@camstack/system 1.2.141 → 1.2.143

package/dist/{dist-6mn3LQvB.mjs → dist-CVuVKA-O.mjs}

@@ -3653,6 +3653,66 @@ var OpsLogQueryInputSchema = z.object({
 	/** Max rows returned, newest-first. */
 	limit: z.number().int().min(1).max(1e3).optional()
 });
+var LabelDefinitionSchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	category: z.string().optional(),
+	description: z.string().optional(),
+	icon: z.string().optional()
+});
+/** Detection-macro targets a catalog `classMap` may resolve to. */
+var CLASS_MAP_MACRO_TARGETS = [
+	"person",
+	"vehicle",
+	"animal",
+	"package"
+];
+/**
+* Le macro classi di PRIMO LIVELLO: quelle che un object detector emette e che
+* un operatore può selezionare.
+*
+* Sono le tre offerte dallo step `object-detection`
+* (`addon-pipeline/src/detection-pipeline/registry/step-definitions.ts`,
+* `enabledMacroClasses`). `package` sta in {@link CLASS_MAP_MACRO_TARGETS} e in
+* `MACRO_LABELS` — è una macro vera — ma NON qui: appartiene allo step
+* `package-detection`, la cui abilitazione è guidata dalle zone, e offrire la
+* stessa parola due volte ha già fatto accendere a un operatore il proxy COCO
+* (suitcase/backpack/handbag) lasciando spento il detector dedicato.
+*
+* UNA lista. Prima di oggi le stesse tre erano scritte a mano nell'offerta
+* dello step e una seconda volta come union `FirstLevelMacro`
+* (`types/detection.ts`); una terza copia per il trigger di registrazione
+* (`RecordingTriggers.objectClasses`) avrebbe reso invisibile la divergenza
+* successiva.
+*/
+var FIRST_LEVEL_MACRO_CLASSES = [
+	"person",
+	"vehicle",
+	"animal"
+];
+/**
+* Wire schema for a per-model CATALOG classMap override
+* (`ModelCatalogEntry.classMap` / `ModelConvertMetadata.classMap`) —
+* restricted to {@link CLASS_MAP_MACRO_TARGETS}, the only macros the
+* detection pipeline executor actually routes.
+*
+* This is deliberately a DIFFERENT, narrower shape than the general-purpose
+* `ClassMapDefinition` interface above (e.g. `IDetectionAddon.getClassMap()`
+* and the audio `YAMNET_TO_MACRO` catalog both use macro targets outside this
+* enum) — the two used to share the name `ClassMapDefinition`/
+* `ClassMapDefinitionSchema`, which made the schema-type-twin guard
+* (`scripts/check-schema-type-twins.ts`) flag them as a duplicated shape. They
+* are not: it is two different concepts colliding on a name. Keep this type
+* under its own name rather than reusing `ClassMapDefinition` — reusing it
+* would either narrow every `ClassMapDefinition` consumer to the four
+* detection macros (breaking `YAMNET_TO_MACRO`) or drop the validation this
+* schema exists for (see the "rejects a classMap whose target is not a
+* detection macro" test in `model-catalog-schema.test.ts`).
+*/
+var DetectionCatalogClassMapSchema = z.object({
+	mapping: z.record(z.string(), z.enum(CLASS_MAP_MACRO_TARGETS)),
+	preserveOriginal: z.boolean()
+});
 /**
 * Numeric day-of-week: 0 = Sunday … 6 = Saturday (matches `Date.getDay`).
 * Named `RecordingWeekday` to avoid collision with the string-union
@@ -3675,10 +3735,55 @@ var RecordingStorageModeSchema = z.enum([
 	"events",
 	"continuous"
 ]);
+/**
+* Le macro classi che possono aprire una finestra di registrazione — le stesse
+* tre offerte dallo step `object-detection`, da UNA lista
+* ({@link FIRST_LEVEL_MACRO_CLASSES}).
+*/
+var RecordingObjectTriggerClassSchema = z.enum(FIRST_LEVEL_MACRO_CLASSES);
+/**
+* True quando `values` non ripete un elemento.
+*
+* Un duplicato non è innocuo: ogni voce di `objectClasses` / `sensorDeviceIds`
+* diventa una SORGENTE in `bandTriggerSources`, e la stessa sorgente due volte
+* conterebbe due volte le sue finestre in `segmentMissedByMs`.
+*/
+var noDuplicates = (values) => new Set(values).size === values.length;
 /** Which detectors trigger an `events`-mode band. */
 var RecordingTriggersSchema = z.object({
 	motion: z.boolean().optional(),
-	audioThresholdDbfs: z.number().optional()
+	audioThresholdDbfs: z.number().optional(),
+	/**
+	* Le macro classi la cui detection apre una finestra. ASSENTE = la sorgente
+	* non è ascoltata; un array VUOTO è rifiutato, perché "banda events, trigger
+	* object acceso, nessuna classe" è la stessa forma "abilitata e non registra
+	* nulla, per sempre" contro cui è scritto `eventsBandCanEverDemand`.
+	*
+	* Il segnale letto è GIÀ FILTRATO: solo detection `source: 'pipeline'`, cioè
+	* quelle che hanno attraversato `enabledMacroClasses`, i
+	* `minConfidence<Macro>` e il full-frame guard. L'AI a bordo camera
+	* (`source: 'onboard'`) non attraversa nessuno di quei gate e NON apre
+	* finestre — vedi `recorder/object-trigger.ts`.
+	*/
+	objectClasses: z.array(RecordingObjectTriggerClassSchema).min(1).refine(noDuplicates, { message: "objectClasses must not repeat a class" }).optional(),
+	/**
+	* I device LINKED il cui FRONTE ALTO apre una finestra. Assente = la sorgente
+	* non è ascoltata; un array vuoto è rifiutato per la stessa ragione di
+	* `objectClasses`.
+	*
+	* Sono id di device SORGENTE, non camere: la banda li nomina, quindi il
+	* percorso caldo (`DeviceStateChanged`, a ritmo di bus su tutta la flotta)
+	* non fa RPC. L'OFFERTA da cui l'operatore li sceglie è un'altra domanda, e
+	* si risolve con `deviceManager.getLinkedDevices` + `getBindingsBatch` per
+	* device (D12) — mai un elenco globale di cap.
+	*
+	* Cosa vuol dire "alto" dipende dal TIPO di device e non è deciso qui:
+	* `SOURCE_CAP_ACTIVE_FIELD` (`catalogs/sensor-active-state.ts`) è LA tabella,
+	* la stessa che il virtual-doorbell usa dal 2026-08-05. Ed è il FRONTE, non
+	* il livello: un contatto trovato già aperto al riavvio del runner non fa
+	* registrare.
