchema = z21.object({
   hostKind: HostKindSchema.optional(),
   role: RoleSchema.optional(),
   accelerator: AcceleratorSchema.optional(),
   paths: InstallPathsSchema.optional(),
   /** Agents only: the hub the agent should dial (host or IP). */
-  hubAddress: z20.string().min(1).optional()
+  hubAddress: z21.string().min(1).optional()
 });
 var RAW = "https://raw.githubusercontent.com/camstack";
 var TEMPLATE_URLS = {
@@ -5411,20 +5901,20 @@ function readService(body) {
     if (raw.trim() === "" || raw.trim().startsWith("#")) continue;
     const line = stripComment(raw);
     const indent = line.length - line.trimStart().length;
-    const text14 = line.trim();
+    const text15 = line.trim();
     if (indent === 4) {
       sub = null;
-      const m = /^([A-Za-z_]+):\s*(.*)$/.exec(text14);
+      const m = /^([A-Za-z_]+):\s*(.*)$/.exec(text15);
       if (m === null) continue;
       key = m[1] ?? null;
       if (key !== null && (m[2] ?? "") !== "") fields.scalars.set(key, unquote(m[2] ?? ""));
     } else if (indent === 6 && key !== null) {
-      if (text14.startsWith("- ")) {
+      if (text15.startsWith("- ")) {
         const list = fields.lists.get(key) ?? [];
-        list.push(unquote(text14.slice(2)));
+        list.push(unquote(text15.slice(2)));
         fields.lists.set(key, list);
       } else {
-        const m = /^([A-Za-z_-]+):\s*(.*)$/.exec(text14);
+        const m = /^([A-Za-z_-]+):\s*(.*)$/.exec(text15);
         if (m === null) continue;
         sub = m[1] ?? null;
         const map = fields.maps.get(key) ?? /* @__PURE__ */ new Map();
@@ -5432,7 +5922,7 @@ function readService(body) {
         fields.maps.set(key, map);
       }
     } else if (indent === 8 && key !== null && sub !== null) {
-      const m = /^([A-Za-z_-]+):\s*(.*)$/.exec(text14);
+      const m = /^([A-Za-z_-]+):\s*(.*)$/.exec(text15);
       if (m === null) continue;
       const map = fields.maps.get(`${key}.${sub}`) ?? /* @__PURE__ */ new Map();
       map.set(m[1] ?? "", unquote(m[2] ?? ""));
@@ -5532,9 +6022,9 @@ async function fetchText(url, fetchFn) {
     return { ok: false, failure: { status: "fetch-failed", url, error } };
   }
 }
-var ReleaseSchema = z21.object({
-  tag_name: z21.string(),
-  assets: z21.array(z21.object({ name: z21.string(), browser_download_url: z21.string() }))
+var ReleaseSchema = z22.object({
+  tag_name: z22.string(),
+  assets: z22.array(z22.object({ name: z22.string(), browser_download_url: z22.string() }))
 });
 var DMG = /^CamStack-[0-9][0-9A-Za-z.-]*-(arm64|x64)\.dmg$/;
 function acceleratorEdits(accelerator, role) {
@@ -5825,15 +6315,15 @@ async function connectTool(server, deps) {
     next: session === null ? LOGIN(url) : "a session exists: the ops tools can use it"
   };
 }
-var DiscoveredAgentsSchema = z22.object({
-  agents: z22.array(
-    z22.object({
-      nodeId: z22.string(),
-      host: z22.string(),
-      port: z22.number(),
-      version: z22.string().nullable(),
-      name: z22.string().nullable(),
-      state: z22.enum(["unpaired", "pending", "paired"])
+var DiscoveredAgentsSchema = z23.object({
+  agents: z23.array(
+    z23.object({
+      nodeId: z23.string(),
+      host: z23.string(),
+      port: z23.number(),
+      version: z23.string().nullable(),
+      name: z23.string().nullable(),
+      state: z23.enum(["unpaired", "pending", "paired"])
     })
   )
 });
@@ -5880,7 +6370,7 @@ async function addNodeTool(input, ctx) {
 var SUPPORTED_HOST_KINDS = HOST_KINDS;
 var REGISTRY2 = "https://registry.npmjs.org";
 var REGISTRY_TIMEOUT_MS2 = 5e3;
-var RegistryLatestSchema = z23.object({ version: z23.string() });
+var RegistryLatestSchema = z24.object({ version: z24.string() });
 async function latestOnNpm(name, fetchFn) {
   const url = `${REGISTRY2}/${name.replace("/", "%2f")}/latest`;
   try {
@@ -5914,7 +6404,7 @@ function registerSetupTools(server, ctx, deps = {}) {
     "setup_about",
     "Versions of the camstack CLI (installed and latest on npm), the latest @camstack/server on npm, and the host kinds CamStack supports. Needs no hub and no login.",
     {},
-    async () => text12(await about(ctx))
+    async () => text11(await about(ctx))
   );
   server.tool(
     "setup_install_guide",
@@ -5924,21 +6414,21 @@ function registerSetupTools(server, ctx, deps = {}) {
       role: RoleSchema.optional(),
       accelerator: AcceleratorSchema.optional(),
       paths: InstallPathsSchema.optional(),
-      hubAddress: z23.string().min(1).optional().describe("Agents only: the hub to dial.")
+      hubAddress: z24.string().min(1).optional().describe("Agents only: the hub to dial.")
