@camstack/addon-post-analysis 1.2.151 → 1.2.153

package/dist/{dist-B5K63Zmt.mjs → dist-DDIu0Q1W.mjs}

@@ -13536,6 +13536,133 @@ var embeddingEncoderCapability = {
 	}
 };
 /**
+* `failure-contribution` — the capability an addon reports its OWN losses
+* through, per camera, with the denominator attached. It stores nothing.
+*
+* ## The twin of `load-contribution`, and why it is a twin and not a field
+*
+* `load-contribution` answers *what did this camera COST*. This answers *what
+* did this camera LOSE*. The reporting discipline is identical and deliberately
+* copied: the contributor reports what it already knows, hub-main adds only
+* `addonId`, nothing needs global knowledge, and there is no central list for
+* somebody to forget to edit.
+*
+* They are not merged, because their invariants are opposites:
+*
+*  - a `load-contribution` measurement is **absent, never zero** — a zero would
+*    claim a camera cost nothing, which is a measurement nobody made;
+*  - a `failure-contribution` zero is the **most valuable value on the
+*    surface** — `attempts: 400, succeeded: 400` is the proof a fix landed,
+*    and it is exactly what an absent entry cannot say.
+*
+* Putting a loss counter on a cost entry would also break the reconciliation
+* that gives `load-contribution` its point: contributions are subtracted from
+* `metrics.node-processes-snapshot` to find processes nobody claims. A failure
+* has no process.
+*
+* ## Why not a log line, since the counters already exist
+*
+* Several of these paths already counted themselves — `CaptureScheduler`'s
+* per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
+* ends in a log line, and a log line is the thing the operator asked to stop
+* needing: *"possiamo armare questi errori intanto? Così al prossimo giro
+* ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
+* hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
+* media blackout were both diagnosed. The counters stay; this is where they can
+* be READ.
+*
+* ## The rate is served with its denominator or not at all
+*
+* Every entry carries `attempts` and `succeeded`. A miss count alone is
+* unreadable: on 2026-08-28 the enrichment-crop miss count read as "35x worse
+* than yesterday" and was **flat across twelve hours** once divided by the
+* successes on the same path. A surface that publishes only the numerator
+* reproduces that mistake on every read.
+*
+* ## Shape
+*
+* Copied from `load-contribution.cap.ts` (`mode: 'collection'`,
+* `internal: true`, `mount: { kind: 'skip' }`): no tRPC route of its own and no
+* generated hooks, while `addons.listCapabilityProviders` still enumerates it
+* and the hub's `CapabilityRegistry` still holds an RPC proxy per provider — so
+* a forked runner's entries reach hub-main over transport that already exists.
+* No new UDS message, no second registry (D3). The operator reads the assembled
+* result through `system.getFailureContributions`.
+*/
+var FailureReasonCountSchema = object({
+	/**
+	* Why the attempt did not land, in the contributor's own vocabulary —
+	* `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
+	* strings that already appear in this repo's logs and, where one exists, the
+	* same string the per-track `previewMissReason` records (D276): a second
+	* vocabulary for the same loss would make the row and the counter
+	* un-joinable.
+	*/
+	reason: string(),
+	count: number().int().nonnegative()
+});
+var FailureContributionSchema = object({
+	/**
+	* The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
+	* `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
+	* `unit` free: the families are owned by different addons and a shared enum
+	* is a central list that rots invisibly.
+	*/
+	family: string(),
+	/**
+	* The NUMERIC device id — the same value every log line carries as
+	* `tags.deviceId`. Never nullable and never absent: a contributor that
+	* cannot name the camera must not emit the entry, because a fleet total
+	* cannot answer the only question anybody asks of this surface.
+	*/
+	deviceId: number().int().positive(),
+	/**
+	* A second dimension inside the family: the model / step id for an inference
+	* timeout, so "which camera AND which model" is one read. Absent when the
+	* family has a single variant.
+	*/
+	variant: string().optional(),
+	/**
+	* Epoch ms this counter started — the INCARNATION MARKER. A consumer
+	* differencing two reads must drop the interval when it changes, because the
+	* counter restarted from zero in a respawned runner. Same discipline as
+	* `LoadContribution.startedAtMs`.
+	*/
+	sinceMs: number(),
+	/** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
+	atMs: number(),
+	/**
+	* THE DENOMINATOR — every attempt on this path for this camera in the
+	* window. A failure count published without it is the mistake this schema
+	* exists to make impossible.
