camstack 1.2.46 → 1.2.48

package/dist/{chunk-HAO7UL6U.js → chunk-4E6GZ4AC.js}

@@ -15603,6 +15603,28 @@ var OpsLogQueryInputSchema = external_exports.object({
   /** Max rows returned, newest-first. */
   limit: external_exports.number().int().min(1).max(1e3).optional()
 });
+var LabelDefinitionSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  category: external_exports.string().optional(),
+  description: external_exports.string().optional(),
+  icon: external_exports.string().optional()
+});
+var CLASS_MAP_MACRO_TARGETS = [
+  "person",
+  "vehicle",
+  "animal",
+  "package"
+];
+var FIRST_LEVEL_MACRO_CLASSES = [
+  "person",
+  "vehicle",
+  "animal"
+];
+var DetectionCatalogClassMapSchema = external_exports.object({
+  mapping: external_exports.record(external_exports.string(), external_exports.enum(CLASS_MAP_MACRO_TARGETS)),
+  preserveOriginal: external_exports.boolean()
+});
 var RecordingWeekdaySchema = external_exports.number().int().min(0).max(6);
 var HHMM = /^([01]\d|2[0-3]):[0-5]\d$/;
 var RecordingStorageModeSchema = external_exports.enum([
@@ -15610,9 +15632,42 @@ var RecordingStorageModeSchema = external_exports.enum([
   "events",
   "continuous"
 ]);
+var RecordingObjectTriggerClassSchema = external_exports.enum(FIRST_LEVEL_MACRO_CLASSES);
+var noDuplicates = (values) => new Set(values).size === values.length;
 var RecordingTriggersSchema = external_exports.object({
   motion: external_exports.boolean().optional(),
-  audioThresholdDbfs: external_exports.number().optional()
+  audioThresholdDbfs: external_exports.number().optional(),
+  /**
+  * Le macro classi la cui detection apre una finestra. ASSENTE = la sorgente
+  * non è ascoltata; un array VUOTO è rifiutato, perché "banda events, trigger
+  * object acceso, nessuna classe" è la stessa forma "abilitata e non registra
+  * nulla, per sempre" contro cui è scritto `eventsBandCanEverDemand`.
+  *
+  * Il segnale letto è GIÀ FILTRATO: solo detection `source: 'pipeline'`, cioè
+  * quelle che hanno attraversato `enabledMacroClasses`, i
+  * `minConfidence<Macro>` e il full-frame guard. L'AI a bordo camera
+  * (`source: 'onboard'`) non attraversa nessuno di quei gate e NON apre
+  * finestre — vedi `recorder/object-trigger.ts`.
+  */
+  objectClasses: external_exports.array(RecordingObjectTriggerClassSchema).min(1).refine(noDuplicates, { message: "objectClasses must not repeat a class" }).optional(),
+  /**
+  * I device LINKED il cui FRONTE ALTO apre una finestra. Assente = la sorgente
+  * non è ascoltata; un array vuoto è rifiutato per la stessa ragione di
+  * `objectClasses`.
+  *
+  * Sono id di device SORGENTE, non camere: la banda li nomina, quindi il
+  * percorso caldo (`DeviceStateChanged`, a ritmo di bus su tutta la flotta)
+  * non fa RPC. L'OFFERTA da cui l'operatore li sceglie è un'altra domanda, e
+  * si risolve con `deviceManager.getLinkedDevices` + `getBindingsBatch` per
+  * device (D12) — mai un elenco globale di cap.
+  *
+  * Cosa vuol dire "alto" dipende dal TIPO di device e non è deciso qui:
+  * `SOURCE_CAP_ACTIVE_FIELD` (`catalogs/sensor-active-state.ts`) è LA tabella,
+  * la stessa che il virtual-doorbell usa dal 2026-08-05. Ed è il FRONTE, non
+  * il livello: un contatto trovato già aperto al riavvio del runner non fa
+  * registrare.
