@camstack/addon-pipeline-orchestrator 1.2.324 → 1.2.326

package/dist/index.mjs

@@ -5390,7 +5390,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DAX0-2v9.mjs
+//#region ../types/dist/sleep-DRqxtc0C.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8730,6 +8730,10 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
+object({
+	code: string().regex(/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/),
+	params: record(string(), union([string(), number()])).optional()
+});
 /**
 * Promise-based timer helpers — used everywhere the codebase needs to
 * wait, back off, or schedule a retry. Before these helpers landed, each
@@ -8755,7 +8759,7 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 }
 //#endregion
-//#region ../types/dist/err-msg-DX6i_MY4.mjs
+//#region ../types/dist/err-msg-DLerKiVO.mjs
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -9005,6 +9009,22 @@ var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
 	DeviceRole["Nightvision"] = "nightvision";
 	DeviceRole["PrivacyMask"] = "privacy-mask";
 	DeviceRole["Doorbell"] = "doorbell";
+	/** Interior blind / shade / roller blind. HA `device_class: blind|shade`. */
+	DeviceRole["CoverBlind"] = "cover-blind";
+	/** Exterior roller shutter. HA `device_class: shutter`; Homematic BROLL. */
+	DeviceRole["CoverShutter"] = "cover-shutter";
+	/** Exterior awning. HA `device_class: awning`. */
+	DeviceRole["CoverAwning"] = "cover-awning";
+	/** Curtain / drape. HA `device_class: curtain`. */
+	DeviceRole["CoverCurtain"] = "cover-curtain";
+	/** Garage door. HA `device_class: garage`. A security actuator: exports gate it. */
+	DeviceRole["CoverGarage"] = "cover-garage";
+	/** Gate. HA `device_class: gate`. A security actuator: exports gate it. */
+	DeviceRole["CoverGate"] = "cover-gate";
+	/** Door. HA `device_class: door`. A security actuator: exports gate it. */
+	DeviceRole["CoverDoor"] = "cover-door";
+	/** Window. HA `device_class: window`. */
+	DeviceRole["CoverWindow"] = "cover-window";
 	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
 	*  real Switch device for UI rendering / export adapters. */
 	DeviceRole["BinaryHelper"] = "binary-helper";
@@ -9085,7 +9105,7 @@ function errMsg$2(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-C-WpVYTX.mjs
+//#region ../types/dist/composition-EQ9Ok0Ee.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -12750,11 +12770,10 @@ var ClipModelMetaSchema = object({
 	/**
 	* The `vector-store` index this model's vectors live in. ONE feature space
 	* per index: two models share an index only when their vectors are ranked
-	* against each other, which for CLIP means never across families. MobileCLIP
-	* S1 and S2 share `object-clip` for history (separated by the row's
-	* `modelId`); any other model gets its own.
+	* against each other, which for CLIP means never across families. Every
+	* model gets its own.
 	*/
-	vectorIndex: string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	vectorIndex: string().regex(/^object-clip-[a-z0-9][a-z0-9-]*$/),
 	/**
 	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
 	* must be unique per tokenizer: every model's siblings land in ONE flat
@@ -13223,7 +13242,8 @@ var ConvertResultSchema = object({
 	})).readonly()
 });
 _enum(["new-session", "step-up"]);
-_enum(["en", "it"]);
+/** The languages the hub's app landing pages are written in (D858). */
+var AppPageLangSchema = _enum(["en", "it"]);
 /** How a native app starts one login method (D858), as `auth.listLoginMethods` reports it. */
 var AppLoginPathSchema = discriminatedUnion("kind", [object({ kind: literal("native") }), object({
 	kind: literal("browser"),
@@ -13720,7 +13740,9 @@ var ConfigTabDeclarationSchema = object({
 var ConfigSectionWithValuesSchema = object({
 	id: string(),
 	title: string(),
+	titleKey: string().optional(),
 	description: string().optional(),
+	descriptionKey: string().optional(),
 	style: _enum(["card", "accordion"]).optional(),
 	defaultCollapsed: boolean().optional(),
 	columns: union([
@@ -17003,6 +17025,9 @@ method(object({
 }), method(object({ refs: RefListSchema }), KeychainResolveResultSchema, { auth: "admin" }), method(object({ refs: RefListSchema }), object({ deleted: number().int() }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ deviceId: number().int() }), object({ refs: array(string()).readonly() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({}), array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }), method(object({}), KeychainStateSchema, { auth: "admin" });
 /**
 * device-history — the ONE mechanism for numeric history (D850).
