@camstack/system 1.2.225 → 1.2.227

package/dist/{dist-DdRxWA7g.js → dist-u8F4ZyXi.js}

@@ -1,5 +1,5 @@
 let zod = require("zod");
-//#region ../types/dist/event-category-DAXzJeTX.mjs
+//#region ../types/dist/event-category-ZyX6jcse.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -560,7 +560,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	* a package zone — a newly-appeared stationary object of a package class
 	* that cleared the class / zone / dwell / size gates. Payload:
 	* `PipelineAnalyticsPackageDeliveredPayload` carrying `{ deviceId,
-	* entryId, className, zoneIds, keyFrameMediaKey?, bbox, timestamp }`.
+	* entryId, className, zoneIds, keyFrameMediaId?, bbox, timestamp }`.
 	* Telemetry (D8): the durable record is the `package-events` store row;
 	* this bus topic drives notifier rules + live UI. See
 	* docs/superpowers/specs/2026-07-17-package-zones-design.md §5.1.
@@ -676,7 +676,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-BnujYGPe.mjs
+//#region ../types/dist/sleep-CnLyvg3w.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -3394,13 +3394,30 @@ new Set([
 	"scene",
 	"motion",
 	"object",
-	"audio"
+	"audio",
+	"mosaic"
 ]);
-new Set([
+/**
+* The owner types that are event tables, in the order the event-media resolver
+* should consider them. Exported so a consumer asking "is this key an event?"
+* does not re-spell the list and drift from it.
+*/
+var EVENT_OWNER_TYPES = [
 	"motion",
 	"object",
 	"audio"
-]);
+];
+/**
+* The same list as a Zod enum, for the cap inputs that must NAME the table
+* (D482: `getEventMedia` / `listEventMedia` take an owner, and an owner is
+* `(table, id)`).
+*
+* Built FROM {@link EVENT_OWNER_TYPES} rather than re-spelled: a fourth event
+* table would otherwise be accepted by the codec and refused at the door, with
+* nothing failing until a caller asked.
+*/
+var EventOwnerTypeSchema = zod.z.enum(EVENT_OWNER_TYPES);
+new Set(EVENT_OWNER_TYPES);
 /**
 * Shared video / audio encode profile schemas used by every consumer
 * that asks the stream broker to spawn a derived stream
@@ -10096,6 +10113,59 @@ var settingsStoreCapability = {
 			filter: QueryFilterSchema.optional(),
 			columns: zod.z.array(zod.z.string()).readonly().optional()
 		}), zod.z.array(SettingsRecordSchema).readonly()),
+		/**
+		* Make a SLOT hold this row — insert it, or update whatever already
+		* occupies the slot — and answer with the id the row HAS.
+		*
+		* ## Why the store needed this
+		*
+		* {@link set} is already an upsert, but its slot is the PRIMARY KEY: the
+		* caller has to know the id to address the row. That is exactly what a
+		* collection keyed by an `INTEGER` rowid alias cannot do — SQLite assigns
+		* the id, so a writer whose uniqueness rule is "one row per
+		* `(ownerKind, ownerId, kind, slot)`" has no id to name and no way to
+		* express the rule. {@link insert} can express it (a UNIQUE index
+		* arbitrates) but only by THROWING at the loser of a race, and the loser
+		* here is a legitimate re-capture, not an error.
+		*
+		* Getting there without this method means read-then-write: query the slot,
+		* then `insert` or `update`. Two statements instead of one, a race between
+		* them, and a recovery path that has to recognise a UNIQUE violation by its
+		* MESSAGE — across a process boundary, because the store lives behind an
+		* RPC door. A string match would be the whole gate, and a store that
+		* rephrased its error would lose the row silently. One statement has no
+		* such gate (D482).
+		*
+		* ## The contract
+		*
+		* `conflict` names the DECLARED columns that identify the slot. They must
+		* be covered by a UNIQUE index on the collection — SQLite resolves an
+		* `ON CONFLICT` target against its indexes and REFUSES the statement when
+		* none matches, so a wrong list is a loud error on the first write, never a
+		* silently duplicated row. An empty list is refused rather than passed on:
+		* `ON CONFLICT()` is not valid SQL, and the intent it would most likely
+		* encode ("no slot, just insert") is {@link insert}.
