@camstack/types 1.2.111 → 1.2.113

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_event_category = require("./event-category-EY0GNjV9.js");
-const require_sleep = require("./sleep-BCRrMlni.js");
+const require_sleep = require("./sleep-CSodb2vQ.js");
 const require_canonical_hash = require("./canonical-hash-DNV8S5ET.js");
 const require_enums = require("./enums.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
@@ -1436,6 +1436,76 @@ var OPS_LOG_RING_DEFAULT_MAX = 500;
 /** Default page size for a `listOpsLog` query when the caller omits `limit`. */
 var OPS_LOG_DEFAULT_LIMIT = 200;
 //#endregion
+//#region src/types/labels.ts
+var LabelDefinitionSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	category: zod.z.string().optional(),
+	description: zod.z.string().optional(),
+	icon: zod.z.string().optional()
+});
+/** Detection-macro targets a catalog `classMap` may resolve to. */
+var CLASS_MAP_MACRO_TARGETS = [
+	"person",
+	"vehicle",
+	"animal",
+	"package"
+];
+/**
+* Le macro classi di PRIMO LIVELLO: quelle che un object detector emette e che
+* un operatore può selezionare.
+*
+* Sono le tre offerte dallo step `object-detection`
+* (`addon-pipeline/src/detection-pipeline/registry/step-definitions.ts`,
+* `enabledMacroClasses`). `package` sta in {@link CLASS_MAP_MACRO_TARGETS} e in
+* `MACRO_LABELS` — è una macro vera — ma NON qui: appartiene allo step
+* `package-detection`, la cui abilitazione è guidata dalle zone, e offrire la
+* stessa parola due volte ha già fatto accendere a un operatore il proxy COCO
+* (suitcase/backpack/handbag) lasciando spento il detector dedicato.
+*
+* UNA lista. Prima di oggi le stesse tre erano scritte a mano nell'offerta
+* dello step e una seconda volta come union `FirstLevelMacro`
+* (`types/detection.ts`); una terza copia per il trigger di registrazione
+* (`RecordingTriggers.objectClasses`) avrebbe reso invisibile la divergenza
+* successiva.
+*/
+var FIRST_LEVEL_MACRO_CLASSES = [
+	"person",
+	"vehicle",
+	"animal"
+];
+/**
+* True quando `value` è una macro di primo livello. Type guard, non cast: un
+* `className` che arriva dal bus è una stringa qualunque finché non passa di
+* qui.
+*/
+function isFirstLevelMacroClass(value) {
+	return FIRST_LEVEL_MACRO_CLASSES.some((macro) => macro === value);
+}
+/**
+* Wire schema for a per-model CATALOG classMap override
+* (`ModelCatalogEntry.classMap` / `ModelConvertMetadata.classMap`) —
+* restricted to {@link CLASS_MAP_MACRO_TARGETS}, the only macros the
+* detection pipeline executor actually routes.
+*
+* This is deliberately a DIFFERENT, narrower shape than the general-purpose
+* `ClassMapDefinition` interface above (e.g. `IDetectionAddon.getClassMap()`
+* and the audio `YAMNET_TO_MACRO` catalog both use macro targets outside this
+* enum) — the two used to share the name `ClassMapDefinition`/
+* `ClassMapDefinitionSchema`, which made the schema-type-twin guard
+* (`scripts/check-schema-type-twins.ts`) flag them as a duplicated shape. They
+* are not: it is two different concepts colliding on a name. Keep this type
+* under its own name rather than reusing `ClassMapDefinition` — reusing it
+* would either narrow every `ClassMapDefinition` consumer to the four
+* detection macros (breaking `YAMNET_TO_MACRO`) or drop the validation this
+* schema exists for (see the "rejects a classMap whose target is not a
+* detection macro" test in `model-catalog-schema.test.ts`).
+*/
+var DetectionCatalogClassMapSchema = zod.z.object({
+	mapping: zod.z.record(zod.z.string(), zod.z.enum(CLASS_MAP_MACRO_TARGETS)),
+	preserveOriginal: zod.z.boolean()
+});
+//#endregion
 //#region src/interfaces/recording-config.ts
 /**
 * THE canonical event-clip pad: the time window a single-timestamp analytics
@@ -1478,10 +1548,64 @@ var RecordingStorageModeSchema = zod.z.enum([
 	"events",
 	"continuous"
 ]);
+/**
+* Le macro classi che possono aprire una finestra di registrazione — le stesse
+* tre offerte dallo step `object-detection`, da UNA lista
+* ({@link FIRST_LEVEL_MACRO_CLASSES}).
+*/
+var RecordingObjectTriggerClassSchema = zod.z.enum(FIRST_LEVEL_MACRO_CLASSES);
+/**
+* True quando `values` non ripete un elemento.
+*
+* Un duplicato non è innocuo: ogni voce di `objectClasses` / `sensorDeviceIds`
+* diventa una SORGENTE in `bandTriggerSources`, e la stessa sorgente due volte
+* conterebbe due volte le sue finestre in `segmentMissedByMs`.
+*/
+var noDuplicates = (values) => new Set(values).size === values.length;
+/**
+* Quanti device sorgente una singola banda può ascoltare.
+*
+* Non è un gusto: ogni sorgente è una CHIAVE nel `TriggerState` del recorder, e
+* il limite per chiave (`MAX_TRIGGER_WINDOWS = 32`) senza un limite sulle
+* chiavi lascerebbe crescere la mappa con l'inventario dell'operatore. 16
+* sensori su UNA camera è già oltre qualunque installazione osservata.
+*/
+var MAX_SENSOR_TRIGGER_DEVICES = 16;
 /** Which detectors trigger an `events`-mode band. */
 var RecordingTriggersSchema = zod.z.object({
 	motion: zod.z.boolean().optional(),
-	audioThresholdDbfs: zod.z.number().optional()
+	audioThresholdDbfs: zod.z.number().optional(),
+	/**
+	* Le macro classi la cui detection apre una finestra. ASSENTE = la sorgente
+	* non è ascoltata; un array VUOTO è rifiutato, perché "banda events, trigger
+	* object acceso, nessuna classe" è la stessa forma "abilitata e non registra
+	* nulla, per sempre" contro cui è scritto `eventsBandCanEverDemand`.
+	*
+	* Il segnale letto è GIÀ FILTRATO: solo detection `source: 'pipeline'`, cioè
+	* quelle che hanno attraversato `enabledMacroClasses`, i
+	* `minConfidence<Macro>` e il full-frame guard. L'AI a bordo camera
+	* (`source: 'onboard'`) non attraversa nessuno di quei gate e NON apre
+	* finestre — vedi `recorder/object-trigger.ts`.
+	*/
+	objectClasses: zod.z.array(RecordingObjectTriggerClassSchema).min(1).refine(noDuplicates, { message: "objectClasses must not repeat a class" }).optional(),
+	/**
+	* I device LINKED il cui FRONTE ALTO apre una finestra. Assente = la sorgente
+	* non è ascoltata; un array vuoto è rifiutato per la stessa ragione di
+	* `objectClasses`.
+	*
+	* Sono id di device SORGENTE, non camere: la banda li nomina, quindi il
+	* percorso caldo (`DeviceStateChanged`, a ritmo di bus su tutta la flotta)
+	* non fa RPC. L'OFFERTA da cui l'operatore li sceglie è un'altra domanda, e
+	* si risolve con `deviceManager.getLinkedDevices` + `getBindingsBatch` per
+	* device (D12) — mai un elenco globale di cap.
+	*
+	* Cosa vuol dire "alto" dipende dal TIPO di device e non è deciso qui:
+	* `SOURCE_CAP_ACTIVE_FIELD` (`catalogs/sensor-active-state.ts`) è LA tabella,
+	* la stessa che il virtual-doorbell usa dal 2026-08-05. Ed è il FRONTE, non
+	* il livello: un contatto trovato già aperto al riavvio del runner non fa
+	* registrare.
+	*/
+	sensorDeviceIds: zod.z.array(zod.z.number().int().positive()).min(1).max(16).refine(noDuplicates, { message: "sensorDeviceIds must not repeat a device" }).optional()
 });
 /**
 * Mode of a single recording band — the recorder per-band vocabulary.