     },
-    async (input) => text12(await installGuide(input, ctx.fetch))
+    async (input) => text11(await installGuide(input, ctx.fetch))
   );
   server.tool(
     "setup_discover_hubs",
     "Find CamStack hubs on the local network (mDNS) plus the hubs this machine already knows, with host, port, name and version. Needs no login.",
-    { timeoutMs: z23.number().int().min(200).max(15e3).optional() },
-    async ({ timeoutMs }) => text12(await discoverHubsTool(timeoutMs, deps))
+    { timeoutMs: z24.number().int().min(200).max(15e3).optional() },
+    async ({ timeoutMs }) => text11(await discoverHubsTool(timeoutMs, deps))
   );
   server.tool(
     "setup_connect",
     "Check that a hub answers on https://<server>:4443/health, whether its CA is already pinned for TLS, and whether a `camstack login` session exists. Never takes a password: when there is no session it says to run `camstack login <server>` in a terminal.",
-    { server: z23.string().min(1) },
-    async ({ server: address }) => text12(await connectTool(address, deps))
+    { server: z24.string().min(1) },
+    async ({ server: address }) => text11(await connectTool(address, deps))
   );
   server.tool(
     "setup_add_node",
@@ -5947,18 +6437,749 @@ function registerSetupTools(server, ctx, deps = {}) {
       hostKind: HostKindSchema.optional(),
       accelerator: AcceleratorSchema.optional(),
       paths: InstallPathsSchema.optional(),
-      hubAddress: z23.string().min(1).optional()
+      hubAddress: z24.string().min(1).optional()
     },
-    async (input) => text12(await addNodeTool(input, ctx))
+    async (input) => text11(await addNodeTool(input, ctx))
   );
 }
 
+// src/mcp/ops-update-cli.ts
+var CLI_PACKAGE = "camstack";
+var NPM_GLOBAL = /[\\/]lib[\\/]node_modules[\\/]camstack[\\/]|[\\/]npm[\\/]node_modules[\\/]camstack[\\/]/;
+var OTHER_MANAGER = /[\\/]\.bun[\\/]|[\\/]pnpm[\\/]|[\\/]\.yarn[\\/]|[\\/]yarn[\\/]|[\\/]\.volta[\\/]/;
+function detectCliInstall(entryPath) {
+  const manual = `Update it with the package manager it was installed with, for example \`npm install -g ${CLI_PACKAGE}@latest\` (no sudo: fix the npm prefix permissions instead).`;
+  if (/[\\/]_npx[\\/]/.test(entryPath)) {
+    return {
+      method: "npx",
+      command: null,
+      instructions: `The CLI runs through npx: there is nothing installed to update. Start it as \`npx ${CLI_PACKAGE}@latest mcp\` (or clear the npx cache), then restart the MCP in your client.`
+    };
+  }
+  if (OTHER_MANAGER.test(entryPath) || !NPM_GLOBAL.test(entryPath)) {
+    return { method: "unknown", command: null, instructions: manual };
+  }
+  return {
+    method: "npm-global",
+    command: ["npm", "install", "-g", `${CLI_PACKAGE}@latest`],
+    instructions: `npm install -g ${CLI_PACKAGE}@latest`
+  };
+}
+var runCommand = (file, args) => new Promise((resolve) => {
+  execFile(file, [...args], { timeout: 5 * 6e4 }, (err, stdout, stderr) => {
+    const out = `${stdout}${stderr}`.trim().slice(-600);
+    resolve({
+      ok: err === null,
+      output: err ? `${err.message} ${out}`.trim() : out
+    });
+  });
+});
+function parts(v) {
+  return v.split("-")[0].split(".").map((n) => Number.parseInt(n, 10) || 0);
+}
+function isOlder(a, b) {
+  const x = parts(a);
+  const y = parts(b);
+  for (let i = 0; i < 3; i++) {
+    const d = (x[i] ?? 0) - (y[i] ?? 0);
+    if (d !== 0) return d < 0;
+  }
+  return false;
+}
+async function cliVerdict(installed, fetchFn, entryPath) {
+  const latest = await latestOnNpm(CLI_PACKAGE, fetchFn);
+  return {
+    installed,
+    latest: latest.latest,
+    updateAvailable: latest.latest === null ? null : isOlder(installed, latest.latest),
+    ...latest.error !== void 0 ? { error: latest.error } : {},
+    install: detectCliInstall(entryPath)
+  };
+}
+
+// src/mcp/ops-update-apply.ts
+var UPDATE_APPLY_TOOL = "ops_update_apply";
+function timing(deps) {
+  return {
+    sleep: deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))),
+    now: deps.now ?? Date.now,
+    pollMs: deps.pollMs ?? 5e3,
+    hubTimeoutMs: deps.hubTimeoutMs ?? 10 * 6e4,
+    agentTimeoutMs: deps.agentTimeoutMs ?? 10 * 6e4,
+    addonTimeoutMs: deps.addonTimeoutMs ?? 5 * 6e4
+  };
+}
+function needs(p, target, restart) {
+  return restart || p.running !== null && isOlder(p.running, target);
+}
+async function readPlan(client, args, ctx, deps) {
+  const topology = await readTopology(client);
+  if (!topology.ok) return { ok: false, problem: topology.reason };
+  const hubNode = topology.value.find((n) => n.isHub === true);
+  if (hubNode === void 0) return { ok: false, problem: "the topology lists no hub node" };
+  const hubStatus = await readNodeStatus(client, hubNode);
+  if (!hubStatus.ok) return { ok: false, problem: hubStatus.reason };
+  const target = args.version ?? hubStatus.value.latestVersion ?? null;
+  if (target === null) {
+    return {
+      ok: false,
+      problem: "the hub has no registry check yet (latestVersion is null); run a check in the admin UI Cluster page or pass `version`"
+    };
+  }
+  const restartFlags = /* @__PURE__ */ new Map();
+  const plans = [];
+  const offline = [];
+  const unreadable = [];
+  for (const node of topology.value) {
+    if (!node.isOnline) {
+      offline.push(node.id);
+      continue;
+    }
+    const status = node.isHub === true ? hubStatus : await readNodeStatus(client, node);
+    if (!status.ok) {
+      unreadable.push({ nodeId: node.id, reason: status.reason });
+      continue;
+    }
+    const v = serverVerdict(status.value);
+    restartFlags.set(node.id, v.restartRequired === true);
+    plans.push({
+      node,
+      running: v.running,
+      busy: v.updateState !== null && v.updateState !== "idle" ? v.updateState : null,
+      wrapper: wrapperVerdict(status.value)
+    });
+  }
+  const updates = args.addons === false ? null : await readQuery(client, "addons.listUpdates", {}, z25.array(AddonUpdateShape));
+  const cli = args.cli === false ? null : await cliVerdict(ctx.cliVersion, ctx.fetch, deps.entryPath ?? process.argv[1] ?? "");
+  const hub = plans.find((p) => p.node.isHub === true) ?? null;
+  return {
+    ok: true,
+    plan: {
+      target,
+      hub,
+      agents: plans.filter((p) => p.node.isHub !== true),
+      offline,
+      unreadable,
+      addons: updates !== null && updates.ok ? updates.value.filter((u) => !u.isSystem && u.category === "addon") : [],
+      cli
+    }
+  };
+}
+function serverSteps(plan, restartOf) {
+  const out = [];
+  if (plan.hub !== null && needs(plan.hub, plan.target, restartOf(plan.hub))) out.push(plan.hub);
+  for (const a of plan.agents) if (needs(a, plan.target, restartOf(a))) out.push(a);
+  return out;
+}
+async function waitUntil(t, timeoutMs, check) {
+  const deadline = t.now() + timeoutMs;
+  let last = "not checked";
+  for (; ; ) {
+    const why = await check();
+    if (why === null) return { ok: true };
+    last = why;
+    if (t.now() >= deadline)
+      return {
+        ok: false,
+        why: `timed out after ${Math.round(timeoutMs / 1e3)}s: ${last}`
+      };
+    await t.sleep(t.pollMs);
+  }
+}
+async function nodeReady(client, nodeId, isHub, target) {
+  const status = await readNodeStatus(client, { id: nodeId, isHub });
+  if (!status.ok) return `status unreadable (${status.reason})`;
+  const v = serverVerdict(status.value);
+  if (v.running !== target) return `still running ${v.running ?? "unknown"}, target ${target}`;
+  if (v.restartRequired === true) return "restart still required";
+  if (v.updateState !== "idle") return `update state ${v.updateState ?? "unknown"}`;
+  const topology = await readTopology(client);
+  if (!topology.ok) return `topology unreadable (${topology.reason})`;
+  const node = topology.value.find((n) => n.id === nodeId);
+  if (node === void 0) return "node absent from the topology";
+  if (!node.isOnline) return "node is not online yet";
+  if (capState(node).capless) return "node is online but registered no capabilities";
+  return null;
+}
+async function applyServer(client, p, target, t) {
+  const isHub = p.node.isHub === true;
+  const step = isHub ? "hub-server" : "agent-server";
+  const nodeId = p.node.id;
+  let note = "";
+  try {
+    const raw = await client.call("POST", "serverManagement.applyServerUpdate", {
+      version: target,
+      ...statusInput(p.node)
+    });
+    const parsed = ServerActionShape.safeParse(raw);
+    if (parsed.success) {
+      const r = parsed.data;
