@camstack/addon-matter-broker 0.2.98 → 0.2.100

package/dist/addon.js

@@ -13,7 +13,7 @@ let node_stream_promises = require("node:stream/promises");
 let node_net = require("node:net");
 let node_dgram = require("node:dgram");
 node_dgram = require_esm.__toESM(node_dgram, 1);
-//#region ../types/dist/event-category-DAXzJeTX.mjs
+//#region ../types/dist/event-category-ZyX6jcse.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -574,7 +574,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	* a package zone — a newly-appeared stationary object of a package class
 	* that cleared the class / zone / dwell / size gates. Payload:
 	* `PipelineAnalyticsPackageDeliveredPayload` carrying `{ deviceId,
-	* entryId, className, zoneIds, keyFrameMediaKey?, bbox, timestamp }`.
+	* entryId, className, zoneIds, keyFrameMediaId?, bbox, timestamp }`.
 	* Telemetry (D8): the durable record is the `package-events` store row;
 	* this bus topic drives notifier rules + live UI. See
 	* docs/superpowers/specs/2026-07-17-package-zones-design.md §5.1.
@@ -5360,7 +5360,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BnujYGPe.mjs
+//#region ../types/dist/sleep-DBKu2-U5.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7327,13 +7327,30 @@ new Set([
 	"scene",
 	"motion",
 	"object",
-	"audio"
+	"audio",
+	"mosaic"
 ]);
-new Set([
+/**
+* The owner types that are event tables, in the order the event-media resolver
+* should consider them. Exported so a consumer asking "is this key an event?"
+* does not re-spell the list and drift from it.
+*/
+var EVENT_OWNER_TYPES = [
 	"motion",
 	"object",
 	"audio"
-]);
+];
+/**
+* The same list as a Zod enum, for the cap inputs that must NAME the table
+* (D482: `getEventMedia` / `listEventMedia` take an owner, and an owner is
+* `(table, id)`).
+*
+* Built FROM {@link EVENT_OWNER_TYPES} rather than re-spelled: a fourth event
+* table would otherwise be accepted by the codec and refused at the door, with
+* nothing failing until a caller asked.
+*/
+var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
+new Set(EVENT_OWNER_TYPES);
 var EncodeProfileSchema = object({
 	video: object({
 		codec: _enum([
@@ -7372,7 +7389,23 @@ var EncodeProfileSchema = object({
 			"zerolatency",
 			"film",
 			"animation"
-		]).optional()
+		]).optional(),
+		/**
+		* ONE slice per access unit.
+		*
+		* `-tune zerolatency` turns on x264's sliced threads, and a frame then leaves
+		* the encoder as five NAL slices that share one RTP timestamp and carry one
+		* marker bit. A libwebrtc depacketiser sees five frame-starts and one
+		* frame-end per frame: the first pictures render and the video then freezes
+		* for good while the audio, on its own plane, plays on. Measured on this hub
+		* 2026-09-13 against the Echo, and reduced to one slice by this flag alone.
+		*
+		* A NAMED field and not a raw flag, because {@link EgressEncodeSchema} omits
+		* `outputArgs` on purpose: an opaque array is part of the sharing key, so two
+		* consumers meaning the same thing spelled differently would stop sharing one
+		* child. Absent means "whatever the encoder does" — today's behaviour.
+		*/
+		singleSlicePerFrame: boolean().optional()
 	}),
 	audio: union([literal("passthrough"), object({
 		codec: _enum([
@@ -7422,7 +7455,7 @@ var BASE_LIVE_EGRESS_PROFILE = {
 	audio: "passthrough"
 };
 ({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
-({ ...BASE_LIVE_EGRESS_PROFILE });
+({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
 /**
 * Deep wiring healthcheck — snapshot of active reachability probes across
 * every declared capability + widget of every installed plugin, on every
@@ -12581,6 +12614,16 @@ method(object({
 	filter: QueryFilterSchema.optional(),
 	columns: array(string$2()).readonly().optional()
 }), array(SettingsRecordSchema).readonly()), method(object({
+	namespace: string$2().optional(),
+	collection: string$2(),
+	/** Declared columns identifying the slot; must be covered by a UNIQUE
+	*  index on the collection. Never empty. */
+	conflict: array(string$2()).readonly(),
+	record: BulkRecordSchema
+}), object({ 
+/** The id the row HAS: assigned by SQLite on an insert, or the existing
+*  row's own id on an update. */
+id: union([string$2(), number()]) }), { kind: "mutation" }), method(object({
 	namespace: string$2().optional(),
 	collection: string$2(),
 	record: object({
@@ -12715,6 +12758,14 @@ method(_void(), EngineInfoSchema, { auth: "admin" }), method(object({
 id: union([string$2(), number()]) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	namespace: string$2().optional(),
+	collection: string$2(),
+	conflict: array(string$2()).readonly(),
+	record: BulkRecordSchema
+}), object({ id: union([string$2(), number()]) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	namespace: string$2().optional(),
 	collection: string$2(),
@@ -19214,8 +19265,8 @@ var TrackPositionSchema = object({
 var TrackSnapshotSchema = object({
 	timestamp: number(),
 	position: TrackPositionSchema,
-	/** MediaStore key; resolve via `getTrackMedia({ trackId })`. */
-	mediaKey: string$2()
+	/** The snapshot's media row id (D482); resolve via `listTrackMedia({ trackId })`. */
+	mediaId: number().int()
 });
 /**
 * Normalized 0..1 trajectory envelope (min/max over every position bbox,
@@ -19819,14 +19870,14 @@ var ObjectEventSchema = object({
 	*  pixel-space `bbox` onto a displayed image. Omitted in slim projection. */
 	frameWidth: number().optional(),
 	frameHeight: number().optional(),
-	/** MediaStore key for the crop attached to this event (if any). */
-	mediaKey: string$2().optional(),
-	/** Design B: MediaStore key of the track's native-resolution key frame (the
+	/** Media row id of the crop attached to this event (if any) — D482. */
+	mediaId: number().int().optional(),
+	/** Design B: media row id of the track's native-resolution key frame (the
 	*  best-detection full frame). Resolve via the event-media data-plane
-	*  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`) for a detail view that
+	*  (`/addon/<addonId>/event-media/m/<keyFrameMediaId>`) for a detail view that
 	*  draws `bbox` over the native frame. Absent on legacy rows / non-decoded
-	*  sources — consumers fall back to `mediaKey` (the tight crop). */
-	keyFrameMediaKey: string$2().optional(),
+	*  sources — consumers fall back to `mediaId` (the tight crop). */
+	keyFrameMediaId: number().int().optional(),
 	/** Populated by B5 (recording playback URL for this event). */
 	mediaUrl: string$2().optional(),
 	/** The parent track's key-event importance [0,1], propagated to every object
@@ -19876,7 +19927,7 @@ var MediaFileKindEnum = _enum([
 * hub-main's heap on the way past — for an `<img>` that would have cached it.
 *
 * `url` points at the `event-media` data plane
-* (`/addon/<addonId>/event-media/<storedKey>`), which serves the same blob
+* (`/addon/<addonId>/event-media/m/<mediaId>` — D482), which serves the same blob
 * with an ETag and `Cache-Control: immutable`, honours conditional GETs, can
 * render a `?variant=thumb`, and streams. The hub gate in front of it requires
 * a bearer or the session cookie (`access: 'authenticated'`), so the bytes are
@@ -19884,10 +19935,13 @@ var MediaFileKindEnum = _enum([
 * `data-plane-access.ts` for the rule and the one gap it does not close
 * (per-device scoping).