@@ -38406,6 +38431,38 @@ var DeviceRegisterPayloadSchema = object({
 	*  omits it and the keyword backstop applies. */
 	secretConfigPaths: array(string()).optional()
 });
+/** One deleted device, kept by device-manager so an addon that missed the
+*  deletion can still learn of it (D865). Written by the delete path ONLY. */
+var DeviceTombstoneSchema = object({
+	deviceId: number().int().positive(),
+	/** Epoch ms the device was deleted. */
+	deletedAt: number(),
+	/** The addon that owned the device when it was deleted. */
+	providerAddonId: string()
+});
+/** Data held for one device that device-manager no longer knows. */
+var OrphanDeviceDataSchema = object({
+	deviceId: number().int().positive(),
+	/** Rows/files per store (`<addonId>:<store>`). */
+	stores: record(string(), number().int().nonnegative())
+});
+var CleanupDeletedDevicesResultSchema = object({
+	/**
+	* `skipped` — the absence check could not be trusted (a device-list read
+	* failed or the two reads disagreed); nothing was listed or deleted.
+	* `dry-run` — `devices` is what a confirmed run would delete.
+	* `cleaned` — `devices` is what was deleted.
+	*/
+	status: _enum([
+		"skipped",
+		"dry-run",
+		"cleaned"
+	]),
+	reason: string().nullable(),
+	devices: array(OrphanDeviceDataSchema),
+	/** Implementers that could not be asked (their stores are not in `devices`). */
+	unreachable: array(string())
+});
 var DeviceRemovePayloadSchema = object({ deviceId: number() });
 var DevicePersistConfigPayloadSchema = object({
 	deviceId: number(),
@@ -38644,6 +38701,9 @@ method(object({
 }), method(object({ deviceId: number() }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ sinceMs: number() }), array(DeviceTombstoneSchema).readonly(), { auth: "admin" }), method(object({ confirm: boolean() }), CleanupDeletedDevicesResultSchema, {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ integrationId: string() }), object({ removed: number() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -39106,6 +39166,72 @@ method(object({
 	auth: "admin"
 });
 /**
+* `device-removal-hook` — the reliable way an addon learns a device was DELETED,
+* so it can delete what it keeps for that device (D865).
+*
+* ## Why an event was not enough
+*
+* `DeviceUnregistered` is telemetry and may be dropped (D8, D11). An addon that
+* hung its per-device clean-up on it left durable garbage whenever the event was
+* lost, the addon was down, or it was restarting at that moment — footage,
+* analytics rows and settings of device 4483 outlived the device. Loss of this
+* signal corrupts durable state, so it travels by RPC with a recorded fact
+* behind it (D8: "if loss would corrupt durable state, use RPC plus a reconcile").
+*
+* ## The three pieces
+*
+* 1. device-manager records a TOMBSTONE per deleted device
+*    (`deviceManager.listDeletedSince`). The tombstone is written by the delete
+*    path only — a device that is unregistered, offline or whose provider is
+*    restarting is NOT deleted and gets none.
+* 2. After a delete, device-manager calls `onDeviceRemoved` on EVERY provider of
+*    this collection, one by one, with bounded retries, logged.
+* 3. An implementer that was down asks `deviceManager.listDeletedSince` at start
+*    (and periodically) and runs its own `onDeviceRemoved` for each tombstone it
+*    may have missed. Reconcile is driven by tombstones, never by "the device is
+*    not in the current list": a failed or partial list read must not destroy data.
+*
+* ## Contract for an implementer
+*
+* - **Idempotent.** It is called again by a retry, by a reconcile and by the
+*   admin cleanup of data that predates tombstones. A device with nothing left
+*   answers zero counts.
