@camstack/addon-provider-reolink 1.2.41 → 1.2.43

package/dist/addon.js

@@ -26,7 +26,7 @@ let fs_promises = require("fs/promises");
 fs_promises = require_chunk.__toESM(fs_promises, 1);
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
-//#region ../types/dist/event-category-Bxo5yJjt.mjs
+//#region ../types/dist/event-category-XfKNtfCc.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -43,9 +43,10 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
 	/**
 	* A newer addon or server-root package version was found by the
-	* authoritative registry check. Emitted once per
-	* `(target, packageName, currentVersion, latestVersion)` transition; repeated
-	* polling of the same result is deduplicated by the checker.
+	* authoritative registry check. Emitted once when any observed
+	* `latestVersion` changes (or a package/node first appears behind);
+	* the payload carries the full currently-available list. Repeated
+	* polling of the same latests is silent.
 	*/
 	EventCategory["UpdateAvailable"] = "update.available";
 	/**
@@ -64,6 +65,22 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["AddonInstalled"] = "addon.installed";
 	EventCategory["AddonUninstalled"] = "addon.uninstalled";
 	EventCategory["AddonCrashed"] = "addon.crashed";
+	/**
+	* A RUNNER the D6 crash circuit-breaker gave up on — terminal.
+	*
+	* `AddonCrashed` is the routine, self-healing fact ("it crashed; it is being
+	* respawned"); this is the one that never resolves itself. Emitted exactly
+	* once per trip, by `process-service.ts`, carrying the node, the runner, the
+	* addons it hosted and the crash count that tripped the breaker.
+	*
+	* It exists because a runner marked terminally `failed` used to be SILENT:
+	* on 2026-08-18 the `recorder` runner died of three unhandled ffmpeg spawn
+	* errors, the breaker stopped respawning it (correctly), `/health` kept
+	* returning 200, and fleet-wide recording was gone for 3h15 before the
+	* operator's phone told him. The Notification Center's system-event intake
+	* consumes this category and maps it to the `addon-crash-loop` kind.
+	*/
+	EventCategory["AddonRunnerFailed"] = "addon.runner-failed";
 	EventCategory["AddonError"] = "addon.error";
 	EventCategory["AddonPageReady"] = "addon.page-ready";
 	EventCategory["AddonWidgetReady"] = "addon.widget-ready";
@@ -7587,6 +7604,10 @@ var RecordingBandSchema = object({
 	preBufferSec: number().min(0).optional(),
 	postBufferSec: number().min(0).optional()
 });
+({
+	preBufferSec: 10,
+	postBufferSec: 30
+}).postBufferSec * 1e3;
 /**
 * Per-device retention overrides. Every field is optional; an unset or `0`
 * value inherits the node-wide recorder default. Only footage-lifetime limits
@@ -7634,6 +7655,12 @@ var RecordingConfigSchema = object({
 	/** DERIVED summary of `bands`, stamped by the recorder on every save.
 	*  Authoring it has no effect — see {@link RecordingStorageModeSchema}. */
 	mode: RecordingStorageModeSchema.optional(),
+	/**
+	* Which assigned broker slots to record. Absent / empty = {@link
+	* DEFAULT_RECORDING_PROFILES} (`high`+`low`) intersected with the
+	* camera's currently assigned slots — never `mid` unless the operator
+	* picks it, and never a slot the broker has not assigned.
+	*/
 	profiles: array(CamProfileSchema).optional(),
 	segmentSeconds: number().int().positive().optional(),
 	/**
@@ -7714,7 +7741,11 @@ var RelocateFootageInputSchema = object({
 	profiles: array(string()).optional(),
 	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
 	*  never allowed to starve live writers. */
-	throttleMbps: number().min(1).max(1e3).optional()
+	throttleMbps: number().min(1).max(1e3).optional(),
+	/** Move only segments whose startMs is >= this. Absent = the whole source
+	*  pile. Used when a full drain is too expensive and the operator only
+	*  wants the recent window on the new disk. */
+	sinceMs: number().int().optional()
 });
 /** Internal, lease-scoped participant operation. It is intentionally separate
 * from persistent recording settings: a migration never changes
@@ -14766,6 +14797,7 @@ var NcSystemEventKindSchema = _enum([
 	"node-offline",
 	"node-inference-unavailable",
 	"detection-blind",
+	"addon-crash-loop",
 	"addon-update-available",
 	"server-update-available",
 	"alarm-triggered",
@@ -14773,6 +14805,9 @@ var NcSystemEventKindSchema = _enum([
 	"alarm-disarmed",
 	"alarm-arming",
 	"alarm-arm-refused",
+	"addon-updated",
+	"server-updated",
+	"export-completed",
 	"camera-online",
 	"camera-offline",
 	"camera-disabled",
@@ -16666,13 +16701,19 @@ var RetrainStatusSchema = _enum([
 * "never marked" from "already trained" must read `retrainStatus`.
 *
 * `debug` does NOT pin; it is attention, not durability.
+*
+* `favourited` IS a BOOLEAN pin (durability bit), not a retrain lifecycle.
+* A favourited track is skipped by retention the same way `staging` is, but
+* it does not enter `none|staging|trained` and has no staging budget.
