@camstack/addon-post-analysis 1.2.32 → 1.2.34

package/dist/pipeline-analytics/index.mjs

@@ -1,8 +1,211 @@
-import { $ as EventCategory, A as notificationRulesCapability, B as createEvent, C as cosineSimilarity, D as faceGalleryCapability, F as videoclipsCapability, G as array, H as isDeviceScopedCap, I as zoneAnalyticsCapability, J as number, K as boolean, L as errMsg, M as plateGalleryCapability, N as readDeviceStateFrom, P as subKindsOf, Q as unknown, R as BaseAddon, S as buildEventKindDescriptor, T as defineCustomActions, U as nodePin, V as hydrateSchema, W as _enum, X as record, Y as object, Z as string, _ as TimelapseRuleInputSchema, a as MACRO_LABELS, b as alarmPanelCapability, c as NcConditionDescriptorSchema, d as NcRuleSchema, f as NcSnoozeInputSchema, g as OpsLogEntrySchema, h as NcTaxonomySchema, i as EVENT_PAD_MS, j as pipelineAnalyticsCapability, k as kebabToCamel, l as NcRuleInputSchema, m as NcSnoozeSuppressedSchema, n as DEFAULT_EVENT_COLOR, o as NC_CONDITION_CATALOG, p as NcSnoozeSchema, q as literal, r as EVENT_KIND_BY_CAP, s as NC_TAXONOMY, t as BaseDevice, u as NcRulePatchSchema, v as TimelapseRuleSchema, w as customAction, x as audioMetricsCapability, y as addonWidgetsSourceCapability, z as DeviceType } from "../dist-iVD5TYly.mjs";
+import { $ as EventCategory, A as notificationRulesCapability, B as createEvent, C as cosineSimilarity, D as faceGalleryCapability, F as videoclipsCapability, G as array, H as isDeviceScopedCap, I as zoneAnalyticsCapability, J as number, K as boolean, L as errMsg, M as plateGalleryCapability, N as readDeviceStateFrom, P as subKindsOf, Q as unknown, R as BaseAddon, S as buildEventKindDescriptor, T as defineCustomActions, U as nodePin, V as hydrateSchema, W as _enum, X as record, Y as object, Z as string, _ as TimelapseRuleInputSchema, a as MACRO_LABELS, b as alarmPanelCapability, c as NcConditionDescriptorSchema, d as NcRuleSchema, f as NcSnoozeInputSchema, g as OpsLogEntrySchema, h as NcTaxonomySchema, i as EVENT_PAD_MS, j as pipelineAnalyticsCapability, k as kebabToCamel, l as NcRuleInputSchema, m as NcSnoozeSuppressedSchema, n as DEFAULT_EVENT_COLOR, o as NC_CONDITION_CATALOG, p as NcSnoozeSchema, q as literal, r as EVENT_KIND_BY_CAP, s as NC_TAXONOMY, t as BaseDevice, u as NcRulePatchSchema, v as TimelapseRuleSchema, w as customAction, x as audioMetricsCapability, y as addonWidgetsSourceCapability, z as DeviceType } from "../dist-Bjhp9nkX.mjs";
 import { promises } from "node:fs";
 import path from "node:path";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import sharp from "sharp";
+//#region src/notification-center/action-token.ts
+/**
+* The authority behind a notification button.
+*
+* **Read this before changing anything here.** A button's URL travels through
+* third-party infrastructure — ntfy's server, a push relay, whatever forwarded
+* the message — and is therefore exactly as public as the notification is. The
+* operator decided (2026-08-05) that the token ALONE authorises the action:
+* there is no session check, and a tap does not identify who tapped. Whoever
+* holds the link can run that one action. [D47](../../../../docs/decisions/adr-0047.md).
+*
+* Everything in this file exists to bound that blast radius, since the
+* authorisation model does not:
+*
+*  - **One token, one action, one notification.** The record carries the rule,
+*    the sequence and the device, so a token cannot be re-pointed at anything
+*    else. There is no "run arbitrary sequence" shape to abuse.
+*  - **Single use, claimed ATOMICALLY.** `claim()` is the only way to read a
+*    record and it marks it spent in the same synchronous step, so two taps
+*    arriving together cannot both open a gate. This is why the registry is a
+*    plain in-process Map and not the settings store: a read-then-write across
+*    an async store is a race that a physical actuator would pay for.