+	*/
+	sensorDeviceIds: z.array(z.number().int().positive()).min(1).max(16).refine(noDuplicates, { message: "sensorDeviceIds must not repeat a device" }).optional()
 });
 /**
 * Mode of a single recording band — the recorder per-band vocabulary.
@@ -4130,41 +4235,6 @@ var DecoderSessionConfigSchema = z.object({
 	*/
 	debug: z.boolean().optional()
 });
-var LabelDefinitionSchema = z.object({
-	id: z.string(),
-	name: z.string(),
-	category: z.string().optional(),
-	description: z.string().optional(),
-	icon: z.string().optional()
-});
-/**
-* Wire schema for a per-model CATALOG classMap override
-* (`ModelCatalogEntry.classMap` / `ModelConvertMetadata.classMap`) —
-* restricted to {@link CLASS_MAP_MACRO_TARGETS}, the only macros the
-* detection pipeline executor actually routes.
-*
-* This is deliberately a DIFFERENT, narrower shape than the general-purpose
-* `ClassMapDefinition` interface above (e.g. `IDetectionAddon.getClassMap()`
-* and the audio `YAMNET_TO_MACRO` catalog both use macro targets outside this
-* enum) — the two used to share the name `ClassMapDefinition`/
-* `ClassMapDefinitionSchema`, which made the schema-type-twin guard
-* (`scripts/check-schema-type-twins.ts`) flag them as a duplicated shape. They
-* are not: it is two different concepts colliding on a name. Keep this type
-* under its own name rather than reusing `ClassMapDefinition` — reusing it
-* would either narrow every `ClassMapDefinition` consumer to the four
-* detection macros (breaking `YAMNET_TO_MACRO`) or drop the validation this
-* schema exists for (see the "rejects a classMap whose target is not a
-* detection macro" test in `model-catalog-schema.test.ts`).
-*/
-var DetectionCatalogClassMapSchema = z.object({
-	mapping: z.record(z.string(), z.enum([
-		"person",
-		"vehicle",
-		"animal",
-		"package"
-	])),
-	preserveOriginal: z.boolean()
-});
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -13849,7 +13919,23 @@ var NcHistoryEntrySchema = z.object({
 	updatedAt: z.number(),
 	/** Failure detail — present on a `dead` row. */
 	error: z.string().optional(),
-	subject: NcHistorySubjectSchema
+	subject: NcHistorySubjectSchema,
+	/**
+	* Ids of the artefacts (still, then gif, then clip) this row's successful
+	* delivery indexed in the artefact library — a REFERENCE, never the bytes
+	* (an artefact is often megabytes; this row is durable JSON rewritten on
+	* every delivery attempt). Absent on a row still pending/dead, a row
+	* delivered before this field shipped, or a wiring with no artefact index.
+	*
+	* Resolve one to a fetchable URL with `resolveArtifactUrl` — an id
+	* outlives any one URL's TTL, so a caller mints a fresh link on demand
+	* rather than trusting one frozen at delivery time. `resolveArtifactUrl`
+	* also answers `null` for an id whose artefact has since expired past the
+	* retained shelf's own age bound — the degrade a caller (the Home
+	* Assistant export) must render as "no image right now", never as a
+	* broken link.
+	*/
+	artifactIds: z.array(z.string().min(1)).optional()
 });
 /**
 * Query filter for `getHistory` (spec §4.2). Every field is a narrowing
@@ -14138,6 +14224,20 @@ var notificationRulesCapability = {
 		*/
 		getHistory: method(z.object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), z.object({ entries: z.array(NcHistoryEntrySchema) }), { auth: "admin" }),
 		/**
+		* Mint a fresh, externally-reachable URL for one artefact a history row
+		* named in {@link NcHistoryEntrySchema.shape.artifactIds} — the SAME
+		* signed-link mechanism the dispatcher uses to attach media to an
+		* outgoing notification (one derivation; this never re-implements it).
+		*
+		* `url: null` on THREE causes a caller must treat identically ("no image
+		* right now", never a broken link): the id is unknown, its artefact has
+		* expired past the retained shelf's own age bound, or this install has no
+		* externally-reachable base URL. A caller that received a URL on a
+		* previous call and now gets `null` must stop showing it — a link that
+		* worked five minutes ago is not proof it works now.
+		*/
+		resolveArtifactUrl: method(z.object({ artifactId: z.string().min(1) }), z.object({ url: z.string().nullable() }), { auth: "admin" }),
+		/**
 		* Snooze windows currently in effect, plus any whose digest has not yet
 		* gone out. `caller: 'required'`: a user sees their OWN windows and the
 		* global ones that silence them, never another person's private silence.
@@ -21066,7 +21166,7 @@ var lifecycleJobSchema = z.object({
 * `useAddonsOnAddonLogs`, etc. flow through the same codegen pipeline
 * as every other cap.
 */
-var LogLevelSchema$1 = z.enum([
+var LogLevelSchema$2 = z.enum([
 	"debug",
 	"info",
 	"warn",
@@ -21293,7 +21393,7 @@ var addonsCapability = {
 		getLogs: method(z.object({
 			addonId: z.string(),
 			limit: z.number().min(1).max(500).default(100),
-			level: LogLevelSchema$1.optional()
+			level: LogLevelSchema$2.optional()
 		}), z.array(LogQueryEntrySchema)),
 		listPackages: method(z.void(), z.array(InstalledPackageSchema).readonly()),
 		installPackage: method(z.object({
@@ -21531,7 +21631,7 @@ var addonsCapability = {
 		}),
 		onAddonLogs: method(z.object({
 			addonId: z.string(),
-			level: LogLevelSchema$1.optional()
+			level: LogLevelSchema$2.optional()
 		}), LogStreamEntrySchema, { kind: "subscription" })
 	},
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
@@ -23373,6 +23473,35 @@ var FaceFilterEnum = z.enum([
 	"identified",
 	"all"
 ]);
+/**
+* What a `listRecentFaces` page is ORDERED BY.
+*
+*  - `timestamp` — when the face was seen. The historical (and default) order.
+*  - `suggestionConfidence` — {@link FaceInfo.suggestedMatchScore}, the peak
+*    cosine of the face's SUGGESTED identity. This is the "review by certainty"
+*    order: it puts the suggestions an operator can confirm with one tap at the
+*    top, and it is the reason this enum exists — a client that ranked a capped
+*    page client-side was ranking the newest N, never the most certain N.