 */
 var TrackFlagFields = {
 	/** Operator marked this track as training material — i.e. `retrainStatus` is
 	*  `'staging'`. */
 	markForTrain: boolean().optional(),
 	/** Operator marked this track for diagnostic attention. */
-	debug: boolean().optional()
+	debug: boolean().optional(),
+	/** Operator favourited this track. Pins it against pruning. */
+	favourited: boolean().optional()
 };
 /**
 * The lifecycle field itself, on the READ surfaces only (`Track`, `KeyEvent`).
@@ -16697,6 +16738,7 @@ var TrackFlagsSchema = object({
 	trackId: string(),
 	markForTrain: boolean(),
 	debug: boolean(),
+	favourited: boolean(),
 	/** The lifecycle state the boolean was derived from. Required here (unlike on
 	*  a track row) because this shape is only ever produced by the write body,
 	*  which always knows it — and a surface that has just written needs to render
@@ -17329,6 +17371,12 @@ var TrackCascadeCountsSchema = object({
 	/** Per-track CLIP search vectors removed (best-effort). */
 	embeddings: number().int()
 });
+/** Disk-wins reconcile: media rows whose blobs are gone, then empty tracks. */
+var DiskReconcileCountsSchema = object({
+	mediaDropped: number().int(),
+	tracks: number().int(),
+	events: number().int()
+});
 /** Event-store footprint for one camera. */
 var EventStoreDeviceFootprintSchema = object({
 	deviceId: number(),
@@ -17505,6 +17553,9 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(object({ deviceId: number() }), TrackCascadeCountsSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ deviceId: number() }), DiskReconcileCountsSchema, {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	trackIds: array(string()).min(1)
@@ -19055,6 +19106,24 @@ var CameraStatusDegradationSchema = object({
 *
 * See spec: `docs/superpowers/specs/2026-06-24-camera-status-aggregator-cap.md`
 */
+var DiskReconcileJobSchema = object({
+	state: _enum([
+		"idle",
+		"running",
+		"done",
+		"error"
+	]),
+	total: number().int().nonnegative(),
+	completed: number().int().nonnegative(),
+	currentDeviceId: number().int().nullable(),
+	failed: array(number().int()).readonly(),
+	mediaDropped: number().int().nonnegative(),
+	tracks: number().int().nonnegative(),
+	events: number().int().nonnegative(),
+	startedAtMs: number().int().nullable(),
+	finishedAtMs: number().int().nullable(),
+	error: string().nullable()
+});
 var CameraStatusSchema = object({
 	deviceId: number(),
 	assignment: CameraAssignmentStatusSchema,
@@ -19286,7 +19355,10 @@ method(StorageMigrationLeaseInputSchema, object({ paused: literal(true) }), {
 }), CameraSwitchGroupSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceId: number() }), CameraStatusSchema), method(object({ deviceIds: array(number()).optional() }), array(CameraStatusSchema).readonly()), method(_void(), array(PipelineTemplateSchema).readonly()), method(object({
+}), method(object({ deviceId: number() }), CameraStatusSchema), method(object({ deviceIds: array(number()).optional() }), array(CameraStatusSchema).readonly()), method(_void(), DiskReconcileJobSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), DiskReconcileJobSchema, { auth: "admin" }), method(_void(), array(PipelineTemplateSchema).readonly()), method(object({
 	name: string(),
 	description: string().optional(),
 	config: CameraPipelineConfigSchema
@@ -20463,20 +20535,6 @@ var VectorStatsResultSchema = object({
 	exact: boolean()
 });
 method(VectorDeclareIndexInputSchema, _void(), { kind: "mutation" }), method(VectorUpsertInputSchema, VectorUpsertResultSchema, { kind: "mutation" }), method(VectorQueryInputSchema, VectorQueryResultSchema), method(VectorGetInputSchema, VectorGetResultSchema), method(VectorDeleteInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorStatsInputSchema, VectorStatsResultSchema);
-/**
-* `videoclips` — the unified, navigable-clip surface for a camera.
-*
-* A device-scoped WRAPPER cap (like `pipeline-analytics`): exactly one active
-* provider per device, substitutable. The DEFAULT provider (registered by
-* `addon-post-analysis`, `defaultActive: true`) composes the analytics event
-* log (markers + thumbnails) with the recorder's `getPlaybackManifest` — a clip
-* is a time-WINDOW over existing footage, never a separate file. A camera that
-* exposes NATIVE onboard clips (Reolink/Hikvision NVR) can later substitute the
-* wrapper provider for its device and serve its own clip catalog + URLs.
-*
-* A `Clip` is purely time-based (subtree-blind): playback resolves segments by
-* temporal overlap, so the API never decides `continuous` vs `events`.
-*/
 var ClipSchema = object({
 	/** Opaque, provider-namespaced id. The default provider encodes the time
 	*  window so `getClipPlayback` is self-contained (no event re-query). */
@@ -20493,8 +20551,57 @@ var ClipSchema = object({
 		startMs: number(),
 		endMs: number()
 	}),
-	/** Thumbnail URL (lazy; e.g. analytics `getEventMedia`). Never inlined. */
-	thumbnail: string().optional()
+	/**
+	* Lazy thumbnail URL, never inlined.
