camstack 1.2.212 → 1.2.213

package/dist/{server-2GOCBDEY.js → server-EFXGQ7FD.js}

@@ -11,13 +11,15 @@ import {
   buildViewerLink,
   capUnitResolver,
   classifyInferenceHardware,
+  convertLegacyWhen,
+  countWhenLeaves,
   findHubs,
   generateAutomationBlock,
   isReadingQuantity,
   prepareRecipeUnits,
   unitsForQuantity,
   validateRecipeBounds
-} from "./chunk-MLWXP2SI.js";
+} from "./chunk-MJJWVAEM.js";
 import "./chunk-LMMQX4CK.js";
 
 // src/mcp/server.ts
@@ -28,9 +30,9 @@ import { MutationGate, tryConnectHub } from "@camstack/develop";
 // src/mcp/configure-tools.ts
 import {
   runGated as runGated4,
-  text as text12
+  text as text13
 } from "@camstack/develop";
-import { z as z26 } from "zod";
+import { z as z28 } from "zod";
 
 // src/mcp/configure-automations.ts
 import { z as z4 } from "zod";
@@ -987,7 +989,7 @@ function toActions(actions) {
 function quantityNotes(recipe) {
   const notes = [];
   const walk = (c, path) => {
-    if (c.kind === "condition" && typeof c.value === "number" && c.unit !== void 0) {
+    if (c.kind === "device-is" && typeof c.value === "number" && c.unit !== void 0) {
       notes.push({
         where: `${path} ${c.cap}.${c.fieldPath}`,
         value: c.value,
@@ -997,7 +999,7 @@ function quantityNotes(recipe) {
     if (c.kind === "not") walk(c.child, path);
     if (c.kind === "all" || c.kind === "any") c.children.forEach((child) => walk(child, path));
   };
-  if (recipe.conditions !== void 0) walk(recipe.conditions, "condition");
+  walk(recipe.when, "condition");
   recipe.actions.forEach((a, i) => {
     if (a.kind !== "cap" || a.args === void 0 || a.argUnits === void 0) return;
     for (const [arg, unit] of Object.entries(a.argUnits)) {
@@ -1085,8 +1087,7 @@ async function interviewAutomation(client, answers) {
   const conditions = answers.conditions ?? [];
   const actions = answers.actions ?? [];
   const draft = {
-    triggers: [outcome.trigger],
-    ...toCondition(conditions) !== void 0 ? { conditions: toCondition(conditions) } : {},
+    when: convertLegacyWhen({ triggers: [outcome.trigger], conditions: toCondition(conditions) }),
     actions: toActions(actions),
     ...answers.cooldownMinutes !== void 0 ? {
       runMode: {
@@ -1184,7 +1185,7 @@ function saveAutomationSpec(client) {
           runsOn: "the hub",
           enabled: args.enabled,
           effect: args.enabled ? "it starts running as soon as it is saved" : "it is saved switched off",
-          triggers: finished.recipe.triggers.length,
+          rows: countWhenLeaves(finished.recipe.when),
           steps: finished.recipe.actions.length,
           quantities: quantityNotes(finished.recipe),
           generatedBytes: code.length
@@ -1217,7 +1218,7 @@ var GATE_HOW = "Two steps: call without confirm_token for a preview and a one-sh
 function registerAutomationTools(server, ctx) {
   server.tool(
     "configure_automation_questionnaire",
-    "Interview for a new automation (a recipe: trigger, conditions, actions). Stateless: send every answer so far in `answers`; it returns the questions still open, with choices read from the hub, or `ready` with a summary and the recipe. A number on a quantity field is { value, unit }. Writes nothing.",
+    "Interview for a new automation (a recipe: ONE `when` tree \u2014 events that start it, states that must hold \u2014 and the actions). Stateless: send every answer so far in `answers`; it returns the questions still open, with choices read from the hub, or `ready` with a summary and the recipe. A number on a quantity field is { value, unit }. Writes nothing.",
     { answers: AutomationAnswersSchema },
     async ({ answers }) => text(await automationQuestionnaire(ctx, answers))
   );
@@ -2345,33 +2346,527 @@ function registerExportTools(server, ctx) {
   );
 }
 
