@camstack/addon-pipeline 1.2.133 → 1.2.135

package/dist/{dist-7Uc6NdFm.mjs → dist-C1dXLLQq.mjs}

@@ -8413,6 +8413,362 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
+*
+* ## Two axes, deliberately separated
+*
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
+*
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
+*
+* ## The canonical call shape
+*
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
+*
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
+*
+* ## Why a channel emits at `info`
+*
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
+*/
+/**
+* The level a channel writes at once armed.
+*
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
+*/
+var LogChannelLevelSchema = _enum([
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
+*/
+var LogChannelDescriptorSchema = object({
+	/**
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
+	*/
+	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
+	/**
+	* Whether this channel can be narrowed to a camera.
+	*
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
+	*/
+	perDevice: boolean()
+});
+/**
+* An armed window over one channel, as the document hands it to a mirror.
+*
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
+*/
+var LogChannelWindowSchema = object({
+	channel: string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: array(number().int()).readonly().nullable()
+});
+/**
+* The gate a hot path holds.
+*
+* Obtain it ONCE — at module scope or in a constructor — and keep the
+* reference. Looking a channel up by name per line would put a Map lookup on
+* the path this class exists to keep free.
+*/
+var LogChannelGate = class {
+	descriptor;
+	/**
+	* HOT PATH GUARD. A plain data FIELD, and it must stay one.
+	*
+	* `log-channel.spec.ts` asserts the property descriptor has no getter and
+	* booby-traps the device set, so turning this into an accessor — or reading
+	* anything before it — fails the spec instead of taxing every line the
+	* process emits.
+	*/
+	on = false;
+	/** `null` while armed for every camera. Never read while `on` is false. */
+	devices = null;
+	level;
+	closesAtMs = 0;
+	constructor(descriptor) {
+		this.descriptor = descriptor;
+		this.level = descriptor.defaultLevel;
+	}
+	/** Epoch ms this channel disarms itself at. 0 when disarmed. */
+	get armedUntilMs() {
+		return this.on ? this.closesAtMs : 0;
+	}
+	/**
+	* Does this channel want a line about `deviceId`?
+	*
+	* Call it only behind `gate.on &&`. On its own it is still correct — the
+	* guard is repeated inside — but the point of the prefix is that a disarmed
+	* channel must not pay the call at all.
+	*/
+	wants(deviceId) {
+		if (!this.on) return false;
+		return this.devices === null || this.devices.has(deviceId);
+	}
+	/**
+	* Emit one line on this channel, at the channel's declared level.
+	*
+	* The channel name is added as `tags.logChannel` so LogQL can select the
+	* channel without matching on the message text, and whatever `tags` the
+	* caller passed — `deviceId` above all — is preserved.
+	*/
+	log(logger, message, extras) {
+		if (!this.on) return;
+		const tags = {
+			...extras.tags,
+			logChannel: this.descriptor.name
+		};
+		const line = {
+			...extras,
+			tags
+		};
+		if (this.level === "error") logger.error(message, line);
+		else if (this.level === "warn") logger.warn(message, line);
+		else logger.info(message, line);
+	}
+	/**
+	* Arm (or RE-arm, restarting) this channel. Off the hot path only.
+	*
+	* An empty `deviceIds` list is treated as "every camera" rather than "no
+	* camera": a window that matches nothing is indistinguishable from a
+	* disarmed one, and the operator who asked for it would wait for lines that
+	* can never come.
+	*/
+	arm(window) {
+		const ids = window.deviceIds;
+		this.devices = ids === null || ids.length === 0 ? null : new Set(ids);
+		this.closesAtMs = window.armedUntilMs;
+		this.on = true;
+	}
+	/** Disarm. Off the hot path only. */
+	disarm() {
+		this.on = false;
+		this.devices = null;
+		this.closesAtMs = 0;
+	}
+};
+/**
+* Every channel this PROCESS declares, and the mirror of what is armed on it.
+*
+* One per process. A forked runner has its own, and it is refreshed through
+* the `log-channels` capability by the hub that owns the document — the
+* registry never reaches for a value itself.
+*/
+var LogChannelRegistry = class {
+	gates = /* @__PURE__ */ new Map();
+	/**
+	* Declare a channel and get its gate.
+	*
+	* A duplicate name throws. Two declarations of one name is a programming
+	* error, not a merge: the operator would arm one and the other would stay
+	* dark, which is the dead-knob shape (D62) with an extra step.
