@camstack/system 1.2.56 → 1.2.58

package/dist/{dist-CblJsHb-.js → dist-Chl2MvMd.js}

@@ -3028,6 +3028,14 @@ var VideoEncodeSchema = zod.z.object({
 		"main",
 		"high"
 	]).optional(),
+	/**
+	* `-level`, e.g. `'3.1'`. A consumer that ADVERTISES a level in its SDP
+	* (`profile-level-id=42e01f` is Baseline 3.1) must constrain the encoder to
+	* it, or it ships a stream that does not match its own advertisement — the
+	* defect class that kept HomeKit black for a year and that Alexa carried
+	* silently. Optional because a browser negotiates the level itself.
+	*/
+	level: zod.z.string().optional(),
 	width: zod.z.number().int().positive().optional(),
 	height: zod.z.number().int().positive().optional(),
 	fps: zod.z.number().positive().optional(),
@@ -3078,6 +3086,29 @@ var EncodeProfileSchema = zod.z.object({
 	outputArgs: zod.z.array(zod.z.string()).optional()
 });
 /**
+* The shape every live egress starts from: H.264 Baseline 3.1 at 720p25.
+* Baseline because it is the one profile every consumer in this repo decodes
+* (Echo, iOS, an old browser); 3.1 because that is what the SDPs advertise.
+*/
+var BASE_LIVE_EGRESS_PROFILE = {
+	video: {
+		codec: "h264",
+		profile: "baseline",
+		level: "3.1",
+		width: 1280,
+		height: 720,
+		fps: 25,
+		bitrateKbps: 2500,
+		gopFrames: 25,
+		bf: 0,
+		preset: "veryfast",
+		tune: "zerolatency"
+	},
+	audio: "passthrough"
+};
+({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
+({ ...BASE_LIVE_EGRESS_PROFILE });
+/**
 * Deep wiring healthcheck — snapshot of active reachability probes across
 * every declared capability + widget of every installed plugin, on every
 * node. Produced by the backend `WiringHealthService` and surfaced via
@@ -3126,6 +3157,105 @@ zod.z.object({
 		unreachable: zod.z.number()
 	})
 });
+/**
+* Per-camera FUNCTION SWITCHES — the one coherent on/off surface over the
+* pipeline functions an operator thinks in terms of.
+*
+* ## This file adds no state
+*
+* Every switch here is a VIEW onto an authority that already existed
+* ([D61](../../../../docs/decisions/adr-0062.md)). The whole point of the
+* group is that there is exactly one place each function is turned off, and
+* the group routes to it:
+*
+* | Switch | Authority | Proven "off stops the work" gate |
+* | --- | --- | --- |
+* | `stream-broker` | `deviceManager.setDisabled` | `StreamBrokerManager.reconcileAllCatalogs` releases the brokers; `ensureBroker` refuses re-creation |
+* | `object-detection` | `deviceManager.setWrapperActive('detection-pipeline')` | `PipelineSettingsStore.resolvePipelineForDevice` returns `{ steps: [], audio: null }` |
+* | `audio-analysis` | `deviceManager.setWrapperActive('audio-analysis')` | `AudioSubscriptionController.subscribeAudioStream` returns `null` before opening the stream |
+* | `recording` | `recording.setDeviceConfig` → `RecordingConfig.enabled` | `band-decision.shouldRecord` returns false; the controller detaches the device |
+* | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
+*
+* The wrapper-binding pair is not a new idea: `legacy-migrations.ts` already
+* migrated the legacy `audioEnabled` / `pipelineEnabled` /
+* `motionDetectionEnabled` booleans ONTO `setWrapperActive`. The group is the
+* surface that decision never got.
+*
+* ## Two rules that are load-bearing
+*
+* - **Recording's switch is `enabled`, never the bands.** `bands` is the only
+*   authored intent and `mode` is derived from it (`deriveRecordingMode`).
+*   Expressing "off" by clearing bands destroys the operator's schedule and
+*   turning the camera back on would then silently record nothing.
+* - **A switch that is off must be reported as off**, not merely produce
+*   nothing. {@link CameraSwitch.enabled} is what a status surface renders as
+*   "disabled by an operator" instead of "broken" — see
+*   `CameraStatus.switchedOff`.
+*/
+/**
+* The five functions the operator named (2026-08-05). Deliberately NOT one id
+* per pipeline step: face recognition and plate/LPR are per-step toggles on
+* `pipelineOrchestrator.setCameraStepToggle` and belong in the pipeline
+* editor, not in a five-button safety group.
+*/
+var CameraSwitchIdSchema = zod.z.enum([
+	"stream-broker",
+	"object-detection",
+	"audio-analysis",
+	"recording",
+	"notifications"
+]);
+/**
+* WHERE the switch's state actually lives. A discriminated union rather than a
+* string so both the writer (the orchestrator's `setCameraSwitch`) and any
+* reader can exhaustively narrow — and so "the group added a parallel map" is
+* a compile error rather than a review comment.
