camstack 1.2.45 → 1.2.47

package/dist/{chunk-3WS4SP46.js → chunk-AOLS4UFV.js}

@@ -14522,7 +14522,7 @@ function date4(params) {
 // ../../node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../types/dist/sleep-DJlqY62B.mjs
+// ../types/dist/sleep-CdbM8ge4.mjs
 var WELL_KNOWN_TABS = [
   {
     id: "overview",
@@ -15603,6 +15603,28 @@ var OpsLogQueryInputSchema = external_exports.object({
   /** Max rows returned, newest-first. */
   limit: external_exports.number().int().min(1).max(1e3).optional()
 });
+var LabelDefinitionSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  category: external_exports.string().optional(),
+  description: external_exports.string().optional(),
+  icon: external_exports.string().optional()
+});
+var CLASS_MAP_MACRO_TARGETS = [
+  "person",
+  "vehicle",
+  "animal",
+  "package"
+];
+var FIRST_LEVEL_MACRO_CLASSES = [
+  "person",
+  "vehicle",
+  "animal"
+];
+var DetectionCatalogClassMapSchema = external_exports.object({
+  mapping: external_exports.record(external_exports.string(), external_exports.enum(CLASS_MAP_MACRO_TARGETS)),
+  preserveOriginal: external_exports.boolean()
+});
 var RecordingWeekdaySchema = external_exports.number().int().min(0).max(6);
 var HHMM = /^([01]\d|2[0-3]):[0-5]\d$/;
 var RecordingStorageModeSchema = external_exports.enum([
@@ -15610,9 +15632,42 @@ var RecordingStorageModeSchema = external_exports.enum([
   "events",
   "continuous"
 ]);
+var RecordingObjectTriggerClassSchema = external_exports.enum(FIRST_LEVEL_MACRO_CLASSES);
+var noDuplicates = (values) => new Set(values).size === values.length;
 var RecordingTriggersSchema = external_exports.object({
   motion: external_exports.boolean().optional(),
-  audioThresholdDbfs: external_exports.number().optional()
+  audioThresholdDbfs: external_exports.number().optional(),
+  /**
+  * Le macro classi la cui detection apre una finestra. ASSENTE = la sorgente
+  * non è ascoltata; un array VUOTO è rifiutato, perché "banda events, trigger
+  * object acceso, nessuna classe" è la stessa forma "abilitata e non registra
+  * nulla, per sempre" contro cui è scritto `eventsBandCanEverDemand`.
+  *
+  * Il segnale letto è GIÀ FILTRATO: solo detection `source: 'pipeline'`, cioè
+  * quelle che hanno attraversato `enabledMacroClasses`, i
+  * `minConfidence<Macro>` e il full-frame guard. L'AI a bordo camera
+  * (`source: 'onboard'`) non attraversa nessuno di quei gate e NON apre
+  * finestre — vedi `recorder/object-trigger.ts`.
+  */
+  objectClasses: external_exports.array(RecordingObjectTriggerClassSchema).min(1).refine(noDuplicates, { message: "objectClasses must not repeat a class" }).optional(),
+  /**
+  * I device LINKED il cui FRONTE ALTO apre una finestra. Assente = la sorgente
+  * non è ascoltata; un array vuoto è rifiutato per la stessa ragione di
+  * `objectClasses`.
+  *
+  * Sono id di device SORGENTE, non camere: la banda li nomina, quindi il
+  * percorso caldo (`DeviceStateChanged`, a ritmo di bus su tutta la flotta)
+  * non fa RPC. L'OFFERTA da cui l'operatore li sceglie è un'altra domanda, e
+  * si risolve con `deviceManager.getLinkedDevices` + `getBindingsBatch` per
+  * device (D12) — mai un elenco globale di cap.
+  *
+  * Cosa vuol dire "alto" dipende dal TIPO di device e non è deciso qui:
+  * `SOURCE_CAP_ACTIVE_FIELD` (`catalogs/sensor-active-state.ts`) è LA tabella,
+  * la stessa che il virtual-doorbell usa dal 2026-08-05. Ed è il FRONTE, non
+  * il livello: un contatto trovato già aperto al riavvio del runner non fa
+  * registrare.
