@camstack/addon-osd-manager 0.1.124 → 0.1.126

package/dist/{hostInit-Du2Me1GR.mjs → hostInit-D_FWYfaI.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.234",
+				version: "1.2.236",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -81,7 +81,7 @@ async function r() {
 				}
 			},
 			"@camstack/ui-library": {
-				version: "1.2.190",
+				version: "1.2.192",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/index.js

@@ -5363,7 +5363,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-CopaBJss.mjs
+//#region ../types/dist/sleep-CaB_hL5g.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -5563,12 +5563,6 @@ Object.fromEntries([
 		icon: "circle-dot",
 		order: 40
 	},
-	{
-		id: "clips",
-		label: "Clips",
-		icon: "clapperboard",
-		order: 41
-	},
 	{
 		id: "engine",
 		label: "Inference Engine",
@@ -7466,6 +7460,8 @@ var EVENT_OWNER_TYPES = [
 * nothing failing until a caller asked.
 */
 var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
+/** The same list as a Zod enum, for the cap input that carries it. */
+var MediaPresenceOwnerKindSchema = _enum([...EVENT_OWNER_TYPES, "track"]);
 new Set(EVENT_OWNER_TYPES);
 var EncodeProfileSchema = object({
 	video: object({
@@ -15946,30 +15942,30 @@ var deviceManagerCapability = {
 		*/
 		getAllBindings: method(object({}), array(DeviceBindingsForDeviceSchema)),
 		/**
-		* Activate (or deactivate) a wrapper addon — or ONE of its sources — for a
-		* (device, cap) pair.
-		*
-		* Persists the binding via ctx.settings; `active: false` on a SINGLETON cap
-		* clears the wrapper (falling back to native if one is registered). On a
-		* COLLECTION cap it adds to the per-device DENY set instead, and the
-		* wrapper binding is left exactly as it was — a cap with several sources
-		* has no "which one" for `getBindings` to answer (D556).
-		*
-		* `sourceId` is what makes the switch match its label. One addon can serve
-		* several of a device's sources (`addon-provider-reolink` answers a hub
-		* child with `native:reolink:onboard` AND `native:reolink:hub`), so a
-		* toggle keyed by addon would turn off both while saying it turned off one
-		* — the D62 defect with the polarity reversed (D557). Naming the source
-		* denies exactly that source. OMITTING it keeps the cap-wide meaning
-		* D556 shipped: every source this addon serves for this device, which is
-		* also how a deny entry persisted before the re-key is still read.
+		* Activate (or deactivate) a wrapper addon for a (device, cap) pair — the
+		* per-camera function switch's ONE authority (D62).
+		*
+		* SINGLETON capabilities only. Persists the binding via ctx.settings;
+		* `active: false` clears the wrapper (falling back to native if one is
+		* registered) by persisting the explicit `{ wrapperAddonId: null }` marker,
+		* which is what stops `getBindings` re-binding a `defaultActive` wrapper.
+		*
+		* **A COLLECTION capability is REFUSED by name.** It briefly took a
+		* `sourceId` and wrote a per-device DENY set, so one of an addon's several
+		* sources could be switched off without switching off the rest (D556, then
+		* D555's re-key by source). The operator removed the whole idea the same
+		* day: *"tutti i providers funzionano sempre, non serve
+		* disattivarli/attivarli … loro vivono lì"* (D557 amended, third). A
+		* collection cap's providers are a DERIVED set — every addon that provides
+		* the cap for this device type, computed on every read and persisted
+		* nowhere — so there is nothing here to activate, and a verb that accepted
+		* the call could only write a field the enumeration does not read. That is
+		* the D62 shape, and this repo has shipped it four times.
 		*/
 		setWrapperActive: method(object({
 			deviceId: number(),
 			capName: string(),
 			wrapperAddonId: string(),
-			/** The `ClipSource.source` id to toggle. Absent = all of the addon's. */
-			sourceId: string().optional(),
 			active: boolean()
 		}), _void(), {
 			kind: "mutation",
@@ -24913,6 +24909,35 @@ var pipelineAnalyticsCapability = {
 			deviceId: number()
 		}), array(MediaFileInfoSchema).readonly()),
 		/**
+		* Which of `ownerIds` hold at least ONE media row — an INDEX read, never a
+		* blob read, and the LICENCE `videoclips` needs to publish a `thumbnail`.