+	*/
+	attempts: number().int().nonnegative(),
+	/** Attempts that landed. `attempts - succeeded` is the loss. */
+	succeeded: number().int().nonnegative(),
+	/** The loss, partitioned. Sums to `attempts - succeeded`. */
+	reasons: array(FailureReasonCountSchema).readonly()
+});
+var failureContributionCapability = {
+	name: "failure-contribution",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { 
+	/**
+	* This addon's per-camera failure counters, read live from bounded in-RAM
+	* state it already keeps. Inert: no persistence, no sampling, no timer.
+	*
+	* READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
+	* consumer that wants a rate differences two reads. A draining read would
+	* make two operators with the page open each destroy half of the other's
+	* numbers, and `load-contribution` already settled the same question the
+	* same way for `cpuSeconds`.
+	*/
+list: method(_void(), array(FailureContributionSchema).readonly()) },
+	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
+	mount: { kind: "skip" }
+};
+/**
 * filesystem-browse — per-node capability for browsing the node's local
 * filesystem. Reads are unconfined (whole filesystem, from `/` down); WRITES
 * are sandboxed to operator-configured allowed roots (D115). Used by the
@@ -14057,6 +14184,68 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }
 	kind: "mutation",
 	auth: "admin"
 });
+var LoadContributionSchema = object({
+	role: _enum([
+		"decode",
+		"transcode",
+		"recording",
+		"streaming",
+		"detection"
+	]),
+	/**
+	* The NUMERIC device id — the same value every log line carries as
+	* `tags.deviceId`. `null` means this cost genuinely belongs to no single
+	* camera (a shared pool), NOT that the contributor forgot to look it up: a
+	* contributor that cannot name its camera must not emit the entry at all,
+	* because an unnamed per-camera entry is indistinguishable from a shared one
+	* and would quietly turn one camera's cost into everybody's.
+	*/
+	deviceId: number().int().positive().nullable(),
+	attribution: _enum([
+		"measured",
+		"accounted",
+		"unattributable"
+	]),
+	/**
+	* What ONE entry is, in the contributor's own words — `615/high`,
+	* `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
+	* family and inventing a common one would lose the only information that
+	* makes two entries for the same camera distinguishable.
+	*/
+	unit: string(),
+	/**
+	* The OS process this cost lives in, when there is one. Present so a
+	* consumer can (a) tell two generations of the same unit apart across a
+	* restart, and (b) subtract claimed processes from the node's process
+	* snapshot to see what NOBODY claimed. Absent for an entry that owns no
+	* process of its own.
+	*/
+	pid: number().int().positive().optional(),
+	/**
+	* When this generation started. The pid's incarnation marker: a consumer
+	* differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
+	* window when this changes, because the counter restarted from zero in a new
+	* process.
+	*/
+	startedAtMs: number().optional(),
+	/**
+	* CUMULATIVE CPU seconds this unit has consumed since it started — user +
+	* system, read from the child's own `/proc/<pid>/stat` at the moment the
+	* contribution is asked for.
+	*
+	* Cumulative and not a rate on purpose: a rate needs a window, a window
+	* needs a sampler, and a new per-node sampler is the defect half of
+	* `docs/architecture/load-ledger.md` documents. A counter can be differenced
+	* by whoever already keeps a history; a rate cannot be un-averaged.
+	*
+	* Absent — never zero — on a node with no `/proc`, on a read failure, and on
+	* an entry with no process.
+	*/
+	cpuSeconds: number().optional(),
+	/** Resident bytes of this unit's process, same source and same rules. */
+	rssBytes: number().optional()
+});
+method(_void(), array(LoadContributionSchema).readonly());
 /**
 * `log-channels` — the capability an addon DECLARES its diagnostic channels
 * through. It stores nothing.
@@ -14133,195 +14322,6 @@ method(LogEntrySchema, _void(), { kind: "mutation" }), method(object({
 	tags: record(string(), string()).optional()
 }), array(LogEntrySchema).readonly());
 /**
-* `failure-contribution` — the capability an addon reports its OWN losses
-* through, per camera, with the denominator attached. It stores nothing.
-*
-* ## The twin of `load-contribution`, and why it is a twin and not a field
-*
-* `load-contribution` answers *what did this camera COST*. This answers *what
-* did this camera LOSE*. The reporting discipline is identical and deliberately
-* copied: the contributor reports what it already knows, hub-main adds only
-* `addonId`, nothing needs global knowledge, and there is no central list for
-* somebody to forget to edit.