-// src/mcp/configure-nc-rules.ts
-import { z as z9 } from "zod";
+// src/mcp/configure-oidc.ts
 import { text as text6 } from "@camstack/develop";
+import { z as z10 } from "zod";
+
+// src/mcp/configure-oidc-providers.ts
+import { z as z9 } from "zod";
+var OidcProviderSchema = z9.enum([
+  "authentik",
+  "pocket-id",
+  "authelia",
+  "keycloak",
+  "zitadel",
+  "kanidm",
+  "google",
+  "microsoft-entra",
+  "auth0",
+  "okta",
+  "generic"
+]);
+var PIECE_QUESTION = {
+  host: "host: the provider host name, with or without https:// (no path)",
+  application_slug: "application_slug: the application slug (authentik) or client name (kanidm)",
+  realm: "realm: the Keycloak realm name",
+  tenant_id: "tenant_id: the Entra directory (tenant) id, a GUID or a verified domain"
+};
+function pieceQuestion(piece) {
+  return PIECE_QUESTION[piece];
+}
+function hostOrigin(host) {
+  const trimmed = host.trim().replace(/\/+$/, "");
+  return /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+}
+var COMMON_STEPS = [
+  "Create the client as an OpenID Connect / OAuth2 web application, authorization-code flow.",
+  "Paste the redirect URI shown below as the ONLY allowed redirect URI.",
+  "Allow the scopes listed below."
+];
+var OIDC_PROVIDERS = {
+  authentik: {
+    label: "authentik",
+    pieces: ["host", "application_slug"],
+    issuerFormat: "https://<host>/application/o/<application_slug>/",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "Admin interface > Applications > Applications > Create with Provider (OAuth2/OpenID)",
+    steps: [
+      "Create an application with an OAuth2/OpenID provider; its slug is the application_slug.",
+      "Set the client type to Public for PKCE without a secret, or Confidential.",
+      "Add the redirect URI below as a Strict redirect URI."
+    ],
+    build: (p) => `${hostOrigin(p.host)}/application/o/${p.application_slug}/`
+  },
+  "pocket-id": {
+    label: "Pocket ID",
+    pieces: ["host"],
+    issuerFormat: "https://<host>",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "Settings > Administration > OIDC Clients > Add OIDC Client",
+    steps: [
+      "Add an OIDC client and paste the redirect URI below as its callback URL.",
+      'Switch on "Public Client" for PKCE without a secret; leave it off for a confidential client.',
+      "Copy the client ID."
+    ],
+    build: (p) => hostOrigin(p.host)
+  },
+  authelia: {
+    label: "Authelia",
+    pieces: ["host"],
+    issuerFormat: "https://<host>",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "configuration.yml > identity_providers.oidc.clients (a file edit, then a restart)",
+    steps: [
+      "Add a client with its redirect URI below and `authorization_policy` of your choice.",
+      "For PKCE without a secret set `public: true` and `require_pkce: true`.",
+      "Set `token_endpoint_auth_method: client_secret_post` for a confidential client."
+    ],
+    build: (p) => hostOrigin(p.host)
+  },
+  keycloak: {
+    label: "Keycloak",
+    pieces: ["host", "realm"],
+    issuerFormat: "https://<host>/realms/<realm>",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "Admin console > the realm > Clients > Create client",
+    steps: [
+      'Client type OpenID Connect; switch "Client authentication" on for confidential, off for public.',
+      'Under Advanced, set "Proof Key for Code Exchange Code Challenge Method" to S256.',
+      "Add the redirect URI below as a valid redirect URI."
+    ],
+    build: (p) => `${hostOrigin(p.host)}/realms/${p.realm}`
+  },
+  zitadel: {
+    label: "ZITADEL",
+    pieces: ["host"],
+    issuerFormat: "https://<host>",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "Console > Project > Applications > New > Web",
+    steps: [
+      "Choose authentication method PKCE (public) or Basic/Post (confidential).",
+      "Add the redirect URI below.",
+      "Copy the client ID."
+    ],
+    build: (p) => hostOrigin(p.host)
+  },
+  kanidm: {
+    label: "Kanidm",
+    pieces: ["host", "application_slug"],
+    issuerFormat: "https://<host>/oauth2/openid/<application_slug>",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "`kanidm system oauth2 create(-public) <name> <display> <origin>` on the server",
+    steps: [
+      "Use `create-public` for PKCE without a secret, `create` for a confidential client.",
+      "Add the redirect URI below with `add-redirect-url`.",
+      "Grant scopes with `update-scope-map <name> <group> openid profile email`.",
+      "The application_slug is the client name you created."
+    ],
+    build: (p) => `${hostOrigin(p.host)}/oauth2/openid/${p.application_slug}`
+  },
+  google: {
+    label: "Google",
+    pieces: [],
+    issuerFormat: "https://accounts.google.com",
+    scopes: "openid profile email",
+    publicPkce: false,
+    usernameClaim: "email",
+    whereToCreate: "Google Cloud console > APIs & Services > Credentials > Create credentials > OAuth client ID (Web application)",
+    steps: [
+      'Choose "Web application"; Google issues a client secret for it, so the client is confidential.',
+      "Add the redirect URI below as an authorized redirect URI (it must be a public https host)."
+    ],
+    build: () => "https://accounts.google.com"
+  },
+  "microsoft-entra": {
+    label: "Microsoft Entra ID",
+    pieces: ["tenant_id"],
+    issuerFormat: "https://login.microsoftonline.com/<tenant_id>/v2.0",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "Entra admin center > App registrations > New registration",
+    steps: [
+      "Register a Web app (confidential, with a client secret) or a Single-page application (public, PKCE).",
+      "Add the redirect URI below under Authentication.",
+      "Copy the Application (client) ID and the Directory (tenant) ID."
+    ],
+    build: (p) => `https://login.microsoftonline.com/${p.tenant_id}/v2.0`
+  },
+  auth0: {
+    label: "Auth0",
+    pieces: ["host"],
+    issuerFormat: "https://<host>/",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "email",
+    whereToCreate: "Dashboard > Applications > Applications > Create Application",
+    steps: [
+      "Regular Web Application for confidential, Single Page Application for public (PKCE).",
+      "Add the redirect URI below under Allowed Callback URLs.",
+      "host is the tenant domain, for example example.eu.auth0.com."
+    ],
+    build: (p) => `${hostOrigin(p.host)}/`
+  },
+  okta: {
+    label: "Okta",
+    pieces: ["host"],
+    issuerFormat: "https://<host>/oauth2/default",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "Admin console > Applications > Applications > Create App Integration > OIDC",
+    steps: [
+      "Web Application for confidential, Single-Page Application for public (PKCE).",
+      "Add the redirect URI below as a sign-in redirect URI.",
+      "host is your Okta domain; the default authorization server is used."
+    ],
+    build: (p) => `${hostOrigin(p.host)}/oauth2/default`
+  },
+  generic: {
+    label: "Any OpenID Connect provider",
+    pieces: [],
+    issuerFormat: "the `issuer` value of the provider's discovery document",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "the provider's admin interface (create an OIDC web client)",
+    steps: COMMON_STEPS,
+    note: "Pass `issuer` exactly as the provider's /.well-known/openid-configuration reports it.",
+    build: () => ""
+  }
+};
+function resolveIssuer(provider, explicit, pieces) {
+  if (explicit !== void 0 && explicit.trim() !== "") {
+    return { issuer: explicit.trim(), missing: [] };
+  }
+  const spec = OIDC_PROVIDERS[provider];
+  const missing = spec.pieces.filter((k) => (pieces[k] ?? "").trim() === "");
+  if (missing.length > 0 || provider === "generic") return { issuer: null, missing };
+  return {
+    issuer: spec.build({
+      host: pieces.host ?? "",
+      application_slug: pieces.application_slug ?? "",
+      realm: pieces.realm ?? "",
+      tenant_id: pieces.tenant_id ?? ""
+    }),
+    missing: []
+  };
+}
+
+// src/mcp/configure-oidc.ts
+var OIDC_TOOL = "configure_oidc";
+var OIDC_ADMIN_ROUTE = "/system/identity?tab=authentication";
+var DISCOVERY_TIMEOUT_MS = 5e3;
+var ClientTypeSchema = z10.enum(["public", "confidential"]);
+var AddressesSchema3 = z10.looseObject({
+  roles: z10.looseObject({
+    publicEndpoint: z10.looseObject({ resolved: z10.string().nullish() }).optional(),
+    appConnections: z10.looseObject({ resolved: z10.array(z10.string()) }).optional()
+  })
+});
+var LOOPBACK2 = /^(localhost|127\.|\[?::1\]?$|0\.0\.0\.0)/i;
+function isLoopback(url) {
+  try {
+    return LOOPBACK2.test(new URL(url).hostname);
+  } catch {
+    return true;
+  }
+}
+async function resolveHubBase(client) {
+  const read = await readQuery(client, "localNetwork.getAddresses", {}, AddressesSchema3);
+  if (!read.ok) return { base: null, reason: read.reason };
+  const pub = read.value.roles.publicEndpoint?.resolved;
+  if (typeof pub === "string" && pub !== "" && !isLoopback(pub)) {
+    return { base: pub.replace(/\/+$/, ""), source: "publicEndpoint" };
+  }
+  const app = read.value.roles.appConnections?.resolved.find((u) => !isLoopback(u));
+  if (app !== void 0) return { base: app.replace(/\/+$/, ""), source: "appConnections" };
+  return {
+    base: null,
+    reason: "no non-loopback public endpoint or app-connections address is set (Network page)"
+  };
+}
+function callbackPath(connectionId) {
+  return `/addon/auth-oidc/${connectionId}/callback`;
+}
+var DiscoverySchema = z10.looseObject({
+  issuer: z10.string().optional(),
+  authorization_endpoint: z10.string().optional(),
+  token_endpoint: z10.string().optional(),
+  jwks_uri: z10.string().optional(),
+  code_challenge_methods_supported: z10.array(z10.string()).optional(),
+  token_endpoint_auth_methods_supported: z10.array(z10.string()).optional()
+});
+var trimSlash = (s) => s.replace(/\/+$/, "");
+async function checkDiscovery(fetchFn, issuer, clientType) {
+  const url = `${trimSlash(issuer)}/.well-known/openid-configuration`;
+  let body;
+  try {
+    const res = await fetchFn(url, { signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS) });
+    if (!res.ok) {
+      return {
+        checked: false,
+        url,
+        warnings: [`discovery answered ${res.status}: check the issuer URL`]
+      };
+    }
+    body = await res.json();
+  } catch (err) {
+    return {
+      checked: false,
+      url,
+      warnings: [`discovery could not be fetched from this machine (${reasonOf(err)})`]
+    };
+  }
+  const parsed = DiscoverySchema.safeParse(body);
+  if (!parsed.success) {
+    return {
+      checked: false,
+      url,
+      warnings: ["discovery answered something that is not a JSON document"]
+    };
+  }
+  const doc = parsed.data;
+  const warnings = [];
+  const issuerMatches = doc.issuer !== void 0 && trimSlash(doc.issuer) === trimSlash(issuer);
+  if (!issuerMatches) {
+    warnings.push(
+      `the provider reports issuer "${doc.issuer ?? "(none)"}", which differs from "${issuer}"`
+    );
+  }
+  if (doc.authorization_endpoint === void 0 || doc.token_endpoint === void 0) {
+    warnings.push("the discovery document lacks an authorization or token endpoint");
+  }
+  const s256 = doc.code_challenge_methods_supported?.includes("S256") === true;
+  if (!s256)
+    warnings.push("code_challenge_methods_supported does not include S256 (PKCE is always used)");
+  const post = doc.token_endpoint_auth_methods_supported?.includes("client_secret_post") === true;
+  if (clientType === "confidential" && !post) {
+    warnings.push(
+      "token_endpoint_auth_methods_supported does not include client_secret_post, which CamStack uses for a confidential client"
+    );
+  }
+  return {
+    checked: true,
+    url,
+    issuerMatches,
+    ...doc.authorization_endpoint !== void 0 ? { authorizationEndpoint: doc.authorization_endpoint } : {},
+    ...doc.token_endpoint !== void 0 ? { tokenEndpoint: doc.token_endpoint } : {},
+    s256,
+    clientSecretPost: post,
+    warnings
+  };
+}
+var ConnectionListSchema = z10.array(
+  z10.looseObject({ id: z10.string(), displayName: z10.string().optional() })
+);
+function connectionIdOf(args) {
+  return args.connection_id ?? args.provider;
+}
+function questionnaire(spec, args, redirectUri) {
+  const questions = [
+    ...spec.pieces.map(pieceQuestion),
+    ...args.provider === "generic" ? ["issuer: the exact issuer from the discovery document"] : [],
+    "client_id: the client id the provider shows after you create the client",
+    `client_type: "public" (PKCE, no secret${spec.publicPkce ? "" : " - NOT supported by this provider"}) or "confidential" (a secret you type into the admin UI)`,
+    "display_name (optional): the text of the login button",
+    "connection_id (optional): to update an existing connection instead of creating one"
+  ];
+  return {
+    status: "questions",
+    provider: args.provider,
+    label: spec.label,
+    questions,
+    issuerFormat: spec.issuerFormat,
+    defaultScopes: spec.scopes,
+    publicClientSupported: spec.publicPkce,
+    whereToCreateTheClient: spec.whereToCreate,
+    providerSideSteps: spec.steps,
+    ...spec.note !== void 0 ? { note: spec.note } : {},
+    redirectUri,
+    ...redirectUri === null ? {
+      redirectUriNote: "the hub address could not be resolved; set a public endpoint on the Network page"
+    } : {},
+    next: `Call ${OIDC_TOOL} again with the answers; it previews the connection and gives a confirm_token.`,
+    secretRule: "A client secret is never a tool argument. For a confidential client you type it in the admin UI."
+  };
+}
+function oidcSpec(client, fetchFn) {
+  return {
+    tool: OIDC_TOOL,
+    async dryRun(args) {
+      const spec = OIDC_PROVIDERS[args.provider];
+      const clientType = args.client_type ?? "public";
+      const resolved = resolveIssuer(args.provider, args.issuer, args);
+      if (resolved.issuer === null || args.client_id === void 0 || args.client_id.trim() === "") {
+        return { confirmable: false, describe: { problem: "issuer and client_id are required" } };
+      }
+      if (clientType === "public" && !spec.publicPkce) {
+        return {
+          confirmable: false,
+          describe: {
+            problem: `${spec.label} does not issue public clients; use client_type "confidential"`
+          }
+        };
+      }
+      const id = connectionIdOf(args);
+      const list = await readQuery(
+        client,
+        "oidcConnections.listConnections",
+        {},
+        ConnectionListSchema
+      );
+      if (!list.ok) return { confirmable: false, describe: { problem: list.reason } };
+      const exists = list.value.some((c) => c.id === id);
+      if (exists && args.connection_id === void 0) {
+        return {
+          confirmable: false,
+          describe: {
+            problem: `a connection "${id}" already exists; pass connection_id "${id}" to update it, or another id to create a new one`
+          }
+        };
+      }
+      const base = await resolveHubBase(client);
+      const discovery = await checkDiscovery(fetchFn, resolved.issuer, clientType);
+      const link = await adminLink(client, OIDC_ADMIN_ROUTE);
+      return {
+        confirmable: true,
+        describe: {
+          action: exists ? "update OIDC connection" : "create OIDC connection",
+          connection: {
+            id,
+            displayName: args.display_name ?? spec.label,
+            issuerUrl: resolved.issuer,
+            clientId: args.client_id.trim(),
+            clientType,
+            scopes: spec.scopes,
+            usernameClaim: spec.usernameClaim,
+            clientSecret: clientType === "public" ? "none (public PKCE client)" : "entered in the admin UI"
+          },
+          redirectUri: base.base !== null ? `${base.base}${callbackPath(id)}` : null,
+          ...base.base === null ? { redirectUriProblem: base.reason } : {},
+          discovery,
+          warnings: discovery.warnings,
+          ...secretStep(clientType, link.url)
+        }
+      };
+    },
+    async execute(args) {
+      const spec = OIDC_PROVIDERS[args.provider];
+      const clientType = args.client_type ?? "public";
+      const resolved = resolveIssuer(args.provider, args.issuer, args);
+      const id = connectionIdOf(args);
+      const displayName = args.display_name ?? spec.label;
+      const list = await readQuery(
+        client,
+        "oidcConnections.listConnections",
+        {},
+        ConnectionListSchema
+      );
+      const exists = list.ok && list.value.some((c) => c.id === id);
+      if (!exists) {
+        await client.call("POST", "oidcConnections.createConnection", { id, displayName });
+      }
+      await client.call("POST", "oidcConnections.updateConnection", {
+        id,
+        displayName,
+        issuerUrl: resolved.issuer ?? "",
+        clientId: (args.client_id ?? "").trim(),
+        scopes: spec.scopes,
+        usernameClaim: spec.usernameClaim,
+        ...exists && clientType === "public" ? { clientSecret: { $secretClear: true } } : {}
+      });
+      const link = await adminLink(client, OIDC_ADMIN_ROUTE);
+      return {
+        connectionId: id,
+        applied: exists ? "updated" : "created",
+        ...secretStep(clientType, link.url)
+      };
+    }
+  };
+}
+function secretStep(clientType, url) {
+  if (clientType === "public") return {};
+  return {
+    secretStep: {
+      required: true,
+      how: url !== null ? `open ${url}, edit the connection and type the client secret in the Client Secret field` : `open ${OIDC_ADMIN_ROUTE} in the admin UI, edit the connection and type the client secret in the Client Secret field`,
+      note: "The secret is never a tool argument and is not shown here."
+    }
+  };
+}
+async function configureOidc(ctx, args, confirmToken) {
+  const spec = OIDC_PROVIDERS[args.provider];
+  const resolved = resolveIssuer(args.provider, args.issuer, args);
+  const asking = resolved.issuer === null || (args.client_id ?? "").trim() === "";
+  if (asking) {
+    const base = await withHub(ctx, async ({ client }) => resolveHubBase(client));
+    const redirect = "status" in base || base.base === null ? null : `${base.base}${callbackPath(connectionIdOf(args))}`;
+    return questionnaire(spec, args, redirect);
+  }
+  return adminGated(ctx, (client) => oidcSpec(client, ctx.fetch), args, confirmToken);
+}
+var OIDC_TOOL_SHAPE = {
+  provider: OidcProviderSchema,
+  issuer: z10.string().optional(),
+  host: z10.string().optional(),
+  application_slug: z10.string().optional(),
+  realm: z10.string().optional(),
+  tenant_id: z10.string().optional(),
+  client_id: z10.string().optional(),
+  client_type: ClientTypeSchema.optional(),
+  display_name: z10.string().optional(),
+  connection_id: z10.string().optional(),
+  confirm_token: ConfirmTokenSchema
+};
+function registerOidcTools(server, ctx) {
+  server.tool(
+    OIDC_TOOL,
+    "Connect an OpenID Connect identity provider (authentik, pocket-id, authelia, keycloak, zitadel, kanidm, google, microsoft-entra, auth0, okta, generic). Call with only `provider` for the questions, the provider-side setup steps and the redirect URI to paste into the provider. With the answers it previews the connection and checks the provider discovery document (warnings, never a crash); call again with the SAME arguments and the confirm_token to create or update it. A client secret is NEVER an argument or output: a confidential client is finished by typing the secret in the admin UI (the route is given); a public PKCE client needs none. Needs an admin `camstack login` session for the write.",
+    OIDC_TOOL_SHAPE,
+    async ({ confirm_token, ...args }) => text6(await configureOidc(ctx, args, confirm_token))
+  );
+}
+
+// src/mcp/configure-nc-rules.ts
+import { z as z11 } from "zod";
+import { text as text7 } from "@camstack/develop";
 var TIME = /^\d{1,2}:\d{2}$/;
 var ALL_DAYS = [0, 1, 2, 3, 4, 5, 6];
-var QuietHoursAnswerSchema = z9.object({
+var QuietHoursAnswerSchema = z11.object({
   /** Notifications are muted from this time … */
-  from: z9.string().regex(TIME),
+  from: z11.string().regex(TIME),
   /** … until this one (HH:MM, hub time zone). A window may cross midnight. */
-  to: z9.string().regex(TIME),
+  to: z11.string().regex(TIME),
   /** Days the quiet window STARTS on (0 = Sunday); absent = every day. */
-  days: z9.array(z9.number().int().min(0).max(6)).min(1).optional()
+  days: z11.array(z11.number().int().min(0).max(6)).min(1).optional()
 });
-var NcRuleAnswersSchema = z9.object({
-  name: z9.string().min(1).max(200).optional(),
-  delivery: z9.enum(["immediate", "track-end"]).optional(),
+var NcRuleAnswersSchema = z11.object({
+  name: z11.string().min(1).max(200).optional(),
+  delivery: z11.enum(["immediate", "track-end"]).optional(),
   /** Camera ids; `[]` means every camera. */
-  cameras: z9.array(z9.number().int().nonnegative()).optional(),
-  classes: z9.array(z9.string().min(1)).optional(),
+  cameras: z11.array(z11.number().int().nonnegative()).optional(),
+  classes: z11.array(z11.string().min(1)).optional(),
   /** Zone ids or names; `[]` means anywhere in view. */
-  zones: z9.array(z9.string().min(1)).optional(),
-  minConfidence: z9.number().min(0).max(1).optional(),
+  zones: z11.array(z11.string().min(1)).optional(),
+  minConfidence: z11.number().min(0).max(1).optional(),
   /** `null` states "no quiet hours"; absent means not asked yet. */
   quietHours: QuietHoursAnswerSchema.nullable().optional(),
   /** Target ids or names. */
-  targets: z9.array(z9.string().min(1)).optional(),
-  cooldownSeconds: z9.number().int().min(0).max(86400).optional()
+  targets: z11.array(z11.string().min(1)).optional(),
+  cooldownSeconds: z11.number().int().min(0).max(86400).optional()
 });
 var SAVE_RULE_TOOL = "configure_notification_rule_save";
 var DELIVERY_CHOICES = [
@@ -2557,11 +3052,11 @@ async function interviewNcRule(client, answers) {
 async function ncRuleQuestionnaire(ctx, answers) {
   return withHub(ctx, ({ client }) => interviewNcRule(client, answers));
 }
-var StoredRuleSchema = z9.looseObject({
-  id: z9.string().optional(),
-  name: z9.string().optional(),
-  conditions: z9.record(z9.string(), z9.unknown()).optional(),
-  schedule: z9.unknown().optional()
+var StoredRuleSchema = z11.looseObject({
+  id: z11.string().optional(),
+  name: z11.string().optional(),
+  conditions: z11.record(z11.string(), z11.unknown()).optional(),
+  schedule: z11.unknown().optional()
 });
 var AUTHORED_CONDITION_KEYS = [
   "devices",
@@ -2693,17 +3188,17 @@ function registerNcRuleTools(server, ctx) {
     "configure_notification_rule_questionnaire",
     "Interview for a detection notification rule (cameras, classes, zones, quiet hours, targets). Stateless: send every answer so far in `answers`; it returns the questions still open, with choices read from the hub, or `ready` with a summary and the rule. Writes nothing.",
     { answers: NcRuleAnswersSchema },
-    async ({ answers }) => text6(await ncRuleQuestionnaire(ctx, answers))
+    async ({ answers }) => text7(await ncRuleQuestionnaire(ctx, answers))
   );
   server.tool(
     SAVE_RULE_TOOL,
     `Create a notification rule (the \`rule\` of a ready questionnaire), or update the one named by ruleId (the full conditions are sent, so keys the interview does not author are kept). ${GATE_HOW4}`,
     {
       rule: NcRuleInputSchema,
-      ruleId: z9.string().optional(),
+      ruleId: z11.string().optional(),
       confirm_token: ConfirmTokenSchema
     },
-    async ({ rule, ruleId, confirm_token }) => text6(
+    async ({ rule, ruleId, confirm_token }) => text7(
       await saveRule(ctx, { rule, ...ruleId !== void 0 ? { ruleId } : {} }, confirm_token)
     )
   );
@@ -2716,20 +3211,21 @@ function registerConfigureP3bTools(server, ctx) {
   registerCalibrateTools(server, ctx);
   registerExportTools(server, ctx);
   registerNetworkTools(server, ctx);
+  registerOidcTools(server, ctx);
   registerZonesAlarmTools(server, ctx);
 }
 