 *
-* The URL is built from the row's **stored** key, which is not always its
-* published `kind`: a track's face/plate crop is stored as `crop` under
+* The URL is built from the row's own id, which since D482 says nothing about
+* the row's owner or kind — and that is the point. The published `kind` is not
+* the stored one (a track's face/plate crop is stored as `crop` under
 * `('face'|'plate', '<prefix>-<trackId>')` and published as
-* `faceCrop`/`plateCrop`. `MediaStore.getByKey` knows only the stored key.
+* `faceCrop`/`plateCrop`), and under the old composite key the URL had to be
+* taken from `row.key` verbatim or it 404'd exactly those two rows. An id
+* cannot be mis-reconstructed, because there is nothing in it to reconstruct.
 *
 * ## `base64` is TRANSITIONAL and is going away
 *
@@ -19900,7 +19954,19 @@ var MediaFileKindEnum = _enum([
 * `analytics-query-facade.ts`; nothing else reads it.
 */
 var MediaFileSchema = object({
-	key: string$2(),
+	/**
+	* The media row's OWN id — the rowid SQLite assigned it (D482).
+	*
+	* It used to be the row's composite key, `<ownerType>:<ownerId>:<fileKind>
+	* [:<timestampMs>]`, which embedded a FOREIGN id. D474 made event ids
+	* per-table rowid aliases, so `object:101314` and `motion:101314` are two
+	* different rows that spell the same number, and a track whose
+	* `bestEventId` was an object event was served a motion event's snapshot —
+	* a night-time thumbnail on an afternoon track, with no error anywhere. A
+	* surrogate id cannot name the wrong row's owner, because it names no owner
+	* at all.
+	*/
+	mediaId: number().int(),
 	kind: MediaFileKindEnum,
 	sizeBytes: number(),
 	timestamp: number()
@@ -20008,7 +20074,7 @@ var RetrainTrackSchema = object({
 });
 /** A frame the picker may offer — an index row, no blob was read to produce it. */
 var RetrainFrameCandidateSchema = object({
-	mediaKey: string$2(),
+	mediaId: number().int(),
 	kind: MediaFileKindEnum,
 	timestamp: number(),
 	sizeBytes: number().int(),
@@ -20022,7 +20088,7 @@ var RetrainFrameSchema = object({
 	deviceId: number(),
 	trackId: string$2(),
 	/** Provenance only. It may already point at nothing — that is expected. */
-	sourceMediaKey: string$2(),
+	sourceMediaId: number().int(),
 	sourceKind: MediaFileKindEnum,
 	sizeBytes: number().int(),
 	width: number().int(),
@@ -20038,7 +20104,7 @@ var RetrainCopyRefusalSchema = _enum([
 var RetrainFrameSelectionSchema = object({
 	copied: array(RetrainFrameSchema).readonly(),
 	refused: array(object({
-		sourceMediaKey: string$2(),
+		sourceMediaId: number().int(),
 		reason: RetrainCopyRefusalSchema
 	})).readonly()
 });
@@ -20046,7 +20112,7 @@ var RetrainFrameListSchema = object({
 	candidates: array(RetrainFrameCandidateSchema).readonly(),
 	copies: array(RetrainFrameSchema).readonly(),
 	/** What the page pre-selects — the native key frame when one survives. */
-	autoPickMediaKey: string$2().optional()
+	autoPickMediaId: number().int().optional()
 });
 /** What the operator asked the assist to look for. */
 var RetrainAssistSubjectSchema = discriminatedUnion("kind", [object({
@@ -20141,9 +20207,11 @@ var RecentTracksQueryInput = object({
 });
 /**
 * A Summary (D359): the per-camera session envelope that references tracks.
-* `groupShotKey` is the media key of its group shot (`ownerKind: 'summary'`,
-* served by the event-media plane by key), null until the first frame with a
-* member visible has been materialised.
+* `groupShotMediaId` is the media ROW id of its group shot (`ownerKind:
+* 'summary'`, served by the event-media plane at `/m/<id>`), null until the
+* first frame with a member visible has been materialised (D482 — it was the
+* row's composite key, which embedded the owner and could name another table's
+* row once event ids became per-table rowids).
 */
 var SummarySchema = object({
 	id: string$2(),
@@ -20152,19 +20220,115 @@ var SummarySchema = object({
 	lastActiveAt: number(),
 	sealedAt: number().nullable(),
 	memberCount: number().int().nonnegative(),
-	groupShotKey: string$2().nullable()
+	groupShotMediaId: number().int().nullable()
 });
 var SummariesQueryInput = object({
 	deviceIds: array(number()).min(1),
 	since: number().optional(),
 	until: number().optional(),
-	limit: number().int().min(1).max(200).default(50)
+	limit: number().int().min(1).max(200).default(50),
+	/** The same member-wise filter {@link listRecentSummaries} takes — one
+	*  meaning of "dog" on every summary surface. */
+	classes: array(string$2().min(1).max(60)).max(40).optional()
 });
-var SummariesPageSchema = object({ summaries: array(SummarySchema).readonly() });
 var SummaryDetailSchema = object({
 	summary: SummarySchema,
-	/** Member track ids, in absorption order. */
-	trackIds: array(string$2()).readonly()
+	/** Members in absorption order, oldest join first. */
+	members: array(object({
+		trackId: string$2(),
+		/**
+		* The track's class at the time it JOINED, or `null` when it was unresolved
+		* and the track no longer exists to fill it.
+		*
+		* The join, not the latest opinion: class voting can re-decide a track's
+		* class afterwards, and a group's composition is the history of who came
+		* together. A consumer counts these to badge a thumbnail — "two people and a
+		* dog" — rather than being handed a second, denormalised tally that would
+		* drift from the members it claims to describe.
+		*/
+		className: string$2().nullable(),
+		/** `primary` is the one member that carries the group's identity. */
+		role: _enum([
+			"primary",
+			"sibling",
+			"child"
+		]).nullable(),
+		joinedAt: number(),
+		/** Tier 1 — the sub-class (`dog`, `van`), resolved from the member's track
+		*  at read time. Absent when nothing resolved, never an empty string. */
+		label: string$2().optional(),
+		/** Tier 2 — the instance: a person's name, a plate. Absent when the pipeline
+		*  recognised nobody, and absent for a member whose track has been pruned —
+		*  a thumbnail that names the wrong person is worse than one naming nobody. */
+		subLabel: string$2().optional()
+	})).readonly()
+});
+/**
+* What a LIST of groups carries: the envelope plus what it is MADE OF.
+*
+* Coarse on purpose — the operator's rule is "only the rough data on the list,
+* we extend when we notice we need more". Enough to draw the card ("two people
+* and a dog") and no more. The MEMBERS, their names and the per-member links
+* are on {@link getSummary}: shipping every member of every group so a client
+* can count them turns a page of two hundred groups into a thousand records to
+* draw two hundred badges.
+*/
+var SummaryListItemSchema = object({
+	summary: SummarySchema,
+	/** Class counts, most numerous first; `className: null` is a member whose
+	*  class never resolved, counted so the counts add up to `memberCount`. */
+	classes: array(object({
+		className: string$2().nullable(),
+		count: number().int().positive()
+	})).readonly()
+});
+var SummariesPageSchema = object({ summaries: array(SummaryListItemSchema).readonly() });
+/**
+* The paged feed, deliberately the SAME shape as {@link RecentTracksQueryInput}.