+*
+* A row with NO suggestion (`suggestedMatchScore` absent — a legacy row, an
+* auto-assigned face, or a face below the suggestion band) has no certainty to
+* compare. Under `suggestionConfidence` it sorts **LAST, in BOTH directions**
+* — flipping the direction reorders the rows that HAVE a certainty and never
+* floods the page with the ones that do not. `addon-post-analysis`'s
+* `store/face-sort.ts` is the single implementation, tiebreaks newest-first
+* then by faceId, and is what makes this a total order instead of the
+* backend's NULL-collation accident.
+*/
+var FaceSortFieldEnum = z.enum(["timestamp", "suggestionConfidence"]);
+var FaceSortDirectionEnum = z.enum(["asc", "desc"]);
+/** One suggested group of look-alike UNASSIGNED faces. Ids only — an embedding
+*  never leaves the server. */
+var FaceClusterSchema = z.object({
+	faceIds: z.array(z.string()).readonly(),
+	representativeFaceId: z.string(),
+	size: z.number().int(),
+	cohesion: z.number()
+});
 var MediaFileLiteSchema$1 = z.object({
 	key: z.string(),
 	kind: z.string(),
@@ -23430,24 +23559,72 @@ includeCrops: z.boolean().optional() }).optional(), z.array(IdentitySchema).read
 			auth: "admin"
 		}),
 		listRecentFaces: method(z.object({
-			/** Restrict to one camera. Absent keeps the cluster-wide gallery view. */
+			/**
+			* Restrict to ONE camera. Absent keeps the cluster-wide gallery view.
+			*
+			* The legacy single-camera form, kept verbatim for every caller that
+			* already sends it. A caller that wants a SET sends {@link deviceIds}
+			* instead — never both: `deviceIds` is the authority whenever it is
+			* present, and this field is then ignored rather than unioned, so
+			* there is exactly one answer to "which cameras did I ask for".
+			*/
 			deviceId: z.number().int().optional(),
+			/**
+			* Restrict to a SET of cameras — the review UI's camera filter, which
+			* until now had to fetch the cluster-wide page and drop rows in the
+			* client (so the `limit` it asked for was spent on cameras it was
+			* about to discard).
+			*
+			* An **empty array reads NOTHING** — `[]` is an empty page, never
+			* "every camera". A request for no devices is a request, not an
+			* omission; same contract as `deviceManager.listFleet` and
+			* `pipelineAnalytics.listRecentTracks`.
+			*
+			* Absent (`undefined`) is the omission, and keeps the cluster-wide view.
+			*/
+			deviceIds: z.array(z.number().int()).optional(),
 			limit: z.number().int().positive().optional(),
 			filter: FaceFilterEnum.optional(),
 			/**
-			* Inline the base64 crop on every row. Default `true` — the existing
-			* behaviour, kept so no caller breaks.
+			* Window lower bound on {@link FaceInfo.timestamp}, INCLUSIVE.
+			* Absent means no lower bound.
+			*/
+			since: z.number().int().optional(),
+			/**
+			* Window upper bound on {@link FaceInfo.timestamp}, INCLUSIVE.
+			* Absent means no upper bound.
+			*/
+			until: z.number().int().optional(),
+			/**
+			* Order the page by time or by suggestion certainty. Default
+			* `'timestamp'` — the historical order, unchanged for every caller
+			* that does not ask.
 			*
-			* Set `false` once the caller renders {@link FaceInfo.cropUrl}: that
-			* drops ~2.87 MiB per 500-row page to a few KiB of metadata and lets
-			* the browser cache the images.
+			* See {@link FaceSortFieldEnum} for what a row with no suggestion
+			* does under `'suggestionConfidence'`.
 			*
-			* **This is an INPUT field, so it does not reach the addon until the
-			* next train.** The hub router validates cap inputs against its own
-			* compiled Zod, which strips a key it does not know — verified today
-			* on the OUTPUT side, where an additive field DOES arrive immediately
-			* (`Track.hasFace`). Until the train ships, sending `false` is
-			* harmless and simply keeps the crops inline.
+			* Cost note: `'timestamp'` is served by the `(deviceId, timestamp)`
+			* index and stops reading as soon as `limit` rows have PASSED the
+			* filter. `'suggestionConfidence'` cannot stop early — the most
+			* certain row may be the oldest — so it walks the window. Narrow it
+			* with {@link since} / {@link until}.
+			*/
+			sortBy: FaceSortFieldEnum.optional(),
+			/** Sort direction for {@link sortBy}. Default `'desc'`. */
+			sortDirection: FaceSortDirectionEnum.optional(),
+			/**
+			* Inline the base64 crop on every row.
+			*
+			* Default `false` since the 2026-08-25 inversion — see
+			* `include-crops-default.ts`, which is the ONE place that resolves
+			* this for every gallery, and which records why the inline shape had
+			* to become the one you ASK for (60 457 ms → UDS timeout at 500 rows).
+			* The doc here used to still say `true`; it was wrong, and a leftover
+			* that describes the old design reads as permission to rely on it.
+			*
+			* Nothing loses its image: the row carries {@link FaceInfo.cropUrl},
+			* which the browser fetches off the `event-media` plane in parallel,
+			* cached and ETagged.
 			*/
 			includeCrops: z.boolean().optional()
 		}).optional(), z.array(FaceInfoSchema).readonly()),
@@ -23496,13 +23673,39 @@ includeCrops: z.boolean().optional() }).optional(), z.array(IdentitySchema).read
 		suggestFaceClusters: method(z.object({
 			threshold: z.number().min(0).max(1).optional(),
 			minClusterSize: z.number().int().min(2).optional(),
-			limit: z.number().int().positive().optional()
-		}).optional(), z.array(z.object({
-			faceIds: z.array(z.string()).readonly(),
-			representativeFaceId: z.string(),
-			size: z.number().int(),
-			cohesion: z.number()
-		})).readonly())
+			/**
+			* Cap on the number of CLUSTERS returned. Renamed from `limit`,
+			* which read as though it bounded the work — it never did.
+			*
+			* Wins over {@link limit} when both are sent.
+			*/
+			maxClusters: z.number().int().positive().optional(),
+			/**
+			* @deprecated Ambiguous name for {@link maxClusters} — it cuts the
+			* RESULT, not the scan. Kept so existing callers keep working; send
+			* `maxClusters` (and, if you care about cost, {@link maxFacesScanned}).
+			*/
+			limit: z.number().int().positive().optional(),
+			/**
+			* Cap on the number of unassigned faces READ AND CLUSTERED — the
+			* POOL, not the result.
+			*
+			* This is the knob {@link maxClusters} was mistaken for. Clustering
+			* used to read every unassigned face on the hub no matter what the
+			* caller asked for, because the only bound cut the finished clusters
+			* afterwards; a UI showing a window of 100 paid for a scan of the
+			* whole corpus, on an addon whose disk is under contention.
