@camstack/system 1.2.304 → 1.2.306

package/dist/{dist-Duqf80QM.mjs → dist-CLfJMMdf.mjs}

@@ -691,7 +691,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-BaRu0bS5.mjs
+//#region ../types/dist/sleep-DC-wdyeS.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -1493,6 +1493,40 @@ var BaseAddon = class {
 		const node = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
 		return keys.size > 0 ? projectStore(raw, keys, node) : raw;
 	}
+	/**
+	* Whether ONE global key of this addon's store was written, read three-way
+	* (D651). For a question a hydrated view cannot answer: `getGlobalSettings`
+	* reports `value ?? default`, so "the operator chose the default" and "nobody
+	* chose" look the same, and a failed read looks like both. A `perNode` key is
+	* not supported here: its stored name is scoped.
+	*/
+	async readStoredGlobalKey(key) {
+		const read = this._ctx?.settings?.readAddonStoreResult;
+		if (read === void 0) return {
+			kind: "unreadable",
+			reason: "three-way-read-unavailable"
+		};
+		let result;
+		try {
+			result = await read.call(this._ctx?.settings);
+		} catch (err) {
+			return {
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: err instanceof Error ? err.message : String(err)
+			};
+		}
+		if (result.kind === "failed") return {
+			kind: "unreadable",
+			reason: "store-read-failed",
+			error: result.error
+		};
+		if (result.kind === "missing" || !Object.prototype.hasOwnProperty.call(result.value, key)) return { kind: "absent" };
+		return {
+			kind: "present",
+			value: result.value[key]
+		};
+	}
 	async updateGlobalSettings(patch, nodeId) {
 		const keys = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
@@ -6389,6 +6423,43 @@ function reducePoints(points, bucketMs, origin) {
 	}
 	return [...buckets.values()].toSorted((a, b) => a.atMs - b.atMs);
 }
+var ClipModelMetaSchema = z.object({
+	/** The paired text encoder's catalog id (the embedding-encoder's text catalog). */
+	textModelId: z.string().min(1),
+	/** Output dimension of BOTH towers. A vector of any other length is refused. */
+	embeddingDim: z.number().int().positive(),
+	/**
+	* The `vector-store` index this model's vectors live in. ONE feature space
+	* per index: two models share an index only when their vectors are ranked
+	* against each other, which for CLIP means never across families. MobileCLIP
+	* S1 and S2 share `object-clip` for history (separated by the row's
+	* `modelId`); any other model gets its own.
+	*/
+	vectorIndex: z.string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	/**
+	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
+	* must be unique per tokenizer: every model's siblings land in ONE flat
+	* models directory, so two different tokenizers under the same name would
+	* silently overwrite each other (whichever model downloaded last wins, and
+	* the other one tokenises with the wrong vocabulary).
+	*/
+	tokenizerFile: z.string().min(1),
+	/** Token window the text graph takes (SigLIP2: 64; CLIP BPE: 77). */
+	contextLength: z.number().int().positive(),
+	/** Id the tokenizer pads with. */
+	padId: z.number().int().nonnegative(),
+	/**
+	* The search cosine floor at `strictness: 'loose'` — calibrated per model,
+	* because cosine bands are a property of the model: 0.2 keeps 96% of matched
+	* COCO caption-image pairs on MobileCLIP S1 and 2.7% on SigLIP2.
+	*/
+	searchMinScore: z.number().min(0).max(1)
+});
+var ClipSearchStrictnessSchema = z.enum([
+	"loose",
+	"balanced",
+	"strict"
+]);
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -6592,7 +6663,14 @@ var ModelCatalogEntrySchema = z.object({
 	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
 	* labels already ARE the CamStack macros (Scrypted identity map).
 	*/
-	classMap: DetectionCatalogClassMapSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional(),
+	/**
+	* The model's CLIP feature-space contract (text encoder, dimension, vector
+	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
+	* CLIP image encoder; its absence is what "not a CLIP model" means to the
+	* embedding encoder and the semantic-search store (D649).
+	*/
+	clip: ClipModelMetaSchema.optional()
 });
 var ConvertTargetSchema = z.discriminatedUnion("format", [z.object({
 	format: z.literal("openvino"),
@@ -12617,6 +12695,42 @@ var LinkedDeviceSchema = z.object({
 	features: z.array(z.string()),
 	producesTrackedEvents: z.boolean().optional()
 });
+/**
+* The `linked-devices` extension slot's editable value (D648): the operator's
+* pick list, exactly what `_linkedDeviceIds` persists. Tree children are NOT
+* in it — they are always linked and are not a pick.
+*
+* `trackedDeviceIds` (D655) is the tracked-event opt-in, exactly what
+* `_linkedDeviceTrackedIds` persists: which linked devices materialize a
+* synthetic tracked event on the camera. A read always carries it AS STORED
+* (an absent key reads as `[]`, which is what the resolver makes of it —
+* NONE). On a write it is optional: absent leaves the opt-in untouched, so a
+* card built before D655 cannot erase it by saving the pick list. A present
+* list REPLACES the opt-in; each id must be a pick, a device the camera links
+* by structure (the row's `impliedSources`: tree children, a picked
+* container's child) or already stored — so what was read can always be
+* written back unchanged, and a NEW opt-in outside the linked set is refused.
+*/
+var LinkedDevicesSlotValueSchema = z.object({
+	deviceIds: z.array(z.number().int().positive()),
+	trackedDeviceIds: z.array(z.number().int().positive()).optional()
+});
+/**
+* The `linked-devices` slot — a camera's companion devices, owned by the
+* device manager over `_linkedDeviceIds` (D648, D356). Any device may be a
+* source except a container (its children are picked in its place) and the
+* camera itself.
+*/
+var LINKED_DEVICES_SLOT = {
+	id: "linked-devices",
+	label: "Linked devices",
+	description: "Companion devices of this camera: their controls appear with it, and the ones you opt in produce tracked events on it.",
+	shape: "association",
+	hostDeviceTypes: [DeviceType.Camera],
+	sourceCaps: "any",
+	cardinality: "many",
+	value: LinkedDevicesSlotValueSchema
+};
 /** One camera's resolved linked set, tagged with the camera it belongs to.
 *  The batch answer needs the tag; the single-device answer already has it
 *  from the input, which is why `getLinkedDevices` keeps the untagged shape. */
@@ -12766,7 +12880,7 @@ var deviceManagerCapability = {
 	name: "device-manager",
 	scope: "system",
 	mode: "singleton",
-	exposesDeviceSettings: true,
+	extensionSlots: [LINKED_DEVICES_SLOT],
 	methods: {
 		/** Reserve (or re-resolve) a progressive numeric id for `(addonId, stableId)`.
 		*  Idempotent: returns the existing id if one is already persisted for the
@@ -13269,11 +13383,12 @@ var deviceManagerCapability = {
 		/**
 		* Resolve the devices LINKED to a camera — the single policy authority
 		* both consumers call (viewer devices panel + pipeline-analytics event
-		* kinds/ingest). Device-tree children are ALWAYS included; mode 'auto'
-		* (default) adds every device sharing the camera's non-null `location`,
-		* mode 'manual' adds the persisted manual list instead. Excludes the
-		* camera itself; deduped. Configuration is standard per-device settings
-		* (see the module docblock) — there are no bespoke link mutations.
+		* kinds/ingest). Device-tree children are ALWAYS included, plus the
+		* operator's persisted pick list (`mode` is always `manual` since D356:
+		* same-location devices are suggested by the picker, never linked on
+		* their own). Excludes the camera itself; deduped. The list is written by
+		* the `linked-devices` extension slot over `_linkedDeviceIds` (see the
+		* module docblock).
 		*/
 		getLinkedDevices: method(z.object({ deviceId: z.number() }), z.object({
 			mode: LinkedDevicesModeSchema,
@@ -13818,11 +13933,98 @@ var EmbeddingResultSchema = z.object({
 	embedding: z.array(z.number()),
 	inferenceMs: z.number()
 });
+/** The two CLIP towers the encoder runs; a crash budget is kept per tower. */
+var EmbeddingTowerSchema = z.enum(["image", "text"]);
+/**
+* A tower in the terminal `failed` state (D649, D6): it crashed or failed to
+* load `crashes` times within `windowMs`, and is refused by name until an
+* operator `resetFailedModels` or a model change — never on a timer.
+*
+* `nodeId` is the node whose tower failed. The state lives in THAT node's
+* encoder process (in memory — a runner respawn clears it), and one node's
+* answer says nothing about another's.
+*/
+var EmbeddingFailedModelSchema = z.object({
+	modelId: z.string(),
+	tower: EmbeddingTowerSchema,
+	nodeId: z.string(),
+	crashes: z.number(),
+	windowMs: z.number(),
+	sinceMs: z.number(),
+	lastReason: z.string()
+});
+/**
+* A model whose REQUIREMENTS can never be met on this node (D649 round 5):
+* an id the catalog does not know, a model URL answering 404/410, a declared
+* sibling (the tokenizer) that is not there. After `attempts` failed builds
+* it is terminally `requirements-failed`, refused by name until an operator
+* `resetFailedModels` or a model change — the same exits as a crashed tower.
