@camstack/addon-provider-hikvision 1.2.141 → 1.2.143

package/dist/addon.js

@@ -10802,6 +10802,57 @@ var ClipSearchStrictnessSchema = _enum([
 	"balanced",
 	"strict"
 ]);
+new Set([
+	{
+		id: "person",
+		name: "Person"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle"
+	},
+	{
+		id: "animal",
+		name: "Animal"
+	},
+	{
+		id: "package",
+		name: "Package"
+	}
+].map((l) => l.id));
+var COCO_TO_MACRO = {
+	mapping: {
+		person: "person",
+		bicycle: "vehicle",
+		car: "vehicle",
+		motorcycle: "vehicle",
+		airplane: "vehicle",
+		bus: "vehicle",
+		train: "vehicle",
+		truck: "vehicle",
+		boat: "vehicle",
+		bird: "animal",
+		cat: "animal",
+		dog: "animal",
+		horse: "animal",
+		sheep: "animal",
+		cow: "animal",
+		elephant: "animal",
+		bear: "animal",
+		zebra: "animal",
+		giraffe: "animal",
+		suitcase: "package",
+		backpack: "package",
+		handbag: "package"
+	},
+	preserveOriginal: false
+};
+/** Steps a root detector may declare it fills. */
+var FILLABLE_STEP_IDS = [
+	"animal-classifier",
+	"vehicle-classifier",
+	"package-detection"
+];
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -10934,6 +10985,12 @@ var ModelLicenseSchema = preprocess((value) => typeof value === "string" ? { wei
 	/** True when the weights or their data forbid commercial use. */
 	nonCommercial: boolean().optional()
 }));
+/** One `fillsClassifierEffects` entry — see `ModelCatalogEntry.fillsClassifierEffects`. */
+var FillsClassifierEffectSchema = object({
+	stepId: _enum(FILLABLE_STEP_IDS),
+	labelToEffect: record(string(), string()),
+	uncovered: array(string()).readonly()
+});
 var ModelCatalogEntrySchema = object({
 	id: string(),
 	name: string(),
@@ -11060,6 +11117,16 @@ var ModelCatalogEntrySchema = object({
 	*/
 	classMap: DetectionCatalogClassMapSchema.optional(),
 	/**
+	* The pipeline steps this ROOT detector already does the work of (D715):
+	* its labels name the effect the step exists to produce (`deer` for
+	* `animal-classifier`, `package` for `package-detection`). Derived from the
+	* labelmap by `deriveClassifierFills`, never hand-written; a COCO model
+	* declares none. Whether a declaration is honoured is the step's own
+	* `labelLink` policy (`resolveLabelLink`). `labelToEffect` values are in
+	* `FILLABLE_STEP_VOCABULARIES` (guard `check-label-link-vocabulary`).
+	*/
+	fillsClassifierEffects: array(FillsClassifierEffectSchema).readonly().optional(),
+	/**
 	* The model's CLIP feature-space contract (text encoder, dimension, vector
 	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
 	* CLIP image encoder; its absence is what "not a CLIP model" means to the
@@ -14532,7 +14599,7 @@ DeviceType.Camera;
 * This matters here more than anywhere else in the repo, because every provider
 * that knows a device's host knows its PASSWORD too: `{ host, port, username,
 * password }` sit in one object on Hikvision, Amcrest, Reolink and ONVIF alike,
-* and `http://admin:hunter2@192.168.x.x/` is a URL a browser accepts. The
+* and `http://admin:hunter2@192.168.60.139/` is a URL a browser accepts. The
 * camera's own page will ask for its own login. That is correct, and pre-
 * filling it is the operator's business, not ours.
 *
@@ -18402,51 +18469,6 @@ method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSche
 	kind: "mutation",
 	auth: "admin"
 });
-new Set([
-	{
-		id: "person",
-		name: "Person"
-	},
-	{
-		id: "vehicle",
-		name: "Vehicle"
-	},
-	{
-		id: "animal",
-		name: "Animal"
-	},
-	{
-		id: "package",
-		name: "Package"
-	}
-].map((l) => l.id));
-var COCO_TO_MACRO = {
-	mapping: {
-		person: "person",
-		bicycle: "vehicle",
-		car: "vehicle",
-		motorcycle: "vehicle",
-		airplane: "vehicle",
-		bus: "vehicle",
-		train: "vehicle",
-		truck: "vehicle",
-		boat: "vehicle",
-		bird: "animal",
-		cat: "animal",
-		dog: "animal",
-		horse: "animal",
-		sheep: "animal",
-		cow: "animal",
-		elephant: "animal",
-		bear: "animal",
-		zebra: "animal",
-		giraffe: "animal",
-		suitcase: "package",
-		backpack: "package",
-		handbag: "package"
-	},
-	preserveOriginal: false
-};
 var AUDIO_MACRO_LABELS = [
 	{
 		id: "speech",
@@ -20340,8 +20362,9 @@ var NcRuleSchema = NcRuleInputSchema.extend({
 	disabledTargetIds: array(string()).default([])
 });
 /**
-* The state-summary SECTIONS (D647 / D698): the D637 kind groups that report a
-* still-true state. `backups-exports` and `alarm` are not sections — a completed
+* The state-summary SECTIONS (D647 / D698 / D708): the D637 kind groups that
+* report a still-true state. `addons` is the crash-looped addons only and
+* `addon-updates` the addons that are behind (D708 split them). `backups-exports` and `alarm` are not sections — a completed
 * job is not an open state, and the alarm stays instant.
 */
 var NcStateSummarySectionIdSchema = _enum([
@@ -20353,6 +20376,7 @@ var NcStateSummarySectionIdSchema = _enum([
 	"detection-blind",
 	"nodes",
 	"addons",
+	"addon-updates",
 	"updates"
 ]);
 /** One section of a previewed state summary. `unavailable` = its state could not be read. */
@@ -20833,7 +20857,19 @@ var NcAlarmModeDelaysListSchema = array(object({
 	* When this mode may be armed. Absent / null = always allowed (same as a
 	* rule with no `schedule`). Evaluated with {@link isScheduleActive}.
