@camstack/addon-post-analysis 1.2.285 → 1.2.286

package/dist/{dist-D2tXUMfE.mjs → clip-model-registry-D4mC2M7F.mjs}

@@ -5360,7 +5360,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BaRu0bS5.mjs
+//#region ../types/dist/sleep-BXv0ZcRa.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6145,6 +6145,40 @@ var BaseAddon = class {
 		const node = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
 		return keys.size > 0 ? projectStore(raw, keys, node) : raw;
 	}
+	/**
+	* Whether ONE global key of this addon's store was written, read three-way
+	* (D651). For a question a hydrated view cannot answer: `getGlobalSettings`
+	* reports `value ?? default`, so "the operator chose the default" and "nobody
+	* chose" look the same, and a failed read looks like both. A `perNode` key is
+	* not supported here: its stored name is scoped.
+	*/
+	async readStoredGlobalKey(key) {
+		const read = this._ctx?.settings?.readAddonStoreResult;
+		if (read === void 0) return {
+			kind: "unreadable",
+			reason: "three-way-read-unavailable"
+		};
+		let result;
+		try {
+			result = await read.call(this._ctx?.settings);
+		} catch (err) {
+			return {
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: err instanceof Error ? err.message : String(err)
+			};
+		}
+		if (result.kind === "failed") return {
+			kind: "unreadable",
+			reason: "store-read-failed",
+			error: result.error
+		};
+		if (result.kind === "missing" || !Object.prototype.hasOwnProperty.call(result.value, key)) return { kind: "absent" };
+		return {
+			kind: "present",
+			value: result.value[key]
+		};
+	}
 	async updateGlobalSettings(patch, nodeId) {
 		const keys = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
@@ -7440,7 +7474,7 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 * can answer "may a rule actuate this?" without importing the schema barrel
 * (~144MB RSS per runner, D28).
 *
-* Coverage: 87 device-scoped capabilities.
+* Coverage: 88 device-scoped capabilities.
 */
 var DEVICE_SCOPED_CAPS = new Set([
 	"accessories",
@@ -7470,6 +7504,7 @@ var DEVICE_SCOPED_CAPS = new Set([
 	"detection-pipeline",
 	"device-admin-link",
 	"device-discovery",
+	"device-extension",
 	"device-ops",
 	"device-status",
 	"doorbell",
@@ -9996,6 +10031,60 @@ var FailureCounters = class {
 		this.counters.clear();
 	}
 };
+var ClipModelMetaSchema = object({
+	/** The paired text encoder's catalog id (the embedding-encoder's text catalog). */
+	textModelId: string().min(1),
+	/** Output dimension of BOTH towers. A vector of any other length is refused. */
+	embeddingDim: number().int().positive(),
+	/**
+	* The `vector-store` index this model's vectors live in. ONE feature space
+	* per index: two models share an index only when their vectors are ranked
+	* against each other, which for CLIP means never across families. MobileCLIP
+	* S1 and S2 share `object-clip` for history (separated by the row's
+	* `modelId`); any other model gets its own.
+	*/
+	vectorIndex: string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	/**
+	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
+	* must be unique per tokenizer: every model's siblings land in ONE flat
+	* models directory, so two different tokenizers under the same name would
+	* silently overwrite each other (whichever model downloaded last wins, and
+	* the other one tokenises with the wrong vocabulary).
+	*/
+	tokenizerFile: string().min(1),
+	/** Token window the text graph takes (SigLIP2: 64; CLIP BPE: 77). */
+	contextLength: number().int().positive(),
+	/** Id the tokenizer pads with. */
+	padId: number().int().nonnegative(),
+	/**
+	* The search cosine floor at `strictness: 'loose'` — calibrated per model,
+	* because cosine bands are a property of the model: 0.2 keeps 96% of matched
+	* COCO caption-image pairs on MobileCLIP S1 and 2.7% on SigLIP2.
+	*/
+	searchMinScore: number().min(0).max(1)
+});
+var ClipSearchStrictnessSchema = _enum([
+	"loose",
+	"balanced",
+	"strict"
+]);
+var CLIP_STRICTNESS_FACTOR = {
+	loose: 1,
+	balanced: 1.25,
+	strict: 1.5
+};
+/**
+* The cosine floor a search runs with.
+*
+* An explicit `minScore` is honoured verbatim: it is a number a caller chose,
+* and silently rescaling it would make the same URL mean different things on
+* two installs. Everything else is relative to the model.
+*/
+function resolveClipSearchMinScore(meta, request) {
+	if (request.minScore !== void 0) return request.minScore;
+	const factor = CLIP_STRICTNESS_FACTOR[request.strictness ?? "loose"];
+	return Math.min(1, Math.round(meta.searchMinScore * factor * 1e3) / 1e3);
+}
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -10199,7 +10288,14 @@ var ModelCatalogEntrySchema = object({
 	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
 	* labels already ARE the CamStack macros (Scrypted identity map).
 	*/
-	classMap: DetectionCatalogClassMapSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional(),
+	/**
+	* The model's CLIP feature-space contract (text encoder, dimension, vector
+	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
+	* CLIP image encoder; its absence is what "not a CLIP model" means to the
+	* embedding encoder and the semantic-search store (D649).
+	*/
+	clip: ClipModelMetaSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -14649,6 +14745,13 @@ var LinkedDeviceSchema = object({
 	features: array(string()),
 	producesTrackedEvents: boolean().optional()
 });
+/**
+* The `linked-devices` extension slot's editable value (D648): the operator's
+* pick list, exactly what `_linkedDeviceIds` persists. Tree children are NOT
+* in it — they are always linked and are not a pick.
+*/
+var LinkedDevicesSlotValueSchema = object({ deviceIds: array(number().int().positive()) });
+DeviceType.Camera;
 /** One camera's resolved linked set, tagged with the camera it belongs to.
 *  The batch answer needs the tag; the single-device answer already has it
 *  from the input, which is why `getLinkedDevices` keeps the untagged shape. */
@@ -15174,11 +15277,128 @@ var EmbeddingResultSchema = object({
 	embedding: array(number()),
 	inferenceMs: number()
 });
+/** The two CLIP towers the encoder runs; a crash budget is kept per tower. */
+var EmbeddingTowerSchema = _enum(["image", "text"]);
+/**
+* A tower in the terminal `failed` state (D649, D6): it crashed or failed to
+* load `crashes` times within `windowMs`, and is refused by name until an
+* operator `resetFailedModels` or a model change — never on a timer.
+*
+* `nodeId` is the node whose tower failed. The state lives in THAT node's
+* encoder process (in memory — a runner respawn clears it), and one node's
+* answer says nothing about another's.
+*/
+var EmbeddingFailedModelSchema = object({
+	modelId: string(),
+	tower: EmbeddingTowerSchema,
+	nodeId: string(),
+	crashes: number(),
+	windowMs: number(),
+	sinceMs: number(),
+	lastReason: string()
+});
+/**
+* A model whose REQUIREMENTS can never be met on this node (D649 round 5):
+* an id the catalog does not know, a model URL answering 404/410, a declared
+* sibling (the tokenizer) that is not there. After `attempts` failed builds
+* it is terminally `requirements-failed`, refused by name until an operator
+* `resetFailedModels` or a model change — the same exits as a crashed tower.
+*/
+var EmbeddingFailedRequirementSchema = object({
+	modelId: string(),
+	tower: EmbeddingTowerSchema,
+	nodeId: string(),
+	attempts: number(),
+	sinceMs: number(),
+	lastReason: string()
+});
 var EmbeddingInfoSchema = object({
 	modelId: string(),
 	embeddingDim: number(),
-	ready: boolean()
-});
+	ready: boolean(),
+	/**
+	* The node that answered. Absent only from an encoder older than D649's
+	* crash budget — whose `failedModels` is then UNKNOWN (D315), never "none".
+	*/
+	nodeId: string().optional(),
+	/**
+	* Towers in `failed` on the answering node, each row naming it. `undefined`
+	* means the node could not say (pre-budget encoder); a node that has the
+	* budget always answers an array, empty included.
+	*/
+	failedModels: array(EmbeddingFailedModelSchema).optional(),
+	/** Models terminally `requirements-failed` on the answering node; same reading as above. */
+	failedRequirements: array(EmbeddingFailedRequirementSchema).optional()
+});
+/**
+* The THREE codes an encoder refusal can carry (D649, D6). Same shape as
+* `VECTOR_INDEX_DIM_CONFLICT`: the code rides in the MESSAGE, because an
+* Error's own properties do not survive the UDS/tRPC hop and its message does,
+* and both sides go through the helpers below — the encoder builds the
+* refusal, the live detail plane classifies on it to count refusals per
+* camera instead of logging one warning per track. The bracketed token
+* carries the code, the model, the tower and the node so a consumer never
+* parses prose.
+*
+* - `EMBEDDING_MODEL_FAILED`: the tower crashed / failed to load past the crash
+*   budget — terminal until `resetFailedModels` or a model change.
+* - `EMBEDDING_REQUIREMENTS_UNAVAILABLE`: files or runtime not there right now
+*   (a download or Python that failed, or the cooldown after one) — the next
+*   request past the cooldown tries again.
+* - `EMBEDDING_REQUIREMENTS_FAILED`: the requirements can never be met (unknown
+*   id, 404/410, missing sibling) and the bounded attempts are spent —
+*   terminal, same exits as a crashed tower.
