@camstack/system 1.2.134 → 1.2.136

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { S as authProviderCapability, _ as UserRecordSchema, ht as userManagementCapability, m as ScopedTokenSchema, r as ApiKeyRecordSchema, yt as BaseAddon } from "../../dist-BUEU7B1V.mjs";
+import { S as authProviderCapability, _ as UserRecordSchema, ht as userManagementCapability, m as ScopedTokenSchema, r as ApiKeyRecordSchema, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DqcaE-k1.js");
+const require_dist = require("../../dist-D-R0SuP-.js");
 const require_tls = require("../../tls-u8QCJCFE.js");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Y as localNetworkCapability, yt as BaseAddon } from "../../dist-BUEU7B1V.mjs";
+import { Gt as EventCategory, Y as localNetworkCapability, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
 import { S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, i as writeExtraSans, l as reissueTlsLeaf, n as readTlsAccessStatus, o as validateUploadedTls, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, y as applyLanHttp } from "../../tls-CQhPGSJm.mjs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DqcaE-k1.js");
+const require_dist = require("../../dist-D-R0SuP-.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-BUEU7B1V.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DqcaE-k1.js");
+const require_dist = require("../../dist-D-R0SuP-.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as metricsProviderCapability, Gt as EventCategory, Mt as createEvent, yt as BaseAddon } from "../../dist-BUEU7B1V.mjs";
+import { $ as metricsProviderCapability, Gt as EventCategory, Mt as createEvent, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
 import * as os from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DqcaE-k1.js");
+const require_dist = require("../../dist-D-R0SuP-.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Gt as EventCategory, L as enumerateInferenceDevices, Pt as emitReadiness, ct as scoreRuntimes, rt as platformProbeCapability, vt as errMsg, yt as BaseAddon } from "../../dist-BUEU7B1V.mjs";
+import { Gt as EventCategory, L as enumerateInferenceDevices, Pt as emitReadiness, ct as scoreRuntimes, rt as platformProbeCapability, vt as errMsg, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import * as os from "node:os";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DqcaE-k1.js");
+const require_dist = require("../../dist-D-R0SuP-.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, yt as BaseAddon } from "../../dist-BUEU7B1V.mjs";
+import { Gt as EventCategory, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DqcaE-k1.js");
+const require_dist = require("../../dist-D-R0SuP-.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Ct as DeviceFeature, Gt as EventCategory, M as deriveBatteryPresence, Rt as nodePin, T as batteryCapability, Tt as DeviceType, i as BatteryStatusSchema, mt as streamQualityLabel, ut as snapshotCapability, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-BUEU7B1V.mjs";
+import { Ct as DeviceFeature, Gt as EventCategory, M as deriveBatteryPresence, Rt as nodePin, T as batteryCapability, Tt as DeviceType, i as BatteryStatusSchema, mt as streamQualityLabel, ut as snapshotCapability, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { signExpiringUrl, verifyExpiringUrl } from "@camstack/types/node";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DqcaE-k1.js");
+const require_dist = require("../../dist-D-R0SuP-.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { V as filesystemBrowseCapability, pt as storageProviderCapability, yt as BaseAddon } from "../../dist-BUEU7B1V.mjs";
+import { V as filesystemBrowseCapability, pt as storageProviderCapability, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/sqlite-settings-backend.d.ts

@@ -45,6 +45,22 @@ export interface DroppedTable {
 export declare function scopeOwnerOf(filter: QueryFilter | undefined): {
     owner?: string;
 };
+/**
+ * Stable identity of a declared schema — every property that changes the DDL
+ * or the set of columns a filter can name.
+ *
+ * Deliberately covers `indexes` too: an added index is as invisible to a
+ * name-only memo as an added column, and `CREATE INDEX IF NOT EXISTS` is
+ * cheap enough that re-running it costs nothing.
+ */
+/**
+ * A `query` asked to read a column the collection cannot serve. Distinct type
+ * so a caller can map it to a 400 — it is always a programming error in the
+ * caller, never a condition of the data.