+	*
+	* Recording-derived clips (events-mode keep-window, and the prepared
+	* continuous event+fragment visit) MUST use the snapshot of the **main
+	* event of the interval** — `getEventMedia({ eventId, kind: 'snapshot' })`
+	* of the event that owns `kind` (object > motion > audio). Do not extract
+	* a keyframe from the recorded segments. Other providers (onboard, HKSV)
+	* mint their own stills.
+	*
+	* **VOUCHED, never fabricated.** A provider emits this only for an event it
+	* has CONFIRMED owns at least one media row (its own, or its owning track's).
+	* Absent is meaningful — "this visit has no event still" — never "we did not
+	* look". Stamping it from a URL template made 35% of one camera's clips point
+	* at a 404 (device 3836, 2026-08-17: 64 of 179 clips dead, 63 of them motion).
+	* A read that FAILS drops the claim; it never invents it.
+	*/
+	thumbnail: string().optional(),
+	/**
+	* An instant INSIDE this visit's footage, hole-safe, where a recorded still
+	* can be decoded. Present whenever the visit came from recorded availability;
+	* absent on a per-event padded window (there is no footage to promise).
+	*
+	* This is not a thumbnail and not a second byte path: it is the argument to
+	* the recorder's existing still route. The surface — never the provider —
+	* decides whether to use it. It is the midpoint of the visit's LONGEST
+	* contiguous range, not of the visit: a visit spans its holes by
+	* construction, so a naive midpoint lands in dead air.
+	*/
+	stillAtMs: number().optional(),
+	/**
+	* Analytics event ids that overlap this visit — a BOUNDED sample, newest
+	* first within kind (object → motion → audio), capped at
+	* {@link MAX_CLIP_EVENT_IDS}. Empty on footage-only clips.
+	*
+	* Bounded because it is not a payload the surface pages through: one visit on
+	* device 615 carried 2 345 ids, and `eventIds` was 99% of a 153 KB
+	* camera-day. Read {@link eventCount} for the true total.
+	*/
+	eventIds: array(string()).optional(),
+	/** How many analytics events actually overlap this visit. Differs from
+	*  `eventIds.length` exactly when the sample was capped — so a truncated
+	*  list is never mistaken for a quiet visit. */
+	eventCount: number().int().nonnegative().optional(),
+	/** Intra-visit footage holes (GOP rolls, discarded segments) still shorter
+	*  than `VISIT_MERGE_GAP_MS`. Playback concatenates around them; the timeline
+	*  bar keeps showing them via `recording.getAvailability`. */
+	holes: array(object({
+		startMs: number(),
+		endMs: number()
+	})).optional()
 });
 var ClipPlaybackSchema = object({
 	/** HLS master URL through the hub data-plane (Range + token in path). */
@@ -20958,7 +21065,14 @@ var SearchResultSchema = object({
 });
 var AutoUpdateSettingsSchema = object({
 	channel: ChannelSchema,
-	intervalSeconds: number()
+	intervalSeconds: number(),
+	/**
+	* Cadence of the "an update exists" POLLER, in seconds. Independent of
+	* `channel`: the poller runs while auto-apply is `off`, because being told
+	* about a publish and installing it are different decisions. Clamped
+	* server-side to 900 s … 604800 s; defaults to 21600 s (6 h).
+	*/
+	updateCheckIntervalSeconds: number()
 });
 var AddonAutoUpdateSchema = ChannelWithInheritSchema;
 var RestartAddonResultSchema = unknown();
@@ -21099,7 +21213,9 @@ method(_void(), array(AddonListItemSchema).readonly()), method(object({
 	auth: "admin"
 }), method(_void(), AutoUpdateSettingsSchema, { auth: "admin" }), method(object({
 	channel: ChannelSchema,
-	intervalSeconds: number().min(300).max(86400).optional()
+	intervalSeconds: number().min(300).max(86400).optional(),
+	/** Availability-poll cadence; see AutoUpdateSettingsSchema. */
+	updateCheckIntervalSeconds: number().min(900).max(604800).optional()
 }), unknown(), {
 	kind: "mutation",
 	auth: "admin"
@@ -26867,7 +26983,9 @@ var ExportOptionsSchema = object({
 	includeAudio: boolean(),
 	maxLifeMs: number().int().positive(),
 	deleteAfterDownload: boolean(),
-	title: string().max(200).optional()
+	title: string().max(200).optional(),
+	/** Notification-output target ids to ping when this export becomes ready. */
+	notifyTargetIds: array(string().min(1)).max(20).optional()
 }).superRefine((v, ctx) => {
 	if (v.speed !== void 0 && v.timelapse !== void 0) ctx.addIssue({
 		code: ZodIssueCode$16.custom,
@@ -26926,10 +27044,18 @@ var ExportBytesSchema = object({
 });
 method(object({
 	deviceId: number(),
-	profile: string(),
+	/** @deprecated Prefer `profiles`. Kept so timelapse/notifiers keep working. */
+	profile: string().optional(),
+	profiles: array(string()).min(1).optional(),
 	fromMs: number(),
 	toMs: number(),
 	options: ExportOptionsSchema
+}).superRefine((v, ctx) => {
+	if ((v.profiles !== void 0 && v.profiles.length > 0 ? v.profiles : v.profile !== void 0 ? [v.profile] : []).length < 1) ctx.addIssue({
+		code: ZodIssueCode$16.custom,
+		message: "pass profiles[] (min 1) or legacy profile",
+		path: ["profiles"]
+	});
 }), ExportRecordSchema, {
 	kind: "mutation",
 	auth: "protected"
@@ -30084,15 +30210,6 @@ var BaseDeviceProvider = class extends BaseAddon {
 			labels: ["probe not implemented"]
 		};
 	}
-	/**
-	* Top-level devices restored at once in {@link onRestoreDevices}.
