@camstack/addon-provider-hikvision 1.2.40 → 1.2.42

package/dist/addon.js

@@ -7463,6 +7463,111 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
+*
+* ## Two axes, deliberately separated
+*
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
+*
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
+*
+* ## The canonical call shape
+*
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
+*
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
+*
+* ## Why a channel emits at `info`
+*
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
+*/
+/**
+* The level a channel writes at once armed.
+*
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
+*/
+var LogChannelLevelSchema = _enum([
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
+*/
+var LogChannelDescriptorSchema = object({
+	/**
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
+	*/
+	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
+	/**
+	* Whether this channel can be narrowed to a camera.
+	*
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
+	*/
+	perDevice: boolean()
+});
+/**
+* An armed window over one channel, as the document hands it to a mirror.
+*
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
+*/
+var LogChannelWindowSchema = object({
+	channel: string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: array(number().int()).readonly().nullable()
+});
+/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -11270,6 +11375,35 @@ var MutationFilterSchema = object({
 	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
 	whereNot: record(string(), unknown()).optional()
 });
+/**
+* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
+*
+* `as` names the slot in the result, so the SAME column may be asked twice with
+* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
+* a `Record<column, op>` shape could not express.
+*/
+var AggregateFieldSchema = object({
+	/** Result key. */
+	as: string().min(1),
+	/** Column to aggregate. Must be a real column of a declared collection. */
+	field: string().min(1),
+	op: _enum([
+		"sum",
+		"min",
+		"max"
+	])
+});
+/**
+* `COUNT(*)` plus one number per requested field.
+*
+* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
+* that really is 0 are different facts, and an accounting caller that renders
+* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
+*/
+var AggregateResultSchema = object({
+	count: number().int(),
+	values: record(string(), number().nullable())
+});
 /** A single stored record: `{ id, data }`. */
 var SettingsRecordSchema = object({
 	id: string(),
@@ -11354,6 +11488,11 @@ method(object({
 	collection: string(),
 	filter: QueryFilterSchema.optional()
 }), number()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	fields: array(AggregateFieldSchema).readonly(),
+	filter: QueryFilterSchema.optional()
+}), AggregateResultSchema), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	field: string(),
@@ -11470,6 +11609,11 @@ method(_void(), EngineInfoSchema, { auth: "admin" }), method(object({
 	collection: string(),
 	filter: QueryFilterSchema.optional()
 }), number(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	fields: array(AggregateFieldSchema).readonly(),
+	filter: QueryFilterSchema.optional()
+}), AggregateResultSchema, { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	field: string(),
@@ -12193,24 +12337,6 @@ var deviceProviderCapability = {
 		})
 	}
 };
-/**
-* Device Manager capability — hub-side singleton that unifies device persistence,
-* live registry access, and all management operations into a single tRPC surface.
-*
-* Replaces:
-*   - `device-persistence` capability (persistence methods absorbed here)
-*   - `device-management.router.ts` (deleted in Phase 2)
-*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
-*
-* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
-* fork into separate processes but never run on remote cluster agents. Therefore:
-*   - No nodeId routing needed — this is a pure hub singleton.
-*   - The hub's DeviceRegistry is the single source of truth for all live devices.
-*   - No shadow registry or cross-node aggregation required.
-*
-* Forked workers register devices back to the hub via `ctx.devices`
-* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
-*/
 /** One child-placement directive on a container's `childLayout`. Structurally
 *  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
 *  shape for the same field. The child is identified by its re-sync-stable
@@ -12579,7 +12705,7 @@ method(object({
 	* it answers today and the caller filters as it already does.
 	*/
 	deviceIds: array(number()).optional()
-}), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
+}), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ parentDeviceIds: array(number()).max(256) }), record(string(), array(DeviceInfoSchema))), method(object({ deviceId: number() }), object({
 	mode: LinkedDevicesModeSchema,
 	devices: array(LinkedDeviceSchema)
 })), method(object({ deviceIds: array(number()) }), array(LinkedDevicesForDeviceSchema)), method(object({ deviceId: number() }), array(StreamSourceEntrySchema$1)), method(object({ deviceId: number() }), array(ConfigEntrySchema)), method(object({ deviceId: number() }), ConfigUISchemaOutput), method(object({
@@ -13303,6 +13429,59 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* `log-channels` — the capability an addon DECLARES its diagnostic channels
+* through. It stores nothing.
+*
+* ## Why a capability at all, and why this shape
+*
+* Which channels exist is knowledge only the addon has: `stream-broker` knows
+* webrtc/ICE/RTP, `provider-reolink` knows baichuan/handshake. A central list
+* maintained by hand rots at the first addition and rots INVISIBLY — nothing
+* fails, an operator just never sees the channel somebody added. So the list
+* is assembled from declarations at runtime.
+*
+* The shape is copied from `log-destination.cap.ts`, which already does
+* exactly this job: `mode: 'collection'`, `internal: true`,
+* `mount: { kind: 'skip' }` — no tRPC route, no generated hooks — while
+* `addons.listCapabilityProviders` still enumerates it, and the hub's
+* `CapabilityRegistry` still holds an RPC proxy per provider so a forked
+* runner's declarations reach hub-main over the transport that already exists.
+* No new UDS message, no second registry.
+*
+* ## What it deliberately does NOT own
+*
+* The VALUES — which channel is armed, for which cameras, until when — live in
+* ONE place: the logging settings document on the `system` cap
+* (`getLoggingSettings` / `setLoggingSettings`). Two authorities over the same
+* value is the defect the plan behind this work exists to remove, and
+* `setRequestCensus` was retired (D245) rather than allowed to be a second
+* one. {@link logChannelsCapability} therefore has no getter for a level, no
+* setter for a window and no persistence of any kind.