 // src/mcp/configure-addons.ts
 import {
-  text as text7
+  text as text8
 } from "@camstack/develop";
-import { z as z11 } from "zod";
+import { z as z13 } from "zod";
 
 // src/mcp/configure-support.ts
 import {
   runGated as runGated2
 } from "@camstack/develop";
-import { z as z10 } from "zod";
+import { z as z12 } from "zod";
 async function runGatedAdmin(ctx, makeSpec, args, confirmToken) {
   const outcome = await ctx.hub();
   if (!outcome.ok) return noSessionResult(outcome);
@@ -2752,28 +3248,28 @@ async function withAdminHub(ctx, body) {
   }
   return body(outcome.connection);
 }
-var FormOptionSchema = z10.looseObject({
-  value: z10.union([z10.string(), z10.number(), z10.boolean()]),
-  label: z10.string().optional()
+var FormOptionSchema = z12.looseObject({
+  value: z12.union([z12.string(), z12.number(), z12.boolean()]),
+  label: z12.string().optional()
 });
-var FormFieldSchema = z10.looseObject({
-  type: z10.string().optional(),
-  key: z10.string().optional(),
-  label: z10.string().optional(),
-  description: z10.string().optional(),
-  required: z10.boolean().optional(),
-  secret: z10.boolean().optional(),
-  default: z10.unknown().optional(),
-  options: z10.array(FormOptionSchema).optional(),
-  itemFields: z10.array(
-    z10.looseObject({
-      type: z10.string().optional(),
-      key: z10.string().optional()
+var FormFieldSchema = z12.looseObject({
+  type: z12.string().optional(),
+  key: z12.string().optional(),
+  label: z12.string().optional(),
+  description: z12.string().optional(),
+  required: z12.boolean().optional(),
+  secret: z12.boolean().optional(),
+  default: z12.unknown().optional(),
+  options: z12.array(FormOptionSchema).optional(),
+  itemFields: z12.array(
+    z12.looseObject({
+      type: z12.string().optional(),
+      key: z12.string().optional()
     })
   ).optional()
 });
-var FormSchemaShape = z10.looseObject({
-  sections: z10.array(z10.looseObject({ fields: z10.array(FormFieldSchema) }))
+var FormSchemaShape = z12.looseObject({
+  sections: z12.array(z12.looseObject({ fields: z12.array(FormFieldSchema) }))
 });
 var NON_INPUT_TYPES = /* @__PURE__ */ new Set(["info", "divider", "heading", "button"]);
 var CREDENTIAL_NAME = /pass(word|wd|phrase)?|token|secret|api[_-]?key|credential|private[_-]?key/i;
@@ -2874,21 +3370,21 @@ function splitConfig(fields, config) {
 function fieldValidator(field) {
   switch (field.type) {
     case "number":
-      return z10.number();
+      return z12.number();
     case "boolean":
     case "switch":
     case "checkbox":
     case "toggle":
-      return z10.boolean();
+      return z12.boolean();
     case "tags":
-      return z10.array(z10.string());
+      return z12.array(z12.string());
     case "editable-array":
-      return z10.array(z10.record(z10.string(), z10.unknown()));
+      return z12.array(z12.record(z12.string(), z12.unknown()));
     case "select":
     case "radio": {
-      if (field.options === null || field.options.length === 0) return z10.unknown();
+      if (field.options === null || field.options.length === 0) return z12.unknown();
       const values = field.options.map((o) => o.value);
-      return z10.custom(
+      return z12.custom(
         (v) => values.some((allowed) => allowed === v),
         `one of: ${values.map(String).join(", ")}`
       );
@@ -2898,9 +3394,9 @@ function fieldValidator(field) {
     case "textarea":
     case "url":
     case "email":
-      return z10.string();
+      return z12.string();
     default:
-      return z10.unknown();
+      return z12.unknown();
   }
 }
 function formValidator(fields) {
@@ -2910,7 +3406,7 @@ function formValidator(fields) {
     const base = fieldValidator(field);
     shape[field.key] = field.required ? base : base.optional();
   }
-  return z10.object(shape);
+  return z12.object(shape);
 }
 function validationProblems(error) {
   return error.issues.map((issue) => {
@@ -2942,64 +3438,64 @@ function viewConfig(fields, config) {
 var REGISTRY = "https://registry.npmjs.org";
 var REGISTRY_TIMEOUT_MS = 5e3;
 var MAX_RESULTS = 15;
-var PackageName = z11.string().min(1).regex(/^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/, "not an npm package name");
-var CatalogShape = z11.looseObject({
-  name: z11.string(),
-  version: z11.string(),
-  description: z11.string(),
-  keywords: z11.array(z11.string()).optional(),
-  installed: z11.boolean(),
-  capabilities: z11.array(z11.string()).nullable()
+var PackageName = z13.string().min(1).regex(/^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/, "not an npm package name");
+var CatalogShape = z13.looseObject({
+  name: z13.string(),
+  version: z13.string(),
+  description: z13.string(),
+  keywords: z13.array(z13.string()).optional(),
+  installed: z13.boolean(),
+  capabilities: z13.array(z13.string()).nullable()
 });
-var ListedAddonShape = z11.looseObject({
-  manifest: z11.looseObject({
-    id: z11.string(),
-    packageName: z11.string(),
-    packageVersion: z11.string(),
+var ListedAddonShape = z13.looseObject({
+  manifest: z13.looseObject({
+    id: z13.string(),
+    packageName: z13.string(),
+    packageVersion: z13.string(),
     // The hub answers null, not absent, for a manifest without the flag.
-    protected: z11.boolean().nullish(),
-    removable: z11.boolean().nullish()
+    protected: z13.boolean().nullish(),
+    removable: z13.boolean().nullish()
   })
 });
-var UpdateShape = z11.looseObject({
-  name: z11.string(),
-  currentVersion: z11.string(),
-  latestVersion: z11.string(),
-  category: z11.enum(["addon", "core"]),
-  requiresRestart: z11.boolean(),
-  isSystem: z11.boolean()
+var UpdateShape = z13.looseObject({
+  name: z13.string(),
+  currentVersion: z13.string(),
+  latestVersion: z13.string(),
+  category: z13.enum(["addon", "core"]),
+  requiresRestart: z13.boolean(),
+  isSystem: z13.boolean()
 });
-var InstallationsShape = z11.looseObject({
-  installations: z11.array(
-    z11.looseObject({
-      nodeId: z11.string(),
-      isHub: z11.boolean(),
-      isOnline: z11.boolean(),
-      version: z11.string().nullable(),
-      source: z11.string()
+var InstallationsShape = z13.looseObject({
+  installations: z13.array(
+    z13.looseObject({
+      nodeId: z13.string(),
+      isHub: z13.boolean(),
+      isOnline: z13.boolean(),
+      version: z13.string().nullable(),
+      source: z13.string()
     })
   ),
-  unreachable: z11.array(z11.looseObject({ nodeId: z11.string(), error: z11.string() }))
+  unreachable: z13.array(z13.looseObject({ nodeId: z13.string(), error: z13.string() }))
 });
-var VersionsShape = z11.array(
-  z11.looseObject({ version: z11.string(), deprecated: z11.string().optional() })
+var VersionsShape = z13.array(
+  z13.looseObject({ version: z13.string(), deprecated: z13.string().optional() })
 );
-var UninstallShape = z11.looseObject({
-  success: z11.boolean(),
-  packageName: z11.string(),
-  results: z11.array(
-    z11.looseObject({
-      nodeId: z11.string(),
-      outcome: z11.string(),
-      error: z11.string().optional()
+var UninstallShape = z13.looseObject({
+  success: z13.boolean(),
+  packageName: z13.string(),
+  results: z13.array(
+    z13.looseObject({
+      nodeId: z13.string(),
+      outcome: z13.string(),
+      error: z13.string().optional()
     })
   )
 });
-var ServerStatusShape = z11.looseObject({
-  runningVersion: z11.string().nullable().optional()
+var ServerStatusShape = z13.looseObject({
+  runningVersion: z13.string().nullable().optional()
 });
 async function readProtection(client, packageName) {
-  const list = await readQuery(client, "addons.list", {}, z11.array(ListedAddonShape));
+  const list = await readQuery(client, "addons.list", {}, z13.array(ListedAddonShape));
   if (!list.ok) return null;
   const mine = list.value.filter((a) => a.manifest.packageName === packageName);
   return {
@@ -3010,13 +3506,13 @@ async function readProtection(client, packageName) {
 }
 var PROTECTED_REASON = (name) => `${name} is a protected package (manifest protected / removable:false): the kernel needs it, so it is never installed over, updated or removed here`;
 var UNREADABLE_PROTECTION_REASON = (name) => `could not read whether ${name} is protected (addons.list did not answer with the expected shape); nothing is changed until it does`;
-var PackumentShape = z11.looseObject({
-  peerDependencies: z11.record(z11.string(), z11.string()).optional(),
-  engines: z11.record(z11.string(), z11.string()).optional(),
-  camstack: z11.looseObject({
-    addons: z11.array(
-      z11.looseObject({
-        execution: z11.looseObject({ placement: z11.string().optional() }).optional()
+var PackumentShape = z13.looseObject({
+  peerDependencies: z13.record(z13.string(), z13.string()).optional(),
+  engines: z13.record(z13.string(), z13.string()).optional(),
+  camstack: z13.looseObject({
+    addons: z13.array(
+      z13.looseObject({
+        execution: z13.looseObject({ placement: z13.string().optional() }).optional()
       })
     ).optional()
   }).optional()
@@ -3068,10 +3564,10 @@ async function configureAddonsSearch(ctx, args) {
           ...args.query !== void 0 ? { query: args.query } : {},
           ...args.capability !== void 0 ? { capability: args.capability } : {}
         },
-        z11.array(CatalogShape)
+        z13.array(CatalogShape)
       ),
-      readQuery(client, "addons.list", {}, z11.array(ListedAddonShape)),
-      readQuery(client, "addons.listUpdates", {}, z11.array(UpdateShape)),
+      readQuery(client, "addons.list", {}, z13.array(ListedAddonShape)),
+      readQuery(client, "addons.listUpdates", {}, z13.array(UpdateShape)),
       readQuery(client, "serverManagement.getServerPackageStatus", void 0, ServerStatusShape)
     ]);
     if (!catalog.ok) return { status: "unavailable", reason: catalog.reason };
@@ -3150,7 +3646,7 @@ function installAddonSpec(client, fetchFn) {
         client,
         "addons.searchAvailable",
         { query: args.packageName },
-        z11.array(CatalogShape)
+        z13.array(CatalogShape)
       );
       if (!catalog.ok) return { confirmable: false, describe: { problem: catalog.reason } };
       const entry = catalog.value.find((c) => c.name === args.packageName);
@@ -3253,7 +3749,7 @@ function updateAddonSpec(client) {
         client,
         "addons.listUpdates",
         args.nodeId !== void 0 ? { nodeId: args.nodeId } : {},
-        z11.array(UpdateShape)
+        z13.array(UpdateShape)
       );
       if (!updates.ok) return { confirmable: false, describe: { problem: updates.reason } };
       const entry = updates.value.find((u) => u.name === args.packageName);
@@ -3374,10 +3870,10 @@ function registerAddonTools(server, ctx) {
     "configure_addons_search",
     "Search the addon store (the catalog the admin UI uses) with the installed version, an available update, whether the package is protected, and compatibility (placement, @camstack/types peer range, node engine; no addon declares a minimum server version).",
     {
-      query: z11.string().max(100).optional(),
-      capability: z11.string().max(100).optional()
+      query: z13.string().max(100).optional(),
+      capability: z13.string().max(100).optional()
     },
-    async ({ query, capability }) => text7(
+    async ({ query, capability }) => text8(
       await configureAddonsSearch(ctx, {
         ...query !== void 0 ? { query } : {},
         ...capability !== void 0 ? { capability } : {}
@@ -3389,10 +3885,10 @@ function registerAddonTools(server, ctx) {
     `Install an addon package on the hub from the store. ${TWO_STEP} Agents reconcile later; the result says so.`,
     {
       packageName: PackageName,
-      version: z11.string().max(64).optional(),
-      confirm_token: z11.string().optional()
+      version: z13.string().max(64).optional(),
+      confirm_token: z13.string().optional()
     },
-    async ({ packageName, version, confirm_token }) => text7(
+    async ({ packageName, version, confirm_token }) => text8(
       await installAddon(
         ctx,
         { packageName, ...version !== void 0 ? { version } : {} },
@@ -3405,11 +3901,11 @@ function registerAddonTools(server, ctx) {
     `Update an installed addon package (hub by default, or one node). Protected and framework packages are refused in the preview. ${TWO_STEP}`,
     {
       packageName: PackageName,
-      version: z11.string().max(64).optional(),
-      nodeId: z11.string().max(100).optional(),
-      confirm_token: z11.string().optional()
+      version: z13.string().max(64).optional(),
+      nodeId: z13.string().max(100).optional(),
+      confirm_token: z13.string().optional()
     },
-    async ({ packageName, version, nodeId, confirm_token }) => text7(
+    async ({ packageName, version, nodeId, confirm_token }) => text8(
       await updateAddon(
         ctx,
         {
@@ -3426,11 +3922,11 @@ function registerAddonTools(server, ctx) {
     `Uninstall an addon package from the hub, one node, or everywhere. Protected packages (manifest protected / removable:false) are refused in the preview with the reason. ${TWO_STEP}`,
     {
       packageName: PackageName,
-      nodeId: z11.string().max(100).optional(),
-      everywhere: z11.boolean().optional(),
-      confirm_token: z11.string().optional()
+      nodeId: z13.string().max(100).optional(),
+      everywhere: z13.boolean().optional(),
+      confirm_token: z13.string().optional()
     },
-    async ({ packageName, nodeId, everywhere, confirm_token }) => text7(
+    async ({ packageName, nodeId, everywhere, confirm_token }) => text8(
       await uninstallAddon(
         ctx,
         {
@@ -3446,9 +3942,9 @@ function registerAddonTools(server, ctx) {
 
