@camstack/addon-osd-manager 0.1.26 → 0.1.28

package/dist/index.js

@@ -7567,6 +7567,111 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
+*
+* ## Two axes, deliberately separated
+*
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
+*
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
+*
+* ## The canonical call shape
+*
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
+*
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
+*
+* ## Why a channel emits at `info`
+*
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
+*/
+/**
+* The level a channel writes at once armed.
+*
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
+*/
+var LogChannelLevelSchema = _enum([
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
+*/
+var LogChannelDescriptorSchema = object({
+	/**
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
+	*/
+	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
+	/**
+	* Whether this channel can be narrowed to a camera.
+	*
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
+	*/
+	perDevice: boolean()
+});
+/**
+* An armed window over one channel, as the document hands it to a mirror.
+*
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
+*/
+var LogChannelWindowSchema = object({
+	channel: string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: array(number().int()).readonly().nullable()
+});
+/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -11834,6 +11939,35 @@ var MutationFilterSchema = object({
 	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
 	whereNot: record(string(), unknown()).optional()
 });
+/**
+* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
+*
+* `as` names the slot in the result, so the SAME column may be asked twice with
+* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
+* a `Record<column, op>` shape could not express.
+*/
+var AggregateFieldSchema = object({
+	/** Result key. */
+	as: string().min(1),
+	/** Column to aggregate. Must be a real column of a declared collection. */
+	field: string().min(1),
+	op: _enum([
+		"sum",
+		"min",
+		"max"
+	])
+});
+/**
+* `COUNT(*)` plus one number per requested field.
+*
+* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
+* that really is 0 are different facts, and an accounting caller that renders
+* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
+*/
+var AggregateResultSchema = object({
+	count: number().int(),
+	values: record(string(), number().nullable())
+});
 /** A single stored record: `{ id, data }`. */
 var SettingsRecordSchema = object({
 	id: string(),
@@ -12001,6 +12135,32 @@ var settingsStoreCapability = {
 			collection: string(),
 			filter: QueryFilterSchema.optional()
 		}), number()),
+		/**
+		* `COUNT(*)` and one `SUM` / `MIN` / `MAX` per requested field, in ONE
+		* statement, over the rows `filter` selects.
+		*
+		* Exists because "how much is there" was being answered by materialising
+		* "what is there". The recorder's storage-pressure sweep asked its in-RAM
+		* footage index for bytes/count/oldest/newest across a set of storage
+		* locations twice a minute, and the only way to answer that from a map is
+		* to visit every row — 7.1 M of them on the live hub, ~15 M row visits a
+		* minute on the main thread, which is also why the whole archive had to
+		* stay resident to be visited. The question is a sum; nothing needs to be
+		* materialised to answer it.
+		*
+		* **The engine REFUSES a field it cannot serve**, exactly as
+		* `query.columns` does and unlike a PREDICATE, which is skipped when
+		* unresolvable. A dropped predicate over-matches and the caller sees extra
+		* rows; a dropped aggregate returns a NUMBER that is wrong and looks
+		* exactly like a real one. That asymmetry is what this repo has already
+		* paid for once in `count`.
+		*/
+		aggregate: method(object({
+			namespace: string().optional(),
+			collection: string(),
+			fields: array(AggregateFieldSchema).readonly(),
+			filter: QueryFilterSchema.optional()
+		}), AggregateResultSchema),
 		/** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
 		histogram: method(object({
 			namespace: string().optional(),
@@ -12207,6 +12367,15 @@ var dataStoreProviderCapability = {
 			collection: string(),
 			filter: QueryFilterSchema.optional()
 		}), number(), { auth: "admin" }),
+		/** `COUNT(*)` plus one SUM/MIN/MAX per field, in one statement. Mirror of
+		*  `settings-store.aggregate` — see it for why an unresolvable field is
+		*  refused rather than dropped. */
+		aggregate: method(object({
+			namespace: string().optional(),
+			collection: string(),
+			fields: array(AggregateFieldSchema).readonly(),
+			filter: QueryFilterSchema.optional()
+		}), AggregateResultSchema, { auth: "admin" }),
 		/** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
 		histogram: method(object({
 			namespace: string().optional(),
@@ -12984,24 +13153,6 @@ var deviceProviderCapability = {
 		})
 	}
 };
-/**
-* Device Manager capability — hub-side singleton that unifies device persistence,
-* live registry access, and all management operations into a single tRPC surface.
-*
-* Replaces:
-*   - `device-persistence` capability (persistence methods absorbed here)
-*   - `device-management.router.ts` (deleted in Phase 2)
-*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
-*
-* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
-* fork into separate processes but never run on remote cluster agents. Therefore:
-*   - No nodeId routing needed — this is a pure hub singleton.
