@camstack/addon-pipeline 1.2.48 → 1.2.50

package/dist/{dist-CksKE1Sn.js → dist-Ci2-N-XC.js}

@@ -18385,6 +18385,23 @@ var CameraRecordingStatusSchema = object({
 	active: boolean(),
 	storageBytes: number()
 });
+/** One stage of the fan-out that could NOT be read, and how long it cost. */
+var CameraStatusDegradationSchema = object({
+	stage: _enum([
+		"source",
+		"broker",
+		"detection",
+		"recording",
+		"switches"
+	]),
+	reason: _enum([
+		"timeout",
+		"error",
+		"partial"
+	]),
+	/** Wall-clock ms spent on the stage before it was abandoned. */
+	elapsedMs: number()
+});
 /**
 * Aggregated per-camera pipeline status — server-composed, single call.
 *
@@ -18415,9 +18432,28 @@ var CameraStatusSchema = object({
 	* differently — a quiet camera that looks identical to a dead one is the
 	* silence-reads-as-never-happened trap this repo keeps paying for.
 	*
-	* Empty when nothing is off. Never contains a switch no provider offers.
+	* Empty when nothing is off, and never contains a switch no provider offers
+	* — but an empty list is only a POSITIVE claim when `degraded` does not name
+	* `'switches'`. When it does, the switch set could not be read and nothing
+	* here may be rendered as "the operator turned nothing off": that is the
+	* D62 failure (a camera we could not read painted as broken) in the very
+	* field that exists to prevent it.
 	*/
 	switchedOff: array(CameraSwitchIdSchema).readonly(),
+	/**
+	* Stages of the bounded fan-out that were CUT SHORT — a timeout or a
+	* rejection — and whose block is therefore `null` because we could not
+	* READ it, not because there is nothing there.
+	*
+	* Without this, three different facts arrive as the same `null`: "the stage
+	* timed out", "the stage failed", and "this camera legitimately has no
+	* decoder / no recording". Every surface that draws a conclusion from a null
+	* block (or from an empty `switchedOff`) must consult this first; a stage
+	* named here supports no conclusion at all, only "unknown".
+	*
+	* Empty on a clean read — the overwhelmingly common case.
+	*/
+	degraded: array(CameraStatusDegradationSchema).readonly(),
 	/** Unix timestamp (ms) when this snapshot was composed server-side. */
 	fetchedAt: number()
 });
@@ -21137,7 +21173,29 @@ var FaceInfoSchema = object({
 	recognizedIdentityId: string().optional(),
 	identityName: string().optional(),
 	assigned: boolean(),
+	/**
+	* The crop, inline, base64.
+	*
+	* **Prefer {@link cropUrl}.** At the 500 rows the Faces view asks for this
+	* field alone is ~2.87 MiB, re-sent in full on every operator assign and
+	* every 30 s poll, base64-inflated over the msgpack socket and held in the
+	* query heap. It stays for callers that have not migrated; `includeCrops:
+	* false` turns it off once they have.
+	*/
 	base64: string().optional(),
+	/**
+	* Same crop, as a data-plane URL for `<img src>` — the move the admin
+	* snapshot surfaces made on 2026-08-08.
+	*
+	* Served by the `event-media` plane, which resolves a raw MediaStore key and
+	* is `access: 'authenticated'`: a bare `<img>` carries the `camstack_session`
+	* cookie, so no header plumbing is needed. The bytes then ride the browser's
+	* HTTP cache with an ETag and `immutable`, instead of the WebSocket.
+	*
+	* Absent when the face has no stored crop, or when the addon has no data
+	* plane — callers fall back to {@link base64}.
+	*/
+	cropUrl: string().optional(),
 	/** Design B: the face bbox (pixel space) on the key frame — lets a detail
 	*  view draw the box over the native `keyFrameMediaKey` frame. Absent on
 	*  legacy rows written before design B. */
@@ -21202,7 +21260,23 @@ method(_void(), array(IdentitySchema).readonly()), method(object({ name: string(
 	auth: "admin"
 }), method(object({
 	limit: number().int().positive().optional(),
-	filter: FaceFilterEnum.optional()
+	filter: FaceFilterEnum.optional(),
+	/**
+	* Inline the base64 crop on every row. Default `true` — the existing
+	* behaviour, kept so no caller breaks.