-	*
-	* Four covers the fleets this ships to without turning a boot into a burst a
-	* camera NVR answers with a refusal. A provider whose upstream is a single
-	* session with a serial command channel (a Baichuan hub, an NVR that
-	* serialises ISAPI) should lower it; nothing needs to raise it.
-	*/
-	restoreConcurrency = 4;
 	async restoreDevices(savedDevices) {
 		await this.onRestoreDevices(savedDevices);
 		if (savedDevices.length > 0) this.ctx.logger.info(`Restored ${savedDevices.length} ${this.providerName} device(s)`);
@@ -30147,14 +30264,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 				});
 			}
 		};
-		let nextTopLevel = 0;
-		await Promise.all(Array.from({ length: Math.min(Math.max(1, this.restoreConcurrency), topLevel.length) }, async () => {
-			for (;;) {
-				const saved = topLevel[nextTopLevel++];
-				if (saved === void 0) return;
-				await restoreOne(saved);
-			}
-		}));
+		await Promise.all(topLevel.map((saved) => restoreOne(saved)));
 		const childRows = savedDevices.filter((s) => s.parentDeviceId !== null);
 		for (const saved of childRows) {
 			const Class = this.deviceClasses[saved.type];
@@ -33492,6 +33602,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.reconcileFromDisk": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.refreshStorageLocationsForMigration": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -33894,6 +34010,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getReconcileFromDiskStatus": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.listAgentSettings": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -33918,6 +34040,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.reconcileFromDisk": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.removeAgentSettings": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -36909,6 +37037,11 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"pipelineAnalytics.reconcileFromDisk": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.restageRetrainTrack": [{
 		name: "deviceId",
 		form: "single",
@@ -37974,6 +38107,8 @@ DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
+var MB = 1024 * 1024;
+1024 * MB, 3072 * MB;
 //#endregion
 //#region ../../node_modules/undici/lib/core/symbols.js
 var require_symbols = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, module) => {
@@ -236782,6 +236917,26 @@ function computeHealthCheckBackoffMs(consecutive) {
 	return 15 * 6e4;
 }
 //#endregion
+//#region src/simple-event-dispatch-trace.ts
+/**
+* Gate for hub-side simpleEvent traces.
+*
+* Hub-child events arrive on the parent's Baichuan socket. Logging them on
+* the child logger only is invisible when the operator filters Logs to the
+* Hub; logging every channel unconditionally floods the Hub (battery ticks).
+* Trace when the target camera — or the hub itself — is under debug.
+*/
+function shouldTraceSimpleEventDispatch(input) {
+	return wantsEventTrace(input.hubDebugGeneral, input.hubSocketFlags) || wantsEventTrace(input.childDebugGeneral, input.childSocketFlags);
+}
+function wantsEventTrace(debugGeneral, socketFlags) {
+	return debugGeneral || socketFlags.includes("traceEvents");
+}
+/** Narrow a persisted `debugSocketLogs` blob to string flags. */
+function asDebugSocketFlags(value) {
+	return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
+}
+//#endregion
 //#region src/reolink-hub.ts
 var HUB_DISCOVERY_REFRESH_TIMEOUT_MS = 8e3;
 /**
@@ -237550,6 +237705,18 @@ var ReolinkHub = class ReolinkHub extends BaseDevice {
 		}
 		this.ctx.devices.getAll().then((all) => all.find((d) => d.id === deviceId)).then((child) => {
 			if (!(child instanceof ReolinkCamera)) return;
+			if (shouldTraceSimpleEventDispatch({
+				hubDebugGeneral: this.config.get("debugGeneral") === true,
+				hubSocketFlags: asDebugSocketFlags(this.config.get("debugSocketLogs")),
+				childDebugGeneral: child.config.get("debugGeneral") === true,
+				childSocketFlags: asDebugSocketFlags(child.config.get("debugSocketLogs"))
+			})) this.ctx.logger.info("Reolink Hub: simpleEvent dispatch", { meta: {
+				type: ev?.type ?? "unknown",
+				channel,
+				timestamp: ev?.timestamp,
+				deviceId: child.id,
+				name: child.name
+			} });
 			child.handleSimpleEvent(ev);
 		}).catch((err) => {
 			this.ctx.logger.debug("Hub simpleEvent dispatch failed", { meta: {

package/dist/addon.mjs

@@ -21,7 +21,7 @@ import netImpl from "net";
 import { fileURLToPath } from "url";
 import { mkdir } from "fs/promises";
 import os from "node:os";
-//#region ../types/dist/event-category-Bxo5yJjt.mjs
+//#region ../types/dist/event-category-XfKNtfCc.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -38,9 +38,10 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
 	/**
 	* A newer addon or server-root package version was found by the
-	* authoritative registry check. Emitted once per
-	* `(target, packageName, currentVersion, latestVersion)` transition; repeated
-	* polling of the same result is deduplicated by the checker.