 	*/
-	schedule: NcScheduleSchema.optional()
+	schedule: NcScheduleSchema.optional(),
+	/**
+	* D706: while this mode's ENTRY DELAY runs, do the alarm rules' own pushes go out (as an
+	* intrusion naming the locations)? Absent = false — the entry-delay notification is the
+	* only one, and the matches ride the triggered notification's mosaic (D705).
+	*/
+	notifyDuringEntryDelay: boolean().optional(),
+	/**
+	* D706: notify "watched again" when a sensor this arm bypassed closes and opens again.
+	* Absent = false (logged, not sent). Even when true it is not sent when that same sensor
+	* is the one that starts the entry delay — the entry-delay notification already names it.
+	*/
+	notifySensorRewatched: boolean().optional()
 })).max(8).refine(uniqueModes, { message: "modeDelays: at most one entry per arm mode" });
 var NcAlarmModeDelaysEditListSchema = array(object({
 	mode: AlarmArmModeSchema,
@@ -20842,7 +20878,11 @@ var NcAlarmModeDelaysEditListSchema = array(object({
 	triggeredDurationSec: NcAlarmTriggeredSecSchema.nullable().optional(),
 	postTriggeredAction: NcAlarmPostTriggeredActionSchema.nullable().optional(),
 	/** Set a schedule, or `null` to clear (mode always allowed again). */
-	schedule: NcScheduleSchema.nullable().optional()
+	schedule: NcScheduleSchema.nullable().optional(),
+	/** D706: set the switch, or `null` to clear it (back to the default, false). */
+	notifyDuringEntryDelay: boolean().nullable().optional(),
+	/** D706: set the switch, or `null` to clear it (back to the default, false). */
+	notifySensorRewatched: boolean().nullable().optional()
 })).max(8).refine(uniqueModes, { message: "modeDelays: at most one edit per arm mode" });
 /** One switch of the alarm table: put ONE device on, or take it off, ONE mode's list. */
 var NcAlarmNonBlockingEditSchema = object({
@@ -23870,7 +23910,8 @@ var PipelineModelOptionSchema = object({
 	group: ModelVariantGroupSchema.optional(),
 	legacy: boolean().optional(),
 	provider: ModelProviderIdSchema.optional(),
-	defaultConfidence: number().optional()
+	defaultConfidence: number().optional(),
+	fillsClassifierEffects: array(FillsClassifierEffectSchema).readonly().optional()
 });
 var ConfigFieldBridge = custom();
 var PipelineAddonSchemaSchema = object({
@@ -24703,6 +24744,22 @@ var MotionSourceEnum = _enum([
 	"device-activity"
 ]);
 /**
+* What opened an on-motion detection SESSION: the motion source that passed the
+* camera's `motionSources` gate, and what raised it (the camera itself, or a
+* sensor the operator attached — D672). `sensorName` is the attached sensor's
+* device name as the orchestrator's camera-sensors resolution last read it;
+* absent when unknown or when the camera itself triggered.
+*
+* Carried on the session attach ONLY so the runner's `DetectionPhaseTransition`
+* can say what started the session (D672 rule 11, amended 2026-10-06). The
+* runner never decides anything on it.
+*/
+var SessionTriggerSchema = object({
+	source: MotionSourceEnum,
+	triggeredBy: MotionTriggeredBySchema,
+	sensorName: string().optional()
+});
+/**
 * List of motion sources active on a camera. Empty array is valid:
 * "no source" — happens for battery cams without firmware motion when
 * the operator hasn't opted into the SW analyzer (would hold the
@@ -24954,6 +25011,14 @@ var RunnerCameraConfigSchema = object({
 	*/
 	motionSources: MotionSourcesSchema.default(["analyzer"]),
 	/**
+	* What opened this attach, on a SESSION attach only (see
+	* {@link SessionTriggerSchema}). OPTIONAL with no default: absent on a
+	* standing attach, an occupancy burst, a re-dispatch with no motion event
+	* behind it, and every attach from an orchestrator older than the field — the
+	* runner then names no source on the phase event.
+	*/
+	sessionTrigger: SessionTriggerSchema.optional(),
+	/**
 	* WHICH root detector runs for this camera. The detection counterpart of
 	* {@link motionSources}, same shape and same discipline: a per-camera list
 	* of sources the system understands, vendor-agnostic, owned here.
@@ -32864,7 +32929,7 @@ var LocalInterfaceSchema = object({
 	name: string(),
 	family: _enum(["IPv4", "IPv6"]),
 	address: string(),
-	/** CIDR shorthand (e.g. `192.168.x.x/24`). Empty when OS doesn't expose. */
+	/** CIDR shorthand (e.g. `192.168.10.10/24`). Empty when OS doesn't expose. */
 	cidr: string(),
 	/** OS netmask. Stable across calls so the SDK can hash on it. */
 	netmask: string(),
@@ -32918,7 +32983,8 @@ var ConnectionEndpointSchema = object({
 		"lan-ipv4",
 		"lan-ipv6",
 		"public",
-		"loopback"
+		"loopback",
+		"app-link"
 	]),
 	/**
 	* Originating-interface kind — `lan`/`wifi`/`docker`/`vpn`/`other`/
@@ -32987,15 +33053,27 @@ var GetConnectionEndpointsResultSchema = object({
 	localPort: AdvertisedLocalPortSchema
 });
 /**
-* The chosen outbound endpoint for notification artifacts. `baseUrl: null` =
-* AUTO (resolved from the candidate ranking at send time); `resolved` reports
-* what AUTO currently picks, so the UI can show the effective value either way.
+* The address flagged for notification links. `baseUrl: null` = AUTO, which
+* since D709 is the CamStack app link; `resolved` reports the effective value,
+* so the UI can show it either way.
