@camstack/addon-provider-homeassistant 1.2.59 → 1.2.60

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/addon.js CHANGED
@@ -1,5 +1,5 @@
1
1
  Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
2
- const require_dist = require("./dist-D_63yMoB.js");
2
+ const require_dist = require("./dist-BN8TjCTI.js");
3
3
  let node_crypto = require("node:crypto");
4
4
  let node_zlib = require("node:zlib");
5
5
  //#region src/ha-device-source.ts
package/dist/addon.mjs CHANGED
@@ -1,4 +1,4 @@
1
- import { $ as presenceCapability, A as controlCapability, At as EventCategory, B as humiditySensorCapability, C as buildAddonRouteProvider, Ct as number, D as colorCapability, Dt as union, E as climateControlCapability, Et as string, F as eventEmitterCapability, G as motionCapability, H as lawnMowerControlCapability, I as fanControlCapability, J as notifierCapability, K as normalizeUnit, L as floodCapability, M as deviceAdoptionCapability, O as connectivityCapability, Ot as unknown, P as enumSensorCapability, Q as prepareNotification, R as gasCapability, S as brokerCapability, St as literal, T as carbonMonoxideCapability, Tt as record, U as lockControlCapability, V as imageCapability, W as mediaPlayerCapability, Y as numericSensorCapability, Z as powerMeterCapability, _ as automationControlCapability, _t as createEvent, at as temperatureSensorCapability, b as binaryCapability, bt as array, ct as valveCapability, d as TargetSchema, dt as weatherCapability, et as pressureSensorCapability, f as accessoriesCapability, ft as errMsg, g as ambientLightSensorCapability, gt as DeviceType, h as alarmPanelCapability, ht as DeviceRole, it as tamperCapability, j as coverCapability, k as contactCapability, kt as url, lt as vibrationCapability, m as airQualitySensorCapability, mt as DeviceFeature, n as BaseDevice, nt as smokeCapability, ot as updateCapability, p as addonRoutesCapability, q as notificationOutputCapability, r as BaseDeviceProvider, rt as switchCapability, s as EnumSensorDateTimeFormatSchema, st as vacuumControlCapability, tt as scriptRunnerCapability, ut as waterHeaterCapability, v as batteryCapability, w as buttonCapability, wt as object, x as brightnessCapability, xt as discriminatedUnion, y as bestLocationMatch, yt as _enum, z as humidifierCapability } from "./dist-C6W8WY0m.mjs";
1
+ import { $ as presenceCapability, A as controlCapability, At as EventCategory, B as humiditySensorCapability, C as buildAddonRouteProvider, Ct as number, D as colorCapability, Dt as union, E as climateControlCapability, Et as string, F as eventEmitterCapability, G as motionCapability, H as lawnMowerControlCapability, I as fanControlCapability, J as notifierCapability, K as normalizeUnit, L as floodCapability, M as deviceAdoptionCapability, O as connectivityCapability, Ot as unknown, P as enumSensorCapability, Q as prepareNotification, R as gasCapability, S as brokerCapability, St as literal, T as carbonMonoxideCapability, Tt as record, U as lockControlCapability, V as imageCapability, W as mediaPlayerCapability, Y as numericSensorCapability, Z as powerMeterCapability, _ as automationControlCapability, _t as createEvent, at as temperatureSensorCapability, b as binaryCapability, bt as array, ct as valveCapability, d as TargetSchema, dt as weatherCapability, et as pressureSensorCapability, f as accessoriesCapability, ft as errMsg, g as ambientLightSensorCapability, gt as DeviceType, h as alarmPanelCapability, ht as DeviceRole, it as tamperCapability, j as coverCapability, k as contactCapability, kt as url, lt as vibrationCapability, m as airQualitySensorCapability, mt as DeviceFeature, n as BaseDevice, nt as smokeCapability, ot as updateCapability, p as addonRoutesCapability, q as notificationOutputCapability, r as BaseDeviceProvider, rt as switchCapability, s as EnumSensorDateTimeFormatSchema, st as vacuumControlCapability, tt as scriptRunnerCapability, ut as waterHeaterCapability, v as batteryCapability, w as buttonCapability, wt as object, x as brightnessCapability, xt as discriminatedUnion, y as bestLocationMatch, yt as _enum, z as humidifierCapability } from "./dist-D4pIhy8v.mjs";
2
2
  import { randomUUID } from "node:crypto";
3
3
  import { brotliCompressSync, deflateSync, gzipSync } from "node:zlib";
4
4
  //#region src/ha-device-source.ts
@@ -13542,6 +13542,114 @@ method(object({
13542
13542
  height: number()
13543
13543
  }), EmbeddingResultSchema, { auth: "admin" }), method(object({ text: string() }), EmbeddingResultSchema, { auth: "admin" }), method(_void(), EmbeddingInfoSchema, { auth: "admin" });
13544
13544
  /**
13545
+ * `failure-contribution` — the capability an addon reports its OWN losses
13546
+ * through, per camera, with the denominator attached. It stores nothing.
13547
+ *
13548
+ * ## The twin of `load-contribution`, and why it is a twin and not a field
13549
+ *
13550
+ * `load-contribution` answers *what did this camera COST*. This answers *what
13551
+ * did this camera LOSE*. The reporting discipline is identical and deliberately
13552
+ * copied: the contributor reports what it already knows, hub-main adds only
13553
+ * `addonId`, nothing needs global knowledge, and there is no central list for
13554
+ * somebody to forget to edit.
13555
+ *
13556
+ * They are not merged, because their invariants are opposites:
13557
+ *
13558
+ * - a `load-contribution` measurement is **absent, never zero** — a zero would
13559
+ * claim a camera cost nothing, which is a measurement nobody made;
13560
+ * - a `failure-contribution` zero is the **most valuable value on the
13561
+ * surface** — `attempts: 400, succeeded: 400` is the proof a fix landed,
13562
+ * and it is exactly what an absent entry cannot say.
13563
+ *
13564
+ * Putting a loss counter on a cost entry would also break the reconciliation
13565
+ * that gives `load-contribution` its point: contributions are subtracted from
13566
+ * `metrics.node-processes-snapshot` to find processes nobody claims. A failure
13567
+ * has no process.
13568
+ *
13569
+ * ## Why not a log line, since the counters already exist
13570
+ *
13571
+ * Several of these paths already counted themselves — `CaptureScheduler`'s
13572
+ * per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
13573
+ * ends in a log line, and a log line is the thing the operator asked to stop
13574
+ * needing: *"possiamo armare questi errori intanto? Così al prossimo giro
13575
+ * ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
13576
+ * hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
13577
+ * media blackout were both diagnosed. The counters stay; this is where they can
13578
+ * be READ.
13579
+ *
13580
+ * ## The rate is served with its denominator or not at all
13581
+ *
13582
+ * Every entry carries `attempts` and `succeeded`. A miss count alone is
13583
+ * unreadable: on 2026-08-28 the enrichment-crop miss count read as "35x worse
13584
+ * than yesterday" and was **flat across twelve hours** once divided by the
13585
+ * successes on the same path. A surface that publishes only the numerator
13586
+ * reproduces that mistake on every read.
