camstack 1.2.143 → 1.2.145

package/dist/{launcher-3ULE3QVN.js → launcher-LICFWRGL.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-DdRxWA7g.js
-var require_dist_DdRxWA7g = __commonJS({
-  "../system/dist/dist-DdRxWA7g.js"(exports) {
+// ../system/dist/dist-B84YlKAH.js
+var require_dist_B84YlKAH = __commonJS({
+  "../system/dist/dist-B84YlKAH.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -25845,6 +25845,13 @@ var require_dist_DdRxWA7g = __commonJS({
       if (typeof err === "string") return err;
       return String(err);
     }
+    var EVENT_OWNER_TYPES = [
+      "motion",
+      "object",
+      "audio"
+    ];
+    var EventOwnerTypeSchema = zod.z.enum(EVENT_OWNER_TYPES);
+    new Set(EVENT_OWNER_TYPES);
     var VideoEncodeSchema = zod.z.object({
       codec: zod.z.enum([
         "h264",
@@ -30739,6 +30746,60 @@ var require_dist_DdRxWA7g = __commonJS({
           filter: QueryFilterSchema.optional(),
           columns: zod.z.array(zod.z.string()).readonly().optional()
         }), zod.z.array(SettingsRecordSchema).readonly()),
+        /**
+        * Make a SLOT hold this row — insert it, or update whatever already
+        * occupies the slot — and answer with the id the row HAS.
+        *
+        * ## Why the store needed this
+        *
+        * {@link set} is already an upsert, but its slot is the PRIMARY KEY: the
+        * caller has to know the id to address the row. That is exactly what a
+        * collection keyed by an `INTEGER` rowid alias cannot do — SQLite assigns
+        * the id, so a writer whose uniqueness rule is "one row per
+        * `(ownerKind, ownerId, kind, slot)`" has no id to name and no way to
+        * express the rule. {@link insert} can express it (a UNIQUE index
+        * arbitrates) but only by THROWING at the loser of a race, and the loser
+        * here is a legitimate re-capture, not an error.
+        *
+        * Getting there without this method means read-then-write: query the slot,
+        * then `insert` or `update`. Two statements instead of one, a race between
+        * them, and a recovery path that has to recognise a UNIQUE violation by its
+        * MESSAGE — across a process boundary, because the store lives behind an
+        * RPC door. A string match would be the whole gate, and a store that
+        * rephrased its error would lose the row silently. One statement has no
+        * such gate (D482).
+        *
+        * ## The contract
+        *
+        * `conflict` names the DECLARED columns that identify the slot. They must
+        * be covered by a UNIQUE index on the collection — SQLite resolves an
+        * `ON CONFLICT` target against its indexes and REFUSES the statement when
+        * none matches, so a wrong list is a loud error on the first write, never a
+        * silently duplicated row. An empty list is refused rather than passed on:
+        * `ON CONFLICT()` is not valid SQL, and the intent it would most likely
+        * encode ("no slot, just insert") is {@link insert}.
+        *
+        * Row shape is {@link insert}'s: `record.id` is used when the collection
+        * needs a supplied key and IGNORED when the primary key is an `INTEGER`
+        * rowid alias — exactly as `insert` and `insertMany` already treat it.
+        *
+        * Returns the id either way: the one SQLite assigned on an insert, or the
+        * one the row it updated already had. A caller cannot tell which happened,
+        * and deliberately — every caller wants the slot's id, and one that needed
+        * to distinguish creation from replacement would have to read first anyway.
+        */
+        upsert: method(zod.z.object({
+          namespace: zod.z.string().optional(),
+          collection: zod.z.string(),
+          /** Declared columns identifying the slot; must be covered by a UNIQUE
+          *  index on the collection. Never empty. */
+          conflict: zod.z.array(zod.z.string()).readonly(),
+          record: BulkRecordSchema
+        }), zod.z.object({
+          /** The id the row HAS: assigned by SQLite on an insert, or the existing
+          *  row's own id on an update. */
+          id: zod.z.union([zod.z.string(), zod.z.number()])
+        }), { kind: "mutation" }),
         /** Insert a new record. */
         insert: method(zod.z.object({
           namespace: zod.z.string().optional(),
@@ -30982,6 +31043,20 @@ var require_dist_DdRxWA7g = __commonJS({
           kind: "mutation",
           auth: "admin"
         }),
+        /**
+        * Make a slot hold this row, and answer with the id the row HAS. The
+        * engine half of `settings-store.upsert` — read that docblock for why the
+        * store needed a slot that is not the primary key (D482).
+        */
+        upsert: method(zod.z.object({
+          namespace: zod.z.string().optional(),
+          collection: zod.z.string(),
+          conflict: zod.z.array(zod.z.string()).readonly(),
+          record: BulkRecordSchema
+        }), zod.z.object({ id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
+          kind: "mutation",
+          auth: "admin"
+        }),
         /** Insert many records in ONE transaction. All or nothing. */
         insertMany: method(zod.z.object({
           namespace: zod.z.string().optional(),
@@ -37311,8 +37386,8 @@ var require_dist_DdRxWA7g = __commonJS({
     var TrackSnapshotSchema = zod.z.object({
       timestamp: zod.z.number(),
       position: TrackPositionSchema,
-      /** MediaStore key; resolve via `getTrackMedia({ trackId })`. */
-      mediaKey: zod.z.string()
+      /** The snapshot's media row id (D482); resolve via `listTrackMedia({ trackId })`. */
+      mediaId: zod.z.number().int()
     });
     var TrackEnvelopeSchema = zod.z.object({
       minX: zod.z.number(),
@@ -37751,14 +37826,14 @@ var require_dist_DdRxWA7g = __commonJS({
       *  pixel-space `bbox` onto a displayed image. Omitted in slim projection. */
       frameWidth: zod.z.number().optional(),
       frameHeight: zod.z.number().optional(),
-      /** MediaStore key for the crop attached to this event (if any). */
-      mediaKey: zod.z.string().optional(),
-      /** Design B: MediaStore key of the track's native-resolution key frame (the
+      /** Media row id of the crop attached to this event (if any) — D482. */
+      mediaId: zod.z.number().int().optional(),
+      /** Design B: media row id of the track's native-resolution key frame (the
       *  best-detection full frame). Resolve via the event-media data-plane
-      *  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`) for a detail view that
+      *  (`/addon/<addonId>/event-media/m/<keyFrameMediaId>`) for a detail view that
       *  draws `bbox` over the native frame. Absent on legacy rows / non-decoded
-      *  sources — consumers fall back to `mediaKey` (the tight crop). */
-      keyFrameMediaKey: zod.z.string().optional(),
+      *  sources — consumers fall back to `mediaId` (the tight crop). */
+      keyFrameMediaId: zod.z.number().int().optional(),
       /** Populated by B5 (recording playback URL for this event). */
       mediaUrl: zod.z.string().optional(),
       /** The parent track's key-event importance [0,1], propagated to every object
@@ -37795,7 +37870,19 @@ var require_dist_DdRxWA7g = __commonJS({
       "sceneFrame"
     ]);
     var MediaFileSchema = zod.z.object({
-      key: zod.z.string(),
+      /**
+      * The media row's OWN id — the rowid SQLite assigned it (D482).