+ */
+export declare class UnprojectableColumnError extends Error {
+    constructor(message: string);
+}
 /**
  * SQLite implementation of ISettingsBackend.
  *
@@ -130,7 +146,7 @@ export declare class SqliteSettingsBackend implements ISettingsBackend {
     getEngineInfo(): Promise<DataStoreEngineInfo>;
     get({ namespace, collection, key }: SettingsGetInput): Promise<unknown>;
     set({ namespace, collection, key, value }: SettingsSetInput): Promise<void>;
-    query<T extends object = Record<string, unknown>>({ namespace, collection, filter, }: SettingsQueryInput): Promise<readonly SettingsRecord<T>[]>;
+    query<T extends object = Record<string, unknown>>({ namespace, collection, filter, columns, }: SettingsQueryInput): Promise<readonly SettingsRecord<T>[]>;
     insert<T extends object = Record<string, unknown>>({ namespace, collection, record, }: SettingsInsertInput<T>): Promise<void>;
     update({ namespace, collection, id, data }: SettingsUpdateInput): Promise<void>;
     delete({ namespace, collection, key }: SettingsDeleteInput): Promise<void>;
@@ -151,6 +167,28 @@ export declare class SqliteSettingsBackend implements ISettingsBackend {
      * uncapped `tableUpdate` would have done.
      */
     updateWhere({ namespace, collection, filter, data, }: SettingsUpdateWhereInput): Promise<SettingsUpdateWhereResult>;
+    /**
+     * How many rows match — about the SAME rows {@link query} would return.
+     *
+     * That agreement is the entire contract, and until now it did not hold. This
+     * was the FOURTH hand-rolled copy of the filter logic (after `query`, the
+     * bulk mutations and `histogram`) and it compiled only `where`:
+     * `whereBetween`, `whereIn` and `whereNot` were dropped silently, so the
+     * count was not slow, it was WRONG, and always wrong in the same direction —
+     * too big, because every dropped predicate is a predicate that would have
+     * excluded rows.
+     *
+     * Two live callers decided on it. `TrackStore.countStaging({ deviceId,
+     * olderThanMs })` sends the cutoff as `whereBetween: { lastSeen: [0, …] }`
+     * and got the device's whole staging history instead. The notification-centre
+     * artefact gallery pages on `total` from this method while listing through
+     * `query`, and its filter is almost entirely `whereIn`/`whereBetween`
+     * (visibility, kind, device, time window, expiry) — so `total` counted rows
+     * the page could never show, including other users'.
+     *
+     * `select` mode, deliberately: `count` must be forgiving in exactly the way
+     * `query` is, or the two disagree again for a new reason.
+     */
     count({ namespace, collection, filter }: SettingsCountInput): Promise<number>;
     histogram({ namespace, collection, field, bucketSize, origin, filter, }: SettingsHistogramInput): Promise<readonly HistogramBucket[]>;
     isEmpty({ namespace, collection }: SettingsIsEmptyInput): Promise<boolean>;

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DqcaE-k1.js");
+const require_dist = require("../../dist-D-R0SuP-.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { dt as storageCapability, ft as storageMigrationCapability, g as StorageMigrationJobSchema, h as StorageLocationTypeSchema, lt as settingsStoreCapability, yt as BaseAddon, zt as parseJsonObject } from "../../dist-BUEU7B1V.mjs";
+import { dt as storageCapability, ft as storageMigrationCapability, g as StorageMigrationJobSchema, h as StorageLocationTypeSchema, lt as settingsStoreCapability, yt as BaseAddon, zt as parseJsonObject } from "../../dist-Bh25kEUH.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DqcaE-k1.js");
+const require_dist = require("../../dist-D-R0SuP-.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { It as hydrateSchema, vt as errMsg, yt as BaseAddon } from "../../dist-BUEU7B1V.mjs";
+import { It as hydrateSchema, vt as errMsg, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DqcaE-k1.js");
+const require_dist = require("../../dist-D-R0SuP-.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-BUEU7B1V.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-BUEU7B1V.mjs → dist-Bh25kEUH.mjs}

@@ -3704,24 +3704,6 @@ var RecordingRetentionSchema = z.object({
 	maxSizeGb: z.number().min(0).optional()
 });
 /**
-* Scrub-thumbnail fidelity preset — the single per-camera selector bundling the
-* sprite tile RESOLUTION + JPEG QUALITY the recorder packs timeline-scrub
-* previews at. Five graduated steps; absent on a config = `standard` (the
-* shipped default, matching `sheet-geometry`/`sheet-composer`).
