camstack 1.2.213 → 1.2.214

package/dist/{server-EFXGQ7FD.js → server-TZCZTLBW.js}

@@ -13,13 +13,23 @@ import {
   classifyInferenceHardware,
   convertLegacyWhen,
   countWhenLeaves,
-  findHubs,
   generateAutomationBlock,
   isReadingQuantity,
   prepareRecipeUnits,
   unitsForQuantity,
   validateRecipeBounds
-} from "./chunk-MJJWVAEM.js";
+} from "./chunk-4Y3CBGOY.js";
+import {
+  IMAGE_TAG_BY_ACCELERATOR,
+  MUST_NOT_OMIT,
+  NO_BARE_LATEST,
+  cliVerdict,
+  isOlder,
+  registerSetupTools,
+  runCommand,
+  text
+} from "./chunk-37A556YF.js";
+import "./chunk-JPGJK5DC.js";
 import "./chunk-LMMQX4CK.js";
 
 // src/mcp/server.ts
@@ -29,14 +39,12 @@ import { MutationGate, tryConnectHub } from "@camstack/develop";
 
 // src/mcp/configure-tools.ts
 import {
-  runGated as runGated4,
-  text as text13
+  runGated as runGated4
 } from "@camstack/develop";
-import { z as z28 } from "zod";
+import { z as z24 } from "zod";
 
 // src/mcp/configure-automations.ts
 import { z as z4 } from "zod";
-import { text } from "@camstack/develop";
 
 // src/mcp/configure-common.ts
 import { runGated } from "@camstack/develop";
@@ -1236,7 +1244,6 @@ function registerAutomationTools(server, ctx) {
 }
 
 // src/mcp/configure-calibrate.ts
-import { text as text2 } from "@camstack/develop";
 import { z as z5 } from "zod";
 var CALIBRATE_APPLY_TOOL = "configure_calibrate_apply";
 var WINDOW_MS = 24 * 36e5;
@@ -1602,7 +1609,7 @@ function registerCalibrateTools(server, ctx) {
     "configure_calibrate_camera",
     "Read-only calibration report for one camera: recent tracks and their top-score distribution per class, likely false-positive and missed patterns, the current motion and detection settings, zones and pipeline health, and the changes it proposes. Writes nothing.",
     { deviceId: z5.number().int().nonnegative() },
-    async ({ deviceId }) => text2(await calibrateCamera(ctx, { deviceId }))
+    async ({ deviceId }) => text(await calibrateCamera(ctx, { deviceId }))
   );
   server.tool(
     CALIBRATE_APPLY_TOOL,
@@ -1613,13 +1620,12 @@ function registerCalibrateTools(server, ctx) {
       patch: z5.record(z5.string(), z5.union([z5.number(), z5.string(), z5.boolean()])),
       confirm_token: ConfirmTokenSchema
     },
-    async ({ deviceId, cap: cap2, patch, confirm_token }) => text2(await calibrateApply(ctx, { deviceId, cap: cap2, patch }, confirm_token))
+    async ({ deviceId, cap: cap2, patch, confirm_token }) => text(await calibrateApply(ctx, { deviceId, cap: cap2, patch }, confirm_token))
   );
 }
 
 // src/mcp/configure-zones-alarm.ts
 import { randomUUID } from "crypto";
-import { text as text3 } from "@camstack/develop";
 import { z as z6 } from "zod";
 var ZONE_UPSERT_TOOL = "configure_zone_upsert";
 var ALARM_SET_TOOL = "configure_alarm_set";
@@ -1910,7 +1916,7 @@ function registerZonesAlarmTools(server, ctx) {
     "configure_zones",
     "Read the detection zones drawn on one camera (id, name, kind, points, normalised 0..1) and a summary of its motion mask. Writes nothing.",
     { deviceId: z6.number().int().nonnegative() },
-    async ({ deviceId }) => text3(await readZonesTool(ctx, { deviceId }))
+    async ({ deviceId }) => text(await readZonesTool(ctx, { deviceId }))
   );
   server.tool(
     ZONE_UPSERT_TOOL,
@@ -1923,7 +1929,7 @@ function registerZonesAlarmTools(server, ctx) {
       points: z6.array(PointSchema).min(2).max(64),
       confirm_token: ConfirmTokenSchema
     },
-    async ({ deviceId, zoneId, name, kind, points, confirm_token }) => text3(
+    async ({ deviceId, zoneId, name, kind, points, confirm_token }) => text(
       await zoneUpsert(
         ctx,
         {
@@ -1941,7 +1947,7 @@ function registerZonesAlarmTools(server, ctx) {
     "configure_alarm",
     "Read the alarm panels of the hub: state, armed mode, the modes each accepts and whether it needs a PIN. Writes nothing.",
     { deviceId: z6.number().int().nonnegative().optional() },
-    async ({ deviceId }) => text3(await readAlarm(ctx, deviceId !== void 0 ? { deviceId } : {}))
+    async ({ deviceId }) => text(await readAlarm(ctx, deviceId !== void 0 ? { deviceId } : {}))
   );
   server.tool(
     ALARM_SET_TOOL,
@@ -1952,7 +1958,7 @@ function registerZonesAlarmTools(server, ctx) {
       mode: AlarmArmModeSchema.optional(),
       confirm_token: ConfirmTokenSchema
     },
-    async ({ deviceId, action, mode, confirm_token }) => text3(
+    async ({ deviceId, action, mode, confirm_token }) => text(
       await alarmSet(
         ctx,
         { deviceId, action, ...mode !== void 0 ? { mode } : {} },
@@ -1963,7 +1969,6 @@ function registerZonesAlarmTools(server, ctx) {
 }
 
 // src/mcp/configure-network.ts
-import { text as text4 } from "@camstack/develop";
 import { z as z7 } from "zod";
 var REMOTE_ACCESS_SET_TOOL = "configure_remote_access_set";
 var RemoteAddonSchema = z7.enum(["cloudflare-tunnel", "cloudflare-turn", "static-turn"]);
@@ -2147,7 +2152,7 @@ function registerNetworkTools(server, ctx) {
     "configure_remote_access",
     "Read how the hub is reachable from outside: the access status and public endpoint, and the settings of the tunnel and TURN addons. Secret fields are reported as configured true/false, never their value. Writes nothing.",
     {},
-    async () => text4(await readRemoteAccess(ctx))
+    async () => text(await readRemoteAccess(ctx))
   );
   server.tool(
     REMOTE_ACCESS_SET_TOOL,
@@ -2157,12 +2162,11 @@ function registerNetworkTools(server, ctx) {
       patch: z7.record(z7.string(), z7.union([z7.string(), z7.number(), z7.boolean()])),
       confirm_token: ConfirmTokenSchema
     },
-    async ({ addonId, patch, confirm_token }) => text4(await remoteAccessSet(ctx, { addonId, patch }, confirm_token))
+    async ({ addonId, patch, confirm_token }) => text(await remoteAccessSet(ctx, { addonId, patch }, confirm_token))
   );
 }
 
 // src/mcp/configure-exports.ts
-import { text as text5 } from "@camstack/develop";
 import { z as z8 } from "zod";
 var EXPORT_SET_TOOL = "configure_export_set";
 var ProvidersSchema = z8.array(z8.looseObject({ addonId: z8.string() }));
@@ -2325,7 +2329,7 @@ function registerExportTools(server, ctx) {
     "configure_exports",
     "Read the exporters (Alexa, Google Home, Home Assistant, HomeKit): link state, how many devices each shows and which cameras. Pairing codes are never shown. Writes nothing.",
     { deviceId: z8.number().int().nonnegative().optional() },
-    async ({ deviceId }) => text5(await readExports(ctx, deviceId !== void 0 ? { deviceId } : {}))
+    async ({ deviceId }) => text(await readExports(ctx, deviceId !== void 0 ? { deviceId } : {}))
   );
   server.tool(
     EXPORT_SET_TOOL,
@@ -2336,18 +2340,17 @@ function registerExportTools(server, ctx) {
       exposed: z8.boolean(),
       confirm_token: ConfirmTokenSchema
     },
-    async ({ addonId, deviceId, exposed, confirm_token }) => text5(await exportSet(ctx, { addonId, deviceId, exposed }, confirm_token))
+    async ({ addonId, deviceId, exposed, confirm_token }) => text(await exportSet(ctx, { addonId, deviceId, exposed }, confirm_token))
   );
   server.tool(
     "configure_ha_guide",
     "Read-only guide for showing CamStack cameras in Home Assistant, including the HACS route. Needs no hub.",
     {},
-    async () => text5({ status: "ok", guide: HA_GUIDE })
+    async () => text({ status: "ok", guide: HA_GUIDE })
   );
 }
 
 // src/mcp/configure-oidc.ts
-import { text as text6 } from "@camstack/develop";
 import { z as z10 } from "zod";
 
 // src/mcp/configure-oidc-providers.ts
@@ -2836,13 +2839,12 @@ function registerOidcTools(server, ctx) {
     OIDC_TOOL,
     "Connect an OpenID Connect identity provider (authentik, pocket-id, authelia, keycloak, zitadel, kanidm, google, microsoft-entra, auth0, okta, generic). Call with only `provider` for the questions, the provider-side setup steps and the redirect URI to paste into the provider. With the answers it previews the connection and checks the provider discovery document (warnings, never a crash); call again with the SAME arguments and the confirm_token to create or update it. A client secret is NEVER an argument or output: a confidential client is finished by typing the secret in the admin UI (the route is given); a public PKCE client needs none. Needs an admin `camstack login` session for the write.",
     OIDC_TOOL_SHAPE,
-    async ({ confirm_token, ...args }) => text6(await configureOidc(ctx, args, confirm_token))
+    async ({ confirm_token, ...args }) => text(await configureOidc(ctx, args, confirm_token))
   );
 }
 
 // src/mcp/configure-nc-rules.ts
 import { z as z11 } from "zod";
-import { text as text7 } from "@camstack/develop";
 var TIME = /^\d{1,2}:\d{2}$/;
 var ALL_DAYS = [0, 1, 2, 3, 4, 5, 6];
 var QuietHoursAnswerSchema = z11.object({
@@ -3188,7 +3190,7 @@ function registerNcRuleTools(server, ctx) {
     "configure_notification_rule_questionnaire",
     "Interview for a detection notification rule (cameras, classes, zones, quiet hours, targets). Stateless: send every answer so far in `answers`; it returns the questions still open, with choices read from the hub, or `ready` with a summary and the rule. Writes nothing.",
     { answers: NcRuleAnswersSchema },
-    async ({ answers }) => text7(await ncRuleQuestionnaire(ctx, answers))
+    async ({ answers }) => text(await ncRuleQuestionnaire(ctx, answers))
   );
   server.tool(
     SAVE_RULE_TOOL,
@@ -3198,7 +3200,7 @@ function registerNcRuleTools(server, ctx) {
       ruleId: z11.string().optional(),
       confirm_token: ConfirmTokenSchema
     },
-    async ({ rule, ruleId, confirm_token }) => text7(
+    async ({ rule, ruleId, confirm_token }) => text(
       await saveRule(ctx, { rule, ...ruleId !== void 0 ? { ruleId } : {} }, confirm_token)
     )
   );
@@ -3216,9 +3218,6 @@ function registerConfigureP3bTools(server, ctx) {
 }
 