+* - **One key per store** in `counts`, deleted rows/files per store, so the log
+*   line and the admin dry run can say where the data was.
+* - **Training datasets are NOT device data** and are never deleted by a hook.
+* - **Per-device SETTINGS are not hooked.** Configuration lives in the standard
+*   per-device store (`ctx.settings.*DeviceStore`), which device-manager clears
+*   for every addon centrally at delete time. This hook is for device DATA
+*   that is not settings: footage, event media, analytics rows, history.
+* - A provider that cannot tell is allowed to throw; the caller retries it.
+*
+* `listDeviceData` is the read side of the admin "Clean data of deleted devices"
+* action: which device ids this addon holds data for, and how much per store. It
+* never deletes. device-manager decides which of those ids are absent from the
+* fleet, from TWO consistent reads of the device list (D49).
+*/
+/** What a hook is told about the deletion. */
+var DeviceRemovedInputSchema = object({
+	deviceId: number().int().positive(),
+	/** Epoch ms the device was deleted (the tombstone's `deletedAt`). */
+	deletedAt: number(),
+	/** The addon that owned the device, as device-manager last knew it. */
+	providerAddonId: string()
+});
+/** Rows/files/refs deleted, per store this implementer owns. */
+var DeviceRemovedResultSchema = object({ counts: record(string(), number().int().nonnegative()) });
+/** One (store, device) pair an implementer holds data for. */
+var DeviceDataEntrySchema = object({
+	store: string(),
+	deviceId: number().int().positive(),
+	/** Rows (or files) held for the device in the store. */
+	count: number().int().nonnegative()
+});
+method(DeviceRemovedInputSchema, DeviceRemovedResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), array(DeviceDataEntrySchema).readonly(), { auth: "admin" });
+/**
 * `failure-contribution` — the capability an addon reports its OWN losses
 * through, per camera, with the denominator attached. It stores nothing.
 *
@@ -56575,7 +56701,19 @@ var TlsStatusSchema = object({
 	sans: array(string()),
 	caCertPem: string().nullable(),
 	reissueError: string().nullable(),
-	restartRequired: boolean()
+	restartRequired: boolean(),
+	/** An uploaded certificate is served but no CA is kept for it and it is not publicly signed (D873). */
+	caMissing: boolean(),
+	/** Does the hub's own generated CA carry a critical name constraint? `null` while it has none. */
+	localCaConstrained: boolean().nullable(),
+	/** ISO time the generated CA was replaced by a constrained one; devices must re-download it. */
+	caReplacedAt: string().nullable(),
+	/** The uploaded certificate kept on disk, selectable again after "Revert to generated". */
+	storedUpload: object({
+		leafFingerprintSha256: string(),
+		validTo: string(),
+		hasCa: boolean()
+	}).nullable()
 });
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
 	/**
@@ -56631,6 +56769,9 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 }), method(_void(), object({ pem: string() })), method(_void(), TlsStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(_void(), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
 });
 object({
 	/** Lifecycle state of the lock. `jammed` means the motor reported
@@ -64674,6 +64815,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.cleanupDeletedDevicesData": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.createDevice": {
 		capName: "device-manager",
 		capScope: "system",
@@ -64854,6 +65001,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.listDeletedSince": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.listDeviceIdsByCaps": {
 		capName: "device-manager",
