camstack 1.2.47 → 1.2.48

package/dist/{launcher-GJBWLSRW.js → launcher-MNOEQWRN.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-CQs1b7uh.js
-var require_dist_CQs1b7uh = __commonJS({
-  "../system/dist/dist-CQs1b7uh.js"(exports) {
+// ../system/dist/dist-D3lqzV40.js
+var require_dist_D3lqzV40 = __commonJS({
+  "../system/dist/dist-D3lqzV40.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -47109,17 +47109,39 @@ var require_dist_CQs1b7uh = __commonJS({
       latitude: zod.z.number().min(-90).max(90),
       longitude: zod.z.number().min(-180).max(180)
     }).nullable();
+    var TransportPlaneSchema = zod.z.enum([
+      "http",
+      "ws",
+      "mesh",
+      "unknown"
+    ]);
+    var TransportPlaneCountsSchema = zod.z.object({
+      http: zod.z.number(),
+      ws: zod.z.number(),
+      mesh: zod.z.number(),
+      unknown: zod.z.number()
+    });
     var RequestCensusGroupSchema = zod.z.object({
+      plane: TransportPlaneSchema,
       procedure: zod.z.string(),
       userAgent: zod.z.string(),
       ip: zod.z.string(),
       principal: zod.z.string(),
       calls: zod.z.number(),
+      subscriptions: zod.z.number(),
       perMin: zod.z.number()
     });
     var RequestCensusProcedureSchema = zod.z.object({
       procedure: zod.z.string(),
       calls: zod.z.number(),
+      /**
+      * The same total, split by transport. THIS is the row that answers the
+      * question the census exists for: one look at `deviceManager.listAll` says
+      * which plane carried the 4 960, without joining two log lines by eye.
+      */
+      planes: TransportPlaneCountsSchema,
+      /** Subscription STARTS on this procedure. Never folded into `calls`. */
+      subscriptions: zod.z.number(),
       perMin: zod.z.number()
     });
     var RequestCensusStatusSchema = zod.z.object({
@@ -47139,14 +47161,45 @@ var require_dist_CQs1b7uh = __commonJS({
       */
       procedureCalls: zod.z.number(),
       /**
+      * `procedureCalls` split by transport. The four keys sum to
+      * `procedureCalls` by construction - {@link RequestCensusSnapshotSchema}'s
+      * `planesExplainTotal` is that identity, checked rather than assumed.
+      */
+      planes: TransportPlaneCountsSchema,
+      /**
+      * True iff `planes` sums to `procedureCalls`. False means a call was counted
+      * on no plane at all - which is a RESULT (a plane is missing from the
+      * instrument), not a failure, and it has to be visible to be read as one.
+      */
+      planesExplainTotal: zod.z.boolean(),
+      /**
       * tRPC WebSocket connections opened during the window. NOT calls - the WS
-      * transport resolves one context per connection - but the number that says
-      * whether a plane this census cannot see was busy while HTTP was quiet.
+      * adapter resolves one context per connection - kept because a plane's call
+      * count of zero against 37 open connections says something different from a
+      * plane with no connections at all.
       */
       wsConnections: zod.z.number(),
+      /**
+      * Client frames the WS plane looked at. `wsMessages` far above
+      * `planes.ws + subscriptions` means most traffic is not operations
+      * (keepalives, connection params) - which is itself an answer.
+      */
+      wsMessages: zod.z.number(),
+      /**
+      * Subscription STARTS across every plane, excluded from `procedureCalls` on
+      * purpose: one live-events stream opened at boot and held for six hours is
+      * one subscription, and counting it as a call would let a quiet plane
+      * masquerade as the storm.
+      */
+      subscriptions: zod.z.number(),
+      /** `subscription.stop` frames. Starts minus stops is what is still open. */
+      subscriptionStops: zod.z.number(),
       distinctGroups: zod.z.number(),
-      /** Calls counted in the totals whose group attribution was shed at the
-      *  cardinality bound. */
+      /**
+      * Operations counted in the totals whose CALLER attribution was shed at the
+      * cardinality bound. Unrelated to the `unknown` PLANE: these calls know
+      * which transport they arrived on, they just lost their group row.
+      */
       unattributedCalls: zod.z.number(),
       procedures: zod.z.array(RequestCensusProcedureSchema).readonly(),
       groups: zod.z.array(RequestCensusGroupSchema).readonly()
@@ -57677,7 +57730,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CQs1b7uh();
+    var require_dist10 = require_dist_D3lqzV40();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -58496,7 +58549,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CQs1b7uh();
+    var require_dist10 = require_dist_D3lqzV40();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -58590,7 +58643,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CQs1b7uh();
+    var require_dist10 = require_dist_D3lqzV40();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -59487,11 +59540,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-Dvei9nhG.js
-var require_retired_settings_keys_Dvei9nhG = __commonJS({
-  "../system/dist/retired-settings-keys-Dvei9nhG.js"(exports) {
+// ../system/dist/retired-settings-keys-OtUQtEbq.js
+var require_retired_settings_keys_OtUQtEbq = __commonJS({
+  "../system/dist/retired-settings-keys-OtUQtEbq.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_CQs1b7uh();
+    var require_dist10 = require_dist_D3lqzV40();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -61534,8 +61587,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CQs1b7uh();
-    var require_retired_settings_keys = require_retired_settings_keys_Dvei9nhG();
+    var require_dist10 = require_dist_D3lqzV40();
+    var require_retired_settings_keys = require_retired_settings_keys_OtUQtEbq();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -66204,7 +66257,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CQs1b7uh();
+    var require_dist10 = require_dist_D3lqzV40();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -66341,7 +66394,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CQs1b7uh();
+    var require_dist10 = require_dist_D3lqzV40();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -66531,7 +66584,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CQs1b7uh();
+    var require_dist10 = require_dist_D3lqzV40();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -74215,7 +74268,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CQs1b7uh();
+    var require_dist10 = require_dist_D3lqzV40();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -74780,7 +74833,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CQs1b7uh();
+    var require_dist10 = require_dist_D3lqzV40();
     var node_child_process = __require("child_process");
     var node_util = __require("util");
     var node_os = __require("os");
@@ -75722,7 +75775,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CQs1b7uh();
+    var require_dist10 = require_dist_D3lqzV40();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -76838,8 +76891,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CQs1b7uh();
-    var require_retired_settings_keys = require_retired_settings_keys_Dvei9nhG();
+    var require_dist10 = require_dist_D3lqzV40();
+    var require_retired_settings_keys = require_retired_settings_keys_OtUQtEbq();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -79033,7 +79086,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CQs1b7uh();
+    var require_dist10 = require_dist_D3lqzV40();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -80912,7 +80965,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CQs1b7uh();
+    var require_dist10 = require_dist_D3lqzV40();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -98973,7 +99026,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CQs1b7uh();
+    var require_dist10 = require_dist_D3lqzV40();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -122221,7 +122274,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CQs1b7uh();
+    var require_dist10 = require_dist_D3lqzV40();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -201048,13 +201101,22 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       const actions = {};
       for (const { actionName, invoke } of options.actions) actions[actionName] = { handler: async (ctx) => {
         const raw = require_manifest_python_deps.deserializeTypedArrays(ctx.params);
-        return invoke(raw !== null && typeof raw === "object" && Object.keys(raw).length === 0 ? void 0 : raw);
+        return invoke(raw !== null && typeof raw === "object" && Object.keys(raw).length === 0 ? void 0 : raw, readOrigin(ctx));
       } };
       return {
         name: options.serviceName ?? "$core-caps",
         actions
       };
     }
+    function readOrigin(ctx) {
+      return {
+        nodeId: asName(ctx.nodeID),
+        caller: asName(ctx.caller)
+      };
+    }
+    function asName(value) {
+      return typeof value === "string" && value.length > 0 ? value : null;
+    }
     var HubLogForwarder = class {
       broker;
       connected = false;
@@ -227086,17 +227148,39 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       latitude: zod.z.number().min(-90).max(90),
       longitude: zod.z.number().min(-180).max(180)
     }).nullable();
+    var TransportPlaneSchema = zod.z.enum([
+      "http",
+      "ws",
+      "mesh",
+      "unknown"
+    ]);
+    var TransportPlaneCountsSchema = zod.z.object({
+      http: zod.z.number(),
+      ws: zod.z.number(),
+      mesh: zod.z.number(),
+      unknown: zod.z.number()
+    });
     var RequestCensusGroupSchema = zod.z.object({
+      plane: TransportPlaneSchema,
       procedure: zod.z.string(),
       userAgent: zod.z.string(),
       ip: zod.z.string(),
       principal: zod.z.string(),
       calls: zod.z.number(),
+      subscriptions: zod.z.number(),
       perMin: zod.z.number()
     });
     var RequestCensusProcedureSchema = zod.z.object({
       procedure: zod.z.string(),
       calls: zod.z.number(),
+      /**
+      * The same total, split by transport. THIS is the row that answers the
+      * question the census exists for: one look at `deviceManager.listAll` says
+      * which plane carried the 4 960, without joining two log lines by eye.
+      */
+      planes: TransportPlaneCountsSchema,
+      /** Subscription STARTS on this procedure. Never folded into `calls`. */
+      subscriptions: zod.z.number(),
       perMin: zod.z.number()
     });
     var RequestCensusSnapshotSchema = zod.z.object({
@@ -227116,14 +227200,45 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       */
       procedureCalls: zod.z.number(),
       /**
+      * `procedureCalls` split by transport. The four keys sum to
+      * `procedureCalls` by construction - {@link RequestCensusSnapshotSchema}'s
+      * `planesExplainTotal` is that identity, checked rather than assumed.
+      */
+      planes: TransportPlaneCountsSchema,
+      /**
+      * True iff `planes` sums to `procedureCalls`. False means a call was counted
+      * on no plane at all - which is a RESULT (a plane is missing from the
+      * instrument), not a failure, and it has to be visible to be read as one.
+      */
+      planesExplainTotal: zod.z.boolean(),
+      /**
       * tRPC WebSocket connections opened during the window. NOT calls - the WS
-      * transport resolves one context per connection - but the number that says
-      * whether a plane this census cannot see was busy while HTTP was quiet.
+      * adapter resolves one context per connection - kept because a plane's call
+      * count of zero against 37 open connections says something different from a
+      * plane with no connections at all.
       */
       wsConnections: zod.z.number(),
+      /**
+      * Client frames the WS plane looked at. `wsMessages` far above
+      * `planes.ws + subscriptions` means most traffic is not operations
+      * (keepalives, connection params) - which is itself an answer.
+      */
+      wsMessages: zod.z.number(),
+      /**
+      * Subscription STARTS across every plane, excluded from `procedureCalls` on
+      * purpose: one live-events stream opened at boot and held for six hours is
+      * one subscription, and counting it as a call would let a quiet plane
+      * masquerade as the storm.
+      */
+      subscriptions: zod.z.number(),
+      /** `subscription.stop` frames. Starts minus stops is what is still open. */
+      subscriptionStops: zod.z.number(),
       distinctGroups: zod.z.number(),
-      /** Calls counted in the totals whose group attribution was shed at the
-      *  cardinality bound. */
+      /**
+      * Operations counted in the totals whose CALLER attribution was shed at the
+      * cardinality bound. Unrelated to the `unknown` PLANE: these calls know
+      * which transport they arrived on, they just lost their group row.
