@camstack/addon-pipeline 1.2.132 → 1.2.133

package/dist/{dist-BZYUUBUx.mjs → dist-7Uc6NdFm.mjs}

@@ -8471,6 +8471,74 @@ var OpsLogQueryInputSchema = object({
 	/** Max rows returned, newest-first. */
 	limit: number().int().min(1).max(1e3).optional()
 });
+var LabelDefinitionSchema = object({
+	id: string(),
+	name: string(),
+	category: string().optional(),
+	description: string().optional(),
+	icon: string().optional()
+});
+/** Detection-macro targets a catalog `classMap` may resolve to. */
+var CLASS_MAP_MACRO_TARGETS = [
+	"person",
+	"vehicle",
+	"animal",
+	"package"
+];
+/**
+* Le macro classi di PRIMO LIVELLO: quelle che un object detector emette e che
+* un operatore può selezionare.
+*
+* Sono le tre offerte dallo step `object-detection`
+* (`addon-pipeline/src/detection-pipeline/registry/step-definitions.ts`,
+* `enabledMacroClasses`). `package` sta in {@link CLASS_MAP_MACRO_TARGETS} e in
+* `MACRO_LABELS` — è una macro vera — ma NON qui: appartiene allo step
+* `package-detection`, la cui abilitazione è guidata dalle zone, e offrire la
+* stessa parola due volte ha già fatto accendere a un operatore il proxy COCO
+* (suitcase/backpack/handbag) lasciando spento il detector dedicato.
+*
+* UNA lista. Prima di oggi le stesse tre erano scritte a mano nell'offerta
+* dello step e una seconda volta come union `FirstLevelMacro`
+* (`types/detection.ts`); una terza copia per il trigger di registrazione
+* (`RecordingTriggers.objectClasses`) avrebbe reso invisibile la divergenza
+* successiva.
+*/
+var FIRST_LEVEL_MACRO_CLASSES = [
+	"person",
+	"vehicle",
+	"animal"
+];
+/**
+* True quando `value` è una macro di primo livello. Type guard, non cast: un
+* `className` che arriva dal bus è una stringa qualunque finché non passa di
+* qui.
+*/
+function isFirstLevelMacroClass(value) {
+	return FIRST_LEVEL_MACRO_CLASSES.some((macro) => macro === value);
+}
+/**
+* Wire schema for a per-model CATALOG classMap override
+* (`ModelCatalogEntry.classMap` / `ModelConvertMetadata.classMap`) —
+* restricted to {@link CLASS_MAP_MACRO_TARGETS}, the only macros the
+* detection pipeline executor actually routes.
+*
+* This is deliberately a DIFFERENT, narrower shape than the general-purpose
+* `ClassMapDefinition` interface above (e.g. `IDetectionAddon.getClassMap()`
+* and the audio `YAMNET_TO_MACRO` catalog both use macro targets outside this
+* enum) — the two used to share the name `ClassMapDefinition`/
+* `ClassMapDefinitionSchema`, which made the schema-type-twin guard
+* (`scripts/check-schema-type-twins.ts`) flag them as a duplicated shape. They
+* are not: it is two different concepts colliding on a name. Keep this type
+* under its own name rather than reusing `ClassMapDefinition` — reusing it
+* would either narrow every `ClassMapDefinition` consumer to the four
+* detection macros (breaking `YAMNET_TO_MACRO`) or drop the validation this
+* schema exists for (see the "rejects a classMap whose target is not a
+* detection macro" test in `model-catalog-schema.test.ts`).
+*/
+var DetectionCatalogClassMapSchema = object({
+	mapping: record(string(), _enum(CLASS_MAP_MACRO_TARGETS)),
+	preserveOriginal: boolean()
+});
 /**
 * THE canonical event-clip pad: the time window a single-timestamp analytics
 * event expands to when joined with footage (clip window = `[timestamp - preMs,
@@ -8512,10 +8580,55 @@ var RecordingStorageModeSchema = _enum([
 	"events",
 	"continuous"
 ]);
+/**
+* Le macro classi che possono aprire una finestra di registrazione — le stesse
+* tre offerte dallo step `object-detection`, da UNA lista
+* ({@link FIRST_LEVEL_MACRO_CLASSES}).
+*/
+var RecordingObjectTriggerClassSchema = _enum(FIRST_LEVEL_MACRO_CLASSES);
+/**
+* True quando `values` non ripete un elemento.
+*
+* Un duplicato non è innocuo: ogni voce di `objectClasses` / `sensorDeviceIds`
+* diventa una SORGENTE in `bandTriggerSources`, e la stessa sorgente due volte
+* conterebbe due volte le sue finestre in `segmentMissedByMs`.
+*/
+var noDuplicates = (values) => new Set(values).size === values.length;
 /** Which detectors trigger an `events`-mode band. */
 var RecordingTriggersSchema = object({
 	motion: boolean().optional(),
-	audioThresholdDbfs: number().optional()
+	audioThresholdDbfs: number().optional(),
+	/**
+	* Le macro classi la cui detection apre una finestra. ASSENTE = la sorgente
+	* non è ascoltata; un array VUOTO è rifiutato, perché "banda events, trigger
+	* object acceso, nessuna classe" è la stessa forma "abilitata e non registra
+	* nulla, per sempre" contro cui è scritto `eventsBandCanEverDemand`.
+	*
+	* Il segnale letto è GIÀ FILTRATO: solo detection `source: 'pipeline'`, cioè
+	* quelle che hanno attraversato `enabledMacroClasses`, i
+	* `minConfidence<Macro>` e il full-frame guard. L'AI a bordo camera
+	* (`source: 'onboard'`) non attraversa nessuno di quei gate e NON apre
+	* finestre — vedi `recorder/object-trigger.ts`.