+	*
+	* Set `false` once the caller renders {@link FaceInfo.cropUrl}: that
+	* drops ~2.87 MiB per 500-row page to a few KiB of metadata and lets
+	* the browser cache the images.
+	*
+	* **This is an INPUT field, so it does not reach the addon until the
+	* next train.** The hub router validates cap inputs against its own
+	* compiled Zod, which strips a key it does not know — verified today
+	* on the OUTPUT side, where an additive field DOES arrive immediately
+	* (`Track.hasFace`). Until the train ships, sending `false` is
+	* harmless and simply keeps the crops inline.
+	*/
+	includeCrops: boolean().optional()
 }).optional(), array(FaceInfoSchema).readonly()), method(object({
 	deviceId: number().int(),
 	trackId: string()

package/dist/{dist-DoTw0NM3.mjs → dist-hRt5QB5i.mjs}

@@ -18385,6 +18385,23 @@ var CameraRecordingStatusSchema = object({
 	active: boolean(),
 	storageBytes: number()
 });
+/** One stage of the fan-out that could NOT be read, and how long it cost. */
+var CameraStatusDegradationSchema = object({
+	stage: _enum([
+		"source",
+		"broker",
+		"detection",
+		"recording",
+		"switches"
+	]),
+	reason: _enum([
+		"timeout",
+		"error",
+		"partial"
+	]),
+	/** Wall-clock ms spent on the stage before it was abandoned. */
+	elapsedMs: number()
+});
 /**
 * Aggregated per-camera pipeline status — server-composed, single call.
 *
@@ -18415,9 +18432,28 @@ var CameraStatusSchema = object({
 	* differently — a quiet camera that looks identical to a dead one is the
 	* silence-reads-as-never-happened trap this repo keeps paying for.
 	*
-	* Empty when nothing is off. Never contains a switch no provider offers.
+	* Empty when nothing is off, and never contains a switch no provider offers
+	* — but an empty list is only a POSITIVE claim when `degraded` does not name
+	* `'switches'`. When it does, the switch set could not be read and nothing
+	* here may be rendered as "the operator turned nothing off": that is the
+	* D62 failure (a camera we could not read painted as broken) in the very
+	* field that exists to prevent it.
 	*/
 	switchedOff: array(CameraSwitchIdSchema).readonly(),
+	/**
+	* Stages of the bounded fan-out that were CUT SHORT — a timeout or a
+	* rejection — and whose block is therefore `null` because we could not
+	* READ it, not because there is nothing there.
+	*
+	* Without this, three different facts arrive as the same `null`: "the stage
+	* timed out", "the stage failed", and "this camera legitimately has no
+	* decoder / no recording". Every surface that draws a conclusion from a null
+	* block (or from an empty `switchedOff`) must consult this first; a stage
+	* named here supports no conclusion at all, only "unknown".
+	*
+	* Empty on a clean read — the overwhelmingly common case.
+	*/
+	degraded: array(CameraStatusDegradationSchema).readonly(),
 	/** Unix timestamp (ms) when this snapshot was composed server-side. */
 	fetchedAt: number()
 });
@@ -21137,7 +21173,29 @@ var FaceInfoSchema = object({
 	recognizedIdentityId: string().optional(),
 	identityName: string().optional(),
 	assigned: boolean(),
+	/**
+	* The crop, inline, base64.
+	*
+	* **Prefer {@link cropUrl}.** At the 500 rows the Faces view asks for this
+	* field alone is ~2.87 MiB, re-sent in full on every operator assign and
+	* every 30 s poll, base64-inflated over the msgpack socket and held in the
+	* query heap. It stays for callers that have not migrated; `includeCrops:
+	* false` turns it off once they have.