+      */
       unattributedCalls: zod.z.number(),
       procedures: zod.z.array(RequestCensusProcedureSchema).readonly(),
       groups: zod.z.array(RequestCensusGroupSchema).readonly()
@@ -244160,6 +244275,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.TrackedDetectionSchema = TrackedDetectionSchema;
     exports.TrainingExportDeviceTotalsSchema = TrainingExportDeviceTotalsSchema;
     exports.TrainingExportSummarySchema = TrainingExportSummarySchema;
+    exports.TransportPlaneCountsSchema = TransportPlaneCountsSchema;
+    exports.TransportPlaneSchema = TransportPlaneSchema;
     exports.TurnServerSchema = TurnServerSchema;
     exports.UNIT_TABLE = UNIT_TABLE;
     exports.UnifiedBrokerInfoSchema = BrokerInfoSchema$1;
@@ -277297,6 +277414,90 @@ var require_agent_http_auth = __commonJS({
   }
 });
 
+// ../../server/backend/dist/agent/agent-update-routes.js
+var require_agent_update_routes = __commonJS({
+  "../../server/backend/dist/agent/agent-update-routes.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ADDON_UPDATE_UNAVAILABLE_REASON = exports.SERVER_UPDATE_UNAVAILABLE_REASON = exports.APPLY_ALREADY_RUNNING_MESSAGE = void 0;
+    exports.createAgentServerUpdateControls = createAgentServerUpdateControls;
+    exports.registerAgentUpdateRoutes = registerAgentUpdateRoutes;
+    exports.APPLY_ALREADY_RUNNING_MESSAGE = "Refused: an update is already in flight on this node.";
+    function createAgentServerUpdateControls(engine, onError) {
+      let lastCheckError = null;
+      let lastApply = null;
+      let applyInFlight = false;
+      return {
+        getView: async () => ({
+          status: await engine.getServerPackageStatus(),
+          lastCheckError,
+          lastApply,
+          applyInFlight
+        }),
+        check: async () => {
+          const result = await engine.checkServerUpdate();
+          lastCheckError = result.error;
+          return result;
+        },
+        applyLatest: () => {
+          if (applyInFlight) {
+            return { started: false, message: exports.APPLY_ALREADY_RUNNING_MESSAGE };
+          }
+          applyInFlight = true;
+          lastApply = null;
+          void engine.applyServerUpdate({}).then((result) => {
+            lastApply = result;
+            if (!result.accepted)
+              onError?.(result.message);
+          }).catch((err) => {
+            const message = err instanceof Error ? err.message : String(err);
+            lastApply = {
+              accepted: false,
+              targetVersion: null,
+              restarting: false,
+              message: `Update failed: ${message}`
+            };
+            onError?.(message);
+          }).finally(() => {
+            applyInFlight = false;
+          });
+          return { started: true, message: null };
+        }
+      };
+    }
+    exports.SERVER_UPDATE_UNAVAILABLE_REASON = "Framework updates are not available on this agent build.";
+    exports.ADDON_UPDATE_UNAVAILABLE_REASON = "The addon roster is not available on this agent build.";
+    function registerAgentUpdateRoutes(app, controls) {
+      const server = controls.server;
+      const addons = controls.addons;
+      app.get("/api/agent/server-update", async () => {
+        if (server === void 0) {
+          return { available: false, reason: exports.SERVER_UPDATE_UNAVAILABLE_REASON };
+        }
+        return { available: true, ...await server.getView() };
+      });
+      app.post("/api/agent/server-update/check", async (_req, reply) => {
+        if (server === void 0) {
+          return reply.status(503).send({ error: exports.SERVER_UPDATE_UNAVAILABLE_REASON });
+        }
+        return server.check();
+      });
+      app.post("/api/agent/server-update/apply", async (_req, reply) => {
+        if (server === void 0) {
+          return reply.status(503).send({ error: exports.SERVER_UPDATE_UNAVAILABLE_REASON });
+        }
+        return server.applyLatest();
+      });
+      app.get("/api/agent/addon-updates", async () => {
+        if (addons === void 0) {
+          return { available: false, reason: exports.ADDON_UPDATE_UNAVAILABLE_REASON };
+        }
+        return { available: true, ...await addons.getReport() };
+      });
+    }
+  }
+});
+
 // ../../server/backend/dist/agent/derive-hub-url.js
 var require_derive_hub_url = __commonJS({
   "../../server/backend/dist/agent/derive-hub-url.js"(exports) {
@@ -283473,6 +283674,7 @@ var require_agent_http = __commonJS({
     var path = __importStar(__require("path"));
     var fastify_1 = __importDefault(require_fastify());
     var agent_http_auth_js_1 = require_agent_http_auth();
+    var agent_update_routes_js_1 = require_agent_update_routes();
     var derive_hub_url_js_1 = require_derive_hub_url();
     Object.defineProperty(exports, "pickIpv4", { enumerable: true, get: function() {
       return derive_hub_url_js_1.pickIpv4;
@@ -283720,6 +283922,7 @@ var require_agent_http = __commonJS({
         });
         return { success: true, message: "Agent reconnecting..." };
       });
+      (0, agent_update_routes_js_1.registerAgentUpdateRoutes)(app, config.updateControls ?? {});
       app.get("/api/agent/discovered-nodes", async () => {
         const b = getBroker();
         const nodes = getRegistryNodes(b);
@@ -375651,312 +375854,6 @@ var require_agent_service = __commonJS({
   }
 });
 
-// ../../server/backend/dist/core/server-update/system-ensure-prebuilds.js
-var require_system_ensure_prebuilds = __commonJS({
-  "../../server/backend/dist/core/server-update/system-ensure-prebuilds.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.buildSystemEnsureNativePrebuilds = buildSystemEnsureNativePrebuilds;
-    var system_1 = require_dist3();
-    function buildSystemEnsureNativePrebuilds(logger) {
-      return async (closureDir) => {
-        await (0, system_1.ensureNativePrebuilds)(closureDir, { logger });
-      };
-    }
-  }
-});
-
-// ../../server/backend/dist/core/server-update/system-exec-npm.js
-var require_system_exec_npm = __commonJS({
-  "../../server/backend/dist/core/server-update/system-exec-npm.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.buildSystemExecNpm = buildSystemExecNpm;
-    var system_1 = require_dist3();
-    function buildSystemExecNpm(options, runNpmFn = system_1.runNpm) {
-      return async (args, opts) => {
-        const { stdout } = await runNpmFn(args, {
-          cacheDir: options.cacheDir,
-          registry: options.registry,
-          logger: options.logger,
-          ...opts.cwd !== void 0 ? { cwd: opts.cwd } : {},
-          timeout: opts.timeoutMs
-        });
-        return { stdout };
-      };
-    }
-  }
-});
-
-// ../../server/backend/dist/core/update-availability-emitter.js
-var require_update_availability_emitter = __commonJS({
-  "../../server/backend/dist/core/update-availability-emitter.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.UpdateAvailabilityEmitter = void 0;
-    var types_1 = require_dist4();
-    var UpdateAvailabilityEmitter = class {
-      eventBus;
-      source;
-      store;
-      latestByKey = /* @__PURE__ */ new Map();
-      held = /* @__PURE__ */ new Map();
-      /** Set when in-memory state diverged from what the store last saw. */
-      dirty = false;
-      constructor(eventBus, source, store) {
-        this.eventBus = eventBus;
-        this.source = source;
-        this.store = store;
-        const persisted = store?.load() ?? null;
-        if (persisted === null)
-          return;
-        for (const [key, version] of Object.entries(persisted.latestByKey)) {
-          this.latestByKey.set(key, version);
-        }
-        for (const [key, candidate] of Object.entries(persisted.held)) {
-          this.held.set(key, candidate);
-        }
-      }
-      publishSnapshot(target, candidates, nodeId) {
-        const scope = nodeId ?? "hub";
-        const present = /* @__PURE__ */ new Set();
-        let latestChanged = false;
-        for (const candidate of candidates) {
-          if (candidate.target !== target)
-            continue;
-          const stamped = stampNode(candidate, nodeId);
-          const key = this.key(stamped);
-          present.add(key);
-          if (this.note(stamped))
-            latestChanged = true;
-        }
-        for (const key of [...this.held.keys()]) {
-          if (!key.startsWith(`${target}:${scope}:`))
-            continue;
-          if (present.has(key))
-            continue;
-          this.held.delete(key);
-          this.latestByKey.delete(key);
-          this.dirty = true;
-        }
-        this.persistIfDirty();
-        if (!latestChanged)
-          return;
-        this.emitList(target, scope);
-      }
-      /** Publish a partial candidate set without treating omissions as up-to-date. */
-      publishCandidates(candidates) {
-        const changed = /* @__PURE__ */ new Map();
-        for (const candidate of candidates) {
-          if (!this.note(candidate))
-            continue;
-          const scope = scopeOf(candidate);
-          changed.set(`${candidate.target}:${scope}`, { target: candidate.target, scope });
-        }
-        this.persistIfDirty();
-        for (const { target, scope } of changed.values())
-          this.emitList(target, scope);
-      }
-      note(candidate) {
-        const key = this.key(candidate);
-        const previous = this.latestByKey.get(key);
-        const previousHeld = this.held.get(key);
-        if (previousHeld === void 0 || previousHeld.currentVersion !== candidate.currentVersion || previousHeld.latestVersion !== candidate.latestVersion || previousHeld.nodeId !== candidate.nodeId) {
-          this.dirty = true;
-        }
-        this.held.set(key, candidate);
-        this.latestByKey.set(key, candidate.latestVersion);
-        return previous !== candidate.latestVersion;
-      }
-      /**
-       * Flush to the durable store. Called BEFORE the emit so a crash between the
-       * two costs a duplicate announcement, never a silent one.
-       */
-      persistIfDirty() {
-        if (!this.dirty)
-          return;
-        this.dirty = false;
-        this.store?.save({
-          latestByKey: Object.fromEntries(this.latestByKey),
-          held: Object.fromEntries(this.held)
-        });
-      }
-      /** Announce ONE scope's full list. `scope` is the node id, `hub` for the hub. */
-      emitList(target, scope) {
-        const list = [...this.held.values()].filter((candidate) => candidate.target === target && scopeOf(candidate) === scope);
-        if (list.length === 0)
-          return;
-        const packages = list.map((candidate) => ({
-          packageName: candidate.packageName,
-          currentVersion: candidate.currentVersion,
-          latestVersion: candidate.latestVersion,
-          nodeId: scope
-        }));
-        const head = list[0];
-        this.eventBus.emit({
-          id: `update.available:${target}:${scope}:${packages.map((pkg) => `${pkg.packageName}@${pkg.latestVersion}`).toSorted().join(",")}`,
-          timestamp: /* @__PURE__ */ new Date(),
-          source: this.source,
-          category: types_1.EventCategory.UpdateAvailable,
-          data: {
-            target,
-            packageName: head.packageName,
-            currentVersion: head.currentVersion,
-            latestVersion: head.latestVersion,
-            packages,
-            nodeId: scope,
-            nodeIds: [scope]
-          }
-        });
-      }
-      key(candidate) {
-        return `${candidate.target}:${scopeOf(candidate)}:${candidate.packageName}`;
-      }
-    };
-    exports.UpdateAvailabilityEmitter = UpdateAvailabilityEmitter;
-    function scopeOf(candidate) {
-      return candidate.nodeId ?? "hub";
-    }
-    function stampNode(candidate, nodeId) {
-      if (nodeId === void 0 || candidate.nodeId !== void 0)
-        return candidate;
-      return { ...candidate, nodeId };
-    }
-  }
-});
-
-// ../../server/backend/dist/core/update-availability-store.js
-var require_update_availability_store = __commonJS({
-  "../../server/backend/dist/core/update-availability-store.js"(exports) {
-    "use strict";
-    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      var desc = Object.getOwnPropertyDescriptor(m, k);
-      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m[k];
-        } };
-      }
-      Object.defineProperty(o, k2, desc);
-    }) : (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      o[k2] = m[k];
-    }));
-    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
-      Object.defineProperty(o, "default", { enumerable: true, value: v });
-    }) : function(o, v) {
-      o["default"] = v;
-    });
-    var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
-      var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function(o2) {
-          var ar = [];
-          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
-          return ar;
-        };
-        return ownKeys(o);
-      };
-      return function(mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) {
-          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        }
-        __setModuleDefault(result, mod);
-        return result;
-      };
-    })();
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.FileUpdateAvailabilityStore = exports.UPDATE_AVAILABILITY_DIR = void 0;
-    var fs = __importStar(__require("fs"));
-    var path = __importStar(__require("path"));
-    var types_1 = require_dist4();
-    exports.UPDATE_AVAILABILITY_DIR = "update-availability";
-    var FileUpdateAvailabilityStore = class {
-      scopeId;
-      logger;
-      filePath;
-      constructor(dataDir, scopeId, logger) {
-        this.scopeId = scopeId;
-        this.logger = logger;
-        this.filePath = path.join(dataDir, exports.UPDATE_AVAILABILITY_DIR, `${scopeId}.json`);
-      }
-      load() {
-        try {
-          if (!fs.existsSync(this.filePath))
-            return null;
-          const parsed = JSON.parse(fs.readFileSync(this.filePath, "utf-8"));
-          return parseState(parsed);