@@ -2271,45 +2395,6 @@ function pickClosestResolution(entries, target) {
 	return bestAbove?.entry ?? bestBelow?.entry;
 }
 //#endregion
-//#region src/types/labels.ts
-var LabelDefinitionSchema = zod.z.object({
-	id: zod.z.string(),
-	name: zod.z.string(),
-	category: zod.z.string().optional(),
-	description: zod.z.string().optional(),
-	icon: zod.z.string().optional()
-});
-/** Detection-macro targets a catalog `classMap` may resolve to. */
-var CLASS_MAP_MACRO_TARGETS = [
-	"person",
-	"vehicle",
-	"animal",
-	"package"
-];
-/**
-* Wire schema for a per-model CATALOG classMap override
-* (`ModelCatalogEntry.classMap` / `ModelConvertMetadata.classMap`) —
-* restricted to {@link CLASS_MAP_MACRO_TARGETS}, the only macros the
-* detection pipeline executor actually routes.
-*
-* This is deliberately a DIFFERENT, narrower shape than the general-purpose
-* `ClassMapDefinition` interface above (e.g. `IDetectionAddon.getClassMap()`
-* and the audio `YAMNET_TO_MACRO` catalog both use macro targets outside this
-* enum) — the two used to share the name `ClassMapDefinition`/
-* `ClassMapDefinitionSchema`, which made the schema-type-twin guard
-* (`scripts/check-schema-type-twins.ts`) flag them as a duplicated shape. They
-* are not: it is two different concepts colliding on a name. Keep this type
-* under its own name rather than reusing `ClassMapDefinition` — reusing it
-* would either narrow every `ClassMapDefinition` consumer to the four
-* detection macros (breaking `YAMNET_TO_MACRO`) or drop the validation this
-* schema exists for (see the "rejects a classMap whose target is not a
-* detection macro" test in `model-catalog-schema.test.ts`).
-*/
-var DetectionCatalogClassMapSchema = zod.z.object({
-	mapping: zod.z.record(zod.z.string(), zod.z.enum(CLASS_MAP_MACRO_TARGETS)),
-	preserveOriginal: zod.z.boolean()
-});
-//#endregion
 //#region src/types/model-variant-groups.ts
 var FORMAT_KEYS = [
 	"onnx",
@@ -14100,7 +14185,23 @@ var NcHistoryEntrySchema = zod.z.object({
 	updatedAt: zod.z.number(),
 	/** Failure detail — present on a `dead` row. */
 	error: zod.z.string().optional(),
-	subject: NcHistorySubjectSchema
+	subject: NcHistorySubjectSchema,
+	/**
+	* Ids of the artefacts (still, then gif, then clip) this row's successful
+	* delivery indexed in the artefact library — a REFERENCE, never the bytes
+	* (an artefact is often megabytes; this row is durable JSON rewritten on
+	* every delivery attempt). Absent on a row still pending/dead, a row
+	* delivered before this field shipped, or a wiring with no artefact index.
+	*
+	* Resolve one to a fetchable URL with `resolveArtifactUrl` — an id
+	* outlives any one URL's TTL, so a caller mints a fresh link on demand
+	* rather than trusting one frozen at delivery time. `resolveArtifactUrl`
+	* also answers `null` for an id whose artefact has since expired past the
+	* retained shelf's own age bound — the degrade a caller (the Home
+	* Assistant export) must render as "no image right now", never as a
+	* broken link.
+	*/
+	artifactIds: zod.z.array(zod.z.string().min(1)).optional()
 });
 /** `getHistory` default page size + hard ceiling (bounded output). */
 var NC_HISTORY_LIMIT_DEFAULT = 100;
@@ -14393,6 +14494,20 @@ var notificationRulesCapability = {
 		*/
 		getHistory: require_sleep.method(zod.z.object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), zod.z.object({ entries: zod.z.array(NcHistoryEntrySchema) }), { auth: "admin" }),
 		/**
+		* Mint a fresh, externally-reachable URL for one artefact a history row
+		* named in {@link NcHistoryEntrySchema.shape.artifactIds} — the SAME
+		* signed-link mechanism the dispatcher uses to attach media to an
+		* outgoing notification (one derivation; this never re-implements it).
+		*
+		* `url: null` on THREE causes a caller must treat identically ("no image
+		* right now", never a broken link): the id is unknown, its artefact has
+		* expired past the retained shelf's own age bound, or this install has no
+		* externally-reachable base URL. A caller that received a URL on a
+		* previous call and now gets `null` must stop showing it — a link that
+		* worked five minutes ago is not proof it works now.
+		*/
+		resolveArtifactUrl: require_sleep.method(zod.z.object({ artifactId: zod.z.string().min(1) }), zod.z.object({ url: zod.z.string().nullable() }), { auth: "admin" }),
+		/**
 		* Snooze windows currently in effect, plus any whose digest has not yet
 		* gone out. `caller: 'required'`: a user sees their OWN windows and the
 		* global ones that silence them, never another person's private silence.
@@ -21621,7 +21736,7 @@ var lifecycleJobSchema = zod.z.object({
 * `useAddonsOnAddonLogs`, etc. flow through the same codegen pipeline
 * as every other cap.
 */
-var LogLevelSchema$1 = zod.z.enum([
+var LogLevelSchema$2 = zod.z.enum([
 	"debug",
 	"info",
 	"warn",
@@ -21848,7 +21963,7 @@ var addonsCapability = {
 		getLogs: require_sleep.method(zod.z.object({
 			addonId: zod.z.string(),
 			limit: zod.z.number().min(1).max(500).default(100),
-			level: LogLevelSchema$1.optional()
+			level: LogLevelSchema$2.optional()
 		}), zod.z.array(LogQueryEntrySchema)),
 		listPackages: require_sleep.method(zod.z.void(), zod.z.array(InstalledPackageSchema).readonly()),
 		installPackage: require_sleep.method(zod.z.object({
@@ -22086,7 +22201,7 @@ var addonsCapability = {
 		}),
 		onAddonLogs: require_sleep.method(zod.z.object({
 			addonId: zod.z.string(),
-			level: LogLevelSchema$1.optional()
+			level: LogLevelSchema$2.optional()
 		}), LogStreamEntrySchema, { kind: "subscription" })
 	},
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
@@ -24032,6 +24147,35 @@ var FaceFilterEnum = zod.z.enum([
 	"identified",
 	"all"
 ]);
+/**
+* What a `listRecentFaces` page is ORDERED BY.
+*
+*  - `timestamp` — when the face was seen. The historical (and default) order.
+*  - `suggestionConfidence` — {@link FaceInfo.suggestedMatchScore}, the peak
+*    cosine of the face's SUGGESTED identity. This is the "review by certainty"
+*    order: it puts the suggestions an operator can confirm with one tap at the
+*    top, and it is the reason this enum exists — a client that ranked a capped
+*    page client-side was ranking the newest N, never the most certain N.
+*
+* A row with NO suggestion (`suggestedMatchScore` absent — a legacy row, an
+* auto-assigned face, or a face below the suggestion band) has no certainty to
+* compare. Under `suggestionConfidence` it sorts **LAST, in BOTH directions**
+* — flipping the direction reorders the rows that HAVE a certainty and never
+* floods the page with the ones that do not. `addon-post-analysis`'s
+* `store/face-sort.ts` is the single implementation, tiebreaks newest-first
+* then by faceId, and is what makes this a total order instead of the
+* backend's NULL-collation accident.
+*/
+var FaceSortFieldEnum = zod.z.enum(["timestamp", "suggestionConfidence"]);
+var FaceSortDirectionEnum = zod.z.enum(["asc", "desc"]);
+/** One suggested group of look-alike UNASSIGNED faces. Ids only — an embedding
+*  never leaves the server. */
+var FaceClusterSchema = zod.z.object({
+	faceIds: zod.z.array(zod.z.string()).readonly(),
+	representativeFaceId: zod.z.string(),
+	size: zod.z.number().int(),
+	cohesion: zod.z.number()
+});
 var MediaFileLiteSchema$1 = zod.z.object({
 	key: zod.z.string(),
 	kind: zod.z.string(),
@@ -24089,24 +24233,72 @@ includeCrops: zod.z.boolean().optional() }).optional(), zod.z.array(IdentitySche
 			auth: "admin"
 		}),
 		listRecentFaces: require_sleep.method(zod.z.object({
-			/** Restrict to one camera. Absent keeps the cluster-wide gallery view. */
+			/**
+			* Restrict to ONE camera. Absent keeps the cluster-wide gallery view.
