@camstack/addon-pipeline-orchestrator 1.2.25 → 1.2.26

package/dist/index.mjs

@@ -7482,6 +7482,14 @@ var EncodeProfileSchema = object({
 			"main",
 			"high"
 		]).optional(),
+		/**
+		* `-level`, e.g. `'3.1'`. A consumer that ADVERTISES a level in its SDP
+		* (`profile-level-id=42e01f` is Baseline 3.1) must constrain the encoder to
+		* it, or it ships a stream that does not match its own advertisement — the
+		* defect class that kept HomeKit black for a year and that Alexa carried
+		* silently. Optional because a browser negotiates the level itself.
+		*/
+		level: string().optional(),
 		width: number().int().positive().optional(),
 		height: number().int().positive().optional(),
 		fps: number().positive().optional(),
@@ -7529,6 +7537,29 @@ var EncodeProfileSchema = object({
 	outputArgs: array(string()).optional()
 });
 /**
+* The shape every live egress starts from: H.264 Baseline 3.1 at 720p25.
+* Baseline because it is the one profile every consumer in this repo decodes
+* (Echo, iOS, an old browser); 3.1 because that is what the SDPs advertise.
+*/
+var BASE_LIVE_EGRESS_PROFILE = {
+	video: {
+		codec: "h264",
+		profile: "baseline",
+		level: "3.1",
+		width: 1280,
+		height: 720,
+		fps: 25,
+		bitrateKbps: 2500,
+		gopFrames: 25,
+		bf: 0,
+		preset: "veryfast",
+		tune: "zerolatency"
+	},
+	audio: "passthrough"
+};
+({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
+({ ...BASE_LIVE_EGRESS_PROFILE });
+/**
 * Deep wiring healthcheck — snapshot of active reachability probes across
 * every declared capability + widget of every installed plugin, on every
 * node. Produced by the backend `WiringHealthService` and surfaced via
@@ -7578,6 +7609,236 @@ object({
 	})
 });
 /**
+* Per-camera FUNCTION SWITCHES — the one coherent on/off surface over the
+* pipeline functions an operator thinks in terms of.
+*
+* ## This file adds no state
+*
+* Every switch here is a VIEW onto an authority that already existed
+* ([D61](../../../../docs/decisions/adr-0062.md)). The whole point of the
+* group is that there is exactly one place each function is turned off, and
+* the group routes to it:
+*
+* | Switch | Authority | Proven "off stops the work" gate |
+* | --- | --- | --- |
+* | `stream-broker` | `deviceManager.setDisabled` | `StreamBrokerManager.reconcileAllCatalogs` releases the brokers; `ensureBroker` refuses re-creation |
+* | `object-detection` | `deviceManager.setWrapperActive('detection-pipeline')` | `PipelineSettingsStore.resolvePipelineForDevice` returns `{ steps: [], audio: null }` |
+* | `audio-analysis` | `deviceManager.setWrapperActive('audio-analysis')` | `AudioSubscriptionController.subscribeAudioStream` returns `null` before opening the stream |
+* | `recording` | `recording.setDeviceConfig` → `RecordingConfig.enabled` | `band-decision.shouldRecord` returns false; the controller detaches the device |
+* | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
+*
+* The wrapper-binding pair is not a new idea: `legacy-migrations.ts` already
+* migrated the legacy `audioEnabled` / `pipelineEnabled` /
+* `motionDetectionEnabled` booleans ONTO `setWrapperActive`. The group is the
+* surface that decision never got.
+*
+* ## Two rules that are load-bearing
+*
+* - **Recording's switch is `enabled`, never the bands.** `bands` is the only
+*   authored intent and `mode` is derived from it (`deriveRecordingMode`).
+*   Expressing "off" by clearing bands destroys the operator's schedule and
+*   turning the camera back on would then silently record nothing.
+* - **A switch that is off must be reported as off**, not merely produce
+*   nothing. {@link CameraSwitch.enabled} is what a status surface renders as
+*   "disabled by an operator" instead of "broken" — see
+*   `CameraStatus.switchedOff`.
+*/
+/**
+* The five functions the operator named (2026-08-05). Deliberately NOT one id
+* per pipeline step: face recognition and plate/LPR are per-step toggles on
+* `pipelineOrchestrator.setCameraStepToggle` and belong in the pipeline
+* editor, not in a five-button safety group.
+*/
+var CameraSwitchIdSchema = _enum([
+	"stream-broker",
+	"object-detection",
+	"audio-analysis",
+	"recording",
+	"notifications"
+]);
+/** Stable render order — broadest blast radius first. */
+var CAMERA_SWITCH_ORDER = [
+	"stream-broker",
+	"object-detection",
+	"audio-analysis",
+	"recording",
+	"notifications"
+];
+/**
+* WHERE the switch's state actually lives. A discriminated union rather than a
+* string so both the writer (the orchestrator's `setCameraSwitch`) and any
+* reader can exhaustively narrow — and so "the group added a parallel map" is
+* a compile error rather than a review comment.
+*/
+var CameraSwitchAuthoritySchema = discriminatedUnion("kind", [
+	object({ kind: literal("device-disabled") }),
+	object({
+		kind: literal("wrapper-binding"),
+		capName: string()
+	}),
+	object({ kind: literal("recording-config") }),
+	object({ kind: literal("notification-mute") })
+]);
+/**
+* Why a switch is not offered for this camera. Rendered instead of the
+* control, never as a dead control — an absent function and a broken one must
+* not look the same.
+*/
+var CameraSwitchUnavailableReasonSchema = _enum(["no-provider", "source-unreachable"]);
+/**
+* One switch, resolved for one camera.
+*
+* `label` and `costWhenOff` travel ON THE WIRE rather than being looked up
+* client-side: the viewer is a separate repository that does not import
+* `@camstack/types`, and a cost line duplicated in two clients is a cost line
+* that will disagree with itself. Five rows per camera is nothing.