+			*
+			* The pool is the NEWEST matching faces first — the same order the
+			* gallery shows — so a bound here shortens the horizon, it does not
+			* sample it randomly.
+			*
+			* Default: 1 000 (`FACE_SWEEP_PAGE`, exactly one store page). Chosen
+			* so the live corpus — 372 face rows — is unaffected while the
+			* unbounded scan can never come back as the table grows.
+			*/
+			maxFacesScanned: z.number().int().positive().optional()
+		}).optional(), z.array(FaceClusterSchema).readonly())
 	}
 };
 /**
@@ -27773,6 +27976,39 @@ var ReadGopBytesResultSchema = z.object({
 	/** Media ms the returned fragment covers. */
 	gopDurMs: z.number()
 });
+/**
+* A time WINDOW of one finalized segment, cut by byte range — the multi-GOP
+* twin of {@link ReadGopBytesResultSchema}'s single instant. Built for the
+* replay clip's `recording` source (`docs/design/plans/2026-08-26-replay-clip-su-pipeline.md`):
+* a replay needs several seconds of native pixels, not one frame.
+*
+* `ok.data` is standalone-demuxable, same as a GOP read. `ok.reachesRequestedEnd`
+* is `false` when the returned bytes were cut short by the read's own safety
+* byte cap before covering `[fromMs, toMs)` — a truncation, reported, not a
+* silently shorter answer. `spans-multiple-segments` is a REFUSAL, not a
+* degradation: a window whose end falls past the covering segment would need
+* bytes stitched from a second segment file (its own `ftyp`+`moov`), which is
+* not one standalone-demuxable stream — the caller's answer is to request a
+* shorter window or one aligned to a single segment, not to receive spliced
+* bytes nothing has proven decodable.
+*/
+var ReadWindowBytesResultSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("ok"),
+	data: z.instanceof(Uint8Array),
+	/** Absolute epoch ms of the returned bytes' first sample — at or before
+	*  the requested `fromMs` (anchored on the nearest keyframe). */
+	gopStartMs: z.number(),
+	/** Media ms the returned bytes cover, from `gopStartMs`. */
+	gopDurMs: z.number(),
+	/** `false` ⇒ the safety byte cap cut the read short before it reached
+	*  the requested `toMs`; the caller got fewer frames than asked for. */
+	reachesRequestedEnd: z.boolean()
+}), z.object({
+	kind: z.literal("spans-multiple-segments"),
+	/** Where the covering segment's own footage runs out — informational,
+	*  not a retry hint (retrying the same window would refuse again). */
+	segmentEndMs: z.number()
+})]);
 var recordingCapability = {
 	name: "recording",
 	scope: "system",
@@ -27852,6 +28088,21 @@ var recordingCapability = {
 			kind: "query",
 			auth: "admin"
 		}),
+		/** Read a WINDOW `[fromMs, toMs)` of segment `startMs`, by mfra byte
+		*  range — the multi-GOP twin of `readGopBytes`. Refuses (does not
+		*  degrade) when the window runs past the covering segment. Used by the
+		*  replay clip's `recording` source to fetch several seconds of native
+		*  footage for its single ffmpeg decode pass. */
+		readWindowBytes: method(z.object({
+			deviceId: z.number(),
+			profile: z.string(),
+			startMs: z.number(),
+			fromMs: z.number(),
+			toMs: z.number()
+		}), ReadWindowBytesResultSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
 		setDeviceConfig: method(z.object({
 			deviceId: z.number(),
 			config: RecordingConfigSchema
@@ -29315,6 +29566,211 @@ var SetSiteLocationInputSchema = z.object({
 	latitude: z.number().min(-90).max(90),
 	longitude: z.number().min(-180).max(180)
 }).nullable();
+/**
+* One `(procedure, user-agent, ip, principal)` tuple of the HTTP request
+* census. `principal` is the DERIVED identity (`apocaliss92 (admin)`,
+* `scoped:1a2b3c4d (scoped-token)`, `anonymous`) that the tRPC error log
+* already prints - never a token, never an `Authorization` header.
+*/
+var RequestCensusGroupSchema = z.object({
+	procedure: z.string(),
+	userAgent: z.string(),
+	ip: z.string(),
+	principal: z.string(),
+	calls: z.number(),
+	perMin: z.number()
+});
+/**
+* A procedure's TOTAL over the window, across every caller.
+*
+* This block, not the group list, is what answers "did these calls arrive over
+* HTTP at all". A total far BELOW what a store-side census counted over the
+* same window excludes the HTTP plane, which is a result, not a failure.
+*/
+var RequestCensusProcedureSchema = z.object({
+	procedure: z.string(),
+	calls: z.number(),
+	perMin: z.number()
+});
+/**
+* The census as an operator sees it.
+*
+* `persisted` is the honest answer to "will this survive the restart I am
+* about to do": the arm deadline is written to `system-settings` so a window
+* armed now can measure the NEXT boot, and a write that failed must not look
+* like one that succeeded.
+*/
+var RequestCensusStatusSchema = z.object({
+	armed: z.boolean(),
+	/** How long the current - or just-closed - window collected, in ms. */
+	elapsedMs: z.number(),
+	/** The window actually armed, after the server clamped the request. */
+	windowMs: z.number(),
+	/** Epoch ms the window closes at. 0 when disarmed. */
+	armedUntilMs: z.number(),
+	httpRequests: z.number(),
+	batchedRequests: z.number(),
+	/**
+	* Procedure invocations. Higher than `httpRequests` whenever tRPC batching
+	* is in play (`?batch=1` carries several procedures in one request); this is
+	* the number comparable with a store-side call count.
+	*/
+	procedureCalls: z.number(),
+	/**
+	* tRPC WebSocket connections opened during the window. NOT calls - the WS
+	* transport resolves one context per connection - but the number that says
+	* whether a plane this census cannot see was busy while HTTP was quiet.
+	*/
+	wsConnections: z.number(),
+	distinctGroups: z.number(),
+	/** Calls counted in the totals whose group attribution was shed at the
+	*  cardinality bound. */
+	unattributedCalls: z.number(),
+	procedures: z.array(RequestCensusProcedureSchema).readonly(),
+	groups: z.array(RequestCensusGroupSchema).readonly()
+}).extend({ persisted: z.boolean() });
+/** Severity vocabulary. Mirrors `LogLevel` in `interfaces/logging.ts`. */
+var LogLevelSchema$1 = z.enum([
+	"debug",
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* The diagnostics that can be ARMED for a window. Exactly one today.