-*
-* They are not merged, because their invariants are opposites:
-*
-*  - a `load-contribution` measurement is **absent, never zero** — a zero would
-*    claim a camera cost nothing, which is a measurement nobody made;
-*  - a `failure-contribution` zero is the **most valuable value on the
-*    surface** — `attempts: 400, succeeded: 400` is the proof a fix landed,
-*    and it is exactly what an absent entry cannot say.
-*
-* Putting a loss counter on a cost entry would also break the reconciliation
-* that gives `load-contribution` its point: contributions are subtracted from
-* `metrics.node-processes-snapshot` to find processes nobody claims. A failure
-* has no process.
-*
-* ## Why not a log line, since the counters already exist
-*
-* Several of these paths already counted themselves — `CaptureScheduler`'s
-* per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
-* ends in a log line, and a log line is the thing the operator asked to stop
-* needing: *"possiamo armare questi errori intanto? Così al prossimo giro
-* ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
-* hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
-* media blackout were both diagnosed. The counters stay; this is where they can
-* be READ.
-*
-* ## The rate is served with its denominator or not at all
-*
-* Every entry carries `attempts` and `succeeded`. A miss count alone is
-* unreadable: on 2026-08-28 the enrichment-crop miss count read as "35x worse
-* than yesterday" and was **flat across twelve hours** once divided by the
-* successes on the same path. A surface that publishes only the numerator
-* reproduces that mistake on every read.
-*
-* ## Shape
-*
-* Copied from `load-contribution.cap.ts` (`mode: 'collection'`,
-* `internal: true`, `mount: { kind: 'skip' }`): no tRPC route of its own and no
-* generated hooks, while `addons.listCapabilityProviders` still enumerates it
-* and the hub's `CapabilityRegistry` still holds an RPC proxy per provider — so
-* a forked runner's entries reach hub-main over transport that already exists.
-* No new UDS message, no second registry (D3). The operator reads the assembled
-* result through `system.getFailureContributions`.
-*/
-var FailureReasonCountSchema = object({
-	/**
-	* Why the attempt did not land, in the contributor's own vocabulary —
-	* `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
-	* strings that already appear in this repo's logs and, where one exists, the
-	* same string the per-track `previewMissReason` records (D276): a second
-	* vocabulary for the same loss would make the row and the counter
-	* un-joinable.
-	*/
-	reason: string(),
-	count: number().int().nonnegative()
-});
-var FailureContributionSchema = object({
-	/**
-	* The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
-	* `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
-	* `unit` free: the families are owned by different addons and a shared enum
-	* is a central list that rots invisibly.
-	*/
-	family: string(),
-	/**
-	* The NUMERIC device id — the same value every log line carries as
-	* `tags.deviceId`. Never nullable and never absent: a contributor that
-	* cannot name the camera must not emit the entry, because a fleet total
-	* cannot answer the only question anybody asks of this surface.
-	*/
-	deviceId: number().int().positive(),
-	/**
-	* A second dimension inside the family: the model / step id for an inference
-	* timeout, so "which camera AND which model" is one read. Absent when the
-	* family has a single variant.
-	*/
-	variant: string().optional(),
-	/**
-	* Epoch ms this counter started — the INCARNATION MARKER. A consumer
-	* differencing two reads must drop the interval when it changes, because the
-	* counter restarted from zero in a respawned runner. Same discipline as
-	* `LoadContribution.startedAtMs`.
-	*/
-	sinceMs: number(),
-	/** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
-	atMs: number(),
-	/**
-	* THE DENOMINATOR — every attempt on this path for this camera in the
-	* window. A failure count published without it is the mistake this schema
-	* exists to make impossible.
-	*/
-	attempts: number().int().nonnegative(),
-	/** Attempts that landed. `attempts - succeeded` is the loss. */
-	succeeded: number().int().nonnegative(),
-	/** The loss, partitioned. Sums to `attempts - succeeded`. */
-	reasons: array(FailureReasonCountSchema).readonly()
-});
-var failureContributionCapability = {
-	name: "failure-contribution",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: { 
-	/**
-	* This addon's per-camera failure counters, read live from bounded in-RAM
-	* state it already keeps. Inert: no persistence, no sampling, no timer.
