camstack 1.2.65 → 1.2.67

package/dist/{chunk-OJ7OCZA6.js → chunk-MYPVHFJL.js}

@@ -14522,7 +14522,7 @@ function date4(params) {
 // ../../node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../types/dist/sleep-bm0x6zZF.mjs
+// ../types/dist/sleep-ot6dTHCA.mjs
 var WELL_KNOWN_TABS = [
   {
     id: "overview",
@@ -15772,6 +15772,21 @@ var RelocateJobSchema = external_exports.object({
   bytesMoved: external_exports.number().int(),
   /** Total files discovered up front; null while (or when) unknown. */
   filesTotal: external_exports.number().int().nullable(),
+  /**
+  * Rows this run CORRECTED while moving them — a durable mutation the move
+  * made that nobody asked for, so it is reported where the operator reads the
+  * job rather than only in a log line.
+  *
+  * A footage segment records its byte count in its own NAME, and the durable
+  * hour row derives its aggregates from those names. A file that does not
+  * match its name therefore makes the ledger's sums — and with them quota and
+  * pressure eviction — wrong by the difference, and only a rename can fix it.
+  * On 2026-08-30 one such row also stalled a 110 749-file drain permanently.
+  *
+  * Absent on lanes where the question has no meaning: a media blob's size is
+  * in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
+  */
+  rowsReconciled: external_exports.number().int().nonnegative().optional(),
   startedAt: external_exports.number(),
   finishedAt: external_exports.number().nullable(),
   error: external_exports.string().nullable()
@@ -15814,11 +15829,18 @@ var RelocateMediaInputSchema = external_exports.object({
   /** Omitted = `move`, the pre-existing behaviour. */
   mode: MediaRelocateModeSchema.optional()
 });
-var UnstampedEventMediaCountSchema = external_exports.object({
-  media: external_exports.number().int().nonnegative(),
-  retrainFrames: external_exports.number().int().nonnegative(),
-  total: external_exports.number().int().nonnegative()
+var UnstampedRowsSchema = external_exports.object({
+  present: external_exports.boolean(),
+  rows: external_exports.number().int().nonnegative().nullable()
 });
+var UnstampedEventMediaCountSchema = external_exports.object({
+  media: UnstampedRowsSchema,
+  retrainFrames: UnstampedRowsSchema,
+  /** True when EITHER collection holds one. The refusal reads this. */
+  anyPresent: external_exports.boolean(),
+  /** Sum across both, or `null` when either lane could not be counted. */
+  total: external_exports.number().int().nonnegative().nullable()
+}).nullable();
 var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: external_exports.string().min(1) });
 var StorageMigrationClassSchema = external_exports.enum([
   "recordings",
@@ -15865,6 +15887,10 @@ var StorageMigrationMoveProgressSchema = external_exports.object({
   /** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
   filesTotal: external_exports.number().int().nonnegative().nullable(),
   bytesMoved: external_exports.number().int().nonnegative(),
+  /** Rows the mover corrected while moving them — see `RelocateJob`. Absent on
+  *  a lane that cannot reconcile. A migration that silently rewrote durable
+  *  rows would be the same failure as one that silently skipped them. */
+  rowsReconciled: external_exports.number().int().nonnegative().optional(),
   /** The MOVER's start, not the migration's: a drain restarted after an addon
   *  crash gets a new mover, and a rate computed from the migration's start
   *  would silently average in the time nothing was running. */
@@ -20804,6 +20830,15 @@ var deviceManagerCapability = {
     * calls are sync. Bindings change rarely (only on wrapper toggle or
     * device add/remove) — clients invalidate via the
     * `capability.binding-changed` event.
+    *
+    * "A single round-trip" describes the CLIENT's side and used not to
+    * describe the server's: until 2026-08-30 the resolver read the persisted
+    * wrapper activations once per device, so answering this cost one
+    * settings-door RPC per device — 1 020 on the live 1 019-device hub, and
+    * it did not return in 240 s against `SystemMirror.init`'s 15 s budget.
+    * The server side is now two reads for the whole fleet. Anything PERIODIC
+    * still belongs on `getBindings` / `getBindingsBatch` (D12); this remains
+    * a warm seed.
