@camstack/system 1.2.143 → 1.2.145

package/dist/{dist-CQs1b7uh.js → dist-BVU5JADq.js}

@@ -3595,6 +3595,111 @@ function logLevelAtMost(level, threshold) {
 	return LOG_LEVEL_RANK[level] <= LOG_LEVEL_RANK[threshold];
 }
 /**
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
+*
+* ## Two axes, deliberately separated
+*
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
+*
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
+*
+* ## The canonical call shape
+*
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
+*
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
+*
+* ## Why a channel emits at `info`
+*
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
+*/
+/**
+* The level a channel writes at once armed.
+*
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
+*/
+var LogChannelLevelSchema = zod.z.enum([
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
+*/
+var LogChannelDescriptorSchema = zod.z.object({
+	/**
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
+	*/
+	name: zod.z.string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: zod.z.string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
+	/**
+	* Whether this channel can be narrowed to a camera.
+	*
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
+	*/
+	perDevice: zod.z.boolean()
+});
+/**
+* An armed window over one channel, as the document hands it to a mirror.
+*
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
+*/
+var LogChannelWindowSchema = zod.z.object({
+	channel: zod.z.string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: zod.z.number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: zod.z.array(zod.z.number().int()).readonly().nullable()
+});
+/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -8134,6 +8239,35 @@ var MutationFilterSchema = zod.z.object({
 	whereBetween: zod.z.record(zod.z.string(), zod.z.tuple([zod.z.unknown(), zod.z.unknown()])).optional(),
 	whereNot: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
 });
+/**
+* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
+*
+* `as` names the slot in the result, so the SAME column may be asked twice with
+* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
+* a `Record<column, op>` shape could not express.
+*/
+var AggregateFieldSchema = zod.z.object({
+	/** Result key. */
+	as: zod.z.string().min(1),
+	/** Column to aggregate. Must be a real column of a declared collection. */
+	field: zod.z.string().min(1),
+	op: zod.z.enum([
+		"sum",
+		"min",
+		"max"
+	])
+});
+/**
+* `COUNT(*)` plus one number per requested field.
+*
+* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
+* that really is 0 are different facts, and an accounting caller that renders
+* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
+*/
+var AggregateResultSchema = zod.z.object({
+	count: zod.z.number().int(),
+	values: zod.z.record(zod.z.string(), zod.z.number().nullable())
+});
 /** A single stored record: `{ id, data }`. */
 var SettingsRecordSchema = zod.z.object({
 	id: zod.z.string(),
@@ -8301,6 +8435,32 @@ var settingsStoreCapability = {
 			collection: zod.z.string(),
 			filter: QueryFilterSchema.optional()
 		}), zod.z.number()),
+		/**
+		* `COUNT(*)` and one `SUM` / `MIN` / `MAX` per requested field, in ONE
+		* statement, over the rows `filter` selects.
+		*
+		* Exists because "how much is there" was being answered by materialising
+		* "what is there". The recorder's storage-pressure sweep asked its in-RAM
+		* footage index for bytes/count/oldest/newest across a set of storage
+		* locations twice a minute, and the only way to answer that from a map is
+		* to visit every row — 7.1 M of them on the live hub, ~15 M row visits a
+		* minute on the main thread, which is also why the whole archive had to
+		* stay resident to be visited. The question is a sum; nothing needs to be
+		* materialised to answer it.
+		*
+		* **The engine REFUSES a field it cannot serve**, exactly as
+		* `query.columns` does and unlike a PREDICATE, which is skipped when
+		* unresolvable. A dropped predicate over-matches and the caller sees extra
+		* rows; a dropped aggregate returns a NUMBER that is wrong and looks
+		* exactly like a real one. That asymmetry is what this repo has already
+		* paid for once in `count`.