+      if (r.outcome === "refused" || r.outcome === "failed" || r.accepted === false && r.outcome !== "already-current") {
+        const blockers = (r.blockers ?? []).map((b) => `${b.addonId}: ${b.reason}`).join("; ");
+        return {
+          step,
+          nodeId,
+          status: "failed",
+          detail: `${nodeId} refused the update (${r.outcome ?? "not accepted"}): ${r.reason ?? r.error ?? r.message ?? "no reason given"}${blockers ? ` [would refuse to start: ${blockers}]` : ""}`
+        };
+      }
+      note = r.outcome ?? "";
+    }
+  } catch (err) {
+    note = `no reply (${reasonOf(err)}); expected while the node restarts`;
+  }
+  const wait = await waitUntil(
+    t,
+    isHub ? t.hubTimeoutMs : t.agentTimeoutMs,
+    () => nodeReady(client, nodeId, isHub, target)
+  );
+  if (!wait.ok) {
+    return {
+      step,
+      nodeId,
+      status: "failed",
+      detail: `${nodeId} did not reach ${target}: ${wait.why}`
+    };
+  }
+  return {
+    step,
+    nodeId,
+    status: "ok",
+    detail: `${nodeId} runs ${target}, capabilities registered${note ? ` (${note})` : ""}`
+  };
+}
+async function applyAddons(client, addons, t) {
+  const done = [];
+  for (const u of addons) {
+    try {
+      await client.call("POST", "addons.updatePackage", {
+        name: u.name,
+        version: u.latestVersion
+      });
+      done.push(u);
+    } catch (err) {
+      return [
+        {
+          step: "addons",
+          status: "failed",
+          detail: `hub failed to update ${u.name} to ${u.latestVersion}: ${reasonOf(err)}${done.length > 0 ? `; already updated: ${done.map((d) => d.name).join(", ")}` : ""}`
+        }
+      ];
+    }
+  }
+  const names = new Set(done.map((d) => d.name));
+  const wait = await waitUntil(t, t.addonTimeoutMs, async () => {
+    const inst = await readInstallations(client);
+    if (!inst.ok) return `installations unreadable (${inst.reason})`;
+    for (const u of done) {
+      const hub = inst.value.installations.find((i) => i.isHub && i.packageName === u.name);
+      if (hub === void 0 || hub.version !== u.latestVersion) {
+        return `${u.name} is ${hub?.version ?? "absent"} on the hub, expected ${u.latestVersion}`;
+      }
+    }
+    const behind = addonDrift({
+      ...inst.value,
+      installations: inst.value.installations.filter((i) => names.has(i.packageName) && i.isOnline)
+    });
+    if (behind.length > 0) {
+      return `agents behind the hub: ${behind.map((d) => `${d.nodeId}/${d.packageName}=${d.nodeVersion ?? "absent"}`).join(", ")}`;
+    }
+    return null;
+  });
+  return [
+    {
+      step: "addons",
+      status: wait.ok ? "ok" : "unverified",
+      detail: wait.ok ? `${done.length} addon(s) updated on the hub and matched on every online agent` : `${done.length} addon(s) updated on the hub; verification: ${wait.why}`
+    }
+  ];
+}
+async function applyCli(cli, run) {
+  const restart = "Restart the MCP server in your client to load the new version; a running stdio MCP cannot swap itself.";
+  if (cli.install.command === null) {
+    return {
+      step: "cli",
+      status: "instructions",
+      detail: `${cli.install.instructions} ${restart}`
+    };
+  }
+  const [file, ...rest] = cli.install.command;
+  const result = await run(file ?? "", rest);
+  if (!result.ok) {
+    return {
+      step: "cli",
+      status: "failed",
+      detail: `\`${cli.install.command.join(" ")}\` failed: ${result.output}`
+    };
+  }
+  return {
+    step: "cli",
+    status: "ok",
+    detail: `ran \`${cli.install.command.join(" ")}\` (${cli.installed} to ${cli.latest ?? "latest"}). ${restart}`
+  };
+}
+function updateApplySpec(client, ctx, deps = {}) {
+  const t = timing(deps);
+  return {
+    tool: UPDATE_APPLY_TOOL,
+    async dryRun(args) {
+      const read = await readPlan(client, args, ctx, deps);
+      if (!read.ok) return { confirmable: false, describe: { problem: read.problem } };
+      const plan = read.plan;
+      const steps = serverSteps(plan, () => false);
+      const busy = [plan.hub, ...plan.agents].filter(
+        (p) => p !== null && p.busy !== null
+      );
+      if (busy.length > 0) {
+        return {
+          confirmable: false,
+          describe: {
+            problem: `a node is mid-update: ${busy.map((p) => `${p.node.id} (${p.busy})`).join(", ")}; wait for it to settle`
+          }
+        };
+      }
+      const cliNeeded = plan.cli?.updateAvailable === true;
+      if (steps.length === 0 && plan.addons.length === 0 && !cliNeeded) {
+        return {
+          confirmable: false,
+          describe: {
+            problem: "nothing to apply: every online node runs the target, no addon update is pending and the CLI is current",
+            target: plan.target,
+            wrapperUpdates: wrapperReport(plan)
+          }
+        };
+      }
+      return {
+        confirmable: true,
+        describe: {
+          action: "update the cluster, in this order, verifying each step",
+          target: plan.target,
+          order: [
+            ...steps.map((p, i) => ({
+              order: i + 1,
+              step: p.node.isHub === true ? "hub-server" : "agent-server",
+              nodeId: p.node.id,
+              from: p.running,
+              to: plan.target
+            })),
+            ...args.addons === false ? [] : [
+              {
+                step: "addons",
+                packages: plan.addons.map(
+                  (a) => `${a.name} ${a.currentVersion} -> ${a.latestVersion}`
+                )
+              }
+            ],
+            ...cliNeeded && plan.cli ? [
+              {
+                step: "cli",
+                from: plan.cli.installed,
+                to: plan.cli.latest,
+                method: plan.cli.install.method,
+                command: plan.cli.install.command?.join(" ") ?? null,
+                instructions: plan.cli.install.command === null ? plan.cli.install.instructions : null
+              }
+            ] : []
+          ],
+          skippedOffline: plan.offline,
+          skippedUnreadable: plan.unreadable,
+          wrapperUpdates: wrapperReport(plan),
+          timeouts: {
+            hubS: t.hubTimeoutMs / 1e3,
+            agentS: t.agentTimeoutMs / 1e3,
+            addonsS: t.addonTimeoutMs / 1e3
+          },
+          notes: [
+            "The hub restarts during step 1: this connection drops for a minute or two; that is expected.",
+            "A failed step stops the chain and says which node and why; addons are not touched if a server step failed.",
+            "Wrapper (image / app) updates are NEVER performed here; the instructions are listed.",
+            ...cliNeeded ? ["The CLI update is the last step; afterwards restart the MCP in your client."] : []
+          ]
+        }
+      };
+    },
+    async execute(args) {
+      const read = await readPlan(client, args, ctx, deps);
+      if (!read.ok) return { outcome: "failed", problem: read.problem, steps: [] };
+      const plan = read.plan;
+      const results = [];
+      const ok = () => results.every((r) => r.status === "ok" || r.status === "skipped");
+      for (const p of serverSteps(plan, () => false)) {
+        if (!ok()) break;
+        results.push(await applyServer(client, p, plan.target, t));
+      }
+      const serverOk = ok();
+      if (serverOk && args.addons !== false && plan.addons.length > 0) {
+        results.push(...await applyAddons(client, plan.addons, t));
+      }
+      const clusterOk = results.every((r) => r.status === "ok");
+      if (clusterOk && plan.cli?.updateAvailable === true) {
+        results.push(await applyCli(plan.cli, deps.runCommand ?? runCommand));
+      } else if (plan.cli?.updateAvailable === true) {
+        results.push({
+          step: "cli",
+          status: "skipped",
+          detail: "not run: a cluster step did not succeed"
+        });
+      }
+      const failed = results.find((r) => r.status === "failed");
+      return {
+        outcome: failed ? "failed" : results.every((r) => r.status === "ok") ? "complete" : "partial",
+        target: plan.target,
+        steps: results,
+        ...failed ? { stoppedAt: failed.nodeId ?? failed.step, reason: failed.detail } : {},
+        skippedOffline: plan.offline,
+        wrapperUpdates: wrapperReport(plan),
+        mcpRestartNeeded: results.some(
+          (r) => r.step === "cli" && (r.status === "ok" || r.status === "instructions")
+        ),
+        next: "Run ops_update_check to confirm; nodes still offline were not touched."