+*/
+var CameraSwitchAuthoritySchema = zod.z.discriminatedUnion("kind", [
+	zod.z.object({ kind: zod.z.literal("device-disabled") }),
+	zod.z.object({
+		kind: zod.z.literal("wrapper-binding"),
+		capName: zod.z.string()
+	}),
+	zod.z.object({ kind: zod.z.literal("recording-config") }),
+	zod.z.object({ kind: zod.z.literal("notification-mute") })
+]);
+/**
+* Why a switch is not offered for this camera. Rendered instead of the
+* control, never as a dead control — an absent function and a broken one must
+* not look the same.
+*/
+var CameraSwitchUnavailableReasonSchema = zod.z.enum(["no-provider", "source-unreachable"]);
+/**
+* One switch, resolved for one camera.
+*
+* `label` and `costWhenOff` travel ON THE WIRE rather than being looked up
+* client-side: the viewer is a separate repository that does not import
+* `@camstack/types`, and a cost line duplicated in two clients is a cost line
+* that will disagree with itself. Five rows per camera is nothing.
+*/
+var CameraSwitchSchema = zod.z.object({
+	id: CameraSwitchIdSchema,
+	label: zod.z.string(),
+	/**
+	* What the operator LOSES while this is off, in one sentence. Required, not
+	* optional: a switch that cannot say what it costs should not ship.
+	*/
+	costWhenOff: zod.z.string(),
+	/** False = do not render a control. `unavailableReason` says why. */
+	available: zod.z.boolean(),
+	unavailableReason: CameraSwitchUnavailableReasonSchema.optional(),
+	/** Current state. Meaningless when `available` is false — read it as `true`. */
+	enabled: zod.z.boolean(),
+	authority: CameraSwitchAuthoritySchema
+});
+/** The whole group for one camera. */
+var CameraSwitchGroupSchema = zod.z.object({
+	deviceId: zod.z.number().int(),
+	switches: zod.z.array(CameraSwitchSchema).readonly(),
+	/** Unix ms when the group was composed server-side. */
+	fetchedAt: zod.z.number()
+});
 /** Friendly display labels for stream quality IDs. */
 var STREAM_QUALITY_LABELS = {
 	high: "High",
@@ -3175,14 +3305,16 @@ var OpsLogOpSchema = zod.z.enum([
 	"manual-delete",
 	"rescan",
 	"retention-run",
-	"relocate"
+	"relocate",
+	"orphan-audit"
 ]);
 /** Why the operation ran. */
 var OpsLogReasonSchema = zod.z.enum([
 	"retention",
 	"quota",
 	"manual",
-	"operator"
+	"operator",
+	"maintenance"
 ]);
 /** One audit row, shared verbatim by both domains. */
 var OpsLogEntrySchema = zod.z.object({
@@ -5409,6 +5541,100 @@ var RtpSourceSchema = zod.z.object({
 	encoder: zod.z.string(),
 	pipelineKey: zod.z.string()
 });
+/**
+* The encode request — **structured and serialisable, with NO raw-flag escape
+* hatch.** This is deliberate and it is the one lesson taken from
+* `getStreamWithCodec`: that method's `outputArgs: string[]` is simultaneously
+* its extensibility mechanism AND part of `pipelineKeyFor`'s sharing key, so
+* adding a flag silently forks the shared child, and two consumers that mean
+* the same thing but spell it differently never share. Here every knob is a
+* NAMED field: a new requirement becomes a schema field (and a codegen run),
+* never an opaque array.
+*
+* `inputArgs` / `outputArgs` are omitted from the profile for the same reason.
+* The operator-facing derived-stream transform editor still has them — that is
+* a different surface (`publishCameraStream({ kind: 'derived' })`) with a
+* different purpose (reshaping a badly-behaved SOURCE), and it is unchanged.
+*/
+var EgressEncodeSchema = EncodeProfileSchema.omit({
+	inputArgs: true,
+	outputArgs: true
+});
+/**
+* How the encoder is bounded. `'tight'` is a one-second VBV window for a
+* consumer whose budget is enforced per second (HomeKit); `'relaxed'` is two
+* seconds, letting a keyframe spike borrow from the next second (a browser,
+* an Echo). Named rather than numeric so the INTENT survives.
+*/
+var EgressRateControlSchema = zod.z.enum(["tight", "relaxed"]);
+var EgressTranscodeRequestSchema = zod.z.object({
+	deviceId: zod.z.number().int().nonnegative(),
+	/** Which published stream to read. */
+	source: zod.z.discriminatedUnion("kind", [zod.z.object({
+		kind: zod.z.literal("profile"),
+		profile: CamProfileSchema
+	}), zod.z.object({
+		kind: zod.z.literal("cam-stream"),
+		camStreamId: zod.z.string().min(1)
+	})]),
+	encode: EgressEncodeSchema,
+	rateControl: EgressRateControlSchema.optional(),
+	/**
+	* `-bsf:v`. A consumer that negotiates its OWN SDP (HomeKit) cannot carry
+	* out-of-band extradata and needs `dump_extra` on both the copy and encode
+	* branches. Enumerated, not free text.