+	*/
+	declare(descriptor) {
+		const parsed = LogChannelDescriptorSchema.parse(descriptor);
+		if (this.gates.get(parsed.name) !== void 0) throw new Error(`log channel "${parsed.name}" is already declared in this process — two declarations of one name is a programming error, not a merge`);
+		const gate = new LogChannelGate(parsed);
+		this.gates.set(parsed.name, gate);
+		return gate;
+	}
+	/** The declarations, sorted by name so a list is stable to read and diff. */
+	list() {
+		return [...this.gates.values()].map((gate) => gate.descriptor).sort((a, b) => a.name.localeCompare(b.name));
+	}
+	/** The gate for a declared channel, or `undefined`. */
+	gate(name) {
+		return this.gates.get(name);
+	}
+	/**
+	* Apply the FULL set of armed windows. Off the hot path.
+	*
+	* Full, not incremental, and that is the whole design: the document is the
+	* authority, so a channel the document does not name is disarmed here. An
+	* incremental apply would let a disarm get lost in transit and leave a
+	* channel running that nobody can see is running.
+	*
+	* A window already past its deadline is ignored rather than armed — a
+	* restore that re-armed an expired window would make a forgotten diagnostic
+	* immortal across restarts.
+	*
+	* Returns the names it could not place, so the caller can log them: a
+	* channel named in the document that this process does not declare is
+	* either a typo or an addon that has not booted yet, and both deserve a
+	* line rather than silence.
+	*/
+	apply(windows, nowMs) {
+		const wanted = /* @__PURE__ */ new Map();
+		const unknown = [];
+		for (const window of windows) {
+			if (window.armedUntilMs <= nowMs) continue;
+			if (!this.gates.has(window.channel)) {
+				unknown.push(window.channel);
+				continue;
+			}
+			wanted.set(window.channel, window);
+		}
+		for (const [name, gate] of this.gates) {
+			const window = wanted.get(name);
+			if (window === void 0) gate.disarm();
+			else gate.arm(window);
+		}
+		return unknown;
+	}
+	/**
+	* Disarm whatever has run out. Called on a timer, NEVER from a log path — a
+	* diagnostic that adds a `Date.now()` to the path it is measuring measures
+	* itself.
+	*
+	* Returns the names it closed, so the caller can write the one line that
+	* says a window ended and stops "it went quiet" from reading as "the branch
+	* was not taken".
+	*/
+	tick(nowMs) {
+		const closed = [];
+		for (const [name, gate] of this.gates) if (gate.on && gate.armedUntilMs <= nowMs) {
+			gate.disarm();
+			closed.push(name);
+		}
+		return closed;
+	}
+	/** The channels armed right now, as the document would describe them. */
+	armed() {
+		const out = [];
+		for (const [name, gate] of this.gates) if (gate.on) out.push({
+			channel: name,
+			armedUntilMs: gate.armedUntilMs,
+			deviceIds: null
+		});
+		return out;
+	}
+};
+/**
+* Process-wide holder for the {@link LogChannelRegistry}.
+*
+* Three call sites that never meet need the SAME instance: the hot paths that
+* declare a gate at module scope, the `log-channels` provider that enumerates
+* the declarations for the hub, and the same provider applying the windows the
+* document hands down. A registry built inside any one of them would be
+* refreshed and collected — the shape of a knob that never does anything.
+*
+* Same idiom as `logging-gate.singleton.ts` and
+* `http-request-census.singleton.ts`.
+*/
+var instance = null;
+/** The process-wide log channel registry. Created empty on first use. */
+function getLogChannelRegistry() {
+	instance ??= new LogChannelRegistry();
+	return instance;
+}
+/**
+* Declare a channel on the process-wide registry and get its gate.
+*
+* The one call an addon makes. Keep the returned gate in a module-scope
+* `const`: looking a channel up by name per line would put a Map lookup on
+* exactly the path this mechanism exists to keep free.
+*
+* `scripts/check-log-channel-gated.ts` reads these call sites. It pairs the
+* declared name with the binding it is assigned to and refuses to let a
+* channel ship that no `<binding>.on` anywhere consults — a declared channel
+* nobody reads is a knob the operator turns with nothing happening, forever,
+* and without a line. That is D62, and this repo has now shipped it three
+* times (`audioThresholdDbfs`, the HA entities with no source, the second
+* per-camera switch that wrote a store nobody read).
+*/
+function declareLogChannel(descriptor) {
+	return getLogChannelRegistry().declare(descriptor);
+}
+/**
+* Build the `log-channels` provider for this process.
+*
+* `logger` is used ONLY off the hot path — for the arm/expiry lines — so a
+* channel that is never armed costs this module nothing but a timer.