-	*
-	* READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
-	* consumer that wants a rate differences two reads. A draining read would
-	* make two operators with the page open each destroy half of the other's
-	* numbers, and `load-contribution` already settled the same question the
-	* same way for `cpuSeconds`.
-	*/
-list: method(_void(), array(FailureContributionSchema).readonly()) },
-	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
-	mount: { kind: "skip" }
-};
-var LoadContributionSchema = object({
-	role: _enum([
-		"decode",
-		"transcode",
-		"recording",
-		"streaming",
-		"detection"
-	]),
-	/**
-	* The NUMERIC device id — the same value every log line carries as
-	* `tags.deviceId`. `null` means this cost genuinely belongs to no single
-	* camera (a shared pool), NOT that the contributor forgot to look it up: a
-	* contributor that cannot name its camera must not emit the entry at all,
-	* because an unnamed per-camera entry is indistinguishable from a shared one
-	* and would quietly turn one camera's cost into everybody's.
-	*/
-	deviceId: number().int().positive().nullable(),
-	attribution: _enum([
-		"measured",
-		"accounted",
-		"unattributable"
-	]),
-	/**
-	* What ONE entry is, in the contributor's own words — `615/high`,
-	* `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
-	* family and inventing a common one would lose the only information that
-	* makes two entries for the same camera distinguishable.
-	*/
-	unit: string(),
-	/**
-	* The OS process this cost lives in, when there is one. Present so a
-	* consumer can (a) tell two generations of the same unit apart across a
-	* restart, and (b) subtract claimed processes from the node's process
-	* snapshot to see what NOBODY claimed. Absent for an entry that owns no
-	* process of its own.
-	*/
-	pid: number().int().positive().optional(),
-	/**
-	* When this generation started. The pid's incarnation marker: a consumer
-	* differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
-	* window when this changes, because the counter restarted from zero in a new
-	* process.
-	*/
-	startedAtMs: number().optional(),
-	/**
-	* CUMULATIVE CPU seconds this unit has consumed since it started — user +
-	* system, read from the child's own `/proc/<pid>/stat` at the moment the
-	* contribution is asked for.
-	*
-	* Cumulative and not a rate on purpose: a rate needs a window, a window
-	* needs a sampler, and a new per-node sampler is the defect half of
-	* `docs/architecture/load-ledger.md` documents. A counter can be differenced
-	* by whoever already keeps a history; a rate cannot be un-averaged.
-	*
-	* Absent — never zero — on a node with no `/proc`, on a read failure, and on
-	* an entry with no process.
-	*/
-	cpuSeconds: number().optional(),
-	/** Resident bytes of this unit's process, same source and same rules. */
-	rssBytes: number().optional()
-});
-method(_void(), array(LoadContributionSchema).readonly());
-/**
 * `login-method` — collection cap through which auth addons contribute
 * their pre-auth login surfaces to the login page. This is the SINGLE,
 * generic mechanism that supersedes the dead `auth.listProviders` reader:
@@ -19687,12 +19687,53 @@ var MediaFileKindEnum = _enum([
 	"keyFrameSmall",
 	"thumbnailSmall"
 ]);
+/**
+* One media row ON THE WIRE: what it is, how big it is, and WHERE ITS BYTES
+* ARE — never the bytes themselves.
+*
+* ## Why `url` and not `base64`
+*
+* Measured on the live hub 2026-08-30: `getTrackMedia {trackId, deviceId}`
+* with no `kinds` returned 6 rows / **3 597 219 B**, of which `keyFrame` alone
+* was **2 824 077 B** — one full-resolution frame, base64, so +33 % on the
+* wire. Forty events is ~144 MB. Every byte of it was read off disk,
+* base64-encoded, held whole in a unary tRPC envelope, and materialised in
+* hub-main's heap on the way past — for an `<img>` that would have cached it.
+*
+* `url` points at the `event-media` data plane
+* (`/addon/<addonId>/event-media/<storedKey>`), which serves the same blob
+* with an ETag and `Cache-Control: immutable`, honours conditional GETs, can
+* render a `?variant=thumb`, and streams. The hub gate in front of it requires
+* a bearer or the session cookie (`access: 'authenticated'`), so the bytes are
+* no less protected than they were inside a `view`-level cap response — see
+* `data-plane-access.ts` for the rule and the one gap it does not close
+* (per-device scoping).
