@camstack/system 1.2.91 → 1.2.93

package/dist/{dist-DhrTd8LL.mjs → dist-F1XDQDE1.mjs}

@@ -10158,6 +10158,18 @@ var LlmGenerateBaseInputSchema = z.object({
 * Resource ceiling = llama-server flags + idleStopMinutes ONLY (no RSS
 * watchdog — operator decision #3).
 */
+/**
+* A companion artifact that MUST land beside the main GGUF: the `mmproj`
+* projector of a vision model, or shards 2..N of a split GGUF. Carried on the
+* REF rather than looked up at install time, so what the operator approved in
+* the preview is exactly what the node downloads.
+*/
+var ManagedModelExtraFileSchema = z.object({
+	url: z.string(),
+	filename: z.string(),
+	sizeBytes: z.number(),
+	sha256: z.string().optional()
+});
 var ManagedModelRefSchema = z.discriminatedUnion("kind", [
 	z.object({
 		kind: z.literal("catalog"),
@@ -10166,7 +10178,11 @@ var ManagedModelRefSchema = z.discriminatedUnion("kind", [
 	z.object({
 		kind: z.literal("url"),
 		url: z.string(),
-		sha256: z.string().optional()
+		sha256: z.string().optional(),
+		/** Picker/status label; the file basename when absent. */
+		label: z.string().optional(),
+		sizeBytes: z.number().optional(),
+		extraFiles: z.array(ManagedModelExtraFileSchema).optional()
 	}),
 	z.object({
 		kind: z.literal("path"),
@@ -10227,11 +10243,39 @@ var ManagedRuntimeConfigSchema = z.object({
 		"q4_1",
 		"q4_0"
 	]).optional(),
+	/**
+	* Escape hatch for llama-server flags this schema does NOT model — `--jinja`
+	* (which most vision chat templates need and some language-only models
+	* dislike), `--cont-batching`, `--rope-scaling`, …
+	*
+	* It is NOT a second place to set the flags above. A token that collides
+	* with a typed field is REJECTED at start, naming the field that owns it
+	* (`assertNoOwnedFlags`), because two knobs writing the same argv is exactly
+	* the "two switches that disagree" failure this repo has already shipped
+	* twice (D62).
+	*/
+	extraArgs: z.array(z.string()).default([]),
 	/** Else lazy: first generate boots it. */
 	autoStart: z.boolean().default(false),
 	/** 0 = never; frees RAM after quiet periods. */
 	idleStopMinutes: z.number().int().default(30)
 });
+/**
+* Where a multi-GB install currently is. A single 0..1 fraction cannot answer
+* "is it stuck?" for an install that is three files (shards + mmproj) followed
+* by a sha256 pass over 22 GB — during which the fraction sat at 1.0 and the
+* node looked hung. Phase + file + bytes is the smallest shape that does.
+*/
+var LlmDownloadProgressSchema = z.object({
+	phase: z.enum(["downloading", "verifying"]),
+	/** The artifact currently moving, e.g. `mmproj-F16.gguf`. */
+	file: z.string(),
+	fileIndex: z.number().int(),
+	fileCount: z.number().int(),
+	/** Across the WHOLE install, not the current file. */
+	downloadedBytes: z.number(),
+	totalBytes: z.number().optional()
+});
 var LlmRuntimeStatusSchema = z.object({
 	/** Status is ALWAYS node-qualified. */
 	nodeId: z.string(),
@@ -10248,6 +10292,8 @@ var LlmRuntimeStatusSchema = z.object({
 	modelPath: z.string().optional(),
 	modelId: z.string().optional(),
 	downloadProgress: z.number().min(0).max(1).optional(),
+	/** Detail behind `downloadProgress`; present for the same lifetime. */
+	download: LlmDownloadProgressSchema.optional(),
 	lastError: z.string().optional(),
 	crashesInWindow: z.number(),
 	/** Child RSS (sampled best-effort). */
@@ -10258,7 +10304,14 @@ var LlmNodeModelSchema = z.object({
 	file: z.string(),
 	sizeBytes: z.number(),
 	catalogId: z.string().optional(),
-	installedAt: z.number().optional()
+	installedAt: z.number().optional(),
+	/**
+	* Absolute path on the node. Present so a file that is on disk but matches
+	* no catalog entry — a custom Hugging Face install, or a GGUF the operator
+	* copied in by hand — is still SELECTABLE, as a `{kind:'path'}` ref. Without
+	* it the picker could list such a file and do nothing with it.
