@camstack/system 1.2.90 → 1.2.91

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CYqL8oZq.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_module = require("node:module");
@@ -1144,10 +1144,21 @@ var SqliteSettingsBackend = class SqliteSettingsBackend {
 			}
 		}
 		this.getDb().exec(`CREATE TABLE IF NOT EXISTS "${table}" (${colDefs.join(", ")})`);
-		if (schema.indexes) for (const idx of schema.indexes) {
-			const unique = idx.unique ? "UNIQUE " : "";
-			const cols = idx.columns.map((c) => `"${c}"`).join(", ");
-			this.getDb().exec(`CREATE ${unique}INDEX IF NOT EXISTS "${idx.name}" ON "${table}" (${cols})`);
+		if (schema.indexes) {
+			const pkName = schema.columns.find((c) => c.primaryKey === true)?.name ?? "id";
+			const nonPkColumns = schema.columns.filter((c) => c.name !== pkName).map((c) => c.name);
+			const kvBlobColumn = nonPkColumns.length === 1 && nonPkColumns[0] === "data" ? "data" : null;
+			const isRealColumn = (field) => field === pkName || nonPkColumns.includes(field);
+			const indexExpr = (field) => {
+				if (isRealColumn(field)) return `"${field}"`;
+				return kvBlobColumn === null ? null : `json_extract("${kvBlobColumn}", '$.${field}')`;
+			};
+			for (const idx of schema.indexes) {
+				const exprs = idx.columns.map((c) => indexExpr(c));
+				if (exprs.some((e) => e === null)) continue;
+				const unique = idx.unique ? "UNIQUE " : "";
+				this.getDb().exec(`CREATE ${unique}INDEX IF NOT EXISTS "${idx.name}" ON "${table}" (${exprs.join(", ")})`);
+			}
 		}
 		this.structuredTables.set(table, fingerprint);
 	}

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,4 +1,4 @@
-import { A as decodeVectorBase64, Dt as asJsonObject, Rt as parseJsonUnknown, _t as BaseAddon, f as RUNTIME_DEFAULTS, gt as errMsg, ht as vectorStoreCapability, k as dataStoreProviderCapability, mt as vectorDimFromBase64, w as bareAddonId } from "../../dist-DMhxx5Kr.mjs";
+import { A as decodeVectorBase64, Dt as asJsonObject, Rt as parseJsonUnknown, _t as BaseAddon, f as RUNTIME_DEFAULTS, gt as errMsg, ht as vectorStoreCapability, k as dataStoreProviderCapability, mt as vectorDimFromBase64, w as bareAddonId } from "../../dist-DhrTd8LL.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { statSync } from "node:fs";
@@ -1138,10 +1138,21 @@ var SqliteSettingsBackend = class SqliteSettingsBackend {
 			}
 		}
 		this.getDb().exec(`CREATE TABLE IF NOT EXISTS "${table}" (${colDefs.join(", ")})`);
-		if (schema.indexes) for (const idx of schema.indexes) {
-			const unique = idx.unique ? "UNIQUE " : "";
-			const cols = idx.columns.map((c) => `"${c}"`).join(", ");
-			this.getDb().exec(`CREATE ${unique}INDEX IF NOT EXISTS "${idx.name}" ON "${table}" (${cols})`);
+		if (schema.indexes) {
+			const pkName = schema.columns.find((c) => c.primaryKey === true)?.name ?? "id";
+			const nonPkColumns = schema.columns.filter((c) => c.name !== pkName).map((c) => c.name);
+			const kvBlobColumn = nonPkColumns.length === 1 && nonPkColumns[0] === "data" ? "data" : null;
+			const isRealColumn = (field) => field === pkName || nonPkColumns.includes(field);
+			const indexExpr = (field) => {
+				if (isRealColumn(field)) return `"${field}"`;
+				return kvBlobColumn === null ? null : `json_extract("${kvBlobColumn}", '$.${field}')`;
+			};
+			for (const idx of schema.indexes) {
+				const exprs = idx.columns.map((c) => indexExpr(c));
+				if (exprs.some((e) => e === null)) continue;
+				const unique = idx.unique ? "UNIQUE " : "";
+				this.getDb().exec(`CREATE ${unique}INDEX IF NOT EXISTS "${idx.name}" ON "${table}" (${exprs.join(", ")})`);
+			}
 		}
 		this.structuredTables.set(table, fingerprint);
 	}

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,13 +3,18 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CYqL8oZq.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
 //#region src/builtins/storage-orchestrator/location-store.ts
+/**
+* @durable class=config owner=storage-orchestrator
+*   write="an operator creates or edits a location (basePath, minFreePercent, enabled, node pin); plus the boot reconcile — declared defaults seeded on a fresh install, and in-memory-only locations backfilled when the store is late-wired"
+*   retention="none — a row goes only when the operator deletes the location, or when the declaration pass prunes one whose declaring addon is gone. Bounded by the storage targets a human configures."