+*/
+var CameraSwitchSchema = object({
+	id: CameraSwitchIdSchema,
+	label: string(),
+	/**
+	* What the operator LOSES while this is off, in one sentence. Required, not
+	* optional: a switch that cannot say what it costs should not ship.
+	*/
+	costWhenOff: string(),
+	/** False = do not render a control. `unavailableReason` says why. */
+	available: boolean(),
+	unavailableReason: CameraSwitchUnavailableReasonSchema.optional(),
+	/** Current state. Meaningless when `available` is false — read it as `true`. */
+	enabled: boolean(),
+	authority: CameraSwitchAuthoritySchema
+});
+/** The whole group for one camera. */
+var CameraSwitchGroupSchema = object({
+	deviceId: number().int(),
+	switches: array(CameraSwitchSchema).readonly(),
+	/** Unix ms when the group was composed server-side. */
+	fetchedAt: number()
+});
+/**
+* THE catalog. One entry per switch; the cost lines are the operator-facing
+* contract and are written to be true rather than reassuring.
+*/
+var CAMERA_SWITCH_CATALOG = {
+	"stream-broker": {
+		id: "stream-broker",
+		label: "Camera",
+		costWhenOff: "Off: the whole camera stops. No live view, no recording, no detection and no notifications — its streams are released and nothing dials it again until you turn it back on.",
+		authority: { kind: "device-disabled" }
+	},
+	"object-detection": {
+		id: "object-detection",
+		label: "Object detection & tracking",
+		costWhenOff: "Off: nothing is detected or tracked on this camera, so it produces no events — and with no events there are no object notifications and no event-triggered recording. Live view and continuous recording are unaffected.",
+		authority: {
+			kind: "wrapper-binding",
+			capName: "detection-pipeline"
+		}
+	},
+	"audio-analysis": {
+		id: "audio-analysis",
+		label: "Audio detection & classification",
+		costWhenOff: "Off: no audio is decoded or classified for this camera. Tracks carry no audio labels and no audio-triggered rule can fire. Audio recorded alongside video is unaffected.",
+		authority: {
+			kind: "wrapper-binding",
+			capName: "audio-analysis"
+		}
+	},
+	recording: {
+		id: "recording",
+		label: "Recording",
+		costWhenOff: "Off: nothing new is written to disk. Footage already recorded stays, but retention keeps deleting it — so this camera’s history shrinks and is not replaced. Your recording schedule is kept and resumes when you turn it back on.",
+		authority: { kind: "recording-config" }
+	},
+	notifications: {
+		id: "notifications",
+		label: "Notifications",
+		costWhenOff: "Off: this camera never notifies anyone, on any rule, with no expiry. Detection, events and recording carry on exactly as before — you simply stop being told about them.",
+		authority: { kind: "notification-mute" }
+	}
+};
+/** Resolve one switch's `{ available, enabled }` pair. */
+function resolveState(descriptor, input) {
+	switch (descriptor.authority.kind) {
+		case "device-disabled": return {
+			available: true,
+			enabled: !input.deviceDisabled
+		};
+		case "wrapper-binding": {
+			const capName = descriptor.authority.capName;
+			if (input.bindableCapNames === null || input.activeWrapperCapNames === null) return {
+				available: false,
+				enabled: true,
+				unavailableReason: "source-unreachable"
+			};
+			if (!input.bindableCapNames.includes(capName)) return {
+				available: false,
+				enabled: true,
+				unavailableReason: "no-provider"
+			};
+			return {
+				available: true,
+				enabled: input.activeWrapperCapNames.includes(capName)
+			};
+		}
+		case "recording-config":
+			if (input.recordingEnabled === null) return {
+				available: false,
+				enabled: true,
+				unavailableReason: "source-unreachable"
+			};
+			return {
+				available: true,
+				enabled: input.recordingEnabled
+			};
+		case "notification-mute":
+			if (input.notificationsMuted === null) return {
+				available: false,
+				enabled: true,
+				unavailableReason: "source-unreachable"
+			};
+			return {
+				available: true,
+				enabled: !input.notificationsMuted
+			};
+	}
+}
+/**
+* Pure derivation of the whole group. No I/O — the orchestrator gathers, this
+* decides, so the decision is testable without a hub.
+*
+* Order is {@link CAMERA_SWITCH_ORDER}; unavailable switches are RETURNED
+* rather than filtered out, so a client can explain the gap instead of
+* silently rendering four buttons where another camera shows five.
+*/
+function deriveCameraSwitches(input) {
+	return CAMERA_SWITCH_ORDER.map((id) => {
+		const descriptor = CAMERA_SWITCH_CATALOG[id];
+		const state = resolveState(descriptor, input);
+		return {
+			id: descriptor.id,
+			label: descriptor.label,
+			costWhenOff: descriptor.costWhenOff,
+			available: state.available,
+			...state.unavailableReason !== void 0 ? { unavailableReason: state.unavailableReason } : {},
+			enabled: state.enabled,
+			authority: descriptor.authority
+		};
+	});
+}
+/**
+* The ids an operator has switched OFF, for a status surface.
+*
+* This is the answer to "a disabled function must be visible as DISABLED, not
+* merely quiet": a camera reporting zero detections with
+* `switchedOff: ['object-detection']` was turned off; the same camera with an
+* empty list is broken. Unavailable switches never appear — a function nobody
+* provides was not switched off by anyone.
