@camstack/system 1.2.24 → 1.2.26

package/dist/builtins/storage-orchestrator/storage-orchestrator.service.d.ts

@@ -37,6 +37,21 @@ export type StorageProviderLookup = () => readonly IStorageProviderImpl[];
  *     remote), the safe default for the early-boot / in-memory path.
  */
 export type NodeLocalResolver = (providerId: string) => boolean | undefined;
+/**
+ * Where a single dispatch must execute: which `storage-provider`, on which
+ * node. `providerId` alone is NOT a routing key — every node's filesystem
+ * provider registers under the same id, so a target without its `nodeId`
+ * silently resolves to whichever node asked (the hub).
+ *
+ * `nodeId` absent = node-agnostic (S3/SFTP/WebDAV): reachable from anywhere,
+ * so the local provider runs it.
+ */
+export interface StorageDispatchTarget {
+    readonly providerId: string;
+    readonly nodeId?: string;
+}
+/** The two chunked-I/O session families the orchestrator tracks. */
+export type StorageSessionKind = 'upload' | 'download';
 export declare class StorageOrchestratorService {
     private readonly logger;
     private readonly getProviders;
@@ -54,8 +69,6 @@ export declare class StorageOrchestratorService {
      * the provider appears. See {@link attachStore}.
      */
     private locationStore;
-    /** This node's id — locations pinned to OTHER nodes dispatch remotely. */
-    private readonly localNodeId;
     /** Cross-node provider resolver (hub wiring: a node-routed capability
      *  proxy over `storage-provider`). Absent → remote locations error. */
     private readonly getRemoteProvider?;
@@ -76,6 +89,15 @@ export declare class StorageOrchestratorService {
      * early-boot path that predates the resolver wiring.
      */
     private nodeLocalResolver;
+    /** `localNodeId` with any forked-child `/addon` suffix stripped. */
+    private readonly localNode;
+    /**
+     * `<kind>:<sessionId>` → the dispatch target that OPENED the session.
+     * Chunked I/O carries no `StorageLocation` after the first hop, so without
+     * this the follow-up chunks fall back to a `providerId`-only lookup — which
+     * on a multi-node cluster means the hub's filesystem, not the agent's.
+     */
+    private readonly sessionTargets;
     constructor(logger: IScopedLogger, getProviders: StorageProviderLookup, 
     /**
      * Optional persistence backend. When supplied, `initialize()`
@@ -96,6 +118,12 @@ export declare class StorageOrchestratorService {
     /** Cross-node provider resolver (hub wiring: a node-routed capability
      *  proxy over `storage-provider`). Absent → remote locations error. */
     getRemoteProvider?: ((nodeId: string) => IStorageProviderImpl | null) | undefined);
+    /**
+     * The node this orchestrator runs on, with any forked-child `/addon`
+     * suffix stripped. A location whose `nodeId` differs is NOT this node's
+     * to touch — its bytes, and its free space, live elsewhere.
+     */
+    getLocalNodeId(): string;
     /** True once a persistence store is wired (constructor or {@link attachStore}). */
     hasStore(): boolean;
     /**
@@ -210,13 +238,45 @@ export declare class StorageOrchestratorService {
      */
     resolveRef(ref: StorageLocationRef): StorageLocation;
     /**
-     * Find the storage-provider that backs a given location. Lookup is by
-     * `location.providerId` against `getProviderInfo().providerId` from
-     * each registered collection provider. Throws with both the missing
-     * providerId and the offending location id so the operator can pick
-     * the right place to fix the config.
+     * Find the storage-provider that backs a given location — the entry point
+     * every consumer-facing `storage` cap method funnels through.
+     *
+     * Routing key is `(providerId, nodeId)`, never `providerId` alone: every
+     * node's FilesystemStorageProvider registers under the SAME providerId, so
+     * a providerId-only match resolves to whichever node asked. That is how a
+     * location created on an agent ended up writing to the HUB's filesystem
+     * (root-caused 2026-07-29).