+	*/
+	path: z.string().optional()
 });
 var LlmRuntimeDiskUsageSchema = z.object({
 	nodeId: z.string(),
@@ -10351,9 +10404,12 @@ var LlmProfileSchema = z.object({
 	systemPrompt: z.string().optional(),
 	/** Total generation bound — the only one a unary call has. */
 	timeoutMs: z.number().int().positive().default(6e4),
-	/** Wait for response headers only. */
+	/** The TCP handshake only — "is the port even open". NOT the wait for
+	*  response headers: on the LM Studio / llama-server wire those are written
+	*  once the model has finished loading, so they belong to the bound below. */
 	connectTimeoutMs: z.number().int().positive().default(1e4),
-	/** Accepted, but no output yet — a cold GPU load lives here. */
+	/** Accepted, but no output yet — response headers included, because a cold
+	*  GPU load is exactly what happens before them. */
 	firstTokenTimeoutMs: z.number().int().positive().default(12e4),
 	/** Output started then stopped. */
 	idleTimeoutMs: z.number().int().positive().default(6e4),
@@ -10416,6 +10472,36 @@ var ManagedModelCatalogEntrySchema = z.object({
 	/** Vision models: companion projector file. */
 	mmprojUrl: z.string().optional()
 });
+/**
+* The outcome of turning one operator-typed Hugging Face reference into a
+* download plan. A RESULT, never a throw: "this repo has 24 quantizations and
+* I will not pick for you" is a normal answer the UI has to render, not an
+* exception.
+*
+* `candidates` is the whole reason the refusal is usable — every string in it
+* is a tag that resolves when pasted back as `<org>/<repo>:<TAG>`.
+*/
+var HfModelResolutionSchema = z.discriminatedUnion("ok", [z.object({
+	ok: z.literal(true),
+	/** Ready to hand to `installModel` unchanged. */
+	model: ManagedModelRefSchema,
+	label: z.string(),
+	repo: z.string(),
+	quantization: z.string(),
+	purpose: z.enum(["text", "vision"]),
+	totalBytes: z.number(),
+	/** mmproj + shards, for the preview: an operator approving 23 GB should
+	*  see that 0.9 GB of it is a projector they did not name. */
+	extraFilenames: z.array(z.string())
+}), z.object({
+	ok: z.literal(false),
+	code: z.string(),
+	message: z.string(),
+	candidates: z.array(z.string()).optional(),
+	/** Set when the refusal was only the ceiling: re-calling with
+	*  `maxBytes: requiredBytes` is the operator's explicit override. */
+	requiredBytes: z.number().optional()
+})]);
 var LlmRuntimeNodeSchema = z.object({
 	nodeId: z.string(),
 	reachable: z.boolean(),
@@ -10483,6 +10569,25 @@ var llmCapability = {
 		listModelCatalog: method(z.object({}), z.array(ManagedModelCatalogEntrySchema)),
 		listRuntimeNodes: method(z.object({}), z.array(LlmRuntimeNodeSchema)),
 		listNodeModels: method(z.object({ nodeId: z.string() }), z.array(LlmNodeModelSchema)),
+		/**
+		* One typed Hugging Face reference → a pinned, verified `ManagedModelRef`.
+		*
+		* Runs on the HUB, not on the target node: resolution needs egress to
+		* huggingface.co, and an agent that cannot reach it still installs fine
+		* through the model-distributor relay. Nothing is downloaded here — this is
+		* a tree read plus a HEAD, so the operator sees the size, the quantization
+		* and the mmproj BEFORE approving a multi-GB pull.
+		*/
+		resolveModelRef: method(z.object({
+			/** `https://huggingface.co/<org>/<repo>/resolve/main/<f>.gguf`,
+			*  `<org>/<repo>/<f>.gguf`, `<org>/<repo>` or `<org>/<repo>:<QUANT>`. */
+			ref: z.string(),
+			/** Explicit ceiling override, in bytes. Absent = the built-in ceiling. */
+			maxBytes: z.number().positive().optional()
+		}), HfModelResolutionSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		installModel: method(z.object({
 			nodeId: z.string(),
 			model: ManagedModelRefSchema
@@ -12620,9 +12725,66 @@ var NcDeviceStateConditionSchema = z.object({
 	/** Any of these matches. */
 	states: z.array(z.string().min(1)).min(1)
 });
+/**
+* "This rule applies only while scene `sceneId` is `matched` / `diverged`."
+*
+* A GATE, not a trigger. `occupancy` and `audio` each DISCRIMINATE their rule —
+* carrying one makes the rule fire on that subject and nothing else. Scene is
+* the other shape entirely, the `deviceState` shape: it narrows a rule that
+* already has a trigger ("tell me about a person at the front door, but only
+* while the bin is still out"). That is why it composes with every delivery
+* instead of owning one, and why no new `NcDelivery` member and no new subject
+* kind exist for it — see D159.
+*
+* ── Identity ───────────────────────────────────────────────────────────────
+* `sceneId` is `SceneMonitor.id`, a `randomUUID()` minted by `createScene` —
+* globally unique, so it needs no device to disambiguate it. `deviceId` is
+* carried as a HINT for the editor and for the log line, never as part of the
+* lookup key: a rule whose hint drifted must still gate correctly.