 */
 var NotificationEndpointSchema = object({
 	/** The operator's explicit choice, or null for AUTO. */
 	baseUrl: string().nullable(),
-	/** What the ranking currently resolves to (null when nothing is reachable). */
-	resolved: string().nullable()
+	/**
+	* The effective flagged address: the explicit choice, else (AUTO) the
+	* CamStack app link `https://camstack.zentik.app` (D709). A pre-D709 hub
+	* answered the public tunnel / mesh here, or null.
+	*/
+	resolved: string().nullable(),
+	/**
+	* The hub origin an app link carries as `hub=` (D709): the hub's best
+	* public HTTPS address — the tunnel, then the mesh (Tailscale MagicDNS) —
+	* picked from this cap's own palette by `pickAppLinkHub`. `null` when the
+	* hub advertises neither; the app link is then minted without `hub=`.
+	* Absent on a pre-D709 hub.
+	*/
+	appLinkHub: string().nullable()
 });
 /**
 * The URLs the SDK / viewer should race for API access. `baseUrls` empty =
@@ -33049,7 +33127,11 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*  Pass `'https'` when the caller is itself loaded over HTTPS
 	*  to avoid mixed-content blocks in the browser. The public
 	*  tunnel always emits `https://` regardless. */
-	scheme: _enum(["http", "https"]).optional()
+	scheme: _enum(["http", "https"]).optional(),
+	/** Append the CamStack app link entry (`kind: 'app-link'`, D709) —
+	*  an address notification links can be flagged with, not a hub
+	*  route. Default `false`: racers and rankers never see it. */
+	includeAppLink: boolean().optional()
 }), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), ViewerEndpointsSchema), method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -33378,7 +33460,7 @@ var MeshPeerSchema = object({
 	tags: array(string()).readonly(),
 	/** True when the peer advertises itself as an exit-node candidate. */
 	exitNodeOption: boolean(),
-	/** Subnet routes the peer advertises (e.g. `["192.168.x.x/24"]`). */
+	/** Subnet routes the peer advertises (e.g. `["192.168.10.0/24"]`). */
 	advertisedRoutes: array(string()).readonly(),
 	/** Owner account login (e.g. `foo@example.com`). Null for tagged peers. */
 	userLogin: string().nullable(),
@@ -53855,12 +53937,14 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 	{
 		id: "addons",
 		family: "system",
-		label: "Addons",
-		kinds: [
-			"addon-crash-loop",
-			"addon-update-available",
-			"addon-updated"
-		]
+		label: "Addons stopped",
+		kinds: ["addon-crash-loop"]
+	},
+	{
+		id: "addon-updates",
+		family: "system",
+		label: "Addon updates",
+		kinds: ["addon-update-available", "addon-updated"]
 	},
 	{
 		id: "updates",
@@ -54020,13 +54104,15 @@ var STATE_SUMMARY_SECTION_VARS = [
 	},
 	{
 		name: "summaryAddons",
-		label: "Summary: addons",
-		example: "@camstack/addon-recorder 1.2.3 → 1.2.4",
-		kinds: [
-			"addon-crash-loop",
-			"addon-update-available",
-			"addon-updated"
-		]
+		label: "Summary: addons stopped",
+		example: "hub — recorder stopped after repeated crashes",
+		kinds: ["addon-crash-loop"]
+	},
+	{
+		name: "summaryAddonUpdates",
+		label: "Summary: addon updates",
+		example: "hub:\n• @camstack/addon-recorder 1.2.3 → 1.2.4",
+		kinds: ["addon-update-available", "addon-updated"]
 	},
 	{
 		name: "summaryUpdates",
@@ -54110,6 +54196,7 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_BODY_ONLY],
 	[...RULE_TEXT],
 	([...RULE_TEXT], [...DEVICE_EVENTS]),
+	([...RULE_TEXT], [...COMBINED_ALARM]),
 	([...RULE_TEXT], [...DEVICE_EVENTS]),
 	([...RULE_TEXT], [...BATTERY, ...CONSUMABLE]),
 	([...RULE_TEXT], [...CONSUMABLE]),
@@ -59847,6 +59934,75 @@ function createAccessoryDevice(kind, ctx, parent) {
 		default: throw new Error(`Hikvision provider does not implement accessory kind "${String(kind)}"`);
 	}
 }
+var ALARM_INGRESS_MESSAGE = "hikvision: alarm event received";
+var countsRecord = (counts) => Object.fromEntries(counts);
+function createAlarmIngressLog(deps) {
+	const intervalMs = deps.intervalMs ?? 6e4;
+	const bursts = /* @__PURE__ */ new Map();
+	const tags = { deviceId: deps.deviceId };
+	const received = (ev) => {
+		const existing = bursts.get(ev.camStreamId);
+		const burst = existing ?? {
+			startedAt: ev.at,
+			lastLineAt: ev.at,
+			counts: /* @__PURE__ */ new Map(),
+			types: /* @__PURE__ */ new Set(),
+			ticks: 0
+		};
+		if (!existing) bursts.set(ev.camStreamId, burst);
+		burst.ticks += 1;
+		if (!burst.types.has(ev.type)) {
+			burst.types.add(ev.type);
+			deps.logger.info(ALARM_INGRESS_MESSAGE, {
+				tags,
+				meta: {
+					edge: "start",
+					type: ev.type,
+					state: ev.state,
+					camStreamId: ev.camStreamId,
+					...ev.aiClass === null ? {} : { aiClass: ev.aiClass },
+					...existing ? { burstAgeMs: ev.at - burst.startedAt } : {}
+				}
+			});
+			burst.lastLineAt = Math.max(burst.lastLineAt, ev.at);
+			return;
+		}
+		burst.counts.set(ev.type, (burst.counts.get(ev.type) ?? 0) + 1);
+		if (ev.at - burst.lastLineAt < intervalMs) return;
+		deps.logger.info(ALARM_INGRESS_MESSAGE, {
+			tags,
+			meta: {
+				edge: "ongoing",
+				camStreamId: ev.camStreamId,
+				counts: countsRecord(burst.counts),
+				windowMs: ev.at - burst.lastLineAt,
+				burstAgeMs: ev.at - burst.startedAt
+			}
+		});
+		burst.counts.clear();
+		burst.lastLineAt = ev.at;
+	};
+	const ended = (camStreamId, at) => {
+		const burst = bursts.get(camStreamId);
+		if (!burst) return;
+		bursts.delete(camStreamId);
+		deps.logger.info(ALARM_INGRESS_MESSAGE, {
+			tags,
+			meta: {
+				edge: "end",
+				camStreamId,
+				counts: countsRecord(burst.counts),
+				ticks: burst.ticks,
+				types: [...burst.types],
+				durationMs: at - burst.startedAt
+			}
+		});
+	};
+	return {
+		received,
+		ended
+	};
+}
 function createAlarmTypeTally(deps) {
 	const intervalMs = deps.intervalMs ?? 3e5;
 	const lastLoggedAt = /* @__PURE__ */ new Map();
@@ -64233,6 +64389,20 @@ var HikvisionCamera = class HikvisionCamera extends BaseDevice {
 		});
 		return this.unhandledAlarmsTally;
 	}
+	/**
+	* Sampled info-level ingress line for the motion-bearing alarms (VMD and
+	* smart events): one at each burst's start, one per minute while it lasts,
+	* one at its end — never one per ~1 Hz tick. Lazy for the same reason as
+	* `unhandledAlarms`.