+*/
+function switchedOffIds(switches) {
+	return switches.filter((s) => s.available && !s.enabled).map((s) => s.id);
+}
+/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -7596,14 +7857,16 @@ var OpsLogOpSchema = _enum([
 	"manual-delete",
 	"rescan",
 	"retention-run",
-	"relocate"
+	"relocate",
+	"orphan-audit"
 ]);
 /** Why the operation ran. */
 var OpsLogReasonSchema = _enum([
 	"retention",
 	"quota",
 	"manual",
-	"operator"
+	"operator",
+	"maintenance"
 ]);
 /** One audit row, shared verbatim by both domains. */
 var OpsLogEntrySchema = object({
@@ -9508,6 +9771,100 @@ var RtpSourceSchema = object({
 	encoder: string(),
 	pipelineKey: string()
 });
+/**
+* The encode request — **structured and serialisable, with NO raw-flag escape
+* hatch.** This is deliberate and it is the one lesson taken from
+* `getStreamWithCodec`: that method's `outputArgs: string[]` is simultaneously
+* its extensibility mechanism AND part of `pipelineKeyFor`'s sharing key, so
+* adding a flag silently forks the shared child, and two consumers that mean
+* the same thing but spell it differently never share. Here every knob is a
+* NAMED field: a new requirement becomes a schema field (and a codegen run),
+* never an opaque array.
+*
+* `inputArgs` / `outputArgs` are omitted from the profile for the same reason.
+* The operator-facing derived-stream transform editor still has them — that is
+* a different surface (`publishCameraStream({ kind: 'derived' })`) with a
+* different purpose (reshaping a badly-behaved SOURCE), and it is unchanged.
+*/
+var EgressEncodeSchema = EncodeProfileSchema.omit({
+	inputArgs: true,
+	outputArgs: true
+});
+/**
+* How the encoder is bounded. `'tight'` is a one-second VBV window for a
+* consumer whose budget is enforced per second (HomeKit); `'relaxed'` is two
+* seconds, letting a keyframe spike borrow from the next second (a browser,
+* an Echo). Named rather than numeric so the INTENT survives.
+*/
+var EgressRateControlSchema = _enum(["tight", "relaxed"]);
+var EgressTranscodeRequestSchema = object({
+	deviceId: number().int().nonnegative(),
+	/** Which published stream to read. */
+	source: discriminatedUnion("kind", [object({
+		kind: literal("profile"),
+		profile: CamProfileSchema
+	}), object({
+		kind: literal("cam-stream"),
+		camStreamId: string().min(1)
+	})]),
+	encode: EgressEncodeSchema,
+	rateControl: EgressRateControlSchema.optional(),
+	/**
+	* `-bsf:v`. A consumer that negotiates its OWN SDP (HomeKit) cannot carry
+	* out-of-band extradata and needs `dump_extra` on both the copy and encode
+	* branches. Enumerated, not free text.
+	*/
+	bitstreamFilter: _enum([
+		"dump_extra",
+		"h264_mp4toannexb",
+		"hevc_mp4toannexb"
+	]).optional(),
+	pixelFormat: _enum(["yuv420p", "nv12"]).optional(),
+	/**
+	* Operator/consumer override for decode hardware. ABSENT is the normal case
+	* and the one that matters: the broker then resolves the backend from the
+	* DECODER ADDON's per-node `probedBestHwaccel` (see
+	* `@camstack/types` `ffmpeg/hwaccel.ts`), which is the ranking known to work
+	* on this hardware — never the raw kernel resolver's qsv-first order.
+	*/
+	decodeHwAccel: _enum([
+		"auto",
+		"none",
+		"videotoolbox",
+		"vaapi",
+		"qsv",
+		"cuda"
+	]).optional(),
+	/**
+	* Host to embed in the returned restream `url`. The broker mints hub-local
+	* `127.0.0.1` URLs; a consumer on another node passes a cluster-resolvable
+	* host (`NodeTopologyService.reachableHostByNode`) so the returned URL is
+	* dialable from there. Same contract as `getStreamWithCodec.hostname` —
+	* `substituteRtspHost` rewrites only the dial address, never the restreamer.
+	*/
+	hostname: string().optional(),
+	/** Attribution for the broker panel. Never part of the sharing key. */
+	tag: string().optional()
+});
+var EgressTranscodeSchema = object({
+	/** Dial-able RTSP url (host-substituted when `hostname` was supplied). */
+	url: string(),
+	/** Release handle. Refcounted — the child dies when the last holder releases. */
+	pipelineKey: string(),
+	videoCodec: _enum(["H264", "H265"]),
+	resolution: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	transcoded: boolean(),
+	encoder: string(),
+	/**
+	* The decode backend the child ACTUALLY ran with — `null` for software.
+	* Returned rather than assumed: a consumer that asked for hardware and got
+	* software needs to be able to see that without reading the broker's logs.
+	*/
+	decodeHwAccel: string().nullable()
+});
 method(object({
 	deviceId: number().int().nonnegative(),
 	camStreamId: string().min(1),
@@ -9617,6 +9974,15 @@ method(object({
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(EgressTranscodeRequestSchema, EgressTranscodeSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ pipelineKey: string() }), object({
+	released: boolean(),
+	refcount: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
 }), method(SubscribeAudioChunksInputSchema, SubscribeAudioChunksResultSchema, { kind: "mutation" }), method(object({
 	subscriptionId: string(),
 	maxCount: number().int().positive().default(8)
@@ -13965,12 +14331,13 @@ var NcConditionsSchema = object({
 	* source; otherwise the subject's source must equal it. Legacy records
 	* with no stamped source are treated as `pipeline`. The union spans both
 	* record kinds — object events carry `pipeline` | `onboard`, synthetic
-	* tracks carry `sensor`.
+	* tracks carry `sensor` (a linked device) or `audio` (a D62 audio marker).
