@camstack/addon-provider-petkit 0.2.41 → 0.2.43

package/dist/addon.js

@@ -9141,18 +9141,61 @@ var RelocateFootageInputSchema = object({
 * `RecordingConfig.enabled` or camera wrapper bindings. */
 var StorageMigrationLeaseInputSchema = object({ leaseId: string().min(1) });
 var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: string().min(1) });
+/**
+* What a `relocateMedia` pass DOES. One engine, three passes — never a second
+* mover (the engine already walks both collections with a timestamp cursor and
+* already has a stamp-without-copy path).
+*
+*  - `move`    — the default and the historical behaviour: event-media and
+*                retrain blobs move to `toLocationId` and their rows are
+*                stamped. The enrolled gallery is skipped (D197).
+*  - `seal`    — ROWS ONLY, no bytes. Every row whose `locationId` is NULL is
+*                stamped with `toLocationId`. `toLocationId` here is the id the
+*                bytes ALREADY sit on — today's `eventMedia` default — because
+*                a NULL row means "wherever `eventMedia` points *now*", and the
+*                instant a repoint moves that pointer the row reads from the
+*                new disk while its bytes are on the old one.
+*  - `gallery` — the inverse selection of `move`: ONLY the retention-exempt
+*                (enrolled-gallery) rows, which `move` deliberately skips.
+*                `galleryMedia` is `cardinality: 'single'`, so this pass can
+*                never run beside a live second location: it is stop-the-world
+*                by construction, which is acceptable only because the gallery
+*                is a few KB per enrolled sample.
+*/
+var MediaRelocateModeSchema = _enum([
+	"move",
+	"seal",
+	"gallery"
+]);
 var RelocateMediaInputSchema = object({
 	toLocationId: string(),
-	throttleMbps: number().min(1).max(1e3).optional()
+	throttleMbps: number().min(1).max(1e3).optional(),
+	/** Omitted = `move`, the pre-existing behaviour. */
+	mode: MediaRelocateModeSchema.optional()
+});
+/** How many rows still carry NO `locationId` — the population a repoint would
+*  silently re-aim at a disk that does not hold their bytes. Zero is the only
+*  value that permits a non-blocking `eventMedia` cutover. */
+var UnstampedEventMediaCountSchema = object({
+	media: number().int().nonnegative(),
+	retrainFrames: number().int().nonnegative(),
+	total: number().int().nonnegative()
 });
 var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
-/** The independently selectable logical storage classes. `recordings`
-* encompasses the high and mid segment profiles; `recordingsLow` is low
-* segments; `eventMedia` is post-analysis blobs. */
+/** The independently selectable logical storage classes — every class
+* `storage.listLocationDeclarations` reports, so an operator never meets a
+* Zod enum error where they should meet an explanation.
+*
+* `recordings` encompasses the high and mid segment profiles; `recordingsLow`
+* is low segments; `eventMedia` is post-analysis blobs; `galleryMedia` is the
+* enrolled gallery; `backups` is the system backup archive. The last two have
+* their own rules — see {@link StorageMigrationFindingCodeSchema}. */
 var StorageMigrationClassSchema = _enum([
 	"recordings",
 	"recordingsLow",
-	"eventMedia"
+	"eventMedia",
+	"backups",
+	"galleryMedia"
 ]);
 /** A destination is always an existing, fully-qualified location id. The
 * migration API intentionally never changes a source location's `basePath`:
@@ -9160,20 +9203,56 @@ var StorageMigrationClassSchema = _enum([
 var StorageMigrationDestinationsSchema = object({
 	recordings: string().min(1).optional(),
 	recordingsLow: string().min(1).optional(),
-	eventMedia: string().min(1).optional()
+	eventMedia: string().min(1).optional(),
+	backups: string().min(1).optional(),
+	galleryMedia: string().min(1).optional()
 }).refine((value) => Object.keys(value).length > 0, { message: "select at least one storage class" });
+/**
+* How a migration sequences the cutover against the byte move.