+		*
+		* Row shape is {@link insert}'s: `record.id` is used when the collection
+		* needs a supplied key and IGNORED when the primary key is an `INTEGER`
+		* rowid alias — exactly as `insert` and `insertMany` already treat it.
+		*
+		* Returns the id either way: the one SQLite assigned on an insert, or the
+		* one the row it updated already had. A caller cannot tell which happened,
+		* and deliberately — every caller wants the slot's id, and one that needed
+		* to distinguish creation from replacement would have to read first anyway.
+		*/
+		upsert: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			/** Declared columns identifying the slot; must be covered by a UNIQUE
+			*  index on the collection. Never empty. */
+			conflict: zod.z.array(zod.z.string()).readonly(),
+			record: BulkRecordSchema
+		}), zod.z.object({ 
+		/** The id the row HAS: assigned by SQLite on an insert, or the existing
+		*  row's own id on an update. */
+id: zod.z.union([zod.z.string(), zod.z.number()]) }), { kind: "mutation" }),
 		/** Insert a new record. */
 		insert: method(zod.z.object({
 			namespace: zod.z.string().optional(),
@@ -10385,6 +10455,20 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* Make a slot hold this row, and answer with the id the row HAS. The
+		* engine half of `settings-store.upsert` — read that docblock for why the
+		* store needed a slot that is not the primary key (D482).
+		*/
+		upsert: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			conflict: zod.z.array(zod.z.string()).readonly(),
+			record: BulkRecordSchema
+		}), zod.z.object({ id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Insert many records in ONE transaction. All or nothing. */
 		insertMany: method(zod.z.object({
 			namespace: zod.z.string().optional(),
@@ -18196,8 +18280,8 @@ var TrackPositionSchema = zod.z.object({
 var TrackSnapshotSchema = zod.z.object({
 	timestamp: zod.z.number(),
 	position: TrackPositionSchema,
-	/** MediaStore key; resolve via `getTrackMedia({ trackId })`. */
-	mediaKey: zod.z.string()
+	/** The snapshot's media row id (D482); resolve via `listTrackMedia({ trackId })`. */
+	mediaId: zod.z.number().int()
 });
 /**
 * Normalized 0..1 trajectory envelope (min/max over every position bbox,
@@ -18809,14 +18893,14 @@ var ObjectEventSchema = zod.z.object({
 	*  pixel-space `bbox` onto a displayed image. Omitted in slim projection. */
 	frameWidth: zod.z.number().optional(),
 	frameHeight: zod.z.number().optional(),
-	/** MediaStore key for the crop attached to this event (if any). */
-	mediaKey: zod.z.string().optional(),
-	/** Design B: MediaStore key of the track's native-resolution key frame (the
+	/** Media row id of the crop attached to this event (if any) — D482. */
+	mediaId: zod.z.number().int().optional(),
+	/** Design B: media row id of the track's native-resolution key frame (the
 	*  best-detection full frame). Resolve via the event-media data-plane
-	*  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`) for a detail view that
+	*  (`/addon/<addonId>/event-media/m/<keyFrameMediaId>`) for a detail view that
 	*  draws `bbox` over the native frame. Absent on legacy rows / non-decoded
-	*  sources — consumers fall back to `mediaKey` (the tight crop). */
-	keyFrameMediaKey: zod.z.string().optional(),
+	*  sources — consumers fall back to `mediaId` (the tight crop). */
+	keyFrameMediaId: zod.z.number().int().optional(),
 	/** Populated by B5 (recording playback URL for this event). */
 	mediaUrl: zod.z.string().optional(),
 	/** The parent track's key-event importance [0,1], propagated to every object
@@ -18866,7 +18950,7 @@ var MediaFileKindEnum = zod.z.enum([
 * hub-main's heap on the way past — for an `<img>` that would have cached it.
 *
 * `url` points at the `event-media` data plane
-* (`/addon/<addonId>/event-media/<storedKey>`), which serves the same blob
+* (`/addon/<addonId>/event-media/m/<mediaId>` — D482), which serves the same blob
 * with an ETag and `Cache-Control: immutable`, honours conditional GETs, can
 * render a `?variant=thumb`, and streams. The hub gate in front of it requires
 * a bearer or the session cookie (`access: 'authenticated'`), so the bytes are
@@ -18874,10 +18958,13 @@ var MediaFileKindEnum = zod.z.enum([
 * `data-plane-access.ts` for the rule and the one gap it does not close
 * (per-device scoping).