+*/
+var EMBEDDING_MODEL_FAILED = "embedding-model-failed";
+var EMBEDDING_REQUIREMENTS_UNAVAILABLE = "embedding-requirements-unavailable";
+var EMBEDDING_REQUIREMENTS_FAILED = "embedding-requirements-failed";
+var EmbeddingRefusalCodeSchema = _enum([
+	EMBEDDING_MODEL_FAILED,
+	EMBEDDING_REQUIREMENTS_UNAVAILABLE,
+	EMBEDDING_REQUIREMENTS_FAILED
+]);
+function embeddingRefusalToken(code, on) {
+	return `[${code} model=${on.modelId} tower=${on.tower} node=${on.nodeId}]`;
+}
+/** The encoder's refusal for a crashed tower, carrying {@link EMBEDDING_MODEL_FAILED}. */
+function embeddingModelFailedError(row) {
+	return /* @__PURE__ */ new Error(`${embeddingRefusalToken(EMBEDDING_MODEL_FAILED, row)} ${row.modelId} (${row.tower} tower) crashed ${String(row.crashes)} times in ${String(Math.round(row.windowMs / 1e3))}s on ${row.nodeId} — ${row.lastReason}. Cleared by embeddingEncoder.resetFailedModels({ modelId: "${row.modelId}", nodeId: "${row.nodeId}" }) or a model change.`);
+}
+/** The requirements refusal for THIS request, carrying {@link EMBEDDING_REQUIREMENTS_UNAVAILABLE}. */
+function embeddingRequirementsUnavailableError(on, reason) {
+	return /* @__PURE__ */ new Error(`${embeddingRefusalToken(EMBEDDING_REQUIREMENTS_UNAVAILABLE, on)} ${on.modelId} (${on.tower} tower) on ${on.nodeId}: ${reason}`);
+}
+/** The terminal requirements refusal, carrying {@link EMBEDDING_REQUIREMENTS_FAILED}. */
+function embeddingRequirementsFailedError(row) {
+	return /* @__PURE__ */ new Error(`${embeddingRefusalToken(EMBEDDING_REQUIREMENTS_FAILED, row)} ${row.modelId} (${row.tower} tower) on ${row.nodeId}: requirements can never be met — ${String(row.attempts)} attempts, last: ${row.lastReason}. Cleared by embeddingEncoder.resetFailedModels({ modelId: "${row.modelId}", nodeId: "${row.nodeId}" }) or a model change.`);
+}
+var EMBEDDING_REFUSAL_TOKEN = new RegExp(`\\[(${EMBEDDING_MODEL_FAILED}|${EMBEDDING_REQUIREMENTS_UNAVAILABLE}|${EMBEDDING_REQUIREMENTS_FAILED}) model=([^\\s\\]]+) tower=(image|text) node=([^\\s\\]]+)\\]`);
+/** The refusal `err` (possibly re-wrapped by a transport) carries, or `null` for any other error. */
+function embeddingRefusalOf(err) {
+	const message = err instanceof Error ? err.message : String(err);
+	const match = EMBEDDING_REFUSAL_TOKEN.exec(message);
+	if (match === null) return null;
+	const code = EmbeddingRefusalCodeSchema.safeParse(match[1]);
+	const tower = EmbeddingTowerSchema.safeParse(match[3]);
+	if (!code.success || !tower.success || match[2] === void 0 || match[4] === void 0) return null;
+	return {
+		code: code.data,
+		modelId: match[2],
+		tower: tower.data,
+		nodeId: match[4]
+	};
+}
+/**
+* ONE provider per node (`placement: any-node`), addressed like every global
+* collection: the codegen injects a `{ nodeId?, addonId? }` selector on the
+* void methods and lifts a top-level `nodeId` off the object ones. A call
+* that names no node is answered by the HUB's provider — never by a merge
+* across nodes, because no global collection fans out across nodes (only the
+* providers of one node are `concatCollection`-fanned). So a fleet view of
+* `failedModels` is one `getInfo({ nodeId })` per node, and every answer
+* names the node it came from (D649 round 4); a node that cannot be asked is
+* UNKNOWN to the reader, never "no failures" (D315).
+*/
 var embeddingEncoderCapability = {
 	name: "embedding-encoder",
 	scope: "system",
@@ -15197,8 +15417,30 @@ var embeddingEncoderCapability = {
 			width: number(),
 			height: number()
 		}), EmbeddingResultSchema, { auth: "admin" }),
-		encodeText: method(object({ text: string() }), EmbeddingResultSchema, { auth: "admin" }),
-		getInfo: method(_void(), EmbeddingInfoSchema, { auth: "admin" })
+		/**
+		* `modelId` (a CLIP IMAGE model id, whose catalog `clip.textModelId` names
+		* the text tower) encodes in that model's space; absent, the cluster row's
+		* `clip-embedding` model — the space every writer is in (D649).
+		*/
+		encodeText: method(object({
+			text: string(),
+			modelId: string().min(1).optional()
+		}), EmbeddingResultSchema, { auth: "admin" }),
+		/** Answers for ONE node — the `nodeId` selector's, else the hub's. */
+		getInfo: method(_void(), EmbeddingInfoSchema, { auth: "admin" }),
+		/**
+		* The operator's explicit clear of the `failed` state (one model, or all)
+		* on ONE node — pass `nodeId` for an agent; the result names the node it
+		* cleared. The only way out besides a model change: a crashing tower is
+		* not retried on a timer.
+		*/
+		resetFailedModels: method(object({ modelId: string().min(1).optional() }), object({
+			cleared: array(string()),
+			nodeId: string()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 /**
@@ -18727,7 +18969,12 @@ var NcMediaPolicySchema = object({
 	* the degrade engine, which drops the video and keeps the still.
 	*/
 	clip: boolean().optional(),
-	/** Seconds of footage BEFORE / AFTER the event instant. Defaults 3 / 7. */
+	/**
+	* Seconds of footage BEFORE / AFTER the event instant. Absent =
+	* {@link NC_CLIP_PRE_ROLL_DEFAULT_SEC} / {@link NC_CLIP_POST_ROLL_DEFAULT_SEC}
+	* (4 / 6), resolved by the Notification Center at dispatch — deliberately not
+	* a Zod default, so a rule that never chose keeps following the hub's.
+	*/
 	clipPreRollSec: number().int().min(0).max(30).optional(),
 	clipPostRollSec: number().int().min(0).max(30).optional(),
 	/**
@@ -20810,6 +21057,202 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
+* A model choice has a SCOPE, and a scope change has a workflow.
+*
+* ## The two scopes
+*
+* Almost every pipeline step's model is a **node** question: which build runs
+* fastest on THIS accelerator. Two nodes may legitimately answer differently —
+* a Coral runs the tflite SSD, a Mac runs the coreml YOLO — because the answers
+* are compared against nothing. They produce boxes, and a box is a box.
+*
+* Two steps are not like that. `face-embedding` and `clip-embedding` produce
+* **vectors that land in ONE shared index** (`identity_samples`,
+* `vec_object_clip`) and are ranked against each other by cosine similarity.
+* Cosine similarity between two encoders is not a weak signal, it is a
+* meaningless number — and nothing inside a vector can tell you it happened.
+* So for those two steps the model is a **cluster** question with exactly one
+* answer, stored in exactly one row.
+*
+* That is the same argument [D52](../../../../docs/decisions/adr-0052.md) makes
+* for the crop convention (`detail-crop.ts`), one level up: the crop decides
+* WHAT pixels the encoder sees, this decides WHICH encoder sees them. Both are
+* cluster-wide for the same reason and neither may become per-node.
+*
+* ## Why the registry lives here and not in the step catalog
+*
+* The scope itself is declared on the step, in
+* `detection-pipeline/registry/step-definitions.ts` (`StepDefinition.modelScope`)
+* — that is where a new step declares what kind of choice its model is. But the
+* catalog lives inside `addon-pipeline`, and three packages that must NOT
+* import an addon need to know the set: the orchestrator (which renders and
+* stores the row), post-analysis (which pins the row for a re-embed pass) and
+* admin-ui (which mirrors it). So the set is mirrored here, and
+* `scripts/check-cluster-model-scope.ts` fails the build when the two disagree.
+* A hand-copied key that stops matching is exactly how a setting silently stops
+* arriving while both sides still look correct.
+*
+* ## The defaults ARE today's behaviour
+*
+* {@link DEFAULT_CLUSTER_STEP_MODELS} reproduces the catalog `defaultModelId`
+* of both steps. Declaring the scope therefore changes nothing on the day it
+* ships: the cluster row starts out saying what every node was already doing.
+* Changing it is legitimate — that is what the knob is for — but it invalidates
+* the stored vectors of that surface, and must be followed by a re-embed pass
+* (`face-reembed-pass.ts`, `embedding-rebuild.ts`).
+*/
+/**
+* Why the orchestrator cannot say which model the operator chose for a
+* cluster-scoped step (D651).
+*/
+var CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS = [
+	"owner-not-ready",
+	"store-read-failed",
+	"three-way-read-unavailable",
+	"invalid-stored",
+	"not-cluster-scoped"
+];
+/**
+* The cluster-scoped steps. Mirrored from the catalog's `modelScope: 'cluster'`
+* declarations and guarded by `scripts/check-cluster-model-scope.ts`.
+*/
+var CLUSTER_MODEL_SCOPED_STEPS = [{
+	stepId: "face-embedding",
+	label: "Face recognition model",
+	defaultModelId: "auraface-r100",
+	indexName: "the enrolled face gallery",
+	options: [
+		{
+			id: "auraface-r100",
+			label: "AuraFace R100"
+		},
+		{
+			id: "arcface-r100",
+			label: "ArcFace (ResNet34)"
+		},
+		{
+			id: "inception-resnet-v1",
+			label: "Inception ResNet V1"
+		}
+	]
+}, {
+	stepId: "clip-embedding",
+	label: "Semantic search model",
+	defaultModelId: "mobileclip-s1",
+	indexName: "the object semantic-search index",
+	options: [
+		{
+			id: "mobileclip-s1",
+			label: "MobileCLIP S1"
+		},
+		{
+			id: "mobileclip-s2",
+			label: "MobileCLIP S2"
+		},
+		{
+			id: "siglip2-b16-224",
+			label: "SigLIP2 B/16 (Apache-2.0)"
+		}
+	]
+}];
+/**
+* The settings key holding one step's cluster model choice.
+*
+* Step-qualified so the keys stay unique across the addon's whole schema, which
+* is what lets {@link pickClusterStepModels} walk every section instead of
+* trusting the section id.
+*/
+function clusterModelSettingKey(stepId) {
+	return `clusterModel:${stepId}`;
+}
+/** The cluster row when nobody has configured one — today's catalog defaults. */
+var DEFAULT_CLUSTER_STEP_MODELS = Object.freeze(Object.fromEntries(CLUSTER_MODEL_SCOPED_STEPS.map((s) => [s.stepId, s.defaultModelId])));
+function interpretStoredClusterModel(raw) {
+	if (raw === void 0 || raw === null || raw === "") return { kind: "absent" };
+	if (typeof raw === "string") return {
+		kind: "chosen",
+		modelId: raw
+	};
+	return {
+		kind: "invalid",
+		value: raw
+	};
+}
+/**
+* Narrow a FLAT settings record to the cluster row.
+*
+* Per-FIELD fallback, deliberately (same rule as `readDetailCropConvention`): a
+* junk face model must not also discard a valid clip model. An `absent` or
+* `invalid` value ({@link interpretStoredClusterModel}) resolves to the step's
+* catalog default — never to a blank id, because a blank id downstream becomes
+* "substitute the format default", which is precisely the substitution this
+* scope exists to forbid.
+*/
+function readClusterStepModels(config) {
+	const out = {};
+	for (const step of CLUSTER_MODEL_SCOPED_STEPS) {
+		const read = interpretStoredClusterModel(config[clusterModelSettingKey(step.stepId)]);
+		out[step.stepId] = read.kind === "chosen" ? read.modelId : step.defaultModelId;
+	}
+	return out;
+}
+function isHydratedField$2(entry) {
+	return typeof entry === "object" && entry !== null && "key" in entry;
+}
+/**
+* Extract the cluster row from an `addon-settings.getGlobalSettings` payload.
+*
+* Walks EVERY section rather than looking inside {@link CLUSTER_MODEL_SECTION_ID}
+* alone: the keys are unique across the addon's schema, and a section rename
+* must not silently revert the whole cluster to the defaults. A `null` payload
+* (addon mid-boot) is the defaults.
