camstack 1.2.212 → 1.2.214

package/dist/{server-2GOCBDEY.js → server-TZCZTLBW.js}

@@ -11,13 +11,25 @@ import {
   buildViewerLink,
   capUnitResolver,
   classifyInferenceHardware,
-  findHubs,
+  convertLegacyWhen,
+  countWhenLeaves,
   generateAutomationBlock,
   isReadingQuantity,
   prepareRecipeUnits,
   unitsForQuantity,
   validateRecipeBounds
-} from "./chunk-MLWXP2SI.js";
+} from "./chunk-4Y3CBGOY.js";
+import {
+  IMAGE_TAG_BY_ACCELERATOR,
+  MUST_NOT_OMIT,
+  NO_BARE_LATEST,
+  cliVerdict,
+  isOlder,
+  registerSetupTools,
+  runCommand,
+  text
+} from "./chunk-37A556YF.js";
+import "./chunk-JPGJK5DC.js";
 import "./chunk-LMMQX4CK.js";
 
 // src/mcp/server.ts
@@ -27,14 +39,12 @@ import { MutationGate, tryConnectHub } from "@camstack/develop";
 
 // src/mcp/configure-tools.ts
 import {
-  runGated as runGated4,
-  text as text12
+  runGated as runGated4
 } from "@camstack/develop";
-import { z as z26 } from "zod";
+import { z as z24 } from "zod";
 
 // src/mcp/configure-automations.ts
 import { z as z4 } from "zod";
-import { text } from "@camstack/develop";
 
 // src/mcp/configure-common.ts
 import { runGated } from "@camstack/develop";
@@ -987,7 +997,7 @@ function toActions(actions) {
 function quantityNotes(recipe) {
   const notes = [];
   const walk = (c, path) => {
-    if (c.kind === "condition" && typeof c.value === "number" && c.unit !== void 0) {
+    if (c.kind === "device-is" && typeof c.value === "number" && c.unit !== void 0) {
       notes.push({
         where: `${path} ${c.cap}.${c.fieldPath}`,
         value: c.value,
@@ -997,7 +1007,7 @@ function quantityNotes(recipe) {
     if (c.kind === "not") walk(c.child, path);
     if (c.kind === "all" || c.kind === "any") c.children.forEach((child) => walk(child, path));
   };
-  if (recipe.conditions !== void 0) walk(recipe.conditions, "condition");
+  walk(recipe.when, "condition");
   recipe.actions.forEach((a, i) => {
     if (a.kind !== "cap" || a.args === void 0 || a.argUnits === void 0) return;
     for (const [arg, unit] of Object.entries(a.argUnits)) {
@@ -1085,8 +1095,7 @@ async function interviewAutomation(client, answers) {
   const conditions = answers.conditions ?? [];
   const actions = answers.actions ?? [];
   const draft = {
-    triggers: [outcome.trigger],
-    ...toCondition(conditions) !== void 0 ? { conditions: toCondition(conditions) } : {},
+    when: convertLegacyWhen({ triggers: [outcome.trigger], conditions: toCondition(conditions) }),
     actions: toActions(actions),
     ...answers.cooldownMinutes !== void 0 ? {
       runMode: {
@@ -1184,7 +1193,7 @@ function saveAutomationSpec(client) {
           runsOn: "the hub",
           enabled: args.enabled,
           effect: args.enabled ? "it starts running as soon as it is saved" : "it is saved switched off",
-          triggers: finished.recipe.triggers.length,
+          rows: countWhenLeaves(finished.recipe.when),
           steps: finished.recipe.actions.length,
           quantities: quantityNotes(finished.recipe),
           generatedBytes: code.length
@@ -1217,7 +1226,7 @@ var GATE_HOW = "Two steps: call without confirm_token for a preview and a one-sh
 function registerAutomationTools(server, ctx) {
   server.tool(
     "configure_automation_questionnaire",
-    "Interview for a new automation (a recipe: trigger, conditions, actions). Stateless: send every answer so far in `answers`; it returns the questions still open, with choices read from the hub, or `ready` with a summary and the recipe. A number on a quantity field is { value, unit }. Writes nothing.",
+    "Interview for a new automation (a recipe: ONE `when` tree \u2014 events that start it, states that must hold \u2014 and the actions). Stateless: send every answer so far in `answers`; it returns the questions still open, with choices read from the hub, or `ready` with a summary and the recipe. A number on a quantity field is { value, unit }. Writes nothing.",
     { answers: AutomationAnswersSchema },
     async ({ answers }) => text(await automationQuestionnaire(ctx, answers))
   );
@@ -1235,7 +1244,6 @@ function registerAutomationTools(server, ctx) {
 }
 
 // src/mcp/configure-calibrate.ts
-import { text as text2 } from "@camstack/develop";
 import { z as z5 } from "zod";
 var CALIBRATE_APPLY_TOOL = "configure_calibrate_apply";
 var WINDOW_MS = 24 * 36e5;
@@ -1601,7 +1609,7 @@ function registerCalibrateTools(server, ctx) {
     "configure_calibrate_camera",
     "Read-only calibration report for one camera: recent tracks and their top-score distribution per class, likely false-positive and missed patterns, the current motion and detection settings, zones and pipeline health, and the changes it proposes. Writes nothing.",
     { deviceId: z5.number().int().nonnegative() },
-    async ({ deviceId }) => text2(await calibrateCamera(ctx, { deviceId }))
+    async ({ deviceId }) => text(await calibrateCamera(ctx, { deviceId }))
   );
   server.tool(
     CALIBRATE_APPLY_TOOL,
@@ -1612,13 +1620,12 @@ function registerCalibrateTools(server, ctx) {
       patch: z5.record(z5.string(), z5.union([z5.number(), z5.string(), z5.boolean()])),
       confirm_token: ConfirmTokenSchema
     },
-    async ({ deviceId, cap: cap2, patch, confirm_token }) => text2(await calibrateApply(ctx, { deviceId, cap: cap2, patch }, confirm_token))
+    async ({ deviceId, cap: cap2, patch, confirm_token }) => text(await calibrateApply(ctx, { deviceId, cap: cap2, patch }, confirm_token))
   );
 }
 
 // src/mcp/configure-zones-alarm.ts
 import { randomUUID } from "crypto";
-import { text as text3 } from "@camstack/develop";
 import { z as z6 } from "zod";
 var ZONE_UPSERT_TOOL = "configure_zone_upsert";
 var ALARM_SET_TOOL = "configure_alarm_set";
@@ -1909,7 +1916,7 @@ function registerZonesAlarmTools(server, ctx) {
     "configure_zones",
     "Read the detection zones drawn on one camera (id, name, kind, points, normalised 0..1) and a summary of its motion mask. Writes nothing.",
     { deviceId: z6.number().int().nonnegative() },
-    async ({ deviceId }) => text3(await readZonesTool(ctx, { deviceId }))
+    async ({ deviceId }) => text(await readZonesTool(ctx, { deviceId }))
   );
   server.tool(
     ZONE_UPSERT_TOOL,
@@ -1922,7 +1929,7 @@ function registerZonesAlarmTools(server, ctx) {
       points: z6.array(PointSchema).min(2).max(64),
       confirm_token: ConfirmTokenSchema
     },
-    async ({ deviceId, zoneId, name, kind, points, confirm_token }) => text3(
+    async ({ deviceId, zoneId, name, kind, points, confirm_token }) => text(
       await zoneUpsert(
         ctx,
         {
@@ -1940,7 +1947,7 @@ function registerZonesAlarmTools(server, ctx) {
     "configure_alarm",
     "Read the alarm panels of the hub: state, armed mode, the modes each accepts and whether it needs a PIN. Writes nothing.",
     { deviceId: z6.number().int().nonnegative().optional() },
-    async ({ deviceId }) => text3(await readAlarm(ctx, deviceId !== void 0 ? { deviceId } : {}))
+    async ({ deviceId }) => text(await readAlarm(ctx, deviceId !== void 0 ? { deviceId } : {}))
   );
   server.tool(
     ALARM_SET_TOOL,
@@ -1951,7 +1958,7 @@ function registerZonesAlarmTools(server, ctx) {
       mode: AlarmArmModeSchema.optional(),
       confirm_token: ConfirmTokenSchema
     },
-    async ({ deviceId, action, mode, confirm_token }) => text3(
+    async ({ deviceId, action, mode, confirm_token }) => text(
       await alarmSet(
         ctx,
         { deviceId, action, ...mode !== void 0 ? { mode } : {} },
@@ -1962,7 +1969,6 @@ function registerZonesAlarmTools(server, ctx) {
 }
 
 // src/mcp/configure-network.ts
-import { text as text4 } from "@camstack/develop";
 import { z as z7 } from "zod";
 var REMOTE_ACCESS_SET_TOOL = "configure_remote_access_set";
 var RemoteAddonSchema = z7.enum(["cloudflare-tunnel", "cloudflare-turn", "static-turn"]);
@@ -2146,7 +2152,7 @@ function registerNetworkTools(server, ctx) {
     "configure_remote_access",
     "Read how the hub is reachable from outside: the access status and public endpoint, and the settings of the tunnel and TURN addons. Secret fields are reported as configured true/false, never their value. Writes nothing.",
     {},
-    async () => text4(await readRemoteAccess(ctx))
+    async () => text(await readRemoteAccess(ctx))
   );
   server.tool(
     REMOTE_ACCESS_SET_TOOL,
@@ -2156,12 +2162,11 @@ function registerNetworkTools(server, ctx) {
       patch: z7.record(z7.string(), z7.union([z7.string(), z7.number(), z7.boolean()])),
       confirm_token: ConfirmTokenSchema
     },
-    async ({ addonId, patch, confirm_token }) => text4(await remoteAccessSet(ctx, { addonId, patch }, confirm_token))
+    async ({ addonId, patch, confirm_token }) => text(await remoteAccessSet(ctx, { addonId, patch }, confirm_token))
   );
 }
 
 // src/mcp/configure-exports.ts
-import { text as text5 } from "@camstack/develop";
 import { z as z8 } from "zod";
 var EXPORT_SET_TOOL = "configure_export_set";
 var ProvidersSchema = z8.array(z8.looseObject({ addonId: z8.string() }));
@@ -2324,7 +2329,7 @@ function registerExportTools(server, ctx) {
     "configure_exports",
     "Read the exporters (Alexa, Google Home, Home Assistant, HomeKit): link state, how many devices each shows and which cameras. Pairing codes are never shown. Writes nothing.",
     { deviceId: z8.number().int().nonnegative().optional() },
-    async ({ deviceId }) => text5(await readExports(ctx, deviceId !== void 0 ? { deviceId } : {}))
+    async ({ deviceId }) => text(await readExports(ctx, deviceId !== void 0 ? { deviceId } : {}))
   );
   server.tool(
     EXPORT_SET_TOOL,
@@ -2335,43 +2340,535 @@ function registerExportTools(server, ctx) {
       exposed: z8.boolean(),
       confirm_token: ConfirmTokenSchema
     },
-    async ({ addonId, deviceId, exposed, confirm_token }) => text5(await exportSet(ctx, { addonId, deviceId, exposed }, confirm_token))
+    async ({ addonId, deviceId, exposed, confirm_token }) => text(await exportSet(ctx, { addonId, deviceId, exposed }, confirm_token))
   );
   server.tool(
     "configure_ha_guide",
     "Read-only guide for showing CamStack cameras in Home Assistant, including the HACS route. Needs no hub.",
     {},
-    async () => text5({ status: "ok", guide: HA_GUIDE })
+    async () => text({ status: "ok", guide: HA_GUIDE })
   );
 }
 
