@camstack/system 1.2.60 → 1.2.62

package/dist/{dist-Cis_iV-u.js → dist-DgPUarcs.js}

@@ -5434,6 +5434,69 @@ var StreamFormatSchema = zod.z.enum([
 	"mjpeg",
 	"rtsp"
 ]);
+/** A container `produceEventMedia` can emit. */
+var EventMediaKindSchema = zod.z.enum(["mp4", "gif"]);
+/**
+* One produced artifact, referenced by HANDLE.
+*
+* Never inline bytes: a produced clip is 200 KB–5 MB and every consumer of this
+* method is in another runner ([D9](../../../../docs/decisions/adr-0009.md),
+* [D18](../../../../docs/decisions/adr-0018.md) — cross-process media is fetched
+* on demand, compressed, by handle). `bytes` is here so a caller can decide
+* whether it wants the fetch at all.
+*/
+var EventMediaArtifactSchema = zod.z.object({
+	kind: EventMediaKindSchema,
+	/** Opaque, single-camera, short-lived. Redeem with `fetchEventMedia`. */
+	handle: zod.z.string(),
+	/**
+	* The node holding the bytes — the ROUTING key for `fetchEventMedia`.
+	*
+	* `stream-broker` is a singleton cap and an unpinned call never leaves the
+	* hub, so a handle produced on an agent's broker would be redeemed against
+	* the hub's store and come back `null`. Same contract, same field name and
+	* the same reason as `FrameHandleSchema.nodeId`: the producer stamps where it
+	* lives and the consumer pins to it.
+	*/
+	nodeId: zod.z.string(),
+	mime: zod.z.string(),
+	bytes: zod.z.number().int(),
+	width: zod.z.number().int(),
+	height: zod.z.number().int()
+});
+/**
+* What a production actually covered — the answer to the only question an
+* operator asks about a notification clip.
+*
+* `fromTs`/`toTs` are WALL CLOCK, derived from the ring's own packet timeline,
+* so a caller can state "this clip starts 4.1 s before the event" instead of
+* inferring it from a duration. A production whose `fromTs` is later than the
+* event is a production with no pre-roll, and that is exactly the defect this
+* method exists to make visible rather than plausible.
+*/
+var EventMediaCoverageSchema = zod.z.object({
+	fromTs: zod.z.number(),
+	toTs: zod.z.number(),
+	/** Encoded packets in the muxed window. */
+	packets: zod.z.number().int()
+});
+/**
+* The result of ONE cut, in every container the caller asked for.
+*
+* Every artifact in `media` came out of the SAME window of the SAME rendition —
+* that is the whole reason this is one method rather than one call per format.
+* A consumer attaching a gif and a video can no longer show two different
+* moments, because it never chose two sources.
+*/
+var EventMediaProductionSchema = zod.z.object({
+	media: zod.z.array(EventMediaArtifactSchema).readonly(),
+	coverage: EventMediaCoverageSchema,
+	/** The rendition actually cut from — what the default or the fallback chose. */
+	profile: CamProfileSchema,
+	/** `copy` = the camera's own H.264, untouched. `encode` = re-encoded (H.265
+	*  source, a downscale, or a playback rate other than 1). */
+	video: zod.z.enum(["copy", "encode"])
+});
 var RtspRestreamEntrySchema = zod.z.object({
 	brokerId: zod.z.string(),
 	url: zod.z.string(),
@@ -5871,6 +5934,66 @@ var streamBrokerCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* THE production point for event media — one window, every container.
+		*
+		* `renderPreBufferClip` renders ONE format per call, so a consumer wanting a
+		* gif and a video made two calls and got two windows. On 2026-08-08 the
+		* operator received exactly that: a gif around a doorbell press and an mp4
+		* of the six seconds after it. This method cuts once and derives the rest,
+		* so "the attachments agree" is a property of the service instead of a
+		* discipline every consumer has to keep.