 		capScope: "system",
@@ -65262,6 +65415,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceRemovalHook.listDeviceData": {
+		capName: "device-removal-hook",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceRemovalHook.onDeviceRemoved": {
+		capName: "device-removal-hook",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceState.claimFields": {
 		capName: "device-state",
 		capScope: "system",
@@ -65694,6 +65859,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"keychain.deleteDeviceScope": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"keychain.getState": {
 		capName: "keychain",
 		capScope: "system",
@@ -66132,6 +66303,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.useStoredUploadedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.getStatus": {
 		capName: "lock-control",
 		capScope: "device",
@@ -71734,6 +71911,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceRemovalHook.onDeviceRemoved": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceState.claimFields": [{
 		name: "deviceId",
 		form: "single",
@@ -71923,6 +72105,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"keychain.deleteDeviceScope": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"lawnMowerControl.dock": [{
 		name: "deviceId",
 		form: "single",
@@ -74271,6 +74458,8 @@ new Set([
 	"audio-tools",
 	"audio-silence"
 ]);
+AppPageLangSchema.options;
+record(string().min(1), string());
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -74549,7 +74738,11 @@ var REMOVED_MODEL_IDS = {
 	"face-embedding": ["arcface-r100", "inception-resnet-v1"],
 	"plate-detection": ["yolov8n-plate"],
 	"plate-ocr": ["vgg-english-g2"],
-	"clip-embedding": ["mobileclip-s1", "mobileclip-s2"],
+	"clip-embedding": [
+		"mobileclip-s0",
+		"mobileclip-s1",
+		"mobileclip-s2"
+	],
 	"package-detection": ["yolov8n-package"],
 	"bird-classifier": ["bird-classifier-aiy-edgetpu", "bird-nabirds-404"],
 	"animal-classifier": ["animals-10"],
@@ -75972,6 +76165,25 @@ var DETAIL_CROP_PADDING_FIELD = {
 	default: DEFAULT_DETAIL_CROP_CONVENTION.paddingRatio
 };
 /**
+* The cadence of the automatic whole-archive face rescore (D866).
+*
+* One cluster-wide knob in `pipeline-orchestrator`'s GLOBAL settings, read by
+* `pipeline-analytics` over the hub-routed `addon-settings` cap on every tick.
+* It lives here for the same reason the detail-crop convention does: the
+* writer (orchestrator) and the reader (analytics) are different addons, they
+* never import each other, and a key copied by hand is how a setting silently
+* stops arriving.
+*/
+var FACE_RESCORE_SECTION_ID = "face-rescore";
+var FACE_RESCORE_INTERVAL_KEY = "faceRescoreIntervalMinutes";
+/** Slider bounds. `0` is "disabled"; anything in 1..9 is raised to `min`. */
+var FACE_RESCORE_INTERVAL_FIELD = {
+	min: 0,
+	max: 1440,
+	step: 5,
+	default: 60
+};
+/**
 * THE native-frame **lease** knobs — hold depth, RAM budget, demand window and
 * subject-tile budget for the decode worker's native-resolution retention.
 *
@@ -76427,6 +76639,22 @@ var DurableLedger = class DurableLedger {
 		}
 	}
 	/**
+	* Drop every MIRRORED row about `deviceId` (per the spec's `deviceIdOf`),
+	* leaving the durable rows to the caller's `deleteWhere` (D871). Returns how
+	* many mirror entries went; a spec without `deviceIdOf` evicts nothing.
+	*/
+	evictDevice(deviceId) {
+		const of = this.spec.deviceIdOf;
+		if (of === void 0) return 0;
+		let evicted = 0;
+		for (const [key, row] of [...this.mirror.entries()]) {
+			if (of(row) !== deviceId) continue;
+			this.mirror.delete(key);
+			evicted += 1;
+		}
+		return evicted;
+	}
+	/**
 	* Drop every mirrored key NOT in `activeKeys`. Returns how many rows went.