      */
     getProviderFor(location: StorageLocation): Promise<IStorageProviderImpl>;
+    /**
+     * Resolve one dispatch target to the provider that must execute it.
+     *
+     * `descriptor` is the operator-facing subject of the error message
+     * (`location "recordings:disk"`, `uploadId "u-42"`); `locationId` is the
+     * structured tag for the log line when there is a location behind the
+     * dispatch (chunked sessions carry only the session id).
+     *
+     * Both failure branches LOG before throwing, and NEITHER falls back to the
+     * local provider — a silent fallback is the bug this method exists to fix.
+     */
+    private getProviderForTarget;
+    /**
+     * Remember which provider — and on which NODE — opened a chunked session.
+     * `beginUpload` / `beginDownload` carry a `StorageLocation`; every later
+     * chunk carries only the session id, and a session id issued by an agent
+     * means nothing to the hub's provider.
+     */
+    rememberSession(kind: StorageSessionKind, sessionId: string, location: StorageLocation): void;
+    /** Drop a session's routing entry (finalize / abort / end). */
+    forgetSession(kind: StorageSessionKind, sessionId: string): void;
+    /** Drop every session entry (addon shutdown). */
+    clearSessions(): void;
+    /**
+     * Resolve the provider that owns an in-flight chunked session, on the node
+     * that opened it. Throws when the orchestrator has no record of the open
+     * call (provider gone, or a chunk for a session it never issued).
+     */
+    getProviderForSession(kind: StorageSessionKind, sessionId: string): Promise<IStorageProviderImpl>;
     /** Convenience: lookup by id (returns `undefined` if not found). */
     getLocationById(id: string): StorageLocation | undefined;
     /**

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CS0pdC8l.js");
+const require_dist = require("../../dist-Cu72wsz5.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { St as hydrateSchema, at as BaseAddon, it as errMsg } from "../../dist-CIek6F9X.mjs";
+import { St as hydrateSchema, at as BaseAddon, it as errMsg } from "../../dist-DimX9eZy.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CS0pdC8l.js");
+const require_dist = require("../../dist-Cu72wsz5.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { at as BaseAddon, z as logDestinationCapability } from "../../dist-CIek6F9X.mjs";
+import { at as BaseAddon, z as logDestinationCapability } from "../../dist-DimX9eZy.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-CS0pdC8l.js → dist-Cu72wsz5.js}

@@ -1,5 +1,5 @@
 let zod = require("zod");
-//#region ../types/dist/event-category-BLcNejAE.mjs
+//#region ../types/dist/event-category-Bz24uP1U.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -270,6 +270,19 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["DeviceStateChanged"] = "device.state-changed";
 	/**
+	* Frame occupancy for a camera CHANGED — a tracked object was gained or
+	* lost. Carries `{ deviceId, totalObjects, byClass, zones }`.
+	*
+	* Emitted only on a change, so a steady scene is silent. It exists so a
+	* client can stop polling `zoneAnalytics.getCurrentSnapshot`: that was the
+	* one live badge with no push signal at all, and it cost a request every
+	* four seconds per visible camera.
+	*
+	* Like every event it is telemetry and may be dropped ([D8]) — a consumer
+	* keeps a slow reconcile rather than trusting it alone.
+	*/
+	EventCategory["ZoneAnalyticsOccupancyChanged"] = "zone-analytics.occupancy-changed";
+	/**
 	* Cap event fired by every device that registers the `battery`
 	* capability. Mirrors the cap definition's `onStatusChanged`. Carries
 	* `{ deviceId, status: BatteryStatus }`. Subscribers (alert center,
@@ -5326,6 +5339,29 @@ var NcOccupancyConditionSchema = zod.z.object({
 	count: zod.z.number().int().min(0).default(1),
 	sustainSeconds: zod.z.number().int().min(0).max(3600).default(15)
 });
+/**
+* Which zone-crossing DIRECTION a rule accepts (`ObjectEvent.zoneCrossing`).