+	*/
 	base64: string().optional(),
+	/**
+	* Same crop, as a data-plane URL for `<img src>` — the move the admin
+	* snapshot surfaces made on 2026-08-08.
+	*
+	* Served by the `event-media` plane, which resolves a raw MediaStore key and
+	* is `access: 'authenticated'`: a bare `<img>` carries the `camstack_session`
+	* cookie, so no header plumbing is needed. The bytes then ride the browser's
+	* HTTP cache with an ETag and `immutable`, instead of the WebSocket.
+	*
+	* Absent when the face has no stored crop, or when the addon has no data
+	* plane — callers fall back to {@link base64}.
+	*/
+	cropUrl: string().optional(),
 	/** Design B: the face bbox (pixel space) on the key frame — lets a detail
 	*  view draw the box over the native `keyFrameMediaKey` frame. Absent on
 	*  legacy rows written before design B. */
@@ -21202,7 +21260,23 @@ method(_void(), array(IdentitySchema).readonly()), method(object({ name: string(
 	auth: "admin"
 }), method(object({
 	limit: number().int().positive().optional(),
-	filter: FaceFilterEnum.optional()
+	filter: FaceFilterEnum.optional(),
+	/**
+	* Inline the base64 crop on every row. Default `true` — the existing
+	* behaviour, kept so no caller breaks.
+	*
+	* Set `false` once the caller renders {@link FaceInfo.cropUrl}: that
+	* drops ~2.87 MiB per 500-row page to a few KiB of metadata and lets
+	* the browser cache the images.
+	*
+	* **This is an INPUT field, so it does not reach the addon until the
+	* next train.** The hub router validates cap inputs against its own
+	* compiled Zod, which strips a key it does not know — verified today
+	* on the OUTPUT side, where an additive field DOES arrive immediately
+	* (`Track.hasFace`). Until the train ships, sending `false` is
+	* harmless and simply keeps the crops inline.
+	*/
+	includeCrops: boolean().optional()
 }).optional(), array(FaceInfoSchema).readonly()), method(object({
 	deviceId: number().int(),
 	trackId: string()

package/dist/{event-loop-stall-monitor-DzdwBr4X.js → event-loop-stall-monitor-B_EOn2Q1.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CksKE1Sn.js");
+const require_dist = require("./dist-Ci2-N-XC.js");
 let node_perf_hooks = require("node:perf_hooks");
 //#region src/detection-pipeline/registry/model-catalogs.ts
 var HF_REPO = "camstack/camstack-models";

package/dist/{event-loop-stall-monitor-CtktCf3u.mjs → event-loop-stall-monitor-DUSB3ymZ.mjs}

@@ -1,4 +1,4 @@
-import { L as hfModelUrl, a as COCO_TO_MACRO, i as COCO_80_LABELS, r as AUDIO_MACRO_LABELS } from "./dist-DoTw0NM3.mjs";
+import { L as hfModelUrl, a as COCO_TO_MACRO, i as COCO_80_LABELS, r as AUDIO_MACRO_LABELS } from "./dist-hRt5QB5i.mjs";
 import { PerformanceObserver } from "node:perf_hooks";
 //#region src/detection-pipeline/registry/model-catalogs.ts
 var HF_REPO = "camstack/camstack-models";

package/dist/motion-wasm/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-CksKE1Sn.js");
+const require_dist = require("../dist-Ci2-N-XC.js");
 const require_lazy_sharp = require("../lazy-sharp-CcYuXtsa.js");
 let node_fs = require("node:fs");
 let node_path = require("node:path");

package/dist/motion-wasm/index.mjs

@@ -1,4 +1,4 @@
-import { B as motionDetectionCapability, I as evaluateZoneRules, at as BaseAddon, ct as DeviceType, ut as hydrateSchema } from "../dist-DoTw0NM3.mjs";
+import { B as motionDetectionCapability, I as evaluateZoneRules, at as BaseAddon, ct as DeviceType, ut as hydrateSchema } from "../dist-hRt5QB5i.mjs";
 import { t as getSharp } from "../lazy-sharp-B-mb8uWx.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/pipeline-runner/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-CksKE1Sn.js");
-const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-DzdwBr4X.js");
-const require_worker_protocol = require("../worker-protocol-CuEcTi66.js");
+const require_dist = require("../dist-Ci2-N-XC.js");
+const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-B_EOn2Q1.js");
+const require_worker_protocol = require("../worker-protocol-CxpdncMB.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_lazy_sharp = require("../lazy-sharp-CcYuXtsa.js");
 const require_remote_restream = require("../remote-restream-CO36Sr30.js");
@@ -1824,116 +1824,6 @@ var CropConventionSource = class {
 	}
 };
 //#endregion
-//#region src/pipeline-runner/native-lease-settings-source.ts
-/**
-* Where the runner gets the cluster-wide native-frame LEASE knobs.