 // src/mcp/configure-addons.ts
-import {
-  text as text8
-} from "@camstack/develop";
 import { z as z13 } from "zod";
 
 // src/mcp/configure-support.ts
@@ -3873,7 +3872,7 @@ function registerAddonTools(server, ctx) {
       query: z13.string().max(100).optional(),
       capability: z13.string().max(100).optional()
     },
-    async ({ query, capability }) => text8(
+    async ({ query, capability }) => text(
       await configureAddonsSearch(ctx, {
         ...query !== void 0 ? { query } : {},
         ...capability !== void 0 ? { capability } : {}
@@ -3888,7 +3887,7 @@ function registerAddonTools(server, ctx) {
       version: z13.string().max(64).optional(),
       confirm_token: z13.string().optional()
     },
-    async ({ packageName, version, confirm_token }) => text8(
+    async ({ packageName, version, confirm_token }) => text(
       await installAddon(
         ctx,
         { packageName, ...version !== void 0 ? { version } : {} },
@@ -3905,7 +3904,7 @@ function registerAddonTools(server, ctx) {
       nodeId: z13.string().max(100).optional(),
       confirm_token: z13.string().optional()
     },
-    async ({ packageName, version, nodeId, confirm_token }) => text8(
+    async ({ packageName, version, nodeId, confirm_token }) => text(
       await updateAddon(
         ctx,
         {
@@ -3926,7 +3925,7 @@ function registerAddonTools(server, ctx) {
       everywhere: z13.boolean().optional(),
       confirm_token: z13.string().optional()
     },
-    async ({ packageName, nodeId, everywhere, confirm_token }) => text8(
+    async ({ packageName, nodeId, everywhere, confirm_token }) => text(
       await uninstallAddon(
         ctx,
         {
@@ -3941,9 +3940,6 @@ function registerAddonTools(server, ctx) {
 }
 
 // src/mcp/configure-cameras.ts
-import {
-  text as text9
-} from "@camstack/develop";
 import { z as z14 } from "zod";
 var UNSUPPORTED_HINT = "use support_diagnose_camera / support_draft_issue";
 var MAX_PROVIDERS = 40;
@@ -4270,7 +4266,7 @@ function registerCameraTools(server, ctx) {
     "configure_camera_providers",
     "Installed camera-provider addons and the published ones not yet installed. A manifest declares no brand/model list, so `query` matches on name, description and keywords; a brand nothing matches is `unsupported` with a pointer to support_diagnose_camera / support_draft_issue.",
     { query: z14.string().max(100).optional() },
-    async ({ query }) => text9(await configureCameraProviders(ctx, query))
+    async ({ query }) => text(await configureCameraProviders(ctx, query))
   );
   server.tool(
     "configure_camera_discover",
@@ -4279,7 +4275,7 @@ function registerCameraTools(server, ctx) {
       addonId: z14.string().min(1),
       params: z14.record(z14.string(), z14.unknown()).optional()
     },
-    async ({ addonId, params }) => text9(
+    async ({ addonId, params }) => text(
       await configureCameraDiscover(ctx, {
         addonId,
         ...params !== void 0 ? { params } : {}
@@ -4294,14 +4290,11 @@ function registerCameraTools(server, ctx) {
       config: z14.record(z14.string(), z14.unknown()),
       confirm_token: z14.string().optional()
     },
-    async ({ addonId, config, confirm_token }) => text9(await addCamera(ctx, { addonId, config }, confirm_token))
+    async ({ addonId, config, confirm_token }) => text(await addCamera(ctx, { addonId, config }, confirm_token))
   );
 }
 
 // src/mcp/configure-notifiers.ts
-import {
-  text as text10
-} from "@camstack/develop";
 import { z as z15 } from "zod";
 var MAX_TARGETS = 50;
 var TargetKindShape = z15.looseObject({
@@ -4604,13 +4597,13 @@ function registerNotifierTools(server, ctx) {
     "configure_notifiers",
     "The notifier kinds a target can be created from (ntfy, telegram, email, \u2026), each with its settings fields, which are required and which are SECRETS. Secrets are never tool arguments. Needs an admin `camstack login`.",
     {},
-    async () => text10(await configureNotifiers(ctx))
+    async () => text(await configureNotifiers(ctx))
   );
   server.tool(
     "configure_notification_targets",
     "Existing notification targets with their non-secret settings. A secret is shown only as set/unset, and a target missing a required secret is listed under `incomplete`. Needs an admin `camstack login`.",
     {},
-    async () => text10(await configureNotificationTargets(ctx))
+    async () => text(await configureNotificationTargets(ctx))
   );
   server.tool(
     UPSERT_TARGET_TOOL,
@@ -4623,7 +4616,7 @@ function registerNotifierTools(server, ctx) {
       enabled: z15.boolean().optional(),
       confirm_token: z15.string().optional()
     },
-    async ({ targetId, kind, name, config, enabled, confirm_token }) => text10(
+    async ({ targetId, kind, name, config, enabled, confirm_token }) => text(
       await upsertNotificationTarget(
         ctx,
         {
@@ -4641,13 +4634,13 @@ function registerNotifierTools(server, ctx) {
     TEST_TARGET_TOOL,
     "Send a test notification to one target. Two steps: the preview checks the target exists and has every required secret, and only the confirmed call delivers a real message.",
     { targetId: z15.string().min(1), confirm_token: z15.string().optional() },
-    async ({ targetId, confirm_token }) => text10(await testNotificationTarget(ctx, { targetId }, confirm_token))
+    async ({ targetId, confirm_token }) => text(await testNotificationTarget(ctx, { targetId }, confirm_token))
   );
 }
 
 // src/mcp/ops-tools.ts
-import { z as z27 } from "zod";
-import { jwtClaims, text as text12 } from "@camstack/develop";
+import { z as z23 } from "zod";
+import { jwtClaims } from "@camstack/develop";
 
 // src/mcp/ops-accelerators.ts
 import { z as z16 } from "zod";
@@ -5540,7 +5533,7 @@ async function opsStatus(ctx) {
 import {
   runGated as runGated3
 } from "@camstack/develop";
-import { z as z25 } from "zod";
+import { z as z21 } from "zod";
 
 // src/mcp/ops-update-model.ts
 import { z as z20 } from "zod";
@@ -5713,790 +5706,6 @@ function addonDrift(installations) {
   return drift;
 }
 