+*  - **Short-lived, and the expiry is a COMPARISON, not a sweeper.** A reaper
+*    that failed would leave tokens live indefinitely — the same reasoning the
+*    snooze policy is built on. The sweep here only reclaims memory.
+*  - **In-memory is deliberate.** Tokens do not survive a hub restart, so a
+*    link can never outlive the process that minted it. The cost is real and
+*    accepted: a deploy kills the buttons on notifications already delivered,
+*    which with a short TTL were nearly dead anyway.
+*/
+/** Sign `(id, exp)` — the exact string the verifier recomputes. Same shape as
+*  the artifact plane's, deliberately: one signing convention in this addon. */
+function signActionToken(secret, id, expMs) {
+	return createHmac("sha256", secret).update(`act:${id}:${expMs}`).digest("hex");
+}
+/**
+* Verify a callback's `(id, exp, sig)`.
+*
+* Constant-time on the signature so a public route cannot be probed for it byte
+* by byte, and expiry-checked BEFORE the compare so an expired link is refused
+* even when its signature is perfect.
+*/
+function verifyActionSignature(input) {
+	if (!Number.isFinite(input.exp) || input.exp <= input.nowMs) return false;
+	const expected = signActionToken(input.secret, input.id, input.exp);
+	const a = Buffer.from(expected, "utf8");
+	const b = Buffer.from(input.sig, "utf8");
+	if (a.length !== b.length) return false;
+	return timingSafeEqual(a, b);
+}
+/** Build the fully-qualified, signed callback URL for one button. */
+function buildActionUrl(input) {
+	const sig = signActionToken(input.secret, input.id, input.expMs);
+	return `${input.baseUrl.endsWith("/") ? input.baseUrl.slice(0, -1) : input.baseUrl}${input.routePrefix.startsWith("/") ? input.routePrefix : `/${input.routePrefix}`}/${encodeURIComponent(input.id)}?exp=${input.expMs}&sig=${sig}`;
+}
+/**
+* How long a button stays live.
+*
+* Fifteen minutes, not the artifact plane's 24 h. An image link is a read; this
+* one moves something physical, and the window is the only thing limiting who
+* can use a forwarded notification. An operator who wakes hours later opens the
+* app — the button was never the path for that.
+*/
+var DEFAULT_ACTION_TTL_MS = 15 * 6e4;
+var NcActionTokenRegistry = class {
+	grants = /* @__PURE__ */ new Map();
+	now;
+	constructor(now) {
+		this.now = now ?? (() => Date.now());
+	}
+	/** Register a freshly minted grant. The caller owns id generation (it needs
+	*  the id to build the URL before the record exists). */
+	put(grant) {
+		this.grants.set(grant.id, {
+			grant,
+			used: false
+		});
+	}
+	/**
+	* Take the grant, once.
+	*
+	* Synchronous and mutating in one step ON PURPOSE — see the header. Anything
+	* that awaited between the read and the mark would let two taps through, and
+	* the thing on the other end is a lock or a gate.
+	*/
+	claim(id) {
+		const found = this.grants.get(id);
+		if (found === void 0) return {
+			ok: false,
+			reason: "unknown"
+		};
+		if (found.used) return {
+			ok: false,
+			reason: "already-used"
+		};
+		if (found.grant.expiresAt <= this.now()) return {
+			ok: false,
+			reason: "expired"
+		};
+		found.used = true;
+		return {
+			ok: true,
+			grant: found.grant
+		};
+	}
+	/** Drop records that can no longer be claimed. Memory hygiene only — an
+	*  expired record is already refused by {@link claim}, so a sweep that never
+	*  ran would cost bytes, never safety. */
+	sweep() {
+		const now = this.now();
+		let removed = 0;
+		for (const [id, entry] of this.grants) if (entry.used || entry.grant.expiresAt <= now) {
+			this.grants.delete(id);
+			removed += 1;
+		}
+		return removed;
+	}
+	/** Live (unclaimed, unexpired) token count — for the log line that tells an
+	*  operator whether buttons are actually being minted. */
+	get liveCount() {
+		const now = this.now();
+		let n = 0;
+		for (const entry of this.grants.values()) if (!entry.used && entry.grant.expiresAt > now) n += 1;
+		return n;
+	}
+};
+//#endregion
+//#region src/notification-center/action-plane.ts
+/** What the human standing in front of the page is told. */
+var FAILURE_COPY = {
+	unknown: "This button is no longer available.",
+	expired: "This button has expired. Open CamStack to do it there.",
+	"already-used": "Already done — this button had been used."