+*/
+function pickClusterStepModels(view) {
+	if (view === null) return DEFAULT_CLUSTER_STEP_MODELS;
+	return readClusterStepModels(flattenHydratedView(view, clusterModelKeys()));
+}
+function clusterModelKeys() {
+	return new Set(CLUSTER_MODEL_SCOPED_STEPS.map((s) => clusterModelSettingKey(s.stepId)));
+}
+/** The `wanted` keys of a hydrated view as one flat record, every section walked. */
+function flattenHydratedView(view, wanted) {
+	const flat = {};
+	for (const section of view.sections) for (const entry of section.fields) {
+		if (!isHydratedField$2(entry) || typeof entry.key !== "string") continue;
+		if (wanted.has(entry.key)) flat[entry.key] = entry.value;
+	}
+	return flat;
+}
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
+/**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
 * per-frame detections emitted by the pipeline runner into tracked
 * objects, per-kind event collections (motion / object / audio), and
@@ -21625,7 +22068,8 @@ var MediaFileKindEnum = _enum([
 	"thumbnailSmall",
 	"confirmationCrop",
 	"debugCrop",
-	"sceneFrame"
+	"sceneFrame",
+	"lastSceneFrame"
 ]);
 /**
 * One media row ON THE WIRE: what it is, how big it is, and WHERE ITS BYTES
@@ -22177,7 +22621,23 @@ var SearchObjectEventsInput = object({
 	until: number().optional(),
 	classFilter: string().optional(),
 	limit: number().default(50),
-	minScore: number().min(0).max(1).default(.2)
+	/**
+	* An ABSOLUTE cosine floor. Optional since D649: a floor is a property of the
+	* model (0.2 kept 96% of matched pairs on MobileCLIP S1 and 2.7% on SigLIP2),
+	* so an absent one resolves to the searched model's own `searchMinScore`
+	* scaled by `strictness`. A number sent here is honoured verbatim.
+	*/
+	minScore: number().min(0).max(1).optional(),
+	/** Model-relative floor — see `resolveClipSearchMinScore`. Default `loose`. */
+	strictness: ClipSearchStrictnessSchema.optional(),
+	/**
+	* Search THIS CLIP model's index instead of the cluster row's. Every index a
+	* model ever wrote stays searchable until it is wiped (the MobileCLIP index
+	* through a SigLIP2 cutover and its rollback window). An id with no CLIP
+	* metadata is refused; an id other than the cluster row's is ADMIN-only
+	* (`model-override-requires-admin`).
+	*/
+	modelId: string().min(1).optional()
 });
 var TrackCascadeCountsSchema = object({
 	/** Persisted track roots deleted (authoritative). */
@@ -22312,7 +22772,41 @@ var RebuildObjectEmbeddingsInput = object({
 * comparable, so wiping and rebuilding is the only way to be sure every vector
 * means the same thing.
 */
-var WipeObjectEmbeddingsResultSchema = object({ deleted: number() });
+var WipeObjectEmbeddingsResultSchema = object({
+	deleted: number(),
+	/**
+	* CLIP indexes that could NOT be emptied (unreachable, or refused at their
+	* dimension) — not a clean slate. Additive and optional (D649).
+	*/
+	failedIndexes: array(string()).optional()
+});
+/**
+* Why a rebuild did not start, BY NAME — ONE vocabulary for both gates in front
+* of a pass (D649 over D651). A bare `started: false` read the same for "the
+* stores are booting" and "the cluster row names a model with no CLIP
+* metadata", which need different fixes.
+*  - `stores-unavailable` — the analytics stores or the API are not up yet.
+*  - the owner's confirmation of the cluster model (D651, `ClusterPinConfirmer`):
+*    a pass that rewrites an index needs two agreeing reads of the OWNER's
+*    answer (`pipelineOrchestrator.getClusterModelChoice`) — a pass that cannot
+*    name its model does not run (D54):
+*    - the owner's own `unreadable` reasons (`owner-not-ready`,
+*      `store-read-failed`, `three-way-read-unavailable`, `invalid-stored`,
+*      `not-cluster-scoped`);
+*    - `method-unavailable` — the orchestrator predates the method;
+*    - `read-failed` — the call failed or answered something unparseable;
+*    - `reads-disagree` — the two reads named different choices.
+*  - `not-a-clip-model` — the CONFIRMED id has no CLIP metadata, so there is no
+*    index to fill and no dimension to check against (D649).
+*/
+var RebuildObjectEmbeddingsRefusalSchema = _enum([
+	"stores-unavailable",
+	...CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS,
+	"method-unavailable",
+	"read-failed",
+	"reads-disagree",
+	"not-a-clip-model"
+]);
 /**
 * Acknowledgement that a rebuild STARTED.
 *
@@ -22325,7 +22819,12 @@ var WipeObjectEmbeddingsResultSchema = object({ deleted: number() });
 var RebuildObjectEmbeddingsResultSchema = object({
 	started: boolean(),
 	/** True when a pass was already running; the new request is ignored. */
-	alreadyRunning: boolean()
+	alreadyRunning: boolean(),
+	/** Present when the pass refused to start — see `RebuildObjectEmbeddingsRefusalSchema`. */
+	refusal: RebuildObjectEmbeddingsRefusalSchema.optional(),
+	/** The CLIP model the pass pinned, and the index it fills (when it started). */
+	modelId: string().optional(),
+	index: string().optional()
 });
 var RebuildStatusSchema = object({
 	running: boolean(),
@@ -22359,7 +22858,11 @@ var RebuildStatusSchema = object({
 	startedAtMs: number().nullable(),
 	finishedAtMs: number().nullable(),
 	/** Present when the pass ended by throwing. */
-	error: string().nullable()
+	error: string().nullable(),
+	/** The CLIP model the current / last pass pinned (D54), `null` before any. */
+	modelId: string().nullable(),
+	/** The index that pass fills — `ClipModelMeta.vectorIndex` of `modelId` (D649). */
+	index: string().nullable()
 });
 /**
 * Acknowledgement that a debug-media reclaim STARTED.
@@ -23318,7 +23821,7 @@ var pipelineAnalyticsCapability = {
 		* ObjectEvents by trackId. Returns up to `limit` events scored ≥
 		* `minScore`, sorted descending by score.
 		*/
-		searchObjectEvents: method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()),
+		searchObjectEvents: method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly(), { caller: "required" }),
 		wipeObjectEmbeddings: method(object({}), WipeObjectEmbeddingsResultSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -24415,6 +24918,17 @@ var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal
 	hubHostnameOverride: string().optional()
 })]).describe("Per-camera frame-source mode for the runner (P2c)");
 /**
+* What ONE step runs with on ONE roster device for THIS camera (D650): the
+* device's per-(node,device) base with the camera's override for that device
+* on top — the same `override ?? base` merge the orchestrator applies to the
+* elected device (`applyDeviceProvisioning`). Absent `modelId` ⇒ the executor
+* resolves the device format's default, exactly as on the elected device.
+*/
+var RunnerJumpStepProvisioningSchema = object({
+	modelId: string().optional(),
+	settings: record(string(), unknown()).optional()
+});
+/**
 * One ENABLED inference device on the runner's node, as the step-tree
 * device-jump resolver sees it (phase 1). The orchestrator populates this
 * roster on the attach payload whenever the camera is elected onto a specific
@@ -24426,7 +24940,16 @@ var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal
 var RunnerInferenceDeviceSchema = object({
 	deviceKey: string(),
 	weight: number().positive().default(1),
-	maxSessions: number().int().positive().nullable().default(null)
+	maxSessions: number().int().positive().nullable().default(null),
+	/**
+	* Per-step provisioning for this camera on THIS device (D650), keyed by step
+	* id. A step the runner jumps here runs with these fields, never with the
+	* elected device's: `modelId` / `settings` are REPLACED on the jumped subtree
+	* (a step absent from the map runs with neither — the target format default).
+	* Absent field ⇒ an orchestrator that predates D650: the jumped step keeps
+	* the elected device's provisioning, as before.
+	*/
+	steps: record(string(), RunnerJumpStepProvisioningSchema).optional()
 });
 /**
 * Camera assignment payload sent by `addon-pipeline-orchestrator` to a
@@ -25301,6 +25824,28 @@ var NodeInferenceDeviceSchema = object({
 	*/
 	exclusion: InferenceDeviceExclusionReasonSchema.nullable()
 });
+/**
+* The operator's model choice for one cluster-scoped step, answered by the
+* addon that OWNS the `clusterModel:*` settings (D651). Three answers, never
+* folded: a written choice, a key nobody wrote (the cluster runs the default
+* BY ABSENCE), or no answer. A caller that rewrites an index acts only on the
+* first two, read twice and agreeing.
+*/
+var ClusterModelChoiceSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("stored"),
+		modelId: string()
+	}),
+	object({
+		kind: literal("absent"),
+		defaultModelId: string()
+	}),
+	object({
+		kind: literal("unreadable"),
+		reason: _enum(CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS),
+		error: string().optional()
+	})
+]);
 var NodeInferenceDevicesSchema = object({
 	nodeId: string(),
 	/** False when the node's platform-probe was unreachable (no live device set). */
@@ -25328,10 +25873,17 @@ method(StorageMigrationLeaseInputSchema, object({ paused: literal(true) }), {
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceId: number() }), object({ deviceKey: string().nullable() })), method(_void(), object({ migrated: number() }), {
+}), method(object({ deviceId: number() }), object({ deviceKey: string().nullable() })), method(_void(), object({
+	migrated: number(),
+	skipped: array(object({
+		deviceId: number(),
+		targetNodeId: string(),
+		reason: string()
+	})).default([])
+}), {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), array(PipelineAssignmentSchema).readonly()), method(object({ deviceId: number() }), PipelineAssignmentSchema.nullable()), method(_void(), array(AgentLoadSummarySchema).readonly()), method(_void(), GlobalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(object({ nodeId: string() }), CapabilityBindingsSchema), method(object({
+}), method(_void(), array(PipelineAssignmentSchema).readonly()), method(object({ deviceId: number() }), PipelineAssignmentSchema.nullable()), method(_void(), array(AgentLoadSummarySchema).readonly()), method(object({ stepId: string() }), ClusterModelChoiceSchema), method(_void(), GlobalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(object({ nodeId: string() }), CapabilityBindingsSchema), method(object({
 	nodeId: string(),
 	capName: string(),
 	addonId: string()
@@ -27047,6 +27599,20 @@ var VectorScanResultSchema = object({
 	*/
 	nextCursor: number().int().nonnegative().nullable()
 });
+/**
+* The ONE error code for "this index exists at another dimension; refusing to
+* redeclare it" (D649). It rides in the MESSAGE — an Error's own properties do
+* not survive the UDS/tRPC hop, its message does — and both sides go through
+* the helpers below, never a copied phrase: a consumer that must tell "this
+* index can never hold my vectors" from "the provider is unreachable" (a
+* delete counts the first as nothing-to-delete and the second as still
+* present) otherwise breaks silently the day the wording changes.
+*/
+var VECTOR_INDEX_DIM_CONFLICT = "vector-index-dim-conflict";
+/** True when `err` (possibly re-wrapped by a transport) is that refusal. */
+function isVectorIndexDimConflict(err) {
+	return (err instanceof Error ? err.message : String(err)).includes(`[${VECTOR_INDEX_DIM_CONFLICT}]`);
+}
 var VectorStatsInputSchema = object({ index: string() });
 var VectorStatsResultSchema = object({
 	/** Provider id, so an operator can tell brute force from an ANN index. */
@@ -27706,6 +28272,349 @@ DeviceType.Camera, method(object({
 	auth: "protected"
 });
 /**
+* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
+* valutatore puro del suo FRONTE.