-// src/mcp/ops-update-cli.ts
-import { execFile } from "child_process";
-
-// src/mcp/setup-tools.ts
-import { text as text11 } from "@camstack/develop";
-import { z as z24 } from "zod";
-
-// src/mcp/setup-hubs.ts
-import * as https from "https";
-import {
-  createHubAgent,
-  explainTlsFailure,
-  HubAddressError,
-  hubCaFileForServer,
-  loadSession,
-  normalizeHubAddress,
-  resolveHubTls
-} from "@camstack/develop";
-import { z as z23 } from "zod";
-
-// src/mcp/setup-install.ts
-import { z as z22 } from "zod";
-
-// src/mcp/setup-install-rules.ts
-import { z as z21 } from "zod";
-var HOST_KINDS = [
-  "docker-compose",
-  "docker",
-  "unraid",
-  "proxmox-lxc",
-  "macos-desktop"
-];
-var HostKindSchema = z21.enum(HOST_KINDS);
-var ROLES = ["hub", "agent"];
-var RoleSchema = z21.enum(ROLES);
-var ACCELERATORS = ["intel", "amd", "coral", "apple", "cpu"];
-var AcceleratorSchema = z21.enum(ACCELERATORS);
-var InstallPathsSchema = z21.object({
-  data: z21.string().min(1),
-  recordings: z21.string().min(1),
-  config: z21.string().min(1).optional(),
-  backups: z21.string().min(1).optional()
-});
-var InstallGuideInputSchema = z21.object({
-  hostKind: HostKindSchema.optional(),
-  role: RoleSchema.optional(),
-  accelerator: AcceleratorSchema.optional(),
-  paths: InstallPathsSchema.optional(),
-  /** Agents only: the hub the agent should dial (host or IP). */
-  hubAddress: z21.string().min(1).optional()
-});
-var RAW = "https://raw.githubusercontent.com/camstack";
-var TEMPLATE_URLS = {
-  compose: {
-    hub: `${RAW}/proxmox/main/compose/hub.yml`,
-    agent: `${RAW}/proxmox/main/compose/agent.yml`
-  },
-  proxmoxInstaller: `${RAW}/proxmox/main/install-camstack-proxmox.sh`,
-  unraid: {
-    hub: `${RAW}/unraid-templates/main/templates/camstack.xml`,
-    agent: `${RAW}/unraid-templates/main/templates/camstack-agent.xml`
-  },
-  latestRelease: "https://api.github.com/repos/camstack/server/releases/latest"
-};
-var IMAGE_REPOSITORY = "ghcr.io/camstack/camstack";
-var IMAGE_TAG_BY_ACCELERATOR = {
-  intel: "intel-latest",
-  amd: "amd-latest",
-  // No Coral- or CPU-specific image: Intel hosts and the Unraid templates track intel-latest.
-  coral: "intel-latest",
-  cpu: "intel-latest",
-  apple: "intel-latest"
-};
-var NO_BARE_LATEST = "There is no bare :latest tag: use intel-<version>/intel-latest or amd-<version>/amd-latest, and never mix them across vendors.";
-var MUST_NOT_OMIT = [
-  "--pids-limit=8192 (pids_limit: 8192): the default 2048 counts threads and silently stops media on a busy hub.",
-  "CAMSTACK_MEDIA_ROOT=/recordings: without it recordings land in /data and fill the cache drive.",
-  "/config mapped: it is a VOLUME, so an unmapped path mints an anonymous volume on every re-create.",
-  "--restart unless-stopped: the NVR must come back after a host reboot.",
-  "CAMSTACK_MOLECULER_USE_HOSTNAME=false: otherwise a multi-machine cluster never forms.",
-  "Coral USB: /dev/bus/usb AND the device-cgroup rule c 189:* rmw."
-];
-var COMPOSE_MARKERS_BY_ACCELERATOR = {
-  intel: ["devices", "dri", "accel"],
-  amd: ["devices", "dri"],
-  coral: ["devices", "usb"],
-  cpu: [],
-  apple: []
-};
-function firstRunHub(host) {
-  return [
-    `Open https://${host}:4443 (a self-signed certificate: accept the browser warning).`,
-    "Sign in as admin / changeme; CamStack asks for a new password at once. Change it now.",
-    `Then, where your MCP client runs: camstack login ${host}`
-  ];
-}
-
-// src/mcp/setup-compose.ts
-var MARKER_LINE = /^(\s*)# (.*#@([A-Za-z0-9_]+)\s*)$/;
-var VOLUME_HOST_PATHS = [
-  { container: "/data", key: "data" },
-  { container: "/recordings", key: "recordings" },
-  { container: "/config", key: "config" },
-  { container: "/backups", key: "backups" }
-];
-function swapImageTag(body, imageTag) {
-  const escaped = IMAGE_REPOSITORY.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  return body.replace(new RegExp(`(${escaped}):[A-Za-z0-9._-]+`), `$1:${imageTag}`);
-}
-function enableMarkers(body, markers) {
-  return body.split("\n").map((line) => {
-    const match = MARKER_LINE.exec(line);
-    if (match === null) return line;
-    const tag = match[3];
-    return tag !== void 0 && markers.includes(tag) ? `${match[1] ?? ""}${match[2] ?? ""}` : line;
-  }).join("\n");
-}
-function setVolumeHosts(body, paths) {
-  const edits = [];
-  let out = body;
-  for (const { container, key } of VOLUME_HOST_PATHS) {
-    const wanted = paths?.[key];
-    const volume = new RegExp(`^(\\s*- )([^\\s:]+)(:${container}\\s*)$`, "m");
-    if (!volume.test(out)) {
-      if (wanted !== void 0) {
-        edits.push(
-          `${container}: no volume line found in the template; map ${wanted} to it yourself`
-        );
-      }
-      continue;
-    }
-    if (wanted === void 0) {
-      edits.push(
-        `${container}: left at the template's host path, change it if that is not where you want it`
-      );
-      continue;
-    }
-    out = out.replace(
-      volume,
-      (_m, pre, _host, post) => `${pre}${wanted}${post}`
-    );
-  }
-  return { body: out, edits };
-}
-function setHubAddress(body, hubAddress) {
-  const line = /^(\s*- CAMSTACK_HUB_ADDRESS=).*$/m;
-  if (!line.test(body)) return { body, edits: [] };
-  if (hubAddress === void 0) {
-    return {
-      body,
-      edits: [
-        "CAMSTACK_HUB_ADDRESS: export it before `docker compose up` (or edit the line) with the hub IP or hostname"
-      ]
-    };
-  }
-  return {
-    body: body.replace(line, (_m, pre) => `${pre}${hubAddress}`),
-    edits: []
-  };
-}
-function customizeCompose(source, c) {
-  const tagged = enableMarkers(swapImageTag(source, c.imageTag), c.markers);
-  const volumes = setVolumeHosts(tagged, c.paths);
-  const hub = setHubAddress(volumes.body, c.hubAddress);
-  return { body: hub.body, edits: [...volumes.edits, ...hub.edits] };
-}
-function unquote(value) {
-  const v = value.trim();
-  if (v.length >= 2 && (v.startsWith('"') || v.startsWith("'")) && v.endsWith(v[0] ?? "")) {
-    return v.slice(1, -1);
-  }
-  return v;
-}
-function stripComment(line) {
-  return line.replace(/\s+#.*$/, "");
-}
-function readService(body) {
-  const fields = {
-    scalars: /* @__PURE__ */ new Map(),
-    lists: /* @__PURE__ */ new Map(),
-    maps: /* @__PURE__ */ new Map()
-  };
-  let key = null;
-  let sub = null;
-  for (const raw of body.split("\n")) {
-    if (raw.trim() === "" || raw.trim().startsWith("#")) continue;
-    const line = stripComment(raw);
-    const indent = line.length - line.trimStart().length;
-    const text15 = line.trim();
-    if (indent === 4) {
-      sub = null;
-      const m = /^([A-Za-z_]+):\s*(.*)$/.exec(text15);
-      if (m === null) continue;
-      key = m[1] ?? null;
-      if (key !== null && (m[2] ?? "") !== "") fields.scalars.set(key, unquote(m[2] ?? ""));
-    } else if (indent === 6 && key !== null) {
-      if (text15.startsWith("- ")) {
-        const list = fields.lists.get(key) ?? [];
-        list.push(unquote(text15.slice(2)));
-        fields.lists.set(key, list);
-      } else {
-        const m = /^([A-Za-z_-]+):\s*(.*)$/.exec(text15);
-        if (m === null) continue;
-        sub = m[1] ?? null;
-        const map = fields.maps.get(key) ?? /* @__PURE__ */ new Map();
-        if ((m[2] ?? "") !== "" && sub !== null) map.set(sub, unquote(m[2] ?? ""));
-        fields.maps.set(key, map);
-      }
-    } else if (indent === 8 && key !== null && sub !== null) {
-      const m = /^([A-Za-z_-]+):\s*(.*)$/.exec(text15);
-      if (m === null) continue;
-      const map = fields.maps.get(`${key}.${sub}`) ?? /* @__PURE__ */ new Map();
-      map.set(m[1] ?? "", unquote(m[2] ?? ""));
-      fields.maps.set(`${key}.${sub}`, map);
-    }
-  }
-  return fields;
-}
-function shellQuote(value) {
-  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
-}
-function composeToDockerRun(body) {
-  const f = readService(body);
-  const image = f.scalars.get("image");
-  if (image === void 0) return null;
-  const args = ["docker run -d"];
-  const name = f.scalars.get("container_name");
-  if (name !== void 0) args.push(`--name ${shellQuote(name)}`);
-  const restart = f.scalars.get("restart");
-  if (restart !== void 0) args.push(`--restart ${shellQuote(restart)}`);
-  const network = f.scalars.get("network_mode");
-  if (network !== void 0) args.push(`--network ${shellQuote(network)}`);
-  const pids = f.scalars.get("pids_limit");
-  if (pids !== void 0) args.push(`--pids-limit=${pids}`);
-  for (const d of f.lists.get("devices") ?? []) args.push(`--device ${shellQuote(d)}`);
-  for (const r of f.lists.get("device_cgroup_rules") ?? []) {
-    args.push(`--device-cgroup-rule ${shellQuote(r)}`);
-  }
-  for (const g of f.lists.get("group_add") ?? []) args.push(`--group-add ${shellQuote(g)}`);
-  for (const v of f.lists.get("volumes") ?? []) args.push(`-v ${shellQuote(v)}`);
-  for (const e of f.lists.get("environment") ?? []) {
-    if (!e.includes("${")) args.push(`-e ${shellQuote(e)}`);
-  }
-  const driver = f.maps.get("logging")?.get("driver");
-  if (driver !== void 0) args.push(`--log-driver ${shellQuote(driver)}`);
-  for (const [k, v] of f.maps.get("logging.options") ?? []) {
-    args.push(`--log-opt ${shellQuote(`${k}=${v}`)}`);
-  }
-  args.push(shellQuote(image));
-  return args.join(" \\\n  ");
-}
-
-// src/mcp/setup-install.ts
-var FETCH_TIMEOUT_MS = 1e4;
-var CONTAINER_ROUTES = ["docker-compose", "docker"];
-var Q_HOST = {
-  id: "hostKind",
-  question: "Where will CamStack run?",
-  options: ["docker-compose", "docker", "unraid", "proxmox-lxc", "macos-desktop"]
-};
-var Q_ROLE = {
-  id: "role",
-  question: "Which role? Start with a hub; an agent only adds a second machine to an existing hub.",
-  options: ["hub", "agent"]
-};
-var Q_ACCEL = {
-  id: "accelerator",
-  question: "Which accelerator does this host have?",
-  options: ["intel", "amd", "coral", "cpu"]
-};
-var Q_PATHS = {
-  id: "paths",
-  question: "Host paths as {data, recordings} (optionally config, backups). Recordings is the one that grows: put it on a roomy disk.",
-  options: []
-};
-function missingQuestions(input) {
-  const out = [];
-  if (input.hostKind === void 0) out.push(Q_HOST);
-  if (input.role === void 0) out.push(Q_ROLE);
-  const desktop = input.hostKind === "macos-desktop";
-  if (!desktop && (input.accelerator === void 0 || input.accelerator === "apple")) {
-    out.push(Q_ACCEL);
-  }
-  if (input.hostKind !== void 0 && CONTAINER_ROUTES.includes(input.hostKind) && input.paths === void 0) {
-    out.push(Q_PATHS);
-  }
-  return out;
-}
-async function fetchText(url, fetchFn) {
-  try {
-    const res = await fetchFn(url, {
-      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
-    });
-    if (!res.ok) {
-      return {
-        ok: false,
-        failure: {
-          status: "fetch-failed",
-          url,
-          error: `answered ${res.status}`
-        }
-      };
-    }
-    return { ok: true, body: await res.text() };
-  } catch (err) {
-    const error = err instanceof Error ? err.message : String(err);
-    return { ok: false, failure: { status: "fetch-failed", url, error } };
-  }
-}
-var ReleaseSchema = z22.object({
-  tag_name: z22.string(),
-  assets: z22.array(z22.object({ name: z22.string(), browser_download_url: z22.string() }))
-});
-var DMG = /^CamStack-[0-9][0-9A-Za-z.-]*-(arm64|x64)\.dmg$/;
-function acceleratorEdits(accelerator, role) {
-  const note = `Image tag ${IMAGE_TAG_BY_ACCELERATOR[accelerator]} for ${accelerator}. ${NO_BARE_LATEST}`;
-  return role === "agent" ? [note, "Do not run a hub and an agent on the same host."] : [note];
-}
-async function composeGuide(input, fetchFn, asDockerRun) {
-  const url = TEMPLATE_URLS.compose[input.role];
-  const fetched = await fetchText(url, fetchFn);
-  if (!fetched.ok) return fetched.failure;
-  const imageTag = IMAGE_TAG_BY_ACCELERATOR[input.accelerator];
-  const custom = customizeCompose(fetched.body, {
-    imageTag,
-    markers: COMPOSE_MARKERS_BY_ACCELERATOR[input.accelerator],
-    paths: input.paths,
-    hubAddress: input.hubAddress
-  });
-  const edits = [...custom.edits, ...acceleratorEdits(input.accelerator, input.role)];
-  const first = firstRun(input);
-  if (!asDockerRun) {
-    return ready(input, imageTag, {
-      steps: [
-        "Save docker-compose.yml (below) in an empty directory on the host.",
-        "docker compose up -d && docker compose logs -f camstack",
-        "The first boot seeds addons and pulls models: allow a few minutes.",
-        ...first
-      ],
-      files: [{ path: "docker-compose.yml", body: custom.body, source: url }],
-      edits
-    });
-  }
-  const run = composeToDockerRun(custom.body);
-  if (run === null) {
-    return {
-      status: "fetch-failed",
-      url,
-      error: "the official compose file has no image line; cannot derive docker run"
-    };
-  }
-  return ready(input, imageTag, {
-    steps: [
-      "Create the host directories named by the -v lines, then run the file below as a shell script.",
-      "docker logs -f camstack (the first boot seeds addons and pulls models).",
-      ...first
-    ],
-    files: [{ path: "run-camstack.sh", body: `#!/bin/sh
-${run}
-`, source: url }],
-    edits
-  });
-}
-async function unraidGuide(input, fetchFn) {
-  const url = TEMPLATE_URLS.unraid[input.role];
-  const fetched = await fetchText(url, fetchFn);
-  if (!fetched.ok) return fetched.failure;
-  const imageTag = IMAGE_TAG_BY_ACCELERATOR[input.accelerator];
-  const edits = [
-    `In the template form, set Repository to ${IMAGE_REPOSITORY}:${imageTag} (the template ships intel-latest). ${NO_BARE_LATEST}`,
-    "Recordings: point it at a roomy array share, not the cache; leave Media root as /recordings.",
-    "Keep ExtraParams as shipped: --device-cgroup-rule and --pids-limit=8192.",
-    ...unraidDeviceEdits(input.accelerator)
-  ];
-  const first = firstRun(input);
-  return ready(input, imageTag, {
-    steps: [
-      `Unraid: Docker > Add Container > Template, paste ${url}`,
-      "Review the paths and Repository (edits below), then Apply.",
-      ...first
-    ],
-    files: [{ path: urlName(url), body: fetched.body, source: url }],
-    edits
-  });
-}
-function unraidDeviceEdits(accelerator) {
-  if (accelerator === "intel" || accelerator === "amd") {
-    return ["Intel/AMD iGPU: enter /dev/dri in that field. Intel NPU: enter /dev/accel."];
-  }
-  if (accelerator === "coral") {
-    return ["Coral USB: enter /dev/bus/usb (the whole bus). Coral PCIe/M.2: /dev/apex_0 (and _1)."];
-  }
-  return [];
-}
-function urlName(url) {
-  return url.slice(url.lastIndexOf("/") + 1);
-}
-async function proxmoxGuide(input, fetchFn) {
-  const url = TEMPLATE_URLS.proxmoxInstaller;
-  const fetched = await fetchText(url, fetchFn);
-  if (!fetched.ok) return fetched.failure;
-  const imageTag = IMAGE_TAG_BY_ACCELERATOR[input.accelerator];
-  const vars = [`ROLE=${input.role}`];
-  vars.push(`IMAGE_TAG=${IMAGE_REPOSITORY}:${imageTag}`);
-  if (input.accelerator === "cpu") vars.push("PASS_ACCEL=none");
-  if (input.role === "agent") vars.push(`CAMSTACK_HUB_ADDRESS=${input.hubAddress ?? "<hub-ip>"}`);
-  if (input.paths !== void 0) vars.push(`RECORDINGS_HOST_PATH=${input.paths.recordings}`);
-  const header = fetched.body.split("\n").slice(1, 20).filter((l) => l.startsWith("#")).join("\n");