+*
+* The reel on the cameras page and the Events gallery both ride a cursor, so a
+* summaries feed that could only answer "the last N for these cameras"
+* (`listSummaries`) would make groups available in the timeline and nowhere
+* else. Two feeds with different ordering contracts would be two ideas of what
+* "newest" means, on one screen.
+*/
+var RecentSummariesQueryInput = object({
+	/** Devices to merge. An empty array yields an empty page. */
+	deviceIds: array(number()),
+	/** Window lower bound on `lastActiveAt` (inclusive). */
+	since: number().optional(),
+	/** Window upper bound on `lastActiveAt` (inclusive). */
+	until: number().optional(),
+	limit: number().int().min(1).max(500).default(100),
+	/** Opaque continuation cursor from a previous page's `nextCursor`. */
+	cursor: string$2().optional(),
+	/**
+	* Restrict to these classes — THE SAME FIELD `listRecentTracks` takes, and
+	* deliberately the same name: the events filter tree emits one list of ticked
+	* taxonomy nodes, and a summaries feed that called it something else would
+	* make the operator's one filter component produce two shapes.
+	*
+	* A question about the MEMBERS: a group matches when ANY of them does. "Show
+	* me the arrivals with a dog" has to return the group of four people who had
+	* one with them; a filter on the group's own fields could only ever answer
+	* about its primary.
+	*
+	* Matched against all THREE tiers of a member — the class (`animal`), the
+	* sub-class (`dog`) and the instance (a name, a plate) — because which tier a
+	* ticked node lives on is the taxonomy's business, not the caller's. `dog` is
+	* an event kind in the tree and a tier-1 label on an `animal` track; a filter
+	* that read only the class would answer "animal" and never "dog".
+	*
+	* ABSENT or EMPTY means no filter — absent is not a selection of none.
+	*/
+	classes: array(string$2().min(1).max(60)).max(40).optional()
+});
+var RecentSummariesPageSchema = object({
+	/** Ordered by (`lastActiveAt` DESC, id DESC). Same light item as
+	*  {@link listSummaries} — one list shape, so a card renders the same
+	*  whichever feed drew it. */
+	summaries: array(SummaryListItemSchema).readonly(),
+	nextCursor: string$2().nullable()
 });
 var RecentTracksPageSchema = object({
 	/** Merged page, ordered by (`lastSeen` DESC, `trackId` DESC). */
@@ -20578,7 +20742,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	classes: array(string$2()).optional(),
 	/** See {@link ExcludeSourcesDoc}. */
 	excludeSources: array(TrackSourceSchema).optional()
-}), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(SummariesQueryInput, SummariesPageSchema), method(object({ id: string$2() }), SummaryDetailSchema.nullable()), method(object({ deviceId: number() }), _void(), {
+}), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(SummariesQueryInput, SummariesPageSchema), method(RecentSummariesQueryInput, RecentSummariesPageSchema), method(object({ id: string$2() }), SummaryDetailSchema.nullable()), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number() }), array(EventKindDescriptorSchema).readonly()), method(object({ deviceIds: array(number()).min(1).max(200) }), array(EventKindsForDeviceSchema).readonly()), method(object({
@@ -20706,7 +20870,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(object({
 	deviceId: number(),
 	trackId: string$2(),
-	mediaKeys: array(string$2()).min(1)
+	mediaIds: array(number().int()).min(1)
 }), RetrainFrameSelectionSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -20774,7 +20938,10 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	kind: "query",
 	auth: "admin"
 }), method(object({
-	eventId: string$2(),
+	/** Which of the three event tables owns the row. */
+	ownerType: EventOwnerTypeSchema,
+	/** The event's rowid in that table (D474: an event id is a number). */
+	eventId: number().int(),
 	kind: MediaFileKindEnum.optional(),
 	deviceId: number()
 }), array(MediaFileSchema).readonly()), method(object({
@@ -20785,7 +20952,8 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	trackId: string$2(),
 	deviceId: number()
 }), array(MediaFileInfoSchema).readonly()), method(object({
-	eventId: string$2(),
+	ownerType: EventOwnerTypeSchema,
+	eventId: number().int(),
 	deviceId: number()
 }), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
 	kind: "mutation",
@@ -25995,8 +26163,8 @@ var IdentitySchema = object({
 	id: string$2(),
 	name: string$2(),
 	sampleCount: number().int().nonnegative(),
-	coverMediaKey: string$2().optional(),
-	/** Inline base64 of the cover sample's crop, resolved from `coverMediaKey`.
+	coverMediaId: number().int().optional(),
+	/** Inline base64 of the cover sample's crop, resolved from `coverMediaId`.
 	*  Lets the UI render the person's face avatar instead of a placeholder icon. */
 	coverBase64: string$2().optional()
 });
@@ -26022,8 +26190,8 @@ var IdentitySampleAuditRowSchema = object({
 	enrolledAt: number().int(),
 	deviceId: number().int().optional(),
 	source: _enum(["detected", "photo"]),
-	/** The enrolled crop's media key, so the panel can show the evidence. */
-	mediaKey: string$2().optional(),
+	/** The enrolled crop's media row id, so the panel can show the evidence. */
+	mediaId: number().int().optional(),
 	/**
 	* False = the sample is stamped with a DIFFERENT face model, and a cosine
 	* across feature spaces is a well-formed float with no meaning. Every number
@@ -26092,15 +26260,15 @@ var FaceInfoSchema = object({
 	*/
 	cropUrl: string$2().optional(),
 	/** Design B: the face bbox (pixel space) on the key frame — lets a detail
-	*  view draw the box over the native `keyFrameMediaKey` frame. Absent on
+	*  view draw the box over the native `keyFrameMediaId` frame. Absent on
 	*  legacy rows written before design B. */
 	faceBbox: BoundingBoxSchema.optional(),
 	/** Design B: MediaStore key of the track's native-resolution key frame.
 	*  Fetch the native JPEG via the event-media data-plane
-	*  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`). Absent when the
+	*  (`/addon/<addonId>/event-media/m/<keyFrameMediaId>`). Absent when the
 	*  track produced no key frame (e.g. native/onboard source) — the UI falls
 	*  back to the inline `base64` face crop. */
-	keyFrameMediaKey: string$2().optional(),
+	keyFrameMediaId: number().int().optional(),
 	/** Winning identity-match cosine (0..1) for this face's track, when an
 	*  identity was auto-confirmed. Lets the UI surface WHY a face was assigned
 	*  (confidence badge / low-confidence audit). Absent on legacy rows and on
@@ -26169,11 +26337,14 @@ var FaceClusterSchema = object({
 * `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
 * dialog already rendering its key FRAME from the `event-media` plane.
 *
-* `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
-* media key directly, so this needed no new plane and no new access decision.
+* `url` is `/addon/<addonId>/event-media/m/<mediaId>` (D482). The plane
+* resolves a media row by its own id, so this needed no new plane and no new
+* access decision.
