@camstack/addon-pipeline 1.2.138 → 1.2.140

package/dist/{dist-BuIP0499.js → dist-3bEUjzHN.js}

@@ -5955,6 +5955,40 @@ var BaseAddon = class {
 	deviceSettingsSchema() {
 		return null;
 	}
+	/**
+	* INTEGRATION-LEVEL SETTINGS — declare which of this addon's global sections
+	* ARE the configuration of its integration.
+	*
+	* Return the `ConfigSection.id`s, from {@link globalSettingsSchema}, that an
+	* operator should find on the addon's integration page (System →
+	* Integrations → <name>) rather than only in the cluster-wide list of every
+	* addon. Empty (the default) means the addon has no integration-level
+	* settings and no such surface is offered — this is opt-in, because whether
+	* an addon's configuration IS its integration's configuration depends on the
+	* nature of the integration.
+	*
+	* WHAT THIS IS NOT. It is not a scope. The selected sections keep living in
+	* the ONE global schema, in the ONE addon store, written by the ONE
+	* `updateGlobalSettings` path. There is deliberately no
+	* `updateIntegrationSettings`: a second write path is how a surface acquires
+	* a second store key, and this repo has shipped that twice (`btmPath@hub`,
+	* D266). Selecting sections cannot introduce a key that selecting cannot.
+	*
+	* WHY IT IS A LIST OF SECTION IDS AND NOT A MARKER ON THE SECTION.
+	* `ConfigFieldBase` used to carry `scope?: 'device' | 'global'` and it was
+	* removed with the reason recorded at
+	* `packages/types/src/interfaces/config-ui.ts:249` — *"a field's scope is
+	* determined by WHICH schema it lives in, not by a field-level marker."* A
+	* marker sprinkled across sections also has to borrow a field that already
+	* means something else; borrowing `section.tab` put the literal word
+	* "integration" into an operator-facing tab bar, because `tab` means "how to
+	* GROUP this visually" and cannot also mean "where this lives" (D269
+	* supersedes D268). One declaration, in one place, next to the schema whose
+	* ids it names.
+	*/
+	integrationSettingSections() {
+		return [];
+	}
 	async getGlobalSettings(overlay, cap, nodeId) {
 		const schema = this.globalSettingsSchema(cap);
 		if (!schema) return { sections: [] };
@@ -5965,6 +5999,55 @@ var BaseAddon = class {
 		} : projected);
 	}
 	/**
+	* The integration-level view of this addon's settings: exactly the sections
+	* named by {@link integrationSettingSections}, hydrated from the SAME store
+	* `getGlobalSettings` reads, and narrowed to cluster-scoped fields.
+	*
+	* Returns `null` when the addon declared nothing — an addon that opts out has
+	* no integration settings surface at all, rather than an empty one that reads
+	* as a failed load.
+	*
+	* Three properties hold BY CONSTRUCTION, which is why they are here in core
+	* and not in whichever UI happens to render this:
+	*
+	*  1. **One key.** The payload is a SUBSET of the global schema, so a field
+	*     shown here is the same field, with the same bare key, that the addon's
+	*     own page shows. There is no integration-specific writer — callers save
+	*     through `updateGlobalSettings` — so a second store key is unreachable,
+	*     not merely discouraged.
+	*  2. **No node scope.** `perNode: true` fields are DROPPED. Their store key
+	*     is `<key>@<nodeId>` and an integration is not a node; whichever node
+	*     such a field silently picked would be a wrong answer for the operator
+	*     who opened the page (D266).
+	*  3. **No silent typo.** A declared id that names no section throws. The
+	*     alternative — skip it — turns a rename into a surface that quietly
+	*     empties, which looks exactly like an addon with nothing to configure.