+      };
+    }
+  };
+}
+function wrapperReport(plan) {
+  return [plan.hub, ...plan.agents].filter((p) => p !== null && p.wrapper.behind === true).map((p) => ({
+    nodeId: p.node.id,
+    kind: p.wrapper.kind,
+    from: p.wrapper.from,
+    to: p.wrapper.to,
+    instructions: p.wrapper.instructions
+  }));
+}
+async function opsUpdateApply(ctx, args, confirmToken, deps = {}) {
+  const outcome = await ctx.hub();
+  if (!outcome.ok) return noSessionResult(outcome);
+  if (outcome.connection.tier !== "admin") {
+    return {
+      status: "refused",
+      reason: outcome.connection.adminHint ?? "this credential is not admin-scoped"
+    };
+  }
+  return runGated3(
+    ctx.gate,
+    updateApplySpec(outcome.connection.client, ctx, deps),
+    args,
+    confirmToken
+  );
+}
+
+// src/mcp/ops-update-check.ts
+import { z as z26 } from "zod";
+var ADDON_LIMIT = 30;
+async function opsUpdateCheck(ctx, deps = {}) {
+  return withAdminHub(ctx, async ({ client, server }) => {
+    const unavailable = {};
+    const [topology, updates, installs, cli] = await Promise.all([
+      readTopology(client),
+      readQuery(client, "addons.listUpdates", {}, z26.array(AddonUpdateShape)),
+      readInstallations(client),
+      cliVerdict(ctx.cliVersion, ctx.fetch, deps.entryPath ?? process.argv[1] ?? "")
+    ]);
+    if (!topology.ok) {
+      return { status: "unavailable", reason: topology.reason, cli };
+    }
+    const drift = installs.ok ? addonDrift(installs.value) : [];
+    if (!installs.ok) unavailable["addonVersionsPerNode"] = installs.reason;
+    else if (installs.value.unreachable.length > 0) {
+      unavailable["addonVersionsPerNode"] = `no answer from ${installs.value.unreachable.map((u) => u.nodeId).join(", ")}`;
+    }
+    const nodes = await Promise.all(topology.value.map((n) => checkNode(client, n, drift)));
+    let hubAddons = null;
+    if (updates.ok) {
+      const capped = cap(updates.value, ADDON_LIMIT);
+      hubAddons = {
+        items: capped.items.map((u) => ({
+          name: u.name,
+          from: u.currentVersion,
+          to: u.latestVersion,
+          framework: u.isSystem || u.category === "core"
+        })),
+        truncated: capped.truncated
+      };
+    } else unavailable["hubAddonUpdates"] = updates.reason;
+    return {
+      status: "ok",
+      hub: server,
+      nodes,
+      hubAddons,
+      cli,
+      viewer: {
+        status: "not-exposed",
+        note: "No hub API reports the viewer version; the web viewer is served by the hub and the mobile apps update through their stores."
+      },
+      summary: {
+        serverUpdateNeeded: nodes.filter((n) => n.serverNeedsUpdate === true).map((n) => n.id),
+        wrapperUpdateNeeded: nodes.filter((n) => n.wrapper?.behind === true).map((n) => n.id),
+        offline: nodes.filter((n) => !n.online).map((n) => n.id),
+        capless: nodes.filter((n) => n.flags.length > 0).map((n) => n.id),
+        nodesWithAddonDrift: [...new Set(drift.map((d) => d.nodeId))],
+        cliUpdateNeeded: cli.updateAvailable
+      },
+      unavailable,
+      note: "Latest versions come from the hub's last registry check (`latestCheckedAt`), not a fresh one; a version just published may not show yet."
+    };
+  });
+}
+async function checkNode(client, node, drift) {
+  const caps = capState(node);
+  const base = {
+    id: node.id,
+    name: node.name ?? null,
+    isHub: node.isHub === true,
+    online: node.isOnline,
+    platform: node.platform ?? null,
+    capabilityCount: caps.count,
+    flags: caps.capless && node.isOnline ? ["online-but-capless"] : [],
+    addonsBehindHub: drift.filter((d) => d.nodeId === node.id)
+  };
+  if (!node.isOnline) {
+    return {
+      ...base,
+      server: null,
+      serverNeedsUpdate: null,
+      wrapper: null,
+      unreadable: "node is offline"
+    };
+  }
+  const status = await readNodeStatus(client, node);
+  if (!status.ok) {
+    return {
+      ...base,
+      server: null,
+      serverNeedsUpdate: null,
+      wrapper: null,
+      unreadable: status.reason
+    };
+  }
+  const server = serverVerdict(status.value);
+  return {
+    ...base,
+    server,
+    serverNeedsUpdate: needsServerUpdate(server),
+    wrapper: wrapperVerdict(status.value)
+  };
+}
+
+// src/mcp/ops-tools.ts
+var IDENTITY_CLAIMS = ["sub", "username", "name", "role"];
+function identityOf(token) {
+  const claims = jwtClaims(token);
+  const out = {};
+  if (claims === null) return out;
+  for (const key of IDENTITY_CLAIMS) {
+    const value = claims[key];
+    if (typeof value === "string" && value !== "") out[key] = value;
+  }
+  return out;
+}
+async function whoami(ctx) {
+  const outcome = await ctx.hub();
+  if (!outcome.ok) return noSessionResult(outcome);
+  const c = outcome.connection;
+  return {
+    status: "ok",
+    hub: c.server,
+    tier: c.tier,
+    source: c.source,
+    identity: identityOf(c.token)
+  };
+}
+function registerOpsTools(server, ctx) {
+  server.tool(
+    "ops_whoami",
+    "Which hub this MCP talks to and as whom, from the `camstack login` session (no network call). If there is no session, says to run `camstack login <host>` in a terminal.",
+    {},
+    async () => text12(await whoami(ctx))
+  );
+  server.tool(
+    "ops_status",
+    'Cluster summary: every node (online, platform, server version, capability count, "online-but-capless" flag), the active alerts and the addons with an update. A part the hub did not answer is null with its reason in `unavailable`, never zero. Node list and updates need an admin `camstack login`.',
+    {},
+    async () => text12(await opsStatus(ctx))
+  );
+  server.tool(
+    "ops_device",
+    "One device: online state, provider addon and node, bound capabilities, runtime-state age and, for a camera, its pipeline, recording state, the functions an operator switched off (not faults) and its latest object events.",
+    { deviceId: z27.number().int() },
+    async ({ deviceId }) => text12(await opsDevice(ctx, deviceId))
+  );
+  server.tool(
+    "ops_unhealthy_devices",
+    "Every enabled device that is unhealthy, each with a typed reason (offline, detection-provisioning-failed, detection-not-assigned, recording-inactive). A function an operator switched off is never listed; a camera whose status could not be fully read is listed under `unknown`.",
+    {},
+    async () => text12(await opsUnhealthyDevices(ctx))
+  );
+  server.tool(
+    "ops_logs",
+    "Hub logs scoped by deviceId, addon, node, level, window and free text, grouped and deduplicated with counts. Says which tier answered (ring = recent in-RAM; persisted = the default log destination). With `around` (a track or event id) returns `contextLines` lines on each side of its first mention. Needs an admin `camstack login`.",
+    {