+	*/
+	objectClasses: array(RecordingObjectTriggerClassSchema).min(1).refine(noDuplicates, { message: "objectClasses must not repeat a class" }).optional(),
+	/**
+	* I device LINKED il cui FRONTE ALTO apre una finestra. Assente = la sorgente
+	* non è ascoltata; un array vuoto è rifiutato per la stessa ragione di
+	* `objectClasses`.
+	*
+	* Sono id di device SORGENTE, non camere: la banda li nomina, quindi il
+	* percorso caldo (`DeviceStateChanged`, a ritmo di bus su tutta la flotta)
+	* non fa RPC. L'OFFERTA da cui l'operatore li sceglie è un'altra domanda, e
+	* si risolve con `deviceManager.getLinkedDevices` + `getBindingsBatch` per
+	* device (D12) — mai un elenco globale di cap.
+	*
+	* Cosa vuol dire "alto" dipende dal TIPO di device e non è deciso qui:
+	* `SOURCE_CAP_ACTIVE_FIELD` (`catalogs/sensor-active-state.ts`) è LA tabella,
+	* la stessa che il virtual-doorbell usa dal 2026-08-05. Ed è il FRONTE, non
+	* il livello: un contatto trovato già aperto al riavvio del runner non fa
+	* registrare.
+	*/
+	sensorDeviceIds: array(number().int().positive()).min(1).max(16).refine(noDuplicates, { message: "sensorDeviceIds must not repeat a device" }).optional()
 });
 /**
 * Mode of a single recording band — the recorder per-band vocabulary.
@@ -9041,41 +9154,6 @@ var DecoderSessionConfigSchema = object({
 	*/
 	debug: boolean().optional()
 });
-var LabelDefinitionSchema = object({
-	id: string(),
-	name: string(),
-	category: string().optional(),
-	description: string().optional(),
-	icon: string().optional()
-});
-/**
-* Wire schema for a per-model CATALOG classMap override
-* (`ModelCatalogEntry.classMap` / `ModelConvertMetadata.classMap`) —
-* restricted to {@link CLASS_MAP_MACRO_TARGETS}, the only macros the
-* detection pipeline executor actually routes.
-*
-* This is deliberately a DIFFERENT, narrower shape than the general-purpose
-* `ClassMapDefinition` interface above (e.g. `IDetectionAddon.getClassMap()`
-* and the audio `YAMNET_TO_MACRO` catalog both use macro targets outside this
-* enum) — the two used to share the name `ClassMapDefinition`/
-* `ClassMapDefinitionSchema`, which made the schema-type-twin guard
-* (`scripts/check-schema-type-twins.ts`) flag them as a duplicated shape. They
-* are not: it is two different concepts colliding on a name. Keep this type
-* under its own name rather than reusing `ClassMapDefinition` — reusing it
-* would either narrow every `ClassMapDefinition` consumer to the four
-* detection macros (breaking `YAMNET_TO_MACRO`) or drop the validation this
-* schema exists for (see the "rejects a classMap whose target is not a
-* detection macro" test in `model-catalog-schema.test.ts`).
-*/
-var DetectionCatalogClassMapSchema = object({
-	mapping: record(string(), _enum([
-		"person",
-		"vehicle",
-		"animal",
-		"package"
-	])),
-	preserveOriginal: boolean()
-});
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -23096,7 +23174,7 @@ var lifecycleJobSchema = object({
 * `useAddonsOnAddonLogs`, etc. flow through the same codegen pipeline
 * as every other cap.
 */
-var LogLevelSchema$1 = _enum([
+var LogLevelSchema$2 = _enum([
 	"debug",
 	"info",
 	"warn",
@@ -23303,7 +23381,7 @@ var CustomActionInputSchema = object({
 method(_void(), array(AddonListItemSchema).readonly()), method(object({
 	addonId: string(),
 	limit: number().min(1).max(500).default(100),
-	level: LogLevelSchema$1.optional()
+	level: LogLevelSchema$2.optional()
 }), array(LogQueryEntrySchema)), method(_void(), array(InstalledPackageSchema).readonly()), method(object({
 	packageName: string(),
 	version: string().optional()
@@ -23401,7 +23479,7 @@ method(_void(), array(AddonListItemSchema).readonly()), method(object({
 	auth: "admin"
 }), method(object({
 	addonId: string(),
-	level: LogLevelSchema$1.optional()
+	level: LogLevelSchema$2.optional()
 }), LogStreamEntrySchema, { kind: "subscription" });
 object({
 	/** Carbon dioxide concentration in ppm. */
@@ -24462,6 +24540,35 @@ var FaceFilterEnum = _enum([
 	"identified",
 	"all"
 ]);
+/**
+* What a `listRecentFaces` page is ORDERED BY.
+*
+*  - `timestamp` — when the face was seen. The historical (and default) order.
+*  - `suggestionConfidence` — {@link FaceInfo.suggestedMatchScore}, the peak
+*    cosine of the face's SUGGESTED identity. This is the "review by certainty"
+*    order: it puts the suggestions an operator can confirm with one tap at the
+*    top, and it is the reason this enum exists — a client that ranked a capped
+*    page client-side was ranking the newest N, never the most certain N.
+*
+* A row with NO suggestion (`suggestedMatchScore` absent — a legacy row, an
+* auto-assigned face, or a face below the suggestion band) has no certainty to
+* compare. Under `suggestionConfidence` it sorts **LAST, in BOTH directions**
+* — flipping the direction reorders the rows that HAVE a certainty and never
+* floods the page with the ones that do not. `addon-post-analysis`'s
+* `store/face-sort.ts` is the single implementation, tiebreaks newest-first
+* then by faceId, and is what makes this a total order instead of the
+* backend's NULL-collation accident.