13587
+ *
13588
+ * ## Shape
13589
+ *
13590
+ * Copied from `load-contribution.cap.ts` (`mode: 'collection'`,
13591
+ * `internal: true`, `mount: { kind: 'skip' }`): no tRPC route of its own and no
13592
+ * generated hooks, while `addons.listCapabilityProviders` still enumerates it
13593
+ * and the hub's `CapabilityRegistry` still holds an RPC proxy per provider — so
13594
+ * a forked runner's entries reach hub-main over transport that already exists.
13595
+ * No new UDS message, no second registry (D3). The operator reads the assembled
13596
+ * result through `system.getFailureContributions`.
13597
+ */
13598
+ var FailureReasonCountSchema = object({
13599
+ /**
13600
+ * Why the attempt did not land, in the contributor's own vocabulary —
13601
+ * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
13602
+ * strings that already appear in this repo's logs and, where one exists, the
13603
+ * same string the per-track `previewMissReason` records (D276): a second
13604
+ * vocabulary for the same loss would make the row and the counter
13605
+ * un-joinable.
13606
+ */
13607
+ reason: string(),
13608
+ count: number().int().nonnegative()
13609
+ });
13610
+ var FailureContributionSchema = object({
13611
+ /**
13612
+ * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
13613
+ * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
13614
+ * `unit` free: the families are owned by different addons and a shared enum
13615
+ * is a central list that rots invisibly.
13616
+ */
13617
+ family: string(),
13618
+ /**
13619
+ * The NUMERIC device id — the same value every log line carries as
13620
+ * `tags.deviceId`. Never nullable and never absent: a contributor that
13621
+ * cannot name the camera must not emit the entry, because a fleet total
13622
+ * cannot answer the only question anybody asks of this surface.
13623
+ */
13624
+ deviceId: number().int().positive(),
13625
+ /**
13626
+ * A second dimension inside the family: the model / step id for an inference
13627
+ * timeout, so "which camera AND which model" is one read. Absent when the
13628
+ * family has a single variant.
13629
+ */
13630
+ variant: string().optional(),
13631
+ /**
13632
+ * Epoch ms this counter started — the INCARNATION MARKER. A consumer
13633
+ * differencing two reads must drop the interval when it changes, because the
13634
+ * counter restarted from zero in a respawned runner. Same discipline as
13635
+ * `LoadContribution.startedAtMs`.
13636
+ */
13637
+ sinceMs: number(),
13638
+ /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
13639
+ atMs: number(),
13640
+ /**
13641
+ * THE DENOMINATOR — every attempt on this path for this camera in the
13642
+ * window. A failure count published without it is the mistake this schema
13643
+ * exists to make impossible.
13644
+ */
13645
+ attempts: number().int().nonnegative(),
13646
+ /** Attempts that landed. `attempts - succeeded` is the loss. */
13647
+ succeeded: number().int().nonnegative(),
13648
+ /** The loss, partitioned. Sums to `attempts - succeeded`. */
13649
+ reasons: array(FailureReasonCountSchema).readonly()
13650
+ });
13651
+ method(_void(), array(FailureContributionSchema).readonly());
13652
+ /**
13545
13653
  * filesystem-browse — per-node capability for browsing the node's local
13546
13654
  * filesystem. Reads are unconfined (whole filesystem, from `/` down); WRITES
13547
13655
  * are sandboxed to operator-configured allowed roots (D115). Used by the
@@ -14063,6 +14171,68 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }
14063
14171
  kind: "mutation",
14064
14172
  auth: "admin"
14065
14173
  });
14174
+ var LoadContributionSchema = object({
14175
+ role: _enum([
14176
+ "decode",
14177
+ "transcode",
14178
+ "recording",
14179
+ "streaming",
14180
+ "detection"
14181
+ ]),
14182
+ /**
14183
+ * The NUMERIC device id — the same value every log line carries as
14184
+ * `tags.deviceId`. `null` means this cost genuinely belongs to no single
14185
+ * camera (a shared pool), NOT that the contributor forgot to look it up: a
14186
+ * contributor that cannot name its camera must not emit the entry at all,
14187
+ * because an unnamed per-camera entry is indistinguishable from a shared one
14188
+ * and would quietly turn one camera's cost into everybody's.
14189
+ */
14190
+ deviceId: number().int().positive().nullable(),
14191
+ attribution: _enum([
14192
+ "measured",
14193
+ "accounted",
14194
+ "unattributable"
14195
+ ]),
14196
+ /**
14197
+ * What ONE entry is, in the contributor's own words — `615/high`,
14198
+ * `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
14199
+ * family and inventing a common one would lose the only information that
14200
+ * makes two entries for the same camera distinguishable.
14201
+ */
14202
+ unit: string(),
14203
+ /**
14204
+ * The OS process this cost lives in, when there is one. Present so a
14205
+ * consumer can (a) tell two generations of the same unit apart across a
14206
+ * restart, and (b) subtract claimed processes from the node's process
14207
+ * snapshot to see what NOBODY claimed. Absent for an entry that owns no
14208
+ * process of its own.
14209
+ */
14210
+ pid: number().int().positive().optional(),
14211
+ /**
14212
+ * When this generation started. The pid's incarnation marker: a consumer
14213
+ * differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
14214
+ * window when this changes, because the counter restarted from zero in a new
14215
+ * process.
14216
+ */
14217
+ startedAtMs: number().optional(),
14218
+ /**
14219
+ * CUMULATIVE CPU seconds this unit has consumed since it started — user +
14220
+ * system, read from the child's own `/proc/<pid>/stat` at the moment the
14221
+ * contribution is asked for.
14222
+ *
14223
+ * Cumulative and not a rate on purpose: a rate needs a window, a window
14224
+ * needs a sampler, and a new per-node sampler is the defect half of
14225
+ * `docs/architecture/load-ledger.md` documents. A counter can be differenced
14226
+ * by whoever already keeps a history; a rate cannot be un-averaged.
14227
+ *
14228
+ * Absent — never zero — on a node with no `/proc`, on a read failure, and on
14229
+ * an entry with no process.
14230
+ */
14231
+ cpuSeconds: number().optional(),
14232
+ /** Resident bytes of this unit's process, same source and same rules. */
14233
+ rssBytes: number().optional()
14234
+ });
14235
+ method(_void(), array(LoadContributionSchema).readonly());
14066
14236
  /**
14067
14237
  * `log-channels` — the capability an addon DECLARES its diagnostic channels
14068
14238
  * through. It stores nothing.
@@ -14139,176 +14309,6 @@ method(LogEntrySchema, _void(), { kind: "mutation" }), method(object({
14139
14309
  tags: record(string(), string()).optional()
14140
14310
  }), array(LogEntrySchema).readonly());
14141
14311
  /**
14142
- * `failure-contribution` — the capability an addon reports its OWN losses
14143
- * through, per camera, with the denominator attached. It stores nothing.