+};
+function page(title, detail) {
+	return `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title><style>body{font:16px/1.5 system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#111;color:#eee}main{max-width:24rem;padding:2rem;text-align:center}h1{font-size:1.25rem;margin:0 0 .5rem}p{margin:0;color:#aaa}</style><main><h1>${title}</h1><p>${detail}</p></main>`;
+}
+var NcActionPlane = class {
+	deps;
+	now;
+	constructor(deps) {
+		this.deps = deps;
+		this.now = deps.now ?? (() => Date.now());
+	}
+	handler = async (req, res) => {
+		const url = new URL(req.url ?? "/", "http://placeholder");
+		const id = decodeURIComponent(url.pathname.split("/").filter(Boolean).pop() ?? "");
+		if (!verifyActionSignature({
+			secret: this.deps.secret,
+			id,
+			exp: Number(url.searchParams.get("exp")),
+			sig: url.searchParams.get("sig") ?? "",
+			nowMs: this.now()
+		})) {
+			this.deps.logger.warn("nc action callback refused — bad or expired signature", { meta: { id } });
+			this.send(res, 404, page("Not found", "This link is not valid."));
+			return;
+		}
+		const claim = this.deps.registry.claim(id);
+		if (!claim.ok) {
+			this.deps.logger.info("nc action callback not claimable", { meta: {
+				id,
+				reason: claim.reason
+			} });
+			this.send(res, 200, page("Nothing to do", FAILURE_COPY[claim.reason]));
+			return;
+		}
+		const grant = claim.grant;
+		try {
+			await this.deps.run(grant);
+			this.deps.logger.info("nc action ran from a notification button", {
+				tags: { deviceId: grant.deviceId },
+				meta: {
+					ruleId: grant.ruleId,
+					rule: grant.ruleName,
+					sequence: grant.sequence,
+					action: grant.actionId,
+					targetId: grant.targetId ?? null
+				}
+			});
+			this.send(res, 200, page("Done", `${grant.ruleName} — ${grant.sequence}`));
+		} catch (err) {
+			this.deps.logger.warn("nc action failed after the token was spent", {
+				tags: { deviceId: grant.deviceId },
+				meta: {
+					ruleId: grant.ruleId,
+					sequence: grant.sequence,
+					action: grant.actionId,
+					error: String(err)
+				}
+			});
+			this.send(res, 200, page("It did not work", "The action failed and this button is now spent. Open CamStack."));
+		}
+	};
+	send(res, status, html) {
+		res.writeHead(status, {
+			"content-type": "text/html; charset=utf-8",
+			"cache-control": "no-store"
+		});
+		res.end(html);
+	}
+};
+//#endregion
 //#region src/notification-center/artifact-url.ts
 /**
 * Signed, externally-reachable URLs for notification artifacts.
@@ -5467,7 +5670,7 @@ var NcDispatcher = class {
 				return { ok: true };
 			}
 		}
-		const notification = await this.buildNotification(entry);
+		const notification = await this.buildNotification(entry, target);
 		try {
 			const result = await this.deps.send({
 				addonId: target.addonId,
@@ -5597,7 +5800,37 @@ var NcDispatcher = class {
 		if (this.now() - this.targetCacheAt > this.targetCacheTtlMs) return null;
 		return this.targetCache.get(targetId) ?? null;
 	}
-	async buildNotification(entry) {
+	/**
+	* This delivery's buttons, or none.
+	*
+	* Never throws. A notification that arrives without its buttons is a
+	* degraded notification; one that does not arrive because the token registry
+	* hiccupped is a missed event. The failure is logged rather than swallowed —
+	* a button the operator authored and never saw is exactly the silence this
+	* repo keeps paying for.