-*
-* Existing sheets are IMMUTABLE — a changed preset applies to NEW windows only.
-* Each window's index sidecar carries its own tile dims, so a camera whose
-* preset changed over time renders every historical window at the dims it was
-* written with.
-*/
-var ScrubThumbnailPresetSchema = z.enum([
-	"minimal",
-	"low",
-	"standard",
-	"high",
-	"max"
-]);
-/**
 * The full per-camera recording intent — the wire shape of a RecordingTarget.
 *
 * `bands` is the ONLY authored recording intent: what to record, when, and on
@@ -3729,7 +3711,11 @@ var ScrubThumbnailPresetSchema = z.enum([
 * other field is a storage knob (profiles, segment length, retention, scrub).
 *
 * STRICT on purpose: the legacy authoring surface (`schedule`/`schedules`/
-* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30.
+* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30,
+* and `scrubThumbnails` — a five-step fidelity knob for a sprite tier that was
+* deleted on 2026-07-24 and had ZERO consumers in the recorder — on 2026-08-25
+* (D62: a switch that writes a store nobody reads is worse than no switch).
+* Stored rows keep loading: the READ schema is `.strip()` (config-store.ts).
 * A stale caller must fail loudly — silently stripping its legacy intent would
 * persist a band-less config, i.e. silently stop recording the camera.
 */
@@ -3752,14 +3738,7 @@ var RecordingConfigSchema = z.object({
 	* "off" is the absence of a covering band, never a band value.
 	*/
 	bands: z.array(RecordingBandSchema).default([]),
-	retention: RecordingRetentionSchema.optional(),
-	/**
-	* Per-camera scrub-thumbnail fidelity preset (resolution + JPEG quality for
-	* timeline-scrub sprite previews). Absent = `standard`. Applies to NEW
-	* windows only — existing sheets are immutable, and each window's index
-	* carries its own tile dims so mixed-preset history renders correctly.
-	*/
-	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
+	retention: RecordingRetentionSchema.optional()
 }).strict();
 /**
 * Entity-relocation job state (storage entity-routing spec, Phase 4).
@@ -8060,11 +8039,26 @@ var settingsStoreCapability = {
 			key: z.string(),
 			value: z.unknown()
 		}), z.void(), { kind: "mutation" }),
-		/** Get all entries matching an optional filter. */
+		/**
+		* Rows matching a filter.
+		*
+		* `columns` is a SQL-level projection: the engine SELECTs only those
+		* columns (plus the primary key) instead of the whole row. It is the only
+		* way to stop paying disk for a column that is discarded — a heavy JSON
+		* column dominates the row, and dropping it in JS after the read pays every
+		* byte first. Measured on the live `pipeline-analytics:tracks` table: a
+		* 501-row page is 4.6 MB whole and 0.11 MB projected, same index, same
+		* plan.
+		*
+		* The engine REFUSES a column it cannot serve rather than omitting it —
+		* see `SettingsQueryInput.columns` for why a projection may not be
+		* forgiving the way a predicate is.
+		*/
 		query: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
-			filter: QueryFilterSchema.optional()
+			filter: QueryFilterSchema.optional(),
+			columns: z.array(z.string()).readonly().optional()
 		}), z.array(SettingsRecordSchema).readonly()),
 		/** Insert a new record. */
 		insert: method(z.object({
@@ -8229,7 +8223,17 @@ var dataStoreProviderCapability = {
 		query: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
-			filter: QueryFilterSchema.optional()
+			filter: QueryFilterSchema.optional(),
+			/**
+			* SQL-level column projection — MUST mirror `settings-store.query`.