+      *
+      * It used to be the row's composite key, `<ownerType>:<ownerId>:<fileKind>
+      * [:<timestampMs>]`, which embedded a FOREIGN id. D474 made event ids
+      * per-table rowid aliases, so `object:101314` and `motion:101314` are two
+      * different rows that spell the same number, and a track whose
+      * `bestEventId` was an object event was served a motion event's snapshot —
+      * a night-time thumbnail on an afternoon track, with no error anywhere. A
+      * surrogate id cannot name the wrong row's owner, because it names no owner
+      * at all.
+      */
+      mediaId: zod.z.number().int(),
       kind: MediaFileKindEnum,
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
@@ -37862,7 +37949,7 @@ var require_dist_DdRxWA7g = __commonJS({
       annotationCount: zod.z.number().int()
     });
     var RetrainFrameCandidateSchema = zod.z.object({
-      mediaKey: zod.z.string(),
+      mediaId: zod.z.number().int(),
       kind: MediaFileKindEnum,
       timestamp: zod.z.number(),
       sizeBytes: zod.z.number().int(),
@@ -37875,7 +37962,7 @@ var require_dist_DdRxWA7g = __commonJS({
       deviceId: zod.z.number(),
       trackId: zod.z.string(),
       /** Provenance only. It may already point at nothing — that is expected. */
-      sourceMediaKey: zod.z.string(),
+      sourceMediaId: zod.z.number().int(),
       sourceKind: MediaFileKindEnum,
       sizeBytes: zod.z.number().int(),
       width: zod.z.number().int(),
@@ -37890,7 +37977,7 @@ var require_dist_DdRxWA7g = __commonJS({
     var RetrainFrameSelectionSchema = zod.z.object({
       copied: zod.z.array(RetrainFrameSchema).readonly(),
       refused: zod.z.array(zod.z.object({
-        sourceMediaKey: zod.z.string(),
+        sourceMediaId: zod.z.number().int(),
         reason: RetrainCopyRefusalSchema
       })).readonly()
     });
@@ -37898,7 +37985,7 @@ var require_dist_DdRxWA7g = __commonJS({
       candidates: zod.z.array(RetrainFrameCandidateSchema).readonly(),
       copies: zod.z.array(RetrainFrameSchema).readonly(),
       /** What the page pre-selects — the native key frame when one survives. */
-      autoPickMediaKey: zod.z.string().optional()
+      autoPickMediaId: zod.z.number().int().optional()
     });
     var RetrainAssistSubjectSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
       kind: zod.z.literal("package"),
@@ -37991,7 +38078,7 @@ var require_dist_DdRxWA7g = __commonJS({
       lastActiveAt: zod.z.number(),
       sealedAt: zod.z.number().nullable(),
       memberCount: zod.z.number().int().nonnegative(),
-      groupShotKey: zod.z.string().nullable()
+      groupShotMediaId: zod.z.number().int().nullable()
     });
     var SummariesQueryInput = zod.z.object({
       deviceIds: zod.z.array(zod.z.number()).min(1),
@@ -38884,7 +38971,7 @@ var require_dist_DdRxWA7g = __commonJS({
         selectRetrainFrames: method(zod.z.object({
           deviceId: zod.z.number(),
           trackId: zod.z.string(),
-          mediaKeys: zod.z.array(zod.z.string()).min(1)
+          mediaIds: zod.z.array(zod.z.number().int()).min(1)
         }), RetrainFrameSelectionSchema, {
           kind: "mutation",
           auth: "admin"
@@ -39048,8 +39135,29 @@ var require_dist_DdRxWA7g = __commonJS({
           kind: "query",
           auth: "admin"
         }),
+        /**
+        * The media an EVENT owns.
+        *
+        * `ownerType` is REQUIRED, and that is the whole correction (D482). An
+        * event is a row in ONE of three tables, and since D474 each numbers from
+        * 1 independently: `motion:101314` and `object:101314` both exist. This
+        * method took a bare `eventId` and the provider probed motion → object →
+        * audio, stopping at the first hit — so on the live hub, where object
+        * events own no media of their own and 299 883 of 300 559 media rows are
+        * motion-owned, EVERY object event resolved to its motion namesake. A
+        * track from 17:34 on camera 615 was served a snapshot from 22:35 eleven
+        * days earlier, silently.
+        *
+        * D476 had already disambiguated the KEY (`motion:` vs `object:`); this is
+        * the API catching up to it. Naming the table is not a "qualification" of
+        * the ambiguity — a listing BY OWNER has no address to make surrogate: the
+        * owner IS (table, id), and half of it is not a question.
+        */
         getEventMedia: method(zod.z.object({
-          eventId: zod.z.string(),
+          /** Which of the three event tables owns the row. */
+          ownerType: EventOwnerTypeSchema,
+          /** The event's rowid in that table (D474: an event id is a number). */
+          eventId: zod.z.number().int(),
           kind: MediaFileKindEnum.optional(),
           deviceId: zod.z.number()
         }), zod.z.array(MediaFileSchema).readonly()),
@@ -39094,11 +39202,14 @@ var require_dist_DdRxWA7g = __commonJS({
         * the live hub: one event's `fullFrameBoxed` is 2 824 077 B, base64'd to
         * ~3.8 MB, allocated whole in hub-main's heap, for a list of keys.
         *
-        * Same `deviceId` authorization subject as `getEventMedia`, and the same
-        * rows — this is a projection of that method, never a different question.
+        * Same `deviceId` authorization subject as `getEventMedia`, the same
+        * REQUIRED `ownerType` (read that method's docblock for the night-time
+        * thumbnail this closes — D482), and the same rows: this is a projection
+        * of that method, never a different question.
         */
         listEventMedia: method(zod.z.object({
-          eventId: zod.z.string(),
+          ownerType: EventOwnerTypeSchema,
+          eventId: zod.z.number().int(),
           deviceId: zod.z.number()
         }), zod.z.array(MediaFileInfoSchema).readonly()),
         /**
@@ -44602,8 +44713,8 @@ var require_dist_DdRxWA7g = __commonJS({
       id: zod.z.string(),
       name: zod.z.string(),
       sampleCount: zod.z.number().int().nonnegative(),
-      coverMediaKey: zod.z.string().optional(),
-      /** Inline base64 of the cover sample's crop, resolved from `coverMediaKey`.
+      coverMediaId: zod.z.number().int().optional(),
+      /** Inline base64 of the cover sample's crop, resolved from `coverMediaId`.