+*
+* ## Why `apply` is here even so
+*
+* The gate lives in the addon's PROCESS; the document lives in hub-main. Some
+* seam has to carry the value from the authority to the mirror, and a channel
+* that cannot be reached is precisely the dead knob this whole slice exists to
+* make impossible (D62 — `audioThresholdDbfs`, the HA entities with no source).
+* `apply` is that seam and nothing more: it writes an in-memory mirror, it
+* persists nothing, it is never the source of a value, and it is called only
+* with a set the hub actually read (D49 — a read that fails does not call it
+* at all, so no channel is silently disarmed by a bad read).
+*/
+/** What `apply` reports back — enough to log, not enough to be a second state. */
+var LogChannelApplyResultSchema = object({
+	/** How many declared channels are armed in this process after the call. */
+	armed: number().int().min(0),
+	/**
+	* Names the document armed that this process does not declare. Reported
+	* rather than swallowed: a name here is either a typo or an addon that has
+	* not booted, and both deserve a line instead of silence.
+	*/
+	unknown: array(string()).readonly()
+});
+method(_void(), array(LogChannelDescriptorSchema).readonly()), method(object({ windows: array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" });
 var LogLevelSchema = _enum([
 	"debug",
 	"info",
@@ -29182,10 +29361,11 @@ var DiagnosticIdSchema = _enum(["request-census"]);
 * The layers of the level hierarchy, general → specific. The most specific
 * layer that carries an explicit value wins.
 *
-* `component` is DECLARED and not yet resolvable: the per-component channels
-* are a later slice of the same plan, and a `levelSource` enum that has to
-* grow later would force every consumer of this document to change with it.
-* Nothing returns `component` today.
+* `component` became RESOLVABLE on 2026-08-27: a component is a declared log
+* CHANNEL (`stream-broker.webrtc`, `provider-reolink.baichuan`), named by
+* `scopeComponent`. It was declared-but-dark in the first slice precisely so
+* that turning it on would not force every consumer of this document to widen
+* a `levelSource` enum — which is what has now not happened.
 */
 var LoggingScopeKindSchema = _enum([
 	"cluster",
@@ -29212,6 +29392,14 @@ var LoggingLevelLayerSchema = object({
 	scope: LoggingScopeKindSchema,
 	/** The node this layer speaks for; `null` on the cluster layer. */
 	nodeId: string().nullable(),
+	/**
+	* The declared channel this layer speaks for; `null` on every layer but
+	* `component`. Never folded into `nodeId`: a component level is CLUSTER-WIDE
+	* by design — the convention this repo settled on is one orchestrator-wide
+	* setting, never per node (D52) — so a component layer that carried a node
+	* would invite a per-node copy of a value that has no per-node meaning.
+	*/
+	component: string().nullable(),
 	/** Explicitly set here, or `null` when this layer inherits. */
 	level: LogLevelSchema$1.nullable()
 });
@@ -29253,6 +29441,49 @@ var DiagnosticWindowPatchSchema = object({
 	reportEveryMs: number().int().positive().optional()
 });
 /**
+* A channel ARMED, as the document reports it.
+*
+* `armMs` is not echoed back: what an operator needs to see is the deadline
+* and the time left, because a diagnostic left running is itself an incident
+* and "armed for 10 minutes" said an hour ago is not an answer.
+*/
+var LogChannelWindowStateSchema = object({
+	channel: string(),
+	armed: boolean(),
+	/** Epoch ms the window closes at. 0 when disarmed. */
+	armedUntilMs: number(),
+	/** Ms left before it expires on its own. 0 when disarmed. */
+	remainingMs: number(),
+	/**
+	* The cameras it is narrowed to, or `null` for every camera.
+	*
+	* A channel declared `perDevice: false` can only ever report `null` here:
+	* its lines do not carry `tags: { deviceId }`, so narrowing them would
+	* produce a filter that silently matches nothing. The server REFUSES such a
+	* patch rather than quietly widening it — ignoring the request would teach
+	* the operator that per-camera filtering works on that channel when it does
+	* not.
+	*/
+	deviceIds: array(number().int()).readonly().nullable()
+});
+/**
+* `armMs: 0` DISARMS. Same grammar as {@link DiagnosticWindowPatchSchema}, and
+* for the same reason: a channel is a window with a deadline, never a switch.
+*/
+var LogChannelWindowPatchSchema = object({
+	channel: string().min(1),
+	armMs: number().int().min(0),
+	/**
+	* Narrow to these numeric device ids. Absent or `null` = every camera.
+	*
+	* Numeric because the repo's own rule makes it possible: every log line
+	* about a device carries `tags: { deviceId }` with the numeric id. That rule
+	* was paid for with a 22% thumbnail gap and a 3-hour media blackout both
+	* diagnosed by hand, and this is the first thing that collects on it.
+	*/
+	deviceIds: array(number().int()).readonly().nullable().optional()
+});
+/**
 * A PATCH, and patches MERGE.
 *
 * A field absent from the patch is left exactly as it was — arming a
@@ -29271,7 +29502,14 @@ var LoggingSettingsPatchSchema = object({
 	* Only the diagnostics NAMED here change. An armed window that is not listed
 	* keeps running — a patch is never a full replacement.
 	*/
-	diagnostics: array(DiagnosticWindowPatchSchema).readonly().optional()
+	diagnostics: array(DiagnosticWindowPatchSchema).readonly().optional(),
+	/**
+	* Only the channels NAMED here change. An armed channel that is not listed
+	* keeps running — same rule as `diagnostics`, because a patch that silently
+	* disarmed the channels it did not mention would make the Levels page and
+	* the Diagnostics page fight over the same value.
+	*/
+	channels: array(LogChannelWindowPatchSchema).readonly().optional()
 });
 /**
 * Which LAYER of the hierarchy is addressed. Absent = the cluster layer.