+*/
+function createLogChannelsProvider(logger, options = {}) {
+	const registry = getLogChannelRegistry();
+	const now = options.now ?? Date.now;
+	const tickMs = options.tickMs ?? 5e3;
+	const timer = setInterval(() => {
+		const closed = registry.tick(now());
+		for (const name of closed) logger.info("log channel window closed", {
+			tags: { logChannel: name },
+			meta: { channel: name }
+		});
+	}, tickMs);
+	timer.unref?.();
+	return {
+		list: () => registry.list(),
+		apply: (input) => {
+			const unknown = registry.apply(input.windows, now());
+			const armed = registry.armed();
+			logger.info("log channels applied", { meta: {
+				armed: armed.map((window) => window.channel),
+				unknown,
+				declared: registry.list().length
+			} });
+			return {
+				armed: armed.length,
+				unknown
+			};
+		},
+		stop: () => {
+			clearInterval(timer);
+		}
+	};
+}
+/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -12477,6 +12833,35 @@ var MutationFilterSchema = object({
 	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
 	whereNot: record(string(), unknown()).optional()
 });
+/**
+* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
+*
+* `as` names the slot in the result, so the SAME column may be asked twice with
+* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
+* a `Record<column, op>` shape could not express.
+*/
+var AggregateFieldSchema = object({
+	/** Result key. */
+	as: string().min(1),
+	/** Column to aggregate. Must be a real column of a declared collection. */
+	field: string().min(1),
+	op: _enum([
+		"sum",
+		"min",
+		"max"
+	])
+});
+/**
+* `COUNT(*)` plus one number per requested field.
+*
+* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
+* that really is 0 are different facts, and an accounting caller that renders
+* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
+*/
+var AggregateResultSchema = object({
+	count: number().int(),
+	values: record(string(), number().nullable())
+});
 /** A single stored record: `{ id, data }`. */
 var SettingsRecordSchema = object({
 	id: string(),
@@ -12561,6 +12946,11 @@ method(object({
 	collection: string(),
 	filter: QueryFilterSchema.optional()
 }), number()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	fields: array(AggregateFieldSchema).readonly(),
+	filter: QueryFilterSchema.optional()
+}), AggregateResultSchema), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	field: string(),
@@ -12677,6 +13067,11 @@ method(_void(), EngineInfoSchema, { auth: "admin" }), method(object({
 	collection: string(),
 	filter: QueryFilterSchema.optional()
 }), number(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	fields: array(AggregateFieldSchema).readonly(),
+	filter: QueryFilterSchema.optional()
+}), AggregateResultSchema, { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	field: string(),
@@ -13269,24 +13664,6 @@ method(_void(), _void(), { kind: "mutation" }), method(_void(), _void(), { kind:
 	kind: "mutation",
 	auth: "admin"
 });
-/**
-* Device Manager capability — hub-side singleton that unifies device persistence,
-* live registry access, and all management operations into a single tRPC surface.
-*
-* Replaces:
-*   - `device-persistence` capability (persistence methods absorbed here)
-*   - `device-management.router.ts` (deleted in Phase 2)
-*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
-*
-* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
-* fork into separate processes but never run on remote cluster agents. Therefore:
-*   - No nodeId routing needed — this is a pure hub singleton.
-*   - The hub's DeviceRegistry is the single source of truth for all live devices.
-*   - No shadow registry or cross-node aggregation required.
-*
-* Forked workers register devices back to the hub via `ctx.devices`
-* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
-*/
 /** One child-placement directive on a container's `childLayout`. Structurally
 *  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
 *  shape for the same field. The child is identified by its re-sync-stable
@@ -13655,7 +14032,7 @@ method(object({
 	* it answers today and the caller filters as it already does.
 	*/
 	deviceIds: array(number()).optional()
-}), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
+}), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ parentDeviceIds: array(number()).max(256) }), record(string(), array(DeviceInfoSchema))), method(object({ deviceId: number() }), object({
 	mode: LinkedDevicesModeSchema,
 	devices: array(LinkedDeviceSchema)
 })), method(object({ deviceIds: array(number()) }), array(LinkedDevicesForDeviceSchema)), method(object({ deviceId: number() }), array(StreamSourceEntrySchema$1)), method(object({ deviceId: number() }), array(ConfigEntrySchema)), method(object({ deviceId: number() }), ConfigUISchemaOutput), method(object({
@@ -14379,6 +14756,80 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* `log-channels` — the capability an addon DECLARES its diagnostic channels
+* through. It stores nothing.
+*
+* ## Why a capability at all, and why this shape
+*
+* Which channels exist is knowledge only the addon has: `stream-broker` knows
+* webrtc/ICE/RTP, `provider-reolink` knows baichuan/handshake. A central list
+* maintained by hand rots at the first addition and rots INVISIBLY — nothing
+* fails, an operator just never sees the channel somebody added. So the list
+* is assembled from declarations at runtime.