+  */
+  sensorDeviceIds: external_exports.array(external_exports.number().int().positive()).min(1).max(16).refine(noDuplicates, { message: "sensorDeviceIds must not repeat a device" }).optional()
 });
 var RecordingBandModeSchema = external_exports.enum(["continuous", "events"]);
 var RecordingBandTriggersSchema = RecordingTriggersSchema;
@@ -15929,23 +15984,6 @@ var DecoderSessionConfigSchema = external_exports.object({
   */
   debug: external_exports.boolean().optional()
 });
-var LabelDefinitionSchema = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  category: external_exports.string().optional(),
-  description: external_exports.string().optional(),
-  icon: external_exports.string().optional()
-});
-var CLASS_MAP_MACRO_TARGETS = [
-  "person",
-  "vehicle",
-  "animal",
-  "package"
-];
-var DetectionCatalogClassMapSchema = external_exports.object({
-  mapping: external_exports.record(external_exports.string(), external_exports.enum(CLASS_MAP_MACRO_TARGETS)),
-  preserveOriginal: external_exports.boolean()
-});
 var MODEL_FORMATS = [
   "onnx",
   "coreml",
@@ -23694,7 +23732,23 @@ var NcHistoryEntrySchema = external_exports.object({
   updatedAt: external_exports.number(),
   /** Failure detail — present on a `dead` row. */
   error: external_exports.string().optional(),
-  subject: NcHistorySubjectSchema
+  subject: NcHistorySubjectSchema,
+  /**
+  * Ids of the artefacts (still, then gif, then clip) this row's successful
+  * delivery indexed in the artefact library — a REFERENCE, never the bytes
+  * (an artefact is often megabytes; this row is durable JSON rewritten on
+  * every delivery attempt). Absent on a row still pending/dead, a row
+  * delivered before this field shipped, or a wiring with no artefact index.
+  *
+  * Resolve one to a fetchable URL with `resolveArtifactUrl` — an id
+  * outlives any one URL's TTL, so a caller mints a fresh link on demand
+  * rather than trusting one frozen at delivery time. `resolveArtifactUrl`
+  * also answers `null` for an id whose artefact has since expired past the
+  * retained shelf's own age bound — the degrade a caller (the Home
+  * Assistant export) must render as "no image right now", never as a
+  * broken link.
+  */
+  artifactIds: external_exports.array(external_exports.string().min(1)).optional()
 });
 var NcHistoryFilterSchema = external_exports.object({
   ruleId: external_exports.string().optional(),
@@ -23940,6 +23994,20 @@ var notificationRulesCapability = {
     */
     getHistory: method(external_exports.object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), external_exports.object({ entries: external_exports.array(NcHistoryEntrySchema) }), { auth: "admin" }),
     /**
+    * Mint a fresh, externally-reachable URL for one artefact a history row
+    * named in {@link NcHistoryEntrySchema.shape.artifactIds} — the SAME
+    * signed-link mechanism the dispatcher uses to attach media to an
+    * outgoing notification (one derivation; this never re-implements it).
+    *
+    * `url: null` on THREE causes a caller must treat identically ("no image
+    * right now", never a broken link): the id is unknown, its artefact has
+    * expired past the retained shelf's own age bound, or this install has no
+    * externally-reachable base URL. A caller that received a URL on a
+    * previous call and now gets `null` must stop showing it — a link that
+    * worked five minutes ago is not proof it works now.
+    */
+    resolveArtifactUrl: method(external_exports.object({ artifactId: external_exports.string().min(1) }), external_exports.object({ url: external_exports.string().nullable() }), { auth: "admin" }),
+    /**
     * Snooze windows currently in effect, plus any whose digest has not yet
     * gone out. `caller: 'required'`: a user sees their OWN windows and the
     * global ones that silence them, never another person's private silence.