     */
     getAllBindings: method(external_exports.object({}), external_exports.array(DeviceBindingsForDeviceSchema)),
     /**
@@ -21202,6 +21237,80 @@ var embeddingEncoderCapability = {
     getInfo: method(external_exports.void(), EmbeddingInfoSchema, { auth: "admin" })
   }
 };
+var FailureReasonCountSchema = external_exports.object({
+  /**
+  * Why the attempt did not land, in the contributor's own vocabulary —
+  * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
+  * strings that already appear in this repo's logs and, where one exists, the
+  * same string the per-track `previewMissReason` records (D276): a second
+  * vocabulary for the same loss would make the row and the counter
+  * un-joinable.
+  */
+  reason: external_exports.string(),
+  count: external_exports.number().int().nonnegative()
+});
+var FailureContributionSchema = external_exports.object({
+  /**
+  * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
+  * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
+  * `unit` free: the families are owned by different addons and a shared enum
+  * is a central list that rots invisibly.
+  */
+  family: external_exports.string(),
+  /**
+  * The NUMERIC device id — the same value every log line carries as
+  * `tags.deviceId`. Never nullable and never absent: a contributor that
+  * cannot name the camera must not emit the entry, because a fleet total
+  * cannot answer the only question anybody asks of this surface.
+  */
+  deviceId: external_exports.number().int().positive(),
+  /**
+  * A second dimension inside the family: the model / step id for an inference
+  * timeout, so "which camera AND which model" is one read. Absent when the
+  * family has a single variant.
+  */
+  variant: external_exports.string().optional(),
+  /**
+  * Epoch ms this counter started — the INCARNATION MARKER. A consumer
+  * differencing two reads must drop the interval when it changes, because the
+  * counter restarted from zero in a respawned runner. Same discipline as
+  * `LoadContribution.startedAtMs`.
+  */
+  sinceMs: external_exports.number(),
+  /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
+  atMs: external_exports.number(),
+  /**
+  * THE DENOMINATOR — every attempt on this path for this camera in the
+  * window. A failure count published without it is the mistake this schema
+  * exists to make impossible.
+  */
+  attempts: external_exports.number().int().nonnegative(),
+  /** Attempts that landed. `attempts - succeeded` is the loss. */
+  succeeded: external_exports.number().int().nonnegative(),
+  /** The loss, partitioned. Sums to `attempts - succeeded`. */
+  reasons: external_exports.array(FailureReasonCountSchema).readonly()
+});
+var failureContributionCapability = {
+  name: "failure-contribution",
+  scope: "system",
+  mode: "collection",
+  internal: true,
+  methods: {
+    /**
+    * This addon's per-camera failure counters, read live from bounded in-RAM
+    * state it already keeps. Inert: no persistence, no sampling, no timer.
+    *
+    * READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
+    * consumer that wants a rate differences two reads. A draining read would
+    * make two operators with the page open each destroy half of the other's
+    * numbers, and `load-contribution` already settled the same question the
+    * same way for `cpuSeconds`.
+    */
+    list: method(external_exports.void(), external_exports.array(FailureContributionSchema).readonly())
+  },
+  /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+  mount: { kind: "skip" }
+};
 var DirEntrySchema = external_exports.object({
   name: external_exports.string(),
   path: external_exports.string()
@@ -21740,145 +21849,6 @@ var llmCapability = {
     })
   }
 };
-var LogChannelApplyResultSchema = external_exports.object({
-  /** How many declared channels are armed in this process after the call. */
-  armed: external_exports.number().int().min(0),
-  /**
-  * Names the document armed that this process does not declare. Reported
-  * rather than swallowed: a name here is either a typo or an addon that has
-  * not booted, and both deserve a line instead of silence.
-  */
-  unknown: external_exports.array(external_exports.string()).readonly()
-});
-var logChannelsCapability = {
-  name: "log-channels",
-  scope: "system",
-  mode: "collection",
-  internal: true,
-  methods: {
-    /** The channels this addon declares. Inert: no value, no state. */
-    list: method(external_exports.void(), external_exports.array(LogChannelDescriptorSchema).readonly()),
-    /**
-    * Refresh this process's mirror from the document's FULL set of armed
-    * windows.
-    *
-    * Full and not incremental on purpose: the document is the authority, so a
-    * channel it does not name is disarmed here. An incremental apply would
-    * let a disarm get lost in transit and leave a channel running that
-    * nobody can see is running.