+			*
+			* The legacy single-camera form, kept verbatim for every caller that
+			* already sends it. A caller that wants a SET sends {@link deviceIds}
+			* instead — never both: `deviceIds` is the authority whenever it is
+			* present, and this field is then ignored rather than unioned, so
+			* there is exactly one answer to "which cameras did I ask for".
+			*/
 			deviceId: zod.z.number().int().optional(),
+			/**
+			* Restrict to a SET of cameras — the review UI's camera filter, which
+			* until now had to fetch the cluster-wide page and drop rows in the
+			* client (so the `limit` it asked for was spent on cameras it was
+			* about to discard).
+			*
+			* An **empty array reads NOTHING** — `[]` is an empty page, never
+			* "every camera". A request for no devices is a request, not an
+			* omission; same contract as `deviceManager.listFleet` and
+			* `pipelineAnalytics.listRecentTracks`.
+			*
+			* Absent (`undefined`) is the omission, and keeps the cluster-wide view.
+			*/
+			deviceIds: zod.z.array(zod.z.number().int()).optional(),
 			limit: zod.z.number().int().positive().optional(),
 			filter: FaceFilterEnum.optional(),
 			/**
-			* Inline the base64 crop on every row. Default `true` — the existing
-			* behaviour, kept so no caller breaks.
+			* Window lower bound on {@link FaceInfo.timestamp}, INCLUSIVE.
+			* Absent means no lower bound.
+			*/
+			since: zod.z.number().int().optional(),
+			/**
+			* Window upper bound on {@link FaceInfo.timestamp}, INCLUSIVE.
+			* Absent means no upper bound.
+			*/
+			until: zod.z.number().int().optional(),
+			/**
+			* Order the page by time or by suggestion certainty. Default
+			* `'timestamp'` — the historical order, unchanged for every caller
+			* that does not ask.
 			*
-			* Set `false` once the caller renders {@link FaceInfo.cropUrl}: that
-			* drops ~2.87 MiB per 500-row page to a few KiB of metadata and lets
-			* the browser cache the images.
+			* See {@link FaceSortFieldEnum} for what a row with no suggestion
+			* does under `'suggestionConfidence'`.
 			*
-			* **This is an INPUT field, so it does not reach the addon until the
-			* next train.** The hub router validates cap inputs against its own
-			* compiled Zod, which strips a key it does not know — verified today
-			* on the OUTPUT side, where an additive field DOES arrive immediately
-			* (`Track.hasFace`). Until the train ships, sending `false` is
-			* harmless and simply keeps the crops inline.
+			* Cost note: `'timestamp'` is served by the `(deviceId, timestamp)`
+			* index and stops reading as soon as `limit` rows have PASSED the
+			* filter. `'suggestionConfidence'` cannot stop early — the most
+			* certain row may be the oldest — so it walks the window. Narrow it
+			* with {@link since} / {@link until}.
+			*/
+			sortBy: FaceSortFieldEnum.optional(),
+			/** Sort direction for {@link sortBy}. Default `'desc'`. */
+			sortDirection: FaceSortDirectionEnum.optional(),
+			/**
+			* Inline the base64 crop on every row.
+			*
+			* Default `false` since the 2026-08-25 inversion — see
+			* `include-crops-default.ts`, which is the ONE place that resolves
+			* this for every gallery, and which records why the inline shape had
+			* to become the one you ASK for (60 457 ms → UDS timeout at 500 rows).
+			* The doc here used to still say `true`; it was wrong, and a leftover
+			* that describes the old design reads as permission to rely on it.
+			*
+			* Nothing loses its image: the row carries {@link FaceInfo.cropUrl},
+			* which the browser fetches off the `event-media` plane in parallel,
+			* cached and ETagged.
 			*/
 			includeCrops: zod.z.boolean().optional()
 		}).optional(), zod.z.array(FaceInfoSchema).readonly()),
@@ -24155,13 +24347,39 @@ includeCrops: zod.z.boolean().optional() }).optional(), zod.z.array(IdentitySche
 		suggestFaceClusters: require_sleep.method(zod.z.object({
 			threshold: zod.z.number().min(0).max(1).optional(),
 			minClusterSize: zod.z.number().int().min(2).optional(),
-			limit: zod.z.number().int().positive().optional()
-		}).optional(), zod.z.array(zod.z.object({
-			faceIds: zod.z.array(zod.z.string()).readonly(),
-			representativeFaceId: zod.z.string(),
-			size: zod.z.number().int(),
-			cohesion: zod.z.number()
-		})).readonly())
+			/**
+			* Cap on the number of CLUSTERS returned. Renamed from `limit`,
+			* which read as though it bounded the work — it never did.
+			*
+			* Wins over {@link limit} when both are sent.
+			*/
+			maxClusters: zod.z.number().int().positive().optional(),
+			/**
+			* @deprecated Ambiguous name for {@link maxClusters} — it cuts the
+			* RESULT, not the scan. Kept so existing callers keep working; send
+			* `maxClusters` (and, if you care about cost, {@link maxFacesScanned}).
+			*/
+			limit: zod.z.number().int().positive().optional(),
+			/**
+			* Cap on the number of unassigned faces READ AND CLUSTERED — the
+			* POOL, not the result.
+			*
+			* This is the knob {@link maxClusters} was mistaken for. Clustering
+			* used to read every unassigned face on the hub no matter what the
+			* caller asked for, because the only bound cut the finished clusters
+			* afterwards; a UI showing a window of 100 paid for a scan of the
+			* whole corpus, on an addon whose disk is under contention.
+			*
+			* The pool is the NEWEST matching faces first — the same order the
+			* gallery shows — so a bound here shortens the horizon, it does not
+			* sample it randomly.
+			*
+			* Default: 1 000 (`FACE_SWEEP_PAGE`, exactly one store page). Chosen
+			* so the live corpus — 372 face rows — is unaffected while the
+			* unbounded scan can never come back as the table grows.
+			*/
+			maxFacesScanned: zod.z.number().int().positive().optional()
+		}).optional(), zod.z.array(FaceClusterSchema).readonly())
 	}
 };
 //#endregion
@@ -28556,6 +28774,39 @@ var ReadGopBytesResultSchema = zod.z.object({
 	/** Media ms the returned fragment covers. */
 	gopDurMs: zod.z.number()
 });
+/**
+* A time WINDOW of one finalized segment, cut by byte range — the multi-GOP
+* twin of {@link ReadGopBytesResultSchema}'s single instant. Built for the
+* replay clip's `recording` source (`docs/design/plans/2026-08-26-replay-clip-su-pipeline.md`):
+* a replay needs several seconds of native pixels, not one frame.
+*
+* `ok.data` is standalone-demuxable, same as a GOP read. `ok.reachesRequestedEnd`
+* is `false` when the returned bytes were cut short by the read's own safety
+* byte cap before covering `[fromMs, toMs)` — a truncation, reported, not a
+* silently shorter answer. `spans-multiple-segments` is a REFUSAL, not a
+* degradation: a window whose end falls past the covering segment would need
+* bytes stitched from a second segment file (its own `ftyp`+`moov`), which is
+* not one standalone-demuxable stream — the caller's answer is to request a
+* shorter window or one aligned to a single segment, not to receive spliced
+* bytes nothing has proven decodable.
+*/
+var ReadWindowBytesResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("ok"),
+	data: zod.z.instanceof(Uint8Array),
+	/** Absolute epoch ms of the returned bytes' first sample — at or before
+	*  the requested `fromMs` (anchored on the nearest keyframe). */
+	gopStartMs: zod.z.number(),
+	/** Media ms the returned bytes cover, from `gopStartMs`. */
+	gopDurMs: zod.z.number(),
+	/** `false` ⇒ the safety byte cap cut the read short before it reached
+	*  the requested `toMs`; the caller got fewer frames than asked for. */
+	reachesRequestedEnd: zod.z.boolean()
+}), zod.z.object({
+	kind: zod.z.literal("spans-multiple-segments"),
+	/** Where the covering segment's own footage runs out — informational,
+	*  not a retry hint (retrying the same window would refuse again). */
+	segmentEndMs: zod.z.number()
+})]);
 var recordingCapability = {
 	name: "recording",
 	scope: "system",
@@ -28635,6 +28886,21 @@ var recordingCapability = {
 			kind: "query",
 			auth: "admin"
 		}),
+		/** Read a WINDOW `[fromMs, toMs)` of segment `startMs`, by mfra byte
+		*  range — the multi-GOP twin of `readGopBytes`. Refuses (does not
+		*  degrade) when the window runs past the covering segment. Used by the
+		*  replay clip's `recording` source to fetch several seconds of native
+		*  footage for its single ffmpeg decode pass. */
+		readWindowBytes: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			profile: zod.z.string(),
+			startMs: zod.z.number(),
+			fromMs: zod.z.number(),
+			toMs: zod.z.number()
+		}), ReadWindowBytesResultSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
 		setDeviceConfig: require_sleep.method(zod.z.object({
 			deviceId: zod.z.number(),
 			config: RecordingConfigSchema
@@ -30179,6 +30445,213 @@ var SetSiteLocationInputSchema = zod.z.object({
 	latitude: zod.z.number().min(-90).max(90),
 	longitude: zod.z.number().min(-180).max(180)
 }).nullable();
+/**
+* One `(procedure, user-agent, ip, principal)` tuple of the HTTP request
+* census. `principal` is the DERIVED identity (`apocaliss92 (admin)`,
+* `scoped:1a2b3c4d (scoped-token)`, `anonymous`) that the tRPC error log
+* already prints - never a token, never an `Authorization` header.