-  const first = firstRun(input);
-  return ready(input, imageTag, {
-    steps: [
-      "Run on the Proxmox HOST (needs `pct`), not inside a container. It asks nothing: everything is an environment variable (defaults: VMID 200 hub / 201 agent, 8 cores, 8 GB, 64 GB disk, bridge vmbr0).",
-      `${vars.join(" ")} bash -c "$(curl -fsSL ${url})"`,
-      "It builds an Ubuntu 24.04 LXC with Docker, passes through the accelerators the host has (PASS_ACCEL=none skips it) and starts CamStack.",
-      ...first
-    ],
-    files: [
-      {
-        path: "install-camstack-proxmox.sh (header)",
-        body: header,
-        source: url
-      }
-    ],
-    edits: [
-      `The script defaults to the amd image; IMAGE_TAG above sets ${imageTag}. ${NO_BARE_LATEST}`,
-      "A hub and an agent on one machine need two CTs (host networking collides otherwise)."
-    ]
-  });
-}
-async function macGuide(input, fetchFn) {
-  const url = TEMPLATE_URLS.latestRelease;
-  const fetched = await fetchText(url, fetchFn);
-  if (!fetched.ok) return fetched.failure;
-  let release;
-  try {
-    const parsed = ReleaseSchema.safeParse(JSON.parse(fetched.body));
-    if (!parsed.success) {
-      return {
-        status: "fetch-failed",
-        url,
-        error: "the release answer had no assets"
-      };
-    }
-    release = parsed.data;
-  } catch {
-    return {
-      status: "fetch-failed",
-      url,
-      error: "the release answer was not JSON"
-    };
-  }
-  const dmgs = release.assets.filter((a) => DMG.test(a.name));
-  const first = firstRun(input);
-  return ready(input, null, {
-    steps: [
-      `Download the disk image for your Mac from release ${release.tag_name}: ${dmgs.map((a) => `${a.name} (${a.browser_download_url})`).join(" or ")}. Apple silicon (M1 and later) takes arm64; Intel takes x64. The CamStackViewer files are a different app.`,
-      "Drag CamStack into Applications and open it.",
-      `The setup window asks what this Mac should be: choose ${input.role === "hub" ? "Hub (full server)" : "Agent (worker)"}, then Save and start.`,
-      ...first
-    ],
-    files: [],
-    edits: ["A Mac uses the app, not Docker: a container there cannot reach the Neural Engine."]
-  });
-}
-function firstRun(input) {
-  const host = input.hostKind === "macos-desktop" ? "localhost" : "<host>";
-  if (input.role === "hub") return firstRunHub(host);
-  return [
-    "The agent status dashboard answers on http://<agent-host>:4444.",
-    "Pair it from the hub: run setup_add_node (it lists agents found on the network), then in the admin UI Cluster > Nodes > Agents found on the network. Type the six digits shown on the other screen on BOTH sides."
-  ];
-}
-function ready(input, imageTag, body) {
-  return {
-    status: "ready",
-    hostKind: input.hostKind,
-    role: input.role,
-    imageTag,
-    steps: body.steps,
-    files: body.files,
-    edits: body.edits,
-    mustNotOmit: input.hostKind === "macos-desktop" ? [] : MUST_NOT_OMIT
-  };
-}
-async function installGuide(input, fetchFn) {
-  const questions = missingQuestions(input);
-  if (questions.length > 0) return { status: "need-answers", questions };
-  const { hostKind, role } = input;
-  if (hostKind === void 0 || role === void 0) {
-    return { status: "need-answers", questions: missingQuestions({}) };
-  }
-  const resolved = {
-    hostKind,
-    role,
-    accelerator: hostKind === "macos-desktop" ? "apple" : input.accelerator ?? "cpu",
-    paths: input.paths,
-    hubAddress: input.hubAddress
-  };
-  switch (hostKind) {
-    case "docker-compose":
-      return composeGuide(resolved, fetchFn, false);
-    case "docker":
-      return composeGuide(resolved, fetchFn, true);
-    case "unraid":
-      return unraidGuide(resolved, fetchFn);
-    case "proxmox-lxc":
-      return proxmoxGuide(resolved, fetchFn);
-    case "macos-desktop":
-      return macGuide(resolved, fetchFn);
-  }
-}
-
-// src/mcp/setup-hubs.ts
-var DEFAULT_DISCOVER_TIMEOUT_MS = 2500;
-var MAX_DISCOVER_TIMEOUT_MS = 15e3;
-var HEALTH_TIMEOUT_MS = 5e3;
-var LOGIN = (server) => `run \`camstack login ${server}\` in a terminal`;
-var httpsHealth = (url, tls) => new Promise((resolve) => {
-  const req = https.get(
-    `${url}/health`,
-    { agent: createHubAgent(tls), timeout: HEALTH_TIMEOUT_MS },
-    (res) => {
-      res.resume();
-      resolve({ ok: true, status: res.statusCode ?? 0 });
-    }
-  );
-  req.on("timeout", () => req.destroy(new Error("timed out")));
-  req.on("error", (err) => {
-    resolve({
-      ok: false,
-      error: err.message,
-      tlsHint: explainTlsFailure(url, err)
-    });
-  });
-});
-async function discoverHubsTool(timeoutMs, deps) {
-  const wait = Math.min(timeoutMs ?? DEFAULT_DISCOVER_TIMEOUT_MS, MAX_DISCOVER_TIMEOUT_MS);
-  const finder = deps.findHubs ?? ((ms) => findHubs({
-    mdnsTimeoutMs: ms,
-    ...deps.sessionDir !== void 0 ? { sessionDir: deps.sessionDir } : {},
-    ...deps.env !== void 0 ? { env: deps.env } : {}
-  }));
-  const found = await finder(wait);
-  const hubs = found.map((h) => ({
-    host: h.host,
-    port: h.port,
-    name: h.nodeId,
-    version: h.version,
-    sources: h.sources
-  }));
-  return {
-    status: "ok",
-    hubs,
-    next: hubs.length === 0 ? "no hub answered: install one with setup_install_guide, or pass its address to setup_connect" : "pass the host of the hub you want to setup_connect"
-  };
-}
-function pinnedTls(url, deps) {
-  const caFile = hubCaFileForServer(url, deps.sessionDir);
-  try {
-    return {
-      tls: resolveHubTls(url, deps.env ?? process.env, deps.sessionDir),
-      caFile
-    };
-  } catch {
-    return { tls: {}, caFile };
-  }
-}
-async function connectTool(server, deps) {
-  let url;
-  try {
-    url = normalizeHubAddress(server);
-  } catch (err) {
-    const message = err instanceof HubAddressError ? err.message : String(err);
-    return { status: "invalid-address", server, message };
-  }
-  const { tls, caFile } = pinnedTls(url, deps);
-  const outcome = await (deps.health ?? httpsHealth)(url, tls);
-  const caPinned = tls.ca !== void 0;
-  const session = loadSession(url, deps.sessionDir);
-  const sessionInfo = {
-    exists: session !== null,
-    username: session?.username ?? null
-  };
-  if (!outcome.ok) {
-    return {
-      status: "unreachable",
-      server: url,
-      message: outcome.error,
-      tls: { caPinned, caFile, hint: outcome.tlsHint },
-      session: sessionInfo,
-      next: outcome.tlsHint === null ? "check the host, that the hub is running, and that port 4443 is reachable" : `the hub answers but its certificate is not trusted: ${LOGIN(url)}; login pins the CA (never disable verification)`
-    };
-  }
-  return {
-    status: "reachable",
-    server: url,
-    health: { status: outcome.status },
-    tls: { caPinned, caFile, hint: null },
-    session: sessionInfo,
-    next: session === null ? LOGIN(url) : "a session exists: the ops tools can use it"
-  };
-}
-var DiscoveredAgentsSchema = z23.object({
-  agents: z23.array(
-    z23.object({
-      nodeId: z23.string(),
-      host: z23.string(),
-      port: z23.number(),
-      version: z23.string().nullable(),
-      name: z23.string().nullable(),
-      state: z23.enum(["unpaired", "pending", "paired"])
-    })
-  )
-});
-var PAIRING_STEPS = [
-  "Pairing is started from the HUB (D857): admin UI, Cluster > Nodes > Agents found on the network. Pick the agent, or add it by address (host and port 4444).",
-  "Both screens now show six digits. Type the digits shown on the OTHER screen, on BOTH sides: the hub operator types the code the agent shows, and the agent operator confirms on the agent.",
-  "The agent installs its certificate only after its own operator confirmed. Nothing here (and no tool of this MCP) confirms a pairing for you.",
-  "The agent then appears under Cluster > Nodes."
-];
-async function addNodeTool(input, ctx) {
-  const guide = await installGuide({ ...input, role: "agent" }, ctx.fetch);
-  const outcome = await ctx.hub();
-  if (!outcome.ok) {
-    return {
-      guide,
-      pairing: PAIRING_STEPS,
-      agentsOnNetwork: { status: "no-session", action: outcome.action }
-    };
-  }
-  try {
-    const raw = await outcome.connection.client.call("GET", "agentPairing.listDiscoveredAgents", {});
-    const parsed = DiscoveredAgentsSchema.safeParse(raw);
-    return {
-      guide,
-      pairing: PAIRING_STEPS,
-      agentsOnNetwork: parsed.success ? { status: "ok", agents: parsed.data.agents } : {
-        status: "unavailable",
-        error: "the hub answered in an unexpected shape"
-      }
-    };
-  } catch (err) {
-    return {
-      guide,
-      pairing: PAIRING_STEPS,
-      agentsOnNetwork: {
-        status: "unavailable",
-        error: err instanceof Error ? err.message : String(err)
-      }
-    };
-  }
-}
-
-// src/mcp/setup-tools.ts
-var SUPPORTED_HOST_KINDS = HOST_KINDS;
-var REGISTRY2 = "https://registry.npmjs.org";
-var REGISTRY_TIMEOUT_MS2 = 5e3;
-var RegistryLatestSchema = z24.object({ version: z24.string() });
-async function latestOnNpm(name, fetchFn) {
-  const url = `${REGISTRY2}/${name.replace("/", "%2f")}/latest`;
-  try {
-    const res = await fetchFn(url, {
-      signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS2)
-    });
-    if (!res.ok) return { latest: null, error: `registry answered ${res.status}` };
-    const parsed = RegistryLatestSchema.safeParse(await res.json());
-    if (!parsed.success) return { latest: null, error: "registry answer had no version" };
-    return { latest: parsed.data.version };
-  } catch (err) {
-    return {
-      latest: null,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
-async function about(ctx) {
-  const [cli, server] = await Promise.all([
-    latestOnNpm("camstack", ctx.fetch),
-    latestOnNpm("@camstack/server", ctx.fetch)
-  ]);
-  return {
-    cli: { installed: ctx.cliVersion, ...cli },
-    server,
-    supportedHostKinds: SUPPORTED_HOST_KINDS
-  };
-}
-function registerSetupTools(server, ctx, deps = {}) {
-  server.tool(
-    "setup_about",
-    "Versions of the camstack CLI (installed and latest on npm), the latest @camstack/server on npm, and the host kinds CamStack supports. Needs no hub and no login.",
-    {},
-    async () => text11(await about(ctx))
-  );
-  server.tool(
-    "setup_install_guide",
-    'Interview-style install guide. Call it with whatever you know; while an answer is missing it returns {status:"need-answers", questions} listing only what is still unknown. When complete it returns the steps and the OFFICIAL template files (fetched live) for that route: docker-compose, docker, unraid, proxmox-lxc or macos-desktop. Start with a hub.',
-    {
-      hostKind: HostKindSchema.optional(),
-      role: RoleSchema.optional(),
-      accelerator: AcceleratorSchema.optional(),
-      paths: InstallPathsSchema.optional(),
-      hubAddress: z24.string().min(1).optional().describe("Agents only: the hub to dial.")
-    },
-    async (input) => text11(await installGuide(input, ctx.fetch))
-  );
-  server.tool(
-    "setup_discover_hubs",
-    "Find CamStack hubs on the local network (mDNS) plus the hubs this machine already knows, with host, port, name and version. Needs no login.",
-    { timeoutMs: z24.number().int().min(200).max(15e3).optional() },
-    async ({ timeoutMs }) => text11(await discoverHubsTool(timeoutMs, deps))
-  );
-  server.tool(
-    "setup_connect",
-    "Check that a hub answers on https://<server>:4443/health, whether its CA is already pinned for TLS, and whether a `camstack login` session exists. Never takes a password: when there is no session it says to run `camstack login <server>` in a terminal.",
-    { server: z24.string().min(1) },
-    async ({ server: address }) => text11(await connectTool(address, deps))
-  );
-  server.tool(
-    "setup_add_node",
-    "Guide to add an AGENT (a second machine) to a hub: the install route for that host, then the pairing flow where the operator types the six digits shown on the other screen on both sides. With a login session it also lists the agents found on the network. It never confirms a pairing.",
-    {
-      hostKind: HostKindSchema.optional(),
-      accelerator: AcceleratorSchema.optional(),
-      paths: InstallPathsSchema.optional(),
-      hubAddress: z24.string().min(1).optional()
-    },
-    async (input) => text11(await addNodeTool(input, ctx))
-  );
-}
-
-// src/mcp/ops-update-cli.ts
-var CLI_PACKAGE = "camstack";
-var NPM_GLOBAL = /[\\/]lib[\\/]node_modules[\\/]camstack[\\/]|[\\/]npm[\\/]node_modules[\\/]camstack[\\/]/;
-var OTHER_MANAGER = /[\\/]\.bun[\\/]|[\\/]pnpm[\\/]|[\\/]\.yarn[\\/]|[\\/]yarn[\\/]|[\\/]\.volta[\\/]/;
-function detectCliInstall(entryPath) {
-  const manual = `Update it with the package manager it was installed with, for example \`npm install -g ${CLI_PACKAGE}@latest\` (no sudo: fix the npm prefix permissions instead).`;
-  if (/[\\/]_npx[\\/]/.test(entryPath)) {
-    return {
-      method: "npx",
-      command: null,
-      instructions: `The CLI runs through npx: there is nothing installed to update. Start it as \`npx ${CLI_PACKAGE}@latest mcp\` (or clear the npx cache), then restart the MCP in your client.`
-    };
-  }
-  if (OTHER_MANAGER.test(entryPath) || !NPM_GLOBAL.test(entryPath)) {
-    return { method: "unknown", command: null, instructions: manual };
-  }
-  return {
-    method: "npm-global",
-    command: ["npm", "install", "-g", `${CLI_PACKAGE}@latest`],
-    instructions: `npm install -g ${CLI_PACKAGE}@latest`
-  };
-}
-var runCommand = (file, args) => new Promise((resolve) => {
-  execFile(file, [...args], { timeout: 5 * 6e4 }, (err, stdout, stderr) => {
-    const out = `${stdout}${stderr}`.trim().slice(-600);
-    resolve({
-      ok: err === null,
-      output: err ? `${err.message} ${out}`.trim() : out
-    });
-  });
-});
-function parts(v) {
-  return v.split("-")[0].split(".").map((n) => Number.parseInt(n, 10) || 0);
-}
-function isOlder(a, b) {
-  const x = parts(a);
-  const y = parts(b);
-  for (let i = 0; i < 3; i++) {
-    const d = (x[i] ?? 0) - (y[i] ?? 0);
-    if (d !== 0) return d < 0;
-  }
-  return false;
-}
-async function cliVerdict(installed, fetchFn, entryPath) {
-  const latest = await latestOnNpm(CLI_PACKAGE, fetchFn);
-  return {
-    installed,
-    latest: latest.latest,
-    updateAvailable: latest.latest === null ? null : isOlder(installed, latest.latest),
-    ...latest.error !== void 0 ? { error: latest.error } : {},
-    install: detectCliInstall(entryPath)
-  };
-}
-
 // src/mcp/ops-update-apply.ts
 var UPDATE_APPLY_TOOL = "ops_update_apply";
 function timing(deps) {
@@ -6549,7 +5758,7 @@ async function readPlan(client, args, ctx, deps) {
       wrapper: wrapperVerdict(status.value)
     });
   }
-  const updates = args.addons === false ? null : await readQuery(client, "addons.listUpdates", {}, z25.array(AddonUpdateShape));
+  const updates = args.addons === false ? null : await readQuery(client, "addons.listUpdates", {}, z21.array(AddonUpdateShape));
   const cli = args.cli === false ? null : await cliVerdict(ctx.cliVersion, ctx.fetch, deps.entryPath ?? process.argv[1] ?? "");
   const hub = plans.find((p) => p.node.isHub === true) ?? null;
   return {
@@ -6865,14 +6074,14 @@ async function opsUpdateApply(ctx, args, confirmToken, deps = {}) {
 }
 