14144
- *
14145
- * ## The twin of `load-contribution`, and why it is a twin and not a field
14146
- *
14147
- * `load-contribution` answers *what did this camera COST*. This answers *what
14148
- * did this camera LOSE*. The reporting discipline is identical and deliberately
14149
- * copied: the contributor reports what it already knows, hub-main adds only
14150
- * `addonId`, nothing needs global knowledge, and there is no central list for
14151
- * somebody to forget to edit.
14152
- *
14153
- * They are not merged, because their invariants are opposites:
14154
- *
14155
- * - a `load-contribution` measurement is **absent, never zero** — a zero would
14156
- * claim a camera cost nothing, which is a measurement nobody made;
14157
- * - a `failure-contribution` zero is the **most valuable value on the
14158
- * surface** — `attempts: 400, succeeded: 400` is the proof a fix landed,
14159
- * and it is exactly what an absent entry cannot say.
14160
- *
14161
- * Putting a loss counter on a cost entry would also break the reconciliation
14162
- * that gives `load-contribution` its point: contributions are subtracted from
14163
- * `metrics.node-processes-snapshot` to find processes nobody claims. A failure
14164
- * has no process.
14165
- *
14166
- * ## Why not a log line, since the counters already exist
14167
- *
14168
- * Several of these paths already counted themselves — `CaptureScheduler`'s
14169
- * per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
14170
- * ends in a log line, and a log line is the thing the operator asked to stop
14171
- * needing: *"possiamo armare questi errori intanto? Così al prossimo giro
14172
- * ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
14173
- * hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
14174
- * media blackout were both diagnosed. The counters stay; this is where they can
14175
- * be READ.
14176
- *
14177
- * ## The rate is served with its denominator or not at all
14178
- *
14179
- * Every entry carries `attempts` and `succeeded`. A miss count alone is
14180
- * unreadable: on 2026-08-28 the enrichment-crop miss count read as "35x worse
14181
- * than yesterday" and was **flat across twelve hours** once divided by the
14182
- * successes on the same path. A surface that publishes only the numerator
14183
- * reproduces that mistake on every read.
14184
- *
14185
- * ## Shape
14186
- *
14187
- * Copied from `load-contribution.cap.ts` (`mode: 'collection'`,
14188
- * `internal: true`, `mount: { kind: 'skip' }`): no tRPC route of its own and no
14189
- * generated hooks, while `addons.listCapabilityProviders` still enumerates it
14190
- * and the hub's `CapabilityRegistry` still holds an RPC proxy per provider — so
14191
- * a forked runner's entries reach hub-main over transport that already exists.
14192
- * No new UDS message, no second registry (D3). The operator reads the assembled
14193
- * result through `system.getFailureContributions`.
14194
- */
14195
- var FailureReasonCountSchema = object({
14196
- /**
14197
- * Why the attempt did not land, in the contributor's own vocabulary —
14198
- * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
14199
- * strings that already appear in this repo's logs and, where one exists, the
14200
- * same string the per-track `previewMissReason` records (D276): a second
14201
- * vocabulary for the same loss would make the row and the counter
14202
- * un-joinable.
14203
- */
14204
- reason: string(),
14205
- count: number().int().nonnegative()
14206
- });
14207
- var FailureContributionSchema = object({
14208
- /**
14209
- * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
14210
- * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
14211
- * `unit` free: the families are owned by different addons and a shared enum
14212
- * is a central list that rots invisibly.
14213
- */
14214
- family: string(),
14215
- /**
14216
- * The NUMERIC device id — the same value every log line carries as
14217
- * `tags.deviceId`. Never nullable and never absent: a contributor that
14218
- * cannot name the camera must not emit the entry, because a fleet total
14219
- * cannot answer the only question anybody asks of this surface.
14220
- */
14221
- deviceId: number().int().positive(),
14222
- /**
14223
- * A second dimension inside the family: the model / step id for an inference
14224
- * timeout, so "which camera AND which model" is one read. Absent when the
14225
- * family has a single variant.
14226
- */
14227
- variant: string().optional(),
14228
- /**
14229
- * Epoch ms this counter started — the INCARNATION MARKER. A consumer
14230
- * differencing two reads must drop the interval when it changes, because the
14231
- * counter restarted from zero in a respawned runner. Same discipline as
14232
- * `LoadContribution.startedAtMs`.
14233
- */
14234
- sinceMs: number(),
14235
- /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
14236
- atMs: number(),
14237
- /**
14238
- * THE DENOMINATOR — every attempt on this path for this camera in the
14239
- * window. A failure count published without it is the mistake this schema
14240
- * exists to make impossible.
14241
- */
14242
- attempts: number().int().nonnegative(),
14243
- /** Attempts that landed. `attempts - succeeded` is the loss. */
14244
- succeeded: number().int().nonnegative(),
14245
- /** The loss, partitioned. Sums to `attempts - succeeded`. */
14246
- reasons: array(FailureReasonCountSchema).readonly()
14247
- });
14248
- method(_void(), array(FailureContributionSchema).readonly());
14249
- var LoadContributionSchema = object({
14250
- role: _enum([
14251
- "decode",
14252
- "transcode",
14253
- "recording",
14254
- "streaming",
14255
- "detection"
14256
- ]),
14257
- /**
14258
- * The NUMERIC device id — the same value every log line carries as
14259
- * `tags.deviceId`. `null` means this cost genuinely belongs to no single
14260
- * camera (a shared pool), NOT that the contributor forgot to look it up: a
14261
- * contributor that cannot name its camera must not emit the entry at all,
14262
- * because an unnamed per-camera entry is indistinguishable from a shared one
14263
- * and would quietly turn one camera's cost into everybody's.
14264
- */
14265
- deviceId: number().int().positive().nullable(),
14266
- attribution: _enum([
14267
- "measured",
14268
- "accounted",
14269
- "unattributable"
14270
- ]),
14271
- /**
14272
- * What ONE entry is, in the contributor's own words — `615/high`,
14273
- * `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
14274
- * family and inventing a common one would lose the only information that
14275
- * makes two entries for the same camera distinguishable.
14276
- */
14277
- unit: string(),
14278
- /**
14279
- * The OS process this cost lives in, when there is one. Present so a
14280
- * consumer can (a) tell two generations of the same unit apart across a
14281
- * restart, and (b) subtract claimed processes from the node's process
14282
- * snapshot to see what NOBODY claimed. Absent for an entry that owns no
14283
- * process of its own.
14284
- */
14285
- pid: number().int().positive().optional(),
14286
- /**
14287
- * When this generation started. The pid's incarnation marker: a consumer
14288
- * differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
14289
- * window when this changes, because the counter restarted from zero in a new
14290
- * process.
14291
- */
14292
- startedAtMs: number().optional(),
14293
- /**
14294
- * CUMULATIVE CPU seconds this unit has consumed since it started — user +
14295
- * system, read from the child's own `/proc/<pid>/stat` at the moment the
14296
- * contribution is asked for.