+*/
+var EmbeddingFailedRequirementSchema = z.object({
+	modelId: z.string(),
+	tower: EmbeddingTowerSchema,
+	nodeId: z.string(),
+	attempts: z.number(),
+	sinceMs: z.number(),
+	lastReason: z.string()
+});
 var EmbeddingInfoSchema = z.object({
 	modelId: z.string(),
 	embeddingDim: z.number(),
-	ready: z.boolean()
-});
+	ready: z.boolean(),
+	/**
+	* The node that answered. Absent only from an encoder older than D649's
+	* crash budget — whose `failedModels` is then UNKNOWN (D315), never "none".
+	*/
+	nodeId: z.string().optional(),
+	/**
+	* Towers in `failed` on the answering node, each row naming it. `undefined`
+	* means the node could not say (pre-budget encoder); a node that has the
+	* budget always answers an array, empty included.
+	*/
+	failedModels: z.array(EmbeddingFailedModelSchema).optional(),
+	/** Models terminally `requirements-failed` on the answering node; same reading as above. */
+	failedRequirements: z.array(EmbeddingFailedRequirementSchema).optional()
+});
+/**
+* The THREE codes an encoder refusal can carry (D649, D6). Same shape as
+* `VECTOR_INDEX_DIM_CONFLICT`: the code rides in the MESSAGE, because an
+* Error's own properties do not survive the UDS/tRPC hop and its message does,
+* and both sides go through the helpers below — the encoder builds the
+* refusal, the live detail plane classifies on it to count refusals per
+* camera instead of logging one warning per track. The bracketed token
+* carries the code, the model, the tower and the node so a consumer never
+* parses prose.
+*
+* - `EMBEDDING_MODEL_FAILED`: the tower crashed / failed to load past the crash
+*   budget — terminal until `resetFailedModels` or a model change.
+* - `EMBEDDING_REQUIREMENTS_UNAVAILABLE`: files or runtime not there right now
+*   (a download or Python that failed, or the cooldown after one) — the next
+*   request past the cooldown tries again.
+* - `EMBEDDING_REQUIREMENTS_FAILED`: the requirements can never be met (unknown
+*   id, 404/410, missing sibling) and the bounded attempts are spent —
+*   terminal, same exits as a crashed tower.
+*/
+var EMBEDDING_MODEL_FAILED = "embedding-model-failed";
+var EMBEDDING_REQUIREMENTS_UNAVAILABLE = "embedding-requirements-unavailable";
+var EMBEDDING_REQUIREMENTS_FAILED = "embedding-requirements-failed";
+z.enum([
+	EMBEDDING_MODEL_FAILED,
+	EMBEDDING_REQUIREMENTS_UNAVAILABLE,
+	EMBEDDING_REQUIREMENTS_FAILED
+]);
+new RegExp(`\\[(${EMBEDDING_MODEL_FAILED}|${EMBEDDING_REQUIREMENTS_UNAVAILABLE}|${EMBEDDING_REQUIREMENTS_FAILED}) model=([^\\s\\]]+) tower=(image|text) node=([^\\s\\]]+)\\]`);
+/**
+* ONE provider per node (`placement: any-node`), addressed like every global
+* collection: the codegen injects a `{ nodeId?, addonId? }` selector on the
+* void methods and lifts a top-level `nodeId` off the object ones. A call
+* that names no node is answered by the HUB's provider — never by a merge
+* across nodes, because no global collection fans out across nodes (only the
+* providers of one node are `concatCollection`-fanned). So a fleet view of
+* `failedModels` is one `getInfo({ nodeId })` per node, and every answer
+* names the node it came from (D649 round 4); a node that cannot be asked is
+* UNKNOWN to the reader, never "no failures" (D315).
+*/
 var embeddingEncoderCapability = {
 	name: "embedding-encoder",
 	scope: "system",
@@ -13841,8 +14043,30 @@ var embeddingEncoderCapability = {
 			width: z.number(),
 			height: z.number()
 		}), EmbeddingResultSchema, { auth: "admin" }),
-		encodeText: method(z.object({ text: z.string() }), EmbeddingResultSchema, { auth: "admin" }),
-		getInfo: method(z.void(), EmbeddingInfoSchema, { auth: "admin" })
+		/**
+		* `modelId` (a CLIP IMAGE model id, whose catalog `clip.textModelId` names
+		* the text tower) encodes in that model's space; absent, the cluster row's
+		* `clip-embedding` model — the space every writer is in (D649).
+		*/
+		encodeText: method(z.object({
+			text: z.string(),
+			modelId: z.string().min(1).optional()
+		}), EmbeddingResultSchema, { auth: "admin" }),
+		/** Answers for ONE node — the `nodeId` selector's, else the hub's. */
+		getInfo: method(z.void(), EmbeddingInfoSchema, { auth: "admin" }),
+		/**
+		* The operator's explicit clear of the `failed` state (one model, or all)
+		* on ONE node — pass `nodeId` for an agent; the result names the node it
+		* cleared. The only way out besides a model change: a crashing tower is
+		* not retried on a timer.
+		*/
+		resetFailedModels: method(z.object({ modelId: z.string().min(1).optional() }), z.object({
+			cleared: z.array(z.string()),
+			nodeId: z.string()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 /**
@@ -17637,7 +17861,12 @@ var NcMediaPolicySchema = z.object({
 	* the degrade engine, which drops the video and keeps the still.
 	*/
 	clip: z.boolean().optional(),
-	/** Seconds of footage BEFORE / AFTER the event instant. Defaults 3 / 7. */
+	/**
+	* Seconds of footage BEFORE / AFTER the event instant. Absent =
+	* {@link NC_CLIP_PRE_ROLL_DEFAULT_SEC} / {@link NC_CLIP_POST_ROLL_DEFAULT_SEC}
+	* (4 / 6), resolved by the Notification Center at dispatch — deliberately not
+	* a Zod default, so a rule that never chose keeps following the hub's.
+	*/
 	clipPreRollSec: z.number().int().min(0).max(30).optional(),
 	clipPostRollSec: z.number().int().min(0).max(30).optional(),
 	/**
@@ -19212,6 +19441,130 @@ var oauthIntegrationCapability = {
 getDescriptor: method(z.void(), OauthIntegrationDescriptorSchema, { auth: "admin" }) }
 };
 /**
+* A model choice has a SCOPE, and a scope change has a workflow.
+*
+* ## The two scopes
+*
+* Almost every pipeline step's model is a **node** question: which build runs
+* fastest on THIS accelerator. Two nodes may legitimately answer differently —
+* a Coral runs the tflite SSD, a Mac runs the coreml YOLO — because the answers
+* are compared against nothing. They produce boxes, and a box is a box.
+*
+* Two steps are not like that. `face-embedding` and `clip-embedding` produce
+* **vectors that land in ONE shared index** (`identity_samples`,
+* `vec_object_clip`) and are ranked against each other by cosine similarity.
+* Cosine similarity between two encoders is not a weak signal, it is a
+* meaningless number — and nothing inside a vector can tell you it happened.
+* So for those two steps the model is a **cluster** question with exactly one
+* answer, stored in exactly one row.
+*
+* That is the same argument [D52](../../../../docs/decisions/adr-0052.md) makes
+* for the crop convention (`detail-crop.ts`), one level up: the crop decides
+* WHAT pixels the encoder sees, this decides WHICH encoder sees them. Both are
+* cluster-wide for the same reason and neither may become per-node.
+*
+* ## Why the registry lives here and not in the step catalog
+*
+* The scope itself is declared on the step, in
+* `detection-pipeline/registry/step-definitions.ts` (`StepDefinition.modelScope`)
+* — that is where a new step declares what kind of choice its model is. But the
+* catalog lives inside `addon-pipeline`, and three packages that must NOT
+* import an addon need to know the set: the orchestrator (which renders and
+* stores the row), post-analysis (which pins the row for a re-embed pass) and
+* admin-ui (which mirrors it). So the set is mirrored here, and
+* `scripts/check-cluster-model-scope.ts` fails the build when the two disagree.
+* A hand-copied key that stops matching is exactly how a setting silently stops
+* arriving while both sides still look correct.
+*
+* ## The defaults ARE today's behaviour
+*
+* {@link DEFAULT_CLUSTER_STEP_MODELS} reproduces the catalog `defaultModelId`
+* of both steps. Declaring the scope therefore changes nothing on the day it
+* ships: the cluster row starts out saying what every node was already doing.
+* Changing it is legitimate — that is what the knob is for — but it invalidates
+* the stored vectors of that surface, and must be followed by a re-embed pass
+* (`face-reembed-pass.ts`, `embedding-rebuild.ts`).
+*/
+/**
+* Why the orchestrator cannot say which model the operator chose for a
+* cluster-scoped step (D651).