-// src/mcp/configure-nc-rules.ts
+// src/mcp/configure-oidc.ts
+import { z as z10 } from "zod";
+
+// src/mcp/configure-oidc-providers.ts
 import { z as z9 } from "zod";
-import { text as text6 } from "@camstack/develop";
+var OidcProviderSchema = z9.enum([
+  "authentik",
+  "pocket-id",
+  "authelia",
+  "keycloak",
+  "zitadel",
+  "kanidm",
+  "google",
+  "microsoft-entra",
+  "auth0",
+  "okta",
+  "generic"
+]);
+var PIECE_QUESTION = {
+  host: "host: the provider host name, with or without https:// (no path)",
+  application_slug: "application_slug: the application slug (authentik) or client name (kanidm)",
+  realm: "realm: the Keycloak realm name",
+  tenant_id: "tenant_id: the Entra directory (tenant) id, a GUID or a verified domain"
+};
+function pieceQuestion(piece) {
+  return PIECE_QUESTION[piece];
+}
+function hostOrigin(host) {
+  const trimmed = host.trim().replace(/\/+$/, "");
+  return /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+}
+var COMMON_STEPS = [
+  "Create the client as an OpenID Connect / OAuth2 web application, authorization-code flow.",
+  "Paste the redirect URI shown below as the ONLY allowed redirect URI.",
+  "Allow the scopes listed below."
+];
+var OIDC_PROVIDERS = {
+  authentik: {
+    label: "authentik",
+    pieces: ["host", "application_slug"],
+    issuerFormat: "https://<host>/application/o/<application_slug>/",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "Admin interface > Applications > Applications > Create with Provider (OAuth2/OpenID)",
+    steps: [
+      "Create an application with an OAuth2/OpenID provider; its slug is the application_slug.",
+      "Set the client type to Public for PKCE without a secret, or Confidential.",
+      "Add the redirect URI below as a Strict redirect URI."
+    ],
+    build: (p) => `${hostOrigin(p.host)}/application/o/${p.application_slug}/`
+  },
+  "pocket-id": {
+    label: "Pocket ID",
+    pieces: ["host"],
+    issuerFormat: "https://<host>",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "Settings > Administration > OIDC Clients > Add OIDC Client",
+    steps: [
+      "Add an OIDC client and paste the redirect URI below as its callback URL.",
+      'Switch on "Public Client" for PKCE without a secret; leave it off for a confidential client.',
+      "Copy the client ID."
+    ],
+    build: (p) => hostOrigin(p.host)
+  },
+  authelia: {
+    label: "Authelia",
+    pieces: ["host"],
+    issuerFormat: "https://<host>",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "configuration.yml > identity_providers.oidc.clients (a file edit, then a restart)",
+    steps: [
+      "Add a client with its redirect URI below and `authorization_policy` of your choice.",
+      "For PKCE without a secret set `public: true` and `require_pkce: true`.",
+      "Set `token_endpoint_auth_method: client_secret_post` for a confidential client."
+    ],
+    build: (p) => hostOrigin(p.host)
+  },
+  keycloak: {
+    label: "Keycloak",
+    pieces: ["host", "realm"],
+    issuerFormat: "https://<host>/realms/<realm>",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "Admin console > the realm > Clients > Create client",
+    steps: [
+      'Client type OpenID Connect; switch "Client authentication" on for confidential, off for public.',
+      'Under Advanced, set "Proof Key for Code Exchange Code Challenge Method" to S256.',
+      "Add the redirect URI below as a valid redirect URI."
+    ],
+    build: (p) => `${hostOrigin(p.host)}/realms/${p.realm}`
+  },
+  zitadel: {
+    label: "ZITADEL",
+    pieces: ["host"],
+    issuerFormat: "https://<host>",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "Console > Project > Applications > New > Web",
+    steps: [
+      "Choose authentication method PKCE (public) or Basic/Post (confidential).",
+      "Add the redirect URI below.",
+      "Copy the client ID."
+    ],
+    build: (p) => hostOrigin(p.host)
+  },
+  kanidm: {
+    label: "Kanidm",
+    pieces: ["host", "application_slug"],
+    issuerFormat: "https://<host>/oauth2/openid/<application_slug>",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "`kanidm system oauth2 create(-public) <name> <display> <origin>` on the server",
+    steps: [
+      "Use `create-public` for PKCE without a secret, `create` for a confidential client.",
+      "Add the redirect URI below with `add-redirect-url`.",
+      "Grant scopes with `update-scope-map <name> <group> openid profile email`.",
+      "The application_slug is the client name you created."
+    ],
+    build: (p) => `${hostOrigin(p.host)}/oauth2/openid/${p.application_slug}`
+  },
+  google: {
+    label: "Google",
+    pieces: [],
+    issuerFormat: "https://accounts.google.com",
+    scopes: "openid profile email",
+    publicPkce: false,
+    usernameClaim: "email",
+    whereToCreate: "Google Cloud console > APIs & Services > Credentials > Create credentials > OAuth client ID (Web application)",
+    steps: [
+      'Choose "Web application"; Google issues a client secret for it, so the client is confidential.',
+      "Add the redirect URI below as an authorized redirect URI (it must be a public https host)."
+    ],
+    build: () => "https://accounts.google.com"
+  },
+  "microsoft-entra": {
+    label: "Microsoft Entra ID",
+    pieces: ["tenant_id"],
+    issuerFormat: "https://login.microsoftonline.com/<tenant_id>/v2.0",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "Entra admin center > App registrations > New registration",
+    steps: [
+      "Register a Web app (confidential, with a client secret) or a Single-page application (public, PKCE).",
+      "Add the redirect URI below under Authentication.",
+      "Copy the Application (client) ID and the Directory (tenant) ID."
+    ],
+    build: (p) => `https://login.microsoftonline.com/${p.tenant_id}/v2.0`
+  },
+  auth0: {
+    label: "Auth0",
+    pieces: ["host"],
+    issuerFormat: "https://<host>/",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "email",
+    whereToCreate: "Dashboard > Applications > Applications > Create Application",
+    steps: [
+      "Regular Web Application for confidential, Single Page Application for public (PKCE).",
+      "Add the redirect URI below under Allowed Callback URLs.",
+      "host is the tenant domain, for example example.eu.auth0.com."
+    ],
+    build: (p) => `${hostOrigin(p.host)}/`
+  },
+  okta: {
+    label: "Okta",
+    pieces: ["host"],
+    issuerFormat: "https://<host>/oauth2/default",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "Admin console > Applications > Applications > Create App Integration > OIDC",
+    steps: [
+      "Web Application for confidential, Single-Page Application for public (PKCE).",
+      "Add the redirect URI below as a sign-in redirect URI.",
+      "host is your Okta domain; the default authorization server is used."
+    ],
+    build: (p) => `${hostOrigin(p.host)}/oauth2/default`
+  },
+  generic: {
+    label: "Any OpenID Connect provider",
+    pieces: [],
+    issuerFormat: "the `issuer` value of the provider's discovery document",
+    scopes: "openid profile email",
+    publicPkce: true,
+    usernameClaim: "preferred_username",
+    whereToCreate: "the provider's admin interface (create an OIDC web client)",
+    steps: COMMON_STEPS,
+    note: "Pass `issuer` exactly as the provider's /.well-known/openid-configuration reports it.",
+    build: () => ""
+  }
+};
+function resolveIssuer(provider, explicit, pieces) {
+  if (explicit !== void 0 && explicit.trim() !== "") {
+    return { issuer: explicit.trim(), missing: [] };
+  }
+  const spec = OIDC_PROVIDERS[provider];
+  const missing = spec.pieces.filter((k) => (pieces[k] ?? "").trim() === "");
+  if (missing.length > 0 || provider === "generic") return { issuer: null, missing };
+  return {
+    issuer: spec.build({
+      host: pieces.host ?? "",
+      application_slug: pieces.application_slug ?? "",
+      realm: pieces.realm ?? "",
+      tenant_id: pieces.tenant_id ?? ""
+    }),
+    missing: []
+  };
+}
+
+// src/mcp/configure-oidc.ts
+var OIDC_TOOL = "configure_oidc";
+var OIDC_ADMIN_ROUTE = "/system/identity?tab=authentication";
+var DISCOVERY_TIMEOUT_MS = 5e3;
+var ClientTypeSchema = z10.enum(["public", "confidential"]);
+var AddressesSchema3 = z10.looseObject({
+  roles: z10.looseObject({
+    publicEndpoint: z10.looseObject({ resolved: z10.string().nullish() }).optional(),
+    appConnections: z10.looseObject({ resolved: z10.array(z10.string()) }).optional()
+  })
+});
+var LOOPBACK2 = /^(localhost|127\.|\[?::1\]?$|0\.0\.0\.0)/i;
+function isLoopback(url) {
+  try {
+    return LOOPBACK2.test(new URL(url).hostname);
+  } catch {
+    return true;
+  }
+}
+async function resolveHubBase(client) {
+  const read = await readQuery(client, "localNetwork.getAddresses", {}, AddressesSchema3);
+  if (!read.ok) return { base: null, reason: read.reason };
+  const pub = read.value.roles.publicEndpoint?.resolved;
+  if (typeof pub === "string" && pub !== "" && !isLoopback(pub)) {
+    return { base: pub.replace(/\/+$/, ""), source: "publicEndpoint" };
+  }
+  const app = read.value.roles.appConnections?.resolved.find((u) => !isLoopback(u));
+  if (app !== void 0) return { base: app.replace(/\/+$/, ""), source: "appConnections" };
+  return {
+    base: null,
+    reason: "no non-loopback public endpoint or app-connections address is set (Network page)"
+  };
+}
+function callbackPath(connectionId) {
+  return `/addon/auth-oidc/${connectionId}/callback`;
+}
+var DiscoverySchema = z10.looseObject({
+  issuer: z10.string().optional(),
+  authorization_endpoint: z10.string().optional(),
+  token_endpoint: z10.string().optional(),
+  jwks_uri: z10.string().optional(),
+  code_challenge_methods_supported: z10.array(z10.string()).optional(),
+  token_endpoint_auth_methods_supported: z10.array(z10.string()).optional()
+});
+var trimSlash = (s) => s.replace(/\/+$/, "");
+async function checkDiscovery(fetchFn, issuer, clientType) {
+  const url = `${trimSlash(issuer)}/.well-known/openid-configuration`;
+  let body;
+  try {
+    const res = await fetchFn(url, { signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS) });
+    if (!res.ok) {
+      return {
+        checked: false,
+        url,
+        warnings: [`discovery answered ${res.status}: check the issuer URL`]
+      };
+    }
+    body = await res.json();
+  } catch (err) {
+    return {
+      checked: false,
+      url,
+      warnings: [`discovery could not be fetched from this machine (${reasonOf(err)})`]
+    };
+  }
+  const parsed = DiscoverySchema.safeParse(body);
+  if (!parsed.success) {
+    return {
+      checked: false,
+      url,
+      warnings: ["discovery answered something that is not a JSON document"]
+    };
+  }
+  const doc = parsed.data;
+  const warnings = [];
+  const issuerMatches = doc.issuer !== void 0 && trimSlash(doc.issuer) === trimSlash(issuer);
+  if (!issuerMatches) {
+    warnings.push(
+      `the provider reports issuer "${doc.issuer ?? "(none)"}", which differs from "${issuer}"`
+    );
+  }
+  if (doc.authorization_endpoint === void 0 || doc.token_endpoint === void 0) {
+    warnings.push("the discovery document lacks an authorization or token endpoint");
+  }
+  const s256 = doc.code_challenge_methods_supported?.includes("S256") === true;
+  if (!s256)
+    warnings.push("code_challenge_methods_supported does not include S256 (PKCE is always used)");
+  const post = doc.token_endpoint_auth_methods_supported?.includes("client_secret_post") === true;
+  if (clientType === "confidential" && !post) {
+    warnings.push(
+      "token_endpoint_auth_methods_supported does not include client_secret_post, which CamStack uses for a confidential client"
+    );
+  }
+  return {
+    checked: true,
+    url,
+    issuerMatches,
+    ...doc.authorization_endpoint !== void 0 ? { authorizationEndpoint: doc.authorization_endpoint } : {},
+    ...doc.token_endpoint !== void 0 ? { tokenEndpoint: doc.token_endpoint } : {},
+    s256,
+    clientSecretPost: post,
+    warnings
+  };
+}
+var ConnectionListSchema = z10.array(
+  z10.looseObject({ id: z10.string(), displayName: z10.string().optional() })
+);
+function connectionIdOf(args) {
+  return args.connection_id ?? args.provider;
+}
+function questionnaire(spec, args, redirectUri) {
+  const questions = [
+    ...spec.pieces.map(pieceQuestion),
+    ...args.provider === "generic" ? ["issuer: the exact issuer from the discovery document"] : [],
+    "client_id: the client id the provider shows after you create the client",
+    `client_type: "public" (PKCE, no secret${spec.publicPkce ? "" : " - NOT supported by this provider"}) or "confidential" (a secret you type into the admin UI)`,
+    "display_name (optional): the text of the login button",
+    "connection_id (optional): to update an existing connection instead of creating one"
+  ];
+  return {
+    status: "questions",
+    provider: args.provider,
+    label: spec.label,
+    questions,
+    issuerFormat: spec.issuerFormat,
+    defaultScopes: spec.scopes,
+    publicClientSupported: spec.publicPkce,
+    whereToCreateTheClient: spec.whereToCreate,
+    providerSideSteps: spec.steps,
+    ...spec.note !== void 0 ? { note: spec.note } : {},
+    redirectUri,
+    ...redirectUri === null ? {
+      redirectUriNote: "the hub address could not be resolved; set a public endpoint on the Network page"
+    } : {},
+    next: `Call ${OIDC_TOOL} again with the answers; it previews the connection and gives a confirm_token.`,
+    secretRule: "A client secret is never a tool argument. For a confidential client you type it in the admin UI."
+  };
+}
+function oidcSpec(client, fetchFn) {
+  return {
+    tool: OIDC_TOOL,
+    async dryRun(args) {
+      const spec = OIDC_PROVIDERS[args.provider];
+      const clientType = args.client_type ?? "public";
+      const resolved = resolveIssuer(args.provider, args.issuer, args);
+      if (resolved.issuer === null || args.client_id === void 0 || args.client_id.trim() === "") {
+        return { confirmable: false, describe: { problem: "issuer and client_id are required" } };
+      }
+      if (clientType === "public" && !spec.publicPkce) {
+        return {
+          confirmable: false,
+          describe: {
+            problem: `${spec.label} does not issue public clients; use client_type "confidential"`
+          }
+        };
+      }
+      const id = connectionIdOf(args);
+      const list = await readQuery(
+        client,
+        "oidcConnections.listConnections",
+        {},
+        ConnectionListSchema
+      );
+      if (!list.ok) return { confirmable: false, describe: { problem: list.reason } };
+      const exists = list.value.some((c) => c.id === id);
+      if (exists && args.connection_id === void 0) {
+        return {
+          confirmable: false,
+          describe: {
+            problem: `a connection "${id}" already exists; pass connection_id "${id}" to update it, or another id to create a new one`
+          }
+        };
+      }
+      const base = await resolveHubBase(client);
+      const discovery = await checkDiscovery(fetchFn, resolved.issuer, clientType);
+      const link = await adminLink(client, OIDC_ADMIN_ROUTE);
+      return {
+        confirmable: true,
+        describe: {
+          action: exists ? "update OIDC connection" : "create OIDC connection",
+          connection: {
+            id,
+            displayName: args.display_name ?? spec.label,
+            issuerUrl: resolved.issuer,
+            clientId: args.client_id.trim(),
+            clientType,
+            scopes: spec.scopes,
+            usernameClaim: spec.usernameClaim,
+            clientSecret: clientType === "public" ? "none (public PKCE client)" : "entered in the admin UI"
+          },
+          redirectUri: base.base !== null ? `${base.base}${callbackPath(id)}` : null,
+          ...base.base === null ? { redirectUriProblem: base.reason } : {},
+          discovery,
+          warnings: discovery.warnings,
+          ...secretStep(clientType, link.url)
+        }
+      };
+    },
+    async execute(args) {
+      const spec = OIDC_PROVIDERS[args.provider];
+      const clientType = args.client_type ?? "public";
+      const resolved = resolveIssuer(args.provider, args.issuer, args);
+      const id = connectionIdOf(args);
+      const displayName = args.display_name ?? spec.label;
+      const list = await readQuery(
+        client,
+        "oidcConnections.listConnections",
+        {},
+        ConnectionListSchema
+      );
+      const exists = list.ok && list.value.some((c) => c.id === id);
+      if (!exists) {
+        await client.call("POST", "oidcConnections.createConnection", { id, displayName });
+      }
+      await client.call("POST", "oidcConnections.updateConnection", {
+        id,
+        displayName,
+        issuerUrl: resolved.issuer ?? "",
+        clientId: (args.client_id ?? "").trim(),
+        scopes: spec.scopes,
+        usernameClaim: spec.usernameClaim,
+        ...exists && clientType === "public" ? { clientSecret: { $secretClear: true } } : {}
+      });
+      const link = await adminLink(client, OIDC_ADMIN_ROUTE);
+      return {
+        connectionId: id,
+        applied: exists ? "updated" : "created",
+        ...secretStep(clientType, link.url)
+      };
+    }
+  };
+}
+function secretStep(clientType, url) {
+  if (clientType === "public") return {};
+  return {
+    secretStep: {
+      required: true,
+      how: url !== null ? `open ${url}, edit the connection and type the client secret in the Client Secret field` : `open ${OIDC_ADMIN_ROUTE} in the admin UI, edit the connection and type the client secret in the Client Secret field`,
+      note: "The secret is never a tool argument and is not shown here."
+    }
+  };
+}
+async function configureOidc(ctx, args, confirmToken) {
+  const spec = OIDC_PROVIDERS[args.provider];
+  const resolved = resolveIssuer(args.provider, args.issuer, args);
+  const asking = resolved.issuer === null || (args.client_id ?? "").trim() === "";
+  if (asking) {
+    const base = await withHub(ctx, async ({ client }) => resolveHubBase(client));
+    const redirect = "status" in base || base.base === null ? null : `${base.base}${callbackPath(connectionIdOf(args))}`;
+    return questionnaire(spec, args, redirect);
+  }
+  return adminGated(ctx, (client) => oidcSpec(client, ctx.fetch), args, confirmToken);
+}
+var OIDC_TOOL_SHAPE = {
+  provider: OidcProviderSchema,
+  issuer: z10.string().optional(),
+  host: z10.string().optional(),
+  application_slug: z10.string().optional(),
+  realm: z10.string().optional(),
+  tenant_id: z10.string().optional(),
+  client_id: z10.string().optional(),
+  client_type: ClientTypeSchema.optional(),
+  display_name: z10.string().optional(),
+  connection_id: z10.string().optional(),
+  confirm_token: ConfirmTokenSchema
+};
+function registerOidcTools(server, ctx) {
+  server.tool(
+    OIDC_TOOL,
+    "Connect an OpenID Connect identity provider (authentik, pocket-id, authelia, keycloak, zitadel, kanidm, google, microsoft-entra, auth0, okta, generic). Call with only `provider` for the questions, the provider-side setup steps and the redirect URI to paste into the provider. With the answers it previews the connection and checks the provider discovery document (warnings, never a crash); call again with the SAME arguments and the confirm_token to create or update it. A client secret is NEVER an argument or output: a confidential client is finished by typing the secret in the admin UI (the route is given); a public PKCE client needs none. Needs an admin `camstack login` session for the write.",
+    OIDC_TOOL_SHAPE,
+    async ({ confirm_token, ...args }) => text(await configureOidc(ctx, args, confirm_token))
+  );
+}
+
+// src/mcp/configure-nc-rules.ts
+import { z as z11 } from "zod";
 var TIME = /^\d{1,2}:\d{2}$/;
 var ALL_DAYS = [0, 1, 2, 3, 4, 5, 6];
-var QuietHoursAnswerSchema = z9.object({
+var QuietHoursAnswerSchema = z11.object({
   /** Notifications are muted from this time … */
-  from: z9.string().regex(TIME),
+  from: z11.string().regex(TIME),
   /** … until this one (HH:MM, hub time zone). A window may cross midnight. */
-  to: z9.string().regex(TIME),
+  to: z11.string().regex(TIME),
   /** Days the quiet window STARTS on (0 = Sunday); absent = every day. */
-  days: z9.array(z9.number().int().min(0).max(6)).min(1).optional()
+  days: z11.array(z11.number().int().min(0).max(6)).min(1).optional()
 });
-var NcRuleAnswersSchema = z9.object({
-  name: z9.string().min(1).max(200).optional(),
-  delivery: z9.enum(["immediate", "track-end"]).optional(),
+var NcRuleAnswersSchema = z11.object({
+  name: z11.string().min(1).max(200).optional(),
+  delivery: z11.enum(["immediate", "track-end"]).optional(),
   /** Camera ids; `[]` means every camera. */
-  cameras: z9.array(z9.number().int().nonnegative()).optional(),
-  classes: z9.array(z9.string().min(1)).optional(),
+  cameras: z11.array(z11.number().int().nonnegative()).optional(),
+  classes: z11.array(z11.string().min(1)).optional(),
   /** Zone ids or names; `[]` means anywhere in view. */
-  zones: z9.array(z9.string().min(1)).optional(),
-  minConfidence: z9.number().min(0).max(1).optional(),
+  zones: z11.array(z11.string().min(1)).optional(),
+  minConfidence: z11.number().min(0).max(1).optional(),
   /** `null` states "no quiet hours"; absent means not asked yet. */
   quietHours: QuietHoursAnswerSchema.nullable().optional(),
   /** Target ids or names. */
-  targets: z9.array(z9.string().min(1)).optional(),
-  cooldownSeconds: z9.number().int().min(0).max(86400).optional()
+  targets: z11.array(z11.string().min(1)).optional(),
+  cooldownSeconds: z11.number().int().min(0).max(86400).optional()
 });
 var SAVE_RULE_TOOL = "configure_notification_rule_save";
 var DELIVERY_CHOICES = [
@@ -2557,11 +3054,11 @@ async function interviewNcRule(client, answers) {
 async function ncRuleQuestionnaire(ctx, answers) {
   return withHub(ctx, ({ client }) => interviewNcRule(client, answers));
 }
-var StoredRuleSchema = z9.looseObject({
-  id: z9.string().optional(),
-  name: z9.string().optional(),
-  conditions: z9.record(z9.string(), z9.unknown()).optional(),
-  schedule: z9.unknown().optional()
+var StoredRuleSchema = z11.looseObject({
+  id: z11.string().optional(),
+  name: z11.string().optional(),
+  conditions: z11.record(z11.string(), z11.unknown()).optional(),
+  schedule: z11.unknown().optional()
 });
 var AUTHORED_CONDITION_KEYS = [
   "devices",
@@ -2693,17 +3190,17 @@ function registerNcRuleTools(server, ctx) {
     "configure_notification_rule_questionnaire",
     "Interview for a detection notification rule (cameras, classes, zones, quiet hours, targets). Stateless: send every answer so far in `answers`; it returns the questions still open, with choices read from the hub, or `ready` with a summary and the rule. Writes nothing.",
     { answers: NcRuleAnswersSchema },
-    async ({ answers }) => text6(await ncRuleQuestionnaire(ctx, answers))
+    async ({ answers }) => text(await ncRuleQuestionnaire(ctx, answers))
   );
   server.tool(
     SAVE_RULE_TOOL,
     `Create a notification rule (the \`rule\` of a ready questionnaire), or update the one named by ruleId (the full conditions are sent, so keys the interview does not author are kept). ${GATE_HOW4}`,
     {
       rule: NcRuleInputSchema,
-      ruleId: z9.string().optional(),
+      ruleId: z11.string().optional(),
       confirm_token: ConfirmTokenSchema
     },
-    async ({ rule, ruleId, confirm_token }) => text6(
+    async ({ rule, ruleId, confirm_token }) => text(
       await saveRule(ctx, { rule, ...ruleId !== void 0 ? { ruleId } : {} }, confirm_token)
     )
   );
@@ -2716,20 +3213,18 @@ function registerConfigureP3bTools(server, ctx) {
   registerCalibrateTools(server, ctx);
   registerExportTools(server, ctx);
   registerNetworkTools(server, ctx);
+  registerOidcTools(server, ctx);
   registerZonesAlarmTools(server, ctx);
 }
 
 // src/mcp/configure-addons.ts
-import {
-  text as text7
-} from "@camstack/develop";
-import { z as z11 } from "zod";
+import { z as z13 } from "zod";
 