+*
+* The URL is built from the row's **stored** key, which is not always its
+* published `kind`: a track's face/plate crop is stored as `crop` under
+* `('face'|'plate', '<prefix>-<trackId>')` and published as
+* `faceCrop`/`plateCrop`. `MediaStore.getByKey` knows only the stored key.
+*
+* ## `base64` is TRANSITIONAL and is going away
+*
+* It is still populated for one reason: the deployed viewer's track-detail
+* HERO tile reads it (`use-track-media-entry.ts` → `parseMediaFiles`, which
+* REQUIRES the field), and a row without it parses as a FAILED read — the red
+* triangle — not as absence. Removing the field before that viewer ships is an
+* outage, not a cleanup. Once the viewer takes its hero bytes from `url`,
+* delete this line and the `withBytes` pass-through in
+* `analytics-query-facade.ts`; nothing else reads it.
+*/
 var MediaFileSchema = object({
 	key: string(),
 	kind: MediaFileKindEnum,
-	base64: string(),
 	sizeBytes: number(),
 	timestamp: number()
+}).extend({
+	/** `/addon/<addonId>/event-media/<encoded stored key>`. Always present. */
+	url: string(),
+	/** @deprecated Transitional — see the schema docblock. Use {@link url}. */
+	base64: string()
 });
 /**
 * One media row WITHOUT its bytes.
@@ -19704,7 +19745,9 @@ var MediaFileSchema = object({
 * blocks the whole view.
 *
 * `sizeBytes` is carried because it is what lets a client decide between the
-* stored blob and a `?variant=thumb` rendering without fetching either.
+* stored blob and a `?variant=thumb` rendering without fetching either, and
+* `url` because a client that had to build the plane path itself is a second
+* copy of a route — the embed, the viewer and the admin UI each grew one.
 */
 var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
 /**
@@ -20051,6 +20094,50 @@ var EventStoreFootprintSchema = object({
 	totalBytes: number().int(),
 	devices: array(EventStoreDeviceFootprintSchema).readonly()
 });
+/** Event-media footprint for one {@link MediaFileKind}. */
+var EventMediaKindFootprintSchema = object({
+	kind: MediaFileKindEnum,
+	/** Media rows of this kind. */
+	rows: number().int(),
+	/** Bytes on disk held by those rows. */
+	bytes: number().int()
+});
+/**
+* The media footprint broken down by KIND — the axis a deletion decision
+* actually turns on.
+*
+* A byte total says how much there is; it cannot say what is safe to remove.
+* The deletable set (the periodic `snapshot` filmstrip, the surplus per-edge
+* motion stills) and the keep set (`firstFrame`, rolling `lastFrame`,
+* `thumbnail`/`thumbnailSmall`, `keyFrame`/`keyFrameSmall`, the face/plate
+* buffers, gallery media, the CLIP `crop`) are distinguished by `kind` and by
+* nothing else, so sizing a deletion means summing per kind.
+*
+* ## Why `unaccounted*` exists
+*
+* `kinds` is enumerated from {@link MediaFileKindEnum} — the closed set the
+* writers use — and summed one kind at a time. `totalRows` / `totalBytes` come
+* from a SEPARATE unfiltered aggregate over the same rows, never from adding
+* `kinds` up. A row whose stored `kind` is not in the enum (written by a
+* retired code path, or by a version that knew a kind this one does not) would
+* otherwise vanish from the total silently, and an operator would delete
+* against a denominator smaller than the disk.
+*
+* `unaccountedRows` / `unaccountedBytes` are the difference. They are normally
+* zero; a non-zero value is a real finding and must be shown, not rounded away.
+*/
+var EventMediaKindBreakdownSchema = object({
+	/** Every media row in scope, from one unfiltered aggregate. */
+	totalRows: number().int(),
+	/** Every media byte in scope, from that same aggregate. */
+	totalBytes: number().int(),
+	/** Per-kind footprint, ordered by bytes descending. */
+	kinds: array(EventMediaKindFootprintSchema).readonly(),
+	/** `totalRows` minus the summed `kinds` rows — see the schema note. */
+	unaccountedRows: number().int(),
+	/** `totalBytes` minus the summed `kinds` bytes — see the schema note. */
+	unaccountedBytes: number().int()
+});
 /** Per-kind counts returned by the event-prune / device-delete mutations. */
 var EventPruneCountsSchema = object({
 	motion: number().int(),
@@ -20432,6 +20519,22 @@ var pipelineAnalyticsCapability = {
 			auth: "admin"
 		}),
 		/**
+		* The same media footprint, broken down by {@link MediaFileKind} instead of
+		* by camera — fleet-wide, or for one camera with `deviceId`.