+	*/
+	motionIngressLog = null;
+	get motionIngress() {
+		this.motionIngressLog ??= createAlarmIngressLog({
+			logger: this.ctx.logger,
+			deviceId: this.id
+		});
+		return this.motionIngressLog;
+	}
 	/** Hysteresis: drop motion-active back to inactive after this many ms with
 	*  no fresh `VMD` event. Hikvision fires VMD every ~1s while motion is
 	*  active; missing 2 ticks signals the burst is over. */
@@ -66808,6 +66978,13 @@ var HikvisionCamera = class HikvisionCamera extends BaseDevice {
 	handleMotionEvent(ev, camStreamId) {
 		const now = ev.observedAt;
 		this.lastMotionAt.set(camStreamId, now);
+		this.motionIngress.received({
+			type: ev.type,
+			state: ev.state,
+			aiClass: ev.aiClass,
+			camStreamId,
+			at: now
+		});
 		this.ctx.eventBus.emit(providerMotionEvent(this.eventSource, {
 			deviceId: this.id,
 			detected: true,
@@ -66820,6 +66997,7 @@ var HikvisionCamera = class HikvisionCamera extends BaseDevice {
 			const clearedAt = Date.now();
 			this.lastMotionAt.set(camStreamId, 0);
 			this.motionInactiveTimers.delete(camStreamId);
+			this.motionIngress.ended(camStreamId, clearedAt);
 			this.ctx.eventBus.emit(providerMotionEvent(this.eventSource, {
 				deviceId: this.id,
 				detected: false,
@@ -66857,7 +67035,7 @@ var HikvisionCamera = class HikvisionCamera extends BaseDevice {
 						key: "host",
 						label: "Camera IP",
 						required: true,
-						placeholder: "192.168.x.x"
+						placeholder: "192.168.10.100"
 					},
 					{
 						type: "number",
@@ -76906,13 +77084,13 @@ function enumerateHosts(cidr) {
 	for (let d = 1; d <= 254; d += 1) out.push(`${a}.${b}.${c}.${d}`);
 	return out;
 }
-/** Best-effort local /24 from the first non-internal IPv4 interface (e.g. `192.168.x.x/24`). */
+/** Best-effort local /24 from the first non-internal IPv4 interface (e.g. `192.168.10.0/24`). */
 function detectLocalCidr() {
 	for (const addrs of Object.values((0, node_os.networkInterfaces)())) for (const addr of addrs ?? []) if (addr.family === "IPv4" && !addr.internal) {
 		const [a, b, c] = addr.address.split(".");
 		return `${a}.${b}.${c}.0/24`;
 	}
-	return "192.168.x.x/24";
+	return "192.168.10.0/24";
 }
 /** Flatten a host into a flat row-key slug — must match `generateStableId`'s host fallback so a
 *  re-scan of a host-added camera is detected as already onboarded. */
@@ -76982,7 +77160,7 @@ function buildCreationFormSchema() {
 					key: "host",
 					label: "Camera IP",
 					required: true,
-					placeholder: "192.168.x.x",
+					placeholder: "192.168.10.100",
 					inputType: "text"
 				},
 				{
@@ -77032,14 +77210,14 @@ function buildDiscoveryParamsFormSchema() {
 	}, {
 		id: "scan",
 		title: "Scan options",
-		description: "The credentialed ISAPI subnet scan is the reliable path (multicast WS-Discovery is not received on a macvlan/br0 hub). IMPORTANT: leaving the network blank scans only the HUB’s own subnet — if your cameras are on a DIFFERENT subnet than the hub, you MUST enter their CIDR here (e.g. 192.168.x.x/24), otherwise the scan returns nothing.",
+		description: "The credentialed ISAPI subnet scan is the reliable path (multicast WS-Discovery is not received on a macvlan/br0 hub). IMPORTANT: leaving the network blank scans only the HUB’s own subnet — if your cameras are on a DIFFERENT subnet than the hub, you MUST enter their CIDR here (e.g. 192.168.60.0/24), otherwise the scan returns nothing.",
 		columns: 1,
 		fields: [{
 			type: "text",
 			key: "networkCidr",
 			label: "Network (CIDR) — required if cameras are on a different subnet than the hub",
 			required: false,
-			placeholder: "192.168.x.x/24"
+			placeholder: "192.168.60.0/24"
 		}, {
 			type: "number",
 			key: "timeoutMs",

package/dist/addon.mjs

@@ -10781,6 +10781,57 @@ var ClipSearchStrictnessSchema = _enum([
 	"balanced",
 	"strict"
 ]);
+new Set([
+	{
+		id: "person",
+		name: "Person"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle"
+	},
+	{
+		id: "animal",
+		name: "Animal"
+	},
+	{
+		id: "package",
+		name: "Package"
+	}
+].map((l) => l.id));
+var COCO_TO_MACRO = {
+	mapping: {
+		person: "person",
+		bicycle: "vehicle",
+		car: "vehicle",
+		motorcycle: "vehicle",
+		airplane: "vehicle",
+		bus: "vehicle",
+		train: "vehicle",
+		truck: "vehicle",
+		boat: "vehicle",
+		bird: "animal",
+		cat: "animal",
+		dog: "animal",
+		horse: "animal",
+		sheep: "animal",
+		cow: "animal",
+		elephant: "animal",
+		bear: "animal",
+		zebra: "animal",