 // src/mcp/configure-support.ts
 import {
   runGated as runGated2
 } from "@camstack/develop";
-import { z as z10 } from "zod";
+import { z as z12 } from "zod";
 async function runGatedAdmin(ctx, makeSpec, args, confirmToken) {
   const outcome = await ctx.hub();
   if (!outcome.ok) return noSessionResult(outcome);
@@ -2752,28 +3247,28 @@ async function withAdminHub(ctx, body) {
   }
   return body(outcome.connection);
 }
-var FormOptionSchema = z10.looseObject({
-  value: z10.union([z10.string(), z10.number(), z10.boolean()]),
-  label: z10.string().optional()
+var FormOptionSchema = z12.looseObject({
+  value: z12.union([z12.string(), z12.number(), z12.boolean()]),
+  label: z12.string().optional()
 });
-var FormFieldSchema = z10.looseObject({
-  type: z10.string().optional(),
-  key: z10.string().optional(),
-  label: z10.string().optional(),
-  description: z10.string().optional(),
-  required: z10.boolean().optional(),
-  secret: z10.boolean().optional(),
-  default: z10.unknown().optional(),
-  options: z10.array(FormOptionSchema).optional(),
-  itemFields: z10.array(
-    z10.looseObject({
-      type: z10.string().optional(),
-      key: z10.string().optional()
+var FormFieldSchema = z12.looseObject({
+  type: z12.string().optional(),
+  key: z12.string().optional(),
+  label: z12.string().optional(),
+  description: z12.string().optional(),
+  required: z12.boolean().optional(),
+  secret: z12.boolean().optional(),
+  default: z12.unknown().optional(),
+  options: z12.array(FormOptionSchema).optional(),
+  itemFields: z12.array(
+    z12.looseObject({
+      type: z12.string().optional(),
+      key: z12.string().optional()
     })
   ).optional()
 });
-var FormSchemaShape = z10.looseObject({
-  sections: z10.array(z10.looseObject({ fields: z10.array(FormFieldSchema) }))
+var FormSchemaShape = z12.looseObject({
+  sections: z12.array(z12.looseObject({ fields: z12.array(FormFieldSchema) }))
 });
 var NON_INPUT_TYPES = /* @__PURE__ */ new Set(["info", "divider", "heading", "button"]);
 var CREDENTIAL_NAME = /pass(word|wd|phrase)?|token|secret|api[_-]?key|credential|private[_-]?key/i;
@@ -2874,21 +3369,21 @@ function splitConfig(fields, config) {
 function fieldValidator(field) {
   switch (field.type) {
     case "number":
-      return z10.number();
+      return z12.number();
     case "boolean":
     case "switch":
     case "checkbox":
     case "toggle":
-      return z10.boolean();
+      return z12.boolean();
     case "tags":
-      return z10.array(z10.string());
+      return z12.array(z12.string());
     case "editable-array":
-      return z10.array(z10.record(z10.string(), z10.unknown()));
+      return z12.array(z12.record(z12.string(), z12.unknown()));
     case "select":
     case "radio": {
-      if (field.options === null || field.options.length === 0) return z10.unknown();
+      if (field.options === null || field.options.length === 0) return z12.unknown();
       const values = field.options.map((o) => o.value);
-      return z10.custom(
+      return z12.custom(
         (v) => values.some((allowed) => allowed === v),
         `one of: ${values.map(String).join(", ")}`
       );
@@ -2898,9 +3393,9 @@ function fieldValidator(field) {
     case "textarea":
     case "url":
     case "email":
-      return z10.string();
+      return z12.string();
     default:
-      return z10.unknown();
+      return z12.unknown();
   }
 }
 function formValidator(fields) {
@@ -2910,7 +3405,7 @@ function formValidator(fields) {
     const base = fieldValidator(field);
     shape[field.key] = field.required ? base : base.optional();
   }
-  return z10.object(shape);
+  return z12.object(shape);
 }
 function validationProblems(error) {
   return error.issues.map((issue) => {
@@ -2942,64 +3437,64 @@ function viewConfig(fields, config) {
 var REGISTRY = "https://registry.npmjs.org";
 var REGISTRY_TIMEOUT_MS = 5e3;
 var MAX_RESULTS = 15;
-var PackageName = z11.string().min(1).regex(/^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/, "not an npm package name");
-var CatalogShape = z11.looseObject({
-  name: z11.string(),
-  version: z11.string(),
-  description: z11.string(),
-  keywords: z11.array(z11.string()).optional(),
-  installed: z11.boolean(),
-  capabilities: z11.array(z11.string()).nullable()
+var PackageName = z13.string().min(1).regex(/^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/, "not an npm package name");
+var CatalogShape = z13.looseObject({
+  name: z13.string(),
+  version: z13.string(),
+  description: z13.string(),
+  keywords: z13.array(z13.string()).optional(),
+  installed: z13.boolean(),
+  capabilities: z13.array(z13.string()).nullable()
 });
-var ListedAddonShape = z11.looseObject({
-  manifest: z11.looseObject({
-    id: z11.string(),
-    packageName: z11.string(),
-    packageVersion: z11.string(),
+var ListedAddonShape = z13.looseObject({
+  manifest: z13.looseObject({
+    id: z13.string(),
+    packageName: z13.string(),
+    packageVersion: z13.string(),
     // The hub answers null, not absent, for a manifest without the flag.
-    protected: z11.boolean().nullish(),
-    removable: z11.boolean().nullish()
+    protected: z13.boolean().nullish(),
+    removable: z13.boolean().nullish()
   })
 });
-var UpdateShape = z11.looseObject({
-  name: z11.string(),
-  currentVersion: z11.string(),
-  latestVersion: z11.string(),
-  category: z11.enum(["addon", "core"]),
-  requiresRestart: z11.boolean(),
-  isSystem: z11.boolean()
+var UpdateShape = z13.looseObject({
+  name: z13.string(),
+  currentVersion: z13.string(),
+  latestVersion: z13.string(),
+  category: z13.enum(["addon", "core"]),
+  requiresRestart: z13.boolean(),
+  isSystem: z13.boolean()
 });
-var InstallationsShape = z11.looseObject({
-  installations: z11.array(
-    z11.looseObject({
-      nodeId: z11.string(),
-      isHub: z11.boolean(),
-      isOnline: z11.boolean(),
-      version: z11.string().nullable(),
-      source: z11.string()
+var InstallationsShape = z13.looseObject({
+  installations: z13.array(
+    z13.looseObject({
+      nodeId: z13.string(),
+      isHub: z13.boolean(),
+      isOnline: z13.boolean(),
+      version: z13.string().nullable(),
+      source: z13.string()
     })
   ),
-  unreachable: z11.array(z11.looseObject({ nodeId: z11.string(), error: z11.string() }))
+  unreachable: z13.array(z13.looseObject({ nodeId: z13.string(), error: z13.string() }))
 });
-var VersionsShape = z11.array(
-  z11.looseObject({ version: z11.string(), deprecated: z11.string().optional() })
+var VersionsShape = z13.array(
+  z13.looseObject({ version: z13.string(), deprecated: z13.string().optional() })
 );
-var UninstallShape = z11.looseObject({
-  success: z11.boolean(),
-  packageName: z11.string(),
-  results: z11.array(
-    z11.looseObject({
-      nodeId: z11.string(),
-      outcome: z11.string(),
-      error: z11.string().optional()
+var UninstallShape = z13.looseObject({
+  success: z13.boolean(),
+  packageName: z13.string(),
+  results: z13.array(
+    z13.looseObject({
+      nodeId: z13.string(),
+      outcome: z13.string(),
+      error: z13.string().optional()
     })
   )
 });
-var ServerStatusShape = z11.looseObject({
-  runningVersion: z11.string().nullable().optional()
+var ServerStatusShape = z13.looseObject({
+  runningVersion: z13.string().nullable().optional()
 });
 async function readProtection(client, packageName) {
-  const list = await readQuery(client, "addons.list", {}, z11.array(ListedAddonShape));
+  const list = await readQuery(client, "addons.list", {}, z13.array(ListedAddonShape));
   if (!list.ok) return null;
   const mine = list.value.filter((a) => a.manifest.packageName === packageName);
   return {
@@ -3010,13 +3505,13 @@ async function readProtection(client, packageName) {
 }
 var PROTECTED_REASON = (name) => `${name} is a protected package (manifest protected / removable:false): the kernel needs it, so it is never installed over, updated or removed here`;
 var UNREADABLE_PROTECTION_REASON = (name) => `could not read whether ${name} is protected (addons.list did not answer with the expected shape); nothing is changed until it does`;
-var PackumentShape = z11.looseObject({
-  peerDependencies: z11.record(z11.string(), z11.string()).optional(),
-  engines: z11.record(z11.string(), z11.string()).optional(),
-  camstack: z11.looseObject({
-    addons: z11.array(
-      z11.looseObject({
-        execution: z11.looseObject({ placement: z11.string().optional() }).optional()
+var PackumentShape = z13.looseObject({
+  peerDependencies: z13.record(z13.string(), z13.string()).optional(),
+  engines: z13.record(z13.string(), z13.string()).optional(),
+  camstack: z13.looseObject({
+    addons: z13.array(
+      z13.looseObject({
+        execution: z13.looseObject({ placement: z13.string().optional() }).optional()
       })
     ).optional()
   }).optional()
@@ -3068,10 +3563,10 @@ async function configureAddonsSearch(ctx, args) {
           ...args.query !== void 0 ? { query: args.query } : {},
           ...args.capability !== void 0 ? { capability: args.capability } : {}
         },
-        z11.array(CatalogShape)
+        z13.array(CatalogShape)
       ),
-      readQuery(client, "addons.list", {}, z11.array(ListedAddonShape)),
-      readQuery(client, "addons.listUpdates", {}, z11.array(UpdateShape)),
+      readQuery(client, "addons.list", {}, z13.array(ListedAddonShape)),
+      readQuery(client, "addons.listUpdates", {}, z13.array(UpdateShape)),
       readQuery(client, "serverManagement.getServerPackageStatus", void 0, ServerStatusShape)
     ]);
     if (!catalog.ok) return { status: "unavailable", reason: catalog.reason };
@@ -3150,7 +3645,7 @@ function installAddonSpec(client, fetchFn) {
         client,
         "addons.searchAvailable",
         { query: args.packageName },
-        z11.array(CatalogShape)
+        z13.array(CatalogShape)
       );
       if (!catalog.ok) return { confirmable: false, describe: { problem: catalog.reason } };
       const entry = catalog.value.find((c) => c.name === args.packageName);
@@ -3253,7 +3748,7 @@ function updateAddonSpec(client) {
         client,
         "addons.listUpdates",
         args.nodeId !== void 0 ? { nodeId: args.nodeId } : {},
-        z11.array(UpdateShape)
+        z13.array(UpdateShape)
       );
       if (!updates.ok) return { confirmable: false, describe: { problem: updates.reason } };
       const entry = updates.value.find((u) => u.name === args.packageName);
@@ -3374,10 +3869,10 @@ function registerAddonTools(server, ctx) {
     "configure_addons_search",
     "Search the addon store (the catalog the admin UI uses) with the installed version, an available update, whether the package is protected, and compatibility (placement, @camstack/types peer range, node engine; no addon declares a minimum server version).",
     {
-      query: z11.string().max(100).optional(),
-      capability: z11.string().max(100).optional()
+      query: z13.string().max(100).optional(),
+      capability: z13.string().max(100).optional()
     },
-    async ({ query, capability }) => text7(
+    async ({ query, capability }) => text(
       await configureAddonsSearch(ctx, {
         ...query !== void 0 ? { query } : {},
         ...capability !== void 0 ? { capability } : {}
@@ -3389,10 +3884,10 @@ function registerAddonTools(server, ctx) {
     `Install an addon package on the hub from the store. ${TWO_STEP} Agents reconcile later; the result says so.`,
     {
       packageName: PackageName,
-      version: z11.string().max(64).optional(),
-      confirm_token: z11.string().optional()
+      version: z13.string().max(64).optional(),
+      confirm_token: z13.string().optional()
     },
-    async ({ packageName, version, confirm_token }) => text7(
+    async ({ packageName, version, confirm_token }) => text(
       await installAddon(
         ctx,
         { packageName, ...version !== void 0 ? { version } : {} },
@@ -3405,11 +3900,11 @@ function registerAddonTools(server, ctx) {
     `Update an installed addon package (hub by default, or one node). Protected and framework packages are refused in the preview. ${TWO_STEP}`,
     {
       packageName: PackageName,
-      version: z11.string().max(64).optional(),
-      nodeId: z11.string().max(100).optional(),
-      confirm_token: z11.string().optional()
+      version: z13.string().max(64).optional(),
+      nodeId: z13.string().max(100).optional(),
+      confirm_token: z13.string().optional()
     },
-    async ({ packageName, version, nodeId, confirm_token }) => text7(
+    async ({ packageName, version, nodeId, confirm_token }) => text(
       await updateAddon(
         ctx,
         {
@@ -3426,11 +3921,11 @@ function registerAddonTools(server, ctx) {
     `Uninstall an addon package from the hub, one node, or everywhere. Protected packages (manifest protected / removable:false) are refused in the preview with the reason. ${TWO_STEP}`,
     {
       packageName: PackageName,
-      nodeId: z11.string().max(100).optional(),
-      everywhere: z11.boolean().optional(),
-      confirm_token: z11.string().optional()
+      nodeId: z13.string().max(100).optional(),
+      everywhere: z13.boolean().optional(),
+      confirm_token: z13.string().optional()
     },
-    async ({ packageName, nodeId, everywhere, confirm_token }) => text7(
+    async ({ packageName, nodeId, everywhere, confirm_token }) => text(
       await uninstallAddon(
         ctx,
         {
@@ -3445,10 +3940,7 @@ function registerAddonTools(server, ctx) {
 }
 
 // src/mcp/configure-cameras.ts
-import {
-  text as text8
-} from "@camstack/develop";
-import { z as z12 } from "zod";
+import { z as z14 } from "zod";
 var UNSUPPORTED_HINT = "use support_diagnose_camera / support_draft_issue";
 var MAX_PROVIDERS = 40;
 var MAX_CANDIDATES = 50;
@@ -3461,34 +3953,34 @@ function unsupported(reason, provider) {
     hint: UNSUPPORTED_HINT
   };
 }
-var CapabilityEntry = z12.union([z12.string(), z12.looseObject({ name: z12.string() })]);
-var InstalledAddonShape = z12.looseObject({
-  manifest: z12.looseObject({
-    id: z12.string(),
-    name: z12.string().optional(),
-    description: z12.string().optional(),
-    packageName: z12.string(),
-    packageVersion: z12.string(),
-    capabilities: z12.array(CapabilityEntry).optional()
+var CapabilityEntry = z14.union([z14.string(), z14.looseObject({ name: z14.string() })]);
+var InstalledAddonShape = z14.looseObject({
+  manifest: z14.looseObject({
+    id: z14.string(),
+    name: z14.string().optional(),
+    description: z14.string().optional(),
+    packageName: z14.string(),
+    packageVersion: z14.string(),
+    capabilities: z14.array(CapabilityEntry).optional()
   })
 });
-var CatalogShape2 = z12.looseObject({
-  name: z12.string(),
-  version: z12.string(),
-  description: z12.string(),
-  keywords: z12.array(z12.string()),
-  installed: z12.boolean(),
-  capabilities: z12.array(z12.string()).nullable()
+var CatalogShape2 = z14.looseObject({
+  name: z14.string(),
+  version: z14.string(),
+  description: z14.string(),
+  keywords: z14.array(z14.string()),
+  installed: z14.boolean(),
+  capabilities: z14.array(z14.string()).nullable()
 });
-var DiscoveryProvidersShape = z12.looseObject({
-  providers: z12.array(z12.looseObject({ addonId: z12.string(), label: z12.string() }))
+var DiscoveryProvidersShape = z14.looseObject({
+  providers: z14.array(z14.looseObject({ addonId: z14.string(), label: z14.string() }))
 });
 function capabilityName(entry) {
   return typeof entry === "string" ? entry : entry.name;
 }
 async function readInstalledProviders(client) {
   const [list, discovery] = await Promise.all([
-    readQuery(client, "addons.list", {}, z12.array(InstalledAddonShape)),
+    readQuery(client, "addons.list", {}, z14.array(InstalledAddonShape)),
     readQuery(client, "deviceManager.discoveryProviders", {}, DiscoveryProvidersShape)
   ]);
   if (!list.ok) return list;
@@ -3519,7 +4011,7 @@ async function configureCameraProviders(ctx, query) {
         client,
         "addons.searchAvailable",
         { capability: DEVICE_PROVIDER },
-        z12.array(CatalogShape2)
+        z14.array(CatalogShape2)
       )
     ]);
     if (!installed.ok) return { status: "unavailable", reason: installed.reason };
@@ -3553,13 +4045,13 @@ async function configureCameraProviders(ctx, query) {
     };
   });
 }
-var CandidateShape = z12.looseObject({
-  stableId: z12.string(),
-  type: z12.string(),
-  suggestedName: z12.string(),
-  prefilledConfig: z12.record(z12.string(), z12.unknown())
+var CandidateShape = z14.looseObject({
+  stableId: z14.string(),
+  type: z14.string(),
+  suggestedName: z14.string(),
+  prefilledConfig: z14.record(z14.string(), z14.unknown())
 });
-var DiscoverShape = z12.looseObject({ candidates: z12.array(CandidateShape) });
+var DiscoverShape = z14.looseObject({ candidates: z14.array(CandidateShape) });
 async function configureCameraDiscover(ctx, args) {
   return withAdminHub(ctx, async ({ client }) => {
     const providers = await readQuery(
@@ -3645,7 +4137,7 @@ async function planAdd(client, args) {
     client,
     "deviceManager.getCreationSchema",
     { addonId: args.addonId, type: "camera" },
-    z12.unknown()
+    z14.unknown()
   );
   if (!schema.ok) return { ok: false, problems: [schema.reason] };
   if (schema.value === null || schema.value === void 0) {
@@ -3696,7 +4188,7 @@ async function providerPage(client, addonId) {
   const link = await resolveLinkBase(client);
   return link.base === null ? null : `${link.base}/integrations/${addonId}`;
 }
-var CreatedShape = z12.looseObject({ id: z12.number(), name: z12.string() });
+var CreatedShape = z14.looseObject({ id: z14.number(), name: z14.string() });
 function addCameraSpec(client) {
   return {
     tool: ADD_CAMERA_TOOL,
@@ -3773,17 +4265,17 @@ function registerCameraTools(server, ctx) {
   server.tool(
     "configure_camera_providers",
     "Installed camera-provider addons and the published ones not yet installed. A manifest declares no brand/model list, so `query` matches on name, description and keywords; a brand nothing matches is `unsupported` with a pointer to support_diagnose_camera / support_draft_issue.",
-    { query: z12.string().max(100).optional() },
-    async ({ query }) => text8(await configureCameraProviders(ctx, query))
+    { query: z14.string().max(100).optional() },
+    async ({ query }) => text(await configureCameraProviders(ctx, query))
   );
   server.tool(
     "configure_camera_discover",
     'Scan the network through one camera provider (the admin UI "add camera" discovery) and list the candidates with the non-secret fields to pass to configure_camera_add. Changes nothing on the hub. A credential in `params` is refused (`secret-required`). Needs an admin `camstack login`.',
     {
-      addonId: z12.string().min(1),
-      params: z12.record(z12.string(), z12.unknown()).optional()
+      addonId: z14.string().min(1),
+      params: z14.record(z14.string(), z14.unknown()).optional()
     },
-    async ({ addonId, params }) => text8(
+    async ({ addonId, params }) => text(
       await configureCameraDiscover(ctx, {
         addonId,
         ...params !== void 0 ? { params } : {}
@@ -3794,46 +4286,43 @@ function registerCameraTools(server, ctx) {
     ADD_CAMERA_TOOL,
     "Add a camera through a provider's creation form (the fields are the provider's own schema). Two steps: call without confirm_token for a preview and a one-shot token, then again with the SAME arguments and that token. `config` takes NON-secret fields only; a password is refused and the answer carries the admin-UI link where the operator types it (`secret-required`). A provider that is not installed or has no manual form is `unsupported`.",
     {
-      addonId: z12.string().min(1),
-      config: z12.record(z12.string(), z12.unknown()),
-      confirm_token: z12.string().optional()
+      addonId: z14.string().min(1),
+      config: z14.record(z14.string(), z14.unknown()),
+      confirm_token: z14.string().optional()
     },
-    async ({ addonId, config, confirm_token }) => text8(await addCamera(ctx, { addonId, config }, confirm_token))
+    async ({ addonId, config, confirm_token }) => text(await addCamera(ctx, { addonId, config }, confirm_token))
   );
 }
 