+*
+* The values are not symmetric, and deliberately so — the absent value has to
+* mean exactly what every rule authored before this condition existed already
+* does:
+*  - `enter` — entries and every NON-crossing record (movement state,
+*    package, sensor). Exits are rejected. **This is the absent behaviour**:
+*    an operator who never asked for exits must not start receiving them.
+*  - `exit`  — ONLY an exit crossing. A record that is not a crossing at all
+*    fails closed, because "the car left the drive" is a question about a
+*    boundary, not about a detection.
+*  - `any`   — no direction filter; entries, exits and non-crossings alike.
+*
+* A rule asking for a direction should normally also scope `zones`, which the
+* engine evaluates against the crossed zone as well as the current membership
+* (an exit's membership no longer contains the zone it just left).
+*/
+var NcCrossingSchema = zod.z.enum([
+	"enter",
+	"exit",
+	"any"
+]);
 /** Admin-zone membership condition (zone IDs as stamped by the ZoneEngine). */
 var NcZoneConditionSchema = zod.z.object({
 	ids: zod.z.array(zod.z.string().min(1)).min(1),
@@ -5350,6 +5386,13 @@ var NcConditionsSchema = zod.z.object({
 	/** Veto zones — any hit fails the rule. */
 	zonesExclude: zod.z.array(zod.z.string().min(1)).optional(),
 	/**
+	* Zone-crossing direction. IMMEDIATE only — a crossing is a per-event fact
+	* and a closed track carries none, so a `track-end` rule asking for one
+	* fails closed (use `zones`, which tests `zonesVisited`). ABSENT = `enter`,
+	* which is exactly today's behaviour. See {@link NcCrossingSchema}.
+	*/
+	crossing: NcCrossingSchema.optional(),
+	/**
 	* Exact (case-insensitive) match on the record's collapsed `label`
 	* (identity name / plate text / subclass).
 	*/
@@ -5538,11 +5581,31 @@ var NcMediaPolicySchema = zod.z.object({
 	*/
 	profile: CamProfileSchema.optional()
 });
+/**
+* Cooldown GRANULARITY over the subject's class — how much a fired
+* notification suppresses.
+*  - `shared` (default, and the absent value) — one window for the whole
+*    rule/scope: a cat silences the next dog for `cooldownSec`.
+*  - `per-class` — an independent window per detected class, so cat→dog fires
+*    at once and cat→cat still waits.
+*
+* AUDIO subjects are ALWAYS per-class regardless of this setting: a scream
+* must not be swallowed by a bark's window (the precedent this generalizes —
+* see `cooldownKey` in the rule engine).
+*/
+var NcThrottleGranularitySchema = zod.z.enum(["shared", "per-class"]);
 /** Throttle — cooldown survives restarts (rebuilt from the outbox on boot). */
 var NcThrottleSchema = zod.z.object({
 	cooldownSec: zod.z.number().int().min(0).max(86400).default(60),
 	/** `rule` = one shared cooldown; `rule-device` = per-camera cooldown. */
-	scope: zod.z.enum(["rule", "rule-device"]).default("rule-device")
+	scope: zod.z.enum(["rule", "rule-device"]).default("rule-device"),
+	/**
+	* Class granularity of the cooldown key. Optional rather than defaulted:
+	* a Zod default does NOT run on the addon→addon cap path, so a persisted
+	* rule authored before this field simply carries none — and the engine
+	* reads absent as `shared`, the pre-existing behaviour.