+*
+* ── Which boolean ──────────────────────────────────────────────────────────
+* `latched` ABSENT means "whatever the scene itself says" — `SceneMonitor.emit`
+* already declares which boolean drives notification rules, and a second knob
+* that could disagree with it is exactly the D62 failure. Set it only to
+* override one rule against the scene's own default.
+*
+*  - LIVE reading (`emit`/`latched` resolve to live): passes iff
+*    `verdict === requiredState`. `unknown` — no reference for this light, view
+*    shifted, no snapshot — passes NEITHER. A scene that cannot judge is not
+*    evidence, in either direction.
+*  - LATCHED reading: passes iff `latched === (requiredState === 'diverged')`.
+*    The latch is a durable fact about the past ("it has diverged since I armed
+*    it"), so a camera that has gone dark does not clear it — that is the whole
+*    reason the operator asked for a latch.
+*
+* The gate reads an in-memory mirror (`NcSceneStateCache`) refreshed OFF the
+* event path, never the cap: D49. A mirror that has never loaded, or a scene it
+* does not carry, reads absent and the rule does NOT fire — fail closed, and
+* said out loud in the log rather than dropped in silence.
+*/
+var NcSceneConditionSchema = z.object({
+	/** `SceneMonitor.id` — the uuid the cap mints. The whole lookup key. */
+	sceneId: z.string().min(1),
+	/** The camera the scene lives on. A hint for the editor and the log line. */
+	deviceId: z.number().int().optional(),
+	/** The state the scene must be in for the rule to fire. */
+	requiredState: z.enum(["matched", "diverged"]),
+	/**
+	* Read the LATCH (`true`) or the LIVE verdict (`false`). Absent = follow the
+	* scene's own `emit` field, which is the only place that decision belongs.
+	*/
+	latched: z.boolean().optional()
+});
 var NcConditionsSchema = z.object({
 	/** Gate on ANOTHER device's current state (the alarm armed, a switch on). */
 	deviceState: NcDeviceStateConditionSchema.optional(),
+	/**
+	* Gate on a SCENE's state — "only while the bin is still out". Composes with
+	* every trigger (detection, occupancy, audio, sensor, package, track-end);
+	* unlike `occupancy`/`audio` it discriminates nothing. See
+	* {@link NcSceneCondition} and D159.
+	*/
+	scene: NcSceneConditionSchema.optional(),
 	/** Device scope — absent = all devices. */
 	devices: z.array(z.number()).optional(),
 	/** Detector class names (any overlap with the record's class set). */
@@ -13260,6 +13422,7 @@ var NcConditionDescriptorSchema = z.object({
 		"occupancy",
 		"audio",
 		"deviceState",
+		"scene",
 		"systemEvent"
 	]),
 	operator: z.enum([
@@ -16485,6 +16648,17 @@ var maxSessionHoldMsField = {
 	default: 12e4,
 	step: 5e3
 };
+/**
+* Quiet period that closes an `audioMode: 'on-motion'` audio window. Floor of
+* 5s so a rearm can never degenerate into per-event stream churn; default 90s
+* comfortably outlives the gap between two PIR wakes on a battery camera.
+*/
+var audioMotionWindowMsField = {
+	min: 5e3,
+	max: 6e5,
+	default: 9e4,
+	step: 5e3
+};
 var motionFpsField = {
 	min: 1,
 	max: 30,
@@ -16661,6 +16835,27 @@ var RunnerCameraConfigSchema = z.object({
 	* resolved `CameraDetectionConfig`.
 	*/
 	maxSessionHoldMs: z.number().min(maxSessionHoldMsField.min).max(maxSessionHoldMsField.max).optional(),
+	/**
+	* Orchestrator-side quiet period (ms) that closes an `audioMode:
+	* 'on-motion'` audio window, measured from the LAST motion event.
+	*
+	* This exists because the falling edge cannot be relied on. Camera-native
+	* providers emit motion as a RISING EDGE ONLY (Reolink's Baichuan push and
+	* its email-push SMTP path both emit `detected: true` and never the
+	* counterpart); only the frame-diff analyzer emits falls. So on an
+	* onboard-only camera a window that closed only on `detected: false` never
+	* closed at all, and `on-motion` silently behaved as `always-on` — on a
+	* battery camera, the one failure mode the mode exists to prevent.
+	*
+	* Every motion event rearms this timer WITHOUT restarting the stream, so a
+	* burst of re-fires costs nothing. A falling edge, when one does arrive,
+	* still closes earlier via `motionCooldownMs` — whichever comes first wins.