+		giraffe: "animal",
+		suitcase: "package",
+		backpack: "package",
+		handbag: "package"
+	},
+	preserveOriginal: false
+};
+/** Steps a root detector may declare it fills. */
+var FILLABLE_STEP_IDS = [
+	"animal-classifier",
+	"vehicle-classifier",
+	"package-detection"
+];
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -10913,6 +10964,12 @@ var ModelLicenseSchema = preprocess((value) => typeof value === "string" ? { wei
 	/** True when the weights or their data forbid commercial use. */
 	nonCommercial: boolean().optional()
 }));
+/** One `fillsClassifierEffects` entry — see `ModelCatalogEntry.fillsClassifierEffects`. */
+var FillsClassifierEffectSchema = object({
+	stepId: _enum(FILLABLE_STEP_IDS),
+	labelToEffect: record(string(), string()),
+	uncovered: array(string()).readonly()
+});
 var ModelCatalogEntrySchema = object({
 	id: string(),
 	name: string(),
@@ -11039,6 +11096,16 @@ var ModelCatalogEntrySchema = object({
 	*/
 	classMap: DetectionCatalogClassMapSchema.optional(),
 	/**
+	* The pipeline steps this ROOT detector already does the work of (D715):
+	* its labels name the effect the step exists to produce (`deer` for
+	* `animal-classifier`, `package` for `package-detection`). Derived from the
+	* labelmap by `deriveClassifierFills`, never hand-written; a COCO model
+	* declares none. Whether a declaration is honoured is the step's own
+	* `labelLink` policy (`resolveLabelLink`). `labelToEffect` values are in
+	* `FILLABLE_STEP_VOCABULARIES` (guard `check-label-link-vocabulary`).
+	*/
+	fillsClassifierEffects: array(FillsClassifierEffectSchema).readonly().optional(),
+	/**
 	* The model's CLIP feature-space contract (text encoder, dimension, vector
 	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
 	* CLIP image encoder; its absence is what "not a CLIP model" means to the
@@ -14511,7 +14578,7 @@ DeviceType.Camera;
 * This matters here more than anywhere else in the repo, because every provider
 * that knows a device's host knows its PASSWORD too: `{ host, port, username,
 * password }` sit in one object on Hikvision, Amcrest, Reolink and ONVIF alike,
-* and `http://admin:hunter2@192.168.x.x/` is a URL a browser accepts. The
+* and `http://admin:hunter2@192.168.60.139/` is a URL a browser accepts. The
 * camera's own page will ask for its own login. That is correct, and pre-
 * filling it is the operator's business, not ours.
 *
@@ -18381,51 +18448,6 @@ method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSche
 	kind: "mutation",
 	auth: "admin"
 });
-new Set([
-	{
-		id: "person",
-		name: "Person"
-	},
-	{
-		id: "vehicle",
-		name: "Vehicle"
-	},
-	{
-		id: "animal",
-		name: "Animal"
-	},
-	{
-		id: "package",
-		name: "Package"
-	}
-].map((l) => l.id));
-var COCO_TO_MACRO = {
-	mapping: {
-		person: "person",
-		bicycle: "vehicle",
-		car: "vehicle",
-		motorcycle: "vehicle",
-		airplane: "vehicle",
-		bus: "vehicle",
-		train: "vehicle",
-		truck: "vehicle",
-		boat: "vehicle",
-		bird: "animal",
-		cat: "animal",
-		dog: "animal",
-		horse: "animal",
-		sheep: "animal",
-		cow: "animal",
-		elephant: "animal",
-		bear: "animal",
-		zebra: "animal",
-		giraffe: "animal",
-		suitcase: "package",
-		backpack: "package",
-		handbag: "package"
-	},
-	preserveOriginal: false
-};
 var AUDIO_MACRO_LABELS = [
 	{
 		id: "speech",
@@ -20319,8 +20341,9 @@ var NcRuleSchema = NcRuleInputSchema.extend({
 	disabledTargetIds: array(string()).default([])
 });
 /**
-* The state-summary SECTIONS (D647 / D698): the D637 kind groups that report a
-* still-true state. `backups-exports` and `alarm` are not sections — a completed
+* The state-summary SECTIONS (D647 / D698 / D708): the D637 kind groups that
+* report a still-true state. `addons` is the crash-looped addons only and
+* `addon-updates` the addons that are behind (D708 split them). `backups-exports` and `alarm` are not sections — a completed
 * job is not an open state, and the alarm stays instant.
 */
 var NcStateSummarySectionIdSchema = _enum([
@@ -20332,6 +20355,7 @@ var NcStateSummarySectionIdSchema = _enum([
 	"detection-blind",
 	"nodes",
 	"addons",
+	"addon-updates",
 	"updates"
 ]);
 /** One section of a previewed state summary. `unavailable` = its state could not be read. */
@@ -20812,7 +20836,19 @@ var NcAlarmModeDelaysListSchema = array(object({
 	* When this mode may be armed. Absent / null = always allowed (same as a
 	* rule with no `schedule`). Evaluated with {@link isScheduleActive}.