 	*
 	* **The caller must hold an AUTHORITATIVE active set.** A prune driven by a
@@ -83735,67 +83963,20 @@ function buildRunnerConfig(base, overrides) {
 		preRollInferenceFrames: config.preRollInferenceFrames
 	};
 }
-var DEVICE_FEATURES_SPEC = {
-	collection: "pipeline-orchestrator:device-features",
-	columns: [
-		{
-			name: "deviceId",
-			type: "TEXT",
-			primaryKey: true,
-			notNull: true
-		},
-		(
-		/** The feature name list, verbatim. */
-		{
-			name: "features",
-			type: "JSON",
-			notNull: true
-		}),
-		{
-			name: "updatedAt",
-			type: "INTEGER",
-			notNull: true
-		}
-	],
-	writeMode: "write-behind",
-	keyOf: (row) => String(row.deviceId),
-	toValue: (row) => ({
-		features: [...row.features],
-		updatedAt: row.updatedAt
-	}),
-	fromRecord: (key, data) => {
-		const deviceId = Number(key);
-		const raw = data["features"];
-		if (!Number.isFinite(deviceId) || !Array.isArray(raw)) return null;
-		const features = raw.filter((f) => typeof f === "string");
-		if (features.length === 0) return null;
-		const updatedAt = Number(data["updatedAt"]);
-		return {
-			deviceId,
-			features,
-			updatedAt: Number.isFinite(updatedAt) ? updatedAt : 0,
-			restored: true
-		};
-	},
-	deviceIdOf: (row) => row.deviceId
-};
+//#endregion
+//#region src/device-features-mirror.ts
+/** The per-device settings key a device's mirrored features live under. */
+var DEVICE_FEATURES_KEY = "deviceFeatures";
 var DeviceFeaturesMirror = class {
 	/** Process-local fallback, used only when no store was supplied. */
 	local = /* @__PURE__ */ new Map();
-	durable;
+	settings;
 	logger;
 	now;
 	constructor(deps) {
 		this.logger = deps.logger;
 		this.now = deps.now ?? (() => Date.now());
-		this.durable = deps.store === void 0 ? null : new DurableLedger({
-			spec: DEVICE_FEATURES_SPEC,
-			store: deps.store,
-			logger: deps.logger
-		});
-	}
-	static declare(store) {
-		return DurableLedger.declare(store, DEVICE_FEATURES_SPEC);
+		this.settings = deps.settings ?? null;
 	}
 	/**
 	* Seed the mirror from the last session. Call once at boot, after `declare`
@@ -83803,13 +83984,29 @@ var DeviceFeaturesMirror = class {
 	* already there when the first read fails.
 	*/
 	async hydrate() {
-		if (this.durable === null) return 0;
-		const rows = await this.durable.load();
-		this.logger.info("device-features mirror restored", { meta: { devices: rows.length } });
-		return rows.length;
+		const settings = this.settings;
+		if (settings === null) return 0;
+		const list = settings.listDeviceStoreIds;
+		if (list !== void 0) {
+			const ids = await list.call(settings);
+			const batch = settings.readDeviceStoreBatch;
+			const blobs = batch === void 0 ? new Map(await Promise.all(ids.map(async (id) => [id, await settings.readDeviceStore(id)]))) : await batch.call(settings, ids);
+			for (const [deviceId, blob] of blobs) {
+				const row = rowOf(deviceId, blob[DEVICE_FEATURES_KEY]);
+				if (row !== null) this.local.set(deviceId, row);
+			}
+		}
+		this.logger.info("device-features mirror restored", { meta: { devices: this.local.size } });
+		return this.local.size;
 	}
 	held(deviceId) {
-		return this.durable === null ? this.local.get(deviceId) : this.durable.get(String(deviceId));
+		return this.local.get(deviceId);
+	}
+	async persist(deviceId, features, updatedAt) {
+		await this.settings?.writeDeviceStore(deviceId, { [DEVICE_FEATURES_KEY]: {
+			features: [...features],
+			updatedAt
+		} });
 	}
 	remember(deviceId, features) {
 		const row = {
@@ -83818,20 +84015,19 @@ var DeviceFeaturesMirror = class {
 			updatedAt: this.now(),
 			restored: false
 		};
-		if (this.durable === null) {
-			this.local.set(deviceId, row);
-			return;
-		}