-*   - The hub's DeviceRegistry is the single source of truth for all live devices.
-*   - No shadow registry or cross-node aggregation required.
-*
-* Forked workers register devices back to the hub via `ctx.devices`
-* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
-*/
 /** One child-placement directive on a container's `childLayout`. Structurally
 *  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
 *  shape for the same field. The child is identified by its re-sync-stable
@@ -13513,6 +13664,39 @@ var deviceManagerCapability = {
 		/** List children of a parent device (by parent numeric id). */
 		getChildren: method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)),
 		/**
+		* `getChildren` for a NAMED SET of parents, in one call.
+		*
+		* The accessory reconcile in `device-cap-proxy.ts` asks this question once
+		* per registered device — every `BaseDevice` inherits a
+		* `getAccessoryChildren()` that returns `[]`, so even a leaf accessory
+		* pays a round-trip to learn it has nothing to prune. Measured on the live
+		* hub 2026-08-27 over a 120-second boot window, fleet of 1 017 devices:
+		* `DeviceRowStore.list < DeviceRowStore.listByParent < getChildren` at
+		* **1 024 calls** returning **919 rows in total** — 1 024 RPCs and 1 024
+		* indexed scans to move less than one row each. `listByParentMany`
+		* collapses the scans; this collapses the RPCs.
+		*
+		* Keyed by parent id as a STRING — a JSON object cannot key by number
+		* (same reason as `getDeviceStatusAggregateBatch`). The per-parent value
+		* is exactly what `getChildren` returns for that parent.
+		*
+		* A parent with no children — or one the fleet does not know — is ABSENT
+		* from the record, never an invented empty row: the same contract as
+		* `DeviceRowStore.getMany`/`listByParentMany`. An EMPTY `parentDeviceIds`
+		* reads nothing at all rather than degrading to "every device".
+		*
+		* `parentDeviceIds` is capped at {@link DEVICE_CHILDREN_BATCH_MAX} — see
+		* that constant for why. A caller with more parents than that sends more
+		* than one call; it never sends one pathological one.
+		*
+		* Version skew: this is a NEW method, not a new field on `getChildren`, so
+		* a hub that predates it answers NOT_FOUND rather than silently stripping
+		* an unknown input key and answering a DIFFERENT question. The kernel-side
+		* loader degrades to per-parent `getChildren` on that error — see
+		* `children-batch-loader.ts`.
+		*/
+		getChildrenBatch: method(object({ parentDeviceIds: array(number()).max(256) }), record(string(), array(DeviceInfoSchema))),
+		/**
 		* Resolve the devices LINKED to a camera — the single policy authority
 		* both consumers call (viewer devices panel + pipeline-analytics event
 		* kinds/ingest). Device-tree children are ALWAYS included; mode 'auto'
@@ -14660,6 +14844,80 @@ var llmCapability = {
 		})
 	}
 };
+/**
+* `log-channels` — the capability an addon DECLARES its diagnostic channels
+* through. It stores nothing.
+*
+* ## Why a capability at all, and why this shape
+*
+* Which channels exist is knowledge only the addon has: `stream-broker` knows
+* webrtc/ICE/RTP, `provider-reolink` knows baichuan/handshake. A central list
+* maintained by hand rots at the first addition and rots INVISIBLY — nothing
+* fails, an operator just never sees the channel somebody added. So the list
+* is assembled from declarations at runtime.
+*
+* The shape is copied from `log-destination.cap.ts`, which already does
+* exactly this job: `mode: 'collection'`, `internal: true`,
+* `mount: { kind: 'skip' }` — no tRPC route, no generated hooks — while
+* `addons.listCapabilityProviders` still enumerates it, and the hub's
+* `CapabilityRegistry` still holds an RPC proxy per provider so a forked
+* runner's declarations reach hub-main over the transport that already exists.
+* No new UDS message, no second registry.
+*
+* ## What it deliberately does NOT own
+*
+* The VALUES — which channel is armed, for which cameras, until when — live in
+* ONE place: the logging settings document on the `system` cap
+* (`getLoggingSettings` / `setLoggingSettings`). Two authorities over the same
+* value is the defect the plan behind this work exists to remove, and
+* `setRequestCensus` was retired (D245) rather than allowed to be a second
+* one. {@link logChannelsCapability} therefore has no getter for a level, no
+* setter for a window and no persistence of any kind.
+*
+* ## Why `apply` is here even so
+*
+* The gate lives in the addon's PROCESS; the document lives in hub-main. Some
+* seam has to carry the value from the authority to the mirror, and a channel
+* that cannot be reached is precisely the dead knob this whole slice exists to
+* make impossible (D62 — `audioThresholdDbfs`, the HA entities with no source).