 	*/
-	schedule: NcScheduleSchema.optional()
+	schedule: NcScheduleSchema.optional(),
+	/**
+	* D706: while this mode's ENTRY DELAY runs, do the alarm rules' own pushes go out (as an
+	* intrusion naming the locations)? Absent = false — the entry-delay notification is the
+	* only one, and the matches ride the triggered notification's mosaic (D705).
+	*/
+	notifyDuringEntryDelay: boolean().optional(),
+	/**
+	* D706: notify "watched again" when a sensor this arm bypassed closes and opens again.
+	* Absent = false (logged, not sent). Even when true it is not sent when that same sensor
+	* is the one that starts the entry delay — the entry-delay notification already names it.
+	*/
+	notifySensorRewatched: boolean().optional()
 })).max(8).refine(uniqueModes, { message: "modeDelays: at most one entry per arm mode" });
 var NcAlarmModeDelaysEditListSchema = array(object({
 	mode: AlarmArmModeSchema,
@@ -20821,7 +20857,11 @@ var NcAlarmModeDelaysEditListSchema = array(object({
 	triggeredDurationSec: NcAlarmTriggeredSecSchema.nullable().optional(),
 	postTriggeredAction: NcAlarmPostTriggeredActionSchema.nullable().optional(),
 	/** Set a schedule, or `null` to clear (mode always allowed again). */
-	schedule: NcScheduleSchema.nullable().optional()
+	schedule: NcScheduleSchema.nullable().optional(),
+	/** D706: set the switch, or `null` to clear it (back to the default, false). */
+	notifyDuringEntryDelay: boolean().nullable().optional(),
+	/** D706: set the switch, or `null` to clear it (back to the default, false). */
+	notifySensorRewatched: boolean().nullable().optional()
 })).max(8).refine(uniqueModes, { message: "modeDelays: at most one edit per arm mode" });
 /** One switch of the alarm table: put ONE device on, or take it off, ONE mode's list. */
 var NcAlarmNonBlockingEditSchema = object({
@@ -23849,7 +23889,8 @@ var PipelineModelOptionSchema = object({
 	group: ModelVariantGroupSchema.optional(),
 	legacy: boolean().optional(),
 	provider: ModelProviderIdSchema.optional(),
-	defaultConfidence: number().optional()
+	defaultConfidence: number().optional(),
+	fillsClassifierEffects: array(FillsClassifierEffectSchema).readonly().optional()
 });
 var ConfigFieldBridge = custom();
 var PipelineAddonSchemaSchema = object({
@@ -24682,6 +24723,22 @@ var MotionSourceEnum = _enum([
 	"device-activity"
 ]);
 /**
+* What opened an on-motion detection SESSION: the motion source that passed the
+* camera's `motionSources` gate, and what raised it (the camera itself, or a
+* sensor the operator attached — D672). `sensorName` is the attached sensor's
+* device name as the orchestrator's camera-sensors resolution last read it;
+* absent when unknown or when the camera itself triggered.
+*
+* Carried on the session attach ONLY so the runner's `DetectionPhaseTransition`
+* can say what started the session (D672 rule 11, amended 2026-10-06). The
+* runner never decides anything on it.
+*/
+var SessionTriggerSchema = object({
+	source: MotionSourceEnum,
+	triggeredBy: MotionTriggeredBySchema,
+	sensorName: string().optional()
+});
+/**
 * List of motion sources active on a camera. Empty array is valid:
 * "no source" — happens for battery cams without firmware motion when
 * the operator hasn't opted into the SW analyzer (would hold the
@@ -24933,6 +24990,14 @@ var RunnerCameraConfigSchema = object({
 	*/
 	motionSources: MotionSourcesSchema.default(["analyzer"]),
 	/**
+	* What opened this attach, on a SESSION attach only (see
+	* {@link SessionTriggerSchema}). OPTIONAL with no default: absent on a
+	* standing attach, an occupancy burst, a re-dispatch with no motion event
+	* behind it, and every attach from an orchestrator older than the field — the
+	* runner then names no source on the phase event.
+	*/
+	sessionTrigger: SessionTriggerSchema.optional(),
+	/**
 	* WHICH root detector runs for this camera. The detection counterpart of
 	* {@link motionSources}, same shape and same discipline: a per-camera list
 	* of sources the system understands, vendor-agnostic, owned here.
@@ -32843,7 +32908,7 @@ var LocalInterfaceSchema = object({
 	name: string(),
 	family: _enum(["IPv4", "IPv6"]),
 	address: string(),
-	/** CIDR shorthand (e.g. `192.168.x.x/24`). Empty when OS doesn't expose. */
+	/** CIDR shorthand (e.g. `192.168.10.10/24`). Empty when OS doesn't expose. */
 	cidr: string(),
 	/** OS netmask. Stable across calls so the SDK can hash on it. */
 	netmask: string(),
@@ -32897,7 +32962,8 @@ var ConnectionEndpointSchema = object({
 		"lan-ipv4",
 		"lan-ipv6",
 		"public",
-		"loopback"
+		"loopback",
+		"app-link"
 	]),
 	/**
 	* Originating-interface kind — `lan`/`wifi`/`docker`/`vpn`/`other`/
@@ -32966,15 +33032,27 @@ var GetConnectionEndpointsResultSchema = object({
 	localPort: AdvertisedLocalPortSchema
 });
 /**
-* The chosen outbound endpoint for notification artifacts. `baseUrl: null` =
-* AUTO (resolved from the candidate ranking at send time); `resolved` reports
-* what AUTO currently picks, so the UI can show the effective value either way.
+* The address flagged for notification links. `baseUrl: null` = AUTO, which
+* since D709 is the CamStack app link; `resolved` reports the effective value,
+* so the UI can show it either way.