+*/
+var FaceSortFieldEnum = _enum(["timestamp", "suggestionConfidence"]);
+var FaceSortDirectionEnum = _enum(["asc", "desc"]);
+/** One suggested group of look-alike UNASSIGNED faces. Ids only — an embedding
+*  never leaves the server. */
+var FaceClusterSchema = object({
+	faceIds: array(string()).readonly(),
+	representativeFaceId: string(),
+	size: number().int(),
+	cohesion: number()
+});
 var MediaFileLiteSchema$1 = object({
 	key: string(),
 	kind: string(),
@@ -24508,24 +24615,72 @@ includeCrops: boolean().optional() }).optional(), array(IdentitySchema).readonly
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
-	/** Restrict to one camera. Absent keeps the cluster-wide gallery view. */
+	/**
+	* Restrict to ONE camera. Absent keeps the cluster-wide gallery view.
+	*
+	* The legacy single-camera form, kept verbatim for every caller that
+	* already sends it. A caller that wants a SET sends {@link deviceIds}
+	* instead — never both: `deviceIds` is the authority whenever it is
+	* present, and this field is then ignored rather than unioned, so
+	* there is exactly one answer to "which cameras did I ask for".
+	*/
 	deviceId: number().int().optional(),
+	/**
+	* Restrict to a SET of cameras — the review UI's camera filter, which
+	* until now had to fetch the cluster-wide page and drop rows in the
+	* client (so the `limit` it asked for was spent on cameras it was
+	* about to discard).
+	*
+	* An **empty array reads NOTHING** — `[]` is an empty page, never
+	* "every camera". A request for no devices is a request, not an
+	* omission; same contract as `deviceManager.listFleet` and
+	* `pipelineAnalytics.listRecentTracks`.
+	*
+	* Absent (`undefined`) is the omission, and keeps the cluster-wide view.
+	*/
+	deviceIds: array(number().int()).optional(),
 	limit: number().int().positive().optional(),
 	filter: FaceFilterEnum.optional(),
 	/**
-	* Inline the base64 crop on every row. Default `true` — the existing
-	* behaviour, kept so no caller breaks.
+	* Window lower bound on {@link FaceInfo.timestamp}, INCLUSIVE.
+	* Absent means no lower bound.
+	*/
+	since: number().int().optional(),
+	/**
+	* Window upper bound on {@link FaceInfo.timestamp}, INCLUSIVE.
+	* Absent means no upper bound.
+	*/
+	until: number().int().optional(),
+	/**
+	* Order the page by time or by suggestion certainty. Default
+	* `'timestamp'` — the historical order, unchanged for every caller
+	* that does not ask.
 	*
-	* Set `false` once the caller renders {@link FaceInfo.cropUrl}: that
-	* drops ~2.87 MiB per 500-row page to a few KiB of metadata and lets
-	* the browser cache the images.
+	* See {@link FaceSortFieldEnum} for what a row with no suggestion
+	* does under `'suggestionConfidence'`.
 	*
-	* **This is an INPUT field, so it does not reach the addon until the
-	* next train.** The hub router validates cap inputs against its own
-	* compiled Zod, which strips a key it does not know — verified today
-	* on the OUTPUT side, where an additive field DOES arrive immediately
-	* (`Track.hasFace`). Until the train ships, sending `false` is
-	* harmless and simply keeps the crops inline.
+	* Cost note: `'timestamp'` is served by the `(deviceId, timestamp)`
+	* index and stops reading as soon as `limit` rows have PASSED the
+	* filter. `'suggestionConfidence'` cannot stop early — the most
+	* certain row may be the oldest — so it walks the window. Narrow it
+	* with {@link since} / {@link until}.
+	*/
+	sortBy: FaceSortFieldEnum.optional(),
+	/** Sort direction for {@link sortBy}. Default `'desc'`. */
+	sortDirection: FaceSortDirectionEnum.optional(),
+	/**
+	* Inline the base64 crop on every row.
+	*
+	* Default `false` since the 2026-08-25 inversion — see
+	* `include-crops-default.ts`, which is the ONE place that resolves
+	* this for every gallery, and which records why the inline shape had
+	* to become the one you ASK for (60 457 ms → UDS timeout at 500 rows).
+	* The doc here used to still say `true`; it was wrong, and a leftover
+	* that describes the old design reads as permission to rely on it.
+	*
+	* Nothing loses its image: the row carries {@link FaceInfo.cropUrl},
+	* which the browser fetches off the `event-media` plane in parallel,
+	* cached and ETagged.
 	*/
 	includeCrops: boolean().optional()
 }).optional(), array(FaceInfoSchema).readonly()), method(object({
@@ -24561,13 +24716,39 @@ includeCrops: boolean().optional() }).optional(), array(IdentitySchema).readonly
 }), method(object({
 	threshold: number().min(0).max(1).optional(),
 	minClusterSize: number().int().min(2).optional(),
-	limit: number().int().positive().optional()
-}).optional(), array(object({
-	faceIds: array(string()).readonly(),
-	representativeFaceId: string(),
-	size: number().int(),
-	cohesion: number()
-})).readonly());
+	/**
+	* Cap on the number of CLUSTERS returned. Renamed from `limit`,
+	* which read as though it bounded the work — it never did.
+	*
+	* Wins over {@link limit} when both are sent.
+	*/
+	maxClusters: number().int().positive().optional(),
+	/**
+	* @deprecated Ambiguous name for {@link maxClusters} — it cuts the
+	* RESULT, not the scan. Kept so existing callers keep working; send
+	* `maxClusters` (and, if you care about cost, {@link maxFacesScanned}).
