@camstack/addon-provider-hikvision 1.2.27 → 1.2.28

package/dist/addon.js

@@ -6,7 +6,7 @@ let node_crypto = require("node:crypto");
 let node_http = require("node:http");
 let node_https = require("node:https");
 let node_os = require("node:os");
-//#region ../types/dist/event-category-C0lyLd5U.mjs
+//#region ../types/dist/event-category-XfKNtfCc.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -45,6 +45,22 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["AddonInstalled"] = "addon.installed";
 	EventCategory["AddonUninstalled"] = "addon.uninstalled";
 	EventCategory["AddonCrashed"] = "addon.crashed";
+	/**
+	* A RUNNER the D6 crash circuit-breaker gave up on — terminal.
+	*
+	* `AddonCrashed` is the routine, self-healing fact ("it crashed; it is being
+	* respawned"); this is the one that never resolves itself. Emitted exactly
+	* once per trip, by `process-service.ts`, carrying the node, the runner, the
+	* addons it hosted and the crash count that tripped the breaker.
+	*
+	* It exists because a runner marked terminally `failed` used to be SILENT:
+	* on 2026-08-18 the `recorder` runner died of three unhandled ffmpeg spawn
+	* errors, the breaker stopped respawning it (correctly), `/health` kept
+	* returning 200, and fleet-wide recording was gone for 3h15 before the
+	* operator's phone told him. The Notification Center's system-event intake
+	* consumes this category and maps it to the `addon-crash-loop` kind.
+	*/
+	EventCategory["AddonRunnerFailed"] = "addon.runner-failed";
 	EventCategory["AddonError"] = "addon.error";
 	EventCategory["AddonPageReady"] = "addon.page-ready";
 	EventCategory["AddonWidgetReady"] = "addon.widget-ready";
@@ -14737,6 +14753,7 @@ var NcSystemEventKindSchema = _enum([
 	"node-offline",
 	"node-inference-unavailable",
 	"detection-blind",
+	"addon-crash-loop",
 	"addon-update-available",
 	"server-update-available",
 	"alarm-triggered",
@@ -20474,20 +20491,6 @@ var VectorStatsResultSchema = object({
 	exact: boolean()
 });
 method(VectorDeclareIndexInputSchema, _void(), { kind: "mutation" }), method(VectorUpsertInputSchema, VectorUpsertResultSchema, { kind: "mutation" }), method(VectorQueryInputSchema, VectorQueryResultSchema), method(VectorGetInputSchema, VectorGetResultSchema), method(VectorDeleteInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorStatsInputSchema, VectorStatsResultSchema);
-/**
-* `videoclips` — the unified, navigable-clip surface for a camera.
-*
-* A device-scoped WRAPPER cap (like `pipeline-analytics`): exactly one active
-* provider per device, substitutable. The DEFAULT provider (registered by
-* `addon-post-analysis`, `defaultActive: true`) composes the analytics event
-* log (markers + thumbnails) with the recorder's `getPlaybackManifest` — a clip
-* is a time-WINDOW over existing footage, never a separate file. A camera that
-* exposes NATIVE onboard clips (Reolink/Hikvision NVR) can later substitute the
-* wrapper provider for its device and serve its own clip catalog + URLs.
-*
-* A `Clip` is purely time-based (subtree-blind): playback resolves segments by
-* temporal overlap, so the API never decides `continuous` vs `events`.
-*/
 var ClipSchema = object({
 	/** Opaque, provider-namespaced id. The default provider encodes the time
 	*  window so `getClipPlayback` is self-contained (no event re-query). */
@@ -20513,12 +20516,41 @@ var ClipSchema = object({
 	* of the event that owns `kind` (object > motion > audio). Do not extract
 	* a keyframe from the recorded segments. Other providers (onboard, HKSV)
 	* mint their own stills.
+	*
+	* **VOUCHED, never fabricated.** A provider emits this only for an event it
+	* has CONFIRMED owns at least one media row (its own, or its owning track's).
+	* Absent is meaningful — "this visit has no event still" — never "we did not
+	* look". Stamping it from a URL template made 35% of one camera's clips point
+	* at a 404 (device 3836, 2026-08-17: 64 of 179 clips dead, 63 of them motion).
+	* A read that FAILS drops the claim; it never invents it.
 	*/
 	thumbnail: string().optional(),
-	/** Analytics event ids that overlap this visit. Empty on footage-only clips.
-	*  The default provider's visit grain puts many motion heartbeats on one clip
-	*  instead of minting one clip per marker. */
+	/**
+	* An instant INSIDE this visit's footage, hole-safe, where a recorded still
+	* can be decoded. Present whenever the visit came from recorded availability;
+	* absent on a per-event padded window (there is no footage to promise).
+	*
+	* This is not a thumbnail and not a second byte path: it is the argument to
+	* the recorder's existing still route. The surface — never the provider —
+	* decides whether to use it. It is the midpoint of the visit's LONGEST
+	* contiguous range, not of the visit: a visit spans its holes by
+	* construction, so a naive midpoint lands in dead air.
+	*/
+	stillAtMs: number().optional(),
+	/**
+	* Analytics event ids that overlap this visit — a BOUNDED sample, newest
+	* first within kind (object → motion → audio), capped at
+	* {@link MAX_CLIP_EVENT_IDS}. Empty on footage-only clips.
+	*
+	* Bounded because it is not a payload the surface pages through: one visit on
+	* device 615 carried 2 345 ids, and `eventIds` was 99% of a 153 KB
+	* camera-day. Read {@link eventCount} for the true total.
+	*/
 	eventIds: array(string()).optional(),
+	/** How many analytics events actually overlap this visit. Differs from
+	*  `eventIds.length` exactly when the sample was capped — so a truncated
+	*  list is never mistaken for a quiet visit. */
+	eventCount: number().int().nonnegative().optional(),
 	/** Intra-visit footage holes (GOP rolls, discarded segments) still shorter
 	*  than `VISIT_MERGE_GAP_MS`. Playback concatenates around them; the timeline
 	*  bar keeps showing them via `recording.getAvailability`. */
@@ -20989,7 +21021,14 @@ var SearchResultSchema = object({
 });
 var AutoUpdateSettingsSchema = object({
 	channel: ChannelSchema,
-	intervalSeconds: number()
+	intervalSeconds: number(),
+	/**
+	* Cadence of the "an update exists" POLLER, in seconds. Independent of
+	* `channel`: the poller runs while auto-apply is `off`, because being told
+	* about a publish and installing it are different decisions. Clamped
+	* server-side to 900 s … 604800 s; defaults to 21600 s (6 h).