@@ -29284,9 +29522,22 @@ var LoggingSettingsPatchSchema = object({
 * authority over the whole hierarchy and answers for every layer, so the
 * layer selector needs a name the transport does not already own.
 */
-var GetLoggingSettingsInputSchema = object({ scopeNodeId: string().optional() });
+var GetLoggingSettingsInputSchema = object({
+	scopeNodeId: string().optional(),
+	/**
+	* The declared CHANNEL this document is addressed at, when the caller wants
+	* the `component` layer. Absent = the node/cluster hierarchy only.
+	*
+	* Naming it separately rather than overloading `scopeNodeId` keeps the two
+	* axes from collapsing: a component level is cluster-wide, a node level is
+	* not, and one selector for both would make "which of these two did I just
+	* set" unanswerable — the exact ambiguity `explicit` exists to remove.
+	*/
+	scopeComponent: string().optional()
+});
 var SetLoggingSettingsInputSchema = object({
 	scopeNodeId: string().optional(),
+	scopeComponent: string().optional(),
 	patch: LoggingSettingsPatchSchema
 });
 /**
@@ -29301,9 +29552,20 @@ var SetLoggingSettingsInputSchema = object({
 var LoggingSettingsStateSchema = object({
 	/** The layer this document was read at. `null` = the cluster layer. */
 	scopeNodeId: string().nullable(),
+	/** The channel this document was read at. `null` = no component layer. */
+	scopeComponent: string().nullable(),
 	effective: LoggingEffectiveSchema,
 	explicit: LoggingExplicitSchema,
 	activeWindows: array(DiagnosticWindowSchema).readonly(),
+	/**
+	* Every channel the cluster's addons DECLARE, gathered from the
+	* `log-channels` providers. Not stored anywhere: assembled per read, so a
+	* channel added by a redeployed addon appears without anybody editing a
+	* list, and a channel whose addon is gone stops being offered.
+	*/
+	channels: array(LogChannelDescriptorSchema).readonly(),
+	/** The channels ARMED right now, each with its deadline. */
+	activeChannels: array(LogChannelWindowStateSchema).readonly(),
 	persisted: boolean()
 });
 method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
@@ -32521,6 +32783,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"dataStoreProvider.aggregate": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"dataStoreProvider.count": {
 		capName: "data-store-provider",
 		capScope: "system",
@@ -32935,6 +33203,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getChildrenBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getConfigSchema": {
 		capName: "device-manager",
 		capScope: "system",
@@ -33985,6 +34259,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"logChannels.apply": {
+		capName: "log-channels",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"logChannels.list": {
+		capName: "log-channels",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"logDestination.query": {
 		capName: "log-destination",
 		capScope: "system",
@@ -36139,6 +36425,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.aggregate": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"settingsStore.count": {
 		capName: "settings-store",
 		capScope: "system",
@@ -37718,6 +38010,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.getChildrenBatch": [{
+		name: "parentDeviceIds",
+		form: "array",
+		optional: false
+	}],
 	"deviceManager.getConfigSchema": [{
 		name: "deviceId",
 		form: "single",
@@ -40184,6 +40481,38 @@ function createAccessoryDevice(kind, ctx, parent) {
 		default: throw new Error(`Hikvision provider does not implement accessory kind "${String(kind)}"`);
 	}
 }
+function createAlarmTypeTally(deps) {
+	const intervalMs = deps.intervalMs ?? 3e5;
+	const lastLoggedAt = /* @__PURE__ */ new Map();
+	const suppressed = /* @__PURE__ */ new Map();
+	const note = (type, state, reason) => {
+		const logger = deps.logger;
+		if (!logger) return;
+		const key = `${type}/${state ?? "none"}`;
+		const now = Date.now();
+		const last = lastLoggedAt.get(key);
+		if (last !== void 0 && now - last < intervalMs) {
+			suppressed.set(key, (suppressed.get(key) ?? 0) + 1);
+			return;
+		}
+		const count = (suppressed.get(key) ?? 0) + 1;
+		suppressed.set(key, 0);
+		lastLoggedAt.set(key, now);
+		const extras = {
+			...deps.deviceId === null ? {} : { tags: { deviceId: deps.deviceId } },
+			meta: {
+				type,
+				state,
+				count,
+				...last === void 0 ? { first: true } : { windowMs: now - last },
+				...reason === void 0 ? {} : { reason }
+			}
+		};
+		if (deps.level === "debug") logger.debug(deps.message, extras);
+		else logger.info(deps.message, extras);
+	};
+	return { note };
+}
 //#endregion
 //#region src/hikvision-channel-fps.ts
 /**
@@ -40269,6 +40598,24 @@ function buildAuthHeader(input) {
 	return `Digest ${parts.join(", ")}`;
 }
 //#endregion
+//#region src/hikvision-alarm-ignore.ts
+var IGNORED_ALARMS = new Map([["videoloss", {
+	states: ["inactive"],
+	reason: "alertStream keep-alive: \"no video loss\" repeated every ~5s by firmware whether or not anything happened. It carries no edge and no state we do not already hold — the stream being alive is already tracked by the idle watchdog, and camera liveness by markOnline(). Measured at 83 200 events / 12 h (116/min) across the fleet, all byte-identical."
+}]]);
+/**
+* The reason this `(type, state)` is deliberately not acted on, or `null` when
+* the event must be delivered.
+*
+* Both arguments are expected lowercased, matching `eventType` / `eventState`
+* as normalised by the alert parser.