 *
-* The URL is built from the row's **stored** key, which is not always its
-* published `kind`: a track's face/plate crop is stored as `crop` under
+* The URL is built from the row's own id, which since D482 says nothing about
+* the row's owner or kind — and that is the point. The published `kind` is not
+* the stored one (a track's face/plate crop is stored as `crop` under
 * `('face'|'plate', '<prefix>-<trackId>')` and published as
-* `faceCrop`/`plateCrop`. `MediaStore.getByKey` knows only the stored key.
+* `faceCrop`/`plateCrop`), and under the old composite key the URL had to be
+* taken from `row.key` verbatim or it 404'd exactly those two rows. An id
+* cannot be mis-reconstructed, because there is nothing in it to reconstruct.
 *
 * ## `base64` is TRANSITIONAL and is going away
 *
@@ -18890,7 +18977,19 @@ var MediaFileKindEnum = zod.z.enum([
 * `analytics-query-facade.ts`; nothing else reads it.
 */
 var MediaFileSchema = zod.z.object({
-	key: zod.z.string(),
+	/**
+	* The media row's OWN id — the rowid SQLite assigned it (D482).
+	*
+	* It used to be the row's composite key, `<ownerType>:<ownerId>:<fileKind>
+	* [:<timestampMs>]`, which embedded a FOREIGN id. D474 made event ids
+	* per-table rowid aliases, so `object:101314` and `motion:101314` are two
+	* different rows that spell the same number, and a track whose
+	* `bestEventId` was an object event was served a motion event's snapshot —
+	* a night-time thumbnail on an afternoon track, with no error anywhere. A
+	* surrogate id cannot name the wrong row's owner, because it names no owner
+	* at all.
+	*/
+	mediaId: zod.z.number().int(),
 	kind: MediaFileKindEnum,
 	sizeBytes: zod.z.number(),
 	timestamp: zod.z.number()
@@ -18998,7 +19097,7 @@ var RetrainTrackSchema = zod.z.object({
 });
 /** A frame the picker may offer — an index row, no blob was read to produce it. */
 var RetrainFrameCandidateSchema = zod.z.object({
-	mediaKey: zod.z.string(),
+	mediaId: zod.z.number().int(),
 	kind: MediaFileKindEnum,
 	timestamp: zod.z.number(),
 	sizeBytes: zod.z.number().int(),
@@ -19012,7 +19111,7 @@ var RetrainFrameSchema = zod.z.object({
 	deviceId: zod.z.number(),
 	trackId: zod.z.string(),
 	/** Provenance only. It may already point at nothing — that is expected. */
-	sourceMediaKey: zod.z.string(),
+	sourceMediaId: zod.z.number().int(),
 	sourceKind: MediaFileKindEnum,
 	sizeBytes: zod.z.number().int(),
 	width: zod.z.number().int(),
@@ -19028,7 +19127,7 @@ var RetrainCopyRefusalSchema = zod.z.enum([
 var RetrainFrameSelectionSchema = zod.z.object({
 	copied: zod.z.array(RetrainFrameSchema).readonly(),
 	refused: zod.z.array(zod.z.object({
-		sourceMediaKey: zod.z.string(),
+		sourceMediaId: zod.z.number().int(),
 		reason: RetrainCopyRefusalSchema
 	})).readonly()
 });
@@ -19036,7 +19135,7 @@ var RetrainFrameListSchema = zod.z.object({
 	candidates: zod.z.array(RetrainFrameCandidateSchema).readonly(),
 	copies: zod.z.array(RetrainFrameSchema).readonly(),
 	/** What the page pre-selects — the native key frame when one survives. */
-	autoPickMediaKey: zod.z.string().optional()
+	autoPickMediaId: zod.z.number().int().optional()
 });
 /** What the operator asked the assist to look for. */
 var RetrainAssistSubjectSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
@@ -19131,9 +19230,11 @@ var RecentTracksQueryInput = zod.z.object({
 });
 /**
 * A Summary (D359): the per-camera session envelope that references tracks.
-* `groupShotKey` is the media key of its group shot (`ownerKind: 'summary'`,
-* served by the event-media plane by key), null until the first frame with a
-* member visible has been materialised.