 // src/mcp/configure-cameras.ts
 import {
-  text as text8
+  text as text9
 } from "@camstack/develop";
-import { z as z12 } from "zod";
+import { z as z14 } from "zod";
 var UNSUPPORTED_HINT = "use support_diagnose_camera / support_draft_issue";
 var MAX_PROVIDERS = 40;
 var MAX_CANDIDATES = 50;
@@ -3461,34 +3957,34 @@ function unsupported(reason, provider) {
     hint: UNSUPPORTED_HINT
   };
 }
-var CapabilityEntry = z12.union([z12.string(), z12.looseObject({ name: z12.string() })]);
-var InstalledAddonShape = z12.looseObject({
-  manifest: z12.looseObject({
-    id: z12.string(),
-    name: z12.string().optional(),
-    description: z12.string().optional(),
-    packageName: z12.string(),
-    packageVersion: z12.string(),
-    capabilities: z12.array(CapabilityEntry).optional()
+var CapabilityEntry = z14.union([z14.string(), z14.looseObject({ name: z14.string() })]);
+var InstalledAddonShape = z14.looseObject({
+  manifest: z14.looseObject({
+    id: z14.string(),
+    name: z14.string().optional(),
+    description: z14.string().optional(),
+    packageName: z14.string(),
+    packageVersion: z14.string(),
+    capabilities: z14.array(CapabilityEntry).optional()
   })
 });
-var CatalogShape2 = z12.looseObject({
-  name: z12.string(),
-  version: z12.string(),
-  description: z12.string(),
-  keywords: z12.array(z12.string()),
-  installed: z12.boolean(),
-  capabilities: z12.array(z12.string()).nullable()
+var CatalogShape2 = z14.looseObject({
+  name: z14.string(),
+  version: z14.string(),
+  description: z14.string(),
+  keywords: z14.array(z14.string()),
+  installed: z14.boolean(),
+  capabilities: z14.array(z14.string()).nullable()
 });
-var DiscoveryProvidersShape = z12.looseObject({
-  providers: z12.array(z12.looseObject({ addonId: z12.string(), label: z12.string() }))
+var DiscoveryProvidersShape = z14.looseObject({
+  providers: z14.array(z14.looseObject({ addonId: z14.string(), label: z14.string() }))
 });
 function capabilityName(entry) {
   return typeof entry === "string" ? entry : entry.name;
 }
 async function readInstalledProviders(client) {
   const [list, discovery] = await Promise.all([
-    readQuery(client, "addons.list", {}, z12.array(InstalledAddonShape)),
+    readQuery(client, "addons.list", {}, z14.array(InstalledAddonShape)),
     readQuery(client, "deviceManager.discoveryProviders", {}, DiscoveryProvidersShape)
   ]);
   if (!list.ok) return list;
@@ -3519,7 +4015,7 @@ async function configureCameraProviders(ctx, query) {
         client,
         "addons.searchAvailable",
         { capability: DEVICE_PROVIDER },
-        z12.array(CatalogShape2)
+        z14.array(CatalogShape2)
       )
     ]);
     if (!installed.ok) return { status: "unavailable", reason: installed.reason };
@@ -3553,13 +4049,13 @@ async function configureCameraProviders(ctx, query) {
     };
   });
 }
-var CandidateShape = z12.looseObject({
-  stableId: z12.string(),
-  type: z12.string(),
-  suggestedName: z12.string(),
-  prefilledConfig: z12.record(z12.string(), z12.unknown())
+var CandidateShape = z14.looseObject({
+  stableId: z14.string(),
+  type: z14.string(),
+  suggestedName: z14.string(),
+  prefilledConfig: z14.record(z14.string(), z14.unknown())
 });
-var DiscoverShape = z12.looseObject({ candidates: z12.array(CandidateShape) });
+var DiscoverShape = z14.looseObject({ candidates: z14.array(CandidateShape) });
 async function configureCameraDiscover(ctx, args) {
   return withAdminHub(ctx, async ({ client }) => {
     const providers = await readQuery(
@@ -3645,7 +4141,7 @@ async function planAdd(client, args) {
     client,
     "deviceManager.getCreationSchema",
     { addonId: args.addonId, type: "camera" },
-    z12.unknown()
+    z14.unknown()
   );
   if (!schema.ok) return { ok: false, problems: [schema.reason] };
   if (schema.value === null || schema.value === void 0) {
@@ -3696,7 +4192,7 @@ async function providerPage(client, addonId) {
   const link = await resolveLinkBase(client);
   return link.base === null ? null : `${link.base}/integrations/${addonId}`;
 }
-var CreatedShape = z12.looseObject({ id: z12.number(), name: z12.string() });
+var CreatedShape = z14.looseObject({ id: z14.number(), name: z14.string() });
 function addCameraSpec(client) {
   return {
     tool: ADD_CAMERA_TOOL,
@@ -3773,17 +4269,17 @@ function registerCameraTools(server, ctx) {
   server.tool(
     "configure_camera_providers",
     "Installed camera-provider addons and the published ones not yet installed. A manifest declares no brand/model list, so `query` matches on name, description and keywords; a brand nothing matches is `unsupported` with a pointer to support_diagnose_camera / support_draft_issue.",
-    { query: z12.string().max(100).optional() },
-    async ({ query }) => text8(await configureCameraProviders(ctx, query))
+    { query: z14.string().max(100).optional() },
+    async ({ query }) => text9(await configureCameraProviders(ctx, query))
   );
   server.tool(
     "configure_camera_discover",
     'Scan the network through one camera provider (the admin UI "add camera" discovery) and list the candidates with the non-secret fields to pass to configure_camera_add. Changes nothing on the hub. A credential in `params` is refused (`secret-required`). Needs an admin `camstack login`.',
     {
-      addonId: z12.string().min(1),
-      params: z12.record(z12.string(), z12.unknown()).optional()
+      addonId: z14.string().min(1),
+      params: z14.record(z14.string(), z14.unknown()).optional()
     },
-    async ({ addonId, params }) => text8(
+    async ({ addonId, params }) => text9(
       await configureCameraDiscover(ctx, {
         addonId,
         ...params !== void 0 ? { params } : {}
@@ -3794,46 +4290,46 @@ function registerCameraTools(server, ctx) {
     ADD_CAMERA_TOOL,
     "Add a camera through a provider's creation form (the fields are the provider's own schema). Two steps: call without confirm_token for a preview and a one-shot token, then again with the SAME arguments and that token. `config` takes NON-secret fields only; a password is refused and the answer carries the admin-UI link where the operator types it (`secret-required`). A provider that is not installed or has no manual form is `unsupported`.",
     {
-      addonId: z12.string().min(1),
-      config: z12.record(z12.string(), z12.unknown()),
-      confirm_token: z12.string().optional()
+      addonId: z14.string().min(1),
+      config: z14.record(z14.string(), z14.unknown()),
+      confirm_token: z14.string().optional()
     },
-    async ({ addonId, config, confirm_token }) => text8(await addCamera(ctx, { addonId, config }, confirm_token))
+    async ({ addonId, config, confirm_token }) => text9(await addCamera(ctx, { addonId, config }, confirm_token))
   );
 }
 
 // src/mcp/configure-notifiers.ts
 import {
-  text as text9
+  text as text10
 } from "@camstack/develop";
-import { z as z13 } from "zod";
+import { z as z15 } from "zod";
 var MAX_TARGETS = 50;
-var TargetKindShape = z13.looseObject({
-  kind: z13.string(),
-  label: z13.string(),
-  addonId: z13.string(),
-  supportsDiscovery: z13.boolean().optional(),
-  configSchema: z13.unknown(),
-  destinationKeys: z13.array(z13.string()).optional()
+var TargetKindShape = z15.looseObject({
+  kind: z15.string(),
+  label: z15.string(),
+  addonId: z15.string(),
+  supportsDiscovery: z15.boolean().optional(),
+  configSchema: z15.unknown(),
+  destinationKeys: z15.array(z15.string()).optional()
 });
-var TargetShape = z13.looseObject({
-  id: z13.string(),
-  name: z13.string(),
-  kind: z13.string(),
-  addonId: z13.string(),
-  enabled: z13.boolean(),
-  config: z13.record(z13.string(), z13.unknown())
+var TargetShape = z15.looseObject({
+  id: z15.string(),
+  name: z15.string(),
+  kind: z15.string(),
+  addonId: z15.string(),
+  enabled: z15.boolean(),
+  config: z15.record(z15.string(), z15.unknown())
 });
-var SendResultShape = z13.looseObject({
-  success: z13.boolean(),
-  error: z13.string().optional()
+var SendResultShape = z15.looseObject({
+  success: z15.boolean(),
+  error: z15.string().optional()
 });
 async function readKinds(client) {
   const read = await readQuery(
     client,
     "notificationOutput.listTargetKinds",
     {},
-    z13.array(TargetKindShape)
+    z15.array(TargetKindShape)
   );
   if (!read.ok) return read;
   return {
@@ -3888,7 +4384,7 @@ async function configureNotificationTargets(ctx) {
   return withAdminHub(ctx, async ({ client }) => {
     const [kinds, targets] = await Promise.all([
       readKinds(client),
-      readQuery(client, "notificationOutput.listTargets", {}, z13.array(TargetShape))
+      readQuery(client, "notificationOutput.listTargets", {}, z15.array(TargetShape))
     ]);
     if (!targets.ok) return { status: "unavailable", reason: targets.reason };
     const forms = kinds.ok ? kinds.value : [];
@@ -3929,7 +4425,7 @@ async function planUpsert(client, args) {
   const fields = form.fields;
   let existing = null;
   if (args.targetId !== void 0) {
-    const list = await readQuery(client, "notificationOutput.listTargets", {}, z13.array(TargetShape));
+    const list = await readQuery(client, "notificationOutput.listTargets", {}, z15.array(TargetShape));
     if (!list.ok) return { ok: false, problems: [list.reason] };
     existing = list.value.find((t) => t.id === args.targetId) ?? null;
     if (existing === null) return { ok: false, problems: [`target ${args.targetId} was not found`] };
@@ -4036,7 +4532,7 @@ function testTargetSpec(client) {
     async dryRun(args) {
       const [kinds, targets] = await Promise.all([
         readKinds(client),
-        readQuery(client, "notificationOutput.listTargets", {}, z13.array(TargetShape))
+        readQuery(client, "notificationOutput.listTargets", {}, z15.array(TargetShape))
       ]);
       if (!targets.ok) return { confirmable: false, describe: { problem: targets.reason } };
       const target = targets.value.find((t) => t.id === args.targetId);
@@ -4108,26 +4604,26 @@ function registerNotifierTools(server, ctx) {
     "configure_notifiers",
     "The notifier kinds a target can be created from (ntfy, telegram, email, \u2026), each with its settings fields, which are required and which are SECRETS. Secrets are never tool arguments. Needs an admin `camstack login`.",
     {},
-    async () => text9(await configureNotifiers(ctx))
+    async () => text10(await configureNotifiers(ctx))
   );
   server.tool(
     "configure_notification_targets",
     "Existing notification targets with their non-secret settings. A secret is shown only as set/unset, and a target missing a required secret is listed under `incomplete`. Needs an admin `camstack login`.",
     {},
-    async () => text9(await configureNotificationTargets(ctx))
+    async () => text10(await configureNotificationTargets(ctx))
   );
   server.tool(
     UPSERT_TARGET_TOOL,
     "Create (no targetId) or edit (targetId) a notification target from its notifier schema (see configure_notifiers). Two steps: call without confirm_token for a preview and a one-shot token, then again with the SAME arguments and that token. `config` takes NON-secret fields only; a secret field is refused, and the target is saved incomplete with the admin-UI link where the operator types the secret (`secret-required`).",
     {
-      targetId: z13.string().min(1).optional(),
-      kind: z13.string().min(1),
-      name: z13.string().min(1),
-      config: z13.record(z13.string(), z13.unknown()),
-      enabled: z13.boolean().optional(),
-      confirm_token: z13.string().optional()
+      targetId: z15.string().min(1).optional(),
+      kind: z15.string().min(1),
+      name: z15.string().min(1),
+      config: z15.record(z15.string(), z15.unknown()),
+      enabled: z15.boolean().optional(),
+      confirm_token: z15.string().optional()
     },
-    async ({ targetId, kind, name, config, enabled, confirm_token }) => text9(
+    async ({ targetId, kind, name, config, enabled, confirm_token }) => text10(
       await upsertNotificationTarget(
         ctx,
         {
@@ -4144,51 +4640,51 @@ function registerNotifierTools(server, ctx) {
   server.tool(
     TEST_TARGET_TOOL,
     "Send a test notification to one target. Two steps: the preview checks the target exists and has every required secret, and only the confirmed call delivers a real message.",
-    { targetId: z13.string().min(1), confirm_token: z13.string().optional() },
-    async ({ targetId, confirm_token }) => text9(await testNotificationTarget(ctx, { targetId }, confirm_token))
+    { targetId: z15.string().min(1), confirm_token: z15.string().optional() },
+    async ({ targetId, confirm_token }) => text10(await testNotificationTarget(ctx, { targetId }, confirm_token))
   );
 }
 