+*/
+function hikvisionIgnoredAlarmReason(type, state) {
+	const policy = IGNORED_ALARMS.get(type);
+	if (!policy) return null;
+	return policy.states.includes(state) ? policy.reason : null;
+}
+//#endregion
 //#region src/hikvision-snapshot-channel.ts
 /**
 * Hikvision encodes a channel id as `{cameraNumber}{streamSlot}`; slot `1` is
@@ -42355,6 +42702,13 @@ async function pumpAlarmStream(stream, declaredBoundary, handlers, options) {
 	const retainBytes = options.retainBytes ?? 65536;
 	const unparsedWarnBytes = options.unparsedWarnBytes ?? 32768;
 	const diagnostics = createAlarmDiagnostics(options.logger ?? null, options.deviceId ?? null, options.diagnosticIntervalMs ?? 6e4);
+	const ignoredTally = createAlarmTypeTally({
+		logger: options.logger ?? null,
+		deviceId: options.deviceId ?? null,
+		message: "hikvision alarm stream: ignored alarm type (declared policy)",
+		level: "debug",
+		...options.ignoredTallyIntervalMs === void 0 ? {} : { intervalMs: options.ignoredTallyIntervalMs }
+	});
 	const reader = stream.getReader();
 	let activeBoundary = declaredBoundary;
 	let activeDashBoundary = `--${activeBoundary}`;
@@ -42397,8 +42751,8 @@ async function pumpAlarmStream(stream, declaredBoundary, handlers, options) {
 			});
 			return;
 		}
-		const ev = parseAlertXml(bodyText);
-		if (!ev) {
+		const peeked = peekAlertTypeState(bodyText);
+		if (!peeked) {
 			diagnostics.report("alert-xml-without-event-type", "hikvision alarm stream: alert part dropped — no <eventType> tag", {
 				contentType,
 				bytes: block.byteLength,
@@ -42406,7 +42760,12 @@ async function pumpAlarmStream(stream, declaredBoundary, handlers, options) {
 			});
 			return;
 		}
-		handlers.onEvent(ev);
+		const ignoredReason = hikvisionIgnoredAlarmReason(peeked.type, peeked.state);
+		if (ignoredReason !== null) {
+			ignoredTally.note(peeked.type, peeked.state, ignoredReason);
+			return;
+		}
+		handlers.onEvent(parseAlertXml(bodyText, peeked));
 	};
 	let idleTimer = null;
 	const armIdle = () => {
@@ -42591,10 +42950,22 @@ function isHikvisionMotionAlarmType(type) {
 function isHikvisionSmartAlarmType(type) {
 	return type !== "vmd" && type !== "motiondetection" && isHikvisionMotionAlarmType(type);
 }
-function parseAlertXml(xml) {
+function peekAlertTypeState(xml) {
 	const type = extractTag(xml, "eventType");
 	if (!type) return null;
 	const state = extractTag(xml, "eventState");
+	return {
+		type: type.toLowerCase(),
+		state: state?.toLowerCase() ?? null
+	};
+}
+/**
+* Build the full event. Takes the already-peeked `(type, state)` so the two
+* tags are extracted exactly once, and so this function has no failure mode
+* left: `peekAlertTypeState` returning non-null IS the precondition, and the
+* caller has already reported the only way it can fail.
+*/
+function parseAlertXml(xml, peeked) {
 	const channelId = extractTag(xml, "dynChannelID") ?? extractTag(xml, "channelID");
 	const description = extractTag(xml, "eventDescription") ?? extractTag(xml, "description");
 	const aiClass = extractTag(xml, "targetType") ?? extractTag(xml, "className");
@@ -42606,8 +42977,8 @@ function parseAlertXml(xml) {
 	})();
 	return {
 		observedAt: Date.now(),
-		type: type.toLowerCase(),
-		state: state?.toLowerCase() ?? null,
+		type: peeked.type,
+		state: peeked.state,
 		channelId,
 		aiClass,
 		description,
@@ -44135,6 +44506,25 @@ var HikvisionCamera = class HikvisionCamera extends BaseDevice {
 	alarmReconnectAttempts = 0;
 	/** Pending alarm-reconnect timer. */
 	alarmReconnectTimer = null;
+	/**
+	* Counting reporter for alarm types the camera receives but does not model.
+	*
+	* Built lazily so it can capture `this.id` / `this.ctx.logger` — every line
+	* it emits carries the numeric `deviceId`. It keeps the historical message
+	* text (`hikvision: unhandled alarm event`) so existing Loki queries keep
+	* working; what changed is that the line now carries `meta.count` and arrives
+	* once per window instead of once per event.
+	*/
+	unhandledAlarmsTally = null;
+	get unhandledAlarms() {
+		this.unhandledAlarmsTally ??= createAlarmTypeTally({
+			logger: this.ctx.logger,
+			deviceId: this.id,
+			message: "hikvision: unhandled alarm event",
+			level: "info"
+		});
+		return this.unhandledAlarmsTally;
+	}
 	/** Hysteresis: drop motion-active back to inactive after this many ms with
 	*  no fresh `VMD` event. Hikvision fires VMD every ~1s while motion is
 	*  active; missing 2 ticks signals the burst is over. */
@@ -46360,22 +46750,17 @@ var HikvisionCamera = class HikvisionCamera extends BaseDevice {
 			return;
 		}
 		if (ev.type === "videoloss") {
-			this.ctx.logger.debug("hikvision: unhandled alarm event", {
+			this.ctx.logger.warn("hikvision: camera reports video signal loss", {
 				tags: { deviceId: this.id },
 				meta: {
 					type: ev.type,
-					state: ev.state
+					state: ev.state,
+					camStreamId
 				}
 			});
 			return;
 		}
-		this.ctx.logger.info("hikvision: unhandled alarm event", {
-			tags: { deviceId: this.id },
-			meta: {
-				type: ev.type,
-				state: ev.state
-			}
-		});
+		this.unhandledAlarms.note(ev.type, ev.state);
 	}
 	resolveAlarmCamStreamId(channelId) {
 		if (!channelId) return "native:main";

package/dist/addon.mjs

@@ -7464,6 +7464,111 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
+*
+* ## Two axes, deliberately separated
+*
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
+*
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
+*
+* ## The canonical call shape
+*
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
+*
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
+*
+* ## Why a channel emits at `info`
+*
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
+*/
+/**
+* The level a channel writes at once armed.