-        } catch (error) {
-          this.logger.warn("Update-availability state unreadable; starting from empty", {
-            meta: { scopeId: this.scopeId, path: this.filePath, error: (0, types_1.errMsg)(error) }
-          });
-          return null;
-        }
-      }
-      save(state) {
-        try {
-          fs.mkdirSync(path.dirname(this.filePath), { recursive: true });
-          const tmp = `${this.filePath}.tmp`;
-          fs.writeFileSync(tmp, JSON.stringify(state, null, 2));
-          fs.renameSync(tmp, this.filePath);
-        } catch (error) {
-          this.logger.warn("Failed to persist update-availability state", {
-            meta: { scopeId: this.scopeId, path: this.filePath, error: (0, types_1.errMsg)(error) }
-          });
-        }
-      }
-    };
-    exports.FileUpdateAvailabilityStore = FileUpdateAvailabilityStore;
-    function parseState(raw) {
-      if (raw === null || typeof raw !== "object")
-        return null;
-      const latestRaw = Reflect.get(raw, "latestByKey");
-      const heldRaw = Reflect.get(raw, "held");
-      if (latestRaw === null || typeof latestRaw !== "object")
-        return null;
-      if (heldRaw === null || typeof heldRaw !== "object")
-        return null;
-      const latestByKey = {};
-      for (const [key, value] of Object.entries(latestRaw)) {
-        if (typeof value === "string")
-          latestByKey[key] = value;
-      }
-      const held = {};
-      for (const [key, value] of Object.entries(heldRaw)) {
-        const candidate = parseCandidate(value);
-        if (candidate !== null)
-          held[key] = candidate;
-      }
-      return { latestByKey, held };
-    }
-    function parseCandidate(raw) {
-      if (raw === null || typeof raw !== "object")
-        return null;
-      const target = Reflect.get(raw, "target");
-      const packageName = Reflect.get(raw, "packageName");
-      const currentVersion = Reflect.get(raw, "currentVersion");
-      const latestVersion = Reflect.get(raw, "latestVersion");
-      const nodeId = Reflect.get(raw, "nodeId");
-      if (target !== "addon" && target !== "server")
-        return null;
-      if (typeof packageName !== "string")
-        return null;
-      if (typeof currentVersion !== "string")
-        return null;
-      if (typeof latestVersion !== "string")
-        return null;
-      return {
-        target,
-        packageName,
-        currentVersion,
-        latestVersion,
-        ...typeof nodeId === "string" ? { nodeId } : {}
-      };
-    }
-  }
-});
-
 // ../../server/backend/dist/server-root/index.js
 var require_server_root = __commonJS({
   "../../server/backend/dist/server-root/index.js"(exports, module) {
@@ -377467,6 +377364,441 @@ var require_server_root = __commonJS({
   }
 });
 
+// ../../server/backend/dist/agent/agent-addon-updates.js
+var require_agent_addon_updates = __commonJS({
+  "../../server/backend/dist/agent/agent-addon-updates.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.DEFAULT_NPM_REGISTRY = void 0;
+    exports.readInstalledAddonPackages = readInstalledAddonPackages;
+    exports.buildAddonUpdateEntries = buildAddonUpdateEntries;
+    exports.resolvePublishedVersion = resolvePublishedVersion;
+    exports.buildAgentAddonUpdateReport = buildAgentAddonUpdateReport;
+    var fs = __importStar(__require("fs"));
+    var path = __importStar(__require("path"));
+    var index_js_1 = require_server_root();
+    var addon_scan_js_1 = require_addon_scan();
+    exports.DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org";
+    function readPackageIdentity(dir) {
+      try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf-8"));
+        if (typeof parsed.name !== "string" || parsed.name.length === 0)
+          return null;
+        return {
+          packageName: parsed.name,
+          installedVersion: typeof parsed.version === "string" ? parsed.version : null
+        };
+      } catch {
+        return null;
+      }
+    }
+    function readInstalledAddonPackages(addonsDir) {
+      const found = [];
+      for (const dir of (0, addon_scan_js_1.resolveAddonPackageDirs)(addonsDir)) {
+        const identity = readPackageIdentity(dir);
+        if (identity !== null)
+          found.push(identity);
+      }
+      return found.sort((a, b) => a.packageName.localeCompare(b.packageName));
+    }
+    function buildAddonUpdateEntries(installed, published) {
+      return installed.map((pkg) => {
+        const latest = published.get(pkg.packageName);
+        const latestVersion = latest?.latestVersion ?? null;
+        const updateAvailable = latestVersion !== null && pkg.installedVersion !== null && (0, index_js_1.compareSemver)(latestVersion, pkg.installedVersion) > 0;
+        return {
+          packageName: pkg.packageName,
+          installedVersion: pkg.installedVersion,
+          latestVersion,
+          updateAvailable,
+          error: latest?.error ?? null
+        };
+      });
+    }
+    async function resolvePublishedVersion(packageName, registryUrl, fetchFn) {
+      const base = registryUrl.replace(/\/+$/, "");
+      const url = `${base}/${encodeURIComponent(packageName).replace(/^%40/, "@")}`;
+      try {
+        const res = await fetchFn(url);
+        if (!res.ok)
+          return { latestVersion: null, error: `registry GET \u2192 ${res.status}` };
+        const body = await res.json();
+        const latest = body["dist-tags"]?.["latest"];
+        if (typeof latest !== "string" || latest.length === 0) {
+          return { latestVersion: null, error: "registry returned no dist-tags.latest" };
+        }
+        return { latestVersion: latest, error: null };
+      } catch (err) {
+        return { latestVersion: null, error: err instanceof Error ? err.message : String(err) };
+      }
+    }
+    async function buildAgentAddonUpdateReport(input) {
+      const now = input.now ?? Date.now;
+      const registryUrl = input.registryUrl ?? exports.DEFAULT_NPM_REGISTRY;
+      const installed = readInstalledAddonPackages(input.addonsDir);
+      const published = /* @__PURE__ */ new Map();
+      const resolved = await Promise.all(installed.map(async (pkg) => ({
+        packageName: pkg.packageName,
+        result: await resolvePublishedVersion(pkg.packageName, registryUrl, input.fetchFn)
+      })));
+      for (const r of resolved)
+        published.set(r.packageName, r.result);
+      const entries = buildAddonUpdateEntries(installed, published);
+      const allFailed = entries.length > 0 && entries.every((e) => e.latestVersion === null);
+      const firstError = entries.find((e) => e.error !== null)?.error ?? "registry unreachable";
+      return {
+        entries,
+        checkedAtMs: now(),
+        error: allFailed ? `Could not reach ${registryUrl}: ${firstError}` : null,
+        hubReachable: input.isHubReachable()
+      };
+    }
+  }
+});
+
+// ../../server/backend/dist/core/server-update/system-ensure-prebuilds.js
+var require_system_ensure_prebuilds = __commonJS({
+  "../../server/backend/dist/core/server-update/system-ensure-prebuilds.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.buildSystemEnsureNativePrebuilds = buildSystemEnsureNativePrebuilds;
+    var system_1 = require_dist3();
+    function buildSystemEnsureNativePrebuilds(logger) {
+      return async (closureDir) => {
+        await (0, system_1.ensureNativePrebuilds)(closureDir, { logger });
+      };
+    }
+  }
+});
+
+// ../../server/backend/dist/core/server-update/system-exec-npm.js
+var require_system_exec_npm = __commonJS({
+  "../../server/backend/dist/core/server-update/system-exec-npm.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.buildSystemExecNpm = buildSystemExecNpm;
+    var system_1 = require_dist3();
+    function buildSystemExecNpm(options, runNpmFn = system_1.runNpm) {
+      return async (args, opts) => {
+        const { stdout } = await runNpmFn(args, {
+          cacheDir: options.cacheDir,
+          registry: options.registry,
+          logger: options.logger,
+          ...opts.cwd !== void 0 ? { cwd: opts.cwd } : {},
+          timeout: opts.timeoutMs
+        });
+        return { stdout };
+      };
+    }
+  }
+});
+
+// ../../server/backend/dist/core/update-availability-emitter.js
+var require_update_availability_emitter = __commonJS({
+  "../../server/backend/dist/core/update-availability-emitter.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.UpdateAvailabilityEmitter = void 0;
+    var types_1 = require_dist4();
+    var UpdateAvailabilityEmitter = class {
+      eventBus;
+      source;
+      store;
+      latestByKey = /* @__PURE__ */ new Map();
+      held = /* @__PURE__ */ new Map();
+      /** Set when in-memory state diverged from what the store last saw. */
+      dirty = false;
+      constructor(eventBus, source, store) {
+        this.eventBus = eventBus;
+        this.source = source;
+        this.store = store;
+        const persisted = store?.load() ?? null;
+        if (persisted === null)
+          return;
+        for (const [key, version] of Object.entries(persisted.latestByKey)) {
+          this.latestByKey.set(key, version);
+        }
+        for (const [key, candidate] of Object.entries(persisted.held)) {
+          this.held.set(key, candidate);
+        }
+      }
+      publishSnapshot(target, candidates, nodeId) {
+        const scope = nodeId ?? "hub";
+        const present = /* @__PURE__ */ new Set();
+        let latestChanged = false;
+        for (const candidate of candidates) {
+          if (candidate.target !== target)
+            continue;
+          const stamped = stampNode(candidate, nodeId);
+          const key = this.key(stamped);
+          present.add(key);
+          if (this.note(stamped))
+            latestChanged = true;
+        }
+        for (const key of [...this.held.keys()]) {
+          if (!key.startsWith(`${target}:${scope}:`))
+            continue;
+          if (present.has(key))
+            continue;
+          this.held.delete(key);
+          this.latestByKey.delete(key);
+          this.dirty = true;
+        }
+        this.persistIfDirty();
+        if (!latestChanged)
+          return;
+        this.emitList(target, scope);
+      }
+      /** Publish a partial candidate set without treating omissions as up-to-date. */
+      publishCandidates(candidates) {
+        const changed = /* @__PURE__ */ new Map();
+        for (const candidate of candidates) {
+          if (!this.note(candidate))
+            continue;
+          const scope = scopeOf(candidate);
+          changed.set(`${candidate.target}:${scope}`, { target: candidate.target, scope });
+        }
+        this.persistIfDirty();
+        for (const { target, scope } of changed.values())
+          this.emitList(target, scope);
+      }
+      note(candidate) {
+        const key = this.key(candidate);
+        const previous = this.latestByKey.get(key);
+        const previousHeld = this.held.get(key);
+        if (previousHeld === void 0 || previousHeld.currentVersion !== candidate.currentVersion || previousHeld.latestVersion !== candidate.latestVersion || previousHeld.nodeId !== candidate.nodeId) {
+          this.dirty = true;
+        }
+        this.held.set(key, candidate);
+        this.latestByKey.set(key, candidate.latestVersion);
+        return previous !== candidate.latestVersion;
+      }
+      /**
+       * Flush to the durable store. Called BEFORE the emit so a crash between the
+       * two costs a duplicate announcement, never a silent one.
+       */
+      persistIfDirty() {
+        if (!this.dirty)
+          return;
+        this.dirty = false;
+        this.store?.save({
+          latestByKey: Object.fromEntries(this.latestByKey),
+          held: Object.fromEntries(this.held)
+        });
+      }
+      /** Announce ONE scope's full list. `scope` is the node id, `hub` for the hub. */
+      emitList(target, scope) {
+        const list = [...this.held.values()].filter((candidate) => candidate.target === target && scopeOf(candidate) === scope);
+        if (list.length === 0)
+          return;
+        const packages = list.map((candidate) => ({
+          packageName: candidate.packageName,
+          currentVersion: candidate.currentVersion,
+          latestVersion: candidate.latestVersion,
+          nodeId: scope
+        }));
+        const head = list[0];
+        this.eventBus.emit({
+          id: `update.available:${target}:${scope}:${packages.map((pkg) => `${pkg.packageName}@${pkg.latestVersion}`).toSorted().join(",")}`,
+          timestamp: /* @__PURE__ */ new Date(),
+          source: this.source,
+          category: types_1.EventCategory.UpdateAvailable,
+          data: {
+            target,
+            packageName: head.packageName,
+            currentVersion: head.currentVersion,
+            latestVersion: head.latestVersion,
+            packages,
+            nodeId: scope,
+            nodeIds: [scope]
+          }
+        });
+      }
+      key(candidate) {
+        return `${candidate.target}:${scopeOf(candidate)}:${candidate.packageName}`;
+      }
+    };
+    exports.UpdateAvailabilityEmitter = UpdateAvailabilityEmitter;
+    function scopeOf(candidate) {
+      return candidate.nodeId ?? "hub";
+    }
+    function stampNode(candidate, nodeId) {
+      if (nodeId === void 0 || candidate.nodeId !== void 0)
+        return candidate;
+      return { ...candidate, nodeId };
+    }
+  }
+});
+
+// ../../server/backend/dist/core/update-availability-store.js
+var require_update_availability_store = __commonJS({
+  "../../server/backend/dist/core/update-availability-store.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.FileUpdateAvailabilityStore = exports.UPDATE_AVAILABILITY_DIR = void 0;
+    var fs = __importStar(__require("fs"));
+    var path = __importStar(__require("path"));
+    var types_1 = require_dist4();
+    exports.UPDATE_AVAILABILITY_DIR = "update-availability";
+    var FileUpdateAvailabilityStore = class {
+      scopeId;
+      logger;
+      filePath;
