@camstack/addon-pipeline 1.2.244 → 1.2.246

package/dist/audio-analyzer/index.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-C1PeUaZn.js");
-const require_process_memory = require("../process-memory-CYMg9OKh.js");
+const require_dist = require("../dist-FF-KPXS7.js");
+const require_process_memory = require("../process-memory-ByvPOmQm.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_path = require("node:path");

package/dist/audio-analyzer/index.mjs

@@ -1,6 +1,6 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
-import { $t as hydrateSchema, Jt as audioChunkBytesPerSample, Lt as errMsg, N as audioAnalysisCapability, Ot as resolvePoolMemoryPolicy, P as audioAnalyzerCapability, Qt as expandAudioChunkToF32le, Wt as BaseAddon, bn as EventCategory, n as AUDIO_BACKEND_CHOICES, ot as mapAudioLabelToMacro, rn as nodePin, s as DEFAULT_AUDIO_ANALYZER_CONFIG, w as PoolMemoryWatchdog, y as HF_BASE_URL } from "../dist-D5j2hIVU.mjs";
-import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-DO-CvzV3.mjs";
+import { $t as hydrateSchema, Jt as audioChunkBytesPerSample, Lt as errMsg, N as audioAnalysisCapability, Ot as resolvePoolMemoryPolicy, P as audioAnalyzerCapability, Qt as expandAudioChunkToF32le, Wt as BaseAddon, bn as EventCategory, n as AUDIO_BACKEND_CHOICES, ot as mapAudioLabelToMacro, rn as nodePin, s as DEFAULT_AUDIO_ANALYZER_CONFIG, w as PoolMemoryWatchdog, y as HF_BASE_URL } from "../dist-XAp9FVoN.mjs";
+import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-DkBPSh44.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
 import { downloadFile } from "@camstack/system/addon-utils";

package/dist/{default-detection-model-CPwmR_XE.js → default-detection-model-BokEDZLK.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-C1PeUaZn.js");
+const require_dist = require("./dist-FF-KPXS7.js");
 let node_crypto = require("node:crypto");
 //#region src/detection-pipeline/pipeline/landmark-precision-gate.ts
 /**
@@ -2114,6 +2114,35 @@ var localFrameRegistry = new LocalFrameRegistry({
 	maxBytes: envPositiveInt("CAMSTACK_LOCAL_FRAME_BUDGET_MB", DEFAULT_MAX_BYTES / 1048576) * 1048576
 });
 //#endregion
+//#region src/detection-pipeline/pipeline/macro-gate.ts
+function capitalize(s) {
+	if (s.length === 0) return s;
+	return s.charAt(0).toUpperCase() + s.slice(1);
+}
+/** Apply the operator's class list and per-macro confidence floor. */
+function macroGateVerdict(macroClass, score, settings) {
+	if (!settings) return "pass";
+	const enabled = settings["enabledMacroClasses"];
+	if (Array.isArray(enabled) && enabled.length > 0) {
+		if (!enabled.includes(macroClass)) return "class-filter";
+	}
+	const perMacroThreshold = settings[`minConfidence${capitalize(macroClass)}`];
+	if (typeof perMacroThreshold === "number" && score < perMacroThreshold) return "below-threshold";
+	return "pass";
+}
+/**
+* The operator's gate, read off the ROOT step.
+*
+* The root is the first ENABLED step — the same one `executor.ts` picks
+* (`enabledSteps[0]`) — because that is the step whose settings the device
+* UI writes `enabledMacroClasses` and `minConfidence<Macro>` into. `undefined`
+* when there is no enabled step or it carries no settings, which the gate
+* itself reads as "pass everything": an absent gate must never mute a camera.
+*/
+function rootObjectGate(steps) {
+	return (steps?.find((s) => s.enabled !== false))?.settings;
+}
+//#endregion
 //#region src/detection-pipeline/default-detection-model.ts
 /** The object-detection step id — the only slot this resolver applies to. */
 var OBJECT_DETECTION_STEP_ID = "object-detection";
@@ -2244,6 +2273,12 @@ Object.defineProperty(exports, "localFrameRegistry", {
 		return localFrameRegistry;
 	}
 });
+Object.defineProperty(exports, "macroGateVerdict", {
+	enumerable: true,
+	get: function() {
+		return macroGateVerdict;
+	}
+});
 Object.defineProperty(exports, "resolveDefaultDetectionModel", {
 	enumerable: true,
 	get: function() {
@@ -2262,3 +2297,9 @@ Object.defineProperty(exports, "resolveModelForFormat", {
 		return resolveModelForFormat;
 	}
 });
+Object.defineProperty(exports, "rootObjectGate", {
+	enumerable: true,
+	get: function() {
+		return rootObjectGate;
+	}
+});

package/dist/{default-detection-model-Be8-TzIO.mjs → default-detection-model-b1HWNGyF.mjs}