+* `groupShotMediaId` is the media ROW id of its group shot (`ownerKind:
+* 'summary'`, served by the event-media plane at `/m/<id>`), null until the
+* first frame with a member visible has been materialised (D482 — it was the
+* row's composite key, which embedded the owner and could name another table's
+* row once event ids became per-table rowids).
 */
 var SummarySchema = zod.z.object({
 	id: zod.z.string(),
@@ -19142,7 +19243,7 @@ var SummarySchema = zod.z.object({
 	lastActiveAt: zod.z.number(),
 	sealedAt: zod.z.number().nullable(),
 	memberCount: zod.z.number().int().nonnegative(),
-	groupShotKey: zod.z.string().nullable()
+	groupShotMediaId: zod.z.number().int().nullable()
 });
 var SummariesQueryInput = zod.z.object({
 	deviceIds: zod.z.array(zod.z.number()).min(1),
@@ -20126,7 +20227,7 @@ var pipelineAnalyticsCapability = {
 		selectRetrainFrames: method(zod.z.object({
 			deviceId: zod.z.number(),
 			trackId: zod.z.string(),
-			mediaKeys: zod.z.array(zod.z.string()).min(1)
+			mediaIds: zod.z.array(zod.z.number().int()).min(1)
 		}), RetrainFrameSelectionSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -20290,8 +20391,29 @@ var pipelineAnalyticsCapability = {
 			kind: "query",
 			auth: "admin"
 		}),
+		/**
+		* The media an EVENT owns.
+		*
+		* `ownerType` is REQUIRED, and that is the whole correction (D482). An
+		* event is a row in ONE of three tables, and since D474 each numbers from
+		* 1 independently: `motion:101314` and `object:101314` both exist. This
+		* method took a bare `eventId` and the provider probed motion → object →
+		* audio, stopping at the first hit — so on the live hub, where object
+		* events own no media of their own and 299 883 of 300 559 media rows are
+		* motion-owned, EVERY object event resolved to its motion namesake. A
+		* track from 17:34 on camera 615 was served a snapshot from 22:35 eleven
+		* days earlier, silently.
+		*
+		* D476 had already disambiguated the KEY (`motion:` vs `object:`); this is
+		* the API catching up to it. Naming the table is not a "qualification" of
+		* the ambiguity — a listing BY OWNER has no address to make surrogate: the
+		* owner IS (table, id), and half of it is not a question.
+		*/
 		getEventMedia: method(zod.z.object({
-			eventId: zod.z.string(),
+			/** Which of the three event tables owns the row. */
+			ownerType: EventOwnerTypeSchema,
+			/** The event's rowid in that table (D474: an event id is a number). */
+			eventId: zod.z.number().int(),
 			kind: MediaFileKindEnum.optional(),
 			deviceId: zod.z.number()
 		}), zod.z.array(MediaFileSchema).readonly()),
@@ -20336,11 +20458,14 @@ var pipelineAnalyticsCapability = {
 		* the live hub: one event's `fullFrameBoxed` is 2 824 077 B, base64'd to
 		* ~3.8 MB, allocated whole in hub-main's heap, for a list of keys.
 		*
-		* Same `deviceId` authorization subject as `getEventMedia`, and the same
-		* rows — this is a projection of that method, never a different question.
+		* Same `deviceId` authorization subject as `getEventMedia`, the same
+		* REQUIRED `ownerType` (read that method's docblock for the night-time
+		* thumbnail this closes — D482), and the same rows: this is a projection
+		* of that method, never a different question.
 		*/
 		listEventMedia: method(zod.z.object({
-			eventId: zod.z.string(),
+			ownerType: EventOwnerTypeSchema,
+			eventId: zod.z.number().int(),
 			deviceId: zod.z.number()
 		}), zod.z.array(MediaFileInfoSchema).readonly()),
 		/**
@@ -27120,8 +27245,8 @@ var IdentitySchema = zod.z.object({
 	id: zod.z.string(),
 	name: zod.z.string(),
 	sampleCount: zod.z.number().int().nonnegative(),
-	coverMediaKey: zod.z.string().optional(),
-	/** Inline base64 of the cover sample's crop, resolved from `coverMediaKey`.