+      constructor(dataDir, scopeId, logger) {
+        this.scopeId = scopeId;
+        this.logger = logger;
+        this.filePath = path.join(dataDir, exports.UPDATE_AVAILABILITY_DIR, `${scopeId}.json`);
+      }
+      load() {
+        try {
+          if (!fs.existsSync(this.filePath))
+            return null;
+          const parsed = JSON.parse(fs.readFileSync(this.filePath, "utf-8"));
+          return parseState(parsed);
+        } catch (error) {
+          this.logger.warn("Update-availability state unreadable; starting from empty", {
+            meta: { scopeId: this.scopeId, path: this.filePath, error: (0, types_1.errMsg)(error) }
+          });
+          return null;
+        }
+      }
+      save(state) {
+        try {
+          fs.mkdirSync(path.dirname(this.filePath), { recursive: true });
+          const tmp = `${this.filePath}.tmp`;
+          fs.writeFileSync(tmp, JSON.stringify(state, null, 2));
+          fs.renameSync(tmp, this.filePath);
+        } catch (error) {
+          this.logger.warn("Failed to persist update-availability state", {
+            meta: { scopeId: this.scopeId, path: this.filePath, error: (0, types_1.errMsg)(error) }
+          });
+        }
+      }
+    };
+    exports.FileUpdateAvailabilityStore = FileUpdateAvailabilityStore;
+    function parseState(raw) {
+      if (raw === null || typeof raw !== "object")
+        return null;
+      const latestRaw = Reflect.get(raw, "latestByKey");
+      const heldRaw = Reflect.get(raw, "held");
+      if (latestRaw === null || typeof latestRaw !== "object")
+        return null;
+      if (heldRaw === null || typeof heldRaw !== "object")
+        return null;
+      const latestByKey = {};
+      for (const [key, value] of Object.entries(latestRaw)) {
+        if (typeof value === "string")
+          latestByKey[key] = value;
+      }
+      const held = {};
+      for (const [key, value] of Object.entries(heldRaw)) {
+        const candidate = parseCandidate(value);
+        if (candidate !== null)
+          held[key] = candidate;
+      }
+      return { latestByKey, held };
+    }
+    function parseCandidate(raw) {
+      if (raw === null || typeof raw !== "object")
+        return null;
+      const target = Reflect.get(raw, "target");
+      const packageName = Reflect.get(raw, "packageName");
+      const currentVersion = Reflect.get(raw, "currentVersion");
+      const latestVersion = Reflect.get(raw, "latestVersion");
+      const nodeId = Reflect.get(raw, "nodeId");
+      if (target !== "addon" && target !== "server")
+        return null;
+      if (typeof packageName !== "string")
+        return null;
+      if (typeof currentVersion !== "string")
+        return null;
+      if (typeof latestVersion !== "string")
+        return null;
+      return {
+        target,
+        packageName,
+        currentVersion,
+        latestVersion,
+        ...typeof nodeId === "string" ? { nodeId } : {}
+      };
+    }
+  }
+});
+
 // ../../server/backend/dist/core/updates/restart-marker.js
 var require_restart_marker = __commonJS({
   "../../server/backend/dist/core/updates/restart-marker.js"(exports) {
@@ -377921,6 +378253,8 @@ var require_main2 = __commonJS({
     var agent_group_runner_js_1 = require_agent_group_runner();
     var agent_http_js_1 = require_agent_http();
     var agent_service_js_1 = require_agent_service();
+    var agent_addon_updates_js_1 = require_agent_addon_updates();
+    var agent_update_routes_js_1 = require_agent_update_routes();
     var agent_update_service_js_1 = require_agent_update_service();
     var derive_hub_url_js_1 = require_derive_hub_url();
     var infra_boot_guard_js_1 = require_infra_boot_guard();
@@ -378329,13 +378663,29 @@ var require_main2 = __commonJS({
         broker.createService((0, system_1.createReadinessServiceForRegistry)(agentReadinessRegistry, system_1.AGENT_READINESS_SERVICE_NAME));
       }
       const getBrokerFn = (() => broker);
+      const updateControls = {
+        server: (0, agent_update_routes_js_1.createAgentServerUpdateControls)(agentUpdateService, (message) => {
+          consoleLogger.warn(`framework update not applied: ${message}`, {
+            tags: { nodeId: config.nodeId }
+          });
+        }),
+        addons: {
+          getReport: () => (0, agent_addon_updates_js_1.buildAgentAddonUpdateReport)({
+            addonsDir: config.addonsDir,
+            ...process.env["CAMSTACK_NPM_REGISTRY"] !== void 0 ? { registryUrl: process.env["CAMSTACK_NPM_REGISTRY"] } : {},
+            fetchFn: (url) => fetch(url),
+            isHubReachable: () => getHubConnectionState() === "connected"
+          })
+        }
+      };
       void (0, agent_http_js_1.startAgentHttpServer)(getBrokerFn, {
         port: config.statusPort ?? 4444,
         nodeId: config.nodeId,
         dataDir: config.dataDir,
         configPath: config.configPath,
         onReconnect: reconnect,
-        getHubConnectionState
+        getHubConnectionState,
+        updateControls
       });
       await bootCoreAddons(broker, config, capabilityRegistry, loadedAddons, loggerFactory);
       for (const dest of capabilityRegistry.getCollection("log-destination")) {
@@ -401027,6 +401377,7 @@ var require_http_request_census = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.HttpRequestCensus = exports.UNKNOWN = exports.PROCEDURE_OVERFLOW = exports.BATCH_OVERFLOW_PROCEDURE = exports.MAX_BATCH_PROCEDURES = exports.USER_AGENT_MAX_CHARS = exports.MAX_PROCEDURES = exports.MAX_GROUPS = exports.MIN_REPORT_EVERY_MS = exports.DEFAULT_REPORT_EVERY_MS = exports.MIN_WINDOW_MS = exports.MAX_WINDOW_MS = exports.TRPC_URL_PREFIX = void 0;
+    exports.zeroPlaneCounts = zeroPlaneCounts;
     exports.shortenUserAgent = shortenUserAgent;
     exports.parseTrpcProcedures = parseTrpcProcedures;
     exports.TRPC_URL_PREFIX = "/trpc/";
@@ -401042,6 +401393,15 @@ var require_http_request_census = __commonJS({
     exports.PROCEDURE_OVERFLOW = "(procedure-overflow)";
     exports.UNKNOWN = "unknown";
     var KEY_SEPARATOR = " | ";
+    function zeroPlaneCounts() {
+      return { http: 0, ws: 0, mesh: 0, unknown: 0 };
+    }
+    function freezePlaneCounts(counts) {
+      return { http: counts.http, ws: counts.ws, mesh: counts.mesh, unknown: counts.unknown };
+    }
+    function sumPlaneCounts(counts) {
+      return counts.http + counts.ws + counts.mesh + counts.unknown;
+    }
     function defaultSchedule(fn, ms) {
       setTimeout(fn, ms).unref();
     }
@@ -401131,7 +401491,11 @@ var require_http_request_census = __commonJS({
       batchedRequests = 0;
       procedureCalls = 0;
       wsConnections = 0;
+      wsMessages = 0;
+      subscriptions = 0;
+      subscriptionStops = 0;
       unattributedCalls = 0;
+      planeCalls = zeroPlaneCounts();
       byProcedure = /* @__PURE__ */ new Map();
       byGroup = /* @__PURE__ */ new Map();
       logger = null;
@@ -401199,38 +401563,85 @@ var require_http_request_census = __commonJS({
         this.httpRequests += 1;
         if (observation.procedures.length > 1)
           this.batchedRequests += 1;
+        this.observe({ ...observation, plane: "http", kind: "call" });
+      }
+      /**
+       * Count operations on ANY plane.
+       *
+       * The plane is data rather than a method name so that a plane added later
+       * cannot quietly reuse the HTTP bookkeeping (`httpRequests`,
+       * `batchedRequests`), which counts REQUESTS and means nothing off HTTP.
+       */
+      observe(observation) {
+        if (!this.isArmed)
+          return;
+        if (observation.procedures.length === 0)
+          return;
         const userAgent = shortenUserAgent(observation.userAgent);
         const ip = observation.ip ?? exports.UNKNOWN;
-        const principal = observation.principal;
+        const { plane, kind, principal } = observation;
         for (const procedure of observation.procedures) {
-          this.procedureCalls += 1;
-          this.countProcedure(procedure);
-          const key = [procedure, userAgent, ip, principal].join(KEY_SEPARATOR);
+          if (kind === "subscription")
+            this.subscriptions += 1;
+          else {
+            this.procedureCalls += 1;
+            this.planeCalls[plane] += 1;
+          }
+          this.countProcedure(procedure, plane, kind);
+          const key = [plane, procedure, userAgent, ip, principal].join(KEY_SEPARATOR);
           const group = this.byGroup.get(key);
           if (group !== void 0) {
-            group.calls += 1;
+            if (kind === "subscription")
+              group.subscriptions += 1;
+            else
+              group.calls += 1;
             continue;
           }
           if (this.byGroup.size >= exports.MAX_GROUPS) {
             this.unattributedCalls += 1;
             continue;
           }
-          this.byGroup.set(key, { procedure, userAgent, ip, principal, calls: 1 });
+          this.byGroup.set(key, {
+            plane,
+            procedure,
+            userAgent,
+            ip,
+            principal,
+            calls: kind === "subscription" ? 0 : 1,
+            subscriptions: kind === "subscription" ? 1 : 0
+          });
         }
       }
       /**
        * Count one tRPC WebSocket connection opening.
        *
-       * Deliberately NOT a call count: the WS adapter resolves one context per
-       * connection, and per-message procedure names never reach this layer. It is
-       * here so a near-zero HTTP total can be read as "the traffic went somewhere
-       * else" rather than as "the instrument was off".
+       * NOT a call count - the WS adapter resolves one context per connection.
+       * Kept alongside the per-operation `ws` plane because "37 connections, 0
+       * calls" and "0 connections, 0 calls" are different answers.
        */
       observeWsConnection() {
         if (!this.isArmed)
           return;
         this.wsConnections += 1;
       }
+      /** Count one client frame the WS plane inspected, operation or not. */
+      observeWsMessage() {
+        if (!this.isArmed)
+          return;
+        this.wsMessages += 1;
+      }
+      /**
+       * Count `subscription.stop` frames.
+       *
+       * Stops carry no procedure path on the wire (tRPC's stop message is `{ id }`
+       * and nothing else), so they are a scalar rather than a group row - inventing
+       * a path for them would put a name on the line that the client never sent.
+       */
+      observeSubscriptionStop(count = 1) {
+        if (!this.isArmed)
+          return;
+        this.subscriptionStops += count;
+      }
       /** Everything the window measured, busiest first. */
       snapshot(limit = exports.MAX_GROUPS) {
         const elapsedMs = this.elapsedMs();
@@ -401238,16 +401649,20 @@ var require_http_request_census = __commonJS({
         const procedures = [...this.byProcedure.entries()].map(([procedure, count]) => ({
           procedure,
           calls: count.calls,
+          planes: freezePlaneCounts(count.planes),
+          subscriptions: count.subscriptions,
           perMin: perMin(count.calls)
         })).toSorted((a, b) => b.calls - a.calls);
         const groups = [...this.byGroup.values()].map((group) => ({
+          plane: group.plane,
           procedure: group.procedure,
           userAgent: group.userAgent,
           ip: group.ip,
           principal: group.principal,
           calls: group.calls,
+          subscriptions: group.subscriptions,
           perMin: perMin(group.calls)
-        })).toSorted((a, b) => b.calls - a.calls);
+        })).toSorted((a, b) => b.calls + b.subscriptions - (a.calls + a.subscriptions));
         return {
           armed: this.isArmed,
           elapsedMs,
@@ -401256,7 +401671,12 @@ var require_http_request_census = __commonJS({
           httpRequests: this.httpRequests,
           batchedRequests: this.batchedRequests,
           procedureCalls: this.procedureCalls,
+          planes: freezePlaneCounts(this.planeCalls),
+          planesExplainTotal: sumPlaneCounts(this.planeCalls) === this.procedureCalls,
           wsConnections: this.wsConnections,
+          wsMessages: this.wsMessages,
+          subscriptions: this.subscriptions,
+          subscriptionStops: this.subscriptionStops,
           distinctGroups: this.byGroup.size,
           unattributedCalls: this.unattributedCalls,
           procedures: procedures.slice(0, limit),
@@ -401264,55 +401684,71 @@ var require_http_request_census = __commonJS({
         };
       }
       /**
-       * Emit ONE aggregated line.
+       * Emit ONE aggregated line - the line that answers the question.
        *
-       * `procedures` comes first because that block is what answers "was it HTTP
-       * at all". `top` is the classification, and it is the part that may be cut.
+       * Field order is the reading order: `planes` first (which transport), then
+       * `planesExplainTotal` (is any call unaccounted for), then `procedures`
+       * (which procedure, split by plane), then `top` (which caller). `top` is the
+       * part that may be cut; the first three never are.
+       *
+       * The message is `transport census` rather than `http request census`
+       * because the line now carries three planes. Grepping Loki for the old text
+       * would find only pre-2026-08-27 windows, which is the honest outcome: those
+       * windows really did measure one plane.
        */
       report(phase) {
         const logger = this.logger;
         if (logger === null)
           return;
         const snap = this.snapshot();
-        logger.info("http request census", {
+        logger.info("transport census", {
           meta: {
             phase,
             armed: snap.armed,
             elapsedMs: snap.elapsedMs,
             windowMs: snap.windowMs,
+            planes: snap.planes,
+            procedureCalls: snap.procedureCalls,
+            // The acceptance criterion, ON the line: false means a call was
+            // counted on no plane, i.e. this instrument is missing one.