 	*/
 	source: _enum([
 		"pipeline",
 		"onboard",
 		"sensor",
+		"audio",
 		"any"
 	]).optional(),
 	/**
@@ -14546,6 +14913,12 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({}), object({ mutedDeviceIds: array(number().int()).readonly() }), { auth: "admin" }), method(object({
+	deviceId: number().int(),
+	muted: boolean()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	rule: NcRuleInputSchema,
 	lookbackMinutes: number().int().min(1).max(1440).default(60)
@@ -14884,12 +15257,60 @@ var TrackAudioLabelSchema = object({
 });
 /**
 * How a track was produced. `pipeline` (default / absent) = the spatial
-* detection+tracking pipeline. `sensor` = a SYNTHETIC track projected from a
-* linked sensor/control state change (no positions; carries a snapshot). The
-* spatial subsystems (tracker association, occupancy count, re-id/embedding,
-* resurrection) MUST skip `sensor` tracks — they have no bbox trajectory.
+* detection+tracking pipeline. Every OTHER value is a SYNTHETIC projection —
+* no positions, a single snapshot, and no bbox trajectory at all:
+*
+*  - `sensor` — a linked sensor/control device state change.
+*  - `audio` — an audio event on the camera itself that was anomalous for
+*    THAT camera, loud, and heard while nothing visual was happening (D62).
+*
+* The spatial subsystems (tracker association, occupancy count, re-id /
+* embedding, resurrection) MUST skip every synthetic source. Test for that
+* with `isSpatialTrack`, which allow-lists `pipeline` — a `!== 'sensor'`
+* check silently readmits every source added after it was written.
 */
-var TrackSourceSchema = _enum(["pipeline", "sensor"]);
+var TrackSourceSchema = _enum([
+	"pipeline",
+	"sensor",
+	"audio"
+]);
+/**
+* Per-track OPERATOR flags — set by hand from the admin UI or the viewer, never
+* by the pipeline. Spread into `TrackSchema` and `KeyEventSchema` from one place
+* so the two surfaces cannot drift.
+*
+* **Absent ≠ false.** A track that has never been touched omits the field; an
+* explicitly un-flagged track carries `false`. Legacy rows written before the
+* columns existed read as absent, and a consumer that needs a boolean should say
+* `flag === true`, not `flag !== false`.
+*
+* What the flags DO is deliberately UNDEFINED at the time of writing: they are
+* operator curation, and the behaviour they drive will be specified separately.
+* In particular a `markForTrain` track is NOT pinned against retention — see
+* `docs/decisions/adr-0059.md` for why that is a store-level change, not a flag.
+*/
+var TrackFlagFields = {
+	/** Operator marked this track as training material. */
+	markForTrain: boolean().optional(),
+	/** Operator marked this track for diagnostic attention. */
+	debug: boolean().optional()
+};
+/**
+* The write half: a PARTIAL patch. An omitted key is left untouched, so setting
+* one flag can never clear the other — the toggles are independent and are
+* driven from three surfaces that do not know about each other.
+*/
+var TrackFlagsPatchSchema = object(TrackFlagFields);
+/**
+* The resolved flag state after a write. Both fields are REQUIRED here (absent
+* collapses to `false`) so a caller can drive a toggle's checked state off the
+* mutation result without a re-fetch.
+*/
+var TrackFlagsSchema = object({
+	trackId: string(),
+	markForTrain: boolean(),
+	debug: boolean()
+});
 var TrackSchema = object({
 	trackId: string(),
 	deviceId: number(),
@@ -14932,7 +15353,8 @@ var TrackSchema = object({
 	/** Normalized 0..1 trajectory envelope (see {@link TrackEnvelopeSchema}).
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
-	envelope: TrackEnvelopeSchema.optional()
+	envelope: TrackEnvelopeSchema.optional(),
+	...TrackFlagFields
 });
 var BaseEventFields = {
 	id: string(),
@@ -15145,7 +15567,8 @@ var KeyEventSchema = object({
 	/** Highest-confidence ObjectEvent id for the track (empty when none). */
 	bestEventId: string(),
 	/** Track lifetime in ms (lastSeen - firstSeen). */
-	windowMs: number().optional()
+	windowMs: number().optional(),
+	...TrackFlagFields
 });
 object({
 	trackId: string(),
@@ -15231,7 +15654,31 @@ var RebuildObjectEmbeddingsInput = object({
 	since: number().optional(),
 	until: number().optional(),
 	/** Stop after this many tracks; the result reports whether more remain. */
-	maxTracks: number().int().positive().optional()
+	maxTracks: number().int().positive().optional(),
+	/**
+	* Run every embedding on THIS node instead of round-robining the fleet.
+	*
+	* Named `executeOnNodeId` and not `nodeId` on purpose: an inline `nodeId`
+	* field in cap args is read by `parent-unowned-call.ts` as a ROUTING PIN, so
+	* calling it that would pin the rebuild REQUEST itself to that node — the
+	* rebuild orchestration lives on the hub, and only the per-track step runs
+	* remotely. This field is data; the per-track pin is applied inside.
+	*
+	* Absent ⇒ round-robin over every online node whose runner can serve the
+	* pinned model.
+	*/
+	executeOnNodeId: string().optional(),
+	/**
+	* Milliseconds to wait between tracks; omit for the built-in default, `0` to
+	* run flat out.
+	*
+	* A rebuild is bulk maintenance on hub-main's single thread. Measured
+	* 2026-08-06, an unpaced pass held that thread busy 82.2 s out of 120 and
+	* pushed `nodes.topology` from 0.25 s to 26 s for 43 minutes. The value in
+	* force is logged at start and finish so a deliberately slow pass reads
+	* differently from a stalled one.
+	*/
+	pacingMs: number().int().nonnegative().optional()
 });
 /**
 * Result of emptying the CLIP index.
@@ -15265,13 +15712,23 @@ var RebuildStatusSchema = object({
 	/** Tracks with no usable detection box. */
 	missingBbox: number(),
 	/**
-	* Tracks the pipeline REFUSED rather than broke on: the camera is not
-	* attached, or `clip-embedding` is not enabled in its step tree. Separate
-	* from `failed` because the remedy is a configuration change, not an engine
-	* investigation — and because a pass over decommissioned cameras would
-	* otherwise read as a total engine outage.