+*
+*  - `blocking`     — the historical order: pause, move every byte, repoint,
+*                     resume. Recording is stopped for the whole move. Right
+*                     for a small or a cold class, and the only legal mode for
+*                     a `cardinality: 'single'` class.
+*  - `nonBlocking`  — repoint FIRST, drain behind: seal, pause, repoint,
+*                     refresh, resume, then move the past with everything
+*                     running. The pause is three bounded instants (a detach +
+*                     attach round, a write-gate drain, a lease) instead of one
+*                     bounded by bytes. 1.09 TB at 7–14 MB/s is thirty hours of
+*                     stopped recording under `blocking`; the same move is
+*                     seconds of stopped recording under `nonBlocking`.
+*
+* The mode is on the JOB, not only on the input, because `status` is where an
+* operator finds out which one is running.
+*/
+var StorageMigrationModeSchema = _enum(["blocking", "nonBlocking"]);
 /** Shared input for planning and starting an orchestrated storage migration. */
 var StorageMigrationInputSchema = object({
 	destinations: StorageMigrationDestinationsSchema,
-	throttleMbps: number().min(1).max(1e3).optional()
+	throttleMbps: number().min(1).max(1e3).optional(),
+	/** Omitted = `blocking`, which stays the default. */
+	mode: StorageMigrationModeSchema.optional()
 });
-/** The durable coordinator state machine. The only phase that changes default
-* locations is `repointing`, after every selected mover has completed and been
-* verified. */
+/**
+* The durable coordinator state machine.
+*
+* `blocking`:
+*   planning → pausing → moving → verifying → repointing → refreshing → resuming → done
+*
+* `nonBlocking`:
+*   planning → sealing → pausing → repointing → refreshing → resuming → draining → verifying → done
+*
+* Same phases, different order plus two new ones — not a second mover.
+* `sealing` closes the `eventMedia` NULL-row hole BEFORE anything is paused;
+* `draining` runs the same movers UNLEASED, after every writer is back up.
+* `repointing` is still the only phase that changes a default location.
+*/
 var StorageMigrationPhaseSchema = _enum([
 	"planning",
+	"sealing",
 	"pausing",
 	"moving",
+	"draining",
 	"verifying",
 	"repointing",
 	"refreshing",
@@ -9198,6 +9277,9 @@ var StorageMigrationMoveSchema = object({
 var StorageMigrationJobSchema = object({
 	jobId: string(),
 	phase: StorageMigrationPhaseSchema,
+	/** Which order this job is running. `status` is the only place an operator
+	*  can tell a seconds-long cutover from a thirty-hour one. */
+	mode: StorageMigrationModeSchema,
 	destinations: StorageMigrationDestinationsSchema,
 	throttleMbps: number(),
 	moves: array(StorageMigrationMoveSchema),
@@ -9210,13 +9292,30 @@ var StorageMigrationJobSchema = object({
 	finishedAt: number().nullable(),
 	error: string().nullable()
 });
+var StorageMigrationFindingSchema = object({
+	code: _enum([
+		"sharesDeviceWithSource",
+		"deviceIdentityUnknown",
+		"unstampedEventMediaRows",
+		"blockingOnly",
+		"noMover"
+	]),
+	storageClass: StorageMigrationClassSchema,
+	/** Human-readable, already carrying the ids and counts. */
+	message: string()
+});
 var StorageMigrationPlanSchema = object({
 	destinations: StorageMigrationDestinationsSchema,
+	/** The mode this plan was built for. A plan is only valid for its mode: the
+	*  `eventMedia` seal gate and the single-cardinality refusal both depend on
+	*  it. */
+	mode: StorageMigrationModeSchema,
 	moves: array(object({
 		storageClass: StorageMigrationClassSchema,
 		fromLocationId: string(),
 		toLocationId: string()
-	}))
+	})),
+	findings: array(StorageMigrationFindingSchema)
 });
 /**
 * `StorageLocationType` — an addon-declared id that identifies the *kind* of
@@ -20086,7 +20185,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(RelocateMediaInputSchema, object({ jobId: string() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), array(RelocateJobSchema).readonly(), {
+}), method(object({}), UnstampedEventMediaCountSchema, { auth: "admin" }), method(object({}), array(RelocateJobSchema).readonly(), {