+            planesExplainTotal: snap.planesExplainTotal,
+            subscriptions: snap.subscriptions,
+            subscriptionStops: snap.subscriptionStops,
             httpRequests: snap.httpRequests,
             batchedRequests: snap.batchedRequests,
-            procedureCalls: snap.procedureCalls,
             wsConnections: snap.wsConnections,
+            wsMessages: snap.wsMessages,
             distinctGroups: snap.distinctGroups,
             unattributedCalls: snap.unattributedCalls,
             procedures: snap.procedures.slice(0, REPORTED_PROCEDURES),
             top: snap.groups.slice(0, REPORTED_GROUPS).map((group) => ({
+              plane: group.plane,
               procedure: group.procedure,
               ua: group.userAgent,
               ip: group.ip,
               principal: group.principal,
               calls: group.calls,
+              subscriptions: group.subscriptions,
               perMin: group.perMin
             }))
           }
         });
       }
-      countProcedure(procedure) {
+      countProcedure(procedure, plane, kind) {
         const existing = this.byProcedure.get(procedure);
         if (existing !== void 0) {
-          existing.calls += 1;
+          bumpCount(existing, plane, kind);
           return;
         }
         if (this.byProcedure.size >= exports.MAX_PROCEDURES) {
-          const overflow = this.byProcedure.get(exports.PROCEDURE_OVERFLOW);
-          if (overflow === void 0)
-            this.byProcedure.set(exports.PROCEDURE_OVERFLOW, { calls: 1 });
-          else
-            overflow.calls += 1;
+          const overflow = this.byProcedure.get(exports.PROCEDURE_OVERFLOW) ?? newCount();
+          bumpCount(overflow, plane, kind);
+          this.byProcedure.set(exports.PROCEDURE_OVERFLOW, overflow);
           return;
         }
-        this.byProcedure.set(procedure, { calls: 1 });
+        const fresh = newCount();
+        bumpCount(fresh, plane, kind);
+        this.byProcedure.set(procedure, fresh);
       }
       elapsedMs() {
         if (this.armedAt === 0)
@@ -401327,7 +401763,11 @@ var require_http_request_census = __commonJS({
         this.batchedRequests = 0;
         this.procedureCalls = 0;
         this.wsConnections = 0;
+        this.wsMessages = 0;
+        this.subscriptions = 0;
+        this.subscriptionStops = 0;
         this.unattributedCalls = 0;
+        this.planeCalls = zeroPlaneCounts();
       }
       scheduleTick(generation) {
         this.schedule(() => {
@@ -401345,6 +401785,17 @@ var require_http_request_census = __commonJS({
     exports.HttpRequestCensus = HttpRequestCensus;
     var REPORTED_PROCEDURES = 40;
     var REPORTED_GROUPS = 25;
+    function newCount() {
+      return { calls: 0, subscriptions: 0, planes: zeroPlaneCounts() };
+    }
+    function bumpCount(count, plane, kind) {
+      if (kind === "subscription") {
+        count.subscriptions += 1;
+        return;
+      }
+      count.calls += 1;
+      count.planes[plane] += 1;
+    }
     function clamp(value, min, max) {
       if (!Number.isFinite(value))
         return min;
@@ -401673,7 +402124,7 @@ var require_request_census_settings = __commonJS({
           updatedAt: this.now()
         };
         const persisted = await this.write(record);
-        this.logger?.info("http request census switched", {
+        this.logger?.info("transport census switched", {
           meta: {
             armed: this.census.armed,
             armedUntilMs: this.census.armedUntilMs,
@@ -401698,13 +402149,13 @@ var require_request_census_settings = __commonJS({
           return false;
         const remainingMs = until - this.now();
         if (remainingMs <= 0) {
-          this.logger?.info("http request census not restored - window already expired", {
+          this.logger?.info("transport census not restored - window already expired", {
             meta: { armedUntilMs: until }
           });
           return false;
         }
         this.census.arm(remainingMs, record?.reportEveryMs ?? http_request_census_js_1.DEFAULT_REPORT_EVERY_MS);
-        this.logger?.info("http request census restored from system-settings", {
+        this.logger?.info("transport census restored from system-settings", {
           meta: { remainingMs, armedUntilMs: this.census.armedUntilMs }
         });
         return true;
@@ -401722,7 +402173,7 @@ var require_request_census_settings = __commonJS({
           });
           return toRecord(raw);
         } catch (err) {
-          this.logger?.warn("http request census settings read failed", {
+          this.logger?.warn("transport census settings read failed", {
             meta: { error: (0, types_1.errMsg)(err) }
           });
           return null;
@@ -401737,7 +402188,7 @@ var require_request_census_settings = __commonJS({
           });
           return true;
         } catch (err) {
-          this.logger?.warn("http request census armed in memory but NOT persisted - it will not survive a restart", { meta: { error: (0, types_1.errMsg)(err) } });
+          this.logger?.warn("transport census armed in memory but NOT persisted - it will not survive a restart", { meta: { error: (0, types_1.errMsg)(err) } });
           return false;
         }
       }
@@ -403305,6 +403756,499 @@ var require_cap_providers = __commonJS({
   }
 });
 
+// ../../server/backend/dist/core/auth/share-token.service.js
+var require_share_token_service = __commonJS({
+  "../../server/backend/dist/core/auth/share-token.service.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ShareTokenService = exports.ShareTokenRecordSchema = exports.ShareTokenScopeSchema = exports.SHARE_TOKEN_MAX_DEVICES = exports.SHARE_TOKEN_TTL_DEFAULT_SEC = exports.SHARE_TOKEN_TTL_MAX_SEC = exports.SHARE_TOKEN_TTL_MIN_SEC = exports.SHARE_TOKEN_PREFIX = void 0;
+    var crypto2 = __importStar(__require("crypto"));
+    var zod_1 = require_zod();
+    var SHARE_TOKENS_COLLECTION = "share_view_tokens";
+    var SHARE_TOKENS_INDEXES = [
+      { name: "idx_share_view_tokens_hash", columns: ["tokenHash"] },
+      { name: "idx_share_view_tokens_user", columns: ["userId"] }
+    ];
+    exports.SHARE_TOKEN_PREFIX = "csv_";
+    exports.SHARE_TOKEN_TTL_MIN_SEC = 60;
+    exports.SHARE_TOKEN_TTL_MAX_SEC = 30 * 24 * 60 * 60;
+    exports.SHARE_TOKEN_TTL_DEFAULT_SEC = 7 * 24 * 60 * 60;
+    exports.SHARE_TOKEN_MAX_DEVICES = 64;
+    exports.ShareTokenScopeSchema = zod_1.z.object({
+      kind: zod_1.z.enum(["grid-view", "events-view"]),
+      deviceIds: zod_1.z.array(zod_1.z.number().int().nonnegative()).min(1).max(exports.SHARE_TOKEN_MAX_DEVICES)
+    });
+    exports.ShareTokenRecordSchema = zod_1.z.object({
+      id: zod_1.z.string(),
+      /** The user that minted the share link (owner — may revoke it). */
+      userId: zod_1.z.string(),
+      tokenHash: zod_1.z.string(),
+      /** First 12 chars of the raw token — display/audit label only. */
+      tokenPrefix: zod_1.z.string(),
+      scope: exports.ShareTokenScopeSchema,
+      createdAt: zod_1.z.number(),
+      /** Epoch ms — or `null` for a never-expiring token (explicit choice at mint). */
+      expiresAt: zod_1.z.number().nullable(),
+      lastUsedAt: zod_1.z.number().optional()
+    });
+    function parseShareToken(data) {
+      const parsed = exports.ShareTokenRecordSchema.safeParse(data);
+      return parsed.success ? parsed.data : null;
+    }
+    var ShareTokenService = class {
+      getStore;
+      logger;
+      /**
+       * Declaration is one-time per process; reset only if the backend itself
+       * is swapped (it never is at runtime — the getter is lazy solely because
+       * the sqlite builtin registers after this service is constructed).
+       */
+      collectionDeclared = false;
+      constructor(getStore, logger = null) {
+        this.getStore = getStore;
+        this.logger = logger;
+      }
+      /**
+       * Resolve the backend AND ensure `share_view_tokens` is declared before
+       * the first operation. The structured settings backend fail-closes on
+       * undeclared collections; this KV shape (`id` PK + `data` TEXT) is
+       * byte-identical to what the legacy on-demand path created, so existing
+       * rows keep working with no migration.
+       */
+      async store() {
+        const store = this.getStore();
+        if (!store) {
+          throw new Error("Share tokens unavailable \u2014 settings backend not ready");
+        }
+        if (!this.collectionDeclared) {
+          await store.declareCollection({
+            collection: SHARE_TOKENS_COLLECTION,
+            columns: [
+              { name: "id", type: "TEXT", primaryKey: true, notNull: true },
+              { name: "data", type: "TEXT", notNull: true }
+            ],
+            indexes: SHARE_TOKENS_INDEXES
+          });
+          this.collectionDeclared = true;
+        }
+        return store;
+      }
+      /**
+       * Mint a new share token. Throws on invalid scope or out-of-bounds TTL
+       * (fail fast — the router's Zod input schema should have caught both).
+       * `ttlSec: 'never'` is the explicit opt-in to a never-expiring token
+       * (`expiresAt: null`); omitted falls back to the 7-day default.
+       * Returns the RAW token exactly once; only its hash is persisted.
+       */
+      async create(input) {
+        const scope = exports.ShareTokenScopeSchema.parse(input.scope);
+        const ttlSec = input.ttlSec ?? exports.SHARE_TOKEN_TTL_DEFAULT_SEC;
+        if (ttlSec !== "never" && (!Number.isInteger(ttlSec) || ttlSec < exports.SHARE_TOKEN_TTL_MIN_SEC || ttlSec > exports.SHARE_TOKEN_TTL_MAX_SEC)) {
+          throw new Error(`Share token TTL out of bounds \u2014 got ${ttlSec}s, allowed [${exports.SHARE_TOKEN_TTL_MIN_SEC}s, ${exports.SHARE_TOKEN_TTL_MAX_SEC}s] or 'never'`);
+        }
+        const rawToken = `${exports.SHARE_TOKEN_PREFIX}${crypto2.randomBytes(32).toString("hex")}`;
+        const now = Date.now();
+        const record = {
+          id: crypto2.randomUUID(),
+          userId: input.userId,
+          tokenHash: crypto2.createHash("sha256").update(rawToken).digest("hex"),
+          tokenPrefix: rawToken.slice(0, 12),
+          scope,
+          createdAt: now,
+          expiresAt: ttlSec === "never" ? null : now + ttlSec * 1e3
+        };
+        await (await this.store()).insert({
+          collection: SHARE_TOKENS_COLLECTION,
+          record: { id: record.id, data: { ...record } }
+        });
+        this.logger?.info("Share token minted", {
+          meta: {
+            id: record.id,
+            userId: record.userId,
+            kind: scope.kind,
+            deviceIds: scope.deviceIds,
+            expiresAt: record.expiresAt
+          }
+        });
+        return { token: rawToken, record };
+      }
+      /**
+       * Resolve a raw `csv_*` token to its record. Returns `null` for:
+       * wrong prefix, unknown token, corrupt record, or expired token.
+       * Never throws on bad input — the auth boundary treats `null` as 401.
+       */
+      async validate(rawToken) {
+        if (!rawToken.startsWith(exports.SHARE_TOKEN_PREFIX))
+          return null;
+        const tokenHash = crypto2.createHash("sha256").update(rawToken).digest("hex");
+        const results = await (await this.store()).query({
+          collection: SHARE_TOKENS_COLLECTION,
+          filter: { where: { tokenHash } }
+        });
+        const first = results[0];
+        if (!first)
+          return null;
+        const record = parseShareToken(first.data);
+        if (!record)
+          return null;
+        if (record.expiresAt !== null && Date.now() > record.expiresAt)
+          return null;
+        this.touchLastUsed(record).catch(() => {
+        });
+        return record;
+      }
+      /**
+       * Revoke (delete) a share token. Only the minting user or an admin may
+       * revoke. Returns `false` when the token doesn't exist; throws on a
+       * permission mismatch so the router surfaces a FORBIDDEN.
+       */
+      async revoke(input) {
+        const results = await (await this.store()).query({
+          collection: SHARE_TOKENS_COLLECTION,
+          filter: { where: { id: input.id } }
+        });
+        const first = results[0];
+        if (!first)
+          return false;
+        const record = parseShareToken(first.data);
+        if (!record) {
+          await (await this.store()).delete({ collection: SHARE_TOKENS_COLLECTION, key: input.id });
+          return true;
+        }
+        if (!input.callerIsAdmin && record.userId !== input.callerUserId) {
+          throw new Error("Only the token owner or an admin can revoke a share token");
+        }
+        await (await this.store()).delete({ collection: SHARE_TOKENS_COLLECTION, key: input.id });
+        this.logger?.info("Share token revoked", {
+          meta: { id: record.id, byUserId: input.callerUserId }
+        });
+        return true;
+      }
+      /** Every share token minted by `userId`, expired ones included. */
+      async listForUser(userId) {
+        const results = await (await this.store()).query({
+          collection: SHARE_TOKENS_COLLECTION,
+          filter: { where: { userId } }
+        });
+        return results.map((r) => parseShareToken(r.data)).filter((r) => r !== null);
+      }
+      /** All share tokens (admin listing). */
+      async listAll() {
+        const results = await (await this.store()).query({
+          collection: SHARE_TOKENS_COLLECTION,
+          filter: {}
+        });
+        return results.map((r) => parseShareToken(r.data)).filter((r) => r !== null);
+      }
+      async touchLastUsed(record) {
+        await (await this.store()).update({
+          collection: SHARE_TOKENS_COLLECTION,
+          id: record.id,
+          data: { ...record, lastUsedAt: Date.now() }
+        });
+      }
+    };
+    exports.ShareTokenService = ShareTokenService;
+  }
+});
+
+// ../../server/backend/dist/api/trpc/trpc-error-principal.js
+var require_trpc_error_principal = __commonJS({
+  "../../server/backend/dist/api/trpc/trpc-error-principal.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.readCredentialIdentity = readCredentialIdentity;
+    exports.describeTrpcPrincipal = describeTrpcPrincipal;
+    function readCredentialIdentity(claims) {
+      const kind = Reflect.get(claims, "kind");
+      if (kind !== "sso-bridge")
+        return {};
+      const provider = Reflect.get(claims, "provider");
+      const sessionId = Reflect.get(claims, "sessionId");
+      return {
+        ...typeof provider === "string" && provider !== "" ? { credential: provider } : {},
+        ...typeof sessionId === "string" && sessionId !== "" ? { sessionId } : {}
+      };
+    }
+    function describeTrpcPrincipal(user) {
+      if (!user)
+        return "anonymous";
+      const name = user.username || user.id || "unknown";
+      if (user.shareView)
+        return `${name} (share-view)`;
+      if (user.isAdmin)
+        return `${name} (admin)`;
+      if (user.credential) {
+        const session = user.oauthSessionId ? ` session=${user.oauthSessionId}` : "";
+        return `${name} (${user.credential}${session})`;
+      }
+      if (user.isScoped)
+        return `${name} (scoped-token)`;
+      return `${name} (session)`;
+    }
+  }
+});
+
+// ../../server/backend/dist/api/trpc/trpc.context.js
+var require_trpc_context = __commonJS({
+  "../../server/backend/dist/api/trpc/trpc.context.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.createMeshTrpcContext = createMeshTrpcContext;
+    exports.createTrpcContext = createTrpcContext;
+    exports.createWsTrpcContext = createWsTrpcContext;
+    var types_1 = require_dist4();
+    var share_token_service_js_1 = require_share_token_service();
+    var trpc_error_principal_js_1 = require_trpc_error_principal();
+    var SCOPE_REFRESH_TTL_MS = 3e4;
+    var SCOPE_REFRESH_MISS_TTL_MS = 5e3;
+    var liveScopeMemo = /* @__PURE__ */ new Map();
+    async function refreshScopesFromStore(userId, addonRegistry) {
+      const cached = liveScopeMemo.get(userId);
+      const now = Date.now();
+      if (cached && now - cached.at < (cached.scopes === null ? SCOPE_REFRESH_MISS_TTL_MS : SCOPE_REFRESH_TTL_MS)) {
+        return cached.scopes;
+      }
+      let scopes = null;
+      try {
+        const userMgmt = addonRegistry.getCapabilityRegistry().getSingleton("user-management");
+        const fresh = typeof userMgmt?.listUsers === "function" ? (await userMgmt.listUsers()).find((u) => u.id === userId) : null;
+        if (fresh)
+          scopes = (0, types_1.normalizeTokenScopes)(fresh.scopes ?? []);
+      } catch {
+        scopes = null;
+      }
+      liveScopeMemo.set(userId, { at: now, scopes });
+      if (liveScopeMemo.size > 512) {
+        for (const [key, entry] of liveScopeMemo) {
+          if (now - entry.at > SCOPE_REFRESH_TTL_MS * 4)
+            liveScopeMemo.delete(key);
+        }
+      }
+      return scopes;
+    }
+    function readQuery(req) {
+      if (!("query" in req))
+        return null;
+      const q = Reflect.get(req, "query");
+      if (q === null || typeof q !== "object" || Array.isArray(q))
+        return null;
+      return { ...q };
+    }
+    function extractTokenFromRequest(req) {
+      const authHeader = req.headers.authorization;
+      if (authHeader && typeof authHeader === "string") {
+        const [scheme, token2] = authHeader.split(" ");
+        if (scheme === "Bearer" && token2)
+          return token2;
+      }
+      const q = readQuery(req);
+      if (q && typeof q.token === "string") {
+        return q.token;
+      }
+      const url = req.url;
+      if (url) {
+        const qIdx = url.indexOf("?");
+        if (qIdx !== -1) {
+          const t = new URLSearchParams(url.slice(qIdx + 1)).get("token");
+          if (t)
+            return t;
+        }
+      }
+      return null;
+    }
+    async function resolveUser(token2, authService, addonRegistry, shareTokens = null, logger = null) {
+      if (!token2)
+        return null;
+      if (token2.startsWith(share_token_service_js_1.SHARE_TOKEN_PREFIX)) {
+        if (!shareTokens)
+          return null;
+        try {
+          const record = await shareTokens.validate(token2);
+          if (!record)
+            return null;
+          return {
+            id: record.userId,
+            // Display label — `share:<prefix>` keeps audit logs readable
+            // without exposing the token hash.