+	* Tracks an executing node REFUSED rather than broke on — an unreadable key
+	* frame, a step that threw. Separate from `failed` because the remedy is
+	* different, and because a whole camera silently contributing zero vectors
+	* is the shape of failure a rebuild must never hide.
 	*/
 	notRunnable: number(),
+	/**
+	* The pass stopped because NO node could serve the pinned model.
+	*
+	* Distinct from `notRunnable` on purpose: that one says "this track was
+	* refused", this one says "the cluster cannot do this work at all" — every
+	* candidate node either lacks the `clip-embedding` step, lacks a build of the
+	* pinned model for its engine format, or dropped out. The remedy is a model /
+	* engine change, not a per-camera one. Non-zero here always comes with
+	* `complete: false`.
+	*/
+	noCapableNode: number(),
 	failed: number(),
 	/** Set once a pass ends: true only when EVERYTHING was covered. */
 	complete: boolean().nullable(),
@@ -15343,7 +15800,12 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), EventStoreFootprintSchema, {
+}), method(object({
+	/** Log/audit scope only — the trackId is globally unique on its own. */
+	deviceId: number(),
+	trackId: string(),
+	flags: TrackFlagsPatchSchema
+}), TrackFlagsSchema, { kind: "mutation" }), method(object({}), EventStoreFootprintSchema, {
 	kind: "query",
 	auth: "admin"
 }), method(object({
@@ -16138,6 +16600,53 @@ var DetailResultSchema = object({
 	nativeFaceShortSidePx: number().optional()
 });
 /**
+* Why an executing node REFUSED a stateless step run (`runStatelessStep`).
+*
+* A refusal is a first-class answer, not an error, because the caller's next
+* move depends on WHICH one it is — and because "the pass produced nothing"
+* must never be reachable without a named, counted cause. The two tiers:
+*
+* - **node-level** (`unknown-step`, `model-not-servable`) — this node can
+*   never serve this (step, model) pair. The caller drops it from its rotation
+*   and retries the same work elsewhere; nothing about the work changes.
+* - **work-level** (`unreadable-frame`, `execution-failed`) — this node is
+*   fine, this one request is not. Retrying it on another node would only
+*   spread the same failure.
+*/
+var StatelessStepRefusalSchema = _enum([
+	"unknown-step",
+	"model-not-servable",
+	"unreadable-frame",
+	"execution-failed"
+]);
+/**
+* Answer to `runStatelessStep` — a discriminated union rather than a nullable
+* result, because `null` is exactly what made the camera-bound detail path
+* unable to tell "refused" from "never asked".
+*/
+var RunStatelessStepResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("ran"),
+	/** The node that actually executed it — the pin, echoed back for the log. */
+	nodeId: string(),
+	/**
+	* The model the step ran with.
+	*
+	* The node verified this exact id has a build for the format it dispatched
+	* on BEFORE running, so the executor's format resolution returns it
+	* unchanged. A caller that pinned a model must compare this field and
+	* treat a mismatch as a refusal — the whole point of the pin is that a
+	* pass writes one feature space.
+	*/
+	modelId: string(),
+	details: array(DetailResultSchema)
+}), object({
+	kind: literal("refused"),
+	nodeId: string(),
+	reason: StatelessStepRefusalSchema,
+	/** Human-readable specifics — the format tried, the formats shipped, etc. */
+	detail: string()
+})]);
+/**
 * Per-camera tunable ranges + defaults. Single source of truth used
 * by both the Zod data schema (validation + default fallback) and
 * the device settings UI (slider min/max/step). Touch one place and
@@ -16626,7 +17135,32 @@ method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mu
 	cropJpeg: string().optional(),
 	parent: DetailParentSchema,
 	steps: array(string()).optional()
-}), object({ details: array(DetailResultSchema) }).nullable(), { kind: "mutation" });
+}), object({ details: array(DetailResultSchema) }).nullable(), { kind: "mutation" }), method(object({
+	/** Catalog step id, e.g. `clip-embedding`. */
+	stepId: string(),
+	/**
+	* REQUIRED model pin. The node runs this exact model or refuses with
+	* `model-not-servable` — it never substitutes a format default, because
+	* a fleet pass that round-robins across nodes would then fill one index
+	* from several encoders.
+	*/
+	modelId: string(),
+	/** FULL FRAME, base64 JPEG. The runner cuts — do NOT pre-crop. */
+	frameJpeg: string(),
+	/**
+	* The subject box, NORMALISED [0,1] against `frameJpeg`. Normalised on
+	* purpose: the caller stores boxes against a downscaled analysis frame
+	* while the stored key frame is native-resolution, and the only side
+	* that reliably knows the image's pixel dimensions is the side that
+	* decodes it. Denormalising here removes a second reader of the
+	* dimensions and the class of mismatch that comes with it.
+	*/
+	bbox: NativeCropBboxSchema,
+	/** Parent class of the subject (`person`, `vehicle`, …) — carried into the result. */
+	className: string(),
+	/** Camera the pixels came from. Diagnostics + log tags ONLY — never routing. */
+	sourceDeviceId: number()
+}), RunStatelessStepResultSchema, { kind: "mutation" });
 var CameraPipelineConfigSchema = object({
 	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).readonly(),
@@ -16924,6 +17458,20 @@ var CameraStatusSchema = object({
 	detection: CameraDetectionStatusSchema.nullable(),
 	audio: CameraAudioStatusSchema.nullable(),
 	recording: CameraRecordingStatusSchema.nullable(),
+	/**
+	* Per-camera function switches an OPERATOR has turned off
+	* ([D61](../../../../docs/decisions/adr-0067.md)).
+	*
+	* This is the difference between DISABLED and BROKEN. A camera whose
+	* `detection` block reports zero fps and whose `switchedOff` contains
+	* `'object-detection'` was switched off by a person; the same camera with an
+	* empty list is failing. Every status surface must render the two
+	* differently — a quiet camera that looks identical to a dead one is the
+	* silence-reads-as-never-happened trap this repo keeps paying for.