 // src/mcp/ops-tools.ts
-import { z as z25 } from "zod";
-import { jwtClaims, text as text11 } from "@camstack/develop";
+import { z as z27 } from "zod";
+import { jwtClaims, text as text12 } from "@camstack/develop";
 
 // src/mcp/ops-accelerators.ts
-import { z as z14 } from "zod";
-var NodesSchema = z14.array(
-  z14.looseObject({
-    id: z14.string(),
-    isOnline: z14.boolean(),
-    name: z14.string().optional()
+import { z as z16 } from "zod";
+var NodesSchema = z16.array(
+  z16.looseObject({
+    id: z16.string(),
+    isOnline: z16.boolean(),
+    name: z16.string().optional()
   })
 );
-var HardwareSchema = z14.looseObject({
-  platform: z14.enum(["darwin", "linux", "win32"]),
-  arch: z14.enum(["arm64", "x64"]),
-  cpuModel: z14.string(),
-  cpuCores: z14.number(),
-  totalRAM_MB: z14.number(),
-  availableRAM_MB: z14.number(),
-  gpu: z14.looseObject({
-    type: z14.enum(["nvidia", "amd", "intel", "apple"]),
-    name: z14.string()
+var HardwareSchema = z16.looseObject({
+  platform: z16.enum(["darwin", "linux", "win32"]),
+  arch: z16.enum(["arm64", "x64"]),
+  cpuModel: z16.string(),
+  cpuCores: z16.number(),
+  totalRAM_MB: z16.number(),
+  availableRAM_MB: z16.number(),
+  gpu: z16.looseObject({
+    type: z16.enum(["nvidia", "amd", "intel", "apple"]),
+    name: z16.string()
   }).nullable(),
-  npu: z14.looseObject({
-    type: z14.enum(["apple-ane", "intel-npu", "amd-xdna"])
+  npu: z16.looseObject({
+    type: z16.enum(["apple-ane", "intel-npu", "amd-xdna"])
   }).nullable()
 });
-var InferenceDevicesSchema = z14.looseObject({
-  reachable: z14.boolean(),
-  devices: z14.array(
-    z14.looseObject({
-      key: z14.string(),
-      backend: z14.string(),
-      device: z14.string(),
-      available: z14.boolean(),
-      presence: z14.enum(["present", "absent", "unknown"]).optional(),
-      enabled: z14.boolean(),
-      exclusion: z14.string().nullable(),
-      defaultModelId: z14.string()
+var InferenceDevicesSchema = z16.looseObject({
+  reachable: z16.boolean(),
+  devices: z16.array(
+    z16.looseObject({
+      key: z16.string(),
+      backend: z16.string(),
+      device: z16.string(),
+      available: z16.boolean(),
+      presence: z16.enum(["present", "absent", "unknown"]).optional(),
+      enabled: z16.boolean(),
+      exclusion: z16.string().nullable(),
+      defaultModelId: z16.string()
     })
   )
 });
@@ -4312,81 +4808,81 @@ async function opsAccelerators(ctx) {
 }
 
 // src/mcp/ops-device.ts
-import { z as z15 } from "zod";
-var DeviceSchema = z15.looseObject({
-  id: z15.number(),
-  name: z15.string(),
-  type: z15.string().optional(),
-  addonId: z15.string().optional(),
-  location: z15.string().nullable().optional(),
-  disabled: z15.boolean().optional(),
-  online: z15.boolean().optional(),
-  isCamera: z15.boolean().optional(),
-  features: z15.array(z15.string()).optional()
+import { z as z17 } from "zod";
+var DeviceSchema = z17.looseObject({
+  id: z17.number(),
+  name: z17.string(),
+  type: z17.string().optional(),
+  addonId: z17.string().optional(),
+  location: z17.string().nullable().optional(),
+  disabled: z17.boolean().optional(),
+  online: z17.boolean().optional(),
+  isCamera: z17.boolean().optional(),
+  features: z17.array(z17.string()).optional()
 });
 var NullableDeviceSchema = DeviceSchema.nullable();
-var DeviceListSchema = z15.array(DeviceSchema);
-var BindingsSchema2 = z15.looseObject({
-  entries: z15.array(
-    z15.looseObject({
-      capName: z15.string(),
-      kind: z15.string(),
-      providerAddonId: z15.string(),
-      providerNodeId: z15.string()
+var DeviceListSchema = z17.array(DeviceSchema);
+var BindingsSchema2 = z17.looseObject({
+  entries: z17.array(
+    z17.looseObject({
+      capName: z17.string(),
+      kind: z17.string(),
+      providerAddonId: z17.string(),
+      providerNodeId: z17.string()
     })
   )
 });
-var StatusAggregateSchema = z15.record(z15.string(), z15.unknown());
-var DegradationSchema = z15.looseObject({
-  stage: z15.string(),
-  reason: z15.string(),
-  elapsedMs: z15.number().optional()
+var StatusAggregateSchema = z17.record(z17.string(), z17.unknown());
+var DegradationSchema = z17.looseObject({
+  stage: z17.string(),
+  reason: z17.string(),
+  elapsedMs: z17.number().optional()
 });
-var CameraStatusSchema = z15.looseObject({
-  deviceId: z15.number(),
-  assignment: z15.looseObject({
-    detectionNodeId: z15.string().nullable(),
-    decoderNodeId: z15.string().nullable(),
-    sourceNodeId: z15.string().nullable(),
+var CameraStatusSchema = z17.looseObject({
+  deviceId: z17.number(),
+  assignment: z17.looseObject({
+    detectionNodeId: z17.string().nullable(),
+    decoderNodeId: z17.string().nullable(),
+    sourceNodeId: z17.string().nullable(),
     /** Why a stage sits where it does; `armed:on-motion` means idle by design. */
-    reasons: z15.record(z15.string(), z15.string().optional()).optional()
+    reasons: z17.record(z17.string(), z17.string().optional()).optional()
   }),
-  broker: z15.looseObject({
-    profiles: z15.array(
-      z15.looseObject({
-        profile: z15.string(),
-        status: z15.string(),
-        subscribers: z15.number()
+  broker: z17.looseObject({
+    profiles: z17.array(
+      z17.looseObject({
+        profile: z17.string(),
+        status: z17.string(),
+        subscribers: z17.number()
       })
     )
   }).nullable(),
-  detection: z15.looseObject({
-    nodeId: z15.string(),
-    phase: z15.string(),
-    actualFps: z15.number(),
-    configuredFps: z15.number(),
-    provisioning: z15.looseObject({
-      state: z15.string(),
-      error: z15.string().optional()
+  detection: z17.looseObject({
+    nodeId: z17.string(),
+    phase: z17.string(),
+    actualFps: z17.number(),
+    configuredFps: z17.number(),
+    provisioning: z17.looseObject({
+      state: z17.string(),
+      error: z17.string().optional()
     })
   }).nullable(),
-  recording: z15.looseObject({
-    mode: z15.string(),
-    active: z15.boolean(),
-    storageBytes: z15.number()
+  recording: z17.looseObject({
+    mode: z17.string(),
+    active: z17.boolean(),
+    storageBytes: z17.number()
   }).nullable(),
-  switchedOff: z15.array(z15.string()),
-  degraded: z15.array(DegradationSchema),
-  fetchedAt: z15.number()
+  switchedOff: z17.array(z17.string()),
+  degraded: z17.array(DegradationSchema),
+  fetchedAt: z17.number()
 });
-var CameraStatusListSchema = z15.array(CameraStatusSchema);
-var ObjectEventSchema = z15.looseObject({
-  id: z15.number(),
-  timestamp: z15.number(),
-  className: z15.string().optional(),
-  trackId: z15.string().optional()
+var CameraStatusListSchema = z17.array(CameraStatusSchema);
+var ObjectEventSchema = z17.looseObject({
+  id: z17.number(),
+  timestamp: z17.number(),
+  className: z17.string().optional(),
+  trackId: z17.string().optional()
 });
-var ObjectEventsSchema2 = z15.array(ObjectEventSchema);
+var ObjectEventsSchema2 = z17.array(ObjectEventSchema);
 var BINDING_LIMIT = 40;
 var EVENT_LIMIT = 5;
 var UNHEALTHY_LIMIT = 50;
@@ -4394,9 +4890,9 @@ function freshness(aggregate, now) {
   const fetched = [];
   let changed = null;
   for (const [capName, value] of Object.entries(aggregate)) {
-    const parsed = z15.looseObject({
-      lastFetchedAt: z15.number().optional(),
-      lastChangedAt: z15.number().optional()
+    const parsed = z17.looseObject({
+      lastFetchedAt: z17.number().optional(),
+      lastChangedAt: z17.number().optional()
     }).safeParse(value);
     if (!parsed.success) continue;
     const at = parsed.data.lastFetchedAt;
@@ -4647,26 +5143,26 @@ async function opsUnhealthyDevices(ctx) {
 }
 
 // src/mcp/ops-logs.ts
-import { z as z16 } from "zod";
-var LevelSchema = z16.enum(["debug", "info", "warn", "error"]);
-var LogEntrySchema = z16.looseObject({
-  timestamp: z16.string(),
-  level: z16.string(),
-  scope: z16.string().optional(),
-  message: z16.string(),
-  tags: z16.record(z16.string(), z16.string().optional()).optional(),
-  meta: z16.record(z16.string(), z16.unknown()).optional()
+import { z as z18 } from "zod";
+var LevelSchema = z18.enum(["debug", "info", "warn", "error"]);
+var LogEntrySchema = z18.looseObject({
+  timestamp: z18.string(),
+  level: z18.string(),
+  scope: z18.string().optional(),
+  message: z18.string(),
+  tags: z18.record(z18.string(), z18.string().optional()).optional(),
+  meta: z18.record(z18.string(), z18.unknown()).optional()
 });
-var LogPageSchema = z16.looseObject({
-  entries: z16.array(LogEntrySchema),
-  done: z16.boolean(),
-  source: z16.string()
+var LogPageSchema = z18.looseObject({
+  entries: z18.array(LogEntrySchema),
+  done: z18.boolean(),
+  source: z18.string()
 });
-var LogSourcesSchema = z16.array(
-  z16.looseObject({
-    addonId: z16.string(),
-    readable: z16.boolean(),
-    isDefault: z16.boolean()
+var LogSourcesSchema = z18.array(
+  z18.looseObject({
+    addonId: z18.string(),
+    readable: z18.boolean(),
+    isDefault: z18.boolean()
   })
 );
 var RING_SOURCE = "ring";
@@ -4881,37 +5377,37 @@ async function opsLogs(ctx, args, now = Date.now()) {
 }
 
 // src/mcp/ops-status.ts
-import { z as z17 } from "zod";
-var TopologyNodeSchema = z17.looseObject({
-  id: z17.string(),
-  name: z17.string().optional(),
-  platform: z17.string().optional(),
-  isHub: z17.boolean().optional(),
-  isOnline: z17.boolean(),
-  addons: z17.array(z17.looseObject({ capabilities: z17.array(z17.string()) })).optional(),
+import { z as z19 } from "zod";
+var TopologyNodeSchema = z19.looseObject({
+  id: z19.string(),
+  name: z19.string().optional(),
+  platform: z19.string().optional(),
+  isHub: z19.boolean().optional(),
+  isOnline: z19.boolean(),
+  addons: z19.array(z19.looseObject({ capabilities: z19.array(z19.string()) })).optional(),
   /** Agents report it; the hub does not. Absent means "not claimed". */
-  capabilitiesRegistered: z17.boolean().optional()
+  capabilitiesRegistered: z19.boolean().optional()
 });
-var TopologySchema = z17.array(TopologyNodeSchema);
-var ServerStatusSchema = z17.looseObject({
-  runningVersion: z17.string(),
-  restartRequired: z17.boolean().optional(),
-  updateAvailable: z17.boolean().optional(),
-  updateState: z17.string().optional()
+var TopologySchema = z19.array(TopologyNodeSchema);
+var ServerStatusSchema = z19.looseObject({
+  runningVersion: z19.string(),
+  restartRequired: z19.boolean().optional(),
+  updateAvailable: z19.boolean().optional(),
+  updateState: z19.string().optional()
 });
-var AlertSchema = z17.looseObject({
-  severity: z17.string(),
-  title: z17.string(),
-  message: z17.string().optional(),
-  status: z17.string()
+var AlertSchema = z19.looseObject({
+  severity: z19.string(),
+  title: z19.string(),
+  message: z19.string().optional(),
+  status: z19.string()
 });
-var AlertsSchema = z17.array(AlertSchema);
-var AddonUpdateSchema = z17.looseObject({
-  name: z17.string(),
-  currentVersion: z17.string(),
-  latestVersion: z17.string()
+var AlertsSchema = z19.array(AlertSchema);
+var AddonUpdateSchema = z19.looseObject({
+  name: z19.string(),
+  currentVersion: z19.string(),
+  latestVersion: z19.string()
 });
-var AddonUpdatesSchema = z17.array(AddonUpdateSchema);
+var AddonUpdatesSchema = z19.array(AddonUpdateSchema);
 var NODE_LIMIT2 = 40;
 var ALERT_LIMIT = 10;
 var UPDATE_LIMIT = 20;
@@ -5044,65 +5540,65 @@ async function opsStatus(ctx) {
 import {
   runGated as runGated3
 } from "@camstack/develop";
-import { z as z23 } from "zod";
+import { z as z25 } from "zod";
 