 // src/mcp/ops-update-check.ts
-import { z as z26 } from "zod";
+import { z as z22 } from "zod";
 var ADDON_LIMIT = 30;
 async function opsUpdateCheck(ctx, deps = {}) {
   return withAdminHub(ctx, async ({ client, server }) => {
     const unavailable = {};
     const [topology, updates, installs, cli] = await Promise.all([
       readTopology(client),
-      readQuery(client, "addons.listUpdates", {}, z26.array(AddonUpdateShape)),
+      readQuery(client, "addons.listUpdates", {}, z22.array(AddonUpdateShape)),
       readInstallations(client),
       cliVerdict(ctx.cliVersion, ctx.fetch, deps.entryPath ?? process.argv[1] ?? "")
     ]);
@@ -6990,40 +6199,40 @@ function registerOpsTools(server, ctx) {
     "ops_whoami",
     "Which hub this MCP talks to and as whom, from the `camstack login` session (no network call). If there is no session, says to run `camstack login <host>` in a terminal.",
     {},
-    async () => text12(await whoami(ctx))
+    async () => text(await whoami(ctx))
   );
   server.tool(
     "ops_status",
     'Cluster summary: every node (online, platform, server version, capability count, "online-but-capless" flag), the active alerts and the addons with an update. A part the hub did not answer is null with its reason in `unavailable`, never zero. Node list and updates need an admin `camstack login`.',
     {},
-    async () => text12(await opsStatus(ctx))
+    async () => text(await opsStatus(ctx))
   );
   server.tool(
     "ops_device",
     "One device: online state, provider addon and node, bound capabilities, runtime-state age and, for a camera, its pipeline, recording state, the functions an operator switched off (not faults) and its latest object events.",
-    { deviceId: z27.number().int() },
-    async ({ deviceId }) => text12(await opsDevice(ctx, deviceId))
+    { deviceId: z23.number().int() },
+    async ({ deviceId }) => text(await opsDevice(ctx, deviceId))
   );
   server.tool(
     "ops_unhealthy_devices",
     "Every enabled device that is unhealthy, each with a typed reason (offline, detection-provisioning-failed, detection-not-assigned, recording-inactive). A function an operator switched off is never listed; a camera whose status could not be fully read is listed under `unknown`.",
     {},
-    async () => text12(await opsUnhealthyDevices(ctx))
+    async () => text(await opsUnhealthyDevices(ctx))
   );
   server.tool(
     "ops_logs",
     "Hub logs scoped by deviceId, addon, node, level, window and free text, grouped and deduplicated with counts. Says which tier answered (ring = recent in-RAM; persisted = the default log destination). With `around` (a track or event id) returns `contextLines` lines on each side of its first mention. Needs an admin `camstack login`.",
     {
-      deviceId: z27.number().int().optional(),
-      addonId: z27.string().optional(),
-      nodeId: z27.string().optional(),
-      level: z27.enum(["debug", "info", "warn", "error"]).optional(),
-      windowMinutes: z27.number().int().min(1).max(1440).optional(),
-      text: z27.string().max(200).optional(),
-      around: z27.string().max(200).optional(),
-      contextLines: z27.number().int().min(1).max(50).optional()
+      deviceId: z23.number().int().optional(),
+      addonId: z23.string().optional(),
+      nodeId: z23.string().optional(),
+      level: z23.enum(["debug", "info", "warn", "error"]).optional(),
+      windowMinutes: z23.number().int().min(1).max(1440).optional(),
+      text: z23.string().max(200).optional(),
+      around: z23.string().max(200).optional(),
+      contextLines: z23.number().int().min(1).max(50).optional()
     },
-    async (args) => text12(
+    async (args) => text(
       await opsLogs(ctx, {
         ...args.deviceId !== void 0 ? { deviceId: args.deviceId } : {},
         ...args.addonId ? { addonId: args.addonId } : {},
@@ -7040,14 +6249,14 @@ function registerOpsTools(server, ctx) {
     "ops_events",
     "Find tracks (and, for one camera, object events) by camera, class, zone, time window and free text. Each result carries an admin-UI link and a viewer link built on the hub address flagged for app connections.",
     {
-      deviceId: z27.number().int().optional(),
-      className: z27.string().optional(),
-      zone: z27.string().optional(),
-      text: z27.string().max(200).optional(),
-      windowMinutes: z27.number().int().min(1).max(10080).optional(),
-      limit: z27.number().int().min(1).max(50).optional()
+      deviceId: z23.number().int().optional(),
+      className: z23.string().optional(),
+      zone: z23.string().optional(),
+      text: z23.string().max(200).optional(),
+      windowMinutes: z23.number().int().min(1).max(10080).optional(),
+      limit: z23.number().int().min(1).max(50).optional()
     },
-    async (args) => text12(
+    async (args) => text(
       await opsEvents(ctx, {
         ...args.deviceId !== void 0 ? { deviceId: args.deviceId } : {},
         ...args.className ? { className: args.className } : {},
@@ -7061,31 +6270,31 @@ function registerOpsTools(server, ctx) {
   server.tool(
     "ops_track",
     "One track with its media audit: best shot, keyframes, every missing media kind with the reason the track recorded for it, and the audit findings. Links to the admin UI and the viewer.",
-    { deviceId: z27.number().int(), trackId: z27.string().min(1) },
-    async ({ deviceId, trackId }) => text12(await opsTrack(ctx, { deviceId, trackId }))
+    { deviceId: z23.number().int(), trackId: z23.string().min(1) },
+    async ({ deviceId, trackId }) => text(await opsTrack(ctx, { deviceId, trackId }))
   );
   server.tool(
     "ops_accelerators",
     'Per node: the inference devices it has, the Auto-tune hardware class the node maps to, and whether the measured detector-latency table has a row for that class and accelerator. A node that could not be read is null with a reason, never "no accelerator". Needs an admin `camstack login`.',
     {},
-    async () => text12(await opsAccelerators(ctx))
+    async () => text(await opsAccelerators(ctx))
   );
   server.tool(
     "ops_update_check",
     'Read-only update report for the whole cluster. Every node from the topology: running vs installed vs latest @camstack/server, restartRequired / updateState / rolledBack, the wrapper (Docker image / desktop app) verdict, and whether its addon versions match the hub; the hub\'s addon updates; the viewer (not exposed by any API, said so); and this CLI/MCP against npm. A node that cannot be read is null with a reason, never "up to date". Needs an admin `camstack login`.',
     {},
-    async () => text12(await opsUpdateCheck(ctx))
+    async () => text(await opsUpdateCheck(ctx))
   );
   server.tool(
     UPDATE_APPLY_TOOL,
     "Bring the cluster up to date, verified step by step: hub server closure, wait until the hub runs it, then each online agent, then addons (agents follow by reconciliation, verified), then this CLI last. Two steps: call without confirm_token for a preview (order, versions, wrapper instructions, timeouts) and a one-shot token, then again with the SAME arguments and that token. A failed step stops the chain and names the node. Wrapper (image/app) updates are only reported with instructions. Needs an admin `camstack login`.",
     {
-      version: z27.string().min(1).optional().describe("Server target; default = the hub's latest."),
-      addons: z27.boolean().optional().describe("Update addons too (default true)."),
-      cli: z27.boolean().optional().describe("Update this CLI last (default true)."),
-      confirm_token: z27.string().optional()
+      version: z23.string().min(1).optional().describe("Server target; default = the hub's latest."),
+      addons: z23.boolean().optional().describe("Update addons too (default true)."),
+      cli: z23.boolean().optional().describe("Update this CLI last (default true)."),
+      confirm_token: z23.string().optional()
     },
-    async ({ version, addons, cli, confirm_token }) => text12(
+    async ({ version, addons, cli, confirm_token }) => text(
       await opsUpdateApply(
         ctx,
         {
@@ -7100,7 +6309,7 @@ function registerOpsTools(server, ctx) {
 }
 