+	*/
+	updateCheckIntervalSeconds: number()
 });
 var AddonAutoUpdateSchema = ChannelWithInheritSchema;
 var RestartAddonResultSchema = unknown();
@@ -21130,7 +21169,9 @@ method(_void(), array(AddonListItemSchema).readonly()), method(object({
 	auth: "admin"
 }), method(_void(), AutoUpdateSettingsSchema, { auth: "admin" }), method(object({
 	channel: ChannelSchema,
-	intervalSeconds: number().min(300).max(86400).optional()
+	intervalSeconds: number().min(300).max(86400).optional(),
+	/** Availability-poll cadence; see AutoUpdateSettingsSchema. */
+	updateCheckIntervalSeconds: number().min(900).max(604800).optional()
 }), unknown(), {
 	kind: "mutation",
 	auth: "admin"
@@ -38134,6 +38175,8 @@ DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
+var MB = 1024 * 1024;
+1024 * MB, 3072 * MB;
 //#endregion
 //#region src/accessories/base.ts
 /**
@@ -40696,36 +40739,87 @@ function parseTwoWayAudioChannels(xml) {
 	return out;
 }
 /**
-* Idle watchdog for the alarm stream. Hikvision firmware emits a keep-alive
-* heartbeat (typically a `videoloss`/`inactive` alert) roughly every ~5s even
-* when nothing is happening, so a total absence of ANY bytes for this long
-* means the pipe is dead — either a half-open TCP connection (no FIN, no data)
-* that would otherwise block `reader.read()` forever, or a stalled proxy/NAT
-* conntrack entry between the hub and a camera on a different subnet. When it
-* fires we cancel the reader, surfacing a clean stream-end that the reconnect
-* path treats as a recoverable disconnect.
-*/
-var ALARM_STREAM_IDLE_TIMEOUT_MS = 3e4;
-/**
-* Subscribe to the camera's alarm stream. Returns an `AbortController`
-* — `controller.abort()` tears the subscription down. Reconnect logic
-* is the caller's responsibility (we keep the parser simple and let
-* the device class own the lifecycle / backoff timing).
-*
-* Every terminal outcome that is NOT a deliberate `controller.abort()` is
-* reported through `onError` exactly once, so the caller's reconnect logic
-* always fires:
-*   - HTTP / boundary failure at subscribe time,
-*   - a thrown error while pumping,
-*   - AND a clean stream-end (`done`). Hikvision cameras recycle the
-*     alertStream HTTP connection periodically (firmware keep-alive limits,
-*     internal event-subsystem restarts, or an idle NAT/proxy hop closing the
-*     socket). A clean close used to fall through silently — `onError` never
-*     fired, the caller's `alarmController` stayed non-null, and the device
-*     never resubscribed — so motion stopped permanently until the provider
-*     restarted. Treating clean-end as a recoverable disconnect closes that gap.
-*/
-function subscribeAlarms(client, handlers, idleTimeoutMs = ALARM_STREAM_IDLE_TIMEOUT_MS) {
+* Why the parser adopts the boundary it SEES rather than the one declared.
+*
+* Five cameras on `C-R-*` firmware (I91DN/I91DD V5.7.1, I91EV V5.8.10) have
+* never delivered one motion event here, while the same cameras deliver real
+* hardware VMD on the same endpoint to another NVR stack. The one dimension
+* where that stack is more permissive is the multipart boundary: it accepts a
+* part framed with the declared `--<boundary>` OR with the literal constant
+* `--boundary`, because "older hikvision send a boundary in the headers, but
+* then use a totally different constant boundary value".
+*
+* We take the general form instead of that special case: if the DECLARED
+* token has never once matched, adopt the token from the first `--…` line
+* actually on the wire and use it from then on. It subsumes the literal
+* `--boundary` case (that IS the observed token on those cameras) and it also
+* covers the next firmware that invents a third constant, which a hard-coded
+* fallback would not. The risk is bounded on both sides: adoption is only ever
+* attempted while the declared token has produced ZERO parts, the candidate
+* must occupy a whole line of RFC 2046 boundary characters, and the closing
+* delimiter (`--<token>--`) is rejected.
+*/
+function detectWireBoundary(buf) {
+	const text = Buffer.from(buf).toString("binary");
+	const lineRe = /(?:^|\r?\n)--([0-9A-Za-z'()+_,./:=?-]{1,70})\r?\n/g;
+	for (;;) {
+		const m = lineRe.exec(text);
+		if (!m) return null;
+		const token = m[1];
+		if (token.endsWith("--")) continue;
+		return token;
+	}
+}
+/**
+* First occurrence of each kind is logged immediately; further occurrences are
+* counted and folded into the next line after `intervalMs`. A stream that
+* drops every part therefore costs one line per minute per kind, not one per
+* chunk.