+		*
+		* The event-media URL is stamped from a template for every event in the
+		* system, so "the plane is up" was being served as "there are bytes": 64 of
+		* one camera's 179 clips pointed at a 404 (device 3836, 2026-08-17). This
+		* is the question that turns the stamp into a claim.
+		*
+		* It is on the WIRE because the clip source is registered by the addon that
+		* owns the FOOTAGE, not by this one (D560) — the probe used to be an
+		* in-process `MediaStore` read. One call per OWNER KIND, never one per
+		* owner: that N+1 is what `MediaStore.ownersWithMedia` was written to
+		* prevent, and crossing a process boundary makes it worse, not better.
+		* `ownerIds` is bounded at the same 5 000 the annotation fetch is bounded
+		* at, so one pathological camera-day cannot mint an unbounded request.
+		*
+		* THROWS rather than answering partially. A probe that quietly
+		* under-reports reads as "these owners have nothing" and the caller drops
+		* thumbnails that exist — the opposite failure to the one above, and
+		* equally invisible.
+		*
+		* `deviceId` is the authorization subject, exactly as on `getEventMedia`.
+		*/
+		ownersWithMedia: method(object({
+			deviceId: number(),
+			ownerKind: MediaPresenceOwnerKindSchema,
+			ownerIds: array(string()).max(5e3)
+		}), array(string()).readonly()),
+		/**
 		* Search object events by text query using CLIP cosine similarity.
 		* Encodes `text` via the `embedding-encoder` cap, queries the
 		* `ObjectEmbeddingStore` with optional prefilters, ranks all matching
@@ -28966,6 +28991,18 @@ var vectorStoreCapability = {
 		stats: method(VectorStatsInputSchema, VectorStatsResultSchema, { auth: "admin" })
 	}
 };
+_enum([
+	"queue-full",
+	"camera-backoff",
+	"sleeping",
+	"camera-refused",
+	"no-keyframe",
+	"no-catalog-row",
+	"unsupported",
+	"unknown-device",
+	"uid-missing"
+]);
+_enum(["deferred", "final"]);
 var ClipSchema = object({
 	/** Opaque, provider-namespaced id. The default provider encodes the time
 	*  window so `getClipPlayback` is self-contained (no event re-query). */
@@ -29116,7 +29153,25 @@ var ClipSchema = object({
 	*/
 	playable: boolean().optional(),
 	/** Why {@link playable} is false, verbatim (`no-file-for-window`). */
-	unplayableReason: string().optional()
+	unplayableReason: string().optional(),
+	/**
+	* This clip is STILL BEING WRITTEN, so {@link ClipSchema.timeRange}`.endMs`
+	* is not its end.
+	*
+	* Absent — the common case — means the row is closed and its `endMs` is the
+	* end of the recording. Present and `true` means the source told us the file
+	* has no end yet, and the `endMs` we carry is whatever the camera's index
+	* entry happened to hold: on a Reolink E1 Outdoor PoE (592, measured
+	* 2026-09-20) the newest file `…_192927_000000_…_0.mp4` reported an `endTime`
+	* of 19:29:56 and STILL reported it eight minutes later, while the file went
+	* on growing. A surface that drew 29 s there was lying about a clip that
+	* plays for minutes, on the one row the operator looks at first.
+	*
+	* `endMs` is deliberately still a number: it is the best bound anything has
+	* for a mint window or a byte fetch, and every consumer already requires it.
+	* This flag says what it is WORTH, and a duration is not drawn from it.
+	*/
+	inProgress: boolean().optional()
 });
 var ClipPlaybackSchema = object({
 	/**
@@ -29199,59 +29254,17 @@ var ClipSourceSchema = object({
 	* alternative — a `native:reolink:* → provider-reolink` table inside the
 	* widget — is a second authority on provider identity living in the one
 	* package with no business knowing it, wrong the day a third source appears
-	* (D557). One addon may serve SEVERAL sources: `addon-provider-reolink`
-	* answers a hub child with both `native:reolink:onboard` and
-	* `native:reolink:hub`, which is why the per-device switch is keyed by
-	* SOURCE and not by this (D555).