-*
-* ## Why a settings read and not the attach config
-*
-* Identical reasoning to `crop-convention-source.ts`, and worth restating
-* because the temptation is the same: `RunnerCameraConfig` is the obvious
-* orchestrator→runner channel and it is the wrong one. Eleven call sites build
-* one; a cluster-wide constant threaded through eleven builders eventually
-* reaches ten of them, and the cameras attached by the forgotten builder just
-* quietly run a different lease window. Instead the runner reads the OWNER
-* addon's global settings directly, hub-routed by `AddonCallGateway`, so an
-* agent runner transparently reads the hub-central store with no placement
-* branching.
-*
-* ## Deliberately NOT node-scoped
-*
-* The read passes no `nodeId`. With one, `addon-settings` would project that
-* node's scoped value and two nodes could hold different lease windows for the
-* same camera — so whether a stored crop is native pixels or the ≤640 fallback
-* would depend on where the balancer happened to place it, which is invisible
-* from the stored media.
-*
-* ## What it hands out
-*
-* A {@link NativeLeaseSettingsOverride} — only the knobs the operator SET. The
-* decode worker resolves the rest (env var, then the shipped default); see
-* `session-decode/native-lease-config.ts` for the precedence. Handing out a
-* fully-resolved triple here would erase the "operator set nothing" state and
-* with it the env-var escape hatch.
-*/
-/**
-* The addon whose GLOBAL settings own the knobs. `pipeline-orchestrator` is
-* hub-resident and neutral — the same owner as the detail-crop convention and
-* the per-node decoder-backend selector.
-*/
-var NATIVE_LEASE_OWNER_ADDON_ID = "pipeline-orchestrator";
-/**
-* Whether two overrides name the same knobs with the same values.
-*
-* **Every knob has to appear here.** This is the equality that decides whether
-* a re-read is ADOPTED at all: a knob missing from the comparison is read from
-* the hub, judged identical, and discarded, so the operator's change never
-* reaches a decode worker and nothing anywhere says so. `admission` shipped
-* missing from this list and did exactly that — the setting was stored, the
-* hub served it, the runner fetched it, and every worker kept spawning with the
-* old value.
-*/
-function sameOverride(a, b) {
-	return a.ttlMs === b.ttlMs && a.budgetMb === b.budgetMb && a.activityMs === b.activityMs && a.admission === b.admission;
-}
-/**
-* TTL-cached read of the cluster native-lease knobs.
-*
-* {@link current} is synchronous because the fork that consumes it is;
-* {@link refresh} is what talks to the hub, and the runner awaits it on the
-* path that precedes a decode-worker spawn.