+  */
+  sensorDeviceIds: external_exports.array(external_exports.number().int().positive()).min(1).max(16).refine(noDuplicates, { message: "sensorDeviceIds must not repeat a device" }).optional()
 });
 var RecordingBandModeSchema = external_exports.enum(["continuous", "events"]);
 var RecordingBandTriggersSchema = RecordingTriggersSchema;
@@ -15929,23 +15984,6 @@ var DecoderSessionConfigSchema = external_exports.object({
   */
   debug: external_exports.boolean().optional()
 });
-var LabelDefinitionSchema = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  category: external_exports.string().optional(),
-  description: external_exports.string().optional(),
-  icon: external_exports.string().optional()
-});
-var CLASS_MAP_MACRO_TARGETS = [
-  "person",
-  "vehicle",
-  "animal",
-  "package"
-];
-var DetectionCatalogClassMapSchema = external_exports.object({
-  mapping: external_exports.record(external_exports.string(), external_exports.enum(CLASS_MAP_MACRO_TARGETS)),
-  preserveOriginal: external_exports.boolean()
-});
 var MODEL_FORMATS = [
   "onnx",
   "coreml",
@@ -29834,7 +29872,7 @@ var lifecycleJobSchema = external_exports.object({
   state: lifecycleJobStateSchema,
   schemaVersion: external_exports.literal(1)
 });
-var LogLevelSchema$1 = external_exports.enum([
+var LogLevelSchema$2 = external_exports.enum([
   "debug",
   "info",
   "warn",
@@ -30034,7 +30072,7 @@ var addonsCapability = {
     getLogs: method(external_exports.object({
       addonId: external_exports.string(),
       limit: external_exports.number().min(1).max(500).default(100),
-      level: LogLevelSchema$1.optional()
+      level: LogLevelSchema$2.optional()
     }), external_exports.array(LogQueryEntrySchema)),
     listPackages: method(external_exports.void(), external_exports.array(InstalledPackageSchema).readonly()),
     installPackage: method(external_exports.object({
@@ -30272,7 +30310,7 @@ var addonsCapability = {
     }),
     onAddonLogs: method(external_exports.object({
       addonId: external_exports.string(),
-      level: LogLevelSchema$1.optional()
+      level: LogLevelSchema$2.optional()
     }), LogStreamEntrySchema, { kind: "subscription" })
   },
   /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
@@ -31731,6 +31769,14 @@ var FaceFilterEnum = external_exports.enum([
   "identified",
   "all"
 ]);
+var FaceSortFieldEnum = external_exports.enum(["timestamp", "suggestionConfidence"]);
+var FaceSortDirectionEnum = external_exports.enum(["asc", "desc"]);
+var FaceClusterSchema = external_exports.object({
+  faceIds: external_exports.array(external_exports.string()).readonly(),
+  representativeFaceId: external_exports.string(),
+  size: external_exports.number().int(),
+  cohesion: external_exports.number()
+});
 var MediaFileLiteSchema$1 = external_exports.object({
   key: external_exports.string(),
   kind: external_exports.string(),
@@ -31789,24 +31835,72 @@ var faceGalleryCapability = {
       auth: "admin"
     }),
     listRecentFaces: method(external_exports.object({
-      /** Restrict to one camera. Absent keeps the cluster-wide gallery view. */
+      /**
+      * Restrict to ONE camera. Absent keeps the cluster-wide gallery view.
+      *
+      * The legacy single-camera form, kept verbatim for every caller that
+      * already sends it. A caller that wants a SET sends {@link deviceIds}
+      * instead — never both: `deviceIds` is the authority whenever it is
+      * present, and this field is then ignored rather than unioned, so
+      * there is exactly one answer to "which cameras did I ask for".
+      */
       deviceId: external_exports.number().int().optional(),
+      /**
+      * Restrict to a SET of cameras — the review UI's camera filter, which
+      * until now had to fetch the cluster-wide page and drop rows in the
+      * client (so the `limit` it asked for was spent on cameras it was
+      * about to discard).
+      *
+      * An **empty array reads NOTHING** — `[]` is an empty page, never
+      * "every camera". A request for no devices is a request, not an
+      * omission; same contract as `deviceManager.listFleet` and
+      * `pipelineAnalytics.listRecentTracks`.
+      *
+      * Absent (`undefined`) is the omission, and keeps the cluster-wide view.
+      */
+      deviceIds: external_exports.array(external_exports.number().int()).optional(),
       limit: external_exports.number().int().positive().optional(),
       filter: FaceFilterEnum.optional(),
       /**
-      * Inline the base64 crop on every row. Default `true` — the existing
-      * behaviour, kept so no caller breaks.