+* `apply` is that seam and nothing more: it writes an in-memory mirror, it
+* persists nothing, it is never the source of a value, and it is called only
+* with a set the hub actually read (D49 — a read that fails does not call it
+* at all, so no channel is silently disarmed by a bad read).
+*/
+/** What `apply` reports back — enough to log, not enough to be a second state. */
+var LogChannelApplyResultSchema = object({
+	/** How many declared channels are armed in this process after the call. */
+	armed: number().int().min(0),
+	/**
+	* Names the document armed that this process does not declare. Reported
+	* rather than swallowed: a name here is either a typo or an addon that has
+	* not booted, and both deserve a line instead of silence.
+	*/
+	unknown: array(string()).readonly()
+});
+var logChannelsCapability = {
+	name: "log-channels",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		/** The channels this addon declares. Inert: no value, no state. */
+		list: method(_void(), array(LogChannelDescriptorSchema).readonly()),
+		/**
+		* Refresh this process's mirror from the document's FULL set of armed
+		* windows.
+		*
+		* Full and not incremental on purpose: the document is the authority, so a
+		* channel it does not name is disarmed here. An incremental apply would
+		* let a disarm get lost in transit and leave a channel running that
+		* nobody can see is running.
+		*/
+		apply: method(object({ windows: array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
+	},
+	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
+	mount: { kind: "skip" }
+};
 var LogLevelSchema = _enum([
 	"debug",
 	"info",
@@ -33358,10 +33616,11 @@ var DiagnosticIdSchema = _enum(["request-census"]);
 * The layers of the level hierarchy, general → specific. The most specific
 * layer that carries an explicit value wins.
 *
-* `component` is DECLARED and not yet resolvable: the per-component channels
-* are a later slice of the same plan, and a `levelSource` enum that has to
-* grow later would force every consumer of this document to change with it.
-* Nothing returns `component` today.
+* `component` became RESOLVABLE on 2026-08-27: a component is a declared log
+* CHANNEL (`stream-broker.webrtc`, `provider-reolink.baichuan`), named by
+* `scopeComponent`. It was declared-but-dark in the first slice precisely so
+* that turning it on would not force every consumer of this document to widen
+* a `levelSource` enum — which is what has now not happened.
 */
 var LoggingScopeKindSchema = _enum([
 	"cluster",
@@ -33388,6 +33647,14 @@ var LoggingLevelLayerSchema = object({
 	scope: LoggingScopeKindSchema,
 	/** The node this layer speaks for; `null` on the cluster layer. */
 	nodeId: string().nullable(),
+	/**
+	* The declared channel this layer speaks for; `null` on every layer but
+	* `component`. Never folded into `nodeId`: a component level is CLUSTER-WIDE
+	* by design — the convention this repo settled on is one orchestrator-wide
+	* setting, never per node (D52) — so a component layer that carried a node
+	* would invite a per-node copy of a value that has no per-node meaning.
+	*/
+	component: string().nullable(),
 	/** Explicitly set here, or `null` when this layer inherits. */
 	level: LogLevelSchema$1.nullable()
 });
@@ -33429,6 +33696,49 @@ var DiagnosticWindowPatchSchema = object({
 	reportEveryMs: number().int().positive().optional()
 });
 /**
+* A channel ARMED, as the document reports it.
+*
+* `armMs` is not echoed back: what an operator needs to see is the deadline
+* and the time left, because a diagnostic left running is itself an incident
+* and "armed for 10 minutes" said an hour ago is not an answer.
+*/
+var LogChannelWindowStateSchema = object({
+	channel: string(),
+	armed: boolean(),
+	/** Epoch ms the window closes at. 0 when disarmed. */
+	armedUntilMs: number(),
+	/** Ms left before it expires on its own. 0 when disarmed. */
+	remainingMs: number(),
+	/**
+	* The cameras it is narrowed to, or `null` for every camera.
+	*
+	* A channel declared `perDevice: false` can only ever report `null` here:
+	* its lines do not carry `tags: { deviceId }`, so narrowing them would
+	* produce a filter that silently matches nothing. The server REFUSES such a
+	* patch rather than quietly widening it — ignoring the request would teach
+	* the operator that per-camera filtering works on that channel when it does
+	* not.
+	*/
+	deviceIds: array(number().int()).readonly().nullable()
+});
+/**
+* `armMs: 0` DISARMS. Same grammar as {@link DiagnosticWindowPatchSchema}, and
+* for the same reason: a channel is a window with a deadline, never a switch.
+*/
+var LogChannelWindowPatchSchema = object({
+	channel: string().min(1),
+	armMs: number().int().min(0),
+	/**
+	* Narrow to these numeric device ids. Absent or `null` = every camera.