+*
+* A diagnostic is anything whose cost is only worth paying while a question is
+* open. It never persists as a boolean: see {@link DiagnosticWindowSchema}.
+*/
+var DiagnosticIdSchema = z.enum(["request-census"]);
+/**
+* The layers of the level hierarchy, general → specific. The most specific
+* layer that carries an explicit value wins.
+*
+* `component` is DECLARED and not yet resolvable: the per-component channels
+* are a later slice of the same plan, and a `levelSource` enum that has to
+* grow later would force every consumer of this document to change with it.
+* Nothing returns `component` today.
+*/
+var LoggingScopeKindSchema = z.enum([
+	"cluster",
+	"node",
+	"component"
+]);
+/** Where an effective level came from. `default` = nothing is set anywhere. */
+var LoggingLevelSourceSchema = z.enum([
+	"default",
+	"cluster",
+	"node",
+	"component"
+]);
+/**
+* One layer of the hierarchy as it actually STANDS.
+*
+* `level: null` is the whole reason this array is returned: it is the
+* difference between "this node is at `info` because I decided it" and
+* "...because it inherits". An operator who clears an override believing they
+* are clearing an inherited value has been handed the same defect as the two
+* contradicting knobs this document exists to remove, moved one floor up.
+*/
+var LoggingLevelLayerSchema = z.object({
+	scope: LoggingScopeKindSchema,
+	/** The node this layer speaks for; `null` on the cluster layer. */
+	nodeId: z.string().nullable(),
+	/** Explicitly set here, or `null` when this layer inherits. */
+	level: LogLevelSchema$1.nullable()
+});
+/** What a line is judged against, and WHICH layer decided it. */
+var LoggingEffectiveSchema = z.object({
+	level: LogLevelSchema$1,
+	levelSource: LoggingLevelSourceSchema
+});
+/** Every layer, general → specific. Never collapsed into the effective value. */
+var LoggingExplicitSchema = z.object({ layers: z.array(LoggingLevelLayerSchema).readonly() });
+/**
+* An armed diagnostic, with its DEADLINE.
+*
+* The shape of ADR-0244: what is stored is a deadline and never a flag, so a
+* diagnostic somebody forgot expires by itself, and a boot-window measurement
+* survives the restart it exists to measure. `remainingMs` is 0 whenever
+* `armed` is false — a window is never reported as slightly expired.
+*/
+var DiagnosticWindowSchema = z.object({
+	id: DiagnosticIdSchema,
+	armed: z.boolean(),
+	/** Epoch ms the window closes at. 0 when disarmed. */
+	armedUntilMs: z.number(),
+	/** Ms left before it expires on its own. 0 when disarmed. */
+	remainingMs: z.number(),
+	/** Whether the stored deadline is the one the live diagnostic is running —
+	*  i.e. whether this window would survive a restart. */
+	persisted: z.boolean()
+});
+/**
+* `armMs: 0` DISARMS. Any positive value arms for that long, clamped by the
+* server — there is no maximum here on purpose: a bound repeated in a schema
+* is a second knob that disagrees with the first the day one of them moves.
+*/
+var DiagnosticWindowPatchSchema = z.object({
+	id: DiagnosticIdSchema,
+	armMs: z.number().int().min(0),
+	/** Cadence of the diagnostic's aggregated report line. Clamped by the server. */
+	reportEveryMs: z.number().int().positive().optional()
+});
+/**
+* A PATCH, and patches MERGE.
+*
+* A field absent from the patch is left exactly as it was — arming a
+* diagnostic never resets a level, and setting a level never disarms a window.
+* The provider must not reconstruct the document as `{ ...snapshot, ...patch }`:
+* `setAll` already merges, and rebuilding the object is how an absent field
+* turns into an erased one.
+*/
+var LoggingSettingsPatchSchema = z.object({
+	/**
+	* Absent leaves the level untouched. `null` CLEARS the explicit value at the
+	* addressed scope so it inherits again. A value sets it.
+	*/
+	level: LogLevelSchema$1.nullable().optional(),
+	/**
+	* Only the diagnostics NAMED here change. An armed window that is not listed
+	* keeps running — a patch is never a full replacement.
+	*/
+	diagnostics: z.array(DiagnosticWindowPatchSchema).readonly().optional()
+});
+/**
+* Which LAYER of the hierarchy is addressed. Absent = the cluster layer.
+*
+* Deliberately NOT called `nodeId`: that key is reserved on every cap method
+* input — the generated router strips it and uses it to resolve the PROVIDER
+* on that node (`resolveProvider(cap, nodeId, …)`). A document about
+* `agent-1` addressed as `nodeId` would be forwarded to agent-1 and answered
+* by an agent that holds no cluster document at all. The hub is the single
+* authority over the whole hierarchy and answers for every layer, so the
+* layer selector needs a name the transport does not already own.
+*/
+var GetLoggingSettingsInputSchema = z.object({ scopeNodeId: z.string().optional() });
+var SetLoggingSettingsInputSchema = z.object({
+	scopeNodeId: z.string().optional(),
+	patch: LoggingSettingsPatchSchema
+});
+/**
+* The whole document, as read and as returned after every write.
+*
+* `persisted: false` means the settings store could not be read or written.
+* The in-memory mirror still governs behaviour and is unchanged by the
+* failure — a read that fails neither switches a level nor disarms a window
+* (D49) — but the operator is told that what they are looking at would not
+* survive a restart.
+*/
+var LoggingSettingsStateSchema = z.object({
+	/** The layer this document was read at. `null` = the cluster layer. */
+	scopeNodeId: z.string().nullable(),
+	effective: LoggingEffectiveSchema,
+	explicit: LoggingExplicitSchema,
+	activeWindows: z.array(DiagnosticWindowSchema).readonly(),
+	persisted: z.boolean()
+});
 var systemCapability = {
 	name: "system",
 	scope: "system",
@@ -29358,6 +29814,38 @@ var systemCapability = {
 		detectSiteLocation: method(z.void(), SiteLocationStatusSchema, {
 			kind: "mutation",
 			auth: "admin"
+		}),
+		/**
+		* Read the HTTP request census - which caller, from which address, with
+		* which user-agent, invoked which tRPC procedure, and how often.
+		*
+		* Reading NEVER re-arms: re-arming clears the counts, which would throw
+		* away exactly the numbers being asked for. A closed window may be read as
+		* many times as the operator likes and always describes the same window.
+		*
+		* Admin-only: the rows carry source addresses and principal names.
+		*/
+		getRequestCensus: method(z.void(), RequestCensusStatusSchema, { auth: "admin" }),
+		/**
+		* The logging settings document — levels and armed diagnostics — resolved
+		* for `nodeId`, or for the cluster when `nodeId` is absent.
