@camstack/addon-post-analysis 1.2.64 → 1.2.66

package/dist/{dist-BQ-M7jn9.js → dist-DKsqvmSl.js}

@@ -7421,8 +7421,31 @@ var AdoptionJobSchema = object({
 	error: string().nullable()
 });
 /**
-* Per-camera FUNCTION SWITCHES — the one coherent on/off surface over the
-* pipeline functions an operator thinks in terms of.
+* Per-camera FUNCTION SWITCHES.
+*
+* ## The aggregate group is being withdrawn — the BADGE is not (D113)
+*
+* This file shipped as "the one coherent on/off surface over the pipeline
+* functions an operator thinks in terms of". The operator's verdict on
+* 2026-08-12 was that the coherent surface bought complexity and no clarity:
+* every function already had a settings page of its own, and a second place to
+* turn it off is a second place to look. Each switch is going back to its own
+* component's original options — detection to the detection-pipeline wrapper
+* binding, audio analysis to its own, recording to `RecordingConfig.enabled`
+* (which was always first-class; the switch was a veneer over
+* `recording.setDeviceConfig`), notifications to a notification-center
+* per-device setting, the two camera planes to their own components.
+*
+* What survives is {@link composeSwitchedOff}: `CameraStatus.switchedOff`, the
+* thing that lets a status surface say DISABLED instead of BROKEN, recomposed
+* straight from the authorities with no group in the middle. That rule was
+* never about a control panel.
+*
+* Everything else here — {@link CAMERA_SWITCH_CATALOG}, {@link CameraSwitch},
+* {@link deriveCameraSwitches}, the `pipelineOrchestrator.getCameraSwitches` /
+* `setCameraSwitch` pair — is a COMPATIBILITY surface for as long as deployed
+* viewers (v1.0.305) and the admin UI still call it. It is deleted when they
+* stop; nothing new may be built on it.
 *
 * ## This file adds no state
 *
@@ -7784,6 +7807,22 @@ var RecordingConfigSchema = object({
 	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
 }).strict();
 /**
+* Derive the {@link RecordingStorageModeSchema} summary from the authoritative
+* bands: `continuous` when any band records continuously, `events` when a band
+* exists at all, else `off`. Pure.
+*
+* THE one definition: the recorder stamps `config.mode` with it on save and
+* reports it as the cap's `activeMode`, and the settings UI reads it back to
+* decide which authoring tab a config opens in. Two copies would drift, and the
+* symptom (a status dot disagreeing with what is being recorded) is exactly the
+* bug this field was added to fix.
+*/
+function deriveRecordingMode(config) {
+	if (!config.enabled || config.bands.length === 0) return "off";
+	if (config.bands.some((band) => band.mode === "continuous")) return "continuous";
+	return "events";
+}
+/**
 * Entity-relocation job state (storage entity-routing spec, Phase 4).
 *
 * One shape shared by the recorder and pipeline-analytics internal movers.
@@ -7962,6 +8001,21 @@ var StorageLocationSchema = object({
 	nodeId: string().optional(),
 	isDefault: boolean().default(false),
 	isSystem: boolean().default(false),
+	/**
+	* Operator opt-in: whether consumers that BALANCE across several locations
+	* of a type may write here. Recordings reads it today; event media and
+	* backups are the next consumers, which is why the flag lives on the
+	* location rather than in any one addon's store — nothing has to be
+	* extended to add the next consumer.
+	*
+	* OPTIONAL, and ABSENT MEANS ACTIVE. Every location persisted before the
+	* flag existed reads back with no flag and keeps working exactly as before;
+	* that is the whole compat story, and it is why no migration ships with it.
+	* A newly CREATED sibling is stamped `false` by the orchestrator (creating a
+	* disk must not silently start writing to it); the default of a type is
+	* always stamped `true`.
+	*/
+	enabled: boolean().optional(),
 	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
 	*  for node-local locations it can reach) — never persisted, absent when the
 	*  volume is remote/unreachable. The single capacity truth every UI reads. */
@@ -12501,7 +12555,8 @@ var embeddingEncoderCapability = {
 };
 /**
 * filesystem-browse — per-node capability for browsing the node's local
-* filesystem, sandboxed to operator-configured allowed roots. Used by the
+* filesystem. Reads are unconfined (whole filesystem, from `/` down); WRITES
+* are sandboxed to operator-configured allowed roots (D115). Used by the
 * admin "Add filesystem location" flow to pick a node + path. `mode:'per-node'`
 * (one provider per node); the hub calls it with `{nodeId}` so the codegen
 * routes to that exact node (default `nodeIdMode:'routing'`).