+		*
+		* Separate from {@link getEventStoreFootprint} rather than a field on it:
+		* the two answer different questions on different axes, the per-camera one
+		* is what the management table renders on every open, and nothing should
+		* pay for a per-kind pass to draw it. See
+		* {@link EventMediaKindBreakdownSchema} for why `unaccounted*` exists —
+		* `kinds` is enumerated, `totalBytes` is not, and the gap must be visible
+		* to anyone sizing a deletion against it.
+		*/
+		getEventMediaFootprintByKind: method(object({ deviceId: number().int().optional() }), EventMediaKindBreakdownSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
 		* Cluster-wide prune of events older than `olderThanMs` (exclusive) across
 		* every camera, deleting each event's media in lockstep. Logged to the
 		* events ops-log with `reason` (default `'retention'`). Returns the summed
@@ -20836,6 +20939,26 @@ var pipelineAnalyticsCapability = {
 			deviceId: number()
 		}), array(MediaFileInfoSchema).readonly()),
 		/**
+		* What media an EVENT has, without any of it — the twin `getEventMedia`
+		* never had.
+		*
+		* `listTrackMedia` above got this treatment because a track's media is
+		* 5-8 MB. An event's is worse per row, not better: an old-style event owns
+		* a `crop` AND a native-resolution `fullFrameBoxed`, and the track DETAIL
+		* modal — the one surface that legitimately shows the big kinds — unions
+		* both listings to build its filmstrip. It then renders every tile from
+		* the `event-media` plane by key and throws the bytes away. Measured on
+		* the live hub: one event's `fullFrameBoxed` is 2 824 077 B, base64'd to
+		* ~3.8 MB, allocated whole in hub-main's heap, for a list of keys.
+		*
+		* Same `deviceId` authorization subject as `getEventMedia`, and the same
+		* rows — this is a projection of that method, never a different question.
+		*/
+		listEventMedia: method(object({
+			eventId: string(),
+			deviceId: number()
+		}), array(MediaFileInfoSchema).readonly()),
+		/**
 		* Search object events by text query using CLIP cosine similarity.
 		* Encodes `text` via the `embedding-encoder` cap, queries the
 		* `ObjectEmbeddingStore` with optional prefilters, ranks all matching
@@ -22704,6 +22827,20 @@ method(object({
 	error: string().optional()
 }), { auth: "admin" }), method(_void(), array(ProviderListEntrySchema).readonly()), method(object({
 	providerId: string(),
+	/**
+	* The location this config is an UNSAVED edit of, when there is one.
+	*
+	* `listLocations` replaces every declared secret with the redaction
+	* sentinel, so the edit modal's form state holds the sentinel for any
+	* credential the operator did not retype — and posting that here
+	* without a way to resolve it makes the provider try to authenticate
+	* as `__camstack_redacted__` and report the operator's own working
+	* password as wrong. Given this id, the orchestrator restores each
+	* sentinel from the stored config (same rule as `upsertLocation`)
+	* before dispatching. Omitted by the "Add location" wizard, where
+	* every value was typed just now and nothing is stored yet.
+	*/
+	locationId: string().optional(),
 	config: record(string(), unknown())
 }), object({
 	ok: boolean(),
@@ -25899,10 +26036,24 @@ var FaceClusterSchema = object({
 	size: number().int(),
 	cohesion: number()
 });
+/**
+* One gallery media row: what the crop is, how big it is, and WHERE its bytes
+* are — never the bytes.
+*
+* `base64` was deleted here rather than deprecated. `MediaFile.base64` (the
+* track/event contract) is still populated because a deployed viewer requires
+* the field to parse a row at all; this method has no such reader. Its ONE
+* caller is the admin UI's detail modal, which was building
+* `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
+* dialog already rendering its key FRAME from the `event-media` plane.
+*
+* `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
+* media key directly, so this needed no new plane and no new access decision.
+*/
 var MediaFileLiteSchema$1 = object({
 	key: string(),
 	kind: string(),
-	base64: string(),
+	url: string(),
 	sizeBytes: number(),
 	timestamp: number()
 });
@@ -28950,10 +29101,24 @@ var PlateInfoSchema = object({
 	*/
 	cropUrl: string().optional()
 });
+/**
+* One gallery media row: what the crop is, how big it is, and WHERE its bytes
+* are — never the bytes.