 	kind: "query",
 	auth: "admin"
 }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
@@ -21993,7 +22092,10 @@ method(object({
 }), StorageLocationSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ id: string() }), _void(), {
+}), method(object({
+	id: string(),
+	force: boolean().optional()
+}), _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ id: string() }), object({
@@ -26069,6 +26171,33 @@ var intercomCapability = {
 	deviceNative: true,
 	mode: "singleton",
 	deviceTypes: [DeviceType.Camera],
+	/**
+	* **Auth tier: `protected` on every method — deliberate, and load-bearing.**
+	*
+	* Talking through a camera is an OPERATE action, not a CONFIGURE one. This
+	* cap has no configuration surface at all: all six methods open, feed and
+	* close one live audio session against one `deviceId`. That is the same
+	* authority as `ptz.move` or `snapshot.getSnapshot`, both `protected` — and
+	* the opposite of `ptz.savePreset` / `snapshot.invalidateCache`, which are
+	* `admin` because they change what the device IS.
+	*
+	* `protected` does not mean ungated: `protectedProcedure` runs the
+	* `METHOD_ACCESS_MAP` scope check, and every method here is `scope: 'device'`
+	* with `access: 'create'` and a `deviceId` in its input. So a caller needs a
+	* grant that covers THAT camera at `create` — a `camera-viewer` (`view`
+	* only) still cannot talk, and a grant on camera 5 cannot talk through
+	* camera 7.
+	*
+	* Every method was `auth: 'admin'` from the initial commit, which made the
+	* cap unreachable by every non-admin principal — `adminProcedure` throws
+	* `FORBIDDEN: Admin required` BEFORE the scope check runs, so the scope
+	* machinery generated for this cap (`METHOD_ACCESS_MAP`,
+	* `DEVICE_SCOPED_CAPS`, `METHOD_DEVICE_SELECTORS`) was complete and dead. The
+	* `camera-operator` scope preset has promised "PTZ control, intercom,
+	* snapshots" since that same commit; the promise could not be kept. Recorded
+	* as D289; `scripts/check-scope-preset-promises.ts` now fails the build if a
+	* preset promises a cap no row of that preset can reach.
+	*/
 	methods: {
 		/**
 		* Open a server-side WebRTC audio-only session. Returns an SDP
@@ -26081,7 +26210,7 @@ var intercomCapability = {
 			sdpOffer: string()
 		}), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		handleAnswer: method(object({
 			deviceId: number(),
@@ -26089,7 +26218,7 @@ var intercomCapability = {
 			sdpAnswer: string()
 		}), _void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/** Close explicitly. Server also auto-closes on 30s idle. */
 		stopSession: method(object({
@@ -26097,7 +26226,7 @@ var intercomCapability = {
 			sessionId: string()
 		}), _void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/**
 		* Open a raw-PCM talk session (no WebRTC SDP plumbing). Used by
@@ -26110,7 +26239,7 @@ var intercomCapability = {
 		*/
 		startTalkSession: method(object({ deviceId: number() }), object({ sessionId: string() }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/**
 		* Push one chunk of talk-back audio onto the active talk session.
@@ -26145,12 +26274,12 @@ var intercomCapability = {
 			sequenceNumber: number().int()
 		}), object({ accepted: boolean() }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/** Close the raw-PCM talk session. Idempotent. */
 		endTalkSession: method(object({ deviceId: number() }), _void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		})
 	},
 	events: { onStatusChanged: { data: object({
@@ -35831,6 +35960,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.countUnstampedEventMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",

package/dist/addon.mjs

@@ -9140,18 +9140,61 @@ var RelocateFootageInputSchema = object({
 * `RecordingConfig.enabled` or camera wrapper bindings. */
 var StorageMigrationLeaseInputSchema = object({ leaseId: string().min(1) });
 var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: string().min(1) });
+/**
+* What a `relocateMedia` pass DOES. One engine, three passes — never a second
+* mover (the engine already walks both collections with a timestamp cursor and
+* already has a stamp-without-copy path).