+*/
+var CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS = [
+	"owner-not-ready",
+	"store-read-failed",
+	"three-way-read-unavailable",
+	"invalid-stored",
+	"not-cluster-scoped"
+];
+Object.freeze(Object.fromEntries([{
+	stepId: "face-embedding",
+	label: "Face recognition model",
+	defaultModelId: "auraface-r100",
+	indexName: "the enrolled face gallery",
+	options: [
+		{
+			id: "auraface-r100",
+			label: "AuraFace R100"
+		},
+		{
+			id: "arcface-r100",
+			label: "ArcFace (ResNet34)"
+		},
+		{
+			id: "inception-resnet-v1",
+			label: "Inception ResNet V1"
+		}
+	]
+}, {
+	stepId: "clip-embedding",
+	label: "Semantic search model",
+	defaultModelId: "mobileclip-s1",
+	indexName: "the object semantic-search index",
+	options: [
+		{
+			id: "mobileclip-s1",
+			label: "MobileCLIP S1"
+		},
+		{
+			id: "mobileclip-s2",
+			label: "MobileCLIP S2"
+		},
+		{
+			id: "siglip2-b16-224",
+			label: "SigLIP2 B/16 (Apache-2.0)"
+		}
+	]
+}].map((s) => [s.stepId, s.defaultModelId])));
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = z.number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
+/**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
 * per-frame detections emitted by the pipeline runner into tracked
 * objects, per-kind event collections (motion / object / audio), and
@@ -20035,7 +20388,8 @@ var MediaFileKindEnum = z.enum([
 	"thumbnailSmall",
 	"confirmationCrop",
 	"debugCrop",
-	"sceneFrame"
+	"sceneFrame",
+	"lastSceneFrame"
 ]);
 /**
 * One media row ON THE WIRE: what it is, how big it is, and WHERE ITS BYTES
@@ -20597,7 +20951,23 @@ var SearchObjectEventsInput = z.object({
 	until: z.number().optional(),
 	classFilter: z.string().optional(),
 	limit: z.number().default(50),
-	minScore: z.number().min(0).max(1).default(.2)
+	/**
+	* An ABSOLUTE cosine floor. Optional since D649: a floor is a property of the
+	* model (0.2 kept 96% of matched pairs on MobileCLIP S1 and 2.7% on SigLIP2),
+	* so an absent one resolves to the searched model's own `searchMinScore`
+	* scaled by `strictness`. A number sent here is honoured verbatim.
+	*/
+	minScore: z.number().min(0).max(1).optional(),
+	/** Model-relative floor — see `resolveClipSearchMinScore`. Default `loose`. */
+	strictness: ClipSearchStrictnessSchema.optional(),
+	/**
+	* Search THIS CLIP model's index instead of the cluster row's. Every index a
+	* model ever wrote stays searchable until it is wiped (the MobileCLIP index
+	* through a SigLIP2 cutover and its rollback window). An id with no CLIP
+	* metadata is refused; an id other than the cluster row's is ADMIN-only
+	* (`model-override-requires-admin`).
+	*/
+	modelId: z.string().min(1).optional()
 });
 var TrackCascadeCountsSchema = z.object({
 	/** Persisted track roots deleted (authoritative). */
@@ -20732,7 +21102,41 @@ var RebuildObjectEmbeddingsInput = z.object({
 * comparable, so wiping and rebuilding is the only way to be sure every vector
 * means the same thing.
 */
-var WipeObjectEmbeddingsResultSchema = z.object({ deleted: z.number() });
+var WipeObjectEmbeddingsResultSchema = z.object({
+	deleted: z.number(),
+	/**
+	* CLIP indexes that could NOT be emptied (unreachable, or refused at their
+	* dimension) — not a clean slate. Additive and optional (D649).
+	*/
+	failedIndexes: z.array(z.string()).optional()
+});
+/**
+* Why a rebuild did not start, BY NAME — ONE vocabulary for both gates in front
+* of a pass (D649 over D651). A bare `started: false` read the same for "the
+* stores are booting" and "the cluster row names a model with no CLIP
+* metadata", which need different fixes.
+*  - `stores-unavailable` — the analytics stores or the API are not up yet.
+*  - the owner's confirmation of the cluster model (D651, `ClusterPinConfirmer`):
+*    a pass that rewrites an index needs two agreeing reads of the OWNER's
+*    answer (`pipelineOrchestrator.getClusterModelChoice`) — a pass that cannot
+*    name its model does not run (D54):
+*    - the owner's own `unreadable` reasons (`owner-not-ready`,
+*      `store-read-failed`, `three-way-read-unavailable`, `invalid-stored`,
+*      `not-cluster-scoped`);
+*    - `method-unavailable` — the orchestrator predates the method;
+*    - `read-failed` — the call failed or answered something unparseable;
+*    - `reads-disagree` — the two reads named different choices.
+*  - `not-a-clip-model` — the CONFIRMED id has no CLIP metadata, so there is no
+*    index to fill and no dimension to check against (D649).
+*/
+var RebuildObjectEmbeddingsRefusalSchema = z.enum([
+	"stores-unavailable",
+	...CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS,
+	"method-unavailable",
+	"read-failed",
+	"reads-disagree",
+	"not-a-clip-model"
+]);
 /**
 * Acknowledgement that a rebuild STARTED.
 *
@@ -20745,7 +21149,12 @@ var WipeObjectEmbeddingsResultSchema = z.object({ deleted: z.number() });
 var RebuildObjectEmbeddingsResultSchema = z.object({
 	started: z.boolean(),
 	/** True when a pass was already running; the new request is ignored. */
-	alreadyRunning: z.boolean()
+	alreadyRunning: z.boolean(),
+	/** Present when the pass refused to start — see `RebuildObjectEmbeddingsRefusalSchema`. */
+	refusal: RebuildObjectEmbeddingsRefusalSchema.optional(),
+	/** The CLIP model the pass pinned, and the index it fills (when it started). */
+	modelId: z.string().optional(),
+	index: z.string().optional()
 });
 var RebuildStatusSchema = z.object({
 	running: z.boolean(),
@@ -20779,7 +21188,11 @@ var RebuildStatusSchema = z.object({
 	startedAtMs: z.number().nullable(),
 	finishedAtMs: z.number().nullable(),
 	/** Present when the pass ended by throwing. */
-	error: z.string().nullable()
+	error: z.string().nullable(),
+	/** The CLIP model the current / last pass pinned (D54), `null` before any. */
+	modelId: z.string().nullable(),
+	/** The index that pass fills — `ClipModelMeta.vectorIndex` of `modelId` (D649). */
+	index: z.string().nullable()
 });
 /**
 * Acknowledgement that a debug-media reclaim STARTED.
@@ -21723,7 +22136,7 @@ var pipelineAnalyticsCapability = {
 		* ObjectEvents by trackId. Returns up to `limit` events scored ≥
 		* `minScore`, sorted descending by score.
 		*/
-		searchObjectEvents: method(SearchObjectEventsInput, z.array(ScoredObjectEventSchema).readonly()),
+		searchObjectEvents: method(SearchObjectEventsInput, z.array(ScoredObjectEventSchema).readonly(), { caller: "required" }),
 		wipeObjectEmbeddings: method(z.object({}), WipeObjectEmbeddingsResultSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -22365,7 +22778,14 @@ var pipelineExecutorCapability = {
 		*/
 		inferCached: method(z.object({
 			stepId: z.string(),
-			frameId: z.number().int()
+			frameId: z.number().int(),
+			/**
+			* The model to time — REQUIRED (D658). Without it the pool answered the
+			* step's ACTIVE variant (the first loaded after boot), so a benchmark
+			* of model B silently timed model A. Callers pass the `rootModelId`
+			* their warmup `runPipeline` reported: the model that actually ran.
+			*/
+			modelId: z.string().min(1)
 		}), z.record(z.string(), z.unknown()), { kind: "mutation" }),
 		/**
 		* Release a cached frame from the Python pool's memory.
@@ -23017,6 +23437,17 @@ var RunnerFrameSourceSchema = z.discriminatedUnion("kind", [z.object({ kind: z.l
 	hubHostnameOverride: z.string().optional()
 })]).describe("Per-camera frame-source mode for the runner (P2c)");
 /**
+* What ONE step runs with on ONE roster device for THIS camera (D650): the
+* device's per-(node,device) base with the camera's override for that device
+* on top — the same `override ?? base` merge the orchestrator applies to the
+* elected device (`applyDeviceProvisioning`). Absent `modelId` ⇒ the executor
+* resolves the device format's default, exactly as on the elected device.
+*/
+var RunnerJumpStepProvisioningSchema = z.object({
+	modelId: z.string().optional(),
+	settings: z.record(z.string(), z.unknown()).optional()
+});
+/**
 * One ENABLED inference device on the runner's node, as the step-tree
 * device-jump resolver sees it (phase 1). The orchestrator populates this
 * roster on the attach payload whenever the camera is elected onto a specific
@@ -23028,7 +23459,16 @@ var RunnerFrameSourceSchema = z.discriminatedUnion("kind", [z.object({ kind: z.l
 var RunnerInferenceDeviceSchema = z.object({
 	deviceKey: z.string(),
 	weight: z.number().positive().default(1),
-	maxSessions: z.number().int().positive().nullable().default(null)
+	maxSessions: z.number().int().positive().nullable().default(null),
+	/**
+	* Per-step provisioning for this camera on THIS device (D650), keyed by step
+	* id. A step the runner jumps here runs with these fields, never with the
+	* elected device's: `modelId` / `settings` are REPLACED on the jumped subtree
+	* (a step absent from the map runs with neither — the target format default).
+	* Absent field ⇒ an orchestrator that predates D650: the jumped step keeps
+	* the elected device's provisioning, as before.