-		const held = this.durable.get(String(deviceId));
+		const held = this.local.get(deviceId);
+		this.local.set(deviceId, row);
 		if (held !== void 0 && !held.restored && sameFeatures(held.features, features)) return;
-		this.durable.put(row);
+		this.persist(deviceId, features, row.updatedAt).catch((err) => {
+			this.logger.warn("device-features mirror not persisted", {
+				tags: { deviceId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+		});
 	}
 	drop(deviceId) {
-		if (this.durable === null) {
-			this.local.delete(deviceId);
-			return;
-		}
-		this.durable.forget(String(deviceId));
+		this.local.delete(deviceId);
+		this.settings?.writeDeviceStore(deviceId, { [DEVICE_FEATURES_KEY]: void 0 });
 	}
 	/**
 	* Resolve a device's features, preferring a fresh read but never letting a
@@ -83880,7 +84076,7 @@ var DeviceFeaturesMirror = class {
 		this.drop(deviceId);
 		return [];
 	}
-	/** Drop a device's mirror — call when the device is removed. */
+	/** Drop a device's mirror. (A removed device's settings are cleared centrally, D865.) */
 	forget(deviceId) {
 		this.drop(deviceId);
 	}
@@ -83891,6 +84087,20 @@ function sameFeatures(a, b) {
 	const held = new Set(a);
 	return b.every((f) => held.has(f));
 }
+function rowOf(deviceId, raw) {
+	if (typeof raw !== "object" || raw === null) return null;
+	const features = Reflect.get(raw, "features");
+	if (!Array.isArray(features)) return null;
+	const kept = features.filter((f) => typeof f === "string");
+	if (kept.length === 0) return null;
+	const updatedAt = Number(Reflect.get(raw, "updatedAt"));
+	return {
+		deviceId,
+		features: kept,
+		updatedAt: Number.isFinite(updatedAt) ? updatedAt : 0,
+		restored: true
+	};
+}
 //#endregion
 //#region src/onboard-forwarding-reconcile.ts
 /** The `detectionSources` member that means "this camera's own firmware". */
@@ -84049,9 +84259,10 @@ var DetectionWiringController = class {
 	featuresMirror;
 	constructor(deps) {
 		this.deps = deps;
+		const settings = deps.persistFeatures === true ? deps.ctx().settings : void 0;
 		this.featuresMirror = new DeviceFeaturesMirror({
 			logger: deps.logger,
-			...deps.featuresStore !== void 0 ? { store: deps.featuresStore } : {}
+			...settings !== void 0 ? { settings } : {}
 		});
 	}
 	/**
@@ -84060,8 +84271,7 @@ var DetectionWiringController = class {
 	* that would have needed it.
 	*/
 	async hydrateFeaturesMirror() {
-		if (this.deps.featuresStore === void 0) return;
-		await DeviceFeaturesMirror.declare(this.deps.featuresStore);
+		if (this.deps.persistFeatures !== true) return;
 		await this.featuresMirror.hydrate();
 	}
 	/** `activeDetections.get(deviceId)`. */
@@ -87442,25 +87652,33 @@ var NodeStressController = class NodeStressController {
 //#region src/durable/lts-aggregator.ts
 /** Wall-clock bucket width. Five minutes, matching HA's statistics tier. */
 var LTS_BUCKET_MS = 5 * 6e4;
+/** Buckets written per transaction — bounds one statement, not the flush. */
+var FLUSH_BATCH = 200;
 /** How often the row cap is enforced. Rarely: it is a bound, not a deadline. */
 var CAP_SWEEP_INTERVAL_MS = 6 * 36e5;
+/**
+* The row's identity IS its four key columns (D871): a composite
+* `primaryKey` + `WITHOUT ROWID`, so the table is its own index and there is no
+* TEXT `id` repeating what the row already says. The old layout kept
+* `<subject>|<series>|<scope>|<bucketStart>` as a TEXT primary key beside the
+* four columns — 85 MB of rows plus a 44 MB autoindex for 1.07 M rows. A
+* composite-key collection is written with `upsertMany` (a bucket flushed twice
+* replaces itself) and read with `query` / `count` / `deleteWhere`; the calls
+* that address one row by id are refused by the engine.