+	coverMediaId: zod.z.number().int().optional(),
+	/** Inline base64 of the cover sample's crop, resolved from `coverMediaId`.
 	*  Lets the UI render the person's face avatar instead of a placeholder icon. */
 	coverBase64: zod.z.string().optional()
 });
@@ -27147,8 +27272,8 @@ var IdentitySampleAuditRowSchema = zod.z.object({
 	enrolledAt: zod.z.number().int(),
 	deviceId: zod.z.number().int().optional(),
 	source: zod.z.enum(["detected", "photo"]),
-	/** The enrolled crop's media key, so the panel can show the evidence. */
-	mediaKey: zod.z.string().optional(),
+	/** The enrolled crop's media row id, so the panel can show the evidence. */
+	mediaId: zod.z.number().int().optional(),
 	/**
 	* False = the sample is stamped with a DIFFERENT face model, and a cosine
 	* across feature spaces is a well-formed float with no meaning. Every number
@@ -27217,15 +27342,15 @@ var FaceInfoSchema = zod.z.object({
 	*/
 	cropUrl: zod.z.string().optional(),
 	/** Design B: the face bbox (pixel space) on the key frame — lets a detail
-	*  view draw the box over the native `keyFrameMediaKey` frame. Absent on
+	*  view draw the box over the native `keyFrameMediaId` frame. Absent on
 	*  legacy rows written before design B. */
 	faceBbox: BoundingBoxSchema.optional(),
 	/** Design B: MediaStore key of the track's native-resolution key frame.
 	*  Fetch the native JPEG via the event-media data-plane
-	*  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`). Absent when the
+	*  (`/addon/<addonId>/event-media/m/<keyFrameMediaId>`). Absent when the
 	*  track produced no key frame (e.g. native/onboard source) — the UI falls
 	*  back to the inline `base64` face crop. */
-	keyFrameMediaKey: zod.z.string().optional(),
+	keyFrameMediaId: zod.z.number().int().optional(),
 	/** Winning identity-match cosine (0..1) for this face's track, when an
 	*  identity was auto-confirmed. Lets the UI surface WHY a face was assigned
 	*  (confidence badge / low-confidence audit). Absent on legacy rows and on
@@ -27294,11 +27419,14 @@ var FaceClusterSchema = zod.z.object({
 * `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
 * dialog already rendering its key FRAME from the `event-media` plane.
 *
-* `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
-* media key directly, so this needed no new plane and no new access decision.
+* `url` is `/addon/<addonId>/event-media/m/<mediaId>` (D482). The plane
+* resolves a media row by its own id, so this needed no new plane and no new
+* access decision.
 */
 var MediaFileLiteSchema$1 = zod.z.object({
-	key: zod.z.string(),
+	/** The media row's own id — the same address `MediaFileRef.mediaId` carries
+	*  (D482). It was the row's composite key, which embedded the owner. */
+	mediaId: zod.z.number().int(),
 	kind: zod.z.string(),
 	url: zod.z.string(),
 	sizeBytes: zod.z.number(),
@@ -27320,7 +27448,7 @@ var faceGalleryCapability = {
 		* covers inline, ~10 KB of base64 per row, on a query this UI mounts
 		* four times and the viewer holds at `staleTime: 30_000`.
 		*
-		* Nothing loses its avatar: `coverMediaKey` is already on every row and
+		* Nothing loses its avatar: `coverMediaId` is already on every row and
 		* the `event-media` plane serves that key `immutable` with an ETag.
 		*
 		* **This is an INPUT field, so it does not reach the addon until the
@@ -31083,8 +31211,8 @@ var VehicleSchema = zod.z.object({
 	id: zod.z.string(),
 	name: zod.z.string(),
 	sampleCount: zod.z.number().int().nonnegative(),
-	coverMediaKey: zod.z.string().optional(),
-	/** Inline base64 of the cover sample's plate crop, resolved from `coverMediaKey`. */
+	coverMediaId: zod.z.number().int().optional(),
+	/** Inline base64 of the cover sample's plate crop, resolved from `coverMediaId`. */
 	coverBase64: zod.z.string().optional()
 });
 var VehicleSampleInfoSchema = zod.z.object({
@@ -31117,7 +31245,7 @@ var PlateInfoSchema = zod.z.object({
 	/** keyFrame parity: the plate bbox (pixel space) on the native key frame. */
 	plateBbox: BoundingBoxSchema.optional(),
 	/** keyFrame parity: MediaStore key of the track's native-resolution key frame. */
-	keyFrameMediaKey: zod.z.string().optional(),
+	keyFrameMediaId: zod.z.number().int().optional(),
 	base64: zod.z.string().optional(),
 	/**
 	* Same crop as a data-plane URL, always present when the plate has a stored
@@ -31138,11 +31266,14 @@ var PlateInfoSchema = zod.z.object({
 * `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
 * dialog already rendering its key FRAME from the `event-media` plane.