-    */
-    apply: method(external_exports.object({ windows: external_exports.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
-  },
-  /** In-process only — enumerated through `addons.listCapabilityProviders`. */
-  mount: { kind: "skip" }
-};
-var LogLevelSchema = external_exports.enum([
-  "debug",
-  "info",
-  "warn",
-  "error"
-]);
-var LogEntrySchema = external_exports.object({
-  timestamp: external_exports.date(),
-  level: LogLevelSchema,
-  scope: external_exports.array(external_exports.string()),
-  message: external_exports.string(),
-  meta: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-  tags: external_exports.record(external_exports.string(), external_exports.string()).optional()
-});
-var logDestinationCapability = {
-  name: "log-destination",
-  scope: "system",
-  mode: "collection",
-  internal: true,
-  methods: {
-    write: method(LogEntrySchema, external_exports.void(), { kind: "mutation" }),
-    query: method(external_exports.object({
-      scope: external_exports.array(external_exports.string()).optional(),
-      level: LogLevelSchema.optional(),
-      since: external_exports.date().optional(),
-      until: external_exports.date().optional(),
-      limit: external_exports.number().optional(),
-      tags: external_exports.record(external_exports.string(), external_exports.string()).optional()
-    }), external_exports.array(LogEntrySchema).readonly())
-  },
-  /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
-  mount: { kind: "skip" }
-};
-var FailureReasonCountSchema = external_exports.object({
-  /**
-  * Why the attempt did not land, in the contributor's own vocabulary —
-  * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
-  * strings that already appear in this repo's logs and, where one exists, the
-  * same string the per-track `previewMissReason` records (D276): a second
-  * vocabulary for the same loss would make the row and the counter
-  * un-joinable.
-  */
-  reason: external_exports.string(),
-  count: external_exports.number().int().nonnegative()
-});
-var FailureContributionSchema = external_exports.object({
-  /**
-  * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
-  * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
-  * `unit` free: the families are owned by different addons and a shared enum
-  * is a central list that rots invisibly.
-  */
-  family: external_exports.string(),
-  /**
-  * The NUMERIC device id — the same value every log line carries as
-  * `tags.deviceId`. Never nullable and never absent: a contributor that
-  * cannot name the camera must not emit the entry, because a fleet total
-  * cannot answer the only question anybody asks of this surface.
-  */
-  deviceId: external_exports.number().int().positive(),
-  /**
-  * A second dimension inside the family: the model / step id for an inference
-  * timeout, so "which camera AND which model" is one read. Absent when the
-  * family has a single variant.
-  */
-  variant: external_exports.string().optional(),
-  /**
-  * Epoch ms this counter started — the INCARNATION MARKER. A consumer
-  * differencing two reads must drop the interval when it changes, because the
-  * counter restarted from zero in a respawned runner. Same discipline as
-  * `LoadContribution.startedAtMs`.
-  */
-  sinceMs: external_exports.number(),
-  /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
-  atMs: external_exports.number(),
-  /**
-  * THE DENOMINATOR — every attempt on this path for this camera in the
-  * window. A failure count published without it is the mistake this schema
-  * exists to make impossible.
-  */
-  attempts: external_exports.number().int().nonnegative(),
-  /** Attempts that landed. `attempts - succeeded` is the loss. */
-  succeeded: external_exports.number().int().nonnegative(),
-  /** The loss, partitioned. Sums to `attempts - succeeded`. */
-  reasons: external_exports.array(FailureReasonCountSchema).readonly()
-});
-var failureContributionCapability = {
-  name: "failure-contribution",
-  scope: "system",
-  mode: "collection",
-  internal: true,
-  methods: {
-    /**
-    * This addon's per-camera failure counters, read live from bounded in-RAM
-    * state it already keeps. Inert: no persistence, no sampling, no timer.
-    *
-    * READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
-    * consumer that wants a rate differences two reads. A draining read would
-    * make two operators with the page open each destroy half of the other's
-    * numbers, and `load-contribution` already settled the same question the
-    * same way for `cpuSeconds`.