+*
+* `base64` was deleted here rather than deprecated. `MediaFile.base64` (the
+* track/event contract) is still populated because a deployed viewer requires
+* the field to parse a row at all; this method has no such reader. Its ONE
+* caller is the admin UI's detail modal, which was building
+* `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
+* dialog already rendering its key FRAME from the `event-media` plane.
+*
+* `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
+* media key directly, so this needed no new plane and no new access decision.
+*/
 var MediaFileLiteSchema = object({
 	key: string(),
 	kind: string(),
-	base64: string(),
+	url: string(),
 	sizeBytes: number(),
 	timestamp: number()
 });
@@ -37005,6 +37170,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getEventMediaFootprintByKind": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getEventStoreFootprint": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -37101,6 +37272,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listEventMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listGroups": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -40664,6 +40841,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.getEventMediaFootprintByKind": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"pipelineAnalytics.getGroup": [{
 		name: "deviceId",
 		form: "single",
@@ -40724,6 +40906,11 @@ Object.freeze({
 		form: "array",
 		optional: false
 	}],
+	"pipelineAnalytics.listEventMedia": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.listGroups": [{
 		name: "deviceIds",
 		form: "array",
@@ -42590,4 +42777,4 @@ function vectorDimFromBase64(encoded) {
 	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
 }
 //#endregion
-export { audioModeOf as $, NcSnoozeSchema as A, BaseAddon as At, SCENE_DEFAULT_UNCOVERED_POLICY as B, discriminatedUnion as Bt, NcConditionDescriptorSchema as C, sceneMonitorCapability as Ct, NcRuleTargetSchema as D, videoclipsCapability as Dt, NcRuleSchema as E, vectorDimFromBase64 as Et, PoolMemoryWatchdog as F, nodePin as Ft, TimelapseRulePatchSchema as G, record as Gt, SceneMonitorSchema as H, number as Ht, RECORDING_EXPORT_MAX_READ_BYTES as I, sleep as It, VISIT_MERGE_GAP_MS as J, EventCategory as Jt, TimelapseRuleSchema as K, string as Kt, RetrainStatusSchema as L, _enum as Lt, NcSystemEventKindSchema as M, createEvent as Mt, NcTaxonomySchema as N, hydrateSchema as Nt, NcScheduleSchema as O, zoneAnalyticsCapability as Ot, OpsLogEntrySchema as P, isDeviceScopedCap as Pt, audioMetricsCapability as Q, SCENE_CONFIRM_DEFAULT_TIMEOUT_MS as R, array as Rt, NC_TAXONOMY as S, resolvePoolMemoryPolicy as St, NcRulePatchSchema as T, systemEventFilterApplies as Tt, TIMELAPSE_DENSE_FLOOR_SEC as U, object as Ut, SCENE_DIVERGED as V, literal as Vt, TimelapseRuleInputSchema as W, partialRecord as Wt, alarmPanelCapability as X, addonWidgetsSourceCapability as Y, assertTimelapseCadences as Z, MACRO_LABELS as _, pickClusterStepModels as _t, COCO_TO_MACRO as a, embeddingEncoderCapability as at, NC_DEFAULT_SNOOZE_MINUTES as b, readDeviceStateFrom as bt, DEFAULT_TIMELAPSE_PREVIEW_TEXT as c, faceGalleryCapability as ct, DeclaredDevices as d, isDetectionMacroClass as dt, buildEventKindDescriptor as et, EVENT_KIND_BY_CAP as f, isScheduleActive as ft, LabelAttributionSchema as g, parseProcStatus as gt, FailureCounters as h, notificationRulesCapability as ht, CLUSTER_MODEL_SCOPED_STEPS as i, deriveRecordingMode as it, NcSnoozeSuppressedSchema as