14297
- *
14298
- * Cumulative and not a rate on purpose: a rate needs a window, a window
14299
- * needs a sampler, and a new per-node sampler is the defect half of
14300
- * `docs/architecture/load-ledger.md` documents. A counter can be differenced
14301
- * by whoever already keeps a history; a rate cannot be un-averaged.
14302
- *
14303
- * Absent — never zero — on a node with no `/proc`, on a read failure, and on
14304
- * an entry with no process.
14305
- */
14306
- cpuSeconds: number().optional(),
14307
- /** Resident bytes of this unit's process, same source and same rules. */
14308
- rssBytes: number().optional()
14309
- });
14310
- method(_void(), array(LoadContributionSchema).readonly());
14311
- /**
14312
14312
  * `login-method` — collection cap through which auth addons contribute
14313
14313
  * their pre-auth login surfaces to the login page. This is the SINGLE,
14314
14314
  * generic mechanism that supersedes the dead `auth.listProviders` reader:
@@ -19076,12 +19076,53 @@ var MediaFileKindEnum = _enum([
19076
19076
  "keyFrameSmall",
19077
19077
  "thumbnailSmall"
19078
19078
  ]);
19079
+ /**
19080
+ * One media row ON THE WIRE: what it is, how big it is, and WHERE ITS BYTES
19081
+ * ARE — never the bytes themselves.
19082
+ *
19083
+ * ## Why `url` and not `base64`
19084
+ *
19085
+ * Measured on the live hub 2026-08-30: `getTrackMedia {trackId, deviceId}`
19086
+ * with no `kinds` returned 6 rows / **3 597 219 B**, of which `keyFrame` alone
19087
+ * was **2 824 077 B** — one full-resolution frame, base64, so +33 % on the
19088
+ * wire. Forty events is ~144 MB. Every byte of it was read off disk,
19089
+ * base64-encoded, held whole in a unary tRPC envelope, and materialised in
19090
+ * hub-main's heap on the way past — for an `<img>` that would have cached it.
19091
+ *
19092
+ * `url` points at the `event-media` data plane
19093
+ * (`/addon/<addonId>/event-media/<storedKey>`), which serves the same blob
19094
+ * with an ETag and `Cache-Control: immutable`, honours conditional GETs, can
19095
+ * render a `?variant=thumb`, and streams. The hub gate in front of it requires
19096
+ * a bearer or the session cookie (`access: 'authenticated'`), so the bytes are
19097
+ * no less protected than they were inside a `view`-level cap response — see
19098
+ * `data-plane-access.ts` for the rule and the one gap it does not close
19099
+ * (per-device scoping).
19100
+ *
19101
+ * The URL is built from the row's **stored** key, which is not always its
19102
+ * published `kind`: a track's face/plate crop is stored as `crop` under
19103
+ * `('face'|'plate', '<prefix>-<trackId>')` and published as
19104
+ * `faceCrop`/`plateCrop`. `MediaStore.getByKey` knows only the stored key.
19105
+ *
19106
+ * ## `base64` is TRANSITIONAL and is going away
19107
+ *
19108
+ * It is still populated for one reason: the deployed viewer's track-detail
19109
+ * HERO tile reads it (`use-track-media-entry.ts` → `parseMediaFiles`, which
19110
+ * REQUIRES the field), and a row without it parses as a FAILED read — the red
19111
+ * triangle — not as absence. Removing the field before that viewer ships is an
19112
+ * outage, not a cleanup. Once the viewer takes its hero bytes from `url`,
19113
+ * delete this line and the `withBytes` pass-through in
19114
+ * `analytics-query-facade.ts`; nothing else reads it.
19115
+ */
19079
19116
  var MediaFileSchema = object({
19080
19117
  key: string(),
19081
19118
  kind: MediaFileKindEnum,
19082
- base64: string(),
19083
19119
  sizeBytes: number(),
19084
19120
  timestamp: number()
19121
+ }).extend({
19122
+ /** `/addon/<addonId>/event-media/<encoded stored key>`. Always present. */
19123
+ url: string(),
19124
+ /** @deprecated Transitional — see the schema docblock. Use {@link url}. */
19125
+ base64: string()
19085
19126
  });
19086
19127
  /**
19087
19128
  * One media row WITHOUT its bytes.
@@ -19093,7 +19134,9 @@ var MediaFileSchema = object({
19093
19134
  * blocks the whole view.
19094
19135
  *
19095
19136
  * `sizeBytes` is carried because it is what lets a client decide between the
19096
- * stored blob and a `?variant=thumb` rendering without fetching either.
19137
+ * stored blob and a `?variant=thumb` rendering without fetching either, and
19138
+ * `url` because a client that had to build the plane path itself is a second
19139
+ * copy of a route — the embed, the viewer and the admin UI each grew one.
19097
19140
  */
19098
19141
  var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
19099
19142
  /**
@@ -19782,6 +19825,9 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
19782
19825
  }), array(MediaFileSchema).readonly()), method(object({
19783
19826
  trackId: string(),
19784
19827
  deviceId: number()
19828
+ }), array(MediaFileInfoSchema).readonly()), method(object({
19829
+ eventId: string(),
19830
+ deviceId: number()
19785
19831
  }), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
19786
19832
  kind: "mutation",
19787
19833
  auth: "admin"
@@ -24861,10 +24907,24 @@ var FaceClusterSchema = object({
24861
24907
  size: number().int(),
24862
24908
  cohesion: number()
24863
24909
  });
24910
+ /**
24911
+ * One gallery media row: what the crop is, how big it is, and WHERE its bytes
24912
+ * are — never the bytes.
24913
+ *
24914
+ * `base64` was deleted here rather than deprecated. `MediaFile.base64` (the
24915
+ * track/event contract) is still populated because a deployed viewer requires
24916
+ * the field to parse a row at all; this method has no such reader. Its ONE
24917
+ * caller is the admin UI's detail modal, which was building
24918
+ * `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
24919
+ * dialog already rendering its key FRAME from the `event-media` plane.
24920
+ *
24921
+ * `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
24922
+ * media key directly, so this needed no new plane and no new access decision.
24923
+ */
24864
24924
  var MediaFileLiteSchema$1 = object({
24865
24925
  key: string(),
24866
24926
  kind: string(),
24867
- base64: string(),
24927
+ url: string(),
24868
24928
  sizeBytes: number(),
24869
24929
  timestamp: number()
24870
24930
  });
@@ -27886,10 +27946,24 @@ var PlateInfoSchema = object({
27886
27946
  */
27887
27947
  cropUrl: string().optional()
27888
27948
  });
27949
+ /**
27950
+ * One gallery media row: what the crop is, how big it is, and WHERE its bytes
27951
+ * are — never the bytes.
27952
+ *
27953
+ * `base64` was deleted here rather than deprecated. `MediaFile.base64` (the
27954
+ * track/event contract) is still populated because a deployed viewer requires
27955
+ * the field to parse a row at all; this method has no such reader. Its ONE
27956
+ * caller is the admin UI's detail modal, which was building
27957
+ * `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
27958
+ * dialog already rendering its key FRAME from the `event-media` plane.
27959
+ *
27960
+ * `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
27961
+ * media key directly, so this needed no new plane and no new access decision.