+*
+*  - `move`    — the default and the historical behaviour: event-media and
+*                retrain blobs move to `toLocationId` and their rows are
+*                stamped. The enrolled gallery is skipped (D197).
+*  - `seal`    — ROWS ONLY, no bytes. Every row whose `locationId` is NULL is
+*                stamped with `toLocationId`. `toLocationId` here is the id the
+*                bytes ALREADY sit on — today's `eventMedia` default — because
+*                a NULL row means "wherever `eventMedia` points *now*", and the
+*                instant a repoint moves that pointer the row reads from the
+*                new disk while its bytes are on the old one.
+*  - `gallery` — the inverse selection of `move`: ONLY the retention-exempt
+*                (enrolled-gallery) rows, which `move` deliberately skips.
+*                `galleryMedia` is `cardinality: 'single'`, so this pass can
+*                never run beside a live second location: it is stop-the-world
+*                by construction, which is acceptable only because the gallery
+*                is a few KB per enrolled sample.
+*/
+var MediaRelocateModeSchema = _enum([
+	"move",
+	"seal",
+	"gallery"
+]);
 var RelocateMediaInputSchema = object({
 	toLocationId: string(),
-	throttleMbps: number().min(1).max(1e3).optional()
+	throttleMbps: number().min(1).max(1e3).optional(),
+	/** Omitted = `move`, the pre-existing behaviour. */
+	mode: MediaRelocateModeSchema.optional()
+});
+/** How many rows still carry NO `locationId` — the population a repoint would
+*  silently re-aim at a disk that does not hold their bytes. Zero is the only
+*  value that permits a non-blocking `eventMedia` cutover. */
+var UnstampedEventMediaCountSchema = object({
+	media: number().int().nonnegative(),
+	retrainFrames: number().int().nonnegative(),
+	total: number().int().nonnegative()
 });
 var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
-/** The independently selectable logical storage classes. `recordings`
-* encompasses the high and mid segment profiles; `recordingsLow` is low
-* segments; `eventMedia` is post-analysis blobs. */
+/** The independently selectable logical storage classes — every class
+* `storage.listLocationDeclarations` reports, so an operator never meets a
+* Zod enum error where they should meet an explanation.
+*
+* `recordings` encompasses the high and mid segment profiles; `recordingsLow`
+* is low segments; `eventMedia` is post-analysis blobs; `galleryMedia` is the
+* enrolled gallery; `backups` is the system backup archive. The last two have
+* their own rules — see {@link StorageMigrationFindingCodeSchema}. */
 var StorageMigrationClassSchema = _enum([
 	"recordings",
 	"recordingsLow",
-	"eventMedia"
+	"eventMedia",
+	"backups",
+	"galleryMedia"
 ]);
 /** A destination is always an existing, fully-qualified location id. The
 * migration API intentionally never changes a source location's `basePath`:
@@ -9159,20 +9202,56 @@ var StorageMigrationClassSchema = _enum([
 var StorageMigrationDestinationsSchema = object({
 	recordings: string().min(1).optional(),
 	recordingsLow: string().min(1).optional(),
-	eventMedia: string().min(1).optional()
+	eventMedia: string().min(1).optional(),
+	backups: string().min(1).optional(),
+	galleryMedia: string().min(1).optional()
 }).refine((value) => Object.keys(value).length > 0, { message: "select at least one storage class" });
+/**
+* How a migration sequences the cutover against the byte move.
+*
+*  - `blocking`     — the historical order: pause, move every byte, repoint,
+*                     resume. Recording is stopped for the whole move. Right
+*                     for a small or a cold class, and the only legal mode for
+*                     a `cardinality: 'single'` class.