+      deviceId: z27.number().int().optional(),
+      addonId: z27.string().optional(),
+      nodeId: z27.string().optional(),
+      level: z27.enum(["debug", "info", "warn", "error"]).optional(),
+      windowMinutes: z27.number().int().min(1).max(1440).optional(),
+      text: z27.string().max(200).optional(),
+      around: z27.string().max(200).optional(),
+      contextLines: z27.number().int().min(1).max(50).optional()
+    },
+    async (args) => text12(
+      await opsLogs(ctx, {
+        ...args.deviceId !== void 0 ? { deviceId: args.deviceId } : {},
+        ...args.addonId ? { addonId: args.addonId } : {},
+        ...args.nodeId ? { nodeId: args.nodeId } : {},
+        ...args.level ? { level: args.level } : {},
+        ...args.windowMinutes !== void 0 ? { windowMinutes: args.windowMinutes } : {},
+        ...args.text ? { text: args.text } : {},
+        ...args.around ? { around: args.around } : {},
+        ...args.contextLines !== void 0 ? { contextLines: args.contextLines } : {}
+      })
+    )
+  );
+  server.tool(
+    "ops_events",
+    "Find tracks (and, for one camera, object events) by camera, class, zone, time window and free text. Each result carries an admin-UI link and a viewer link built on the hub address flagged for app connections.",
+    {
+      deviceId: z27.number().int().optional(),
+      className: z27.string().optional(),
+      zone: z27.string().optional(),
+      text: z27.string().max(200).optional(),
+      windowMinutes: z27.number().int().min(1).max(10080).optional(),
+      limit: z27.number().int().min(1).max(50).optional()
+    },
+    async (args) => text12(
+      await opsEvents(ctx, {
+        ...args.deviceId !== void 0 ? { deviceId: args.deviceId } : {},
+        ...args.className ? { className: args.className } : {},
+        ...args.zone ? { zone: args.zone } : {},
+        ...args.text ? { text: args.text } : {},
+        ...args.windowMinutes !== void 0 ? { windowMinutes: args.windowMinutes } : {},
+        ...args.limit !== void 0 ? { limit: args.limit } : {}
+      })
+    )
+  );
+  server.tool(
+    "ops_track",
+    "One track with its media audit: best shot, keyframes, every missing media kind with the reason the track recorded for it, and the audit findings. Links to the admin UI and the viewer.",
+    { deviceId: z27.number().int(), trackId: z27.string().min(1) },
+    async ({ deviceId, trackId }) => text12(await opsTrack(ctx, { deviceId, trackId }))
+  );
+  server.tool(
+    "ops_accelerators",
+    'Per node: the inference devices it has, the Auto-tune hardware class the node maps to, and whether the measured detector-latency table has a row for that class and accelerator. A node that could not be read is null with a reason, never "no accelerator". Needs an admin `camstack login`.',
+    {},
+    async () => text12(await opsAccelerators(ctx))
+  );
+  server.tool(
+    "ops_update_check",
+    'Read-only update report for the whole cluster. Every node from the topology: running vs installed vs latest @camstack/server, restartRequired / updateState / rolledBack, the wrapper (Docker image / desktop app) verdict, and whether its addon versions match the hub; the hub\'s addon updates; the viewer (not exposed by any API, said so); and this CLI/MCP against npm. A node that cannot be read is null with a reason, never "up to date". Needs an admin `camstack login`.',
+    {},
+    async () => text12(await opsUpdateCheck(ctx))
+  );
+  server.tool(
+    UPDATE_APPLY_TOOL,
+    "Bring the cluster up to date, verified step by step: hub server closure, wait until the hub runs it, then each online agent, then addons (agents follow by reconciliation, verified), then this CLI last. Two steps: call without confirm_token for a preview (order, versions, wrapper instructions, timeouts) and a one-shot token, then again with the SAME arguments and that token. A failed step stops the chain and names the node. Wrapper (image/app) updates are only reported with instructions. Needs an admin `camstack login`.",
+    {
+      version: z27.string().min(1).optional().describe("Server target; default = the hub's latest."),
+      addons: z27.boolean().optional().describe("Update addons too (default true)."),
+      cli: z27.boolean().optional().describe("Update this CLI last (default true)."),
+      confirm_token: z27.string().optional()
+    },
+    async ({ version, addons, cli, confirm_token }) => text12(
+      await opsUpdateApply(
+        ctx,
+        {
+          ...version !== void 0 ? { version } : {},
+          ...addons !== void 0 ? { addons } : {},
+          ...cli !== void 0 ? { cli } : {}
+        },
+        confirm_token
+      )
+    )
+  );
+}
+
+// src/mcp/configure-tools.ts
+var CurrentDeviceSchema = z28.object({ name: z28.string() }).nullable();
+var RENAME_DEVICE_TOOL = "configure_rename_device";
+function renameDeviceSpec(client) {
+  return {
+    tool: RENAME_DEVICE_TOOL,
+    async dryRun(args) {
+      const current = CurrentDeviceSchema.safeParse(
+        await client.call("GET", "deviceManager.getDevice", {
+          deviceId: args.deviceId
+        })
+      );
+      if (!current.success || current.data === null) {
+        return {
+          confirmable: false,
+          describe: {
+            problem: `device ${args.deviceId} was not found on the hub`
+          }
+        };
+      }
+      if (current.data.name === args.name) {
+        return {
+          confirmable: false,
+          describe: {
+            problem: `device ${args.deviceId} is already named "${args.name}"`
+          }
+        };
+      }
+      return {
+        confirmable: true,
+        describe: {
+          action: "rename device",
+          deviceId: args.deviceId,
+          from: current.data.name,
+          to: args.name
+        }
+      };
+    },
+    async execute(args) {
+      await client.call("POST", "deviceManager.setName", {
+        deviceId: args.deviceId,
+        name: args.name
+      });
+      return { deviceId: args.deviceId, name: args.name };
+    }
+  };
+}
+async function renameDevice(ctx, args, confirmToken) {
+  const outcome = await ctx.hub();
+  if (!outcome.ok) return noSessionResult(outcome);
+  if (outcome.connection.tier !== "admin") {
+    return {
+      status: "refused",
+      reason: outcome.connection.adminHint ?? "this credential is not admin-scoped"
+    };
+  }
+  return runGated4(ctx.gate, renameDeviceSpec(outcome.connection.client), args, confirmToken);
+}
+function registerConfigureTools(server, ctx) {
+  server.tool(
+    RENAME_DEVICE_TOOL,
+    "Rename a device. Two steps: call without confirm_token for a preview and a one-shot token, then call again with the SAME arguments and that token to apply. Needs an admin `camstack login` session.",
+    {
+      deviceId: z28.number().int(),
+      name: z28.string().min(1),