 // src/mcp/configure-notifiers.ts
-import {
-  text as text9
-} from "@camstack/develop";
-import { z as z13 } from "zod";
+import { z as z15 } from "zod";
 var MAX_TARGETS = 50;
-var TargetKindShape = z13.looseObject({
-  kind: z13.string(),
-  label: z13.string(),
-  addonId: z13.string(),
-  supportsDiscovery: z13.boolean().optional(),
-  configSchema: z13.unknown(),
-  destinationKeys: z13.array(z13.string()).optional()
+var TargetKindShape = z15.looseObject({
+  kind: z15.string(),
+  label: z15.string(),
+  addonId: z15.string(),
+  supportsDiscovery: z15.boolean().optional(),
+  configSchema: z15.unknown(),
+  destinationKeys: z15.array(z15.string()).optional()
 });
-var TargetShape = z13.looseObject({
-  id: z13.string(),
-  name: z13.string(),
-  kind: z13.string(),
-  addonId: z13.string(),
-  enabled: z13.boolean(),
-  config: z13.record(z13.string(), z13.unknown())
+var TargetShape = z15.looseObject({
+  id: z15.string(),
+  name: z15.string(),
+  kind: z15.string(),
+  addonId: z15.string(),
+  enabled: z15.boolean(),
+  config: z15.record(z15.string(), z15.unknown())
 });
-var SendResultShape = z13.looseObject({
-  success: z13.boolean(),
-  error: z13.string().optional()
+var SendResultShape = z15.looseObject({
+  success: z15.boolean(),
+  error: z15.string().optional()
 });
 async function readKinds(client) {
   const read = await readQuery(
     client,
     "notificationOutput.listTargetKinds",
     {},
-    z13.array(TargetKindShape)
+    z15.array(TargetKindShape)
   );
   if (!read.ok) return read;
   return {
@@ -3888,7 +4377,7 @@ async function configureNotificationTargets(ctx) {
   return withAdminHub(ctx, async ({ client }) => {
     const [kinds, targets] = await Promise.all([
       readKinds(client),
-      readQuery(client, "notificationOutput.listTargets", {}, z13.array(TargetShape))
+      readQuery(client, "notificationOutput.listTargets", {}, z15.array(TargetShape))
     ]);
     if (!targets.ok) return { status: "unavailable", reason: targets.reason };
     const forms = kinds.ok ? kinds.value : [];
@@ -3929,7 +4418,7 @@ async function planUpsert(client, args) {
   const fields = form.fields;
   let existing = null;
   if (args.targetId !== void 0) {
-    const list = await readQuery(client, "notificationOutput.listTargets", {}, z13.array(TargetShape));
+    const list = await readQuery(client, "notificationOutput.listTargets", {}, z15.array(TargetShape));
     if (!list.ok) return { ok: false, problems: [list.reason] };
     existing = list.value.find((t) => t.id === args.targetId) ?? null;
     if (existing === null) return { ok: false, problems: [`target ${args.targetId} was not found`] };
@@ -4036,7 +4525,7 @@ function testTargetSpec(client) {
     async dryRun(args) {
       const [kinds, targets] = await Promise.all([
         readKinds(client),
-        readQuery(client, "notificationOutput.listTargets", {}, z13.array(TargetShape))
+        readQuery(client, "notificationOutput.listTargets", {}, z15.array(TargetShape))
       ]);
       if (!targets.ok) return { confirmable: false, describe: { problem: targets.reason } };
       const target = targets.value.find((t) => t.id === args.targetId);
@@ -4108,26 +4597,26 @@ function registerNotifierTools(server, ctx) {
     "configure_notifiers",
     "The notifier kinds a target can be created from (ntfy, telegram, email, \u2026), each with its settings fields, which are required and which are SECRETS. Secrets are never tool arguments. Needs an admin `camstack login`.",
     {},
-    async () => text9(await configureNotifiers(ctx))
+    async () => text(await configureNotifiers(ctx))
   );
   server.tool(
     "configure_notification_targets",
     "Existing notification targets with their non-secret settings. A secret is shown only as set/unset, and a target missing a required secret is listed under `incomplete`. Needs an admin `camstack login`.",
     {},
-    async () => text9(await configureNotificationTargets(ctx))
+    async () => text(await configureNotificationTargets(ctx))
   );
   server.tool(
     UPSERT_TARGET_TOOL,
     "Create (no targetId) or edit (targetId) a notification target from its notifier schema (see configure_notifiers). Two steps: call without confirm_token for a preview and a one-shot token, then again with the SAME arguments and that token. `config` takes NON-secret fields only; a secret field is refused, and the target is saved incomplete with the admin-UI link where the operator types the secret (`secret-required`).",
     {
-      targetId: z13.string().min(1).optional(),
-      kind: z13.string().min(1),
-      name: z13.string().min(1),
-      config: z13.record(z13.string(), z13.unknown()),
-      enabled: z13.boolean().optional(),
-      confirm_token: z13.string().optional()
+      targetId: z15.string().min(1).optional(),
+      kind: z15.string().min(1),
+      name: z15.string().min(1),
+      config: z15.record(z15.string(), z15.unknown()),
+      enabled: z15.boolean().optional(),
+      confirm_token: z15.string().optional()
     },
-    async ({ targetId, kind, name, config, enabled, confirm_token }) => text9(
+    async ({ targetId, kind, name, config, enabled, confirm_token }) => text(
       await upsertNotificationTarget(
         ctx,
         {
@@ -4144,51 +4633,51 @@ function registerNotifierTools(server, ctx) {
   server.tool(
     TEST_TARGET_TOOL,
     "Send a test notification to one target. Two steps: the preview checks the target exists and has every required secret, and only the confirmed call delivers a real message.",
-    { targetId: z13.string().min(1), confirm_token: z13.string().optional() },
-    async ({ targetId, confirm_token }) => text9(await testNotificationTarget(ctx, { targetId }, confirm_token))
+    { targetId: z15.string().min(1), confirm_token: z15.string().optional() },
+    async ({ targetId, confirm_token }) => text(await testNotificationTarget(ctx, { targetId }, confirm_token))
   );
 }
 
 // src/mcp/ops-tools.ts
-import { z as z25 } from "zod";
-import { jwtClaims, text as text11 } from "@camstack/develop";
+import { z as z23 } from "zod";
+import { jwtClaims } from "@camstack/develop";
 
 // src/mcp/ops-accelerators.ts
-import { z as z14 } from "zod";
-var NodesSchema = z14.array(
-  z14.looseObject({
-    id: z14.string(),
-    isOnline: z14.boolean(),
-    name: z14.string().optional()
+import { z as z16 } from "zod";
+var NodesSchema = z16.array(
+  z16.looseObject({
+    id: z16.string(),
+    isOnline: z16.boolean(),
+    name: z16.string().optional()
   })
 );
-var HardwareSchema = z14.looseObject({
-  platform: z14.enum(["darwin", "linux", "win32"]),
-  arch: z14.enum(["arm64", "x64"]),
-  cpuModel: z14.string(),
-  cpuCores: z14.number(),
-  totalRAM_MB: z14.number(),
-  availableRAM_MB: z14.number(),
-  gpu: z14.looseObject({
-    type: z14.enum(["nvidia", "amd", "intel", "apple"]),
-    name: z14.string()
+var HardwareSchema = z16.looseObject({
+  platform: z16.enum(["darwin", "linux", "win32"]),
+  arch: z16.enum(["arm64", "x64"]),
+  cpuModel: z16.string(),
+  cpuCores: z16.number(),
+  totalRAM_MB: z16.number(),
+  availableRAM_MB: z16.number(),
+  gpu: z16.looseObject({
+    type: z16.enum(["nvidia", "amd", "intel", "apple"]),
+    name: z16.string()
   }).nullable(),
-  npu: z14.looseObject({
-    type: z14.enum(["apple-ane", "intel-npu", "amd-xdna"])
+  npu: z16.looseObject({
+    type: z16.enum(["apple-ane", "intel-npu", "amd-xdna"])
   }).nullable()
 });
-var InferenceDevicesSchema = z14.looseObject({
-  reachable: z14.boolean(),
-  devices: z14.array(
-    z14.looseObject({
-      key: z14.string(),
-      backend: z14.string(),
-      device: z14.string(),
-      available: z14.boolean(),
-      presence: z14.enum(["present", "absent", "unknown"]).optional(),
-      enabled: z14.boolean(),
-      exclusion: z14.string().nullable(),
-      defaultModelId: z14.string()
+var InferenceDevicesSchema = z16.looseObject({
+  reachable: z16.boolean(),
+  devices: z16.array(
+    z16.looseObject({
+      key: z16.string(),
+      backend: z16.string(),
+      device: z16.string(),
+      available: z16.boolean(),
+      presence: z16.enum(["present", "absent", "unknown"]).optional(),
+      enabled: z16.boolean(),
+      exclusion: z16.string().nullable(),
+      defaultModelId: z16.string()
     })
   )
 });
@@ -4312,81 +4801,81 @@ async function opsAccelerators(ctx) {
 }
 
 // src/mcp/ops-device.ts
-import { z as z15 } from "zod";
-var DeviceSchema = z15.looseObject({
-  id: z15.number(),
-  name: z15.string(),
-  type: z15.string().optional(),
-  addonId: z15.string().optional(),
-  location: z15.string().nullable().optional(),
-  disabled: z15.boolean().optional(),
-  online: z15.boolean().optional(),
-  isCamera: z15.boolean().optional(),
-  features: z15.array(z15.string()).optional()
+import { z as z17 } from "zod";
+var DeviceSchema = z17.looseObject({
+  id: z17.number(),
+  name: z17.string(),
+  type: z17.string().optional(),
+  addonId: z17.string().optional(),
+  location: z17.string().nullable().optional(),
+  disabled: z17.boolean().optional(),
+  online: z17.boolean().optional(),
+  isCamera: z17.boolean().optional(),
+  features: z17.array(z17.string()).optional()
 });
 var NullableDeviceSchema = DeviceSchema.nullable();
-var DeviceListSchema = z15.array(DeviceSchema);
-var BindingsSchema2 = z15.looseObject({
-  entries: z15.array(
-    z15.looseObject({
-      capName: z15.string(),
-      kind: z15.string(),
-      providerAddonId: z15.string(),
-      providerNodeId: z15.string()
+var DeviceListSchema = z17.array(DeviceSchema);
+var BindingsSchema2 = z17.looseObject({
+  entries: z17.array(
+    z17.looseObject({
+      capName: z17.string(),
+      kind: z17.string(),
+      providerAddonId: z17.string(),
+      providerNodeId: z17.string()
     })
   )
 });
-var StatusAggregateSchema = z15.record(z15.string(), z15.unknown());
-var DegradationSchema = z15.looseObject({
-  stage: z15.string(),
-  reason: z15.string(),
-  elapsedMs: z15.number().optional()
+var StatusAggregateSchema = z17.record(z17.string(), z17.unknown());
+var DegradationSchema = z17.looseObject({
+  stage: z17.string(),
+  reason: z17.string(),
+  elapsedMs: z17.number().optional()
 });
-var CameraStatusSchema = z15.looseObject({
-  deviceId: z15.number(),
-  assignment: z15.looseObject({
-    detectionNodeId: z15.string().nullable(),
-    decoderNodeId: z15.string().nullable(),
-    sourceNodeId: z15.string().nullable(),
+var CameraStatusSchema = z17.looseObject({
+  deviceId: z17.number(),
+  assignment: z17.looseObject({
+    detectionNodeId: z17.string().nullable(),
+    decoderNodeId: z17.string().nullable(),
+    sourceNodeId: z17.string().nullable(),
     /** Why a stage sits where it does; `armed:on-motion` means idle by design. */
-    reasons: z15.record(z15.string(), z15.string().optional()).optional()
+    reasons: z17.record(z17.string(), z17.string().optional()).optional()
   }),
-  broker: z15.looseObject({
-    profiles: z15.array(
-      z15.looseObject({
-        profile: z15.string(),
-        status: z15.string(),
-        subscribers: z15.number()
+  broker: z17.looseObject({
+    profiles: z17.array(
+      z17.looseObject({
+        profile: z17.string(),
+        status: z17.string(),
+        subscribers: z17.number()
       })
     )
   }).nullable(),
-  detection: z15.looseObject({
-    nodeId: z15.string(),
-    phase: z15.string(),
-    actualFps: z15.number(),
-    configuredFps: z15.number(),
-    provisioning: z15.looseObject({
-      state: z15.string(),
-      error: z15.string().optional()
+  detection: z17.looseObject({
+    nodeId: z17.string(),
+    phase: z17.string(),
+    actualFps: z17.number(),
+    configuredFps: z17.number(),
+    provisioning: z17.looseObject({
+      state: z17.string(),
+      error: z17.string().optional()
     })
   }).nullable(),
-  recording: z15.looseObject({
-    mode: z15.string(),
-    active: z15.boolean(),
-    storageBytes: z15.number()
+  recording: z17.looseObject({
+    mode: z17.string(),
+    active: z17.boolean(),
+    storageBytes: z17.number()
   }).nullable(),
-  switchedOff: z15.array(z15.string()),
-  degraded: z15.array(DegradationSchema),
-  fetchedAt: z15.number()
+  switchedOff: z17.array(z17.string()),
+  degraded: z17.array(DegradationSchema),
+  fetchedAt: z17.number()
 });
-var CameraStatusListSchema = z15.array(CameraStatusSchema);
-var ObjectEventSchema = z15.looseObject({
-  id: z15.number(),
-  timestamp: z15.number(),
-  className: z15.string().optional(),
-  trackId: z15.string().optional()
+var CameraStatusListSchema = z17.array(CameraStatusSchema);
+var ObjectEventSchema = z17.looseObject({
+  id: z17.number(),
+  timestamp: z17.number(),
+  className: z17.string().optional(),
+  trackId: z17.string().optional()
 });
-var ObjectEventsSchema2 = z15.array(ObjectEventSchema);
+var ObjectEventsSchema2 = z17.array(ObjectEventSchema);
 var BINDING_LIMIT = 40;
 var EVENT_LIMIT = 5;
 var UNHEALTHY_LIMIT = 50;
@@ -4394,9 +4883,9 @@ function freshness(aggregate, now) {
   const fetched = [];
   let changed = null;
   for (const [capName, value] of Object.entries(aggregate)) {
-    const parsed = z15.looseObject({
-      lastFetchedAt: z15.number().optional(),
-      lastChangedAt: z15.number().optional()
+    const parsed = z17.looseObject({
+      lastFetchedAt: z17.number().optional(),
+      lastChangedAt: z17.number().optional()
     }).safeParse(value);
     if (!parsed.success) continue;
     const at = parsed.data.lastFetchedAt;
@@ -4647,26 +5136,26 @@ async function opsUnhealthyDevices(ctx) {
 }
 
 // src/mcp/ops-logs.ts
-import { z as z16 } from "zod";
-var LevelSchema = z16.enum(["debug", "info", "warn", "error"]);
-var LogEntrySchema = z16.looseObject({
-  timestamp: z16.string(),
-  level: z16.string(),
-  scope: z16.string().optional(),
-  message: z16.string(),
-  tags: z16.record(z16.string(), z16.string().optional()).optional(),
-  meta: z16.record(z16.string(), z16.unknown()).optional()
+import { z as z18 } from "zod";
+var LevelSchema = z18.enum(["debug", "info", "warn", "error"]);
+var LogEntrySchema = z18.looseObject({
+  timestamp: z18.string(),
+  level: z18.string(),
+  scope: z18.string().optional(),
+  message: z18.string(),
+  tags: z18.record(z18.string(), z18.string().optional()).optional(),
+  meta: z18.record(z18.string(), z18.unknown()).optional()
 });
-var LogPageSchema = z16.looseObject({
-  entries: z16.array(LogEntrySchema),
-  done: z16.boolean(),
-  source: z16.string()
+var LogPageSchema = z18.looseObject({
+  entries: z18.array(LogEntrySchema),
+  done: z18.boolean(),
+  source: z18.string()
 });
-var LogSourcesSchema = z16.array(
-  z16.looseObject({
-    addonId: z16.string(),
-    readable: z16.boolean(),
-    isDefault: z16.boolean()
+var LogSourcesSchema = z18.array(
+  z18.looseObject({
+    addonId: z18.string(),
+    readable: z18.boolean(),
+    isDefault: z18.boolean()
   })
 );
 var RING_SOURCE = "ring";
@@ -4881,37 +5370,37 @@ async function opsLogs(ctx, args, now = Date.now()) {
 }
 