+      * Window lower bound on {@link FaceInfo.timestamp}, INCLUSIVE.
+      * Absent means no lower bound.
+      */
+      since: external_exports.number().int().optional(),
+      /**
+      * Window upper bound on {@link FaceInfo.timestamp}, INCLUSIVE.
+      * Absent means no upper bound.
+      */
+      until: external_exports.number().int().optional(),
+      /**
+      * Order the page by time or by suggestion certainty. Default
+      * `'timestamp'` — the historical order, unchanged for every caller
+      * that does not ask.
       *
-      * Set `false` once the caller renders {@link FaceInfo.cropUrl}: that
-      * drops ~2.87 MiB per 500-row page to a few KiB of metadata and lets
-      * the browser cache the images.
+      * See {@link FaceSortFieldEnum} for what a row with no suggestion
+      * does under `'suggestionConfidence'`.
       *
-      * **This is an INPUT field, so it does not reach the addon until the
-      * next train.** The hub router validates cap inputs against its own
-      * compiled Zod, which strips a key it does not know — verified today
-      * on the OUTPUT side, where an additive field DOES arrive immediately
-      * (`Track.hasFace`). Until the train ships, sending `false` is
-      * harmless and simply keeps the crops inline.
+      * Cost note: `'timestamp'` is served by the `(deviceId, timestamp)`
+      * index and stops reading as soon as `limit` rows have PASSED the
+      * filter. `'suggestionConfidence'` cannot stop early — the most
+      * certain row may be the oldest — so it walks the window. Narrow it
+      * with {@link since} / {@link until}.
+      */
+      sortBy: FaceSortFieldEnum.optional(),
+      /** Sort direction for {@link sortBy}. Default `'desc'`. */
+      sortDirection: FaceSortDirectionEnum.optional(),
+      /**
+      * Inline the base64 crop on every row.
+      *
+      * Default `false` since the 2026-08-25 inversion — see
+      * `include-crops-default.ts`, which is the ONE place that resolves
+      * this for every gallery, and which records why the inline shape had
+      * to become the one you ASK for (60 457 ms → UDS timeout at 500 rows).
+      * The doc here used to still say `true`; it was wrong, and a leftover
+      * that describes the old design reads as permission to rely on it.
+      *
+      * Nothing loses its image: the row carries {@link FaceInfo.cropUrl},
+      * which the browser fetches off the `event-media` plane in parallel,
+      * cached and ETagged.
       */
       includeCrops: external_exports.boolean().optional()
     }).optional(), external_exports.array(FaceInfoSchema).readonly()),
@@ -31855,13 +31949,39 @@ var faceGalleryCapability = {
     suggestFaceClusters: method(external_exports.object({
       threshold: external_exports.number().min(0).max(1).optional(),
       minClusterSize: external_exports.number().int().min(2).optional(),
-      limit: external_exports.number().int().positive().optional()
-    }).optional(), external_exports.array(external_exports.object({
-      faceIds: external_exports.array(external_exports.string()).readonly(),
-      representativeFaceId: external_exports.string(),
-      size: external_exports.number().int(),
-      cohesion: external_exports.number()
-    })).readonly())
+      /**
+      * Cap on the number of CLUSTERS returned. Renamed from `limit`,
+      * which read as though it bounded the work — it never did.
+      *
+      * Wins over {@link limit} when both are sent.
+      */
+      maxClusters: external_exports.number().int().positive().optional(),
+      /**
+      * @deprecated Ambiguous name for {@link maxClusters} — it cuts the
+      * RESULT, not the scan. Kept so existing callers keep working; send
+      * `maxClusters` (and, if you care about cost, {@link maxFacesScanned}).
+      */
+      limit: external_exports.number().int().positive().optional(),
+      /**
+      * Cap on the number of unassigned faces READ AND CLUSTERED — the
+      * POOL, not the result.
+      *
+      * This is the knob {@link maxClusters} was mistaken for. Clustering
+      * used to read every unassigned face on the hub no matter what the
+      * caller asked for, because the only bound cut the finished clusters
+      * afterwards; a UI showing a window of 100 paid for a scan of the
+      * whole corpus, on an addon whose disk is under contention.