+	*/
+	bitstreamFilter: zod.z.enum([
+		"dump_extra",
+		"h264_mp4toannexb",
+		"hevc_mp4toannexb"
+	]).optional(),
+	pixelFormat: zod.z.enum(["yuv420p", "nv12"]).optional(),
+	/**
+	* Operator/consumer override for decode hardware. ABSENT is the normal case
+	* and the one that matters: the broker then resolves the backend from the
+	* DECODER ADDON's per-node `probedBestHwaccel` (see
+	* `@camstack/types` `ffmpeg/hwaccel.ts`), which is the ranking known to work
+	* on this hardware — never the raw kernel resolver's qsv-first order.
+	*/
+	decodeHwAccel: zod.z.enum([
+		"auto",
+		"none",
+		"videotoolbox",
+		"vaapi",
+		"qsv",
+		"cuda"
+	]).optional(),
+	/**
+	* Host to embed in the returned restream `url`. The broker mints hub-local
+	* `127.0.0.1` URLs; a consumer on another node passes a cluster-resolvable
+	* host (`NodeTopologyService.reachableHostByNode`) so the returned URL is
+	* dialable from there. Same contract as `getStreamWithCodec.hostname` —
+	* `substituteRtspHost` rewrites only the dial address, never the restreamer.
+	*/
+	hostname: zod.z.string().optional(),
+	/** Attribution for the broker panel. Never part of the sharing key. */
+	tag: zod.z.string().optional()
+});
+var EgressTranscodeSchema = zod.z.object({
+	/** Dial-able RTSP url (host-substituted when `hostname` was supplied). */
+	url: zod.z.string(),
+	/** Release handle. Refcounted — the child dies when the last holder releases. */
+	pipelineKey: zod.z.string(),
+	videoCodec: zod.z.enum(["H264", "H265"]),
+	resolution: zod.z.object({
+		width: zod.z.number().int().positive(),
+		height: zod.z.number().int().positive()
+	}),
+	transcoded: zod.z.boolean(),
+	encoder: zod.z.string(),
+	/**
+	* The decode backend the child ACTUALLY ran with — `null` for software.
+	* Returned rather than assumed: a consumer that asked for hardware and got
+	* software needs to be able to see that without reading the broker's logs.
+	*/
+	decodeHwAccel: zod.z.string().nullable()
+});
 var streamBrokerCapability = {
 	name: "stream-broker",
 	scope: "system",
@@ -5580,6 +5806,40 @@ var streamBrokerCapability = {
 			auth: "admin"
 		}),
 		/**
+		* THE ffmpeg primitive. Acquire an encoded stream matching a structured
+		* encode plan; the broker builds the argv through the ONE builder
+		* (`@camstack/types` `ffmpeg/invocation.ts`), resolves decode hardware from
+		* the DECODER ADDON's per-node ranking, and returns a dialable RTSP url.
+		*
+		* **Refcounted and deduplicated on EXACT match.** Two requesters whose
+		* requests produce the same `egressTranscodeSharingKey` receive the SAME
+		* `pipelineKey` and the same child process. Nearly-identical requests are
+		* NOT merged.
+		*
+		* **The handle is immutable.** There is deliberately no `reconfigure`
+		* method and this one never accepts a `pipelineKey` alongside encode
+		* parameters: a consumer whose requirements change releases and
+		* re-acquires. A mutable shared handle is exactly what made Alexa's old
+		* `derived:alexa-<id>` stream a co-tenant hazard — one consumer's
+		* downgrade dragged every other consumer down with it.
+		*
+		* Placement: unpinned, `classifyCapRoute` serves this hub-in-process
+		* (Priority 1). A caller that wants the transcode elsewhere passes
+		* `nodePin(nodeId)` and a `hostname` it can dial.
+		*/
+		acquireEgressTranscode: method(EgressTranscodeRequestSchema, EgressTranscodeSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Drop one reference. The child dies when the last holder releases. */
+		releaseEgressTranscode: method(zod.z.object({ pipelineKey: zod.z.string() }), zod.z.object({
+			released: zod.z.boolean(),
+			refcount: zod.z.number().int().nonnegative()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* ── Decoded audio-chunk plane (Phase 5 / D9) ──────────────────────
 		*
 		* The serialisable replacement for the live-object `IStreamBroker.
@@ -11467,12 +11727,13 @@ var NcConditionsSchema = zod.z.object({
 	* source; otherwise the subject's source must equal it. Legacy records
 	* with no stamped source are treated as `pipeline`. The union spans both
 	* record kinds — object events carry `pipeline` | `onboard`, synthetic
-	* tracks carry `sensor`.
+	* tracks carry `sensor` (a linked device) or `audio` (a D62 audio marker).