27962
+ */
27889
27963
  var MediaFileLiteSchema = object({
27890
27964
  key: string(),
27891
27965
  kind: string(),
27892
- base64: string(),
27966
+ url: string(),
27893
27967
  sizeBytes: number(),
27894
27968
  timestamp: number()
27895
27969
  });
@@ -35786,6 +35860,12 @@ Object.freeze({
35786
35860
  addonId: null,
35787
35861
  access: "view"
35788
35862
  },
35863
+ "pipelineAnalytics.listEventMedia": {
35864
+ capName: "pipeline-analytics",
35865
+ capScope: "device",
35866
+ addonId: null,
35867
+ access: "view"
35868
+ },
35789
35869
  "pipelineAnalytics.listGroups": {
35790
35870
  capName: "pipeline-analytics",
35791
35871
  capScope: "device",
@@ -39409,6 +39489,11 @@ Object.freeze({
39409
39489
  form: "array",
39410
39490
  optional: false
39411
39491
  }],
39492
+ "pipelineAnalytics.listEventMedia": [{
39493
+ name: "deviceId",
39494
+ form: "single",
39495
+ optional: false
39496
+ }],
39412
39497
  "pipelineAnalytics.listGroups": [{
39413
39498
  name: "deviceIds",
39414
39499
  form: "array",
@@ -13542,6 +13542,114 @@ method(object({
13542
13542
  height: number()
13543
13543
  }), EmbeddingResultSchema, { auth: "admin" }), method(object({ text: string() }), EmbeddingResultSchema, { auth: "admin" }), method(_void(), EmbeddingInfoSchema, { auth: "admin" });
13544
13544
  /**
13545
+ * `failure-contribution` — the capability an addon reports its OWN losses
13546
+ * through, per camera, with the denominator attached. It stores nothing.
13547
+ *
13548
+ * ## The twin of `load-contribution`, and why it is a twin and not a field
13549
+ *
13550
+ * `load-contribution` answers *what did this camera COST*. This answers *what
13551
+ * did this camera LOSE*. The reporting discipline is identical and deliberately
13552
+ * copied: the contributor reports what it already knows, hub-main adds only
13553
+ * `addonId`, nothing needs global knowledge, and there is no central list for
13554
+ * somebody to forget to edit.
13555
+ *
13556
+ * They are not merged, because their invariants are opposites:
13557
+ *
13558
+ * - a `load-contribution` measurement is **absent, never zero** — a zero would
13559
+ * claim a camera cost nothing, which is a measurement nobody made;
13560
+ * - a `failure-contribution` zero is the **most valuable value on the
13561
+ * surface** — `attempts: 400, succeeded: 400` is the proof a fix landed,
13562
+ * and it is exactly what an absent entry cannot say.
13563
+ *
13564
+ * Putting a loss counter on a cost entry would also break the reconciliation
13565
+ * that gives `load-contribution` its point: contributions are subtracted from
13566
+ * `metrics.node-processes-snapshot` to find processes nobody claims. A failure
13567
+ * has no process.
13568
+ *
13569
+ * ## Why not a log line, since the counters already exist
13570
+ *
13571
+ * Several of these paths already counted themselves — `CaptureScheduler`'s
13572
+ * per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
13573
+ * ends in a log line, and a log line is the thing the operator asked to stop
13574
+ * needing: *"possiamo armare questi errori intanto? Così al prossimo giro
13575
+ * ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
13576
+ * hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
13577
+ * media blackout were both diagnosed. The counters stay; this is where they can
13578
+ * be READ.
13579
+ *
13580
+ * ## The rate is served with its denominator or not at all
13581
+ *
13582
+ * Every entry carries `attempts` and `succeeded`. A miss count alone is
13583
+ * unreadable: on 2026-08-28 the enrichment-crop miss count read as "35x worse
13584
+ * than yesterday" and was **flat across twelve hours** once divided by the
13585
+ * successes on the same path. A surface that publishes only the numerator
13586
+ * reproduces that mistake on every read.
13587
+ *
13588
+ * ## Shape
13589
+ *
13590
+ * Copied from `load-contribution.cap.ts` (`mode: 'collection'`,
13591
+ * `internal: true`, `mount: { kind: 'skip' }`): no tRPC route of its own and no
13592
+ * generated hooks, while `addons.listCapabilityProviders` still enumerates it
13593
+ * and the hub's `CapabilityRegistry` still holds an RPC proxy per provider — so
13594
+ * a forked runner's entries reach hub-main over transport that already exists.
13595
+ * No new UDS message, no second registry (D3). The operator reads the assembled
13596
+ * result through `system.getFailureContributions`.
13597
+ */
13598
+ var FailureReasonCountSchema = object({
13599
+ /**
13600
+ * Why the attempt did not land, in the contributor's own vocabulary —
13601
+ * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
13602
+ * strings that already appear in this repo's logs and, where one exists, the
13603
+ * same string the per-track `previewMissReason` records (D276): a second
13604
+ * vocabulary for the same loss would make the row and the counter
13605
+ * un-joinable.
13606
+ */
13607
+ reason: string(),
13608
+ count: number().int().nonnegative()
13609
+ });
13610
+ var FailureContributionSchema = object({
13611
+ /**
13612
+ * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
13613
+ * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
13614
+ * `unit` free: the families are owned by different addons and a shared enum
13615
+ * is a central list that rots invisibly.
13616
+ */
13617
+ family: string(),
13618
+ /**
13619
+ * The NUMERIC device id — the same value every log line carries as
13620
+ * `tags.deviceId`. Never nullable and never absent: a contributor that
13621
+ * cannot name the camera must not emit the entry, because a fleet total
13622
+ * cannot answer the only question anybody asks of this surface.
13623
+ */
13624
+ deviceId: number().int().positive(),
13625
+ /**
13626
+ * A second dimension inside the family: the model / step id for an inference
13627
+ * timeout, so "which camera AND which model" is one read. Absent when the
13628
+ * family has a single variant.
13629
+ */
13630
+ variant: string().optional(),
13631
+ /**
13632
+ * Epoch ms this counter started — the INCARNATION MARKER. A consumer
13633
+ * differencing two reads must drop the interval when it changes, because the
13634
+ * counter restarted from zero in a respawned runner. Same discipline as
13635
+ * `LoadContribution.startedAtMs`.
13636
+ */
13637
+ sinceMs: number(),
13638
+ /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
13639
+ atMs: number(),
13640
+ /**
13641
+ * THE DENOMINATOR — every attempt on this path for this camera in the
13642
+ * window. A failure count published without it is the mistake this schema
13643
+ * exists to make impossible.