+*/
 var STORAGE_LOCATIONS = "storage_locations";
 /**
 * Reserved key under which the cluster `nodeId` (SP1) is persisted INSIDE
@@ -799,11 +804,23 @@ var StorageOrchestratorService = class {
 	*   2. backfill — in-memory locations the DB doesn't have yet (the
 	*      pre-store seed defaults on a fresh install) are persisted, so the
 	*      store becomes the durable source of truth from here on.
+	*
+	* **The re-entry guard latches on a SUCCESSFUL hydrate, not on the attempt** —
+	* `loadAll()` is awaited BEFORE `this.locationStore` is assigned, and the
+	* order is load-bearing. Latching first meant one transient read error
+	* answered `hasStore()` true forever, so the addon's `ensureStoreWired` gate
+	* skipped every retry; the service then ran the whole process lifetime on
+	* pre-store seed defaults while `upsert` mirrored them onto rows it had never
+	* read, silently replacing the operator's persisted `minFreePercent`. Failing
+	* back to store-less is the safe direction: an in-memory-only service writes
+	* nothing over what is on disk, and the next `capability:provider-registered`
+	* event tries again. Held by
+	* `__tests__/storage-orchestrator-persistence.spec.ts`.
 	*/
 	async attachStore(store) {
 		if (this.locationStore) return;
-		this.locationStore = store;
 		const rows = await store.loadAll();
+		this.locationStore = store;
 		const dbIds = new Set(rows.map((r) => r.id));
 		for (const loc of rows) {
 			const upgraded = !loc.isSystem && loc.id === `${loc.type}:default` ? {

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,8 +1,13 @@
-import { Lt as parseJsonObject, _t as BaseAddon, g as StorageMigrationJobSchema, h as StorageLocationTypeSchema, lt as storageCapability, st as settingsStoreCapability, ut as storageMigrationCapability } from "../../dist-DMhxx5Kr.mjs";
+import { Lt as parseJsonObject, _t as BaseAddon, g as StorageMigrationJobSchema, h as StorageLocationTypeSchema, lt as storageCapability, st as settingsStoreCapability, ut as storageMigrationCapability } from "../../dist-DhrTd8LL.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";
 //#region src/builtins/storage-orchestrator/location-store.ts
+/**
+* @durable class=config owner=storage-orchestrator
+*   write="an operator creates or edits a location (basePath, minFreePercent, enabled, node pin); plus the boot reconcile — declared defaults seeded on a fresh install, and in-memory-only locations backfilled when the store is late-wired"
+*   retention="none — a row goes only when the operator deletes the location, or when the declaration pass prunes one whose declaring addon is gone. Bounded by the storage targets a human configures."
+*/
 var STORAGE_LOCATIONS = "storage_locations";
 /**
 * Reserved key under which the cluster `nodeId` (SP1) is persisted INSIDE
@@ -792,11 +797,23 @@ var StorageOrchestratorService = class {
 	*   2. backfill — in-memory locations the DB doesn't have yet (the
 	*      pre-store seed defaults on a fresh install) are persisted, so the
 	*      store becomes the durable source of truth from here on.