+		*
+		* Returns BOTH `effective` and `explicit`. See
+		* {@link LoggingLevelLayerSchema} for why collapsing them is the defect.
+		*/
+		getLoggingSettings: method(GetLoggingSettingsInputSchema, LoggingSettingsStateSchema, { auth: "admin" }),
+		/**
+		* Write the logging settings document. The ONLY write authority over log
+		* levels and diagnostic windows — arming the request census went through
+		* `system.setRequestCensus` until 2026-08-27 and no longer does, because
+		* two writes that disagree about the same window is exactly the defect
+		* this document exists to remove (D245).
+		*
+		* The patch MERGES: see {@link LoggingSettingsPatchSchema}.
+		*/
+		setLoggingSettings: method(SetLoggingSettingsInputSchema, LoggingSettingsStateSchema, {
+			kind: "mutation",
+			auth: "admin"
 		})
 	},
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
@@ -30429,6 +30917,170 @@ var zoneRulesCapability = {
 	durability: "restored"
 };
 /**
+* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
+* valutatore puro del suo FRONTE.
+*
+* Viveva dentro il builtin virtual-doorbell
+* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
+* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
+* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
+* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
+* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
+* SPOSTA qui e il doorbell la ri-esporta.
+*
+* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
+* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
+* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
+* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
+*/
+/**
+* Known binary / switch source caps → the boolean slice field whose
+* false→true rise counts as ACTIVE. Every entry is "fire on active".
+* Sensors whose "active" reading is not a plain boolean (presence's string
+* state, connectivity's connected flag) are deliberately excluded — a
+* reconnect is not a doorbell press, and it is not a recording either.
+*/
+var SOURCE_CAP_ACTIVE_FIELD = {
+	contact: "entryOpen",
+	binary: "on",
+	switch: "on",
+	motion: "detected",
+	flood: "flooded",
+	gas: "detected",
+	smoke: "detected",
+	"carbon-monoxide": "detected",
+	vibration: "detected",
+	tamper: "tampered"
+};
+/**
+* The same caps → the slice field carrying the ms-epoch timestamp of the
+* last transition. Every source cap MUST appear here (guarded by a spec):
+* without a transition timestamp the evaluator cannot tell a genuine rise
+* from a boot-time hydration when the FIRST slice it ever sees is already
+* active, and errs towards silence — swallowing the rise.
+*
+* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
+* provider derives them from `state.last_changed`, so they survive our own
+* restarts and correctly read as "hours ago" for a state that has been
+* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
+*/
+var SOURCE_CAP_CHANGED_AT_FIELD = {
+	contact: "lastChangedAt",
+	binary: "lastChangedAt",
+	switch: "lastChangedAt",
+	motion: "lastDetectedAt",
+	flood: "lastChangedAt",
+	gas: "lastChangedAt",
+	smoke: "lastChangedAt",
+	"carbon-monoxide": "lastChangedAt",
+	vibration: "lastChangedAt",
+	tamper: "lastChangedAt"
+};
+/** Cap names whose presence in a device's bindings qualify it as a source. */
+var SOURCE_CAPS = Object.keys(SOURCE_CAP_ACTIVE_FIELD);
+/**
+* Device `type` values (from `DeviceType`) that can host a binary/switch
+* source cap. Used by the camera's `device-multiselect` picker as the
+* CLIENT-SIDE filter, alongside `SOURCE_CAPS`.
+*
+* Why types and not caps alone: the shared picker filters
+* `deviceManager.listAll` rows client-side, and those rows carry only the
+* device's advertised `features` — NOT its registered cap list. On the live
+* cluster binary sensors and switches advertise EMPTY features (features
+* mirror only a handful of caps like `motion-trigger`), so a caps-only
+* filter matched against `features` would list nothing (the very bug this
+* replaced, which relied on the now-empty `getAllBindings`). Matching by
+* `type` is the reliable client-side signal; the union with `SOURCE_CAPS`
+* still captures any device that DOES advertise a source-cap feature.
+* `sensor` covers contact/motion/flood/gas/smoke/CO/vibration/tamper,
+* `switch` covers switches, `control` covers generic binary actuators.
+*/
+var SOURCE_DEVICE_TYPES = [
+	"sensor",
+	"switch",
+	"control"
+];
+/** True when a cap is a recognised binary/switch source. */
+function isSourceCap(capName) {
+	return Object.prototype.hasOwnProperty.call(SOURCE_CAP_ACTIVE_FIELD, capName);
+}
+/** Extract the "active" boolean a source cap's slice carries, or null when
+*  the cap is unknown or the field is missing / non-boolean. */
+function sliceActiveValue(capName, slice) {
+	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	return typeof raw === "boolean" ? raw : null;
+}
+/** Ms-epoch transition timestamp a source cap's slice carries, or null when
+*  it is absent, non-numeric or the zero "never observed" sentinel. */
+function sliceChangedAt(capName, slice) {
+	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
+	return raw;
+}
+/**
+* How recent a source's own transition timestamp must be for a FIRST
+* sighting that is already active to count as a genuine rise rather than a
+* hydration of long-standing state.
+*/
+var DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = 3e4;
+/**
+* IL fronte. Puro: nessun orologio proprio, nessuna memoria — il chiamante
+* porta `prior`, `nowMs` e il proprio `startedAtMs`.
+*
+* Il caso della PRIMA slice già attiva è trattato esplicitamente e vale come
+* fronte solo se il timestamp UPSTREAM della transizione è posteriore a
+* `startedAtMs` **e** entro `firstSightingFreshnessMs`. Entrambe le metà
+* servono: la sola freschezza scatterebbe su un'idratazione al boot di uno
+* stato flippato pochi secondi prima del riavvio, e il solo "dopo che abbiamo
+* iniziato" scatterebbe, su un processo di lunga vita, per una sorgente
+* adottata oggi il cui stato è cambiato ieri. Il caso ambiguo ERRA VERSO IL
+* SILENZIO e lo dichiara (`baseline-seeded-stale-active`).
+*/
+function evaluateSensorEdge(input) {
+	const value = sliceActiveValue(input.capName, input.slice);
+	if (value === null) return {
+		edge: "none",
+		value: null,
+		reason: isSourceCap(input.capName) ? "non-boolean-value" : "unknown-cap"
+	};
+	if (input.prior === void 0) {
+		if (!value) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-inactive"
+		};
+		const changedAt = sliceChangedAt(input.capName, input.slice);
+		const floor = Math.max(input.startedAtMs, input.nowMs - input.firstSightingFreshnessMs);
+		if (changedAt === null || changedAt < floor) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-stale-active"
+		};
+		return {
+			edge: "rising",
+			value: true
+		};
+	}
+	if (input.prior === value) return {
+		edge: "none",
+		value,
+		reason: "no-change"
+	};
+	if (!value) return {
+		edge: "none",
+		value,
+		reason: "falling-edge"
+	};
+	return {
+		edge: "rising",
+		value: true
+	};
+}
+/**
 * Runtime defaults -- used by ConfigManager.get() for backward compatibility
 * until Plan B wires all runtime settings to the system_settings SQL table.