+	*/
+	granularity: NcThrottleGranularitySchema.optional()
 });
 /** Client-supplied rule fields (server stamps id/createdBy/createdAt/updatedAt). */
 var NcRuleInputSchema = zod.z.object({
@@ -5650,6 +5713,7 @@ var NcConditionDescriptorSchema = zod.z.object({
 		"schedule",
 		"plateMatcher",
 		"packagePhase",
+		"crossingSelect",
 		"polygonDraw",
 		"occupancy"
 	]),
@@ -15673,7 +15737,29 @@ var deviceManagerCapability = {
 		getDeviceStatusAggregate: method(zod.z.object({
 			deviceId: zod.z.number(),
 			caps: zod.z.array(zod.z.string()).readonly().optional()
-		}), zod.z.record(zod.z.string(), zod.z.unknown().nullable()))
+		}), zod.z.record(zod.z.string(), zod.z.unknown().nullable())),
+		/**
+		* The same aggregate, for a LIST of devices in one round-trip.
+		*
+		* The viewer's camera list is the caller this exists for. Each card asked
+		* for its own badges — battery here, recording mode there — so a ten-camera
+		* install issued N separate procedures per reconcile, each its own message
+		* on the one WebSocket that also carries the WebRTC signalling (the client
+		* has no `httpBatchLink`, so there is no transport-level batching to lean
+		* on: collapsing has to happen at the procedure level, which is here).
+		*
+		* Keyed by device id as a STRING — a JSON object cannot key by number, and
+		* pretending otherwise is how a record survives the wire only in tests.
+		* The per-device value is exactly what `getDeviceStatusAggregate` returns,
+		* so a caller can move between the two without reshaping anything.
+		*
+		* `caps` matters more here than in the single call: a client that needs two
+		* caps should not pay for every status-carrying cap × every device.
+		*/
+		getDeviceStatusAggregateBatch: method(zod.z.object({
+			deviceIds: zod.z.array(zod.z.number()).readonly(),
+			caps: zod.z.array(zod.z.string()).readonly().optional()
+		}), zod.z.record(zod.z.string(), zod.z.record(zod.z.string(), zod.z.unknown().nullable())))
 	}
 };
 /**
@@ -17399,6 +17485,37 @@ var MotionEventSchema = zod.z.object({
 * Absent on legacy rows ⇒ treat as `pipeline`.
 */
 var DetectionSourceSchema = zod.z.enum(["pipeline", "onboard"]);
+/**
+* Which WAY a subject crossed a zone boundary. An entry and an exit are two
+* different notifications ("the parcel arrived" / "the car left the drive"),
+* and until this existed they were indistinguishable on the persisted record —
+* which is why exits were computed and dropped at the emit boundary rather
+* than doubling every zone-scoped rule.
+*/
+var ZoneCrossingDirectionSchema = zod.z.enum(["enter", "exit"]);
+/**
+* The confirmed zone crossing that produced an object event. Present ONLY on
+* an event emitted BY a crossing (`zone.enter` / `zone.exit`); a movement-state
+* event (`object.entering` / `leaving` / `stationary` / `loitering`) and an
+* appearance event carry none, so a rule asking for a direction fails closed
+* on them.
+*
+* Exactly ONE crossing per event: the emitter turns each confirmed crossing
+* into its own event, so a frame in which a track enters A while leaving B
+* produces two events with two directions — never one ambiguous row.
+*
+* `zoneId` is load-bearing for an EXIT: the event's `zones` list is the
+* membership the box has NOW, and by definition it no longer contains the zone
+* that was just left. Without the id here, a zone-scoped rule could never match
+* the exit it asked for.
+*/
+var ZoneCrossingSchema = zod.z.object({
+	direction: ZoneCrossingDirectionSchema,
+	/** Admin zone id crossed. */
+	zoneId: zod.z.string(),
+	/** Zone display name at crossing time (falls back to the id). */
+	zoneName: zod.z.string().optional()
+});
 var ObjectEventSchema = zod.z.object({
 	...BaseEventFields,
 	kind: zod.z.literal("object"),
@@ -17425,6 +17542,12 @@ var ObjectEventSchema = zod.z.object({
 	zones: zod.z.array(zod.z.string()).readonly().optional(),
 	/** Omitted in slim projection. */
 	state: TrackStateSchema.optional(),
+	/**
+	* The zone crossing this event IS, when it is one. Absent on every other
+	* event kind (movement state, appearance, package) — see
+	* {@link ZoneCrossingSchema}. Omitted in slim projection.