+	*/
+	steps: z.record(z.string(), RunnerJumpStepProvisioningSchema).optional()
 });
 /**
 * Camera assignment payload sent by `addon-pipeline-orchestrator` to a
@@ -24125,6 +24565,28 @@ var NodeInferenceDeviceSchema = z.object({
 	*/
 	exclusion: InferenceDeviceExclusionReasonSchema.nullable()
 });
+/**
+* The operator's model choice for one cluster-scoped step, answered by the
+* addon that OWNS the `clusterModel:*` settings (D651). Three answers, never
+* folded: a written choice, a key nobody wrote (the cluster runs the default
+* BY ABSENCE), or no answer. A caller that rewrites an index acts only on the
+* first two, read twice and agreeing.
+*/
+var ClusterModelChoiceSchema = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("stored"),
+		modelId: z.string()
+	}),
+	z.object({
+		kind: z.literal("absent"),
+		defaultModelId: z.string()
+	}),
+	z.object({
+		kind: z.literal("unreadable"),
+		reason: z.enum(CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS),
+		error: z.string().optional()
+	})
+]);
 var NodeInferenceDevicesSchema = z.object({
 	nodeId: z.string(),
 	/** False when the node's platform-probe was unreachable (no live device set). */
@@ -24221,9 +24683,19 @@ var pipelineOrchestratorCapability = {
 		* Trigger a full rebalance pass. Iterates over all assigned cameras,
 		* recomputes the optimal agent for each one based on current load +
 		* hardware affinity, and migrates cameras whose current agent is no
-		* longer optimal. Pinned cameras are never migrated.
-		*/
-		rebalance: method(z.void(), z.object({ migrated: z.number() }), {
+		* longer optimal. Pinned cameras are never migrated. `skipped` names the
+		* cameras the pass wanted to move and could not, with why — a target node
+		* that has not answered its catalog / device health yet, or a device that
+		* cannot run the camera's root (D650).
+		*/
+		rebalance: method(z.void(), z.object({
+			migrated: z.number(),
+			skipped: z.array(z.object({
+				deviceId: z.number(),
+				targetNodeId: z.string(),
+				reason: z.string()
+			})).default([])
+		}), {
 			kind: "mutation",
 			auth: "admin"
 		}),
@@ -24233,6 +24705,13 @@ var pipelineOrchestratorCapability = {
 		getPipelineAssignment: method(z.object({ deviceId: z.number() }), PipelineAssignmentSchema.nullable()),
 		/** Get per-agent load summaries used by the load balancer + dashboards. */
 		getAgentLoad: method(z.void(), z.array(AgentLoadSummarySchema).readonly()),
+		/**
+		* The operator's STORED model choice for one cluster-scoped step (D651).
+		* Read three-way from this addon's own store, only once its boot has
+		* settled. Unlike `addonSettings.getGlobalSettings`, it never answers a
+		* default as though someone chose it.
+		*/
+		getClusterModelChoice: method(z.object({ stepId: z.string() }), ClusterModelChoiceSchema),
 		/** Aggregate global metrics across the whole detection cluster. */
 		getGlobalMetrics: method(z.void(), GlobalMetricsSchema),
 		/**
@@ -26703,6 +27182,20 @@ var VectorScanResultSchema = z.object({
 	*/
 	nextCursor: z.number().int().nonnegative().nullable()
 });
+/**
+* The ONE error code for "this index exists at another dimension; refusing to
+* redeclare it" (D649). It rides in the MESSAGE — an Error's own properties do
+* not survive the UDS/tRPC hop, its message does — and both sides go through
+* the helpers below, never a copied phrase: a consumer that must tell "this
+* index can never hold my vectors" from "the provider is unreachable" (a
+* delete counts the first as nothing-to-delete and the second as still
+* present) otherwise breaks silently the day the wording changes.
+*/
+var VECTOR_INDEX_DIM_CONFLICT = "vector-index-dim-conflict";
+/** The provider's refusal, carrying {@link VECTOR_INDEX_DIM_CONFLICT}. */
+function vectorIndexDimConflictError(index, declaredDim, requestedDim) {
+	return /* @__PURE__ */ new Error(`[${VECTOR_INDEX_DIM_CONFLICT}] vector-store: index "${index}" is declared with dim ${String(declaredDim)}; refusing to redeclare as ${String(requestedDim)}`);
+}
 var VectorStatsInputSchema = z.object({ index: z.string() });
 var VectorStatsResultSchema = z.object({
 	/** Provider id, so an operator can tell brute force from an ANN index. */
@@ -27561,6 +28054,411 @@ var videoclipsCapability = {
 	}
 };
 /**
+* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
+* valutatore puro del suo FRONTE.
+*
+* Viveva dentro il builtin virtual-doorbell
+* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
+* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
+* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
+* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
+* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
+* SPOSTA qui e il doorbell la ri-esporta.
+*
+* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
+* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
+* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
+* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
+*/
+/**
+* Known binary / switch source caps → the boolean slice field whose
+* false→true rise counts as ACTIVE. Every entry is "fire on active".
+* Sensors whose "active" reading is not a plain boolean (presence's string
+* state, connectivity's connected flag) are deliberately excluded — a
+* reconnect is not a doorbell press, and it is not a recording either.
+*/
+var SOURCE_CAP_ACTIVE_FIELD = {
+	contact: "entryOpen",
+	binary: "on",
+	switch: "on",
+	motion: "detected",
+	flood: "flooded",
+	gas: "detected",
+	smoke: "detected",
+	"carbon-monoxide": "detected",
+	vibration: "detected",
+	tamper: "tampered"
+};
+/**
+* The same caps → the slice field carrying the ms-epoch timestamp of the
+* last transition. Every source cap MUST appear here (guarded by a spec):
+* without a transition timestamp the evaluator cannot tell a genuine rise
+* from a boot-time hydration when the FIRST slice it ever sees is already
+* active, and errs towards silence — swallowing the rise.
+*
+* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
+* provider derives them from `state.last_changed`, so they survive our own
+* restarts and correctly read as "hours ago" for a state that has been
+* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
+*/
+var SOURCE_CAP_CHANGED_AT_FIELD = {
+	contact: "lastChangedAt",
+	binary: "lastChangedAt",
+	switch: "lastChangedAt",
+	motion: "lastDetectedAt",
+	flood: "lastChangedAt",
+	gas: "lastChangedAt",
+	smoke: "lastChangedAt",
+	"carbon-monoxide": "lastChangedAt",
+	vibration: "lastChangedAt",
+	tamper: "lastChangedAt"
+};
+/** Cap names whose presence in a device's bindings qualify it as a source. */
+var SOURCE_CAPS = Object.keys(SOURCE_CAP_ACTIVE_FIELD);
+/** True when a cap is a recognised binary/switch source. */
+function isSourceCap(capName) {
+	return Object.prototype.hasOwnProperty.call(SOURCE_CAP_ACTIVE_FIELD, capName);
+}
+/** Extract the "active" boolean a source cap's slice carries, or null when
+*  the cap is unknown or the field is missing / non-boolean. */
+function sliceActiveValue(capName, slice) {
+	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	return typeof raw === "boolean" ? raw : null;
+}
+/** Ms-epoch transition timestamp a source cap's slice carries, or null when
+*  it is absent, non-numeric or the zero "never observed" sentinel. */
+function sliceChangedAt(capName, slice) {
+	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
+	return raw;
+}
+/**
+* How recent a source's own transition timestamp must be for a FIRST
+* sighting that is already active to count as a genuine rise rather than a
+* hydration of long-standing state.
+*/
+var DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = 3e4;
+/**
+* IL fronte. Puro: nessun orologio proprio, nessuna memoria — il chiamante
+* porta `prior`, `nowMs` e il proprio `startedAtMs`.
+*
+* Il caso della PRIMA slice già attiva è trattato esplicitamente e vale come
+* fronte solo se il timestamp UPSTREAM della transizione è posteriore a
+* `startedAtMs` **e** entro `firstSightingFreshnessMs`. Entrambe le metà
+* servono: la sola freschezza scatterebbe su un'idratazione al boot di uno
+* stato flippato pochi secondi prima del riavvio, e il solo "dopo che abbiamo
+* iniziato" scatterebbe, su un processo di lunga vita, per una sorgente
+* adottata oggi il cui stato è cambiato ieri. Il caso ambiguo ERRA VERSO IL
+* SILENZIO e lo dichiara (`baseline-seeded-stale-active`).
+*/
+function evaluateSensorEdge(input) {
+	const value = sliceActiveValue(input.capName, input.slice);
+	if (value === null) return {
+		edge: "none",
+		value: null,
+		reason: isSourceCap(input.capName) ? "non-boolean-value" : "unknown-cap"
+	};
+	if (input.prior === void 0) {
+		if (!value) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-inactive"
+		};
+		const changedAt = sliceChangedAt(input.capName, input.slice);
+		const floor = Math.max(input.startedAtMs, input.nowMs - input.firstSightingFreshnessMs);
+		if (changedAt === null || changedAt < floor) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-stale-active"
+		};
+		return {
+			edge: "rising",
+			value: true
+		};
+	}
+	if (input.prior === value) return {
+		edge: "none",
+		value,
+		reason: "no-change"
+	};
+	if (!value) return {
+		edge: "none",
+		value,
+		reason: "falling-edge"
+	};
+	return {
+		edge: "rising",
+		value: true
+	};
+}
+/**
+* Doorbell button cap. Two kinds of providers coexist behind this cap
+* name (same pattern as `snapshot`):
+*
+*   - **Native** providers: registered per-device by device-driver
+*     addons via `ctx.registerNativeCap` — either on a
+*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
+*     or directly on the camera (Reolink registers at camera level).