 // src/mcp/ops-status.ts
-import { z as z17 } from "zod";
-var TopologyNodeSchema = z17.looseObject({
-  id: z17.string(),
-  name: z17.string().optional(),
-  platform: z17.string().optional(),
-  isHub: z17.boolean().optional(),
-  isOnline: z17.boolean(),
-  addons: z17.array(z17.looseObject({ capabilities: z17.array(z17.string()) })).optional(),
+import { z as z19 } from "zod";
+var TopologyNodeSchema = z19.looseObject({
+  id: z19.string(),
+  name: z19.string().optional(),
+  platform: z19.string().optional(),
+  isHub: z19.boolean().optional(),
+  isOnline: z19.boolean(),
+  addons: z19.array(z19.looseObject({ capabilities: z19.array(z19.string()) })).optional(),
   /** Agents report it; the hub does not. Absent means "not claimed". */
-  capabilitiesRegistered: z17.boolean().optional()
+  capabilitiesRegistered: z19.boolean().optional()
 });
-var TopologySchema = z17.array(TopologyNodeSchema);
-var ServerStatusSchema = z17.looseObject({
-  runningVersion: z17.string(),
-  restartRequired: z17.boolean().optional(),
-  updateAvailable: z17.boolean().optional(),
-  updateState: z17.string().optional()
+var TopologySchema = z19.array(TopologyNodeSchema);
+var ServerStatusSchema = z19.looseObject({
+  runningVersion: z19.string(),
+  restartRequired: z19.boolean().optional(),
+  updateAvailable: z19.boolean().optional(),
+  updateState: z19.string().optional()
 });
-var AlertSchema = z17.looseObject({
-  severity: z17.string(),
-  title: z17.string(),
-  message: z17.string().optional(),
-  status: z17.string()
+var AlertSchema = z19.looseObject({
+  severity: z19.string(),
+  title: z19.string(),
+  message: z19.string().optional(),
+  status: z19.string()
 });
-var AlertsSchema = z17.array(AlertSchema);
-var AddonUpdateSchema = z17.looseObject({
-  name: z17.string(),
-  currentVersion: z17.string(),
-  latestVersion: z17.string()
+var AlertsSchema = z19.array(AlertSchema);
+var AddonUpdateSchema = z19.looseObject({
+  name: z19.string(),
+  currentVersion: z19.string(),
+  latestVersion: z19.string()
 });
-var AddonUpdatesSchema = z17.array(AddonUpdateSchema);
+var AddonUpdatesSchema = z19.array(AddonUpdateSchema);
 var NODE_LIMIT2 = 40;
 var ALERT_LIMIT = 10;
 var UPDATE_LIMIT = 20;
@@ -5044,65 +5533,65 @@ async function opsStatus(ctx) {
 import {
   runGated as runGated3
 } from "@camstack/develop";
-import { z as z23 } from "zod";
+import { z as z21 } from "zod";
 
 // src/mcp/ops-update-model.ts
-import { z as z18 } from "zod";
-var ImageContractShape = z18.looseObject({
-  state: z18.enum(["in-sync", "behind-patch", "behind-series", "ahead", "unknown"]),
-  seedVersion: z18.string().nullable(),
-  contractVersion: z18.string().nullable(),
-  message: z18.string().optional()
+import { z as z20 } from "zod";
+var ImageContractShape = z20.looseObject({
+  state: z20.enum(["in-sync", "behind-patch", "behind-series", "ahead", "unknown"]),
+  seedVersion: z20.string().nullable(),
+  contractVersion: z20.string().nullable(),
+  message: z20.string().optional()
 });
-var WrapperShape = z18.looseObject({
-  kind: z18.enum(["docker", "electron", "native", "contradictory", "unknown"]),
-  currentVersion: z18.string().nullable().optional()
+var WrapperShape = z20.looseObject({
+  kind: z20.enum(["docker", "electron", "native", "contradictory", "unknown"]),
+  currentVersion: z20.string().nullable().optional()
 });
-var ServerStatusShape2 = z18.looseObject({
-  runningVersion: z18.string().nullable(),
-  installedVersion: z18.string().nullable().optional(),
-  latestVersion: z18.string().nullable().optional(),
-  pendingVersion: z18.string().nullable().optional(),
-  restartRequired: z18.boolean().optional(),
-  updateAvailable: z18.boolean().optional(),
-  updateState: z18.string().optional(),
-  lastCheckedAtMs: z18.number().nullable().optional(),
-  rolledBack: z18.looseObject({
-    fromVersion: z18.string(),
-    toVersion: z18.string().nullable(),
-    reason: z18.string()
+var ServerStatusShape2 = z20.looseObject({
+  runningVersion: z20.string().nullable(),
+  installedVersion: z20.string().nullable().optional(),
+  latestVersion: z20.string().nullable().optional(),
+  pendingVersion: z20.string().nullable().optional(),
+  restartRequired: z20.boolean().optional(),
+  updateAvailable: z20.boolean().optional(),
+  updateState: z20.string().optional(),
+  lastCheckedAtMs: z20.number().nullable().optional(),
+  rolledBack: z20.looseObject({
+    fromVersion: z20.string(),
+    toVersion: z20.string().nullable(),
+    reason: z20.string()
   }).nullable().optional(),
   imageContract: ImageContractShape.optional(),
   wrapper: WrapperShape.optional()
 });
-var AddonUpdateShape = z18.looseObject({
-  name: z18.string(),
-  currentVersion: z18.string(),
-  latestVersion: z18.string(),
-  category: z18.enum(["addon", "core"]),
-  requiresRestart: z18.boolean().optional(),
-  isSystem: z18.boolean()
+var AddonUpdateShape = z20.looseObject({
+  name: z20.string(),
+  currentVersion: z20.string(),
+  latestVersion: z20.string(),
+  category: z20.enum(["addon", "core"]),
+  requiresRestart: z20.boolean().optional(),
+  isSystem: z20.boolean()
 });
-var InstallationsShape2 = z18.looseObject({
-  installations: z18.array(
-    z18.looseObject({
-      packageName: z18.string(),
-      nodeId: z18.string(),
-      isHub: z18.boolean(),
-      isOnline: z18.boolean(),
-      version: z18.string().nullable(),
-      onHub: z18.boolean().optional()
+var InstallationsShape2 = z20.looseObject({
+  installations: z20.array(
+    z20.looseObject({
+      packageName: z20.string(),
+      nodeId: z20.string(),
+      isHub: z20.boolean(),
+      isOnline: z20.boolean(),
+      version: z20.string().nullable(),
+      onHub: z20.boolean().optional()
     })
   ),
-  unreachable: z18.array(z18.looseObject({ nodeId: z18.string(), error: z18.string() }))
+  unreachable: z20.array(z20.looseObject({ nodeId: z20.string(), error: z20.string() }))
 });
-var ServerActionShape = z18.looseObject({
-  accepted: z18.boolean().optional(),
-  outcome: z18.enum(["staged", "restart-scheduled", "already-current", "refused", "failed"]).optional(),
-  reason: z18.string().nullable().optional(),
-  error: z18.string().nullable().optional(),
-  message: z18.string().optional(),
-  blockers: z18.array(z18.looseObject({ addonId: z18.string(), reason: z18.string() })).optional()
+var ServerActionShape = z20.looseObject({
+  accepted: z20.boolean().optional(),
+  outcome: z20.enum(["staged", "restart-scheduled", "already-current", "refused", "failed"]).optional(),
+  reason: z20.string().nullable().optional(),
+  error: z20.string().nullable().optional(),
+  message: z20.string().optional(),
+  blockers: z20.array(z20.looseObject({ addonId: z20.string(), reason: z20.string() })).optional()
 });
 function statusInput(node) {
   return node.isHub === true ? void 0 : { nodeId: node.id };
@@ -5217,790 +5706,6 @@ function addonDrift(installations) {
   return drift;
 }
 