+	*/
+	zoneCrossing: ZoneCrossingSchema.optional(),
 	/** Detection-frame dimensions in pixels — let consumers normalize the
 	*  pixel-space `bbox` onto a displayed image. Omitted in slim projection. */
 	frameWidth: zod.z.number().optional(),
@@ -24958,6 +25081,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getDeviceStatusAggregateBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getLinkedDevices": {
 		capName: "device-manager",
 		capScope: "system",

package/dist/{dist-CIek6F9X.mjs → dist-DimX9eZy.mjs}

@@ -1,5 +1,5 @@
 import { z } from "zod";
-//#region ../types/dist/event-category-BLcNejAE.mjs
+//#region ../types/dist/event-category-Bz24uP1U.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -270,6 +270,19 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["DeviceStateChanged"] = "device.state-changed";
 	/**
+	* Frame occupancy for a camera CHANGED — a tracked object was gained or
+	* lost. Carries `{ deviceId, totalObjects, byClass, zones }`.
+	*
+	* Emitted only on a change, so a steady scene is silent. It exists so a
+	* client can stop polling `zoneAnalytics.getCurrentSnapshot`: that was the
+	* one live badge with no push signal at all, and it cost a request every
+	* four seconds per visible camera.
+	*
+	* Like every event it is telemetry and may be dropped ([D8]) — a consumer
+	* keeps a slow reconcile rather than trusting it alone.
+	*/
+	EventCategory["ZoneAnalyticsOccupancyChanged"] = "zone-analytics.occupancy-changed";
+	/**
 	* Cap event fired by every device that registers the `battery`
 	* capability. Mirrors the cap definition's `onStatusChanged`. Carries
 	* `{ deviceId, status: BatteryStatus }`. Subscribers (alert center,
@@ -5326,6 +5339,29 @@ var NcOccupancyConditionSchema = z.object({
 	count: z.number().int().min(0).default(1),
 	sustainSeconds: z.number().int().min(0).max(3600).default(15)
 });
+/**
+* Which zone-crossing DIRECTION a rule accepts (`ObjectEvent.zoneCrossing`).
+*
+* The values are not symmetric, and deliberately so — the absent value has to
+* mean exactly what every rule authored before this condition existed already
+* does:
+*  - `enter` — entries and every NON-crossing record (movement state,
+*    package, sensor). Exits are rejected. **This is the absent behaviour**:
+*    an operator who never asked for exits must not start receiving them.
+*  - `exit`  — ONLY an exit crossing. A record that is not a crossing at all
+*    fails closed, because "the car left the drive" is a question about a
+*    boundary, not about a detection.
+*  - `any`   — no direction filter; entries, exits and non-crossings alike.
+*
+* A rule asking for a direction should normally also scope `zones`, which the
+* engine evaluates against the crossed zone as well as the current membership
+* (an exit's membership no longer contains the zone it just left).
+*/
+var NcCrossingSchema = z.enum([
+	"enter",
+	"exit",
+	"any"
+]);
 /** Admin-zone membership condition (zone IDs as stamped by the ZoneEngine). */
 var NcZoneConditionSchema = z.object({
 	ids: z.array(z.string().min(1)).min(1),
@@ -5350,6 +5386,13 @@ var NcConditionsSchema = z.object({
 	/** Veto zones — any hit fails the rule. */
 	zonesExclude: z.array(z.string().min(1)).optional(),
 	/**
+	* Zone-crossing direction. IMMEDIATE only — a crossing is a per-event fact
+	* and a closed track carries none, so a `track-end` rule asking for one
+	* fails closed (use `zones`, which tests `zonesVisited`). ABSENT = `enter`,
+	* which is exactly today's behaviour. See {@link NcCrossingSchema}.
+	*/
+	crossing: NcCrossingSchema.optional(),
+	/**
 	* Exact (case-insensitive) match on the record's collapsed `label`
 	* (identity name / plate text / subclass).