@@ -18913,9 +18968,16 @@ var CameraStatusSchema = object({
 	audio: CameraAudioStatusSchema.nullable(),
 	recording: CameraRecordingStatusSchema.nullable(),
 	/**
-	* Per-camera function switches an OPERATOR has turned off
+	* Per-camera functions an OPERATOR has turned off
 	* ([D61](../../../../docs/decisions/adr-0067.md)).
 	*
+	* Composed from the AUTHORITIES themselves — the wrapper bindings,
+	* `RecordingConfig.enabled`, the notification mute, the broker's audio
+	* policy, the camera's own microphone — via `composeSwitchedOff`, not from
+	* the deprecated `getCameraSwitches` group ([D113](../../../../docs/decisions/adr-0113.md)).
+	* The badge outlives the control panel: the panel was a convenience, this is
+	* the difference between a camera being off and a camera being dead.
+	*
 	* This is the difference between DISABLED and BROKEN. A camera whose
 	* `detection` block reports zero fps and whose `switchedOff` contains
 	* `'object-detection'` was switched off by a person; the same camera with an
@@ -25953,7 +26015,7 @@ method(object({
 	auth: "admin"
 });
 /**
-* `recordingExport` cap — render a footage time range into a single downloadable
+* `recording-export` cap — render a footage time range into a single downloadable
 * MP4 (regular / accelerated / decelerated / timelapse, ± audio), kept for a
 * bounded lifetime with a durable history, auto-expiry, and optional
 * delete-after-download.
@@ -25968,10 +26030,42 @@ method(object({
 */
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = number().min(.25).max(32);
+/**
+* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+*
+* Relative and not absolute epoch on purpose: the renderer's frame-select
+* expression sees ffmpeg's `t`, which starts at 0 for the export's source
+* playlist. Handing it absolute epochs would make every call site responsible
+* for the same subtraction, and the one that forgot would emit a filter that
+* selects nothing — silently, as a uniform timelapse.
+*/
+var ExportDenseRangeSchema = object({
+	fromSec: number().nonnegative(),
+	toSec: number().nonnegative()
+}).refine((r) => r.toSec > r.fromSec, { message: "dense range must have toSec > fromSec" });
+/**
+* Dense-interval overlay for a timelapse: sample at `dense.everyMs` INSIDE the
+* listed ranges and at the base `everyMs` everywhere else.
+*
+* `everyMs` must be strictly smaller than the base cadence — a dense rate that
+* is not denser renders a uniform timelapse the operator believes is two-rate.
+*/
+var ExportDenseSchema = object({
+	everyMs: number().int().positive(),
+	ranges: array(ExportDenseRangeSchema).min(1).max(200)
+});
 /** Timelapse cadence — sample one source frame per `everyMs`, output at `outputFps`. */
 var ExportTimelapseSchema = object({
 	everyMs: number().int().positive(),
-	outputFps: number().int().min(1).max(60).optional()
+	outputFps: number().int().min(1).max(60).optional(),
+	/** Optional second, FASTER rate over the intervals that matter. */
+	dense: ExportDenseSchema.optional()
+}).superRefine((v, ctx) => {
+	if (v.dense !== void 0 && v.dense.everyMs >= v.everyMs) ctx.addIssue({
+		code: ZodIssueCode.custom,
+		message: "dense.everyMs must be strictly smaller than the base everyMs",
+		path: ["dense", "everyMs"]
+	});
 });
 /**
 * Render options. `speed` and `timelapse` are mutually exclusive. `includeAudio`
@@ -26029,6 +26123,38 @@ var ExportDownloadSchema = object({
 	url: string(),
 	endpoints: array(string())
 });
+/**
+* Hard ceiling on ONE {@link recordingExportCapability} byte read — 50 MiB.
+*
+* Two independent reasons land on the same number, which is why it is this one
+* and not a rounder guess:
+*
+*  - **Nobody would accept more.** The roomiest byte cap any notifier backend
+*    declares is telegram's 50 MiB, and the degrade engine DROPS an over-cap
+*    attachment outright rather than degrading it to a link. Bytes above this
+*    are read, encoded and moved to be thrown away at the last step.
+*  - **The envelope is unary.** A base64 payload is held whole, ~1.33× its
+*    size, in the provider AND in the caller — on a hub this repo has already
+*    OOM'd once (D9/D18). A bounded on-demand read at human speed is the shape
+*    those records permit; an unbounded one is the shape they forbid.
+*
+* Above it the provider REFUSES with a log line rather than truncating: half a
+* video is worse than a notification that says there is no attachment.