+*
+* The shape is copied from `log-destination.cap.ts`, which already does
+* exactly this job: `mode: 'collection'`, `internal: true`,
+* `mount: { kind: 'skip' }` — no tRPC route, no generated hooks — while
+* `addons.listCapabilityProviders` still enumerates it, and the hub's
+* `CapabilityRegistry` still holds an RPC proxy per provider so a forked
+* runner's declarations reach hub-main over the transport that already exists.
+* No new UDS message, no second registry.
+*
+* ## What it deliberately does NOT own
+*
+* The VALUES — which channel is armed, for which cameras, until when — live in
+* ONE place: the logging settings document on the `system` cap
+* (`getLoggingSettings` / `setLoggingSettings`). Two authorities over the same
+* value is the defect the plan behind this work exists to remove, and
+* `setRequestCensus` was retired (D245) rather than allowed to be a second
+* one. {@link logChannelsCapability} therefore has no getter for a level, no
+* setter for a window and no persistence of any kind.
+*
+* ## Why `apply` is here even so
+*
+* The gate lives in the addon's PROCESS; the document lives in hub-main. Some
+* seam has to carry the value from the authority to the mirror, and a channel
+* that cannot be reached is precisely the dead knob this whole slice exists to
+* make impossible (D62 — `audioThresholdDbfs`, the HA entities with no source).
+* `apply` is that seam and nothing more: it writes an in-memory mirror, it
+* persists nothing, it is never the source of a value, and it is called only
+* with a set the hub actually read (D49 — a read that fails does not call it
+* at all, so no channel is silently disarmed by a bad read).
+*/
+/** What `apply` reports back — enough to log, not enough to be a second state. */
+var LogChannelApplyResultSchema = object({
+	/** How many declared channels are armed in this process after the call. */
+	armed: number().int().min(0),
+	/**
+	* Names the document armed that this process does not declare. Reported
+	* rather than swallowed: a name here is either a typo or an addon that has
+	* not booted, and both deserve a line instead of silence.
+	*/
+	unknown: array(string()).readonly()
+});
+var logChannelsCapability = {
+	name: "log-channels",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		/** The channels this addon declares. Inert: no value, no state. */
+		list: method(_void(), array(LogChannelDescriptorSchema).readonly()),
+		/**
+		* Refresh this process's mirror from the document's FULL set of armed
+		* windows.
+		*
+		* Full and not incremental on purpose: the document is the authority, so a
+		* channel it does not name is disarmed here. An incremental apply would
+		* let a disarm get lost in transit and leave a channel running that
+		* nobody can see is running.
+		*/
+		apply: method(object({ windows: array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
+	},
+	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
+	mount: { kind: "skip" }
+};
 var LogLevelSchema = _enum([
 	"debug",
 	"info",
@@ -28631,17 +29082,60 @@ var SetSiteLocationInputSchema = object({
 	longitude: number().min(-180).max(180)
 }).nullable();
 /**
-* One `(procedure, user-agent, ip, principal)` tuple of the HTTP request
+* The TRANSPORT a call arrived on.
+*
+* Every counted call carries exactly one of these, and `unknown` is a PLANE
+* rather than a gap: a plane that cannot attribute a call declares it here, so
+* the call lands in a named bucket instead of vanishing. `planes` summing to
+* `procedureCalls` is what makes "the sum of the planes explains the total"
+* checkable rather than asserted.
+*
+*  - `http`  — the Fastify tRPC plugin (`/trpc/*`), one context per request.
+*  - `ws`    — `applyWSSHandler`, counted per OPERATION rather than per
+*              connection; the viewer talks to the hub over `wsLink`
+*              exclusively, so this is the plane the HTTP census could not see.
+*  - `mesh`  — the in-process `$core-caps` bridge (`createCaller`), which
+*              never touches a socket and therefore never touched a census.
+*  - `unknown` — counted, plane undecidable. No hook produces it today, and
+*    that is exactly what its `0` asserts: every plane the hub has can name
+*    itself. It is an output bucket, never a knob — a call that arrives on a
+*    plane nobody instrumented lands here instead of vanishing from the total.
+*/
+var TransportPlaneSchema = _enum([
+	"http",
+	"ws",
+	"mesh",
+	"unknown"
+]);
+/**
+* Calls per plane. Every key is always present, `0` included — an absent plane
+* reads as "not instrumented", which is the one thing this census must never
+* make an operator wonder about.