+*
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
+*/
+var LogChannelLevelSchema = _enum([
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
+*/
+var LogChannelDescriptorSchema = object({
+	/**
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
+	*/
+	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
+	/**
+	* Whether this channel can be narrowed to a camera.
+	*
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
+	*/
+	perDevice: boolean()
+});
+/**
+* An armed window over one channel, as the document hands it to a mirror.
+*
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
+*/
+var LogChannelWindowSchema = object({
+	channel: string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: array(number().int()).readonly().nullable()
+});
+/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -11271,6 +11376,35 @@ var MutationFilterSchema = object({
 	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
 	whereNot: record(string(), unknown()).optional()
 });
+/**
+* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
+*
+* `as` names the slot in the result, so the SAME column may be asked twice with
+* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
+* a `Record<column, op>` shape could not express.
+*/
+var AggregateFieldSchema = object({
+	/** Result key. */
+	as: string().min(1),
+	/** Column to aggregate. Must be a real column of a declared collection. */
+	field: string().min(1),
+	op: _enum([
+		"sum",
+		"min",
+		"max"
+	])
+});
+/**
+* `COUNT(*)` plus one number per requested field.
+*
+* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
+* that really is 0 are different facts, and an accounting caller that renders
+* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
+*/
+var AggregateResultSchema = object({
+	count: number().int(),
+	values: record(string(), number().nullable())
+});
 /** A single stored record: `{ id, data }`. */
 var SettingsRecordSchema = object({
 	id: string(),
@@ -11355,6 +11489,11 @@ method(object({
 	collection: string(),
 	filter: QueryFilterSchema.optional()
 }), number()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	fields: array(AggregateFieldSchema).readonly(),
+	filter: QueryFilterSchema.optional()
+}), AggregateResultSchema), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	field: string(),
@@ -11471,6 +11610,11 @@ method(_void(), EngineInfoSchema, { auth: "admin" }), method(object({
 	collection: string(),
 	filter: QueryFilterSchema.optional()
 }), number(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	fields: array(AggregateFieldSchema).readonly(),
+	filter: QueryFilterSchema.optional()
+}), AggregateResultSchema, { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	field: string(),
@@ -12194,24 +12338,6 @@ var deviceProviderCapability = {
 		})
 	}
 };
-/**
-* Device Manager capability — hub-side singleton that unifies device persistence,
-* live registry access, and all management operations into a single tRPC surface.
-*
-* Replaces:
-*   - `device-persistence` capability (persistence methods absorbed here)
-*   - `device-management.router.ts` (deleted in Phase 2)
-*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
-*
-* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
-* fork into separate processes but never run on remote cluster agents. Therefore:
-*   - No nodeId routing needed — this is a pure hub singleton.
-*   - The hub's DeviceRegistry is the single source of truth for all live devices.
-*   - No shadow registry or cross-node aggregation required.
-*
-* Forked workers register devices back to the hub via `ctx.devices`
-* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
-*/
 /** One child-placement directive on a container's `childLayout`. Structurally
 *  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
 *  shape for the same field. The child is identified by its re-sync-stable
@@ -12580,7 +12706,7 @@ method(object({
 	* it answers today and the caller filters as it already does.
 	*/
 	deviceIds: array(number()).optional()
-}), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
+}), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ parentDeviceIds: array(number()).max(256) }), record(string(), array(DeviceInfoSchema))), method(object({ deviceId: number() }), object({
 	mode: LinkedDevicesModeSchema,
 	devices: array(LinkedDeviceSchema)
 })), method(object({ deviceIds: array(number()) }), array(LinkedDevicesForDeviceSchema)), method(object({ deviceId: number() }), array(StreamSourceEntrySchema$1)), method(object({ deviceId: number() }), array(ConfigEntrySchema)), method(object({ deviceId: number() }), ConfigUISchemaOutput), method(object({
@@ -13304,6 +13430,59 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* `log-channels` — the capability an addon DECLARES its diagnostic channels
+* through. It stores nothing.
+*
+* ## Why a capability at all, and why this shape
+*
+* Which channels exist is knowledge only the addon has: `stream-broker` knows
+* webrtc/ICE/RTP, `provider-reolink` knows baichuan/handshake. A central list
+* maintained by hand rots at the first addition and rots INVISIBLY — nothing
+* fails, an operator just never sees the channel somebody added. So the list
+* is assembled from declarations at runtime.
+*
+* The shape is copied from `log-destination.cap.ts`, which already does
+* exactly this job: `mode: 'collection'`, `internal: true`,
+* `mount: { kind: 'skip' }` — no tRPC route, no generated hooks — while
+* `addons.listCapabilityProviders` still enumerates it, and the hub's
+* `CapabilityRegistry` still holds an RPC proxy per provider so a forked
+* runner's declarations reach hub-main over the transport that already exists.
+* No new UDS message, no second registry.
+*
+* ## What it deliberately does NOT own
+*
+* The VALUES — which channel is armed, for which cameras, until when — live in
+* ONE place: the logging settings document on the `system` cap
+* (`getLoggingSettings` / `setLoggingSettings`). Two authorities over the same
+* value is the defect the plan behind this work exists to remove, and
+* `setRequestCensus` was retired (D245) rather than allowed to be a second
+* one. {@link logChannelsCapability} therefore has no getter for a level, no
+* setter for a window and no persistence of any kind.
+*
+* ## Why `apply` is here even so
+*
+* The gate lives in the addon's PROCESS; the document lives in hub-main. Some
+* seam has to carry the value from the authority to the mirror, and a channel
+* that cannot be reached is precisely the dead knob this whole slice exists to
+* make impossible (D62 — `audioThresholdDbfs`, the HA entities with no source).