-    */
-    list: method(external_exports.void(), external_exports.array(FailureContributionSchema).readonly())
-  },
-  /** In-process only — enumerated through `addons.listCapabilityProviders`. */
-  mount: { kind: "skip" }
-};
 var LOAD_CONTRIBUTION_ROLES = [
   "decode",
   "transcode",
@@ -21958,6 +21928,71 @@ var loadContributionCapability = {
   /** In-process only — enumerated through `addons.listCapabilityProviders`. */
   mount: { kind: "skip" }
 };
+var LogChannelApplyResultSchema = external_exports.object({
+  /** How many declared channels are armed in this process after the call. */
+  armed: external_exports.number().int().min(0),
+  /**
+  * Names the document armed that this process does not declare. Reported
+  * rather than swallowed: a name here is either a typo or an addon that has
+  * not booted, and both deserve a line instead of silence.
+  */
+  unknown: external_exports.array(external_exports.string()).readonly()
+});
+var logChannelsCapability = {
+  name: "log-channels",
+  scope: "system",
+  mode: "collection",
+  internal: true,
+  methods: {
+    /** The channels this addon declares. Inert: no value, no state. */
+    list: method(external_exports.void(), external_exports.array(LogChannelDescriptorSchema).readonly()),
+    /**
+    * Refresh this process's mirror from the document's FULL set of armed
+    * windows.
+    *
+    * Full and not incremental on purpose: the document is the authority, so a
+    * channel it does not name is disarmed here. An incremental apply would
+    * let a disarm get lost in transit and leave a channel running that
+    * nobody can see is running.
+    */
+    apply: method(external_exports.object({ windows: external_exports.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
+  },
+  /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+  mount: { kind: "skip" }
+};
+var LogLevelSchema = external_exports.enum([
+  "debug",
+  "info",
+  "warn",
+  "error"
+]);
+var LogEntrySchema = external_exports.object({
+  timestamp: external_exports.date(),
+  level: LogLevelSchema,
+  scope: external_exports.array(external_exports.string()),
+  message: external_exports.string(),
+  meta: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  tags: external_exports.record(external_exports.string(), external_exports.string()).optional()
+});
+var logDestinationCapability = {
+  name: "log-destination",
+  scope: "system",
+  mode: "collection",
+  internal: true,
+  methods: {
+    write: method(LogEntrySchema, external_exports.void(), { kind: "mutation" }),
+    query: method(external_exports.object({
+      scope: external_exports.array(external_exports.string()).optional(),
+      level: LogLevelSchema.optional(),
+      since: external_exports.date().optional(),
+      until: external_exports.date().optional(),
+      limit: external_exports.number().optional(),
+      tags: external_exports.record(external_exports.string(), external_exports.string()).optional()
+    }), external_exports.array(LogEntrySchema).readonly())
+  },
+  /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+  mount: { kind: "skip" }
+};
 var LoginStageEnum = external_exports.enum(["primary", "second-factor"]);
 var RedirectLoginMethodSchema = external_exports.object({
   kind: external_exports.literal("redirect"),
@@ -26046,13 +26081,18 @@ var MediaFileKindEnum = external_exports.enum([
   "keyFrameSmall",
   "thumbnailSmall"
 ]);
-var MediaFileSchema = external_exports.object({
+var MediaFileRefSchema = external_exports.object({
   key: external_exports.string(),
   kind: MediaFileKindEnum,
-  base64: external_exports.string(),
   sizeBytes: external_exports.number(),
   timestamp: external_exports.number()
 });
+var MediaFileSchema = MediaFileRefSchema.extend({
+  /** `/addon/<addonId>/event-media/<encoded stored key>`. Always present. */
+  url: external_exports.string(),
+  /** @deprecated Transitional — see the schema docblock. Use {@link url}. */
+  base64: external_exports.string()
+});
 var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
 var RetrainMacroClassSchema = external_exports.enum([
   "person",
@@ -26784,6 +26824,17 @@ var pipelineAnalyticsCapability = {
     * happens to stamp it. This count is what the migration planner's
     * non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
     * it to zero.
+    *
+    * TWO indexed statements per collection, not a walk. It used to page the
+    * whole collection at 200 rows per RPC ordered by an unindexed column, so
+    * on the live hub — 1 254 576 rows — it hit the 60 s RPC deadline every
+    * time it was called, and the migration it gates could never start. The
+    * cheap question (`present`: is there at least one) is asked first and
+    * separately from the expensive one (`rows`), because only the first has
+    * to be answerable for the gate to do its job.
+    *
+    * **`null` is "not measurable", never zero** — at either level. An
+    * unreadable collection must not read as a sealed one.