+*/
+function createAlarmDiagnostics(logger, deviceId, intervalMs) {
+	const lastLoggedAt = /* @__PURE__ */ new Map();
+	const suppressed = /* @__PURE__ */ new Map();
+	const report = (kind, message, meta, level = "warn") => {
+		if (!logger) return;
+		const now = Date.now();
+		const last = lastLoggedAt.get(kind);
+		if (last !== void 0 && now - last < intervalMs) {
+			suppressed.set(kind, (suppressed.get(kind) ?? 0) + 1);
+			return;
+		}
+		const since = suppressed.get(kind) ?? 0;
+		suppressed.set(kind, 0);
+		lastLoggedAt.set(kind, now);
+		const extras = {
+			...deviceId === null ? {} : { tags: { deviceId } },
+			meta: {
+				kind,
+				...meta,
+				...since > 0 ? { suppressedSincePrevious: since } : {}
+			}
+		};
+		if (level === "debug") logger.debug(message, extras);
+		else logger.warn(message, extras);
+	};
+	return { report };
+}
+/** First line of a buffer, clipped — the single most useful field when asking
+*  "what is this camera actually sending?". */
+function firstLineOf(buf, maxChars = 120) {
+	const line = Buffer.from(buf.subarray(0, 1024)).toString("utf8").split(/\r?\n/, 1)[0] ?? "";
+	return line.length > maxChars ? `${line.slice(0, maxChars)}…` : line;
+}
+/** First whole line that starts with `--` — i.e. the framing the camera really
+*  uses. `null` when the buffer contains no such line. */
+function firstDashLineOf(buf, maxChars = 120) {
+	const text = Buffer.from(buf.subarray(0, 4096)).toString("utf8");
+	for (const line of text.split(/\r?\n/)) {
+		if (!line.startsWith("--")) continue;
+		return line.length > maxChars ? `${line.slice(0, maxChars)}…` : line;
+	}
+	return null;
+}
+function subscribeAlarms(client, handlers, options = {}) {
 	const controller = new AbortController();
 	let settled = false;
 	const fail = (err) => {
@@ -40752,7 +40846,7 @@ function subscribeAlarms(client, handlers, idleTimeoutMs = ALARM_STREAM_IDLE_TIM
 				return;
 			}
 			handlers.onConnected?.();
-			await pumpAlarmStream(res.body, boundary, handlers, idleTimeoutMs);
+			await pumpAlarmStream(res.body, boundary, handlers, options);
 			fail(/* @__PURE__ */ new Error("alarm stream ended"));
 		} catch (err) {
 			fail(err);
@@ -40764,10 +40858,65 @@ function parseBoundary(contentType) {
 	const m = /boundary\s*=\s*"?([^";\s]+)"?/i.exec(contentType);
 	return m ? m[1].trim() : null;
 }
-async function pumpAlarmStream(stream, boundary, handlers, idleTimeoutMs = ALARM_STREAM_IDLE_TIMEOUT_MS) {
+async function pumpAlarmStream(stream, declaredBoundary, handlers, options) {
+	const idleTimeoutMs = options.idleTimeoutMs ?? 3e4;
+	const maxBufferBytes = options.maxBufferBytes ?? 1048576;
+	const retainBytes = options.retainBytes ?? 65536;
+	const unparsedWarnBytes = options.unparsedWarnBytes ?? 32768;
+	const diagnostics = createAlarmDiagnostics(options.logger ?? null, options.deviceId ?? null, options.diagnosticIntervalMs ?? 6e4);
 	const reader = stream.getReader();
-	const dashBoundary = `--${boundary}`;
+	let activeBoundary = declaredBoundary;
+	let activeDashBoundary = `--${activeBoundary}`;
+	/** Has the ACTIVE token ever framed anything? Gates boundary adoption. */
+	let matchedAnyBoundary = false;
+	/**
+	* Is the fragment that precedes the next boundary junk?
+	*
+	* True only at the head of the stream (RFC 1521 preamble), after we already
+	* emitted the bytes sitting in the buffer, and after the overflow cap cut
+	* the buffer mid-part. It used to be true unconditionally, which meant every
+	* split after the first DISCARDED a completed part — on a stream that
+	* delivers one part per TCP read, that is every event the camera ever sent.
+	*/
+	let dropLeadingFragment = true;
 	let bufferedBytes = new Uint8Array(0);
+	const dispatchBlock = (block) => {
+		const parsed = parseMultipartBlock(block);
+		if (!parsed.ok) {
+			diagnostics.report("part-unparseable", "hikvision alarm stream: multipart part dropped", {
+				reason: parsed.reason,
+				bytes: block.byteLength,
+				firstLine: firstLineOf(block)
+			});
+			return;
+		}
+		const { contentType, bodyText } = parsed.block;
+		if (!(contentType.startsWith("application/xml") || contentType.startsWith("text/xml") || looksLikeAlertXml(bodyText))) {
+			if (contentType.startsWith("image/")) {
+				diagnostics.report("part-image-ignored", "hikvision alarm stream: image part ignored (not forwarded yet)", {
+					contentType,
+					bytes: block.byteLength
+				}, "debug");
+				return;
+			}
+			diagnostics.report("part-not-alert-xml", "hikvision alarm stream: part dropped — neither an xml Content-Type nor alert-shaped XML", {
+				contentType,
+				bytes: block.byteLength,
+				bodyPreview: bodyText.slice(0, 120)
+			});
+			return;
+		}
+		const ev = parseAlertXml(bodyText);
+		if (!ev) {
+			diagnostics.report("alert-xml-without-event-type", "hikvision alarm stream: alert part dropped — no <eventType> tag", {
+				contentType,
+				bytes: block.byteLength,
+				bodyPreview: bodyText.slice(0, 120)
+			});
+			return;
+		}
+		handlers.onEvent(ev);
+	};
 	let idleTimer = null;
 	const armIdle = () => {
 		if (idleTimeoutMs <= 0) return;
@@ -40784,16 +40933,57 @@ async function pumpAlarmStream(stream, boundary, handlers, idleTimeoutMs = ALARM
 			armIdle();
 			if (!value || value.byteLength === 0) continue;
 			bufferedBytes = concat(bufferedBytes, value);
-			const parts = splitOnBoundary(bufferedBytes, dashBoundary);
-			bufferedBytes = parts.tail;
-			for (const block of parts.blocks) {
-				const parsed = parseMultipartBlock(block);
-				if (!parsed) continue;
-				if (parsed.contentType.startsWith("application/xml") || parsed.contentType.startsWith("text/xml") || looksLikeAlertXml(parsed.bodyText)) {
-					const ev = parseAlertXml(parsed.bodyText);
-					if (ev) handlers.onEvent(ev);