+	*/
+	async getIntegrationSettings(nodeId) {
+		const declared = this.integrationSettingSections();
+		if (declared.length === 0) return null;
+		const schema = this.globalSettingsSchema();
+		if (!schema) throw new Error(`${this.constructor.name}: integrationSettingSections() names [${declared.join(", ")}] but globalSettingsSchema() returns null.`);
+		const byId = new Map(schema.sections.map((section) => [section.id, section]));
+		const sections = [];
+		for (const id of declared) {
+			const section = byId.get(id);
+			if (!section) throw new Error(`${this.constructor.name}: integrationSettingSections() names unknown section "${id}". Known sections: [${[...byId.keys()].join(", ")}].`);
+			const fields = dropPerNodeFields(section.fields);
+			if (fields.length === 0) continue;
+			sections.push({
+				...section,
+				fields
+			});
+		}
+		if (sections.length === 0) return null;
+		const projected = await this.resolveGlobalStore(nodeId);
+		return hydrateSchema({
+			...schema,
+			sections
+		}, projected);
+	}
+	/**
 	* The raw addon store PROJECTED onto the target node's bare per-node keys:
 	* every `perNode: true` field carries THAT node's scoped value on its bare
 	* key (absent scoped key ⇒ key absent, so the schema `default` wins — no
@@ -6268,6 +6351,41 @@ var BaseAddon = class {
 * `hydrateSchema` does. Valueless structural fields (separator/info/…)
 * don't declare `perNode` and are excluded by the `in` narrowing.
 */
+/**
+* The same fields with every `perNode: true` one removed, recursing into layout
+* containers exactly as {@link collectPerNodeFieldKeys} does. A container left
+* with no child is dropped rather than rendered empty.
+*
+* Used by `getIntegrationSettings`: an integration is not a node, so a field
+* whose store key is `<key>@<nodeId>` has no node to belong to there.
+*/
+function dropPerNodeFields(fields) {
+	const kept = [];
+	for (const field of fields) {
+		if (field.type === "group") {
+			const inner = dropPerNodeFields(field.fields);
+			if (inner.length > 0) kept.push({
+				...field,
+				fields: inner
+			});
+			continue;
+		}
+		if (field.type === "sub-tabs") {
+			const tabs = field.tabs.map((tab) => ({
+				...tab,
+				fields: dropPerNodeFields(tab.fields)
+			})).filter((tab) => tab.fields.length > 0);
+			if (tabs.length > 0) kept.push({
+				...field,
+				tabs
+			});
+			continue;
+		}
+		if ("perNode" in field && field.perNode === true) continue;
+		kept.push(field);
+	}
+	return kept;
+}
 function collectPerNodeFieldKeys(fields) {
 	const collected = [];
 	for (const field of fields) {
@@ -9567,6 +9685,112 @@ var DecoderSessionConfigSchema = object({
 	*/
 	debug: boolean().optional()
 });
+/**
+* Distinct (device, family, variant) counters one instance will hold.
+*
+* A large fleet x the handful of families any single addon reports, with
+* slack. At ~200 B per counter this is a ~100 KB ceiling on a process that
+* already declares an RSS budget in the gigabytes.
+*/
+var MAX_KEYS = 1024;
+/**
+* Where reasons past {@link MAX_REASONS_PER_KEY} go.
+*
+* They are FOLDED, never dropped: `attempts - succeeded` must always equal the
+* sum of the reason counts, or the ratio stops adding up.
+*/
+var OVERFLOW_REASON = "other";
+/** `deviceId` + `family` + optional `variant`, flattened into the map key. */
+function counterKey(deviceId, family, variant) {
+	return variant === void 0 ? `${deviceId}${family}` : `${deviceId}${family}${variant}`;
+}
+/**
+* A bounded set of per-camera, cumulative failure counters.
+*
+* One instance per contributing subsystem. `note` is O(1) and allocation-free
+* on the steady path; `snapshot` reads without mutating anything.
+*/
+var FailureCounters = class {
+	maxKeys;
+	maxReasons;
+	counters = /* @__PURE__ */ new Map();
+	refused = 0;
+	constructor(maxKeys = MAX_KEYS, maxReasons = 16) {
+		this.maxKeys = maxKeys;
+		this.maxReasons = maxReasons;
+	}
+	/**
+	* Counters refused because {@link MAX_KEYS} was already held.
+	*
+	* Cumulative for the life of the instance: a bound that bit is a fact about
+	* the deployment, and a surface that hid it would under-report a fleet
+	* precisely when the fleet got large enough to matter.