 */
 var MediaFileLiteSchema$1 = object({
-	key: string$2(),
+	/** The media row's own id — the same address `MediaFileRef.mediaId` carries
+	*  (D482). It was the row's composite key, which embedded the owner. */
+	mediaId: number().int(),
 	kind: string$2(),
 	url: string$2(),
 	sizeBytes: number(),
@@ -26190,7 +26361,7 @@ method(object({
 * covers inline, ~10 KB of base64 per row, on a query this UI mounts
 * four times and the viewer holds at `staleTime: 30_000`.
 *
-* Nothing loses its avatar: `coverMediaKey` is already on every row and
+* Nothing loses its avatar: `coverMediaId` is already on every row and
 * the `event-media` plane serves that key `immutable` with an ETag.
 *
 * **This is an INPUT field, so it does not reach the addon until the
@@ -29553,8 +29724,8 @@ var VehicleSchema = object({
 	id: string$2(),
 	name: string$2(),
 	sampleCount: number().int().nonnegative(),
-	coverMediaKey: string$2().optional(),
-	/** Inline base64 of the cover sample's plate crop, resolved from `coverMediaKey`. */
+	coverMediaId: number().int().optional(),
+	/** Inline base64 of the cover sample's plate crop, resolved from `coverMediaId`. */
 	coverBase64: string$2().optional()
 });
 var VehicleSampleInfoSchema = object({
@@ -29587,7 +29758,7 @@ var PlateInfoSchema = object({
 	/** keyFrame parity: the plate bbox (pixel space) on the native key frame. */
 	plateBbox: BoundingBoxSchema.optional(),
 	/** keyFrame parity: MediaStore key of the track's native-resolution key frame. */
-	keyFrameMediaKey: string$2().optional(),
+	keyFrameMediaId: number().int().optional(),
 	base64: string$2().optional(),
 	/**
 	* Same crop as a data-plane URL, always present when the plate has a stored
@@ -29608,11 +29779,14 @@ var PlateInfoSchema = object({
 * `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
 * dialog already rendering its key FRAME from the `event-media` plane.
 *
-* `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
-* media key directly, so this needed no new plane and no new access decision.
+* `url` is `/addon/<addonId>/event-media/m/<mediaId>` (D482). The plane
+* resolves a media row by its own id, so this needed no new plane and no new
+* access decision.
 */
 var MediaFileLiteSchema = object({
-	key: string$2(),
+	/** The media row's own id — the same address `MediaFileRef.mediaId` carries
+	*  (D482). It was the row's composite key, which embedded the owner. */
+	mediaId: number().int(),
 	kind: string$2(),
 	url: string$2(),
 	sizeBytes: number(),
@@ -29671,7 +29845,7 @@ method(object({
 }), method(object({ 
 /** Inline {@link VehicleSchema.coverBase64} on every row. Default
 *  `false` — the vehicle twin of `faceGallery.listIdentities`'s
-*  option; `coverMediaKey` + the `event-media` plane carry the picture.
+*  option; `coverMediaId` + the `event-media` plane carry the picture.
 *  INPUT field: stripped by the hub router until the train ships, which
 *  resolves to `false` and is exactly the intended default. */
 includeCrops: boolean().optional() }).optional(), array(VehicleSchema).readonly()), method(object({ name: string$2().min(1) }), VehicleSchema, {
@@ -31240,7 +31414,14 @@ var SceneReferenceSchema = object({
 	modelId: string$2(),
 	condition: SceneConditionSchema,
 	capturedAt: number(),
-	thumbnailMediaId: string$2().optional(),
+	/**
+	* The reference thumbnail's media ROW id (D482).
+	*
+	* The name already said `mediaId` while the value was the row's composite
+	* key — a leftover that read as done and was not. It is the row's own id
+	* now, addressed at `/addon/<addonId>/event-media/m/<id>`.
+	*/
+	thumbnailMediaId: number().int().optional(),
 	/** Whole-frame (downscaled) embedding captured alongside the ROI crop. The
 	*  anti-view-shift anchor: a bumped camera, a PTZ preset or a re-aim makes the
 	*  normalized rect frame a different piece of world, and the scene would
@@ -32331,7 +32512,29 @@ var LoggingSettingsPatchSchema = object({
 	* disarmed the channels it did not mention would make the Levels page and
 	* the Diagnostics page fight over the same value.
 	*/
-	channels: array(LogChannelWindowPatchSchema).readonly().optional()
+	channels: array(LogChannelWindowPatchSchema).readonly().optional(),
+	/**
+	* How many days the analytics OPS LOG is kept — the audit trail of what
+	* retention actually deleted.
+	*
+	* It lives HERE, on the logging document, and not on the analytics addon's
+	* settings form, on the operator's instruction: every other log-ish window in
+	* this system is configured through this one document, and a retention audit
+	* configured somewhere else is a second place to look when the question is
+	* "what happened to my data".
+	*
+	* That placement has a cost worth stating: this document ships in the
+	* framework closure, so this knob needs a published `@camstack/server` while
+	* the four windows beside it (D485) reach a node on `camstack deploy`.
+	*
+	* `retention-model.ts` argued this one must NOT follow a device window,
+	* because the audit trail is the history of the SWEEP and not of the camera.
+	* That argument stands and is untouched — what changes is that 30 days stops
+	* being a constant nobody can reach. `0` keeps it forever. The floor is 1 day
+	* rather than 0-as-delete: an audit log truncated to nothing is precisely the
+	* state in which the next 9.5 GiB leak cannot be explained.
+	*/
+	opsLogRetentionDays: number().int().min(0).max(3650).optional()
 });
 /**
 * Which LAYER of the hierarchy is addressed. Absent = the cluster layer.
@@ -32404,6 +32607,14 @@ var LoggingSettingsStateSchema = object({
 	channels: array(LogChannelDescriptorSchema).readonly(),
 	/** The channels ARMED right now, each with its deadline. */
 	activeChannels: array(LogChannelWindowStateSchema).readonly(),
+	/**
+	* The ops-log window in days, as it is in force. `0` = kept forever.
+	*
+	* Reported rather than left to the caller's memory of what it wrote: this is
+	* the value the analytics sweep will actually use, and an operator asking how
+	* long their audit trail lives should not have to infer it from a default.
+	*/
+	opsLogRetentionDays: number().int().min(0),
 	persisted: boolean()
 });
 method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string$2(), unknown()), _null(), {
@@ -33224,7 +33435,7 @@ var StationaryObjectSchema = object({
 	/** Enrichment label carried from the source track (identity / plate). */
 	label: string$2().optional(),
 	/** Native-resolution key-frame media key for the parked object's best image. */
-	keyFrameMediaKey: string$2().optional()
+	keyFrameMediaId: number().int().optional()
 });
 var CameraOccupancySnapshotSchema = object({
 	/** Frame timestamp of the inference result that produced this snapshot. */
@@ -35962,6 +36173,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"dataStoreProvider.upsert": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dayNight.getOptions": {
 		capName: "day-night",
 		capScope: "device",
@@ -38398,6 +38615,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRecentSummaries": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRecentTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -39826,6 +40049,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.upsert": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"smtpProvider.getStatus": {
 		capName: "smtp-provider",
 		capScope: "system",
@@ -42219,6 +42448,11 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"pipelineAnalytics.listRecentSummaries": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"pipelineAnalytics.listRecentTracks": [{
 		name: "deviceIds",
 		form: "array",

package/dist/addon.mjs

@@ -11,7 +11,7 @@ import { networkInterfaces, tmpdir, uptime } from "node:os";
 import { finished } from "node:stream/promises";
 import { createConnection, createServer as createServer$2 } from "node:net";
 import * as dgram from "node:dgram";
-//#region ../types/dist/event-category-DAXzJeTX.mjs
+//#region ../types/dist/event-category-ZyX6jcse.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -572,7 +572,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	* a package zone — a newly-appeared stationary object of a package class
 	* that cleared the class / zone / dwell / size gates. Payload:
 	* `PipelineAnalyticsPackageDeliveredPayload` carrying `{ deviceId,
-	* entryId, className, zoneIds, keyFrameMediaKey?, bbox, timestamp }`.