+		*
+		* It is also the only place that owns the packets. The broker already
+		* retains an AnnexB ring per camera (`setClipRetention`, D32) — the
+		* prebuffer — so a production reaches BACKWARDS from the event with no
+		* process to spawn and nothing kept warm. It waits out `postSeconds`, muxes
+		* the window once (COPYING the camera's own H.264 whenever nothing is being
+		* changed), derives any gif from that same mux, and returns HANDLES.
+		*
+		* Intended for every future consumer, not just notifications: a clips API, a
+		* retrain export and an event export all want the same window of the same
+		* camera and must not each grow their own renderer.
+		*/
+		produceEventMedia: method(zod.z.object({
+			deviceId: zod.z.number(),
+			/** Absent = the largest H.264 rendition at or below 1080p, which is
+			*  also the one that can be copied. Falls back to whatever the ring
+			*  actually retained, and the answer says which. */
+			profile: CamProfileSchema.optional(),
+			aroundMs: zod.z.number(),
+			preSeconds: zod.z.number().min(0).max(20).default(4),
+			postSeconds: zod.z.number().min(0).max(20).default(6),
+			kinds: zod.z.array(EventMediaKindSchema).min(1).default(["mp4"]),
+			/** GIF geometry. The video keeps the source's own. */
+			gifMaxWidth: zod.z.number().int().min(120).max(1280).default(640),
+			gifFps: zod.z.number().int().min(1).max(15).default(8),
+			/**
+			* Playback rate, applied to EVERY container so they stay one clip.
+			* `1` is real time and is what allows the copy branch.
+			*/
+			speed: zod.z.number().min(1).max(8).default(1)
+		}), EventMediaProductionSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Redeem a {@link EventMediaArtifactSchema} handle for its bytes.
+		*
+		* Separate from the production on purpose (D18): the producing runner keeps
+		* the artifact for a few minutes, and a consumer that only wanted the
+		* coverage never moves a megabyte. `null` once it has expired — a handle is
+		* short-lived by design and a caller that waited too long must see that
+		* rather than a zero-length file.
+		*/
+		fetchEventMedia: method(zod.z.object({ handle: zod.z.string() }), zod.z.object({
+			base64: zod.z.string(),
+			mime: zod.z.string(),
+			bytes: zod.z.number().int()
+		}).nullable(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		listAllCameraStreams: method(zod.z.void(), zod.z.array(CameraStreamSchema).readonly()),
 		listAllProfileSlots: method(zod.z.void(), zod.z.array(ProfileSlotSchema).readonly()),
 		getBrokerStats: method(zod.z.object({ brokerId: zod.z.string() }), BrokerStatsSchema),
@@ -13026,6 +13149,60 @@ var TrackFlagsSchema = zod.z.object({
 	*  `trained` without a re-fetch. */
 	retrainStatus: RetrainStatusSchema
 });
+zod.z.union([zod.z.literal(1), zod.z.literal(2)]);
+/**
+* WHO decided a label, and when. Carried per tier so a value can be traced to
+* the step and model that produced it — which is what makes the write rule
+* arguable after the fact ("why is 592's label `dog` and not `Canis lupus`?")
+* and what lets a migrated, UNATTRIBUTED value be told apart from a real one.
+*
+* `stepId` is the pipeline step id (`animal-classifier`, `bird-classifier`,
+* `plate-ocr`, `face-embedding`, `object-detection`), or the sentinel
+* `migration:4g` for a value the 4g migration moved from the single-slot era —
+* that value has no provenance, and the write rule lets ANY properly-attributed
+* write of the same tier replace it regardless of score.
+*/
+var LabelAttributionSchema = zod.z.object({
+	stepId: zod.z.string(),
+	modelId: zod.z.string().optional(),
+	decidedAt: zod.z.number()
+});
+/**
+* The TIERED label model (roadmap 4g), spread into `TrackSchema` and
+* `ObjectEventSchema` from ONE place so the two surfaces cannot drift — a
+* track and its events always answer the same question the same way.
+*
+* Two scalar columns, not an array: every consumer wants "the coarse one" or
+* "the fine one", and an array made both a scan. `label` is tier 1, `subLabel`
+* is tier 2, and each carries its own score + attribution.