+	* (D557). One addon may serve SEVERAL sources, which is why the per-device
+	* switch is keyed by SOURCE and not by this (D555) — `addon-provider-reolink`
+	* served a hub child two of them until the two views were measured to be one
+	* store read twice (D555) and then read ONE way (D565).
 	*
 	* Optional for version skew only. The collection dispatcher stamps it from
 	* the registry, so a row that travelled through the fan-out carries the
 	* authoritative id whatever the provider filled in.
 	*/
 	addonId: string().optional(),
-	/**
-	* Which API this source resolved to FOR THIS CAMERA, when it has a choice.
-	*
-	* A source may cover one store through more than one surface — the Reolink
-	* provider reads a hub child through the parent's event log and a standalone
-	* through its own file list, because that is what each camera answers. The
-	* CHOICE is the provider's, made from what the camera is, and is never a row
-	* the operator has to understand; but it is REPORTED, because a source that
-	* silently reads a different API on two cameras and then behaves differently
-	* is the thing nobody can debug later. Absent when the source has only one
-	* way to read its store.
-	*/
-	via: string().optional(),
-	availability: ClipSourceAvailabilitySchema,
-	/**
-	* The operator switched this source OFF for this camera.
-	*
-	* Deliberately NOT a member of {@link ClipSourceAvailabilitySchema}'s
-	* vocabulary. That enum models what the source CAN do — a sleeping camera, an
-	* unmounted card, an index that disagrees with its own calendar — and a
-	* switched-off source could answer perfectly well; the operator decided it
-	* should not. Folding the choice in is how `disabled` and `broken` stop being
-	* distinguishable, which is the D62 rule this repo has already paid for twice:
-	* an off switch is REPORTED off (`CameraStatus.switchedOff`, the same word),
-	* and disabled must never look like broken. It is also what lets every
-	* exhaustive consumer of the availability enum keep compiling.
-	*
-	* A switched-off source contributes NO clips (`listClips` never calls it) and
-	* its row carries no `catalogAsOf`: nothing confirms a catalog it is not
-	* allowed to serve, and a frozen age that can only grow draws a stalling
-	* source rather than an off switch.
-	*
-	* The row survives BECAUSE it is the control the operator switches the source
-	* back on from — D554 decision 4's rule ("a source that cannot answer
-	* produces a ROW, not an absence") applied to the one case D556 carved out of
-	* it, and D557's own kept property ("a source is never hidden, only its
-	* rows"). Absent means on.
-	*
-	* A provider never sets this — like {@link ClipSourceSchema.addonId} it is
-	* stamped by the collection dispatcher, which holds the registry's projection
-	* of the persisted authority (D556) and is the only place that knows it.
-	*/
-	switchedOff: boolean().optional()
+	availability: ClipSourceAvailabilitySchema
 });
 var videoclipsCapability = {
 	name: "videoclips",
@@ -29271,17 +29284,31 @@ var videoclipsCapability = {
 	* `device-config-widget-wrapped-binding.spec.ts` pins that a `kind:'wrapped'`
 	* binding entry derives the same section a native one does.
 	*
-	* `topTab` because the browser owns the whole pane (a day's clips, a source
-	* list and a player), exactly as `ptz` does; the widget itself is
-	* `host/clips-browser` in ui-library's `HOST_WIDGETS`.
+	* **It is a SECTION of the Recording tab, at the end of it — not a tab of
+	* its own.** It shipped as a `clips` top-tab and the operator rejected the
+	* placement: *"utilizzerei la stessa tab recordings, lì abbiamo già tutto il
+	* necessario, una nuova sezione alla fine per le clips"*. The Recording tab
+	* already holds the recorder's panel, the schedule bands and the unified
+	* retention policy; footage the camera itself holds is the same question,
+	* asked of a different store. `order: 100` puts it after all of them with
+	* room left in front. The `clips` entry in `WELL_KNOWN_TABS` went with it —
+	* a well-known id nobody declares is an invitation to mint the tab again.