+	*
+	* **The re-entry guard latches on a SUCCESSFUL hydrate, not on the attempt** —
+	* `loadAll()` is awaited BEFORE `this.locationStore` is assigned, and the
+	* order is load-bearing. Latching first meant one transient read error
+	* answered `hasStore()` true forever, so the addon's `ensureStoreWired` gate
+	* skipped every retry; the service then ran the whole process lifetime on
+	* pre-store seed defaults while `upsert` mirrored them onto rows it had never
+	* read, silently replacing the operator's persisted `minFreePercent`. Failing
+	* back to store-less is the safe direction: an in-memory-only service writes
+	* nothing over what is on disk, and the next `capability:provider-registered`
+	* event tries again. Held by
+	* `__tests__/storage-orchestrator-persistence.spec.ts`.
 	*/
 	async attachStore(store) {
 		if (this.locationStore) return;
-		this.locationStore = store;
 		const rows = await store.loadAll();
+		this.locationStore = store;
 		const dbIds = new Set(rows.map((r) => r.id));
 		for (const loc of rows) {
 			const upgraded = !loc.isSystem && loc.id === `${loc.type}:default` ? {

package/dist/builtins/storage-orchestrator/storage-orchestrator.service.d.ts

@@ -139,6 +139,18 @@ export declare class StorageOrchestratorService {
      *   2. backfill — in-memory locations the DB doesn't have yet (the
      *      pre-store seed defaults on a fresh install) are persisted, so the
      *      store becomes the durable source of truth from here on.
+     *
+     * **The re-entry guard latches on a SUCCESSFUL hydrate, not on the attempt** —
+     * `loadAll()` is awaited BEFORE `this.locationStore` is assigned, and the
+     * order is load-bearing. Latching first meant one transient read error
+     * answered `hasStore()` true forever, so the addon's `ensureStoreWired` gate
+     * skipped every retry; the service then ran the whole process lifetime on
+     * pre-store seed defaults while `upsert` mirrored them onto rows it had never
+     * read, silently replacing the operator's persisted `minFreePercent`. Failing
+     * back to store-less is the safe direction: an in-memory-only service writes
+     * nothing over what is on disk, and the next `capability:provider-registered`
+     * event tries again. Held by
+     * `__tests__/storage-orchestrator-persistence.spec.ts`.
      */
     attachStore(store: ILocationStore): Promise<void>;
     /**

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CYqL8oZq.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { Pt as hydrateSchema, _t as BaseAddon, gt as errMsg } from "../../dist-DMhxx5Kr.mjs";
+import { Pt as hydrateSchema, _t as BaseAddon, gt as errMsg } from "../../dist-DhrTd8LL.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CYqL8oZq.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { J as logDestinationCapability, _t as BaseAddon } from "../../dist-DMhxx5Kr.mjs";
+import { J as logDestinationCapability, _t as BaseAddon } from "../../dist-DhrTd8LL.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-CYqL8oZq.js → dist-9Gfk4KOk.js}

@@ -728,12 +728,6 @@ var WELL_KNOWN_TAB_MAP = Object.fromEntries([
 		icon: "shapes",
 		order: 38
 	},
-	{
-		id: "scenes",
-		label: "Scenes",
-		icon: "scan-eye",
-		order: 36
-	},
 	{
 		id: "analytics",
 		label: "Analytics",
@@ -10105,6 +10099,17 @@ var LlmImageSchema = zod.z.object({
 	bytes: zod.z.instanceof(Uint8Array),
 	mimeType: zod.z.string()
 });
+/**
+* Retry policy. `enabled: false` is NOT the same as `maxAttempts: 1` in intent —
+* the flag is what a consumer table flips, the count is what the operator tunes.
+* A retry doubles the wall time of a call, so the two gates that run inside a
+* notification's budget keep it off (see `CONSUMER_RETRY_POLICY` in addon-ai).