+*     Emits an `onPressed` event every time the firmware pushes a
+*     ring; status tracks the last press and a pressCount since start
+*     (diagnostic).
+*
+*   - **Wrapper** provider: the `virtual-doorbell` system builtin
+*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
+*     device (contact / switch / event-emitter …) into a doorbell for
+*     a camera. `defaultActive: false` — the operator explicitly binds
+*     it per camera in the device-bindings UI, then picks the source
+*     device + trigger in the per-device settings.
+*
+* The DeviceEventPropagator re-emits `onPressed` on the camera parent
+* — subscribers listening at the camera level receive ring events
+* with `via[]` populated. No code on the parent needed.
+*/
+var DoorbellStatusSchema = z.object({
+	/** Ms epoch of the last press. null = never observed since this provider started. */
+	lastPressedAt: z.number().nullable(),
+	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
+	pressCountSinceStart: z.number()
+});
+var DoorbellPressEventSchema = z.object({
+	deviceId: z.number(),
+	timestamp: z.number()
+});
+/**
+* The `doorbell-source` extension slot's editable value (D648): the camera's
+* virtual-doorbell trigger devices, exactly what the wrapper's
+* `doorbellSources` persists (as `{ deviceId }` records).
+*/
+var DoorbellSourceSlotValueSchema = z.object({ deviceIds: z.array(z.number().int().positive()) });
+/**
+* The `doorbell-source` slot — which devices ring this camera's VIRTUAL
+* doorbell, owned by the `virtual-doorbell` wrapper over its
+* `doorbellSources` store (D648). A source rings when one of its
+* `SOURCE_CAPS` rises. Whether the wrapper is bound to the camera at all is a
+* different authority (`deviceManager.setWrapperActive`, D62) — the slot
+* reports it, it never writes it.
+*/
+var DOORBELL_SOURCE_SLOT = {
+	id: "doorbell-source",
+	label: "Doorbell trigger devices",
+	description: "Any of these becoming active rings this camera's virtual doorbell: a binary sensor when it goes active, a switch when it turns on.",
+	shape: "association",
+	hostDeviceTypes: [DeviceType.Camera],
+	sourceCaps: SOURCE_CAPS,
+	cardinality: "many",
+	value: DoorbellSourceSlotValueSchema
+};
+var doorbellCapability = {
+	name: "doorbell",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	kind: "wrapper",
+	defaultActive: false,
+	deviceTypes: [DeviceType.Button, DeviceType.Camera],
+	extensionSlots: [DOORBELL_SOURCE_SLOT],
+	methods: {},
+	events: { 
+	/**
+	* Fires once per physical press. Reolink delivers via Baichuan
+	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
+	* release/duration — it's a pulse.
+	*/
+onPressed: { data: DoorbellPressEventSchema } },
+	status: {
+		schema: DoorbellStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — last press timestamp + lifetime press count.
+	* Mirrored by the kernel and readable via
+	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
+	* without subscribing.
+	*/
+	runtimeState: DoorbellStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+var ExtensionSlotIdSchema = z.enum(["doorbell-source", "linked-devices"]);
+var EXTENSION_SLOTS = {
+	"doorbell-source": {
+		descriptor: DOORBELL_SOURCE_SLOT,
+		declaringCap: "doorbell",
+		hostDeviceTypes: [DeviceType.Camera]
+	},
+	"linked-devices": {
+		descriptor: LINKED_DEVICES_SLOT,
+		declaringCap: "device-manager",
+		hostDeviceTypes: [DeviceType.Camera]
+	}
+};
+/** A slot's editable value, discriminated on `slot`. */
+var ExtensionSlotValueSchema = z.discriminatedUnion("slot", [DoorbellSourceSlotValueSchema.extend({ slot: z.literal("doorbell-source") }), LinkedDevicesSlotValueSchema.extend({ slot: z.literal("linked-devices") })]);
+/** Every device type at least one slot is offered on — `device-extension`'s `deviceTypes`. */
+var EXTENSION_HOST_DEVICE_TYPES = [DeviceType.Camera];
+var ExtensionSourceAvailabilitySchema = z.discriminatedUnion("state", [z.object({ state: z.literal("ok") }), z.object({
+	state: z.literal("unreachable"),
+	reason: z.string()
+})]);
+/** One provider of slots — the D554 source-listing row. */
+var ExtensionSourceSchema = z.object({
+	/** The routing prefix of every `slotRef` this provider serves. */
+	source: z.string(),
+	label: z.string(),
+	/** Stamped by the dispatcher from the registry (D557). */
+	addonId: z.string().optional(),
+	availability: ExtensionSourceAvailabilitySchema
+});
+/**
+* How one picked source stands. `missing` — no such device (deleted, or an id
+* that never existed); `foreign` — a device the slot's owner cannot read from
+* (slice 2's cross-owner graft source); `unavailable` — it exists but is not a
+* valid source now (a container, which is never a pick). A source in any of
+* these states is SHOWN, never silently dropped or re-pointed.
+*/
+var ExtensionSourceHealthSchema = z.enum([
+	"ok",
+	"missing",
+	"foreign",
+	"unavailable"
+]);
+var ExtensionSlotSourceSchema = z.object({
+	deviceId: z.number().int(),
+	/** The device's name, or null when it could not be resolved (`missing`). */
+	name: z.string().nullable(),
+	health: ExtensionSourceHealthSchema,
+	detail: z.string().optional()
+});
+/**
+* A DIFFERENT authority that gates whether the slot's sources do anything —
+* reported read-only, named, never written through this contract (D62). The
+* virtual doorbell's sources ring only while the wrapper is bound to the
+* camera, and that binding belongs to `deviceManager.setWrapperActive`.
+* `unknown` means the gate could not be read; it is not "inactive" (D315).
+*/
+var ExtensionSlotActivationSchema = z.object({
+	state: z.enum([
+		"active",
+		"inactive",
+		"unknown"
+	]),
+	authority: z.string(),
+	detail: z.string().optional()
+});
+/** One slot of one device, as its owner reads it from its own store. */
+var ExtensionSlotStateSchema = z.object({
+	state: z.literal("ok"),
+	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
+	slotRef: z.string(),
+	slot: ExtensionSlotIdSchema,
+	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
+	authority: z.string(),
+	/** graft: its switch. association: null — removing every source is "off". */
+	enabled: z.boolean().nullable(),
+	/** graft: the cap registered on the host. association: null. */
+	projects: z.string().nullable(),
+	activation: ExtensionSlotActivationSchema.nullable(),
+	value: ExtensionSlotValueSchema,
+	sources: z.array(ExtensionSlotSourceSchema),
+	/**
+	* Devices the owner links to the host ON ITS OWN, by structure, and that
+	* are therefore not in `value` (D655): a camera's device-tree children, and
+	* the child a picked container stands for (D356 — a container is never a
+	* pick, its children are). Read-only; the editor shows them and may offer
+	* per-device options on them (the linked-devices tracked-event opt-in).
+	* Absent when the owner links nothing beyond the picks, and from an owner
+	* older than D655.
+	*/
+	impliedSources: z.array(ExtensionSlotSourceSchema).optional()
+});
+/**
+* A provider that could not answer `listSlots` at all. It could not name its
+* own slots, so the row names the ADDON and carries the refusal verbatim.
+* Written by the dispatcher, never by a provider.
+*/
+var ExtensionSlotUnreachableSchema = z.object({
+	state: z.literal("unreachable"),
+	addonId: z.string(),
+	reason: z.string()
+});
+var ExtensionSlotRowSchema = z.discriminatedUnion("state", [ExtensionSlotStateSchema, ExtensionSlotUnreachableSchema]);
+/** One device the slot's editor may offer as a source. */
+var ExtensionCandidateSchema = z.object({
+	deviceId: z.number().int(),
+	name: z.string(),
+	type: z.string(),
+	location: z.string().nullable(),
+	/** The container a child belongs to — "Spotlight 2" alone does not say which. */
+	parentName: z.string().nullable(),
+	/** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
+	suggested: z.boolean(),
+	/** Why it is suggested ("same location"), null when it is not. */
+	reason: z.string().nullable()
+});
+var ExtensionCandidatesSchema = z.object({ candidates: z.array(ExtensionCandidateSchema) });
+/**
+* What a write did. `none` — applied in place. `host` / `parent` — the owner
+* reloaded the host (or, for an accessory child, its parent) because the
+* write changed what the host REGISTERS (a graft switched on or off, slice 2).