+            username: `share:${record.tokenPrefix}`,
+            isAdmin: false,
+            permissions: {
+              isAdmin: false,
+              allowedProviders: "*",
+              allowedDevices: {}
+            },
+            isApiKey: true,
+            shareView: { tokenId: record.id, scope: record.scope }
+          };
+        } catch {
+          return null;
+        }
+      }
+      if (token2.startsWith("cst_")) {
+        try {
+          const userMgmt = addonRegistry.getCapabilityRegistry().getSingleton("user-management");
+          if (!userMgmt)
+            return null;
+          const record = await userMgmt.validateScopedToken({ token: token2 });
+          if (!record)
+            return null;
+          return {
+            id: record.userId,
+            // Display label — `scoped:<prefix>` makes audit logs read
+            // naturally without exposing the token hash.
+            username: `scoped:${record.tokenPrefix}`,
+            isAdmin: false,
+            permissions: {
+              isAdmin: false,
+              allowedProviders: "*",
+              allowedDevices: {}
+            },
+            isApiKey: true,
+            isScoped: true,
+            // Migrate any v2 `device:targets` grant to a v3 selector at the
+            // boundary so the enforcement matcher only ever sees v3.
+            scopes: (0, types_1.normalizeTokenScopes)(record.scopes)
+          };
+        } catch {
+          return null;
+        }
+      }
+      try {
+        const payload = authService.verifyToken(token2);
+        if (typeof payload.isAdmin !== "boolean") {
+          return null;
+        }
+        const principal = (0, types_1.classifyBearerPrincipal)(payload);
+        if (principal.kind === "not-a-credential") {
+          logger?.warn("trpc: refused a bearer that is not an API credential", {
+            meta: { reason: principal.reason, userId: payload.userId ?? payload.keyId ?? "unknown" }
+          });
+          return null;
+        }
+        const credential = (0, trpc_error_principal_js_1.readCredentialIdentity)(payload);
+        return {
+          id: payload.userId ?? payload.keyId ?? "unknown",
+          username: payload.username ?? "unknown",
+          isAdmin: payload.isAdmin,
+          permissions: {
+            isAdmin: payload.isAdmin,
+            allowedProviders: payload.allowedProviders,
+            allowedDevices: payload.allowedDevices
+          },
+          isApiKey: payload.type === "api_key",
+          agentId: payload.agentId,
+          // Scopes are baked into the JWT at login; the middleware uses
+          // them to gate every call until the user re-logs. Normalised at the
+          // boundary — a v2 `device:targets` JWT (issued before the v3 model)
+          // migrates to a selector here, so a pre-v3 token keeps working.
+          //
+          // …but a login-time snapshot is exactly the bug: an admin editing a
+          // user's scopes expects the change to APPLY, and the live session
+          // kept gating on the old set until re-login (2026-08-15: a user
+          // granted the whole fleet kept seeing zero cameras). For non-admin
+          // SESSION principals the store's current scopes win when readable
+          // (memoized — see above); the JWT's copy is the fallback when the
+          // user-management cap is unreachable, so a store hiccup never
+          // locks anybody out mid-request.
+          //
+          // `session` ONLY, and that word is the whole fix. An ACCOUNT-LINK token
+          // is governed by the grant the operator consented to, not by the linking
+          // user's record: it always carries `isAdmin: false` (`oauth-grants.ts`
+          // → `baseClaims`) and its owner is normally an admin, whose record is
+          // deliberately unscoped — so the refresh replaced a six-scope Home
+          // Assistant grant with `[]` and the hub refused the component's first
+          // call with `Have: (none)` (2026-08-19). The user store knows nothing
+          // about a link and must not get a vote on one.
+          ...payload.scopes !== void 0 ? { scopes: (0, types_1.normalizeTokenScopes)(payload.scopes) } : {},
+          ...!payload.isAdmin && principal.kind === "session" ? await (async () => {
+            const fresh = await refreshScopesFromStore(payload.userId ?? payload.keyId ?? "unknown", addonRegistry);
+            return fresh !== null ? { scopes: fresh } : {};
+          })() : {},
+          ...credential.credential !== void 0 ? { credential: credential.credential } : {},
+          ...credential.sessionId !== void 0 ? { oauthSessionId: credential.sessionId } : {}
+        };
+      } catch {
+        return null;
+      }
+    }
+    function makeDeviceScopeLookup(addonRegistry) {
+      return {
+        getAncestors: (deviceId) => addonRegistry.getPersistedAncestors(deviceId),
+        getType: (deviceId) => addonRegistry.getPersistedType(deviceId),
+        getLocation: (deviceId) => addonRegistry.getPersistedLocation(deviceId)
+      };
+    }
+    function createMeshTrpcContext() {
+      const user = {
+        id: "mesh",
+        username: "mesh",
+        isAdmin: true,
+        permissions: { isAdmin: true, allowedProviders: "*", allowedDevices: {} },
+        isApiKey: true
+      };
+      return { user };
+    }
+    async function createTrpcContext(req, authService, addonRegistry, shareTokens = null, logger = null) {
+      const token2 = extractTokenFromRequest(req);
+      return {
+        user: await resolveUser(token2, authService, addonRegistry, shareTokens, logger),
+        req,
+        deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
+        deviceFleet: () => addonRegistry.getPersistedDeviceList()
+      };
+    }
+    async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null, logger = null) {
+      const paramToken = opts.info.connectionParams?.["token"];
+      const token2 = (typeof paramToken === "string" ? paramToken : null) ?? extractTokenFromRequest(opts.req);
+      const user = await resolveUser(token2, authService, addonRegistry, shareTokens, logger);
+      return {
+        user,
+        req: opts.req,
+        deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
+        deviceFleet: () => addonRegistry.getPersistedDeviceList()
+      };
+    }
+  }
+});
+
 // ../../node_modules/superjson/dist/double-indexed-kv.js
 var DoubleIndexedKV;
 var init_double_indexed_kv = __esm({
@@ -404812,509 +405756,18 @@ var require_trpc_middleware = __commonJS({
   }
 });
 
-// ../../server/backend/dist/core/auth/share-token.service.js
-var require_share_token_service = __commonJS({
-  "../../server/backend/dist/core/auth/share-token.service.js"(exports) {
-    "use strict";
-    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      var desc = Object.getOwnPropertyDescriptor(m, k);
-      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m[k];
-        } };
-      }
-      Object.defineProperty(o, k2, desc);
-    }) : (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      o[k2] = m[k];
-    }));
-    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
-      Object.defineProperty(o, "default", { enumerable: true, value: v });
-    }) : function(o, v) {
-      o["default"] = v;
-    });
-    var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
-      var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function(o2) {
-          var ar = [];
-          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
-          return ar;
-        };
-        return ownKeys(o);
-      };
-      return function(mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) {
-          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        }
-        __setModuleDefault(result, mod);
-        return result;
-      };
-    })();
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.ShareTokenService = exports.ShareTokenRecordSchema = exports.ShareTokenScopeSchema = exports.SHARE_TOKEN_MAX_DEVICES = exports.SHARE_TOKEN_TTL_DEFAULT_SEC = exports.SHARE_TOKEN_TTL_MAX_SEC = exports.SHARE_TOKEN_TTL_MIN_SEC = exports.SHARE_TOKEN_PREFIX = void 0;
-    var crypto2 = __importStar(__require("crypto"));
-    var zod_1 = require_zod();
-    var SHARE_TOKENS_COLLECTION = "share_view_tokens";
-    var SHARE_TOKENS_INDEXES = [
-      { name: "idx_share_view_tokens_hash", columns: ["tokenHash"] },
-      { name: "idx_share_view_tokens_user", columns: ["userId"] }
-    ];
-    exports.SHARE_TOKEN_PREFIX = "csv_";
-    exports.SHARE_TOKEN_TTL_MIN_SEC = 60;
-    exports.SHARE_TOKEN_TTL_MAX_SEC = 30 * 24 * 60 * 60;
-    exports.SHARE_TOKEN_TTL_DEFAULT_SEC = 7 * 24 * 60 * 60;
-    exports.SHARE_TOKEN_MAX_DEVICES = 64;
-    exports.ShareTokenScopeSchema = zod_1.z.object({
-      kind: zod_1.z.enum(["grid-view", "events-view"]),
-      deviceIds: zod_1.z.array(zod_1.z.number().int().nonnegative()).min(1).max(exports.SHARE_TOKEN_MAX_DEVICES)
-    });
-    exports.ShareTokenRecordSchema = zod_1.z.object({
-      id: zod_1.z.string(),
-      /** The user that minted the share link (owner — may revoke it). */
-      userId: zod_1.z.string(),
-      tokenHash: zod_1.z.string(),
-      /** First 12 chars of the raw token — display/audit label only. */
-      tokenPrefix: zod_1.z.string(),
-      scope: exports.ShareTokenScopeSchema,
-      createdAt: zod_1.z.number(),
-      /** Epoch ms — or `null` for a never-expiring token (explicit choice at mint). */
-      expiresAt: zod_1.z.number().nullable(),
-      lastUsedAt: zod_1.z.number().optional()
-    });
-    function parseShareToken(data) {
-      const parsed = exports.ShareTokenRecordSchema.safeParse(data);
-      return parsed.success ? parsed.data : null;
-    }
-    var ShareTokenService = class {
-      getStore;
-      logger;
-      /**
-       * Declaration is one-time per process; reset only if the backend itself
-       * is swapped (it never is at runtime — the getter is lazy solely because
-       * the sqlite builtin registers after this service is constructed).
-       */
-      collectionDeclared = false;
-      constructor(getStore, logger = null) {
-        this.getStore = getStore;
-        this.logger = logger;
-      }
-      /**
-       * Resolve the backend AND ensure `share_view_tokens` is declared before
-       * the first operation. The structured settings backend fail-closes on
-       * undeclared collections; this KV shape (`id` PK + `data` TEXT) is
-       * byte-identical to what the legacy on-demand path created, so existing
-       * rows keep working with no migration.