+*
+* **Reading it.** What a human should be shown is `subLabel ?? label` — the
+* finest thing known. Before 4g the single `label` column held the finest
+* value, so a consumer that has not been updated reads the tier-1 slot and
+* shows nothing on a species-only row; that is why the migration puts every
+* pre-4g value in tier 2 (it cannot regress a display that reads the fallback)
+* and why the read surfaces were changed in the same train.
+*
+* **Writing it.** The slots are independent, which is the whole point: a
+* tier-1 write (`bird`) can never overwrite a tier-2 value (`Turdus
+* migratorius`), so fineness cannot regress by construction. Within a tier the
+* higher score wins. One rule, one implementation — see
+* `pipeline/label-tier.ts` in addon-post-analysis.
+*/
+var TieredLabelFields = {
+	/** Tier 1 — the sub-class. See {@link LabelTierSchema}. */
+	label: zod.z.string().optional(),
+	/** Confidence of the tier-1 value, as reported by the deciding step. */
+	labelScore: zod.z.number().optional(),
+	/** Provenance of the tier-1 value. See {@link LabelAttributionSchema}. */
+	labelMeta: LabelAttributionSchema.optional(),
+	/** Tier 2 — the instance. See {@link LabelTierSchema}. */
+	subLabel: zod.z.string().optional(),
+	/** Confidence of the tier-2 value, as reported by the deciding step. */
+	subLabelScore: zod.z.number().optional(),
+	/** Provenance of the tier-2 value. See {@link LabelAttributionSchema}. */
+	subLabelMeta: LabelAttributionSchema.optional()
+};
 /** Per-camera slice of a training-export estimate. */
 var TrainingExportDeviceTotalsSchema = zod.z.object({
 	deviceId: zod.z.number(),
@@ -13050,7 +13227,7 @@ var TrackSchema = zod.z.object({
 	trackId: zod.z.string(),
 	deviceId: zod.z.number(),
 	className: zod.z.string(),
-	label: zod.z.string().optional(),
+	...TieredLabelFields,
 	producingDeviceName: zod.z.string().optional(),
 	/** Track provenance. Absent ⇒ `pipeline` (legacy rows). */
 	source: TrackSourceSchema.optional(),
@@ -13171,7 +13348,7 @@ var ObjectEventSchema = zod.z.object({
 	/** Omitted in slim projection. */
 	trackId: zod.z.string().optional(),
 	className: zod.z.string(),
-	label: zod.z.string().optional(),
+	...TieredLabelFields,
 	/** Omitted in slim projection. */
 	confidence: zod.z.number().optional(),
 	/** Heavy JSON — omitted in slim projection. */
@@ -13252,6 +13429,173 @@ var MediaFileSchema = zod.z.object({
 * stored blob and a `?variant=thumb` rendering without fetching either.
 */
 var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
+/**
+* The MACRO tier of an annotation — a CLOSED set.
+*
+* This is what the exported detector predicts, so a typo here is a new class
+* with one example in it. `label` and `subLabel` are open strings by contrast:
+* the whole point of the page is teaching the model things it does not know
+* yet, and constraining that vocabulary would make it useless.
+*
+* A macro class is NEVER a label. The provider refuses a write whose `label` or
+* `subLabel` is one of these values, in any casing, because once `person`
+* exists in both tiers "every person box" stops being answerable without
+* knowing every string anyone ever typed — and the damage is retroactive.
+*/
+var RetrainMacroClassSchema = zod.z.enum([
+	"person",
+	"vehicle",
+	"animal",
+	"package",
+	"face",
+	"plate"
+]);
+/** A subject to learn, or a phantom to unlearn (taught by OMISSION). */
+var RetrainAnnotationKindSchema = zod.z.enum(["subject", "model_error"]);
+/** Did a human draw this box, or did the assist propose it? */
+var RetrainAnnotationSourceSchema = zod.z.enum(["operator", "assist"]);
+/** Normalised `[0,1]` rectangle against the FULL frame — the canonical form. */
+var RetrainBboxSchema = zod.z.object({
+	x: zod.z.number(),
+	y: zod.z.number(),
+	w: zod.z.number(),
+	h: zod.z.number()
+});
+/**
+* One annotated subject.