+	* entryId, className, zoneIds, keyFrameMediaId?, bbox, timestamp }`.
 	* Telemetry (D8): the durable record is the `package-events` store row;
 	* this bus topic drives notifier rules + live UI. See
 	* docs/superpowers/specs/2026-07-17-package-zones-design.md §5.1.
@@ -5358,7 +5358,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BnujYGPe.mjs
+//#region ../types/dist/sleep-DBKu2-U5.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7325,13 +7325,30 @@ new Set([
 	"scene",
 	"motion",
 	"object",
-	"audio"
+	"audio",
+	"mosaic"
 ]);
-new Set([
+/**
+* The owner types that are event tables, in the order the event-media resolver
+* should consider them. Exported so a consumer asking "is this key an event?"
+* does not re-spell the list and drift from it.
+*/
+var EVENT_OWNER_TYPES = [
 	"motion",
 	"object",
 	"audio"
-]);
+];
+/**
+* The same list as a Zod enum, for the cap inputs that must NAME the table
+* (D482: `getEventMedia` / `listEventMedia` take an owner, and an owner is
+* `(table, id)`).
+*
+* Built FROM {@link EVENT_OWNER_TYPES} rather than re-spelled: a fourth event
+* table would otherwise be accepted by the codec and refused at the door, with
+* nothing failing until a caller asked.
+*/
+var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
+new Set(EVENT_OWNER_TYPES);
 var EncodeProfileSchema = object({
 	video: object({
 		codec: _enum([
@@ -7370,7 +7387,23 @@ var EncodeProfileSchema = object({
 			"zerolatency",
 			"film",
 			"animation"
-		]).optional()
+		]).optional(),
+		/**
+		* ONE slice per access unit.
+		*
+		* `-tune zerolatency` turns on x264's sliced threads, and a frame then leaves
+		* the encoder as five NAL slices that share one RTP timestamp and carry one
+		* marker bit. A libwebrtc depacketiser sees five frame-starts and one
+		* frame-end per frame: the first pictures render and the video then freezes
+		* for good while the audio, on its own plane, plays on. Measured on this hub
+		* 2026-09-13 against the Echo, and reduced to one slice by this flag alone.
+		*
+		* A NAMED field and not a raw flag, because {@link EgressEncodeSchema} omits
+		* `outputArgs` on purpose: an opaque array is part of the sharing key, so two
+		* consumers meaning the same thing spelled differently would stop sharing one
+		* child. Absent means "whatever the encoder does" — today's behaviour.
+		*/
+		singleSlicePerFrame: boolean().optional()
 	}),
 	audio: union([literal("passthrough"), object({
 		codec: _enum([
@@ -7420,7 +7453,7 @@ var BASE_LIVE_EGRESS_PROFILE = {
 	audio: "passthrough"
 };
 ({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
-({ ...BASE_LIVE_EGRESS_PROFILE });
+({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
 /**
 * Deep wiring healthcheck — snapshot of active reachability probes across
 * every declared capability + widget of every installed plugin, on every
@@ -12579,6 +12612,16 @@ method(object({
 	filter: QueryFilterSchema.optional(),
 	columns: array(string$2()).readonly().optional()
 }), array(SettingsRecordSchema).readonly()), method(object({
+	namespace: string$2().optional(),
+	collection: string$2(),
+	/** Declared columns identifying the slot; must be covered by a UNIQUE
+	*  index on the collection. Never empty. */
+	conflict: array(string$2()).readonly(),
+	record: BulkRecordSchema
+}), object({ 
+/** The id the row HAS: assigned by SQLite on an insert, or the existing
+*  row's own id on an update. */
+id: union([string$2(), number()]) }), { kind: "mutation" }), method(object({
 	namespace: string$2().optional(),
 	collection: string$2(),
 	record: object({
@@ -12713,6 +12756,14 @@ method(_void(), EngineInfoSchema, { auth: "admin" }), method(object({
 id: union([string$2(), number()]) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	namespace: string$2().optional(),
+	collection: string$2(),
+	conflict: array(string$2()).readonly(),
+	record: BulkRecordSchema
+}), object({ id: union([string$2(), number()]) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	namespace: string$2().optional(),
 	collection: string$2(),
@@ -19212,8 +19263,8 @@ var TrackPositionSchema = object({
 var TrackSnapshotSchema = object({
 	timestamp: number(),
 	position: TrackPositionSchema,
-	/** MediaStore key; resolve via `getTrackMedia({ trackId })`. */
-	mediaKey: string$2()
+	/** The snapshot's media row id (D482); resolve via `listTrackMedia({ trackId })`. */
+	mediaId: number().int()
 });
 /**
 * Normalized 0..1 trajectory envelope (min/max over every position bbox,
@@ -19817,14 +19868,14 @@ var ObjectEventSchema = object({
 	*  pixel-space `bbox` onto a displayed image. Omitted in slim projection. */
 	frameWidth: number().optional(),
 	frameHeight: number().optional(),
-	/** MediaStore key for the crop attached to this event (if any). */
-	mediaKey: string$2().optional(),
-	/** Design B: MediaStore key of the track's native-resolution key frame (the
+	/** Media row id of the crop attached to this event (if any) — D482. */
+	mediaId: number().int().optional(),
+	/** Design B: media row id of the track's native-resolution key frame (the
 	*  best-detection full frame). Resolve via the event-media data-plane
-	*  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`) for a detail view that
+	*  (`/addon/<addonId>/event-media/m/<keyFrameMediaId>`) for a detail view that
 	*  draws `bbox` over the native frame. Absent on legacy rows / non-decoded
-	*  sources — consumers fall back to `mediaKey` (the tight crop). */
-	keyFrameMediaKey: string$2().optional(),
+	*  sources — consumers fall back to `mediaId` (the tight crop). */
+	keyFrameMediaId: number().int().optional(),
 	/** Populated by B5 (recording playback URL for this event). */
 	mediaUrl: string$2().optional(),
 	/** The parent track's key-event importance [0,1], propagated to every object
@@ -19874,7 +19925,7 @@ var MediaFileKindEnum = _enum([
 * hub-main's heap on the way past — for an `<img>` that would have cached it.
 *
 * `url` points at the `event-media` data plane
-* (`/addon/<addonId>/event-media/<storedKey>`), which serves the same blob
+* (`/addon/<addonId>/event-media/m/<mediaId>` — D482), which serves the same blob
 * with an ETag and `Cache-Control: immutable`, honours conditional GETs, can
 * render a `?variant=thumb`, and streams. The hub gate in front of it requires
 * a bearer or the session cookie (`access: 'authenticated'`), so the bytes are
@@ -19882,10 +19933,13 @@ var MediaFileKindEnum = _enum([
 * `data-plane-access.ts` for the rule and the one gap it does not close
 * (per-device scoping).