+	*
+	* Not consumed by the runner: carried here so it shares the per-camera
+	* device-settings surface with `motionCooldownMs`, exactly like
+	* `maxSessionHoldMs`.
+	*/
+	audioMotionWindowMs: z.number().min(audioMotionWindowMsField.min).max(audioMotionWindowMsField.max).optional(),
 	motionFps: z.number().min(motionFpsField.min).max(motionFpsField.max).default(motionFpsField.default),
 	detectionFps: z.number().min(detectionFpsField.min).max(detectionFpsField.max).default(detectionFpsField.default),
 	motionStreamId: z.string(),
@@ -16756,7 +16951,7 @@ var RunnerCameraConfigSchema = z.object({
 	*/
 	inferenceDevices: z.array(RunnerInferenceDeviceSchema).readonly().optional()
 });
-motionFpsField.min, motionFpsField.max, motionFpsField.step, motionFpsField.default, detectionFpsField.min, detectionFpsField.max, detectionFpsField.step, detectionFpsField.default, motionCooldownMsField.min, motionCooldownMsField.max, motionCooldownMsField.step, motionCooldownMsField.default, maxSessionHoldMsField.min, maxSessionHoldMsField.max, maxSessionHoldMsField.step, maxSessionHoldMsField.default, occupancyRecheckSecField.min, occupancyRecheckSecField.max, occupancyRecheckSecField.step, occupancyRecheckSecField.default, occupancyRecheckFramesField.min, occupancyRecheckFramesField.max, occupancyRecheckFramesField.step, occupancyRecheckFramesField.default;
+motionFpsField.min, motionFpsField.max, motionFpsField.step, motionFpsField.default, detectionFpsField.min, detectionFpsField.max, detectionFpsField.step, detectionFpsField.default, motionCooldownMsField.min, motionCooldownMsField.max, motionCooldownMsField.step, motionCooldownMsField.default, maxSessionHoldMsField.min, maxSessionHoldMsField.max, maxSessionHoldMsField.step, maxSessionHoldMsField.default, audioMotionWindowMsField.min, audioMotionWindowMsField.max, audioMotionWindowMsField.step, audioMotionWindowMsField.default, occupancyRecheckSecField.min, occupancyRecheckSecField.max, occupancyRecheckSecField.step, occupancyRecheckSecField.default, occupancyRecheckFramesField.min, occupancyRecheckFramesField.max, occupancyRecheckFramesField.step, occupancyRecheckFramesField.default;
 /**
 * Runtime load summary returned by `getLocalLoad`. Used by the orchestrator's
 * load-balancing levels (L2 capacity-based, L3 hardware-aware) to decide
@@ -20630,6 +20825,25 @@ var BatteryStatusSchema = z.object({
 	/** Ms epoch of the last observation. Lets consumers reason about freshness. */
 	lastUpdated: z.number(),
 	/**
+	* Ms epoch of the last time the device PROVED it was reachable — a
+	* completed firmware round-trip, an observed wake, or an inbound push
+	* (firmware event, email). `0`/absent = never since this slice was born.
+	*
+	* This is the ONLY input that separates "asleep" from "gone", and it is
+	* fed exclusively by PASSIVE signals: nothing may write it by reaching
+	* for the radio, because a poll that confirms reachability is the same
+	* poll that drains the battery. See {@link deriveBatteryPresence} — the
+	* single derivation every consumer must use; no surface computes its own.
+	*
+	* It is deliberately NOT a clock in the
+	* `scripts/check-runtime-state-durability.ts` sense: it is the
+	* observation itself, and it is the only thing a 30-hour silence is
+	* visible in. Writers quantise it (see `CONTACT_WRITE_QUANTUM_MS` in the
+	* Reolink provider) so a value that means "recently" cannot cost a
+	* SQLite commit per round-trip.
+	*/
+	lastContactAt: z.number().optional(),
+	/**
 	* True when the source is a BINARY low-battery indicator (HA
 	* `binary_sensor` device_class=battery / `LOW_BAT`) that has no real
 	* charge level — `percentage` is then a coarse stand-in (100 = normal,
@@ -26788,6 +27002,33 @@ var recordingExportCapability = {
 *  as `unknown`, never guessed. A day reference scored against an IR frame
 *  collapses the cosine and would latch a false alarm every single night. */
 var SceneConditionSchema = z.string();
+/**
+* What a scene does when the CURRENT light has no reference of its own.
+*
+* The lighting variants are not equally likely to exist. Almost every operator
+* captures daylight and then never stands outside at 22:00 to capture IR, and a
+* scene that is only ever going to be asked about a daytime question ("is the
+* bin still on the kerb at 08:00") does not need a night reference at all. The
+* night half must therefore be OPTIONAL, and optional means the scene keeps
+* working without it rather than degrading into a permanent complaint.