+      confirm_token: z28.string().optional()
+    },
+    async ({ deviceId, name, confirm_token }) => text13(await renameDevice(ctx, { deviceId, name }, confirm_token))
+  );
+  registerAddonTools(server, ctx);
+  registerCameraTools(server, ctx);
+  registerNotifierTools(server, ctx);
+  registerConfigureP3bTools(server, ctx);
+}
+
 // src/mcp/support-tools.ts
-import { text as text13 } from "@camstack/develop";
-import { z as z28 } from "zod";
+import { text as text14 } from "@camstack/develop";
+import { z as z33 } from "zod";
 
 // src/mcp/support-accelerator.ts
-import { z as z24 } from "zod";
+import { z as z29 } from "zod";
 var EXPECTED_ACCELERATORS = [
   "intel-igpu",
   "intel-npu",
@@ -5970,23 +7191,23 @@ var EXPECTED_ACCELERATORS = [
   "apple-ane",
   "nvidia"
 ];
-var ExpectedAcceleratorSchema = z24.enum(EXPECTED_ACCELERATORS);
-var HardwareSchema2 = z24.looseObject({
-  platform: z24.enum(["darwin", "linux", "win32"]),
-  arch: z24.enum(["arm64", "x64"]),
-  cpuModel: z24.string(),
-  gpu: z24.looseObject({ type: z24.string(), name: z24.string() }).nullable(),
-  npu: z24.looseObject({ type: z24.string() }).nullable()
+var ExpectedAcceleratorSchema = z29.enum(EXPECTED_ACCELERATORS);
+var HardwareSchema2 = z29.looseObject({
+  platform: z29.enum(["darwin", "linux", "win32"]),
+  arch: z29.enum(["arm64", "x64"]),
+  cpuModel: z29.string(),
+  gpu: z29.looseObject({ type: z29.string(), name: z29.string() }).nullable(),
+  npu: z29.looseObject({ type: z29.string() }).nullable()
 });
-var InferenceDevicesSchema2 = z24.looseObject({
-  reachable: z24.boolean(),
-  devices: z24.array(
-    z24.looseObject({
-      key: z24.string(),
-      available: z24.boolean(),
-      presence: z24.enum(["present", "absent", "unknown"]).optional(),
-      enabled: z24.boolean(),
-      exclusion: z24.string().nullable()
+var InferenceDevicesSchema2 = z29.looseObject({
+  reachable: z29.boolean(),
+  devices: z29.array(
+    z29.looseObject({
+      key: z29.string(),
+      available: z29.boolean(),
+      presence: z29.enum(["present", "absent", "unknown"]).optional(),
+      enabled: z29.boolean(),
+      exclusion: z29.string().nullable()
     })
   )
 });
@@ -6263,9 +7484,9 @@ async function supportDiagnoseAccelerator(ctx, args) {
 
 // src/mcp/support-benchmark.ts
 import {
-  runGated as runGated4
+  runGated as runGated5
 } from "@camstack/develop";
-import { z as z25 } from "zod";
+import { z as z30 } from "zod";
 var BENCHMARK_RUN_TOOL = "support_benchmark_run";
 var AUTO_TUNE_MODELS = [
   "yolov9t-320",
@@ -6287,64 +7508,64 @@ var CONTRIBUTE_HOW = [
   "The measured medians belong in the Auto-tune latency table: docs/benchmarks/detector-latency.json and packages/types/src/pipeline/auto-tune/detector-performance.ts, changed together (detector-performance.spec.ts fails until they agree), in the camstack/server repository.",
   'Use support_draft_pr with kind "benchmark", the column ("<hardwareClass>/<accelerator>") and these cells to get the branch plan and the `gh pr create` command.'
 ];
-var HardwareSchema3 = z25.looseObject({
-  platform: z25.enum(["darwin", "linux", "win32"]),
-  arch: z25.enum(["arm64", "x64"]),
-  cpuModel: z25.string(),
-  cpuCores: z25.number(),
-  totalRAM_MB: z25.number(),
-  availableRAM_MB: z25.number(),
-  gpu: z25.looseObject({
-    type: z25.enum(["nvidia", "amd", "intel", "apple"]),
-    name: z25.string()
+var HardwareSchema3 = z30.looseObject({
+  platform: z30.enum(["darwin", "linux", "win32"]),
+  arch: z30.enum(["arm64", "x64"]),
+  cpuModel: z30.string(),
+  cpuCores: z30.number(),
+  totalRAM_MB: z30.number(),
+  availableRAM_MB: z30.number(),
+  gpu: z30.looseObject({
+    type: z30.enum(["nvidia", "amd", "intel", "apple"]),
+    name: z30.string()
   }).nullable(),
-  npu: z25.looseObject({ type: z25.enum(["apple-ane", "intel-npu", "amd-xdna"]) }).nullable()
+  npu: z30.looseObject({ type: z30.enum(["apple-ane", "intel-npu", "amd-xdna"]) }).nullable()
 });
-var InferenceDevicesSchema3 = z25.looseObject({
-  reachable: z25.boolean(),
-  devices: z25.array(
-    z25.looseObject({
-      key: z25.string(),
-      backend: z25.string(),
-      available: z25.boolean(),
-      enabled: z25.boolean()
+var InferenceDevicesSchema3 = z30.looseObject({
+  reachable: z30.boolean(),
+  devices: z30.array(
+    z30.looseObject({
+      key: z30.string(),
+      backend: z30.string(),
+      available: z30.boolean(),
+      enabled: z30.boolean()
     })
   )
 });
-var RunStatusSchema = z25.looseObject({
-  run: z25.looseObject({
-    runId: z25.string(),
-    nodeId: z25.string(),
-    state: z25.string(),
-    endReason: z25.string().nullable().optional(),
-    error: z25.string().nullable().optional()
+var RunStatusSchema = z30.looseObject({
+  run: z30.looseObject({
+    runId: z30.string(),
+    nodeId: z30.string(),
+    state: z30.string(),
+    endReason: z30.string().nullable().optional(),
+    error: z30.string().nullable().optional()
   }).nullable()
 });
-var ModelListSchema = z25.array(
-  z25.looseObject({
-    id: z25.string(),
-    formats: z25.record(z25.string(), z25.looseObject({ downloaded: z25.boolean().optional() })).optional()
+var ModelListSchema = z30.array(
+  z30.looseObject({
+    id: z30.string(),
+    formats: z30.record(z30.string(), z30.looseObject({ downloaded: z30.boolean().optional() })).optional()
   })
 );
-var PipelineTestSchema = z25.looseObject({
-  kind: z25.string().optional(),
-  detections: z25.array(
-    z25.looseObject({
-      debug: z25.looseObject({
-        stepLatencyMs: z25.record(z25.string(), z25.number()).optional()
+var PipelineTestSchema = z30.looseObject({
+  kind: z30.string().optional(),
+  detections: z30.array(
+    z30.looseObject({
+      debug: z30.looseObject({
+        stepLatencyMs: z30.record(z30.string(), z30.number()).optional()
       }).optional()
     })
   ).optional(),
-  discarded: z25.array(z25.unknown()).optional(),
-  debug: z25.looseObject({
-    stepTimings: z25.array(
-      z25.looseObject({
-        source: z25.string().optional(),
-        ms: z25.number().optional()
+  discarded: z30.array(z30.unknown()).optional(),
+  debug: z30.looseObject({
+    stepTimings: z30.array(
+      z30.looseObject({
+        source: z30.string().optional(),
+        ms: z30.number().optional()
       })
     ).optional(),
-    predictMs: z25.number().optional(),
-    totalInferenceMs: z25.number().optional()
+    predictMs: z30.number().optional(),
+    totalInferenceMs: z30.number().optional()
   }).optional()
 });
 var FORMAT_BY_BACKEND = {
@@ -6371,10 +7592,10 @@ function inferMsOf(raw) {
   if (!parsed.success) return { inferMs: null, shed: false };
   const r = parsed.data;
   const fromDetection = r.detections?.[0]?.debug?.stepLatencyMs?.[DETECTOR_STEP];
-  const timing = r.debug?.stepTimings?.find(