 // src/mcp/configure-tools.ts
-var CurrentDeviceSchema = z28.object({ name: z28.string() }).nullable();
+var CurrentDeviceSchema = z24.object({ name: z24.string() }).nullable();
 var RENAME_DEVICE_TOOL = "configure_rename_device";
 function renameDeviceSpec(client) {
   return {
@@ -7162,11 +6371,11 @@ function registerConfigureTools(server, ctx) {
     RENAME_DEVICE_TOOL,
     "Rename a device. Two steps: call without confirm_token for a preview and a one-shot token, then call again with the SAME arguments and that token to apply. Needs an admin `camstack login` session.",
     {
-      deviceId: z28.number().int(),
-      name: z28.string().min(1),
-      confirm_token: z28.string().optional()
+      deviceId: z24.number().int(),
+      name: z24.string().min(1),
+      confirm_token: z24.string().optional()
     },
-    async ({ deviceId, name, confirm_token }) => text13(await renameDevice(ctx, { deviceId, name }, confirm_token))
+    async ({ deviceId, name, confirm_token }) => text(await renameDevice(ctx, { deviceId, name }, confirm_token))
   );
   registerAddonTools(server, ctx);
   registerCameraTools(server, ctx);
@@ -7175,11 +6384,10 @@ function registerConfigureTools(server, ctx) {
 }
 