+			let split = splitOnBoundary(bufferedBytes, activeDashBoundary, dropLeadingFragment);
+			if (!split.sawBoundary && !matchedAnyBoundary) {
+				const observed = detectWireBoundary(bufferedBytes);
+				if (observed !== null && observed !== activeBoundary) {
+					diagnostics.report("boundary-adopted", "hikvision alarm stream: declared multipart boundary never matched — adopting the boundary seen on the wire", {
+						declaredBoundary,
+						observedBoundary: observed,
+						bufferedBytes: bufferedBytes.byteLength,
+						firstDashLine: firstDashLineOf(bufferedBytes),
+						firstLine: firstLineOf(bufferedBytes)
+					});
+					activeBoundary = observed;
+					activeDashBoundary = `--${observed}`;
+					split = splitOnBoundary(bufferedBytes, activeDashBoundary, dropLeadingFragment);
 				}
 			}
+			if (split.sawBoundary) {
+				matchedAnyBoundary = true;
+				dropLeadingFragment = false;
+			}
+			bufferedBytes = split.tail;
+			for (const block of split.blocks) dispatchBlock(block);
+			if (!dropLeadingFragment) {
+				const early = takeCompletePart(bufferedBytes);
+				if (early) {
+					dispatchBlock(early.block);
+					bufferedBytes = early.rest;
+					dropLeadingFragment = true;
+				}
+			}
+			if (!matchedAnyBoundary && bufferedBytes.byteLength >= unparsedWarnBytes) diagnostics.report("boundary-never-matched", "hikvision alarm stream: no multipart boundary found in the buffered bytes — every part is being dropped", {
+				declaredBoundary,
+				activeBoundary,
+				bufferedBytes: bufferedBytes.byteLength,
+				firstDashLine: firstDashLineOf(bufferedBytes),
+				firstLine: firstLineOf(bufferedBytes)
+			});
+			if (bufferedBytes.byteLength > maxBufferBytes) {
+				diagnostics.report("buffer-overflow", "hikvision alarm stream: unparsed multipart buffer hit its cap — discarding the head", {
+					declaredBoundary,
+					activeBoundary,
+					matchedAnyBoundary,
+					bufferedBytes: bufferedBytes.byteLength,
+					maxBufferBytes,
+					retainBytes,
+					firstDashLine: firstDashLineOf(bufferedBytes),
+					firstLine: firstLineOf(bufferedBytes)
+				});
+				bufferedBytes = bufferedBytes.slice(bufferedBytes.byteLength - retainBytes);
+				dropLeadingFragment = true;
+			}
 		}
 	} finally {
 		if (idleTimer) clearTimeout(idleTimer);
@@ -40808,17 +40998,42 @@ function concat(a, b) {
 	out.set(b, a.byteLength);
 	return out;
 }
-function splitOnBoundary(buf, dashBoundary) {
+function splitOnBoundary(buf, dashBoundary, dropLeadingFragment) {
 	const parts = Buffer.from(buf).toString("binary").split(dashBoundary);
 	if (parts.length <= 1) return {
 		blocks: [],
-		tail: buf
+		tail: buf,
+		sawBoundary: false
 	};
 	const tail = Buffer.from(parts.pop(), "binary");
-	parts.shift();
+	if (dropLeadingFragment) parts.shift();
 	return {
 		blocks: parts.filter((p) => p.length > 0 && !p.startsWith("--")).map((p) => Buffer.from(p, "binary")),
-		tail
+		tail,
+		sawBoundary: true
+	};
+}
+function parseContentLength(headerBlob) {
+	const m = /^content-length\s*:\s*(\d+)\s*$/im.exec(headerBlob);
+	if (!m) return null;
+	const n = Number.parseInt(m[1], 10);
+	return Number.isSafeInteger(n) && n >= 0 ? n : null;
+}
+/**
+* If `buf` (which must start immediately after a boundary) already holds a
+* whole part per its `Content-Length`, return it and the leftover bytes.
+* Firmware that omits `Content-Length` falls back to boundary-framed delivery.
+*/
+function takeCompletePart(buf) {
+	const headerEnd = findHeaderEnd(buf, 0);
+	if (headerEnd < 0) return null;
+	const contentLength = parseContentLength(Buffer.from(buf.subarray(0, headerEnd)).toString("utf8"));
+	if (contentLength === null) return null;
+	const end = headerEnd + 4 + contentLength;
+	if (buf.byteLength < end) return null;
+	return {
+		block: buf.slice(0, end),
+		rest: buf.slice(end)
 	};
 }
 function looksLikeAlertXml(text) {
@@ -40833,10 +41048,16 @@ function parseMultipartBlock(block) {
 		bodySlice = block.subarray(headerEnd + 4);
 	} else {
 		const raw = Buffer.from(block).toString("utf8");
-		if (!looksLikeAlertXml(raw)) return null;
+		if (!looksLikeAlertXml(raw)) return {
+			ok: false,
+			reason: "no-header-separator-and-not-alert-xml"
+		};
 		return {
-			contentType: "",
-			bodyText: raw.replace(/\r?\n--$/m, "").trim()
+			ok: true,
+			block: {
+				contentType: "",
+				bodyText: raw.replace(/\r?\n--$/m, "").trim()
+			}
 		};
 	}
 	const headers = {};
@@ -40846,8 +41067,11 @@ function parseMultipartBlock(block) {
 		headers[line.slice(0, idx).trim().toLowerCase()] = line.slice(idx + 1).trim();
 	}
 	return {
-		contentType: headers["content-type"] ?? "",
-		bodyText: Buffer.from(bodySlice).toString("utf8").replace(/\r?\n--$/m, "").trim()
+		ok: true,
+		block: {
+			contentType: headers["content-type"] ?? "",
+			bodyText: Buffer.from(bodySlice).toString("utf8").replace(/\r?\n--$/m, "").trim()
+		}
 	};
 }
 function findHeaderEnd(buf, from) {
@@ -44522,6 +44746,9 @@ var HikvisionCamera = class HikvisionCamera extends BaseDevice {
 				this.alarmController = null;
 				this.scheduleAlarmReconnect();
 			}
+		}, {
+			logger: this.ctx.logger,
+			deviceId: this.id
 		});
 	}
 	scheduleAlarmReconnect() {

package/dist/addon.mjs

@@ -7,7 +7,7 @@ import { networkInterfaces } from "node:os";
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 //#endregion
-//#region ../types/dist/event-category-C0lyLd5U.mjs
+//#region ../types/dist/event-category-XfKNtfCc.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -46,6 +46,22 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["AddonInstalled"] = "addon.installed";
 	EventCategory["AddonUninstalled"] = "addon.uninstalled";
 	EventCategory["AddonCrashed"] = "addon.crashed";
+	/**
+	* A RUNNER the D6 crash circuit-breaker gave up on — terminal.