13644
+ */
13645
+ attempts: number().int().nonnegative(),
13646
+ /** Attempts that landed. `attempts - succeeded` is the loss. */
13647
+ succeeded: number().int().nonnegative(),
13648
+ /** The loss, partitioned. Sums to `attempts - succeeded`. */
13649
+ reasons: array(FailureReasonCountSchema).readonly()
13650
+ });
13651
+ method(_void(), array(FailureContributionSchema).readonly());
13652
+ /**
13545
13653
  * filesystem-browse — per-node capability for browsing the node's local
13546
13654
  * filesystem. Reads are unconfined (whole filesystem, from `/` down); WRITES
13547
13655
  * are sandboxed to operator-configured allowed roots (D115). Used by the
@@ -14063,6 +14171,68 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }
14063
14171
  kind: "mutation",
14064
14172
  auth: "admin"
14065
14173
  });
14174
+ var LoadContributionSchema = object({
14175
+ role: _enum([
14176
+ "decode",
14177
+ "transcode",
14178
+ "recording",
14179
+ "streaming",
14180
+ "detection"
14181
+ ]),
14182
+ /**
14183
+ * The NUMERIC device id — the same value every log line carries as
14184
+ * `tags.deviceId`. `null` means this cost genuinely belongs to no single
14185
+ * camera (a shared pool), NOT that the contributor forgot to look it up: a
14186
+ * contributor that cannot name its camera must not emit the entry at all,
14187
+ * because an unnamed per-camera entry is indistinguishable from a shared one
14188
+ * and would quietly turn one camera's cost into everybody's.
14189
+ */
14190
+ deviceId: number().int().positive().nullable(),
14191
+ attribution: _enum([
14192
+ "measured",
14193
+ "accounted",
14194
+ "unattributable"
14195
+ ]),
14196
+ /**
14197
+ * What ONE entry is, in the contributor's own words — `615/high`,
14198
+ * `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
14199
+ * family and inventing a common one would lose the only information that
14200
+ * makes two entries for the same camera distinguishable.
14201
+ */
14202
+ unit: string(),
14203
+ /**
14204
+ * The OS process this cost lives in, when there is one. Present so a
14205
+ * consumer can (a) tell two generations of the same unit apart across a
14206
+ * restart, and (b) subtract claimed processes from the node's process
14207
+ * snapshot to see what NOBODY claimed. Absent for an entry that owns no
14208
+ * process of its own.
14209
+ */
14210
+ pid: number().int().positive().optional(),
14211
+ /**
14212
+ * When this generation started. The pid's incarnation marker: a consumer
14213
+ * differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
14214
+ * window when this changes, because the counter restarted from zero in a new
14215
+ * process.
14216
+ */
14217
+ startedAtMs: number().optional(),
14218
+ /**
14219
+ * CUMULATIVE CPU seconds this unit has consumed since it started — user +
14220
+ * system, read from the child's own `/proc/<pid>/stat` at the moment the
14221
+ * contribution is asked for.
14222
+ *
14223
+ * Cumulative and not a rate on purpose: a rate needs a window, a window
14224
+ * needs a sampler, and a new per-node sampler is the defect half of
14225
+ * `docs/architecture/load-ledger.md` documents. A counter can be differenced
14226
+ * by whoever already keeps a history; a rate cannot be un-averaged.
14227
+ *
14228
+ * Absent — never zero — on a node with no `/proc`, on a read failure, and on
14229
+ * an entry with no process.
14230
+ */
14231
+ cpuSeconds: number().optional(),
14232
+ /** Resident bytes of this unit's process, same source and same rules. */
14233
+ rssBytes: number().optional()
14234
+ });
14235
+ method(_void(), array(LoadContributionSchema).readonly());
14066
14236
  /**
14067
14237
  * `log-channels` — the capability an addon DECLARES its diagnostic channels
14068
14238
  * through. It stores nothing.
@@ -14139,176 +14309,6 @@ method(LogEntrySchema, _void(), { kind: "mutation" }), method(object({
14139
14309
  tags: record(string(), string()).optional()
14140
14310
  }), array(LogEntrySchema).readonly());
14141
14311
  /**
14142
- * `failure-contribution` — the capability an addon reports its OWN losses
14143
- * through, per camera, with the denominator attached. It stores nothing.
14144
- *
14145
- * ## The twin of `load-contribution`, and why it is a twin and not a field
14146
- *
14147
- * `load-contribution` answers *what did this camera COST*. This answers *what
14148
- * did this camera LOSE*. The reporting discipline is identical and deliberately
14149
- * copied: the contributor reports what it already knows, hub-main adds only
14150
- * `addonId`, nothing needs global knowledge, and there is no central list for
14151
- * somebody to forget to edit.
14152
- *
14153
- * They are not merged, because their invariants are opposites:
14154
- *
14155
- * - a `load-contribution` measurement is **absent, never zero** — a zero would
14156
- * claim a camera cost nothing, which is a measurement nobody made;
14157
- * - a `failure-contribution` zero is the **most valuable value on the
14158
- * surface** — `attempts: 400, succeeded: 400` is the proof a fix landed,
14159
- * and it is exactly what an absent entry cannot say.
14160
- *
14161
- * Putting a loss counter on a cost entry would also break the reconciliation
14162
- * that gives `load-contribution` its point: contributions are subtracted from
14163
- * `metrics.node-processes-snapshot` to find processes nobody claims. A failure
14164
- * has no process.
14165
- *
14166
- * ## Why not a log line, since the counters already exist
14167
- *
14168
- * Several of these paths already counted themselves — `CaptureScheduler`'s
14169
- * per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
14170
- * ends in a log line, and a log line is the thing the operator asked to stop
14171
- * needing: *"possiamo armare questi errori intanto? Così al prossimo giro
14172
- * ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
14173
- * hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
14174
- * media blackout were both diagnosed. The counters stay; this is where they can
14175
- * be READ.
14176
- *
14177
- * ## The rate is served with its denominator or not at all
14178
- *
14179
- * Every entry carries `attempts` and `succeeded`. A miss count alone is
14180
- * unreadable: on 2026-08-28 the enrichment-crop miss count read as "35x worse
14181
- * than yesterday" and was **flat across twelve hours** once divided by the
14182
- * successes on the same path. A surface that publishes only the numerator
14183
- * reproduces that mistake on every read.
14184
- *
14185
- * ## Shape
14186
- *
14187
- * Copied from `load-contribution.cap.ts` (`mode: 'collection'`,
14188
- * `internal: true`, `mount: { kind: 'skip' }`): no tRPC route of its own and no
14189
- * generated hooks, while `addons.listCapabilityProviders` still enumerates it
14190
- * and the hub's `CapabilityRegistry` still holds an RPC proxy per provider — so
14191
- * a forked runner's entries reach hub-main over transport that already exists.
14192
- * No new UDS message, no second registry (D3). The operator reads the assembled
14193
- * result through `system.getFailureContributions`.
14194
- */
14195
- var FailureReasonCountSchema = object({
14196
- /**
14197
- * Why the attempt did not land, in the contributor's own vocabulary —
14198
- * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
14199
- * strings that already appear in this repo's logs and, where one exists, the
14200
- * same string the per-track `previewMissReason` records (D276): a second
14201
- * vocabulary for the same loss would make the row and the counter
14202
- * un-joinable.