+*/
+var ExtensionSetResultSchema = z.object({
+	applied: z.literal(true),
+	reload: z.enum([
+		"none",
+		"host",
+		"parent"
+	])
+});
+var ExtensionSlotRefInputSchema = z.object({
+	deviceId: z.number().int(),
+	slotRef: z.string().min(1)
+});
+var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
+var deviceExtensionCapability = {
+	name: "device-extension",
+	scope: "device",
+	mode: "collection",
+	kind: "wrapper",
+	defaultActive: true,
+	deviceTypes: EXTENSION_HOST_DEVICE_TYPES,
+	deviceConfig: { ui: {
+		kind: "widget",
+		widgetId: "host/extensions-panel",
+		tab: "general",
+		label: "Extensions",
+		order: 72
+	} },
+	methods: {
+		/** One row per slot owner — the D554 source listing `slotRef` routes by. */
+		listSources: method(z.object({ deviceId: z.number().int() }), z.array(ExtensionSourceSchema)),
+		/**
+		* Every slot this device is offered, read by each owner from its own
+		* store. A provider that throws is ONE `unreachable` row (D554.4).
+		*/
+		listSlots: method(z.object({ deviceId: z.number().int() }), z.array(ExtensionSlotRowSchema)),
+		/** The devices the slot's editor may offer, suggestions pre-marked (D356). */
+		listCandidates: method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema),
+		/**
+		* Write one slot through its owner's EXISTING write path. The owner
+		* validates (a container is never a linked device, a camera is never its
+		* own source) and refuses by name before persisting.
+		*/
+		setSlot: method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
 * Optional client-side hints sent at session creation to help the provider
 * pick the best native source. All fields optional — a viewer that knows
 * nothing still gets a sane default. (Relocated from the retired `webrtc`
@@ -30461,75 +31359,6 @@ onStatusChanged: { data: z.object({
 	volatileStateFields: ["lastChangedAt"]
 };
 /**
-* Doorbell button cap. Two kinds of providers coexist behind this cap
-* name (same pattern as `snapshot`):
-*
-*   - **Native** providers: registered per-device by device-driver
-*     addons via `ctx.registerNativeCap` — either on a
-*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
-*     or directly on the camera (Reolink registers at camera level).
-*     Emits an `onPressed` event every time the firmware pushes a
-*     ring; status tracks the last press and a pressCount since start
-*     (diagnostic).
-*
-*   - **Wrapper** provider: the `virtual-doorbell` system builtin
-*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
-*     device (contact / switch / event-emitter …) into a doorbell for
-*     a camera. `defaultActive: false` — the operator explicitly binds
-*     it per camera in the device-bindings UI, then picks the source
-*     device + trigger in the per-device settings.
-*
-* The DeviceEventPropagator re-emits `onPressed` on the camera parent
-* — subscribers listening at the camera level receive ring events
-* with `via[]` populated. No code on the parent needed.
-*/
-var DoorbellStatusSchema = z.object({
-	/** Ms epoch of the last press. null = never observed since this provider started. */
-	lastPressedAt: z.number().nullable(),
-	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
-	pressCountSinceStart: z.number()
-});
-var DoorbellPressEventSchema = z.object({
-	deviceId: z.number(),
-	timestamp: z.number()
-});
-var doorbellCapability = {
-	name: "doorbell",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	kind: "wrapper",
-	defaultActive: false,
-	deviceTypes: [DeviceType.Button, DeviceType.Camera],
-	exposesDeviceSettings: true,
-	methods: {},
-	events: { 
-	/**
-	* Fires once per physical press. Reolink delivers via Baichuan
-	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
-	* release/duration — it's a pulse.
-	*/
-onPressed: { data: DoorbellPressEventSchema } },
-	status: {
-		schema: DoorbellStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — last press timestamp + lifetime press count.
-	* Mirrored by the kernel and readable via
-	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
-	* without subscribing.
-	*/
-	runtimeState: DoorbellStatusSchema,
-	/**
-	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored"
-};
-/**
 * Enum-state sensor — a string value picked from a finite option set.
 * Drives HA `sensor` entries with `state_class: enum` (HVAC action
 * states, weather conditions, contact-source channels, mode strings).
@@ -40684,168 +41513,87 @@ var zoneRulesCapability = {
 	*/
 	durability: "restored"
 };
-/**
-* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
-* valutatore puro del suo FRONTE.
-*
-* Viveva dentro il builtin virtual-doorbell
-* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
-* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
-* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
-* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
-* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
-* SPOSTA qui e il doorbell la ri-esporta.
-*
-* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
-* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
-* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
-* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
-*/
-/**
-* Known binary / switch source caps → the boolean slice field whose
-* false→true rise counts as ACTIVE. Every entry is "fire on active".
-* Sensors whose "active" reading is not a plain boolean (presence's string
-* state, connectivity's connected flag) are deliberately excluded — a
-* reconnect is not a doorbell press, and it is not a recording either.
-*/
-var SOURCE_CAP_ACTIVE_FIELD = {
-	contact: "entryOpen",
-	binary: "on",
-	switch: "on",
-	motion: "detected",
-	flood: "flooded",
-	gas: "detected",
-	smoke: "detected",
-	"carbon-monoxide": "detected",
-	vibration: "detected",
-	tamper: "tampered"
-};
-/**
-* The same caps → the slice field carrying the ms-epoch timestamp of the
-* last transition. Every source cap MUST appear here (guarded by a spec):
-* without a transition timestamp the evaluator cannot tell a genuine rise
-* from a boot-time hydration when the FIRST slice it ever sees is already
-* active, and errs towards silence — swallowing the rise.
-*
-* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
-* provider derives them from `state.last_changed`, so they survive our own
-* restarts and correctly read as "hours ago" for a state that has been
-* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
-*/
-var SOURCE_CAP_CHANGED_AT_FIELD = {
-	contact: "lastChangedAt",
-	binary: "lastChangedAt",
-	switch: "lastChangedAt",
-	motion: "lastDetectedAt",
-	flood: "lastChangedAt",
-	gas: "lastChangedAt",
-	smoke: "lastChangedAt",
-	"carbon-monoxide": "lastChangedAt",
-	vibration: "lastChangedAt",
-	tamper: "lastChangedAt"
-};
-/** Cap names whose presence in a device's bindings qualify it as a source. */
-var SOURCE_CAPS = Object.keys(SOURCE_CAP_ACTIVE_FIELD);
-/**
-* Device `type` values (from `DeviceType`) that can host a binary/switch
-* source cap. Used by the camera's `device-multiselect` picker as the
-* CLIENT-SIDE filter, alongside `SOURCE_CAPS`.
-*
-* Why types and not caps alone: the shared picker filters
-* `deviceManager.listAll` rows client-side, and those rows carry only the
-* device's advertised `features` — NOT its registered cap list. On the live
-* cluster binary sensors and switches advertise EMPTY features (features
-* mirror only a handful of caps like `motion-trigger`), so a caps-only
-* filter matched against `features` would list nothing (the very bug this
-* replaced, which relied on the now-empty `getAllBindings`). Matching by
-* `type` is the reliable client-side signal; the union with `SOURCE_CAPS`
-* still captures any device that DOES advertise a source-cap feature.
-* `sensor` covers contact/motion/flood/gas/smoke/CO/vibration/tamper,
-* `switch` covers switches, `control` covers generic binary actuators.
-*/
-var SOURCE_DEVICE_TYPES = [
-	"sensor",
-	"switch",
-	"control"
-];
-/** True when a cap is a recognised binary/switch source. */
-function isSourceCap(capName) {
-	return Object.prototype.hasOwnProperty.call(SOURCE_CAP_ACTIVE_FIELD, capName);
+function isValueOf(slot, value) {
+	return value.slot === slot;
 }
-/** Extract the "active" boolean a source cap's slice carries, or null when
-*  the cap is unknown or the field is missing / non-boolean. */
-function sliceActiveValue(capName, slice) {
-	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
-	if (field === void 0) return null;
-	const raw = slice[field];
-	return typeof raw === "boolean" ? raw : null;
+/** Bind slot `slot` to its owner's functions. See the module docblock. */
+function defineExtensionSlotProvider(slot, impl) {
+	return {
+		slot,
+		list: async (deviceId) => {
+			const listing = await impl.list(deviceId);
+			if (listing === null) return null;
+			const value = listing.value;
+			return {
+				...listing,
+				value
+			};
+		},
+		set: async (deviceId, value) => {
+			if (!isValueOf(slot, value)) throw new Error(`device-extension: a "${value.slot}" value was sent to slot "${slot}" — refused`);
+			return await impl.set(deviceId, value);
+		},
+		candidates: (deviceId) => impl.candidates(deviceId)
+	};
 }
-/** Ms-epoch transition timestamp a source cap's slice carries, or null when
-*  it is absent, non-numeric or the zero "never observed" sentinel. */
-function sliceChangedAt(capName, slice) {
-	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
-	if (field === void 0) return null;
-	const raw = slice[field];
-	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
-	return raw;
+/** `<source>:<slotId>`. */
+function extensionSlotRef(source, slot) {
+	return `${source}:${slot}`;
 }
-/**
-* How recent a source's own transition timestamp must be for a FIRST
-* sighting that is already active to count as a genuine rise rather than a
-* hydration of long-standing state.
-*/
-var DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = 3e4;
-/**
-* IL fronte. Puro: nessun orologio proprio, nessuna memoria — il chiamante
-* porta `prior`, `nowMs` e il proprio `startedAtMs`.