+*/
+var LTS_KEY_COLUMNS = [
+	"subject",
+	"series",
+	"scope",
+	"bucketStart"
+];
 var LTS_COLUMNS = [
-	(
-	/** `<subject>|<series>|<scope>|<bucketStart>` — deterministic, so a bucket
-	*  flushed twice replaces itself rather than doubling. */
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	}),
 	(
 	/** The camera id, or the node id. One column, because every query is
 	*  "this thing over time" and the thing is one or the other. */
 	{
 		name: "subject",
-		type: "TEXT",
-		notNull: true
+		type: "TEXT"
 	}),
 	(
 	/** Numeric mirror of `subject` for camera rows, so a per-camera question is
@@ -87472,22 +87690,19 @@ var LTS_COLUMNS = [
 	}),
 	{
 		name: "series",
-		type: "TEXT",
-		notNull: true
+		type: "TEXT"
 	},
 	(
 	/** Sub-scope within a series: a zoneId for occupancy, `''` otherwise. */
 	{
 		name: "scope",
-		type: "TEXT",
-		notNull: true
+		type: "TEXT"
 	}),
 	(
 	/** Bucket start, wall-clock aligned to {@link LTS_BUCKET_MS}. */
 	{
 		name: "bucketStart",
-		type: "INTEGER",
-		notNull: true
+		type: "INTEGER"
 	}),
 	{
 		name: "samples",
@@ -87510,12 +87725,15 @@ var LTS_COLUMNS = [
 		notNull: true
 	}
 ];
+/**
+* The primary key serves every per-subject read (`subject, series, scope` then a
+* `bucketStart` range, already in bucket order); this index serves the read that
+* names a series without a subject. The old `deviceId` index went with the TEXT
+* id: nothing queries a series by the numeric mirror.
+*/
 var LTS_INDEXES = [{
 	name: "idx_lts_series_bucket",
 	columns: ["series", "bucketStart"]
-}, {
-	name: "idx_lts_device",
-	columns: ["deviceId"]
 }];
 function ltsBucketStart(at, bucketMs = LTS_BUCKET_MS) {
 	return Math.floor(at / bucketMs) * bucketMs;
@@ -87544,6 +87762,8 @@ var LtsAggregator = class {
 		return store.declareCollection.mutate({
 			collection,
 			columns: [...LTS_COLUMNS],
+			primaryKey: [...LTS_KEY_COLUMNS],
+			withoutRowid: true,
 			indexes: [...LTS_INDEXES]
 		});
 	}
@@ -87603,43 +87823,60 @@ var LtsAggregator = class {
 			return 0;
 		}
 		let written = 0;
-		for (const bucket of due) {
-			const key = rowId(bucket.subject, bucket.series, bucket.scope, bucket.bucketStart);
-			try {
-				await this.store.set.mutate({
-					collection: this.collection,
-					key,
-					value: {
-						subject: bucket.subject,
-						...bucket.deviceId !== void 0 ? { deviceId: bucket.deviceId } : {},
-						series: bucket.series,
-						scope: bucket.scope,
-						bucketStart: bucket.bucketStart,
-						samples: bucket.samples,
-						sum: bucket.sum,
-						min: bucket.min,
-						max: bucket.max
-					}
-				});
-				written += 1;
-				this.groups.add(groupKey(bucket.subject, bucket.series, bucket.scope));
-			} catch (err) {
-				this.logger.warn("lts bucket write failed — this interval will be missing", {
-					...bucket.deviceId !== void 0 ? { tags: { deviceId: bucket.deviceId } } : {},
-					meta: {
-						collection: this.collection,
-						series: bucket.series,
-						subject: bucket.subject,
-						bucketStart: bucket.bucketStart,
-						error: String(err)
-					}
-				});
-			}
-			this.open.delete(key);
+		for (const batch of chunk(due, FLUSH_BATCH)) {
+			written += await this.writeBatch(batch);
+			for (const bucket of batch) this.open.delete(rowId(bucket.subject, bucket.series, bucket.scope, bucket.bucketStart));
 		}
 		await this.maybeSweepCap(now);
 		return written;
 	}
+	/**
+	* Upsert one batch in a single transaction. If the batch is refused as a
+	* whole (all-or-nothing), each bucket is retried alone so one bad row costs
+	* one interval, not forty. Returns the number of rows written.