+*
+* - `skip` (default) — the check in that light is not made. Not a verdict, not
+*   an alarm, not even an `unknown`: the live state simply stays whatever the
+*   last covered light left it at, the latch is untouched, and the hysteresis
+*   run is neither spent nor cleared. The scene resumes by itself at first
+*   light. This is the only behaviour under which "I never captured IR" is a
+*   configuration choice instead of a nightly fault.
+* - `judge-anyway` — score against the OTHER conditions' references. Available
+*   for cameras whose IR frame is close enough to daylight (a floodlit
+*   driveway, an always-white-light doorbell), and wrong for everything else:
+*   cross-condition cosines are not comparable, so a day reference against a
+*   true IR frame collapses and the scene reports a theft at 21:40.
+*
+* Never applies when the scene has NO comparable reference at all — that is
+* "not armed yet", it is reported as `no-reference-for-condition`, and silence
+* there would hide a scene the operator never finished setting up.
+*/
+var SceneUncoveredPolicySchema = z.enum(["skip", "judge-anyway"]);
 /** `matched` = the baseline is what we see; `diverged` = it demonstrably is not;
 *  `unknown` = we cannot judge (no reference for this condition, encoder model
 *  changed, view shifted, no snapshot). `unknown` is a real value, not a null,
@@ -26843,6 +27084,9 @@ var SceneCheckSchema = z.discriminatedUnion("mode", [z.object({
 	hysteresisCount: z.number().int().positive()
 })]);
 var SCENE_DEFAULT_ANCHOR_THRESHOLD = .85;
+/** Night is OPTIONAL. A scene with only a daylight reference sits the IR hours
+*  out in silence rather than reporting a fault every night. */
+var SCENE_DEFAULT_UNCOVERED_POLICY = "skip";
 /**
 * Vision-model adjudication of a candidate flip. Field names deliberately
 * mirror `NcConfirmSchema` so an operator meets one vocabulary, not two.
@@ -26909,6 +27153,21 @@ var SceneMonitorSchema = z.object({
 	*  automation can react to the bin coming back without the operator's own
 	*  alarm silently clearing itself. */
 	autoRestore: z.boolean().default(false),
+	/** What to do when the current light has no reference of its own. See
+	*  {@link SceneUncoveredPolicySchema} — the default makes night OPTIONAL. */
+	onUncoveredCondition: SceneUncoveredPolicySchema.default(SCENE_DEFAULT_UNCOVERED_POLICY),
+	/**
+	* The light whose checks are currently being SAT OUT under
+	* `onUncoveredCondition: 'skip'` — `null` when the scene is checking normally.
+	*
+	* Engine-reported and advisory only: it moves no verdict, no latch and no
+	* hysteresis. It exists so the card can say *"night (IR) — checks paused,
+	* nothing captured in this light"* in the same calm voice as the coverage
+	* line, because the alternative is a scene that silently stops answering
+	* after sunset with nothing anywhere saying why. A skipped check must never
+	* read as a broken one.
+	*/
+	suspendedCondition: SceneConditionSchema.nullable().default(null),
 	/** Named cause when `verdict === 'unknown'`. */
 	unavailable: SceneUnavailableSchema.nullable(),
 	/** Conditions that have at least one comparable reference — the coverage line
@@ -26962,6 +27221,7 @@ var sceneMonitorCapability = {
 				minObservationSpacingSec: z.number().int().min(0).max(3600).optional(),
 				anchorThreshold: z.number().min(0).max(1).optional(),
 				autoRestore: z.boolean().optional(),
+				onUncoveredCondition: SceneUncoveredPolicySchema.optional(),
 				/** `null` clears the vision-model adjudicator. */
 				confirm: SceneConfirmSchema.nullable().optional()
 			})
@@ -27266,13 +27526,63 @@ var CamStreamDescriptorSchema = z.object({
 * set of stream descriptors it can offer for the device, synchronously, so the
 * broker can reconcile its registry against the authoritative provider state.
 */
+/**
+* The catalog as a DURABLE fact rather than a live answer.
+*
+* A battery camera's descriptors are profile-stable — they change when the
+* operator rewrites an encoder profile, not minute to minute — but building
+* them costs a Baichuan login, which on a sleeping Argus IS a wake. So the
+* provider is allowed to build them exactly once per profile and must serve
+* every later pull from a cache.
+*
+* Holding that cache only in RAM is what turned a restart into an outage. The
+* runner comes back with the camera asleep, `buildStreamCatalogUncached`
+* correctly refuses to wake it, the pull answers `[]`, the broker has no
+* cam-stream entry to build a broker from, and `webrtcSession.handleOffer`
+* fails with a flat "No broker for stream" — for as long as the camera sleeps,
+* which on a battery cam is most of the day. The camera was fine. The stream
+* was unreachable because the process had forgotten what the camera offers.