+  const timing2 = r.debug?.stepTimings?.find(
     (t) => t.source === DETECTOR_STEP && typeof t.ms === "number"
   );
-  const candidates = [fromDetection, timing?.ms, r.debug?.predictMs, r.debug?.totalInferenceMs];
+  const candidates = [fromDetection, timing2?.ms, r.debug?.predictMs, r.debug?.totalInferenceMs];
   const inferMs = candidates.find((c) => typeof c === "number" && c > 0) ?? null;
   const shedReason = (r.discarded ?? []).some(
     (d) => /deadline|shed/i.test(String(JSON.stringify(d)))
@@ -6629,17 +7850,17 @@ async function supportBenchmarkRun(ctx, deps, args, confirmToken) {
       reason: outcome.connection.adminHint ?? "this credential is not admin-scoped"
     };
   }
-  return runGated4(ctx.gate, benchmarkRunSpec(outcome.connection.client, deps), args, confirmToken);
-}
-var ResultsSchema = z25.array(
-  z25.looseObject({
-    nodeId: z25.string(),
-    cell: z25.looseObject({
-      phase: z25.string(),
-      deviceKey: z25.string(),
-      modelId: z25.string(),
-      p50Ms: z25.number().optional(),
-      fps: z25.number().optional()
+  return runGated5(ctx.gate, benchmarkRunSpec(outcome.connection.client, deps), args, confirmToken);
+}
+var ResultsSchema = z30.array(
+  z30.looseObject({
+    nodeId: z30.string(),
+    cell: z30.looseObject({
+      phase: z30.string(),
+      deviceKey: z30.string(),
+      modelId: z30.string(),
+      p50Ms: z30.number().optional(),
+      fps: z30.number().optional()
     })
   })
 );
@@ -6692,20 +7913,20 @@ async function supportBenchmarkStatus(ctx, args) {
 }
 
 // src/mcp/support-camera.ts
-import { z as z26 } from "zod";
-var DeviceSchema2 = z26.looseObject({
-  id: z26.number(),
-  name: z26.string(),
-  addonId: z26.string().optional(),
-  disabled: z26.boolean().optional(),
-  online: z26.boolean().optional()
+import { z as z31 } from "zod";
+var DeviceSchema2 = z31.looseObject({
+  id: z31.number(),
+  name: z31.string(),
+  addonId: z31.string().optional(),
+  disabled: z31.boolean().optional(),
+  online: z31.boolean().optional()
 }).nullable();
 var GENERIC = /onvif|rtsp/i;
-function words(text14) {
-  return text14.toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length >= 3);
+function words(text15) {
+  return text15.toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length >= 3);
 }
-function isGeneric(parts) {
-  return parts.some((p) => GENERIC.test(p));
+function isGeneric(parts2) {
+  return parts2.some((p) => GENERIC.test(p));
 }
 function installedPick(p) {
   return {
@@ -6726,9 +7947,9 @@ function availablePick(p) {
 var MATCHING_NOTE = "A provider manifest declares no brand or model list: matching is on provider name, description and keywords, so a brand that is supported under another name can be missed.";
 function matchIn(pools, tokens) {
   if (tokens.length === 0) return null;
-  const hit = (parts) => {
-    if (isGeneric(parts)) return false;
-    const joined = parts.join(" ").toLowerCase();
+  const hit = (parts2) => {
+    if (isGeneric(parts2)) return false;
+    const joined = parts2.join(" ").toLowerCase();
     return tokens.some((t) => joined.includes(t));
   };
   const installed = pools.installed.find(
@@ -6864,10 +8085,10 @@ async function supportDiagnoseCamera(ctx, args) {
 }
 
 // src/mcp/support-deps.ts
-import { execFile } from "child_process";
+import { execFile as execFile2 } from "child_process";
 var RUN_TIMEOUT_MS = 6e4;
 var spawnRunner = (command, args) => new Promise((resolve) => {
-  execFile(
+  execFile2(
     command,
     [...args],
     { timeout: RUN_TIMEOUT_MS, maxBuffer: 1e6 },
@@ -6897,9 +8118,9 @@ import { tmpdir } from "os";
 import { join } from "path";
 import {
   digestArgs,
-  runGated as runGated5
+  runGated as runGated6
 } from "@camstack/develop";
-import { z as z27 } from "zod";
+import { z as z32 } from "zod";
 
 // src/mcp/support-scrub.ts
 import { redactToolArgs, scrubSecrets } from "@camstack/develop";
@@ -6908,10 +8129,10 @@ var IPV6 = /\b(?:[0-9a-fA-F]{1,4}:){4,7}[0-9a-fA-F]{1,4}(?![\w:])|\b[0-9a-fA-F]{
 var MAC = /\b(?:[0-9a-fA-F]{2}[:-]){5}[0-9a-fA-F]{2}\b/g;
 var HOME_DIR = /(\/Users|\/home)\/[^/\s'"]+/g;
 function octets(ip) {
-  const parts = ip.split(".").map((p) => Number(p));
-  if (parts.length !== 4) return null;
-  if (parts.some((p) => !Number.isInteger(p) || p < 0 || p > 255)) return null;
-  return parts;
+  const parts2 = ip.split(".").map((p) => Number(p));
+  if (parts2.length !== 4) return null;
+  if (parts2.some((p) => !Number.isInteger(p) || p < 0 || p > 255)) return null;
+  return parts2;
 }
 function maskIpv4(ip) {
   const o = octets(ip);
@@ -6952,16 +8173,16 @@ var INFERENCE_PACKAGE = "@camstack/addon-pipeline";
 var TITLE_MAX = 140;
 var DIAGNOSIS_MAX = 4e3;
 var DRAFT_KINDS = ["accelerator", "camera", "benchmark", "other"];
-var DraftKindSchema = z27.enum(DRAFT_KINDS);
-var BenchmarkCellsSchema = z27.record(
-  z27.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/),
-  z27.object({ p50Ms: z27.number().positive(), fps: z27.number().positive() })
+var DraftKindSchema = z32.enum(DRAFT_KINDS);
+var BenchmarkCellsSchema = z32.record(
+  z32.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/),
+  z32.object({ p50Ms: z32.number().positive(), fps: z32.number().positive() })
 );
 var PackageNameRe = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
 var GithubRepoRe = /github\.com[:/]([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?(?:[/#?].*)?$/;
 var ShorthandRe = /^(?:github:)?([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/;
-var RegistryDocSchema = z27.looseObject({
-  repository: z27.union([z27.string(), z27.looseObject({ url: z27.string() })]).optional()
+var RegistryDocSchema = z32.looseObject({
+  repository: z32.union([z32.string(), z32.looseObject({ url: z32.string() })]).optional()
 });
 function githubRepoOf(value) {
   const url = GithubRepoRe.exec(value);
@@ -7003,7 +8224,7 @@ async function resolveRepo(ctx, packageName) {
     reason: null
   };
 }
-var ServerStatusSchema2 = z27.looseObject({ runningVersion: z27.string() });
+var ServerStatusSchema2 = z32.looseObject({ runningVersion: z32.string() });
 async function serverVersion(client, nodeId) {
   const status = await readQuery(
     client,
@@ -7205,8 +8426,8 @@ var BENCHMARK_FILES = [
   "docs/benchmarks/detector-latency.json",
   "packages/types/src/pipeline/auto-tune/detector-performance.ts"
 ];
-function slug(text14) {
-  const s = text14.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
+function slug(text15) {
+  const s = text15.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
   return s === "" ? "change" : s;
 }
 function prProblem(args) {
@@ -7262,27 +8483,27 @@ function prSpec(ctx) {
   };
 }
 async function supportDraftIssue(ctx, deps, args, confirmToken) {
-  return runGated5(ctx.gate, issueSpec({ ctx, deps }), args, confirmToken);