+*
+* Viveva dentro il builtin virtual-doorbell
+* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
+* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
+* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
+* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
+* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
+* SPOSTA qui e il doorbell la ri-esporta.
+*
+* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
+* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
+* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
+* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
+*/
+/**
+* Known binary / switch source caps → the boolean slice field whose
+* false→true rise counts as ACTIVE. Every entry is "fire on active".
+* Sensors whose "active" reading is not a plain boolean (presence's string
+* state, connectivity's connected flag) are deliberately excluded — a
+* reconnect is not a doorbell press, and it is not a recording either.
+*/
+var SOURCE_CAP_ACTIVE_FIELD = {
+	contact: "entryOpen",
+	binary: "on",
+	switch: "on",
+	motion: "detected",
+	flood: "flooded",
+	gas: "detected",
+	smoke: "detected",
+	"carbon-monoxide": "detected",
+	vibration: "detected",
+	tamper: "tampered"
+};
+/**
+* The same caps → the slice field carrying the ms-epoch timestamp of the
+* last transition. Every source cap MUST appear here (guarded by a spec):
+* without a transition timestamp the evaluator cannot tell a genuine rise
+* from a boot-time hydration when the FIRST slice it ever sees is already
+* active, and errs towards silence — swallowing the rise.
+*
+* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
+* provider derives them from `state.last_changed`, so they survive our own
+* restarts and correctly read as "hours ago" for a state that has been
+* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
+*/
+var SOURCE_CAP_CHANGED_AT_FIELD = {
+	contact: "lastChangedAt",
+	binary: "lastChangedAt",
+	switch: "lastChangedAt",
+	motion: "lastDetectedAt",
+	flood: "lastChangedAt",
+	gas: "lastChangedAt",
+	smoke: "lastChangedAt",
+	"carbon-monoxide": "lastChangedAt",
+	vibration: "lastChangedAt",
+	tamper: "lastChangedAt"
+};
+/** Cap names whose presence in a device's bindings qualify it as a source. */
+var SOURCE_CAPS = Object.keys(SOURCE_CAP_ACTIVE_FIELD);
+/** True when a cap is a recognised binary/switch source. */
+function isSourceCap(capName) {
+	return Object.prototype.hasOwnProperty.call(SOURCE_CAP_ACTIVE_FIELD, capName);
+}
+/** Extract the "active" boolean a source cap's slice carries, or null when
+*  the cap is unknown or the field is missing / non-boolean. */
+function sliceActiveValue(capName, slice) {
+	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	return typeof raw === "boolean" ? raw : null;
+}
+/** Ms-epoch transition timestamp a source cap's slice carries, or null when
+*  it is absent, non-numeric or the zero "never observed" sentinel. */
+function sliceChangedAt(capName, slice) {
+	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
+	return raw;
+}
+/**
+* How recent a source's own transition timestamp must be for a FIRST
+* sighting that is already active to count as a genuine rise rather than a
+* hydration of long-standing state.
+*/
+var DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = 3e4;
+/**
+* IL fronte. Puro: nessun orologio proprio, nessuna memoria — il chiamante
+* porta `prior`, `nowMs` e il proprio `startedAtMs`.
+*
+* Il caso della PRIMA slice già attiva è trattato esplicitamente e vale come
+* fronte solo se il timestamp UPSTREAM della transizione è posteriore a
+* `startedAtMs` **e** entro `firstSightingFreshnessMs`. Entrambe le metà
+* servono: la sola freschezza scatterebbe su un'idratazione al boot di uno
+* stato flippato pochi secondi prima del riavvio, e il solo "dopo che abbiamo
+* iniziato" scatterebbe, su un processo di lunga vita, per una sorgente
+* adottata oggi il cui stato è cambiato ieri. Il caso ambiguo ERRA VERSO IL
+* SILENZIO e lo dichiara (`baseline-seeded-stale-active`).
+*/
+function evaluateSensorEdge(input) {
+	const value = sliceActiveValue(input.capName, input.slice);
+	if (value === null) return {
+		edge: "none",
+		value: null,
+		reason: isSourceCap(input.capName) ? "non-boolean-value" : "unknown-cap"
+	};
+	if (input.prior === void 0) {
+		if (!value) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-inactive"
+		};
+		const changedAt = sliceChangedAt(input.capName, input.slice);
+		const floor = Math.max(input.startedAtMs, input.nowMs - input.firstSightingFreshnessMs);
+		if (changedAt === null || changedAt < floor) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-stale-active"
+		};
+		return {
+			edge: "rising",
+			value: true
+		};
+	}
+	if (input.prior === value) return {
+		edge: "none",
+		value,
+		reason: "no-change"
+	};
+	if (!value) return {
+		edge: "none",
+		value,
+		reason: "falling-edge"
+	};
+	return {
+		edge: "rising",
+		value: true
+	};
+}
+/**
+* Doorbell button cap. Two kinds of providers coexist behind this cap
+* name (same pattern as `snapshot`):
+*
+*   - **Native** providers: registered per-device by device-driver
+*     addons via `ctx.registerNativeCap` — either on a
+*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
+*     or directly on the camera (Reolink registers at camera level).
+*     Emits an `onPressed` event every time the firmware pushes a
+*     ring; status tracks the last press and a pressCount since start
+*     (diagnostic).
+*
+*   - **Wrapper** provider: the `virtual-doorbell` system builtin
+*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
+*     device (contact / switch / event-emitter …) into a doorbell for
+*     a camera. `defaultActive: false` — the operator explicitly binds
+*     it per camera in the device-bindings UI, then picks the source
+*     device + trigger in the per-device settings.
+*
+* The DeviceEventPropagator re-emits `onPressed` on the camera parent
+* — subscribers listening at the camera level receive ring events
+* with `via[]` populated. No code on the parent needed.
+*/
+var DoorbellStatusSchema = object({
+	/** Ms epoch of the last press. null = never observed since this provider started. */
+	lastPressedAt: number().nullable(),
+	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
+	pressCountSinceStart: number()
+});
+var DoorbellPressEventSchema = object({
+	deviceId: number(),
+	timestamp: number()
+});
+/**
+* The `doorbell-source` extension slot's editable value (D648): the camera's
+* virtual-doorbell trigger devices, exactly what the wrapper's
+* `doorbellSources` persists (as `{ deviceId }` records).
+*/
+var DoorbellSourceSlotValueSchema = object({ deviceIds: array(number().int().positive()) });
+/**
+* The `doorbell-source` slot — which devices ring this camera's VIRTUAL
+* doorbell, owned by the `virtual-doorbell` wrapper over its
+* `doorbellSources` store (D648). A source rings when one of its
+* `SOURCE_CAPS` rises. Whether the wrapper is bound to the camera at all is a
+* different authority (`deviceManager.setWrapperActive`, D62) — the slot
+* reports it, it never writes it.
+*/
+var DOORBELL_SOURCE_SLOT = {
+	id: "doorbell-source",
+	label: "Doorbell trigger devices",
+	description: "Any of these becoming active rings this camera's virtual doorbell: a binary sensor when it goes active, a switch when it turns on.",
+	shape: "association",
+	hostDeviceTypes: [DeviceType.Camera],
+	sourceCaps: SOURCE_CAPS,
+	cardinality: "many",
+	value: DoorbellSourceSlotValueSchema
+};
+var doorbellCapability = {
+	name: "doorbell",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	kind: "wrapper",
+	defaultActive: false,
+	deviceTypes: [DeviceType.Button, DeviceType.Camera],
+	exposesDeviceSettings: true,
+	extensionSlots: [DOORBELL_SOURCE_SLOT],
+	methods: {},
+	events: { 
+	/**
+	* Fires once per physical press. Reolink delivers via Baichuan
+	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
+	* release/duration — it's a pulse.
+	*/
+onPressed: { data: DoorbellPressEventSchema } },
+	status: {
+		schema: DoorbellStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — last press timestamp + lifetime press count.
+	* Mirrored by the kernel and readable via
+	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
+	* without subscribing.
+	*/
+	runtimeState: DoorbellStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+var ExtensionSlotIdSchema = _enum(["doorbell-source", "linked-devices"]);
+DeviceType.Camera, DeviceType.Camera;
+/** A slot's editable value, discriminated on `slot`. */
+var ExtensionSlotValueSchema = discriminatedUnion("slot", [DoorbellSourceSlotValueSchema.extend({ slot: literal("doorbell-source") }), LinkedDevicesSlotValueSchema.extend({ slot: literal("linked-devices") })]);
+DeviceType.Camera;
+var ExtensionSourceAvailabilitySchema = discriminatedUnion("state", [object({ state: literal("ok") }), object({
+	state: literal("unreachable"),
+	reason: string()
+})]);
+/** One provider of slots — the D554 source-listing row. */
+var ExtensionSourceSchema = object({
+	/** The routing prefix of every `slotRef` this provider serves. */
+	source: string(),
+	label: string(),
+	/** Stamped by the dispatcher from the registry (D557). */
+	addonId: string().optional(),
+	availability: ExtensionSourceAvailabilitySchema
+});
+/**
+* How one picked source stands. `missing` — no such device (deleted, or an id
+* that never existed); `foreign` — a device the slot's owner cannot read from
+* (slice 2's cross-owner graft source); `unavailable` — it exists but is not a
+* valid source now (a container, which is never a pick). A source in any of
+* these states is SHOWN, never silently dropped or re-pointed.
+*/
+var ExtensionSourceHealthSchema = _enum([
+	"ok",
+	"missing",
+	"foreign",
+	"unavailable"
+]);
+var ExtensionSlotSourceSchema = object({
+	deviceId: number().int(),
+	/** The device's name, or null when it could not be resolved (`missing`). */
+	name: string().nullable(),
+	health: ExtensionSourceHealthSchema,
+	detail: string().optional()
+});
+/**
+* A DIFFERENT authority that gates whether the slot's sources do anything —
+* reported read-only, named, never written through this contract (D62). The
+* virtual doorbell's sources ring only while the wrapper is bound to the
+* camera, and that binding belongs to `deviceManager.setWrapperActive`.
+* `unknown` means the gate could not be read; it is not "inactive" (D315).
+*/
+var ExtensionSlotActivationSchema = object({
+	state: _enum([
+		"active",
+		"inactive",
+		"unknown"
+	]),
+	authority: string(),
+	detail: string().optional()
+});
+var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
+	state: literal("ok"),
+	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
+	slotRef: string(),
+	slot: ExtensionSlotIdSchema,
+	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
+	authority: string(),
+	/** graft: its switch. association: null — removing every source is "off". */
+	enabled: boolean().nullable(),
+	/** graft: the cap registered on the host. association: null. */
+	projects: string().nullable(),
+	activation: ExtensionSlotActivationSchema.nullable(),
+	value: ExtensionSlotValueSchema,
+	sources: array(ExtensionSlotSourceSchema)
+}), object({
+	state: literal("unreachable"),
+	addonId: string(),
+	reason: string()
+})]);
+var ExtensionCandidatesSchema = object({ candidates: array(object({
+	deviceId: number().int(),
+	name: string(),
+	type: string(),
+	location: string().nullable(),
+	/** The container a child belongs to — "Spotlight 2" alone does not say which. */
+	parentName: string().nullable(),
+	/** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
+	suggested: boolean(),
+	/** Why it is suggested ("same location"), null when it is not. */
+	reason: string().nullable()
+})) });
+/**
+* What a write did. `none` — applied in place. `host` / `parent` — the owner
+* reloaded the host (or, for an accessory child, its parent) because the
+* write changed what the host REGISTERS (a graft switched on or off, slice 2).