@@ -1,4 +1,4 @@
-import { F as audioKindId, a as COCO_80_LABELS, o as COCO_TO_MACRO, r as AUDIO_MACRO_LABELS, tt as hfModelUrl } from "./dist-D5j2hIVU.mjs";
+import { F as audioKindId, a as COCO_80_LABELS, o as COCO_TO_MACRO, r as AUDIO_MACRO_LABELS, tt as hfModelUrl } from "./dist-XAp9FVoN.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/detection-pipeline/pipeline/landmark-precision-gate.ts
 /**
@@ -2114,6 +2114,35 @@ var localFrameRegistry = new LocalFrameRegistry({
 	maxBytes: envPositiveInt("CAMSTACK_LOCAL_FRAME_BUDGET_MB", DEFAULT_MAX_BYTES / 1048576) * 1048576
 });
 //#endregion
+//#region src/detection-pipeline/pipeline/macro-gate.ts
+function capitalize(s) {
+	if (s.length === 0) return s;
+	return s.charAt(0).toUpperCase() + s.slice(1);
+}
+/** Apply the operator's class list and per-macro confidence floor. */
+function macroGateVerdict(macroClass, score, settings) {
+	if (!settings) return "pass";
+	const enabled = settings["enabledMacroClasses"];
+	if (Array.isArray(enabled) && enabled.length > 0) {
+		if (!enabled.includes(macroClass)) return "class-filter";
+	}
+	const perMacroThreshold = settings[`minConfidence${capitalize(macroClass)}`];
+	if (typeof perMacroThreshold === "number" && score < perMacroThreshold) return "below-threshold";
+	return "pass";
+}
+/**
+* The operator's gate, read off the ROOT step.
+*
+* The root is the first ENABLED step — the same one `executor.ts` picks
+* (`enabledSteps[0]`) — because that is the step whose settings the device
+* UI writes `enabledMacroClasses` and `minConfidence<Macro>` into. `undefined`
+* when there is no enabled step or it carries no settings, which the gate
+* itself reads as "pass everything": an absent gate must never mute a camera.
+*/
+function rootObjectGate(steps) {
+	return (steps?.find((s) => s.enabled !== false))?.settings;
+}
+//#endregion
 //#region src/detection-pipeline/default-detection-model.ts
 /** The object-detection step id — the only slot this resolver applies to. */
 var OBJECT_DETECTION_STEP_ID = "object-detection";
@@ -2196,4 +2225,4 @@ function resolveDefaultDetectionModel(backend, device, format, getStepDef = getS
 	return getDefaultModelForFormatFromDef(def, format);
 }
 //#endregion
-export { ALL_PIPELINE_STEPS as a, getStep as c, landmarkPrecisionVerdict as d, resolveFrameViewGeometry as i, getStepDefinition as l, resolveDefaultDetectionModel as n, ALL_STEPS as o, localFrameRegistry as r, getDefaultModelForFormat as s, OBJECT_DETECTION_STEP_ID as t, resolveModelForFormat as u };
+export { localFrameRegistry as a, ALL_STEPS as c, getStepDefinition as d, resolveModelForFormat as f, rootObjectGate as i, getDefaultModelForFormat as l, resolveDefaultDetectionModel as n, resolveFrameViewGeometry as o, landmarkPrecisionVerdict as p, macroGateVerdict as r, ALL_PIPELINE_STEPS as s, OBJECT_DETECTION_STEP_ID as t, getStep as u };