+	*
+	* Numeric because the repo's own rule makes it possible: every log line
+	* about a device carries `tags: { deviceId }` with the numeric id. That rule
+	* was paid for with a 22% thumbnail gap and a 3-hour media blackout both
+	* diagnosed by hand, and this is the first thing that collects on it.
+	*/
+	deviceIds: array(number().int()).readonly().nullable().optional()
+});
+/**
 * A PATCH, and patches MERGE.
 *
 * A field absent from the patch is left exactly as it was — arming a
@@ -33447,7 +33757,14 @@ var LoggingSettingsPatchSchema = object({
 	* Only the diagnostics NAMED here change. An armed window that is not listed
 	* keeps running — a patch is never a full replacement.
 	*/
-	diagnostics: array(DiagnosticWindowPatchSchema).readonly().optional()
+	diagnostics: array(DiagnosticWindowPatchSchema).readonly().optional(),
+	/**
+	* Only the channels NAMED here change. An armed channel that is not listed
+	* keeps running — same rule as `diagnostics`, because a patch that silently
+	* disarmed the channels it did not mention would make the Levels page and
+	* the Diagnostics page fight over the same value.
+	*/
+	channels: array(LogChannelWindowPatchSchema).readonly().optional()
 });
 /**
 * Which LAYER of the hierarchy is addressed. Absent = the cluster layer.
@@ -33460,9 +33777,22 @@ var LoggingSettingsPatchSchema = object({
 * authority over the whole hierarchy and answers for every layer, so the
 * layer selector needs a name the transport does not already own.
 */
-var GetLoggingSettingsInputSchema = object({ scopeNodeId: string().optional() });
+var GetLoggingSettingsInputSchema = object({
+	scopeNodeId: string().optional(),
+	/**
+	* The declared CHANNEL this document is addressed at, when the caller wants
+	* the `component` layer. Absent = the node/cluster hierarchy only.
+	*
+	* Naming it separately rather than overloading `scopeNodeId` keeps the two
+	* axes from collapsing: a component level is cluster-wide, a node level is
+	* not, and one selector for both would make "which of these two did I just
+	* set" unanswerable — the exact ambiguity `explicit` exists to remove.
+	*/
+	scopeComponent: string().optional()
+});
 var SetLoggingSettingsInputSchema = object({
 	scopeNodeId: string().optional(),
+	scopeComponent: string().optional(),
 	patch: LoggingSettingsPatchSchema
 });
 /**
@@ -33477,9 +33807,20 @@ var SetLoggingSettingsInputSchema = object({
 var LoggingSettingsStateSchema = object({
 	/** The layer this document was read at. `null` = the cluster layer. */
 	scopeNodeId: string().nullable(),
+	/** The channel this document was read at. `null` = no component layer. */
+	scopeComponent: string().nullable(),
 	effective: LoggingEffectiveSchema,
 	explicit: LoggingExplicitSchema,
 	activeWindows: array(DiagnosticWindowSchema).readonly(),
+	/**
+	* Every channel the cluster's addons DECLARE, gathered from the
+	* `log-channels` providers. Not stored anywhere: assembled per read, so a
+	* channel added by a redeployed addon appears without anybody editing a
+	* list, and a channel whose addon is gone stops being offered.
+	*/
+	channels: array(LogChannelDescriptorSchema).readonly(),
+	/** The channels ARMED right now, each with its deadline. */
+	activeChannels: array(LogChannelWindowStateSchema).readonly(),
 	persisted: boolean()
 });
 var systemCapability = {
@@ -34788,6 +35129,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	llmRuntimeCapability,
 	localNetworkCapability,
 	lockControlCapability,
+	logChannelsCapability,
 	logDestinationCapability,
 	loginMethodCapability,
 	mediaPlayerCapability,
@@ -35754,6 +36096,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"dataStoreProvider.aggregate": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"dataStoreProvider.count": {
 		capName: "data-store-provider",
 		capScope: "system",
@@ -36168,6 +36516,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getChildrenBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getConfigSchema": {
 		capName: "device-manager",
 		capScope: "system",
@@ -37218,6 +37572,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"logChannels.apply": {
+		capName: "log-channels",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"logChannels.list": {
+		capName: "log-channels",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"logDestination.query": {
 		capName: "log-destination",
 		capScope: "system",
@@ -39372,6 +39738,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.aggregate": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"settingsStore.count": {
 		capName: "settings-store",
 		capScope: "system",
@@ -40951,6 +41323,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.getChildrenBatch": [{
+		name: "parentDeviceIds",
+		form: "array",
+		optional: false
+	}],
 	"deviceManager.getConfigSchema": [{
 		name: "deviceId",
 		form: "single",