+      *
+      * The pool is the NEWEST matching faces first — the same order the
+      * gallery shows — so a bound here shortens the horizon, it does not
+      * sample it randomly.
+      *
+      * Default: 1 000 (`FACE_SWEEP_PAGE`, exactly one store page). Chosen
+      * so the live corpus — 372 face rows — is unaffected while the
+      * unbounded scan can never come back as the table grows.
+      */
+      maxFacesScanned: external_exports.number().int().positive().optional()
+    }).optional(), external_exports.array(FaceClusterSchema).readonly())
   }
 };
 var FanDirectionSchema = external_exports.enum(["forward", "reverse"]);
@@ -36461,6 +36581,174 @@ var SetSiteLocationInputSchema = external_exports.object({
   latitude: external_exports.number().min(-90).max(90),
   longitude: external_exports.number().min(-180).max(180)
 }).nullable();
+var TransportPlaneSchema = external_exports.enum([
+  "http",
+  "ws",
+  "mesh",
+  "unknown"
+]);
+var TransportPlaneCountsSchema = external_exports.object({
+  http: external_exports.number(),
+  ws: external_exports.number(),
+  mesh: external_exports.number(),
+  unknown: external_exports.number()
+});
+var RequestCensusGroupSchema = external_exports.object({
+  plane: TransportPlaneSchema,
+  procedure: external_exports.string(),
+  userAgent: external_exports.string(),
+  ip: external_exports.string(),
+  principal: external_exports.string(),
+  calls: external_exports.number(),
+  subscriptions: external_exports.number(),
+  perMin: external_exports.number()
+});
+var RequestCensusProcedureSchema = external_exports.object({
+  procedure: external_exports.string(),
+  calls: external_exports.number(),
+  /**
+  * The same total, split by transport. THIS is the row that answers the
+  * question the census exists for: one look at `deviceManager.listAll` says
+  * which plane carried the 4 960, without joining two log lines by eye.
+  */
+  planes: TransportPlaneCountsSchema,
+  /** Subscription STARTS on this procedure. Never folded into `calls`. */
+  subscriptions: external_exports.number(),
+  perMin: external_exports.number()
+});
+var RequestCensusSnapshotSchema = external_exports.object({
+  armed: external_exports.boolean(),
+  /** How long the current - or just-closed - window collected, in ms. */
+  elapsedMs: external_exports.number(),
+  /** The window actually armed, after the server clamped the request. */
+  windowMs: external_exports.number(),
+  /** Epoch ms the window closes at. 0 when disarmed. */
+  armedUntilMs: external_exports.number(),
+  httpRequests: external_exports.number(),
+  batchedRequests: external_exports.number(),
+  /**
+  * Procedure invocations. Higher than `httpRequests` whenever tRPC batching
+  * is in play (`?batch=1` carries several procedures in one request); this is
+  * the number comparable with a store-side call count.
+  */
+  procedureCalls: external_exports.number(),
+  /**
+  * `procedureCalls` split by transport. The four keys sum to
+  * `procedureCalls` by construction - {@link RequestCensusSnapshotSchema}'s
+  * `planesExplainTotal` is that identity, checked rather than assumed.
+  */
+  planes: TransportPlaneCountsSchema,
+  /**
+  * True iff `planes` sums to `procedureCalls`. False means a call was counted
+  * on no plane at all - which is a RESULT (a plane is missing from the
+  * instrument), not a failure, and it has to be visible to be read as one.
+  */
+  planesExplainTotal: external_exports.boolean(),
+  /**
+  * tRPC WebSocket connections opened during the window. NOT calls - the WS
+  * adapter resolves one context per connection - kept because a plane's call
+  * count of zero against 37 open connections says something different from a
+  * plane with no connections at all.
+  */
+  wsConnections: external_exports.number(),
+  /**
+  * Client frames the WS plane looked at. `wsMessages` far above
+  * `planes.ws + subscriptions` means most traffic is not operations
+  * (keepalives, connection params) - which is itself an answer.
+  */
+  wsMessages: external_exports.number(),
+  /**
+  * Subscription STARTS across every plane, excluded from `procedureCalls` on
+  * purpose: one live-events stream opened at boot and held for six hours is
+  * one subscription, and counting it as a call would let a quiet plane
+  * masquerade as the storm.