package/dist/detection-pipeline/index.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-C1PeUaZn.js");
-const require_node = require("../node-DHN6cJXp.js");
-const require_default_detection_model = require("../default-detection-model-CPwmR_XE.js");
+const require_dist = require("../dist-FF-KPXS7.js");
+const require_node = require("../node-C-KslKQf.js");
+const require_default_detection_model = require("../default-detection-model-BokEDZLK.js");
 const require_lazy_sharp = require("../lazy-sharp-BuwKlQLR.js");
-const require_process_memory = require("../process-memory-CYMg9OKh.js");
+const require_process_memory = require("../process-memory-ByvPOmQm.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");
@@ -5891,20 +5891,9 @@ var PipelineExecutor = class {
 	*   - `minConfidence<Macro>`: number (e.g. `minConfidencePerson: 0.5`)
 	*/
 	macroFilterVerdict(macroClass, score, settings) {
-		if (!settings) return "pass";
-		const enabled = settings["enabledMacroClasses"];
-		if (Array.isArray(enabled) && enabled.length > 0) {
-			if (!enabled.includes(macroClass)) return "class-filter";
-		}
-		const perMacroThreshold = settings[`minConfidence${capitalize(macroClass)}`];
-		if (typeof perMacroThreshold === "number" && score < perMacroThreshold) return "below-threshold";
-		return "pass";
+		return require_default_detection_model.macroGateVerdict(macroClass, score, settings);
 	}
 };
-function capitalize(s) {
-	if (s.length === 0) return s;
-	return s.charAt(0).toUpperCase() + s.slice(1);
-}
 //#endregion
 //#region src/detection-pipeline/pipeline/native-crop-compose.ts
 /** Clamp `v` into `[lo, hi]`. */

package/dist/detection-pipeline/index.mjs

@@ -1,9 +1,9 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
-import { $t as hydrateSchema, At as runtimeDevices$1, Ft as supportedRuntimes$1, G as detectionPipelineCapability, J as enumerateInferenceDevices, Lt as errMsg, Ot as resolvePoolMemoryPolicy, Tt as resolveClusterStepModelId, V as defaultDeviceFor$1, Wt as BaseAddon, X as evaluateZoneRules, Yt as createEvent, bn as EventCategory, c as DEFAULT_CLUSTER_STEP_MODELS, gt as pickClusterStepSettings, hn as object, ht as pickClusterStepModels, in as parseJsonUnknown, it as loadContributionCapability, j as YAMNET_TO_MACRO, l as DEFAULT_CLUSTER_STEP_SETTINGS, ln as array, m as DEVICE_BACKEND_TO_FORMAT, nt as inferModelProvider, pt as overlayClusterStepSettings, rn as nodePin, sn as sleep, t as APPLE_SA_TO_MACRO, vn as string, w as PoolMemoryWatchdog, yn as union, yt as pipelineExecutorCapability } from "../dist-D5j2hIVU.mjs";
-import { o as readProcessCost } from "../node-CpJcoSCa.mjs";
-import { a as ALL_PIPELINE_STEPS, c as getStep, d as landmarkPrecisionVerdict, l as getStepDefinition, n as resolveDefaultDetectionModel, o as ALL_STEPS, r as localFrameRegistry, s as getDefaultModelForFormat, u as resolveModelForFormat } from "../default-detection-model-Be8-TzIO.mjs";
+import { $t as hydrateSchema, At as runtimeDevices$1, Ft as supportedRuntimes$1, G as detectionPipelineCapability, J as enumerateInferenceDevices, Lt as errMsg, Ot as resolvePoolMemoryPolicy, Tt as resolveClusterStepModelId, V as defaultDeviceFor$1, Wt as BaseAddon, X as evaluateZoneRules, Yt as createEvent, bn as EventCategory, c as DEFAULT_CLUSTER_STEP_MODELS, gt as pickClusterStepSettings, hn as object, ht as pickClusterStepModels, in as parseJsonUnknown, it as loadContributionCapability, j as YAMNET_TO_MACRO, l as DEFAULT_CLUSTER_STEP_SETTINGS, ln as array, m as DEVICE_BACKEND_TO_FORMAT, nt as inferModelProvider, pt as overlayClusterStepSettings, rn as nodePin, sn as sleep, t as APPLE_SA_TO_MACRO, vn as string, w as PoolMemoryWatchdog, yn as union, yt as pipelineExecutorCapability } from "../dist-XAp9FVoN.mjs";
+import { o as readProcessCost } from "../node-umwnvSsV.mjs";
+import { a as localFrameRegistry, c as ALL_STEPS, d as getStepDefinition, f as resolveModelForFormat, l as getDefaultModelForFormat, n as resolveDefaultDetectionModel, p as landmarkPrecisionVerdict, r as macroGateVerdict, s as ALL_PIPELINE_STEPS, u as getStep } from "../default-detection-model-b1HWNGyF.mjs";
 import { t as getSharp } from "../lazy-sharp-DXsqwpph.mjs";
-import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-DO-CvzV3.mjs";
+import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-DkBPSh44.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
@@ -5884,20 +5884,9 @@ var PipelineExecutor = class {
 	*   - `minConfidence<Macro>`: number (e.g. `minConfidencePerson: 0.5`)
 	*/
 	macroFilterVerdict(macroClass, score, settings) {
-		if (!settings) return "pass";
-		const enabled = settings["enabledMacroClasses"];
-		if (Array.isArray(enabled) && enabled.length > 0) {
-			if (!enabled.includes(macroClass)) return "class-filter";
-		}
-		const perMacroThreshold = settings[`minConfidence${capitalize(macroClass)}`];
-		if (typeof perMacroThreshold === "number" && score < perMacroThreshold) return "below-threshold";
-		return "pass";
+		return macroGateVerdict(macroClass, score, settings);
 	}
 };
-function capitalize(s) {
-	if (s.length === 0) return s;
-	return s.charAt(0).toUpperCase() + s.slice(1);
-}
 //#endregion
 //#region src/detection-pipeline/pipeline/native-crop-compose.ts
 /** Clamp `v` into `[lo, hi]`. */