+*
+* Declaring it here puts it in `device-runtime-state`, the kernel's canonical
+* declared collection, with the same `restored` durability `battery` uses for
+* the same reason: the last known value is the only value there is while the
+* device is asleep. The broker's brokers are therefore always DEFINABLE — it
+* is the DIAL that wakes a camera, never the catalog (D173).
+*/
+var StreamCatalogStateSchema = z.object({
+	/** The descriptors as last built from a real camera response. Never a guess:
+	*  a failed or refused build writes NOTHING, so a restored catalog is always
+	*  one the camera itself once produced. */
+	descriptors: z.array(CamStreamDescriptorSchema),
+	/** Ms epoch of the build that produced {@link descriptors}. Lets the wake
+	*  path decide whether the camera's own awake window is worth spending on a
+	*  re-read. */
+	lastFetchedAt: z.number()
+});
 var streamCatalogCapability = {
 	name: "stream-catalog",
 	scope: "device",
 	deviceNative: true,
 	mode: "singleton",
 	deviceTypes: [DeviceType.Camera],
-	methods: { getCatalog: method(z.object({ deviceId: z.number().int().nonnegative() }), z.array(CamStreamDescriptorSchema).readonly()) }
+	methods: { getCatalog: method(z.object({ deviceId: z.number().int().nonnegative() }), z.array(CamStreamDescriptorSchema).readonly()) },
+	runtimeState: StreamCatalogStateSchema,
+	/**
+	* Runtime-state durability: **restored** — see the schema doc. A cold
+	* catalog on a sleeping battery camera is not a slow first frame, it is a
+	* camera that cannot be watched at all until it happens to wake.
+	*
+	* Churn is nil by construction: the slice is written only by a SUCCESSFUL
+	* build, and a build only runs when there is no cached copy (or the copy is
+	* a day old and the camera is awake anyway).
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock field: written, but excluded from the compare that decides whether
+	*  persisting is worth a SQLite commit — the descriptors are the value. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /** One of the camera's stream profiles. */
 var StreamProfileSchema = z.enum([
@@ -29269,6 +29579,24 @@ var DeclaredDevices = class {
 DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
 new Set(Object.values(DeviceType));
 DeviceFeature.BatteryOperated;
+/**
+* THE derivation. One crop rectangle, one presence verdict — see D52 for why
+* this repo insists a derived value has exactly one implementation.
+*
+* `undefined` status ⇒ `sleeping`. A device with no slice has made no claim,
+* and the caller decides separately whether it is even battery-operated
+* (`DeviceFeature.BatteryOperated`); this function never answers that
+* question, only what a battery device is doing.
+*/
+function deriveBatteryPresence(input) {
+	const status = input.status;
+	if (!status) return "sleeping";
+	if (status.sleeping !== true) return "awake";
+	const lastContactAt = status.lastContactAt;
+	if (typeof lastContactAt !== "number" || lastContactAt <= 0) return "sleeping";
+	const budget = input.unreachableAfterMs ?? 216e5;
+	return input.nowMs - lastContactAt > budget ? "unreachable" : "sleeping";
+}
 /** Unwrap ZodNullable / ZodOptional / ZodDefault wrappers to reach the inner type.
 *  Zod v4 exposes `.unwrap()` on all three wrapper classes. */
 function unwrap(schema) {
@@ -31707,6 +32035,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"llm.resolveModelRef": {
+		capName: "llm",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llm.setDefault": {
 		capName: "llm",
 		capScope: "system",
@@ -36876,7 +37210,7 @@ Object.freeze({
 });
 /**
 * Per-cap runtime-state policy, projected from every `*.cap.ts` that declares
-* `runtimeState`. 63 caps: 33 `restored`, 30 `session`.
+* `runtimeState`. 64 caps: 34 `restored`, 30 `session`.
 *
 * A cap absent from this map has no runtime-state slice at all. A cap PRESENT
 * with `durability: 'session'` has one and has decided not to keep it.