 *
-* The URL is built from the row's **stored** key, which is not always its
-* published `kind`: a track's face/plate crop is stored as `crop` under
+* The URL is built from the row's own id, which since D482 says nothing about
+* the row's owner or kind — and that is the point. The published `kind` is not
+* the stored one (a track's face/plate crop is stored as `crop` under
 * `('face'|'plate', '<prefix>-<trackId>')` and published as
-* `faceCrop`/`plateCrop`. `MediaStore.getByKey` knows only the stored key.
+* `faceCrop`/`plateCrop`), and under the old composite key the URL had to be
+* taken from `row.key` verbatim or it 404'd exactly those two rows. An id
+* cannot be mis-reconstructed, because there is nothing in it to reconstruct.
 *
 * ## `base64` is TRANSITIONAL and is going away
 *
@@ -19898,7 +19952,19 @@ var MediaFileKindEnum = _enum([
 * `analytics-query-facade.ts`; nothing else reads it.
 */
 var MediaFileSchema = object({
-	key: string$2(),
+	/**
+	* The media row's OWN id — the rowid SQLite assigned it (D482).
+	*
+	* It used to be the row's composite key, `<ownerType>:<ownerId>:<fileKind>
+	* [:<timestampMs>]`, which embedded a FOREIGN id. D474 made event ids
+	* per-table rowid aliases, so `object:101314` and `motion:101314` are two
+	* different rows that spell the same number, and a track whose
+	* `bestEventId` was an object event was served a motion event's snapshot —
+	* a night-time thumbnail on an afternoon track, with no error anywhere. A
+	* surrogate id cannot name the wrong row's owner, because it names no owner
+	* at all.
+	*/
+	mediaId: number().int(),
 	kind: MediaFileKindEnum,
 	sizeBytes: number(),
 	timestamp: number()
@@ -20006,7 +20072,7 @@ var RetrainTrackSchema = object({
 });
 /** A frame the picker may offer — an index row, no blob was read to produce it. */
 var RetrainFrameCandidateSchema = object({
-	mediaKey: string$2(),
+	mediaId: number().int(),
 	kind: MediaFileKindEnum,
 	timestamp: number(),
 	sizeBytes: number().int(),
@@ -20020,7 +20086,7 @@ var RetrainFrameSchema = object({
 	deviceId: number(),
 	trackId: string$2(),
 	/** Provenance only. It may already point at nothing — that is expected. */
-	sourceMediaKey: string$2(),
+	sourceMediaId: number().int(),
 	sourceKind: MediaFileKindEnum,
 	sizeBytes: number().int(),
 	width: number().int(),
@@ -20036,7 +20102,7 @@ var RetrainCopyRefusalSchema = _enum([
 var RetrainFrameSelectionSchema = object({
 	copied: array(RetrainFrameSchema).readonly(),
 	refused: array(object({
-		sourceMediaKey: string$2(),
+		sourceMediaId: number().int(),
 		reason: RetrainCopyRefusalSchema
 	})).readonly()
 });
@@ -20044,7 +20110,7 @@ var RetrainFrameListSchema = object({
 	candidates: array(RetrainFrameCandidateSchema).readonly(),
 	copies: array(RetrainFrameSchema).readonly(),
 	/** What the page pre-selects — the native key frame when one survives. */
-	autoPickMediaKey: string$2().optional()
+	autoPickMediaId: number().int().optional()
 });
 /** What the operator asked the assist to look for. */
 var RetrainAssistSubjectSchema = discriminatedUnion("kind", [object({
@@ -20139,9 +20205,11 @@ var RecentTracksQueryInput = object({
 });
 /**
 * A Summary (D359): the per-camera session envelope that references tracks.
-* `groupShotKey` is the media key of its group shot (`ownerKind: 'summary'`,
-* served by the event-media plane by key), null until the first frame with a
-* member visible has been materialised.
+* `groupShotMediaId` is the media ROW id of its group shot (`ownerKind:
+* 'summary'`, served by the event-media plane at `/m/<id>`), null until the
+* first frame with a member visible has been materialised (D482 — it was the
+* row's composite key, which embedded the owner and could name another table's
+* row once event ids became per-table rowids).
 */
 var SummarySchema = object({
 	id: string$2(),
@@ -20150,19 +20218,115 @@ var SummarySchema = object({
 	lastActiveAt: number(),
 	sealedAt: number().nullable(),
 	memberCount: number().int().nonnegative(),
-	groupShotKey: string$2().nullable()
+	groupShotMediaId: number().int().nullable()
 });
 var SummariesQueryInput = object({
 	deviceIds: array(number()).min(1),
 	since: number().optional(),
 	until: number().optional(),
-	limit: number().int().min(1).max(200).default(50)
+	limit: number().int().min(1).max(200).default(50),
+	/** The same member-wise filter {@link listRecentSummaries} takes — one
+	*  meaning of "dog" on every summary surface. */
+	classes: array(string$2().min(1).max(60)).max(40).optional()
 });
-var SummariesPageSchema = object({ summaries: array(SummarySchema).readonly() });
 var SummaryDetailSchema = object({
 	summary: SummarySchema,
-	/** Member track ids, in absorption order. */
-	trackIds: array(string$2()).readonly()
+	/** Members in absorption order, oldest join first. */
+	members: array(object({
+		trackId: string$2(),
+		/**
+		* The track's class at the time it JOINED, or `null` when it was unresolved
+		* and the track no longer exists to fill it.
+		*
+		* The join, not the latest opinion: class voting can re-decide a track's
+		* class afterwards, and a group's composition is the history of who came
+		* together. A consumer counts these to badge a thumbnail — "two people and a
+		* dog" — rather than being handed a second, denormalised tally that would
+		* drift from the members it claims to describe.
+		*/
+		className: string$2().nullable(),
+		/** `primary` is the one member that carries the group's identity. */
+		role: _enum([
+			"primary",
+			"sibling",
+			"child"
+		]).nullable(),
+		joinedAt: number(),
+		/** Tier 1 — the sub-class (`dog`, `van`), resolved from the member's track
+		*  at read time. Absent when nothing resolved, never an empty string. */
+		label: string$2().optional(),
+		/** Tier 2 — the instance: a person's name, a plate. Absent when the pipeline
+		*  recognised nobody, and absent for a member whose track has been pruned —
+		*  a thumbnail that names the wrong person is worse than one naming nobody. */
+		subLabel: string$2().optional()
+	})).readonly()
+});
+/**
+* What a LIST of groups carries: the envelope plus what it is MADE OF.
+*
+* Coarse on purpose — the operator's rule is "only the rough data on the list,
+* we extend when we notice we need more". Enough to draw the card ("two people
+* and a dog") and no more. The MEMBERS, their names and the per-member links
+* are on {@link getSummary}: shipping every member of every group so a client
+* can count them turns a page of two hundred groups into a thousand records to
+* draw two hundred badges.
+*/
+var SummaryListItemSchema = object({
+	summary: SummarySchema,
+	/** Class counts, most numerous first; `className: null` is a member whose
+	*  class never resolved, counted so the counts add up to `memberCount`. */
+	classes: array(object({
+		className: string$2().nullable(),
+		count: number().int().positive()
+	})).readonly()
+});
+var SummariesPageSchema = object({ summaries: array(SummaryListItemSchema).readonly() });
+/**
+* The paged feed, deliberately the SAME shape as {@link RecentTracksQueryInput}.