+	*/
+	async mintActions(entry, target) {
+		if (this.deps.buildActions === void 0) return [];
+		try {
+			return await this.deps.buildActions({
+				ruleId: entry.ruleId,
+				ruleName: entry.payload.ruleName,
+				deviceId: entry.deviceId,
+				targetId: target.id
+			});
+		} catch (err) {
+			this.deps.logger.warn("notification buttons could not be minted — sending without them", {
+				tags: { deviceId: entry.deviceId },
+				meta: {
+					ruleId: entry.ruleId,
+					targetId: target.id,
+					error: String(err)
+				}
+			});
+			return [];
+		}
+	}
+	async buildNotification(entry, target) {
 		const subject = entry.payload.subject;
 		const deviceName = await this.deps.getDeviceName(subject.deviceId).catch(() => null) ?? `camera ${subject.deviceId}`;
 		const zoneLabels = await resolveZoneLabels(this.deps.getZoneNames, subject.deviceId, subject.zones);
@@ -5606,6 +5839,7 @@ var NcDispatcher = class {
 		const body = renderTemplate(entry.payload.template?.body, vars) ?? defaultBody(entry, deviceName, zoneLabels);
 		const attachments = await this.withArtifactUrls(await this.resolveAttachments(entry));
 		const params = pickParams(entry.payload.params);
+		const actions = await this.mintActions(entry, target);
 		return {
 			body,
 			title,
@@ -5614,7 +5848,8 @@ var NcDispatcher = class {
 			tag: entry.ruleId,
 			deviceId: subject.deviceId,
 			...subject.eventId !== void 0 ? { eventId: subject.eventId } : {},
-			...attachments.length > 0 ? { attachments } : {}
+			...attachments.length > 0 ? { attachments } : {},
+			...actions.length > 0 ? { actions } : {}
 		};
 	}
 	/**
@@ -6732,6 +6967,60 @@ function rowToEntry$1(id, data) {
 	};
 }
 //#endregion
+//#region src/notification-center/action-buttons.ts
+/** Sequence names the rule actually declares. A button may only name one. */
+function declaredSequences(actions) {
+	const names = /* @__PURE__ */ new Set();
+	for (const sequence of actions.onTrigger ?? []) names.add(sequence.name);
+	return names;
+}
+/**
+* Build the notification's buttons.
+*
+* Returns an empty array rather than `undefined` — the caller decides whether
+* to set the field, and an empty array is the honest answer to "which buttons
+* survived", which `undefined` would conflate with "the rule declared none".
+*/
+function buildActionButtons(input) {
+	const actions = input.actions;
+	if (actions === void 0) return [];
+	const buttons = actions.buttons ?? [];
+	if (buttons.length === 0) return [];
+	const known = declaredSequences(actions);
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const button of buttons) {
+		if (!known.has(button.sequence)) continue;
+		if (seen.has(button.id)) continue;
+		seen.add(button.id);
+		out.push({
+			id: button.id,
+			label: button.label,
+			url: input.mintUrl({
+				sequence: button.sequence,
+				actionId: button.id
+			}),
+			...button.icon !== void 0 ? { icon: button.icon } : {},
+			...button.destructive !== void 0 ? { destructive: button.destructive } : {}
+		});
+	}
+	return out;
+}
+/**
+* Which of a rule's buttons name a sequence it does not have.
+*
+* Exported so the caller can LOG the drop. A button silently missing from a
+* notification is the exact shape of failure this repo keeps paying for — the
+* operator authored it, it never appeared, and nothing said why.
+*/
+function unresolvableButtons(actions) {
+	if (actions === void 0) return [];
+	const buttons = actions.buttons ?? [];
+	if (buttons.length === 0) return [];
+	const known = declaredSequences(actions);
+	return buttons.filter((b) => !known.has(b.sequence)).map((b) => `${b.id}→${b.sequence}`);
+}
+//#endregion
 //#region src/notification-center/rule-actions.ts
 var NcRuleActionRunner = class {
 	deps;
@@ -7810,6 +8099,31 @@ var TimelapseStore = class {
 //#endregion
 //#region src/notification-center/index.ts
 /**
+* NotificationCenter — the P1 core of the Notification Center (spec
+* `2026-07-22-notification-center-requirements.md`, decisions D-1/D-2/D-3).