+*/
+var ExtensionSetResultSchema = object({
+	applied: literal(true),
+	reload: _enum([
+		"none",
+		"host",
+		"parent"
+	])
+});
+var ExtensionSlotRefInputSchema = object({
+	deviceId: number().int(),
+	slotRef: string().min(1)
+});
+var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
+method(object({ deviceId: number().int() }), array(ExtensionSourceSchema)), method(object({ deviceId: number().int() }), array(ExtensionSlotRowSchema)), method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema), method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * Optional client-side hints sent at session creation to help the provider
 * pick the best native source. All fields optional — a viewer that knows
 * nothing still gets a sane default. (Relocated from the retired `webrtc`
@@ -30155,75 +31064,6 @@ onStatusChanged: { data: object({
 	volatileStateFields: ["lastChangedAt"]
 };
 /**
-* Doorbell button cap. Two kinds of providers coexist behind this cap
-* name (same pattern as `snapshot`):
-*
-*   - **Native** providers: registered per-device by device-driver
-*     addons via `ctx.registerNativeCap` — either on a
-*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
-*     or directly on the camera (Reolink registers at camera level).
-*     Emits an `onPressed` event every time the firmware pushes a
-*     ring; status tracks the last press and a pressCount since start
-*     (diagnostic).
-*
-*   - **Wrapper** provider: the `virtual-doorbell` system builtin
-*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
-*     device (contact / switch / event-emitter …) into a doorbell for
-*     a camera. `defaultActive: false` — the operator explicitly binds
-*     it per camera in the device-bindings UI, then picks the source
-*     device + trigger in the per-device settings.
-*
-* The DeviceEventPropagator re-emits `onPressed` on the camera parent
-* — subscribers listening at the camera level receive ring events
-* with `via[]` populated. No code on the parent needed.
-*/
-var DoorbellStatusSchema = object({
-	/** Ms epoch of the last press. null = never observed since this provider started. */
-	lastPressedAt: number().nullable(),
-	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
-	pressCountSinceStart: number()
-});
-var DoorbellPressEventSchema = object({
-	deviceId: number(),
-	timestamp: number()
-});
-var doorbellCapability = {
-	name: "doorbell",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	kind: "wrapper",
-	defaultActive: false,
-	deviceTypes: [DeviceType.Button, DeviceType.Camera],
-	exposesDeviceSettings: true,
-	methods: {},
-	events: { 
-	/**
-	* Fires once per physical press. Reolink delivers via Baichuan
-	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
-	* release/duration — it's a pulse.
-	*/
-onPressed: { data: DoorbellPressEventSchema } },
-	status: {
-		schema: DoorbellStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — last press timestamp + lifetime press count.
-	* Mirrored by the kernel and readable via
-	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
-	* without subscribing.
-	*/
-	runtimeState: DoorbellStatusSchema,
-	/**
-	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored"
-};
-/**
 * Enum-state sensor — a string value picked from a finite option set.
 * Drives HA `sensor` entries with `state_class: enum` (HVAC action
 * states, weather conditions, contact-source channels, mode strings).
@@ -39111,146 +39951,6 @@ function readDeviceStateFrom(runtimeState) {
 	}
 }
 /**
-* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
-* valutatore puro del suo FRONTE.
-*
-* Viveva dentro il builtin virtual-doorbell
-* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
-* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
-* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
-* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
-* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
-* SPOSTA qui e il doorbell la ri-esporta.
-*
-* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
-* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
-* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
-* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
-*/
-/**
-* Known binary / switch source caps → the boolean slice field whose
-* false→true rise counts as ACTIVE. Every entry is "fire on active".
-* Sensors whose "active" reading is not a plain boolean (presence's string
-* state, connectivity's connected flag) are deliberately excluded — a
-* reconnect is not a doorbell press, and it is not a recording either.
-*/
-var SOURCE_CAP_ACTIVE_FIELD = {
-	contact: "entryOpen",
-	binary: "on",
-	switch: "on",
-	motion: "detected",
-	flood: "flooded",
-	gas: "detected",
-	smoke: "detected",
-	"carbon-monoxide": "detected",
-	vibration: "detected",
-	tamper: "tampered"
-};
-/**
-* The same caps → the slice field carrying the ms-epoch timestamp of the
-* last transition. Every source cap MUST appear here (guarded by a spec):
-* without a transition timestamp the evaluator cannot tell a genuine rise
-* from a boot-time hydration when the FIRST slice it ever sees is already
-* active, and errs towards silence — swallowing the rise.
-*
-* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
-* provider derives them from `state.last_changed`, so they survive our own
-* restarts and correctly read as "hours ago" for a state that has been
-* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
-*/
-var SOURCE_CAP_CHANGED_AT_FIELD = {
-	contact: "lastChangedAt",
-	binary: "lastChangedAt",
-	switch: "lastChangedAt",
-	motion: "lastDetectedAt",
-	flood: "lastChangedAt",
-	gas: "lastChangedAt",
-	smoke: "lastChangedAt",
-	"carbon-monoxide": "lastChangedAt",
-	vibration: "lastChangedAt",
-	tamper: "lastChangedAt"
-};
-/** True when a cap is a recognised binary/switch source. */
-function isSourceCap(capName) {
-	return Object.prototype.hasOwnProperty.call(SOURCE_CAP_ACTIVE_FIELD, capName);
-}
-/** Extract the "active" boolean a source cap's slice carries, or null when
-*  the cap is unknown or the field is missing / non-boolean. */
-function sliceActiveValue(capName, slice) {
-	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
-	if (field === void 0) return null;
-	const raw = slice[field];
-	return typeof raw === "boolean" ? raw : null;
-}
-/** Ms-epoch transition timestamp a source cap's slice carries, or null when
-*  it is absent, non-numeric or the zero "never observed" sentinel. */
-function sliceChangedAt(capName, slice) {
-	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
-	if (field === void 0) return null;
-	const raw = slice[field];
-	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
-	return raw;
-}
-/**
-* How recent a source's own transition timestamp must be for a FIRST
-* sighting that is already active to count as a genuine rise rather than a
-* hydration of long-standing state.
-*/
-var DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = 3e4;
-/**
-* IL fronte. Puro: nessun orologio proprio, nessuna memoria — il chiamante
-* porta `prior`, `nowMs` e il proprio `startedAtMs`.
-*
-* Il caso della PRIMA slice già attiva è trattato esplicitamente e vale come
-* fronte solo se il timestamp UPSTREAM della transizione è posteriore a
-* `startedAtMs` **e** entro `firstSightingFreshnessMs`. Entrambe le metà
-* servono: la sola freschezza scatterebbe su un'idratazione al boot di uno
-* stato flippato pochi secondi prima del riavvio, e il solo "dopo che abbiamo
-* iniziato" scatterebbe, su un processo di lunga vita, per una sorgente
-* adottata oggi il cui stato è cambiato ieri. Il caso ambiguo ERRA VERSO IL
-* SILENZIO e lo dichiara (`baseline-seeded-stale-active`).
-*/
-function evaluateSensorEdge(input) {
-	const value = sliceActiveValue(input.capName, input.slice);
-	if (value === null) return {
-		edge: "none",
-		value: null,
-		reason: isSourceCap(input.capName) ? "non-boolean-value" : "unknown-cap"
-	};
-	if (input.prior === void 0) {
-		if (!value) return {
-			edge: "none",
-			value,
-			reason: "baseline-seeded-inactive"
-		};
-		const changedAt = sliceChangedAt(input.capName, input.slice);
-		const floor = Math.max(input.startedAtMs, input.nowMs - input.firstSightingFreshnessMs);
-		if (changedAt === null || changedAt < floor) return {
-			edge: "none",
-			value,
-			reason: "baseline-seeded-stale-active"
-		};
-		return {
-			edge: "rising",
-			value: true
-		};
-	}
-	if (input.prior === value) return {
-		edge: "none",
-		value,
-		reason: "no-change"
-	};
-	if (!value) return {
-		edge: "none",
-		value,
-		reason: "falling-edge"
-	};
-	return {
-		edge: "rising",
-		value: true
-	};
-}
-/**
 * Accessory device helpers — shared across drivers.
 *
 * Many vendor-specific drivers register accessory child devices on
@@ -43090,6 +43790,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceExtension.listCandidates": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.listSlots": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.listSources": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.setSlot": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.addLocation": {
 		capName: "device-manager",
 		capScope: "system",
@@ -43840,6 +44564,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"embeddingEncoder.resetFailedModels": {
+		capName: "embedding-encoder",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"enumSensor.getStatus": {
 		capName: "enum-sensor",
 		capScope: "device",
@@ -46174,6 +46904,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getClusterModelChoice": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getDeviceLiveContribution": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -48999,6 +49735,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceExtension.listCandidates": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.listSlots": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.listSources": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.setSlot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceManager.adoptionRelease": [{
 		name: "camDeviceId",
 		form: "single",
@@ -52621,169 +53377,6 @@ function readTimelapseGeneratedAt(rule, deviceId) {
 	if (map !== void 0) return map[String(deviceId)] ?? 0;
 	return rule.lastGeneratedAt ?? 0;
 }
-/**
-* A model choice has a SCOPE, and a scope change has a workflow.
-*
-* ## The two scopes
-*
-* Almost every pipeline step's model is a **node** question: which build runs
-* fastest on THIS accelerator. Two nodes may legitimately answer differently —
-* a Coral runs the tflite SSD, a Mac runs the coreml YOLO — because the answers
-* are compared against nothing. They produce boxes, and a box is a box.
-*
-* Two steps are not like that. `face-embedding` and `clip-embedding` produce
-* **vectors that land in ONE shared index** (`identity_samples`,
-* `vec_object_clip`) and are ranked against each other by cosine similarity.
-* Cosine similarity between two encoders is not a weak signal, it is a
-* meaningless number — and nothing inside a vector can tell you it happened.
-* So for those two steps the model is a **cluster** question with exactly one
-* answer, stored in exactly one row.
-*
-* That is the same argument [D52](../../../../docs/decisions/adr-0052.md) makes
-* for the crop convention (`detail-crop.ts`), one level up: the crop decides
-* WHAT pixels the encoder sees, this decides WHICH encoder sees them. Both are
-* cluster-wide for the same reason and neither may become per-node.
-*
-* ## Why the registry lives here and not in the step catalog
-*
-* The scope itself is declared on the step, in
-* `detection-pipeline/registry/step-definitions.ts` (`StepDefinition.modelScope`)
-* — that is where a new step declares what kind of choice its model is. But the
-* catalog lives inside `addon-pipeline`, and three packages that must NOT
-* import an addon need to know the set: the orchestrator (which renders and
-* stores the row), post-analysis (which pins the row for a re-embed pass) and
-* admin-ui (which mirrors it). So the set is mirrored here, and
-* `scripts/check-cluster-model-scope.ts` fails the build when the two disagree.