package/dist/{dist-C1PeUaZn.js → dist-FF-KPXS7.js}

@@ -5360,7 +5360,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-e0RweZzn.mjs
+//#region ../types/dist/sleep-BDR76Ykr.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -20514,6 +20514,48 @@ var NcAlarmConfigSchema = object({
 	settings: NcAlarmSettingsSchema,
 	coverage: array(NcAlarmModeCoverageSchema)
 });
+/**
+* ONE rule's demand on ONE camera's clip ring.
+*
+* A rule, not a camera: the broker takes the MAX over the asks that reach a
+* camera, so the answer stays a faithful description of the rules and the
+* bounding (the byte budget, the broker's own ceiling) stays where the cost
+* lives. A camera that appears in no ask is being told **nothing** — which is
+* a different thing from never having been told, and only the envelope
+* (`rulesLoaded`) can tell those apart.
+*/
+var NcClipRetentionAskSchema = object({
+	/**
+	* The camera this ask is about. **Absent = every camera**, which is what a
+	* rule with no `conditions.devices` means: it can fire anywhere, so it is
+	* asking everywhere.
+	*/
+	deviceId: number().int().nonnegative().optional(),
+	/** Seconds of history the rule needs held for it. Never zero — a rule that
+	*  needs nothing produces no ask at all. */
+	seconds: number().min(0).max(60),
+	/** The profile the rule cuts from, when it named one. Absent = the cheapest
+	*  assigned, which is what the cut defaults to. */
+	profile: CamProfileSchema.optional(),
+	/** Who is asking — so a retention the operator did not expect names a rule. */
+	ruleId: string(),
+	ruleName: string(),
+	/** Why this many seconds: the rule's own window, or the occupancy ceiling. */
+	reason: _enum(["window", "occupancy"])
+});
+/**
+* The whole answer, with the one bit that keeps absence from reading as zero.
+*
+* `rulesLoaded` is false until the rule ledger has completed a load at least
+* once. A centre that is up but has not read its rules yet answers with an
+* empty ask list that means nothing at all — applying it would drop every
+* camera's ring to zero for the first events after a restart, which is the
+* footage this mechanism exists to keep.
+*/
+var NcClipRetentionPlanSchema = object({
+	rulesLoaded: boolean(),
+	asks: array(NcClipRetentionAskSchema).readonly()
+});
 method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), method(object({ ruleId: string() }), object({ rule: NcRuleSchema.nullable() }), { auth: "admin" }), method(object({ rule: NcRuleInputSchema }), object({ rule: NcRuleSchema }), {
 	kind: "mutation",
 	auth: "admin",
@@ -20534,7 +20576,7 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), object({ mutedDeviceIds: array(number().int()).readonly() }), { auth: "admin" }), method(object({
+}), method(object({}), NcClipRetentionPlanSchema, { auth: "admin" }), method(object({}), object({ mutedDeviceIds: array(number().int()).readonly() }), { auth: "admin" }), method(object({
 	deviceId: number().int(),
 	muted: boolean()
 }), object({ success: literal(true) }), {
@@ -21863,13 +21905,26 @@ var TrackAudioLabelSchema = object({
 *  - `audio` — an audio event on the camera itself that was anomalous for
 *    THAT camera, loud, and heard while nothing visual was happening (D62).
 *
+*  - `onboard` — the CAMERA's own firmware, paired with a decoded frame in
+*    that frame's pixel space. A real root detector and a SPATIAL one: its
+*    boxes are the same kind of fact `pipeline`'s are, produced by a different
+*    detector.
+*
+* `onboard` was missing here while `DetectionSourceSchema` already had it, so
+* a persisted onboard track failed `safeParse` on read and came back with NO
+* source at all — which `isSpatialTrack` then admitted by accident, through the
+* `undefined` arm rather than by anybody's decision, and which `excludeSources`
+* could not name.
+*
 * The spatial subsystems (tracker association, occupancy count, re-id /
 * embedding, resurrection) MUST skip every synthetic source. Test for that
-* with `isSpatialTrack`, which allow-lists `pipeline` — a `!== 'sensor'`
-* check silently readmits every source added after it was written.
+* with `isSpatialTrack`, which allow-lists the spatial sources explicitly — a
+* `!== 'sensor'` check silently readmits every source added after it was
+* written.
 */
 var TrackSourceSchema = _enum([
 	"pipeline",
+	"onboard",
 	"sensor",
 	"audio"
 ]);
@@ -23951,13 +24006,39 @@ var MotionSourceEnum = _enum([
 */
 var MotionSourcesSchema = array(MotionSourceEnum);
 /**
-* Which root detectors a camera runs. Deliberately the SAME vocabulary
-* post-analysis already tags every detection with (`DetectionSource`) rather
-* than a second spelling of the same two ideas — the value an operator picks
-* here is the value that comes back on the track, the overlay and the debug
-* row.
+* Which root detector a camera runs — EXACTLY ONE.
+*
+* Deliberately the SAME vocabulary post-analysis already tags every detection
+* with (`DetectionSource`) rather than a second spelling of the same two
+* ideas: the value an operator picks here is the value that comes back on the
+* track, the overlay and the debug row.
+*
+* ## Why one, and why it is still an array
+*
+* Two roots on one camera is a capability nobody asked for and the operator has
+* since ruled out. It was never free: both planes feed the SAME per-device
+* stationary registry, both can promote the same parked object, and the two
+* detectors disagree about the same box by construction — which is the
+* disagreement D505 had to arbitrate. Removing the case removes the arbitration.
+*
+* The ARRAY shape survives because the stored settings and the attach payload
+* already speak it on every camera of every fleet, and a cap input that
+* suddenly refuses a stored value makes the camera un-attachable — a fail-closed
+* in the one direction that costs an operator their cameras. So the wire stays
+* tolerant and the TYPE is exact: a longer list is truncated to its first
+* element rather than refused, and `max(1)` is what every consumer can then
+* rely on.
+*
+* AT MOST one, not exactly one. The EMPTY list is a legal, deliberate pick —
+* a camera an operator left with no root detector — and `planDetectionSources`
+* has always said so: inventing a root for them is how a default acts without
+* anybody choosing it. Tightening this to `length(1)` broke that, and the
+* suite caught it.
+*
+* Measured before tightening (2026-09-15, this fleet, 6 h of attaches): 3327
+* `["pipeline"]` and 2 `["onboard"]`. Not one camera had two.
 */
-var DetectionSourcesSchema = array(DetectionSourceSchema);
+var DetectionSourcesSchema = preprocess((value) => Array.isArray(value) && value.length > 1 ? value.slice(0, 1) : value, array(DetectionSourceSchema).max(1));
 /**
 * Input shape for `pipeline-runner.reportMotion` cap method. Exported
 * so cap-side consumers (the orchestrator forward, the runner addon's
@@ -37755,6 +37836,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.getClipRetentionAsks": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.getConditionCatalog": {
 		capName: "notification-rules",
 		capScope: "system",