j, DeviceType as jt, NcSnoozeInputSchema as k, errMsg as kt, DETECTION_MACRO_CLASSES as l, failureContributionCapability as lt, FULL_IMAGE_BBOX as m, kebabToCamel as mt, AnalyticsGroupRecordSchema as n, customAction as nt, DEFAULT_EVENT_COLOR as o, encodeVectorBase64 as ot, EVENT_PAD_MS as p, isSourceCap as pt, TrackSourceSchema as q, unknown as qt, BaseDevice as r, defineCustomActions as rt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as s, evaluateSensorEdge as st, AnalyticsGroupDetailSchema as t, cosineSimilarity as tt, DETECTION_PIPELINE_CAP_NAME as u, hfModelUrl as ut, NC_ALARM_SYSTEM_EVENT_KINDS as v, pipelineAnalyticsCapability as vt, NcRuleInputSchema as w, subKindsOf as wt, NC_SNOOZE_MAX_MINUTES as x, readTimelapseGeneratedAt as xt, NC_CONDITION_CATALOG as y, plateGalleryCapability as yt, SCENE_DEFAULT_ANCHOR_THRESHOLD as z, boolean as zt };
+export { audioMetricsCapability as $, NcSnoozeInputSchema as A, errMsg as At, SCENE_DEFAULT_ANCHOR_THRESHOLD as B, boolean as Bt, NC_TAXONOMY as C, resolvePoolMemoryPolicy as Ct, NcRuleSchema as D, vectorDimFromBase64 as Dt, NcRulePatchSchema as E, systemEventFilterApplies as Et, OpsLogEntrySchema as F, isDeviceScopedCap as Ft, TimelapseRuleInputSchema as G, partialRecord as Gt, SCENE_DIVERGED as H, literal as Ht, PoolMemoryWatchdog as I, nodePin as It, TrackSourceSchema as J, unknown as Jt, TimelapseRulePatchSchema as K, record as Kt, RECORDING_EXPORT_MAX_READ_BYTES as L, sleep as Lt, NcSnoozeSuppressedSchema as M, DeviceType as Mt, NcSystemEventKindSchema as N, createEvent as Nt, NcRuleTargetSchema as O, videoclipsCapability as Ot, NcTaxonomySchema as P, hydrateSchema as Pt, assertTimelapseCadences as Q, RetrainStatusSchema as R, _enum as Rt, NC_SNOOZE_MAX_MINUTES as S, readTimelapseGeneratedAt as St, NcRuleInputSchema as T, subKindsOf as Tt, SceneMonitorSchema as U, number as Ut, SCENE_DEFAULT_UNCOVERED_POLICY as V, discriminatedUnion as Vt, TIMELAPSE_DENSE_FLOOR_SEC as W, object as Wt, addonWidgetsSourceCapability as X, VISIT_MERGE_GAP_MS as Y, EventCategory as Yt, alarmPanelCapability as Z, MACRO_LABELS as _, parseProcStatus as _t, COCO_TO_MACRO as a, deriveRecordingMode as at, NC_CONDITION_CATALOG as b, plateGalleryCapability as bt, DEFAULT_TIMELAPSE_PREVIEW_TEXT as c, evaluateSensorEdge as ct, DeclaredDevices as d, hfModelUrl as dt, audioModeOf as et, EVENT_KIND_BY_CAP as f, isDetectionMacroClass as ft, LabelAttributionSchema as g, notificationRulesCapability as gt, FailureCounters as h, kebabToCamel as ht, CLUSTER_MODEL_SCOPED_STEPS as i, defineCustomActions as it, NcSnoozeSchema as j, BaseAddon as jt, NcScheduleSchema as k, zoneAnalyticsCapability as kt, DETECTION_MACRO_CLASSES as l, faceGalleryCapability as lt, FULL_IMAGE_BBOX as m, isSourceCap as mt, AnalyticsGroupRecordSchema as n, cosineSimilarity as nt, DEFAULT_EVENT_COLOR as o, embeddingEncoderCapability as ot, EVENT_PAD_MS as p, isScheduleActive as pt, TimelapseRuleSchema as q, string as qt, BaseDevice as r, customAction as rt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as s, encodeVectorBase64 as st, AnalyticsGroupDetailSchema as t, buildEventKindDescriptor as tt, DETECTION_PIPELINE_CAP_NAME as u, failureContributionCapability as ut, MediaFileKindEnum as v, pickClusterStepModels as vt, NcConditionDescriptorSchema as w, sceneMonitorCapability as wt, NC_DEFAULT_SNOOZE_MINUTES as x, readDeviceStateFrom as xt, NC_ALARM_SYSTEM_EVENT_KINDS as y, pipelineAnalyticsCapability as yt, SCENE_CONFIRM_DEFAULT_TIMEOUT_MS as z, array as zt };