14203
- */
14204
- reason: string(),
14205
- count: number().int().nonnegative()
14206
- });
14207
- var FailureContributionSchema = object({
14208
- /**
14209
- * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
14210
- * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
14211
- * `unit` free: the families are owned by different addons and a shared enum
14212
- * is a central list that rots invisibly.
14213
- */
14214
- family: string(),
14215
- /**
14216
- * The NUMERIC device id — the same value every log line carries as
14217
- * `tags.deviceId`. Never nullable and never absent: a contributor that
14218
- * cannot name the camera must not emit the entry, because a fleet total
14219
- * cannot answer the only question anybody asks of this surface.
14220
- */
14221
- deviceId: number().int().positive(),
14222
- /**
14223
- * A second dimension inside the family: the model / step id for an inference
14224
- * timeout, so "which camera AND which model" is one read. Absent when the
14225
- * family has a single variant.
14226
- */
14227
- variant: string().optional(),
14228
- /**
14229
- * Epoch ms this counter started — the INCARNATION MARKER. A consumer
14230
- * differencing two reads must drop the interval when it changes, because the
14231
- * counter restarted from zero in a respawned runner. Same discipline as
14232
- * `LoadContribution.startedAtMs`.
14233
- */
14234
- sinceMs: number(),
14235
- /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
14236
- atMs: number(),
14237
- /**
14238
- * THE DENOMINATOR — every attempt on this path for this camera in the
14239
- * window. A failure count published without it is the mistake this schema
14240
- * exists to make impossible.
14241
- */
14242
- attempts: number().int().nonnegative(),
14243
- /** Attempts that landed. `attempts - succeeded` is the loss. */
14244
- succeeded: number().int().nonnegative(),
14245
- /** The loss, partitioned. Sums to `attempts - succeeded`. */
14246
- reasons: array(FailureReasonCountSchema).readonly()
14247
- });
14248
- method(_void(), array(FailureContributionSchema).readonly());
14249
- var LoadContributionSchema = object({
14250
- role: _enum([
14251
- "decode",
14252
- "transcode",
14253
- "recording",
14254
- "streaming",
14255
- "detection"
14256
- ]),
14257
- /**
14258
- * The NUMERIC device id — the same value every log line carries as
14259
- * `tags.deviceId`. `null` means this cost genuinely belongs to no single
14260
- * camera (a shared pool), NOT that the contributor forgot to look it up: a
14261
- * contributor that cannot name its camera must not emit the entry at all,
14262
- * because an unnamed per-camera entry is indistinguishable from a shared one
14263
- * and would quietly turn one camera's cost into everybody's.
14264
- */
14265
- deviceId: number().int().positive().nullable(),
14266
- attribution: _enum([
14267
- "measured",
14268
- "accounted",
14269
- "unattributable"
14270
- ]),
14271
- /**
14272
- * What ONE entry is, in the contributor's own words — `615/high`,
14273
- * `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
14274
- * family and inventing a common one would lose the only information that
14275
- * makes two entries for the same camera distinguishable.
14276
- */
14277
- unit: string(),
14278
- /**
14279
- * The OS process this cost lives in, when there is one. Present so a
14280
- * consumer can (a) tell two generations of the same unit apart across a
14281
- * restart, and (b) subtract claimed processes from the node's process
14282
- * snapshot to see what NOBODY claimed. Absent for an entry that owns no
14283
- * process of its own.
14284
- */
14285
- pid: number().int().positive().optional(),
14286
- /**
14287
- * When this generation started. The pid's incarnation marker: a consumer
14288
- * differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
14289
- * window when this changes, because the counter restarted from zero in a new
14290
- * process.
14291
- */
14292
- startedAtMs: number().optional(),
14293
- /**
14294
- * CUMULATIVE CPU seconds this unit has consumed since it started — user +
14295
- * system, read from the child's own `/proc/<pid>/stat` at the moment the
14296
- * contribution is asked for.
14297
- *
14298
- * Cumulative and not a rate on purpose: a rate needs a window, a window
14299
- * needs a sampler, and a new per-node sampler is the defect half of
14300
- * `docs/architecture/load-ledger.md` documents. A counter can be differenced
14301
- * by whoever already keeps a history; a rate cannot be un-averaged.
14302
- *
14303
- * Absent — never zero — on a node with no `/proc`, on a read failure, and on
14304
- * an entry with no process.
14305
- */
14306
- cpuSeconds: number().optional(),
14307
- /** Resident bytes of this unit's process, same source and same rules. */
14308
- rssBytes: number().optional()
14309
- });
14310
- method(_void(), array(LoadContributionSchema).readonly());
14311
- /**
14312
14312
  * `login-method` — collection cap through which auth addons contribute
14313
14313
  * their pre-auth login surfaces to the login page. This is the SINGLE,
14314
14314
  * generic mechanism that supersedes the dead `auth.listProviders` reader:
@@ -19076,12 +19076,53 @@ var MediaFileKindEnum = _enum([
19076
19076
  "keyFrameSmall",
19077
19077
  "thumbnailSmall"
19078
19078
  ]);
19079
+ /**
19080
+ * One media row ON THE WIRE: what it is, how big it is, and WHERE ITS BYTES
19081
+ * ARE — never the bytes themselves.
19082
+ *
19083
+ * ## Why `url` and not `base64`
19084
+ *
19085
+ * Measured on the live hub 2026-08-30: `getTrackMedia {trackId, deviceId}`
19086
+ * with no `kinds` returned 6 rows / **3 597 219 B**, of which `keyFrame` alone
19087
+ * was **2 824 077 B** — one full-resolution frame, base64, so +33 % on the
19088
+ * wire. Forty events is ~144 MB. Every byte of it was read off disk,
19089
+ * base64-encoded, held whole in a unary tRPC envelope, and materialised in
19090
+ * hub-main's heap on the way past — for an `<img>` that would have cached it.
19091
+ *
19092
+ * `url` points at the `event-media` data plane
19093
+ * (`/addon/<addonId>/event-media/<storedKey>`), which serves the same blob
19094
+ * with an ETag and `Cache-Control: immutable`, honours conditional GETs, can
19095
+ * render a `?variant=thumb`, and streams. The hub gate in front of it requires
19096
+ * a bearer or the session cookie (`access: 'authenticated'`), so the bytes are
19097
+ * no less protected than they were inside a `view`-level cap response — see
19098
+ * `data-plane-access.ts` for the rule and the one gap it does not close
19099
+ * (per-device scoping).
19100
+ *
19101
+ * The URL is built from the row's **stored** key, which is not always its
19102
+ * published `kind`: a track's face/plate crop is stored as `crop` under
19103
+ * `('face'|'plate', '<prefix>-<trackId>')` and published as
19104
+ * `faceCrop`/`plateCrop`. `MediaStore.getByKey` knows only the stored key.
19105
+ *
19106
+ * ## `base64` is TRANSITIONAL and is going away
19107
+ *
19108
+ * It is still populated for one reason: the deployed viewer's track-detail
19109
+ * HERO tile reads it (`use-track-media-entry.ts` → `parseMediaFiles`, which
19110
+ * REQUIRES the field), and a row without it parses as a FAILED read — the red
19111
+ * triangle — not as absence. Removing the field before that viewer ships is an
19112
+ * outage, not a cleanup. Once the viewer takes its hero bytes from `url`,
19113
+ * delete this line and the `withBytes` pass-through in
19114
+ * `analytics-query-facade.ts`; nothing else reads it.