+* `apply` is that seam and nothing more: it writes an in-memory mirror, it
+* persists nothing, it is never the source of a value, and it is called only
+* with a set the hub actually read (D49 — a read that fails does not call it
+* at all, so no channel is silently disarmed by a bad read).
+*/
+/** What `apply` reports back — enough to log, not enough to be a second state. */
+var LogChannelApplyResultSchema = object({
+	/** How many declared channels are armed in this process after the call. */
+	armed: number().int().min(0),
+	/**
+	* Names the document armed that this process does not declare. Reported
+	* rather than swallowed: a name here is either a typo or an addon that has
+	* not booted, and both deserve a line instead of silence.
+	*/
+	unknown: array(string()).readonly()
+});
+method(_void(), array(LogChannelDescriptorSchema).readonly()), method(object({ windows: array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" });
 var LogLevelSchema = _enum([
 	"debug",
 	"info",
@@ -29183,10 +29362,11 @@ var DiagnosticIdSchema = _enum(["request-census"]);
 * The layers of the level hierarchy, general → specific. The most specific
 * layer that carries an explicit value wins.
 *
-* `component` is DECLARED and not yet resolvable: the per-component channels
-* are a later slice of the same plan, and a `levelSource` enum that has to
-* grow later would force every consumer of this document to change with it.
-* Nothing returns `component` today.
+* `component` became RESOLVABLE on 2026-08-27: a component is a declared log
+* CHANNEL (`stream-broker.webrtc`, `provider-reolink.baichuan`), named by
+* `scopeComponent`. It was declared-but-dark in the first slice precisely so
+* that turning it on would not force every consumer of this document to widen
+* a `levelSource` enum — which is what has now not happened.
 */
 var LoggingScopeKindSchema = _enum([
 	"cluster",
@@ -29213,6 +29393,14 @@ var LoggingLevelLayerSchema = object({
 	scope: LoggingScopeKindSchema,
 	/** The node this layer speaks for; `null` on the cluster layer. */
 	nodeId: string().nullable(),
+	/**
+	* The declared channel this layer speaks for; `null` on every layer but
+	* `component`. Never folded into `nodeId`: a component level is CLUSTER-WIDE
+	* by design — the convention this repo settled on is one orchestrator-wide
+	* setting, never per node (D52) — so a component layer that carried a node
+	* would invite a per-node copy of a value that has no per-node meaning.
+	*/
+	component: string().nullable(),
 	/** Explicitly set here, or `null` when this layer inherits. */
 	level: LogLevelSchema$1.nullable()
 });
@@ -29254,6 +29442,49 @@ var DiagnosticWindowPatchSchema = object({
 	reportEveryMs: number().int().positive().optional()
 });
 /**
+* A channel ARMED, as the document reports it.
+*
+* `armMs` is not echoed back: what an operator needs to see is the deadline
+* and the time left, because a diagnostic left running is itself an incident
+* and "armed for 10 minutes" said an hour ago is not an answer.
+*/
+var LogChannelWindowStateSchema = object({
+	channel: string(),
+	armed: boolean(),
+	/** Epoch ms the window closes at. 0 when disarmed. */
+	armedUntilMs: number(),
+	/** Ms left before it expires on its own. 0 when disarmed. */
+	remainingMs: number(),
+	/**
+	* The cameras it is narrowed to, or `null` for every camera.
+	*
+	* A channel declared `perDevice: false` can only ever report `null` here:
+	* its lines do not carry `tags: { deviceId }`, so narrowing them would
+	* produce a filter that silently matches nothing. The server REFUSES such a
+	* patch rather than quietly widening it — ignoring the request would teach
+	* the operator that per-camera filtering works on that channel when it does
+	* not.
+	*/
+	deviceIds: array(number().int()).readonly().nullable()
+});
+/**
+* `armMs: 0` DISARMS. Same grammar as {@link DiagnosticWindowPatchSchema}, and
+* for the same reason: a channel is a window with a deadline, never a switch.
+*/
+var LogChannelWindowPatchSchema = object({
+	channel: string().min(1),
+	armMs: number().int().min(0),
+	/**
+	* Narrow to these numeric device ids. Absent or `null` = every camera.
+	*
+	* Numeric because the repo's own rule makes it possible: every log line
+	* about a device carries `tags: { deviceId }` with the numeric id. That rule
+	* was paid for with a 22% thumbnail gap and a 3-hour media blackout both
+	* diagnosed by hand, and this is the first thing that collects on it.
+	*/
+	deviceIds: array(number().int()).readonly().nullable().optional()
+});
+/**
 * A PATCH, and patches MERGE.
 *
 * A field absent from the patch is left exactly as it was — arming a
@@ -29272,7 +29503,14 @@ var LoggingSettingsPatchSchema = object({
 	* Only the diagnostics NAMED here change. An armed window that is not listed
 	* keeps running — a patch is never a full replacement.
 	*/
-	diagnostics: array(DiagnosticWindowPatchSchema).readonly().optional()
+	diagnostics: array(DiagnosticWindowPatchSchema).readonly().optional(),
+	/**
+	* Only the channels NAMED here change. An armed channel that is not listed
+	* keeps running — same rule as `diagnostics`, because a patch that silently
+	* disarmed the channels it did not mention would make the Levels page and
+	* the Diagnostics page fight over the same value.
+	*/
+	channels: array(LogChannelWindowPatchSchema).readonly().optional()
 });
 /**
 * Which LAYER of the hierarchy is addressed. Absent = the cluster layer.
@@ -29285,9 +29523,22 @@ var LoggingSettingsPatchSchema = object({
 * authority over the whole hierarchy and answers for every layer, so the
 * layer selector needs a name the transport does not already own.