+	*/
+	get keysRefused() {
+		return this.refused;
+	}
+	/** Counters currently held. */
+	get size() {
+		return this.counters.size;
+	}
+	/**
+	* Fold one observation in.
+	*
+	* A non-positive or non-integer `deviceId` is REFUSED rather than bucketed:
+	* see the module docblock — an entry that cannot name its camera is worse
+	* than no entry.
+	*/
+	note(observation, nowMs) {
+		if (!Number.isInteger(observation.deviceId) || observation.deviceId <= 0) return;
+		const key = counterKey(observation.deviceId, observation.family, observation.variant);
+		let counter = this.counters.get(key);
+		if (counter === void 0) {
+			if (this.counters.size >= this.maxKeys) {
+				this.refused += 1;
+				return;
+			}
+			counter = {
+				deviceId: observation.deviceId,
+				family: observation.family,
+				variant: observation.variant,
+				sinceMs: nowMs,
+				attempts: 0,
+				succeeded: 0,
+				reasons: /* @__PURE__ */ new Map()
+			};
+			this.counters.set(key, counter);
+		}
+		counter.attempts += 1;
+		if (observation.reason === void 0) {
+			counter.succeeded += 1;
+			return;
+		}
+		const reason = counter.reasons.has(observation.reason) || counter.reasons.size < this.maxReasons ? observation.reason : OVERFLOW_REASON;
+		counter.reasons.set(reason, (counter.reasons.get(reason) ?? 0) + 1);
+	}
+	/** Read every counter. Never mutates — see the module docblock. */
+	snapshot(nowMs) {
+		const out = [];
+		for (const counter of this.counters.values()) out.push({
+			deviceId: counter.deviceId,
+			family: counter.family,
+			...counter.variant !== void 0 ? { variant: counter.variant } : {},
+			sinceMs: counter.sinceMs,
+			atMs: nowMs,
+			attempts: counter.attempts,
+			succeeded: counter.succeeded,
+			reasons: [...counter.reasons.entries()].map(([reason, count]) => ({
+				reason,
+				count
+			})).toSorted((a, b) => b.count - a.count)
+		});
+		return out;
+	}
+	/** Drop everything (host disposal). */
+	clear() {
+		this.counters.clear();
+	}
+};
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -10765,6 +10989,9 @@ method(object({
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
+	addonId: string(),
+	nodeId: string().optional()
+}), SettingsSchemaWithValuesSchema.nullable()), method(object({
 	addonId: string(),
 	deviceId: number(),
 	nodeId: string().optional()
@@ -11152,8 +11379,7 @@ var AUDIO_BACKEND_CHOICES = [
 ];
 var DEFAULT_AUDIO_ANALYZER_CONFIG = {
 	audioBackend: "auto",
-	probedBestAudioBackend: "",
-	selectedAudioModel: ""
+	probedBestAudioBackend: ""
 };
 var audioAnalyzerCapability = {
 	name: "audio-analyzer",
@@ -14933,6 +15159,133 @@ method(LogEntrySchema, _void(), { kind: "mutation" }), method(object({
 	limit: number().optional(),
 	tags: record(string(), string()).optional()
 }), array(LogEntrySchema).readonly());
+/**
+* `failure-contribution` — the capability an addon reports its OWN losses
+* through, per camera, with the denominator attached. It stores nothing.
+*
+* ## The twin of `load-contribution`, and why it is a twin and not a field
+*
+* `load-contribution` answers *what did this camera COST*. This answers *what
+* did this camera LOSE*. The reporting discipline is identical and deliberately
+* copied: the contributor reports what it already knows, hub-main adds only
+* `addonId`, nothing needs global knowledge, and there is no central list for
+* somebody to forget to edit.
+*
+* They are not merged, because their invariants are opposites:
+*
+*  - a `load-contribution` measurement is **absent, never zero** — a zero would
+*    claim a camera cost nothing, which is a measurement nobody made;
+*  - a `failure-contribution` zero is the **most valuable value on the
+*    surface** — `attempts: 400, succeeded: 400` is the proof a fix landed,
+*    and it is exactly what an absent entry cannot say.