-* A hand-copied key that stops matching is exactly how a setting silently stops
-* arriving while both sides still look correct.
-*
-* ## The defaults ARE today's behaviour
-*
-* {@link DEFAULT_CLUSTER_STEP_MODELS} reproduces the catalog `defaultModelId`
-* of both steps. Declaring the scope therefore changes nothing on the day it
-* ships: the cluster row starts out saying what every node was already doing.
-* Changing it is legitimate — that is what the knob is for — but it invalidates
-* the stored vectors of that surface, and must be followed by a re-embed pass
-* (`face-reembed-pass.ts`, `embedding-rebuild.ts`).
-*/
-/**
-* The cluster-scoped steps. Mirrored from the catalog's `modelScope: 'cluster'`
-* declarations and guarded by `scripts/check-cluster-model-scope.ts`.
-*/
-var CLUSTER_MODEL_SCOPED_STEPS = [{
-	stepId: "face-embedding",
-	label: "Face recognition model",
-	defaultModelId: "arcface-r100",
-	indexName: "the enrolled face gallery",
-	options: [
-		{
-			id: "arcface-r100",
-			label: "ArcFace (ResNet34)"
-		},
-		{
-			id: "auraface-r100",
-			label: "AuraFace R100"
-		},
-		{
-			id: "inception-resnet-v1",
-			label: "Inception ResNet V1"
-		}
-	]
-}, {
-	stepId: "clip-embedding",
-	label: "Semantic search model",
-	defaultModelId: "mobileclip-s1",
-	indexName: "the object semantic-search index",
-	options: [{
-		id: "mobileclip-s1",
-		label: "MobileCLIP S1"
-	}, {
-		id: "mobileclip-s2",
-		label: "MobileCLIP S2"
-	}]
-}];
-/**
-* The settings key holding one step's cluster model choice.
-*
-* Step-qualified so the keys stay unique across the addon's whole schema, which
-* is what lets {@link pickClusterStepModels} walk every section instead of
-* trusting the section id.
-*/
-function clusterModelSettingKey(stepId) {
-	return `clusterModel:${stepId}`;
-}
-/** The cluster row when nobody has configured one — today's catalog defaults. */
-var DEFAULT_CLUSTER_STEP_MODELS = Object.freeze(Object.fromEntries(CLUSTER_MODEL_SCOPED_STEPS.map((s) => [s.stepId, s.defaultModelId])));
-/** A stored choice is a non-empty model id, or it is not a choice. */
-var ChosenModelIdSchema = string().min(1);
-/**
-* Narrow a FLAT settings record to the cluster row.
-*
-* Per-FIELD fallback, deliberately (same rule as `readDetailCropConvention`): a
-* junk face model must not also discard a valid clip model. An absent, empty or
-* non-string value resolves to the step's catalog default — the historical
-* behaviour — never to a blank id, because a blank id downstream becomes
-* "substitute the format default", which is precisely the substitution this
-* scope exists to forbid.
-*/
-function readClusterStepModels(config) {
-	const out = {};
-	for (const step of CLUSTER_MODEL_SCOPED_STEPS) {
-		const parsed = ChosenModelIdSchema.safeParse(config[clusterModelSettingKey(step.stepId)]);
-		out[step.stepId] = parsed.success ? parsed.data : step.defaultModelId;
-	}
-	return out;
-}
-function isHydratedField$2(entry) {
-	return typeof entry === "object" && entry !== null && "key" in entry;
-}
-/**
-* Extract the cluster row from an `addon-settings.getGlobalSettings` payload.
-*
-* Walks EVERY section rather than looking inside {@link CLUSTER_MODEL_SECTION_ID}
-* alone: the keys are unique across the addon's schema, and a section rename
-* must not silently revert the whole cluster to the defaults. A `null` payload
-* (addon mid-boot) is the defaults.
-*/
-function pickClusterStepModels(view) {
-	if (view === null) return DEFAULT_CLUSTER_STEP_MODELS;
-	const flat = {};
-	const wanted = new Set(CLUSTER_MODEL_SCOPED_STEPS.map((s) => clusterModelSettingKey(s.stepId)));
-	for (const section of view.sections) for (const entry of section.fields) {
-		if (!isHydratedField$2(entry) || typeof entry.key !== "string") continue;
-		if (wanted.has(entry.key)) flat[entry.key] = entry.value;
-	}
-	return readClusterStepModels(flat);
-}
-var CLUSTER_STEP_SETTING_FIELDS = [{
-	stepId: "face-embedding",
-	key: "minLandmarkFaceSize",
-	label: "Min face size for recognition (detection px)",
-	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
-	type: "slider",
-	min: 0,
-	max: 64,
-	step: 2,
-	default: 24
-}];
-function clusterStepSettingKey(stepId, fieldKey) {
-	return `clusterStepSetting:${stepId}:${fieldKey}`;
-}
-var ClusterSettingNumberSchema = number().finite();
-function readClusterStepSettings(config) {
-	const out = {};
-	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
-		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
-		const value = parsed.success ? parsed.data : field.default;
-		const existing = out[field.stepId] ?? {};
-		out[field.stepId] = {
-			...existing,
-			[field.key]: value
-		};
-	}
-	return out;
-}
-readClusterStepSettings({});
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -53325,4 +53918,395 @@ function vectorDimFromBase64(encoded) {
 	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
 }
 //#endregion
-export { NcTemplatePreviewSchema as $, resolvePoolMemoryPolicy as $t, NC_DEFAULT_SNOOZE_MINUTES as A, literal as An, evictionPolicyOfLocation as At, NcConditionsSchema as B, isSystemDelivery as Bt, MAX_BIRTH_DECISION_RECORDS as C, isDeviceScopedCap as Cn, cosineSimilarity as Ct, NC_ALARM_SYSTEM_EVENT_KINDS as D, array as Dn, embeddingEncoderCapability as Dt, MediaFileKindEnum as E, _enum as En, describeSystemEventFamilyProblem as Et, NC_TAXONOMY as F, string as Fn, isEventOwnerType as Ft, NcRuleUpdateInputSchema as G, occupancyScope as Gt, NcRulePatchSchema as H, kebabToCamel as Ht, NC_TEMPLATE_VARS as I, unknown as In, isKnownTemplateVar as It, NcSnoozeSchema as J, pipelineAnalyticsCapability as Jt, NcScheduleSchema as K, parseProcStatus as Kt, NcAlarmConfigSchema as L, EventCategory as Ln, isMediaOwnerType as Lt, NC_SNOOZE_MAX_MINUTES as M, object as Mn, failureContributionCapability as Mt, NC_SYSTEM_EVENT_KIND_GROUP_SPECS as N, partialRecord as Nn, hfModelUrl as Nt, NC_CONDITION_CATALOG as O, boolean as On, encodeVectorBase64 as Ot, NC_TANK_SYSTEM_EVENT_KINDS as P, record as Pn, isDetectionMacroClass as Pt, NcTemplatePreviewInputSchema as Q, resolveLocationMode as Qt, NcAlarmSettingsPatchSchema as R, isScheduleActive as Rt, MAX_ARCHIVED_DEBUG_NOTES as S, hydrateSchema as Sn, consumableLowPercentOf as St, MOTION_CLOSE_AFTER_MS as T, sleep as Tn, describeSystemEventDeliveryProblem as Tt, NcRuleSchema as U, mayWriteToLocation as Ut, NcRuleInputSchema as V, isSystemEventSummaryRule as Vt, NcRuleTargetSchema as W, notificationRulesCapability as Wt, NcSystemEventKindSchema as X, readDeviceStateFrom as Xt, NcSnoozeSuppressedSchema as Y, plateGalleryCapability as Yt, NcTaxonomySchema as Z, readTimelapseGeneratedAt as Zt, FIRST_LEVEL_MACRO_CLASSES as _, CamProfileSchema as _n, alarmPanelCapability as _t, BirthDecisionRecordSchema as a, subKindsOf as an, RetrainStatusSchema as at, LabelAttributionSchema as b, customAction as bn, audioModeOf as bt, CoverStateSchema as c, systemEventFilterApplies as cn, SCENE_DEFAULT_UNCOVERED_POLICY as ct, DEFAULT_TIMELAPSE_PREVIEW_TEXT as d, templateVarsFor as dn, TIMELAPSE_DENSE_FLOOR_SEC as dt, ruleBelongsToAlarm as en, NcTemplateVarDescriptorSchema as et, DETECTION_MACRO_CLASSES as f, vectorDimFromBase64 as fn, TimelapseRuleInputSchema as ft, EVENT_OWNER_TYPES as g, BaseAddon as gn, addonWidgetsSourceCapability as gt, EVENT_KIND_BY_CAP as h, canonicalHash as hn, TrackSourceSchema as ht, BaseDevice as i, storageOccupancyCapability as in, RECORDING_SOURCE_CAMSTACK_ADDON as it, NC_SENSOR_TRANSITION_KINDS as j, number as jn, faceGalleryCapability as jt, NC_CONSUMABLE_SYSTEM_EVENT_KINDS as k, discriminatedUnion as kn, evaluateSensorEdge as kt, DEFAULT_EVENT_COLOR as l, systemEventSummaryScheduleOf as ln, SCENE_DIVERGED as lt, DeclaredDevices as m, errMsg as mn, TimelapseRuleSchema as mt, AlarmArmModeSchema as n, sensorRaisedOf as nn, PoolMemoryWatchdog as nt, CLUSTER_MODEL_SCOPED_STEPS as o, systemEventDeliveryProblems as on, SCENE_CONFIRM_DEFAULT_TIMEOUT_MS as ot, DETECTION_PIPELINE_CAP_NAME as p, zoneAnalyticsCapability as pn, TimelapseRulePatchSchema as pt, NcSnoozeInputSchema as q, pickClusterStepModels as qt, ArchivedDebugNoteSchema as r, servedTemplateVars as rn, RECORDING_EXPORT_MAX_READ_BYTES as rt, COCO_TO_MACRO as s, systemEventFamilyProblems as sn, SCENE_DEFAULT_ANCHOR_THRESHOLD as st, AUDIO_MACRO_LABELS as t, sceneMonitorCapability as tn, OpsLogEntrySchema as tt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as u, templateCarriesSummary as un, SceneMonitorSchema as ut, FULL_IMAGE_BBOX as v, DeviceType as vn, assertTimelapseCadences as vt, MAX_BIRTH_LATENCY_PROXY_MS as w, nodePin as wn, deriveRecordingMode as wt, LockStateSchema as x, defineCustomActions as xn, buildEventKindDescriptor as xt, FailureCounters as y, createEvent as yn, audioMetricsCapability as yt, NcConditionDescriptorSchema as z, isSourceCap as zt };
+//#region src/pipeline-analytics/cluster-model-pin.ts
+/**
+* Where a re-embed pass gets the model it pins.