 */
 var NotificationEndpointSchema = object({
 	/** The operator's explicit choice, or null for AUTO. */
 	baseUrl: string().nullable(),
-	/** What the ranking currently resolves to (null when nothing is reachable). */
-	resolved: string().nullable()
+	/**
+	* The effective flagged address: the explicit choice, else (AUTO) the
+	* CamStack app link `https://camstack.zentik.app` (D709). A pre-D709 hub
+	* answered the public tunnel / mesh here, or null.
+	*/
+	resolved: string().nullable(),
+	/**
+	* The hub origin an app link carries as `hub=` (D709): the hub's best
+	* public HTTPS address — the tunnel, then the mesh (Tailscale MagicDNS) —
+	* picked from this cap's own palette by `pickAppLinkHub`. `null` when the
+	* hub advertises neither; the app link is then minted without `hub=`.
+	* Absent on a pre-D709 hub.
+	*/
+	appLinkHub: string().nullable()
 });
 /**
 * The URLs the SDK / viewer should race for API access. `baseUrls` empty =
@@ -33028,7 +33106,11 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*  Pass `'https'` when the caller is itself loaded over HTTPS
 	*  to avoid mixed-content blocks in the browser. The public
 	*  tunnel always emits `https://` regardless. */
-	scheme: _enum(["http", "https"]).optional()
+	scheme: _enum(["http", "https"]).optional(),
+	/** Append the CamStack app link entry (`kind: 'app-link'`, D709) —
+	*  an address notification links can be flagged with, not a hub
+	*  route. Default `false`: racers and rankers never see it. */
+	includeAppLink: boolean().optional()
 }), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), ViewerEndpointsSchema), method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -33357,7 +33439,7 @@ var MeshPeerSchema = object({
 	tags: array(string()).readonly(),
 	/** True when the peer advertises itself as an exit-node candidate. */
 	exitNodeOption: boolean(),
-	/** Subnet routes the peer advertises (e.g. `["192.168.x.x/24"]`). */
+	/** Subnet routes the peer advertises (e.g. `["192.168.10.0/24"]`). */
 	advertisedRoutes: array(string()).readonly(),
 	/** Owner account login (e.g. `foo@example.com`). Null for tagged peers. */
 	userLogin: string().nullable(),
@@ -53834,12 +53916,14 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 	{
 		id: "addons",
 		family: "system",
-		label: "Addons",
-		kinds: [
-			"addon-crash-loop",
-			"addon-update-available",
-			"addon-updated"
-		]
+		label: "Addons stopped",
+		kinds: ["addon-crash-loop"]
+	},
+	{
+		id: "addon-updates",
+		family: "system",
+		label: "Addon updates",
+		kinds: ["addon-update-available", "addon-updated"]
 	},
 	{
 		id: "updates",
@@ -53999,13 +54083,15 @@ var STATE_SUMMARY_SECTION_VARS = [
 	},
 	{
 		name: "summaryAddons",
-		label: "Summary: addons",
-		example: "@camstack/addon-recorder 1.2.3 → 1.2.4",
-		kinds: [
-			"addon-crash-loop",
-			"addon-update-available",
-			"addon-updated"
-		]
+		label: "Summary: addons stopped",
+		example: "hub — recorder stopped after repeated crashes",
+		kinds: ["addon-crash-loop"]
+	},
+	{
+		name: "summaryAddonUpdates",
+		label: "Summary: addon updates",
+		example: "hub:\n• @camstack/addon-recorder 1.2.3 → 1.2.4",
+		kinds: ["addon-update-available", "addon-updated"]
 	},
 	{
 		name: "summaryUpdates",
@@ -54089,6 +54175,7 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_BODY_ONLY],
 	[...RULE_TEXT],
 	([...RULE_TEXT], [...DEVICE_EVENTS]),
+	([...RULE_TEXT], [...COMBINED_ALARM]),
 	([...RULE_TEXT], [...DEVICE_EVENTS]),
 	([...RULE_TEXT], [...BATTERY, ...CONSUMABLE]),
 	([...RULE_TEXT], [...CONSUMABLE]),
@@ -59826,6 +59913,75 @@ function createAccessoryDevice(kind, ctx, parent) {
 		default: throw new Error(`Hikvision provider does not implement accessory kind "${String(kind)}"`);
 	}
 }
+var ALARM_INGRESS_MESSAGE = "hikvision: alarm event received";
+var countsRecord = (counts) => Object.fromEntries(counts);
+function createAlarmIngressLog(deps) {
+	const intervalMs = deps.intervalMs ?? 6e4;
+	const bursts = /* @__PURE__ */ new Map();
+	const tags = { deviceId: deps.deviceId };
+	const received = (ev) => {
+		const existing = bursts.get(ev.camStreamId);
+		const burst = existing ?? {
+			startedAt: ev.at,
+			lastLineAt: ev.at,
+			counts: /* @__PURE__ */ new Map(),
+			types: /* @__PURE__ */ new Set(),
+			ticks: 0
+		};
+		if (!existing) bursts.set(ev.camStreamId, burst);
+		burst.ticks += 1;
+		if (!burst.types.has(ev.type)) {
+			burst.types.add(ev.type);
+			deps.logger.info(ALARM_INGRESS_MESSAGE, {
+				tags,
+				meta: {
+					edge: "start",
+					type: ev.type,
+					state: ev.state,
+					camStreamId: ev.camStreamId,
+					...ev.aiClass === null ? {} : { aiClass: ev.aiClass },
+					...existing ? { burstAgeMs: ev.at - burst.startedAt } : {}
+				}
+			});
+			burst.lastLineAt = Math.max(burst.lastLineAt, ev.at);
+			return;
+		}
+		burst.counts.set(ev.type, (burst.counts.get(ev.type) ?? 0) + 1);
+		if (ev.at - burst.lastLineAt < intervalMs) return;
+		deps.logger.info(ALARM_INGRESS_MESSAGE, {
+			tags,
+			meta: {
+				edge: "ongoing",
+				camStreamId: ev.camStreamId,
+				counts: countsRecord(burst.counts),
+				windowMs: ev.at - burst.lastLineAt,
+				burstAgeMs: ev.at - burst.startedAt
+			}
+		});
+		burst.counts.clear();
+		burst.lastLineAt = ev.at;
+	};
+	const ended = (camStreamId, at) => {
+		const burst = bursts.get(camStreamId);
+		if (!burst) return;
+		bursts.delete(camStreamId);
+		deps.logger.info(ALARM_INGRESS_MESSAGE, {
+			tags,
+			meta: {
+				edge: "end",
+				camStreamId,
+				counts: countsRecord(burst.counts),
+				ticks: burst.ticks,
+				types: [...burst.types],
+				durationMs: at - burst.startedAt
+			}
+		});
+	};
+	return {
+		received,
+		ended
+	};
+}
 function createAlarmTypeTally(deps) {
 	const intervalMs = deps.intervalMs ?? 3e5;
 	const lastLoggedAt = /* @__PURE__ */ new Map();
@@ -64212,6 +64368,20 @@ var HikvisionCamera = class HikvisionCamera extends BaseDevice {
 		});
 		return this.unhandledAlarmsTally;
 	}
+	/**
+	* Sampled info-level ingress line for the motion-bearing alarms (VMD and
+	* smart events): one at each burst's start, one per minute while it lasts,
+	* one at its end — never one per ~1 Hz tick. Lazy for the same reason as
+	* `unhandledAlarms`.