 *
-* `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
-* media key directly, so this needed no new plane and no new access decision.
+* `url` is `/addon/<addonId>/event-media/m/<mediaId>` (D482). The plane
+* resolves a media row by its own id, so this needed no new plane and no new
+* access decision.
 */
 var MediaFileLiteSchema = zod.z.object({
-	key: zod.z.string(),
+	/** The media row's own id — the same address `MediaFileRef.mediaId` carries
+	*  (D482). It was the row's composite key, which embedded the owner. */
+	mediaId: zod.z.number().int(),
 	kind: zod.z.string(),
 	url: zod.z.string(),
 	sizeBytes: zod.z.number(),
@@ -31224,7 +31355,7 @@ var plateGalleryCapability = {
 		listVehicles: method(zod.z.object({ 
 		/** Inline {@link VehicleSchema.coverBase64} on every row. Default
 		*  `false` — the vehicle twin of `faceGallery.listIdentities`'s
-		*  option; `coverMediaKey` + the `event-media` plane carry the picture.
+		*  option; `coverMediaId` + the `event-media` plane carry the picture.
 		*  INPUT field: stripped by the hub router until the train ships, which
 		*  resolves to `false` and is exactly the intended default. */
 includeCrops: zod.z.boolean().optional() }).optional(), zod.z.array(VehicleSchema).readonly()),
@@ -33123,7 +33254,14 @@ var SceneReferenceSchema = zod.z.object({
 	modelId: zod.z.string(),
 	condition: SceneConditionSchema,
 	capturedAt: zod.z.number(),
-	thumbnailMediaId: zod.z.string().optional(),
+	/**
+	* The reference thumbnail's media ROW id (D482).
+	*
+	* The name already said `mediaId` while the value was the row's composite
+	* key — a leftover that read as done and was not. It is the row's own id
+	* now, addressed at `/addon/<addonId>/event-media/m/<id>`.
+	*/
+	thumbnailMediaId: zod.z.number().int().optional(),
 	/** Whole-frame (downscaled) embedding captured alongside the ROI crop. The
 	*  anti-view-shift anchor: a bumped camera, a PTZ preset or a re-aim makes the
 	*  normalized rect frame a different piece of world, and the scene would
@@ -34480,7 +34618,29 @@ var LoggingSettingsPatchSchema = zod.z.object({
 	* disarmed the channels it did not mention would make the Levels page and
 	* the Diagnostics page fight over the same value.
 	*/
-	channels: zod.z.array(LogChannelWindowPatchSchema).readonly().optional()
+	channels: zod.z.array(LogChannelWindowPatchSchema).readonly().optional(),
+	/**
+	* How many days the analytics OPS LOG is kept — the audit trail of what
+	* retention actually deleted.
+	*
+	* It lives HERE, on the logging document, and not on the analytics addon's
+	* settings form, on the operator's instruction: every other log-ish window in
+	* this system is configured through this one document, and a retention audit
+	* configured somewhere else is a second place to look when the question is
+	* "what happened to my data".
+	*
+	* That placement has a cost worth stating: this document ships in the
+	* framework closure, so this knob needs a published `@camstack/server` while
+	* the four windows beside it (D485) reach a node on `camstack deploy`.
+	*
+	* `retention-model.ts` argued this one must NOT follow a device window,
+	* because the audit trail is the history of the SWEEP and not of the camera.
+	* That argument stands and is untouched — what changes is that 30 days stops
+	* being a constant nobody can reach. `0` keeps it forever. The floor is 1 day
+	* rather than 0-as-delete: an audit log truncated to nothing is precisely the
+	* state in which the next 9.5 GiB leak cannot be explained.