 *
@@ -30504,6 +31156,24 @@ var AccessoryKind = {
 	PrivacyMask: DeviceRole.PrivacyMask
 };
 AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
+/**
+* THE derivation. One crop rectangle, one presence verdict — see D52 for why
+* this repo insists a derived value has exactly one implementation.
+*
+* `undefined` status ⇒ `sleeping`. A device with no slice has made no claim,
+* and the caller decides separately whether it is even battery-operated
+* (`DeviceFeature.BatteryOperated`); this function never answers that
+* question, only what a battery device is doing.
+*/
+function deriveBatteryPresence(input) {
+	const status = input.status;
+	if (!status) return "sleeping";
+	if (status.sleeping !== true) return "awake";
+	const lastContactAt = status.lastContactAt;
+	if (typeof lastContactAt !== "number" || lastContactAt <= 0) return "sleeping";
+	const budget = input.unreachableAfterMs ?? 216e5;
+	return input.nowMs - lastContactAt > budget ? "unreachable" : "sleeping";
+}
 /** Marker written to a declared integration's `info`. */
 var DECLARED_INTEGRATION_FIXED_KEY = "fixed";
 /**
@@ -30745,24 +31415,6 @@ var DeclaredDevices = class {
 DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
 new Set(Object.values(DeviceType));
 DeviceFeature.BatteryOperated;
-/**
-* THE derivation. One crop rectangle, one presence verdict — see D52 for why
-* this repo insists a derived value has exactly one implementation.
-*
-* `undefined` status ⇒ `sleeping`. A device with no slice has made no claim,
-* and the caller decides separately whether it is even battery-operated
-* (`DeviceFeature.BatteryOperated`); this function never answers that
-* question, only what a battery device is doing.
-*/
-function deriveBatteryPresence(input) {
-	const status = input.status;
-	if (!status) return "sleeping";
-	if (status.sleeping !== true) return "awake";
-	const lastContactAt = status.lastContactAt;
-	if (typeof lastContactAt !== "number" || lastContactAt <= 0) return "sleeping";
-	const budget = input.unreachableAfterMs ?? 216e5;
-	return input.nowMs - lastContactAt > budget ? "unreachable" : "sleeping";
-}
 /** Unwrap ZodNullable / ZodOptional / ZodDefault wrappers to reach the inner type.
 *  Zod v4 exposes `.unwrap()` on all three wrapper classes. */
 function unwrap(schema) {
@@ -33957,6 +34609,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.resolveArtifactUrl": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.setAlarmConfig": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -35361,6 +36019,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.readWindowBytes": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.refreshStorageLocationsForMigration": {
 		capName: "recording",
 		capScope: "system",
@@ -36201,6 +36865,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.getLoggingSettings": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"system.getRequestCensus": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"system.getRetentionConfig": {
 		capName: "system",
 		capScope: "system",
@@ -36231,6 +36907,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"system.setLoggingSettings": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"system.setRetentionConfig": {
 		capName: "system",
 		capScope: "system",
@@ -37386,6 +38068,10 @@ Object.freeze({
 		name: "deviceId",
 		form: "single",
 		optional: true
+	}, {
+		name: "deviceIds",
+		form: "array",
+		optional: true
 	}],
 	"fanControl.setDirection": [{
 		name: "deviceId",
@@ -38191,6 +38877,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"recording.readWindowBytes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"recording.relocateFootage": [{
 		name: "deviceId",
 		form: "single",
@@ -39271,7 +39962,38 @@ z.object({
 	* fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
 	* reproduce that.
 	*/
-	tileBudgetMb: z.number().int().min(0).max(1024)
+	tileBudgetMb: z.number().int().min(0).max(1024),
+	/**
+	* RAM ceiling per decode worker, in MB, for the SCENE TILES — one
+	* JPEG-encoded copy of the WHOLE native frame, cut in the same instant as the
+	* subject tiles, on frames that detected something.
+	*
+	* It exists because a subject tile cannot answer a FULL-FRAME request:
+	* containment is strict by design, so the native `keyFrame`, the detail
+	* plane's `frameJpeg` rung and the display-crop fallback had no rung at all
+	* below the hold. Measured on the live cluster: 23.3% of key-frame captures
+	* missed, 95.7% of them with `worker-lease-gone` — the raster released one
+	* frame-time after delivery, with the request only p50 367 ms behind it.
+	*
+	* Sizing, and why this is a budget and not a duration: a scene tile is
+	* ~1.5-2.5 MB at 4K (against ~23.75 MB for the raster it was cut from and
+	* ~60-120 KB for a subject tile), and it is cut ~0.4 times a second per busy
+	* camera — only detection-bearing frames get one. 48 MB is therefore ~20-30
+	* frames, i.e. the store's 30 s TTL binds at the steady state and the budget
+	* binds only through a detection burst, where it still covers well past the
+	* measured p90 ask age of 4.3 s. Holding the RASTERS for the same window
+	* would be ~498 MB per camera and ~6 GB at peak concurrency — the OOM this
+	* whole shape exists to avoid.
+	*
+	* A SEPARATE ceiling from `tileBudgetMb` on purpose: a scene tile is ~20× a
+	* subject tile, so one shared budget would let a busy camera's key frames
+	* evict the face/plate tiles the recognisers depend on. Two budgets make that
+	* impossible rather than unlikely. `0` DISABLES scene tiles and restores the
+	* pre-existing behaviour, where a late full-frame request had nothing but the
+	* ≤640 RAM raster — which the `keyFrame` gate rejects, so in practice it had
+	* nothing.
+	*/
+	sceneBudgetMb: z.number().int().min(0).max(1024)
 });
 /**
 * The values in force when the operator has set nothing.
@@ -39287,12 +40009,14 @@ var DEFAULT_NATIVE_LEASE_SETTINGS = {
 	budgetMb: 1024,
 	activityMs: 15e3,
 	tileBudgetMb: 64,
+	sceneBudgetMb: 48,
 	admission: "inferred"
 };
 DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames;
 DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
+DEFAULT_NATIVE_LEASE_SETTINGS.sceneBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 /**
 * The addon id as the REGISTRY, the wire and the durable stores spell it.