-// src/mcp/ops-update-cli.ts
-import { execFile } from "child_process";
-
-// src/mcp/setup-tools.ts
-import { text as text10 } from "@camstack/develop";
-import { z as z22 } from "zod";
-
-// src/mcp/setup-hubs.ts
-import * as https from "https";
-import {
-  createHubAgent,
-  explainTlsFailure,
-  HubAddressError,
-  hubCaFileForServer,
-  loadSession,
-  normalizeHubAddress,
-  resolveHubTls
-} from "@camstack/develop";
-import { z as z21 } from "zod";
-
-// src/mcp/setup-install.ts
-import { z as z20 } from "zod";
-
-// src/mcp/setup-install-rules.ts
-import { z as z19 } from "zod";
-var HOST_KINDS = [
-  "docker-compose",
-  "docker",
-  "unraid",
-  "proxmox-lxc",
-  "macos-desktop"
-];
-var HostKindSchema = z19.enum(HOST_KINDS);
-var ROLES = ["hub", "agent"];
-var RoleSchema = z19.enum(ROLES);
-var ACCELERATORS = ["intel", "amd", "coral", "apple", "cpu"];
-var AcceleratorSchema = z19.enum(ACCELERATORS);
-var InstallPathsSchema = z19.object({
-  data: z19.string().min(1),
-  recordings: z19.string().min(1),
-  config: z19.string().min(1).optional(),
-  backups: z19.string().min(1).optional()
-});
-var InstallGuideInputSchema = z19.object({
-  hostKind: HostKindSchema.optional(),
-  role: RoleSchema.optional(),
-  accelerator: AcceleratorSchema.optional(),
-  paths: InstallPathsSchema.optional(),
-  /** Agents only: the hub the agent should dial (host or IP). */
-  hubAddress: z19.string().min(1).optional()
-});
-var RAW = "https://raw.githubusercontent.com/camstack";
-var TEMPLATE_URLS = {
-  compose: {
-    hub: `${RAW}/proxmox/main/compose/hub.yml`,
-    agent: `${RAW}/proxmox/main/compose/agent.yml`
-  },
-  proxmoxInstaller: `${RAW}/proxmox/main/install-camstack-proxmox.sh`,
-  unraid: {
-    hub: `${RAW}/unraid-templates/main/templates/camstack.xml`,
-    agent: `${RAW}/unraid-templates/main/templates/camstack-agent.xml`
-  },
-  latestRelease: "https://api.github.com/repos/camstack/server/releases/latest"
-};
-var IMAGE_REPOSITORY = "ghcr.io/camstack/camstack";
-var IMAGE_TAG_BY_ACCELERATOR = {
-  intel: "intel-latest",
-  amd: "amd-latest",
-  // No Coral- or CPU-specific image: Intel hosts and the Unraid templates track intel-latest.
-  coral: "intel-latest",
-  cpu: "intel-latest",
-  apple: "intel-latest"
-};
-var NO_BARE_LATEST = "There is no bare :latest tag: use intel-<version>/intel-latest or amd-<version>/amd-latest, and never mix them across vendors.";
-var MUST_NOT_OMIT = [
-  "--pids-limit=8192 (pids_limit: 8192): the default 2048 counts threads and silently stops media on a busy hub.",
-  "CAMSTACK_MEDIA_ROOT=/recordings: without it recordings land in /data and fill the cache drive.",
-  "/config mapped: it is a VOLUME, so an unmapped path mints an anonymous volume on every re-create.",
-  "--restart unless-stopped: the NVR must come back after a host reboot.",
-  "CAMSTACK_MOLECULER_USE_HOSTNAME=false: otherwise a multi-machine cluster never forms.",
-  "Coral USB: /dev/bus/usb AND the device-cgroup rule c 189:* rmw."
-];
-var COMPOSE_MARKERS_BY_ACCELERATOR = {
-  intel: ["devices", "dri", "accel"],
-  amd: ["devices", "dri"],
-  coral: ["devices", "usb"],
-  cpu: [],
-  apple: []
-};
-function firstRunHub(host) {
-  return [
-    `Open https://${host}:4443 (a self-signed certificate: accept the browser warning).`,
-    "Sign in as admin / changeme; CamStack asks for a new password at once. Change it now.",
-    `Then, where your MCP client runs: camstack login ${host}`
-  ];
-}
-
-// src/mcp/setup-compose.ts
-var MARKER_LINE = /^(\s*)# (.*#@([A-Za-z0-9_]+)\s*)$/;
-var VOLUME_HOST_PATHS = [
-  { container: "/data", key: "data" },
-  { container: "/recordings", key: "recordings" },
-  { container: "/config", key: "config" },
-  { container: "/backups", key: "backups" }
-];
-function swapImageTag(body, imageTag) {
-  const escaped = IMAGE_REPOSITORY.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  return body.replace(new RegExp(`(${escaped}):[A-Za-z0-9._-]+`), `$1:${imageTag}`);
-}
-function enableMarkers(body, markers) {
-  return body.split("\n").map((line) => {
-    const match = MARKER_LINE.exec(line);
-    if (match === null) return line;
-    const tag = match[3];
-    return tag !== void 0 && markers.includes(tag) ? `${match[1] ?? ""}${match[2] ?? ""}` : line;
-  }).join("\n");
-}
-function setVolumeHosts(body, paths) {
-  const edits = [];
-  let out = body;
-  for (const { container, key } of VOLUME_HOST_PATHS) {
-    const wanted = paths?.[key];
-    const volume = new RegExp(`^(\\s*- )([^\\s:]+)(:${container}\\s*)$`, "m");
-    if (!volume.test(out)) {
-      if (wanted !== void 0) {
-        edits.push(
-          `${container}: no volume line found in the template; map ${wanted} to it yourself`
-        );
-      }
-      continue;
-    }
-    if (wanted === void 0) {
-      edits.push(
-        `${container}: left at the template's host path, change it if that is not where you want it`
-      );
-      continue;
-    }
-    out = out.replace(
-      volume,
-      (_m, pre, _host, post) => `${pre}${wanted}${post}`
-    );
-  }
-  return { body: out, edits };
-}
-function setHubAddress(body, hubAddress) {
-  const line = /^(\s*- CAMSTACK_HUB_ADDRESS=).*$/m;
-  if (!line.test(body)) return { body, edits: [] };
-  if (hubAddress === void 0) {
-    return {
-      body,
-      edits: [
-        "CAMSTACK_HUB_ADDRESS: export it before `docker compose up` (or edit the line) with the hub IP or hostname"
-      ]
-    };
-  }
-  return {
-    body: body.replace(line, (_m, pre) => `${pre}${hubAddress}`),
-    edits: []
-  };
-}
-function customizeCompose(source, c) {
-  const tagged = enableMarkers(swapImageTag(source, c.imageTag), c.markers);
-  const volumes = setVolumeHosts(tagged, c.paths);
-  const hub = setHubAddress(volumes.body, c.hubAddress);
-  return { body: hub.body, edits: [...volumes.edits, ...hub.edits] };
-}
-function unquote(value) {
-  const v = value.trim();
-  if (v.length >= 2 && (v.startsWith('"') || v.startsWith("'")) && v.endsWith(v[0] ?? "")) {
-    return v.slice(1, -1);
-  }
-  return v;
-}
-function stripComment(line) {
-  return line.replace(/\s+#.*$/, "");
-}
-function readService(body) {
-  const fields = {
-    scalars: /* @__PURE__ */ new Map(),
-    lists: /* @__PURE__ */ new Map(),
-    maps: /* @__PURE__ */ new Map()
-  };
-  let key = null;
-  let sub = null;
-  for (const raw of body.split("\n")) {
-    if (raw.trim() === "" || raw.trim().startsWith("#")) continue;
-    const line = stripComment(raw);
-    const indent = line.length - line.trimStart().length;
-    const text14 = line.trim();
-    if (indent === 4) {
-      sub = null;
-      const m = /^([A-Za-z_]+):\s*(.*)$/.exec(text14);
-      if (m === null) continue;
-      key = m[1] ?? null;
-      if (key !== null && (m[2] ?? "") !== "") fields.scalars.set(key, unquote(m[2] ?? ""));
-    } else if (indent === 6 && key !== null) {
-      if (text14.startsWith("- ")) {
-        const list = fields.lists.get(key) ?? [];
-        list.push(unquote(text14.slice(2)));
-        fields.lists.set(key, list);
-      } else {
-        const m = /^([A-Za-z_-]+):\s*(.*)$/.exec(text14);
-        if (m === null) continue;
-        sub = m[1] ?? null;
-        const map = fields.maps.get(key) ?? /* @__PURE__ */ new Map();
-        if ((m[2] ?? "") !== "" && sub !== null) map.set(sub, unquote(m[2] ?? ""));
-        fields.maps.set(key, map);
-      }
-    } else if (indent === 8 && key !== null && sub !== null) {
-      const m = /^([A-Za-z_-]+):\s*(.*)$/.exec(text14);
-      if (m === null) continue;
-      const map = fields.maps.get(`${key}.${sub}`) ?? /* @__PURE__ */ new Map();
-      map.set(m[1] ?? "", unquote(m[2] ?? ""));
-      fields.maps.set(`${key}.${sub}`, map);
-    }
-  }
-  return fields;
-}
-function shellQuote(value) {
-  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
-}
-function composeToDockerRun(body) {
-  const f = readService(body);
-  const image = f.scalars.get("image");
-  if (image === void 0) return null;
-  const args = ["docker run -d"];
-  const name = f.scalars.get("container_name");
-  if (name !== void 0) args.push(`--name ${shellQuote(name)}`);
-  const restart = f.scalars.get("restart");
-  if (restart !== void 0) args.push(`--restart ${shellQuote(restart)}`);
-  const network = f.scalars.get("network_mode");
-  if (network !== void 0) args.push(`--network ${shellQuote(network)}`);
-  const pids = f.scalars.get("pids_limit");
-  if (pids !== void 0) args.push(`--pids-limit=${pids}`);
-  for (const d of f.lists.get("devices") ?? []) args.push(`--device ${shellQuote(d)}`);
-  for (const r of f.lists.get("device_cgroup_rules") ?? []) {
-    args.push(`--device-cgroup-rule ${shellQuote(r)}`);
-  }
-  for (const g of f.lists.get("group_add") ?? []) args.push(`--group-add ${shellQuote(g)}`);
-  for (const v of f.lists.get("volumes") ?? []) args.push(`-v ${shellQuote(v)}`);
-  for (const e of f.lists.get("environment") ?? []) {
-    if (!e.includes("${")) args.push(`-e ${shellQuote(e)}`);
-  }
-  const driver = f.maps.get("logging")?.get("driver");
-  if (driver !== void 0) args.push(`--log-driver ${shellQuote(driver)}`);
-  for (const [k, v] of f.maps.get("logging.options") ?? []) {
-    args.push(`--log-opt ${shellQuote(`${k}=${v}`)}`);
-  }
-  args.push(shellQuote(image));
-  return args.join(" \\\n  ");
-}
-
-// src/mcp/setup-install.ts
-var FETCH_TIMEOUT_MS = 1e4;
-var CONTAINER_ROUTES = ["docker-compose", "docker"];
-var Q_HOST = {
-  id: "hostKind",
-  question: "Where will CamStack run?",
-  options: ["docker-compose", "docker", "unraid", "proxmox-lxc", "macos-desktop"]
-};
-var Q_ROLE = {
-  id: "role",
-  question: "Which role? Start with a hub; an agent only adds a second machine to an existing hub.",
-  options: ["hub", "agent"]
-};
-var Q_ACCEL = {
-  id: "accelerator",
-  question: "Which accelerator does this host have?",
-  options: ["intel", "amd", "coral", "cpu"]
-};
-var Q_PATHS = {
-  id: "paths",
-  question: "Host paths as {data, recordings} (optionally config, backups). Recordings is the one that grows: put it on a roomy disk.",
-  options: []
-};
-function missingQuestions(input) {
-  const out = [];
-  if (input.hostKind === void 0) out.push(Q_HOST);
-  if (input.role === void 0) out.push(Q_ROLE);
-  const desktop = input.hostKind === "macos-desktop";
-  if (!desktop && (input.accelerator === void 0 || input.accelerator === "apple")) {
-    out.push(Q_ACCEL);
-  }
-  if (input.hostKind !== void 0 && CONTAINER_ROUTES.includes(input.hostKind) && input.paths === void 0) {
-    out.push(Q_PATHS);
-  }
-  return out;
-}
-async function fetchText(url, fetchFn) {
-  try {
-    const res = await fetchFn(url, {
-      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
-    });
-    if (!res.ok) {
-      return {
-        ok: false,
-        failure: {
-          status: "fetch-failed",
-          url,
-          error: `answered ${res.status}`
-        }
-      };
-    }
-    return { ok: true, body: await res.text() };
-  } catch (err) {
-    const error = err instanceof Error ? err.message : String(err);
-    return { ok: false, failure: { status: "fetch-failed", url, error } };
-  }
-}
-var ReleaseSchema = z20.object({
-  tag_name: z20.string(),
-  assets: z20.array(z20.object({ name: z20.string(), browser_download_url: z20.string() }))
-});
-var DMG = /^CamStack-[0-9][0-9A-Za-z.-]*-(arm64|x64)\.dmg$/;
-function acceleratorEdits(accelerator, role) {
-  const note = `Image tag ${IMAGE_TAG_BY_ACCELERATOR[accelerator]} for ${accelerator}. ${NO_BARE_LATEST}`;
-  return role === "agent" ? [note, "Do not run a hub and an agent on the same host."] : [note];
-}
-async function composeGuide(input, fetchFn, asDockerRun) {
-  const url = TEMPLATE_URLS.compose[input.role];
-  const fetched = await fetchText(url, fetchFn);
-  if (!fetched.ok) return fetched.failure;
-  const imageTag = IMAGE_TAG_BY_ACCELERATOR[input.accelerator];
-  const custom = customizeCompose(fetched.body, {
-    imageTag,
-    markers: COMPOSE_MARKERS_BY_ACCELERATOR[input.accelerator],
-    paths: input.paths,
-    hubAddress: input.hubAddress
-  });
-  const edits = [...custom.edits, ...acceleratorEdits(input.accelerator, input.role)];
-  const first = firstRun(input);
-  if (!asDockerRun) {
-    return ready(input, imageTag, {
-      steps: [
-        "Save docker-compose.yml (below) in an empty directory on the host.",
-        "docker compose up -d && docker compose logs -f camstack",
-        "The first boot seeds addons and pulls models: allow a few minutes.",
-        ...first
-      ],
-      files: [{ path: "docker-compose.yml", body: custom.body, source: url }],
-      edits
-    });
-  }
-  const run = composeToDockerRun(custom.body);
-  if (run === null) {
-    return {
-      status: "fetch-failed",
-      url,
-      error: "the official compose file has no image line; cannot derive docker run"
-    };
-  }
-  return ready(input, imageTag, {
-    steps: [
-      "Create the host directories named by the -v lines, then run the file below as a shell script.",
-      "docker logs -f camstack (the first boot seeds addons and pulls models).",
-      ...first
-    ],
-    files: [{ path: "run-camstack.sh", body: `#!/bin/sh
-${run}
-`, source: url }],
-    edits
-  });
-}
-async function unraidGuide(input, fetchFn) {
-  const url = TEMPLATE_URLS.unraid[input.role];
-  const fetched = await fetchText(url, fetchFn);
-  if (!fetched.ok) return fetched.failure;
-  const imageTag = IMAGE_TAG_BY_ACCELERATOR[input.accelerator];
-  const edits = [
-    `In the template form, set Repository to ${IMAGE_REPOSITORY}:${imageTag} (the template ships intel-latest). ${NO_BARE_LATEST}`,
-    "Recordings: point it at a roomy array share, not the cache; leave Media root as /recordings.",
-    "Keep ExtraParams as shipped: --device-cgroup-rule and --pids-limit=8192.",
-    ...unraidDeviceEdits(input.accelerator)
-  ];
-  const first = firstRun(input);
-  return ready(input, imageTag, {
-    steps: [
-      `Unraid: Docker > Add Container > Template, paste ${url}`,
-      "Review the paths and Repository (edits below), then Apply.",
-      ...first
-    ],
-    files: [{ path: urlName(url), body: fetched.body, source: url }],
-    edits
-  });
-}
-function unraidDeviceEdits(accelerator) {
-  if (accelerator === "intel" || accelerator === "amd") {
-    return ["Intel/AMD iGPU: enter /dev/dri in that field. Intel NPU: enter /dev/accel."];
-  }
-  if (accelerator === "coral") {
-    return ["Coral USB: enter /dev/bus/usb (the whole bus). Coral PCIe/M.2: /dev/apex_0 (and _1)."];
-  }
-  return [];
-}
-function urlName(url) {
-  return url.slice(url.lastIndexOf("/") + 1);
-}
-async function proxmoxGuide(input, fetchFn) {
-  const url = TEMPLATE_URLS.proxmoxInstaller;
-  const fetched = await fetchText(url, fetchFn);
-  if (!fetched.ok) return fetched.failure;
-  const imageTag = IMAGE_TAG_BY_ACCELERATOR[input.accelerator];
-  const vars = [`ROLE=${input.role}`];
-  vars.push(`IMAGE_TAG=${IMAGE_REPOSITORY}:${imageTag}`);
-  if (input.accelerator === "cpu") vars.push("PASS_ACCEL=none");
-  if (input.role === "agent") vars.push(`CAMSTACK_HUB_ADDRESS=${input.hubAddress ?? "<hub-ip>"}`);
-  if (input.paths !== void 0) vars.push(`RECORDINGS_HOST_PATH=${input.paths.recordings}`);
-  const header = fetched.body.split("\n").slice(1, 20).filter((l) => l.startsWith("#")).join("\n");
-  const first = firstRun(input);
-  return ready(input, imageTag, {
-    steps: [
-      "Run on the Proxmox HOST (needs `pct`), not inside a container. It asks nothing: everything is an environment variable (defaults: VMID 200 hub / 201 agent, 8 cores, 8 GB, 64 GB disk, bridge vmbr0).",
-      `${vars.join(" ")} bash -c "$(curl -fsSL ${url})"`,
-      "It builds an Ubuntu 24.04 LXC with Docker, passes through the accelerators the host has (PASS_ACCEL=none skips it) and starts CamStack.",
-      ...first
-    ],
-    files: [
-      {
-        path: "install-camstack-proxmox.sh (header)",
-        body: header,
-        source: url
-      }
-    ],
-    edits: [
-      `The script defaults to the amd image; IMAGE_TAG above sets ${imageTag}. ${NO_BARE_LATEST}`,
-      "A hub and an agent on one machine need two CTs (host networking collides otherwise)."
-    ]
-  });
-}
-async function macGuide(input, fetchFn) {
-  const url = TEMPLATE_URLS.latestRelease;
-  const fetched = await fetchText(url, fetchFn);
-  if (!fetched.ok) return fetched.failure;
-  let release;
-  try {
-    const parsed = ReleaseSchema.safeParse(JSON.parse(fetched.body));
-    if (!parsed.success) {
-      return {
-        status: "fetch-failed",
-        url,
-        error: "the release answer had no assets"
-      };
-    }
-    release = parsed.data;
-  } catch {
-    return {
-      status: "fetch-failed",
-      url,
-      error: "the release answer was not JSON"
-    };
-  }
-  const dmgs = release.assets.filter((a) => DMG.test(a.name));
-  const first = firstRun(input);
-  return ready(input, null, {
-    steps: [
-      `Download the disk image for your Mac from release ${release.tag_name}: ${dmgs.map((a) => `${a.name} (${a.browser_download_url})`).join(" or ")}. Apple silicon (M1 and later) takes arm64; Intel takes x64. The CamStackViewer files are a different app.`,
-      "Drag CamStack into Applications and open it.",
-      `The setup window asks what this Mac should be: choose ${input.role === "hub" ? "Hub (full server)" : "Agent (worker)"}, then Save and start.`,
-      ...first
-    ],
-    files: [],
-    edits: ["A Mac uses the app, not Docker: a container there cannot reach the Neural Engine."]
-  });
-}
-function firstRun(input) {
-  const host = input.hostKind === "macos-desktop" ? "localhost" : "<host>";
-  if (input.role === "hub") return firstRunHub(host);
-  return [
-    "The agent status dashboard answers on http://<agent-host>:4444.",
-    "Pair it from the hub: run setup_add_node (it lists agents found on the network), then in the admin UI Cluster > Nodes > Agents found on the network. Type the six digits shown on the other screen on BOTH sides."
-  ];
-}
-function ready(input, imageTag, body) {
-  return {
-    status: "ready",
-    hostKind: input.hostKind,
-    role: input.role,
-    imageTag,
-    steps: body.steps,
-    files: body.files,
-    edits: body.edits,
-    mustNotOmit: input.hostKind === "macos-desktop" ? [] : MUST_NOT_OMIT
-  };
-}
-async function installGuide(input, fetchFn) {
-  const questions = missingQuestions(input);
-  if (questions.length > 0) return { status: "need-answers", questions };
-  const { hostKind, role } = input;
-  if (hostKind === void 0 || role === void 0) {
-    return { status: "need-answers", questions: missingQuestions({}) };
-  }
-  const resolved = {
-    hostKind,
-    role,
-    accelerator: hostKind === "macos-desktop" ? "apple" : input.accelerator ?? "cpu",
-    paths: input.paths,
-    hubAddress: input.hubAddress
-  };
-  switch (hostKind) {
-    case "docker-compose":
-      return composeGuide(resolved, fetchFn, false);
-    case "docker":
-      return composeGuide(resolved, fetchFn, true);
-    case "unraid":
-      return unraidGuide(resolved, fetchFn);
-    case "proxmox-lxc":
-      return proxmoxGuide(resolved, fetchFn);
-    case "macos-desktop":
-      return macGuide(resolved, fetchFn);
-  }
-}
-
-// src/mcp/setup-hubs.ts
-var DEFAULT_DISCOVER_TIMEOUT_MS = 2500;
-var MAX_DISCOVER_TIMEOUT_MS = 15e3;
-var HEALTH_TIMEOUT_MS = 5e3;
-var LOGIN = (server) => `run \`camstack login ${server}\` in a terminal`;
-var httpsHealth = (url, tls) => new Promise((resolve) => {
-  const req = https.get(
-    `${url}/health`,
-    { agent: createHubAgent(tls), timeout: HEALTH_TIMEOUT_MS },
-    (res) => {
-      res.resume();
-      resolve({ ok: true, status: res.statusCode ?? 0 });
-    }
-  );
-  req.on("timeout", () => req.destroy(new Error("timed out")));
-  req.on("error", (err) => {
-    resolve({
-      ok: false,
-      error: err.message,
-      tlsHint: explainTlsFailure(url, err)
-    });
-  });
-});
-async function discoverHubsTool(timeoutMs, deps) {
-  const wait = Math.min(timeoutMs ?? DEFAULT_DISCOVER_TIMEOUT_MS, MAX_DISCOVER_TIMEOUT_MS);
-  const finder = deps.findHubs ?? ((ms) => findHubs({
-    mdnsTimeoutMs: ms,
-    ...deps.sessionDir !== void 0 ? { sessionDir: deps.sessionDir } : {},
-    ...deps.env !== void 0 ? { env: deps.env } : {}
-  }));
-  const found = await finder(wait);
-  const hubs = found.map((h) => ({
-    host: h.host,
-    port: h.port,
-    name: h.nodeId,
-    version: h.version,
-    sources: h.sources
-  }));
-  return {
-    status: "ok",
-    hubs,
-    next: hubs.length === 0 ? "no hub answered: install one with setup_install_guide, or pass its address to setup_connect" : "pass the host of the hub you want to setup_connect"
-  };
-}
-function pinnedTls(url, deps) {
-  const caFile = hubCaFileForServer(url, deps.sessionDir);
-  try {
-    return {
-      tls: resolveHubTls(url, deps.env ?? process.env, deps.sessionDir),
-      caFile
-    };
-  } catch {
-    return { tls: {}, caFile };
-  }
-}
-async function connectTool(server, deps) {
-  let url;
-  try {
-    url = normalizeHubAddress(server);
-  } catch (err) {
-    const message = err instanceof HubAddressError ? err.message : String(err);
-    return { status: "invalid-address", server, message };
-  }
-  const { tls, caFile } = pinnedTls(url, deps);
-  const outcome = await (deps.health ?? httpsHealth)(url, tls);
-  const caPinned = tls.ca !== void 0;
-  const session = loadSession(url, deps.sessionDir);
-  const sessionInfo = {
-    exists: session !== null,
-    username: session?.username ?? null
-  };
-  if (!outcome.ok) {
-    return {
-      status: "unreachable",
-      server: url,
-      message: outcome.error,
-      tls: { caPinned, caFile, hint: outcome.tlsHint },
-      session: sessionInfo,
-      next: outcome.tlsHint === null ? "check the host, that the hub is running, and that port 4443 is reachable" : `the hub answers but its certificate is not trusted: ${LOGIN(url)}; login pins the CA (never disable verification)`
-    };
-  }
-  return {
-    status: "reachable",
-    server: url,
-    health: { status: outcome.status },
-    tls: { caPinned, caFile, hint: null },
-    session: sessionInfo,
-    next: session === null ? LOGIN(url) : "a session exists: the ops tools can use it"
-  };
-}
-var DiscoveredAgentsSchema = z21.object({
-  agents: z21.array(
-    z21.object({
-      nodeId: z21.string(),
-      host: z21.string(),
-      port: z21.number(),
-      version: z21.string().nullable(),
-      name: z21.string().nullable(),
-      state: z21.enum(["unpaired", "pending", "paired"])
-    })
-  )
-});
-var PAIRING_STEPS = [
-  "Pairing is started from the HUB (D857): admin UI, Cluster > Nodes > Agents found on the network. Pick the agent, or add it by address (host and port 4444).",
-  "Both screens now show six digits. Type the digits shown on the OTHER screen, on BOTH sides: the hub operator types the code the agent shows, and the agent operator confirms on the agent.",
-  "The agent installs its certificate only after its own operator confirmed. Nothing here (and no tool of this MCP) confirms a pairing for you.",
-  "The agent then appears under Cluster > Nodes."
-];
-async function addNodeTool(input, ctx) {
-  const guide = await installGuide({ ...input, role: "agent" }, ctx.fetch);
-  const outcome = await ctx.hub();
-  if (!outcome.ok) {
-    return {
-      guide,
-      pairing: PAIRING_STEPS,
-      agentsOnNetwork: { status: "no-session", action: outcome.action }
-    };
-  }
-  try {
-    const raw = await outcome.connection.client.call("GET", "agentPairing.listDiscoveredAgents", {});
-    const parsed = DiscoveredAgentsSchema.safeParse(raw);
-    return {
-      guide,
-      pairing: PAIRING_STEPS,
-      agentsOnNetwork: parsed.success ? { status: "ok", agents: parsed.data.agents } : {
-        status: "unavailable",
-        error: "the hub answered in an unexpected shape"
-      }
-    };
-  } catch (err) {
-    return {
-      guide,
-      pairing: PAIRING_STEPS,
-      agentsOnNetwork: {
-        status: "unavailable",
-        error: err instanceof Error ? err.message : String(err)
-      }
-    };
-  }
-}
-
-// src/mcp/setup-tools.ts
-var SUPPORTED_HOST_KINDS = HOST_KINDS;
-var REGISTRY2 = "https://registry.npmjs.org";
-var REGISTRY_TIMEOUT_MS2 = 5e3;
-var RegistryLatestSchema = z22.object({ version: z22.string() });
-async function latestOnNpm(name, fetchFn) {
-  const url = `${REGISTRY2}/${name.replace("/", "%2f")}/latest`;
-  try {
-    const res = await fetchFn(url, {
-      signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS2)
-    });
-    if (!res.ok) return { latest: null, error: `registry answered ${res.status}` };
-    const parsed = RegistryLatestSchema.safeParse(await res.json());
-    if (!parsed.success) return { latest: null, error: "registry answer had no version" };
-    return { latest: parsed.data.version };
-  } catch (err) {
-    return {
-      latest: null,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
-async function about(ctx) {
-  const [cli, server] = await Promise.all([
-    latestOnNpm("camstack", ctx.fetch),
-    latestOnNpm("@camstack/server", ctx.fetch)
-  ]);
-  return {
-    cli: { installed: ctx.cliVersion, ...cli },
-    server,
-    supportedHostKinds: SUPPORTED_HOST_KINDS
-  };
-}
-function registerSetupTools(server, ctx, deps = {}) {
-  server.tool(
-    "setup_about",
-    "Versions of the camstack CLI (installed and latest on npm), the latest @camstack/server on npm, and the host kinds CamStack supports. Needs no hub and no login.",
-    {},
-    async () => text10(await about(ctx))
-  );
-  server.tool(
-    "setup_install_guide",
-    'Interview-style install guide. Call it with whatever you know; while an answer is missing it returns {status:"need-answers", questions} listing only what is still unknown. When complete it returns the steps and the OFFICIAL template files (fetched live) for that route: docker-compose, docker, unraid, proxmox-lxc or macos-desktop. Start with a hub.',
-    {
-      hostKind: HostKindSchema.optional(),
-      role: RoleSchema.optional(),
-      accelerator: AcceleratorSchema.optional(),
-      paths: InstallPathsSchema.optional(),
-      hubAddress: z22.string().min(1).optional().describe("Agents only: the hub to dial.")
-    },
-    async (input) => text10(await installGuide(input, ctx.fetch))
-  );
-  server.tool(
-    "setup_discover_hubs",
-    "Find CamStack hubs on the local network (mDNS) plus the hubs this machine already knows, with host, port, name and version. Needs no login.",
-    { timeoutMs: z22.number().int().min(200).max(15e3).optional() },
-    async ({ timeoutMs }) => text10(await discoverHubsTool(timeoutMs, deps))
-  );
-  server.tool(
-    "setup_connect",
-    "Check that a hub answers on https://<server>:4443/health, whether its CA is already pinned for TLS, and whether a `camstack login` session exists. Never takes a password: when there is no session it says to run `camstack login <server>` in a terminal.",
-    { server: z22.string().min(1) },
-    async ({ server: address }) => text10(await connectTool(address, deps))
-  );
-  server.tool(
-    "setup_add_node",
-    "Guide to add an AGENT (a second machine) to a hub: the install route for that host, then the pairing flow where the operator types the six digits shown on the other screen on both sides. With a login session it also lists the agents found on the network. It never confirms a pairing.",
-    {
-      hostKind: HostKindSchema.optional(),
-      accelerator: AcceleratorSchema.optional(),
-      paths: InstallPathsSchema.optional(),
-      hubAddress: z22.string().min(1).optional()
-    },
-    async (input) => text10(await addNodeTool(input, ctx))
-  );
-}
-
-// src/mcp/ops-update-cli.ts
-var CLI_PACKAGE = "camstack";
-var NPM_GLOBAL = /[\\/]lib[\\/]node_modules[\\/]camstack[\\/]|[\\/]npm[\\/]node_modules[\\/]camstack[\\/]/;
-var OTHER_MANAGER = /[\\/]\.bun[\\/]|[\\/]pnpm[\\/]|[\\/]\.yarn[\\/]|[\\/]yarn[\\/]|[\\/]\.volta[\\/]/;
-function detectCliInstall(entryPath) {
-  const manual = `Update it with the package manager it was installed with, for example \`npm install -g ${CLI_PACKAGE}@latest\` (no sudo: fix the npm prefix permissions instead).`;
-  if (/[\\/]_npx[\\/]/.test(entryPath)) {
-    return {
-      method: "npx",
-      command: null,
-      instructions: `The CLI runs through npx: there is nothing installed to update. Start it as \`npx ${CLI_PACKAGE}@latest mcp\` (or clear the npx cache), then restart the MCP in your client.`
-    };
-  }
-  if (OTHER_MANAGER.test(entryPath) || !NPM_GLOBAL.test(entryPath)) {
-    return { method: "unknown", command: null, instructions: manual };
-  }
-  return {
-    method: "npm-global",
-    command: ["npm", "install", "-g", `${CLI_PACKAGE}@latest`],
-    instructions: `npm install -g ${CLI_PACKAGE}@latest`
-  };
-}
-var runCommand = (file, args) => new Promise((resolve) => {
-  execFile(file, [...args], { timeout: 5 * 6e4 }, (err, stdout, stderr) => {
-    const out = `${stdout}${stderr}`.trim().slice(-600);
-    resolve({
-      ok: err === null,
-      output: err ? `${err.message} ${out}`.trim() : out
-    });
-  });
-});
-function parts(v) {
-  return v.split("-")[0].split(".").map((n) => Number.parseInt(n, 10) || 0);
-}
-function isOlder(a, b) {
-  const x = parts(a);
-  const y = parts(b);
-  for (let i = 0; i < 3; i++) {
-    const d = (x[i] ?? 0) - (y[i] ?? 0);
-    if (d !== 0) return d < 0;
-  }
-  return false;
-}
-async function cliVerdict(installed, fetchFn, entryPath) {
-  const latest = await latestOnNpm(CLI_PACKAGE, fetchFn);
-  return {
-    installed,
-    latest: latest.latest,
-    updateAvailable: latest.latest === null ? null : isOlder(installed, latest.latest),
-    ...latest.error !== void 0 ? { error: latest.error } : {},
-    install: detectCliInstall(entryPath)
-  };
-}
-
 // src/mcp/ops-update-apply.ts
 var UPDATE_APPLY_TOOL = "ops_update_apply";
 function timing(deps) {
@@ -6053,7 +5758,7 @@ async function readPlan(client, args, ctx, deps) {
       wrapper: wrapperVerdict(status.value)
     });
   }
-  const updates = args.addons === false ? null : await readQuery(client, "addons.listUpdates", {}, z23.array(AddonUpdateShape));
+  const updates = args.addons === false ? null : await readQuery(client, "addons.listUpdates", {}, z21.array(AddonUpdateShape));
   const cli = args.cli === false ? null : await cliVerdict(ctx.cliVersion, ctx.fetch, deps.entryPath ?? process.argv[1] ?? "");
   const hub = plans.find((p) => p.node.isHub === true) ?? null;
   return {
@@ -6369,14 +6074,14 @@ async function opsUpdateApply(ctx, args, confirmToken, deps = {}) {
 }
 