+	*/
+	motionIngressLog = null;
+	get motionIngress() {
+		this.motionIngressLog ??= createAlarmIngressLog({
+			logger: this.ctx.logger,
+			deviceId: this.id
+		});
+		return this.motionIngressLog;
+	}
 	/** Hysteresis: drop motion-active back to inactive after this many ms with
 	*  no fresh `VMD` event. Hikvision fires VMD every ~1s while motion is
 	*  active; missing 2 ticks signals the burst is over. */
@@ -66787,6 +66957,13 @@ var HikvisionCamera = class HikvisionCamera extends BaseDevice {
 	handleMotionEvent(ev, camStreamId) {
 		const now = ev.observedAt;
 		this.lastMotionAt.set(camStreamId, now);
+		this.motionIngress.received({
+			type: ev.type,
+			state: ev.state,
+			aiClass: ev.aiClass,
+			camStreamId,
+			at: now
+		});
 		this.ctx.eventBus.emit(providerMotionEvent(this.eventSource, {
 			deviceId: this.id,
 			detected: true,
@@ -66799,6 +66976,7 @@ var HikvisionCamera = class HikvisionCamera extends BaseDevice {
 			const clearedAt = Date.now();
 			this.lastMotionAt.set(camStreamId, 0);
 			this.motionInactiveTimers.delete(camStreamId);
+			this.motionIngress.ended(camStreamId, clearedAt);
 			this.ctx.eventBus.emit(providerMotionEvent(this.eventSource, {
 				deviceId: this.id,
 				detected: false,
@@ -66836,7 +67014,7 @@ var HikvisionCamera = class HikvisionCamera extends BaseDevice {
 						key: "host",
 						label: "Camera IP",
 						required: true,
-						placeholder: "192.168.x.x"
+						placeholder: "192.168.10.100"
 					},
 					{
 						type: "number",
@@ -76885,13 +77063,13 @@ function enumerateHosts(cidr) {
 	for (let d = 1; d <= 254; d += 1) out.push(`${a}.${b}.${c}.${d}`);
 	return out;
 }
-/** Best-effort local /24 from the first non-internal IPv4 interface (e.g. `192.168.x.x/24`). */
+/** Best-effort local /24 from the first non-internal IPv4 interface (e.g. `192.168.10.0/24`). */
 function detectLocalCidr() {
 	for (const addrs of Object.values(networkInterfaces())) for (const addr of addrs ?? []) if (addr.family === "IPv4" && !addr.internal) {
 		const [a, b, c] = addr.address.split(".");
 		return `${a}.${b}.${c}.0/24`;
 	}
-	return "192.168.x.x/24";
+	return "192.168.10.0/24";
 }
 /** Flatten a host into a flat row-key slug — must match `generateStableId`'s host fallback so a
 *  re-scan of a host-added camera is detected as already onboarded. */
@@ -76961,7 +77139,7 @@ function buildCreationFormSchema() {
 					key: "host",
 					label: "Camera IP",
 					required: true,
-					placeholder: "192.168.x.x",
+					placeholder: "192.168.10.100",
 					inputType: "text"
 				},
 				{
@@ -77011,14 +77189,14 @@ function buildDiscoveryParamsFormSchema() {
 	}, {
 		id: "scan",
 		title: "Scan options",
-		description: "The credentialed ISAPI subnet scan is the reliable path (multicast WS-Discovery is not received on a macvlan/br0 hub). IMPORTANT: leaving the network blank scans only the HUB’s own subnet — if your cameras are on a DIFFERENT subnet than the hub, you MUST enter their CIDR here (e.g. 192.168.x.x/24), otherwise the scan returns nothing.",
+		description: "The credentialed ISAPI subnet scan is the reliable path (multicast WS-Discovery is not received on a macvlan/br0 hub). IMPORTANT: leaving the network blank scans only the HUB’s own subnet — if your cameras are on a DIFFERENT subnet than the hub, you MUST enter their CIDR here (e.g. 192.168.60.0/24), otherwise the scan returns nothing.",
 		columns: 1,
 		fields: [{
 			type: "text",
 			key: "networkCidr",
 			label: "Network (CIDR) — required if cameras are on a different subnet than the hub",
 			required: false,
-			placeholder: "192.168.x.x/24"
+			placeholder: "192.168.60.0/24"
 		}, {
 			type: "number",
 			key: "timeoutMs",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-hikvision",
-  "version": "1.2.141",
+  "version": "1.2.143",
   "description": "Hikvision camera device provider addon for CamStack — ISAPI over HTTP(S) with digest auth (snapshot, alarm stream, RTSP discovery)",
   "keywords": [
     "camstack",