+			*
+			* This is the second schema the same call passes through, and Zod
+			* objects STRIP what they do not declare: a field present on the door
+			* and absent here does not error, it silently disappears one hop before
+			* the engine, and the caller concludes the projection does nothing.
+			* `data-door-schema-parity.spec.ts` is what keeps the two in step.
+			*/
+			columns: z.array(z.string()).readonly().optional()
 		}), z.array(SettingsRecordSchema).readonly()),
 		/** Insert a new record. */
 		insert: method(z.object({
@@ -22863,7 +22867,27 @@ var faceGalleryCapability = {
 	scope: "system",
 	mode: "singleton",
 	methods: {
-		listIdentities: method(z.void(), z.array(IdentitySchema).readonly()),
+		listIdentities: method(z.object({ 
+		/**
+		* Inline {@link IdentitySchema.coverBase64} on every row.
+		*
+		* Default `false`, the same inversion `listRecentFaces` and
+		* `listPlates` took on 2026-08-25 (see `include-crops-default.ts` for
+		* why the burden belongs on the caller that WANTS the bytes). Measured
+		* on the live hub the same day: four identities cost 40,979 B with the
+		* covers inline, ~10 KB of base64 per row, on a query this UI mounts
+		* four times and the viewer holds at `staleTime: 30_000`.
+		*
+		* Nothing loses its avatar: `coverMediaKey` is already on every row and
+		* the `event-media` plane serves that key `immutable` with an ETag.
+		*
+		* **This is an INPUT field, so it does not reach the addon until the
+		* next train** — the hub router validates cap inputs against its own
+		* compiled Zod and strips a key it does not know. Until then the
+		* provider sees `undefined`, which resolves to `false`: the cheap shape
+		* is what ships, and the opt-in becomes reachable when the train lands.
+		*/
+includeCrops: z.boolean().optional() }).optional(), z.array(IdentitySchema).readonly()),
 		createIdentity: method(z.object({ name: z.string().min(1) }), IdentitySchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -26225,7 +26249,13 @@ var plateGalleryCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		listVehicles: method(z.void(), z.array(VehicleSchema).readonly()),
+		listVehicles: method(z.object({ 
+		/** Inline {@link VehicleSchema.coverBase64} on every row. Default
+		*  `false` — the vehicle twin of `faceGallery.listIdentities`'s
+		*  option; `coverMediaKey` + the `event-media` plane carry the picture.
+		*  INPUT field: stripped by the hub router until the train ships, which
+		*  resolves to `false` and is exactly the intended default. */
+includeCrops: z.boolean().optional() }).optional(), z.array(VehicleSchema).readonly()),
 		createVehicle: method(z.object({ name: z.string().min(1) }), VehicleSchema, {
 			kind: "mutation",
 			auth: "admin"

package/dist/{dist-DqcaE-k1.js → dist-D-R0SuP-.js}

@@ -3704,24 +3704,6 @@ var RecordingRetentionSchema = zod.z.object({
 	maxSizeGb: zod.z.number().min(0).optional()
 });
 /**
-* Scrub-thumbnail fidelity preset — the single per-camera selector bundling the
-* sprite tile RESOLUTION + JPEG QUALITY the recorder packs timeline-scrub
-* previews at. Five graduated steps; absent on a config = `standard` (the
-* shipped default, matching `sheet-geometry`/`sheet-composer`).
-*
-* Existing sheets are IMMUTABLE — a changed preset applies to NEW windows only.
-* Each window's index sidecar carries its own tile dims, so a camera whose
-* preset changed over time renders every historical window at the dims it was
-* written with.