@@ -29804,7 +29872,7 @@ var lifecycleJobSchema = external_exports.object({
   state: lifecycleJobStateSchema,
   schemaVersion: external_exports.literal(1)
 });
-var LogLevelSchema$1 = external_exports.enum([
+var LogLevelSchema$2 = external_exports.enum([
   "debug",
   "info",
   "warn",
@@ -30004,7 +30072,7 @@ var addonsCapability = {
     getLogs: method(external_exports.object({
       addonId: external_exports.string(),
       limit: external_exports.number().min(1).max(500).default(100),
-      level: LogLevelSchema$1.optional()
+      level: LogLevelSchema$2.optional()
     }), external_exports.array(LogQueryEntrySchema)),
     listPackages: method(external_exports.void(), external_exports.array(InstalledPackageSchema).readonly()),
     installPackage: method(external_exports.object({
@@ -30242,7 +30310,7 @@ var addonsCapability = {
     }),
     onAddonLogs: method(external_exports.object({
       addonId: external_exports.string(),
-      level: LogLevelSchema$1.optional()
+      level: LogLevelSchema$2.optional()
     }), LogStreamEntrySchema, { kind: "subscription" })
   },
   /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
@@ -31701,6 +31769,14 @@ var FaceFilterEnum = external_exports.enum([
   "identified",
   "all"
 ]);
+var FaceSortFieldEnum = external_exports.enum(["timestamp", "suggestionConfidence"]);
+var FaceSortDirectionEnum = external_exports.enum(["asc", "desc"]);
+var FaceClusterSchema = external_exports.object({
+  faceIds: external_exports.array(external_exports.string()).readonly(),
+  representativeFaceId: external_exports.string(),
+  size: external_exports.number().int(),
+  cohesion: external_exports.number()
+});
 var MediaFileLiteSchema$1 = external_exports.object({
   key: external_exports.string(),
   kind: external_exports.string(),
@@ -31759,24 +31835,72 @@ var faceGalleryCapability = {
       auth: "admin"
     }),
     listRecentFaces: method(external_exports.object({
-      /** Restrict to one camera. Absent keeps the cluster-wide gallery view. */
+      /**
+      * Restrict to ONE camera. Absent keeps the cluster-wide gallery view.
+      *
+      * The legacy single-camera form, kept verbatim for every caller that
+      * already sends it. A caller that wants a SET sends {@link deviceIds}
+      * instead — never both: `deviceIds` is the authority whenever it is
+      * present, and this field is then ignored rather than unioned, so
+      * there is exactly one answer to "which cameras did I ask for".
+      */
       deviceId: external_exports.number().int().optional(),
+      /**
+      * Restrict to a SET of cameras — the review UI's camera filter, which
+      * until now had to fetch the cluster-wide page and drop rows in the
+      * client (so the `limit` it asked for was spent on cameras it was
+      * about to discard).
+      *
+      * An **empty array reads NOTHING** — `[]` is an empty page, never
+      * "every camera". A request for no devices is a request, not an
+      * omission; same contract as `deviceManager.listFleet` and
+      * `pipelineAnalytics.listRecentTracks`.
+      *
+      * Absent (`undefined`) is the omission, and keeps the cluster-wide view.
+      */
+      deviceIds: external_exports.array(external_exports.number().int()).optional(),
       limit: external_exports.number().int().positive().optional(),
       filter: FaceFilterEnum.optional(),
       /**
-      * Inline the base64 crop on every row. Default `true` — the existing
-      * behaviour, kept so no caller breaks.
+      * Window lower bound on {@link FaceInfo.timestamp}, INCLUSIVE.
+      * Absent means no lower bound.
+      */
+      since: external_exports.number().int().optional(),
+      /**
+      * Window upper bound on {@link FaceInfo.timestamp}, INCLUSIVE.
+      * Absent means no upper bound.
+      */
+      until: external_exports.number().int().optional(),
+      /**
+      * Order the page by time or by suggestion certainty. Default
+      * `'timestamp'` — the historical order, unchanged for every caller
+      * that does not ask.