package/dist/{dist-D5j2hIVU.mjs → dist-XAp9FVoN.mjs}

@@ -5360,7 +5360,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-e0RweZzn.mjs
+//#region ../types/dist/sleep-BDR76Ykr.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -20514,6 +20514,48 @@ var NcAlarmConfigSchema = object({
 	settings: NcAlarmSettingsSchema,
 	coverage: array(NcAlarmModeCoverageSchema)
 });
+/**
+* ONE rule's demand on ONE camera's clip ring.
+*
+* A rule, not a camera: the broker takes the MAX over the asks that reach a
+* camera, so the answer stays a faithful description of the rules and the
+* bounding (the byte budget, the broker's own ceiling) stays where the cost
+* lives. A camera that appears in no ask is being told **nothing** — which is
+* a different thing from never having been told, and only the envelope
+* (`rulesLoaded`) can tell those apart.
+*/
+var NcClipRetentionAskSchema = object({
+	/**
+	* The camera this ask is about. **Absent = every camera**, which is what a
+	* rule with no `conditions.devices` means: it can fire anywhere, so it is
+	* asking everywhere.
+	*/
+	deviceId: number().int().nonnegative().optional(),
+	/** Seconds of history the rule needs held for it. Never zero — a rule that
+	*  needs nothing produces no ask at all. */
+	seconds: number().min(0).max(60),
+	/** The profile the rule cuts from, when it named one. Absent = the cheapest
+	*  assigned, which is what the cut defaults to. */
+	profile: CamProfileSchema.optional(),
+	/** Who is asking — so a retention the operator did not expect names a rule. */
+	ruleId: string(),
+	ruleName: string(),
+	/** Why this many seconds: the rule's own window, or the occupancy ceiling. */
+	reason: _enum(["window", "occupancy"])
+});
+/**
+* The whole answer, with the one bit that keeps absence from reading as zero.
+*
+* `rulesLoaded` is false until the rule ledger has completed a load at least
+* once. A centre that is up but has not read its rules yet answers with an
+* empty ask list that means nothing at all — applying it would drop every
+* camera's ring to zero for the first events after a restart, which is the
+* footage this mechanism exists to keep.
+*/
+var NcClipRetentionPlanSchema = object({
+	rulesLoaded: boolean(),
+	asks: array(NcClipRetentionAskSchema).readonly()
+});
 method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), method(object({ ruleId: string() }), object({ rule: NcRuleSchema.nullable() }), { auth: "admin" }), method(object({ rule: NcRuleInputSchema }), object({ rule: NcRuleSchema }), {
 	kind: "mutation",
 	auth: "admin",
@@ -20534,7 +20576,7 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), object({ mutedDeviceIds: array(number().int()).readonly() }), { auth: "admin" }), method(object({
+}), method(object({}), NcClipRetentionPlanSchema, { auth: "admin" }), method(object({}), object({ mutedDeviceIds: array(number().int()).readonly() }), { auth: "admin" }), method(object({
 	deviceId: number().int(),
 	muted: boolean()
 }), object({ success: literal(true) }), {
@@ -21863,13 +21905,26 @@ var TrackAudioLabelSchema = object({
 *  - `audio` — an audio event on the camera itself that was anomalous for
 *    THAT camera, loud, and heard while nothing visual was happening (D62).
 *
+*  - `onboard` — the CAMERA's own firmware, paired with a decoded frame in
+*    that frame's pixel space. A real root detector and a SPATIAL one: its
+*    boxes are the same kind of fact `pipeline`'s are, produced by a different
+*    detector.
+*
+* `onboard` was missing here while `DetectionSourceSchema` already had it, so