-       */
-      async store() {
-        const store = this.getStore();
-        if (!store) {
-          throw new Error("Share tokens unavailable \u2014 settings backend not ready");
-        }
-        if (!this.collectionDeclared) {
-          await store.declareCollection({
-            collection: SHARE_TOKENS_COLLECTION,
-            columns: [
-              { name: "id", type: "TEXT", primaryKey: true, notNull: true },
-              { name: "data", type: "TEXT", notNull: true }
-            ],
-            indexes: SHARE_TOKENS_INDEXES
-          });
-          this.collectionDeclared = true;
-        }
-        return store;
-      }
-      /**
-       * Mint a new share token. Throws on invalid scope or out-of-bounds TTL
-       * (fail fast — the router's Zod input schema should have caught both).
-       * `ttlSec: 'never'` is the explicit opt-in to a never-expiring token
-       * (`expiresAt: null`); omitted falls back to the 7-day default.
-       * Returns the RAW token exactly once; only its hash is persisted.
-       */
-      async create(input) {
-        const scope = exports.ShareTokenScopeSchema.parse(input.scope);
-        const ttlSec = input.ttlSec ?? exports.SHARE_TOKEN_TTL_DEFAULT_SEC;
-        if (ttlSec !== "never" && (!Number.isInteger(ttlSec) || ttlSec < exports.SHARE_TOKEN_TTL_MIN_SEC || ttlSec > exports.SHARE_TOKEN_TTL_MAX_SEC)) {
-          throw new Error(`Share token TTL out of bounds \u2014 got ${ttlSec}s, allowed [${exports.SHARE_TOKEN_TTL_MIN_SEC}s, ${exports.SHARE_TOKEN_TTL_MAX_SEC}s] or 'never'`);
-        }
-        const rawToken = `${exports.SHARE_TOKEN_PREFIX}${crypto2.randomBytes(32).toString("hex")}`;
-        const now = Date.now();
-        const record = {
-          id: crypto2.randomUUID(),
-          userId: input.userId,
-          tokenHash: crypto2.createHash("sha256").update(rawToken).digest("hex"),
-          tokenPrefix: rawToken.slice(0, 12),
-          scope,
-          createdAt: now,
-          expiresAt: ttlSec === "never" ? null : now + ttlSec * 1e3
-        };
-        await (await this.store()).insert({
-          collection: SHARE_TOKENS_COLLECTION,
-          record: { id: record.id, data: { ...record } }
-        });
-        this.logger?.info("Share token minted", {
-          meta: {
-            id: record.id,
-            userId: record.userId,
-            kind: scope.kind,
-            deviceIds: scope.deviceIds,
-            expiresAt: record.expiresAt
-          }
-        });
-        return { token: rawToken, record };
-      }
-      /**
-       * Resolve a raw `csv_*` token to its record. Returns `null` for:
-       * wrong prefix, unknown token, corrupt record, or expired token.
-       * Never throws on bad input — the auth boundary treats `null` as 401.
-       */
-      async validate(rawToken) {
-        if (!rawToken.startsWith(exports.SHARE_TOKEN_PREFIX))
-          return null;
-        const tokenHash = crypto2.createHash("sha256").update(rawToken).digest("hex");
-        const results = await (await this.store()).query({
-          collection: SHARE_TOKENS_COLLECTION,
-          filter: { where: { tokenHash } }
-        });
-        const first = results[0];
-        if (!first)
-          return null;
-        const record = parseShareToken(first.data);
-        if (!record)
-          return null;
-        if (record.expiresAt !== null && Date.now() > record.expiresAt)
-          return null;
-        this.touchLastUsed(record).catch(() => {
-        });
-        return record;
-      }
-      /**
-       * Revoke (delete) a share token. Only the minting user or an admin may
-       * revoke. Returns `false` when the token doesn't exist; throws on a
-       * permission mismatch so the router surfaces a FORBIDDEN.
-       */
-      async revoke(input) {
-        const results = await (await this.store()).query({
-          collection: SHARE_TOKENS_COLLECTION,
-          filter: { where: { id: input.id } }
-        });
-        const first = results[0];
-        if (!first)
-          return false;
-        const record = parseShareToken(first.data);
-        if (!record) {
-          await (await this.store()).delete({ collection: SHARE_TOKENS_COLLECTION, key: input.id });
-          return true;
-        }
-        if (!input.callerIsAdmin && record.userId !== input.callerUserId) {
-          throw new Error("Only the token owner or an admin can revoke a share token");
-        }
-        await (await this.store()).delete({ collection: SHARE_TOKENS_COLLECTION, key: input.id });
-        this.logger?.info("Share token revoked", {
-          meta: { id: record.id, byUserId: input.callerUserId }
-        });
-        return true;
-      }
-      /** Every share token minted by `userId`, expired ones included. */
-      async listForUser(userId) {
-        const results = await (await this.store()).query({
-          collection: SHARE_TOKENS_COLLECTION,
-          filter: { where: { userId } }
-        });
-        return results.map((r) => parseShareToken(r.data)).filter((r) => r !== null);
-      }
-      /** All share tokens (admin listing). */
-      async listAll() {
-        const results = await (await this.store()).query({
-          collection: SHARE_TOKENS_COLLECTION,
-          filter: {}
-        });
-        return results.map((r) => parseShareToken(r.data)).filter((r) => r !== null);
-      }
-      async touchLastUsed(record) {
-        await (await this.store()).update({
-          collection: SHARE_TOKENS_COLLECTION,
-          id: record.id,
-          data: { ...record, lastUsedAt: Date.now() }
-        });
-      }
-    };
-    exports.ShareTokenService = ShareTokenService;
-  }
-});
-
-// ../../server/backend/dist/api/trpc/trpc-error-principal.js
-var require_trpc_error_principal = __commonJS({
-  "../../server/backend/dist/api/trpc/trpc-error-principal.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.readCredentialIdentity = readCredentialIdentity;
-    exports.describeTrpcPrincipal = describeTrpcPrincipal;
-    function readCredentialIdentity(claims) {
-      const kind = Reflect.get(claims, "kind");
-      if (kind !== "sso-bridge")
-        return {};
-      const provider = Reflect.get(claims, "provider");
-      const sessionId = Reflect.get(claims, "sessionId");
-      return {
-        ...typeof provider === "string" && provider !== "" ? { credential: provider } : {},
-        ...typeof sessionId === "string" && sessionId !== "" ? { sessionId } : {}
-      };
-    }
-    function describeTrpcPrincipal(user) {
-      if (!user)
-        return "anonymous";
-      const name = user.username || user.id || "unknown";
-      if (user.shareView)
-        return `${name} (share-view)`;
-      if (user.isAdmin)
-        return `${name} (admin)`;
-      if (user.credential) {
-        const session = user.oauthSessionId ? ` session=${user.oauthSessionId}` : "";
-        return `${name} (${user.credential}${session})`;
-      }
-      if (user.isScoped)
-        return `${name} (scoped-token)`;
-      return `${name} (session)`;
-    }
-  }
-});
-
-// ../../server/backend/dist/api/trpc/trpc.context.js
-var require_trpc_context = __commonJS({
-  "../../server/backend/dist/api/trpc/trpc.context.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.createMeshTrpcContext = createMeshTrpcContext;
-    exports.createTrpcContext = createTrpcContext;
-    exports.createWsTrpcContext = createWsTrpcContext;
-    var types_1 = require_dist4();
-    var share_token_service_js_1 = require_share_token_service();
-    var trpc_error_principal_js_1 = require_trpc_error_principal();
-    var SCOPE_REFRESH_TTL_MS = 3e4;
-    var SCOPE_REFRESH_MISS_TTL_MS = 5e3;
-    var liveScopeMemo = /* @__PURE__ */ new Map();
-    async function refreshScopesFromStore(userId, addonRegistry) {
-      const cached = liveScopeMemo.get(userId);
-      const now = Date.now();
-      if (cached && now - cached.at < (cached.scopes === null ? SCOPE_REFRESH_MISS_TTL_MS : SCOPE_REFRESH_TTL_MS)) {
-        return cached.scopes;
-      }
-      let scopes = null;
-      try {
-        const userMgmt = addonRegistry.getCapabilityRegistry().getSingleton("user-management");
-        const fresh = typeof userMgmt?.listUsers === "function" ? (await userMgmt.listUsers()).find((u) => u.id === userId) : null;
-        if (fresh)
-          scopes = (0, types_1.normalizeTokenScopes)(fresh.scopes ?? []);
-      } catch {
-        scopes = null;
-      }
-      liveScopeMemo.set(userId, { at: now, scopes });
-      if (liveScopeMemo.size > 512) {
-        for (const [key, entry] of liveScopeMemo) {
-          if (now - entry.at > SCOPE_REFRESH_TTL_MS * 4)
-            liveScopeMemo.delete(key);
-        }
-      }
-      return scopes;
-    }
-    function readQuery(req) {
-      if (!("query" in req))
-        return null;
-      const q = Reflect.get(req, "query");
-      if (q === null || typeof q !== "object" || Array.isArray(q))
-        return null;
-      return { ...q };
-    }
-    function extractTokenFromRequest(req) {
-      const authHeader = req.headers.authorization;
-      if (authHeader && typeof authHeader === "string") {
-        const [scheme, token2] = authHeader.split(" ");
-        if (scheme === "Bearer" && token2)
-          return token2;
-      }
-      const q = readQuery(req);
-      if (q && typeof q.token === "string") {
-        return q.token;
-      }
-      const url = req.url;
-      if (url) {
-        const qIdx = url.indexOf("?");
-        if (qIdx !== -1) {
-          const t = new URLSearchParams(url.slice(qIdx + 1)).get("token");
-          if (t)
-            return t;
-        }
-      }
-      return null;
-    }
-    async function resolveUser(token2, authService, addonRegistry, shareTokens = null, logger = null) {
-      if (!token2)
-        return null;
-      if (token2.startsWith(share_token_service_js_1.SHARE_TOKEN_PREFIX)) {
-        if (!shareTokens)
-          return null;
-        try {
-          const record = await shareTokens.validate(token2);
-          if (!record)
-            return null;
-          return {
-            id: record.userId,
-            // Display label — `share:<prefix>` keeps audit logs readable
-            // without exposing the token hash.
-            username: `share:${record.tokenPrefix}`,
-            isAdmin: false,
-            permissions: {
-              isAdmin: false,
-              allowedProviders: "*",
-              allowedDevices: {}
-            },
-            isApiKey: true,
-            shareView: { tokenId: record.id, scope: record.scope }
-          };
-        } catch {
-          return null;
-        }
-      }
-      if (token2.startsWith("cst_")) {
-        try {
-          const userMgmt = addonRegistry.getCapabilityRegistry().getSingleton("user-management");
-          if (!userMgmt)
-            return null;
-          const record = await userMgmt.validateScopedToken({ token: token2 });
-          if (!record)
-            return null;
-          return {
-            id: record.userId,
-            // Display label — `scoped:<prefix>` makes audit logs read
-            // naturally without exposing the token hash.
-            username: `scoped:${record.tokenPrefix}`,
-            isAdmin: false,
-            permissions: {
-              isAdmin: false,
-              allowedProviders: "*",
-              allowedDevices: {}
-            },
-            isApiKey: true,
-            isScoped: true,
-            // Migrate any v2 `device:targets` grant to a v3 selector at the
-            // boundary so the enforcement matcher only ever sees v3.
-            scopes: (0, types_1.normalizeTokenScopes)(record.scopes)
-          };
-        } catch {
-          return null;
-        }
-      }
-      try {
-        const payload = authService.verifyToken(token2);
-        if (typeof payload.isAdmin !== "boolean") {
-          return null;
-        }
-        const principal = (0, types_1.classifyBearerPrincipal)(payload);
-        if (principal.kind === "not-a-credential") {
-          logger?.warn("trpc: refused a bearer that is not an API credential", {
-            meta: { reason: principal.reason, userId: payload.userId ?? payload.keyId ?? "unknown" }
-          });
-          return null;
-        }
-        const credential = (0, trpc_error_principal_js_1.readCredentialIdentity)(payload);
-        return {
-          id: payload.userId ?? payload.keyId ?? "unknown",
-          username: payload.username ?? "unknown",
-          isAdmin: payload.isAdmin,
-          permissions: {
-            isAdmin: payload.isAdmin,
-            allowedProviders: payload.allowedProviders,
-            allowedDevices: payload.allowedDevices
-          },
-          isApiKey: payload.type === "api_key",
-          agentId: payload.agentId,
-          // Scopes are baked into the JWT at login; the middleware uses
-          // them to gate every call until the user re-logs. Normalised at the
-          // boundary — a v2 `device:targets` JWT (issued before the v3 model)
-          // migrates to a selector here, so a pre-v3 token keeps working.
-          //
-          // …but a login-time snapshot is exactly the bug: an admin editing a
-          // user's scopes expects the change to APPLY, and the live session
-          // kept gating on the old set until re-login (2026-08-15: a user
-          // granted the whole fleet kept seeing zero cameras). For non-admin
-          // SESSION principals the store's current scopes win when readable
-          // (memoized — see above); the JWT's copy is the fallback when the
-          // user-management cap is unreachable, so a store hiccup never
-          // locks anybody out mid-request.
-          //
-          // `session` ONLY, and that word is the whole fix. An ACCOUNT-LINK token
-          // is governed by the grant the operator consented to, not by the linking
-          // user's record: it always carries `isAdmin: false` (`oauth-grants.ts`
-          // → `baseClaims`) and its owner is normally an admin, whose record is
-          // deliberately unscoped — so the refresh replaced a six-scope Home
-          // Assistant grant with `[]` and the hub refused the component's first
-          // call with `Have: (none)` (2026-08-19). The user store knows nothing
-          // about a link and must not get a vote on one.