+		*/
+		aggregate: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			fields: zod.z.array(AggregateFieldSchema).readonly(),
+			filter: QueryFilterSchema.optional()
+		}), AggregateResultSchema),
 		/** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
 		histogram: method(zod.z.object({
 			namespace: zod.z.string().optional(),
@@ -8507,6 +8667,15 @@ var dataStoreProviderCapability = {
 			collection: zod.z.string(),
 			filter: QueryFilterSchema.optional()
 		}), zod.z.number(), { auth: "admin" }),
+		/** `COUNT(*)` plus one SUM/MIN/MAX per field, in one statement. Mirror of
+		*  `settings-store.aggregate` — see it for why an unresolvable field is
+		*  refused rather than dropped. */
+		aggregate: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			fields: zod.z.array(AggregateFieldSchema).readonly(),
+			filter: QueryFilterSchema.optional()
+		}), AggregateResultSchema, { auth: "admin" }),
 		/** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
 		histogram: method(zod.z.object({
 			namespace: zod.z.string().optional(),
@@ -9329,24 +9498,6 @@ var deviceProviderCapability = {
 		})
 	}
 };
-/**
-* Device Manager capability — hub-side singleton that unifies device persistence,
-* live registry access, and all management operations into a single tRPC surface.
-*
-* Replaces:
-*   - `device-persistence` capability (persistence methods absorbed here)
-*   - `device-management.router.ts` (deleted in Phase 2)
-*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
-*
-* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
-* fork into separate processes but never run on remote cluster agents. Therefore:
-*   - No nodeId routing needed — this is a pure hub singleton.
-*   - The hub's DeviceRegistry is the single source of truth for all live devices.
-*   - No shadow registry or cross-node aggregation required.
-*
-* Forked workers register devices back to the hub via `ctx.devices`
-* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
-*/
 /** One child-placement directive on a container's `childLayout`. Structurally
 *  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
 *  shape for the same field. The child is identified by its re-sync-stable
@@ -9858,6 +10009,39 @@ var deviceManagerCapability = {
 		/** List children of a parent device (by parent numeric id). */
 		getChildren: method(zod.z.object({ parentDeviceId: zod.z.number() }), zod.z.array(DeviceInfoSchema)),
 		/**
+		* `getChildren` for a NAMED SET of parents, in one call.
+		*
+		* The accessory reconcile in `device-cap-proxy.ts` asks this question once
+		* per registered device — every `BaseDevice` inherits a
+		* `getAccessoryChildren()` that returns `[]`, so even a leaf accessory
+		* pays a round-trip to learn it has nothing to prune. Measured on the live
+		* hub 2026-08-27 over a 120-second boot window, fleet of 1 017 devices:
+		* `DeviceRowStore.list < DeviceRowStore.listByParent < getChildren` at
+		* **1 024 calls** returning **919 rows in total** — 1 024 RPCs and 1 024
+		* indexed scans to move less than one row each. `listByParentMany`
+		* collapses the scans; this collapses the RPCs.
+		*
+		* Keyed by parent id as a STRING — a JSON object cannot key by number
+		* (same reason as `getDeviceStatusAggregateBatch`). The per-parent value
+		* is exactly what `getChildren` returns for that parent.
+		*
+		* A parent with no children — or one the fleet does not know — is ABSENT
+		* from the record, never an invented empty row: the same contract as
+		* `DeviceRowStore.getMany`/`listByParentMany`. An EMPTY `parentDeviceIds`
+		* reads nothing at all rather than degrading to "every device".
+		*
+		* `parentDeviceIds` is capped at {@link DEVICE_CHILDREN_BATCH_MAX} — see
+		* that constant for why. A caller with more parents than that sends more
+		* than one call; it never sends one pathological one.
+		*
+		* Version skew: this is a NEW method, not a new field on `getChildren`, so
+		* a hub that predates it answers NOT_FOUND rather than silently stripping
+		* an unknown input key and answering a DIFFERENT question. The kernel-side
+		* loader degrades to per-parent `getChildren` on that error — see
+		* `children-batch-loader.ts`.
+		*/
+		getChildrenBatch: method(zod.z.object({ parentDeviceIds: zod.z.array(zod.z.number()).max(256) }), zod.z.record(zod.z.string(), zod.z.array(DeviceInfoSchema))),
+		/**
 		* Resolve the devices LINKED to a camera — the single policy authority
 		* both consumers call (viewer devices panel + pipeline-analytics event
 		* kinds/ingest). Device-tree children are ALWAYS included; mode 'auto'
@@ -11007,6 +11191,80 @@ var llmCapability = {
 		})
 	}
 };
+/**
+* `log-channels` — the capability an addon DECLARES its diagnostic channels
+* through. It stores nothing.
+*
+* ## Why a capability at all, and why this shape
+*
+* Which channels exist is knowledge only the addon has: `stream-broker` knows
+* webrtc/ICE/RTP, `provider-reolink` knows baichuan/handshake. A central list
+* maintained by hand rots at the first addition and rots INVISIBLY — nothing
+* fails, an operator just never sees the channel somebody added. So the list
+* is assembled from declarations at runtime.