     */
     countUnstampedEventMedia: method(external_exports.object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
     /**
@@ -27107,6 +27158,26 @@ var pipelineAnalyticsCapability = {
       deviceId: external_exports.number()
     }), external_exports.array(MediaFileInfoSchema).readonly()),
     /**
+    * What media an EVENT has, without any of it — the twin `getEventMedia`
+    * never had.
+    *
+    * `listTrackMedia` above got this treatment because a track's media is
+    * 5-8 MB. An event's is worse per row, not better: an old-style event owns
+    * a `crop` AND a native-resolution `fullFrameBoxed`, and the track DETAIL
+    * modal — the one surface that legitimately shows the big kinds — unions
+    * both listings to build its filmstrip. It then renders every tile from
+    * the `event-media` plane by key and throws the bytes away. Measured on
+    * the live hub: one event's `fullFrameBoxed` is 2 824 077 B, base64'd to
+    * ~3.8 MB, allocated whole in hub-main's heap, for a list of keys.
+    *
+    * Same `deviceId` authorization subject as `getEventMedia`, and the same
+    * rows — this is a projection of that method, never a different question.
+    */
+    listEventMedia: method(external_exports.object({
+      eventId: external_exports.string(),
+      deviceId: external_exports.number()
+    }), external_exports.array(MediaFileInfoSchema).readonly()),
+    /**
     * Search object events by text query using CLIP cosine similarity.
     * Encodes `text` via the `embedding-encoder` cap, queries the
     * `ObjectEmbeddingStore` with optional prefilters, ranks all matching
@@ -32547,7 +32618,7 @@ var FaceClusterSchema = external_exports.object({
 var MediaFileLiteSchema$1 = external_exports.object({
   key: external_exports.string(),
   kind: external_exports.string(),
-  base64: external_exports.string(),
+  url: external_exports.string(),
   sizeBytes: external_exports.number(),
   timestamp: external_exports.number()
 });
@@ -35440,7 +35511,7 @@ var PlateInfoSchema = external_exports.object({
 var MediaFileLiteSchema = external_exports.object({
   key: external_exports.string(),
   kind: external_exports.string(),
-  base64: external_exports.string(),
+  url: external_exports.string(),
   sizeBytes: external_exports.number(),
   timestamp: external_exports.number()
 });
@@ -41982,6 +42053,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "pipelineAnalytics.listEventMedia": {
+    capName: "pipeline-analytics",
+    capScope: "device",
+    addonId: null,
+    access: "view"
+  },
   "pipelineAnalytics.listGroups": {
     capName: "pipeline-analytics",
     capScope: "device",
@@ -45605,6 +45682,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
     form: "array",
     optional: false
   }],
+  "pipelineAnalytics.listEventMedia": [{
+    name: "deviceId",
+    form: "single",
+    optional: false
+  }],
   "pipelineAnalytics.listGroups": [{
     name: "deviceIds",
     form: "array",

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runDiscover
-} from "./chunk-OJ7OCZA6.js";
+} from "./chunk-MYPVHFJL.js";
 import "./chunk-LMMQX4CK.js";
 
 // src/cli.ts
@@ -38,7 +38,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-3XCU3XJF.js");
+  await import("./launcher-5FCVBL5M.js");
 }
 
 // src/commands/agent.ts
@@ -83,7 +83,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-3XCU3XJF.js");
+  await import("./launcher-5FCVBL5M.js");
 }
 
 // src/commands/setup.ts
@@ -1130,7 +1130,7 @@ function isUnknown(_value) {
   return true;
 }
 async function resolveServerInteractive(presetNamespace) {
-  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-GAZVSA4I.js");
+  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-PJINOUDH.js");
   if (presetNamespace) {
     const spinner4 = clack.spinner();
     spinner4.start(`Discovering hub on LAN (namespace "${presetNamespace}")`);

package/dist/{discover-GAZVSA4I.js → discover-PJINOUDH.js}

@@ -5,7 +5,7 @@ import {
   filterHubNodes,
   resolveHubFromDiscovered,
   runDiscover
-} from "./chunk-OJ7OCZA6.js";
+} from "./chunk-MYPVHFJL.js";
 import "./chunk-LMMQX4CK.js";
 export {
   DEFAULT_HUB_HTTPS_PORT,