+	* authoritative registry check. Emitted once when any observed
+	* `latestVersion` changes (or a package/node first appears behind);
+	* the payload carries the full currently-available list. Repeated
+	* polling of the same latests is silent.
 	*/
 	EventCategory["UpdateAvailable"] = "update.available";
 	/**
@@ -59,6 +60,22 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["AddonInstalled"] = "addon.installed";
 	EventCategory["AddonUninstalled"] = "addon.uninstalled";
 	EventCategory["AddonCrashed"] = "addon.crashed";
+	/**
+	* A RUNNER the D6 crash circuit-breaker gave up on — terminal.
+	*
+	* `AddonCrashed` is the routine, self-healing fact ("it crashed; it is being
+	* respawned"); this is the one that never resolves itself. Emitted exactly
+	* once per trip, by `process-service.ts`, carrying the node, the runner, the
+	* addons it hosted and the crash count that tripped the breaker.
+	*
+	* It exists because a runner marked terminally `failed` used to be SILENT:
+	* on 2026-08-18 the `recorder` runner died of three unhandled ffmpeg spawn
+	* errors, the breaker stopped respawning it (correctly), `/health` kept
+	* returning 200, and fleet-wide recording was gone for 3h15 before the
+	* operator's phone told him. The Notification Center's system-event intake
+	* consumes this category and maps it to the `addon-crash-loop` kind.
+	*/
+	EventCategory["AddonRunnerFailed"] = "addon.runner-failed";
 	EventCategory["AddonError"] = "addon.error";
 	EventCategory["AddonPageReady"] = "addon.page-ready";
 	EventCategory["AddonWidgetReady"] = "addon.widget-ready";
@@ -7582,6 +7599,10 @@ var RecordingBandSchema = object({
 	preBufferSec: number().min(0).optional(),
 	postBufferSec: number().min(0).optional()
 });
+({
+	preBufferSec: 10,
+	postBufferSec: 30
+}).postBufferSec * 1e3;
 /**
 * Per-device retention overrides. Every field is optional; an unset or `0`
 * value inherits the node-wide recorder default. Only footage-lifetime limits
@@ -7629,6 +7650,12 @@ var RecordingConfigSchema = object({
 	/** DERIVED summary of `bands`, stamped by the recorder on every save.
 	*  Authoring it has no effect — see {@link RecordingStorageModeSchema}. */
 	mode: RecordingStorageModeSchema.optional(),
+	/**
+	* Which assigned broker slots to record. Absent / empty = {@link
+	* DEFAULT_RECORDING_PROFILES} (`high`+`low`) intersected with the
+	* camera's currently assigned slots — never `mid` unless the operator
+	* picks it, and never a slot the broker has not assigned.
+	*/
 	profiles: array(CamProfileSchema).optional(),
 	segmentSeconds: number().int().positive().optional(),
 	/**
@@ -7709,7 +7736,11 @@ var RelocateFootageInputSchema = object({
 	profiles: array(string()).optional(),
 	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
 	*  never allowed to starve live writers. */
-	throttleMbps: number().min(1).max(1e3).optional()
+	throttleMbps: number().min(1).max(1e3).optional(),
+	/** Move only segments whose startMs is >= this. Absent = the whole source
+	*  pile. Used when a full drain is too expensive and the operator only
+	*  wants the recent window on the new disk. */
+	sinceMs: number().int().optional()
 });
 /** Internal, lease-scoped participant operation. It is intentionally separate
 * from persistent recording settings: a migration never changes
@@ -14761,6 +14792,7 @@ var NcSystemEventKindSchema = _enum([
 	"node-offline",
 	"node-inference-unavailable",
 	"detection-blind",
+	"addon-crash-loop",
 	"addon-update-available",
 	"server-update-available",
 	"alarm-triggered",
@@ -14768,6 +14800,9 @@ var NcSystemEventKindSchema = _enum([
 	"alarm-disarmed",
 	"alarm-arming",
 	"alarm-arm-refused",
+	"addon-updated",
+	"server-updated",
+	"export-completed",
 	"camera-online",
 	"camera-offline",
 	"camera-disabled",
@@ -16661,13 +16696,19 @@ var RetrainStatusSchema = _enum([
 * "never marked" from "already trained" must read `retrainStatus`.
 *
 * `debug` does NOT pin; it is attention, not durability.
+*
+* `favourited` IS a BOOLEAN pin (durability bit), not a retrain lifecycle.
+* A favourited track is skipped by retention the same way `staging` is, but
+* it does not enter `none|staging|trained` and has no staging budget.