       *
-      * Set `false` once the caller renders {@link FaceInfo.cropUrl}: that
-      * drops ~2.87 MiB per 500-row page to a few KiB of metadata and lets
-      * the browser cache the images.
+      * See {@link FaceSortFieldEnum} for what a row with no suggestion
+      * does under `'suggestionConfidence'`.
       *
-      * **This is an INPUT field, so it does not reach the addon until the
-      * next train.** The hub router validates cap inputs against its own
-      * compiled Zod, which strips a key it does not know — verified today
-      * on the OUTPUT side, where an additive field DOES arrive immediately
-      * (`Track.hasFace`). Until the train ships, sending `false` is
-      * harmless and simply keeps the crops inline.
+      * Cost note: `'timestamp'` is served by the `(deviceId, timestamp)`
+      * index and stops reading as soon as `limit` rows have PASSED the
+      * filter. `'suggestionConfidence'` cannot stop early — the most
+      * certain row may be the oldest — so it walks the window. Narrow it
+      * with {@link since} / {@link until}.
+      */
+      sortBy: FaceSortFieldEnum.optional(),
+      /** Sort direction for {@link sortBy}. Default `'desc'`. */
+      sortDirection: FaceSortDirectionEnum.optional(),
+      /**
+      * Inline the base64 crop on every row.
+      *
+      * Default `false` since the 2026-08-25 inversion — see
+      * `include-crops-default.ts`, which is the ONE place that resolves
+      * this for every gallery, and which records why the inline shape had
+      * to become the one you ASK for (60 457 ms → UDS timeout at 500 rows).
+      * The doc here used to still say `true`; it was wrong, and a leftover
+      * that describes the old design reads as permission to rely on it.
+      *
+      * Nothing loses its image: the row carries {@link FaceInfo.cropUrl},
+      * which the browser fetches off the `event-media` plane in parallel,
+      * cached and ETagged.
       */
       includeCrops: external_exports.boolean().optional()
     }).optional(), external_exports.array(FaceInfoSchema).readonly()),
@@ -31825,13 +31949,39 @@ var faceGalleryCapability = {
     suggestFaceClusters: method(external_exports.object({
       threshold: external_exports.number().min(0).max(1).optional(),
       minClusterSize: external_exports.number().int().min(2).optional(),
-      limit: external_exports.number().int().positive().optional()
-    }).optional(), external_exports.array(external_exports.object({
-      faceIds: external_exports.array(external_exports.string()).readonly(),
-      representativeFaceId: external_exports.string(),
-      size: external_exports.number().int(),
-      cohesion: external_exports.number()
-    })).readonly())
+      /**
+      * Cap on the number of CLUSTERS returned. Renamed from `limit`,
+      * which read as though it bounded the work — it never did.
+      *
+      * Wins over {@link limit} when both are sent.
+      */
+      maxClusters: external_exports.number().int().positive().optional(),
+      /**
+      * @deprecated Ambiguous name for {@link maxClusters} — it cuts the
+      * RESULT, not the scan. Kept so existing callers keep working; send
+      * `maxClusters` (and, if you care about cost, {@link maxFacesScanned}).
+      */
+      limit: external_exports.number().int().positive().optional(),
+      /**
+      * Cap on the number of unassigned faces READ AND CLUSTERED — the
+      * POOL, not the result.
+      *
+      * This is the knob {@link maxClusters} was mistaken for. Clustering
+      * used to read every unassigned face on the hub no matter what the
+      * caller asked for, because the only bound cut the finished clusters
+      * afterwards; a UI showing a window of 100 paid for a scan of the
+      * whole corpus, on an addon whose disk is under contention.
+      *
+      * The pool is the NEWEST matching faces first — the same order the
+      * gallery shows — so a bound here shortens the horizon, it does not
+      * sample it randomly.
+      *
+      * Default: 1 000 (`FACE_SWEEP_PAGE`, exactly one store page). Chosen
+      * so the live corpus — 372 face rows — is unaffected while the
+      * unbounded scan can never come back as the table grows.