+*
+* `bbox` is normalised against the full frame, ALWAYS. The per-model shapes
+* (letterboxed root / zone-cropped package / subject-cropped classifier) are
+* derived from it at export and never stored — storing them is how one feature
+* space ends up holding two crops of the same subject (D52).
+*/
+var RetrainAnnotationSchema = zod.z.object({
+	id: zod.z.string(),
+	trackId: zod.z.string(),
+	deviceId: zod.z.number(),
+	/** The COPY in retrain storage — never the source track's media key. */
+	mediaKey: zod.z.string(),
+	bbox: RetrainBboxSchema,
+	macroClass: RetrainMacroClassSchema,
+	label: zod.z.string().optional(),
+	subLabel: zod.z.string().optional(),
+	kind: RetrainAnnotationKindSchema,
+	source: RetrainAnnotationSourceSchema,
+	/** Which model proposed this box — or, on a `model_error`, drew the phantom. */
+	assistModelId: zod.z.string().optional(),
+	assistScore: zod.z.number().optional(),
+	exportedInBatch: zod.z.string().optional(),
+	createdAt: zod.z.number()
+});
+/** The write form — the server owns `id`, `createdAt` and the frame binding. */
+var RetrainAnnotationDraftSchema = RetrainAnnotationSchema.omit({
+	id: true,
+	trackId: true,
+	deviceId: true,
+	mediaKey: true,
+	createdAt: true,
+	exportedInBatch: true
+});
+/** A track sitting in `staging`, with everything the worklist needs to rank it. */
+var RetrainTrackSchema = zod.z.object({
+	trackId: zod.z.string(),
+	deviceId: zod.z.number(),
+	className: zod.z.string(),
+	label: zod.z.string().optional(),
+	firstSeen: zod.z.number(),
+	lastSeen: zod.z.number(),
+	/** How many frames the dataset already holds from this track. */
+	frameCount: zod.z.number().int(),
+	/** How many subjects have been annotated on those frames. `0` with
+	*  `frameCount: 0` is exactly "staging, still to work". */
+	annotationCount: zod.z.number().int()
+});
+/** A frame the picker may offer — an index row, no blob was read to produce it. */
+var RetrainFrameCandidateSchema = zod.z.object({
+	mediaKey: zod.z.string(),
+	kind: MediaFileKindEnum,
+	timestamp: zod.z.number(),
+	sizeBytes: zod.z.number().int(),
+	/** A copy of this original already exists — selecting it is free and cannot
+	*  fail, whatever became of the original. */
+	copied: zod.z.boolean()
+});
+/** A frame the dataset OWNS: bytes copied at selection time. */
+var RetrainFrameSchema = zod.z.object({
+	frameId: zod.z.string(),
+	deviceId: zod.z.number(),
+	trackId: zod.z.string(),
+	/** Provenance only. It may already point at nothing — that is expected. */
+	sourceMediaKey: zod.z.string(),
+	sourceKind: MediaFileKindEnum,
+	sizeBytes: zod.z.number().int(),
+	width: zod.z.number().int(),
+	height: zod.z.number().int(),
+	copiedAt: zod.z.number()
+});
+/** Why a copy-on-select could not be honoured — named, never a silent skip. */
+var RetrainCopyRefusalSchema = zod.z.enum([
+	"source-missing",
+	"unreadable-image",
+	"write-failed"
+]);
+var RetrainFrameSelectionSchema = zod.z.object({
+	copied: zod.z.array(RetrainFrameSchema).readonly(),
+	refused: zod.z.array(zod.z.object({
+		sourceMediaKey: zod.z.string(),
+		reason: RetrainCopyRefusalSchema
+	})).readonly()
+});
+var RetrainFrameListSchema = zod.z.object({
+	candidates: zod.z.array(RetrainFrameCandidateSchema).readonly(),
+	copies: zod.z.array(RetrainFrameSchema).readonly(),
+	/** What the page pre-selects — the native key frame when one survives. */
+	autoPickMediaKey: zod.z.string().optional()
+});
+/** What the operator asked the assist to look for. */
+var RetrainAssistSubjectSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("package"),
+	zone: RetrainBboxSchema.optional()
+}), zod.z.object({
+	kind: zod.z.literal("objects"),
+	modelId: zod.z.string(),
+	minScore: zod.z.number().optional()
+})]);
+/**
+* The assist's answer — a discriminated union, because "the model saw nothing"
+* and "this node cannot run that model" lead to different next moves and a
+* nullable result cannot tell them apart.