       *  Lets the UI render the person's face avatar instead of a placeholder icon. */
       coverBase64: zod.z.string().optional()
     });
@@ -44619,8 +44730,8 @@ var require_dist_DdRxWA7g = __commonJS({
       enrolledAt: zod.z.number().int(),
       deviceId: zod.z.number().int().optional(),
       source: zod.z.enum(["detected", "photo"]),
-      /** The enrolled crop's media key, so the panel can show the evidence. */
-      mediaKey: zod.z.string().optional(),
+      /** The enrolled crop's media row id, so the panel can show the evidence. */
+      mediaId: zod.z.number().int().optional(),
       /**
       * False = the sample is stamped with a DIFFERENT face model, and a cosine
       * across feature spaces is a well-formed float with no meaning. Every number
@@ -44689,15 +44800,15 @@ var require_dist_DdRxWA7g = __commonJS({
       */
       cropUrl: zod.z.string().optional(),
       /** Design B: the face bbox (pixel space) on the key frame — lets a detail
-      *  view draw the box over the native `keyFrameMediaKey` frame. Absent on
+      *  view draw the box over the native `keyFrameMediaId` frame. Absent on
       *  legacy rows written before design B. */
       faceBbox: BoundingBoxSchema.optional(),
       /** Design B: MediaStore key of the track's native-resolution key frame.
       *  Fetch the native JPEG via the event-media data-plane
-      *  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`). Absent when the
+      *  (`/addon/<addonId>/event-media/m/<keyFrameMediaId>`). Absent when the
       *  track produced no key frame (e.g. native/onboard source) — the UI falls
       *  back to the inline `base64` face crop. */
-      keyFrameMediaKey: zod.z.string().optional(),
+      keyFrameMediaId: zod.z.number().int().optional(),
       /** Winning identity-match cosine (0..1) for this face's track, when an
       *  identity was auto-confirmed. Lets the UI surface WHY a face was assigned
       *  (confidence badge / low-confidence audit). Absent on legacy rows and on
@@ -44735,7 +44846,9 @@ var require_dist_DdRxWA7g = __commonJS({
       cohesion: zod.z.number()
     });
     var MediaFileLiteSchema$1 = zod.z.object({
-      key: zod.z.string(),
+      /** The media row's own id — the same address `MediaFileRef.mediaId` carries
+      *  (D482). It was the row's composite key, which embedded the owner. */
+      mediaId: zod.z.number().int(),
       kind: zod.z.string(),
       url: zod.z.string(),
       sizeBytes: zod.z.number(),
@@ -44757,7 +44870,7 @@ var require_dist_DdRxWA7g = __commonJS({
           * covers inline, ~10 KB of base64 per row, on a query this UI mounts
           * four times and the viewer holds at `staleTime: 30_000`.
           *
-          * Nothing loses its avatar: `coverMediaKey` is already on every row and
+          * Nothing loses its avatar: `coverMediaId` is already on every row and
           * the `event-media` plane serves that key `immutable` with an ETag.
           *
           * **This is an INPUT field, so it does not reach the addon until the
@@ -47885,8 +47998,8 @@ var require_dist_DdRxWA7g = __commonJS({
       id: zod.z.string(),
       name: zod.z.string(),
       sampleCount: zod.z.number().int().nonnegative(),
-      coverMediaKey: zod.z.string().optional(),
-      /** Inline base64 of the cover sample's plate crop, resolved from `coverMediaKey`. */
+      coverMediaId: zod.z.number().int().optional(),
+      /** Inline base64 of the cover sample's plate crop, resolved from `coverMediaId`. */
       coverBase64: zod.z.string().optional()
     });
     var VehicleSampleInfoSchema = zod.z.object({
@@ -47919,7 +48032,7 @@ var require_dist_DdRxWA7g = __commonJS({
       /** keyFrame parity: the plate bbox (pixel space) on the native key frame. */
       plateBbox: BoundingBoxSchema.optional(),
       /** keyFrame parity: MediaStore key of the track's native-resolution key frame. */
-      keyFrameMediaKey: zod.z.string().optional(),
+      keyFrameMediaId: zod.z.number().int().optional(),
       base64: zod.z.string().optional(),
       /**
       * Same crop as a data-plane URL, always present when the plate has a stored
@@ -47930,7 +48043,9 @@ var require_dist_DdRxWA7g = __commonJS({
       cropUrl: zod.z.string().optional()
     });
     var MediaFileLiteSchema = zod.z.object({
-      key: zod.z.string(),
+      /** The media row's own id — the same address `MediaFileRef.mediaId` carries
+      *  (D482). It was the row's composite key, which embedded the owner. */
+      mediaId: zod.z.number().int(),
       kind: zod.z.string(),
       url: zod.z.string(),
       sizeBytes: zod.z.number(),
@@ -48004,7 +48119,7 @@ var require_dist_DdRxWA7g = __commonJS({
         listVehicles: method(zod.z.object({
           /** Inline {@link VehicleSchema.coverBase64} on every row. Default
           *  `false` — the vehicle twin of `faceGallery.listIdentities`'s
-          *  option; `coverMediaKey` + the `event-media` plane carry the picture.
+          *  option; `coverMediaId` + the `event-media` plane carry the picture.
           *  INPUT field: stripped by the hub router until the train ships, which
           *  resolves to `false` and is exactly the intended default. */
           includeCrops: zod.z.boolean().optional()
@@ -49501,7 +49616,14 @@ var require_dist_DdRxWA7g = __commonJS({
       modelId: zod.z.string(),
       condition: SceneConditionSchema,
       capturedAt: zod.z.number(),
-      thumbnailMediaId: zod.z.string().optional(),
+      /**
+      * The reference thumbnail's media ROW id (D482).
+      *
+      * The name already said `mediaId` while the value was the row's composite
+      * key — a leftover that read as done and was not. It is the row's own id
+      * now, addressed at `/addon/<addonId>/event-media/m/<id>`.