 	*/
 	source: zod.z.enum([
 		"pipeline",
 		"onboard",
 		"sensor",
+		"audio",
 		"any"
 	]).optional(),
 	/**
@@ -12060,6 +12321,35 @@ var notificationRulesCapability = {
 			auth: "admin"
 		}),
 		/**
+		* PERMANENT per-camera mute — the notifications half of the per-camera
+		* function switch group ([D61](../../../../docs/decisions/adr-0067.md)).
+		*
+		* Deliberately NOT a snooze. A snooze is bounded at
+		* {@link NC_SNOOZE_MAX_MINUTES} on purpose — "a snooze that could not
+		* expire would be an outage the operator asked for once and forgot" — and
+		* widening it to express "this camera never notifies" would destroy that
+		* property for every snooze. A mute is the other thing: an explicit,
+		* indefinite, admin-only decision, visible in the switch group next to the
+		* other four, and reported on `CameraStatus.switchedOff` so a silent
+		* camera never reads as a working one.
+		*
+		* Returned as ONE list rather than a per-camera query: the group's reader
+		* needs every camera's state, and a per-camera fan-out over the viewer's
+		* single WebSocket is N frames serialised on one socket.
+		*/
+		listDeviceMutes: method(zod.z.object({}), zod.z.object({ mutedDeviceIds: zod.z.array(zod.z.number().int()).readonly() }), { auth: "admin" }),
+		/**
+		* Mute or unmute one camera. Idempotent; an unmute of a camera that was
+		* never muted succeeds.
+		*/
+		setDeviceMuted: method(zod.z.object({
+			deviceId: zod.z.number().int(),
+			muted: zod.z.boolean()
+		}), zod.z.object({ success: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Dry-run a rule against recently persisted records (object events for
 		* `immediate`, closed tracks for `track-end`). Mutation kind only to
 		* carry the full rule object safely; no side effects.
@@ -12471,12 +12761,60 @@ var TrackAudioLabelSchema = zod.z.object({
 });
 /**
 * How a track was produced. `pipeline` (default / absent) = the spatial
-* detection+tracking pipeline. `sensor` = a SYNTHETIC track projected from a
-* linked sensor/control state change (no positions; carries a snapshot). The
-* spatial subsystems (tracker association, occupancy count, re-id/embedding,
-* resurrection) MUST skip `sensor` tracks — they have no bbox trajectory.
+* detection+tracking pipeline. Every OTHER value is a SYNTHETIC projection —
+* no positions, a single snapshot, and no bbox trajectory at all:
+*
+*  - `sensor` — a linked sensor/control device state change.
+*  - `audio` — an audio event on the camera itself that was anomalous for
+*    THAT camera, loud, and heard while nothing visual was happening (D62).
+*
+* The spatial subsystems (tracker association, occupancy count, re-id /
+* embedding, resurrection) MUST skip every synthetic source. Test for that
+* with `isSpatialTrack`, which allow-lists `pipeline` — a `!== 'sensor'`
+* check silently readmits every source added after it was written.
+*/
+var TrackSourceSchema = zod.z.enum([
+	"pipeline",
+	"sensor",
+	"audio"
+]);
+/**
+* Per-track OPERATOR flags — set by hand from the admin UI or the viewer, never
+* by the pipeline. Spread into `TrackSchema` and `KeyEventSchema` from one place
+* so the two surfaces cannot drift.
+*
+* **Absent ≠ false.** A track that has never been touched omits the field; an
+* explicitly un-flagged track carries `false`. Legacy rows written before the
+* columns existed read as absent, and a consumer that needs a boolean should say
+* `flag === true`, not `flag !== false`.
+*
+* What the flags DO is deliberately UNDEFINED at the time of writing: they are
+* operator curation, and the behaviour they drive will be specified separately.
+* In particular a `markForTrain` track is NOT pinned against retention — see
+* `docs/decisions/adr-0059.md` for why that is a store-level change, not a flag.
+*/
+var TrackFlagFields = {
+	/** Operator marked this track as training material. */
+	markForTrain: zod.z.boolean().optional(),
+	/** Operator marked this track for diagnostic attention. */
+	debug: zod.z.boolean().optional()
+};
+/**
+* The write half: a PARTIAL patch. An omitted key is left untouched, so setting
+* one flag can never clear the other — the toggles are independent and are
+* driven from three surfaces that do not know about each other.
+*/
+var TrackFlagsPatchSchema = zod.z.object(TrackFlagFields);
+/**
+* The resolved flag state after a write. Both fields are REQUIRED here (absent
+* collapses to `false`) so a caller can drive a toggle's checked state off the
+* mutation result without a re-fetch.
 */
-var TrackSourceSchema = zod.z.enum(["pipeline", "sensor"]);
+var TrackFlagsSchema = zod.z.object({
+	trackId: zod.z.string(),
+	markForTrain: zod.z.boolean(),
+	debug: zod.z.boolean()
+});
 var TrackSchema = zod.z.object({
 	trackId: zod.z.string(),
 	deviceId: zod.z.number(),
@@ -12519,7 +12857,8 @@ var TrackSchema = zod.z.object({
 	/** Normalized 0..1 trajectory envelope (see {@link TrackEnvelopeSchema}).