 */
 var TrackFlagFields = {
 	/** Operator marked this track as training material — i.e. `retrainStatus` is
 	*  `'staging'`. */
 	markForTrain: boolean().optional(),
 	/** Operator marked this track for diagnostic attention. */
-	debug: boolean().optional()
+	debug: boolean().optional(),
+	/** Operator favourited this track. Pins it against pruning. */
+	favourited: boolean().optional()
 };
 /**
 * The lifecycle field itself, on the READ surfaces only (`Track`, `KeyEvent`).
@@ -16692,6 +16733,7 @@ var TrackFlagsSchema = object({
 	trackId: string(),
 	markForTrain: boolean(),
 	debug: boolean(),
+	favourited: boolean(),
 	/** The lifecycle state the boolean was derived from. Required here (unlike on
 	*  a track row) because this shape is only ever produced by the write body,
 	*  which always knows it — and a surface that has just written needs to render
@@ -17324,6 +17366,12 @@ var TrackCascadeCountsSchema = object({
 	/** Per-track CLIP search vectors removed (best-effort). */
 	embeddings: number().int()
 });
+/** Disk-wins reconcile: media rows whose blobs are gone, then empty tracks. */
+var DiskReconcileCountsSchema = object({
+	mediaDropped: number().int(),
+	tracks: number().int(),
+	events: number().int()
+});
 /** Event-store footprint for one camera. */
 var EventStoreDeviceFootprintSchema = object({
 	deviceId: number(),
@@ -17500,6 +17548,9 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(object({ deviceId: number() }), TrackCascadeCountsSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ deviceId: number() }), DiskReconcileCountsSchema, {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	trackIds: array(string()).min(1)
@@ -19050,6 +19101,24 @@ var CameraStatusDegradationSchema = object({
 *
 * See spec: `docs/superpowers/specs/2026-06-24-camera-status-aggregator-cap.md`
 */
+var DiskReconcileJobSchema = object({
+	state: _enum([
+		"idle",
+		"running",
+		"done",
+		"error"
+	]),
+	total: number().int().nonnegative(),
+	completed: number().int().nonnegative(),
+	currentDeviceId: number().int().nullable(),
+	failed: array(number().int()).readonly(),
+	mediaDropped: number().int().nonnegative(),
+	tracks: number().int().nonnegative(),
+	events: number().int().nonnegative(),
+	startedAtMs: number().int().nullable(),
+	finishedAtMs: number().int().nullable(),
+	error: string().nullable()
+});
 var CameraStatusSchema = object({
 	deviceId: number(),
 	assignment: CameraAssignmentStatusSchema,
@@ -19281,7 +19350,10 @@ method(StorageMigrationLeaseInputSchema, object({ paused: literal(true) }), {
 }), CameraSwitchGroupSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceId: number() }), CameraStatusSchema), method(object({ deviceIds: array(number()).optional() }), array(CameraStatusSchema).readonly()), method(_void(), array(PipelineTemplateSchema).readonly()), method(object({
+}), method(object({ deviceId: number() }), CameraStatusSchema), method(object({ deviceIds: array(number()).optional() }), array(CameraStatusSchema).readonly()), method(_void(), DiskReconcileJobSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), DiskReconcileJobSchema, { auth: "admin" }), method(_void(), array(PipelineTemplateSchema).readonly()), method(object({
 	name: string(),
 	description: string().optional(),
 	config: CameraPipelineConfigSchema
@@ -20458,20 +20530,6 @@ var VectorStatsResultSchema = object({
 	exact: boolean()
 });
 method(VectorDeclareIndexInputSchema, _void(), { kind: "mutation" }), method(VectorUpsertInputSchema, VectorUpsertResultSchema, { kind: "mutation" }), method(VectorQueryInputSchema, VectorQueryResultSchema), method(VectorGetInputSchema, VectorGetResultSchema), method(VectorDeleteInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorStatsInputSchema, VectorStatsResultSchema);
-/**
-* `videoclips` — the unified, navigable-clip surface for a camera.
-*
-* A device-scoped WRAPPER cap (like `pipeline-analytics`): exactly one active
-* provider per device, substitutable. The DEFAULT provider (registered by
-* `addon-post-analysis`, `defaultActive: true`) composes the analytics event
-* log (markers + thumbnails) with the recorder's `getPlaybackManifest` — a clip
-* is a time-WINDOW over existing footage, never a separate file. A camera that
-* exposes NATIVE onboard clips (Reolink/Hikvision NVR) can later substitute the
-* wrapper provider for its device and serve its own clip catalog + URLs.
-*
-* A `Clip` is purely time-based (subtree-blind): playback resolves segments by
-* temporal overlap, so the API never decides `continuous` vs `events`.
-*/
 var ClipSchema = object({
 	/** Opaque, provider-namespaced id. The default provider encodes the time
 	*  window so `getClipPlayback` is self-contained (no event re-query). */
@@ -20488,8 +20546,57 @@ var ClipSchema = object({
 		startMs: number(),
 		endMs: number()
 	}),
-	/** Thumbnail URL (lazy; e.g. analytics `getEventMedia`). Never inlined. */
-	thumbnail: string().optional()
+	/**
+	* Lazy thumbnail URL, never inlined.