-*/
-var NativeLeaseSettingsSource = class {
-	override = {};
-	lastReadAtMs = Number.NEGATIVE_INFINITY;
-	inFlight = null;
-	logger;
-	now;
-	ttlMs;
-	constructor(options) {
-		this.logger = options.logger;
-		this.now = options.now ?? (() => Date.now());
-		this.ttlMs = options.ttlMs ?? 3e4;
-	}
-	/** The operator's overrides as last read — `{}` until a read lands. */
-	current() {
-		return this.override;
-	}
-	/**
-	* Re-read if the cached value has expired. Concurrent callers share one
-	* in-flight read; a failure keeps the LAST KNOWN value rather than reverting
-	* to `{}`, because a revert would silently hand the next-spawned workers a
-	* different RAM profile than the ones already running.
-	*/
-	async refresh(api) {
-		if (api === void 0) return this.override;
-		if (this.now() - this.lastReadAtMs < this.ttlMs) return this.override;
-		this.inFlight ??= this.read(api).finally(() => {
-			this.inFlight = null;
-		});
-		await this.inFlight;
-		return this.override;
-	}
-	async read(api) {
-		try {
-			const next = require_dist.pickNativeLeaseOverride(await api.addonSettings.getGlobalSettings.query({ addonId: NATIVE_LEASE_OWNER_ADDON_ID }));
-			this.lastReadAtMs = this.now();
-			if (sameOverride(next, this.override)) return;
-			this.logger.info("native lease settings changed — applies to NEW decode sessions", { meta: {
-				from: { ...this.override },
-				to: { ...next }
-			} });
-			this.override = next;
-		} catch (err) {
-			this.logger.warn("native lease settings read failed — keeping the last known value", { meta: {
-				owner: NATIVE_LEASE_OWNER_ADDON_ID,
-				inUse: { ...this.override },
-				error: err instanceof Error ? err.message : String(err)
-			} });
-		}
-	}
-};
-//#endregion
 //#region src/pipeline-runner/detail-subtree.ts
 /** Did the native-lease fetch report a miss (rather than return pixels)? */
 function isNativeCropMiss(fetch) {
@@ -2508,6 +2398,116 @@ function resolveNativeCropSource(isFullFrame, nativeHit) {
 	return isFullFrame ? "ram-fullframe" : "miss";
 }
 //#endregion
+//#region src/pipeline-runner/native-lease-settings-source.ts
+/**
+* Where the runner gets the cluster-wide native-frame LEASE knobs.
+*
+* ## Why a settings read and not the attach config
+*
+* Identical reasoning to `crop-convention-source.ts`, and worth restating
+* because the temptation is the same: `RunnerCameraConfig` is the obvious
+* orchestrator→runner channel and it is the wrong one. Eleven call sites build
+* one; a cluster-wide constant threaded through eleven builders eventually
+* reaches ten of them, and the cameras attached by the forgotten builder just
+* quietly run a different lease window. Instead the runner reads the OWNER
+* addon's global settings directly, hub-routed by `AddonCallGateway`, so an
+* agent runner transparently reads the hub-central store with no placement
+* branching.
+*
+* ## Deliberately NOT node-scoped
+*
+* The read passes no `nodeId`. With one, `addon-settings` would project that
+* node's scoped value and two nodes could hold different lease windows for the
+* same camera — so whether a stored crop is native pixels or the ≤640 fallback
+* would depend on where the balancer happened to place it, which is invisible
+* from the stored media.
+*
+* ## What it hands out
+*
+* A {@link NativeLeaseSettingsOverride} — only the knobs the operator SET. The
+* decode worker resolves the rest (env var, then the shipped default); see
+* `session-decode/native-lease-config.ts` for the precedence. Handing out a
+* fully-resolved triple here would erase the "operator set nothing" state and
+* with it the env-var escape hatch.
+*/
+/**
+* The addon whose GLOBAL settings own the knobs. `pipeline-orchestrator` is
+* hub-resident and neutral — the same owner as the detail-crop convention and
+* the per-node decoder-backend selector.
+*/
+var NATIVE_LEASE_OWNER_ADDON_ID = "pipeline-orchestrator";
+/**
+* Whether two overrides name the same knobs with the same values.