+      */
+      maxFacesScanned: external_exports.number().int().positive().optional()
+    }).optional(), external_exports.array(FaceClusterSchema).readonly())
   }
 };
 var FanDirectionSchema = external_exports.enum(["forward", "reverse"]);
@@ -35381,6 +35531,23 @@ var ReadGopBytesResultSchema = external_exports.object({
   /** Media ms the returned fragment covers. */
   gopDurMs: external_exports.number()
 });
+var ReadWindowBytesResultSchema = external_exports.discriminatedUnion("kind", [external_exports.object({
+  kind: external_exports.literal("ok"),
+  data: external_exports.instanceof(Uint8Array),
+  /** Absolute epoch ms of the returned bytes' first sample — at or before
+  *  the requested `fromMs` (anchored on the nearest keyframe). */
+  gopStartMs: external_exports.number(),
+  /** Media ms the returned bytes cover, from `gopStartMs`. */
+  gopDurMs: external_exports.number(),
+  /** `false` ⇒ the safety byte cap cut the read short before it reached
+  *  the requested `toMs`; the caller got fewer frames than asked for. */
+  reachesRequestedEnd: external_exports.boolean()
+}), external_exports.object({
+  kind: external_exports.literal("spans-multiple-segments"),
+  /** Where the covering segment's own footage runs out — informational,
+  *  not a retry hint (retrying the same window would refuse again). */
+  segmentEndMs: external_exports.number()
+})]);
 var recordingCapability = {
   name: "recording",
   scope: "system",
@@ -35460,6 +35627,21 @@ var recordingCapability = {
       kind: "query",
       auth: "admin"
     }),
+    /** Read a WINDOW `[fromMs, toMs)` of segment `startMs`, by mfra byte
+    *  range — the multi-GOP twin of `readGopBytes`. Refuses (does not
+    *  degrade) when the window runs past the covering segment. Used by the
+    *  replay clip's `recording` source to fetch several seconds of native
+    *  footage for its single ffmpeg decode pass. */
+    readWindowBytes: method(external_exports.object({
+      deviceId: external_exports.number(),
+      profile: external_exports.string(),
+      startMs: external_exports.number(),
+      fromMs: external_exports.number(),
+      toMs: external_exports.number()
+    }), ReadWindowBytesResultSchema, {
+      kind: "query",
+      auth: "admin"
+    }),
     setDeviceConfig: method(external_exports.object({
       deviceId: external_exports.number(),
       config: RecordingConfigSchema
@@ -36399,6 +36581,121 @@ var SetSiteLocationInputSchema = external_exports.object({
   latitude: external_exports.number().min(-90).max(90),
   longitude: external_exports.number().min(-180).max(180)
 }).nullable();
+var RequestCensusGroupSchema = external_exports.object({
+  procedure: external_exports.string(),
+  userAgent: external_exports.string(),
+  ip: external_exports.string(),
+  principal: external_exports.string(),
+  calls: external_exports.number(),
+  perMin: external_exports.number()
+});
+var RequestCensusProcedureSchema = external_exports.object({
+  procedure: external_exports.string(),
+  calls: external_exports.number(),
+  perMin: external_exports.number()
+});
+var RequestCensusSnapshotSchema = external_exports.object({
+  armed: external_exports.boolean(),
+  /** How long the current - or just-closed - window collected, in ms. */
+  elapsedMs: external_exports.number(),
+  /** The window actually armed, after the server clamped the request. */
+  windowMs: external_exports.number(),
+  /** Epoch ms the window closes at. 0 when disarmed. */
+  armedUntilMs: external_exports.number(),
+  httpRequests: external_exports.number(),
+  batchedRequests: external_exports.number(),
+  /**
+  * Procedure invocations. Higher than `httpRequests` whenever tRPC batching
+  * is in play (`?batch=1` carries several procedures in one request); this is
+  * the number comparable with a store-side call count.