+*/
+var RequestCensusGroupSchema = zod.z.object({
+	procedure: zod.z.string(),
+	userAgent: zod.z.string(),
+	ip: zod.z.string(),
+	principal: zod.z.string(),
+	calls: zod.z.number(),
+	perMin: zod.z.number()
+});
+/**
+* A procedure's TOTAL over the window, across every caller.
+*
+* This block, not the group list, is what answers "did these calls arrive over
+* HTTP at all". A total far BELOW what a store-side census counted over the
+* same window excludes the HTTP plane, which is a result, not a failure.
+*/
+var RequestCensusProcedureSchema = zod.z.object({
+	procedure: zod.z.string(),
+	calls: zod.z.number(),
+	perMin: zod.z.number()
+});
+/** What one armed window measured. Mirrors `HttpRequestCensus.snapshot()`. */
+var RequestCensusSnapshotSchema = zod.z.object({
+	armed: zod.z.boolean(),
+	/** How long the current - or just-closed - window collected, in ms. */
+	elapsedMs: zod.z.number(),
+	/** The window actually armed, after the server clamped the request. */
+	windowMs: zod.z.number(),
+	/** Epoch ms the window closes at. 0 when disarmed. */
+	armedUntilMs: zod.z.number(),
+	httpRequests: zod.z.number(),
+	batchedRequests: zod.z.number(),
+	/**
+	* Procedure invocations. Higher than `httpRequests` whenever tRPC batching
+	* is in play (`?batch=1` carries several procedures in one request); this is
+	* the number comparable with a store-side call count.
+	*/
+	procedureCalls: zod.z.number(),
+	/**
+	* tRPC WebSocket connections opened during the window. NOT calls - the WS
+	* transport resolves one context per connection - but the number that says
+	* whether a plane this census cannot see was busy while HTTP was quiet.
+	*/
+	wsConnections: zod.z.number(),
+	distinctGroups: zod.z.number(),
+	/** Calls counted in the totals whose group attribution was shed at the
+	*  cardinality bound. */
+	unattributedCalls: zod.z.number(),
+	procedures: zod.z.array(RequestCensusProcedureSchema).readonly(),
+	groups: zod.z.array(RequestCensusGroupSchema).readonly()
+});
+/**
+* The census as an operator sees it.
+*
+* `persisted` is the honest answer to "will this survive the restart I am
+* about to do": the arm deadline is written to `system-settings` so a window
+* armed now can measure the NEXT boot, and a write that failed must not look
+* like one that succeeded.
+*/
+var RequestCensusStatusSchema = RequestCensusSnapshotSchema.extend({ persisted: zod.z.boolean() });
+/** Severity vocabulary. Mirrors `LogLevel` in `interfaces/logging.ts`. */
+var LogLevelSchema$1 = zod.z.enum([
+	"debug",
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* The diagnostics that can be ARMED for a window. Exactly one today.
+*
+* A diagnostic is anything whose cost is only worth paying while a question is
+* open. It never persists as a boolean: see {@link DiagnosticWindowSchema}.
+*/
+var DiagnosticIdSchema = zod.z.enum(["request-census"]);
+/**
+* The layers of the level hierarchy, general → specific. The most specific
+* layer that carries an explicit value wins.
+*
+* `component` is DECLARED and not yet resolvable: the per-component channels
+* are a later slice of the same plan, and a `levelSource` enum that has to
+* grow later would force every consumer of this document to change with it.
+* Nothing returns `component` today.
+*/
+var LoggingScopeKindSchema = zod.z.enum([
+	"cluster",
+	"node",
+	"component"
+]);
+/** Where an effective level came from. `default` = nothing is set anywhere. */
+var LoggingLevelSourceSchema = zod.z.enum([
+	"default",
+	"cluster",
+	"node",
+	"component"
+]);
+/**
+* One layer of the hierarchy as it actually STANDS.
+*
+* `level: null` is the whole reason this array is returned: it is the
+* difference between "this node is at `info` because I decided it" and
+* "...because it inherits". An operator who clears an override believing they
+* are clearing an inherited value has been handed the same defect as the two
+* contradicting knobs this document exists to remove, moved one floor up.
+*/
+var LoggingLevelLayerSchema = zod.z.object({
+	scope: LoggingScopeKindSchema,
+	/** The node this layer speaks for; `null` on the cluster layer. */
+	nodeId: zod.z.string().nullable(),
+	/** Explicitly set here, or `null` when this layer inherits. */
+	level: LogLevelSchema$1.nullable()
+});
+/** What a line is judged against, and WHICH layer decided it. */
+var LoggingEffectiveSchema = zod.z.object({
+	level: LogLevelSchema$1,
+	levelSource: LoggingLevelSourceSchema
+});
+/** Every layer, general → specific. Never collapsed into the effective value. */
+var LoggingExplicitSchema = zod.z.object({ layers: zod.z.array(LoggingLevelLayerSchema).readonly() });
+/**
+* An armed diagnostic, with its DEADLINE.
+*
+* The shape of ADR-0244: what is stored is a deadline and never a flag, so a
+* diagnostic somebody forgot expires by itself, and a boot-window measurement
+* survives the restart it exists to measure. `remainingMs` is 0 whenever
+* `armed` is false — a window is never reported as slightly expired.
+*/
+var DiagnosticWindowSchema = zod.z.object({
+	id: DiagnosticIdSchema,
+	armed: zod.z.boolean(),
+	/** Epoch ms the window closes at. 0 when disarmed. */
+	armedUntilMs: zod.z.number(),
+	/** Ms left before it expires on its own. 0 when disarmed. */
+	remainingMs: zod.z.number(),
+	/** Whether the stored deadline is the one the live diagnostic is running —
+	*  i.e. whether this window would survive a restart. */
+	persisted: zod.z.boolean()
+});
+/**
+* `armMs: 0` DISARMS. Any positive value arms for that long, clamped by the
+* server — there is no maximum here on purpose: a bound repeated in a schema
+* is a second knob that disagrees with the first the day one of them moves.
+*/
+var DiagnosticWindowPatchSchema = zod.z.object({
+	id: DiagnosticIdSchema,
+	armMs: zod.z.number().int().min(0),
+	/** Cadence of the diagnostic's aggregated report line. Clamped by the server. */
+	reportEveryMs: zod.z.number().int().positive().optional()
+});
+/**
+* A PATCH, and patches MERGE.
+*
+* A field absent from the patch is left exactly as it was — arming a
+* diagnostic never resets a level, and setting a level never disarms a window.
+* The provider must not reconstruct the document as `{ ...snapshot, ...patch }`:
+* `setAll` already merges, and rebuilding the object is how an absent field
+* turns into an erased one.
+*/
+var LoggingSettingsPatchSchema = zod.z.object({
+	/**
+	* Absent leaves the level untouched. `null` CLEARS the explicit value at the
+	* addressed scope so it inherits again. A value sets it.
+	*/
+	level: LogLevelSchema$1.nullable().optional(),
+	/**
+	* Only the diagnostics NAMED here change. An armed window that is not listed
+	* keeps running — a patch is never a full replacement.
+	*/
+	diagnostics: zod.z.array(DiagnosticWindowPatchSchema).readonly().optional()
+});
+/**
+* Which LAYER of the hierarchy is addressed. Absent = the cluster layer.