+*/
+var LlmRetryPolicySchema = zod.z.object({
+	enabled: zod.z.boolean().default(false),
+	/** Total attempts INCLUDING the first. 1 = no retry. */
+	maxAttempts: zod.z.number().int().min(1).max(5).default(1)
+});
 var LlmGenerateBaseInputSchema = zod.z.object({
 	/** Collection routing (the notification-output posture). */
 	addonId: zod.z.string().optional(),
@@ -10119,7 +10124,28 @@ var LlmGenerateBaseInputSchema = zod.z.object({
 	jsonSchema: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
 	/** Per-call override of the profile default. */
 	maxTokens: zod.z.number().int().positive().optional(),
-	temperature: zod.z.number().optional()
+	temperature: zod.z.number().optional(),
+	/** Per-call override of the profile default (nucleus sampling). */
+	topP: zod.z.number().min(0).max(1).optional(),
+	/** Per-call override of the profile default (top-k sampling). */
+	topK: zod.z.number().int().positive().optional(),
+	/** Per-call override of `profile.timeoutMs` — the total generation bound. */
+	timeoutMs: zod.z.number().int().positive().optional(),
+	/** Per-call override; beats both the consumer table and the profile. */
+	retry: LlmRetryPolicySchema.optional(),
+	/**
+	* Caller-minted id that makes this generation CANCELLABLE.
+	*
+	* Without it a caller that stops waiting cannot stop the work: the gates race
+	* the call against 8 s and free their own slot when the timer wins, while the
+	* generation upstream keeps running to `profile.timeoutMs` — 60 s by default,
+	* on a single-threaded local model. The per-camera bound then counts WAITS,
+	* not generations, and the real load is unbounded.
+	*
+	* `AbortSignal` cannot cross a process boundary; an id can. Pass one here and
+	* `llm.cancel({ requestId })` tears the socket down.
+	*/
+	requestId: zod.z.string().optional()
 });
 /**
 * `llm-runtime` — node-side managed llama.cpp executor (spec §4). Registered
@@ -10158,8 +10184,49 @@ var ManagedRuntimeConfigSchema = zod.z.object({
 	gpuLayers: zod.z.number().int().default(0),
 	/** Default: cpus-2, clamped ≥1 (resolved node-side). */
 	threads: zod.z.number().int().optional(),
-	/** Concurrent slots. */
+	/** Concurrent slots (`--parallel`). */
 	parallel: zod.z.number().int().default(1),
+	/** Logical batch size (`-b`). Larger = faster prompt ingest, more RAM. */
+	batchSize: zod.z.number().int().positive().optional(),
+	/** Physical batch / micro-batch (`-ub`). */
+	ubatchSize: zod.z.number().int().positive().optional(),
+	/**
+	* `--flash-attn`. Cuts KV-cache memory on the backends that implement it and
+	* is a no-op elsewhere, so it is offered rather than assumed.
+	*/
+	flashAttention: zod.z.boolean().default(false),
+	/**
+	* `--mlock`. Pins the weights in RAM so the OS cannot page them out mid
+	* inference. Costs the full model size in resident memory — which is exactly
+	* what the RAM budget is counting.
+	*/
+	mlock: zod.z.boolean().default(false),
+	/**
+	* `--no-mmap`. Reads the whole GGUF up front instead of mapping it. Slower to
+	* start, but avoids the page-fault stalls a network or spinning-disk model
+	* store produces on every first token.