+*
+* A deps-injected, extractable module (TrackCloser pattern) hosted by
+* pipeline-analytics. It couples rule evaluation to the DURABLE persist
+* moments (D-2), never to the telemetry bus:
+*
+*   object-event insert ─▶ onObjectEventPersisted ─▶ immediate rules
+*   TrackCloser.closeExpired ─▶ onTrackClosed ─▶ track-end rules
+*        │ match + throttle
+*        ▼
+*   NcOutbox (durable rows, unique key rule:track:target)
+*        │ drain loop (backoff / dead-letter)
+*        ▼
+*   NcDispatcher ─▶ ctx.api notification-output.send (RPC, hub-routed)
+*
+* Crash gap: on start (evaluation mode) the module scans object events
+* newer than the persisted watermark and re-evaluates them — idempotent
+* through the outbox dedup key (D8: reconcile, never trust an event).
+*
+* Multi-node: rules live in the centralized settings-store; only the
+* designated post-processing node runs evaluation + the drain loop, so a
+* CRUD served elsewhere becomes effective within one rule-reload tick.
+*/
+/**
 * How often the "matched NO rule" report may fire per device. Long enough that
 * a busy camera prints one line rather than one per event, short enough that a
 * rule which has stopped matching is visible within minutes rather than by
@@ -7929,6 +8243,9 @@ var NotificationCenter = class NotificationCenter {
 	deviceStates;
 	/** Runs a matched rule's action sequences. Null when no actuator is wired. */
 	actionRunner;
+	/** Grants behind the tap-through buttons. In-process and single-use — read
+	*  `action-token.ts` before assuming anything about what a tap proves. */
+	actionTokens = new NcActionTokenRegistry();
 	/** True when ≥1 enabled `device-event` rule declares an occupancy condition —
 	*  the watcher is idle (zero per-frame cost) otherwise. */
 	occupancyEnabled = false;
@@ -7949,6 +8266,109 @@ var NotificationCenter = class NotificationCenter {
 	reloadTimer = null;
 	drainTicks = 0;
 	evaluationActive = false;
+	/**
+	* The tap-through buttons for ONE delivery, each with its own single-use
+	* token.
+	*
+	* Per delivery, not per notification: the first tap spends the token, so two
+	* recipients sharing one would mean the second person's button was already
+	* dead when it arrived.
+	*
+	* Returns `[]` for every ordinary reason — the rule declares no buttons, no
+	* actuator is wired, no reachable URL exists. A button is an enhancement; not
+	* being able to mint one must never cost the notification.
+	*/
+	async mintButtons(input) {
+		const mint = this.deps.mintActionUrl;
+		if (mint === void 0 || this.actionRunner === null) return [];
+		const rule = this.rules.get(input.ruleId);
+		if (rule === null) return [];
+		if ((rule.actions?.buttons ?? []).length === 0) return [];
+		const expMs = this.now() + DEFAULT_ACTION_TTL_MS;
+		const pending = [];
+		const out = buildActionButtons({
+			actions: rule.actions,
+			mintUrl: ({ sequence, actionId }) => {
+				const id = randomUUID();
+				pending.push({
+					id,
+					url: "",
+					sequence,
+					actionId
+				});
+				return id;
+			}
+		});
+		if (out.length === 0) return [];
+		const resolved = [];
+		for (const [index, action] of out.entries()) {
+			const slot = pending[index];
+			if (slot === void 0) continue;
+			const url = await mint({
+				id: slot.id,
+				expMs
+			});
+			if (url === null) {
+				this.logger.debug("no reachable base URL — notification buttons omitted", {
+					tags: { deviceId: input.deviceId },
+					meta: { ruleId: input.ruleId }
+				});
+				return [];
+			}
+			this.actionTokens.put({
+				id: slot.id,
+				ruleId: input.ruleId,
+				ruleName: input.ruleName,
+				sequence: slot.sequence,
+				deviceId: input.deviceId,
+				actionId: slot.actionId,
+				targetId: input.targetId,
+				expiresAt: expMs
+			});
+			resolved.push({
+				...action,
+				url
+			});
+		}
+		return resolved;
+	}
+	/** The registry the action plane claims against. */
+	get actionTokenRegistry() {
+		return this.actionTokens;
+	}
+	/**
+	* Run the sequence a spent token granted.