-*
-* Il caso della PRIMA slice già attiva è trattato esplicitamente e vale come
-* fronte solo se il timestamp UPSTREAM della transizione è posteriore a
-* `startedAtMs` **e** entro `firstSightingFreshnessMs`. Entrambe le metà
-* servono: la sola freschezza scatterebbe su un'idratazione al boot di uno
-* stato flippato pochi secondi prima del riavvio, e il solo "dopo che abbiamo
-* iniziato" scatterebbe, su un processo di lunga vita, per una sorgente
-* adottata oggi il cui stato è cambiato ieri. Il caso ambiguo ERRA VERSO IL
-* SILENZIO e lo dichiara (`baseline-seeded-stale-active`).
-*/
-function evaluateSensorEdge(input) {
-	const value = sliceActiveValue(input.capName, input.slice);
-	if (value === null) return {
-		edge: "none",
-		value: null,
-		reason: isSourceCap(input.capName) ? "non-boolean-value" : "unknown-cap"
-	};
-	if (input.prior === void 0) {
-		if (!value) return {
-			edge: "none",
-			value,
-			reason: "baseline-seeded-inactive"
-		};
-		const changedAt = sliceChangedAt(input.capName, input.slice);
-		const floor = Math.max(input.startedAtMs, input.nowMs - input.firstSightingFreshnessMs);
-		if (changedAt === null || changedAt < floor) return {
-			edge: "none",
-			value,
-			reason: "baseline-seeded-stale-active"
-		};
-		return {
-			edge: "rising",
-			value: true
-		};
-	}
-	if (input.prior === value) return {
-		edge: "none",
-		value,
-		reason: "no-change"
-	};
-	if (!value) return {
-		edge: "none",
-		value,
-		reason: "falling-edge"
+/** Build the `device-extension` provider one owner registers. */
+function createDeviceExtensionProvider(options) {
+	const { source, label, slots, hostTypeOf, logger } = options;
+	const offered = (slot, hostType) => hostType !== null && EXTENSION_SLOTS[slot].hostDeviceTypes.some((t) => t === hostType);
+	const resolve = async (deviceId, slotRef) => {
+		const prefix = `${source}:`;
+		const slot = slotRef.startsWith(prefix) ? slots.find((s) => s.slot === slotRef.slice(prefix.length)) : void 0;
+		if (slot === void 0) throw new Error(`device-extension: "${slotRef}" is not a slot of "${source}" — it serves ${slots.map((s) => extensionSlotRef(source, s.slot)).join(", ") || "(none)"}`);
+		const hostType = await hostTypeOf(deviceId);
+		if (!offered(slot.slot, hostType)) throw new Error(`device-extension: slot "${slot.slot}" is not offered on device ${deviceId} (type ${hostType ?? "unknown"}; offered on ${EXTENSION_SLOTS[slot.slot].hostDeviceTypes.join(", ")})`);
+		return slot;
 	};
 	return {
-		edge: "rising",
-		value: true
+		listSources: async () => [{
+			source,
+			label,
+			availability: { state: "ok" }
+		}],
+		listSlots: async (input) => {
+			const hostType = await hostTypeOf(input.deviceId);
+			const rows = [];
+			for (const slot of slots) {
+				if (!offered(slot.slot, hostType)) continue;
+				const listing = await slot.list(input.deviceId);
+				if (listing === null) continue;
+				rows.push({
+					state: "ok",
+					slotRef: extensionSlotRef(source, slot.slot),
+					slot: slot.slot,
+					authority: listing.authority,
+					enabled: listing.enabled,
+					projects: EXTENSION_SLOTS[slot.slot].descriptor.projects ?? null,
+					activation: listing.activation,
+					value: listing.value,
+					sources: [...listing.sources],
+					...listing.impliedSources !== void 0 ? { impliedSources: [...listing.impliedSources] } : {}
+				});
+			}
+			return rows;
+		},
+		listCandidates: async (input) => {
+			return { candidates: [...await (await resolve(input.deviceId, input.slotRef)).candidates(input.deviceId)] };
+		},
+		setSlot: async (input) => {
+			const result = await (await resolve(input.deviceId, input.slotRef)).set(input.deviceId, input.value);
+			logger.info("device-extension: slot written", {
+				tags: { deviceId: input.deviceId },
+				meta: {
+					slotRef: input.slotRef,
+					reload: result.reload
+				}
+			});
+			return result;
+		}
 	};
 }
 /**
@@ -43741,6 +44489,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	deviceAdoptionCapability,
 	deviceDiscoveryCapability,
 	deviceExportCapability,
+	deviceExtensionCapability,
 	deviceManagerCapability,
 	deviceOpsCapability,
 	deviceProviderCapability,
@@ -45289,6 +46038,30 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceExtension.listCandidates": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.listSlots": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.listSources": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.setSlot": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.addLocation": {
 		capName: "device-manager",
 		capScope: "system",
@@ -45361,12 +46134,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"deviceManager.applyDeviceSettingsPatch": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"deviceManager.applyInitialMeta": {
 		capName: "device-manager",
 		capScope: "system",
@@ -45469,12 +46236,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"deviceManager.getDeviceLiveContribution": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"deviceManager.getDeviceLiveInfoAggregate": {
 		capName: "device-manager",
 		capScope: "system",
@@ -45487,12 +46248,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"deviceManager.getDeviceSettingsContribution": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"deviceManager.getDeviceStatusAggregate": {
 		capName: "device-manager",
 		capScope: "system",
@@ -45997,24 +46752,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"doorbell.applyDeviceSettingsPatch": {
-		capName: "doorbell",
-		capScope: "device",
-		addonId: null,
-		access: "create"
-	},
-	"doorbell.getDeviceLiveContribution": {
-		capName: "doorbell",
-		capScope: "device",
-		addonId: null,
-		access: "view"
-	},
-	"doorbell.getDeviceSettingsContribution": {
-		capName: "doorbell",
-		capScope: "device",
-		addonId: null,
-		access: "view"
-	},
 	"doorbell.getStatus": {
 		capName: "doorbell",
 		capScope: "device",
@@ -46039,6 +46776,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"embeddingEncoder.resetFailedModels": {
+		capName: "embedding-encoder",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"enumSensor.getStatus": {
 		capName: "enum-sensor",
 		capScope: "device",
@@ -48373,6 +49116,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getClusterModelChoice": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getDeviceLiveContribution": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -51198,6 +51947,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceExtension.listCandidates": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.listSlots": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.listSources": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.setSlot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceManager.adoptionRelease": [{
 		name: "camDeviceId",
 		form: "single",
@@ -53957,68 +54726,6 @@ TimelapseRuleInputSchema.extend({
 	createdAt: z.number(),
 	updatedAt: z.number()
 });
-Object.freeze(Object.fromEntries([{
-	stepId: "face-embedding",
-	label: "Face recognition model",
-	defaultModelId: "arcface-r100",
-	indexName: "the enrolled face gallery",
-	options: [
-		{
-			id: "arcface-r100",
-			label: "ArcFace (ResNet34)"
-		},
-		{
-			id: "auraface-r100",
-			label: "AuraFace R100"
-		},
-		{
-			id: "inception-resnet-v1",
-			label: "Inception ResNet V1"
-		}
-	]
-}, {
-	stepId: "clip-embedding",
-	label: "Semantic search model",
-	defaultModelId: "mobileclip-s1",
-	indexName: "the object semantic-search index",
-	options: [{
-		id: "mobileclip-s1",
-		label: "MobileCLIP S1"
-	}, {
-		id: "mobileclip-s2",
-		label: "MobileCLIP S2"
-	}]
-}].map((s) => [s.stepId, s.defaultModelId])));
-z.string().min(1);
-var CLUSTER_STEP_SETTING_FIELDS = [{
-	stepId: "face-embedding",
-	key: "minLandmarkFaceSize",
-	label: "Min face size for recognition (detection px)",
-	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
-	type: "slider",
-	min: 0,
-	max: 64,
-	step: 2,
-	default: 24
-}];
-function clusterStepSettingKey(stepId, fieldKey) {
-	return `clusterStepSetting:${stepId}:${fieldKey}`;
-}
-var ClusterSettingNumberSchema = z.number().finite();
-function readClusterStepSettings(config) {
-	const out = {};
-	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