 	*/
@@ -5538,11 +5581,31 @@ var NcMediaPolicySchema = z.object({
 	*/
 	profile: CamProfileSchema.optional()
 });
+/**
+* Cooldown GRANULARITY over the subject's class — how much a fired
+* notification suppresses.
+*  - `shared` (default, and the absent value) — one window for the whole
+*    rule/scope: a cat silences the next dog for `cooldownSec`.
+*  - `per-class` — an independent window per detected class, so cat→dog fires
+*    at once and cat→cat still waits.
+*
+* AUDIO subjects are ALWAYS per-class regardless of this setting: a scream
+* must not be swallowed by a bark's window (the precedent this generalizes —
+* see `cooldownKey` in the rule engine).
+*/
+var NcThrottleGranularitySchema = z.enum(["shared", "per-class"]);
 /** Throttle — cooldown survives restarts (rebuilt from the outbox on boot). */
 var NcThrottleSchema = z.object({
 	cooldownSec: z.number().int().min(0).max(86400).default(60),
 	/** `rule` = one shared cooldown; `rule-device` = per-camera cooldown. */
-	scope: z.enum(["rule", "rule-device"]).default("rule-device")
+	scope: z.enum(["rule", "rule-device"]).default("rule-device"),
+	/**
+	* Class granularity of the cooldown key. Optional rather than defaulted:
+	* a Zod default does NOT run on the addon→addon cap path, so a persisted
+	* rule authored before this field simply carries none — and the engine
+	* reads absent as `shared`, the pre-existing behaviour.
+	*/
+	granularity: NcThrottleGranularitySchema.optional()
 });
 /** Client-supplied rule fields (server stamps id/createdBy/createdAt/updatedAt). */
 var NcRuleInputSchema = z.object({
@@ -5650,6 +5713,7 @@ var NcConditionDescriptorSchema = z.object({
 		"schedule",
 		"plateMatcher",
 		"packagePhase",
+		"crossingSelect",
 		"polygonDraw",
 		"occupancy"
 	]),
@@ -15673,7 +15737,29 @@ var deviceManagerCapability = {
 		getDeviceStatusAggregate: method(z.object({
 			deviceId: z.number(),
 			caps: z.array(z.string()).readonly().optional()
-		}), z.record(z.string(), z.unknown().nullable()))
+		}), z.record(z.string(), z.unknown().nullable())),
+		/**
+		* The same aggregate, for a LIST of devices in one round-trip.
+		*
+		* The viewer's camera list is the caller this exists for. Each card asked
+		* for its own badges — battery here, recording mode there — so a ten-camera
+		* install issued N separate procedures per reconcile, each its own message
+		* on the one WebSocket that also carries the WebRTC signalling (the client
+		* has no `httpBatchLink`, so there is no transport-level batching to lean
+		* on: collapsing has to happen at the procedure level, which is here).
+		*
+		* Keyed by device id as a STRING — a JSON object cannot key by number, and
+		* pretending otherwise is how a record survives the wire only in tests.
+		* The per-device value is exactly what `getDeviceStatusAggregate` returns,
+		* so a caller can move between the two without reshaping anything.
+		*
+		* `caps` matters more here than in the single call: a client that needs two
+		* caps should not pay for every status-carrying cap × every device.
+		*/
+		getDeviceStatusAggregateBatch: method(z.object({
+			deviceIds: z.array(z.number()).readonly(),
+			caps: z.array(z.string()).readonly().optional()
+		}), z.record(z.string(), z.record(z.string(), z.unknown().nullable())))
 	}
 };
 /**
@@ -17399,6 +17485,37 @@ var MotionEventSchema = z.object({
 * Absent on legacy rows ⇒ treat as `pipeline`.