+*
+* The shape is copied from `log-destination.cap.ts`, which already does
+* exactly this job: `mode: 'collection'`, `internal: true`,
+* `mount: { kind: 'skip' }` — no tRPC route, no generated hooks — while
+* `addons.listCapabilityProviders` still enumerates it, and the hub's
+* `CapabilityRegistry` still holds an RPC proxy per provider so a forked
+* runner's declarations reach hub-main over the transport that already exists.
+* No new UDS message, no second registry.
+*
+* ## What it deliberately does NOT own
+*
+* The VALUES — which channel is armed, for which cameras, until when — live in
+* ONE place: the logging settings document on the `system` cap
+* (`getLoggingSettings` / `setLoggingSettings`). Two authorities over the same
+* value is the defect the plan behind this work exists to remove, and
+* `setRequestCensus` was retired (D245) rather than allowed to be a second
+* one. {@link logChannelsCapability} therefore has no getter for a level, no
+* setter for a window and no persistence of any kind.
+*
+* ## Why `apply` is here even so
+*
+* The gate lives in the addon's PROCESS; the document lives in hub-main. Some
+* seam has to carry the value from the authority to the mirror, and a channel
+* that cannot be reached is precisely the dead knob this whole slice exists to
+* make impossible (D62 — `audioThresholdDbfs`, the HA entities with no source).
+* `apply` is that seam and nothing more: it writes an in-memory mirror, it
+* persists nothing, it is never the source of a value, and it is called only
+* with a set the hub actually read (D49 — a read that fails does not call it
+* at all, so no channel is silently disarmed by a bad read).
+*/
+/** What `apply` reports back — enough to log, not enough to be a second state. */
+var LogChannelApplyResultSchema = zod.z.object({
+	/** How many declared channels are armed in this process after the call. */
+	armed: zod.z.number().int().min(0),
+	/**
+	* Names the document armed that this process does not declare. Reported
+	* rather than swallowed: a name here is either a typo or an addon that has
+	* not booted, and both deserve a line instead of silence.
+	*/
+	unknown: zod.z.array(zod.z.string()).readonly()
+});
+var logChannelsCapability = {
+	name: "log-channels",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		/** The channels this addon declares. Inert: no value, no state. */
+		list: method(zod.z.void(), zod.z.array(LogChannelDescriptorSchema).readonly()),
+		/**
+		* Refresh this process's mirror from the document's FULL set of armed
+		* windows.
+		*
+		* Full and not incremental on purpose: the document is the authority, so a
+		* channel it does not name is disarmed here. An incremental apply would
+		* let a disarm get lost in transit and leave a channel running that
+		* nobody can see is running.
+		*/
+		apply: method(zod.z.object({ windows: zod.z.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
+	},
+	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
+	mount: { kind: "skip" }
+};
 var LogLevelSchema = zod.z.enum([
 	"debug",
 	"info",
@@ -29567,17 +29825,60 @@ var SetSiteLocationInputSchema = zod.z.object({
 	longitude: zod.z.number().min(-180).max(180)
 }).nullable();
 /**
-* One `(procedure, user-agent, ip, principal)` tuple of the HTTP request
+* The TRANSPORT a call arrived on.
+*
+* Every counted call carries exactly one of these, and `unknown` is a PLANE
+* rather than a gap: a plane that cannot attribute a call declares it here, so
+* the call lands in a named bucket instead of vanishing. `planes` summing to
+* `procedureCalls` is what makes "the sum of the planes explains the total"
+* checkable rather than asserted.
+*
+*  - `http`  — the Fastify tRPC plugin (`/trpc/*`), one context per request.
+*  - `ws`    — `applyWSSHandler`, counted per OPERATION rather than per
+*              connection; the viewer talks to the hub over `wsLink`
+*              exclusively, so this is the plane the HTTP census could not see.
+*  - `mesh`  — the in-process `$core-caps` bridge (`createCaller`), which
+*              never touches a socket and therefore never touched a census.
+*  - `unknown` — counted, plane undecidable. No hook produces it today, and
+*    that is exactly what its `0` asserts: every plane the hub has can name
+*    itself. It is an output bucket, never a knob — a call that arrives on a
+*    plane nobody instrumented lands here instead of vanishing from the total.