+	*/
+	limit: number().int().positive().optional(),
+	/**
+	* Cap on the number of unassigned faces READ AND CLUSTERED — the
+	* POOL, not the result.
+	*
+	* This is the knob {@link maxClusters} was mistaken for. Clustering
+	* used to read every unassigned face on the hub no matter what the
+	* caller asked for, because the only bound cut the finished clusters
+	* afterwards; a UI showing a window of 100 paid for a scan of the
+	* whole corpus, on an addon whose disk is under contention.
+	*
+	* The pool is the NEWEST matching faces first — the same order the
+	* gallery shows — so a bound here shortens the horizon, it does not
+	* sample it randomly.
+	*
+	* Default: 1 000 (`FACE_SWEEP_PAGE`, exactly one store page). Chosen
+	* so the live corpus — 372 face rows — is unaffected while the
+	* unbounded scan can never come back as the table grows.
+	*/
+	maxFacesScanned: number().int().positive().optional()
+}).optional(), array(FaceClusterSchema).readonly());
 /**
 * Fan-control cap. Models HA `fan.*` entity-specific surfaces:
 * speed percentage, preset modes, ceiling-fan direction, and
@@ -28449,6 +28630,211 @@ var SetSiteLocationInputSchema = object({
 	latitude: number().min(-90).max(90),
 	longitude: number().min(-180).max(180)
 }).nullable();
+/**
+* One `(procedure, user-agent, ip, principal)` tuple of the HTTP request
+* census. `principal` is the DERIVED identity (`apocaliss92 (admin)`,
+* `scoped:1a2b3c4d (scoped-token)`, `anonymous`) that the tRPC error log
+* already prints - never a token, never an `Authorization` header.
+*/
+var RequestCensusGroupSchema = object({
+	procedure: string(),
+	userAgent: string(),
+	ip: string(),
+	principal: string(),
+	calls: number(),
+	perMin: number()
+});
+/**
+* A procedure's TOTAL over the window, across every caller.
+*
+* This block, not the group list, is what answers "did these calls arrive over
+* HTTP at all". A total far BELOW what a store-side census counted over the
+* same window excludes the HTTP plane, which is a result, not a failure.
+*/
+var RequestCensusProcedureSchema = object({
+	procedure: string(),
+	calls: number(),
+	perMin: number()
+});
+/**
+* The census as an operator sees it.
+*
+* `persisted` is the honest answer to "will this survive the restart I am
+* about to do": the arm deadline is written to `system-settings` so a window
+* armed now can measure the NEXT boot, and a write that failed must not look
+* like one that succeeded.
+*/
+var RequestCensusStatusSchema = object({
+	armed: boolean(),
+	/** How long the current - or just-closed - window collected, in ms. */
+	elapsedMs: number(),
+	/** The window actually armed, after the server clamped the request. */
+	windowMs: number(),
+	/** Epoch ms the window closes at. 0 when disarmed. */
+	armedUntilMs: number(),
+	httpRequests: number(),
+	batchedRequests: number(),
+	/**
+	* Procedure invocations. Higher than `httpRequests` whenever tRPC batching
+	* is in play (`?batch=1` carries several procedures in one request); this is
+	* the number comparable with a store-side call count.
+	*/
+	procedureCalls: number(),
+	/**
+	* tRPC WebSocket connections opened during the window. NOT calls - the WS
+	* transport resolves one context per connection - but the number that says
+	* whether a plane this census cannot see was busy while HTTP was quiet.
+	*/
+	wsConnections: number(),
+	distinctGroups: number(),
+	/** Calls counted in the totals whose group attribution was shed at the
+	*  cardinality bound. */
+	unattributedCalls: number(),
+	procedures: array(RequestCensusProcedureSchema).readonly(),
+	groups: array(RequestCensusGroupSchema).readonly()
+}).extend({ persisted: boolean() });
+/** Severity vocabulary. Mirrors `LogLevel` in `interfaces/logging.ts`. */
+var LogLevelSchema$1 = _enum([
+	"debug",
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* The diagnostics that can be ARMED for a window. Exactly one today.
+*
+* A diagnostic is anything whose cost is only worth paying while a question is
+* open. It never persists as a boolean: see {@link DiagnosticWindowSchema}.
+*/
+var DiagnosticIdSchema = _enum(["request-census"]);
+/**
+* The layers of the level hierarchy, general → specific. The most specific
+* layer that carries an explicit value wins.
+*
+* `component` is DECLARED and not yet resolvable: the per-component channels
+* are a later slice of the same plan, and a `levelSource` enum that has to
+* grow later would force every consumer of this document to change with it.
+* Nothing returns `component` today.
+*/
+var LoggingScopeKindSchema = _enum([
+	"cluster",
+	"node",
+	"component"
+]);
+/** Where an effective level came from. `default` = nothing is set anywhere. */
+var LoggingLevelSourceSchema = _enum([
+	"default",
+	"cluster",
+	"node",
+	"component"
+]);
+/**
+* One layer of the hierarchy as it actually STANDS.
+*
+* `level: null` is the whole reason this array is returned: it is the
+* difference between "this node is at `info` because I decided it" and
+* "...because it inherits". An operator who clears an override believing they
+* are clearing an inherited value has been handed the same defect as the two
+* contradicting knobs this document exists to remove, moved one floor up.
+*/
+var LoggingLevelLayerSchema = object({
+	scope: LoggingScopeKindSchema,
+	/** The node this layer speaks for; `null` on the cluster layer. */
+	nodeId: string().nullable(),
+	/** Explicitly set here, or `null` when this layer inherits. */
+	level: LogLevelSchema$1.nullable()
+});
+/** What a line is judged against, and WHICH layer decided it. */
+var LoggingEffectiveSchema = object({
+	level: LogLevelSchema$1,
+	levelSource: LoggingLevelSourceSchema
+});
+/** Every layer, general → specific. Never collapsed into the effective value. */
+var LoggingExplicitSchema = object({ layers: array(LoggingLevelLayerSchema).readonly() });
+/**
+* An armed diagnostic, with its DEADLINE.