 */
 var DetectionSourceSchema = z.enum(["pipeline", "onboard"]);
+/**
+* Which WAY a subject crossed a zone boundary. An entry and an exit are two
+* different notifications ("the parcel arrived" / "the car left the drive"),
+* and until this existed they were indistinguishable on the persisted record —
+* which is why exits were computed and dropped at the emit boundary rather
+* than doubling every zone-scoped rule.
+*/
+var ZoneCrossingDirectionSchema = z.enum(["enter", "exit"]);
+/**
+* The confirmed zone crossing that produced an object event. Present ONLY on
+* an event emitted BY a crossing (`zone.enter` / `zone.exit`); a movement-state
+* event (`object.entering` / `leaving` / `stationary` / `loitering`) and an
+* appearance event carry none, so a rule asking for a direction fails closed
+* on them.
+*
+* Exactly ONE crossing per event: the emitter turns each confirmed crossing
+* into its own event, so a frame in which a track enters A while leaving B
+* produces two events with two directions — never one ambiguous row.
+*
+* `zoneId` is load-bearing for an EXIT: the event's `zones` list is the
+* membership the box has NOW, and by definition it no longer contains the zone
+* that was just left. Without the id here, a zone-scoped rule could never match
+* the exit it asked for.
+*/
+var ZoneCrossingSchema = z.object({
+	direction: ZoneCrossingDirectionSchema,
+	/** Admin zone id crossed. */
+	zoneId: z.string(),
+	/** Zone display name at crossing time (falls back to the id). */
+	zoneName: z.string().optional()
+});
 var ObjectEventSchema = z.object({
 	...BaseEventFields,
 	kind: z.literal("object"),
@@ -17425,6 +17542,12 @@ var ObjectEventSchema = z.object({
 	zones: z.array(z.string()).readonly().optional(),
 	/** Omitted in slim projection. */
 	state: TrackStateSchema.optional(),
+	/**
+	* The zone crossing this event IS, when it is one. Absent on every other
+	* event kind (movement state, appearance, package) — see
+	* {@link ZoneCrossingSchema}. Omitted in slim projection.
+	*/
+	zoneCrossing: ZoneCrossingSchema.optional(),
 	/** Detection-frame dimensions in pixels — let consumers normalize the
 	*  pixel-space `bbox` onto a displayed image. Omitted in slim projection. */
 	frameWidth: z.number().optional(),
@@ -24958,6 +25081,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getDeviceStatusAggregateBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getLinkedDevices": {
 		capName: "device-manager",
 		capScope: "system",

package/dist/index.js

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CS0pdC8l.js");
+const require_dist = require("./dist-Cu72wsz5.js");
 const require_model_download_service = require("./model-download-service-hf0ookyy.js");
-const require_manifest_python_deps = require("./manifest-python-deps-BbOZZbVt.js");
+const require_manifest_python_deps = require("./manifest-python-deps-COgal7Jy.js");
 const require_resource_monitor = require("./resource-monitor-DNNomR-i.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { B as logLevelAtMost, Dt as readinessKey, Et as parseJsonUnknown$1, F as isVoidInput, I as kebabToCamel, L as lifecycleJobSchema, M as isArrayOutputSchema, N as isCollectionArrayMethod, Ot as resolveCapMount, P as isObjectInput, Tt as parseJsonObject, V as looseSchema, W as objectInputDeclaresAddonId, _t as asString$1, c as RUNTIME_DEFAULTS, ct as DEVICE_STATUS_METHOD, ft as ReadinessRegistry, gt as asNumber, ht as asJsonObject$1, it as errMsg$1, jt as EventCategory$1, k as extractNestedAddonId, kt as scopeKey, m as addonSettingsCapability, ot as DATAPLANE_SECRET_HEADER$1, pt as ReadinessTimeoutError, q as procedureAuthKey, s as METHOD_ACCESS_MAP, st as DEVICE_SETTINGS_CONTRIBUTION_METHODS, t as ALL_CAPABILITY_DEFINITIONS, vt as createEvent, xt as expandCapMethods, yt as emitDownForOwnedCaps } from "./dist-CIek6F9X.mjs";