+*
+* ## Why not `embeddingEncoder.getInfo`
+*
+* That is what the CLIP rebuild used, and it answers a subtly different
+* question: "which model is the encoder addon currently holding", not "which
+* model has the operator chosen for the cluster". The two agree until they do
+* not — an encoder mid-reload, a node that never picked up a change — and when
+* they disagree the pass writes a whole index in the wrong space with a status
+* line that looks fine. Since `face-embedding` and `clip-embedding` declare
+* `modelScope: 'cluster'`, there is now exactly one authority for each, and it
+* is a stored row rather than a live process's opinion.
+*
+* ## Why the read is not cached here
+*
+* A pass reads it ONCE, at the start, and pins that value for its whole run
+* (D54). A cache would only matter for a caller that re-read it mid-pass, which
+* is precisely the thing the pin exists to prevent — so there is nothing to
+* cache and the absence is deliberate.
+*
+* ## Why a failed read refuses instead of defaulting
+*
+* A pass that cannot name its model must not run. The previous CLIP path's
+* `?? 'unknown'` is the shipped version of the alternative: rows stamped with an
+* id nothing ran, in an index whose same-model gate then has nothing to reason
+* about.
+*/
+/** The addon whose GLOBAL settings hold the cluster row. */
+var CLUSTER_MODEL_OWNER_ADDON_ID = "pipeline-orchestrator";
+/** The step ids this module can pin — the same two the catalog declares. */
+var FACE_EMBEDDING_STEP_ID = "face-embedding";
+var CLIP_EMBEDDING_STEP_ID = "clip-embedding";
+/**
+* The cluster row, or `null` when it could not be read.
+*
+* `null` and not "the defaults": a caller that cannot distinguish "the operator
+* chose arcface" from "I could not ask" will run a pass on a guess. The one
+* production caller turns `null` into a refusal to start.
+*/
+async function readClusterModelRow(api, logger) {
+	try {
+		return pickClusterStepModels(await api.addonSettings.getGlobalSettings.query({ addonId: CLUSTER_MODEL_OWNER_ADDON_ID }));
+	} catch (err) {
+		logger.warn("cluster model row unreadable — a re-embed pass must not guess which encoder the operator chose", { meta: {
+			owner: CLUSTER_MODEL_OWNER_ADDON_ID,
+			error: err instanceof Error ? err.message : String(err)
+		} });
+		return null;
+	}
+}
+/**
+* Pin one cluster-scoped step's model for a whole pass.
+*
+* Returns `null` on an unreadable row OR an unknown step id — both mean the
+* caller must not start, and folding them together is safe because the caller's
+* move is identical: refuse, loudly.
+*/
+async function resolveClusterModelPin(api, stepId, logger) {
+	if (!CLUSTER_MODEL_SCOPED_STEPS.some((s) => s.stepId === stepId)) {
+		logger.warn("cluster model pin requested for a step that is not cluster-scoped", { meta: {
+			stepId,
+			clusterScoped: CLUSTER_MODEL_SCOPED_STEPS.map((s) => s.stepId)
+		} });
+		return null;
+	}
+	const row = await readClusterModelRow(api, logger);
+	if (row === null) return null;
+	const modelId = row[stepId];
+	return modelId !== void 0 && modelId !== "" ? modelId : null;
+}
+/**
+* The error texts a cap call carries when the provider or the router has no
+* such method: the kernel's `Capability "…" has no method "…"`, tRPC's
+* `No procedure found on path`, and the forked-child hop's
+* `method '…' not found on provider '…'` (child-cap-dispatch.ts). NOT `is not a function`: that is any
+* `TypeError` thrown INSIDE the owner while it answers, and reading it as
+* "the owner predates the method" would file a bug in the owner under a
+* rolling-release reason nobody investigates.
+*/
+var METHOD_UNAVAILABLE_FINGERPRINTS = [
+	/has no method/i,
+	/no procedure found/i,
+	/method not found/i,
+	/method '[^']*' not found on provider/i
+];
+/**
+* The pin read for a pass that REWRITES an index (D651 fix rounds 1–3).
+*
+* Asks the OWNER. The orchestrator owns `clusterModel:*` and answers from a
+* three-way read of its own store, once its boot has settled
+* (`pipelineOrchestrator.getClusterModelChoice`). Never the hydrated view,
+* which answers `value ?? default`, and never the owner's private store
+* layout. Silent on purpose: the callers log state CHANGES.
+*/
+async function readClusterModelPinStrict(api, stepId) {
+	const method = api.pipelineOrchestrator?.getClusterModelChoice;
+	if (method === void 0) return {
+		kind: "unknown",
+		reason: "method-unavailable"
+	};
+	let raw;
+	try {
+		raw = await method.query({ stepId });
+	} catch (err) {
+		const error = err instanceof Error ? err.message : String(err);
+		return METHOD_UNAVAILABLE_FINGERPRINTS.some((re) => re.test(error)) ? {
+			kind: "unknown",
+			reason: "method-unavailable",
+			error
+		} : {
+			kind: "unknown",
+			reason: "read-failed",
+			error
+		};
+	}
+	if (raw === void 0) return {
+		kind: "unknown",
+		reason: "method-unavailable"
+	};
+	const parsed = ClusterModelChoiceSchema.safeParse(raw);
+	if (!parsed.success) return {
+		kind: "unknown",
+		reason: "read-failed",
+		error: "unparseable owner answer"
+	};
+	const choice = parsed.data;
+	if (choice.kind === "stored") return {
+		kind: "known",
+		modelId: choice.modelId
+	};
+	if (choice.kind === "absent") return {
+		kind: "not-stored",
+		defaultModelId: choice.defaultModelId
+	};
+	return choice.error !== void 0 ? {
+		kind: "unknown",
+		reason: choice.reason,
+		error: choice.error
+	} : {
+		kind: "unknown",
+		reason: choice.reason
+	};
+}
+//#endregion
+//#region src/embedding-encoder/catalogs/embedding-models.ts
+var HF_REPO = "camstack/camstack-models";
+var hf = (path) => hfModelUrl(HF_REPO, path);
+/**
+* The text tower's tokenizer, in HF `tokenizers` format, hosted next to every
+* text-encoder onnx (`.../onnx/tokenizer.json`) and fetched as a sibling file so
+* it lands beside the model. Each model folder hosts ITS OWN (MobileCLIP: the
+* CLIP BPE, vocab 49408; SigLIP2: Gemma SentencePiece, 256k, lower-casing).
+*/
+var TOKENIZER_FILE = "tokenizer.json";
+/** SigLIP2's tokenizer — a DIFFERENT file name on purpose: see `ClipModelMeta.tokenizerFile`. */
+var SIGLIP2_TOKENIZER_FILE = "camstack-siglip2-b16-224-tokenizer.json";
+var ovFormat = (url, sizeMB) => {
+	const base = url.split("/").pop() ?? "";
+	const files = base.endsWith(".xml") ? [base.replace(/\.xml$/, ".bin")] : void 0;
+	return {
+		url,
+		sizeMB,
+		runtimes: ["python"],
+		...files ? { files } : {}
+	};
+};
+/**
+* Files inside an .mlpackage directory bundle.
+* Must be fetched alongside the package root when isDirectory is true.
+*/
+var MLPACKAGE_FILES = [
+	"Manifest.json",
+	"Data/com.apple.CoreML/model.mlmodel",
+	"Data/com.apple.CoreML/weights/weight.bin"
+];
+/**
+* The MobileCLIP feature-space contract (D649 — see `clip-model.ts` in
+* `@camstack/types`). S1 and S2 share the historical 512-d `object-clip` index,
+* separated by each row's `modelId`; the CLIP BPE window is 77 tokens padded
+* with 0; 0.2 is the floor the search always shipped with, measured to keep 96%
+* of matched COCO caption-image pairs on S1.
+*/
+var mobileclipMeta = (textModelId) => ({
+	textModelId,
+	embeddingDim: 512,
+	vectorIndex: "object-clip",
+	tokenizerFile: TOKENIZER_FILE,
+	contextLength: 77,
+	padId: 0,
+	searchMinScore: .2
+});
+/**
+* SigLIP2 B/16-224 (D649). 768-d, so its OWN index; a 64-token Gemma
+* SentencePiece window padded with 0 (the hosted `tokenizer.json` lower-cases,
+* see `scripts/build-siglip2-model.py`). The floor is SIGLIP2_SEARCH_MIN_SCORE.
+*/
+var SIGLIP2_META = {
+	textModelId: "siglip2-b16-224-text",
+	embeddingDim: 768,
+	vectorIndex: "object-clip-siglip2-b16-224",
+	tokenizerFile: SIGLIP2_TOKENIZER_FILE,
+	contextLength: 64,
+	padId: 0,
+	searchMinScore: .1
+};
+/**
+* NO onnx vision builds, deliberately (2026-08-21). The int8 ONNX vision
+* exports were measured misaligned with the text encoders (matched image↔text
+* cosine ≈ 0.01 vs ≈ 0.22 for the fp16 openvino/coreml builds) — see the
+* catalog note in `addon-pipeline/.../model-catalogs.ts`. The image-encode leg
+* that consumed them here (`embeddingEncoder.encode` → PythonRawTensorEngine)
+* is retired with them: its only caller discarded the vector, and its
+* `preprocessForClip` applied OpenAI mean/std that MobileCLIP never used.
+* S0 was retired the same day (measured worst of the family on fleet crops).
+*/
+var CLIP_IMAGE_MODELS = [
+	{
+		id: "mobileclip-s1",
+		name: "MobileCLIP S1",
+		description: "Apple MobileCLIP S1 — balanced vision encoder, 512-dim, 256×256 (fp16 OpenVINO/CoreML)",
+		inputSize: {
+			width: 256,
+			height: 256
+		},
+		labels: [],
+		inputNormalization: "none",
+		clip: mobileclipMeta("mobileclip-s1-text"),
+		formats: {
+			openvino: ovFormat(hf("clip/mobileclip-s1/openvino/camstack-mobileclip-s1-vision.xml"), 55),
+			coreml: {
+				url: hf("clip/mobileclip-s1/coreml/camstack-mobileclip-s1-vision.mlpackage"),
+				sizeMB: 65,
+				isDirectory: true,
+				files: [...MLPACKAGE_FILES],
+				runtimes: ["python"]
+			}
+		}
+	},
+	{
+		id: "mobileclip-s2",
+		name: "MobileCLIP S2",
+		description: "Apple MobileCLIP S2 — high-accuracy vision encoder, 512-dim, 256×256 (fp16 OpenVINO/CoreML)",
+		inputSize: {
+			width: 256,
+			height: 256
+		},
+		labels: [],
+		inputNormalization: "none",
+		clip: mobileclipMeta("mobileclip-s2-text"),
+		formats: {
+			openvino: ovFormat(hf("clip/mobileclip-s2/openvino/camstack-mobileclip-s2-vision.xml"), 90),
+			coreml: {
+				url: hf("clip/mobileclip-s2/coreml/camstack-mobileclip-s2-vision.mlpackage"),
+				sizeMB: 110,
+				isDirectory: true,
+				files: [...MLPACKAGE_FILES],
+				runtimes: ["python"]
+			}
+		}
+	},
+	{
+		id: "siglip2-b16-224",
+		name: "SigLIP2 B/16",
+		description: "Google SigLIP2 base, patch 16, 224×224 — Apache-2.0 vision encoder, 768-dim (fp16 OpenVINO/CoreML)",
+		inputSize: {
+			width: 224,
+			height: 224
+		},
+		labels: [],
+		inputNormalization: "none",
+		license: "Apache-2.0",
+		clip: SIGLIP2_META,
+		formats: {
+			openvino: ovFormat(hf("clip/siglip2/openvino/camstack-siglip2-b16-224-vision.xml"), 186),
+			coreml: {
+				url: hf("clip/siglip2/coreml/camstack-siglip2-b16-224-vision.mlpackage"),
+				sizeMB: 185,
+				isDirectory: true,
+				files: [...MLPACKAGE_FILES],
+				runtimes: ["python"]
+			}
+		}
+	}
+];
+/**
+* The int8 TEXT onnx encoders are healthy — unlike the retired int8 vision
+* exports. Verified 2026-08-21: the live search path (fp16 openvino vision
+* vectors ⋅ int8 onnx text queries) ranks correctly on the real index, and the
+* local cross-check aligns them with the fp16 vision space (cos ≈ 0.22 on
+* matched pairs).