+      */
+      thumbnailMediaId: zod.z.number().int().optional(),
       /** Whole-frame (downscaled) embedding captured alongside the ROI crop. The
       *  anti-view-shift anchor: a bumped camera, a PTZ preset or a re-aim makes the
       *  normalized rect frame a different piece of world, and the scene would
@@ -51423,7 +51545,7 @@ var require_dist_DdRxWA7g = __commonJS({
       /** Enrichment label carried from the source track (identity / plate). */
       label: zod.z.string().optional(),
       /** Native-resolution key-frame media key for the parked object's best image. */
-      keyFrameMediaKey: zod.z.string().optional()
+      keyFrameMediaId: zod.z.number().int().optional()
     });
     var CameraOccupancySnapshotSchema = zod.z.object({
       /** Frame timestamp of the inference result that produced this snapshot. */
@@ -53287,6 +53409,12 @@ var require_dist_DdRxWA7g = __commonJS({
         addonId: null,
         access: "create"
       },
+      "dataStoreProvider.upsert": {
+        capName: "data-store-provider",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "dayNight.getOptions": {
         capName: "day-night",
         capScope: "device",
@@ -57151,6 +57279,12 @@ var require_dist_DdRxWA7g = __commonJS({
         addonId: null,
         access: "create"
       },
+      "settingsStore.upsert": {
+        capName: "settings-store",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "smtpProvider.getStatus": {
         capName: "smtp-provider",
         capScope: "system",
@@ -61865,7 +61999,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_B84YlKAH();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -62684,7 +62818,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_B84YlKAH();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -62778,7 +62912,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_B84YlKAH();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -63675,11 +63809,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-C-jOWHI0.js
-var require_retired_settings_keys_C_jOWHI0 = __commonJS({
-  "../system/dist/retired-settings-keys-C-jOWHI0.js"(exports) {
+// ../system/dist/retired-settings-keys-Cxgwa0bk.js
+var require_retired_settings_keys_Cxgwa0bk = __commonJS({
+  "../system/dist/retired-settings-keys-Cxgwa0bk.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_B84YlKAH();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -65914,8 +66048,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
-    var require_retired_settings_keys = require_retired_settings_keys_C_jOWHI0();
+    var require_dist10 = require_dist_B84YlKAH();
+    var require_retired_settings_keys = require_retired_settings_keys_Cxgwa0bk();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -71540,7 +71674,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_B84YlKAH();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -71677,7 +71811,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_B84YlKAH();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -71873,7 +72007,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_B84YlKAH();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -79686,7 +79820,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_B84YlKAH();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -80273,7 +80407,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_B84YlKAH();
     var node_fs_promises = __require("fs/promises");
     var node_fs = __require("fs");
     node_fs = require_chunk.__toESM(node_fs);
@@ -83026,7 +83160,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_B84YlKAH();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -84253,8 +84387,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
-    var require_retired_settings_keys = require_retired_settings_keys_C_jOWHI0();
+    var require_dist10 = require_dist_B84YlKAH();
+    var require_retired_settings_keys = require_retired_settings_keys_Cxgwa0bk();
     var require_wal_checkpoint_policy = require_wal_checkpoint_policy_CCJZngds();
     var node_crypto = __require("crypto");
     var node_path = __require("path");
@@ -85082,6 +85216,54 @@ var require_sqlite_settings_addon = __commonJS({
         return { id: suppliedOrMinted ?? Number(rowid) };
       }
       /**
+      * Make a SLOT hold this row, and answer with the id the row HAS — one
+      * statement, `INSERT … ON CONFLICT(<slot>) DO UPDATE … RETURNING <pk>`.
+      *
+      * See `settings-store.cap.ts`'s `upsert` docblock for why the store needed a
+      * slot that is not the primary key (D482). Three things are load-bearing
+      * here:
+      *
+      *  - **`RETURNING` and not `lastInsertRowid`.** On the UPDATE branch
+      *    `lastInsertRowid` is whatever the connection last inserted — a
+      *    different row, or a different TABLE. It answers confidently and wrongly,
+      *    which is worse than not answering. `RETURNING` names the row this
+      *    statement actually touched, on both branches.
+      *  - **The conflict columns are checked against the declaration** before they
+      *    reach the SQL. An undeclared name would be interpolated into DDL-shaped
+      *    text; it is refused, by the same rule and for the same reason
+      *    {@link resolveProjection} throws on an unprojectable column.
+      *  - **The primary key is never part of the SET list.** An `INTEGER` rowid
+      *    alias is not in `row` at all, and on a TEXT key rewriting the id of the
+      *    row we just matched is the one update that cannot be right.
+      */
+      async upsert({ namespace, collection, conflict, record }) {
+        const scoped = this.scopedName(namespace, collection);
+        const decl = this.requireDeclared(scoped);
+        if (conflict.length === 0) throw new UnprojectableColumnError(`upsert on "${scoped}" was given an EMPTY conflict target \u2014 "ON CONFLICT()" is not valid SQL, and "no slot, just insert" is insert()`);
+        const unknownCols = conflict.filter((name) => !decl.columns.has(name) && name !== decl.primaryKey);
+        if (unknownCols.length > 0) throw new UnprojectableColumnError(`upsert on "${scoped}" names conflict column(s) the collection does not declare: ${unknownCols.join(", ")}`);
+        const suppliedOrMinted = decl.autoPrimaryKey ? null : record.id || (0, node_crypto.randomUUID)();
+        const row = decl.autoPrimaryKey ? {} : { [decl.primaryKey]: suppliedOrMinted };
+        if (decl.columns.size === 1 && decl.columns.has("data")) row["data"] = JSON.stringify(record.data);
+        else for (const [k, v] of Object.entries(record.data)) if (decl.columns.has(k)) row[k] = this.serializeColumnValue(v);
+        const keys = Object.keys(row);
+        const cols = keys.map((k) => `"${k}"`).join(", ");
+        const placeholders = keys.map(() => "?").join(", ");
+        const target = conflict.map((k) => `"${k}"`).join(", ");
+        const updates = keys.filter((k) => k !== decl.primaryKey && !conflict.includes(k)).map((k) => `"${k}" = excluded."${k}"`);
+        const sql = `INSERT INTO "${scoped}" (${cols}) VALUES (${placeholders}) ON CONFLICT(${target}) DO UPDATE SET ${updates.length > 0 ? updates.join(", ") : `"${conflict[0]}" = excluded."${conflict[0]}"`} RETURNING "${decl.primaryKey}"`;
+        const values = keys.map((k) => row[k] ?? null);
+        const id = this.measured({
+          op: "upsert",
+          collection: scoped,
+          sql,
+          params: values
+        }, () => this.getDb().prepare(sql).get(...values))?.[decl.primaryKey];
+        if (typeof id === "number" || typeof id === "bigint") return { id: Number(id) };
+        if (typeof id === "string") return { id };
+        throw new Error(`upsert on "${scoped}" returned no row \u2014 the ON CONFLICT target (${target}) resolved to no unique index, or the write was rejected`);
+      }
+      /**
       * Insert a batch in ONE transaction, on ONE prepared statement.