+*
+* Deliberately NOT called `nodeId`: that key is reserved on every cap method
+* input — the generated router strips it and uses it to resolve the PROVIDER
+* on that node (`resolveProvider(cap, nodeId, …)`). A document about
+* `agent-1` addressed as `nodeId` would be forwarded to agent-1 and answered
+* by an agent that holds no cluster document at all. The hub is the single
+* authority over the whole hierarchy and answers for every layer, so the
+* layer selector needs a name the transport does not already own.
+*/
+var GetLoggingSettingsInputSchema = zod.z.object({ scopeNodeId: zod.z.string().optional() });
+var SetLoggingSettingsInputSchema = zod.z.object({
+	scopeNodeId: zod.z.string().optional(),
+	patch: LoggingSettingsPatchSchema
+});
+/**
+* The whole document, as read and as returned after every write.
+*
+* `persisted: false` means the settings store could not be read or written.
+* The in-memory mirror still governs behaviour and is unchanged by the
+* failure — a read that fails neither switches a level nor disarms a window
+* (D49) — but the operator is told that what they are looking at would not
+* survive a restart.
+*/
+var LoggingSettingsStateSchema = zod.z.object({
+	/** The layer this document was read at. `null` = the cluster layer. */
+	scopeNodeId: zod.z.string().nullable(),
+	effective: LoggingEffectiveSchema,
+	explicit: LoggingExplicitSchema,
+	activeWindows: zod.z.array(DiagnosticWindowSchema).readonly(),
+	persisted: zod.z.boolean()
+});
 var systemCapability = {
 	name: "system",
 	scope: "system",
@@ -30222,6 +30695,38 @@ var systemCapability = {
 		detectSiteLocation: require_sleep.method(zod.z.void(), SiteLocationStatusSchema, {
 			kind: "mutation",
 			auth: "admin"
+		}),
+		/**
+		* Read the HTTP request census - which caller, from which address, with
+		* which user-agent, invoked which tRPC procedure, and how often.
+		*
+		* Reading NEVER re-arms: re-arming clears the counts, which would throw
+		* away exactly the numbers being asked for. A closed window may be read as
+		* many times as the operator likes and always describes the same window.
+		*
+		* Admin-only: the rows carry source addresses and principal names.
+		*/
+		getRequestCensus: require_sleep.method(zod.z.void(), RequestCensusStatusSchema, { auth: "admin" }),
+		/**
+		* The logging settings document — levels and armed diagnostics — resolved
+		* for `nodeId`, or for the cluster when `nodeId` is absent.
+		*
+		* Returns BOTH `effective` and `explicit`. See
+		* {@link LoggingLevelLayerSchema} for why collapsing them is the defect.
+		*/
+		getLoggingSettings: require_sleep.method(GetLoggingSettingsInputSchema, LoggingSettingsStateSchema, { auth: "admin" }),
+		/**
+		* Write the logging settings document. The ONLY write authority over log
+		* levels and diagnostic windows — arming the request census went through
+		* `system.setRequestCensus` until 2026-08-27 and no longer does, because
+		* two writes that disagree about the same window is exactly the defect
+		* this document exists to remove (D245).
+		*
+		* The patch MERGES: see {@link LoggingSettingsPatchSchema}.
+		*/
+		setLoggingSettings: require_sleep.method(SetLoggingSettingsInputSchema, LoggingSettingsStateSchema, {
+			kind: "mutation",
+			auth: "admin"
 		})
 	},
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
@@ -31416,6 +31921,172 @@ function stateVocabularyFor(runtimeState, alarmStates = []) {
 	return [];
 }
 //#endregion
+//#region src/catalogs/sensor-active-state.ts
+/**
+* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
+* valutatore puro del suo FRONTE.
+*
+* Viveva dentro il builtin virtual-doorbell
+* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
+* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
+* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
+* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
+* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
+* SPOSTA qui e il doorbell la ri-esporta.
+*
+* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
+* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
+* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
+* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
+*/
+/**
+* Known binary / switch source caps → the boolean slice field whose
+* false→true rise counts as ACTIVE. Every entry is "fire on active".
+* Sensors whose "active" reading is not a plain boolean (presence's string
+* state, connectivity's connected flag) are deliberately excluded — a
+* reconnect is not a doorbell press, and it is not a recording either.
+*/
+var SOURCE_CAP_ACTIVE_FIELD = {
+	contact: "entryOpen",
+	binary: "on",
+	switch: "on",
+	motion: "detected",
+	flood: "flooded",
+	gas: "detected",
+	smoke: "detected",
+	"carbon-monoxide": "detected",
+	vibration: "detected",
+	tamper: "tampered"
+};
+/**
+* The same caps → the slice field carrying the ms-epoch timestamp of the
+* last transition. Every source cap MUST appear here (guarded by a spec):
+* without a transition timestamp the evaluator cannot tell a genuine rise
+* from a boot-time hydration when the FIRST slice it ever sees is already
+* active, and errs towards silence — swallowing the rise.
+*
+* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
+* provider derives them from `state.last_changed`, so they survive our own
+* restarts and correctly read as "hours ago" for a state that has been
+* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
+*/
+var SOURCE_CAP_CHANGED_AT_FIELD = {
+	contact: "lastChangedAt",
+	binary: "lastChangedAt",
+	switch: "lastChangedAt",
+	motion: "lastDetectedAt",
+	flood: "lastChangedAt",
+	gas: "lastChangedAt",
+	smoke: "lastChangedAt",
+	"carbon-monoxide": "lastChangedAt",
+	vibration: "lastChangedAt",
+	tamper: "lastChangedAt"
+};
+/** Cap names whose presence in a device's bindings qualify it as a source. */
+var SOURCE_CAPS = Object.keys(SOURCE_CAP_ACTIVE_FIELD);
+/**
+* Device `type` values (from `DeviceType`) that can host a binary/switch
+* source cap. Used by the camera's `device-multiselect` picker as the
+* CLIENT-SIDE filter, alongside `SOURCE_CAPS`.
+*
+* Why types and not caps alone: the shared picker filters
+* `deviceManager.listAll` rows client-side, and those rows carry only the
+* device's advertised `features` — NOT its registered cap list. On the live
+* cluster binary sensors and switches advertise EMPTY features (features
+* mirror only a handful of caps like `motion-trigger`), so a caps-only
+* filter matched against `features` would list nothing (the very bug this
+* replaced, which relied on the now-empty `getAllBindings`). Matching by
+* `type` is the reliable client-side signal; the union with `SOURCE_CAPS`
+* still captures any device that DOES advertise a source-cap feature.
+* `sensor` covers contact/motion/flood/gas/smoke/CO/vibration/tamper,
+* `switch` covers switches, `control` covers generic binary actuators.
+*/
+var SOURCE_DEVICE_TYPES = [
+	"sensor",
+	"switch",
+	"control"
+];
+/** True when a cap is a recognised binary/switch source. */
+function isSourceCap(capName) {
+	return Object.prototype.hasOwnProperty.call(SOURCE_CAP_ACTIVE_FIELD, capName);
+}
+/** Extract the "active" boolean a source cap's slice carries, or null when
+*  the cap is unknown or the field is missing / non-boolean. */
+function sliceActiveValue(capName, slice) {
+	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	return typeof raw === "boolean" ? raw : null;
+}
+/** Ms-epoch transition timestamp a source cap's slice carries, or null when
+*  it is absent, non-numeric or the zero "never observed" sentinel. */
+function sliceChangedAt(capName, slice) {
+	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
+	return raw;
+}
+/**
+* How recent a source's own transition timestamp must be for a FIRST
+* sighting that is already active to count as a genuine rise rather than a
+* hydration of long-standing state.
+*/
+var DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = 3e4;
+/**
+* IL fronte. Puro: nessun orologio proprio, nessuna memoria — il chiamante
+* porta `prior`, `nowMs` e il proprio `startedAtMs`.
+*
+* Il caso della PRIMA slice già attiva è trattato esplicitamente e vale come
+* fronte solo se il timestamp UPSTREAM della transizione è posteriore a
+* `startedAtMs` **e** entro `firstSightingFreshnessMs`. Entrambe le metà
+* servono: la sola freschezza scatterebbe su un'idratazione al boot di uno
+* stato flippato pochi secondi prima del riavvio, e il solo "dopo che abbiamo
+* iniziato" scatterebbe, su un processo di lunga vita, per una sorgente
+* adottata oggi il cui stato è cambiato ieri. Il caso ambiguo ERRA VERSO IL
+* SILENZIO e lo dichiara (`baseline-seeded-stale-active`).