+*/
+var RetrainAssistResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("proposed"),
+	modelId: zod.z.string(),
+	stepId: zod.z.string(),
+	minScore: zod.z.number(),
+	/** Drafts, ready to edit. `source: 'assist'` until the operator touches one. */
+	proposals: zod.z.array(RetrainAnnotationDraftSchema).readonly(),
+	/** Returned by the runner but removed by the threshold. */
+	belowThreshold: zod.z.number().int()
+}), zod.z.object({
+	kind: zod.z.literal("refused"),
+	/** `no-zone` is ours; the rest are the runner's own refusal vocabulary. */
+	reason: zod.z.string(),
+	detail: zod.z.string().optional()
+})]);
+/** The outcome of a lifecycle move owned by the retrain page. */
+var RetrainTransitionResultSchema = zod.z.object({
+	trackId: zod.z.string(),
+	/** Where the track ended up, whatever happened. */
+	retrainStatus: RetrainStatusSchema,
+	/** `false` ⇒ the move was refused or was a no-op; `reason` says which. */
+	changed: zod.z.boolean(),
+	reason: zod.z.enum([
+		"unknown-track",
+		"no-frames-copied",
+		"not-staging",
+		"not-trained",
+		"unchanged"
+	]).optional()
+});
 var DEFAULT_EVENT_QUERY_LIMIT = 1e3;
 var MAX_EVENT_QUERY_LIMIT = 5e3;
 var DeviceEventQueryInput = zod.z.object({
@@ -13306,7 +13650,7 @@ var KeyEventSchema = zod.z.object({
 	/** Track start time (firstSeen). */
 	timestamp: zod.z.number(),
 	className: zod.z.string(),
-	label: zod.z.string().optional(),
+	...TieredLabelFields,
 	importance: zod.z.number(),
 	/** Highest-confidence ObjectEvent id for the track (empty when none). */
 	bestEventId: zod.z.string(),
@@ -13797,6 +14141,201 @@ var pipelineAnalyticsCapability = {
 			kind: "query",
 			auth: "admin"
 		}),
+		/**
+		* The staging worklist for one camera, or for every camera that has one.
+		*
+		* Fetched ON DEMAND, over the staging set only — the page never scans
+		* history, because making the working set small is the entire purpose of
+		* the mark. Each row carries how many frames the dataset already holds from
+		* the track and how many subjects were annotated on them, so
+		* `frameCount: 0` reads as "still to work" without a second call per track.
+		*
+		* `auth: 'admin'`, unlike the viewer-level mark itself: marking a track is
+		* curation you do while looking at it, but building the training set the
+		* fleet's models are fine-tuned on is not.
+		*/
+		listRetrainStaging: method(zod.z.object({
+			/** Empty ⇒ every camera that has staging tracks. A LIST, not a single
+			*  `deviceId`, deliberately: `deviceId` would make this device-bound and
+			*  route it at one camera's owner, and "every camera" would stop being
+			*  expressible at all. */
+			deviceIds: zod.z.array(zod.z.number()).optional(),
+			limit: zod.z.number().int().min(1).max(500).optional()
+		}), zod.z.array(RetrainTrackSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* What a track can contribute, and what it already has.
+		*
+		* `candidates` are the track's whole, unannotated frames — index rows only,
+		* so this is cheap. `copies` are the frames already inside the dataset, and
+		* a candidate whose copy exists is marked `copied: true`: selecting it again
+		* is free and CANNOT fail, whatever became of the original.