+*
+* The shape of ADR-0244: what is stored is a deadline and never a flag, so a
+* diagnostic somebody forgot expires by itself, and a boot-window measurement
+* survives the restart it exists to measure. `remainingMs` is 0 whenever
+* `armed` is false — a window is never reported as slightly expired.
+*/
+var DiagnosticWindowSchema = object({
+	id: DiagnosticIdSchema,
+	armed: boolean(),
+	/** Epoch ms the window closes at. 0 when disarmed. */
+	armedUntilMs: number(),
+	/** Ms left before it expires on its own. 0 when disarmed. */
+	remainingMs: number(),
+	/** Whether the stored deadline is the one the live diagnostic is running —
+	*  i.e. whether this window would survive a restart. */
+	persisted: boolean()
+});
+/**
+* `armMs: 0` DISARMS. Any positive value arms for that long, clamped by the
+* server — there is no maximum here on purpose: a bound repeated in a schema
+* is a second knob that disagrees with the first the day one of them moves.
+*/
+var DiagnosticWindowPatchSchema = object({
+	id: DiagnosticIdSchema,
+	armMs: number().int().min(0),
+	/** Cadence of the diagnostic's aggregated report line. Clamped by the server. */
+	reportEveryMs: number().int().positive().optional()
+});
+/**
+* A PATCH, and patches MERGE.
+*
+* A field absent from the patch is left exactly as it was — arming a
+* diagnostic never resets a level, and setting a level never disarms a window.
+* The provider must not reconstruct the document as `{ ...snapshot, ...patch }`:
+* `setAll` already merges, and rebuilding the object is how an absent field
+* turns into an erased one.
+*/
+var LoggingSettingsPatchSchema = object({
+	/**
+	* Absent leaves the level untouched. `null` CLEARS the explicit value at the
+	* addressed scope so it inherits again. A value sets it.
+	*/
+	level: LogLevelSchema$1.nullable().optional(),
+	/**
+	* Only the diagnostics NAMED here change. An armed window that is not listed
+	* keeps running — a patch is never a full replacement.
+	*/
+	diagnostics: array(DiagnosticWindowPatchSchema).readonly().optional()
+});
+/**
+* Which LAYER of the hierarchy is addressed. Absent = the cluster layer.
+*
+* Deliberately NOT called `nodeId`: that key is reserved on every cap method
+* input — the generated router strips it and uses it to resolve the PROVIDER
+* on that node (`resolveProvider(cap, nodeId, …)`). A document about
+* `agent-1` addressed as `nodeId` would be forwarded to agent-1 and answered
+* by an agent that holds no cluster document at all. The hub is the single
+* authority over the whole hierarchy and answers for every layer, so the
+* layer selector needs a name the transport does not already own.
+*/
+var GetLoggingSettingsInputSchema = object({ scopeNodeId: string().optional() });
+var SetLoggingSettingsInputSchema = object({
+	scopeNodeId: string().optional(),
+	patch: LoggingSettingsPatchSchema
+});
+/**
+* The whole document, as read and as returned after every write.
+*
+* `persisted: false` means the settings store could not be read or written.
+* The in-memory mirror still governs behaviour and is unchanged by the
+* failure — a read that fails neither switches a level nor disarms a window
+* (D49) — but the operator is told that what they are looking at would not
+* survive a restart.
+*/
+var LoggingSettingsStateSchema = object({
+	/** The layer this document was read at. `null` = the cluster layer. */
+	scopeNodeId: string().nullable(),
+	effective: LoggingEffectiveSchema,
+	explicit: LoggingExplicitSchema,
+	activeWindows: array(DiagnosticWindowSchema).readonly(),
+	persisted: boolean()
+});
 method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
 	kind: "mutation",
 	auth: "admin"
@@ -28461,6 +28847,9 @@ method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), met
 }), method(_void(), SiteLocationStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(_void(), RequestCensusStatusSchema, { auth: "admin" }), method(GetLoggingSettingsInputSchema, LoggingSettingsStateSchema, { auth: "admin" }), method(SetLoggingSettingsInputSchema, LoggingSettingsStateSchema, {
+	kind: "mutation",
+	auth: "admin"
 });
 object({
 	/** True when the device's tamper switch / case-open contact is
@@ -29089,6 +29478,146 @@ DeviceType.Camera, method(object({
 	detection: array(ZoneRuleSchema).readonly(),
 	package: array(ZoneRuleSchema).readonly()
 });
+/**
+* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
+* valutatore puro del suo FRONTE.
+*
+* Viveva dentro il builtin virtual-doorbell
+* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
+* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
+* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
+* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
+* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
+* SPOSTA qui e il doorbell la ri-esporta.
+*
+* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
+* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
+* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
+* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
+*/
+/**
+* Known binary / switch source caps → the boolean slice field whose
+* false→true rise counts as ACTIVE. Every entry is "fire on active".
+* Sensors whose "active" reading is not a plain boolean (presence's string
+* state, connectivity's connected flag) are deliberately excluded — a
+* reconnect is not a doorbell press, and it is not a recording either.