+	*
+	* `AddonCrashed` is the routine, self-healing fact ("it crashed; it is being
+	* respawned"); this is the one that never resolves itself. Emitted exactly
+	* once per trip, by `process-service.ts`, carrying the node, the runner, the
+	* addons it hosted and the crash count that tripped the breaker.
+	*
+	* It exists because a runner marked terminally `failed` used to be SILENT:
+	* on 2026-08-18 the `recorder` runner died of three unhandled ffmpeg spawn
+	* errors, the breaker stopped respawning it (correctly), `/health` kept
+	* returning 200, and fleet-wide recording was gone for 3h15 before the
+	* operator's phone told him. The Notification Center's system-event intake
+	* consumes this category and maps it to the `addon-crash-loop` kind.
+	*/
+	EventCategory["AddonRunnerFailed"] = "addon.runner-failed";
 	EventCategory["AddonError"] = "addon.error";
 	EventCategory["AddonPageReady"] = "addon.page-ready";
 	EventCategory["AddonWidgetReady"] = "addon.widget-ready";
@@ -14738,6 +14754,7 @@ var NcSystemEventKindSchema = _enum([
 	"node-offline",
 	"node-inference-unavailable",
 	"detection-blind",
+	"addon-crash-loop",
 	"addon-update-available",
 	"server-update-available",
 	"alarm-triggered",
@@ -20475,20 +20492,6 @@ var VectorStatsResultSchema = object({
 	exact: boolean()
 });
 method(VectorDeclareIndexInputSchema, _void(), { kind: "mutation" }), method(VectorUpsertInputSchema, VectorUpsertResultSchema, { kind: "mutation" }), method(VectorQueryInputSchema, VectorQueryResultSchema), method(VectorGetInputSchema, VectorGetResultSchema), method(VectorDeleteInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorStatsInputSchema, VectorStatsResultSchema);
-/**
-* `videoclips` — the unified, navigable-clip surface for a camera.
-*
-* A device-scoped WRAPPER cap (like `pipeline-analytics`): exactly one active
-* provider per device, substitutable. The DEFAULT provider (registered by
-* `addon-post-analysis`, `defaultActive: true`) composes the analytics event
-* log (markers + thumbnails) with the recorder's `getPlaybackManifest` — a clip
-* is a time-WINDOW over existing footage, never a separate file. A camera that
-* exposes NATIVE onboard clips (Reolink/Hikvision NVR) can later substitute the
-* wrapper provider for its device and serve its own clip catalog + URLs.
-*
-* A `Clip` is purely time-based (subtree-blind): playback resolves segments by
-* temporal overlap, so the API never decides `continuous` vs `events`.
-*/
 var ClipSchema = object({
 	/** Opaque, provider-namespaced id. The default provider encodes the time
 	*  window so `getClipPlayback` is self-contained (no event re-query). */
@@ -20514,12 +20517,41 @@ var ClipSchema = object({
 	* of the event that owns `kind` (object > motion > audio). Do not extract
 	* a keyframe from the recorded segments. Other providers (onboard, HKSV)
 	* mint their own stills.
+	*
+	* **VOUCHED, never fabricated.** A provider emits this only for an event it
+	* has CONFIRMED owns at least one media row (its own, or its owning track's).
+	* Absent is meaningful — "this visit has no event still" — never "we did not
+	* look". Stamping it from a URL template made 35% of one camera's clips point
+	* at a 404 (device 3836, 2026-08-17: 64 of 179 clips dead, 63 of them motion).
+	* A read that FAILS drops the claim; it never invents it.
 	*/
 	thumbnail: string().optional(),
-	/** Analytics event ids that overlap this visit. Empty on footage-only clips.
-	*  The default provider's visit grain puts many motion heartbeats on one clip
-	*  instead of minting one clip per marker. */
+	/**
+	* An instant INSIDE this visit's footage, hole-safe, where a recorded still
+	* can be decoded. Present whenever the visit came from recorded availability;
+	* absent on a per-event padded window (there is no footage to promise).
+	*
+	* This is not a thumbnail and not a second byte path: it is the argument to
+	* the recorder's existing still route. The surface — never the provider —
+	* decides whether to use it. It is the midpoint of the visit's LONGEST
+	* contiguous range, not of the visit: a visit spans its holes by
+	* construction, so a naive midpoint lands in dead air.
+	*/
+	stillAtMs: number().optional(),
+	/**
+	* Analytics event ids that overlap this visit — a BOUNDED sample, newest
+	* first within kind (object → motion → audio), capped at
+	* {@link MAX_CLIP_EVENT_IDS}. Empty on footage-only clips.
+	*
+	* Bounded because it is not a payload the surface pages through: one visit on
+	* device 615 carried 2 345 ids, and `eventIds` was 99% of a 153 KB
+	* camera-day. Read {@link eventCount} for the true total.
+	*/
 	eventIds: array(string()).optional(),
+	/** How many analytics events actually overlap this visit. Differs from
+	*  `eventIds.length` exactly when the sample was capped — so a truncated
+	*  list is never mistaken for a quiet visit. */
+	eventCount: number().int().nonnegative().optional(),
 	/** Intra-visit footage holes (GOP rolls, discarded segments) still shorter
 	*  than `VISIT_MERGE_GAP_MS`. Playback concatenates around them; the timeline
 	*  bar keeps showing them via `recording.getAvailability`. */
@@ -20990,7 +21022,14 @@ var SearchResultSchema = object({
 });
 var AutoUpdateSettingsSchema = object({
 	channel: ChannelSchema,
-	intervalSeconds: number()
+	intervalSeconds: number(),
+	/**
+	* Cadence of the "an update exists" POLLER, in seconds. Independent of
+	* `channel`: the poller runs while auto-apply is `off`, because being told
+	* about a publish and installing it are different decisions. Clamped
+	* server-side to 900 s … 604800 s; defaults to 21600 s (6 h).