+	*
+	* `topTab` stays: the browser owns a pane (a day's tiles, a source list and
+	* a player) and the Config tab's inner bar has no room for one. The widget
+	* itself is `host/clips-browser` in ui-library's `HOST_WIDGETS`, and because
+	* the admin Recordings page renders every `location:'top-tab'` +
+	* `tab:'recording'` section behind its camera picker
+	* (`CameraRecordingSettingsSection`), this declaration lands the section on
+	* BOTH surfaces with no second wiring.
 	*/
 	deviceConfig: { ui: {
 		kind: "widget",
 		widgetId: "host/clips-browser",
-		tab: "clips",
+		tab: "recording",
 		topTab: true,
 		label: "Clips",
-		order: 0
+		order: 100
 	} },
 	methods: {
 		listClips: method(object({
@@ -29290,13 +29317,23 @@ var videoclipsCapability = {
 			until: number(),
 			limit: number().int().positive().optional(),
 			/**
-			* View filter over {@link ClipSourceSchema.source} values — the
-			* picker's selection, forwarded so a provider need not list what
-			* nobody is looking at. ABSENT means every source this camera has,
-			* which is the honest default for a surface whose whole point is that
-			* nothing is hidden (D554 3). A provider with one source ignores it.
+			* WHICH provider to ask — the `addonId` a {@link ClipSourceSchema} row
+			* carries, never a source id and never a list.
+			*
+			* Absent means the device's BOUND provider, which is CamStack on every
+			* camera today because that is what `deviceManager.getBindings`
+			* answers with. A provider the device is not bound to is refused by
+			* name rather than answered by another one (D552's
+			* `rejectUnresolvedAddonPin` rule).
+			*
+			* It replaced `sources?: string[]`, a VIEW filter over source ids that
+			* assumed the answer was a fan-out over everything a camera has. The
+			* operator settled otherwise on 2026-09-20 — *"il get videoclips
+			* prendere un provider opzionale, di default va su camstack"*,
+			* *"l'utilizzatore è uno solo"* — so the list is asked of one provider
+			* at a time and there is nothing to filter out of it.
 			*/
-			sources: array(string()).optional()
+			provider: string().optional()
 		}), array(ClipSchema).readonly(), {
 			kind: "query",
 			auth: "protected"
@@ -44834,6 +44871,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.ownersWithMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.pauseForStorageMigration": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -48734,6 +48777,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.ownersWithMedia": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.proposeRetrainAnnotations": [{
 		name: "deviceId",
 		form: "single",

package/dist/index.mjs

@@ -5359,7 +5359,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-CopaBJss.mjs
+//#region ../types/dist/sleep-CaB_hL5g.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -5559,12 +5559,6 @@ Object.fromEntries([
 		icon: "circle-dot",
 		order: 40
 	},
-	{
-		id: "clips",
-		label: "Clips",
-		icon: "clapperboard",
-		order: 41
-	},
 	{
 		id: "engine",
 		label: "Inference Engine",
@@ -7462,6 +7456,8 @@ var EVENT_OWNER_TYPES = [
 * nothing failing until a caller asked.
 */
 var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
+/** The same list as a Zod enum, for the cap input that carries it. */
+var MediaPresenceOwnerKindSchema = _enum([...EVENT_OWNER_TYPES, "track"]);
 new Set(EVENT_OWNER_TYPES);
 var EncodeProfileSchema = object({
 	video: object({
@@ -15942,30 +15938,30 @@ var deviceManagerCapability = {
 		*/
 		getAllBindings: method(object({}), array(DeviceBindingsForDeviceSchema)),
 		/**
-		* Activate (or deactivate) a wrapper addon — or ONE of its sources — for a
-		* (device, cap) pair.
-		*
-		* Persists the binding via ctx.settings; `active: false` on a SINGLETON cap
-		* clears the wrapper (falling back to native if one is registered). On a
-		* COLLECTION cap it adds to the per-device DENY set instead, and the
-		* wrapper binding is left exactly as it was — a cap with several sources
-		* has no "which one" for `getBindings` to answer (D556).
-		*
-		* `sourceId` is what makes the switch match its label. One addon can serve
-		* several of a device's sources (`addon-provider-reolink` answers a hub
-		* child with `native:reolink:onboard` AND `native:reolink:hub`), so a
-		* toggle keyed by addon would turn off both while saying it turned off one
-		* — the D62 defect with the polarity reversed (D557). Naming the source
-		* denies exactly that source. OMITTING it keeps the cap-wide meaning
-		* D556 shipped: every source this addon serves for this device, which is
-		* also how a deny entry persisted before the re-key is still read.