+	*
+	* Recording-derived clips (events-mode keep-window, and the prepared
+	* continuous event+fragment visit) MUST use the snapshot of the **main
+	* event of the interval** — `getEventMedia({ eventId, kind: 'snapshot' })`
+	* of the event that owns `kind` (object > motion > audio). Do not extract
+	* a keyframe from the recorded segments. Other providers (onboard, HKSV)
+	* mint their own stills.
+	*
+	* **VOUCHED, never fabricated.** A provider emits this only for an event it
+	* has CONFIRMED owns at least one media row (its own, or its owning track's).
+	* Absent is meaningful — "this visit has no event still" — never "we did not
+	* look". Stamping it from a URL template made 35% of one camera's clips point
+	* at a 404 (device 3836, 2026-08-17: 64 of 179 clips dead, 63 of them motion).
+	* A read that FAILS drops the claim; it never invents it.
+	*/
+	thumbnail: string().optional(),
+	/**
+	* An instant INSIDE this visit's footage, hole-safe, where a recorded still
+	* can be decoded. Present whenever the visit came from recorded availability;
+	* absent on a per-event padded window (there is no footage to promise).
+	*
+	* This is not a thumbnail and not a second byte path: it is the argument to
+	* the recorder's existing still route. The surface — never the provider —
+	* decides whether to use it. It is the midpoint of the visit's LONGEST
+	* contiguous range, not of the visit: a visit spans its holes by
+	* construction, so a naive midpoint lands in dead air.
+	*/
+	stillAtMs: number().optional(),
+	/**
+	* Analytics event ids that overlap this visit — a BOUNDED sample, newest
+	* first within kind (object → motion → audio), capped at
+	* {@link MAX_CLIP_EVENT_IDS}. Empty on footage-only clips.
+	*
+	* Bounded because it is not a payload the surface pages through: one visit on
+	* device 615 carried 2 345 ids, and `eventIds` was 99% of a 153 KB
+	* camera-day. Read {@link eventCount} for the true total.
+	*/
+	eventIds: array(string()).optional(),
+	/** How many analytics events actually overlap this visit. Differs from
+	*  `eventIds.length` exactly when the sample was capped — so a truncated
+	*  list is never mistaken for a quiet visit. */
+	eventCount: number().int().nonnegative().optional(),
+	/** Intra-visit footage holes (GOP rolls, discarded segments) still shorter
+	*  than `VISIT_MERGE_GAP_MS`. Playback concatenates around them; the timeline
+	*  bar keeps showing them via `recording.getAvailability`. */
+	holes: array(object({
+		startMs: number(),
+		endMs: number()
+	})).optional()
 });
 var ClipPlaybackSchema = object({
 	/** HLS master URL through the hub data-plane (Range + token in path). */
@@ -20953,7 +21060,14 @@ var SearchResultSchema = object({
 });
 var AutoUpdateSettingsSchema = object({
 	channel: ChannelSchema,
-	intervalSeconds: number()
+	intervalSeconds: number(),
+	/**
+	* Cadence of the "an update exists" POLLER, in seconds. Independent of
+	* `channel`: the poller runs while auto-apply is `off`, because being told
+	* about a publish and installing it are different decisions. Clamped
+	* server-side to 900 s … 604800 s; defaults to 21600 s (6 h).
+	*/
+	updateCheckIntervalSeconds: number()
 });
 var AddonAutoUpdateSchema = ChannelWithInheritSchema;
 var RestartAddonResultSchema = unknown();
@@ -21094,7 +21208,9 @@ method(_void(), array(AddonListItemSchema).readonly()), method(object({
 	auth: "admin"
 }), method(_void(), AutoUpdateSettingsSchema, { auth: "admin" }), method(object({
 	channel: ChannelSchema,
-	intervalSeconds: number().min(300).max(86400).optional()
+	intervalSeconds: number().min(300).max(86400).optional(),
+	/** Availability-poll cadence; see AutoUpdateSettingsSchema. */
+	updateCheckIntervalSeconds: number().min(900).max(604800).optional()
 }), unknown(), {
 	kind: "mutation",
 	auth: "admin"
@@ -26862,7 +26978,9 @@ var ExportOptionsSchema = object({
 	includeAudio: boolean(),
 	maxLifeMs: number().int().positive(),
 	deleteAfterDownload: boolean(),
-	title: string().max(200).optional()
+	title: string().max(200).optional(),
+	/** Notification-output target ids to ping when this export becomes ready. */
+	notifyTargetIds: array(string().min(1)).max(20).optional()
 }).superRefine((v, ctx) => {
 	if (v.speed !== void 0 && v.timelapse !== void 0) ctx.addIssue({
 		code: ZodIssueCode$16.custom,
@@ -26921,10 +27039,18 @@ var ExportBytesSchema = object({
 });
 method(object({
 	deviceId: number(),
-	profile: string(),
+	/** @deprecated Prefer `profiles`. Kept so timelapse/notifiers keep working. */
+	profile: string().optional(),
+	profiles: array(string()).min(1).optional(),
 	fromMs: number(),
 	toMs: number(),
 	options: ExportOptionsSchema
+}).superRefine((v, ctx) => {
+	if ((v.profiles !== void 0 && v.profiles.length > 0 ? v.profiles : v.profile !== void 0 ? [v.profile] : []).length < 1) ctx.addIssue({
+		code: ZodIssueCode$16.custom,
+		message: "pass profiles[] (min 1) or legacy profile",
+		path: ["profiles"]
+	});
 }), ExportRecordSchema, {
 	kind: "mutation",
 	auth: "protected"
@@ -30079,15 +30205,6 @@ var BaseDeviceProvider = class extends BaseAddon {
 			labels: ["probe not implemented"]
 		};
 	}
-	/**
-	* Top-level devices restored at once in {@link onRestoreDevices}.