+import { B as logLevelAtMost, Dt as readinessKey, Et as parseJsonUnknown$1, F as isVoidInput, I as kebabToCamel, L as lifecycleJobSchema, M as isArrayOutputSchema, N as isCollectionArrayMethod, Ot as resolveCapMount, P as isObjectInput, Tt as parseJsonObject, V as looseSchema, W as objectInputDeclaresAddonId, _t as asString$1, c as RUNTIME_DEFAULTS, ct as DEVICE_STATUS_METHOD, ft as ReadinessRegistry, gt as asNumber, ht as asJsonObject$1, it as errMsg$1, jt as EventCategory$1, k as extractNestedAddonId, kt as scopeKey, m as addonSettingsCapability, ot as DATAPLANE_SECRET_HEADER$1, pt as ReadinessTimeoutError, q as procedureAuthKey, s as METHOD_ACCESS_MAP, st as DEVICE_SETTINGS_CONTRIBUTION_METHODS, t as ALL_CAPABILITY_DEFINITIONS, vt as createEvent, xt as expandCapMethods, yt as emitDownForOwnedCaps } from "./dist-DimX9eZy.mjs";
 import { a as downloadModel, c as getModelFilePath, d as contentTypeFor, f as createAuthenticatedFileServer, h as resolveFilePath, i as downloadFile, l as isModelDownloaded, m as parseTokenizedUrl, n as collectModelFiles, o as ensureModel, p as parseRangeHeader, r as deleteModelFromDisk, s as fetchJson, t as ModelDownloadService, u as createFileDataPlaneHandler } from "./model-download-service-Cp9f4dk6.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-C9qhvMUi.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-julrfvyf.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BkP504Vq.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
 import { SqliteSettingsAddon, t as SqliteSettingsBackend } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";

package/dist/kernel/moleculer/settings-read-guard.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Read-modify-write guard for the addon settings stores.
+ *
+ * ## The data loss this prevents
+ *
+ * Every settings mutation is `read current → merge patch → write back`. The
+ * read used to answer `{}` for BOTH "this addon has no settings yet" and "the
+ * read failed", so a failed read merged the patch onto nothing and the write
+ * persisted a blob containing ONLY the patch. Everything else in it was gone.
+ *
+ * It happened on 2026-07-31. The UDS transport stalled, `settings write failed
+ * (addon-settings/root) — transport error ... UDS request timed out after
+ * 60000ms` appeared in the log, and the recording configuration for all three
+ * recording cameras came back as `{"enabled": false, "bands": []}`. Two and a
+ * half hours of footage were never written, and nothing looked broken: an
+ * emptied config is indistinguishable from an operator switching recording off.
+ *
+ * The rule this module enforces: **a read that FAILED is not an empty value.**
+ * A miss still merges onto `{}` — that is a real empty. A failure refuses the
+ * write and says so, leaving the stored blob untouched so the next successful
+ * write starts from the truth.
+ */
+/**
+ * Outcome of a settings read. `missing` and `failed` are deliberately distinct
+ * — collapsing them is the bug.
+ */
+export type SettingsRead = {
+    readonly kind: 'value';
+    readonly value: Record<string, unknown>;
+} | {
+    readonly kind: 'missing';
+} | {
+    readonly kind: 'failed';
+    readonly error: string;
+};
+export interface ReadModifyWriteInput {
+    readonly read: () => Promise<SettingsRead>;
+    readonly write: (next: Record<string, unknown>) => Promise<void>;
+    readonly patch: Record<string, unknown>;
+    /** Called instead of writing when the read failed — always log this. */
+    readonly onRefused: (error: string) => void;
+}
+/**
+ * Merge `patch` over the current value and write it — unless the read failed,
+ * in which case write NOTHING.
+ *
+ * Returns whether the write was attempted, so a caller can surface the refusal.
+ */
+export declare function readModifyWrite(input: ReadModifyWriteInput): Promise<boolean>;