+	*
+	* Empty when nothing is off. Never contains a switch no provider offers.
+	*/
+	switchedOff: array(CameraSwitchIdSchema).readonly(),
 	/** Unix timestamp (ms) when this snapshot was composed server-side. */
 	fetchedAt: number()
 });
@@ -17323,6 +17871,43 @@ var pipelineOrchestratorCapability = {
 			agentNodeId: string().optional()
 		}), CameraPipelineConfigSchema),
 		/**
+		* The whole per-camera function switch group, DERIVED — never a stored
+		* list ([D61](../../../../docs/decisions/adr-0067.md)).
+		*
+		* The group adds no state. Each switch is a view onto the authority that
+		* already owned it (`deviceManager.setDisabled`,
+		* `deviceManager.setWrapperActive`, `RecordingConfig.enabled`,
+		* `notificationRules.setDeviceMuted`), and `switch.authority` says which.
+		* Availability comes from `deviceManager.listBindableCapsForDeviceType`,
+		* so a deployment with no audio analyzer renders no audio switch.
+		*
+		* `auth: 'view'` deliberately — a NON-admin must be able to see that a
+		* camera is quiet because somebody switched it off. Only the mutation is
+		* admin-gated.
+		*/
+		getCameraSwitches: method(object({ deviceId: number() }), CameraSwitchGroupSchema),
+		/**
+		* Flip ONE switch, routed to its existing authority.
+		*
+		* Never writes a parallel map: `recording` patches `RecordingConfig.enabled`
+		* and leaves `bands` byte-identical (clearing bands to express "off"
+		* destroys the operator's authored schedule and turning the camera back on
+		* would silently record nothing), and the two pipeline switches write the
+		* SAME wrapper binding the legacy `pipelineEnabled` / `audioEnabled`
+		* booleans were migrated onto.
+		*
+		* Rejects a switch this camera does not offer rather than persisting a
+		* write nothing reads.
+		*/
+		setCameraSwitch: method(object({
+			deviceId: number(),
+			switchId: CameraSwitchIdSchema,
+			enabled: boolean()
+		}), CameraSwitchGroupSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Server-composed aggregated status for a single camera.
 		*
 		* Fans out in parallel (bounded, per-stage graceful degradation) to
@@ -26391,6 +26976,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.listDeviceMutes": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.listRules": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -26409,6 +27000,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.setDeviceMuted": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.setRuleEnabled": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -26685,6 +27282,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.setTrackFlags": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.wipeAllAnalytics": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -26991,6 +27594,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getCameraSwitches": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getCapabilityBindings": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -27123,6 +27732,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraSwitch": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCapabilityBinding": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -27213,6 +27828,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.runStatelessStep": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"plateGallery.assignPlate": {
 		capName: "plate-gallery",
 		capScope: "system",
@@ -28029,6 +28650,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.acquireEgressTranscode": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.assignProfile": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -28137,6 +28764,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.releaseEgressTranscode": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.releaseStreamWithCodec": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -30942,6 +31575,7 @@ function composeCameraStatus(input) {
 		detection: mapDetection(input.detectionResult),
 		audio: mapAudio(input.audioResult),
 		recording: mapRecording(input.recordingResult),
+		switchedOff: input.switchedOff,
 		fetchedAt: input.fetchedAt
 	};
 }
@@ -31165,12 +31799,23 @@ var CameraStatusService = class {
 			};
 		}), STAGE_TIMEOUT_MS);
 	}
-	/** Audio stage (from cached audio assignment). Orchestrator-local — no remote call needed. */
-	buildAudioStage(audioNodeId) {
-		return audioNodeId ? {
+	/**
+	* Audio stage. `nodeId` is orchestrator-local (the cached assignment);
+	* `enabled` is the REAL `audio-analysis` switch.
+	*
+	* It used to be a hardcoded `true` whenever an audio node was assigned — so
+	* a camera whose operator had turned audio off reported `audio.enabled:
+	* true` and produced nothing, which is indistinguishable from broken. That
+	* is precisely the failure the switch group exists to remove, and leaving
+	* the lie in place would have made the group's own status block disagree
+	* with it.
+	*/
+	buildAudioStage(audioNodeId, switchedOff) {
+		if (audioNodeId === null) return null;
+		return {
 			nodeId: audioNodeId,
-			enabled: true
-		} : null;
+			enabled: !switchedOff.includes("audio-analysis")
+		};
 	}
 	/**
 	* Recording stage (recording cap getStatus). `recording.getStatus` is
@@ -31208,15 +31853,17 @@ var CameraStatusService = class {
 		const decoderFetch = this.buildDecoderStage(detectionNodeId);
 		const motionResult = this.buildMotionStage(deviceId);
 		const detectionFetch = this.buildDetectionStage(api, detectionNodeId, deviceId);
-		const audioResult = this.buildAudioStage(audioNodeId);
 		const recordingFetch = this.buildRecordingStage(api, deviceId);
-		const [sourceResult, brokerResult, decoderResult, detectionResult, recordingResult] = await Promise.all([
+		const switchesFetch = this.boundedStage(this.deps.switchedOffIdsFor(deviceId).catch(() => null), STAGE_TIMEOUT_MS).then((ids) => ids ?? []);
+		const [sourceResult, brokerResult, decoderResult, detectionResult, recordingResult, switchedOff] = await Promise.all([
 			sourceFetch,
 			brokerFetch,
 			decoderFetch,
 			detectionFetch,
-			recordingFetch
+			recordingFetch,
+			switchesFetch
 		]);
+		const audioResult = this.buildAudioStage(audioNodeId, switchedOff);
 		const liveDecoderNodeId = brokerResult !== null ? liveDecoder.nodeId : null;
 		const decoderNodeId = liveDecoderNodeId ?? detectionNodeId;
 		const reasons = {
@@ -31239,7 +31886,8 @@ var CameraStatusService = class {
 			motionResult,
 			detectionResult,
 			audioResult,
-			recordingResult
+			recordingResult,
+			switchedOff
 		});
 	}
 	/**
@@ -31260,6 +31908,195 @@ var CameraStatusService = class {
 	}
 };
 //#endregion
+//#region src/camera-switch-service.ts
+function isDeviceShape(v) {
+	if (v === null || typeof v !== "object") return false;
+	const rec = { ...v };
+	return typeof rec["type"] === "string" && typeof rec["disabled"] === "boolean";
+}
+/** Narrow `recording.getDeviceConfig` to the fields a switch may touch. */
+function isRecordingConfig(v) {
+	if (v === null || typeof v !== "object") return false;
+	const rec = { ...v };
+	return typeof rec["enabled"] === "boolean" && Array.isArray(rec["bands"]);
+}
+var CameraSwitchService = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** The whole group for one camera, derived. */
+	async getCameraSwitches(deviceId) {
+		const { derivation } = await this.gather(deviceId);
+		return {
+			deviceId,
+			switches: deriveCameraSwitches(derivation),
+			fetchedAt: Date.now()
+		};
+	}
+	/**
+	* The ids an operator has switched off, for `CameraStatus.switchedOff`.