+  */
+  procedureCalls: external_exports.number(),
+  /**
+  * tRPC WebSocket connections opened during the window. NOT calls - the WS
+  * transport resolves one context per connection - but the number that says
+  * whether a plane this census cannot see was busy while HTTP was quiet.
+  */
+  wsConnections: external_exports.number(),
+  distinctGroups: external_exports.number(),
+  /** Calls counted in the totals whose group attribution was shed at the
+  *  cardinality bound. */
+  unattributedCalls: external_exports.number(),
+  procedures: external_exports.array(RequestCensusProcedureSchema).readonly(),
+  groups: external_exports.array(RequestCensusGroupSchema).readonly()
+});
+var RequestCensusStatusSchema = RequestCensusSnapshotSchema.extend({ persisted: external_exports.boolean() });
+var LogLevelSchema$1 = external_exports.enum([
+  "debug",
+  "info",
+  "warn",
+  "error"
+]);
+var DiagnosticIdSchema = external_exports.enum(["request-census"]);
+var LoggingScopeKindSchema = external_exports.enum([
+  "cluster",
+  "node",
+  "component"
+]);
+var LoggingLevelSourceSchema = external_exports.enum([
+  "default",
+  "cluster",
+  "node",
+  "component"
+]);
+var LoggingLevelLayerSchema = external_exports.object({
+  scope: LoggingScopeKindSchema,
+  /** The node this layer speaks for; `null` on the cluster layer. */
+  nodeId: external_exports.string().nullable(),
+  /** Explicitly set here, or `null` when this layer inherits. */
+  level: LogLevelSchema$1.nullable()
+});
+var LoggingEffectiveSchema = external_exports.object({
+  level: LogLevelSchema$1,
+  levelSource: LoggingLevelSourceSchema
+});
+var LoggingExplicitSchema = external_exports.object({ layers: external_exports.array(LoggingLevelLayerSchema).readonly() });
+var DiagnosticWindowSchema = external_exports.object({
+  id: DiagnosticIdSchema,
+  armed: external_exports.boolean(),
+  /** Epoch ms the window closes at. 0 when disarmed. */
+  armedUntilMs: external_exports.number(),
+  /** Ms left before it expires on its own. 0 when disarmed. */
+  remainingMs: external_exports.number(),
+  /** Whether the stored deadline is the one the live diagnostic is running —
+  *  i.e. whether this window would survive a restart. */
+  persisted: external_exports.boolean()
+});
+var DiagnosticWindowPatchSchema = external_exports.object({
+  id: DiagnosticIdSchema,
+  armMs: external_exports.number().int().min(0),
+  /** Cadence of the diagnostic's aggregated report line. Clamped by the server. */
+  reportEveryMs: external_exports.number().int().positive().optional()
+});
+var LoggingSettingsPatchSchema = external_exports.object({
+  /**
+  * Absent leaves the level untouched. `null` CLEARS the explicit value at the
+  * addressed scope so it inherits again. A value sets it.
+  */
+  level: LogLevelSchema$1.nullable().optional(),
+  /**
+  * Only the diagnostics NAMED here change. An armed window that is not listed
+  * keeps running — a patch is never a full replacement.
+  */
+  diagnostics: external_exports.array(DiagnosticWindowPatchSchema).readonly().optional()
+});
+var GetLoggingSettingsInputSchema = external_exports.object({ scopeNodeId: external_exports.string().optional() });
+var SetLoggingSettingsInputSchema = external_exports.object({
+  scopeNodeId: external_exports.string().optional(),
+  patch: LoggingSettingsPatchSchema
+});
+var LoggingSettingsStateSchema = external_exports.object({
+  /** The layer this document was read at. `null` = the cluster layer. */
+  scopeNodeId: external_exports.string().nullable(),
+  effective: LoggingEffectiveSchema,
+  explicit: LoggingExplicitSchema,
+  activeWindows: external_exports.array(DiagnosticWindowSchema).readonly(),
+  persisted: external_exports.boolean()
+});
 var systemCapability = {
   name: "system",
   scope: "system",
@@ -36442,6 +36739,38 @@ var systemCapability = {
     detectSiteLocation: method(external_exports.void(), SiteLocationStatusSchema, {
       kind: "mutation",
       auth: "admin"
+    }),
+    /**
+    * Read the HTTP request census - which caller, from which address, with
+    * which user-agent, invoked which tRPC procedure, and how often.