+	*/
+	updateCheckIntervalSeconds: number()
 });
 var AddonAutoUpdateSchema = ChannelWithInheritSchema;
 var RestartAddonResultSchema = unknown();
@@ -21131,7 +21170,9 @@ method(_void(), array(AddonListItemSchema).readonly()), method(object({
 	auth: "admin"
 }), method(_void(), AutoUpdateSettingsSchema, { auth: "admin" }), method(object({
 	channel: ChannelSchema,
-	intervalSeconds: number().min(300).max(86400).optional()
+	intervalSeconds: number().min(300).max(86400).optional(),
+	/** Availability-poll cadence; see AutoUpdateSettingsSchema. */
+	updateCheckIntervalSeconds: number().min(900).max(604800).optional()
 }), unknown(), {
 	kind: "mutation",
 	auth: "admin"
@@ -38135,6 +38176,8 @@ DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
+var MB = 1024 * 1024;
+1024 * MB, 3072 * MB;
 //#endregion
 //#region src/accessories/base.ts
 /**
@@ -40697,36 +40740,87 @@ function parseTwoWayAudioChannels(xml) {
 	return out;
 }
 /**
-* Idle watchdog for the alarm stream. Hikvision firmware emits a keep-alive
-* heartbeat (typically a `videoloss`/`inactive` alert) roughly every ~5s even
-* when nothing is happening, so a total absence of ANY bytes for this long
-* means the pipe is dead — either a half-open TCP connection (no FIN, no data)
-* that would otherwise block `reader.read()` forever, or a stalled proxy/NAT
-* conntrack entry between the hub and a camera on a different subnet. When it
-* fires we cancel the reader, surfacing a clean stream-end that the reconnect
-* path treats as a recoverable disconnect.
-*/
-var ALARM_STREAM_IDLE_TIMEOUT_MS = 3e4;
-/**
-* Subscribe to the camera's alarm stream. Returns an `AbortController`
-* — `controller.abort()` tears the subscription down. Reconnect logic
-* is the caller's responsibility (we keep the parser simple and let
-* the device class own the lifecycle / backoff timing).
-*
-* Every terminal outcome that is NOT a deliberate `controller.abort()` is
-* reported through `onError` exactly once, so the caller's reconnect logic
-* always fires:
-*   - HTTP / boundary failure at subscribe time,
-*   - a thrown error while pumping,
-*   - AND a clean stream-end (`done`). Hikvision cameras recycle the
-*     alertStream HTTP connection periodically (firmware keep-alive limits,
-*     internal event-subsystem restarts, or an idle NAT/proxy hop closing the
-*     socket). A clean close used to fall through silently — `onError` never
-*     fired, the caller's `alarmController` stayed non-null, and the device
-*     never resubscribed — so motion stopped permanently until the provider
-*     restarted. Treating clean-end as a recoverable disconnect closes that gap.
-*/
-function subscribeAlarms(client, handlers, idleTimeoutMs = ALARM_STREAM_IDLE_TIMEOUT_MS) {
+* Why the parser adopts the boundary it SEES rather than the one declared.
+*
+* Five cameras on `C-R-*` firmware (I91DN/I91DD V5.7.1, I91EV V5.8.10) have
+* never delivered one motion event here, while the same cameras deliver real
+* hardware VMD on the same endpoint to another NVR stack. The one dimension
+* where that stack is more permissive is the multipart boundary: it accepts a
+* part framed with the declared `--<boundary>` OR with the literal constant
+* `--boundary`, because "older hikvision send a boundary in the headers, but
+* then use a totally different constant boundary value".
+*
+* We take the general form instead of that special case: if the DECLARED
+* token has never once matched, adopt the token from the first `--…` line
+* actually on the wire and use it from then on. It subsumes the literal
+* `--boundary` case (that IS the observed token on those cameras) and it also
+* covers the next firmware that invents a third constant, which a hard-coded
+* fallback would not. The risk is bounded on both sides: adoption is only ever
+* attempted while the declared token has produced ZERO parts, the candidate
+* must occupy a whole line of RFC 2046 boundary characters, and the closing
+* delimiter (`--<token>--`) is rejected.
+*/
+function detectWireBoundary(buf) {
+	const text = Buffer.from(buf).toString("binary");
+	const lineRe = /(?:^|\r?\n)--([0-9A-Za-z'()+_,./:=?-]{1,70})\r?\n/g;
+	for (;;) {
+		const m = lineRe.exec(text);
+		if (!m) return null;
+		const token = m[1];
+		if (token.endsWith("--")) continue;
+		return token;
+	}
+}
+/**
+* First occurrence of each kind is logged immediately; further occurrences are
+* counted and folded into the next line after `intervalMs`. A stream that
+* drops every part therefore costs one line per minute per kind, not one per
+* chunk.