 // src/mcp/ops-update-model.ts
-import { z as z18 } from "zod";
-var ImageContractShape = z18.looseObject({
-  state: z18.enum(["in-sync", "behind-patch", "behind-series", "ahead", "unknown"]),
-  seedVersion: z18.string().nullable(),
-  contractVersion: z18.string().nullable(),
-  message: z18.string().optional()
+import { z as z20 } from "zod";
+var ImageContractShape = z20.looseObject({
+  state: z20.enum(["in-sync", "behind-patch", "behind-series", "ahead", "unknown"]),
+  seedVersion: z20.string().nullable(),
+  contractVersion: z20.string().nullable(),
+  message: z20.string().optional()
 });
-var WrapperShape = z18.looseObject({
-  kind: z18.enum(["docker", "electron", "native", "contradictory", "unknown"]),
-  currentVersion: z18.string().nullable().optional()
+var WrapperShape = z20.looseObject({
+  kind: z20.enum(["docker", "electron", "native", "contradictory", "unknown"]),
+  currentVersion: z20.string().nullable().optional()
 });
-var ServerStatusShape2 = z18.looseObject({
-  runningVersion: z18.string().nullable(),
-  installedVersion: z18.string().nullable().optional(),
-  latestVersion: z18.string().nullable().optional(),
-  pendingVersion: z18.string().nullable().optional(),
-  restartRequired: z18.boolean().optional(),
-  updateAvailable: z18.boolean().optional(),
-  updateState: z18.string().optional(),
-  lastCheckedAtMs: z18.number().nullable().optional(),
-  rolledBack: z18.looseObject({
-    fromVersion: z18.string(),
-    toVersion: z18.string().nullable(),
-    reason: z18.string()
+var ServerStatusShape2 = z20.looseObject({
+  runningVersion: z20.string().nullable(),
+  installedVersion: z20.string().nullable().optional(),
+  latestVersion: z20.string().nullable().optional(),
+  pendingVersion: z20.string().nullable().optional(),
+  restartRequired: z20.boolean().optional(),
+  updateAvailable: z20.boolean().optional(),
+  updateState: z20.string().optional(),
+  lastCheckedAtMs: z20.number().nullable().optional(),
+  rolledBack: z20.looseObject({
+    fromVersion: z20.string(),
+    toVersion: z20.string().nullable(),
+    reason: z20.string()
   }).nullable().optional(),
   imageContract: ImageContractShape.optional(),
   wrapper: WrapperShape.optional()
 });
-var AddonUpdateShape = z18.looseObject({
-  name: z18.string(),
-  currentVersion: z18.string(),
-  latestVersion: z18.string(),
-  category: z18.enum(["addon", "core"]),
-  requiresRestart: z18.boolean().optional(),
-  isSystem: z18.boolean()
+var AddonUpdateShape = z20.looseObject({
+  name: z20.string(),
+  currentVersion: z20.string(),
+  latestVersion: z20.string(),
+  category: z20.enum(["addon", "core"]),
+  requiresRestart: z20.boolean().optional(),
+  isSystem: z20.boolean()
 });
-var InstallationsShape2 = z18.looseObject({
-  installations: z18.array(
-    z18.looseObject({
-      packageName: z18.string(),
-      nodeId: z18.string(),
-      isHub: z18.boolean(),
-      isOnline: z18.boolean(),
-      version: z18.string().nullable(),
-      onHub: z18.boolean().optional()
+var InstallationsShape2 = z20.looseObject({
+  installations: z20.array(
+    z20.looseObject({
+      packageName: z20.string(),
+      nodeId: z20.string(),
+      isHub: z20.boolean(),
+      isOnline: z20.boolean(),
+      version: z20.string().nullable(),
+      onHub: z20.boolean().optional()
     })
   ),
-  unreachable: z18.array(z18.looseObject({ nodeId: z18.string(), error: z18.string() }))
+  unreachable: z20.array(z20.looseObject({ nodeId: z20.string(), error: z20.string() }))
 });
-var ServerActionShape = z18.looseObject({
-  accepted: z18.boolean().optional(),
-  outcome: z18.enum(["staged", "restart-scheduled", "already-current", "refused", "failed"]).optional(),
-  reason: z18.string().nullable().optional(),
-  error: z18.string().nullable().optional(),
-  message: z18.string().optional(),
-  blockers: z18.array(z18.looseObject({ addonId: z18.string(), reason: z18.string() })).optional()
+var ServerActionShape = z20.looseObject({
+  accepted: z20.boolean().optional(),
+  outcome: z20.enum(["staged", "restart-scheduled", "already-current", "refused", "failed"]).optional(),
+  reason: z20.string().nullable().optional(),
+  error: z20.string().nullable().optional(),
+  message: z20.string().optional(),
+  blockers: z20.array(z20.looseObject({ addonId: z20.string(), reason: z20.string() })).optional()
 });
 function statusInput(node) {
   return node.isHub === true ? void 0 : { nodeId: node.id };
@@ -5221,8 +5717,8 @@ function addonDrift(installations) {
 import { execFile } from "child_process";
 
 // src/mcp/setup-tools.ts
-import { text as text10 } from "@camstack/develop";
-import { z as z22 } from "zod";
+import { text as text11 } from "@camstack/develop";
+import { z as z24 } from "zod";
 
 // src/mcp/setup-hubs.ts
 import * as https from "https";
@@ -5235,13 +5731,13 @@ import {
   normalizeHubAddress,
   resolveHubTls
 } from "@camstack/develop";
-import { z as z21 } from "zod";
+import { z as z23 } from "zod";
 
 // src/mcp/setup-install.ts
-import { z as z20 } from "zod";
+import { z as z22 } from "zod";
 
 // src/mcp/setup-install-rules.ts
-import { z as z19 } from "zod";
+import { z as z21 } from "zod";
 var HOST_KINDS = [
   "docker-compose",
   "docker",
@@ -5249,24 +5745,24 @@ var HOST_KINDS = [
   "proxmox-lxc",
   "macos-desktop"
 ];
-var HostKindSchema = z19.enum(HOST_KINDS);
+var HostKindSchema = z21.enum(HOST_KINDS);
 var ROLES = ["hub", "agent"];
-var RoleSchema = z19.enum(ROLES);
+var RoleSchema = z21.enum(ROLES);
 var ACCELERATORS = ["intel", "amd", "coral", "apple", "cpu"];
-var AcceleratorSchema = z19.enum(ACCELERATORS);
-var InstallPathsSchema = z19.object({
-  data: z19.string().min(1),
-  recordings: z19.string().min(1),
-  config: z19.string().min(1).optional(),
-  backups: z19.string().min(1).optional()
+var AcceleratorSchema = z21.enum(ACCELERATORS);
+var InstallPathsSchema = z21.object({
+  data: z21.string().min(1),
+  recordings: z21.string().min(1),
+  config: z21.string().min(1).optional(),
+  backups: z21.string().min(1).optional()
 });
-var InstallGuideInputSchema = z19.object({
+var InstallGuideInputSchema = z21.object({
   hostKind: HostKindSchema.optional(),
   role: RoleSchema.optional(),
   accelerator: AcceleratorSchema.optional(),
   paths: InstallPathsSchema.optional(),
   /** Agents only: the hub the agent should dial (host or IP). */
-  hubAddress: z19.string().min(1).optional()
+  hubAddress: z21.string().min(1).optional()
 });
 var RAW = "https://raw.githubusercontent.com/camstack";
 var TEMPLATE_URLS = {
@@ -5405,20 +5901,20 @@ function readService(body) {
     if (raw.trim() === "" || raw.trim().startsWith("#")) continue;
     const line = stripComment(raw);
     const indent = line.length - line.trimStart().length;
-    const text14 = line.trim();
+    const text15 = line.trim();
     if (indent === 4) {
       sub = null;
-      const m = /^([A-Za-z_]+):\s*(.*)$/.exec(text14);
+      const m = /^([A-Za-z_]+):\s*(.*)$/.exec(text15);
       if (m === null) continue;
       key = m[1] ?? null;
       if (key !== null && (m[2] ?? "") !== "") fields.scalars.set(key, unquote(m[2] ?? ""));
     } else if (indent === 6 && key !== null) {
-      if (text14.startsWith("- ")) {
+      if (text15.startsWith("- ")) {
         const list = fields.lists.get(key) ?? [];
-        list.push(unquote(text14.slice(2)));
+        list.push(unquote(text15.slice(2)));
         fields.lists.set(key, list);
       } else {
-        const m = /^([A-Za-z_-]+):\s*(.*)$/.exec(text14);
+        const m = /^([A-Za-z_-]+):\s*(.*)$/.exec(text15);
         if (m === null) continue;
         sub = m[1] ?? null;
         const map = fields.maps.get(key) ?? /* @__PURE__ */ new Map();
@@ -5426,7 +5922,7 @@ function readService(body) {
         fields.maps.set(key, map);
       }
     } else if (indent === 8 && key !== null && sub !== null) {
-      const m = /^([A-Za-z_-]+):\s*(.*)$/.exec(text14);
+      const m = /^([A-Za-z_-]+):\s*(.*)$/.exec(text15);
       if (m === null) continue;
       const map = fields.maps.get(`${key}.${sub}`) ?? /* @__PURE__ */ new Map();
       map.set(m[1] ?? "", unquote(m[2] ?? ""));
@@ -5526,9 +6022,9 @@ async function fetchText(url, fetchFn) {
     return { ok: false, failure: { status: "fetch-failed", url, error } };
   }
 }
-var ReleaseSchema = z20.object({
-  tag_name: z20.string(),
-  assets: z20.array(z20.object({ name: z20.string(), browser_download_url: z20.string() }))
+var ReleaseSchema = z22.object({
+  tag_name: z22.string(),
+  assets: z22.array(z22.object({ name: z22.string(), browser_download_url: z22.string() }))
 });
 var DMG = /^CamStack-[0-9][0-9A-Za-z.-]*-(arm64|x64)\.dmg$/;
 function acceleratorEdits(accelerator, role) {
@@ -5819,15 +6315,15 @@ async function connectTool(server, deps) {
     next: session === null ? LOGIN(url) : "a session exists: the ops tools can use it"
   };
 }
-var DiscoveredAgentsSchema = z21.object({
-  agents: z21.array(
-    z21.object({
-      nodeId: z21.string(),
-      host: z21.string(),
-      port: z21.number(),
-      version: z21.string().nullable(),
-      name: z21.string().nullable(),
-      state: z21.enum(["unpaired", "pending", "paired"])
+var DiscoveredAgentsSchema = z23.object({
+  agents: z23.array(
+    z23.object({
+      nodeId: z23.string(),
+      host: z23.string(),
+      port: z23.number(),
+      version: z23.string().nullable(),
+      name: z23.string().nullable(),
+      state: z23.enum(["unpaired", "pending", "paired"])
     })
   )
 });
@@ -5874,7 +6370,7 @@ async function addNodeTool(input, ctx) {
 var SUPPORTED_HOST_KINDS = HOST_KINDS;
 var REGISTRY2 = "https://registry.npmjs.org";
 var REGISTRY_TIMEOUT_MS2 = 5e3;
-var RegistryLatestSchema = z22.object({ version: z22.string() });
+var RegistryLatestSchema = z24.object({ version: z24.string() });
 async function latestOnNpm(name, fetchFn) {
   const url = `${REGISTRY2}/${name.replace("/", "%2f")}/latest`;
   try {
@@ -5908,7 +6404,7 @@ function registerSetupTools(server, ctx, deps = {}) {
     "setup_about",
     "Versions of the camstack CLI (installed and latest on npm), the latest @camstack/server on npm, and the host kinds CamStack supports. Needs no hub and no login.",
     {},
-    async () => text10(await about(ctx))
+    async () => text11(await about(ctx))
   );
   server.tool(
     "setup_install_guide",
@@ -5918,21 +6414,21 @@ function registerSetupTools(server, ctx, deps = {}) {
       role: RoleSchema.optional(),
       accelerator: AcceleratorSchema.optional(),
       paths: InstallPathsSchema.optional(),
-      hubAddress: z22.string().min(1).optional().describe("Agents only: the hub to dial.")
+      hubAddress: z24.string().min(1).optional().describe("Agents only: the hub to dial.")
     },
-    async (input) => text10(await installGuide(input, ctx.fetch))
+    async (input) => text11(await installGuide(input, ctx.fetch))
   );
   server.tool(
     "setup_discover_hubs",
     "Find CamStack hubs on the local network (mDNS) plus the hubs this machine already knows, with host, port, name and version. Needs no login.",
-    { timeoutMs: z22.number().int().min(200).max(15e3).optional() },
-    async ({ timeoutMs }) => text10(await discoverHubsTool(timeoutMs, deps))
+    { timeoutMs: z24.number().int().min(200).max(15e3).optional() },
+    async ({ timeoutMs }) => text11(await discoverHubsTool(timeoutMs, deps))
   );
   server.tool(
     "setup_connect",
     "Check that a hub answers on https://<server>:4443/health, whether its CA is already pinned for TLS, and whether a `camstack login` session exists. Never takes a password: when there is no session it says to run `camstack login <server>` in a terminal.",
-    { server: z22.string().min(1) },
-    async ({ server: address }) => text10(await connectTool(address, deps))
+    { server: z24.string().min(1) },
+    async ({ server: address }) => text11(await connectTool(address, deps))
   );
   server.tool(
     "setup_add_node",
@@ -5941,9 +6437,9 @@ function registerSetupTools(server, ctx, deps = {}) {
       hostKind: HostKindSchema.optional(),
       accelerator: AcceleratorSchema.optional(),
       paths: InstallPathsSchema.optional(),
-      hubAddress: z22.string().min(1).optional()
+      hubAddress: z24.string().min(1).optional()
     },
-    async (input) => text10(await addNodeTool(input, ctx))
+    async (input) => text11(await addNodeTool(input, ctx))
   );
 }
 