@@ -39464,4 +40188,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { metricsProviderCapability as $, dataStoreProviderCapability as A, asJsonObject as At, extractNestedAddonId as B, parseJsonObject as Bt, backupCapability as C, DEVICE_STATUS_METHOD as Ct, coreBlockAddonId as D, ReadinessRegistry as Dt, buildStreamParamsConfigSchema as E, DeviceType as Et, deviceStatusCapability as F, emitReadiness as Ft, isSameAddonId as G, sleep as Gt, isArrayOutputSchema as H, readinessKey as Ht, doorbellCapability as I, expandCapMethods as It, lifecycleJobSchema as J, isVoidInput as K, EventCategory as Kt, enumerateInferenceDevices as L, hydrateSchema as Lt, deriveBatteryPresence as M, asString as Mt, deviceManagerCapability as N, createEvent as Nt, coreBlockIdFromAddonId as O, ReadinessTimeoutError as Ot, deviceStateCapability as P, emitDownForOwnedCaps as Pt, looseSchema as Q, enumerateItemArrayFields as R, isDeviceConfigCap as Rt, authProviderCapability as S, DEVICE_SETTINGS_CONTRIBUTION_METHODS as St, batteryCapability as T, DeviceRole as Tt, isCollectionArrayMethod as U, resolveCapMount as Ut, filesystemBrowseCapability as V, parseJsonUnknown as Vt, isObjectInput as W, scopeKey as Wt, logDestinationCapability as X, localNetworkCapability as Y, logLevelAtMost as Z, UserRecordSchema as _, vectorDimFromBase64 as _t, CAP_NAMES_WITH_STATUS as a, resolveMethodAuth as at, addonWidgetsCapability as b, BaseAddon as bt, CoreBlockSchema as c, scopesAllowDeviceCap as ct, METHOD_ACCESS_MAP as d, snapshotCapability as dt, normalizeUnit as et, RUNTIME_DEFAULTS as f, storageCapability as ft, StorageMigrationJobSchema as g, userManagementCapability as gt, StorageLocationTypeSchema as h, streamQualityLabel as ht, BatteryStatusSchema as i, procedureAuthKey as it, decodeVectorBase64 as j, asNumber as jt, coreBlocksCapability as k, WELL_KNOWN_TAB_MAP as kt, DeclaredDevices as l, scoreRuntimes as lt, ScopedTokenSchema as m, storageProviderCapability as mt, AlertSchema as n, parseStreamParamsFormPatch as nt, CORE_BLOCKS_ADDON_ID as o, runtimeStatePolicyFor as ot, STREAM_PROFILE_META as p, storageMigrationCapability as pt, kebabToCamel as q, ApiKeyRecordSchema as r, platformProbeCapability as rt, CORE_BLOCK_ADDON_PREFIX as s, scopesAllowAddon as st, ALL_CAPABILITY_DEFINITIONS as t, objectInputDeclaresAddonId as tt, DeviceStatusSchema as u, settingsStoreCapability as ut, addonPagesCapability as v, vectorStoreCapability as vt, bareAddonId as w, DeviceFeature as wt, alertsCapability as x, DATAPLANE_SECRET_HEADER as xt, addonSettingsCapability as y, errMsg as yt, enumerateSchemaFields as z, nodePin as zt };
+export { kebabToCamel as $, buildStreamParamsConfigSchema as A, DeviceFeature as At, doorbellCapability as B, emitDownForOwnedCaps as Bt, addonSettingsCapability as C, vectorDimFromBase64 as Ct, backupCapability as D, DATAPLANE_SECRET_HEADER as Dt, authProviderCapability as E, BaseAddon as Et, decodeVectorBase64 as F, WELL_KNOWN_TAB_MAP as Ft, extractNestedAddonId as G, nodePin as Gt, enumerateItemArrayFields as H, expandCapMethods as Ht, deriveBatteryPresence as I, asJsonObject as It, isCollectionArrayMethod as J, readinessKey as Jt, filesystemBrowseCapability as K, parseJsonObject as Kt, deviceManagerCapability as L, asNumber as Lt, coreBlockIdFromAddonId as M, DeviceType as Mt, coreBlocksCapability as N, ReadinessRegistry as Nt, bareAddonId as O, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Ot, dataStoreProviderCapability as P, ReadinessTimeoutError as Pt, isVoidInput as Q, EventCategory as Qt, deviceStateCapability as R, asString as Rt, addonPagesCapability as S, userManagementCapability as St, alertsCapability as T, errMsg as Tt, enumerateSchemaFields as U, hydrateSchema as Ut, enumerateInferenceDevices as V, emitReadiness as Vt, evaluateSensorEdge as W, isDeviceConfigCap as Wt, isSameAddonId as X, scopeKey as Xt, isObjectInput as Y, resolveCapMount as Yt, isSourceCap as Z, sleep as Zt, STREAM_PROFILE_META as _, snapshotCapability as _t, CAP_NAMES_WITH_STATUS as a, metricsProviderCapability as at, StorageMigrationJobSchema as b, storageProviderCapability as bt, CoreBlockSchema as c, parseStreamParamsFormPatch as ct, DeviceStatusSchema as d, resolveMethodAuth as dt, lifecycleJobSchema as et, LOG_LEVEL_RANK as f, runtimeStatePolicyFor as ft, SOURCE_DEVICE_TYPES as g, settingsStoreCapability as gt, SOURCE_CAPS as h, scoreRuntimes as ht, BatteryStatusSchema as i, looseSchema as it, coreBlockAddonId as j, DeviceRole as jt, batteryCapability as k, DEVICE_STATUS_METHOD as kt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as l, platformProbeCapability as lt, RUNTIME_DEFAULTS as m, scopesAllowDeviceCap as mt, AlertSchema as n, logDestinationCapability as nt, CORE_BLOCKS_ADDON_ID as o, normalizeUnit as ot, METHOD_ACCESS_MAP as p, scopesAllowAddon as pt, isArrayOutputSchema as q, parseJsonUnknown as qt, ApiKeyRecordSchema as r, logLevelAtMost as rt, CORE_BLOCK_ADDON_PREFIX as s, objectInputDeclaresAddonId as st, ALL_CAPABILITY_DEFINITIONS as t, localNetworkCapability as tt, DeclaredDevices as u, procedureAuthKey as ut, ScopedTokenSchema as v, storageCapability as vt, addonWidgetsCapability as w, vectorStoreCapability as wt, UserRecordSchema as x, streamQualityLabel as xt, StorageLocationTypeSchema as y, storageMigrationCapability as yt, deviceStatusCapability as z, createEvent as zt };