 // src/mcp/support-tools.ts
-import { text as text14 } from "@camstack/develop";
-import { z as z33 } from "zod";
+import { z as z29 } from "zod";
 
 // src/mcp/support-accelerator.ts
-import { z as z29 } from "zod";
+import { z as z25 } from "zod";
 var EXPECTED_ACCELERATORS = [
   "intel-igpu",
   "intel-npu",
@@ -7191,23 +6399,23 @@ var EXPECTED_ACCELERATORS = [
   "apple-ane",
   "nvidia"
 ];
-var ExpectedAcceleratorSchema = z29.enum(EXPECTED_ACCELERATORS);
-var HardwareSchema2 = z29.looseObject({
-  platform: z29.enum(["darwin", "linux", "win32"]),
-  arch: z29.enum(["arm64", "x64"]),
-  cpuModel: z29.string(),
-  gpu: z29.looseObject({ type: z29.string(), name: z29.string() }).nullable(),
-  npu: z29.looseObject({ type: z29.string() }).nullable()
+var ExpectedAcceleratorSchema = z25.enum(EXPECTED_ACCELERATORS);
+var HardwareSchema2 = z25.looseObject({
+  platform: z25.enum(["darwin", "linux", "win32"]),
+  arch: z25.enum(["arm64", "x64"]),
+  cpuModel: z25.string(),
+  gpu: z25.looseObject({ type: z25.string(), name: z25.string() }).nullable(),
+  npu: z25.looseObject({ type: z25.string() }).nullable()
 });
-var InferenceDevicesSchema2 = z29.looseObject({
-  reachable: z29.boolean(),
-  devices: z29.array(
-    z29.looseObject({
-      key: z29.string(),
-      available: z29.boolean(),
-      presence: z29.enum(["present", "absent", "unknown"]).optional(),
-      enabled: z29.boolean(),
-      exclusion: z29.string().nullable()
+var InferenceDevicesSchema2 = z25.looseObject({
+  reachable: z25.boolean(),
+  devices: z25.array(
+    z25.looseObject({
+      key: z25.string(),
+      available: z25.boolean(),
+      presence: z25.enum(["present", "absent", "unknown"]).optional(),
+      enabled: z25.boolean(),
+      exclusion: z25.string().nullable()
     })
   )
 });
@@ -7403,11 +6611,11 @@ function diagnoseAccelerator(input) {
   }
   const matched = devices.filter((d) => expectation.deviceKeys(d.key));
   const matchedKeys = matched.map((d) => d.key);
-  const ready2 = matched.filter((d) => d.available && d.enabled && d.exclusion === null);
-  if (ready2.length > 0) {
+  const ready = matched.filter((d) => d.available && d.enabled && d.exclusion === null);
+  if (ready.length > 0) {
     return finish(
       "ok",
-      `The node offers ${ready2.map((d) => d.key).join(", ")}, available and enabled.`,
+      `The node offers ${ready.map((d) => d.key).join(", ")}, available and enabled.`,
       matchedKeys,
       [],
       null
@@ -7486,7 +6694,7 @@ async function supportDiagnoseAccelerator(ctx, args) {
 import {
   runGated as runGated5
 } from "@camstack/develop";
-import { z as z30 } from "zod";
+import { z as z26 } from "zod";
 var BENCHMARK_RUN_TOOL = "support_benchmark_run";
 var AUTO_TUNE_MODELS = [
   "yolov9t-320",
@@ -7508,64 +6716,64 @@ var CONTRIBUTE_HOW = [
   "The measured medians belong in the Auto-tune latency table: docs/benchmarks/detector-latency.json and packages/types/src/pipeline/auto-tune/detector-performance.ts, changed together (detector-performance.spec.ts fails until they agree), in the camstack/server repository.",
   'Use support_draft_pr with kind "benchmark", the column ("<hardwareClass>/<accelerator>") and these cells to get the branch plan and the `gh pr create` command.'
 ];
-var HardwareSchema3 = z30.looseObject({
-  platform: z30.enum(["darwin", "linux", "win32"]),
-  arch: z30.enum(["arm64", "x64"]),
-  cpuModel: z30.string(),
-  cpuCores: z30.number(),
-  totalRAM_MB: z30.number(),
-  availableRAM_MB: z30.number(),
-  gpu: z30.looseObject({
-    type: z30.enum(["nvidia", "amd", "intel", "apple"]),
-    name: z30.string()
+var HardwareSchema3 = z26.looseObject({
+  platform: z26.enum(["darwin", "linux", "win32"]),
+  arch: z26.enum(["arm64", "x64"]),
+  cpuModel: z26.string(),
+  cpuCores: z26.number(),
+  totalRAM_MB: z26.number(),
+  availableRAM_MB: z26.number(),
+  gpu: z26.looseObject({
+    type: z26.enum(["nvidia", "amd", "intel", "apple"]),
+    name: z26.string()
   }).nullable(),
-  npu: z30.looseObject({ type: z30.enum(["apple-ane", "intel-npu", "amd-xdna"]) }).nullable()
+  npu: z26.looseObject({ type: z26.enum(["apple-ane", "intel-npu", "amd-xdna"]) }).nullable()
 });
-var InferenceDevicesSchema3 = z30.looseObject({
-  reachable: z30.boolean(),
-  devices: z30.array(
-    z30.looseObject({
-      key: z30.string(),
-      backend: z30.string(),
-      available: z30.boolean(),
-      enabled: z30.boolean()
+var InferenceDevicesSchema3 = z26.looseObject({
+  reachable: z26.boolean(),
+  devices: z26.array(
+    z26.looseObject({
+      key: z26.string(),
+      backend: z26.string(),
+      available: z26.boolean(),
+      enabled: z26.boolean()
     })
   )
 });
-var RunStatusSchema = z30.looseObject({
-  run: z30.looseObject({
-    runId: z30.string(),
-    nodeId: z30.string(),
-    state: z30.string(),
-    endReason: z30.string().nullable().optional(),
-    error: z30.string().nullable().optional()
+var RunStatusSchema = z26.looseObject({
+  run: z26.looseObject({
+    runId: z26.string(),
+    nodeId: z26.string(),
+    state: z26.string(),
+    endReason: z26.string().nullable().optional(),
+    error: z26.string().nullable().optional()
   }).nullable()
 });
-var ModelListSchema = z30.array(
-  z30.looseObject({
-    id: z30.string(),
-    formats: z30.record(z30.string(), z30.looseObject({ downloaded: z30.boolean().optional() })).optional()
+var ModelListSchema = z26.array(
+  z26.looseObject({
+    id: z26.string(),
+    formats: z26.record(z26.string(), z26.looseObject({ downloaded: z26.boolean().optional() })).optional()
   })
 );
-var PipelineTestSchema = z30.looseObject({
-  kind: z30.string().optional(),
-  detections: z30.array(
-    z30.looseObject({
-      debug: z30.looseObject({
-        stepLatencyMs: z30.record(z30.string(), z30.number()).optional()
+var PipelineTestSchema = z26.looseObject({
+  kind: z26.string().optional(),
+  detections: z26.array(
+    z26.looseObject({
+      debug: z26.looseObject({
+        stepLatencyMs: z26.record(z26.string(), z26.number()).optional()
       }).optional()
     })
   ).optional(),
-  discarded: z30.array(z30.unknown()).optional(),
-  debug: z30.looseObject({
-    stepTimings: z30.array(
-      z30.looseObject({
-        source: z30.string().optional(),
-        ms: z30.number().optional()
+  discarded: z26.array(z26.unknown()).optional(),
+  debug: z26.looseObject({
+    stepTimings: z26.array(
+      z26.looseObject({
+        source: z26.string().optional(),
+        ms: z26.number().optional()
       })
     ).optional(),
-    predictMs: z30.number().optional(),
-    totalInferenceMs: z30.number().optional()
+    predictMs: z26.number().optional(),
+    totalInferenceMs: z26.number().optional()
   }).optional()
 });
 var FORMAT_BY_BACKEND = {
@@ -7852,15 +7060,15 @@ async function supportBenchmarkRun(ctx, deps, args, confirmToken) {
   }
   return runGated5(ctx.gate, benchmarkRunSpec(outcome.connection.client, deps), args, confirmToken);
 }
-var ResultsSchema = z30.array(
-  z30.looseObject({
-    nodeId: z30.string(),
-    cell: z30.looseObject({
-      phase: z30.string(),
-      deviceKey: z30.string(),
-      modelId: z30.string(),
-      p50Ms: z30.number().optional(),
-      fps: z30.number().optional()
+var ResultsSchema = z26.array(
+  z26.looseObject({
+    nodeId: z26.string(),
+    cell: z26.looseObject({
+      phase: z26.string(),
+      deviceKey: z26.string(),
+      modelId: z26.string(),
+      p50Ms: z26.number().optional(),
+      fps: z26.number().optional()
     })
   })
 );
@@ -7913,20 +7121,20 @@ async function supportBenchmarkStatus(ctx, args) {
 }
 
 // src/mcp/support-camera.ts
-import { z as z31 } from "zod";
-var DeviceSchema2 = z31.looseObject({
-  id: z31.number(),
-  name: z31.string(),
-  addonId: z31.string().optional(),
-  disabled: z31.boolean().optional(),
-  online: z31.boolean().optional()
+import { z as z27 } from "zod";
+var DeviceSchema2 = z27.looseObject({
+  id: z27.number(),
+  name: z27.string(),
+  addonId: z27.string().optional(),
+  disabled: z27.boolean().optional(),
+  online: z27.boolean().optional()
 }).nullable();
 var GENERIC = /onvif|rtsp/i;
-function words(text15) {
-  return text15.toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length >= 3);
+function words(text2) {
+  return text2.toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length >= 3);
 }
-function isGeneric(parts2) {
-  return parts2.some((p) => GENERIC.test(p));
+function isGeneric(parts) {
+  return parts.some((p) => GENERIC.test(p));
 }
 function installedPick(p) {
   return {
@@ -7947,9 +7155,9 @@ function availablePick(p) {
 var MATCHING_NOTE = "A provider manifest declares no brand or model list: matching is on provider name, description and keywords, so a brand that is supported under another name can be missed.";
 function matchIn(pools, tokens) {
   if (tokens.length === 0) return null;
-  const hit = (parts2) => {
-    if (isGeneric(parts2)) return false;
-    const joined = parts2.join(" ").toLowerCase();
+  const hit = (parts) => {
+    if (isGeneric(parts)) return false;
+    const joined = parts.join(" ").toLowerCase();
     return tokens.some((t) => joined.includes(t));
   };
   const installed = pools.installed.find(
@@ -8085,10 +7293,10 @@ async function supportDiagnoseCamera(ctx, args) {
 }
 
 // src/mcp/support-deps.ts
-import { execFile as execFile2 } from "child_process";
+import { execFile } from "child_process";
 var RUN_TIMEOUT_MS = 6e4;
 var spawnRunner = (command, args) => new Promise((resolve) => {
-  execFile2(
+  execFile(
     command,
     [...args],
     { timeout: RUN_TIMEOUT_MS, maxBuffer: 1e6 },
@@ -8120,7 +7328,7 @@ import {
   digestArgs,
   runGated as runGated6
 } from "@camstack/develop";
-import { z as z32 } from "zod";
+import { z as z28 } from "zod";
 