-*/
-var ScrubThumbnailPresetSchema = zod.z.enum([
-	"minimal",
-	"low",
-	"standard",
-	"high",
-	"max"
-]);
-/**
 * The full per-camera recording intent — the wire shape of a RecordingTarget.
 *
 * `bands` is the ONLY authored recording intent: what to record, when, and on
@@ -3729,7 +3711,11 @@ var ScrubThumbnailPresetSchema = zod.z.enum([
 * other field is a storage knob (profiles, segment length, retention, scrub).
 *
 * STRICT on purpose: the legacy authoring surface (`schedule`/`schedules`/
-* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30.
+* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30,
+* and `scrubThumbnails` — a five-step fidelity knob for a sprite tier that was
+* deleted on 2026-07-24 and had ZERO consumers in the recorder — on 2026-08-25
+* (D62: a switch that writes a store nobody reads is worse than no switch).
+* Stored rows keep loading: the READ schema is `.strip()` (config-store.ts).
 * A stale caller must fail loudly — silently stripping its legacy intent would
 * persist a band-less config, i.e. silently stop recording the camera.
 */
@@ -3752,14 +3738,7 @@ var RecordingConfigSchema = zod.z.object({
 	* "off" is the absence of a covering band, never a band value.
 	*/
 	bands: zod.z.array(RecordingBandSchema).default([]),
-	retention: RecordingRetentionSchema.optional(),
-	/**
-	* Per-camera scrub-thumbnail fidelity preset (resolution + JPEG quality for
-	* timeline-scrub sprite previews). Absent = `standard`. Applies to NEW
-	* windows only — existing sheets are immutable, and each window's index
-	* carries its own tile dims so mixed-preset history renders correctly.
-	*/
-	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
+	retention: RecordingRetentionSchema.optional()
 }).strict();
 /**
 * Entity-relocation job state (storage entity-routing spec, Phase 4).
@@ -8060,11 +8039,26 @@ var settingsStoreCapability = {
 			key: zod.z.string(),
 			value: zod.z.unknown()
 		}), zod.z.void(), { kind: "mutation" }),
-		/** Get all entries matching an optional filter. */
+		/**
+		* Rows matching a filter.
+		*
+		* `columns` is a SQL-level projection: the engine SELECTs only those
+		* columns (plus the primary key) instead of the whole row. It is the only
+		* way to stop paying disk for a column that is discarded — a heavy JSON
+		* column dominates the row, and dropping it in JS after the read pays every
+		* byte first. Measured on the live `pipeline-analytics:tracks` table: a
+		* 501-row page is 4.6 MB whole and 0.11 MB projected, same index, same
+		* plan.
+		*
+		* The engine REFUSES a column it cannot serve rather than omitting it —
+		* see `SettingsQueryInput.columns` for why a projection may not be
+		* forgiving the way a predicate is.
+		*/
 		query: method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
-			filter: QueryFilterSchema.optional()
+			filter: QueryFilterSchema.optional(),
+			columns: zod.z.array(zod.z.string()).readonly().optional()
 		}), zod.z.array(SettingsRecordSchema).readonly()),
 		/** Insert a new record. */
 		insert: method(zod.z.object({
@@ -8229,7 +8223,17 @@ var dataStoreProviderCapability = {
 		query: method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
-			filter: QueryFilterSchema.optional()
+			filter: QueryFilterSchema.optional(),
+			/**
+			* SQL-level column projection — MUST mirror `settings-store.query`.
+			*
+			* This is the second schema the same call passes through, and Zod
+			* objects STRIP what they do not declare: a field present on the door
+			* and absent here does not error, it silently disappears one hop before
+			* the engine, and the caller concludes the projection does nothing.
+			* `data-door-schema-parity.spec.ts` is what keeps the two in step.