@@ -37082,6 +37416,10 @@ var RUNTIME_STATE_POLICY = {
 		durability: "restored",
 		volatileFields: ["lastChangedAt"]
 	},
+	"stream-catalog": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
 	"stream-params": {
 		durability: "restored",
 		volatileFields: ["lastFetchedAt"]
@@ -37687,4 +38025,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { objectInputDeclaresAddonId as $, decodeVectorBase64 as A, createEvent as At, isArrayOutputSchema as B, resolveCapMount as Bt, backupCapability as C, DeviceType as Ct, coreBlockIdFromAddonId as D, asJsonObject as Dt, coreBlockAddonId as E, WELL_KNOWN_TAB_MAP as Et, enumerateInferenceDevices as F, isDeviceConfigCap as Ft, kebabToCamel as G, isObjectInput as H, sleep as Ht, enumerateItemArrayFields as I, nodePin as It, logDestinationCapability as J, lifecycleJobSchema as K, enumerateSchemaFields as L, parseJsonObject as Lt, deviceStateCapability as M, emitReadiness as Mt, deviceStatusCapability as N, expandCapMethods as Nt, coreBlocksCapability as O, asNumber as Ot, doorbellCapability as P, hydrateSchema as Pt, normalizeUnit as Q, extractNestedAddonId as R, parseJsonUnknown as Rt, authProviderCapability as S, DeviceRole as St, buildStreamParamsConfigSchema as T, ReadinessTimeoutError as Tt, isSameAddonId as U, EventCategory as Ut, isCollectionArrayMethod as V, scopeKey as Vt, isVoidInput as W, looseSchema as X, logLevelAtMost as Y, metricsProviderCapability as Z, UserRecordSchema as _, BaseAddon as _t, CAP_NAMES_WITH_STATUS as a, scopesAllowDeviceCap as at, addonWidgetsCapability as b, DEVICE_STATUS_METHOD as bt, CoreBlockSchema as c, snapshotCapability as ct, METHOD_ACCESS_MAP as d, storageProviderCapability as dt, parseStreamParamsFormPatch as et, RUNTIME_DEFAULTS as f, streamQualityLabel as ft, StorageMigrationJobSchema as g, errMsg as gt, StorageLocationTypeSchema as h, vectorStoreCapability as ht, BatteryStatusSchema as i, scopesAllowAddon as it, deviceManagerCapability as j, emitDownForOwnedCaps as jt, dataStoreProviderCapability as k, asString as kt, DeclaredDevices as l, storageCapability as lt, ScopedTokenSchema as m, vectorDimFromBase64 as mt, AlertSchema as n, procedureAuthKey as nt, CORE_BLOCKS_ADDON_ID as o, scoreRuntimes as ot, STREAM_PROFILE_META as p, userManagementCapability as pt, localNetworkCapability as q, ApiKeyRecordSchema as r, runtimeStatePolicyFor as rt, CORE_BLOCK_ADDON_PREFIX as s, settingsStoreCapability as st, ALL_CAPABILITY_DEFINITIONS as t, platformProbeCapability as tt, DeviceStatusSchema as u, storageMigrationCapability as ut, addonPagesCapability as v, DATAPLANE_SECRET_HEADER as vt, bareAddonId as w, ReadinessRegistry as wt, alertsCapability as x, DeviceFeature as xt, addonSettingsCapability as y, DEVICE_SETTINGS_CONTRIBUTION_METHODS as yt, filesystemBrowseCapability as z, readinessKey as zt };
+export { normalizeUnit as $, decodeVectorBase64 as A, asString as At, filesystemBrowseCapability as B, readinessKey as Bt, backupCapability as C, DeviceRole as Ct, coreBlockIdFromAddonId as D, WELL_KNOWN_TAB_MAP as Dt, coreBlockAddonId as E, ReadinessTimeoutError as Et, doorbellCapability as F, hydrateSchema as Ft, isVoidInput as G, isCollectionArrayMethod as H, scopeKey as Ht, enumerateInferenceDevices as I, isDeviceConfigCap as It, localNetworkCapability as J, kebabToCamel as K, enumerateItemArrayFields as L, nodePin as Lt, deviceManagerCapability as M, emitDownForOwnedCaps as Mt, deviceStateCapability as N, emitReadiness as Nt, coreBlocksCapability as O, asJsonObject as Ot, deviceStatusCapability as P, expandCapMethods as Pt, metricsProviderCapability as Q, enumerateSchemaFields as R, parseJsonObject as Rt, authProviderCapability as S, DeviceFeature as St, buildStreamParamsConfigSchema as T, ReadinessRegistry as Tt, isObjectInput as U, sleep as Ut, isArrayOutputSchema as V, resolveCapMount as Vt, isSameAddonId as W, EventCategory as Wt, logLevelAtMost as X, logDestinationCapability as Y, looseSchema as Z, UserRecordSchema as _, errMsg as _t, CAP_NAMES_WITH_STATUS as a, scopesAllowAddon as at, addonWidgetsCapability as b, DEVICE_SETTINGS_CONTRIBUTION_METHODS as bt, CoreBlockSchema as c, settingsStoreCapability as ct, METHOD_ACCESS_MAP as d, storageMigrationCapability as dt, objectInputDeclaresAddonId as et, RUNTIME_DEFAULTS as f, storageProviderCapability as ft, StorageMigrationJobSchema as g, vectorStoreCapability