+*/
+var TransportPlaneCountsSchema = object({
+	http: number(),
+	ws: number(),
+	mesh: number(),
+	unknown: number()
+});
+/**
+* One `(plane, procedure, user-agent, ip, principal)` tuple of the transport
 * census. `principal` is the DERIVED identity (`apocaliss92 (admin)`,
 * `scoped:1a2b3c4d (scoped-token)`, `anonymous`) that the tRPC error log
 * already prints - never a token, never an `Authorization` header.
+*
+* `subscriptions` is counted APART from `calls`: a subscription is opened once
+* and lives for hours, so folding it into a call count makes one long-lived
+* stream look like a storm.
 */
 var RequestCensusGroupSchema = object({
+	plane: TransportPlaneSchema,
 	procedure: string(),
 	userAgent: string(),
 	ip: string(),
 	principal: string(),
 	calls: number(),
+	subscriptions: number(),
 	perMin: number()
 });
 /**
@@ -28654,6 +29148,14 @@ var RequestCensusGroupSchema = object({
 var RequestCensusProcedureSchema = object({
 	procedure: string(),
 	calls: number(),
+	/**
+	* The same total, split by transport. THIS is the row that answers the
+	* question the census exists for: one look at `deviceManager.listAll` says
+	* which plane carried the 4 960, without joining two log lines by eye.
+	*/
+	planes: TransportPlaneCountsSchema,
+	/** Subscription STARTS on this procedure. Never folded into `calls`. */
+	subscriptions: number(),
 	perMin: number()
 });
 /**
@@ -28681,14 +29183,45 @@ var RequestCensusStatusSchema = object({
 	*/
 	procedureCalls: number(),
 	/**
+	* `procedureCalls` split by transport. The four keys sum to
+	* `procedureCalls` by construction - {@link RequestCensusSnapshotSchema}'s
+	* `planesExplainTotal` is that identity, checked rather than assumed.
+	*/
+	planes: TransportPlaneCountsSchema,
+	/**
+	* True iff `planes` sums to `procedureCalls`. False means a call was counted
+	* on no plane at all - which is a RESULT (a plane is missing from the
+	* instrument), not a failure, and it has to be visible to be read as one.
+	*/
+	planesExplainTotal: boolean(),
+	/**
 	* tRPC WebSocket connections opened during the window. NOT calls - the WS
-	* transport resolves one context per connection - but the number that says
-	* whether a plane this census cannot see was busy while HTTP was quiet.
+	* adapter resolves one context per connection - kept because a plane's call
+	* count of zero against 37 open connections says something different from a
+	* plane with no connections at all.
 	*/
 	wsConnections: number(),
+	/**
+	* Client frames the WS plane looked at. `wsMessages` far above
+	* `planes.ws + subscriptions` means most traffic is not operations
+	* (keepalives, connection params) - which is itself an answer.
+	*/
+	wsMessages: number(),
+	/**
+	* Subscription STARTS across every plane, excluded from `procedureCalls` on
+	* purpose: one live-events stream opened at boot and held for six hours is
+	* one subscription, and counting it as a call would let a quiet plane
+	* masquerade as the storm.
+	*/
+	subscriptions: number(),
+	/** `subscription.stop` frames. Starts minus stops is what is still open. */
+	subscriptionStops: number(),
 	distinctGroups: number(),
-	/** Calls counted in the totals whose group attribution was shed at the
-	*  cardinality bound. */
+	/**
+	* Operations counted in the totals whose CALLER attribution was shed at the
+	* cardinality bound. Unrelated to the `unknown` PLANE: these calls know
+	* which transport they arrived on, they just lost their group row.
+	*/
 	unattributedCalls: number(),
 	procedures: array(RequestCensusProcedureSchema).readonly(),
 	groups: array(RequestCensusGroupSchema).readonly()
@@ -28711,10 +29244,11 @@ var DiagnosticIdSchema = _enum(["request-census"]);
 * The layers of the level hierarchy, general → specific. The most specific
 * layer that carries an explicit value wins.
 *
-* `component` is DECLARED and not yet resolvable: the per-component channels
-* are a later slice of the same plan, and a `levelSource` enum that has to
-* grow later would force every consumer of this document to change with it.
-* Nothing returns `component` today.
+* `component` became RESOLVABLE on 2026-08-27: a component is a declared log
+* CHANNEL (`stream-broker.webrtc`, `provider-reolink.baichuan`), named by
+* `scopeComponent`. It was declared-but-dark in the first slice precisely so
+* that turning it on would not force every consumer of this document to widen
+* a `levelSource` enum — which is what has now not happened.