+	*/
+	noMmap: zod.z.boolean().default(false),
+	/** `--cache-type-k` / `--cache-type-v` — quantising the KV cache is the
+	*  cheapest way to fit a longer context in the same RAM. */
+	cacheTypeK: zod.z.enum([
+		"f32",
+		"f16",
+		"q8_0",
+		"q5_1",
+		"q5_0",
+		"q4_1",
+		"q4_0"
+	]).optional(),
+	cacheTypeV: zod.z.enum([
+		"f32",
+		"f16",
+		"q8_0",
+		"q5_1",
+		"q5_0",
+		"q4_1",
+		"q4_0"
+	]).optional(),
 	/** Else lazy: first generate boots it. */
 	autoStart: zod.z.boolean().default(false),
 	/** 0 = never; frees RAM after quiet periods. */
@@ -10262,10 +10329,44 @@ var LlmProfileSchema = zod.z.object({
 	baseUrl: zod.z.string().optional(),
 	/** ConfigUISchema type:'password' — never round-trips (spec §5). */
 	apiKey: zod.z.string().optional(),
+	/** Vision on/off. A vision call against a `false` profile is REFUSED, never
+	*  degraded to text — that shipped once and produced a confident answer to a
+	*  question about a picture nobody sent. */
 	supportsVision: zod.z.boolean(),
 	temperature: zod.z.number().min(0).max(2).optional(),
+	/** Nucleus sampling. Every wire we speak has it. */
+	topP: zod.z.number().min(0).max(1).optional(),
+	/** Top-k sampling. Carried only by the wires that have it — NEITHER OpenAI
+	*  wire does, and the client drops it there (measured: the request body gets
+	*  `top_p` and no `top_k`). The profile editor hides the field wherever it
+	*  would change nothing; `KINDS_WITH_TOP_K` is the single owner of that list. */
+	topK: zod.z.number().int().positive().optional(),
 	maxTokens: zod.z.number().int().positive().optional(),
+	/** Prompt context window. Advisory for cloud kinds (they enforce their own);
+	*  for `managed-local` it is the llama.cpp `--ctx-size` the runtime starts
+	*  the model with, so it is the one field that changes a PROCESS. */
+	contextLength: zod.z.number().int().positive().optional(),
+	/** Default system prompt. A caller's `system` REPLACES it (never appends —
+	*  two system prompts fighting is worse than either alone). */
+	systemPrompt: zod.z.string().optional(),
+	/** Total generation bound — the only one a unary call has. */
 	timeoutMs: zod.z.number().int().positive().default(6e4),
+	/** Wait for response headers only. */
+	connectTimeoutMs: zod.z.number().int().positive().default(1e4),
+	/** Accepted, but no output yet — a cold GPU load lives here. */
+	firstTokenTimeoutMs: zod.z.number().int().positive().default(12e4),
+	/** Output started then stopped. */
+	idleTimeoutMs: zod.z.number().int().positive().default(6e4),
+	/** Profile-level default. The per-consumer table and a per-call override
+	*  both beat it — see `resolveRetryPolicy`. */
+	retry: LlmRetryPolicySchema.default({
+		enabled: false,
+		maxAttempts: 1
+	}),
+	/** Whether this profile may use tools. The tool-call plumbing rides the
+	*  library; the REGISTRY of callable tools is ours and is empty in v1, so a
+	*  `true` here buys the wiring, not behaviour, until tools are registered. */
+	toolsEnabled: zod.z.boolean().default(false),
 	extraHeaders: zod.z.record(zod.z.string(), zod.z.string()).optional(),
 	/** kind === 'managed-local' only (spec §4). */
 	runtime: ManagedRuntimeConfigSchema.optional()
@@ -10338,6 +10439,17 @@ var llmCapability = {
 	methods: {
 		generate: method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }),
 		generateVision: method(GenerateVisionInputSchema, LlmGenerateResultSchema, { kind: "mutation" }),
+		/**
+		* Stop a generation started with a `requestId`.
+		*
+		* Idempotent and always successful: cancelling an id that already finished,
+		* never existed, or was cancelled a moment ago is a no-op. A caller that has
+		* given up must never have to handle an error from giving up.