 */
-var GetLoggingSettingsInputSchema = object({ scopeNodeId: string().optional() });
+var GetLoggingSettingsInputSchema = object({
+	scopeNodeId: string().optional(),
+	/**
+	* The declared CHANNEL this document is addressed at, when the caller wants
+	* the `component` layer. Absent = the node/cluster hierarchy only.
+	*
+	* Naming it separately rather than overloading `scopeNodeId` keeps the two
+	* axes from collapsing: a component level is cluster-wide, a node level is
+	* not, and one selector for both would make "which of these two did I just
+	* set" unanswerable — the exact ambiguity `explicit` exists to remove.
+	*/
+	scopeComponent: string().optional()
+});
 var SetLoggingSettingsInputSchema = object({
 	scopeNodeId: string().optional(),
+	scopeComponent: string().optional(),
 	patch: LoggingSettingsPatchSchema
 });
 /**
@@ -29302,9 +29553,20 @@ var SetLoggingSettingsInputSchema = object({
 var LoggingSettingsStateSchema = object({
 	/** The layer this document was read at. `null` = the cluster layer. */
 	scopeNodeId: string().nullable(),
+	/** The channel this document was read at. `null` = no component layer. */
+	scopeComponent: string().nullable(),
 	effective: LoggingEffectiveSchema,
 	explicit: LoggingExplicitSchema,
 	activeWindows: array(DiagnosticWindowSchema).readonly(),
+	/**
+	* Every channel the cluster's addons DECLARE, gathered from the
+	* `log-channels` providers. Not stored anywhere: assembled per read, so a
+	* channel added by a redeployed addon appears without anybody editing a
+	* list, and a channel whose addon is gone stops being offered.
+	*/
+	channels: array(LogChannelDescriptorSchema).readonly(),
+	/** The channels ARMED right now, each with its deadline. */
+	activeChannels: array(LogChannelWindowStateSchema).readonly(),
 	persisted: boolean()
 });
 method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
@@ -32522,6 +32784,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"dataStoreProvider.aggregate": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"dataStoreProvider.count": {
 		capName: "data-store-provider",
 		capScope: "system",
@@ -32936,6 +33204,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getChildrenBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getConfigSchema": {
 		capName: "device-manager",
 		capScope: "system",
@@ -33986,6 +34260,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"logChannels.apply": {
+		capName: "log-channels",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"logChannels.list": {
+		capName: "log-channels",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"logDestination.query": {
 		capName: "log-destination",
 		capScope: "system",
@@ -36140,6 +36426,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.aggregate": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"settingsStore.count": {
 		capName: "settings-store",
 		capScope: "system",
@@ -37719,6 +38011,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.getChildrenBatch": [{
+		name: "parentDeviceIds",
+		form: "array",
+		optional: false
+	}],
 	"deviceManager.getConfigSchema": [{
 		name: "deviceId",
 		form: "single",
@@ -40185,6 +40482,38 @@ function createAccessoryDevice(kind, ctx, parent) {
 		default: throw new Error(`Hikvision provider does not implement accessory kind "${String(kind)}"`);
 	}
 }
+function createAlarmTypeTally(deps) {
+	const intervalMs = deps.intervalMs ?? 3e5;
+	const lastLoggedAt = /* @__PURE__ */ new Map();
+	const suppressed = /* @__PURE__ */ new Map();
+	const note = (type, state, reason) => {
+		const logger = deps.logger;
+		if (!logger) return;
+		const key = `${type}/${state ?? "none"}`;
+		const now = Date.now();
+		const last = lastLoggedAt.get(key);
+		if (last !== void 0 && now - last < intervalMs) {
+			suppressed.set(key, (suppressed.get(key) ?? 0) + 1);
+			return;
+		}
+		const count = (suppressed.get(key) ?? 0) + 1;
+		suppressed.set(key, 0);
+		lastLoggedAt.set(key, now);
+		const extras = {
+			...deps.deviceId === null ? {} : { tags: { deviceId: deps.deviceId } },
+			meta: {
+				type,
+				state,
+				count,
+				...last === void 0 ? { first: true } : { windowMs: now - last },
+				...reason === void 0 ? {} : { reason }
+			}
+		};
+		if (deps.level === "debug") logger.debug(deps.message, extras);
+		else logger.info(deps.message, extras);
+	};
+	return { note };
+}
 //#endregion
 //#region src/hikvision-channel-fps.ts
 /**
@@ -40270,6 +40599,24 @@ function buildAuthHeader(input) {
 	return `Digest ${parts.join(", ")}`;
 }
 //#endregion
+//#region src/hikvision-alarm-ignore.ts
+var IGNORED_ALARMS = new Map([["videoloss", {
+	states: ["inactive"],
+	reason: "alertStream keep-alive: \"no video loss\" repeated every ~5s by firmware whether or not anything happened. It carries no edge and no state we do not already hold — the stream being alive is already tracked by the idle watchdog, and camera liveness by markOnline(). Measured at 83 200 events / 12 h (116/min) across the fleet, all byte-identical."
+}]]);
+/**
+* The reason this `(type, state)` is deliberately not acted on, or `null` when
+* the event must be delivered.
+*
+* Both arguments are expected lowercased, matching `eventType` / `eventState`
+* as normalised by the alert parser.