 */
 var LoggingScopeKindSchema = _enum([
 	"cluster",
@@ -28741,6 +29275,14 @@ var LoggingLevelLayerSchema = object({
 	scope: LoggingScopeKindSchema,
 	/** The node this layer speaks for; `null` on the cluster layer. */
 	nodeId: string().nullable(),
+	/**
+	* The declared channel this layer speaks for; `null` on every layer but
+	* `component`. Never folded into `nodeId`: a component level is CLUSTER-WIDE
+	* by design — the convention this repo settled on is one orchestrator-wide
+	* setting, never per node (D52) — so a component layer that carried a node
+	* would invite a per-node copy of a value that has no per-node meaning.
+	*/
+	component: string().nullable(),
 	/** Explicitly set here, or `null` when this layer inherits. */
 	level: LogLevelSchema$1.nullable()
 });
@@ -28782,6 +29324,49 @@ var DiagnosticWindowPatchSchema = object({
 	reportEveryMs: number().int().positive().optional()
 });
 /**
+* A channel ARMED, as the document reports it.
+*
+* `armMs` is not echoed back: what an operator needs to see is the deadline
+* and the time left, because a diagnostic left running is itself an incident
+* and "armed for 10 minutes" said an hour ago is not an answer.
+*/
+var LogChannelWindowStateSchema = object({
+	channel: string(),
+	armed: boolean(),
+	/** Epoch ms the window closes at. 0 when disarmed. */
+	armedUntilMs: number(),
+	/** Ms left before it expires on its own. 0 when disarmed. */
+	remainingMs: number(),
+	/**
+	* The cameras it is narrowed to, or `null` for every camera.
+	*
+	* A channel declared `perDevice: false` can only ever report `null` here:
+	* its lines do not carry `tags: { deviceId }`, so narrowing them would
+	* produce a filter that silently matches nothing. The server REFUSES such a
+	* patch rather than quietly widening it — ignoring the request would teach
+	* the operator that per-camera filtering works on that channel when it does
+	* not.
+	*/
+	deviceIds: array(number().int()).readonly().nullable()
+});
+/**
+* `armMs: 0` DISARMS. Same grammar as {@link DiagnosticWindowPatchSchema}, and
+* for the same reason: a channel is a window with a deadline, never a switch.
+*/
+var LogChannelWindowPatchSchema = object({
+	channel: string().min(1),
+	armMs: number().int().min(0),
+	/**
+	* Narrow to these numeric device ids. Absent or `null` = every camera.
+	*
+	* Numeric because the repo's own rule makes it possible: every log line
+	* about a device carries `tags: { deviceId }` with the numeric id. That rule
+	* was paid for with a 22% thumbnail gap and a 3-hour media blackout both
+	* diagnosed by hand, and this is the first thing that collects on it.
+	*/
+	deviceIds: array(number().int()).readonly().nullable().optional()
+});
+/**
 * A PATCH, and patches MERGE.
 *
 * A field absent from the patch is left exactly as it was — arming a
@@ -28800,7 +29385,14 @@ var LoggingSettingsPatchSchema = object({
 	* Only the diagnostics NAMED here change. An armed window that is not listed
 	* keeps running — a patch is never a full replacement.
 	*/
-	diagnostics: array(DiagnosticWindowPatchSchema).readonly().optional()
+	diagnostics: array(DiagnosticWindowPatchSchema).readonly().optional(),
+	/**
+	* Only the channels NAMED here change. An armed channel that is not listed
+	* keeps running — same rule as `diagnostics`, because a patch that silently
+	* disarmed the channels it did not mention would make the Levels page and
+	* the Diagnostics page fight over the same value.
+	*/
+	channels: array(LogChannelWindowPatchSchema).readonly().optional()
 });
 /**
 * Which LAYER of the hierarchy is addressed. Absent = the cluster layer.
@@ -28813,9 +29405,22 @@ var LoggingSettingsPatchSchema = object({
 * authority over the whole hierarchy and answers for every layer, so the
 * layer selector needs a name the transport does not already own.
 */
-var GetLoggingSettingsInputSchema = object({ scopeNodeId: string().optional() });
+var GetLoggingSettingsInputSchema = object({
+	scopeNodeId: string().optional(),
+	/**
+	* The declared CHANNEL this document is addressed at, when the caller wants
+	* the `component` layer. Absent = the node/cluster hierarchy only.
+	*
+	* Naming it separately rather than overloading `scopeNodeId` keeps the two
+	* axes from collapsing: a component level is cluster-wide, a node level is
+	* not, and one selector for both would make "which of these two did I just
+	* set" unanswerable — the exact ambiguity `explicit` exists to remove.