+		*/
+		cancel: method(zod.z.object({
+			addonId: zod.z.string().optional(),
+			requestId: zod.z.string()
+		}), zod.z.void(), { kind: "mutation" }),
 		listProfileKinds: method(zod.z.object({}), zod.z.array(LlmProfileKindDescriptorSchema)),
 		listProfiles: method(zod.z.object({}), zod.z.array(LlmProfileSchema)),
 		upsertProfile: method(zod.z.object({ profile: LlmProfileSchema }), LlmProfileSchema, {
@@ -12312,28 +12424,36 @@ var NcOccupancyConditionSchema = zod.z.object({
 /**
 * Audio condition (IMMEDIATE trigger) — a rule on SOUND, not on a picture.
 *
-* Operator-approved vocabulary (2026-08-12, option A — the same one the
-* reference notifier uses, so an operator moving between them re-uses what
-* they already know): a rule matches when, over a sampling window of
-* `samplingSeconds`, at least `hitPercent`% of the audio samples in that
-* window are HITS. A sample is a hit when it satisfies BOTH present filters:
-*
-*  - `dbThreshold` — its level is at or above this many dBFS (see
-*    {@link NC_AUDIO_DBFS_FLOOR}: negative-going, `0` = full scale);
-*  - `labels` — the classifier put at least one of these labels on it.
-*
-* Both are OPTIONAL and independent, which is the point of the shape: a
-* loudness rule ("something loud at 3am") needs no model to be right, and a
-* label rule ("a dog barked") needs no threshold. **Fail-closed when NEITHER
-* is given** — a window in which every sample is trivially a hit would fire on
-* silence, so the engine refuses such a condition rather than notifying on
-* nothing (the schema cannot express "at least one of" without becoming a
-* ZodEffects the cap path would have to special-case).
-*
-* `hitPercent` is over the samples the window actually HOLDS, and the window
-* must be FULL before it can match — a window that has been open for two
-* seconds of its ten is 100% of nothing, and firing on it would make
-* `samplingSeconds` decorative.
+* **TWO EXCLUSIVE MODES** (operator decision 2026-08-14, D157). Which one a
+* rule is in is not a stored field — it is WHICH FILTER the rule carries, so
+* there is no second switch that can disagree with the first and every rule
+* authored before the decision migrates for free (`audioModeOf`):
+*
+*  - **LABEL mode — `labels` present.** The rule fires on the FIRST frame the
+*    classifier labels with one of them. No window, no percentage:
+*    `hitPercent` and `samplingSeconds` are ignored, and the rule's own
+*    `throttle` cooldown is the only brake. The per-label confidence floor is
+*    the analyzer's (`classificationMinScore`, per device) — a label only
+*    reaches this condition if the classifier was already confident enough.
+*  - **LEVEL mode — `dbThreshold` present, no labels.** The sampling window IS
+*    the condition: at least `hitPercent`% of the samples over
+*    `samplingSeconds` must be at or above `dbThreshold` dBFS (see
+*    {@link NC_AUDIO_DBFS_FLOOR}: negative-going, `0` = full scale). The window
+*    must be FULL before it can match — a window open for two of its ten
+*    seconds is 100% of nothing.
+*
+* **Why label mode has no window.** It had one, and it never fired: the
+* analyzer emits ~1 audio frame per second but YAMNet only LABELS one to three
+* of them per episode, even through continuous crying. The measured maximum
+* `hitPercent` over the whole live history was 40 — under the shipped default
+* of 60, so a label rule could not fire at all, ever. A percentage of frames is
+* the wrong question to ask of a sparse classifier.
+*
+* **Fail-closed when NEITHER is given** — every sample would be a trivial hit
+* and the rule would fire on silence. The schema cannot express "exactly one
+* of" without becoming a ZodEffects the cap path would have to special-case, so
+* the exclusivity is enforced where every editor writes (`patchAudio`) and a
+* legacy rule carrying both resolves to LABEL (the mode that fires).
 *
 * Labels are the audio macro classes (`AUDIO_MACRO_LABELS` / the NC taxonomy's
 * `audio-*` ids). Both spellings are accepted — the matcher normalizes the
@@ -12341,13 +12461,13 @@ var NcOccupancyConditionSchema = zod.z.object({
 * an operator who typed `dog` mean the same thing.