-          ...payload.scopes !== void 0 ? { scopes: (0, types_1.normalizeTokenScopes)(payload.scopes) } : {},
-          ...!payload.isAdmin && principal.kind === "session" ? await (async () => {
-            const fresh = await refreshScopesFromStore(payload.userId ?? payload.keyId ?? "unknown", addonRegistry);
-            return fresh !== null ? { scopes: fresh } : {};
-          })() : {},
-          ...credential.credential !== void 0 ? { credential: credential.credential } : {},
-          ...credential.sessionId !== void 0 ? { oauthSessionId: credential.sessionId } : {}
-        };
-      } catch {
-        return null;
-      }
-    }
-    function makeDeviceScopeLookup(addonRegistry) {
-      return {
-        getAncestors: (deviceId) => addonRegistry.getPersistedAncestors(deviceId),
-        getType: (deviceId) => addonRegistry.getPersistedType(deviceId),
-        getLocation: (deviceId) => addonRegistry.getPersistedLocation(deviceId)
-      };
-    }
-    function createMeshTrpcContext() {
-      const user = {
-        id: "mesh",
-        username: "mesh",
-        isAdmin: true,
-        permissions: { isAdmin: true, allowedProviders: "*", allowedDevices: {} },
-        isApiKey: true
-      };
-      return { user };
-    }
-    async function createTrpcContext(req, authService, addonRegistry, shareTokens = null, logger = null) {
-      const token2 = extractTokenFromRequest(req);
-      return {
-        user: await resolveUser(token2, authService, addonRegistry, shareTokens, logger),
-        req,
-        deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
-        deviceFleet: () => addonRegistry.getPersistedDeviceList()
-      };
-    }
-    async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null, logger = null) {
-      const paramToken = opts.info.connectionParams?.["token"];
-      const token2 = (typeof paramToken === "string" ? paramToken : null) ?? extractTokenFromRequest(opts.req);
-      const user = await resolveUser(token2, authService, addonRegistry, shareTokens, logger);
-      return {
-        user,
-        req: opts.req,
-        deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
-        deviceFleet: () => addonRegistry.getPersistedDeviceList()
-      };
-    }
-  }
-});
-
 // ../../server/backend/dist/api/trpc/core-cap-bridge.js
 var require_core_cap_bridge = __commonJS({
   "../../server/backend/dist/api/trpc/core-cap-bridge.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.isCoreServiceCapName = isCoreServiceCapName;
+    exports.describeMeshOrigin = describeMeshOrigin;
     exports.buildCoreCapService = buildCoreCapService;
     var system_1 = require_dist3();
-    var trpc_middleware_js_1 = require_trpc_middleware();
+    var http_request_census_singleton_js_1 = require_http_request_census_singleton();
     var trpc_context_js_1 = require_trpc_context();
+    var trpc_middleware_js_1 = require_trpc_middleware();
     var CORE_NAMESPACES = /* @__PURE__ */ new Set([
       // Service-backed cap routers (no addon provider).
       "system",
@@ -405359,6 +405812,24 @@ var require_core_cap_bridge = __commonJS({
         }
       }
     }
+    function countMeshCall(census, path, origin) {
+      if (!census.armed)
+        return;
+      census.observe({
+        plane: "mesh",
+        kind: "call",
+        procedures: [path],
+        // A mesh call has no socket and no user-agent. Both render as the named
+        // unknown rather than as a blank, which would read as a logging defect.
+        userAgent: null,
+        ip: null,
+        principal: describeMeshOrigin(origin)
+      });
+    }
+    function describeMeshOrigin(origin) {
+      const node = origin.nodeId ?? "unknown";
+      return origin.caller === null ? `mesh:${node}` : `mesh:${node} via ${origin.caller}`;
+    }
     function resolveInvoker(caller, path) {
       let node = caller;
       for (const segment of path.split(".")) {
@@ -405368,7 +405839,7 @@ var require_core_cap_bridge = __commonJS({
       }
       return typeof node === "function" ? node : null;
     }
-    function buildCoreCapService(appRouter) {
+    function buildCoreCapService(appRouter, census = (0, http_request_census_singleton_js_1.getHttpRequestCensus)()) {
       const meshCaller = (0, trpc_middleware_js_1.createCallerFactory)(appRouter)((0, trpc_context_js_1.createMeshTrpcContext)());
       const discovered = [];
       collectProcedures(appRouter._def.procedures, "", discovered);
@@ -405386,7 +405857,13 @@ var require_core_cap_bridge = __commonJS({
         if (invoke === null)
           continue;
         const method = path.slice(dot + 1);
-        actions.push({ actionName: `${toKebab(namespace)}.${method}`, invoke });
+        actions.push({
+          actionName: `${toKebab(namespace)}.${method}`,
+          invoke: (input, origin) => {
+            countMeshCall(census, path, origin);
+            return invoke(input);
+          }
+        });
       }
       return (0, system_1.createCoreCapService)({ actions });
     }
@@ -407757,6 +408234,202 @@ var require_trpc_router = __commonJS({
   }
 });
 
+// ../../server/backend/dist/api/trpc/ws-request-census.js
+var require_ws_request_census = __commonJS({
+  "../../server/backend/dist/api/trpc/ws-request-census.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.WsCensusSession = exports.MAX_PENDING_WS_OPERATIONS = exports.WS_PATHLESS_PROCEDURE = void 0;
+    exports.parseTrpcWsFrame = parseTrpcWsFrame;
+    exports.attachWsCensusSession = attachWsCensusSession;
+    exports.identifyWsCensusSession = identifyWsCensusSession;
+    var client_ip_js_1 = require_client_ip();
+    var http_request_census_js_1 = require_http_request_census();
+    var KEEPALIVE_FRAMES = /* @__PURE__ */ new Set(["PING", "PONG"]);
+    exports.WS_PATHLESS_PROCEDURE = "(ws-no-path)";
+    exports.MAX_PENDING_WS_OPERATIONS = 128;
+    var NO_OPERATIONS = { calls: [], subscriptions: [], stops: 0 };
+    function parseTrpcWsFrame(raw) {
+      const text = raw.trim();
+      if (text.length === 0)
+        return NO_OPERATIONS;
+      if (KEEPALIVE_FRAMES.has(text))
+        return NO_OPERATIONS;
+      const parsed = parseJsonSafely(text);
+      if (parsed === null)
+        return NO_OPERATIONS;
+      const messages = Array.isArray(parsed) ? parsed : [parsed];
+      const calls = [];
+      const subscriptions = [];
+      let stops = 0;
+      let overflowed = false;
+      for (const message of messages) {
+        if (typeof message !== "object" || message === null)
+          continue;
+        const method = Reflect.get(message, "method");
+        if (method === "subscription.stop") {
+          stops += 1;
+          continue;
+        }
+        if (method !== "query" && method !== "mutation" && method !== "subscription")
+          continue;
+        if (calls.length + subscriptions.length >= http_request_census_js_1.MAX_BATCH_PROCEDURES) {
+          overflowed = true;
+          continue;
+        }
+        const path = readPath(Reflect.get(message, "params"));
+        if (method === "subscription")
+          subscriptions.push(path);
+        else
+          calls.push(path);
+      }
+      if (overflowed)
+        calls.push(http_request_census_js_1.BATCH_OVERFLOW_PROCEDURE);
+      return { calls, subscriptions, stops };
+    }
+    function parseJsonSafely(text) {
+      try {
+        return JSON.parse(text);
+      } catch {
+        return null;
+      }
+    }
+    function readPath(params) {
+      if (typeof params !== "object" || params === null)
+        return exports.WS_PATHLESS_PROCEDURE;
+      const path = Reflect.get(params, "path");
+      return typeof path === "string" && path.length > 0 ? path : exports.WS_PATHLESS_PROCEDURE;
+    }
+    var WsCensusSession = class {
+      census;
+      userAgent;
+      ip;
+      /** `null` until `createWsTrpcContext` resolved the bearer. */
+      principal = null;
+      pending = [];
+      closed = false;
+      constructor(census, req) {
+        this.census = census;
+        this.userAgent = (0, client_ip_js_1.extractUserAgent)(req);
+        this.ip = (0, client_ip_js_1.extractClientIp)(req);
+      }
+      /**
+       * Count one raw client frame.
+       *
+       * The armed check is the FIRST statement. If it ever moves below a field
+       * access, the hostile-frame spec fails instead of the hub paying for a
+       * diagnostic nobody switched on.
+       */
+      observeMessage(data) {
+        if (!this.census.armed)
+          return;
+        this.census.observeWsMessage();
+        const text = frameText(data);
+        if (text === null)
+          return;
+        const operations = parseTrpcWsFrame(text);
+        if (operations.stops > 0)
+          this.census.observeSubscriptionStop(operations.stops);
+        if (operations.calls.length === 0 && operations.subscriptions.length === 0)
+          return;
+        if (this.principal !== null) {
+          this.flushFrame(operations, this.principal);
+          return;
+        }
+        if (this.pending.length >= exports.MAX_PENDING_WS_OPERATIONS) {
+          this.flushFrame(operations, http_request_census_js_1.UNKNOWN);
+          return;
+        }
+        this.pending.push(operations);
+      }
+      /** Name the connection, once, and release everything held for it. */
+      identify(principal) {
+        if (this.principal !== null || this.closed)
+          return;
+        this.principal = principal;
+        this.drain(principal);
+      }
+      /** The socket went away. Anything still unnamed is released as {@link UNKNOWN}. */
+      close() {
+        if (this.closed)
+          return;
+        this.closed = true;
+        this.drain(this.principal ?? http_request_census_js_1.UNKNOWN);
+      }
+      drain(principal) {
+        if (this.pending.length === 0)
+          return;
+        const held = this.pending;
+        this.pending = [];
+        for (const frame of held)
+          this.flushFrame(frame, principal);
+      }
+      flushFrame(operations, principal) {
+        if (operations.calls.length > 0) {
+          this.census.observe({
+            plane: "ws",
+            kind: "call",
+            procedures: operations.calls,
+            userAgent: this.userAgent,
+            ip: this.ip,
+            principal
+          });
+        }
+        if (operations.subscriptions.length > 0) {
+          this.census.observe({
+            plane: "ws",
+            kind: "subscription",
+            procedures: operations.subscriptions,
+            userAgent: this.userAgent,
+            ip: this.ip,
+            principal
+          });
+        }
+      }
+    };
+    exports.WsCensusSession = WsCensusSession;
+    var sessions = /* @__PURE__ */ new WeakMap();
+    function attachWsCensusSession(census, client, req, logger) {
+      census.observeWsConnection();
+      const session = new WsCensusSession(census, req);
+      sessions.set(client, session);
+      let broken = false;
+      client.on("message", (data) => {
+        if (broken)
+          return;
+        try {
+          session.observeMessage(data);
+        } catch (err) {
+          broken = true;
+          logger?.warn("transport census: ws frames no longer counted on this socket", {
+            meta: { error: err instanceof Error ? err.message : String(err) }
+          });
+        }
+      });
+      client.once("close", () => {
+        session.close();
+      });
+      return session;
+    }
+    function identifyWsCensusSession(client, principal) {
+      sessions.get(client)?.identify(principal);
+    }
+    function frameText(data) {
+      if (typeof data === "string")
+        return data;
+      if (Buffer.isBuffer(data))
+        return data.toString("utf8");
+      if (data instanceof ArrayBuffer)
+        return Buffer.from(data).toString("utf8");
+      if (Array.isArray(data)) {
+        const chunks = data.filter((chunk) => Buffer.isBuffer(chunk));
+        return chunks.length === 0 ? null : Buffer.concat(chunks).toString("utf8");
+      }
+      return null;
+    }
+  }
+});
+
 // ../../server/backend/dist/auth/addon-route-jwt-gate.js
 var require_addon_route_jwt_gate = __commonJS({
   "../../server/backend/dist/auth/addon-route-jwt-gate.js"(exports) {
@@ -415525,6 +416198,7 @@ var require_main4 = __commonJS({
     var trpc_context_1 = require_trpc_context();
     var trpc_router_1 = require_trpc_router();
     var trpc_error_principal_1 = require_trpc_error_principal();
+    var ws_request_census_1 = require_ws_request_census();
     var addon_route_jwt_gate_js_1 = require_addon_route_jwt_gate();
     var session_cookie_js_1 = require_session_cookie();
     var boot_config_1 = require_boot_config();
@@ -416191,12 +416865,16 @@ var require_main4 = __commonJS({
             concurrencyLimit: 10
           }
         });
+        wss.on("connection", (client, req) => {
+          (0, ws_request_census_1.attachWsCensusSession)(httpRequestCensus, client, req, app.get(logging_service_1.LoggingService).createLogger("tRPC:ws"));
+        });
         (0, ws_1.applyWSSHandler)({
           wss,
           router: appRouter,
-          createContext: (opts) => {
-            httpRequestCensus.observeWsConnection();
-            return (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService, app.get(logging_service_1.LoggingService).createLogger("tRPC:ws"));
+          createContext: async (opts) => {
+            const wsCtx = await (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService, app.get(logging_service_1.LoggingService).createLogger("tRPC:ws"));
+            (0, ws_request_census_1.identifyWsCensusSession)(opts.res, (0, trpc_error_principal_1.describeTrpcPrincipal)(wsCtx.user));
+            return wsCtx;
           },
           onError: ({ path: trpcPath, error, ctx }) => {
             const trpcLogger = app.get(logging_service_1.LoggingService).createLogger("tRPC:ws");