+  */
+  subscriptions: external_exports.number(),
+  /** `subscription.stop` frames. Starts minus stops is what is still open. */
+  subscriptionStops: external_exports.number(),
+  distinctGroups: external_exports.number(),
+  /**
+  * Operations counted in the totals whose CALLER attribution was shed at the
+  * cardinality bound. Unrelated to the `unknown` PLANE: these calls know
+  * which transport they arrived on, they just lost their group row.
+  */
+  unattributedCalls: external_exports.number(),
+  procedures: external_exports.array(RequestCensusProcedureSchema).readonly(),
+  groups: external_exports.array(RequestCensusGroupSchema).readonly()
+});
+var RequestCensusStatusSchema = RequestCensusSnapshotSchema.extend({ persisted: external_exports.boolean() });
+var LogLevelSchema$1 = external_exports.enum([
+  "debug",
+  "info",
+  "warn",
+  "error"
+]);
+var DiagnosticIdSchema = external_exports.enum(["request-census"]);
+var LoggingScopeKindSchema = external_exports.enum([
+  "cluster",
+  "node",
+  "component"
+]);
+var LoggingLevelSourceSchema = external_exports.enum([
+  "default",
+  "cluster",
+  "node",
+  "component"
+]);
+var LoggingLevelLayerSchema = external_exports.object({
+  scope: LoggingScopeKindSchema,
+  /** The node this layer speaks for; `null` on the cluster layer. */
+  nodeId: external_exports.string().nullable(),
+  /** Explicitly set here, or `null` when this layer inherits. */
+  level: LogLevelSchema$1.nullable()
+});
+var LoggingEffectiveSchema = external_exports.object({
+  level: LogLevelSchema$1,
+  levelSource: LoggingLevelSourceSchema
+});
+var LoggingExplicitSchema = external_exports.object({ layers: external_exports.array(LoggingLevelLayerSchema).readonly() });
+var DiagnosticWindowSchema = external_exports.object({
+  id: DiagnosticIdSchema,
+  armed: external_exports.boolean(),
+  /** Epoch ms the window closes at. 0 when disarmed. */
+  armedUntilMs: external_exports.number(),
+  /** Ms left before it expires on its own. 0 when disarmed. */
+  remainingMs: external_exports.number(),
+  /** Whether the stored deadline is the one the live diagnostic is running —
+  *  i.e. whether this window would survive a restart. */
+  persisted: external_exports.boolean()
+});
+var DiagnosticWindowPatchSchema = external_exports.object({
+  id: DiagnosticIdSchema,
+  armMs: external_exports.number().int().min(0),
+  /** Cadence of the diagnostic's aggregated report line. Clamped by the server. */
+  reportEveryMs: external_exports.number().int().positive().optional()
+});
+var LoggingSettingsPatchSchema = external_exports.object({
+  /**
+  * Absent leaves the level untouched. `null` CLEARS the explicit value at the
+  * addressed scope so it inherits again. A value sets it.
+  */
+  level: LogLevelSchema$1.nullable().optional(),
+  /**
+  * Only the diagnostics NAMED here change. An armed window that is not listed
+  * keeps running — a patch is never a full replacement.
+  */
+  diagnostics: external_exports.array(DiagnosticWindowPatchSchema).readonly().optional()
+});
+var GetLoggingSettingsInputSchema = external_exports.object({ scopeNodeId: external_exports.string().optional() });
+var SetLoggingSettingsInputSchema = external_exports.object({
+  scopeNodeId: external_exports.string().optional(),
+  patch: LoggingSettingsPatchSchema
+});
+var LoggingSettingsStateSchema = external_exports.object({
+  /** The layer this document was read at. `null` = the cluster layer. */
+  scopeNodeId: external_exports.string().nullable(),
+  effective: LoggingEffectiveSchema,
+  explicit: LoggingExplicitSchema,
+  activeWindows: external_exports.array(DiagnosticWindowSchema).readonly(),
+  persisted: external_exports.boolean()
+});
 var systemCapability = {
   name: "system",
   scope: "system",
@@ -36504,6 +36792,38 @@ var systemCapability = {
     detectSiteLocation: method(external_exports.void(), SiteLocationStatusSchema, {
       kind: "mutation",
       auth: "admin"
+    }),
+    /**
+    * Read the HTTP request census - which caller, from which address, with
+    * which user-agent, invoked which tRPC procedure, and how often.