+*  - `nonBlocking`  — repoint FIRST, drain behind: seal, pause, repoint,
+*                     refresh, resume, then move the past with everything
+*                     running. The pause is three bounded instants (a detach +
+*                     attach round, a write-gate drain, a lease) instead of one
+*                     bounded by bytes. 1.09 TB at 7–14 MB/s is thirty hours of
+*                     stopped recording under `blocking`; the same move is
+*                     seconds of stopped recording under `nonBlocking`.
+*
+* The mode is on the JOB, not only on the input, because `status` is where an
+* operator finds out which one is running.
+*/
+var StorageMigrationModeSchema = _enum(["blocking", "nonBlocking"]);
 /** Shared input for planning and starting an orchestrated storage migration. */
 var StorageMigrationInputSchema = object({
 	destinations: StorageMigrationDestinationsSchema,
-	throttleMbps: number().min(1).max(1e3).optional()
+	throttleMbps: number().min(1).max(1e3).optional(),
+	/** Omitted = `blocking`, which stays the default. */
+	mode: StorageMigrationModeSchema.optional()
 });
-/** The durable coordinator state machine. The only phase that changes default
-* locations is `repointing`, after every selected mover has completed and been
-* verified. */
+/**
+* The durable coordinator state machine.
+*
+* `blocking`:
+*   planning → pausing → moving → verifying → repointing → refreshing → resuming → done
+*
+* `nonBlocking`:
+*   planning → sealing → pausing → repointing → refreshing → resuming → draining → verifying → done
+*
+* Same phases, different order plus two new ones — not a second mover.
+* `sealing` closes the `eventMedia` NULL-row hole BEFORE anything is paused;
+* `draining` runs the same movers UNLEASED, after every writer is back up.
+* `repointing` is still the only phase that changes a default location.
+*/
 var StorageMigrationPhaseSchema = _enum([
 	"planning",
+	"sealing",
 	"pausing",
 	"moving",
+	"draining",
 	"verifying",
 	"repointing",
 	"refreshing",
@@ -9197,6 +9276,9 @@ var StorageMigrationMoveSchema = object({
 var StorageMigrationJobSchema = object({
 	jobId: string(),
 	phase: StorageMigrationPhaseSchema,
+	/** Which order this job is running. `status` is the only place an operator
+	*  can tell a seconds-long cutover from a thirty-hour one. */
+	mode: StorageMigrationModeSchema,
 	destinations: StorageMigrationDestinationsSchema,
 	throttleMbps: number(),
 	moves: array(StorageMigrationMoveSchema),
@@ -9209,13 +9291,30 @@ var StorageMigrationJobSchema = object({
 	finishedAt: number().nullable(),
 	error: string().nullable()
 });
+var StorageMigrationFindingSchema = object({
+	code: _enum([
+		"sharesDeviceWithSource",
+		"deviceIdentityUnknown",
+		"unstampedEventMediaRows",
+		"blockingOnly",
+		"noMover"
+	]),
+	storageClass: StorageMigrationClassSchema,
+	/** Human-readable, already carrying the ids and counts. */
+	message: string()
+});
 var StorageMigrationPlanSchema = object({
 	destinations: StorageMigrationDestinationsSchema,
+	/** The mode this plan was built for. A plan is only valid for its mode: the
+	*  `eventMedia` seal gate and the single-cardinality refusal both depend on
+	*  it. */
+	mode: StorageMigrationModeSchema,
 	moves: array(object({
 		storageClass: StorageMigrationClassSchema,
 		fromLocationId: string(),
 		toLocationId: string()
-	}))
+	})),
+	findings: array(StorageMigrationFindingSchema)
 });
 /**
 * `StorageLocationType` — an addon-declared id that identifies the *kind* of
@@ -20085,7 +20184,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(RelocateMediaInputSchema, object({ jobId: string() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), array(RelocateJobSchema).readonly(), {
+}), method(object({}), UnstampedEventMediaCountSchema, { auth: "admin" }), method(object({}), array(RelocateJobSchema).readonly(), {
 	kind: "query",
 	auth: "admin"
 }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
@@ -21992,7 +22091,10 @@ method(object({
 }), StorageLocationSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ id: string() }), _void(), {
+}), method(object({
+	id: string(),
+	force: boolean().optional()
+}), _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ id: string() }), object({
@@ -26068,6 +26170,33 @@ var intercomCapability = {
 	deviceNative: true,
 	mode: "singleton",
 	deviceTypes: [DeviceType.Camera],
+	/**
+	* **Auth tier: `protected` on every method — deliberate, and load-bearing.**
+	*
+	* Talking through a camera is an OPERATE action, not a CONFIGURE one. This
+	* cap has no configuration surface at all: all six methods open, feed and
+	* close one live audio session against one `deviceId`. That is the same
+	* authority as `ptz.move` or `snapshot.getSnapshot`, both `protected` — and
+	* the opposite of `ptz.savePreset` / `snapshot.invalidateCache`, which are
+	* `admin` because they change what the device IS.