+		* Activate (or deactivate) a wrapper addon for a (device, cap) pair — the
+		* per-camera function switch's ONE authority (D62).
+		*
+		* SINGLETON capabilities only. Persists the binding via ctx.settings;
+		* `active: false` clears the wrapper (falling back to native if one is
+		* registered) by persisting the explicit `{ wrapperAddonId: null }` marker,
+		* which is what stops `getBindings` re-binding a `defaultActive` wrapper.
+		*
+		* **A COLLECTION capability is REFUSED by name.** It briefly took a
+		* `sourceId` and wrote a per-device DENY set, so one of an addon's several
+		* sources could be switched off without switching off the rest (D556, then
+		* D555's re-key by source). The operator removed the whole idea the same
+		* day: *"tutti i providers funzionano sempre, non serve
+		* disattivarli/attivarli … loro vivono lì"* (D557 amended, third). A
+		* collection cap's providers are a DERIVED set — every addon that provides
+		* the cap for this device type, computed on every read and persisted
+		* nowhere — so there is nothing here to activate, and a verb that accepted
+		* the call could only write a field the enumeration does not read. That is
+		* the D62 shape, and this repo has shipped it four times.
 		*/
 		setWrapperActive: method(object({
 			deviceId: number(),
 			capName: string(),
 			wrapperAddonId: string(),
-			/** The `ClipSource.source` id to toggle. Absent = all of the addon's. */
-			sourceId: string().optional(),
 			active: boolean()
 		}), _void(), {
 			kind: "mutation",
@@ -24909,6 +24905,35 @@ var pipelineAnalyticsCapability = {
 			deviceId: number()
 		}), array(MediaFileInfoSchema).readonly()),
 		/**
+		* Which of `ownerIds` hold at least ONE media row — an INDEX read, never a
+		* blob read, and the LICENCE `videoclips` needs to publish a `thumbnail`.
+		*
+		* The event-media URL is stamped from a template for every event in the
+		* system, so "the plane is up" was being served as "there are bytes": 64 of
+		* one camera's 179 clips pointed at a 404 (device 3836, 2026-08-17). This
+		* is the question that turns the stamp into a claim.
+		*
+		* It is on the WIRE because the clip source is registered by the addon that
+		* owns the FOOTAGE, not by this one (D560) — the probe used to be an
+		* in-process `MediaStore` read. One call per OWNER KIND, never one per
+		* owner: that N+1 is what `MediaStore.ownersWithMedia` was written to
+		* prevent, and crossing a process boundary makes it worse, not better.
+		* `ownerIds` is bounded at the same 5 000 the annotation fetch is bounded
+		* at, so one pathological camera-day cannot mint an unbounded request.
+		*
+		* THROWS rather than answering partially. A probe that quietly
+		* under-reports reads as "these owners have nothing" and the caller drops
+		* thumbnails that exist — the opposite failure to the one above, and
+		* equally invisible.
+		*
+		* `deviceId` is the authorization subject, exactly as on `getEventMedia`.
+		*/
+		ownersWithMedia: method(object({
+			deviceId: number(),
+			ownerKind: MediaPresenceOwnerKindSchema,
+			ownerIds: array(string()).max(5e3)
+		}), array(string()).readonly()),
+		/**
 		* Search object events by text query using CLIP cosine similarity.
 		* Encodes `text` via the `embedding-encoder` cap, queries the
 		* `ObjectEmbeddingStore` with optional prefilters, ranks all matching
@@ -28962,6 +28987,18 @@ var vectorStoreCapability = {
 		stats: method(VectorStatsInputSchema, VectorStatsResultSchema, { auth: "admin" })
 	}
 };
+_enum([
+	"queue-full",
+	"camera-backoff",
+	"sleeping",
+	"camera-refused",
+	"no-keyframe",
+	"no-catalog-row",
+	"unsupported",
+	"unknown-device",
+	"uid-missing"
+]);
+_enum(["deferred", "final"]);
 var ClipSchema = object({
 	/** Opaque, provider-namespaced id. The default provider encodes the time
 	*  window so `getClipPlayback` is self-contained (no event re-query). */
@@ -29112,7 +29149,25 @@ var ClipSchema = object({
 	*/
 	playable: boolean().optional(),
 	/** Why {@link playable} is false, verbatim (`no-file-for-window`). */
-	unplayableReason: string().optional()
+	unplayableReason: string().optional(),
+	/**
+	* This clip is STILL BEING WRITTEN, so {@link ClipSchema.timeRange}`.endMs`
+	* is not its end.