+    *
+    * Reading NEVER re-arms: re-arming clears the counts, which would throw
+    * away exactly the numbers being asked for. A closed window may be read as
+    * many times as the operator likes and always describes the same window.
+    *
+    * Admin-only: the rows carry source addresses and principal names.
+    */
+    getRequestCensus: method(external_exports.void(), RequestCensusStatusSchema, { auth: "admin" }),
+    /**
+    * The logging settings document — levels and armed diagnostics — resolved
+    * for `nodeId`, or for the cluster when `nodeId` is absent.
+    *
+    * Returns BOTH `effective` and `explicit`. See
+    * {@link LoggingLevelLayerSchema} for why collapsing them is the defect.
+    */
+    getLoggingSettings: method(GetLoggingSettingsInputSchema, LoggingSettingsStateSchema, { auth: "admin" }),
+    /**
+    * Write the logging settings document. The ONLY write authority over log
+    * levels and diagnostic windows — arming the request census went through
+    * `system.setRequestCensus` until 2026-08-27 and no longer does, because
+    * two writes that disagree about the same window is exactly the defect
+    * this document exists to remove (D245).
+    *
+    * The patch MERGES: see {@link LoggingSettingsPatchSchema}.
+    */
+    setLoggingSettings: method(SetLoggingSettingsInputSchema, LoggingSettingsStateSchema, {
+      kind: "mutation",
+      auth: "admin"
     })
   },
   /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
@@ -37305,6 +37634,19 @@ var PIPELINE_OWNER_CAPABILITY_NAMES = [
   "pipeline-orchestrator",
   "pipeline-runner"
 ];
+var SOURCE_CAP_ACTIVE_FIELD = {
+  contact: "entryOpen",
+  binary: "on",
+  switch: "on",
+  motion: "detected",
+  flood: "flooded",
+  gas: "detected",
+  smoke: "detected",
+  "carbon-monoxide": "detected",
+  vibration: "detected",
+  tamper: "tampered"
+};
+var SOURCE_CAPS = Object.keys(SOURCE_CAP_ACTIVE_FIELD);
 var HF_REPO = "camstack/camstack-models";
 var HF_BASE_URL = `https://huggingface.co/${HF_REPO}/resolve/main`;
 var AccessoryKind = {
@@ -37327,6 +37669,7 @@ var ACCESSORY_LABEL = {
   [AccessoryKind.Nightvision]: "Night Vision",
   [AccessoryKind.PrivacyMask]: "Privacy Mask"
 };
+var BATTERY_UNREACHABLE_AFTER_MS = 360 * 6e4;
 var DEVICE_TYPE_CONTROL_KIND = {
   [DeviceType.Cover]: "cover",
   [DeviceType.Valve]: "valve",
@@ -37371,7 +37714,6 @@ var BATTERY_DEVICE_PROFILE = {
   },
   settings: {}
 };
-var BATTERY_UNREACHABLE_AFTER_MS = 360 * 6e4;
 var OPERATOR_WRITTEN_STALE_MS = 10 * 6e4;
 var METHOD_ACCESS_MAP = Object.freeze({
   "accessories.setChildHidden": {
@@ -40278,6 +40620,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "notificationRules.resolveArtifactUrl": {
+    capName: "notification-rules",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "notificationRules.setAlarmConfig": {
     capName: "notification-rules",
     capScope: "system",
@@ -41682,6 +42030,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "recording.readWindowBytes": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "recording.refreshStorageLocationsForMigration": {
     capName: "recording",
     capScope: "system",
@@ -42522,6 +42876,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "system.getLoggingSettings": {
+    capName: "system",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "system.getRequestCensus": {
+    capName: "system",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "system.getRetentionConfig": {
     capName: "system",
     capScope: "system",
@@ -42552,6 +42918,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "system.setLoggingSettings": {
+    capName: "system",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "system.setRetentionConfig": {
     capName: "system",
     capScope: "system",
@@ -43707,6 +44079,10 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
     name: "deviceId",
     form: "single",
     optional: true
+  }, {
+    name: "deviceIds",
+    form: "array",
+    optional: true
   }],
   "fanControl.setDirection": [{
     name: "deviceId",
@@ -44512,6 +44888,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
     form: "single",
     optional: false
   }],
+  "recording.readWindowBytes": [{
+    name: "deviceId",
+    form: "single",
+    optional: false
+  }],
   "recording.relocateFootage": [{
     name: "deviceId",
     form: "single",
@@ -45179,13 +45560,45 @@ var NativeLeaseSettingsSchema = external_exports.object({
   * fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
   * reproduce that.