+*/
+function hikvisionIgnoredAlarmReason(type, state) {
+	const policy = IGNORED_ALARMS.get(type);
+	if (!policy) return null;
+	return policy.states.includes(state) ? policy.reason : null;
+}
+//#endregion
 //#region src/hikvision-snapshot-channel.ts
 /**
 * Hikvision encodes a channel id as `{cameraNumber}{streamSlot}`; slot `1` is
@@ -42356,6 +42703,13 @@ async function pumpAlarmStream(stream, declaredBoundary, handlers, options) {
 	const retainBytes = options.retainBytes ?? 65536;
 	const unparsedWarnBytes = options.unparsedWarnBytes ?? 32768;
 	const diagnostics = createAlarmDiagnostics(options.logger ?? null, options.deviceId ?? null, options.diagnosticIntervalMs ?? 6e4);
+	const ignoredTally = createAlarmTypeTally({
+		logger: options.logger ?? null,
+		deviceId: options.deviceId ?? null,
+		message: "hikvision alarm stream: ignored alarm type (declared policy)",
+		level: "debug",
+		...options.ignoredTallyIntervalMs === void 0 ? {} : { intervalMs: options.ignoredTallyIntervalMs }
+	});
 	const reader = stream.getReader();
 	let activeBoundary = declaredBoundary;
 	let activeDashBoundary = `--${activeBoundary}`;
@@ -42398,8 +42752,8 @@ async function pumpAlarmStream(stream, declaredBoundary, handlers, options) {
 			});
 			return;
 		}
-		const ev = parseAlertXml(bodyText);
-		if (!ev) {
+		const peeked = peekAlertTypeState(bodyText);
+		if (!peeked) {
 			diagnostics.report("alert-xml-without-event-type", "hikvision alarm stream: alert part dropped — no <eventType> tag", {
 				contentType,
 				bytes: block.byteLength,
@@ -42407,7 +42761,12 @@ async function pumpAlarmStream(stream, declaredBoundary, handlers, options) {
 			});
 			return;
 		}
-		handlers.onEvent(ev);
+		const ignoredReason = hikvisionIgnoredAlarmReason(peeked.type, peeked.state);
+		if (ignoredReason !== null) {
+			ignoredTally.note(peeked.type, peeked.state, ignoredReason);
+			return;
+		}
+		handlers.onEvent(parseAlertXml(bodyText, peeked));
 	};
 	let idleTimer = null;
 	const armIdle = () => {
@@ -42592,10 +42951,22 @@ function isHikvisionMotionAlarmType(type) {
 function isHikvisionSmartAlarmType(type) {
 	return type !== "vmd" && type !== "motiondetection" && isHikvisionMotionAlarmType(type);
 }
-function parseAlertXml(xml) {
+function peekAlertTypeState(xml) {
 	const type = extractTag(xml, "eventType");
 	if (!type) return null;
 	const state = extractTag(xml, "eventState");
+	return {
+		type: type.toLowerCase(),
+		state: state?.toLowerCase() ?? null
+	};
+}
+/**
+* Build the full event. Takes the already-peeked `(type, state)` so the two
+* tags are extracted exactly once, and so this function has no failure mode
+* left: `peekAlertTypeState` returning non-null IS the precondition, and the
+* caller has already reported the only way it can fail.
+*/
+function parseAlertXml(xml, peeked) {
 	const channelId = extractTag(xml, "dynChannelID") ?? extractTag(xml, "channelID");
 	const description = extractTag(xml, "eventDescription") ?? extractTag(xml, "description");
 	const aiClass = extractTag(xml, "targetType") ?? extractTag(xml, "className");
@@ -42607,8 +42978,8 @@ function parseAlertXml(xml) {
 	})();
 	return {
 		observedAt: Date.now(),
-		type: type.toLowerCase(),
-		state: state?.toLowerCase() ?? null,
+		type: peeked.type,
+		state: peeked.state,
 		channelId,
 		aiClass,
 		description,
@@ -44136,6 +44507,25 @@ var HikvisionCamera = class HikvisionCamera extends BaseDevice {
 	alarmReconnectAttempts = 0;
 	/** Pending alarm-reconnect timer. */
 	alarmReconnectTimer = null;
+	/**
+	* Counting reporter for alarm types the camera receives but does not model.
+	*
+	* Built lazily so it can capture `this.id` / `this.ctx.logger` — every line
+	* it emits carries the numeric `deviceId`. It keeps the historical message
+	* text (`hikvision: unhandled alarm event`) so existing Loki queries keep
+	* working; what changed is that the line now carries `meta.count` and arrives
+	* once per window instead of once per event.
+	*/
+	unhandledAlarmsTally = null;
+	get unhandledAlarms() {
+		this.unhandledAlarmsTally ??= createAlarmTypeTally({
+			logger: this.ctx.logger,
+			deviceId: this.id,
+			message: "hikvision: unhandled alarm event",
+			level: "info"
+		});
+		return this.unhandledAlarmsTally;
+	}
 	/** Hysteresis: drop motion-active back to inactive after this many ms with
 	*  no fresh `VMD` event. Hikvision fires VMD every ~1s while motion is
 	*  active; missing 2 ticks signals the burst is over. */
@@ -46361,22 +46751,17 @@ var HikvisionCamera = class HikvisionCamera extends BaseDevice {
 			return;
 		}
 		if (ev.type === "videoloss") {
-			this.ctx.logger.debug("hikvision: unhandled alarm event", {
+			this.ctx.logger.warn("hikvision: camera reports video signal loss", {
 				tags: { deviceId: this.id },
 				meta: {
 					type: ev.type,
-					state: ev.state
+					state: ev.state,
+					camStreamId
 				}
 			});
 			return;
 		}
-		this.ctx.logger.info("hikvision: unhandled alarm event", {
-			tags: { deviceId: this.id },
-			meta: {
-				type: ev.type,
-				state: ev.state
-			}
-		});
+		this.unhandledAlarms.note(ev.type, ev.state);
 	}
 	resolveAlarmCamStreamId(channelId) {
 		if (!channelId) return "native:main";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-hikvision",
-  "version": "1.2.40",
+  "version": "1.2.42",
   "description": "Hikvision camera device provider addon for CamStack — ISAPI over HTTP(S) with digest auth (snapshot, alarm stream, RTSP discovery)",
   "keywords": [
     "camstack",