+*/
+var TransportPlaneSchema = zod.z.enum([
+	"http",
+	"ws",
+	"mesh",
+	"unknown"
+]);
+/**
+* Calls per plane. Every key is always present, `0` included — an absent plane
+* reads as "not instrumented", which is the one thing this census must never
+* make an operator wonder about.
+*/
+var TransportPlaneCountsSchema = zod.z.object({
+	http: zod.z.number(),
+	ws: zod.z.number(),
+	mesh: zod.z.number(),
+	unknown: zod.z.number()
+});
+/**
+* One `(plane, procedure, user-agent, ip, principal)` tuple of the transport
 * census. `principal` is the DERIVED identity (`apocaliss92 (admin)`,
 * `scoped:1a2b3c4d (scoped-token)`, `anonymous`) that the tRPC error log
 * already prints - never a token, never an `Authorization` header.
+*
+* `subscriptions` is counted APART from `calls`: a subscription is opened once
+* and lives for hours, so folding it into a call count makes one long-lived
+* stream look like a storm.
 */
 var RequestCensusGroupSchema = zod.z.object({
+	plane: TransportPlaneSchema,
 	procedure: zod.z.string(),
 	userAgent: zod.z.string(),
 	ip: zod.z.string(),
 	principal: zod.z.string(),
 	calls: zod.z.number(),
+	subscriptions: zod.z.number(),
 	perMin: zod.z.number()
 });
 /**
@@ -29590,6 +29891,14 @@ var RequestCensusGroupSchema = zod.z.object({
 var RequestCensusProcedureSchema = zod.z.object({
 	procedure: zod.z.string(),
 	calls: zod.z.number(),
+	/**
+	* The same total, split by transport. THIS is the row that answers the
+	* question the census exists for: one look at `deviceManager.listAll` says
+	* which plane carried the 4 960, without joining two log lines by eye.
+	*/
+	planes: TransportPlaneCountsSchema,
+	/** Subscription STARTS on this procedure. Never folded into `calls`. */
+	subscriptions: zod.z.number(),
 	perMin: zod.z.number()
 });
 /**
@@ -29617,14 +29926,45 @@ var RequestCensusStatusSchema = zod.z.object({
 	*/
 	procedureCalls: zod.z.number(),
 	/**
+	* `procedureCalls` split by transport. The four keys sum to
+	* `procedureCalls` by construction - {@link RequestCensusSnapshotSchema}'s
+	* `planesExplainTotal` is that identity, checked rather than assumed.
+	*/
+	planes: TransportPlaneCountsSchema,
+	/**
+	* True iff `planes` sums to `procedureCalls`. False means a call was counted
+	* on no plane at all - which is a RESULT (a plane is missing from the
+	* instrument), not a failure, and it has to be visible to be read as one.
+	*/
+	planesExplainTotal: zod.z.boolean(),
+	/**
 	* tRPC WebSocket connections opened during the window. NOT calls - the WS
-	* transport resolves one context per connection - but the number that says
-	* whether a plane this census cannot see was busy while HTTP was quiet.
+	* adapter resolves one context per connection - kept because a plane's call
+	* count of zero against 37 open connections says something different from a
+	* plane with no connections at all.
 	*/
 	wsConnections: zod.z.number(),
+	/**
+	* Client frames the WS plane looked at. `wsMessages` far above
+	* `planes.ws + subscriptions` means most traffic is not operations
+	* (keepalives, connection params) - which is itself an answer.
+	*/
+	wsMessages: zod.z.number(),
+	/**
+	* Subscription STARTS across every plane, excluded from `procedureCalls` on
+	* purpose: one live-events stream opened at boot and held for six hours is
+	* one subscription, and counting it as a call would let a quiet plane
+	* masquerade as the storm.
+	*/
+	subscriptions: zod.z.number(),
+	/** `subscription.stop` frames. Starts minus stops is what is still open. */
+	subscriptionStops: zod.z.number(),
 	distinctGroups: zod.z.number(),
-	/** Calls counted in the totals whose group attribution was shed at the
-	*  cardinality bound. */
+	/**
+	* Operations counted in the totals whose CALLER attribution was shed at the
+	* cardinality bound. Unrelated to the `unknown` PLANE: these calls know
+	* which transport they arrived on, they just lost their group row.