+  return runGated6(ctx.gate, issueSpec({ ctx, deps }), args, confirmToken);
 }
 async function supportDraftPr(ctx, args, confirmToken) {
-  return runGated5(ctx.gate, prSpec(ctx), args, confirmToken);
+  return runGated6(ctx.gate, prSpec(ctx), args, confirmToken);
 }
 
 // src/mcp/support-tools.ts
-var ModelId = z28.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/);
+var ModelId = z33.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/);
 var DraftShape = {
   kind: DraftKindSchema,
-  title: z28.string().min(3).max(300),
-  summary: z28.string().min(3).max(4e3),
-  nodeId: z28.string().max(100).optional(),
+  title: z33.string().min(3).max(300),
+  summary: z33.string().min(3).max(4e3),
+  nodeId: z33.string().max(100).optional(),
   expected: ExpectedAcceleratorSchema.optional(),
-  brand: z28.string().max(100).optional(),
-  model: z28.string().max(100).optional(),
-  deviceId: z28.number().int().optional(),
-  packageName: z28.string().max(214).optional(),
-  column: z28.string().max(100).optional(),
+  brand: z33.string().max(100).optional(),
+  model: z33.string().max(100).optional(),
+  deviceId: z33.number().int().optional(),
+  packageName: z33.string().max(214).optional(),
+  column: z33.string().max(100).optional(),
   cells: BenchmarkCellsSchema.optional(),
-  confirm_token: z28.string().optional()
+  confirm_token: z33.string().optional()
 };
 function draftArgs(input) {
   return {
@@ -7303,20 +8524,20 @@ function registerSupportTools(server, ctx, deps = defaultSupportDeps) {
   server.tool(
     "support_benchmark_status",
     "The hub's own node-benchmark state: the active or last run and the per-device latency cells it stored. Read-only. The Auto-tune latency table is filled with support_benchmark_run. Needs an admin `camstack login`.",
-    { nodeId: z28.string().max(100).optional() },
-    async ({ nodeId }) => text13(await supportBenchmarkStatus(ctx, nodeId !== void 0 ? { nodeId } : {}))
+    { nodeId: z33.string().max(100).optional() },
+    async ({ nodeId }) => text14(await supportBenchmarkStatus(ctx, nodeId !== void 0 ? { nodeId } : {}))
   );
   server.tool(
     BENCHMARK_RUN_TOOL,
     "Measure detector latency on a node x device (cold run, then warm median per model, via runPipelineTest) and return it next to the Auto-tune table cell for the same hardware, plus how to contribute it. LOADS THE NODE: the detection pool restarts between models. Pick the node and deviceKey from ops_accelerators. Two steps: call without confirm_token for the plan and a one-shot token, then again with the SAME arguments and that token. Needs an admin `camstack login`.",
     {
-      nodeId: z28.string().min(1).max(100),
-      deviceKey: z28.string().min(1).max(60),
-      models: z28.array(ModelId).min(1).max(MAX_MODELS).optional(),
-      warmRuns: z28.number().int().min(1).max(MAX_WARM_RUNS).optional(),
-      confirm_token: z28.string().optional()
+      nodeId: z33.string().min(1).max(100),
+      deviceKey: z33.string().min(1).max(60),
+      models: z33.array(ModelId).min(1).max(MAX_MODELS).optional(),
+      warmRuns: z33.number().int().min(1).max(MAX_WARM_RUNS).optional(),
+      confirm_token: z33.string().optional()
     },
-    async ({ nodeId, deviceKey, models, warmRuns, confirm_token }) => text13(
+    async ({ nodeId, deviceKey, models, warmRuns, confirm_token }) => text14(
       await supportBenchmarkRun(
         ctx,
         deps,
@@ -7333,18 +8554,18 @@ function registerSupportTools(server, ctx, deps = defaultSupportDeps) {
   server.tool(
     "support_diagnose_accelerator",
     "A node should have an accelerator (Intel iGPU/NPU, AMD WebGPU/VAAPI/NPU, Coral USB/PCIe, Apple Neural Engine, NVIDIA) and the hub does not offer it. Reads what the platform probe saw and what the node's inference runtime offers, and answers ok | misconfigured (with fix steps: passthrough, driver, image tag, opt-in) | unsupported (which addon would need extending) | unknown (a read failed). A Coral is never auto-picked: the answer says how to opt in. Read-only.",
-    { nodeId: z28.string().min(1).max(100), expected: ExpectedAcceleratorSchema },
-    async ({ nodeId, expected }) => text13(await supportDiagnoseAccelerator(ctx, { nodeId, expected }))
+    { nodeId: z33.string().min(1).max(100), expected: ExpectedAcceleratorSchema },
+    async ({ nodeId, expected }) => text14(await supportDiagnoseAccelerator(ctx, { nodeId, expected }))
   );
   server.tool(
     "support_diagnose_camera",
     "A camera brand or model, or an existing device that fails: which provider addons could serve it (installed, then published), and a verdict use-provider | generic-fallback (ONVIF / RTSP) | unsupported | unknown, with the next steps. Give a brand and/or model, or a deviceId. Read-only.",
     {
-      brand: z28.string().max(100).optional(),
-      model: z28.string().max(100).optional(),
-      deviceId: z28.number().int().optional()
+      brand: z33.string().max(100).optional(),
+      model: z33.string().max(100).optional(),
+      deviceId: z33.number().int().optional()
     },
-    async ({ brand, model, deviceId }) => text13(
+    async ({ brand, model, deviceId }) => text14(
       await supportDiagnoseCamera(ctx, {
         ...brand !== void 0 ? { brand } : {},
         ...model !== void 0 ? { model } : {},
@@ -7356,13 +8577,13 @@ function registerSupportTools(server, ctx, deps = defaultSupportDeps) {
     DRAFT_ISSUE_TOOL,
     "Draft a GitHub issue for the public repository that owns the addon (the package's `repository` field; camstack/server when it names none): title, an environment block (server and CLI version, node platform, accelerator or camera facts from the diagnose tools), secrets and private addresses removed. Two steps: the dry run is the full draft and the target; the confirmed call runs YOUR own `gh issue create` (only if `gh auth status` succeeds, otherwise it returns the draft and a ready command). Never uses a token of ours.",
     DraftShape,
-    async (input) => text13(await supportDraftIssue(ctx, deps, draftArgs(input), input.confirm_token))
+    async (input) => text14(await supportDraftIssue(ctx, deps, draftArgs(input), input.confirm_token))
   );
   server.tool(
     DRAFT_PR_TOOL,
     'Plan a pull request for the public repository that owns the addon: branch, files to change, steps and the `gh pr create` command, with a scrubbed body. For kind "benchmark" give column and cells from support_benchmark_run. Two steps like every gated tool; it pushes no code and calls no GitHub API, you run the plan with your own git and gh.',
     DraftShape,
-    async (input) => text13(await supportDraftPr(ctx, draftArgs(input), input.confirm_token))
+    async (input) => text14(await supportDraftPr(ctx, draftArgs(input), input.confirm_token))
   );
 }