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
-	envelope: TrackEnvelopeSchema.optional()
+	envelope: TrackEnvelopeSchema.optional(),
+	...TrackFlagFields
 });
 var BaseEventFields = {
 	id: zod.z.string(),
@@ -12740,7 +13079,8 @@ var KeyEventSchema = zod.z.object({
 	/** Highest-confidence ObjectEvent id for the track (empty when none). */
 	bestEventId: zod.z.string(),
 	/** Track lifetime in ms (lastSeen - firstSeen). */
-	windowMs: zod.z.number().optional()
+	windowMs: zod.z.number().optional(),
+	...TrackFlagFields
 });
 zod.z.object({
 	trackId: zod.z.string(),
@@ -12825,16 +13165,32 @@ var RebuildObjectEmbeddingsInput = zod.z.object({
 	deviceId: zod.z.number().optional(),
 	since: zod.z.number().optional(),
 	until: zod.z.number().optional(),
+	/** Stop after this many tracks; the result reports whether more remain. */
+	maxTracks: zod.z.number().int().positive().optional(),
 	/**
-	* Fraction added on EACH side of the detection box before cropping.
-	* ~0.2 (a 1.4x window) gives CLIP the surroundings it is trained on; 0 is
-	* the pixel-tight crop the first implementation used.
+	* Run every embedding on THIS node instead of round-robining the fleet.
+	*
+	* Named `executeOnNodeId` and not `nodeId` on purpose: an inline `nodeId`
+	* field in cap args is read by `parent-unowned-call.ts` as a ROUTING PIN, so
+	* calling it that would pin the rebuild REQUEST itself to that node — the
+	* rebuild orchestration lives on the hub, and only the per-track step runs
+	* remotely. This field is data; the per-track pin is applied inside.
+	*
+	* Absent ⇒ round-robin over every online node whose runner can serve the
+	* pinned model.
 	*/
-	cropMargin: zod.z.number().min(0).max(4).optional(),
-	/** Square the window before extracting, so a tall subject is not squashed. */
-	square: zod.z.boolean().optional(),
-	/** Stop after this many tracks; the result reports whether more remain. */
-	maxTracks: zod.z.number().int().positive().optional()
+	executeOnNodeId: zod.z.string().optional(),
+	/**
+	* Milliseconds to wait between tracks; omit for the built-in default, `0` to
+	* run flat out.
+	*
+	* A rebuild is bulk maintenance on hub-main's single thread. Measured
+	* 2026-08-06, an unpaced pass held that thread busy 82.2 s out of 120 and
+	* pushed `nodes.topology` from 0.25 s to 26 s for 43 minutes. The value in
+	* force is logged at start and finish so a deliberately slow pass reads
+	* differently from a stalled one.
+	*/
+	pacingMs: zod.z.number().int().nonnegative().optional()
 });
 /**
 * Result of emptying the CLIP index.
@@ -12867,6 +13223,24 @@ var RebuildStatusSchema = zod.z.object({
 	missingKeyFrame: zod.z.number(),
 	/** Tracks with no usable detection box. */
 	missingBbox: zod.z.number(),
+	/**
+	* Tracks an executing node REFUSED rather than broke on — an unreadable key
+	* frame, a step that threw. Separate from `failed` because the remedy is
+	* different, and because a whole camera silently contributing zero vectors
+	* is the shape of failure a rebuild must never hide.
+	*/
+	notRunnable: zod.z.number(),
+	/**
+	* The pass stopped because NO node could serve the pinned model.
+	*
+	* Distinct from `notRunnable` on purpose: that one says "this track was
+	* refused", this one says "the cluster cannot do this work at all" — every
+	* candidate node either lacks the `clip-embedding` step, lacks a build of the
+	* pinned model for its engine format, or dropped out. The remedy is a model /
+	* engine change, not a per-camera one. Non-zero here always comes with
+	* `complete: false`.
+	*/
+	noCapableNode: zod.z.number(),
 	failed: zod.z.number(),
 	/** Set once a pass ends: true only when EVERYTHING was covered. */
 	complete: zod.z.boolean().nullable(),
@@ -13056,6 +13430,31 @@ var pipelineAnalyticsCapability = {
 			auth: "admin"
 		}),
 		/**
+		* Set the per-track operator flags (`markForTrain`, `debug`) on ONE track.
+		* The patch is PARTIAL — an omitted key is left untouched — because the
+		* three surfaces that write it (admin Events grid, viewer track detail,
+		* viewer cluster detail) each own one toggle and must not clobber the other.
+		*
+		* Writes the track ROW: `markForTrain`/`debug` are per-TRACK state, so they
+		* live where `label` and `importance` live, not in any per-device settings
+		* store. Updates the in-RAM active track too, so a flag set on a live track
+		* survives its expiry-time persist.