+	*
+	* Absent — the common case — means the row is closed and its `endMs` is the
+	* end of the recording. Present and `true` means the source told us the file
+	* has no end yet, and the `endMs` we carry is whatever the camera's index
+	* entry happened to hold: on a Reolink E1 Outdoor PoE (592, measured
+	* 2026-09-20) the newest file `…_192927_000000_…_0.mp4` reported an `endTime`
+	* of 19:29:56 and STILL reported it eight minutes later, while the file went
+	* on growing. A surface that drew 29 s there was lying about a clip that
+	* plays for minutes, on the one row the operator looks at first.
+	*
+	* `endMs` is deliberately still a number: it is the best bound anything has
+	* for a mint window or a byte fetch, and every consumer already requires it.
+	* This flag says what it is WORTH, and a duration is not drawn from it.
+	*/
+	inProgress: boolean().optional()
 });
 var ClipPlaybackSchema = object({
 	/**
@@ -29195,59 +29250,17 @@ var ClipSourceSchema = object({
 	* alternative — a `native:reolink:* → provider-reolink` table inside the
 	* widget — is a second authority on provider identity living in the one
 	* package with no business knowing it, wrong the day a third source appears
-	* (D557). One addon may serve SEVERAL sources: `addon-provider-reolink`
-	* answers a hub child with both `native:reolink:onboard` and
-	* `native:reolink:hub`, which is why the per-device switch is keyed by
-	* SOURCE and not by this (D555).
+	* (D557). One addon may serve SEVERAL sources, which is why the per-device
+	* switch is keyed by SOURCE and not by this (D555) — `addon-provider-reolink`
+	* served a hub child two of them until the two views were measured to be one
+	* store read twice (D555) and then read ONE way (D565).
 	*
 	* Optional for version skew only. The collection dispatcher stamps it from
 	* the registry, so a row that travelled through the fan-out carries the
 	* authoritative id whatever the provider filled in.
 	*/
 	addonId: string().optional(),
-	/**
-	* Which API this source resolved to FOR THIS CAMERA, when it has a choice.
-	*
-	* A source may cover one store through more than one surface — the Reolink
-	* provider reads a hub child through the parent's event log and a standalone
-	* through its own file list, because that is what each camera answers. The
-	* CHOICE is the provider's, made from what the camera is, and is never a row
-	* the operator has to understand; but it is REPORTED, because a source that
-	* silently reads a different API on two cameras and then behaves differently
-	* is the thing nobody can debug later. Absent when the source has only one
-	* way to read its store.
-	*/
-	via: string().optional(),
-	availability: ClipSourceAvailabilitySchema,
-	/**
-	* The operator switched this source OFF for this camera.
-	*
-	* Deliberately NOT a member of {@link ClipSourceAvailabilitySchema}'s
-	* vocabulary. That enum models what the source CAN do — a sleeping camera, an
-	* unmounted card, an index that disagrees with its own calendar — and a
-	* switched-off source could answer perfectly well; the operator decided it
-	* should not. Folding the choice in is how `disabled` and `broken` stop being
-	* distinguishable, which is the D62 rule this repo has already paid for twice:
-	* an off switch is REPORTED off (`CameraStatus.switchedOff`, the same word),
-	* and disabled must never look like broken. It is also what lets every
-	* exhaustive consumer of the availability enum keep compiling.
-	*
-	* A switched-off source contributes NO clips (`listClips` never calls it) and
-	* its row carries no `catalogAsOf`: nothing confirms a catalog it is not
-	* allowed to serve, and a frozen age that can only grow draws a stalling
-	* source rather than an off switch.