+	*
+	* `protected` does not mean ungated: `protectedProcedure` runs the
+	* `METHOD_ACCESS_MAP` scope check, and every method here is `scope: 'device'`
+	* with `access: 'create'` and a `deviceId` in its input. So a caller needs a
+	* grant that covers THAT camera at `create` — a `camera-viewer` (`view`
+	* only) still cannot talk, and a grant on camera 5 cannot talk through
+	* camera 7.
+	*
+	* Every method was `auth: 'admin'` from the initial commit, which made the
+	* cap unreachable by every non-admin principal — `adminProcedure` throws
+	* `FORBIDDEN: Admin required` BEFORE the scope check runs, so the scope
+	* machinery generated for this cap (`METHOD_ACCESS_MAP`,
+	* `DEVICE_SCOPED_CAPS`, `METHOD_DEVICE_SELECTORS`) was complete and dead. The
+	* `camera-operator` scope preset has promised "PTZ control, intercom,
+	* snapshots" since that same commit; the promise could not be kept. Recorded
+	* as D289; `scripts/check-scope-preset-promises.ts` now fails the build if a
+	* preset promises a cap no row of that preset can reach.
+	*/
 	methods: {
 		/**
 		* Open a server-side WebRTC audio-only session. Returns an SDP
@@ -26080,7 +26209,7 @@ var intercomCapability = {
 			sdpOffer: string()
 		}), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		handleAnswer: method(object({
 			deviceId: number(),
@@ -26088,7 +26217,7 @@ var intercomCapability = {
 			sdpAnswer: string()
 		}), _void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/** Close explicitly. Server also auto-closes on 30s idle. */
 		stopSession: method(object({
@@ -26096,7 +26225,7 @@ var intercomCapability = {
 			sessionId: string()
 		}), _void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/**
 		* Open a raw-PCM talk session (no WebRTC SDP plumbing). Used by
@@ -26109,7 +26238,7 @@ var intercomCapability = {
 		*/
 		startTalkSession: method(object({ deviceId: number() }), object({ sessionId: string() }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/**
 		* Push one chunk of talk-back audio onto the active talk session.
@@ -26144,12 +26273,12 @@ var intercomCapability = {
 			sequenceNumber: number().int()
 		}), object({ accepted: boolean() }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/** Close the raw-PCM talk session. Idempotent. */
 		endTalkSession: method(object({ deviceId: number() }), _void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		})
 	},
 	events: { onStatusChanged: { data: object({
@@ -35830,6 +35959,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.countUnstampedEventMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-petkit",
-  "version": "0.2.41",
+  "version": "0.2.43",
   "description": "PetKit smart-feeder device-provider addon for CamStack — wraps the @apocaliss92/nodepetkit PetKit cloud client",
   "keywords": [
     "camstack",