+			*/
+			columns: zod.z.array(zod.z.string()).readonly().optional()
 		}), zod.z.array(SettingsRecordSchema).readonly()),
 		/** Insert a new record. */
 		insert: method(zod.z.object({
@@ -22863,7 +22867,27 @@ var faceGalleryCapability = {
 	scope: "system",
 	mode: "singleton",
 	methods: {
-		listIdentities: method(zod.z.void(), zod.z.array(IdentitySchema).readonly()),
+		listIdentities: method(zod.z.object({ 
+		/**
+		* Inline {@link IdentitySchema.coverBase64} on every row.
+		*
+		* Default `false`, the same inversion `listRecentFaces` and
+		* `listPlates` took on 2026-08-25 (see `include-crops-default.ts` for
+		* why the burden belongs on the caller that WANTS the bytes). Measured
+		* on the live hub the same day: four identities cost 40,979 B with the
+		* covers inline, ~10 KB of base64 per row, on a query this UI mounts
+		* four times and the viewer holds at `staleTime: 30_000`.
+		*
+		* Nothing loses its avatar: `coverMediaKey` is already on every row and
+		* the `event-media` plane serves that key `immutable` with an ETag.
+		*
+		* **This is an INPUT field, so it does not reach the addon until the
+		* next train** — the hub router validates cap inputs against its own
+		* compiled Zod and strips a key it does not know. Until then the
+		* provider sees `undefined`, which resolves to `false`: the cheap shape
+		* is what ships, and the opt-in becomes reachable when the train lands.
+		*/
+includeCrops: zod.z.boolean().optional() }).optional(), zod.z.array(IdentitySchema).readonly()),
 		createIdentity: method(zod.z.object({ name: zod.z.string().min(1) }), IdentitySchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -26225,7 +26249,13 @@ var plateGalleryCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		listVehicles: method(zod.z.void(), zod.z.array(VehicleSchema).readonly()),
+		listVehicles: method(zod.z.object({ 
+		/** Inline {@link VehicleSchema.coverBase64} on every row. Default
+		*  `false` — the vehicle twin of `faceGallery.listIdentities`'s
+		*  option; `coverMediaKey` + the `event-media` plane carry the picture.
+		*  INPUT field: stripped by the hub router until the train ships, which
+		*  resolves to `false` and is exactly the intended default. */
+includeCrops: zod.z.boolean().optional() }).optional(), zod.z.array(VehicleSchema).readonly()),
 		createVehicle: method(zod.z.object({ name: zod.z.string().min(1) }), VehicleSchema, {
 			kind: "mutation",
 			auth: "admin"

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DqcaE-k1.js");
+const require_dist = require("./dist-D-R0SuP-.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -6763,6 +6763,23 @@ function createDoorSettingsView(addonId, door, sections) {
 		async readDeviceStore(deviceId) {
 			return loadPrefixed(door, "addon-device-settings", `${addonId}:${String(deviceId)}.`);
 		},
+		async readDeviceStoreBatch(deviceIds) {
+			const out = /* @__PURE__ */ new Map();
+			if (deviceIds.length === 0) return out;
+			for (const id of deviceIds) out.set(id, {});
+			const wanted = new Set(deviceIds);
+			const all = await loadPrefixed(door, "addon-device-settings", `${addonId}:`);
+			for (const [suffix, value] of Object.entries(all)) {
+				const dot = suffix.indexOf(".");
+				if (dot <= 0) continue;
+				const deviceId = Number(suffix.slice(0, dot));
+				if (!Number.isInteger(deviceId) || !wanted.has(deviceId)) continue;
+				const blob = out.get(deviceId);
+				if (blob === void 0) continue;
+				blob[suffix.slice(dot + 1)] = value;
+			}
+			return out;
+		},
 		async writeDeviceStore(deviceId, patch) {
 			const scope = `${addonId}:${String(deviceId)}.`;
 			await replacePrefixed(door, "addon-device-settings", scope, {