+		*
+		* `auth: 'protected'` (the default), NOT `admin`: the viewer is an
+		* authenticated non-admin surface and two of the three call sites are
+		* there. Revisit if a flag ever gains an effect that costs storage —
+		* `deleteTracks` next door is admin for exactly that reason.
+		*
+		* Returns the RESOLVED state of both flags (absent → `false`) so a caller
+		* can drive its toggle without a re-fetch. Rejects an unknown track.
+		*/
+		setTrackFlags: method(zod.z.object({
+			/** Log/audit scope only — the trackId is globally unique on its own. */
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			flags: TrackFlagsPatchSchema
+		}), TrackFlagsSchema, { kind: "mutation" }),
+		/**
 		* Durable event-store footprint for the management UI: event rows
 		* (motion + object + audio) counted per camera + total, plus the
 		* event-owned media bytes on disk per camera + total. Stat/count-based,
@@ -13935,6 +14334,53 @@ var DetailResultSchema = zod.z.object({
 	nativeFaceShortSidePx: zod.z.number().optional()
 });
 /**
+* Why an executing node REFUSED a stateless step run (`runStatelessStep`).
+*
+* A refusal is a first-class answer, not an error, because the caller's next
+* move depends on WHICH one it is — and because "the pass produced nothing"
+* must never be reachable without a named, counted cause. The two tiers:
+*
+* - **node-level** (`unknown-step`, `model-not-servable`) — this node can
+*   never serve this (step, model) pair. The caller drops it from its rotation
+*   and retries the same work elsewhere; nothing about the work changes.
+* - **work-level** (`unreadable-frame`, `execution-failed`) — this node is
+*   fine, this one request is not. Retrying it on another node would only
+*   spread the same failure.
+*/
+var StatelessStepRefusalSchema = zod.z.enum([
+	"unknown-step",
+	"model-not-servable",
+	"unreadable-frame",
+	"execution-failed"
+]);
+/**
+* Answer to `runStatelessStep` — a discriminated union rather than a nullable
+* result, because `null` is exactly what made the camera-bound detail path
+* unable to tell "refused" from "never asked".
+*/
+var RunStatelessStepResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("ran"),
+	/** The node that actually executed it — the pin, echoed back for the log. */
+	nodeId: zod.z.string(),
+	/**
+	* The model the step ran with.
+	*
+	* The node verified this exact id has a build for the format it dispatched
+	* on BEFORE running, so the executor's format resolution returns it
+	* unchanged. A caller that pinned a model must compare this field and
+	* treat a mismatch as a refusal — the whole point of the pin is that a
+	* pass writes one feature space.
+	*/
+	modelId: zod.z.string(),
+	details: zod.z.array(DetailResultSchema)
+}), zod.z.object({
+	kind: zod.z.literal("refused"),
+	nodeId: zod.z.string(),
+	reason: StatelessStepRefusalSchema,
+	/** Human-readable specifics — the format tried, the formats shipped, etc. */
+	detail: zod.z.string()
+})]);
+/**
 * Per-camera tunable ranges + defaults. Single source of truth used
 * by both the Zod data schema (validation + default fallback) and
 * the device settings UI (slider min/max/step). Touch one place and
@@ -14338,20 +14784,118 @@ var pipelineRunnerCapability = {
 		* for a single tracked detection. The per-frame plane (`runPipeline`
 		* with `plane: 'frame'`) skips crop children entirely; a track-level
 		* caller invokes this per-track, on its own cadence, instead of on
-		* every frame. Takes either a `frameHandle` (shm lease/session —
-		* preferred, zero-copy) or a `cropJpeg` fallback when the lease/
-		* session backing the frame is already gone. `steps` narrows which
-		* configured children to run (default: all configured children for
-		* `parent.className`). Returns `null` when neither frame source is
-		* resolvable (handle evicted and no cropJpeg fallback supplied).
+		* every frame. `steps` narrows which configured children to run
+		* (default: all configured children for `parent.className`).
+		*
+		* ## Three pixel sources, and WHO decides the rectangle
+		*
+		* Tried in this order; the difference between them is not the pixels but
+		* which side derives the crop, and confusing the two is how the CLIP index
+		* ended up holding two incomparable feature spaces:
+		*
+		* 1. `frameHandle` — shm lease/session, preferred and zero-copy. **The
+		*    runner cuts**, applying the cluster crop convention.
+		* 2. `frameJpeg` — a FULL FRAME supplied by the caller (the embedding
+		*    rebuild's stored key frame). **The runner cuts**, applying the same
+		*    convention to the same function, so a rebuilt vector lands in the same
+		*    feature space as a live one.
+		* 3. `cropJpeg` — an ALREADY-CUT tile. **The caller decided the
+		*    rectangle**; the runner applies NO padding and no squaring and feeds
+		*    it to the model verbatim. Only for the lease-miss retry, where the
+		*    caller holds pixels the runner can no longer reach.
+		*
+		* Returns `null` when no source resolves (handle evicted and no fallback
+		* supplied), when the camera is not attached, or when no enabled step
+		* matches — every one of those is logged on the runner with the deviceId.