+*/
+function createAlarmDiagnostics(logger, deviceId, intervalMs) {
+	const lastLoggedAt = /* @__PURE__ */ new Map();
+	const suppressed = /* @__PURE__ */ new Map();
+	const report = (kind, message, meta, level = "warn") => {
+		if (!logger) return;
+		const now = Date.now();
+		const last = lastLoggedAt.get(kind);
+		if (last !== void 0 && now - last < intervalMs) {
+			suppressed.set(kind, (suppressed.get(kind) ?? 0) + 1);
+			return;
+		}
+		const since = suppressed.get(kind) ?? 0;
+		suppressed.set(kind, 0);
+		lastLoggedAt.set(kind, now);
+		const extras = {
+			...deviceId === null ? {} : { tags: { deviceId } },
+			meta: {
+				kind,
+				...meta,
+				...since > 0 ? { suppressedSincePrevious: since } : {}
+			}
+		};
+		if (level === "debug") logger.debug(message, extras);
+		else logger.warn(message, extras);
+	};
+	return { report };
+}
+/** First line of a buffer, clipped — the single most useful field when asking
+*  "what is this camera actually sending?". */
+function firstLineOf(buf, maxChars = 120) {
+	const line = Buffer.from(buf.subarray(0, 1024)).toString("utf8").split(/\r?\n/, 1)[0] ?? "";
+	return line.length > maxChars ? `${line.slice(0, maxChars)}…` : line;
+}
+/** First whole line that starts with `--` — i.e. the framing the camera really
+*  uses. `null` when the buffer contains no such line. */
+function firstDashLineOf(buf, maxChars = 120) {
+	const text = Buffer.from(buf.subarray(0, 4096)).toString("utf8");
+	for (const line of text.split(/\r?\n/)) {
+		if (!line.startsWith("--")) continue;
+		return line.length > maxChars ? `${line.slice(0, maxChars)}…` : line;
+	}
+	return null;
+}
+function subscribeAlarms(client, handlers, options = {}) {
 	const controller = new AbortController();
 	let settled = false;
 	const fail = (err) => {
@@ -40753,7 +40847,7 @@ function subscribeAlarms(client, handlers, idleTimeoutMs = ALARM_STREAM_IDLE_TIM
 				return;
 			}
 			handlers.onConnected?.();
-			await pumpAlarmStream(res.body, boundary, handlers, idleTimeoutMs);
+			await pumpAlarmStream(res.body, boundary, handlers, options);
 			fail(/* @__PURE__ */ new Error("alarm stream ended"));
 		} catch (err) {
 			fail(err);
@@ -40765,10 +40859,65 @@ function parseBoundary(contentType) {
 	const m = /boundary\s*=\s*"?([^";\s]+)"?/i.exec(contentType);
 	return m ? m[1].trim() : null;
 }
-async function pumpAlarmStream(stream, boundary, handlers, idleTimeoutMs = ALARM_STREAM_IDLE_TIMEOUT_MS) {
+async function pumpAlarmStream(stream, declaredBoundary, handlers, options) {
+	const idleTimeoutMs = options.idleTimeoutMs ?? 3e4;
+	const maxBufferBytes = options.maxBufferBytes ?? 1048576;
+	const retainBytes = options.retainBytes ?? 65536;
+	const unparsedWarnBytes = options.unparsedWarnBytes ?? 32768;
+	const diagnostics = createAlarmDiagnostics(options.logger ?? null, options.deviceId ?? null, options.diagnosticIntervalMs ?? 6e4);
 	const reader = stream.getReader();
-	const dashBoundary = `--${boundary}`;
+	let activeBoundary = declaredBoundary;
+	let activeDashBoundary = `--${activeBoundary}`;
+	/** Has the ACTIVE token ever framed anything? Gates boundary adoption. */
+	let matchedAnyBoundary = false;
+	/**
+	* Is the fragment that precedes the next boundary junk?
+	*
+	* True only at the head of the stream (RFC 1521 preamble), after we already
+	* emitted the bytes sitting in the buffer, and after the overflow cap cut
+	* the buffer mid-part. It used to be true unconditionally, which meant every
+	* split after the first DISCARDED a completed part — on a stream that
+	* delivers one part per TCP read, that is every event the camera ever sent.
+	*/
+	let dropLeadingFragment = true;
 	let bufferedBytes = new Uint8Array(0);
+	const dispatchBlock = (block) => {
+		const parsed = parseMultipartBlock(block);
+		if (!parsed.ok) {
+			diagnostics.report("part-unparseable", "hikvision alarm stream: multipart part dropped", {
+				reason: parsed.reason,
+				bytes: block.byteLength,
+				firstLine: firstLineOf(block)
+			});
+			return;
+		}
+		const { contentType, bodyText } = parsed.block;
+		if (!(contentType.startsWith("application/xml") || contentType.startsWith("text/xml") || looksLikeAlertXml(bodyText))) {
+			if (contentType.startsWith("image/")) {
+				diagnostics.report("part-image-ignored", "hikvision alarm stream: image part ignored (not forwarded yet)", {
+					contentType,
+					bytes: block.byteLength
+				}, "debug");
+				return;
+			}
+			diagnostics.report("part-not-alert-xml", "hikvision alarm stream: part dropped — neither an xml Content-Type nor alert-shaped XML", {
+				contentType,
+				bytes: block.byteLength,
+				bodyPreview: bodyText.slice(0, 120)
+			});
+			return;
+		}
+		const ev = parseAlertXml(bodyText);
+		if (!ev) {
+			diagnostics.report("alert-xml-without-event-type", "hikvision alarm stream: alert part dropped — no <eventType> tag", {
+				contentType,
+				bytes: block.byteLength,
+				bodyPreview: bodyText.slice(0, 120)
+			});
+			return;
+		}
+		handlers.onEvent(ev);
+	};
 	let idleTimer = null;
 	const armIdle = () => {
 		if (idleTimeoutMs <= 0) return;
@@ -40785,16 +40934,57 @@ async function pumpAlarmStream(stream, boundary, handlers, idleTimeoutMs = ALARM
 			armIdle();
 			if (!value || value.byteLength === 0) continue;
 			bufferedBytes = concat(bufferedBytes, value);
-			const parts = splitOnBoundary(bufferedBytes, dashBoundary);
-			bufferedBytes = parts.tail;
-			for (const block of parts.blocks) {
-				const parsed = parseMultipartBlock(block);
-				if (!parsed) continue;
-				if (parsed.contentType.startsWith("application/xml") || parsed.contentType.startsWith("text/xml") || looksLikeAlertXml(parsed.bodyText)) {