+	*/
+	opsLogRetentionDays: zod.z.number().int().min(0).max(3650).optional()
 });
 /**
 * Which LAYER of the hierarchy is addressed. Absent = the cluster layer.
@@ -34553,6 +34713,14 @@ var LoggingSettingsStateSchema = zod.z.object({
 	channels: zod.z.array(LogChannelDescriptorSchema).readonly(),
 	/** The channels ARMED right now, each with its deadline. */
 	activeChannels: zod.z.array(LogChannelWindowStateSchema).readonly(),
+	/**
+	* The ops-log window in days, as it is in force. `0` = kept forever.
+	*
+	* Reported rather than left to the caller's memory of what it wrote: this is
+	* the value the analytics sweep will actually use, and an operator asking how
+	* long their audit trail lives should not have to infer it from a default.
+	*/
+	opsLogRetentionDays: zod.z.number().int().min(0),
 	persisted: zod.z.boolean()
 });
 var systemCapability = {
@@ -35542,7 +35710,7 @@ var StationaryObjectSchema = zod.z.object({
 	/** Enrichment label carried from the source track (identity / plate). */
 	label: zod.z.string().optional(),
 	/** Native-resolution key-frame media key for the parked object's best image. */
-	keyFrameMediaKey: zod.z.string().optional()
+	keyFrameMediaId: zod.z.number().int().optional()
 });
 var CameraOccupancySnapshotSchema = zod.z.object({
 	/** Frame timestamp of the inference result that produced this snapshot. */
@@ -37706,6 +37874,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"dataStoreProvider.upsert": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dayNight.getOptions": {
 		capName: "day-night",
 		capScope: "device",
@@ -41570,6 +41744,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.upsert": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"smtpProvider.getStatus": {
 		capName: "smtp-provider",
 		capScope: "system",

package/dist/index.d.ts

@@ -102,5 +102,5 @@ export * from './tls/index.js';
 export { IntegrationRegistry } from './builtins/sqlite-storage/integration-registry.js';
 export { type EnsureAddonNativePrebuildsOptions, ensureAddonNativePrebuilds, type NativeEnsureOutcome, type NativeEnsureResult, } from './kernel/deps/ensure-addon-natives.js';
 export { type EnsureNativePrebuildsOptions, ensureNativePrebuilds, hasDotNode, NATIVE_SCAN_DEPTH, type PrebuildFetchFn, type PrebuildTarget, TRADITIONAL_NATIVE_PACKAGES, } from './kernel/deps/ensure-native-prebuilds.js';
-export { type NpmInvocation, type RunNpmOptions, resolveNpmInvocation, runNpm, } from './kernel/deps/npm-command.js';
+export { type NpmInvocation, type RunNpmOptions, buildNpmChildEnv, resolveNpmInvocation, runNpm, } from './kernel/deps/npm-command.js';
 export * from './kernel/index.js';

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DdRxWA7g.js");
+const require_dist = require("./dist-u8F4ZyXi.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -27,9 +27,9 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-CAsHdMwP.js");
 const require_tls$1 = require("./tls-BFs4PzoW.js");
-const require_manifest_system_deps = require("./manifest-system-deps-8x1jgPz_.js");
+const require_manifest_system_deps = require("./manifest-system-deps-CrSP0Kkp.js");
 const require_resource_monitor = require("./resource-monitor-LVE1BoLs.js");
-const require_custom_action_registry = require("./custom-action-registry-BTB-LgGN.js");
+const require_custom_action_registry = require("./custom-action-registry-mtS2EOEs.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -95967,6 +95967,7 @@ exports.buildHeapSample = require_manifest_system_deps.buildHeapSample;
 exports.buildLinkChain = require_manifest_system_deps.buildLinkChain;
 exports.buildNativeCapProxy = require_manifest_system_deps.buildNativeCapProxy;
 exports.buildNodeManifest = buildNodeManifest;
+exports.buildNpmChildEnv = require_manifest_system_deps.buildNpmChildEnv;
 exports.buildStorageLocationRegistry = require_builtins_storage_orchestrator_storage_orchestrator_addon.buildStorageLocationRegistry;
 exports.buildUdsNativeCapProxy = require_manifest_system_deps.buildUdsNativeCapProxy;
 exports.builderMountedCapNames = builderMountedCapNames;