 		*/
 		runDetailSubtree: method(zod.z.object({
 			deviceId: zod.z.number(),
 			frameHandle: FrameHandleSchema.optional(),
+			/**
+			* FULL FRAME (base64 JPEG). The runner derives the crop rectangle from
+			* `parent.bbox` with the cluster crop convention and cuts it itself —
+			* do NOT pre-crop for this field, that is what `cropJpeg` is.
+			*/
+			frameJpeg: zod.z.string().optional(),
+			/**
+			* PRE-CUT tile (base64 JPEG), used verbatim — NO padding is applied.
+			* The fallback when the lease/session backing the frame is gone and the
+			* caller already holds a crop.
+			*/
 			cropJpeg: zod.z.string().optional(),
 			parent: DetailParentSchema,
 			steps: zod.z.array(zod.z.string()).optional()
-		}), zod.z.object({ details: zod.z.array(DetailResultSchema) }).nullable(), { kind: "mutation" })
+		}), zod.z.object({ details: zod.z.array(DetailResultSchema) }).nullable(), { kind: "mutation" }),
+		/**
+		* Run ONE enrichment step against caller-supplied pixels, with NO camera
+		* session — no attach, no frame handle, no device affinity.
+		*
+		* ## Why this exists next to `runDetailSubtree` and not inside it
+		*
+		* `runDetailSubtree` resolves its step tree from the LIVE ATTACH STATE. That
+		* is correct for it: its reason to exist is a frame HANDLE, and a handle is
+		* only resolvable while a decode session is open. But it makes the method
+		* useless to anything walking history — cameras run `detectionMode:
+		* 'on-motion'` and detach ~30 s after motion stops, so a fleet-wide
+		* embedding rebuild found most cameras detached and rebuilt only whatever
+		* happened to be attached at that second (measured 2026-08-06: 1125 tracks
+		* scanned, 121 rebuilt, 601 refused as "camera is not attached").
+		*
+		* A caller that ships its own pixels needs none of that machinery. So this
+		* method takes the three things a step actually needs — an image, a box, a
+		* step id — resolves the step from the CATALOG rather than from an
+		* attachment, and runs it on whichever node the caller pinned.
+		*
+		* ## What it deliberately keeps
+		*
+		* The crop rectangle is derived by the SAME `deriveDetailCropRect` call the
+		* live detail plane uses, from the same cluster-wide convention
+		* ([D52](../../../docs/decisions/adr-0052.md)). `frameJpeg` is a FULL frame,
+		* never a pre-cut tile, for exactly the reason `runDetailSubtree` documents:
+		* a caller that cuts is a second feature space.
+		*
+		* ## What it deliberately drops
+		*
+		* No device jump and no `deviceKey`: the jump roster comes from the attach
+		* config, which does not exist here. The step runs on the node's default
+		* engine. This is a maintenance path, not a latency-sensitive one.
+		*
+		* ## Routing
+		*
+		* NOT device-bound. `sourceDeviceId` is DIAGNOSTIC — the camera whose track
+		* these pixels came from, so every log line on the executing node can carry
+		* `tags: { deviceId }`. It is deliberately not named `deviceId`: that field
+		* is a routing hint that would send the call to the camera's owning node,
+		* which is the placement constraint this method exists to remove. Callers
+		* choose the node with `nodePin(nodeId)`; unpinned, an unowned call is
+		* served hub-in-process like any other singleton.
+		*/
+		runStatelessStep: method(zod.z.object({
+			/** Catalog step id, e.g. `clip-embedding`. */
+			stepId: zod.z.string(),
+			/**
+			* REQUIRED model pin. The node runs this exact model or refuses with
+			* `model-not-servable` — it never substitutes a format default, because
+			* a fleet pass that round-robins across nodes would then fill one index
+			* from several encoders.
+			*/
+			modelId: zod.z.string(),
+			/** FULL FRAME, base64 JPEG. The runner cuts — do NOT pre-crop. */
+			frameJpeg: zod.z.string(),
+			/**
+			* The subject box, NORMALISED [0,1] against `frameJpeg`. Normalised on
+			* purpose: the caller stores boxes against a downscaled analysis frame
+			* while the stored key frame is native-resolution, and the only side
+			* that reliably knows the image's pixel dimensions is the side that
+			* decodes it. Denormalising here removes a second reader of the
+			* dimensions and the class of mismatch that comes with it.
+			*/
+			bbox: NativeCropBboxSchema,
+			/** Parent class of the subject (`person`, `vehicle`, …) — carried into the result. */
+			className: zod.z.string(),
+			/** Camera the pixels came from. Diagnostics + log tags ONLY — never routing. */
+			sourceDeviceId: zod.z.number()
+		}), RunStatelessStepResultSchema, { kind: "mutation" })
 	}
 };
 var CameraPipelineConfigSchema = zod.z.object({
@@ -14659,6 +15203,20 @@ var CameraStatusSchema = zod.z.object({
 	detection: CameraDetectionStatusSchema.nullable(),
 	audio: CameraAudioStatusSchema.nullable(),
 	recording: CameraRecordingStatusSchema.nullable(),
+	/**
+	* Per-camera function switches an OPERATOR has turned off
+	* ([D61](../../../../docs/decisions/adr-0067.md)).