+	*/
+	scopeComponent: string().optional()
+});
 var SetLoggingSettingsInputSchema = object({
 	scopeNodeId: string().optional(),
+	scopeComponent: string().optional(),
 	patch: LoggingSettingsPatchSchema
 });
 /**
@@ -28830,9 +29435,20 @@ var SetLoggingSettingsInputSchema = object({
 var LoggingSettingsStateSchema = object({
 	/** The layer this document was read at. `null` = the cluster layer. */
 	scopeNodeId: string().nullable(),
+	/** The channel this document was read at. `null` = no component layer. */
+	scopeComponent: string().nullable(),
 	effective: LoggingEffectiveSchema,
 	explicit: LoggingExplicitSchema,
 	activeWindows: array(DiagnosticWindowSchema).readonly(),
+	/**
+	* Every channel the cluster's addons DECLARE, gathered from the
+	* `log-channels` providers. Not stored anywhere: assembled per read, so a
+	* channel added by a redeployed addon appears without anybody editing a
+	* list, and a channel whose addon is gone stops being offered.
+	*/
+	channels: array(LogChannelDescriptorSchema).readonly(),
+	/** The channels ARMED right now, each with its deadline. */
+	activeChannels: array(LogChannelWindowStateSchema).readonly(),
 	persisted: boolean()
 });
 method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
@@ -30568,6 +31184,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"dataStoreProvider.aggregate": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"dataStoreProvider.count": {
 		capName: "data-store-provider",
 		capScope: "system",
@@ -30982,6 +31604,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getChildrenBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getConfigSchema": {
 		capName: "device-manager",
 		capScope: "system",
@@ -32032,6 +32660,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"logChannels.apply": {
+		capName: "log-channels",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"logChannels.list": {
+		capName: "log-channels",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"logDestination.query": {
 		capName: "log-destination",
 		capScope: "system",
@@ -34186,6 +34826,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.aggregate": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"settingsStore.count": {
 		capName: "settings-store",
 		capScope: "system",
@@ -35765,6 +36411,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.getChildrenBatch": [{
+		name: "parentDeviceIds",
+		form: "array",
+		optional: false
+	}],
 	"deviceManager.getConfigSchema": [{
 		name: "deviceId",
 		form: "single",
@@ -38816,4 +39467,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { motionDetectionCapability as $, audioAnalysisCapability as A, hydrateSchema as At, deriveDetailCropRect as B, array as Bt, RATE_CONTROL_RELAXED as C, invocationFromEncodeProfile as Ct, RingBuffer as D, DeviceFeature as Dt, RecordingConfigSchema as E, CAM_PROFILE_ORDER as Et, createHwAccelCache as F, parseJsonUnknown as Ft, enumerateInferenceDevices as G, number as Gt, detectionPipelineCapability as H, discriminatedUnion as Ht, customAction as I, parseProfileBrokerId as It, hfModelUrl as J, string as Jt, evaluateSensorEdge as K, object as Kt, defaultDeviceFor as L, selectAssignedProfileSlots as Lt, audioKindId as M, makeProfileBrokerId as Mt, batteryCapability as N, makeSourceBrokerId as Nt, YAMNET_TO_MACRO as O, DeviceType as Ot, cameraStreamsCapability as P, nodePin as Pt, maskUrlCredentials as Q, defineCustomActions as R, sleep as Rt, PoolMemoryWatchdog as S, buildFfmpegArgs as St, RECORDING_EXPORT_MAX_READ_BYTES as T, BaseAddon as Tt, egressTranscodeSharingKey as U, lazy as Ut, deriveRecordingMode as V, boolean as Vt, egressTransportFromRequest as W, literal as Wt, isFirstLevelMacroClass as X, EventCategory as Xt, inferModelProvider as Y, union as Yt, mapAudioLabelToMacro as Z, ExportRecordSchema as _, supportedRuntimes as _t, COCO_80_LABELS as a, pickNativeLeaseOverride as at, NativeLeaseSettingsSchema as b, AUDIO_PRESETS as bt, DEFAULT_CLUSTER_STEP_MODELS as c, recordingCapability as ct, DEFAULT_EVENTS_BAND_BUFFER_SEC