19115
+ */
19079
19116
  var MediaFileSchema = object({
19080
19117
  key: string(),
19081
19118
  kind: MediaFileKindEnum,
19082
- base64: string(),
19083
19119
  sizeBytes: number(),
19084
19120
  timestamp: number()
19121
+ }).extend({
19122
+ /** `/addon/<addonId>/event-media/<encoded stored key>`. Always present. */
19123
+ url: string(),
19124
+ /** @deprecated Transitional — see the schema docblock. Use {@link url}. */
19125
+ base64: string()
19085
19126
  });
19086
19127
  /**
19087
19128
  * One media row WITHOUT its bytes.
@@ -19093,7 +19134,9 @@ var MediaFileSchema = object({
19093
19134
  * blocks the whole view.
19094
19135
  *
19095
19136
  * `sizeBytes` is carried because it is what lets a client decide between the
19096
- * stored blob and a `?variant=thumb` rendering without fetching either.
19137
+ * stored blob and a `?variant=thumb` rendering without fetching either, and
19138
+ * `url` because a client that had to build the plane path itself is a second
19139
+ * copy of a route — the embed, the viewer and the admin UI each grew one.
19097
19140
  */
19098
19141
  var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
19099
19142
  /**
@@ -19782,6 +19825,9 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
19782
19825
  }), array(MediaFileSchema).readonly()), method(object({
19783
19826
  trackId: string(),
19784
19827
  deviceId: number()
19828
+ }), array(MediaFileInfoSchema).readonly()), method(object({
19829
+ eventId: string(),
19830
+ deviceId: number()
19785
19831
  }), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
19786
19832
  kind: "mutation",
19787
19833
  auth: "admin"
@@ -24861,10 +24907,24 @@ var FaceClusterSchema = object({
24861
24907
  size: number().int(),
24862
24908
  cohesion: number()
24863
24909
  });
24910
+ /**
24911
+ * One gallery media row: what the crop is, how big it is, and WHERE its bytes
24912
+ * are — never the bytes.
24913
+ *
24914
+ * `base64` was deleted here rather than deprecated. `MediaFile.base64` (the
24915
+ * track/event contract) is still populated because a deployed viewer requires
24916
+ * the field to parse a row at all; this method has no such reader. Its ONE
24917
+ * caller is the admin UI's detail modal, which was building
24918
+ * `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
24919
+ * dialog already rendering its key FRAME from the `event-media` plane.
24920
+ *
24921
+ * `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
24922
+ * media key directly, so this needed no new plane and no new access decision.
24923
+ */
24864
24924
  var MediaFileLiteSchema$1 = object({
24865
24925
  key: string(),
24866
24926
  kind: string(),
24867
- base64: string(),
24927
+ url: string(),
24868
24928
  sizeBytes: number(),
24869
24929
  timestamp: number()
24870
24930
  });
@@ -27886,10 +27946,24 @@ var PlateInfoSchema = object({
27886
27946
  */
27887
27947
  cropUrl: string().optional()
27888
27948
  });
27949
+ /**
27950
+ * One gallery media row: what the crop is, how big it is, and WHERE its bytes
27951
+ * are — never the bytes.
27952
+ *
27953
+ * `base64` was deleted here rather than deprecated. `MediaFile.base64` (the
27954
+ * track/event contract) is still populated because a deployed viewer requires
27955
+ * the field to parse a row at all; this method has no such reader. Its ONE
27956
+ * caller is the admin UI's detail modal, which was building
27957
+ * `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
27958
+ * dialog already rendering its key FRAME from the `event-media` plane.
27959
+ *
27960
+ * `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
27961
+ * media key directly, so this needed no new plane and no new access decision.
27962
+ */
27889
27963
  var MediaFileLiteSchema = object({
27890
27964
  key: string(),
27891
27965
  kind: string(),
27892
- base64: string(),
27966
+ url: string(),
27893
27967
  sizeBytes: number(),
27894
27968
  timestamp: number()
27895
27969
  });
@@ -35786,6 +35860,12 @@ Object.freeze({
35786
35860
  addonId: null,
35787
35861
  access: "view"
35788
35862
  },
35863
+ "pipelineAnalytics.listEventMedia": {
35864
+ capName: "pipeline-analytics",
35865
+ capScope: "device",
35866
+ addonId: null,
35867
+ access: "view"
35868
+ },
35789
35869
  "pipelineAnalytics.listGroups": {
35790
35870
  capName: "pipeline-analytics",
35791
35871
  capScope: "device",
@@ -39409,6 +39489,11 @@ Object.freeze({
39409
39489
  form: "array",
39410
39490
  optional: false
39411
39491
  }],
39492
+ "pipelineAnalytics.listEventMedia": [{
39493
+ name: "deviceId",
39494
+ form: "single",
39495
+ optional: false
39496
+ }],
39412
39497
  "pipelineAnalytics.listGroups": [{
39413
39498
  name: "deviceIds",
39414
39499
  form: "array",
@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
3
3
  [Symbol.toStringTag]: { value: "Module" }
4
4
  });
5
5
  //#endregion
6
- const require_dist = require("../dist-D_63yMoB.js");
6
+ const require_dist = require("../dist-BN8TjCTI.js");
7
7
  let node_crypto = require("node:crypto");
8
8
  //#region src/ha-export/topics.ts
9
9
  /**
@@ -1,4 +1,4 @@
1
- import { At as EventCategory, C as buildAddonRouteProvider, Et as string, N as deviceExportCapability, X as oauthIntegrationCapability, a as COCO_TO_MACRO, c as FanDirectionSchema, i as CAMERA_SWITCH_ORDER, l as HvacModeSchema, o as CameraSwitchIdSchema, p as addonRoutesCapability, pt as BaseAddon, t as AlarmArmModeSchema, u as MediaPlayerRepeatSchema, vt as nodePin } from "../dist-C6W8WY0m.mjs";
1
+ import { At as EventCategory, C as buildAddonRouteProvider, Et as string, N as deviceExportCapability, X as oauthIntegrationCapability, a as COCO_TO_MACRO, c as FanDirectionSchema, i as CAMERA_SWITCH_ORDER, l as HvacModeSchema, o as CameraSwitchIdSchema, p as addonRoutesCapability, pt as BaseAddon, t as AlarmArmModeSchema, u as MediaPlayerRepeatSchema, vt as nodePin } from "../dist-D4pIhy8v.mjs";
2
2
  import { createHmac, timingSafeEqual } from "node:crypto";
3
3
  //#region src/ha-export/topics.ts
4
4
  /**
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@camstack/addon-provider-homeassistant",
3
- "version": "1.2.59",
3
+ "version": "1.2.60",
4
4
  "description": "Home Assistant device provider addon for CamStack",
5
5
  "keywords": [
6
6
  "camstack",