       *
       * The write-side twin of {@link deleteWhere}. Every row in the batch shares
@@ -86993,7 +87175,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_B84YlKAH();
     var require_hub_cap_forward = require_hub_cap_forward_DmHNjbB0();
     var zod = require_zod();
     var node_crypto = __require("crypto");
@@ -88030,6 +88212,7 @@ var require_storage_orchestrator_addon = __commonJS({
         set: async (input) => (await engine()).set(input),
         query: async (input) => (await engine()).query(input),
         insert: async (input) => (await engine()).insert(input),
+        upsert: async (input) => (await engine()).upsert(input),
         insertMany: async (input) => (await engine()).insertMany(input),
         update: async (input) => (await engine()).update(input),
         delete: async (input) => (await engine()).delete(input),
@@ -88177,6 +88360,7 @@ var require_storage_orchestrator_addon = __commonJS({
         set: (input) => send("set", input),
         query: (input) => send("query", input),
         insert: (input) => send("insert", input),
+        upsert: (input) => send("upsert", input),
         insertMany: (input) => send("insertMany", input),
         update: (input) => send("update", input),
         delete: (input) => send("delete", input),
@@ -90643,7 +90827,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_B84YlKAH();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -108704,7 +108888,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_B84YlKAH();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -110573,9 +110757,9 @@ ${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
   }
 });
 
-// ../types/dist/event-category-BNJ9EE5B.js
-var require_event_category_BNJ9EE5B = __commonJS({
-  "../types/dist/event-category-BNJ9EE5B.js"(exports) {
+// ../types/dist/event-category-yW4s1MGD.js
+var require_event_category_yW4s1MGD = __commonJS({
+  "../types/dist/event-category-yW4s1MGD.js"(exports) {
     "use strict";
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
       EventCategory2["SystemBoot"] = "system.boot";
@@ -110741,11 +110925,11 @@ var require_event_category_BNJ9EE5B = __commonJS({
   }
 });
 
-// ../types/dist/sleep-B1ZwxAhh.js
-var require_sleep_B1ZwxAhh = __commonJS({
-  "../types/dist/sleep-B1ZwxAhh.js"(exports) {
+// ../types/dist/sleep-CfDqEZrs.js
+var require_sleep_CfDqEZrs = __commonJS({
+  "../types/dist/sleep-CfDqEZrs.js"(exports) {
     "use strict";
-    var require_event_category = require_event_category_BNJ9EE5B();
+    var require_event_category = require_event_category_yW4s1MGD();
     var zod = require_zod();
     var AUDIO_CHUNK_FORMATS = [
       "f32le",
@@ -114575,8 +114759,8 @@ var require_addon = __commonJS({
   "../types/dist/addon.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_sleep = require_sleep_B1ZwxAhh();
-    var require_event_category = require_event_category_BNJ9EE5B();
+    var require_sleep = require_sleep_CfDqEZrs();
+    var require_event_category = require_event_category_yW4s1MGD();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -130964,11 +131148,11 @@ var require_manifest_system_deps_8x1jgPz = __commonJS({
   }
 });
 
-// ../system/dist/custom-action-registry-BTB-LgGN.js
-var require_custom_action_registry_BTB_LgGN = __commonJS({
-  "../system/dist/custom-action-registry-BTB-LgGN.js"(exports) {
+// ../system/dist/custom-action-registry-DwaSEiji.js
+var require_custom_action_registry_DwaSEiji = __commonJS({
+  "../system/dist/custom-action-registry-DwaSEiji.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_B84YlKAH();
     var CustomActionRegistry = class {
       byAddon = /* @__PURE__ */ new Map();
       registerAddon(addonId, catalog, handler) {
@@ -134782,7 +134966,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_B84YlKAH();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -134811,7 +134995,7 @@ var require_dist3 = __commonJS({
     var require_tls$1 = require_tls_BFs4PzoW();
     var require_manifest_system_deps = require_manifest_system_deps_8x1jgPz();
     var require_resource_monitor = require_resource_monitor_LVE1BoLs();
-    var require_custom_action_registry = require_custom_action_registry_BTB_LgGN();
+    var require_custom_action_registry = require_custom_action_registry_DwaSEiji();
     var zod = require_zod();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
@@ -215899,7 +216083,7 @@ var require_enums = __commonJS({
   "../types/dist/enums.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_event_category = require_event_category_BNJ9EE5B();
+    var require_event_category = require_event_category_yW4s1MGD();
     var EventSourceType = /* @__PURE__ */ (function(EventSourceType2) {
       EventSourceType2["Addon"] = "addon";
       EventSourceType2["Core"] = "core";
@@ -215919,8 +216103,8 @@ var require_dist4 = __commonJS({
   "../types/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_sleep = require_sleep_B1ZwxAhh();
-    var require_event_category = require_event_category_BNJ9EE5B();
+    var require_sleep = require_sleep_CfDqEZrs();
+    var require_event_category = require_event_category_yW4s1MGD();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -215935,18 +216119,19 @@ var require_dist4 = __commonJS({
       "scene",
       "motion",
       "object",
-      "audio"
+      "audio",
+      "mosaic"
     ];
     var OWNER_TYPES = new Set(MEDIA_OWNER_TYPES);
     var DIGITS = /^\d+$/;
-    function isOwnerType(value) {
+    function isMediaOwnerType(value) {
       return OWNER_TYPES.has(value);
     }
     function parseMediaOwnerKey(key) {
       const parts = key.split(":");
       if (parts.length !== 3 && parts.length !== 4) return null;
       const [ownerType, ownerId, fileKind, timestamp] = parts;
-      if (ownerType === void 0 || !isOwnerType(ownerType)) return null;
+      if (ownerType === void 0 || !isMediaOwnerType(ownerType)) return null;
       if (ownerId === void 0 || ownerId.length === 0) return null;
       if (fileKind === void 0 || fileKind.length === 0) return null;
       if (timestamp === void 0) return {
@@ -215971,6 +216156,7 @@ var require_dist4 = __commonJS({
       "object",
       "audio"
     ];
+    var EventOwnerTypeSchema = zod.z.enum(EVENT_OWNER_TYPES);
     var EVENT_OWNER_TYPE_SET = new Set(EVENT_OWNER_TYPES);
     function isEventOwnerType(ownerType) {
       return EVENT_OWNER_TYPE_SET.has(ownerType);
@@ -222875,6 +223061,60 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           filter: QueryFilterSchema.optional(),
           columns: zod.z.array(zod.z.string()).readonly().optional()
         }), zod.z.array(SettingsRecordSchema).readonly()),
+        /**
+        * Make a SLOT hold this row — insert it, or update whatever already
+        * occupies the slot — and answer with the id the row HAS.
+        *
+        * ## Why the store needed this
+        *
+        * {@link set} is already an upsert, but its slot is the PRIMARY KEY: the
+        * caller has to know the id to address the row. That is exactly what a
+        * collection keyed by an `INTEGER` rowid alias cannot do — SQLite assigns
+        * the id, so a writer whose uniqueness rule is "one row per
+        * `(ownerKind, ownerId, kind, slot)`" has no id to name and no way to
+        * express the rule. {@link insert} can express it (a UNIQUE index
+        * arbitrates) but only by THROWING at the loser of a race, and the loser
+        * here is a legitimate re-capture, not an error.
+        *
+        * Getting there without this method means read-then-write: query the slot,
+        * then `insert` or `update`. Two statements instead of one, a race between
+        * them, and a recovery path that has to recognise a UNIQUE violation by its
+        * MESSAGE — across a process boundary, because the store lives behind an
+        * RPC door. A string match would be the whole gate, and a store that
+        * rephrased its error would lose the row silently. One statement has no
+        * such gate (D482).
+        *
+        * ## The contract
+        *
+        * `conflict` names the DECLARED columns that identify the slot. They must
+        * be covered by a UNIQUE index on the collection — SQLite resolves an
+        * `ON CONFLICT` target against its indexes and REFUSES the statement when
+        * none matches, so a wrong list is a loud error on the first write, never a
+        * silently duplicated row. An empty list is refused rather than passed on:
+        * `ON CONFLICT()` is not valid SQL, and the intent it would most likely
+        * encode ("no slot, just insert") is {@link insert}.
+        *
+        * Row shape is {@link insert}'s: `record.id` is used when the collection
+        * needs a supplied key and IGNORED when the primary key is an `INTEGER`
+        * rowid alias — exactly as `insert` and `insertMany` already treat it.
+        *
+        * Returns the id either way: the one SQLite assigned on an insert, or the
+        * one the row it updated already had. A caller cannot tell which happened,
+        * and deliberately — every caller wants the slot's id, and one that needed
+        * to distinguish creation from replacement would have to read first anyway.