 */
 var NcAudioConditionSchema = zod.z.object({
-	/** Audio macro labels; absent = any sound (level-only rule). */
+	/** LABEL MODE: audio macro labels. Present ⇒ fires on the first labelled frame. */
 	labels: zod.z.array(zod.z.string().min(1)).min(1).optional(),
-	/** Level floor in dBFS (negative-going, `0` = full scale); absent = any level. */
+	/** LEVEL MODE: floor in dBFS (negative-going, `0` = full scale). */
 	dbThreshold: zod.z.number().min(-96).max(0).optional(),
-	/** Percentage of the window's samples that must be hits (1–100). */
+	/** LEVEL MODE ONLY: percentage of the window's samples that must be hits (1–100). */
 	hitPercent: zod.z.number().int().min(1).max(100).default(60),
-	/** Length of the sampling window in seconds. */
+	/** LEVEL MODE ONLY: length of the sampling window in seconds. */
 	samplingSeconds: zod.z.number().int().min(1).max(300).default(10)
 });
 /**
@@ -26642,10 +26762,22 @@ var recordingExportCapability = {
 * thing except the comparator: `similarity` (CLIP cosine at the same ROI coords
 * vs condition-tagged references) and `llm` (vision-LLM judgment over the crop).
 *
-* D14 device-config archetype (`deviceConfig.ui.kind:'widget'`) — the framework
-* derives the device-detail contribution; the provider carries NO hand-written
-* settings-contribution methods. `status.kind:'push'` — the engine pushes on
-* every hysteresis flip / availability change; consumers never poll.
+* **No `deviceConfig`, deliberately.** This shipped as the D14 widget archetype,
+* which put a "Scenes" tab on one camera's detail page. That is the wrong shape
+* for the thing: a scene is a standing question about the property ("is the bin
+* still out"), and the operator's question is "which of my scenes have tripped",
+* across every camera at once — not "what does camera 617 think". Buried one
+* camera deep it also could not be found. The surface is now a top-level admin
+* page (`/scenes`, `pages/Scenes.tsx`) that lists every scene on every camera and
+* picks the camera inside the create flow, the same shape Events and Faces have.
+*
+* The consequence to keep in mind: `host/scene-monitor-editor` is gone from
+* `HOST_WIDGETS` too. `scripts/check-host-widget-resolves.ts` asserts BOTH
+* directions, so a registration nobody declares fails exactly as loudly as a
+* declaration nobody registers. The editor is imported directly by the page.
+*
+* `status.kind:'push'` — the engine pushes on every hysteresis flip /
+* availability change; consumers never poll.
 */
 /** Extensible condition tag. Seeded 'day' | 'ir' (the two variants the operator
 *  captures) plus 'night' | 'dawn' | 'dusk' from the resolver's sun-times band.
@@ -26794,12 +26926,6 @@ var sceneMonitorCapability = {
 	kind: "wrapper",
 	defaultActive: true,
 	deviceTypes: [DeviceType.Camera],
-	deviceConfig: { ui: {
-		kind: "widget",
-		widgetId: "host/scene-monitor-editor",
-		tab: "scenes",
-		label: "Scenes"
-	} },
 	methods: {
 		listScenes: method(zod.z.object({ deviceId: zod.z.number() }), SceneMonitorStatusSchema),
 		createScene: method(zod.z.object({
@@ -27658,6 +27784,61 @@ var NetworkAddressSchema = zod.z.object({
 	family: zod.z.string(),
 	internal: zod.z.boolean()
 });
+/**
+* Provenance of the site coordinates, and the whole reason this is not just two
+* numbers.
+*
+*   - `operator-set` — a human typed it, or accepted a detection. Authoritative;
+*     nothing overwrites it.
+*   - `derived-from-ip` — the hub geolocated its own public IP once, because a
+*     default that is right to a few kilometres beats the coarse UTC clock split
+*     the sun-times consumers otherwise fall back to.