-	*
-	* The row survives BECAUSE it is the control the operator switches the source
-	* back on from — D554 decision 4's rule ("a source that cannot answer
-	* produces a ROW, not an absence") applied to the one case D556 carved out of
-	* it, and D557's own kept property ("a source is never hidden, only its
-	* rows"). Absent means on.
-	*
-	* A provider never sets this — like {@link ClipSourceSchema.addonId} it is
-	* stamped by the collection dispatcher, which holds the registry's projection
-	* of the persisted authority (D556) and is the only place that knows it.
-	*/
-	switchedOff: boolean().optional()
+	availability: ClipSourceAvailabilitySchema
 });
 var videoclipsCapability = {
 	name: "videoclips",
@@ -29267,17 +29280,31 @@ var videoclipsCapability = {
 	* `device-config-widget-wrapped-binding.spec.ts` pins that a `kind:'wrapped'`
 	* binding entry derives the same section a native one does.
 	*
-	* `topTab` because the browser owns the whole pane (a day's clips, a source
-	* list and a player), exactly as `ptz` does; the widget itself is
-	* `host/clips-browser` in ui-library's `HOST_WIDGETS`.
+	* **It is a SECTION of the Recording tab, at the end of it — not a tab of
+	* its own.** It shipped as a `clips` top-tab and the operator rejected the
+	* placement: *"utilizzerei la stessa tab recordings, lì abbiamo già tutto il
+	* necessario, una nuova sezione alla fine per le clips"*. The Recording tab
+	* already holds the recorder's panel, the schedule bands and the unified
+	* retention policy; footage the camera itself holds is the same question,
+	* asked of a different store. `order: 100` puts it after all of them with
+	* room left in front. The `clips` entry in `WELL_KNOWN_TABS` went with it —
+	* a well-known id nobody declares is an invitation to mint the tab again.
+	*
+	* `topTab` stays: the browser owns a pane (a day's tiles, a source list and
+	* a player) and the Config tab's inner bar has no room for one. The widget
+	* itself is `host/clips-browser` in ui-library's `HOST_WIDGETS`, and because
+	* the admin Recordings page renders every `location:'top-tab'` +
+	* `tab:'recording'` section behind its camera picker
+	* (`CameraRecordingSettingsSection`), this declaration lands the section on
+	* BOTH surfaces with no second wiring.
 	*/
 	deviceConfig: { ui: {
 		kind: "widget",
 		widgetId: "host/clips-browser",
-		tab: "clips",
+		tab: "recording",
 		topTab: true,
 		label: "Clips",
-		order: 0
+		order: 100
 	} },
 	methods: {
 		listClips: method(object({
@@ -29286,13 +29313,23 @@ var videoclipsCapability = {
 			until: number(),
 			limit: number().int().positive().optional(),
 			/**
-			* View filter over {@link ClipSourceSchema.source} values — the
-			* picker's selection, forwarded so a provider need not list what
-			* nobody is looking at. ABSENT means every source this camera has,
-			* which is the honest default for a surface whose whole point is that
-			* nothing is hidden (D554 3). A provider with one source ignores it.
+			* WHICH provider to ask — the `addonId` a {@link ClipSourceSchema} row
+			* carries, never a source id and never a list.
+			*
+			* Absent means the device's BOUND provider, which is CamStack on every
+			* camera today because that is what `deviceManager.getBindings`
+			* answers with. A provider the device is not bound to is refused by
+			* name rather than answered by another one (D552's
+			* `rejectUnresolvedAddonPin` rule).
+			*
+			* It replaced `sources?: string[]`, a VIEW filter over source ids that
+			* assumed the answer was a fan-out over everything a camera has. The
+			* operator settled otherwise on 2026-09-20 — *"il get videoclips
+			* prendere un provider opzionale, di default va su camstack"*,
+			* *"l'utilizzatore è uno solo"* — so the list is asked of one provider
+			* at a time and there is nothing to filter out of it.
 			*/
-			sources: array(string()).optional()
+			provider: string().optional()
 		}), array(ClipSchema).readonly(), {
 			kind: "query",
 			auth: "protected"
@@ -44830,6 +44867,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.ownersWithMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.pauseForStorageMigration": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -48730,6 +48773,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.ownersWithMedia": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.proposeRetrainAnnotations": [{
 		name: "deviceId",
 		form: "single",