+*
+* **Every knob has to appear here.** This is the equality that decides whether
+* a re-read is ADOPTED at all: a knob missing from the comparison is read from
+* the hub, judged identical, and discarded, so the operator's change never
+* reaches a decode worker and nothing anywhere says so. `admission` shipped
+* missing from this list and did exactly that — the setting was stored, the
+* hub served it, the runner fetched it, and every worker kept spawning with the
+* old value.
+*/
+function sameOverride(a, b) {
+	return a.ttlMs === b.ttlMs && a.budgetMb === b.budgetMb && a.activityMs === b.activityMs && a.admission === b.admission;
+}
+/**
+* TTL-cached read of the cluster native-lease knobs.
+*
+* {@link current} is synchronous because the fork that consumes it is;
+* {@link refresh} is what talks to the hub, and the runner awaits it on the
+* path that precedes a decode-worker spawn.
+*/
+var NativeLeaseSettingsSource = class {
+	override = {};
+	lastReadAtMs = Number.NEGATIVE_INFINITY;
+	inFlight = null;
+	logger;
+	now;
+	ttlMs;
+	constructor(options) {
+		this.logger = options.logger;
+		this.now = options.now ?? (() => Date.now());
+		this.ttlMs = options.ttlMs ?? 3e4;
+	}
+	/** The operator's overrides as last read — `{}` until a read lands. */
+	current() {
+		return this.override;
+	}
+	/**
+	* Re-read if the cached value has expired. Concurrent callers share one
+	* in-flight read; a failure keeps the LAST KNOWN value rather than reverting
+	* to `{}`, because a revert would silently hand the next-spawned workers a
+	* different RAM profile than the ones already running.
+	*/
+	async refresh(api) {
+		if (api === void 0) return this.override;
+		if (this.now() - this.lastReadAtMs < this.ttlMs) return this.override;
+		this.inFlight ??= this.read(api).finally(() => {
+			this.inFlight = null;
+		});
+		await this.inFlight;
+		return this.override;
+	}
+	async read(api) {
+		try {
+			const next = require_dist.pickNativeLeaseOverride(await api.addonSettings.getGlobalSettings.query({ addonId: NATIVE_LEASE_OWNER_ADDON_ID }));
+			this.lastReadAtMs = this.now();
+			if (sameOverride(next, this.override)) return;
+			this.logger.info("native lease settings changed — applies to NEW decode sessions", { meta: {
+				from: { ...this.override },
+				to: { ...next }
+			} });
+			this.override = next;
+		} catch (err) {
+			this.logger.warn("native lease settings read failed — keeping the last known value", { meta: {
+				owner: NATIVE_LEASE_OWNER_ADDON_ID,
+				inUse: { ...this.override },
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		}
+	}
+};
+//#endregion
 //#region src/pipeline-runner/frame-governor.ts
 var FrameGovernor = class {
 	config;
@@ -4986,7 +4986,20 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends require_dist.BaseAdd
 		if (resolved.tier === "native" && resolved.pixels !== null) return this.encodeNativeCropResult(resolved.pixels, resolved.tier, input.encodeJpeg);
 		if (resolved.tier !== "ram-fullframe") return null;
 		const crop = this.retainedFrames?.crop(input.handle, input.bbox, input.maxWidth);
-		if (!crop) return null;
+		if (!crop) {
+			this.ctx?.logger.warn("native full-frame miss — the retained store no longer holds this frame", {
+				tags: { deviceId: this.nativeCropRegistry.deviceIdFor(input.handle) ?? -1 },
+				meta: {
+					handle: `${input.handle.shmId}#${input.handle.slot}#${input.handle.seq}`,
+					handleNodeId: input.handle.nodeId,
+					nativeMissReason: resolved.missReason,
+					nativeHandleAgeMs: resolved.handleAgeMs,
+					maxWidth: input.maxWidth ?? null,
+					hint: "both the native lease and the retained-frame window have closed for this frame — the detail dispatch that asked for it produces NO crop"
+				}
+			});
+			return null;
+		}
 		return this.encodeNativeCropResult({
 			bytes: crop.bytes,
 			width: crop.width,