+*/
+var SOURCE_CAP_ACTIVE_FIELD = {
+	contact: "entryOpen",
+	binary: "on",
+	switch: "on",
+	motion: "detected",
+	flood: "flooded",
+	gas: "detected",
+	smoke: "detected",
+	"carbon-monoxide": "detected",
+	vibration: "detected",
+	tamper: "tampered"
+};
+/**
+* The same caps → the slice field carrying the ms-epoch timestamp of the
+* last transition. Every source cap MUST appear here (guarded by a spec):
+* without a transition timestamp the evaluator cannot tell a genuine rise
+* from a boot-time hydration when the FIRST slice it ever sees is already
+* active, and errs towards silence — swallowing the rise.
+*
+* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
+* provider derives them from `state.last_changed`, so they survive our own
+* restarts and correctly read as "hours ago" for a state that has been
+* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
+*/
+var SOURCE_CAP_CHANGED_AT_FIELD = {
+	contact: "lastChangedAt",
+	binary: "lastChangedAt",
+	switch: "lastChangedAt",
+	motion: "lastDetectedAt",
+	flood: "lastChangedAt",
+	gas: "lastChangedAt",
+	smoke: "lastChangedAt",
+	"carbon-monoxide": "lastChangedAt",
+	vibration: "lastChangedAt",
+	tamper: "lastChangedAt"
+};
+/** True when a cap is a recognised binary/switch source. */
+function isSourceCap(capName) {
+	return Object.prototype.hasOwnProperty.call(SOURCE_CAP_ACTIVE_FIELD, capName);
+}
+/** Extract the "active" boolean a source cap's slice carries, or null when
+*  the cap is unknown or the field is missing / non-boolean. */
+function sliceActiveValue(capName, slice) {
+	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	return typeof raw === "boolean" ? raw : null;
+}
+/** Ms-epoch transition timestamp a source cap's slice carries, or null when
+*  it is absent, non-numeric or the zero "never observed" sentinel. */
+function sliceChangedAt(capName, slice) {
+	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
+	return raw;
+}
+/**
+* How recent a source's own transition timestamp must be for a FIRST
+* sighting that is already active to count as a genuine rise rather than a
+* hydration of long-standing state.
+*/
+var DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = 3e4;
+/**
+* IL fronte. Puro: nessun orologio proprio, nessuna memoria — il chiamante
+* porta `prior`, `nowMs` e il proprio `startedAtMs`.
+*
+* Il caso della PRIMA slice già attiva è trattato esplicitamente e vale come
+* fronte solo se il timestamp UPSTREAM della transizione è posteriore a
+* `startedAtMs` **e** entro `firstSightingFreshnessMs`. Entrambe le metà
+* servono: la sola freschezza scatterebbe su un'idratazione al boot di uno
+* stato flippato pochi secondi prima del riavvio, e il solo "dopo che abbiamo
+* iniziato" scatterebbe, su un processo di lunga vita, per una sorgente
+* adottata oggi il cui stato è cambiato ieri. Il caso ambiguo ERRA VERSO IL
+* SILENZIO e lo dichiara (`baseline-seeded-stale-active`).
+*/
+function evaluateSensorEdge(input) {
+	const value = sliceActiveValue(input.capName, input.slice);
+	if (value === null) return {
+		edge: "none",
+		value: null,
+		reason: isSourceCap(input.capName) ? "non-boolean-value" : "unknown-cap"
+	};
+	if (input.prior === void 0) {
+		if (!value) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-inactive"
+		};
+		const changedAt = sliceChangedAt(input.capName, input.slice);
+		const floor = Math.max(input.startedAtMs, input.nowMs - input.firstSightingFreshnessMs);
+		if (changedAt === null || changedAt < floor) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-stale-active"
+		};
+		return {
+			edge: "rising",
+			value: true
+		};
+	}
+	if (input.prior === value) return {
+		edge: "none",
+		value,
+		reason: "no-change"
+	};
+	if (!value) return {
+		edge: "none",
+		value,
+		reason: "falling-edge"
+	};
+	return {
+		edge: "rising",
+		value: true
+	};
+}
 var HF_BASE_URL = `https://huggingface.co/camstack/camstack-models/resolve/main`;
 /**
 * Accessory device helpers — shared across drivers.
@@ -29129,9 +29658,6 @@ var AccessoryKind = {
 	PrivacyMask: DeviceRole.PrivacyMask
 };
 AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
-new Set(Object.values(DeviceType));
-DeviceFeature.BatteryOperated;
 /**
 * THE derivation. One crop rectangle, one presence verdict — see D52 for why
 * this repo insists a derived value has exactly one implementation.
@@ -29150,6 +29676,9 @@ function deriveBatteryPresence(input) {
 	const budget = input.unreachableAfterMs ?? 216e5;
 	return input.nowMs - lastContactAt > budget ? "unreachable" : "sleeping";
 }
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
+new Set(Object.values(DeviceType));
+DeviceFeature.BatteryOperated;
 Object.freeze({
 	"accessories.setChildHidden": {
 		capName: "accessories",
@@ -34311,6 +34840,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.getLoggingSettings": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"system.getRequestCensus": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"system.getRetentionConfig": {
 		capName: "system",
 		capScope: "system",
@@ -34341,6 +34882,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"system.setLoggingSettings": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"system.setRetentionConfig": {
 		capName: "system",
 		capScope: "system",
@@ -35496,6 +36043,10 @@ Object.freeze({
 		name: "deviceId",
 		form: "single",
 		optional: true
+	}, {
+		name: "deviceIds",
+		form: "array",
+		optional: true
 	}],
 	"fanControl.setDirection": [{
 		name: "deviceId",
@@ -37326,6 +37877,7 @@ var NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
 var NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
 var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
 var NATIVE_LEASE_TILE_BUDGET_KEY = "nativeTileBudgetMb";
+var NATIVE_LEASE_SCENE_BUDGET_KEY = "nativeSceneBudgetMb";
 /**
 * WHICH delivered frames the decode worker retains a native copy of.