+        */
+        upsert: require_sleep.method(zod.z.object({
+          namespace: zod.z.string().optional(),
+          collection: zod.z.string(),
+          /** Declared columns identifying the slot; must be covered by a UNIQUE
+          *  index on the collection. Never empty. */
+          conflict: zod.z.array(zod.z.string()).readonly(),
+          record: BulkRecordSchema
+        }), zod.z.object({
+          /** The id the row HAS: assigned by SQLite on an insert, or the existing
+          *  row's own id on an update. */
+          id: zod.z.union([zod.z.string(), zod.z.number()])
+        }), { kind: "mutation" }),
         /** Insert a new record. */
         insert: require_sleep.method(zod.z.object({
           namespace: zod.z.string().optional(),
@@ -223118,6 +223358,20 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           kind: "mutation",
           auth: "admin"
         }),
+        /**
+        * Make a slot hold this row, and answer with the id the row HAS. The
+        * engine half of `settings-store.upsert` — read that docblock for why the
+        * store needed a slot that is not the primary key (D482).
+        */
+        upsert: require_sleep.method(zod.z.object({
+          namespace: zod.z.string().optional(),
+          collection: zod.z.string(),
+          conflict: zod.z.array(zod.z.string()).readonly(),
+          record: BulkRecordSchema
+        }), zod.z.object({ id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
+          kind: "mutation",
+          auth: "admin"
+        }),
         /** Insert many records in ONE transaction. All or nothing. */
         insertMany: require_sleep.method(zod.z.object({
           namespace: zod.z.string().optional(),
@@ -230347,8 +230601,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     var TrackSnapshotSchema = zod.z.object({
       timestamp: zod.z.number(),
       position: TrackPositionSchema,
-      /** MediaStore key; resolve via `getTrackMedia({ trackId })`. */
-      mediaKey: zod.z.string()
+      /** The snapshot's media row id (D482); resolve via `listTrackMedia({ trackId })`. */
+      mediaId: zod.z.number().int()
     });
     var TrackEnvelopeSchema = zod.z.object({
       minX: zod.z.number(),
@@ -230788,14 +231042,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       *  pixel-space `bbox` onto a displayed image. Omitted in slim projection. */
       frameWidth: zod.z.number().optional(),
       frameHeight: zod.z.number().optional(),
-      /** MediaStore key for the crop attached to this event (if any). */
-      mediaKey: zod.z.string().optional(),
-      /** Design B: MediaStore key of the track's native-resolution key frame (the
+      /** Media row id of the crop attached to this event (if any) — D482. */
+      mediaId: zod.z.number().int().optional(),
+      /** Design B: media row id of the track's native-resolution key frame (the
       *  best-detection full frame). Resolve via the event-media data-plane
-      *  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`) for a detail view that
+      *  (`/addon/<addonId>/event-media/m/<keyFrameMediaId>`) for a detail view that
       *  draws `bbox` over the native frame. Absent on legacy rows / non-decoded
-      *  sources — consumers fall back to `mediaKey` (the tight crop). */
-      keyFrameMediaKey: zod.z.string().optional(),
+      *  sources — consumers fall back to `mediaId` (the tight crop). */
+      keyFrameMediaId: zod.z.number().int().optional(),
       /** Populated by B5 (recording playback URL for this event). */
       mediaUrl: zod.z.string().optional(),
       /** The parent track's key-event importance [0,1], propagated to every object
@@ -230832,7 +231086,19 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "sceneFrame"
     ]);
     var MediaFileRefSchema = zod.z.object({
-      key: zod.z.string(),
+      /**
+      * The media row's OWN id — the rowid SQLite assigned it (D482).
+      *
+      * It used to be the row's composite key, `<ownerType>:<ownerId>:<fileKind>
+      * [:<timestampMs>]`, which embedded a FOREIGN id. D474 made event ids
+      * per-table rowid aliases, so `object:101314` and `motion:101314` are two
+      * different rows that spell the same number, and a track whose
+      * `bestEventId` was an object event was served a motion event's snapshot —
+      * a night-time thumbnail on an afternoon track, with no error anywhere. A
+      * surrogate id cannot name the wrong row's owner, because it names no owner
+      * at all.
+      */
+      mediaId: zod.z.number().int(),
       kind: MediaFileKindEnum,
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
@@ -230900,7 +231166,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       annotationCount: zod.z.number().int()
     });
     var RetrainFrameCandidateSchema = zod.z.object({
-      mediaKey: zod.z.string(),
+      mediaId: zod.z.number().int(),
       kind: MediaFileKindEnum,
       timestamp: zod.z.number(),
       sizeBytes: zod.z.number().int(),
@@ -230913,7 +231179,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       deviceId: zod.z.number(),
       trackId: zod.z.string(),
       /** Provenance only. It may already point at nothing — that is expected. */
-      sourceMediaKey: zod.z.string(),
+      sourceMediaId: zod.z.number().int(),
       sourceKind: MediaFileKindEnum,
       sizeBytes: zod.z.number().int(),
       width: zod.z.number().int(),
@@ -230928,7 +231194,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     var RetrainFrameSelectionSchema = zod.z.object({
       copied: zod.z.array(RetrainFrameSchema).readonly(),
       refused: zod.z.array(zod.z.object({
-        sourceMediaKey: zod.z.string(),
+        sourceMediaId: zod.z.number().int(),
         reason: RetrainCopyRefusalSchema
       })).readonly()
     });
@@ -230936,7 +231202,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       candidates: zod.z.array(RetrainFrameCandidateSchema).readonly(),
       copies: zod.z.array(RetrainFrameSchema).readonly(),
       /** What the page pre-selects — the native key frame when one survives. */
-      autoPickMediaKey: zod.z.string().optional()
+      autoPickMediaId: zod.z.number().int().optional()
     });
     var RetrainAssistSubjectSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
       kind: zod.z.literal("package"),
@@ -231029,7 +231295,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       lastActiveAt: zod.z.number(),
       sealedAt: zod.z.number().nullable(),
       memberCount: zod.z.number().int().nonnegative(),
-      groupShotKey: zod.z.string().nullable()
+      groupShotMediaId: zod.z.number().int().nullable()
     });
     var SUMMARIES_MAX_LIMIT = 200;
     var SUMMARIES_DEFAULT_LIMIT = 50;
@@ -231925,7 +232191,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         selectRetrainFrames: require_sleep.method(zod.z.object({
           deviceId: zod.z.number(),
           trackId: zod.z.string(),
-          mediaKeys: zod.z.array(zod.z.string()).min(1)
+          mediaIds: zod.z.array(zod.z.number().int()).min(1)
         }), RetrainFrameSelectionSchema, {
           kind: "mutation",
           auth: "admin"
@@ -232089,8 +232355,29 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           kind: "query",
           auth: "admin"
         }),
+        /**
+        * The media an EVENT owns.
+        *
+        * `ownerType` is REQUIRED, and that is the whole correction (D482). An
+        * event is a row in ONE of three tables, and since D474 each numbers from
+        * 1 independently: `motion:101314` and `object:101314` both exist. This
+        * method took a bare `eventId` and the provider probed motion → object →
+        * audio, stopping at the first hit — so on the live hub, where object
+        * events own no media of their own and 299 883 of 300 559 media rows are
+        * motion-owned, EVERY object event resolved to its motion namesake. A
+        * track from 17:34 on camera 615 was served a snapshot from 22:35 eleven
+        * days earlier, silently.