@@ -6053,7 +6549,7 @@ async function readPlan(client, args, ctx, deps) {
       wrapper: wrapperVerdict(status.value)
     });
   }
-  const updates = args.addons === false ? null : await readQuery(client, "addons.listUpdates", {}, z23.array(AddonUpdateShape));
+  const updates = args.addons === false ? null : await readQuery(client, "addons.listUpdates", {}, z25.array(AddonUpdateShape));
   const cli = args.cli === false ? null : await cliVerdict(ctx.cliVersion, ctx.fetch, deps.entryPath ?? process.argv[1] ?? "");
   const hub = plans.find((p) => p.node.isHub === true) ?? null;
   return {
@@ -6369,14 +6865,14 @@ async function opsUpdateApply(ctx, args, confirmToken, deps = {}) {
 }
 
 // src/mcp/ops-update-check.ts
-import { z as z24 } from "zod";
+import { z as z26 } from "zod";
 var ADDON_LIMIT = 30;
 async function opsUpdateCheck(ctx, deps = {}) {
   return withAdminHub(ctx, async ({ client, server }) => {
     const unavailable = {};
     const [topology, updates, installs, cli] = await Promise.all([
       readTopology(client),
-      readQuery(client, "addons.listUpdates", {}, z24.array(AddonUpdateShape)),
+      readQuery(client, "addons.listUpdates", {}, z26.array(AddonUpdateShape)),
       readInstallations(client),
       cliVerdict(ctx.cliVersion, ctx.fetch, deps.entryPath ?? process.argv[1] ?? "")
     ]);
@@ -6494,40 +6990,40 @@ function registerOpsTools(server, ctx) {
     "ops_whoami",
     "Which hub this MCP talks to and as whom, from the `camstack login` session (no network call). If there is no session, says to run `camstack login <host>` in a terminal.",
     {},
-    async () => text11(await whoami(ctx))
+    async () => text12(await whoami(ctx))
   );
   server.tool(
     "ops_status",
     'Cluster summary: every node (online, platform, server version, capability count, "online-but-capless" flag), the active alerts and the addons with an update. A part the hub did not answer is null with its reason in `unavailable`, never zero. Node list and updates need an admin `camstack login`.',
     {},
-    async () => text11(await opsStatus(ctx))
+    async () => text12(await opsStatus(ctx))
   );
   server.tool(
     "ops_device",
     "One device: online state, provider addon and node, bound capabilities, runtime-state age and, for a camera, its pipeline, recording state, the functions an operator switched off (not faults) and its latest object events.",
-    { deviceId: z25.number().int() },
-    async ({ deviceId }) => text11(await opsDevice(ctx, deviceId))
+    { deviceId: z27.number().int() },
+    async ({ deviceId }) => text12(await opsDevice(ctx, deviceId))
   );
   server.tool(
     "ops_unhealthy_devices",
     "Every enabled device that is unhealthy, each with a typed reason (offline, detection-provisioning-failed, detection-not-assigned, recording-inactive). A function an operator switched off is never listed; a camera whose status could not be fully read is listed under `unknown`.",
     {},
-    async () => text11(await opsUnhealthyDevices(ctx))
+    async () => text12(await opsUnhealthyDevices(ctx))
   );
   server.tool(
     "ops_logs",
     "Hub logs scoped by deviceId, addon, node, level, window and free text, grouped and deduplicated with counts. Says which tier answered (ring = recent in-RAM; persisted = the default log destination). With `around` (a track or event id) returns `contextLines` lines on each side of its first mention. Needs an admin `camstack login`.",
     {
-      deviceId: z25.number().int().optional(),
-      addonId: z25.string().optional(),
-      nodeId: z25.string().optional(),
-      level: z25.enum(["debug", "info", "warn", "error"]).optional(),
-      windowMinutes: z25.number().int().min(1).max(1440).optional(),
-      text: z25.string().max(200).optional(),
-      around: z25.string().max(200).optional(),
-      contextLines: z25.number().int().min(1).max(50).optional()
+      deviceId: z27.number().int().optional(),
+      addonId: z27.string().optional(),
+      nodeId: z27.string().optional(),
+      level: z27.enum(["debug", "info", "warn", "error"]).optional(),
+      windowMinutes: z27.number().int().min(1).max(1440).optional(),
+      text: z27.string().max(200).optional(),
+      around: z27.string().max(200).optional(),
+      contextLines: z27.number().int().min(1).max(50).optional()
     },
-    async (args) => text11(
+    async (args) => text12(
       await opsLogs(ctx, {
         ...args.deviceId !== void 0 ? { deviceId: args.deviceId } : {},
         ...args.addonId ? { addonId: args.addonId } : {},
@@ -6544,14 +7040,14 @@ function registerOpsTools(server, ctx) {
     "ops_events",
     "Find tracks (and, for one camera, object events) by camera, class, zone, time window and free text. Each result carries an admin-UI link and a viewer link built on the hub address flagged for app connections.",
     {
-      deviceId: z25.number().int().optional(),
-      className: z25.string().optional(),
-      zone: z25.string().optional(),
-      text: z25.string().max(200).optional(),
-      windowMinutes: z25.number().int().min(1).max(10080).optional(),
-      limit: z25.number().int().min(1).max(50).optional()
+      deviceId: z27.number().int().optional(),
+      className: z27.string().optional(),
+      zone: z27.string().optional(),
+      text: z27.string().max(200).optional(),
+      windowMinutes: z27.number().int().min(1).max(10080).optional(),
+      limit: z27.number().int().min(1).max(50).optional()
     },
-    async (args) => text11(
+    async (args) => text12(
       await opsEvents(ctx, {
         ...args.deviceId !== void 0 ? { deviceId: args.deviceId } : {},
         ...args.className ? { className: args.className } : {},
@@ -6565,31 +7061,31 @@ function registerOpsTools(server, ctx) {
   server.tool(
     "ops_track",
     "One track with its media audit: best shot, keyframes, every missing media kind with the reason the track recorded for it, and the audit findings. Links to the admin UI and the viewer.",
-    { deviceId: z25.number().int(), trackId: z25.string().min(1) },
-    async ({ deviceId, trackId }) => text11(await opsTrack(ctx, { deviceId, trackId }))
+    { deviceId: z27.number().int(), trackId: z27.string().min(1) },
+    async ({ deviceId, trackId }) => text12(await opsTrack(ctx, { deviceId, trackId }))
   );
   server.tool(
     "ops_accelerators",
     'Per node: the inference devices it has, the Auto-tune hardware class the node maps to, and whether the measured detector-latency table has a row for that class and accelerator. A node that could not be read is null with a reason, never "no accelerator". Needs an admin `camstack login`.',
     {},
-    async () => text11(await opsAccelerators(ctx))
+    async () => text12(await opsAccelerators(ctx))
   );
   server.tool(
     "ops_update_check",
     'Read-only update report for the whole cluster. Every node from the topology: running vs installed vs latest @camstack/server, restartRequired / updateState / rolledBack, the wrapper (Docker image / desktop app) verdict, and whether its addon versions match the hub; the hub\'s addon updates; the viewer (not exposed by any API, said so); and this CLI/MCP against npm. A node that cannot be read is null with a reason, never "up to date". Needs an admin `camstack login`.',
     {},
-    async () => text11(await opsUpdateCheck(ctx))
+    async () => text12(await opsUpdateCheck(ctx))
   );
   server.tool(
     UPDATE_APPLY_TOOL,
     "Bring the cluster up to date, verified step by step: hub server closure, wait until the hub runs it, then each online agent, then addons (agents follow by reconciliation, verified), then this CLI last. Two steps: call without confirm_token for a preview (order, versions, wrapper instructions, timeouts) and a one-shot token, then again with the SAME arguments and that token. A failed step stops the chain and names the node. Wrapper (image/app) updates are only reported with instructions. Needs an admin `camstack login`.",
     {
-      version: z25.string().min(1).optional().describe("Server target; default = the hub's latest."),
-      addons: z25.boolean().optional().describe("Update addons too (default true)."),
-      cli: z25.boolean().optional().describe("Update this CLI last (default true)."),
-      confirm_token: z25.string().optional()
+      version: z27.string().min(1).optional().describe("Server target; default = the hub's latest."),
+      addons: z27.boolean().optional().describe("Update addons too (default true)."),
+      cli: z27.boolean().optional().describe("Update this CLI last (default true)."),
+      confirm_token: z27.string().optional()
     },
-    async ({ version, addons, cli, confirm_token }) => text11(
+    async ({ version, addons, cli, confirm_token }) => text12(
       await opsUpdateApply(
         ctx,
         {
@@ -6604,7 +7100,7 @@ function registerOpsTools(server, ctx) {
 }
 
 // src/mcp/configure-tools.ts
-var CurrentDeviceSchema = z26.object({ name: z26.string() }).nullable();
+var CurrentDeviceSchema = z28.object({ name: z28.string() }).nullable();
 var RENAME_DEVICE_TOOL = "configure_rename_device";
 function renameDeviceSpec(client) {
   return {
@@ -6666,11 +7162,11 @@ function registerConfigureTools(server, ctx) {
     RENAME_DEVICE_TOOL,
     "Rename a device. Two steps: call without confirm_token for a preview and a one-shot token, then call again with the SAME arguments and that token to apply. Needs an admin `camstack login` session.",
     {
-      deviceId: z26.number().int(),
-      name: z26.string().min(1),
-      confirm_token: z26.string().optional()
+      deviceId: z28.number().int(),
+      name: z28.string().min(1),
+      confirm_token: z28.string().optional()
     },
-    async ({ deviceId, name, confirm_token }) => text12(await renameDevice(ctx, { deviceId, name }, confirm_token))
+    async ({ deviceId, name, confirm_token }) => text13(await renameDevice(ctx, { deviceId, name }, confirm_token))
   );
   registerAddonTools(server, ctx);
   registerCameraTools(server, ctx);
@@ -6679,11 +7175,11 @@ function registerConfigureTools(server, ctx) {
 }
 
 // src/mcp/support-tools.ts
-import { text as text13 } from "@camstack/develop";
-import { z as z31 } from "zod";
+import { text as text14 } from "@camstack/develop";
+import { z as z33 } from "zod";
 
 // src/mcp/support-accelerator.ts
-import { z as z27 } from "zod";
+import { z as z29 } from "zod";
 var EXPECTED_ACCELERATORS = [
   "intel-igpu",
   "intel-npu",
@@ -6695,23 +7191,23 @@ var EXPECTED_ACCELERATORS = [
   "apple-ane",
   "nvidia"
 ];
-var ExpectedAcceleratorSchema = z27.enum(EXPECTED_ACCELERATORS);
-var HardwareSchema2 = z27.looseObject({
-  platform: z27.enum(["darwin", "linux", "win32"]),
-  arch: z27.enum(["arm64", "x64"]),
-  cpuModel: z27.string(),
-  gpu: z27.looseObject({ type: z27.string(), name: z27.string() }).nullable(),
-  npu: z27.looseObject({ type: z27.string() }).nullable()
+var ExpectedAcceleratorSchema = z29.enum(EXPECTED_ACCELERATORS);
+var HardwareSchema2 = z29.looseObject({
+  platform: z29.enum(["darwin", "linux", "win32"]),
+  arch: z29.enum(["arm64", "x64"]),
+  cpuModel: z29.string(),
+  gpu: z29.looseObject({ type: z29.string(), name: z29.string() }).nullable(),
+  npu: z29.looseObject({ type: z29.string() }).nullable()
 });
-var InferenceDevicesSchema2 = z27.looseObject({
-  reachable: z27.boolean(),
-  devices: z27.array(
-    z27.looseObject({
-      key: z27.string(),
-      available: z27.boolean(),
-      presence: z27.enum(["present", "absent", "unknown"]).optional(),
-      enabled: z27.boolean(),
-      exclusion: z27.string().nullable()
+var InferenceDevicesSchema2 = z29.looseObject({
+  reachable: z29.boolean(),
+  devices: z29.array(
+    z29.looseObject({
+      key: z29.string(),
+      available: z29.boolean(),
+      presence: z29.enum(["present", "absent", "unknown"]).optional(),
+      enabled: z29.boolean(),
+      exclusion: z29.string().nullable()
     })
   )
 });
@@ -6990,7 +7486,7 @@ async function supportDiagnoseAccelerator(ctx, args) {
 import {
   runGated as runGated5
 } from "@camstack/develop";
-import { z as z28 } from "zod";
+import { z as z30 } from "zod";
 var BENCHMARK_RUN_TOOL = "support_benchmark_run";
 var AUTO_TUNE_MODELS = [
   "yolov9t-320",
@@ -7012,64 +7508,64 @@ var CONTRIBUTE_HOW = [
   "The measured medians belong in the Auto-tune latency table: docs/benchmarks/detector-latency.json and packages/types/src/pipeline/auto-tune/detector-performance.ts, changed together (detector-performance.spec.ts fails until they agree), in the camstack/server repository.",
   'Use support_draft_pr with kind "benchmark", the column ("<hardwareClass>/<accelerator>") and these cells to get the branch plan and the `gh pr create` command.'
 ];
-var HardwareSchema3 = z28.looseObject({
-  platform: z28.enum(["darwin", "linux", "win32"]),
-  arch: z28.enum(["arm64", "x64"]),
-  cpuModel: z28.string(),
-  cpuCores: z28.number(),
-  totalRAM_MB: z28.number(),
-  availableRAM_MB: z28.number(),
-  gpu: z28.looseObject({
-    type: z28.enum(["nvidia", "amd", "intel", "apple"]),
-    name: z28.string()
+var HardwareSchema3 = z30.looseObject({
+  platform: z30.enum(["darwin", "linux", "win32"]),
+  arch: z30.enum(["arm64", "x64"]),
+  cpuModel: z30.string(),
+  cpuCores: z30.number(),
+  totalRAM_MB: z30.number(),
+  availableRAM_MB: z30.number(),
+  gpu: z30.looseObject({
+    type: z30.enum(["nvidia", "amd", "intel", "apple"]),
+    name: z30.string()
   }).nullable(),
-  npu: z28.looseObject({ type: z28.enum(["apple-ane", "intel-npu", "amd-xdna"]) }).nullable()
+  npu: z30.looseObject({ type: z30.enum(["apple-ane", "intel-npu", "amd-xdna"]) }).nullable()
 });
-var InferenceDevicesSchema3 = z28.looseObject({
-  reachable: z28.boolean(),
-  devices: z28.array(
-    z28.looseObject({
-      key: z28.string(),
-      backend: z28.string(),
-      available: z28.boolean(),
-      enabled: z28.boolean()
+var InferenceDevicesSchema3 = z30.looseObject({
+  reachable: z30.boolean(),
+  devices: z30.array(
+    z30.looseObject({
+      key: z30.string(),
+      backend: z30.string(),
+      available: z30.boolean(),
+      enabled: z30.boolean()
     })
   )
 });
-var RunStatusSchema = z28.looseObject({
-  run: z28.looseObject({
-    runId: z28.string(),
-    nodeId: z28.string(),
-    state: z28.string(),
-    endReason: z28.string().nullable().optional(),
-    error: z28.string().nullable().optional()
+var RunStatusSchema = z30.looseObject({
+  run: z30.looseObject({
+    runId: z30.string(),
+    nodeId: z30.string(),
+    state: z30.string(),
+    endReason: z30.string().nullable().optional(),
+    error: z30.string().nullable().optional()
   }).nullable()
 });
-var ModelListSchema = z28.array(
-  z28.looseObject({
-    id: z28.string(),
-    formats: z28.record(z28.string(), z28.looseObject({ downloaded: z28.boolean().optional() })).optional()
+var ModelListSchema = z30.array(
+  z30.looseObject({
+    id: z30.string(),
+    formats: z30.record(z30.string(), z30.looseObject({ downloaded: z30.boolean().optional() })).optional()
   })
 );
-var PipelineTestSchema = z28.looseObject({
-  kind: z28.string().optional(),
-  detections: z28.array(
-    z28.looseObject({
-      debug: z28.looseObject({
-        stepLatencyMs: z28.record(z28.string(), z28.number()).optional()
+var PipelineTestSchema = z30.looseObject({
+  kind: z30.string().optional(),
+  detections: z30.array(
+    z30.looseObject({
+      debug: z30.looseObject({
+        stepLatencyMs: z30.record(z30.string(), z30.number()).optional()
       }).optional()
     })
   ).optional(),
-  discarded: z28.array(z28.unknown()).optional(),
-  debug: z28.looseObject({
-    stepTimings: z28.array(
-      z28.looseObject({
-        source: z28.string().optional(),
-        ms: z28.number().optional()
+  discarded: z30.array(z30.unknown()).optional(),
+  debug: z30.looseObject({
+    stepTimings: z30.array(
+      z30.looseObject({
+        source: z30.string().optional(),
+        ms: z30.number().optional()
       })
     ).optional(),
-    predictMs: z28.number().optional(),
-    totalInferenceMs: z28.number().optional()
+    predictMs: z30.number().optional(),
+    totalInferenceMs: z30.number().optional()
   }).optional()
 });
 var FORMAT_BY_BACKEND = {
@@ -7356,15 +7852,15 @@ async function supportBenchmarkRun(ctx, deps, args, confirmToken) {
   }
   return runGated5(ctx.gate, benchmarkRunSpec(outcome.connection.client, deps), args, confirmToken);
 }
-var ResultsSchema = z28.array(
-  z28.looseObject({
-    nodeId: z28.string(),
-    cell: z28.looseObject({
-      phase: z28.string(),
-      deviceKey: z28.string(),
-      modelId: z28.string(),
-      p50Ms: z28.number().optional(),
-      fps: z28.number().optional()
+var ResultsSchema = z30.array(
+  z30.looseObject({
+    nodeId: z30.string(),
+    cell: z30.looseObject({
+      phase: z30.string(),
+      deviceKey: z30.string(),
+      modelId: z30.string(),
+      p50Ms: z30.number().optional(),
+      fps: z30.number().optional()
     })
   })
 );
@@ -7417,17 +7913,17 @@ async function supportBenchmarkStatus(ctx, args) {
 }
 