+*
+* The reel on the cameras page and the Events gallery both ride a cursor, so a
+* summaries feed that could only answer "the last N for these cameras"
+* (`listSummaries`) would make groups available in the timeline and nowhere
+* else. Two feeds with different ordering contracts would be two ideas of what
+* "newest" means, on one screen.
+*/
+var RecentSummariesQueryInput = object({
+	/** Devices to merge. An empty array yields an empty page. */
+	deviceIds: array(number()),
+	/** Window lower bound on `lastActiveAt` (inclusive). */
+	since: number().optional(),
+	/** Window upper bound on `lastActiveAt` (inclusive). */
+	until: number().optional(),
+	limit: number().int().min(1).max(500).default(100),
+	/** Opaque continuation cursor from a previous page's `nextCursor`. */
+	cursor: string$2().optional(),
+	/**
+	* Restrict to these classes — THE SAME FIELD `listRecentTracks` takes, and
+	* deliberately the same name: the events filter tree emits one list of ticked
+	* taxonomy nodes, and a summaries feed that called it something else would
+	* make the operator's one filter component produce two shapes.
+	*
+	* A question about the MEMBERS: a group matches when ANY of them does. "Show
+	* me the arrivals with a dog" has to return the group of four people who had
+	* one with them; a filter on the group's own fields could only ever answer
+	* about its primary.
+	*
+	* Matched against all THREE tiers of a member — the class (`animal`), the
+	* sub-class (`dog`) and the instance (a name, a plate) — because which tier a
+	* ticked node lives on is the taxonomy's business, not the caller's. `dog` is
+	* an event kind in the tree and a tier-1 label on an `animal` track; a filter
+	* that read only the class would answer "animal" and never "dog".
+	*
+	* ABSENT or EMPTY means no filter — absent is not a selection of none.
+	*/
+	classes: array(string$2().min(1).max(60)).max(40).optional()
+});
+var RecentSummariesPageSchema = object({
+	/** Ordered by (`lastActiveAt` DESC, id DESC). Same light item as
+	*  {@link listSummaries} — one list shape, so a card renders the same
+	*  whichever feed drew it. */
+	summaries: array(SummaryListItemSchema).readonly(),
+	nextCursor: string$2().nullable()
 });
 var RecentTracksPageSchema = object({
 	/** Merged page, ordered by (`lastSeen` DESC, `trackId` DESC). */
@@ -20576,7 +20740,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	classes: array(string$2()).optional(),
 	/** See {@link ExcludeSourcesDoc}. */
 	excludeSources: array(TrackSourceSchema).optional()
-}), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(SummariesQueryInput, SummariesPageSchema), method(object({ id: string$2() }), SummaryDetailSchema.nullable()), method(object({ deviceId: number() }), _void(), {
+}), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(SummariesQueryInput, SummariesPageSchema), method(RecentSummariesQueryInput, RecentSummariesPageSchema), method(object({ id: string$2() }), SummaryDetailSchema.nullable()), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number() }), array(EventKindDescriptorSchema).readonly()), method(object({ deviceIds: array(number()).min(1).max(200) }), array(EventKindsForDeviceSchema).readonly()), method(object({
@@ -20704,7 +20868,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(object({
 	deviceId: number(),
 	trackId: string$2(),
-	mediaKeys: array(string$2()).min(1)
+	mediaIds: array(number().int()).min(1)
 }), RetrainFrameSelectionSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -20772,7 +20936,10 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	kind: "query",
 	auth: "admin"
 }), method(object({
-	eventId: string$2(),
+	/** Which of the three event tables owns the row. */
+	ownerType: EventOwnerTypeSchema,
+	/** The event's rowid in that table (D474: an event id is a number). */
+	eventId: number().int(),
 	kind: MediaFileKindEnum.optional(),
 	deviceId: number()
 }), array(MediaFileSchema).readonly()), method(object({
@@ -20783,7 +20950,8 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	trackId: string$2(),
 	deviceId: number()
 }), array(MediaFileInfoSchema).readonly()), method(object({
-	eventId: string$2(),
+	ownerType: EventOwnerTypeSchema,
+	eventId: number().int(),
 	deviceId: number()
 }), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
 	kind: "mutation",
@@ -25993,8 +26161,8 @@ var IdentitySchema = object({
 	id: string$2(),
 	name: string$2(),
 	sampleCount: number().int().nonnegative(),
-	coverMediaKey: string$2().optional(),
-	/** Inline base64 of the cover sample's crop, resolved from `coverMediaKey`.
+	coverMediaId: number().int().optional(),
+	/** Inline base64 of the cover sample's crop, resolved from `coverMediaId`.
 	*  Lets the UI render the person's face avatar instead of a placeholder icon. */
 	coverBase64: string$2().optional()
 });
@@ -26020,8 +26188,8 @@ var IdentitySampleAuditRowSchema = object({
 	enrolledAt: number().int(),
 	deviceId: number().int().optional(),
 	source: _enum(["detected", "photo"]),
-	/** The enrolled crop's media key, so the panel can show the evidence. */
-	mediaKey: string$2().optional(),
+	/** The enrolled crop's media row id, so the panel can show the evidence. */
+	mediaId: number().int().optional(),
 	/**
 	* False = the sample is stamped with a DIFFERENT face model, and a cosine
 	* across feature spaces is a well-formed float with no meaning. Every number
@@ -26090,15 +26258,15 @@ var FaceInfoSchema = object({
 	*/
 	cropUrl: string$2().optional(),
 	/** Design B: the face bbox (pixel space) on the key frame — lets a detail
-	*  view draw the box over the native `keyFrameMediaKey` frame. Absent on
+	*  view draw the box over the native `keyFrameMediaId` frame. Absent on
 	*  legacy rows written before design B. */
 	faceBbox: BoundingBoxSchema.optional(),
 	/** Design B: MediaStore key of the track's native-resolution key frame.
 	*  Fetch the native JPEG via the event-media data-plane
-	*  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`). Absent when the
+	*  (`/addon/<addonId>/event-media/m/<keyFrameMediaId>`). Absent when the
 	*  track produced no key frame (e.g. native/onboard source) — the UI falls
 	*  back to the inline `base64` face crop. */
-	keyFrameMediaKey: string$2().optional(),
+	keyFrameMediaId: number().int().optional(),
 	/** Winning identity-match cosine (0..1) for this face's track, when an
 	*  identity was auto-confirmed. Lets the UI surface WHY a face was assigned
 	*  (confidence badge / low-confidence audit). Absent on legacy rows and on
@@ -26167,11 +26335,14 @@ var FaceClusterSchema = object({
 * `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
 * dialog already rendering its key FRAME from the `event-media` plane.
 *
-* `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
-* media key directly, so this needed no new plane and no new access decision.
+* `url` is `/addon/<addonId>/event-media/m/<mediaId>` (D482). The plane
+* resolves a media row by its own id, so this needed no new plane and no new
+* access decision.
 */
 var MediaFileLiteSchema$1 = object({
-	key: string$2(),
+	/** The media row's own id — the same address `MediaFileRef.mediaId` carries
+	*  (D482). It was the row's composite key, which embedded the owner. */
+	mediaId: number().int(),
 	kind: string$2(),
 	url: string$2(),
 	sizeBytes: number(),
@@ -26188,7 +26359,7 @@ method(object({
 * covers inline, ~10 KB of base64 per row, on a query this UI mounts
 * four times and the viewer holds at `staleTime: 30_000`.