+*/
+function evaluateSensorEdge(input) {
+	const value = sliceActiveValue(input.capName, input.slice);
+	if (value === null) return {
+		edge: "none",
+		value: null,
+		reason: isSourceCap(input.capName) ? "non-boolean-value" : "unknown-cap"
+	};
+	if (input.prior === void 0) {
+		if (!value) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-inactive"
+		};
+		const changedAt = sliceChangedAt(input.capName, input.slice);
+		const floor = Math.max(input.startedAtMs, input.nowMs - input.firstSightingFreshnessMs);
+		if (changedAt === null || changedAt < floor) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-stale-active"
+		};
+		return {
+			edge: "rising",
+			value: true
+		};
+	}
+	if (input.prior === value) return {
+		edge: "none",
+		value,
+		reason: "no-change"
+	};
+	if (!value) return {
+		edge: "none",
+		value,
+		reason: "falling-edge"
+	};
+	return {
+		edge: "rising",
+		value: true
+	};
+}
+//#endregion
 //#region src/constants.ts
 var HF_REPO = "camstack/camstack-models";
 var HF_BASE_URL = `https://huggingface.co/${HF_REPO}/resolve/main`;
@@ -32577,6 +33248,47 @@ var BaseDeviceProvider = class extends require_sleep.BaseAddon {
 	}
 };
 //#endregion
+//#region src/device/battery-presence.ts
+/**
+* Default silence budget before a sleeping battery camera is called gone.
+*
+* Sized off the mechanism that produces contact, not off taste: a battery cam
+* on this deployment surfaces a firmware push (battery level, sleep/wake, or a
+* motion email) on the order of hours even with no visitors, and the snapshot
+* wrapper's own battery window is 1 hour. Six hours is therefore several
+* missed opportunities, not one — so a single quiet night does not raise a
+* fault, and a genuinely flat camera is named well inside a day.
+*/
+var BATTERY_UNREACHABLE_AFTER_MS = 360 * 6e4;
+/**
+* THE derivation. One crop rectangle, one presence verdict — see D52 for why
+* this repo insists a derived value has exactly one implementation.
+*
+* `undefined` status ⇒ `sleeping`. A device with no slice has made no claim,
+* and the caller decides separately whether it is even battery-operated
+* (`DeviceFeature.BatteryOperated`); this function never answers that
+* question, only what a battery device is doing.
+*/
+function deriveBatteryPresence(input) {
+	const status = input.status;
+	if (!status) return "sleeping";
+	if (status.sleeping !== true) return "awake";
+	const lastContactAt = status.lastContactAt;
+	if (typeof lastContactAt !== "number" || lastContactAt <= 0) return "sleeping";
+	const budget = input.unreachableAfterMs ?? 216e5;
+	return input.nowMs - lastContactAt > budget ? "unreachable" : "sleeping";
+}
+/**
+* Is this presence a FAULT the operator should be told about?
+*
+* Exists so no surface has to re-decide it — the whole point of the third
+* state is that `sleeping` stops being rendered as breakage, and a caller that
+* writes `presence !== 'awake'` has silently undone that.
+*/
+function isBatteryPresenceFault(presence) {
+	return presence === "unreachable";
+}
+//#endregion
 //#region src/device/declared-device.ts
 /** Marker written to a declared integration's `info`. */
 var DECLARED_INTEGRATION_FIXED_KEY = "fixed";
@@ -33043,47 +33755,6 @@ function resolveDeviceProfile(features) {
 	return null;
 }
 //#endregion
-//#region src/device/battery-presence.ts
-/**
-* Default silence budget before a sleeping battery camera is called gone.
-*
-* Sized off the mechanism that produces contact, not off taste: a battery cam
-* on this deployment surfaces a firmware push (battery level, sleep/wake, or a
-* motion email) on the order of hours even with no visitors, and the snapshot
-* wrapper's own battery window is 1 hour. Six hours is therefore several
-* missed opportunities, not one — so a single quiet night does not raise a
-* fault, and a genuinely flat camera is named well inside a day.
-*/
-var BATTERY_UNREACHABLE_AFTER_MS = 360 * 6e4;
-/**
-* THE derivation. One crop rectangle, one presence verdict — see D52 for why
-* this repo insists a derived value has exactly one implementation.
-*
-* `undefined` status ⇒ `sleeping`. A device with no slice has made no claim,
-* and the caller decides separately whether it is even battery-operated
-* (`DeviceFeature.BatteryOperated`); this function never answers that
-* question, only what a battery device is doing.
-*/
-function deriveBatteryPresence(input) {
-	const status = input.status;
-	if (!status) return "sleeping";
-	if (status.sleeping !== true) return "awake";
-	const lastContactAt = status.lastContactAt;
-	if (typeof lastContactAt !== "number" || lastContactAt <= 0) return "sleeping";
-	const budget = input.unreachableAfterMs ?? 216e5;
-	return input.nowMs - lastContactAt > budget ? "unreachable" : "sleeping";
-}
-/**
-* Is this presence a FAULT the operator should be told about?
-*
-* Exists so no surface has to re-decide it — the whole point of the third
-* state is that `sleeping` stops being rendered as breakage, and a caller that
-* writes `presence !== 'awake'` has silently undone that.
-*/
-function isBatteryPresenceFault(presence) {
-	return presence === "unreachable";
-}
-//#endregion
 //#region src/device/path-util.ts
 /** Returns true when `x` is a non-null, non-array plain object. */
 function isRecord(x) {
@@ -38111,6 +38782,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.resolveArtifactUrl": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.setAlarmConfig": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -39515,6 +40192,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.readWindowBytes": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.refreshStorageLocationsForMigration": {
 		capName: "recording",
 		capScope: "system",
@@ -40355,6 +41038,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.getLoggingSettings": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"system.getRequestCensus": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"system.getRetentionConfig": {
 		capName: "system",
 		capScope: "system",
@@ -40385,6 +41080,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"system.setLoggingSettings": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"system.setRetentionConfig": {
 		capName: "system",
 		capScope: "system",
@@ -41797,6 +42498,10 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		name: "deviceId",
 		form: "single",
 		optional: true
+	}, {
+		name: "deviceIds",
+		form: "array",
+		optional: true
 	}],
 	"fanControl.setDirection": [{
 		name: "deviceId",
@@ -42602,6 +43307,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"recording.readWindowBytes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"recording.relocateFootage": [{
 		name: "deviceId",
 		form: "single",
@@ -43080,6 +43790,7 @@ var SYSTEM_SCOPE_DEVICE_METHODS = [
 	"recording.pruneFootage",
 	"recording.readGopBytes",
 	"recording.readSegmentBytes",
+	"recording.readWindowBytes",
 	"recording.relocateFootage",
 	"recording.renderClip",
 	"recording.renderGif",
@@ -44108,7 +44819,10 @@ function createSystemProxy(api) {
 			forceRetentionCleanup: (input) => dispatch("system", "forceRetentionCleanup", "mutation", input),
 			getSiteLocation: (input) => dispatch("system", "getSiteLocation", "query", input),
 			setSiteLocation: (input) => dispatch("system", "setSiteLocation", "mutation", input),
-			detectSiteLocation: (input) => dispatch("system", "detectSiteLocation", "mutation", input)
+			detectSiteLocation: (input) => dispatch("system", "detectSiteLocation", "mutation", input),
+			getRequestCensus: (input) => dispatch("system", "getRequestCensus", "query", input),
+			getLoggingSettings: (input) => dispatch("system", "getLoggingSettings", "query", input),
+			setLoggingSettings: (input) => dispatch("system", "setLoggingSettings", "mutation", input)
 		},
 		terminalSession: {
 			listProfiles: (input) => dispatch("terminalSession", "listProfiles", "query", input),
@@ -45971,6 +46685,7 @@ var NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
 var NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
 var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
 var NATIVE_LEASE_TILE_BUDGET_KEY = "nativeTileBudgetMb";
+var NATIVE_LEASE_SCENE_BUDGET_KEY = "nativeSceneBudgetMb";
 /**
 * WHICH delivered frames the decode worker retains a native copy of.
 *
@@ -46065,7 +46780,38 @@ var NativeLeaseSettingsSchema = zod.z.object({
 	* fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
 	* reproduce that.