+*/
+var RECORDING_EXPORT_MAX_READ_BYTES = 50 * 1024 * 1024;
+/**
+* A finished export's bytes, inline.
+*
+* `bytes` is the DECODED length — the number the caller bounds and logs
+* against, so nobody has to infer it from the base64 length.
+*/
+var ExportBytesSchema = object({
+	base64: string(),
+	contentType: string(),
+	/** Suggested filename, extension included. */
+	name: string(),
+	bytes: number().int().nonnegative()
+});
 method(object({
 	deviceId: number(),
 	profile: string(),
@@ -26053,6 +26179,9 @@ method(object({
 }), method(object({ exportId: string() }), ExportDownloadSchema, {
 	kind: "query",
 	auth: "protected"
+}), method(object({ exportId: string() }), ExportBytesSchema, {
+	kind: "query",
+	auth: "protected"
 });
 /**
 * scene-monitor — device-scoped reference-region state cap. An operator marks
@@ -28519,9 +28648,10 @@ var DeclaredDevices = class {
 		}
 		const integrationId = spec.integrationId ?? await this.ensureIntegration(spec.integrationName);
 		const index = await this.readIndex();
+		const live = await this.readLiveByStableId();
 		const outcomes = [];
 		for (const declaration of spec.devices) {
-			const outcome = await this.applyDeclaration(declaration, integrationId, index);
+			const outcome = await this.applyDeclaration(declaration, integrationId, index, live);
 			if (outcome !== null) outcomes.push(outcome);
 		}
 		return {
@@ -28567,6 +28697,26 @@ var DeclaredDevices = class {
 		return new Map(rows.map((row) => [row.stableId, row]));
 	}
 	/**
+	* Devices this kernel already has CONSTRUCTED, by stableId.
+	*
+	* Distinct from {@link readIndex}, and the distinction is the bug: the index
+	* is persisted rows, this is live objects. A row without an object must be
+	* adopted; an object must be left exactly as it is.
+	*
+	* Failure is non-fatal and deliberately so — an empty map degrades to the
+	* previous behaviour (attempt the adopt) rather than skipping a device that
+	* genuinely needs bringing up.
+	*/
+	async readLiveByStableId() {
+		try {
+			const devices = await this.ports.devices.getAll();
+			return new Map(devices.map((device) => [device.stableId, device]));
+		} catch (err) {
+			this.ports.logger.warn("could not read live devices — falling back to adopt-by-row", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			return /* @__PURE__ */ new Map();
+		}
+	}
+	/**
 	* One declaration: adopt what exists, create what does not.
 	*
 	* The create branch is the destructive one — it seeds `initialMeta`, and
@@ -28575,8 +28725,15 @@ var DeclaredDevices = class {
 	* the declared name over the operator's rename. D49: that branch needs a
 	* second read to agree.
 	*/
-	async applyDeclaration(declaration, integrationId, index) {
+	async applyDeclaration(declaration, integrationId, index, live) {
 		try {
+			const alreadyLive = live.get(declaration.stableId);
+			if (alreadyLive !== void 0) return {
+				stableId: declaration.stableId,
+				deviceId: alreadyLive.id,
+				device: alreadyLive,
+				created: false
+			};
 			let existing = index.get(declaration.stableId);
 			if (existing === void 0) {
 				existing = (await this.readIndex()).get(declaration.stableId);
@@ -32882,37 +33039,43 @@ Object.freeze({
 		access: "create"
 	},
 	"recordingExport.cancelExport": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
 	"recordingExport.createExport": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
 	"recordingExport.deleteExport": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
 	"recordingExport.getDownloadUrl": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
 	"recordingExport.getExport": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
 	"recordingExport.listExports": {
-		capName: "recordingExport",
+		capName: "recording-export",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"recordingExport.readExportBytes": {
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "view"
@@ -34374,7 +34537,23 @@ var TimelapseRuleInputSchema = object({
 	/** Canonical notification priority ordinal (1..5); per-target overridable. */
 	priority: PriorityField.default(3)
 });
-object({
+/**
+* Partial patch for an update — any subset of the INPUT fields, with NO
+* defaults (an absent key means "leave unchanged", never "reset to default").
+* Provenance and ownership are absent by construction: a patch can rename or
+* retune a rule, never re-own it or forge its generation state.
+*
+* CLEAR SIGNAL: `template` is the one OPTIONAL field an editor can REMOVE, so
+* it is `.nullable()` here and NOWHERE else. Wire representation:
+*  - key absent          → leave the template unchanged
+*  - `"template": null`  → CLEAR it (the persisted rule loses the key)
+*  - `"template": {...}` → replace it
+* `undefined` is deliberately NOT the clear signal: it does not survive
+* `JSON.stringify`, so a viewer editor could not express "remove". The
+* PERSISTED rule never carries `null` — the store drops the key (see
+* `TimelapseStore.update`).