 // src/mcp/support-camera.ts
-import { z as z29 } from "zod";
-var DeviceSchema2 = z29.looseObject({
-  id: z29.number(),
-  name: z29.string(),
-  addonId: z29.string().optional(),
-  disabled: z29.boolean().optional(),
-  online: z29.boolean().optional()
+import { z as z31 } from "zod";
+var DeviceSchema2 = z31.looseObject({
+  id: z31.number(),
+  name: z31.string(),
+  addonId: z31.string().optional(),
+  disabled: z31.boolean().optional(),
+  online: z31.boolean().optional()
 }).nullable();
 var GENERIC = /onvif|rtsp/i;
-function words(text14) {
-  return text14.toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length >= 3);
+function words(text15) {
+  return text15.toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length >= 3);
 }
 function isGeneric(parts2) {
   return parts2.some((p) => GENERIC.test(p));
@@ -7624,7 +8120,7 @@ import {
   digestArgs,
   runGated as runGated6
 } from "@camstack/develop";
-import { z as z30 } from "zod";
+import { z as z32 } from "zod";
 
 // src/mcp/support-scrub.ts
 import { redactToolArgs, scrubSecrets } from "@camstack/develop";
@@ -7677,16 +8173,16 @@ var INFERENCE_PACKAGE = "@camstack/addon-pipeline";
 var TITLE_MAX = 140;
 var DIAGNOSIS_MAX = 4e3;
 var DRAFT_KINDS = ["accelerator", "camera", "benchmark", "other"];
-var DraftKindSchema = z30.enum(DRAFT_KINDS);
-var BenchmarkCellsSchema = z30.record(
-  z30.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/),
-  z30.object({ p50Ms: z30.number().positive(), fps: z30.number().positive() })
+var DraftKindSchema = z32.enum(DRAFT_KINDS);
+var BenchmarkCellsSchema = z32.record(
+  z32.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/),
+  z32.object({ p50Ms: z32.number().positive(), fps: z32.number().positive() })
 );
 var PackageNameRe = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
 var GithubRepoRe = /github\.com[:/]([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?(?:[/#?].*)?$/;
 var ShorthandRe = /^(?:github:)?([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/;
-var RegistryDocSchema = z30.looseObject({
-  repository: z30.union([z30.string(), z30.looseObject({ url: z30.string() })]).optional()
+var RegistryDocSchema = z32.looseObject({
+  repository: z32.union([z32.string(), z32.looseObject({ url: z32.string() })]).optional()
 });
 function githubRepoOf(value) {
   const url = GithubRepoRe.exec(value);
@@ -7728,7 +8224,7 @@ async function resolveRepo(ctx, packageName) {
     reason: null
   };
 }
-var ServerStatusSchema2 = z30.looseObject({ runningVersion: z30.string() });
+var ServerStatusSchema2 = z32.looseObject({ runningVersion: z32.string() });
 async function serverVersion(client, nodeId) {
   const status = await readQuery(
     client,
@@ -7930,8 +8426,8 @@ var BENCHMARK_FILES = [
   "docs/benchmarks/detector-latency.json",
   "packages/types/src/pipeline/auto-tune/detector-performance.ts"
 ];
-function slug(text14) {
-  const s = text14.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
+function slug(text15) {
+  const s = text15.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
   return s === "" ? "change" : s;
 }
 function prProblem(args) {
@@ -7994,20 +8490,20 @@ async function supportDraftPr(ctx, args, confirmToken) {
 }
 
 // src/mcp/support-tools.ts
-var ModelId = z31.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/);
+var ModelId = z33.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/);
 var DraftShape = {
   kind: DraftKindSchema,
-  title: z31.string().min(3).max(300),
-  summary: z31.string().min(3).max(4e3),
-  nodeId: z31.string().max(100).optional(),
+  title: z33.string().min(3).max(300),
+  summary: z33.string().min(3).max(4e3),
+  nodeId: z33.string().max(100).optional(),
   expected: ExpectedAcceleratorSchema.optional(),
-  brand: z31.string().max(100).optional(),
-  model: z31.string().max(100).optional(),
-  deviceId: z31.number().int().optional(),
-  packageName: z31.string().max(214).optional(),
-  column: z31.string().max(100).optional(),
+  brand: z33.string().max(100).optional(),
+  model: z33.string().max(100).optional(),
+  deviceId: z33.number().int().optional(),
+  packageName: z33.string().max(214).optional(),
+  column: z33.string().max(100).optional(),
   cells: BenchmarkCellsSchema.optional(),
-  confirm_token: z31.string().optional()
+  confirm_token: z33.string().optional()
 };
 function draftArgs(input) {
   return {
@@ -8028,20 +8524,20 @@ function registerSupportTools(server, ctx, deps = defaultSupportDeps) {
   server.tool(
     "support_benchmark_status",
     "The hub's own node-benchmark state: the active or last run and the per-device latency cells it stored. Read-only. The Auto-tune latency table is filled with support_benchmark_run. Needs an admin `camstack login`.",
-    { nodeId: z31.string().max(100).optional() },
-    async ({ nodeId }) => text13(await supportBenchmarkStatus(ctx, nodeId !== void 0 ? { nodeId } : {}))
+    { nodeId: z33.string().max(100).optional() },
+    async ({ nodeId }) => text14(await supportBenchmarkStatus(ctx, nodeId !== void 0 ? { nodeId } : {}))
   );
   server.tool(
     BENCHMARK_RUN_TOOL,
     "Measure detector latency on a node x device (cold run, then warm median per model, via runPipelineTest) and return it next to the Auto-tune table cell for the same hardware, plus how to contribute it. LOADS THE NODE: the detection pool restarts between models. Pick the node and deviceKey from ops_accelerators. Two steps: call without confirm_token for the plan and a one-shot token, then again with the SAME arguments and that token. Needs an admin `camstack login`.",
     {
-      nodeId: z31.string().min(1).max(100),
-      deviceKey: z31.string().min(1).max(60),
-      models: z31.array(ModelId).min(1).max(MAX_MODELS).optional(),
-      warmRuns: z31.number().int().min(1).max(MAX_WARM_RUNS).optional(),
-      confirm_token: z31.string().optional()
+      nodeId: z33.string().min(1).max(100),
+      deviceKey: z33.string().min(1).max(60),
+      models: z33.array(ModelId).min(1).max(MAX_MODELS).optional(),
+      warmRuns: z33.number().int().min(1).max(MAX_WARM_RUNS).optional(),
+      confirm_token: z33.string().optional()
     },
-    async ({ nodeId, deviceKey, models, warmRuns, confirm_token }) => text13(
+    async ({ nodeId, deviceKey, models, warmRuns, confirm_token }) => text14(
       await supportBenchmarkRun(
         ctx,
         deps,
@@ -8058,18 +8554,18 @@ function registerSupportTools(server, ctx, deps = defaultSupportDeps) {
   server.tool(
     "support_diagnose_accelerator",
     "A node should have an accelerator (Intel iGPU/NPU, AMD WebGPU/VAAPI/NPU, Coral USB/PCIe, Apple Neural Engine, NVIDIA) and the hub does not offer it. Reads what the platform probe saw and what the node's inference runtime offers, and answers ok | misconfigured (with fix steps: passthrough, driver, image tag, opt-in) | unsupported (which addon would need extending) | unknown (a read failed). A Coral is never auto-picked: the answer says how to opt in. Read-only.",
-    { nodeId: z31.string().min(1).max(100), expected: ExpectedAcceleratorSchema },
-    async ({ nodeId, expected }) => text13(await supportDiagnoseAccelerator(ctx, { nodeId, expected }))
+    { nodeId: z33.string().min(1).max(100), expected: ExpectedAcceleratorSchema },
+    async ({ nodeId, expected }) => text14(await supportDiagnoseAccelerator(ctx, { nodeId, expected }))
   );
   server.tool(
     "support_diagnose_camera",
     "A camera brand or model, or an existing device that fails: which provider addons could serve it (installed, then published), and a verdict use-provider | generic-fallback (ONVIF / RTSP) | unsupported | unknown, with the next steps. Give a brand and/or model, or a deviceId. Read-only.",
     {
-      brand: z31.string().max(100).optional(),
-      model: z31.string().max(100).optional(),
-      deviceId: z31.number().int().optional()
+      brand: z33.string().max(100).optional(),
+      model: z33.string().max(100).optional(),
+      deviceId: z33.number().int().optional()
     },
-    async ({ brand, model, deviceId }) => text13(
+    async ({ brand, model, deviceId }) => text14(
       await supportDiagnoseCamera(ctx, {
         ...brand !== void 0 ? { brand } : {},
         ...model !== void 0 ? { model } : {},
@@ -8081,13 +8577,13 @@ function registerSupportTools(server, ctx, deps = defaultSupportDeps) {
     DRAFT_ISSUE_TOOL,
     "Draft a GitHub issue for the public repository that owns the addon (the package's `repository` field; camstack/server when it names none): title, an environment block (server and CLI version, node platform, accelerator or camera facts from the diagnose tools), secrets and private addresses removed. Two steps: the dry run is the full draft and the target; the confirmed call runs YOUR own `gh issue create` (only if `gh auth status` succeeds, otherwise it returns the draft and a ready command). Never uses a token of ours.",
     DraftShape,
-    async (input) => text13(await supportDraftIssue(ctx, deps, draftArgs(input), input.confirm_token))
+    async (input) => text14(await supportDraftIssue(ctx, deps, draftArgs(input), input.confirm_token))
   );
   server.tool(
     DRAFT_PR_TOOL,
     'Plan a pull request for the public repository that owns the addon: branch, files to change, steps and the `gh pr create` command, with a scrubbed body. For kind "benchmark" give column and cells from support_benchmark_run. Two steps like every gated tool; it pushes no code and calls no GitHub API, you run the plan with your own git and gh.',
     DraftShape,
-    async (input) => text13(await supportDraftPr(ctx, draftArgs(input), input.confirm_token))
+    async (input) => text14(await supportDraftPr(ctx, draftArgs(input), input.confirm_token))
   );
 }