 	*/
-	tileBudgetMb: zod.z.number().int().min(0).max(1024)
+	tileBudgetMb: zod.z.number().int().min(0).max(1024),
+	/**
+	* RAM ceiling per decode worker, in MB, for the SCENE TILES — one
+	* JPEG-encoded copy of the WHOLE native frame, cut in the same instant as the
+	* subject tiles, on frames that detected something.
+	*
+	* It exists because a subject tile cannot answer a FULL-FRAME request:
+	* containment is strict by design, so the native `keyFrame`, the detail
+	* plane's `frameJpeg` rung and the display-crop fallback had no rung at all
+	* below the hold. Measured on the live cluster: 23.3% of key-frame captures
+	* missed, 95.7% of them with `worker-lease-gone` — the raster released one
+	* frame-time after delivery, with the request only p50 367 ms behind it.
+	*
+	* Sizing, and why this is a budget and not a duration: a scene tile is
+	* ~1.5-2.5 MB at 4K (against ~23.75 MB for the raster it was cut from and
+	* ~60-120 KB for a subject tile), and it is cut ~0.4 times a second per busy
+	* camera — only detection-bearing frames get one. 48 MB is therefore ~20-30
+	* frames, i.e. the store's 30 s TTL binds at the steady state and the budget
+	* binds only through a detection burst, where it still covers well past the
+	* measured p90 ask age of 4.3 s. Holding the RASTERS for the same window
+	* would be ~498 MB per camera and ~6 GB at peak concurrency — the OOM this
+	* whole shape exists to avoid.
+	*
+	* A SEPARATE ceiling from `tileBudgetMb` on purpose: a scene tile is ~20× a
+	* subject tile, so one shared budget would let a busy camera's key frames
+	* evict the face/plate tiles the recognisers depend on. Two budgets make that
+	* impossible rather than unlikely. `0` DISABLES scene tiles and restores the
+	* pre-existing behaviour, where a late full-frame request had nothing but the
+	* ≤640 RAM raster — which the `keyFrame` gate rejects, so in practice it had
+	* nothing.
+	*/
+	sceneBudgetMb: zod.z.number().int().min(0).max(1024)
 });
 /**
 * The values in force when the operator has set nothing.
@@ -46081,6 +46827,7 @@ var DEFAULT_NATIVE_LEASE_SETTINGS = {
 	budgetMb: 1024,
 	activityMs: 15e3,
 	tileBudgetMb: 64,
+	sceneBudgetMb: 48,
 	admission: "inferred"
 };
 /** Slider bounds for the operator-facing knobs (orchestrator settings UI). */
@@ -46108,6 +46855,12 @@ var NATIVE_LEASE_TILE_BUDGET_FIELD = {
 	step: 16,
 	default: DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb
 };
+var NATIVE_LEASE_SCENE_BUDGET_FIELD = {
+	min: 0,
+	max: 1024,
+	step: 16,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.sceneBudgetMb
+};
 /** Select options for the admission knob (orchestrator settings UI). */
 var NATIVE_LEASE_ADMISSION_FIELD = {
 	options: [{
@@ -46166,12 +46919,14 @@ function readNativeLeaseOverride(config) {
 	const activityMs = readKnob("activityMs", config[NATIVE_LEASE_ACTIVITY_KEY]);
 	const admission = readAdmissionKnob(config[NATIVE_LEASE_ADMISSION_KEY]);
 	const tileBudgetMb = readKnob("tileBudgetMb", config[NATIVE_LEASE_TILE_BUDGET_KEY]);
+	const sceneBudgetMb = readKnob("sceneBudgetMb", config[NATIVE_LEASE_SCENE_BUDGET_KEY]);
 	return {
 		...holdFrames === null ? {} : { holdFrames },
 		...budgetMb === null ? {} : { budgetMb },
 		...activityMs === null ? {} : { activityMs },
 		...admission === null ? {} : { admission },
-		...tileBudgetMb === null ? {} : { tileBudgetMb }
+		...tileBudgetMb === null ? {} : { tileBudgetMb },
+		...sceneBudgetMb === null ? {} : { sceneBudgetMb }
 	};
 }
 function isHydratedField(entry) {
@@ -46182,7 +46937,8 @@ var LEASE_KEYS = [
 	NATIVE_LEASE_BUDGET_KEY,
 	NATIVE_LEASE_ACTIVITY_KEY,
 	NATIVE_LEASE_ADMISSION_KEY,
-	NATIVE_LEASE_TILE_BUDGET_KEY
+	NATIVE_LEASE_TILE_BUDGET_KEY,
+	NATIVE_LEASE_SCENE_BUDGET_KEY
 ];
 /**
 * Extract the operator's lease overrides from an
@@ -48274,6 +49030,7 @@ exports.DEFAULT_DETAIL_CROP_CONVENTION = DEFAULT_DETAIL_CROP_CONVENTION;
 exports.DEFAULT_EVENTS_BAND_BUFFER_SEC = DEFAULT_EVENTS_BAND_BUFFER_SEC;
 exports.DEFAULT_EVENT_COLOR = DEFAULT_EVENT_COLOR;
 exports.DEFAULT_FEATURES = DEFAULT_FEATURES;
+exports.DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = DEFAULT_FIRST_SIGHTING_FRESHNESS_MS;
 exports.DEFAULT_MIN_LANDMARK_FACE_SIZE_PX = DEFAULT_MIN_LANDMARK_FACE_SIZE_PX;
 exports.DEFAULT_NATIVE_LEASE_SETTINGS = DEFAULT_NATIVE_LEASE_SETTINGS;
 exports.DEFAULT_POOL_MEMORY_POLICY = DEFAULT_POOL_MEMORY_POLICY;
@@ -48324,6 +49081,9 @@ exports.DeviceRuntimeState = DeviceRuntimeState;
 exports.DeviceSelectorSchema = DeviceSelectorSchema;
 exports.DeviceStatusSchema = DeviceStatusSchema;
 exports.DeviceType = require_sleep.DeviceType;
+exports.DiagnosticIdSchema = DiagnosticIdSchema;
+exports.DiagnosticWindowPatchSchema = DiagnosticWindowPatchSchema;
+exports.DiagnosticWindowSchema = DiagnosticWindowSchema;
 exports.DiscoveredChildDeviceSchema = DiscoveredChildDeviceSchema;
 exports.DiscoveredChildStatusSchema = DiscoveredChildStatusSchema;
 exports.DiscoveredDeviceSchema = DiscoveredDeviceSchema;
@@ -48388,6 +49148,7 @@ exports.ExpressionGlobalBindingSchema = ExpressionGlobalBindingSchema;
 exports.ExpressionLiteralBindingSchema = ExpressionLiteralBindingSchema;
 exports.ExpressionParseError = ExpressionParseError;
 exports.ExpressionSourceSchema = ExpressionSourceSchema;
+exports.FIRST_LEVEL_MACRO_CLASSES = FIRST_LEVEL_MACRO_CLASSES;
 exports.FULL_IMAGE_BBOX = FULL_IMAGE_BBOX;
 exports.FanControlStatusSchema = FanControlStatusSchema;
 exports.FanDirectionSchema = FanDirectionSchema;
@@ -48401,6 +49162,7 @@ exports.FrameInputSchema = FrameInputSchema;
 exports.FrameLazyCountersSchema = FrameLazyCountersSchema;
 exports.FrameLazyMetricsSchema = FrameLazyMetricsSchema;
 exports.GasStatusSchema = GasStatusSchema;
+exports.GetLoggingSettingsInputSchema = GetLoggingSettingsInputSchema;
 exports.GetStreamWithCodecInputSchema = GetStreamWithCodecInputSchema;
 exports.GlobalMetricsSchema = GlobalMetricsSchema;
 exports.HAP_AUDIO_BASE = HAP_AUDIO_BASE;
@@ -48472,6 +49234,13 @@ exports.LockStateSchema = LockStateSchema;
 exports.LogEntrySchema = LogEntrySchema;
 exports.LogLevelSchema = LogLevelSchema;
 exports.LogStreamEntrySchema = LogStreamEntrySchema;
+exports.LoggingEffectiveSchema = LoggingEffectiveSchema;