 // src/mcp/support-scrub.ts
 import { redactToolArgs, scrubSecrets } from "@camstack/develop";
@@ -8129,10 +7337,10 @@ var IPV6 = /\b(?:[0-9a-fA-F]{1,4}:){4,7}[0-9a-fA-F]{1,4}(?![\w:])|\b[0-9a-fA-F]{
 var MAC = /\b(?:[0-9a-fA-F]{2}[:-]){5}[0-9a-fA-F]{2}\b/g;
 var HOME_DIR = /(\/Users|\/home)\/[^/\s'"]+/g;
 function octets(ip) {
-  const parts2 = ip.split(".").map((p) => Number(p));
-  if (parts2.length !== 4) return null;
-  if (parts2.some((p) => !Number.isInteger(p) || p < 0 || p > 255)) return null;
-  return parts2;
+  const parts = ip.split(".").map((p) => Number(p));
+  if (parts.length !== 4) return null;
+  if (parts.some((p) => !Number.isInteger(p) || p < 0 || p > 255)) return null;
+  return parts;
 }
 function maskIpv4(ip) {
   const o = octets(ip);
@@ -8173,16 +7381,16 @@ var INFERENCE_PACKAGE = "@camstack/addon-pipeline";
 var TITLE_MAX = 140;
 var DIAGNOSIS_MAX = 4e3;
 var DRAFT_KINDS = ["accelerator", "camera", "benchmark", "other"];
-var DraftKindSchema = z32.enum(DRAFT_KINDS);
-var BenchmarkCellsSchema = z32.record(
-  z32.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/),
-  z32.object({ p50Ms: z32.number().positive(), fps: z32.number().positive() })
+var DraftKindSchema = z28.enum(DRAFT_KINDS);
+var BenchmarkCellsSchema = z28.record(
+  z28.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/),
+  z28.object({ p50Ms: z28.number().positive(), fps: z28.number().positive() })
 );
 var PackageNameRe = /^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
 var GithubRepoRe = /github\.com[:/]([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?(?:[/#?].*)?$/;
 var ShorthandRe = /^(?:github:)?([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/;
-var RegistryDocSchema = z32.looseObject({
-  repository: z32.union([z32.string(), z32.looseObject({ url: z32.string() })]).optional()
+var RegistryDocSchema = z28.looseObject({
+  repository: z28.union([z28.string(), z28.looseObject({ url: z28.string() })]).optional()
 });
 function githubRepoOf(value) {
   const url = GithubRepoRe.exec(value);
@@ -8224,7 +7432,7 @@ async function resolveRepo(ctx, packageName) {
     reason: null
   };
 }
-var ServerStatusSchema2 = z32.looseObject({ runningVersion: z32.string() });
+var ServerStatusSchema2 = z28.looseObject({ runningVersion: z28.string() });
 async function serverVersion(client, nodeId) {
   const status = await readQuery(
     client,
@@ -8339,11 +7547,11 @@ async function buildDraft(ctx, args, heading) {
   ].filter((s) => s !== "");
   return { target, title: cleanTitle(args.title), body: sections.join("\n\n") };
 }
-function shellQuote2(value) {
+function shellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 function issueCommand(draft, bodyFile) {
-  return `gh issue create --repo ${draft.target.repo} --title ${shellQuote2(draft.title)} --body-file ${bodyFile}`;
+  return `gh issue create --repo ${draft.target.repo} --title ${shellQuote(draft.title)} --body-file ${bodyFile}`;
 }
 var ISSUE_BODY_FILE = "./camstack-issue.md";
 async function issueDraft(ctx, args) {
@@ -8426,8 +7634,8 @@ var BENCHMARK_FILES = [
   "docs/benchmarks/detector-latency.json",
   "packages/types/src/pipeline/auto-tune/detector-performance.ts"
 ];
-function slug(text15) {
-  const s = text15.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
+function slug(text2) {
+  const s = text2.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
   return s === "" ? "change" : s;
 }
 function prProblem(args) {
@@ -8450,7 +7658,7 @@ function planFor(args, draft) {
       `Merge the measured cells into docs/benchmarks/detector-latency.json under "${args.column ?? ""}" (set "measured": true on the column when every kept cell was measured on the box) and mirror the same cells into DETECTOR_PERF in packages/types/src/pipeline/auto-tune/detector-performance.ts.`,
       "npx vitest run packages/types/src/pipeline/auto-tune/__tests__/detector-performance.spec.ts (it fails until the two files agree)."
     ] : ["Make the change with a spec that fails first, then passes."],
-    `git commit -am ${shellQuote2(benchmark ? `docs: measured detector latency for ${args.column ?? ""}` : `fix: ${draft.title}`)}`,
+    `git commit -am ${shellQuote(benchmark ? `docs: measured detector latency for ${args.column ?? ""}` : `fix: ${draft.title}`)}`,
     `git push -u origin ${branch}`,
     `Save the body below as ${PR_BODY_FILE}, then run the command.`
   ];
@@ -8463,7 +7671,7 @@ function planFor(args, draft) {
     branch,
     files,
     steps,
-    command: `gh pr create --repo ${draft.target.repo} --head <your-github-user>:${branch} --title ${shellQuote2(draft.title)} --body-file ${PR_BODY_FILE}`,
+    command: `gh pr create --repo ${draft.target.repo} --head <your-github-user>:${branch} --title ${shellQuote(draft.title)} --body-file ${PR_BODY_FILE}`,
     note: "This tool pushes no code and calls no GitHub API; you run these steps with your own git and gh."
   };
 }
@@ -8490,20 +7698,20 @@ async function supportDraftPr(ctx, args, confirmToken) {
 }
 
 // src/mcp/support-tools.ts
-var ModelId = z33.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/);
+var ModelId = z29.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/);
 var DraftShape = {
   kind: DraftKindSchema,
-  title: z33.string().min(3).max(300),
-  summary: z33.string().min(3).max(4e3),
-  nodeId: z33.string().max(100).optional(),
+  title: z29.string().min(3).max(300),
+  summary: z29.string().min(3).max(4e3),
+  nodeId: z29.string().max(100).optional(),
   expected: ExpectedAcceleratorSchema.optional(),
-  brand: z33.string().max(100).optional(),
-  model: z33.string().max(100).optional(),
-  deviceId: z33.number().int().optional(),
-  packageName: z33.string().max(214).optional(),
-  column: z33.string().max(100).optional(),
+  brand: z29.string().max(100).optional(),
+  model: z29.string().max(100).optional(),
+  deviceId: z29.number().int().optional(),
+  packageName: z29.string().max(214).optional(),
+  column: z29.string().max(100).optional(),
   cells: BenchmarkCellsSchema.optional(),
-  confirm_token: z33.string().optional()
+  confirm_token: z29.string().optional()
 };
 function draftArgs(input) {
   return {
@@ -8524,20 +7732,20 @@ function registerSupportTools(server, ctx, deps = defaultSupportDeps) {
   server.tool(
     "support_benchmark_status",
     "The hub's own node-benchmark state: the active or last run and the per-device latency cells it stored. Read-only. The Auto-tune latency table is filled with support_benchmark_run. Needs an admin `camstack login`.",
-    { nodeId: z33.string().max(100).optional() },
-    async ({ nodeId }) => text14(await supportBenchmarkStatus(ctx, nodeId !== void 0 ? { nodeId } : {}))
+    { nodeId: z29.string().max(100).optional() },
+    async ({ nodeId }) => text(await supportBenchmarkStatus(ctx, nodeId !== void 0 ? { nodeId } : {}))
   );
   server.tool(
     BENCHMARK_RUN_TOOL,
     "Measure detector latency on a node x device (cold run, then warm median per model, via runPipelineTest) and return it next to the Auto-tune table cell for the same hardware, plus how to contribute it. LOADS THE NODE: the detection pool restarts between models. Pick the node and deviceKey from ops_accelerators. Two steps: call without confirm_token for the plan and a one-shot token, then again with the SAME arguments and that token. Needs an admin `camstack login`.",
     {
-      nodeId: z33.string().min(1).max(100),
-      deviceKey: z33.string().min(1).max(60),
-      models: z33.array(ModelId).min(1).max(MAX_MODELS).optional(),
-      warmRuns: z33.number().int().min(1).max(MAX_WARM_RUNS).optional(),
-      confirm_token: z33.string().optional()
+      nodeId: z29.string().min(1).max(100),
+      deviceKey: z29.string().min(1).max(60),
+      models: z29.array(ModelId).min(1).max(MAX_MODELS).optional(),
+      warmRuns: z29.number().int().min(1).max(MAX_WARM_RUNS).optional(),
+      confirm_token: z29.string().optional()
     },
-    async ({ nodeId, deviceKey, models, warmRuns, confirm_token }) => text14(
+    async ({ nodeId, deviceKey, models, warmRuns, confirm_token }) => text(
       await supportBenchmarkRun(
         ctx,
         deps,
@@ -8554,18 +7762,18 @@ function registerSupportTools(server, ctx, deps = defaultSupportDeps) {
   server.tool(
     "support_diagnose_accelerator",
     "A node should have an accelerator (Intel iGPU/NPU, AMD WebGPU/VAAPI/NPU, Coral USB/PCIe, Apple Neural Engine, NVIDIA) and the hub does not offer it. Reads what the platform probe saw and what the node's inference runtime offers, and answers ok | misconfigured (with fix steps: passthrough, driver, image tag, opt-in) | unsupported (which addon would need extending) | unknown (a read failed). A Coral is never auto-picked: the answer says how to opt in. Read-only.",
-    { nodeId: z33.string().min(1).max(100), expected: ExpectedAcceleratorSchema },
-    async ({ nodeId, expected }) => text14(await supportDiagnoseAccelerator(ctx, { nodeId, expected }))
+    { nodeId: z29.string().min(1).max(100), expected: ExpectedAcceleratorSchema },
+    async ({ nodeId, expected }) => text(await supportDiagnoseAccelerator(ctx, { nodeId, expected }))
   );
   server.tool(
     "support_diagnose_camera",
     "A camera brand or model, or an existing device that fails: which provider addons could serve it (installed, then published), and a verdict use-provider | generic-fallback (ONVIF / RTSP) | unsupported | unknown, with the next steps. Give a brand and/or model, or a deviceId. Read-only.",
     {
-      brand: z33.string().max(100).optional(),
-      model: z33.string().max(100).optional(),
-      deviceId: z33.number().int().optional()
+      brand: z29.string().max(100).optional(),
+      model: z29.string().max(100).optional(),
+      deviceId: z29.number().int().optional()
     },
-    async ({ brand, model, deviceId }) => text14(
+    async ({ brand, model, deviceId }) => text(
       await supportDiagnoseCamera(ctx, {
         ...brand !== void 0 ? { brand } : {},
         ...model !== void 0 ? { model } : {},
@@ -8577,13 +7785,13 @@ function registerSupportTools(server, ctx, deps = defaultSupportDeps) {
     DRAFT_ISSUE_TOOL,
     "Draft a GitHub issue for the public repository that owns the addon (the package's `repository` field; camstack/server when it names none): title, an environment block (server and CLI version, node platform, accelerator or camera facts from the diagnose tools), secrets and private addresses removed. Two steps: the dry run is the full draft and the target; the confirmed call runs YOUR own `gh issue create` (only if `gh auth status` succeeds, otherwise it returns the draft and a ready command). Never uses a token of ours.",
     DraftShape,
-    async (input) => text14(await supportDraftIssue(ctx, deps, draftArgs(input), input.confirm_token))
+    async (input) => text(await supportDraftIssue(ctx, deps, draftArgs(input), input.confirm_token))
   );
   server.tool(
     DRAFT_PR_TOOL,
     'Plan a pull request for the public repository that owns the addon: branch, files to change, steps and the `gh pr create` command, with a scrubbed body. For kind "benchmark" give column and cells from support_benchmark_run. Two steps like every gated tool; it pushes no code and calls no GitHub API, you run the plan with your own git and gh.',
     DraftShape,
-    async (input) => text14(await supportDraftPr(ctx, draftArgs(input), input.confirm_token))
+    async (input) => text(await supportDraftPr(ctx, draftArgs(input), input.confirm_token))
   );
 }