+        *
+        * D476 had already disambiguated the KEY (`motion:` vs `object:`); this is
+        * the API catching up to it. Naming the table is not a "qualification" of
+        * the ambiguity — a listing BY OWNER has no address to make surrogate: the
+        * owner IS (table, id), and half of it is not a question.
+        */
         getEventMedia: require_sleep.method(zod.z.object({
-          eventId: zod.z.string(),
+          /** Which of the three event tables owns the row. */
+          ownerType: EventOwnerTypeSchema,
+          /** The event's rowid in that table (D474: an event id is a number). */
+          eventId: zod.z.number().int(),
           kind: MediaFileKindEnum.optional(),
           deviceId: zod.z.number()
         }), zod.z.array(MediaFileSchema).readonly()),
@@ -232135,11 +232422,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * the live hub: one event's `fullFrameBoxed` is 2 824 077 B, base64'd to
         * ~3.8 MB, allocated whole in hub-main's heap, for a list of keys.
         *
-        * Same `deviceId` authorization subject as `getEventMedia`, and the same
-        * rows — this is a projection of that method, never a different question.
+        * Same `deviceId` authorization subject as `getEventMedia`, the same
+        * REQUIRED `ownerType` (read that method's docblock for the night-time
+        * thumbnail this closes — D482), and the same rows: this is a projection
+        * of that method, never a different question.
         */
         listEventMedia: require_sleep.method(zod.z.object({
-          eventId: zod.z.string(),
+          ownerType: EventOwnerTypeSchema,
+          eventId: zod.z.number().int(),
           deviceId: zod.z.number()
         }), zod.z.array(MediaFileInfoSchema).readonly()),
         /**
@@ -237840,8 +238130,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       id: zod.z.string(),
       name: zod.z.string(),
       sampleCount: zod.z.number().int().nonnegative(),
-      coverMediaKey: zod.z.string().optional(),
-      /** Inline base64 of the cover sample's crop, resolved from `coverMediaKey`.
+      coverMediaId: zod.z.number().int().optional(),
+      /** Inline base64 of the cover sample's crop, resolved from `coverMediaId`.
       *  Lets the UI render the person's face avatar instead of a placeholder icon. */
       coverBase64: zod.z.string().optional()
     });
@@ -237857,8 +238147,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       enrolledAt: zod.z.number().int(),
       deviceId: zod.z.number().int().optional(),
       source: zod.z.enum(["detected", "photo"]),
-      /** The enrolled crop's media key, so the panel can show the evidence. */
-      mediaKey: zod.z.string().optional(),
+      /** The enrolled crop's media row id, so the panel can show the evidence. */
+      mediaId: zod.z.number().int().optional(),
       /**
       * False = the sample is stamped with a DIFFERENT face model, and a cosine
       * across feature spaces is a well-formed float with no meaning. Every number
@@ -237927,15 +238217,15 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       */
       cropUrl: zod.z.string().optional(),
       /** Design B: the face bbox (pixel space) on the key frame — lets a detail
-      *  view draw the box over the native `keyFrameMediaKey` frame. Absent on
+      *  view draw the box over the native `keyFrameMediaId` frame. Absent on
       *  legacy rows written before design B. */
       faceBbox: BoundingBoxSchema.optional(),
       /** Design B: MediaStore key of the track's native-resolution key frame.
       *  Fetch the native JPEG via the event-media data-plane
-      *  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`). Absent when the
+      *  (`/addon/<addonId>/event-media/m/<keyFrameMediaId>`). Absent when the
       *  track produced no key frame (e.g. native/onboard source) — the UI falls
       *  back to the inline `base64` face crop. */
-      keyFrameMediaKey: zod.z.string().optional(),
+      keyFrameMediaId: zod.z.number().int().optional(),
       /** Winning identity-match cosine (0..1) for this face's track, when an
       *  identity was auto-confirmed. Lets the UI surface WHY a face was assigned
       *  (confidence badge / low-confidence audit). Absent on legacy rows and on
@@ -237973,7 +238263,9 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       cohesion: zod.z.number()
     });
     var MediaFileLiteSchema$1 = zod.z.object({
-      key: zod.z.string(),
+      /** The media row's own id — the same address `MediaFileRef.mediaId` carries
+      *  (D482). It was the row's composite key, which embedded the owner. */
+      mediaId: zod.z.number().int(),
       kind: zod.z.string(),
       url: zod.z.string(),
       sizeBytes: zod.z.number(),
@@ -237995,7 +238287,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           * covers inline, ~10 KB of base64 per row, on a query this UI mounts
           * four times and the viewer holds at `staleTime: 30_000`.
           *
-          * Nothing loses its avatar: `coverMediaKey` is already on every row and
+          * Nothing loses its avatar: `coverMediaId` is already on every row and
           * the `event-media` plane serves that key `immutable` with an ETag.
           *
           * **This is an INPUT field, so it does not reach the addon until the
@@ -241265,8 +241557,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       id: zod.z.string(),
       name: zod.z.string(),
       sampleCount: zod.z.number().int().nonnegative(),
-      coverMediaKey: zod.z.string().optional(),
-      /** Inline base64 of the cover sample's plate crop, resolved from `coverMediaKey`. */
+      coverMediaId: zod.z.number().int().optional(),
+      /** Inline base64 of the cover sample's plate crop, resolved from `coverMediaId`. */
       coverBase64: zod.z.string().optional()
     });
     var VehicleSampleInfoSchema = zod.z.object({
@@ -241299,7 +241591,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** keyFrame parity: the plate bbox (pixel space) on the native key frame. */
       plateBbox: BoundingBoxSchema.optional(),
       /** keyFrame parity: MediaStore key of the track's native-resolution key frame. */
-      keyFrameMediaKey: zod.z.string().optional(),
+      keyFrameMediaId: zod.z.number().int().optional(),
       base64: zod.z.string().optional(),
       /**
       * Same crop as a data-plane URL, always present when the plate has a stored
@@ -241310,7 +241602,9 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       cropUrl: zod.z.string().optional()
     });
     var MediaFileLiteSchema = zod.z.object({
-      key: zod.z.string(),
+      /** The media row's own id — the same address `MediaFileRef.mediaId` carries
+      *  (D482). It was the row's composite key, which embedded the owner. */
+      mediaId: zod.z.number().int(),
       kind: zod.z.string(),
       url: zod.z.string(),
       sizeBytes: zod.z.number(),
@@ -241384,7 +241678,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         listVehicles: require_sleep.method(zod.z.object({
           /** Inline {@link VehicleSchema.coverBase64} on every row. Default
           *  `false` — the vehicle twin of `faceGallery.listIdentities`'s
-          *  option; `coverMediaKey` + the `event-media` plane carry the picture.
+          *  option; `coverMediaId` + the `event-media` plane carry the picture.