 // src/mcp/ops-update-check.ts
-import { z as z24 } from "zod";
+import { z as z22 } from "zod";
 var ADDON_LIMIT = 30;
 async function opsUpdateCheck(ctx, deps = {}) {
   return withAdminHub(ctx, async ({ client, server }) => {
     const unavailable = {};
     const [topology, updates, installs, cli] = await Promise.all([
       readTopology(client),
-      readQuery(client, "addons.listUpdates", {}, z24.array(AddonUpdateShape)),
+      readQuery(client, "addons.listUpdates", {}, z22.array(AddonUpdateShape)),
       readInstallations(client),
       cliVerdict(ctx.cliVersion, ctx.fetch, deps.entryPath ?? process.argv[1] ?? "")
     ]);
@@ -6494,40 +6199,40 @@ function registerOpsTools(server, ctx) {
     "ops_whoami",
     "Which hub this MCP talks to and as whom, from the `camstack login` session (no network call). If there is no session, says to run `camstack login <host>` in a terminal.",
     {},
-    async () => text11(await whoami(ctx))
+    async () => text(await whoami(ctx))
   );
   server.tool(
     "ops_status",
     'Cluster summary: every node (online, platform, server version, capability count, "online-but-capless" flag), the active alerts and the addons with an update. A part the hub did not answer is null with its reason in `unavailable`, never zero. Node list and updates need an admin `camstack login`.',
     {},
-    async () => text11(await opsStatus(ctx))
+    async () => text(await opsStatus(ctx))
   );
   server.tool(
     "ops_device",
     "One device: online state, provider addon and node, bound capabilities, runtime-state age and, for a camera, its pipeline, recording state, the functions an operator switched off (not faults) and its latest object events.",
-    { deviceId: z25.number().int() },
-    async ({ deviceId }) => text11(await opsDevice(ctx, deviceId))
+    { deviceId: z23.number().int() },
+    async ({ deviceId }) => text(await opsDevice(ctx, deviceId))
   );
   server.tool(
     "ops_unhealthy_devices",
     "Every enabled device that is unhealthy, each with a typed reason (offline, detection-provisioning-failed, detection-not-assigned, recording-inactive). A function an operator switched off is never listed; a camera whose status could not be fully read is listed under `unknown`.",
     {},
-    async () => text11(await opsUnhealthyDevices(ctx))
+    async () => text(await opsUnhealthyDevices(ctx))
   );
   server.tool(
     "ops_logs",
     "Hub logs scoped by deviceId, addon, node, level, window and free text, grouped and deduplicated with counts. Says which tier answered (ring = recent in-RAM; persisted = the default log destination). With `around` (a track or event id) returns `contextLines` lines on each side of its first mention. Needs an admin `camstack login`.",
     {
-      deviceId: z25.number().int().optional(),
-      addonId: z25.string().optional(),
-      nodeId: z25.string().optional(),
-      level: z25.enum(["debug", "info", "warn", "error"]).optional(),
-      windowMinutes: z25.number().int().min(1).max(1440).optional(),
-      text: z25.string().max(200).optional(),
-      around: z25.string().max(200).optional(),
-      contextLines: z25.number().int().min(1).max(50).optional()
+      deviceId: z23.number().int().optional(),
+      addonId: z23.string().optional(),
+      nodeId: z23.string().optional(),
+      level: z23.enum(["debug", "info", "warn", "error"]).optional(),
+      windowMinutes: z23.number().int().min(1).max(1440).optional(),
+      text: z23.string().max(200).optional(),
+      around: z23.string().max(200).optional(),
+      contextLines: z23.number().int().min(1).max(50).optional()
     },
-    async (args) => text11(
+    async (args) => text(
       await opsLogs(ctx, {
         ...args.deviceId !== void 0 ? { deviceId: args.deviceId } : {},
         ...args.addonId ? { addonId: args.addonId } : {},
@@ -6544,14 +6249,14 @@ function registerOpsTools(server, ctx) {
     "ops_events",
     "Find tracks (and, for one camera, object events) by camera, class, zone, time window and free text. Each result carries an admin-UI link and a viewer link built on the hub address flagged for app connections.",
     {
-      deviceId: z25.number().int().optional(),
-      className: z25.string().optional(),
-      zone: z25.string().optional(),
-      text: z25.string().max(200).optional(),
-      windowMinutes: z25.number().int().min(1).max(10080).optional(),
-      limit: z25.number().int().min(1).max(50).optional()
+      deviceId: z23.number().int().optional(),
+      className: z23.string().optional(),
+      zone: z23.string().optional(),
+      text: z23.string().max(200).optional(),
+      windowMinutes: z23.number().int().min(1).max(10080).optional(),
+      limit: z23.number().int().min(1).max(50).optional()
     },
-    async (args) => text11(
+    async (args) => text(
       await opsEvents(ctx, {
         ...args.deviceId !== void 0 ? { deviceId: args.deviceId } : {},
         ...args.className ? { className: args.className } : {},
@@ -6565,31 +6270,31 @@ function registerOpsTools(server, ctx) {
   server.tool(
     "ops_track",
     "One track with its media audit: best shot, keyframes, every missing media kind with the reason the track recorded for it, and the audit findings. Links to the admin UI and the viewer.",
-    { deviceId: z25.number().int(), trackId: z25.string().min(1) },
-    async ({ deviceId, trackId }) => text11(await opsTrack(ctx, { deviceId, trackId }))
+    { deviceId: z23.number().int(), trackId: z23.string().min(1) },
+    async ({ deviceId, trackId }) => text(await opsTrack(ctx, { deviceId, trackId }))
   );
   server.tool(
     "ops_accelerators",
     'Per node: the inference devices it has, the Auto-tune hardware class the node maps to, and whether the measured detector-latency table has a row for that class and accelerator. A node that could not be read is null with a reason, never "no accelerator". Needs an admin `camstack login`.',
     {},
-    async () => text11(await opsAccelerators(ctx))
+    async () => text(await opsAccelerators(ctx))
   );
   server.tool(
     "ops_update_check",
     'Read-only update report for the whole cluster. Every node from the topology: running vs installed vs latest @camstack/server, restartRequired / updateState / rolledBack, the wrapper (Docker image / desktop app) verdict, and whether its addon versions match the hub; the hub\'s addon updates; the viewer (not exposed by any API, said so); and this CLI/MCP against npm. A node that cannot be read is null with a reason, never "up to date". Needs an admin `camstack login`.',
     {},
-    async () => text11(await opsUpdateCheck(ctx))
+    async () => text(await opsUpdateCheck(ctx))
   );
   server.tool(
     UPDATE_APPLY_TOOL,
     "Bring the cluster up to date, verified step by step: hub server closure, wait until the hub runs it, then each online agent, then addons (agents follow by reconciliation, verified), then this CLI last. Two steps: call without confirm_token for a preview (order, versions, wrapper instructions, timeouts) and a one-shot token, then again with the SAME arguments and that token. A failed step stops the chain and names the node. Wrapper (image/app) updates are only reported with instructions. Needs an admin `camstack login`.",
     {
-      version: z25.string().min(1).optional().describe("Server target; default = the hub's latest."),
-      addons: z25.boolean().optional().describe("Update addons too (default true)."),
-      cli: z25.boolean().optional().describe("Update this CLI last (default true)."),
-      confirm_token: z25.string().optional()
+      version: z23.string().min(1).optional().describe("Server target; default = the hub's latest."),
+      addons: z23.boolean().optional().describe("Update addons too (default true)."),
+      cli: z23.boolean().optional().describe("Update this CLI last (default true)."),
+      confirm_token: z23.string().optional()
     },
-    async ({ version, addons, cli, confirm_token }) => text11(
+    async ({ version, addons, cli, confirm_token }) => text(
       await opsUpdateApply(
         ctx,
         {
@@ -6604,7 +6309,7 @@ function registerOpsTools(server, ctx) {
 }
 
 // src/mcp/configure-tools.ts
-var CurrentDeviceSchema = z26.object({ name: z26.string() }).nullable();
+var CurrentDeviceSchema = z24.object({ name: z24.string() }).nullable();
 var RENAME_DEVICE_TOOL = "configure_rename_device";
 function renameDeviceSpec(client) {
   return {
@@ -6666,11 +6371,11 @@ function registerConfigureTools(server, ctx) {
     RENAME_DEVICE_TOOL,
     "Rename a device. Two steps: call without confirm_token for a preview and a one-shot token, then call again with the SAME arguments and that token to apply. Needs an admin `camstack login` session.",
     {
-      deviceId: z26.number().int(),
-      name: z26.string().min(1),
-      confirm_token: z26.string().optional()
+      deviceId: z24.number().int(),
+      name: z24.string().min(1),
+      confirm_token: z24.string().optional()
     },
-    async ({ deviceId, name, confirm_token }) => text12(await renameDevice(ctx, { deviceId, name }, confirm_token))
+    async ({ deviceId, name, confirm_token }) => text(await renameDevice(ctx, { deviceId, name }, confirm_token))
   );
   registerAddonTools(server, ctx);
   registerCameraTools(server, ctx);
@@ -6679,11 +6384,10 @@ function registerConfigureTools(server, ctx) {
 }
 
 // src/mcp/support-tools.ts
-import { text as text13 } from "@camstack/develop";
-import { z as z31 } from "zod";
+import { z as z29 } from "zod";
 
 // src/mcp/support-accelerator.ts
-import { z as z27 } from "zod";
+import { z as z25 } from "zod";
 var EXPECTED_ACCELERATORS = [
   "intel-igpu",
   "intel-npu",
@@ -6695,23 +6399,23 @@ var EXPECTED_ACCELERATORS = [
   "apple-ane",
   "nvidia"
 ];
-var ExpectedAcceleratorSchema = z27.enum(EXPECTED_ACCELERATORS);
-var HardwareSchema2 = z27.looseObject({
-  platform: z27.enum(["darwin", "linux", "win32"]),
-  arch: z27.enum(["arm64", "x64"]),
-  cpuModel: z27.string(),
-  gpu: z27.looseObject({ type: z27.string(), name: z27.string() }).nullable(),
-  npu: z27.looseObject({ type: z27.string() }).nullable()
+var ExpectedAcceleratorSchema = z25.enum(EXPECTED_ACCELERATORS);
+var HardwareSchema2 = z25.looseObject({
+  platform: z25.enum(["darwin", "linux", "win32"]),
+  arch: z25.enum(["arm64", "x64"]),
+  cpuModel: z25.string(),
+  gpu: z25.looseObject({ type: z25.string(), name: z25.string() }).nullable(),
+  npu: z25.looseObject({ type: z25.string() }).nullable()
 });
-var InferenceDevicesSchema2 = z27.looseObject({
-  reachable: z27.boolean(),
-  devices: z27.array(
-    z27.looseObject({
-      key: z27.string(),
-      available: z27.boolean(),
-      presence: z27.enum(["present", "absent", "unknown"]).optional(),
-      enabled: z27.boolean(),
-      exclusion: z27.string().nullable()
+var InferenceDevicesSchema2 = z25.looseObject({
+  reachable: z25.boolean(),
+  devices: z25.array(
+    z25.looseObject({
+      key: z25.string(),
+      available: z25.boolean(),
+      presence: z25.enum(["present", "absent", "unknown"]).optional(),
+      enabled: z25.boolean(),
+      exclusion: z25.string().nullable()
     })
   )
 });
@@ -6907,11 +6611,11 @@ function diagnoseAccelerator(input) {
   }
   const matched = devices.filter((d) => expectation.deviceKeys(d.key));
   const matchedKeys = matched.map((d) => d.key);
-  const ready2 = matched.filter((d) => d.available && d.enabled && d.exclusion === null);
-  if (ready2.length > 0) {
+  const ready = matched.filter((d) => d.available && d.enabled && d.exclusion === null);
+  if (ready.length > 0) {
     return finish(
       "ok",
-      `The node offers ${ready2.map((d) => d.key).join(", ")}, available and enabled.`,
+      `The node offers ${ready.map((d) => d.key).join(", ")}, available and enabled.`,
       matchedKeys,
       [],
       null
@@ -6990,7 +6694,7 @@ async function supportDiagnoseAccelerator(ctx, args) {
 import {
   runGated as runGated5
 } from "@camstack/develop";
-import { z as z28 } from "zod";
+import { z as z26 } from "zod";
 var BENCHMARK_RUN_TOOL = "support_benchmark_run";
 var AUTO_TUNE_MODELS = [
   "yolov9t-320",
@@ -7012,64 +6716,64 @@ var CONTRIBUTE_HOW = [
   "The measured medians belong in the Auto-tune latency table: docs/benchmarks/detector-latency.json and packages/types/src/pipeline/auto-tune/detector-performance.ts, changed together (detector-performance.spec.ts fails until they agree), in the camstack/server repository.",
   'Use support_draft_pr with kind "benchmark", the column ("<hardwareClass>/<accelerator>") and these cells to get the branch plan and the `gh pr create` command.'
 ];
-var HardwareSchema3 = z28.looseObject({
-  platform: z28.enum(["darwin", "linux", "win32"]),
-  arch: z28.enum(["arm64", "x64"]),
-  cpuModel: z28.string(),
-  cpuCores: z28.number(),
-  totalRAM_MB: z28.number(),
-  availableRAM_MB: z28.number(),
-  gpu: z28.looseObject({
-    type: z28.enum(["nvidia", "amd", "intel", "apple"]),
-    name: z28.string()
+var HardwareSchema3 = z26.looseObject({
+  platform: z26.enum(["darwin", "linux", "win32"]),
+  arch: z26.enum(["arm64", "x64"]),
+  cpuModel: z26.string(),
+  cpuCores: z26.number(),
+  totalRAM_MB: z26.number(),
+  availableRAM_MB: z26.number(),
+  gpu: z26.looseObject({
+    type: z26.enum(["nvidia", "amd", "intel", "apple"]),
+    name: z26.string()
   }).nullable(),
-  npu: z28.looseObject({ type: z28.enum(["apple-ane", "intel-npu", "amd-xdna"]) }).nullable()
+  npu: z26.looseObject({ type: z26.enum(["apple-ane", "intel-npu", "amd-xdna"]) }).nullable()
 });
-var InferenceDevicesSchema3 = z28.looseObject({
-  reachable: z28.boolean(),
-  devices: z28.array(
-    z28.looseObject({
-      key: z28.string(),
-      backend: z28.string(),
-      available: z28.boolean(),
-      enabled: z28.boolean()
+var InferenceDevicesSchema3 = z26.looseObject({
+  reachable: z26.boolean(),
+  devices: z26.array(
+    z26.looseObject({
+      key: z26.string(),
+      backend: z26.string(),
+      available: z26.boolean(),
+      enabled: z26.boolean()
     })
   )
 });
-var RunStatusSchema = z28.looseObject({
-  run: z28.looseObject({
-    runId: z28.string(),
-    nodeId: z28.string(),
-    state: z28.string(),
-    endReason: z28.string().nullable().optional(),
-    error: z28.string().nullable().optional()
+var RunStatusSchema = z26.looseObject({
+  run: z26.looseObject({
+    runId: z26.string(),
+    nodeId: z26.string(),
+    state: z26.string(),
+    endReason: z26.string().nullable().optional(),
+    error: z26.string().nullable().optional()
   }).nullable()
 });
-var ModelListSchema = z28.array(
-  z28.looseObject({
-    id: z28.string(),
-    formats: z28.record(z28.string(), z28.looseObject({ downloaded: z28.boolean().optional() })).optional()
+var ModelListSchema = z26.array(
+  z26.looseObject({
+    id: z26.string(),
+    formats: z26.record(z26.string(), z26.looseObject({ downloaded: z26.boolean().optional() })).optional()
   })
 );
-var PipelineTestSchema = z28.looseObject({
-  kind: z28.string().optional(),
-  detections: z28.array(
-    z28.looseObject({
-      debug: z28.looseObject({
-        stepLatencyMs: z28.record(z28.string(), z28.number()).optional()
+var PipelineTestSchema = z26.looseObject({
+  kind: z26.string().optional(),
+  detections: z26.array(
+    z26.looseObject({
+      debug: z26.looseObject({
+        stepLatencyMs: z26.record(z26.string(), z26.number()).optional()
       }).optional()
     })
   ).optional(),
-  discarded: z28.array(z28.unknown()).optional(),
-  debug: z28.looseObject({
-    stepTimings: z28.array(
-      z28.looseObject({
-        source: z28.string().optional(),
-        ms: z28.number().optional()
+  discarded: z26.array(z26.unknown()).optional(),
+  debug: z26.looseObject({
+    stepTimings: z26.array(
+      z26.looseObject({
+        source: z26.string().optional(),
+        ms: z26.number().optional()
       })
     ).optional(),
-    predictMs: z28.number().optional(),
-    totalInferenceMs: z28.number().optional()
+    predictMs: z26.number().optional(),
+    totalInferenceMs: z26.number().optional()
   }).optional()
 });
 var FORMAT_BY_BACKEND = {
@@ -7356,15 +7060,15 @@ async function supportBenchmarkRun(ctx, deps, args, confirmToken) {
   }
   return runGated5(ctx.gate, benchmarkRunSpec(outcome.connection.client, deps), args, confirmToken);
 }
-var ResultsSchema = z28.array(
-  z28.looseObject({
-    nodeId: z28.string(),
-    cell: z28.looseObject({
-      phase: z28.string(),
-      deviceKey: z28.string(),
-      modelId: z28.string(),
-      p50Ms: z28.number().optional(),
-      fps: z28.number().optional()
+var ResultsSchema = z26.array(
+  z26.looseObject({
+    nodeId: z26.string(),
+    cell: z26.looseObject({
+      phase: z26.string(),
+      deviceKey: z26.string(),
+      modelId: z26.string(),
+      p50Ms: z26.number().optional(),
+      fps: z26.number().optional()
     })
   })
 );
@@ -7417,20 +7121,20 @@ async function supportBenchmarkStatus(ctx, args) {
 }
 