 *
@@ -37420,7 +37972,38 @@ var NativeLeaseSettingsSchema = object({
 	* fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
 	* reproduce that.
 	*/
-	tileBudgetMb: number().int().min(0).max(1024)
+	tileBudgetMb: number().int().min(0).max(1024),
+	/**
+	* RAM ceiling per decode worker, in MB, for the SCENE TILES — one
+	* JPEG-encoded copy of the WHOLE native frame, cut in the same instant as the
+	* subject tiles, on frames that detected something.
+	*
+	* It exists because a subject tile cannot answer a FULL-FRAME request:
+	* containment is strict by design, so the native `keyFrame`, the detail
+	* plane's `frameJpeg` rung and the display-crop fallback had no rung at all
+	* below the hold. Measured on the live cluster: 23.3% of key-frame captures
+	* missed, 95.7% of them with `worker-lease-gone` — the raster released one
+	* frame-time after delivery, with the request only p50 367 ms behind it.
+	*
+	* Sizing, and why this is a budget and not a duration: a scene tile is
+	* ~1.5-2.5 MB at 4K (against ~23.75 MB for the raster it was cut from and
+	* ~60-120 KB for a subject tile), and it is cut ~0.4 times a second per busy
+	* camera — only detection-bearing frames get one. 48 MB is therefore ~20-30
+	* frames, i.e. the store's 30 s TTL binds at the steady state and the budget
+	* binds only through a detection burst, where it still covers well past the
+	* measured p90 ask age of 4.3 s. Holding the RASTERS for the same window
+	* would be ~498 MB per camera and ~6 GB at peak concurrency — the OOM this
+	* whole shape exists to avoid.
+	*
+	* A SEPARATE ceiling from `tileBudgetMb` on purpose: a scene tile is ~20× a
+	* subject tile, so one shared budget would let a busy camera's key frames
+	* evict the face/plate tiles the recognisers depend on. Two budgets make that
+	* impossible rather than unlikely. `0` DISABLES scene tiles and restores the
+	* pre-existing behaviour, where a late full-frame request had nothing but the
+	* ≤640 RAM raster — which the `keyFrame` gate rejects, so in practice it had
+	* nothing.
+	*/
+	sceneBudgetMb: number().int().min(0).max(1024)
 });
 /**
 * The values in force when the operator has set nothing.
@@ -37436,12 +38019,14 @@ var DEFAULT_NATIVE_LEASE_SETTINGS = {
 	budgetMb: 1024,
 	activityMs: 15e3,
 	tileBudgetMb: 64,
+	sceneBudgetMb: 48,
 	admission: "inferred"
 };
 DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames;
 DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
+DEFAULT_NATIVE_LEASE_SETTINGS.sceneBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 /**
 * Parse one knob, reporting `null` for absent, junk, out-of-bounds — AND for a
@@ -37490,12 +38075,14 @@ function readNativeLeaseOverride(config) {
 	const activityMs = readKnob("activityMs", config[NATIVE_LEASE_ACTIVITY_KEY]);
 	const admission = readAdmissionKnob(config[NATIVE_LEASE_ADMISSION_KEY]);
 	const tileBudgetMb = readKnob("tileBudgetMb", config[NATIVE_LEASE_TILE_BUDGET_KEY]);
+	const sceneBudgetMb = readKnob("sceneBudgetMb", config[NATIVE_LEASE_SCENE_BUDGET_KEY]);
 	return {
 		...holdFrames === null ? {} : { holdFrames },
 		...budgetMb === null ? {} : { budgetMb },
 		...activityMs === null ? {} : { activityMs },
 		...admission === null ? {} : { admission },
-		...tileBudgetMb === null ? {} : { tileBudgetMb }
+		...tileBudgetMb === null ? {} : { tileBudgetMb },
+		...sceneBudgetMb === null ? {} : { sceneBudgetMb }
 	};
 }
 function isHydratedField(entry) {
@@ -37506,7 +38093,8 @@ var LEASE_KEYS = [
 	NATIVE_LEASE_BUDGET_KEY,
 	NATIVE_LEASE_ACTIVITY_KEY,
 	NATIVE_LEASE_ADMISSION_KEY,
-	NATIVE_LEASE_TILE_BUDGET_KEY
+	NATIVE_LEASE_TILE_BUDGET_KEY,
+	NATIVE_LEASE_SCENE_BUDGET_KEY
 ];
 /**
 * Extract the operator's lease overrides from an
@@ -38228,4 +38816,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { pickClusterStepModels as $, audioAnalyzerCapability as A, makeSourceBrokerId as At, deriveRecordingMode as B, lazy as Bt, RATE_CONTROL_TIGHT as C, CAM_PROFILE_ORDER as Ct, YAMNET_TO_MACRO as D, hydrateSchema as Dt, RingBuffer as E, createEvent as Et, customAction as F, sleep as Ft, evaluateZoneRules as G, string as Gt, egressTranscodeSharingKey as H, number as Ht, defaultDeviceFor as I, _enum as It, mapAudioLabelToMacro as J, hfModelUrl as K, union as Kt, defineCustomActions as L, array as Lt, batteryCapability as M, parseJsonUnknown as Mt, cameraStreamsCapability as N, parseProfileBrokerId as Nt, addonWidgetsSourceCapability as O, isEvent as Ot, createHwAccelCache as P, selectAssignedProfileSlots as Pt, parseProcStatus as