+exports.LoggingExplicitSchema = LoggingExplicitSchema;
+exports.LoggingLevelLayerSchema = LoggingLevelLayerSchema;
+exports.LoggingLevelSourceSchema = LoggingLevelSourceSchema;
+exports.LoggingScopeKindSchema = LoggingScopeKindSchema;
+exports.LoggingSettingsPatchSchema = LoggingSettingsPatchSchema;
+exports.LoggingSettingsStateSchema = LoggingSettingsStateSchema;
 exports.LoginMethodContributionSchema = LoginMethodContributionSchema;
 exports.LoginStageEnum = LoginStageEnum;
 exports.MACRO_LABELS = MACRO_LABELS;
@@ -48484,6 +49253,7 @@ exports.MAX_EXPRESSION_BINDINGS = MAX_EXPRESSION_BINDINGS;
 exports.MAX_EXPRESSION_CALL_ARGS = MAX_EXPRESSION_CALL_ARGS;
 exports.MAX_EXPRESSION_EVAL_STEPS = MAX_EXPRESSION_EVAL_STEPS;
 exports.MAX_EXPRESSION_SOURCE_LENGTH = MAX_EXPRESSION_SOURCE_LENGTH;
+exports.MAX_SENSOR_TRIGGER_DEVICES = MAX_SENSOR_TRIGGER_DEVICES;
 exports.METHOD_ACCESS_MAP = METHOD_ACCESS_MAP;
 exports.METHOD_DEVICE_SELECTORS = METHOD_DEVICE_SELECTORS;
 exports.MODEL_FORMATS = MODEL_FORMATS;
@@ -48544,6 +49314,8 @@ exports.NATIVE_LEASE_BUDGET_FIELD = NATIVE_LEASE_BUDGET_FIELD;
 exports.NATIVE_LEASE_BUDGET_KEY = NATIVE_LEASE_BUDGET_KEY;
 exports.NATIVE_LEASE_HOLD_FIELD = NATIVE_LEASE_HOLD_FIELD;
 exports.NATIVE_LEASE_HOLD_KEY = NATIVE_LEASE_HOLD_KEY;
+exports.NATIVE_LEASE_SCENE_BUDGET_FIELD = NATIVE_LEASE_SCENE_BUDGET_FIELD;
+exports.NATIVE_LEASE_SCENE_BUDGET_KEY = NATIVE_LEASE_SCENE_BUDGET_KEY;
 exports.NATIVE_LEASE_SECTION_ID = NATIVE_LEASE_SECTION_ID;
 exports.NATIVE_LEASE_TILE_BUDGET_FIELD = NATIVE_LEASE_TILE_BUDGET_FIELD;
 exports.NATIVE_LEASE_TILE_BUDGET_KEY = NATIVE_LEASE_TILE_BUDGET_KEY;
@@ -48736,6 +49508,7 @@ exports.RUNTIME_TO_FORMAT = RUNTIME_TO_FORMAT;
 exports.RawStateResultSchema = require_sleep.RawStateResultSchema;
 exports.ReadGopBytesResultSchema = ReadGopBytesResultSchema;
 exports.ReadSegmentBytesResultSchema = ReadSegmentBytesResultSchema;
+exports.ReadWindowBytesResultSchema = ReadWindowBytesResultSchema;
 exports.ReadinessRegistry = require_sleep.ReadinessRegistry;
 exports.ReadinessTimeoutError = require_sleep.ReadinessTimeoutError;
 exports.RecentTracksPageSchema = RecentTracksPageSchema;
@@ -48749,6 +49522,7 @@ exports.RecordingDaysSchema = RecordingDaysSchema;
 exports.RecordingDeviceUsageSchema = RecordingDeviceUsageSchema;
 exports.RecordingLocationUsageSchema = RecordingLocationUsageSchema;
 exports.RecordingManifestSchema = RecordingManifestSchema;
+exports.RecordingObjectTriggerClassSchema = RecordingObjectTriggerClassSchema;
 exports.RecordingRangeSchema = RecordingRangeSchema;
 exports.RecordingRebalanceInputSchema = RecordingRebalanceInputSchema;
 exports.RecordingRebalanceMoveSchema = RecordingRebalanceMoveSchema;
@@ -48769,6 +49543,10 @@ exports.RelocateJobStateSchema = RelocateJobStateSchema;
 exports.RelocateMediaInputSchema = RelocateMediaInputSchema;
 exports.RenderedAsSchema = RenderedAsSchema;
 exports.ReportMotionInputSchema = ReportMotionInputSchema;
+exports.RequestCensusGroupSchema = RequestCensusGroupSchema;
+exports.RequestCensusProcedureSchema = RequestCensusProcedureSchema;
+exports.RequestCensusSnapshotSchema = RequestCensusSnapshotSchema;
+exports.RequestCensusStatusSchema = RequestCensusStatusSchema;
 exports.RetrainAnnotationDraftSchema = RetrainAnnotationDraftSchema;
 exports.RetrainAnnotationKindSchema = RetrainAnnotationKindSchema;
 exports.RetrainAnnotationSchema = RetrainAnnotationSchema;
@@ -48806,6 +49584,10 @@ exports.SCENE_RESET_RECAPTURES = SCENE_RESET_RECAPTURES;
 exports.SCOPE_PRESETS = SCOPE_PRESETS;
 exports.SENSOR_FEATURES = SENSOR_FEATURES;
 exports.SENSOR_MAP = SENSOR_MAP;
+exports.SOURCE_CAPS = SOURCE_CAPS;
+exports.SOURCE_CAP_ACTIVE_FIELD = SOURCE_CAP_ACTIVE_FIELD;
+exports.SOURCE_CAP_CHANGED_AT_FIELD = SOURCE_CAP_CHANGED_AT_FIELD;
+exports.SOURCE_DEVICE_TYPES = SOURCE_DEVICE_TYPES;
 exports.SOURCE_INFO_METADATA_KEY = SOURCE_INFO_METADATA_KEY;
 exports.STREAM_PROFILE_META = STREAM_PROFILE_META;
 exports.STREAM_QUALITY_LABELS = STREAM_QUALITY_LABELS;
@@ -48837,6 +49619,7 @@ exports.ServerRollbackInfoSchema = ServerRollbackInfoSchema;
 exports.ServerUpdateActionResultSchema = ServerUpdateActionResultSchema;
 exports.ServerUpdateCheckResultSchema = ServerUpdateCheckResultSchema;
 exports.ServerUpdateStateSchema = ServerUpdateStateSchema;
+exports.SetLoggingSettingsInputSchema = SetLoggingSettingsInputSchema;
 exports.SetSiteLocationInputSchema = SetSiteLocationInputSchema;
 exports.SettingsPatchSchema = SettingsPatchSchema;
 exports.SettingsRecordSchema = SettingsRecordSchema;
@@ -49142,6 +49925,7 @@ exports.errMsg = require_err_msg.errMsg;
 exports.evaluateAst = evaluateAst;
 exports.evaluateExpressionSource = evaluateExpressionSource;
 exports.evaluatePoolMemory = evaluatePoolMemory;
+exports.evaluateSensorEdge = evaluateSensorEdge;
 exports.evaluateZoneRules = evaluateZoneRules;
 exports.event = require_sleep.event;
 exports.eventEmitterCapability = eventEmitterCapability;
@@ -49189,6 +49973,7 @@ exports.isDetectionMacroClass = isDetectionMacroClass;
 exports.isDeviceConfigCap = require_sleep.isDeviceConfigCap;
 exports.isDeviceScopedCap = require_sleep.isDeviceScopedCap;
 exports.isEvent = require_sleep.isEvent;
+exports.isFirstLevelMacroClass = isFirstLevelMacroClass;
 exports.isIsolatedBuiltin = isIsolatedBuiltin;
 exports.isNode = isNode;
 exports.isObjectInput = isObjectInput;
@@ -49197,6 +49982,7 @@ exports.isRestoredCap = isRestoredCap;
 exports.isSameAddonId = isSameAddonId;
 exports.isScheduleActive = isScheduleActive;
 exports.isSoftwareDecode = require_canonical_hash.isSoftwareDecode;
+exports.isSourceCap = isSourceCap;
 exports.isSystemDelivery = isSystemDelivery;
 exports.isVoidInput = isVoidInput;
 exports.jobKindSchema = jobKindSchema;
@@ -49350,6 +50136,8 @@ exports.setByPath = setByPath;
 exports.settingsStoreCapability = settingsStoreCapability;
 exports.sleep = require_sleep.sleep;
 exports.sleepCancellable = require_sleep.sleepCancellable;
+exports.sliceActiveValue = sliceActiveValue;
+exports.sliceChangedAt = sliceChangedAt;
 exports.smokeCapability = smokeCapability;
 exports.smtpProviderCapability = smtpProviderCapability;
 exports.snapshotCapability = snapshotCapability;