-		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
-		const value = parsed.success ? parsed.data : field.default;
-		const existing = out[field.stepId] ?? {};
-		out[field.stepId] = {
-			...existing,
-			[field.key]: value
-		};
-	}
-	return out;
-}
-readClusterStepSettings({});
 z.object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -54369,4 +55076,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { decodeVectorBase64 as $, siteZoneKey as $t, STREAM_PROFILE_META as A, hydrateSchema as An, logLevelAtMost as At, alertsCapability as B, EventCategory as Bn, parseStreamParamsFormPatch as Bt, RECORDING_SOURCE_CAMSTACK_ADDON as C, asJsonObject as Cn, kebabToCamel as Ct, SOURCE_CAPS as D, emitDownForOwnedCaps as Dn, localNetworkCapability as Dt, RecordingStatusSchema as E, createEvent as En, lifecycleJobSchema as Et, StorageMigrationJobSchema as F, parseJsonUnknown as Fn, modeMayWrite as Ft, buildStreamParamsConfigSchema as G, resolveBucketMs as Gt, backupCapability as H, procedureAuthKey as Ht, UserRecordSchema as I, readinessKey as In, motionCapability as It, coreBlockAddonId as J, runtimeStatePolicyFor as Jt, cameraGridLayoutCapability as K, resolveLocationMode as Kt, addonPagesCapability as L, resolveCapMount as Ln, normalizeUnit as Lt, StorageCleanupJobSchema as M, isEvent as Mn, mayReadLocation as Mt, StorageLocationModeSchema as N, nodePin as Nn, mayWriteToLocation as Nt, SOURCE_DEVICE_TYPES as O, emitReadiness as On, locationIconKey as Ot, StorageLocationTypeSchema as P, parseJsonObject as Pn, metricsProviderCapability as Pt, declarationOwnerNodeId as Q, settingsStoreCapability as Qt, addonSettingsCapability as R, scopeKey as Rn, objectInputDeclaresAddonId as Rt, MOTION_CLOSE_AFTER_MS as S, WELL_KNOWN_TAB_MAP as Sn, isVoidInput as St, RUNTIME_DEFAULTS as T, asString as Tn, legacyModeOf as Tt, bareAddonId as U, ptzAutotrackCapability as Ut, authProviderCapability as V, platformProbeCapability as Vt, batteryCapability as W, reducePoints as Wt, coreBlocksCapability as X, scopesAllowDeviceCap as Xt, coreBlockIdFromAddonId as Y, scopesAllowAddon as Yt, dataStoreProviderCapability as Z, scoreRuntimes as Zt, LOG_LEVEL_RANK as _, DeviceFeature as _n, isCollectionArrayMethod as _t, BatteryStatusSchema as a, streamCatalogCapability as an, enumerateInferenceDevices as at, METHOD_ACCESS_MAP as b, ReadinessRegistry as bn, isSameAddonId as bt, CORE_BLOCKS_ADDON_ID as c, vectorDimFromBase64 as cn, evaluateSensorEdge as ct, DAY_NAMES as d, errMsg as dn, extractNestedAddonId as dt, snapshotCapability as en, deriveBatteryPresence as et, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as f, buildFfmpegArgs as fn, filesystemBrowseCapability as ft, FIRST_LEVEL_MACRO_CLASSES as g, DEVICE_STATUS_METHOD as gn, isArrayOutputSchema as gt, DeviceStatusSchema as h, DEVICE_SETTINGS_CONTRIBUTION_METHODS as hn, gbToBytes as ht, BaseDevice as i, storageProviderCapability as in, doorbellCapability as it, ScopedTokenSchema as j, isDeviceConfigCap as jn, looseSchema as jt, STORAGE_ACCESS_FALLBACK as k, expandCapMethods as kn, logDestinationCapability as kt, CORE_BLOCK_ADDON_PREFIX as l, vectorStoreCapability as ln, evictionPolicyOfLocation as lt, DeclaredDevices as m, DATAPLANE_SECRET_HEADER as mn, formatMinutes as mt, AlertSchema as n, storageMigrationCapability as nn, deviceStateCapability as nt, CAMERA_SWITCH_ORDER as o, streamQualityLabel as on, enumerateItemArrayFields as ot, DERIVED_CAMERA_SILENCED_CAP_NAMES as p, BaseAddon as pn, foldSnapshotByFunction as pt, collectSecretConfigKeys as q, resolveMethodAuth as qt, ApiKeyRecordSchema as r, storageOccupancyCapability as rn, deviceStatusCapability as rt, CAP_NAMES_WITH_STATUS as s, userManagementCapability as sn, enumerateSchemaFields as st, ALL_CAPABILITY_DEFINITIONS as t, storageCapability as tn, deviceManagerCapability as tt, CoreBlockSchema as u, withLocationMode as un, expandContainer as ut, LegacyStorageLocationDefaultSchema as v, DeviceRole as vn, isLocationEnabled as vt, REDACTED_SECRET as w, asNumber as wn, legacyAutoLinkIds as wt, MINUTES_PER_DAY as x, ReadinessTimeoutError as xn, isSourceCap as xt, LocationIconIdSchema as y, DeviceType as yn, isObjectInput as yt, addonWidgetsCapability as z, sleep as zn, objectInputDeclaresRequiredDeviceId as zt };
+export { decodeVectorBase64 as $, scoreRuntimes as $t, ScopedTokenSchema as A, emitDownForOwnedCaps as An, locationIconKey as At, authProviderCapability as B, resolveCapMount as Bn, objectInputDeclaresAddonId as Bt, RECORDING_SOURCE_CAMSTACK_ADDON as C, ReadinessRegistry as Cn, isSourceCap as Ct, SOURCE_CAPS as D, asNumber as Dn, legacyModeOf as Dt, RecordingStatusSchema as E, asJsonObject as En, legacyAutoLinkIds as Et, UserRecordSchema as F, isEvent as Fn, mayWriteToLocation as Ft, cameraGridLayoutCapability as G, ptzAutotrackCapability as Gt, bareAddonId as H, sleep as Hn, parseStreamParamsFormPatch as Ht, addonPagesCapability as I, nodePin as In, metricsProviderCapability as It, coreBlockIdFromAddonId as J, resolveLocationMode as Jt, collectSecretConfigKeys as K, reducePoints as Kt, addonSettingsCapability as L, parseJsonObject as Ln, modeMayWrite as Lt, StorageLocationModeSchema as M, expandCapMethods as Mn, logLevelAtMost as Mt, StorageLocationTypeSchema as N, hydrateSchema as Nn, looseSchema as Nt, STORAGE_ACCESS_FALLBACK as O, asString as On, lifecycleJobSchema as Ot, StorageMigrationJobSchema as P, isDeviceConfigCap as Pn, mayReadLocation as Pt, declarationOwnerNodeId as Q, scopesAllowDeviceCap as Qt, addonWidgetsCapability as R, parseJsonUnknown as Rn, motionCapability as Rt, MOTION_CLOSE_AFTER_MS as S, DeviceType as Sn, isSameAddonId as St, RUNTIME_DEFAULTS as T, WELL_KNOWN_TAB_MAP as Tn, kebabToCamel as Tt, batteryCapability as U, EventCategory as Un, platformProbeCapability as Ut, backupCapability as V, scopeKey as Vn, objectInputDeclaresRequiredDeviceId as Vt, buildStreamParamsConfigSchema as W, procedureAuthKey as Wt, createDeviceExtensionProvider as X, runtimeStatePolicyFor as Xt, coreBlocksCapability as Y, resolveMethodAuth as Yt, dataStoreProviderCapability as Z, scopesAllowAddon as Zt, LOG_LEVEL_RANK as _, DATAPLANE_SECRET_HEADER as _n, gbToBytes as _t, BatteryStatusSchema as a, storageOccupancyCapability as an, deviceStatusCapability as at, METHOD_ACCESS_MAP as b, DeviceFeature as bn, isLocationEnabled as bt, CORE_BLOCKS_ADDON_ID as c, streamQualityLabel as cn, enumerateItemArrayFields as ct, DAY_NAMES as d, vectorIndexDimConflictError as dn, evictionPolicyOfLocation as dt, settingsStoreCapability as en, defineExtensionSlotProvider as et, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as f, vectorStoreCapability as fn, expandContainer as ft, FIRST_LEVEL_MACRO_CLASSES as g, BaseAddon as gn, formatMinutes as gt, DeviceStatusSchema as h, buildFfmpegArgs as hn, foldSnapshotByFunction as ht, BaseDevice as i, storageMigrationCapability as in, deviceStateCapability as it, StorageCleanupJobSchema as j, emitReadiness as jn, logDestinationCapability as jt, STREAM_PROFILE_META as k, createEvent as kn, localNetworkCapability as kt, CORE_BLOCK_ADDON_PREFIX as l, userManagementCapability as ln, enumerateSchemaFields as lt, DeclaredDevices as m, errMsg as mn, filesystemBrowseCapability as mt, AlertSchema as n, snapshotCapability as nn, deviceExtensionCapability as nt, CAMERA_SWITCH_ORDER as o, storageProviderCapability as on, doorbellCapability as ot, DERIVED_CAMERA_SILENCED_CAP_NAMES as p, withLocationMode as pn, extractNestedAddonId as pt, coreBlockAddonId as q, resolveBucketMs as qt, ApiKeyRecordSchema as r, storageCapability as rn, deviceManagerCapability as rt, CAP_NAMES_WITH_STATUS as s, streamCatalogCapability as sn, enumerateInferenceDevices as st, ALL_CAPABILITY_DEFINITIONS as t, siteZoneKey as tn, deriveBatteryPresence as tt, CoreBlockSchema as u, vectorDimFromBase64 as un, evaluateSensorEdge as ut, LegacyStorageLocationDefaultSchema as v, DEVICE_SETTINGS_CONTRIBUTION_METHODS as vn, isArrayOutputSchema as vt, REDACTED_SECRET as w, ReadinessTimeoutError as wn, isVoidInput as wt, MINUTES_PER_DAY as x, DeviceRole as xn, isObjectInput as xt, LocationIconIdSchema as y, DEVICE_STATUS_METHOD as yn, isCollectionArrayMethod as yt, alertsCapability as z, readinessKey as zn, normalizeUnit as zt };