Q, deriveBatteryPresence as R, boolean as Rt, RATE_CONTROL_RELAXED as S, BaseAddon as St, RecordingConfigSchema as T, DeviceType as Tt, egressTransportFromRequest as U, object as Ut, detectionPipelineCapability as V, literal as Vt, enumerateInferenceDevices as W, record as Wt, motionDetectionCapability as X, maskUrlCredentials as Y, overlayClusterStepSettings as Z, HF_BASE_URL as _, AUDIO_PRESETS as _t, COCO_80_LABELS as a, recordingCapability as at, OpsLogEntrySchema as b, invocationFromEncodeProfile as bt, DEFAULT_CLUSTER_STEP_MODELS as c, resolveEgressDecodeHwAccel as ct, DEFAULT_EVENTS_BAND_BUFFER_SEC as d, runtimeDevices as dt, pickClusterStepSettings as et, DEFAULT_NATIVE_LEASE_SETTINGS as f, storageEvictableCapability as ft, ExportRecordSchema as g, errMsg as gt, EncodeProfileSchema as h, webrtcSessionCapability as ht, BatteryStatusSchema as i, pipelineRunnerCapability as it, audioKindId as j, nodePin as jt, audioAnalysisCapability as k, makeProfileBrokerId as kt, DEFAULT_CLUSTER_STEP_SETTINGS as l, resolvePoolMemoryPolicy as lt, EVENT_PAD_MS as m, supportedRuntimes as mt, AUDIO_BACKEND_CHOICES as n, pickNativeLeaseOverride as nt, COCO_TO_MACRO as o, recordingExportCapability as ot, DEVICE_BACKEND_TO_FORMAT as p, streamBrokerCapability as pt, inferModelProvider as q, EventCategory as qt, AUDIO_MACRO_LABELS as r, pipelineExecutorCapability as rt, DEFAULT_AUDIO_ANALYZER_CONFIG as s, resolveClusterStepModelId as st, APPLE_SA_TO_MACRO as t, pickDetailCropConvention as tt, DEFAULT_DETAIL_CROP_CONVENTION as u, resolveRecordingProfiles as ut, NativeLeaseAdmissionSchema as v, Fmp4BoxSplitter as vt, RECORDING_EXPORT_MAX_READ_BYTES as w, DeviceFeature as wt, PoolMemoryWatchdog as x, isSoftwareDecode as xt, NativeLeaseSettingsSchema as y, buildFfmpegArgs as yt, deriveDetailCropRect as z, discriminatedUnion as zt };
+export { motionDetectionCapability as $, audioAnalysisCapability as A, hydrateSchema as At, deriveDetailCropRect as B, array as Bt, RATE_CONTROL_RELAXED as C, invocationFromEncodeProfile as Ct, RingBuffer as D, DeviceFeature as Dt, RecordingConfigSchema as E, CAM_PROFILE_ORDER as Et, createHwAccelCache as F, parseJsonUnknown as Ft, enumerateInferenceDevices as G, number as Gt, detectionPipelineCapability as H, discriminatedUnion as Ht, customAction as I, parseProfileBrokerId as It, hfModelUrl as J, string as Jt, evaluateSensorEdge as K, object as Kt, defaultDeviceFor as L, selectAssignedProfileSlots as Lt, audioKindId as M, makeProfileBrokerId as Mt, batteryCapability as N, makeSourceBrokerId as Nt, YAMNET_TO_MACRO as O, DeviceType as Ot, cameraStreamsCapability as P, nodePin as Pt, maskUrlCredentials as Q, defineCustomActions as R, sleep as Rt, PoolMemoryWatchdog as S, buildFfmpegArgs as St, RECORDING_EXPORT_MAX_READ_BYTES as T, BaseAddon as Tt, egressTranscodeSharingKey as U, lazy as Ut, deriveRecordingMode as V, boolean as Vt, egressTransportFromRequest as W, literal as Wt, isFirstLevelMacroClass as X, EventCategory as Xt, inferModelProvider as Y, union as Yt, mapAudioLabelToMacro as Z, ExportRecordSchema as _, supportedRuntimes as _t, COCO_80_LABELS as a, pickNativeLeaseOverride as at, NativeLeaseSettingsSchema as b, AUDIO_PRESETS as bt, DEFAULT_CLUSTER_STEP_MODELS as c, recordingCapability as ct, DEFAULT_EVENTS_BAND_BUFFER_SEC as d, resolveEgressDecodeHwAccel as dt, overlayClusterStepSettings as et, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as f, resolvePoolMemoryPolicy as ft, EncodeProfileSchema as g, streamBrokerCapability as gt, EVENT_PAD_MS as h, storageEvictableCapability as ht, BatteryStatusSchema as i, pickDetailCropConvention as it, audioAnalyzerCapability as j, isEvent as jt, addonWidgetsSourceCapability as k, createEvent as kt, DEFAULT_CLUSTER_STEP_SETTINGS as l, recordingExportCapability as lt, DEVICE_BACKEND_TO_FORMAT as m, runtimeDevices as mt, AUDIO_BACKEND_CHOICES as n, pickClusterStepModels as nt, COCO_TO_MACRO as o, pipelineExecutorCapability as ot, DEFAULT_NATIVE_LEASE_SETTINGS as p, resolveRecordingProfiles as pt, evaluateZoneRules as q, record as qt, AUDIO_MACRO_LABELS as r, pickClusterStepSettings as rt, DEFAULT_AUDIO_ANALYZER_CONFIG as s, pipelineRunnerCapability as st, APPLE_SA_TO_MACRO as t, parseProcStatus as tt, DEFAULT_DETAIL_CROP_CONVENTION as u, resolveClusterStepModelId as ut, HF_BASE_URL as v, webrtcSessionCapability as vt, RATE_CONTROL_TIGHT as w, isSoftwareDecode as wt, OpsLogEntrySchema as x, Fmp4BoxSplitter as xt, NativeLeaseAdmissionSchema as y, errMsg as yt, deriveBatteryPresence as z, _enum as zt };