+*
+* Putting a loss counter on a cost entry would also break the reconciliation
+* that gives `load-contribution` its point: contributions are subtracted from
+* `metrics.node-processes-snapshot` to find processes nobody claims. A failure
+* has no process.
+*
+* ## Why not a log line, since the counters already exist
+*
+* Several of these paths already counted themselves — `CaptureScheduler`'s
+* per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
+* ends in a log line, and a log line is the thing the operator asked to stop
+* needing: *"possiamo armare questi errori intanto? Così al prossimo giro
+* ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
+* hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
+* media blackout were both diagnosed. The counters stay; this is where they can
+* be READ.
+*
+* ## The rate is served with its denominator or not at all
+*
+* Every entry carries `attempts` and `succeeded`. A miss count alone is
+* unreadable: on 2026-08-28 the enrichment-crop miss count read as "35x worse
+* than yesterday" and was **flat across twelve hours** once divided by the
+* successes on the same path. A surface that publishes only the numerator
+* reproduces that mistake on every read.
+*
+* ## Shape
+*
+* Copied from `load-contribution.cap.ts` (`mode: 'collection'`,
+* `internal: true`, `mount: { kind: 'skip' }`): no tRPC route of its own and no
+* generated hooks, while `addons.listCapabilityProviders` still enumerates it
+* and the hub's `CapabilityRegistry` still holds an RPC proxy per provider — so
+* a forked runner's entries reach hub-main over transport that already exists.
+* No new UDS message, no second registry (D3). The operator reads the assembled
+* result through `system.getFailureContributions`.
+*/
+var FailureReasonCountSchema = object({
+	/**
+	* Why the attempt did not land, in the contributor's own vocabulary —
+	* `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
+	* strings that already appear in this repo's logs and, where one exists, the
+	* same string the per-track `previewMissReason` records (D276): a second
+	* vocabulary for the same loss would make the row and the counter
+	* un-joinable.
+	*/
+	reason: string(),
+	count: number().int().nonnegative()
+});
+var FailureContributionSchema = object({
+	/**
+	* The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
+	* `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
+	* `unit` free: the families are owned by different addons and a shared enum
+	* is a central list that rots invisibly.
+	*/
+	family: string(),
+	/**
+	* The NUMERIC device id — the same value every log line carries as
+	* `tags.deviceId`. Never nullable and never absent: a contributor that
+	* cannot name the camera must not emit the entry, because a fleet total
+	* cannot answer the only question anybody asks of this surface.
+	*/
+	deviceId: number().int().positive(),
+	/**
+	* A second dimension inside the family: the model / step id for an inference
+	* timeout, so "which camera AND which model" is one read. Absent when the
+	* family has a single variant.
+	*/
+	variant: string().optional(),
+	/**
+	* Epoch ms this counter started — the INCARNATION MARKER. A consumer
+	* differencing two reads must drop the interval when it changes, because the
+	* counter restarted from zero in a respawned runner. Same discipline as
+	* `LoadContribution.startedAtMs`.
+	*/
+	sinceMs: number(),
+	/** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
+	atMs: number(),
+	/**
+	* THE DENOMINATOR — every attempt on this path for this camera in the
+	* window. A failure count published without it is the mistake this schema
+	* exists to make impossible.
+	*/
+	attempts: number().int().nonnegative(),
+	/** Attempts that landed. `attempts - succeeded` is the loss. */
+	succeeded: number().int().nonnegative(),
+	/** The loss, partitioned. Sums to `attempts - succeeded`. */
+	reasons: array(FailureReasonCountSchema).readonly()
+});
+var failureContributionCapability = {
+	name: "failure-contribution",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { 
+	/**
+	* This addon's per-camera failure counters, read live from bounded in-RAM
+	* state it already keeps. Inert: no persistence, no sampling, no timer.
+	*
+	* READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
+	* consumer that wants a rate differences two reads. A draining read would
+	* make two operators with the page open each destroy half of the other's
+	* numbers, and `load-contribution` already settled the same question the
+	* same way for `cpuSeconds`.