+*/
+var CLIP_TEXT_MODELS = [
+	{
+		id: "mobileclip-s1-text",
+		name: "MobileCLIP S1 Text Encoder",
+		description: "Text encoder for MobileCLIP S1, 512-dim, int8 quantized (61 MB)",
+		inputSize: {
+			width: 0,
+			height: 0
+		},
+		labels: [],
+		formats: {
+			onnx: {
+				url: hf("clip/mobileclip-s1/onnx/camstack-mobileclip-s1-text.onnx"),
+				sizeMB: 61,
+				files: [TOKENIZER_FILE]
+			},
+			openvino: ovFormat(hf("clip/mobileclip-s1/openvino/camstack-mobileclip-s1-text.xml"), 121)
+		}
+	},
+	{
+		id: "mobileclip-s2-text",
+		name: "MobileCLIP S2 Text Encoder",
+		description: "Text encoder for MobileCLIP S2, 512-dim, int8 quantized (61 MB)",
+		inputSize: {
+			width: 0,
+			height: 0
+		},
+		labels: [],
+		formats: {
+			onnx: {
+				url: hf("clip/mobileclip-s2/onnx/camstack-mobileclip-s2-text.onnx"),
+				sizeMB: 61,
+				files: [TOKENIZER_FILE]
+			},
+			openvino: ovFormat(hf("clip/mobileclip-s2/openvino/camstack-mobileclip-s2-text.xml"), 121)
+		}
+	},
+	{
+		id: "siglip2-b16-224-text",
+		name: "SigLIP2 B/16 Text Encoder",
+		description: "Text encoder for SigLIP2 B/16, 768-dim, fp16 (565 MB)",
+		inputSize: {
+			width: 0,
+			height: 0
+		},
+		labels: [],
+		license: "Apache-2.0",
+		formats: {
+			onnx: {
+				url: hf("clip/siglip2/onnx/camstack-siglip2-b16-224-text.onnx"),
+				sizeMB: 565,
+				files: [SIGLIP2_TOKENIZER_FILE]
+			},
+			openvino: ovFormat(hf("clip/siglip2/openvino/camstack-siglip2-b16-224-text.xml"), 565)
+		}
+	}
+];
+//#endregion
+//#region src/shared/clip/clip-model-registry.ts
+/** The model in force when nobody has chosen — the cluster row's default. */
+var DEFAULT_CLIP_MODEL = "mobileclip-s1";
+/**
+* Build a registry from catalog entries. Throws when two models share an index
+* at different dimensions: that is a catalog defect, and the vector store would
+* refuse the second model's writes one at a time, forever, at runtime.
+*/
+function buildClipModelRegistry(entries) {
+	const models = /* @__PURE__ */ new Map();
+	const spaces = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const meta = entry.clip;
+		if (meta === void 0) continue;
+		models.set(entry.id, {
+			modelId: entry.id,
+			inputSize: entry.inputSize.width,
+			meta
+		});
+		const existing = spaces.get(meta.vectorIndex);
+		if (existing !== void 0 && existing.dim !== meta.embeddingDim) throw new Error(`CLIP index "${meta.vectorIndex}" declared at ${String(existing.dim)} dims by ${existing.modelIds.join(", ")} and at ${String(meta.embeddingDim)} by ${entry.id}`);
+		spaces.set(meta.vectorIndex, {
+			index: meta.vectorIndex,
+			dim: meta.embeddingDim,
+			modelIds: [...existing?.modelIds ?? [], entry.id]
+		});
+	}
+	const all = [...spaces.values()];
+	return {
+		resolve: (modelId) => models.get(modelId) ?? null,
+		spaceFor: (modelId) => {
+			const model = models.get(modelId);
+			return model === void 0 ? null : spaces.get(model.meta.vectorIndex) ?? null;
+		},
+		spaces: () => all
+	};
+}
+/** The built-in catalog's registry. */
+var BUILTIN_CLIP_MODELS = buildClipModelRegistry(CLIP_IMAGE_MODELS);
+//#endregion
+export { NcRuleSchema as $, EventCategory as $n, isSourceCap as $t, LabelAttributionSchema as A, canonicalHash as An, audioMetricsCapability as At, NC_DEFAULT_SNOOZE_MINUTES as B, normalizeNodeId as Bn, embeddingRefusalOf as Bt, EMBEDDING_REQUIREMENTS_FAILED as C, systemEventFilterApplies as Cn, TimelapseRuleInputSchema as Ct, FIRST_LEVEL_MACRO_CLASSES as D, vectorDimFromBase64 as Dn, addonWidgetsSourceCapability as Dt, EVENT_OWNER_TYPES as E, templateVarsFor as En, TrackSourceSchema as Et, MOTION_CLOSE_AFTER_MS as F, customAction as Fn, deriveRecordingMode as Ft, NC_TAXONOMY as G, discriminatedUnion as Gn, evictionPolicyOfLocation as Gt, NC_SNOOZE_MAX_MINUTES as H, _enum as Hn, embeddingRequirementsUnavailableError as Ht, MediaFileKindEnum as I, defineCustomActions as In, describeSystemEventDeliveryProblem as It, NcAlarmSettingsPatchSchema as J, object as Jn, isDetectionMacroClass as Jt, NC_TEMPLATE_VARS as K, literal as Kn, faceGalleryCapability as Kt, NC_ALARM_SYSTEM_EVENT_KINDS as L, hydrateSchema as Ln, describeSystemEventFamilyProblem as Lt, MAX_ARCHIVED_DEBUG_NOTES as M, CamProfileSchema as Mn, buildEventKindDescriptor as Mt, MAX_BIRTH_DECISION_RECORDS as N, DeviceType as Nn, consumableLowPercentOf as Nt, FULL_IMAGE_BBOX as O, zoneAnalyticsCapability as On, alarmPanelCapability as Ot, MAX_BIRTH_LATENCY_PROXY_MS as P, createEvent as Pn, cosineSimilarity as Pt, NcRulePatchSchema as Q, unknown as Qn, isScheduleActive as Qt, NC_CONDITION_CATALOG as R, isDeviceScopedCap as Rn, embeddingEncoderCapability as Rt, EMBEDDING_MODEL_FAILED as S, systemEventFamilyProblems as Sn, TIMELAPSE_DENSE_FLOOR_SEC as St, EVENT_KIND_BY_CAP as T, templateCarriesSummary as Tn, TimelapseRuleSchema as Tt, NC_SYSTEM_EVENT_KIND_GROUP_SPECS as U, array as Un, encodeVectorBase64 as Ut, NC_SENSOR_TRANSITION_KINDS as V, sleep as Vn, embeddingRequirementsFailedError as Vt, NC_TANK_SYSTEM_EVENT_KINDS as W, boolean as Wn, evaluateSensorEdge as Wt, NcConditionsSchema as X, record as Xn, isKnownTemplateVar as Xt, NcConditionDescriptorSchema as Y, partialRecord as Yn, isEventOwnerType as Yt, NcRuleInputSchema as Z, string as Zn, isMediaOwnerType as Zt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as _, sensorRaisedOf as _n, SCENE_CONFIRM_DEFAULT_TIMEOUT_MS as _t, CLIP_EMBEDDING_STEP_ID as a, notificationRulesCapability as an, NcSnoozeSuppressedSchema as at, DETECTION_PIPELINE_CAP_NAME as b, subKindsOf as bn, SCENE_DIVERGED as bt, resolveClusterModelPin as c, pipelineAnalyticsCapability as cn, NcTemplatePreviewInputSchema as ct, ArchivedDebugNoteSchema as d, readTimelapseGeneratedAt as dn, OpsLogEntrySchema as dt, isSystemDelivery as en, NcRuleTargetSchema as et, BaseDevice as f, resolveClipSearchMinScore as fn, PoolMemoryWatchdog as ft, DEFAULT_EVENT_COLOR as g, sceneMonitorCapability as gn, RetrainStatusSchema as gt, CoverStateSchema as h, ruleBelongsToAlarm as hn, RebuildObjectEmbeddingsRefusalSchema as ht, CLIP_TEXT_MODELS as i, mayWriteToLocation as in, NcSnoozeSchema as it, LockStateSchema as j, BaseAddon as jn, audioModeOf as jt, FailureCounters as k, errMsg as kn, assertTimelapseCadences as kt, AUDIO_MACRO_LABELS as l, plateGalleryCapability as ln, NcTemplatePreviewSchema as lt, COCO_TO_MACRO as m, resolvePoolMemoryPolicy as mn, RECORDING_SOURCE_CAMSTACK_ADDON as mt, DEFAULT_CLIP_MODEL as n, isVectorIndexDimConflict as nn, NcScheduleSchema as nt, FACE_EMBEDDING_STEP_ID as o, occupancyScope as on, NcSystemEventKindSchema as ot, BirthDecisionRecordSchema as p, resolveLocationMode as pn, RECORDING_EXPORT_MAX_READ_BYTES as pt, NcAlarmConfigSchema as q, number as qn, failureContributionCapability as qt, CLIP_IMAGE_MODELS as r, kebabToCamel as rn, NcSnoozeInputSchema as rt, readClusterModelPinStrict as s, parseProcStatus as sn, NcTaxonomySchema as st, BUILTIN_CLIP_MODELS as t, isSystemEventSummaryRule as tn, NcRuleUpdateInputSchema as tt, AlarmArmModeSchema as u, readDeviceStateFrom as un, NcTemplateVarDescriptorSchema as ut, DEFAULT_TIMELAPSE_PREVIEW_TEXT as v, servedTemplateVars as vn, SCENE_DEFAULT_ANCHOR_THRESHOLD as vt, EMBEDDING_REQUIREMENTS_UNAVAILABLE as w, systemEventSummaryScheduleOf as wn, TimelapseRulePatchSchema as wt, DeclaredDevices as x, systemEventDeliveryProblems as xn, SceneMonitorSchema as xt, DETECTION_MACRO_CLASSES as y, storageOccupancyCapability as yn, SCENE_DEFAULT_UNCOVERED_POLICY as yt, NC_CONSUMABLE_SYSTEM_EVENT_KINDS as z, nodePin as zn, embeddingModelFailedError as zt };