 *
-* Nothing loses its avatar: `coverMediaKey` is already on every row and
+* Nothing loses its avatar: `coverMediaId` is already on every row and
 * the `event-media` plane serves that key `immutable` with an ETag.
 *
 * **This is an INPUT field, so it does not reach the addon until the
@@ -29551,8 +29722,8 @@ var VehicleSchema = object({
 	id: string$2(),
 	name: string$2(),
 	sampleCount: number().int().nonnegative(),
-	coverMediaKey: string$2().optional(),
-	/** Inline base64 of the cover sample's plate crop, resolved from `coverMediaKey`. */
+	coverMediaId: number().int().optional(),
+	/** Inline base64 of the cover sample's plate crop, resolved from `coverMediaId`. */
 	coverBase64: string$2().optional()
 });
 var VehicleSampleInfoSchema = object({
@@ -29585,7 +29756,7 @@ var PlateInfoSchema = object({
 	/** keyFrame parity: the plate bbox (pixel space) on the native key frame. */
 	plateBbox: BoundingBoxSchema.optional(),
 	/** keyFrame parity: MediaStore key of the track's native-resolution key frame. */
-	keyFrameMediaKey: string$2().optional(),
+	keyFrameMediaId: number().int().optional(),
 	base64: string$2().optional(),
 	/**
 	* Same crop as a data-plane URL, always present when the plate has a stored
@@ -29606,11 +29777,14 @@ var PlateInfoSchema = object({
 * `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
 * dialog already rendering its key FRAME from the `event-media` plane.
 *
-* `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
-* media key directly, so this needed no new plane and no new access decision.
+* `url` is `/addon/<addonId>/event-media/m/<mediaId>` (D482). The plane
+* resolves a media row by its own id, so this needed no new plane and no new
+* access decision.
 */
 var MediaFileLiteSchema = object({
-	key: string$2(),
+	/** The media row's own id — the same address `MediaFileRef.mediaId` carries
+	*  (D482). It was the row's composite key, which embedded the owner. */
+	mediaId: number().int(),
 	kind: string$2(),
 	url: string$2(),
 	sizeBytes: number(),
@@ -29669,7 +29843,7 @@ method(object({
 }), method(object({ 
 /** Inline {@link VehicleSchema.coverBase64} on every row. Default
 *  `false` — the vehicle twin of `faceGallery.listIdentities`'s
-*  option; `coverMediaKey` + the `event-media` plane carry the picture.
+*  option; `coverMediaId` + the `event-media` plane carry the picture.
 *  INPUT field: stripped by the hub router until the train ships, which
 *  resolves to `false` and is exactly the intended default. */
 includeCrops: boolean().optional() }).optional(), array(VehicleSchema).readonly()), method(object({ name: string$2().min(1) }), VehicleSchema, {
@@ -31238,7 +31412,14 @@ var SceneReferenceSchema = object({
 	modelId: string$2(),
 	condition: SceneConditionSchema,
 	capturedAt: number(),
-	thumbnailMediaId: string$2().optional(),
+	/**
+	* The reference thumbnail's media ROW id (D482).
+	*
+	* The name already said `mediaId` while the value was the row's composite
+	* key — a leftover that read as done and was not. It is the row's own id
+	* now, addressed at `/addon/<addonId>/event-media/m/<id>`.
+	*/
+	thumbnailMediaId: number().int().optional(),
 	/** Whole-frame (downscaled) embedding captured alongside the ROI crop. The
 	*  anti-view-shift anchor: a bumped camera, a PTZ preset or a re-aim makes the
 	*  normalized rect frame a different piece of world, and the scene would
@@ -32329,7 +32510,29 @@ var LoggingSettingsPatchSchema = object({
 	* disarmed the channels it did not mention would make the Levels page and
 	* the Diagnostics page fight over the same value.
 	*/
-	channels: array(LogChannelWindowPatchSchema).readonly().optional()
+	channels: array(LogChannelWindowPatchSchema).readonly().optional(),
+	/**
+	* How many days the analytics OPS LOG is kept — the audit trail of what
+	* retention actually deleted.
+	*
+	* It lives HERE, on the logging document, and not on the analytics addon's
+	* settings form, on the operator's instruction: every other log-ish window in
+	* this system is configured through this one document, and a retention audit
+	* configured somewhere else is a second place to look when the question is
+	* "what happened to my data".
+	*
+	* That placement has a cost worth stating: this document ships in the
+	* framework closure, so this knob needs a published `@camstack/server` while
+	* the four windows beside it (D485) reach a node on `camstack deploy`.
+	*
+	* `retention-model.ts` argued this one must NOT follow a device window,
+	* because the audit trail is the history of the SWEEP and not of the camera.
+	* That argument stands and is untouched — what changes is that 30 days stops
+	* being a constant nobody can reach. `0` keeps it forever. The floor is 1 day
+	* rather than 0-as-delete: an audit log truncated to nothing is precisely the
+	* state in which the next 9.5 GiB leak cannot be explained.
+	*/
+	opsLogRetentionDays: number().int().min(0).max(3650).optional()
 });
 /**
 * Which LAYER of the hierarchy is addressed. Absent = the cluster layer.
@@ -32402,6 +32605,14 @@ var LoggingSettingsStateSchema = object({
 	channels: array(LogChannelDescriptorSchema).readonly(),
 	/** The channels ARMED right now, each with its deadline. */
 	activeChannels: array(LogChannelWindowStateSchema).readonly(),
+	/**
+	* The ops-log window in days, as it is in force. `0` = kept forever.
+	*
+	* Reported rather than left to the caller's memory of what it wrote: this is
+	* the value the analytics sweep will actually use, and an operator asking how
+	* long their audit trail lives should not have to infer it from a default.
+	*/
+	opsLogRetentionDays: number().int().min(0),
 	persisted: boolean()
 });
 method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string$2(), unknown()), _null(), {
@@ -33222,7 +33433,7 @@ var StationaryObjectSchema = object({
 	/** Enrichment label carried from the source track (identity / plate). */
 	label: string$2().optional(),
 	/** Native-resolution key-frame media key for the parked object's best image. */
-	keyFrameMediaKey: string$2().optional()
+	keyFrameMediaId: number().int().optional()
 });
 var CameraOccupancySnapshotSchema = object({
 	/** Frame timestamp of the inference result that produced this snapshot. */
@@ -35960,6 +36171,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"dataStoreProvider.upsert": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dayNight.getOptions": {
 		capName: "day-night",
 		capScope: "device",
@@ -38396,6 +38613,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRecentSummaries": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRecentTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -39824,6 +40047,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.upsert": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"smtpProvider.getStatus": {
 		capName: "smtp-provider",
 		capScope: "system",
@@ -42217,6 +42446,11 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"pipelineAnalytics.listRecentSummaries": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"pipelineAnalytics.listRecentTracks": [{
 		name: "deviceIds",
 		form: "array",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-matter-broker",
-  "version": "0.2.98",
+  "version": "0.2.100",
   "description": "Matter broker addon for CamStack — owns a Matter fabric (commissioning + the long-lived controller) via the matter.js controller and brokers commissioned Matter nodes into CamStack",
   "keywords": [
     "camstack",