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { At as asNumber, B as extractNestedAddonId, Bt as parseJsonUnknown$1, Dt as ReadinessTimeoutError, Et as ReadinessRegistry, Ft as expandCapMethods, Gt as EventCategory$1, H as isArrayOutputSchema, Ht as resolveCapMount, J as lifecycleJobSchema, K as isVoidInput, Mt as createEvent, Nt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_STATUS_METHOD, U as isCollectionArrayMethod, Ut as scopeKey, Vt as readinessKey, W as isObjectInput, Z as logLevelAtMost, bt as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asString$1, kt as asJsonObject$1, ot as scopesAllowAddon, q as kebabToCamel, st as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, vt as errMsg$1, xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, y as addonSettingsCapability, zt as parseJsonObject } from "./dist-BUEU7B1V.mjs";
+import { At as asNumber, B as extractNestedAddonId, Bt as parseJsonUnknown$1, Dt as ReadinessTimeoutError, Et as ReadinessRegistry, Ft as expandCapMethods, Gt as EventCategory$1, H as isArrayOutputSchema, Ht as resolveCapMount, J as lifecycleJobSchema, K as isVoidInput, Mt as createEvent, Nt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_STATUS_METHOD, U as isCollectionArrayMethod, Ut as scopeKey, Vt as readinessKey, W as isObjectInput, Z as logLevelAtMost, bt as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asString$1, kt as asJsonObject$1, ot as scopesAllowAddon, q as kebabToCamel, st as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, vt as errMsg$1, xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, y as addonSettingsCapability, zt as parseJsonObject } from "./dist-Bh25kEUH.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -6756,6 +6756,23 @@ function createDoorSettingsView(addonId, door, sections) {
 		async readDeviceStore(deviceId) {
 			return loadPrefixed(door, "addon-device-settings", `${addonId}:${String(deviceId)}.`);
 		},
+		async readDeviceStoreBatch(deviceIds) {
+			const out = /* @__PURE__ */ new Map();
+			if (deviceIds.length === 0) return out;
+			for (const id of deviceIds) out.set(id, {});
+			const wanted = new Set(deviceIds);
+			const all = await loadPrefixed(door, "addon-device-settings", `${addonId}:`);
+			for (const [suffix, value] of Object.entries(all)) {
+				const dot = suffix.indexOf(".");
+				if (dot <= 0) continue;
+				const deviceId = Number(suffix.slice(0, dot));
+				if (!Number.isInteger(deviceId) || !wanted.has(deviceId)) continue;
+				const blob = out.get(deviceId);
+				if (blob === void 0) continue;
+				blob[suffix.slice(dot + 1)] = value;
+			}
+			return out;
+		},
 		async writeDeviceStore(deviceId, patch) {
 			const scope = `${addonId}:${String(deviceId)}.`;
 			await replacePrefixed(door, "addon-device-settings", scope, {

package/dist/kernel/config-manager.d.ts

@@ -4,6 +4,10 @@ export interface AddonSettingsView {
     readAddonStore(): Promise<Record<string, unknown>>;
     writeAddonStore(patch: Record<string, unknown>): Promise<void>;
     readDeviceStore(deviceId: number): Promise<Record<string, unknown>>;
+    /** See `IAddonContext['settings'].readDeviceStoreBatch` — optional there and
+     *  here for the same reason: only the door-backed view can answer it in one
+     *  range scan, and a caller must fall back rather than refuse. */
+    readDeviceStoreBatch?(deviceIds: readonly number[]): Promise<ReadonlyMap<number, Record<string, unknown>>>;
     writeDeviceStore(deviceId: number, patch: Record<string, unknown>): Promise<void>;
     clearDeviceStore(deviceId: number): Promise<void>;
     getSection(section: string): Promise<Record<string, unknown>>;

package/dist/{retired-settings-keys-BhPleRL7.mjs → retired-settings-keys-BZbOXqch.mjs}

@@ -1,4 +1,4 @@
-import { kt as asJsonObject } from "./dist-BUEU7B1V.mjs";
+import { kt as asJsonObject } from "./dist-Bh25kEUH.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-KZnmtfsh.js → retired-settings-keys-CqD6rSQx.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DqcaE-k1.js");
+const require_dist = require("./dist-D-R0SuP-.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?