+*/
+var TimelapseRulePatchSchema = object({
 	name: NameField.optional(),
 	enabled: boolean().optional(),
 	deviceIds: DeviceIdsField.optional(),
@@ -34395,15 +34574,50 @@ var TimelapseRuleSchema = TimelapseRuleInputSchema.extend({
 	*/
 	ownerUserId: string().optional(),
 	/**
-	* Epoch-ms of the last successful generation — the 1-hour re-generation
-	* guard's durable state (predecessor parity). Absent = never generated.
+	* Epoch-ms of the NEWEST successful generation across every camera of this
+	* rule. What a UI shows, and the compatibility floor for
+	* {@link readTimelapseGeneratedAt}. Absent = never generated.
 	*/
 	lastGeneratedAt: number().optional(),
+	/**
+	* PER-CAMERA generation state, keyed by `String(deviceId)` — the
+	* re-generation guard's real durable state.
+	*
+	* One rule covers several cameras and each renders its own video, so a rule
+	* -wide stamp is wrong in the direction that DESTROYS work: camera A
+	* succeeding at 06:05 tells camera B, whose render failed, that it is
+	* already done — and B's night is gone for good, because the window will not
+	* come back.
+	*
+	* ADDITIVE, so the migration is free: a row written before this field simply
+	* has no map, and {@link readTimelapseGeneratedAt} falls back to
+	* {@link TimelapseRuleSchema.shape.lastGeneratedAt}. Reading an old row as
+	* "never generated" would re-render and re-notify every camera of every rule
+	* once, on the deploy that shipped the map.
+	*/
+	generatedByDevice: record(string(), number()).optional(),
 	/** userId of the caller who created the rule (server-stamped). */
 	createdBy: string(),
 	createdAt: number(),
 	updatedAt: number()
 });
+/**
+* The last successful generation for ONE camera of a rule, epoch-ms.
+*
+* The per-device map wins; a rule with no map falls back to the rule-wide
+* `lastGeneratedAt` (the compatible-migration path — see
+* {@link TimelapseRuleSchema}); a rule with neither returns 0, which every
+* guard reads as "never generated".
+*
+* Read through this helper and never off the field directly: the fallback is
+* the whole migration, and a call site that forgot it would re-render an
+* entire rule set once.
+*/
+function readTimelapseGeneratedAt(rule, deviceId) {
+	const map = rule.generatedByDevice;
+	if (map !== void 0) return map[String(deviceId)] ?? 0;
+	return rule.lastGeneratedAt ?? 0;
+}
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -34682,6 +34896,12 @@ Object.defineProperty(exports, "OpsLogEntrySchema", {
 		return OpsLogEntrySchema;
 	}
 });
+Object.defineProperty(exports, "RECORDING_EXPORT_MAX_READ_BYTES", {
+	enumerable: true,
+	get: function() {
+		return RECORDING_EXPORT_MAX_READ_BYTES;
+	}
+});
 Object.defineProperty(exports, "RetrainStatusSchema", {
 	enumerable: true,
 	get: function() {
@@ -34694,6 +34914,12 @@ Object.defineProperty(exports, "TimelapseRuleInputSchema", {
 		return TimelapseRuleInputSchema;
 	}
 });
+Object.defineProperty(exports, "TimelapseRulePatchSchema", {
+	enumerable: true,
+	get: function() {
+		return TimelapseRulePatchSchema;
+	}
+});
 Object.defineProperty(exports, "TimelapseRuleSchema", {
 	enumerable: true,
 	get: function() {
@@ -34784,6 +35010,12 @@ Object.defineProperty(exports, "defineCustomActions", {
 		return defineCustomActions;
 	}
 });
+Object.defineProperty(exports, "deriveRecordingMode", {
+	enumerable: true,
+	get: function() {
+		return deriveRecordingMode;
+	}
+});
 Object.defineProperty(exports, "embeddingEncoderCapability", {
 	enumerable: true,
 	get: function() {
@@ -34886,6 +35118,12 @@ Object.defineProperty(exports, "readDeviceStateFrom", {
 		return readDeviceStateFrom;
 	}
 });
+Object.defineProperty(exports, "readTimelapseGeneratedAt", {
+	enumerable: true,
+	get: function() {
+		return readTimelapseGeneratedAt;
+	}
+});
 Object.defineProperty(exports, "record", {
 	enumerable: true,
 	get: function() {