+* a persisted onboard track failed `safeParse` on read and came back with NO
+* source at all — which `isSpatialTrack` then admitted by accident, through the
+* `undefined` arm rather than by anybody's decision, and which `excludeSources`
+* could not name.
+*
 * The spatial subsystems (tracker association, occupancy count, re-id /
 * embedding, resurrection) MUST skip every synthetic source. Test for that
-* with `isSpatialTrack`, which allow-lists `pipeline` — a `!== 'sensor'`
-* check silently readmits every source added after it was written.
+* with `isSpatialTrack`, which allow-lists the spatial sources explicitly — a
+* `!== 'sensor'` check silently readmits every source added after it was
+* written.
 */
 var TrackSourceSchema = _enum([
 	"pipeline",
+	"onboard",
 	"sensor",
 	"audio"
 ]);
@@ -23951,13 +24006,39 @@ var MotionSourceEnum = _enum([
 */
 var MotionSourcesSchema = array(MotionSourceEnum);
 /**
-* Which root detectors a camera runs. Deliberately the SAME vocabulary
-* post-analysis already tags every detection with (`DetectionSource`) rather
-* than a second spelling of the same two ideas — the value an operator picks
-* here is the value that comes back on the track, the overlay and the debug
-* row.
+* Which root detector a camera runs — EXACTLY ONE.
+*
+* Deliberately the SAME vocabulary post-analysis already tags every detection
+* with (`DetectionSource`) rather than a second spelling of the same two
+* ideas: the value an operator picks here is the value that comes back on the
+* track, the overlay and the debug row.
+*
+* ## Why one, and why it is still an array
+*
+* Two roots on one camera is a capability nobody asked for and the operator has
+* since ruled out. It was never free: both planes feed the SAME per-device
+* stationary registry, both can promote the same parked object, and the two
+* detectors disagree about the same box by construction — which is the
+* disagreement D505 had to arbitrate. Removing the case removes the arbitration.
+*
+* The ARRAY shape survives because the stored settings and the attach payload
+* already speak it on every camera of every fleet, and a cap input that
+* suddenly refuses a stored value makes the camera un-attachable — a fail-closed
+* in the one direction that costs an operator their cameras. So the wire stays
+* tolerant and the TYPE is exact: a longer list is truncated to its first
+* element rather than refused, and `max(1)` is what every consumer can then
+* rely on.
+*
+* AT MOST one, not exactly one. The EMPTY list is a legal, deliberate pick —
+* a camera an operator left with no root detector — and `planDetectionSources`
+* has always said so: inventing a root for them is how a default acts without
+* anybody choosing it. Tightening this to `length(1)` broke that, and the
+* suite caught it.
+*
+* Measured before tightening (2026-09-15, this fleet, 6 h of attaches): 3327
+* `["pipeline"]` and 2 `["onboard"]`. Not one camera had two.
 */
-var DetectionSourcesSchema = array(DetectionSourceSchema);
+var DetectionSourcesSchema = preprocess((value) => Array.isArray(value) && value.length > 1 ? value.slice(0, 1) : value, array(DetectionSourceSchema).max(1));
 /**
 * Input shape for `pipeline-runner.reportMotion` cap method. Exported
 * so cap-side consumers (the orchestrator forward, the runner addon's
@@ -37755,6 +37836,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.getClipRetentionAsks": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.getConditionCatalog": {
 		capName: "notification-rules",
 		capScope: "system",