+		*
+		* A crop, a thumbnail and `fullFrameBoxed` are never candidates. The last
+		* one matters most: it has the model's own rectangle burned into the pixels,
+		* and a detector trained on it learns to find a green line.
+		*/
+		listRetrainFrames: method(zod.z.object({ trackId: zod.z.string() }), RetrainFrameListSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* COPY-ON-SELECT — the write that makes `trained` safe to evict.
+		*
+		* Selecting a frame copies its bytes into retrain storage immediately: not
+		* a reference, not a lease. Once the copy exists the dataset no longer
+		* depends on the track's media, which is exactly what lets D81 hand a
+		* `trained` track back to retention.
+		*
+		* The order inside is load-bearing and is pinned by a test: an EXISTING
+		* copy is returned without touching the source, so an original that
+		* evaporated blocks the selection of THAT ORIGINAL and never the copy
+		* already taken. Every refusal comes back named — a dropped selection is
+		* never silent, on the wire or in the log.
+		*/
+		selectRetrainFrames: method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			mediaKeys: zod.z.array(zod.z.string()).min(1)
+		}), RetrainFrameSelectionSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Un-select a frame: its annotations go first, then the copy and its blob.
+		*  Deliberately destructive and deliberately explicit — it is the only way
+		*  a frame leaves the dataset before export. */
+		deselectRetrainFrame: method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			frameId: zod.z.string()
+		}), zod.z.object({
+			removed: zod.z.boolean(),
+			removedAnnotations: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* The pixels of ONE copied frame, base64.
+		*
+		* Through the cap rather than a data plane because it is genuinely one
+		* frame at a time, on demand, at human speed — the shape D9/D18 permit
+		* (what they forbid is frames crossing a boundary at frame RATE). The
+		* annotation canvas needs the image and its exact dimensions in the same
+		* answer: a canvas that places a normalised box against a size it guessed
+		* draws every box in the wrong place.
+		*/
+		getRetrainFrameImage: method(zod.z.object({ frameId: zod.z.string() }), zod.z.object({
+			base64: zod.z.string(),
+			width: zod.z.number().int(),
+			height: zod.z.number().int()
+		}), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* Ask the pipeline what it sees, as a PROPOSAL.
+		*
+		* Runs through `pipelineRunner.runStatelessStep` on the COPIED frame, and
+		* every box comes back as a draft with `source: 'assist'` plus the model and
+		* score that produced it. The operator confirms, edits, adds and deletes;
+		* nothing is stored until `saveRetrainAnnotations`.
+		*
+		* For packages the request is `rfdetr-package` on the ZONE CROP at 0.35 —
+		* never the whole frame, where a package detector at that threshold proposes
+		* furniture. A package request with no zone is REFUSED rather than widened,
+		* because the silent widening would look like a bad model for as long as
+		* nobody checked which rectangle it ran on.
+		*/
+		proposeRetrainAnnotations: method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			frameId: zod.z.string(),
+			subject: RetrainAssistSubjectSchema,
+			/** Which node runs it. Absent ⇒ wherever an unowned call lands. */
+			nodeId: zod.z.string().optional()
+		}), RetrainAssistResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Every annotation on a track, oldest first. */
+		listRetrainAnnotations: method(zod.z.object({ trackId: zod.z.string() }), zod.z.array(RetrainAnnotationSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* Replace EVERY annotation on one frame with the supplied set.
+		*
+		* Whole-frame replacement, not per-box upsert: the unit of ground truth is
+		* the frame, and "the operator deleted a box" must be the same durable
+		* outcome as "the operator never drew it". A per-box patch would let a frame
+		* keep a box the operator removed on a surface that only knew about the
+		* boxes it sent.
+		*
+		* Refuses a macro class typed into `label` or `subLabel` — the tiers are
+		* separate and the guard is at the WRITE, because a mixed taxonomy cannot
+		* be un-mixed by reading it.
+		*/
+		saveRetrainAnnotations: method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			frameId: zod.z.string(),
+			annotations: zod.z.array(RetrainAnnotationDraftSchema)
+		}), zod.z.array(RetrainAnnotationSchema).readonly(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Finish with a track: `staging → trained`. **The only writer of that
+		* state** — D81 shipped the column with it deliberately unreachable.