+    *
+    * Reading NEVER re-arms: re-arming clears the counts, which would throw
+    * away exactly the numbers being asked for. A closed window may be read as
+    * many times as the operator likes and always describes the same window.
+    *
+    * Admin-only: the rows carry source addresses and principal names.
+    */
+    getRequestCensus: method(external_exports.void(), RequestCensusStatusSchema, { auth: "admin" }),
+    /**
+    * The logging settings document — levels and armed diagnostics — resolved
+    * for `nodeId`, or for the cluster when `nodeId` is absent.
+    *
+    * Returns BOTH `effective` and `explicit`. See
+    * {@link LoggingLevelLayerSchema} for why collapsing them is the defect.
+    */
+    getLoggingSettings: method(GetLoggingSettingsInputSchema, LoggingSettingsStateSchema, { auth: "admin" }),
+    /**
+    * Write the logging settings document. The ONLY write authority over log
+    * levels and diagnostic windows — arming the request census went through
+    * `system.setRequestCensus` until 2026-08-27 and no longer does, because
+    * two writes that disagree about the same window is exactly the defect
+    * this document exists to remove (D245).
+    *
+    * The patch MERGES: see {@link LoggingSettingsPatchSchema}.
+    */
+    setLoggingSettings: method(SetLoggingSettingsInputSchema, LoggingSettingsStateSchema, {
+      kind: "mutation",
+      auth: "admin"
     })
   },
   /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
@@ -37367,6 +37687,19 @@ var PIPELINE_OWNER_CAPABILITY_NAMES = [
   "pipeline-orchestrator",
   "pipeline-runner"
 ];
+var SOURCE_CAP_ACTIVE_FIELD = {
+  contact: "entryOpen",
+  binary: "on",
+  switch: "on",
+  motion: "detected",
+  flood: "flooded",
+  gas: "detected",
+  smoke: "detected",
+  "carbon-monoxide": "detected",
+  vibration: "detected",
+  tamper: "tampered"
+};
+var SOURCE_CAPS = Object.keys(SOURCE_CAP_ACTIVE_FIELD);
 var HF_REPO = "camstack/camstack-models";
 var HF_BASE_URL = `https://huggingface.co/${HF_REPO}/resolve/main`;
 var AccessoryKind = {
@@ -37389,6 +37722,7 @@ var ACCESSORY_LABEL = {
   [AccessoryKind.Nightvision]: "Night Vision",
   [AccessoryKind.PrivacyMask]: "Privacy Mask"
 };
+var BATTERY_UNREACHABLE_AFTER_MS = 360 * 6e4;
 var DEVICE_TYPE_CONTROL_KIND = {
   [DeviceType.Cover]: "cover",
   [DeviceType.Valve]: "valve",
@@ -37433,7 +37767,6 @@ var BATTERY_DEVICE_PROFILE = {
   },
   settings: {}
 };
-var BATTERY_UNREACHABLE_AFTER_MS = 360 * 6e4;
 var OPERATOR_WRITTEN_STALE_MS = 10 * 6e4;
 var METHOD_ACCESS_MAP = Object.freeze({
   "accessories.setChildHidden": {
@@ -42596,6 +42929,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "system.getLoggingSettings": {
+    capName: "system",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "system.getRequestCensus": {
+    capName: "system",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "system.getRetentionConfig": {
     capName: "system",
     capScope: "system",
@@ -42626,6 +42971,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "system.setLoggingSettings": {
+    capName: "system",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "system.setRetentionConfig": {
     capName: "system",
     capScope: "system",
@@ -43781,6 +44132,10 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
     name: "deviceId",
     form: "single",
     optional: true
+  }, {
+    name: "deviceIds",
+    form: "array",
+    optional: true
   }],
   "fanControl.setDirection": [{
     name: "deviceId",
@@ -45258,13 +45613,45 @@ var NativeLeaseSettingsSchema = external_exports.object({
   * fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
   * reproduce that.