as d, resolveEgressDecodeHwAccel as dt, overlayClusterStepSettings as et, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as f, resolvePoolMemoryPolicy as ft, EncodeProfileSchema as g, streamBrokerCapability as gt, EVENT_PAD_MS as h, storageEvictableCapability as ht, BatteryStatusSchema as i, pickDetailCropConvention as it, audioAnalyzerCapability as j, isEvent as jt, addonWidgetsSourceCapability as k, createEvent as kt, DEFAULT_CLUSTER_STEP_SETTINGS as l, recordingExportCapability as lt, DEVICE_BACKEND_TO_FORMAT as m, runtimeDevices as mt, AUDIO_BACKEND_CHOICES as n, pickClusterStepModels as nt, COCO_TO_MACRO as o, pipelineExecutorCapability as ot, DEFAULT_NATIVE_LEASE_SETTINGS as p, resolveRecordingProfiles as pt, evaluateZoneRules as q, record as qt, AUDIO_MACRO_LABELS as r, pickClusterStepSettings as rt, DEFAULT_AUDIO_ANALYZER_CONFIG as s, pipelineRunnerCapability as st, APPLE_SA_TO_MACRO as t, parseProcStatus as tt, DEFAULT_DETAIL_CROP_CONVENTION as u, resolveClusterStepModelId as ut, HF_BASE_URL as v, webrtcSessionCapability as vt, RATE_CONTROL_TIGHT as w, isSoftwareDecode as wt, OpsLogEntrySchema as x, Fmp4BoxSplitter as xt, NativeLeaseAdmissionSchema as y, errMsg as yt, deriveBatteryPresence as z, _enum as zt };
+export { logChannelsCapability as $, EventCategory as $t, audioAnalysisCapability as A, DeviceFeature as At, defineCustomActions as B, selectAssignedProfileSlots as Bt, RATE_CONTROL_RELAXED as C, AUDIO_PRESETS as Ct, RingBuffer as D, isSoftwareDecode as Dt, RecordingConfigSchema as E, invocationFromEncodeProfile as Et, createHwAccelCache as F, makeProfileBrokerId as Ft, egressTranscodeSharingKey as G, discriminatedUnion as Gt, deriveDetailCropRect as H, _enum as Ht, createLogChannelsProvider as I, makeSourceBrokerId as It, evaluateSensorEdge as J, number as Jt, egressTransportFromRequest as K, lazy as Kt, customAction as L, nodePin as Lt, audioKindId as M, createEvent as Mt, batteryCapability as N, hydrateSchema as Nt, YAMNET_TO_MACRO as O, BaseAddon as Ot, cameraStreamsCapability as P, isEvent as Pt, isFirstLevelMacroClass as Q, union as Qt, declareLogChannel as R, parseJsonUnknown as Rt, PoolMemoryWatchdog as S, errMsg as St, RECORDING_EXPORT_MAX_READ_BYTES as T, buildFfmpegArgs as Tt, deriveRecordingMode as U, array as Ut, deriveBatteryPresence as V, sleep as Vt, detectionPipelineCapability as W, boolean as Wt, hfModelUrl as X, record as Xt, evaluateZoneRules as Y, object as Yt, inferModelProvider as Z, string as Zt, ExportRecordSchema as _, runtimeDevices as _t, COCO_80_LABELS as a, pickClusterStepModels as at, NativeLeaseSettingsSchema as b, supportedRuntimes as bt, DEFAULT_CLUSTER_STEP_MODELS as c, pickNativeLeaseOverride as ct, DEFAULT_EVENTS_BAND_BUFFER_SEC as d, recordingCapability as dt, mapAudioLabelToMacro as et, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as f, recordingExportCapability as ft, EncodeProfileSchema as g, resolveRecordingProfiles as gt, EVENT_PAD_MS as h, resolvePoolMemoryPolicy as ht, BatteryStatusSchema as i, parseProcStatus as it, audioAnalyzerCapability as j, DeviceType as jt, addonWidgetsSourceCapability as k, CAM_PROFILE_ORDER as kt, DEFAULT_CLUSTER_STEP_SETTINGS as l, pipelineExecutorCapability as lt, DEVICE_BACKEND_TO_FORMAT as m, resolveEgressDecodeHwAccel as mt, AUDIO_BACKEND_CHOICES as n, motionDetectionCapability as nt, COCO_TO_MACRO as o, pickClusterStepSettings as ot, DEFAULT_NATIVE_LEASE_SETTINGS as p, resolveClusterStepModelId as pt, enumerateInferenceDevices as q, literal as qt, AUDIO_MACRO_LABELS as r, overlayClusterStepSettings as rt, DEFAULT_AUDIO_ANALYZER_CONFIG as s, pickDetailCropConvention as st, APPLE_SA_TO_MACRO as t, maskUrlCredentials as tt, DEFAULT_DETAIL_CROP_CONVENTION as u, pipelineRunnerCapability as ut, HF_BASE_URL as v, storageEvictableCapability as vt, RATE_CONTROL_TIGHT as w, Fmp4BoxSplitter as wt, OpsLogEntrySchema as x, webrtcSessionCapability as xt, NativeLeaseAdmissionSchema as y, streamBrokerCapability as yt, defaultDeviceFor as z, parseProfileBrokerId as zt };