-	*
-	* Four covers the fleets this ships to without turning a boot into a burst a
-	* camera NVR answers with a refusal. A provider whose upstream is a single
-	* session with a serial command channel (a Baichuan hub, an NVR that
-	* serialises ISAPI) should lower it; nothing needs to raise it.
-	*/
-	restoreConcurrency = 4;
 	async restoreDevices(savedDevices) {
 		await this.onRestoreDevices(savedDevices);
 		if (savedDevices.length > 0) this.ctx.logger.info(`Restored ${savedDevices.length} ${this.providerName} device(s)`);
@@ -30142,14 +30259,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 				});
 			}
 		};
-		let nextTopLevel = 0;
-		await Promise.all(Array.from({ length: Math.min(Math.max(1, this.restoreConcurrency), topLevel.length) }, async () => {
-			for (;;) {
-				const saved = topLevel[nextTopLevel++];
-				if (saved === void 0) return;
-				await restoreOne(saved);
-			}
-		}));
+		await Promise.all(topLevel.map((saved) => restoreOne(saved)));
 		const childRows = savedDevices.filter((s) => s.parentDeviceId !== null);
 		for (const saved of childRows) {
 			const Class = this.deviceClasses[saved.type];
@@ -33487,6 +33597,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.reconcileFromDisk": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.refreshStorageLocationsForMigration": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -33889,6 +34005,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getReconcileFromDiskStatus": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.listAgentSettings": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -33913,6 +34035,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.reconcileFromDisk": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.removeAgentSettings": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -36904,6 +37032,11 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"pipelineAnalytics.reconcileFromDisk": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.restageRetrainTrack": [{
 		name: "deviceId",
 		form: "single",
@@ -37969,6 +38102,8 @@ DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
+var MB = 1024 * 1024;
+1024 * MB, 3072 * MB;
 //#endregion
 //#region ../../node_modules/undici/lib/core/symbols.js
 var require_symbols = /* @__PURE__ */ __commonJSMin(((exports, module) => {
@@ -236762,6 +236897,26 @@ function computeHealthCheckBackoffMs(consecutive) {
 	return 15 * 6e4;
 }
 //#endregion
+//#region src/simple-event-dispatch-trace.ts
+/**
+* Gate for hub-side simpleEvent traces.
+*
+* Hub-child events arrive on the parent's Baichuan socket. Logging them on
+* the child logger only is invisible when the operator filters Logs to the
+* Hub; logging every channel unconditionally floods the Hub (battery ticks).
+* Trace when the target camera — or the hub itself — is under debug.
+*/
+function shouldTraceSimpleEventDispatch(input) {
+	return wantsEventTrace(input.hubDebugGeneral, input.hubSocketFlags) || wantsEventTrace(input.childDebugGeneral, input.childSocketFlags);
+}
+function wantsEventTrace(debugGeneral, socketFlags) {
+	return debugGeneral || socketFlags.includes("traceEvents");
+}
+/** Narrow a persisted `debugSocketLogs` blob to string flags. */
+function asDebugSocketFlags(value) {
+	return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
+}
+//#endregion
 //#region src/reolink-hub.ts
 var HUB_DISCOVERY_REFRESH_TIMEOUT_MS = 8e3;
 /**
@@ -237530,6 +237685,18 @@ var ReolinkHub = class ReolinkHub extends BaseDevice {
 		}
 		this.ctx.devices.getAll().then((all) => all.find((d) => d.id === deviceId)).then((child) => {
 			if (!(child instanceof ReolinkCamera)) return;
+			if (shouldTraceSimpleEventDispatch({
+				hubDebugGeneral: this.config.get("debugGeneral") === true,
+				hubSocketFlags: asDebugSocketFlags(this.config.get("debugSocketLogs")),
+				childDebugGeneral: child.config.get("debugGeneral") === true,
+				childSocketFlags: asDebugSocketFlags(child.config.get("debugSocketLogs"))
+			})) this.ctx.logger.info("Reolink Hub: simpleEvent dispatch", { meta: {
+				type: ev?.type ?? "unknown",
+				channel,
+				timestamp: ev?.timestamp,
+				deviceId: child.id,
+				name: child.name
+			} });
 			child.handleSimpleEvent(ev);
 		}).catch((err) => {
 			this.ctx.logger.debug("Hub simpleEvent dispatch failed", { meta: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-reolink",
-  "version": "1.2.41",
+  "version": "1.2.43",
   "description": "Reolink camera device provider addon for CamStack — native Baichuan protocol",
   "keywords": [
     "camstack",