+	*/
+	async writeBatch(batch) {
+		try {
+			await this.upsert(batch);
+			for (const bucket of batch) this.groups.add(groupKey(bucket.subject, bucket.series, bucket.scope));
+			return batch.length;
+		} catch (err) {
+			if (batch.length > 1) {
+				let written = 0;
+				for (const bucket of batch) written += await this.writeBatch([bucket]);
+				return written;
+			}
+			const bucket = batch[0];
+			this.logger.warn("lts bucket write failed — this interval will be missing", {
+				...bucket?.deviceId !== void 0 ? { tags: { deviceId: bucket.deviceId } } : {},
+				meta: {
+					collection: this.collection,
+					series: bucket?.series,
+					subject: bucket?.subject,
+					bucketStart: bucket?.bucketStart,
+					error: String(err)
+				}
+			});
+			return 0;
+		}
+	}
+	async upsert(batch) {
+		await this.store.upsertMany.mutate({
+			collection: this.collection,
+			conflict: [...LTS_KEY_COLUMNS],
+			records: batch.map((bucket) => ({ data: {
+				subject: bucket.subject,
+				deviceId: bucket.deviceId ?? null,
+				series: bucket.series,
+				scope: bucket.scope,
+				bucketStart: bucket.bucketStart,
+				samples: bucket.samples,
+				sum: bucket.sum,
+				min: bucket.min,
+				max: bucket.max
+			} }))
+		});
+	}
 	/** Read closed buckets back. The read surface every chart will use. */
 	async read(query = {}) {
 		const where = {};
@@ -87724,6 +87961,11 @@ var LtsAggregator = class {
 		}
 	}
 };
+function chunk(items, size) {
+	const out = [];
+	for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));
+	return out;
+}
 function groupKey(subject, series, scope) {
 	return `${subject}${series}${scope}`;
 }
@@ -87782,7 +88024,7 @@ function recordToRow(data) {
 *   write="one row per (node, series, 5-min bucket), written ONCE when the bucket closes; a node reporting no samples writes nothing"
 *   retention="row CAP per (subject, series, scope) — 105,120 rows ≈ one year of 5-minute buckets. Not an age sweep: an LTS row summarises an interval and has no owner to be orphaned from."
 */
-var NODE_STRESS_LTS_COLLECTION = "pipeline-orchestrator:stats-5m";
+var NODE_STRESS_LTS_COLLECTION = "pipeline-orchestrator:stats-5m-v2";
 var NodeStressLts = class {
 	lts;
 	constructor(deps) {
@@ -94359,7 +94601,7 @@ async function buildOrchestratorControllers(deps) {
 	reconcile.scheduleReconcile();
 	const detectionWiring = new DetectionWiringController({
 		ctx: () => deps.ctx(),
-		featuresStore: deps.ctx().api.settingsStore,
+		persistFeatures: true,
 		ledger,
 		placement,
 		audio,
@@ -94579,6 +94821,24 @@ function buildGlobalSettingsSections(options) {
 				default: DEFAULT_DETAIL_CROP_CONVENTION.square
 			}]
 		},
+		{
+			id: FACE_RESCORE_SECTION_ID,
+			title: "Face suggestions",
+			tab: "pipeline",
+			description: "How often the people suggestions on unassigned faces are refreshed against the current gallery. The job only runs when the gallery or the set of unassigned faces changed since the last run; otherwise it does nothing.",
+			fields: [{
+				key: FACE_RESCORE_INTERVAL_KEY,
+				type: "slider",
+				label: "Suggestion refresh interval",
+				description: "0 = off (use the Recompute suggestions button). Values from 1 to 9 run every 10 minutes. The first run happens one interval after the addon starts.",
+				min: FACE_RESCORE_INTERVAL_FIELD.min,
+				max: FACE_RESCORE_INTERVAL_FIELD.max,
+				step: FACE_RESCORE_INTERVAL_FIELD.step,
+				default: FACE_RESCORE_INTERVAL_FIELD.default,
+				showValue: true,
+				unit: "min"
+			}]
+		},
 		{
 			id: NATIVE_LEASE_SECTION_ID,
 			title: "Native frame lease",