   */
-  tileBudgetMb: external_exports.number().int().min(0).max(1024)
+  tileBudgetMb: external_exports.number().int().min(0).max(1024),
+  /**
+  * RAM ceiling per decode worker, in MB, for the SCENE TILES — one
+  * JPEG-encoded copy of the WHOLE native frame, cut in the same instant as the
+  * subject tiles, on frames that detected something.
+  *
+  * It exists because a subject tile cannot answer a FULL-FRAME request:
+  * containment is strict by design, so the native `keyFrame`, the detail
+  * plane's `frameJpeg` rung and the display-crop fallback had no rung at all
+  * below the hold. Measured on the live cluster: 23.3% of key-frame captures
+  * missed, 95.7% of them with `worker-lease-gone` — the raster released one
+  * frame-time after delivery, with the request only p50 367 ms behind it.
+  *
+  * Sizing, and why this is a budget and not a duration: a scene tile is
+  * ~1.5-2.5 MB at 4K (against ~23.75 MB for the raster it was cut from and
+  * ~60-120 KB for a subject tile), and it is cut ~0.4 times a second per busy
+  * camera — only detection-bearing frames get one. 48 MB is therefore ~20-30
+  * frames, i.e. the store's 30 s TTL binds at the steady state and the budget
+  * binds only through a detection burst, where it still covers well past the
+  * measured p90 ask age of 4.3 s. Holding the RASTERS for the same window
+  * would be ~498 MB per camera and ~6 GB at peak concurrency — the OOM this
+  * whole shape exists to avoid.
+  *
+  * A SEPARATE ceiling from `tileBudgetMb` on purpose: a scene tile is ~20× a
+  * subject tile, so one shared budget would let a busy camera's key frames
+  * evict the face/plate tiles the recognisers depend on. Two budgets make that
+  * impossible rather than unlikely. `0` DISABLES scene tiles and restores the
+  * pre-existing behaviour, where a late full-frame request had nothing but the
+  * ≤640 RAM raster — which the `keyFrame` gate rejects, so in practice it had
+  * nothing.
+  */
+  sceneBudgetMb: external_exports.number().int().min(0).max(1024)
 });
 var DEFAULT_NATIVE_LEASE_SETTINGS = {
   holdFrames: 8,
   budgetMb: 1024,
   activityMs: 15e3,
   tileBudgetMb: 64,
+  sceneBudgetMb: 48,
   admission: "inferred"
 };
 var NATIVE_LEASE_HOLD_FIELD = {
@@ -45291,6 +45678,12 @@ var NATIVE_LEASE_TILE_BUDGET_FIELD = {
   step: 16,
   default: DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb
 };
+var NATIVE_LEASE_SCENE_BUDGET_FIELD = {
+  min: 0,
+  max: 1024,
+  step: 16,
+  default: DEFAULT_NATIVE_LEASE_SETTINGS.sceneBudgetMb
+};
 var NATIVE_LEASE_ADMISSION_FIELD = {
   options: [{
     value: "all",

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runDiscover
-} from "./chunk-HAO7UL6U.js";
+} from "./chunk-4E6GZ4AC.js";
 import "./chunk-LMMQX4CK.js";
 
 // src/cli.ts
@@ -38,7 +38,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-Y5I6QU24.js");
+  await import("./launcher-MNOEQWRN.js");
 }
 
 // src/commands/agent.ts
@@ -83,7 +83,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-Y5I6QU24.js");
+  await import("./launcher-MNOEQWRN.js");
 }
 
 // src/commands/setup.ts
@@ -1130,7 +1130,7 @@ function isUnknown(_value) {
   return true;
 }
 async function resolveServerInteractive(presetNamespace) {
-  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-27QPK6P7.js");
+  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-LCFU2BSJ.js");
   if (presetNamespace) {
     const spinner4 = clack.spinner();
     spinner4.start(`Discovering hub on LAN (namespace "${presetNamespace}")`);

package/dist/{discover-27QPK6P7.js → discover-LCFU2BSJ.js}

@@ -5,7 +5,7 @@ import {
   filterHubNodes,
   resolveHubFromDiscovered,
   runDiscover
-} from "./chunk-HAO7UL6U.js";
+} from "./chunk-4E6GZ4AC.js";
 import "./chunk-LMMQX4CK.js";
 export {
   DEFAULT_HUB_HTTPS_PORT,