+	*
+	* This is what lets a status surface tell DISABLED from BROKEN: a camera
+	* reporting nothing with `['object-detection']` here was turned off; the
+	* same camera with an empty list is failing.
+	*/
+	async switchedOffIdsFor(deviceId) {
+		const { derivation } = await this.gather(deviceId);
+		return switchedOffIds(deriveCameraSwitches(derivation));
+	}
+	/**
+	* Flip one switch and return the RECOMPOSED group, so a client renders what
+	* the server settled on rather than its own optimistic guess.
+	*/
+	async setCameraSwitch(deviceId, switchId, enabled) {
+		const api = this.deps.api();
+		if (!api) throw new Error("camera switches unavailable — the hub api is not wired yet");
+		const state = await this.gather(deviceId);
+		const current = deriveCameraSwitches(state.derivation).find((s) => s.id === switchId);
+		if (!current) throw new Error(`unknown camera switch '${switchId}'`);
+		if (!current.available) {
+			this.deps.logger.warn("camera switch write REFUSED — the switch is not available here", {
+				tags: { deviceId },
+				meta: {
+					switchId,
+					reason: current.unavailableReason
+				}
+			});
+			throw new Error(`camera switch '${switchId}' is not available for device ${deviceId} (${current.unavailableReason})`);
+		}
+		await this.applyWrite(api, deviceId, current, state, enabled);
+		this.deps.logger.info("camera switch changed", {
+			tags: { deviceId },
+			meta: {
+				switchId,
+				enabled,
+				authority: current.authority.kind
+			}
+		});
+		return this.getCameraSwitches(deviceId);
+	}
+	async applyWrite(api, deviceId, current, state, enabled) {
+		const authority = current.authority;
+		switch (authority.kind) {
+			case "device-disabled":
+				await api.deviceManager.setDisabled.mutate({
+					deviceId,
+					disabled: !enabled
+				});
+				return;
+			case "wrapper-binding": {
+				const wrapperAddonId = state.wrapperAddonIdByCap.get(authority.capName);
+				if (wrapperAddonId === void 0) throw new Error(`no wrapper registered for '${authority.capName}' — nothing could apply this switch`);
+				await api.deviceManager.setWrapperActive.mutate({
+					deviceId,
+					capName: authority.capName,
+					wrapperAddonId,
+					active: enabled
+				});
+				return;
+			}
+			case "recording-config": {
+				const config = state.recordingConfig;
+				if (config === null) throw new Error(`recording config unreadable for device ${deviceId} — refusing to write`);
+				await api.recording.setDeviceConfig.mutate({
+					deviceId,
+					config: {
+						...config,
+						enabled
+					}
+				});
+				return;
+			}
+			case "notification-mute":
+				await api.notificationRules.setDeviceMuted.mutate({
+					deviceId,
+					muted: !enabled
+				});
+				return;
+		}
+	}
+	/**
+	* One bounded parallel fan-out over the four authorities. Every branch
+	* degrades to `null` INDEPENDENTLY — one unreachable addon removes its own
+	* switch from the group and leaves the other four usable.