   */
-  tileBudgetMb: external_exports.number().int().min(0).max(1024)
+  tileBudgetMb: external_exports.number().int().min(0).max(1024),
+  /**
+  * RAM ceiling per decode worker, in MB, for the SCENE TILES — one
+  * JPEG-encoded copy of the WHOLE native frame, cut in the same instant as the
+  * subject tiles, on frames that detected something.
+  *
+  * It exists because a subject tile cannot answer a FULL-FRAME request:
+  * containment is strict by design, so the native `keyFrame`, the detail
+  * plane's `frameJpeg` rung and the display-crop fallback had no rung at all
+  * below the hold. Measured on the live cluster: 23.3% of key-frame captures
+  * missed, 95.7% of them with `worker-lease-gone` — the raster released one
+  * frame-time after delivery, with the request only p50 367 ms behind it.
+  *
+  * Sizing, and why this is a budget and not a duration: a scene tile is
+  * ~1.5-2.5 MB at 4K (against ~23.75 MB for the raster it was cut from and
+  * ~60-120 KB for a subject tile), and it is cut ~0.4 times a second per busy
+  * camera — only detection-bearing frames get one. 48 MB is therefore ~20-30
+  * frames, i.e. the store's 30 s TTL binds at the steady state and the budget
+  * binds only through a detection burst, where it still covers well past the
+  * measured p90 ask age of 4.3 s. Holding the RASTERS for the same window
+  * would be ~498 MB per camera and ~6 GB at peak concurrency — the OOM this
+  * whole shape exists to avoid.
+  *
+  * A SEPARATE ceiling from `tileBudgetMb` on purpose: a scene tile is ~20× a
+  * subject tile, so one shared budget would let a busy camera's key frames
+  * evict the face/plate tiles the recognisers depend on. Two budgets make that
+  * impossible rather than unlikely. `0` DISABLES scene tiles and restores the
+  * pre-existing behaviour, where a late full-frame request had nothing but the
+  * ≤640 RAM raster — which the `keyFrame` gate rejects, so in practice it had
+  * nothing.
+  */
+  sceneBudgetMb: external_exports.number().int().min(0).max(1024)
 });
 var DEFAULT_NATIVE_LEASE_SETTINGS = {
   holdFrames: 8,
   budgetMb: 1024,
   activityMs: 15e3,
   tileBudgetMb: 64,
+  sceneBudgetMb: 48,
   admission: "inferred"
 };
 var NATIVE_LEASE_HOLD_FIELD = {
@@ -45212,6 +45625,12 @@ var NATIVE_LEASE_TILE_BUDGET_FIELD = {
   step: 16,
   default: DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb
 };
+var NATIVE_LEASE_SCENE_BUDGET_FIELD = {
+  min: 0,
+  max: 1024,
+  step: 16,
+  default: DEFAULT_NATIVE_LEASE_SETTINGS.sceneBudgetMb
+};
 var NATIVE_LEASE_ADMISSION_FIELD = {
   options: [{
     value: "all",