 // src/mcp/support-camera.ts
-import { z as z29 } from "zod";
-var DeviceSchema2 = z29.looseObject({
-  id: z29.number(),
-  name: z29.string(),
-  addonId: z29.string().optional(),
-  disabled: z29.boolean().optional(),
-  online: z29.boolean().optional()
+import { z as z27 } from "zod";
+var DeviceSchema2 = z27.looseObject({
+  id: z27.number(),
+  name: z27.string(),
+  addonId: z27.string().optional(),
+  disabled: z27.boolean().optional(),
+  online: z27.boolean().optional()
 }).nullable();
 var GENERIC = /onvif|rtsp/i;
-function words(text14) {
-  return text14.toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length >= 3);
+function words(text2) {
+  return text2.toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length >= 3);
 }
-function isGeneric(parts2) {
-  return parts2.some((p) => GENERIC.test(p));
+function isGeneric(parts) {
+  return parts.some((p) => GENERIC.test(p));
 }
 function installedPick(p) {
   return {
@@ -7451,9 +7155,9 @@ function availablePick(p) {
 var MATCHING_NOTE = "A provider manifest declares no brand or model list: matching is on provider name, description and keywords, so a brand that is supported under another name can be missed.";
 function matchIn(pools, tokens) {
   if (tokens.length === 0) return null;
-  const hit = (parts2) => {
-    if (isGeneric(parts2)) return false;
-    const joined = parts2.join(" ").toLowerCase();
+  const hit = (parts) => {
+    if (isGeneric(parts)) return false;
+    const joined = parts.join(" ").toLowerCase();
     return tokens.some((t) => joined.includes(t));
   };
   const installed = pools.installed.find(
@@ -7589,10 +7293,10 @@ async function supportDiagnoseCamera(ctx, args) {
 }
 
 // src/mcp/support-deps.ts
-import { execFile as execFile2 } from "child_process";
+import { execFile } from "child_process";
 var RUN_TIMEOUT_MS = 6e4;
 var spawnRunner = (command, args) => new Promise((resolve) => {
-  execFile2(
+  execFile(
     command,
     [...args],
     { timeout: RUN_TIMEOUT_MS, maxBuffer: 1e6 },
@@ -7624,7 +7328,7 @@ import {
   digestArgs,
   runGated as runGated6
 } from "@camstack/develop";
-import { z as z30 } from "zod";
+import { z as z28 } from "zod";
 
 // src/mcp/support-scrub.ts
 import { redactToolArgs, scrubSecrets } from "@camstack/develop";
@@ -7633,10 +7337,10 @@ var IPV6 = /\b(?:[0-9a-fA-F]{1,4}:){4,7}[0-9a-fA-F]{1,4}(?![\w:])|\b[0-9a-fA-F]{
 var MAC = /\b(?:[0-9a-fA-F]{2}[:-]){5}[0-9a-fA-F]{2}\b/g;
 var HOME_DIR = /(\/Users|\/home)\/[^/\s'"]+/g;
 function octets(ip) {
-  const parts2 = ip.split(".").map((p) => Number(p));
-  if (parts2.length !== 4) return null;
-  if (parts2.some((p) => !Number.isInteger(p) || p < 0 || p > 255)) return null;
-  return parts2;
+  const parts = ip.split(".").map((p) => Number(p));
+  if (parts.length !== 4) return null;
+  if (parts.some((p) => !Number.isInteger(p) || p < 0 || p > 255)) return null;
+  return parts;
 }
 function maskIpv4(ip) {
   const o = octets(ip);
@@ -7677,16 +7381,16 @@ var INFERENCE_PACKAGE = "@camstack/addon-pipeline";
 var TITLE_MAX = 140;
 var DIAGNOSIS_MAX = 4e3;
 var DRAFT_KINDS = ["accelerator", "camera", "benchmark", "other"];
-var DraftKindSchema = z30.enum(DRAFT_KINDS);
-var BenchmarkCellsSchema = z30.record(
-  z30.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/),
-  z30.object({ p50Ms: z30.number().positive(), fps: z30.number().positive() })
+var DraftKindSchema = z28.enum(DRAFT_KINDS);
+var BenchmarkCellsSchema = z28.record(
+  z28.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/),
+  z28.object({ p50Ms: z28.number().positive(), fps: z28.number().positive() })
 );
 var PackageNameRe = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
 var GithubRepoRe = /github\.com[:/]([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?(?:[/#?].*)?$/;
 var ShorthandRe = /^(?:github:)?([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/;
-var RegistryDocSchema = z30.looseObject({
-  repository: z30.union([z30.string(), z30.looseObject({ url: z30.string() })]).optional()
+var RegistryDocSchema = z28.looseObject({
+  repository: z28.union([z28.string(), z28.looseObject({ url: z28.string() })]).optional()
 });
 function githubRepoOf(value) {
   const url = GithubRepoRe.exec(value);
@@ -7728,7 +7432,7 @@ async function resolveRepo(ctx, packageName) {
     reason: null
   };
 }
-var ServerStatusSchema2 = z30.looseObject({ runningVersion: z30.string() });
+var ServerStatusSchema2 = z28.looseObject({ runningVersion: z28.string() });
 async function serverVersion(client, nodeId) {
   const status = await readQuery(
     client,
@@ -7843,11 +7547,11 @@ async function buildDraft(ctx, args, heading) {
   ].filter((s) => s !== "");
   return { target, title: cleanTitle(args.title), body: sections.join("\n\n") };
 }
-function shellQuote2(value) {
+function shellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 function issueCommand(draft, bodyFile) {
-  return `gh issue create --repo ${draft.target.repo} --title ${shellQuote2(draft.title)} --body-file ${bodyFile}`;
+  return `gh issue create --repo ${draft.target.repo} --title ${shellQuote(draft.title)} --body-file ${bodyFile}`;
 }
 var ISSUE_BODY_FILE = "./camstack-issue.md";
 async function issueDraft(ctx, args) {
@@ -7930,8 +7634,8 @@ var BENCHMARK_FILES = [
   "docs/benchmarks/detector-latency.json",
   "packages/types/src/pipeline/auto-tune/detector-performance.ts"
 ];
-function slug(text14) {
-  const s = text14.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
+function slug(text2) {
+  const s = text2.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
   return s === "" ? "change" : s;
 }
 function prProblem(args) {
@@ -7954,7 +7658,7 @@ function planFor(args, draft) {
       `Merge the measured cells into docs/benchmarks/detector-latency.json under "${args.column ?? ""}" (set "measured": true on the column when every kept cell was measured on the box) and mirror the same cells into DETECTOR_PERF in packages/types/src/pipeline/auto-tune/detector-performance.ts.`,
       "npx vitest run packages/types/src/pipeline/auto-tune/__tests__/detector-performance.spec.ts (it fails until the two files agree)."
     ] : ["Make the change with a spec that fails first, then passes."],
-    `git commit -am ${shellQuote2(benchmark ? `docs: measured detector latency for ${args.column ?? ""}` : `fix: ${draft.title}`)}`,
+    `git commit -am ${shellQuote(benchmark ? `docs: measured detector latency for ${args.column ?? ""}` : `fix: ${draft.title}`)}`,
     `git push -u origin ${branch}`,
     `Save the body below as ${PR_BODY_FILE}, then run the command.`
   ];
@@ -7967,7 +7671,7 @@ function planFor(args, draft) {
     branch,
     files,
     steps,
-    command: `gh pr create --repo ${draft.target.repo} --head <your-github-user>:${branch} --title ${shellQuote2(draft.title)} --body-file ${PR_BODY_FILE}`,
+    command: `gh pr create --repo ${draft.target.repo} --head <your-github-user>:${branch} --title ${shellQuote(draft.title)} --body-file ${PR_BODY_FILE}`,
     note: "This tool pushes no code and calls no GitHub API; you run these steps with your own git and gh."
   };
 }
@@ -7994,20 +7698,20 @@ async function supportDraftPr(ctx, args, confirmToken) {
 }
 
 // src/mcp/support-tools.ts
-var ModelId = z31.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/);
+var ModelId = z29.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/);
 var DraftShape = {
   kind: DraftKindSchema,
-  title: z31.string().min(3).max(300),
-  summary: z31.string().min(3).max(4e3),
-  nodeId: z31.string().max(100).optional(),
+  title: z29.string().min(3).max(300),
+  summary: z29.string().min(3).max(4e3),
+  nodeId: z29.string().max(100).optional(),
   expected: ExpectedAcceleratorSchema.optional(),
-  brand: z31.string().max(100).optional(),
-  model: z31.string().max(100).optional(),
-  deviceId: z31.number().int().optional(),
-  packageName: z31.string().max(214).optional(),
-  column: z31.string().max(100).optional(),
+  brand: z29.string().max(100).optional(),
+  model: z29.string().max(100).optional(),
+  deviceId: z29.number().int().optional(),
+  packageName: z29.string().max(214).optional(),
+  column: z29.string().max(100).optional(),
   cells: BenchmarkCellsSchema.optional(),
-  confirm_token: z31.string().optional()
+  confirm_token: z29.string().optional()
 };
 function draftArgs(input) {
   return {
@@ -8028,20 +7732,20 @@ function registerSupportTools(server, ctx, deps = defaultSupportDeps) {
   server.tool(
     "support_benchmark_status",
     "The hub's own node-benchmark state: the active or last run and the per-device latency cells it stored. Read-only. The Auto-tune latency table is filled with support_benchmark_run. Needs an admin `camstack login`.",
-    { nodeId: z31.string().max(100).optional() },
-    async ({ nodeId }) => text13(await supportBenchmarkStatus(ctx, nodeId !== void 0 ? { nodeId } : {}))
+    { nodeId: z29.string().max(100).optional() },
+    async ({ nodeId }) => text(await supportBenchmarkStatus(ctx, nodeId !== void 0 ? { nodeId } : {}))
   );
   server.tool(
     BENCHMARK_RUN_TOOL,
     "Measure detector latency on a node x device (cold run, then warm median per model, via runPipelineTest) and return it next to the Auto-tune table cell for the same hardware, plus how to contribute it. LOADS THE NODE: the detection pool restarts between models. Pick the node and deviceKey from ops_accelerators. Two steps: call without confirm_token for the plan and a one-shot token, then again with the SAME arguments and that token. Needs an admin `camstack login`.",
     {
-      nodeId: z31.string().min(1).max(100),
-      deviceKey: z31.string().min(1).max(60),
-      models: z31.array(ModelId).min(1).max(MAX_MODELS).optional(),
-      warmRuns: z31.number().int().min(1).max(MAX_WARM_RUNS).optional(),
-      confirm_token: z31.string().optional()
+      nodeId: z29.string().min(1).max(100),
+      deviceKey: z29.string().min(1).max(60),
+      models: z29.array(ModelId).min(1).max(MAX_MODELS).optional(),
+      warmRuns: z29.number().int().min(1).max(MAX_WARM_RUNS).optional(),
+      confirm_token: z29.string().optional()
     },
-    async ({ nodeId, deviceKey, models, warmRuns, confirm_token }) => text13(
+    async ({ nodeId, deviceKey, models, warmRuns, confirm_token }) => text(
       await supportBenchmarkRun(
         ctx,
         deps,
@@ -8058,18 +7762,18 @@ function registerSupportTools(server, ctx, deps = defaultSupportDeps) {
   server.tool(
     "support_diagnose_accelerator",
     "A node should have an accelerator (Intel iGPU/NPU, AMD WebGPU/VAAPI/NPU, Coral USB/PCIe, Apple Neural Engine, NVIDIA) and the hub does not offer it. Reads what the platform probe saw and what the node's inference runtime offers, and answers ok | misconfigured (with fix steps: passthrough, driver, image tag, opt-in) | unsupported (which addon would need extending) | unknown (a read failed). A Coral is never auto-picked: the answer says how to opt in. Read-only.",
-    { nodeId: z31.string().min(1).max(100), expected: ExpectedAcceleratorSchema },
-    async ({ nodeId, expected }) => text13(await supportDiagnoseAccelerator(ctx, { nodeId, expected }))
+    { nodeId: z29.string().min(1).max(100), expected: ExpectedAcceleratorSchema },
+    async ({ nodeId, expected }) => text(await supportDiagnoseAccelerator(ctx, { nodeId, expected }))
   );
   server.tool(
     "support_diagnose_camera",
     "A camera brand or model, or an existing device that fails: which provider addons could serve it (installed, then published), and a verdict use-provider | generic-fallback (ONVIF / RTSP) | unsupported | unknown, with the next steps. Give a brand and/or model, or a deviceId. Read-only.",
     {
-      brand: z31.string().max(100).optional(),
-      model: z31.string().max(100).optional(),
-      deviceId: z31.number().int().optional()
+      brand: z29.string().max(100).optional(),
+      model: z29.string().max(100).optional(),
+      deviceId: z29.number().int().optional()
     },
-    async ({ brand, model, deviceId }) => text13(
+    async ({ brand, model, deviceId }) => text(
       await supportDiagnoseCamera(ctx, {
         ...brand !== void 0 ? { brand } : {},
         ...model !== void 0 ? { model } : {},
@@ -8081,13 +7785,13 @@ function registerSupportTools(server, ctx, deps = defaultSupportDeps) {
     DRAFT_ISSUE_TOOL,
     "Draft a GitHub issue for the public repository that owns the addon (the package's `repository` field; camstack/server when it names none): title, an environment block (server and CLI version, node platform, accelerator or camera facts from the diagnose tools), secrets and private addresses removed. Two steps: the dry run is the full draft and the target; the confirmed call runs YOUR own `gh issue create` (only if `gh auth status` succeeds, otherwise it returns the draft and a ready command). Never uses a token of ours.",
     DraftShape,
-    async (input) => text13(await supportDraftIssue(ctx, deps, draftArgs(input), input.confirm_token))
+    async (input) => text(await supportDraftIssue(ctx, deps, draftArgs(input), input.confirm_token))
   );
   server.tool(
     DRAFT_PR_TOOL,
     'Plan a pull request for the public repository that owns the addon: branch, files to change, steps and the `gh pr create` command, with a scrubbed body. For kind "benchmark" give column and cells from support_benchmark_run. Two steps like every gated tool; it pushes no code and calls no GitHub API, you run the plan with your own git and gh.',
     DraftShape,
-    async (input) => text13(await supportDraftPr(ctx, draftArgs(input), input.confirm_token))
+    async (input) => text(await supportDraftPr(ctx, draftArgs(input), input.confirm_token))
   );
 }