+	*/
+	async gather(deviceId) {
+		const api = this.deps.api();
+		if (!api) return {
+			derivation: {
+				deviceId,
+				deviceDisabled: false,
+				bindableCapNames: null,
+				activeWrapperCapNames: null,
+				recordingEnabled: null,
+				notificationsMuted: null
+			},
+			wrapperAddonIdByCap: /* @__PURE__ */ new Map(),
+			recordingConfig: null
+		};
+		const devicePromise = api.deviceManager.getDevice.query({ deviceId }).then((d) => isDeviceShape(d) ? d : null).catch((err) => {
+			this.warn(deviceId, "getDevice", err);
+			return null;
+		});
+		const bindingsPromise = api.deviceManager.getBindings.query({ deviceId }).then((b) => b.entries.filter((e) => e.kind === "wrapped").map((e) => e.capName)).catch((err) => {
+			this.warn(deviceId, "getBindings", err);
+			return null;
+		});
+		const boundProviderPromise = api.deviceManager.getBindings.query({ deviceId }).then((b) => {
+			const map = /* @__PURE__ */ new Map();
+			for (const e of b.entries) if (e.kind === "wrapped" && e.providerAddonId !== "") map.set(e.capName, e.providerAddonId);
+			return map;
+		}).catch(() => /* @__PURE__ */ new Map());
+		const recordingPromise = api.recording.getDeviceConfig.query({ deviceId }).then((c) => isRecordingConfig(c) ? c : null).catch((err) => {
+			this.warn(deviceId, "recording.getDeviceConfig", err);
+			return null;
+		});
+		const mutesPromise = api.notificationRules.listDeviceMutes.query({}).then((r) => r.mutedDeviceIds).catch((err) => {
+			this.warn(deviceId, "notificationRules.listDeviceMutes", err);
+			return null;
+		});
+		const [device, activeWrapperCapNames, boundProviders, recordingConfig, mutedDeviceIds] = await Promise.all([
+			devicePromise,
+			bindingsPromise,
+			boundProviderPromise,
+			recordingPromise,
+			mutesPromise
+		]);
+		const bindable = device === null ? null : await api.deviceManager.listBindableCapsForDeviceType.query({ deviceType: device.type }).catch((err) => {
+			this.warn(deviceId, "listBindableCapsForDeviceType", err);
+			return null;
+		});
+		const wrapperAddonIdByCap = /* @__PURE__ */ new Map();
+		for (const entry of bindable ?? []) {
+			const first = entry.wrappers[0];
+			const chosen = boundProviders.get(entry.capName) ?? first;
+			if (chosen !== void 0) wrapperAddonIdByCap.set(entry.capName, chosen);
+		}
+		return {
+			derivation: {
+				deviceId,
+				deviceDisabled: device?.disabled ?? false,
+				bindableCapNames: bindable === null ? null : bindable.filter((b) => b.wrappers.length > 0).map((b) => b.capName),
+				activeWrapperCapNames,
+				recordingEnabled: recordingConfig === null ? null : recordingConfig.enabled,
+				notificationsMuted: mutedDeviceIds === null ? null : mutedDeviceIds.includes(deviceId)
+			},
+			wrapperAddonIdByCap,
+			recordingConfig
+		};
+	}
+	warn(deviceId, source, err) {
+		this.deps.logger.warn("camera switch source unreachable — its switch is not offered", {
+			tags: { deviceId },
+			meta: {
+				source,
+				error: errMsg(err)
+			}
+		});
+	}
+};
+//#endregion
 //#region src/apply-device-provisioning.ts
 /**
 * Merge base then override for one step. Override keys win; undefined = inherit.
@@ -36764,6 +37601,10 @@ async function buildOrchestratorControllers(deps) {
 		redispatchAllActiveCameras: (reason) => placement.redispatchAllActiveCameras(reason),
 		clearOnSettingsChange: () => loadShed.clearOnSettingsChange()
 	});
+	const cameraSwitchService = new CameraSwitchService({
+		api: () => deps.ctx().api ?? null,
+		logger: deps.ctx().logger
+	});
 	const cameraStatusService = new CameraStatusService({
 		api: () => deps.ctx().api,
 		getAssignment: (deviceId) => ledger.getAssignment(deviceId),
@@ -36772,7 +37613,8 @@ async function buildOrchestratorControllers(deps) {
 		hasCameraConfig: (deviceId) => ledger.hasConfig(deviceId),
 		getPendingReason: (deviceId) => ledger.getPendingReason(deviceId),
 		assignSource: (deviceId) => topology.assignSource(deviceId),
-		listAssignedDeviceIds: () => ledger.listAssignedDeviceIds()
+		listAssignedDeviceIds: () => ledger.listAssignedDeviceIds(),
+		switchedOffIdsFor: (deviceId) => cameraSwitchService.switchedOffIdsFor(deviceId)
 	});
 	const reconcile = new ReconcileController({
 		api: () => deps.ctx().api ?? null,
@@ -37016,6 +37858,7 @@ async function buildOrchestratorControllers(deps) {
 		session,
 		deviceConfig,
 		cameraStatusService,
+		cameraSwitchService,
 		reconcile,
 		nodeLifecycle,
 		pipelineWatchdog,
@@ -37568,6 +38411,8 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	* the end of `onShutdown`.
 	*/
 	cameraStatusService = null;
+	/** The per-camera function switch group (D61) — see `camera-switch-service.ts`. */
+	cameraSwitchService = null;
 	/**
 	* Device-details aggregator contributions (`getDeviceSettingsContribution`/
 	* `getDeviceLiveContribution`/`applyDeviceSettingsPatch`/
@@ -37751,6 +38596,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		this.session = controllers.session;
 		this.deviceConfig = controllers.deviceConfig;
 		this.cameraStatusService = controllers.cameraStatusService;
+		this.cameraSwitchService = controllers.cameraSwitchService;
 		this.reconcile = controllers.reconcile;
 		this.nodeLifecycle = controllers.nodeLifecycle;
 		this.pipelineWatchdog = controllers.pipelineWatchdog;
@@ -37863,6 +38709,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		this.zonesProvider = null;
 		this.zoneRulesProvider = null;
 		this.cameraStatusService = null;
+		this.cameraSwitchService = null;
 		this.deviceConfig = null;
 		this.settingsStore?.dispose();
 		this.settingsStore = null;
@@ -38517,6 +39364,22 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		return this.settingsStore.deleteTemplate(input);
 	}
 	/**
+	* The per-camera FUNCTION SWITCH group (D61) — derived, never stored.
+	*
+	* Read-only and view-authed: a non-admin must be able to SEE that a camera
+	* is quiet because somebody switched it off.
+	*/
+	async getCameraSwitches(input) {
+		return this.cameraSwitchService.getCameraSwitches(input.deviceId);
+	}
+	/**
+	* Flip one switch, routed to the authority that already owned the function.
+	* Returns the recomposed group so a client never renders its own guess.
+	*/
+	async setCameraSwitch(input) {
+		return this.cameraSwitchService.setCameraSwitch(input.deviceId, input.switchId, input.enabled);
+	}
+	/**
 	* Server-composed aggregated status for a single camera.
 	*
 	* Fans out in parallel (bounded, per-stage graceful degradation) to