+		*
+		* Refuses a track the dataset holds no copies from. `trained` un-pins the
+		* track's media, so completing without a copy is a delete order for material
+		* nothing ever extracted anything from; that refusal IS the safety argument
+		* of D81, expressed as a precondition.
+		*/
+		completeRetrainTrack: method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string()
+		}), RetrainTransitionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* The deliberate return: `trained → staging`, for the rare case.
+		*
+		* The generic `setTrackFlags` toggle refuses this in both directions by
+		* design (D81) — re-staging from a checkbox is how the same material gets
+		* annotated twice under two ground truths. Doing it here means the operator
+		* is looking at the annotations that already exist while they decide, and
+		* those annotations are LEFT ALONE: "put this back" must not be a
+		* destructive act wearing a navigational name.
+		*/
+		restageRetrainTrack: method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string()
+		}), RetrainTransitionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Where to download the ANNOTATED dataset.
+		*
+		* The sibling of `getTrainingExportUrl` and deliberately not the same
+		* archive: that one streams a marked track's stored media verbatim, this one
+		* streams the retrain COPIES plus an `annotations.json` carrying, for every
+		* subject, the canonical full-frame box AND the geometry derived for each
+		* model shape (letterboxed root / zone-cropped package / subject-cropped
+		* classifier). Derived at export, never stored — one box in, three shapes
+		* out, so two crops of the same subject can never end up in one feature
+		* space (D52).
+		*/
+		getRetrainExportUrl: method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), zod.z.object({ url: zod.z.string() }), {
+			kind: "query",
+			auth: "admin"
+		}),
 		getEventMedia: method(zod.z.object({
 			eventId: zod.z.string(),
 			kind: MediaFileKindEnum.optional()
@@ -14614,6 +15153,22 @@ var DetailResultSchema = zod.z.object({
 	bbox: NativeCropBboxSchema.optional(),
 	embedding: zod.z.string().optional(),
 	label: zod.z.string().optional(),
+	/**
+	* The tier `label` occupies, copied VERBATIM from the producing step's
+	* `StepDefinition.labelTier` (roadmap 4g). Present only when `label` is.
+	*
+	* It rides the wire rather than being resolved by the consumer because the
+	* declaration lives with the step definition, which only the executing node
+	* has: post-analysis holds no step registry, and re-deriving the tier from
+	* `className` there would be exactly the inference this model exists to
+	* forbid. A `label` that arrives WITHOUT this field is refused by the write
+	* rule and logged (`label tier undeclared`) — an older runner therefore
+	* stops enriching rather than guessing, which is why addon-pipeline is
+	* deployed BEFORE addon-post-analysis.
+	*/
+	labelTier: zod.z.union([zod.z.literal(1), zod.z.literal(2)]).optional(),
+	/** Model that produced `label` — carried into the tier's attribution. */
+	labelModelId: zod.z.string().optional(),
 	alignedCropJpeg: zod.z.string().optional(),
 	/** Face short side (px) measured on the NATIVE crop surface. The `bbox`
 	*  above is detection-frame px (≈6× smaller on a 4K camera) — min-face-size
@@ -29171,6 +29726,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.completeRetrainTrack": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29183,6 +29744,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.deselectRetrainFrame": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.getActiveTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29243,6 +29810,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getRetrainExportUrl": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.getRetrainFrameImage": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getSensorEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29297,6 +29876,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRetrainAnnotations": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainFrames": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainStaging": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listTrackMedia": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29309,6 +29906,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.proposeRetrainAnnotations": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.pruneEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29339,12 +29942,30 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.restageRetrainTrack": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"pipelineAnalytics.saveRetrainAnnotations": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.searchObjectEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.selectRetrainFrames": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -30737,6 +31358,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.fetchEventMedia": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.getAllRtspEntries": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -30821,6 +31448,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.produceEventMedia": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.publishCameraStream": {
 		capName: "stream-broker",
 		capScope: "system",