+	*/
 	unattributedCalls: zod.z.number(),
 	procedures: zod.z.array(RequestCensusProcedureSchema).readonly(),
 	groups: zod.z.array(RequestCensusGroupSchema).readonly()
@@ -29647,10 +29987,11 @@ var DiagnosticIdSchema = zod.z.enum(["request-census"]);
 * The layers of the level hierarchy, general → specific. The most specific
 * layer that carries an explicit value wins.
 *
-* `component` is DECLARED and not yet resolvable: the per-component channels
-* are a later slice of the same plan, and a `levelSource` enum that has to
-* grow later would force every consumer of this document to change with it.
-* Nothing returns `component` today.
+* `component` became RESOLVABLE on 2026-08-27: a component is a declared log
+* CHANNEL (`stream-broker.webrtc`, `provider-reolink.baichuan`), named by
+* `scopeComponent`. It was declared-but-dark in the first slice precisely so
+* that turning it on would not force every consumer of this document to widen
+* a `levelSource` enum — which is what has now not happened.
 */
 var LoggingScopeKindSchema = zod.z.enum([
 	"cluster",
@@ -29677,6 +30018,14 @@ var LoggingLevelLayerSchema = zod.z.object({
 	scope: LoggingScopeKindSchema,
 	/** The node this layer speaks for; `null` on the cluster layer. */
 	nodeId: zod.z.string().nullable(),
+	/**
+	* The declared channel this layer speaks for; `null` on every layer but
+	* `component`. Never folded into `nodeId`: a component level is CLUSTER-WIDE
+	* by design — the convention this repo settled on is one orchestrator-wide
+	* setting, never per node (D52) — so a component layer that carried a node
+	* would invite a per-node copy of a value that has no per-node meaning.
+	*/
+	component: zod.z.string().nullable(),
 	/** Explicitly set here, or `null` when this layer inherits. */
 	level: LogLevelSchema$1.nullable()
 });
@@ -29718,6 +30067,49 @@ var DiagnosticWindowPatchSchema = zod.z.object({
 	reportEveryMs: zod.z.number().int().positive().optional()
 });
 /**
+* A channel ARMED, as the document reports it.
+*
+* `armMs` is not echoed back: what an operator needs to see is the deadline
+* and the time left, because a diagnostic left running is itself an incident
+* and "armed for 10 minutes" said an hour ago is not an answer.
+*/
+var LogChannelWindowStateSchema = zod.z.object({
+	channel: zod.z.string(),
+	armed: zod.z.boolean(),
+	/** Epoch ms the window closes at. 0 when disarmed. */
+	armedUntilMs: zod.z.number(),
+	/** Ms left before it expires on its own. 0 when disarmed. */
+	remainingMs: zod.z.number(),
+	/**
+	* The cameras it is narrowed to, or `null` for every camera.
+	*
+	* A channel declared `perDevice: false` can only ever report `null` here:
+	* its lines do not carry `tags: { deviceId }`, so narrowing them would
+	* produce a filter that silently matches nothing. The server REFUSES such a
+	* patch rather than quietly widening it — ignoring the request would teach
+	* the operator that per-camera filtering works on that channel when it does
+	* not.
+	*/
+	deviceIds: zod.z.array(zod.z.number().int()).readonly().nullable()
+});
+/**
+* `armMs: 0` DISARMS. Same grammar as {@link DiagnosticWindowPatchSchema}, and
+* for the same reason: a channel is a window with a deadline, never a switch.
+*/
+var LogChannelWindowPatchSchema = zod.z.object({
+	channel: zod.z.string().min(1),
+	armMs: zod.z.number().int().min(0),
+	/**
+	* Narrow to these numeric device ids. Absent or `null` = every camera.
+	*
+	* Numeric because the repo's own rule makes it possible: every log line
+	* about a device carries `tags: { deviceId }` with the numeric id. That rule
+	* was paid for with a 22% thumbnail gap and a 3-hour media blackout both
+	* diagnosed by hand, and this is the first thing that collects on it.
+	*/
+	deviceIds: zod.z.array(zod.z.number().int()).readonly().nullable().optional()
+});
+/**
 * A PATCH, and patches MERGE.
 *
 * A field absent from the patch is left exactly as it was — arming a
@@ -29736,7 +30128,14 @@ var LoggingSettingsPatchSchema = zod.z.object({
 	* Only the diagnostics NAMED here change. An armed window that is not listed
 	* keeps running — a patch is never a full replacement.