+	*
+	* **The grant overrides `enabled`, deliberately.** A sequence reachable only
+	* by a button is written as `enabled: false` — that is how "do not run this
+	* automatically" is expressed — and the runner skips a disabled sequence. For
+	* a granted run the BUTTON is the enablement, and the operator tapping it is
+	* a more explicit instruction than the flag it overrides. The per-sequence
+	* throttle still applies: `minDelaySec` is about how often a gate may
+	* physically move, and a tap does not change that.
+	*
+	* Throws when the sequence is gone or a step failed — the plane turns that
+	* into the page that says so.
+	*/
+	async runGrantedAction(grant) {
+		if (this.actionRunner === null) throw new Error("no actuator is wired on this node");
+		const rule = this.rules.get(grant.ruleId);
+		if (rule === null) throw new Error(`rule ${grant.ruleId} no longer exists`);
+		const sequence = (rule.actions?.onTrigger ?? []).find((s) => s.name === grant.sequence);
+		if (sequence === void 0) throw new Error(`sequence "${grant.sequence}" no longer exists on rule ${rule.name}`);
+		const [outcome] = await this.actionRunner.run({
+			ruleId: rule.id,
+			ruleName: rule.name,
+			deviceId: grant.deviceId,
+			sequences: [{
+				...sequence,
+				enabled: true
+			}]
+		});
+		if (outcome === void 0) throw new Error("the sequence did not run");
+		if (outcome.failedAt !== void 0) throw new Error(`step ${String(outcome.failedAt)} of "${sequence.name}" failed`);
+		if (!outcome.ran) throw new Error(`"${sequence.name}" did not run (${outcome.skippedReason ?? "unknown"})`);
+	}
 	constructor(deps) {
 		this.deps = deps;
 		this.logger = deps.logger;
@@ -8349,6 +8769,15 @@ var NotificationCenter = class NotificationCenter {
 				deviceId: subject.deviceId,
 				sequences
 			});
+			const unresolvable = unresolvableButtons(rule.actions);
+			if (unresolvable.length > 0) this.logger.warn("rule buttons reference sequences that do not exist — not sent", {
+				tags: { deviceId: subject.deviceId },
+				meta: {
+					ruleId: rule.id,
+					rule: rule.name,
+					buttons: unresolvable.join(", ")
+				}
+			});
 			const userTargets = await this.resolveUserTargets(rule, subject.deviceId);
 			if (await this.outbox.enqueue(this.buildEntries(rule, subject, kind, evaluation.matchedOn, userTargets)) > 0) this.lastFiredAt.set(key, now);
 			anyMatched = true;
@@ -12154,6 +12583,43 @@ var MediaStore = class {
 		return files;
 	}
 	/**
+	* The same rows as {@link listByOwner}, WITHOUT reading a single blob.
+	*
+	* This is not `listByOwner` with a field dropped — that would still read
+	* every blob off disk and base64-encode it before discarding it. Measured on
+	* a 140 s track: 23 files, 7.67 MB read and ~10 MB of string allocated, to
+	* answer a question the index rows already contain.
+	*
+	* `kind`, `sizeBytes` and `timestamp` all live on the index row. Nothing is
+	* persisted at track close to make this cheap, deliberately: media is written
+	* throughout a track's life AND after it (late enrichment adds face/plate
+	* crops), and retention deletes it later — a manifest frozen at close would
+	* advertise tiles that 404 and hide ones that exist.
+	*/
+	async listInfoByOwner(ownerKind, ownerId) {
+		return (await this.store.query.query({
+			collection: MEDIA_COLLECTION,
+			filter: {
+				where: {
+					ownerKind,
+					ownerId
+				},
+				orderBy: {
+					field: "timestamp",
+					direction: "asc"
+				}
+			}
+		})).map((row) => {
+			const data = row.data;
+			return {
+				key: row.id,
+				kind: String(data["kind"]),
+				sizeBytes: Number(data["sizeBytes"]),
+				timestamp: Number(data["timestamp"])
+			};
+		});
+	}
+	/**
 	* Delete all media (blobs + index rows) for the given owners of one kind.
 	* Best-effort per row; returns the number of index rows removed.