package/dist/motion-wasm/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-C1PeUaZn.js");
+const require_dist = require("../dist-FF-KPXS7.js");
 const require_lazy_sharp = require("../lazy-sharp-BuwKlQLR.js");
 let node_fs = require("node:fs");
 let node_path = require("node:path");

package/dist/motion-wasm/index.mjs

@@ -1,4 +1,4 @@
-import { $t as hydrateSchema, Wt as BaseAddon, X as evaluateZoneRules, ft as motionDetectionCapability, qt as DeviceType } from "../dist-D5j2hIVU.mjs";
+import { $t as hydrateSchema, Wt as BaseAddon, X as evaluateZoneRules, ft as motionDetectionCapability, qt as DeviceType } from "../dist-XAp9FVoN.mjs";
 import { t as getSharp } from "../lazy-sharp-DXsqwpph.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/{node-DHN6cJXp.js → node-C-KslKQf.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-emK7D4bc.js");
-const require_dist = require("./dist-C1PeUaZn.js");
+const require_dist = require("./dist-FF-KPXS7.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs, 1);

package/dist/{node-CpJcoSCa.mjs → node-umwnvSsV.mjs}

@@ -1,4 +1,4 @@
-import { Bt as buildFfmpegArgs, Ht as isSoftwareDecode, Lt as errMsg, zt as Fmp4BoxSplitter } from "./dist-D5j2hIVU.mjs";
+import { Bt as buildFfmpegArgs, Ht as isSoftwareDecode, Lt as errMsg, zt as Fmp4BoxSplitter } from "./dist-XAp9FVoN.mjs";
 import { randomUUID } from "node:crypto";
 import { realpathSync } from "node:fs";
 import path from "node:path";