-					const ev = parseAlertXml(parsed.bodyText);
-					if (ev) handlers.onEvent(ev);
+			let split = splitOnBoundary(bufferedBytes, activeDashBoundary, dropLeadingFragment);
+			if (!split.sawBoundary && !matchedAnyBoundary) {
+				const observed = detectWireBoundary(bufferedBytes);
+				if (observed !== null && observed !== activeBoundary) {
+					diagnostics.report("boundary-adopted", "hikvision alarm stream: declared multipart boundary never matched — adopting the boundary seen on the wire", {
+						declaredBoundary,
+						observedBoundary: observed,
+						bufferedBytes: bufferedBytes.byteLength,
+						firstDashLine: firstDashLineOf(bufferedBytes),
+						firstLine: firstLineOf(bufferedBytes)
+					});
+					activeBoundary = observed;
+					activeDashBoundary = `--${observed}`;
+					split = splitOnBoundary(bufferedBytes, activeDashBoundary, dropLeadingFragment);
 				}
 			}
+			if (split.sawBoundary) {
+				matchedAnyBoundary = true;
+				dropLeadingFragment = false;
+			}
+			bufferedBytes = split.tail;
+			for (const block of split.blocks) dispatchBlock(block);
+			if (!dropLeadingFragment) {
+				const early = takeCompletePart(bufferedBytes);
+				if (early) {
+					dispatchBlock(early.block);
+					bufferedBytes = early.rest;
+					dropLeadingFragment = true;
+				}
+			}
+			if (!matchedAnyBoundary && bufferedBytes.byteLength >= unparsedWarnBytes) diagnostics.report("boundary-never-matched", "hikvision alarm stream: no multipart boundary found in the buffered bytes — every part is being dropped", {
+				declaredBoundary,
+				activeBoundary,
+				bufferedBytes: bufferedBytes.byteLength,
+				firstDashLine: firstDashLineOf(bufferedBytes),
+				firstLine: firstLineOf(bufferedBytes)
+			});
+			if (bufferedBytes.byteLength > maxBufferBytes) {
+				diagnostics.report("buffer-overflow", "hikvision alarm stream: unparsed multipart buffer hit its cap — discarding the head", {
+					declaredBoundary,
+					activeBoundary,
+					matchedAnyBoundary,
+					bufferedBytes: bufferedBytes.byteLength,
+					maxBufferBytes,
+					retainBytes,
+					firstDashLine: firstDashLineOf(bufferedBytes),
+					firstLine: firstLineOf(bufferedBytes)
+				});
+				bufferedBytes = bufferedBytes.slice(bufferedBytes.byteLength - retainBytes);
+				dropLeadingFragment = true;
+			}
 		}
 	} finally {
 		if (idleTimer) clearTimeout(idleTimer);
@@ -40809,17 +40999,42 @@ function concat(a, b) {
 	out.set(b, a.byteLength);
 	return out;
 }
-function splitOnBoundary(buf, dashBoundary) {
+function splitOnBoundary(buf, dashBoundary, dropLeadingFragment) {
 	const parts = Buffer.from(buf).toString("binary").split(dashBoundary);
 	if (parts.length <= 1) return {
 		blocks: [],
-		tail: buf
+		tail: buf,
+		sawBoundary: false
 	};
 	const tail = Buffer.from(parts.pop(), "binary");
-	parts.shift();
+	if (dropLeadingFragment) parts.shift();
 	return {
 		blocks: parts.filter((p) => p.length > 0 && !p.startsWith("--")).map((p) => Buffer.from(p, "binary")),
-		tail
+		tail,
+		sawBoundary: true
+	};
+}
+function parseContentLength(headerBlob) {
+	const m = /^content-length\s*:\s*(\d+)\s*$/im.exec(headerBlob);
+	if (!m) return null;
+	const n = Number.parseInt(m[1], 10);
+	return Number.isSafeInteger(n) && n >= 0 ? n : null;
+}
+/**
+* If `buf` (which must start immediately after a boundary) already holds a
+* whole part per its `Content-Length`, return it and the leftover bytes.
+* Firmware that omits `Content-Length` falls back to boundary-framed delivery.
+*/
+function takeCompletePart(buf) {
+	const headerEnd = findHeaderEnd(buf, 0);
+	if (headerEnd < 0) return null;
+	const contentLength = parseContentLength(Buffer.from(buf.subarray(0, headerEnd)).toString("utf8"));
+	if (contentLength === null) return null;
+	const end = headerEnd + 4 + contentLength;
+	if (buf.byteLength < end) return null;
+	return {
+		block: buf.slice(0, end),
+		rest: buf.slice(end)
 	};
 }
 function looksLikeAlertXml(text) {
@@ -40834,10 +41049,16 @@ function parseMultipartBlock(block) {
 		bodySlice = block.subarray(headerEnd + 4);
 	} else {
 		const raw = Buffer.from(block).toString("utf8");
-		if (!looksLikeAlertXml(raw)) return null;
+		if (!looksLikeAlertXml(raw)) return {
+			ok: false,
+			reason: "no-header-separator-and-not-alert-xml"
+		};
 		return {
-			contentType: "",
-			bodyText: raw.replace(/\r?\n--$/m, "").trim()
+			ok: true,
+			block: {
+				contentType: "",
+				bodyText: raw.replace(/\r?\n--$/m, "").trim()
+			}
 		};
 	}
 	const headers = {};
@@ -40847,8 +41068,11 @@ function parseMultipartBlock(block) {
 		headers[line.slice(0, idx).trim().toLowerCase()] = line.slice(idx + 1).trim();
 	}
 	return {
-		contentType: headers["content-type"] ?? "",
-		bodyText: Buffer.from(bodySlice).toString("utf8").replace(/\r?\n--$/m, "").trim()
+		ok: true,
+		block: {
+			contentType: headers["content-type"] ?? "",
+			bodyText: Buffer.from(bodySlice).toString("utf8").replace(/\r?\n--$/m, "").trim()
+		}
 	};
 }
 function findHeaderEnd(buf, from) {
@@ -44523,6 +44747,9 @@ var HikvisionCamera = class HikvisionCamera extends BaseDevice {
 				this.alarmController = null;
 				this.scheduleAlarmReconnect();
 			}
+		}, {
+			logger: this.ctx.logger,
+			deviceId: this.id
 		});
 	}
 	scheduleAlarmReconnect() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-hikvision",
-  "version": "1.2.27",
+  "version": "1.2.28",
   "description": "Hikvision camera device provider addon for CamStack — ISAPI over HTTP(S) with digest auth (snapshot, alarm stream, RTSP discovery)",
   "keywords": [
     "camstack",