as gt, StorageLocationTypeSchema as h, vectorDimFromBase64 as ht, BatteryStatusSchema as i, runtimeStatePolicyFor as it, deriveBatteryPresence as j, createEvent as jt, dataStoreProviderCapability as k, asNumber as kt, DeclaredDevices as l, snapshotCapability as lt, ScopedTokenSchema as m, userManagementCapability as mt, AlertSchema as n, platformProbeCapability as nt, CORE_BLOCKS_ADDON_ID as o, scopesAllowDeviceCap as ot, STREAM_PROFILE_META as p, streamQualityLabel as pt, lifecycleJobSchema as q, ApiKeyRecordSchema as r, procedureAuthKey as rt, CORE_BLOCK_ADDON_PREFIX as s, scoreRuntimes as st, ALL_CAPABILITY_DEFINITIONS as t, parseStreamParamsFormPatch as tt, DeviceStatusSchema as u, storageCapability as ut, addonPagesCapability as v, BaseAddon as vt, bareAddonId as w, DeviceType as wt, alertsCapability as x, DEVICE_STATUS_METHOD as xt, addonSettingsCapability as y, DATAPLANE_SECRET_HEADER as yt, extractNestedAddonId as z, parseJsonUnknown as zt };

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-9Gfk4KOk.js");
+const require_dist = require("./dist-BMus2E5R.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -25,7 +25,7 @@ const require_builtins_system_config_system_config_addon = require("./builtins/s
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DUHPHa-Y.js");
-const require_manifest_python_deps = require("./manifest-python-deps-C0zkl1Ae.js");
+const require_manifest_python_deps = require("./manifest-python-deps-BZO_eMn-.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");
@@ -1181,6 +1181,11 @@ var LogManager = class {
 	subscribers = /* @__PURE__ */ new Map();
 	deviceNameLookup = null;
 	/**
+	* The bootstrap stdout sink, while one is attached. Detached — and its
+	* replay suppressed — when {@link STDOUT_DESTINATION_ADDON_ID} registers.
+	*/
+	bootstrapConsole = null;
+	/**
 	* `perAddonCapacity` bounds EACH addon's bucket, not the total — a chatty addon
 	* evicts only its own lines, so quiet addons keep their sparse history.
 	*
@@ -1282,13 +1287,34 @@ var LogManager = class {
 	setDestinationEnabledCheck(check) {
 		this.isDestinationEnabled = check ?? void 0;
 	}
+	/**
+	* Attach a minimal console sink that carries the boot log until the real
+	* `console-logging` builtin registers — see {@link STDOUT_DESTINATION_ADDON_ID}.
+	*
+	* Registered WITHOUT an `addonId` on purpose: the per-destination toggle
+	* could otherwise hide the one window an operator cannot read any other way
+	* (a hub that dies before pass 3 would emit nothing at all). It is detached
+	* the moment the stdout owner arrives, so stdout never carries two copies.
+	*
+	* Idempotent: a second call while one is attached is a no-op.
+	*/
+	attachBootstrapConsole(dest) {
+		if (this.bootstrapConsole !== null) return;
+		this.bootstrapConsole = dest;
+		this.destinations.push({ dest });
+	}
 	addDestination(dest, opts = {}) {
-		const replay = opts.replay ?? true;
+		const supersedesBootstrap = this.bootstrapConsole !== null && opts.addonId === "console-logging";
+		if (supersedesBootstrap && this.bootstrapConsole !== null) {
+			this.removeDestination(this.bootstrapConsole);
+			this.bootstrapConsole = null;
+		}
+		const replay = opts.replay ?? !supersedesBootstrap;
 		this.destinations.push(opts.addonId === void 0 ? { dest } : {
 			dest,
 			addonId: opts.addonId
 		});
-		if (replay) for (const entry of this.ringBuffer.query({})) try {
+		if (replay) for (const entry of [...this.ringBuffer.query({})].reverse()) try {
 			dest.write(entry);
 		} catch {}
 	}
@@ -93941,9 +93967,18 @@ function createStreamProbeBrokerService(deps) {
 */
 var HEALTH_MONITOR_TICK_MS = 3e4;
 var HEALTH_MONITOR_GRACE_PERIOD_MS = 5 * 6e4;
-/** Retry intervals after each failure (capped — never stops). */
+/**
+* Retry intervals after each failure (capped — never stops).
+*
+* The FIRST interval must not exceed {@link HEALTH_MONITOR_TICK_MS}: retries can
+* only fire on a tick, so anything larger just adds latency on top of a wait the
+* tick already imposes. It used to be 60 s, which meant an addon that failed to
+* load because the boot was still moving files around stayed down for 60–90 s
+* — a schedule that presumed a healthy hub (docs/design/boot-to-usable-camera.md,
+* item E). Pinned by `addon-health-monitor.spec.ts`.
+*/
 var HEALTH_MONITOR_RETRY_INTERVALS_MS = [
-	6e4,
+	3e4,
 	12e4,
 	3e5
 ];