+*
+* The UI shows which one it is. An operator who cannot tell a guess from their
+* own input will eventually trust the guess.
+*/
+var SiteLocationSourceSchema = zod.z.enum(["operator-set", "derived-from-ip"]);
+/**
+* Where the installation physically is — a fact of the SITE, not of any addon.
+*
+* It used to live in `pipeline-analytics`' global settings, which made a
+* property of the building a property of one analytics addon. Anything that
+* needs sun-times (scene condition variants today; anything solar tomorrow)
+* reads it from here.
+*/
+var SiteLocationSchema = zod.z.object({
+	/** WGS84 decimal degrees. */
+	latitude: zod.z.number().min(-90).max(90),
+	longitude: zod.z.number().min(-180).max(180),
+	source: SiteLocationSourceSchema,
+	/** Epoch ms the value was last written. */
+	updatedAt: zod.z.number(),
+	/**
+	* Human-readable place the geo-IP service reported ("Napoli, IT"). Display
+	* only — never parsed, never matched on. Absent for an operator-typed value.
+	*/
+	label: zod.z.string().optional()
+});
+/**
+* The read shape: the location plus the honest state of the one-shot derivation.
+*
+* `derivationAttemptedAt` is what makes the "one call, ever" contract
+* inspectable. When it is set and `location` is null, the geo-IP lookup ran and
+* failed; the hub will NOT try again on its own — the fallback is declared
+* (consumers degrade to their own last resort) and the operator either types the
+* coordinates or presses detect.
+*/
+var SiteLocationStatusSchema = zod.z.object({
+	location: SiteLocationSchema.nullable(),
+	derivationAttemptedAt: zod.z.number().nullable(),
+	/** Why the last derivation failed, for the UI to show instead of a shrug. */
+	derivationError: zod.z.string().nullable()
+});
+/** `null` clears the location and re-arms nothing — the derivation stays spent. */
+var SetSiteLocationInputSchema = zod.z.object({
+	latitude: zod.z.number().min(-90).max(90),
+	longitude: zod.z.number().min(-180).max(180)
+}).nullable();
 var systemCapability = {
 	name: "system",
 	scope: "system",
@@ -27675,6 +27856,32 @@ var systemCapability = {
 		forceRetentionCleanup: method(zod.z.void(), zod.z.void(), {
 			kind: "mutation",
 			auth: "admin"
+		}),
+		/**
+		* The site coordinates, deriving a default from the hub's public IP on the
+		* FIRST read that finds nothing stored.
+		*
+		* The derivation is one-shot and bounded: one outbound request, a few
+		* seconds, its outcome persisted either way. A hub with no internet pays it
+		* once and never again, and neither boot nor any consumer is blocked on it —
+		* the caller gets `location: null` and degrades exactly as it did before this
+		* method existed.
+		*/
+		getSiteLocation: method(zod.z.void(), SiteLocationStatusSchema),
+		/** Operator input. Always lands as `source: 'operator-set'`. */
+		setSiteLocation: method(SetSiteLocationInputSchema, SiteLocationStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Re-run the geo-IP derivation now. The ONLY way a spent or failed
+		* derivation is retried — there is no timer, and no read path retries.
+		* Overwrites an existing `derived-from-ip` value; refuses to clobber an
+		* `operator-set` one.
+		*/
+		detectSiteLocation: method(zod.z.void(), SiteLocationStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
 		})
 	},
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
@@ -31410,6 +31617,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"llm.cancel": {
+		capName: "llm",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llm.deleteModel": {
 		capName: "llm",
 		capScope: "system",
@@ -34344,6 +34557,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.detectSiteLocation": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"system.featureFlags": {
 		capName: "system",
 		capScope: "system",
@@ -34362,6 +34581,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"system.getSiteLocation": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"system.health": {
 		capName: "system",
 		capScope: "system",
@@ -34386,6 +34611,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.setSiteLocation": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.adoptLegacyMonitor": {
 		capName: "terminal-session",
 		capScope: "system",