 	*/
-	diagnostics: zod.z.array(DiagnosticWindowPatchSchema).readonly().optional()
+	diagnostics: zod.z.array(DiagnosticWindowPatchSchema).readonly().optional(),
+	/**
+	* Only the channels NAMED here change. An armed channel that is not listed
+	* keeps running — same rule as `diagnostics`, because a patch that silently
+	* disarmed the channels it did not mention would make the Levels page and
+	* the Diagnostics page fight over the same value.
+	*/
+	channels: zod.z.array(LogChannelWindowPatchSchema).readonly().optional()
 });
 /**
 * Which LAYER of the hierarchy is addressed. Absent = the cluster layer.
@@ -29749,9 +30148,22 @@ var LoggingSettingsPatchSchema = zod.z.object({
 * authority over the whole hierarchy and answers for every layer, so the
 * layer selector needs a name the transport does not already own.
 */
-var GetLoggingSettingsInputSchema = zod.z.object({ scopeNodeId: zod.z.string().optional() });
+var GetLoggingSettingsInputSchema = zod.z.object({
+	scopeNodeId: zod.z.string().optional(),
+	/**
+	* The declared CHANNEL this document is addressed at, when the caller wants
+	* the `component` layer. Absent = the node/cluster hierarchy only.
+	*
+	* Naming it separately rather than overloading `scopeNodeId` keeps the two
+	* axes from collapsing: a component level is cluster-wide, a node level is
+	* not, and one selector for both would make "which of these two did I just
+	* set" unanswerable — the exact ambiguity `explicit` exists to remove.
+	*/
+	scopeComponent: zod.z.string().optional()
+});
 var SetLoggingSettingsInputSchema = zod.z.object({
 	scopeNodeId: zod.z.string().optional(),
+	scopeComponent: zod.z.string().optional(),
 	patch: LoggingSettingsPatchSchema
 });
 /**
@@ -29766,9 +30178,20 @@ var SetLoggingSettingsInputSchema = zod.z.object({
 var LoggingSettingsStateSchema = zod.z.object({
 	/** The layer this document was read at. `null` = the cluster layer. */
 	scopeNodeId: zod.z.string().nullable(),
+	/** The channel this document was read at. `null` = no component layer. */
+	scopeComponent: zod.z.string().nullable(),
 	effective: LoggingEffectiveSchema,
 	explicit: LoggingExplicitSchema,
 	activeWindows: zod.z.array(DiagnosticWindowSchema).readonly(),
+	/**
+	* Every channel the cluster's addons DECLARE, gathered from the
+	* `log-channels` providers. Not stored anywhere: assembled per read, so a
+	* channel added by a redeployed addon appears without anybody editing a
+	* list, and a channel whose addon is gone stops being offered.
+	*/
+	channels: zod.z.array(LogChannelDescriptorSchema).readonly(),
+	/** The channels ARMED right now, each with its deadline. */
+	activeChannels: zod.z.array(LogChannelWindowStateSchema).readonly(),
 	persisted: zod.z.boolean()
 });
 var systemCapability = {
@@ -31627,6 +32050,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	llmRuntimeCapability,
 	localNetworkCapability,
 	lockControlCapability,
+	logChannelsCapability,
 	logDestinationCapability,
 	loginMethodCapability,
 	mediaPlayerCapability,
@@ -32593,6 +33017,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"dataStoreProvider.aggregate": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"dataStoreProvider.count": {
 		capName: "data-store-provider",
 		capScope: "system",
@@ -33007,6 +33437,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getChildrenBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getConfigSchema": {
 		capName: "device-manager",
 		capScope: "system",
@@ -34057,6 +34493,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"logChannels.apply": {
+		capName: "log-channels",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"logChannels.list": {
+		capName: "log-channels",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"logDestination.query": {
 		capName: "log-destination",
 		capScope: "system",
@@ -36211,6 +36659,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.aggregate": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"settingsStore.count": {
 		capName: "settings-store",
 		capScope: "system",
@@ -37790,6 +38244,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.getChildrenBatch": [{
+		name: "parentDeviceIds",
+		form: "array",
+		optional: false
+	}],
 	"deviceManager.getConfigSchema": [{
 		name: "deviceId",
 		form: "single",