           *  INPUT field: stripped by the hub router until the train ships, which
           *  resolves to `false` and is exactly the intended default. */
           includeCrops: zod.z.boolean().optional()
@@ -242897,7 +243191,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       modelId: zod.z.string(),
       condition: SceneConditionSchema,
       capturedAt: zod.z.number(),
-      thumbnailMediaId: zod.z.string().optional(),
+      /**
+      * The reference thumbnail's media ROW id (D482).
+      *
+      * The name already said `mediaId` while the value was the row's composite
+      * key — a leftover that read as done and was not. It is the row's own id
+      * now, addressed at `/addon/<addonId>/event-media/m/<id>`.
+      */
+      thumbnailMediaId: zod.z.number().int().optional(),
       /** Whole-frame (downscaled) embedding captured alongside the ROI crop. The
       *  anti-view-shift anchor: a bumped camera, a PTZ preset or a re-aim makes the
       *  normalized rect frame a different piece of world, and the scene would
@@ -244826,7 +245127,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** Enrichment label carried from the source track (identity / plate). */
       label: zod.z.string().optional(),
       /** Native-resolution key-frame media key for the parked object's best image. */
-      keyFrameMediaKey: zod.z.string().optional()
+      keyFrameMediaId: zod.z.number().int().optional()
     });
     var CameraOccupancySnapshotSchema = zod.z.object({
       /** Frame timestamp of the inference result that produced this snapshot. */
@@ -250039,6 +250340,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "dataStoreProvider.upsert": {
+        capName: "data-store-provider",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "dayNight.getOptions": {
         capName: "day-night",
         capScope: "device",
@@ -253903,6 +254210,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "settingsStore.upsert": {
+        capName: "settings-store",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "smtpProvider.getStatus": {
         capName: "smtp-provider",
         capScope: "system",
@@ -258420,6 +258733,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           get: (input) => dispatch("settingsStore", "get", "query", input),
           set: (input) => dispatch("settingsStore", "set", "mutation", input),
           query: (input) => dispatch("settingsStore", "query", "query", input),
+          upsert: (input) => dispatch("settingsStore", "upsert", "mutation", input),
           insert: (input) => dispatch("settingsStore", "insert", "mutation", input),
           insertMany: (input) => dispatch("settingsStore", "insertMany", "mutation", input),
           update: (input) => dispatch("settingsStore", "update", "mutation", input),
@@ -261567,6 +261881,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.EventMediaCoverageSchema = EventMediaCoverageSchema;
     exports.EventMediaKindSchema = EventMediaKindSchema;
     exports.EventMediaProductionSchema = EventMediaProductionSchema;
+    exports.EventOwnerTypeSchema = EventOwnerTypeSchema;
     exports.EventSourceType = require_enums2.EventSourceType$1;
     exports.ExportBytesSchema = ExportBytesSchema;
     exports.ExportDenseRangeSchema = ExportDenseRangeSchema;
@@ -262539,6 +262854,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.isFirstLevelMacroClass = isFirstLevelMacroClass;
     exports.isIsolatedBuiltin = isIsolatedBuiltin;
     exports.isLocationEnabled = isLocationEnabled;
+    exports.isMediaOwnerType = isMediaOwnerType;
     exports.isNode = isNode;
     exports.isObjectInput = isObjectInput;
     exports.isOccupancyRule = isOccupancyRule;
@@ -263394,6 +263710,7 @@ var require_server_root = __commonJS({
           devUploadsDir: /* @__PURE__ */ __name(() => devUploadsDir, "devUploadsDir"),
           emptyServerRootState: /* @__PURE__ */ __name(() => emptyServerRootState, "emptyServerRootState"),
           findMissingNativePrebuilds: /* @__PURE__ */ __name(() => findMissingNativePrebuilds, "findMissingNativePrebuilds"),
+          findUnappliedClosurePatches: /* @__PURE__ */ __name(() => findUnappliedClosurePatches, "findUnappliedClosurePatches"),
           isDevChannelVersion: /* @__PURE__ */ __name(() => isDevChannelVersion, "isDevChannelVersion"),
           isHostExternal: /* @__PURE__ */ __name(() => isHostExternal, "isHostExternal"),
           isServerRootState: /* @__PURE__ */ __name(() => isServerRootState, "isServerRootState"),
@@ -263798,6 +264115,58 @@ var require_server_root = __commonJS({
           return missing;
         }
         __name(findMissingNativePrebuilds, "findMissingNativePrebuilds");
+        var CLOSURE_PATCH_PAYLOAD = [
+          "node_modules",
+          "@camstack",
+          "server",
+          "dist",
+          "closure-patches"
+        ];
+        var CLOSURE_PATCH_MANIFEST = "patch-reach.json";
+        function fileContains(file, marker) {
+          try {
+            return fs3.readFileSync(file, "utf-8").includes(marker);
+          } catch {
+            return false;
+          }
+        }
+        __name(fileContains, "fileContains");
+        function findUnappliedClosurePatches(closureDir) {
+          const payloadDir = path3.join(closureDir, ...CLOSURE_PATCH_PAYLOAD);
+          let manifest;
+          try {
+            const raw = JSON.parse(fs3.readFileSync(path3.join(payloadDir, CLOSURE_PATCH_MANIFEST), "utf-8"));
+            if (typeof raw !== "object" || raw === null) return [];
+            manifest = raw;
+          } catch {
+            return [];
+          }
+          if (!Array.isArray(manifest.patches)) return [];
+          const nm = path3.join(closureDir, "node_modules");
+          const missing = [];
+          for (const raw of manifest.patches) {
+            if (raw.reach !== "closure-postinstall") continue;
+            const pkg = raw.package;
+            const markers = raw.markers;
+            if (typeof pkg !== "string" || typeof markers !== "object" || markers === null) continue;
+            const pkgDir = path3.join(nm, pkg);
+            if (!fs3.existsSync(pkgDir)) {
+              continue;
+            }
+            for (const [rel, list] of Object.entries(markers)) {
+              if (!Array.isArray(list)) continue;
+              const target = path3.join(pkgDir, ...rel.split("/"));
+              for (const marker of list) {
+                if (typeof marker !== "string") continue;
+                if (!fileContains(target, marker)) {
+                  missing.push(`${pkg}/${rel}: ${marker}`);
+                }
+              }
+            }
+          }
+          return missing;
+        }
+        __name(findUnappliedClosurePatches, "findUnappliedClosurePatches");
         function rmrf(target) {
           try {
             fs3.rmSync(target, {
@@ -264734,6 +265103,10 @@ var require_server_root = __commonJS({
               if (missingNatives.length > 0) {
                 throw new Error(`staged closure missing native prebuilds: ${missingNatives.join(", ")} \u2014 refusing to arm a swap that would break the forked runners`);
               }
+              const unpatched = findUnappliedClosurePatches(stagingDir);
+              if (unpatched.length > 0) {
+                throw new Error(`staged closure did not apply its shipped patches: ${unpatched.join(", ")} \u2014 refusing to arm a swap into an unpatched closure`);
+              }
               return stagingDir;
             } catch (err) {
               await fs6.promises.rm(stagingDir, {