 	*/
@@ -16814,6 +17280,18 @@ var AnalyticsQueryFacade = class {
 		const kinds = input.kinds;
 		return kinds && kinds.length > 0 ? all.filter((m) => kinds.includes(m.kind)) : all;
 	}
+	/**
+	* A track's media WITHOUT the bytes.
+	*
+	* Reads the INDEX ROWS only — it never touches a blob. Stripping `base64`
+	* off `getTrackMedia` would have been the obvious shape and the wrong one:
+	* that path reads every blob off disk and base64-encodes it first, so the
+	* response would shrink while the work did not. Measured: 7.67 MB read and
+	* ~10 MB of string allocated, to answer a question the index already holds.
+	*/
+	async listTrackMedia(input) {
+		return this.deps.mediaStore()?.listInfoByOwner("track", input.trackId) ?? Promise.resolve([]);
+	}
 	async pruneEventsBefore(input) {
 		const eventStore = this.deps.eventStore();
 		if (!eventStore) return {
@@ -21997,6 +22475,95 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		}
 	}
 	/**
+	* The ranked base-URL candidates a notification LINK may use.
+	*
+	* Shared by the artifact plane (media) and the action plane (buttons) — one
+	* resolver, because a second copy would drift and the two would start
+	* minting links on different hosts for the same notification.
+	*/
+	async ncEndpoints() {
+		return collectArtifactEndpoints({
+			markedBaseUrl: await this.markedNotificationEndpoint(),
+			configuredPublicUrl: process.env["CAMSTACK_HUB_PUBLIC_URL"],
+			getConnected: async () => {
+				const status = await this.ctx.api.networkAccess.getStatus.query();
+				this.ctx.logger.debug("artifact base-url: connected ingress", { meta: {
+					connected: status.connected,
+					url: status.endpoint?.url ?? null,
+					protocol: status.endpoint?.protocol ?? null
+				} });
+				return status.connected && status.endpoint !== null ? {
+					url: status.endpoint.url,
+					protocol: status.endpoint.protocol
+				} : null;
+			},
+			listExternal: async () => {
+				return (await this.ctx.api.networkAccess.listEndpoints.query()).map((e) => ({
+					url: e.url,
+					protocol: e.protocol
+				}));
+			},
+			listLan: async (port) => {
+				return (await this.ctx.api.localNetwork.getConnectionEndpoints.query({ port })).endpoints.map((e) => ({
+					baseUrl: e.baseUrl,
+					kind: e.kind,
+					priority: e.priority
+				}));
+			},
+			logger: this.ctx.logger
+		});
+	}
+	/**
+	* Serve the NC ACTION plane: the public route a notification button lands on.
+	*
+	* A sibling of the artifact plane and a strictly more dangerous one — that
+	* route serves bytes, this one MOVES something. Its authority is the token in
+	* the link and nothing else, which is the operator's explicit choice; the
+	* bounds are in `notification-center/action-token.ts` and D47.
+	*
+	* Best-effort like every plane here: no facility ⇒ no route, and the
+	* dispatcher simply mints no buttons, because `mintActionUrl` returns null.