+	*
+	* This is the difference between DISABLED and BROKEN. A camera whose
+	* `detection` block reports zero fps and whose `switchedOff` contains
+	* `'object-detection'` was switched off by a person; the same camera with an
+	* empty list is failing. Every status surface must render the two
+	* differently — a quiet camera that looks identical to a dead one is the
+	* silence-reads-as-never-happened trap this repo keeps paying for.
+	*
+	* Empty when nothing is off. Never contains a switch no provider offers.
+	*/
+	switchedOff: zod.z.array(CameraSwitchIdSchema).readonly(),
 	/** Unix timestamp (ms) when this snapshot was composed server-side. */
 	fetchedAt: zod.z.number()
 });
@@ -15058,6 +15616,43 @@ var pipelineOrchestratorCapability = {
 			agentNodeId: zod.z.string().optional()
 		}), CameraPipelineConfigSchema),
 		/**
+		* The whole per-camera function switch group, DERIVED — never a stored
+		* list ([D61](../../../../docs/decisions/adr-0067.md)).
+		*
+		* The group adds no state. Each switch is a view onto the authority that
+		* already owned it (`deviceManager.setDisabled`,
+		* `deviceManager.setWrapperActive`, `RecordingConfig.enabled`,
+		* `notificationRules.setDeviceMuted`), and `switch.authority` says which.
+		* Availability comes from `deviceManager.listBindableCapsForDeviceType`,
+		* so a deployment with no audio analyzer renders no audio switch.
+		*
+		* `auth: 'view'` deliberately — a NON-admin must be able to see that a
+		* camera is quiet because somebody switched it off. Only the mutation is
+		* admin-gated.
+		*/
+		getCameraSwitches: method(zod.z.object({ deviceId: zod.z.number() }), CameraSwitchGroupSchema),
+		/**
+		* Flip ONE switch, routed to its existing authority.
+		*
+		* Never writes a parallel map: `recording` patches `RecordingConfig.enabled`
+		* and leaves `bands` byte-identical (clearing bands to express "off"
+		* destroys the operator's authored schedule and turning the camera back on
+		* would silently record nothing), and the two pipeline switches write the
+		* SAME wrapper binding the legacy `pipelineEnabled` / `audioEnabled`
+		* booleans were migrated onto.
+		*
+		* Rejects a switch this camera does not offer rather than persisting a
+		* write nothing reads.
+		*/
+		setCameraSwitch: method(zod.z.object({
+			deviceId: zod.z.number(),
+			switchId: CameraSwitchIdSchema,
+			enabled: zod.z.boolean()
+		}), CameraSwitchGroupSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Server-composed aggregated status for a single camera.
 		*
 		* Fans out in parallel (bounded, per-stage graceful degradation) to
@@ -27783,6 +28378,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.listDeviceMutes": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.listRules": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -27801,6 +28402,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.setDeviceMuted": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.setRuleEnabled": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -28077,6 +28684,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.setTrackFlags": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.wipeAllAnalytics": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -28383,6 +28996,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getCameraSwitches": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getCapabilityBindings": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -28515,6 +29134,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraSwitch": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCapabilityBinding": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -28605,6 +29230,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.runStatelessStep": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"plateGallery.assignPlate": {
 		capName: "plate-gallery",
 		capScope: "system",
@@ -29421,6 +30052,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.acquireEgressTranscode": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.assignProfile": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -29529,6 +30166,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.releaseEgressTranscode": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.releaseStreamWithCodec": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -30307,6 +30950,30 @@ function decodeVectorBase64(encoded) {
 function vectorDimFromBase64(encoded) {
 	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
 }
+zod.z.object({
+	/**
+	* Fraction of the box's own size added on EACH side before cutting.
+	*
+	* CLIP is trained on natural images WITH surroundings; a pixel-tight crop
+	* removes exactly the context it is strongest on (a dog cut to its outline
+	* is a dark blob). The right value is an empirical question, which is why it
+	* is a setting: 0 / 0.15 / 0.2 / 0.5 are the interesting points.
+	*/
+	paddingRatio: zod.z.number().min(0).max(4),
+	/**
+	* Square the window (in PIXELS) before cutting.
+	*
+	* CLIP's input is square, so a tall bbox resized straight to NxN is squashed
+	* — a standing person becomes a shape the model never saw. Squaring costs
+	* extra background, which is context the model wants anyway. Off by default
+	* because the live path has never squared and the stored index reflects that.
+	*/
+	square: zod.z.boolean()
+});
+({
+	paddingRatio: .15,
+	square: false
+}).paddingRatio;
 /**
 * Scores all applicable inference backends for the given hardware.
 *