+	*/
+list: method(_void(), array(FailureContributionSchema).readonly()) },
+	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
+	mount: { kind: "skip" }
+};
 var LoadContributionSchema = object({
 	role: _enum([
 		"decode",
@@ -19986,6 +20339,20 @@ var TrackSchema = object({
 	* `=== true` and render nothing otherwise — never infer "no rider".
 	*/
 	hasRider: boolean().optional(),
+	/**
+	* WHY this track ended without a NATIVE best-shot tile
+	* ([D276](../decisions/adr-0276-a-stand-in-tile-is-provisional-and-a-close-says-why.md)) —
+	* a composed token line (`no-key-frame capture=keyframe:native-missx4`,
+	* `derive-returned-null tile=standin`, …) written at close and CLEARED by
+	* the late-keyFrame upgrade when a native tile lands after all. The
+	* operator-facing answer to "perché manca l'immagine?" on a track whose
+	* tile is a face/plate stand-in, a raster crop, or an icon.
+	*
+	* **Absent ≠ "missed silently"**: a row written before the column, a hub
+	* that predates the field, and every track whose tile landed native all
+	* omit it. Render nothing when absent.
+	*/
+	previewMissReason: string().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -29682,6 +30049,13 @@ var LoggingSettingsPatchSchema = object({
 * anyone but its owner.
 */
 var ReportedLoadContributionSchema = LoadContributionSchema.extend({ addonId: string() });
+/**
+* One per-camera failure counter, plus WHO reported it.
+*
+* Same rule as {@link ReportedLoadContributionSchema}: `addonId` is stamped by
+* the hub as it enumerates providers, never by the contributor.
+*/
+var ReportedFailureContributionSchema = FailureContributionSchema.extend({ addonId: string() });
 var GetLoggingSettingsInputSchema = object({
 	scopeNodeId: string().optional(),
 	/**
@@ -29740,7 +30114,7 @@ method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), met
 }), method(_void(), SiteLocationStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), RequestCensusStatusSchema, { auth: "admin" }), method(_void(), array(ReportedLoadContributionSchema).readonly(), { auth: "admin" }), method(GetLoggingSettingsInputSchema, LoggingSettingsStateSchema, { auth: "admin" }), method(SetLoggingSettingsInputSchema, LoggingSettingsStateSchema, {
+}), method(_void(), RequestCensusStatusSchema, { auth: "admin" }), method(_void(), array(ReportedLoadContributionSchema).readonly(), { auth: "admin" }), method(_void(), array(ReportedFailureContributionSchema).readonly(), { auth: "admin" }), method(GetLoggingSettingsInputSchema, LoggingSettingsStateSchema, { auth: "admin" }), method(SetLoggingSettingsInputSchema, LoggingSettingsStateSchema, {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -30813,6 +31187,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"addonSettings.getIntegrationSettings": {
+		capName: "addon-settings",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"addonSettings.updateDeviceSettings": {
 		capName: "addon-settings",
 		capScope: "system",
@@ -32475,6 +32855,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"failureContribution.list": {
+		capName: "failure-contribution",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"fanControl.setDirection": {
 		capName: "fan-control",
 		capScope: "device",
@@ -35781,6 +36167,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.getFailureContributions": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"system.getLoadContributions": {
 		capName: "system",
 		capScope: "system",
@@ -39912,6 +40304,12 @@ Object.defineProperty(exports, "ExportRecordSchema", {
 		return ExportRecordSchema;
 	}
 });
+Object.defineProperty(exports, "FailureCounters", {
+	enumerable: true,
+	get: function() {
+		return FailureCounters;
+	}
+});
 Object.defineProperty(exports, "Fmp4BoxSplitter", {
 	enumerable: true,
 	get: function() {
@@ -40164,6 +40562,12 @@ Object.defineProperty(exports, "evaluateZoneRules", {
 		return evaluateZoneRules;
 	}
 });
+Object.defineProperty(exports, "failureContributionCapability", {
+	enumerable: true,
+	get: function() {
+		return failureContributionCapability;
+	}
+});
 Object.defineProperty(exports, "hfModelUrl", {
 	enumerable: true,
 	get: function() {