+	*/
+	async serveNcActionPlane(center) {
+		try {
+			const secretState = this.state("ncActionSecret", NcArtifactSecretSchema, "");
+			let secret = await secretState.get();
+			if (secret === "") {
+				secret = randomUUID().replace(/-/g, "");
+				await secretState.set(secret);
+			}
+			const routePrefix = `/addon/${this.ctx.id}/nc-action`;
+			const plane = new NcActionPlane({
+				registry: center.actionTokenRegistry,
+				secret,
+				logger: this.ctx.logger.child("nc-actions"),
+				run: (grant) => center.runGrantedAction(grant)
+			});
+			const served = await this.ctx.dataPlane?.serve({
+				prefix: "nc-action",
+				access: "public",
+				handler: plane.handler
+			}) ?? null;
+			this.ncActionMintUrl = served === null ? null : async ({ id, expMs }) => {
+				const baseUrl = pickArtifactBaseUrl(await this.ncEndpoints());
+				if (baseUrl === null) return null;
+				return buildActionUrl({
+					baseUrl,
+					routePrefix,
+					id,
+					secret,
+					expMs
+				});
+			};
+			this.ctx.logger.info("nc-action data-plane served", { meta: { served: served !== null } });
+		} catch (err) {
+			this.ctx.logger.warn("nc-action data-plane failed to serve", { meta: { error: errMsg(err) } });
+		}
+	}
+	/** Mints a button's callback URL once the action plane is served; null until
+	*  then, and null forever on an install with no reachable public address. */
+	ncActionMintUrl = null;
+	/**
 	* Serve the NC artifact plane: a PUBLIC route whose authority is the HMAC on
 	* each link (see `notification-center/artifact-url.ts`). It exists because
 	* attachments used to carry BYTES only, and the degrade engine drops a
@@ -22024,36 +22591,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				secret,
 				logger: this.ctx.logger.child("nc-artifacts"),
 				routePrefix: `/addon/${this.ctx.id}/nc-artifact`,
-				listEndpoints: async () => collectArtifactEndpoints({
-					markedBaseUrl: await this.markedNotificationEndpoint(),
-					configuredPublicUrl: process.env["CAMSTACK_HUB_PUBLIC_URL"],
-					getConnected: async () => {
-						const status = await this.ctx.api.networkAccess.getStatus.query();
-						this.ctx.logger.debug("artifact base-url: connected ingress", { meta: {
-							connected: status.connected,
-							url: status.endpoint?.url ?? null,
-							protocol: status.endpoint?.protocol ?? null
-						} });
-						return status.connected && status.endpoint !== null ? {
-							url: status.endpoint.url,
-							protocol: status.endpoint.protocol
-						} : null;
-					},
-					listExternal: async () => {
-						return (await this.ctx.api.networkAccess.listEndpoints.query()).map((e) => ({
-							url: e.url,
-							protocol: e.protocol
-						}));
-					},
-					listLan: async (port) => {
-						return (await this.ctx.api.localNetwork.getConnectionEndpoints.query({ port })).endpoints.map((e) => ({
-							baseUrl: e.baseUrl,
-							kind: e.kind,
-							priority: e.priority
-						}));
-					},
-					logger: this.ctx.logger
-				})
+				listEndpoints: () => this.ncEndpoints()
 			});
 			this.ncArtifactDataPlane = await this.ctx.dataPlane?.serve({
 				prefix: "nc-artifact",
@@ -22821,6 +23359,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				});
 			},
 			isCapDeviceScoped: isDeviceScopedCap,
+			mintActionUrl: (input) => this.ncActionMintUrl?.(input) ?? Promise.resolve(null),
 			readDeviceStates: async (ids) => {
 				const out = /* @__PURE__ */ new Map();
 				for (const id of ids) try {
@@ -22882,18 +23421,20 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 					});
 				},
 				send: async (input) => {
-					const { attachments, ...notification } = input.notification;
+					const { attachments, actions, ...notification } = input.notification;
 					return api.notificationOutput.send.mutate({
 						addonId: input.addonId,
 						targetId: input.targetId,
 						notification: {
 							...notification,
-							...attachments !== void 0 ? { attachments: [...attachments] } : {}
+							...attachments !== void 0 ? { attachments: [...attachments] } : {},
+							...actions !== void 0 ? { actions: [...actions] } : {}
 						}
 					});
 				},
 				getMediaForOwner: (ownerKind, ownerId) => stores.mediaStore.listByOwner(ownerKind, ownerId),
-				getDeviceName
+				getDeviceName,
+				buildActions: (input) => this.notificationCenter?.mintButtons(input) ?? Promise.resolve([])
 			},
 			listObjectEventsSince: (since, limit) => stores.eventStore.queryObjectSince({
 				since,
@@ -22909,6 +23450,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				})).tracks;
 			}
 		});
+		await this.serveNcActionPlane(this.notificationCenter);
 		await this.notificationCenter.start({ evaluation: this.isPostProcessingNode });
 	}
 	/** Event-media data-plane: serve thumbnail JPEGs at
@@ -25437,6 +25979,10 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	async getTrackMedia(input) {
 		return this.queryFacade.getTrackMedia(input);
 	}
+	/** What media a track HAS, without any of it — the detail view's manifest. */
+	async listTrackMedia(input) {
+		return this.queryFacade.listTrackMedia(input);
+	}
 	/**
 	* Search object events by text using CLIP cosine similarity.
 	*