camstack 1.2.66 → 1.2.67

package/dist/{launcher-EJVL74UN.js → launcher-5FCVBL5M.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-CcvXUhHK.js
-var require_dist_CcvXUhHK = __commonJS({
-  "../system/dist/dist-CcvXUhHK.js"(exports) {
+// ../system/dist/dist-Keu5TDO7.js
+var require_dist_Keu5TDO7 = __commonJS({
+  "../system/dist/dist-Keu5TDO7.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -31940,6 +31940,80 @@ var require_dist_CcvXUhHK = __commonJS({
         getInfo: method(zod.z.void(), EmbeddingInfoSchema, { auth: "admin" })
       }
     };
+    var FailureReasonCountSchema = zod.z.object({
+      /**
+      * Why the attempt did not land, in the contributor's own vocabulary —
+      * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
+      * strings that already appear in this repo's logs and, where one exists, the
+      * same string the per-track `previewMissReason` records (D276): a second
+      * vocabulary for the same loss would make the row and the counter
+      * un-joinable.
+      */
+      reason: zod.z.string(),
+      count: zod.z.number().int().nonnegative()
+    });
+    var FailureContributionSchema = zod.z.object({
+      /**
+      * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
+      * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
+      * `unit` free: the families are owned by different addons and a shared enum
+      * is a central list that rots invisibly.
+      */
+      family: zod.z.string(),
+      /**
+      * The NUMERIC device id — the same value every log line carries as
+      * `tags.deviceId`. Never nullable and never absent: a contributor that
+      * cannot name the camera must not emit the entry, because a fleet total
+      * cannot answer the only question anybody asks of this surface.
+      */
+      deviceId: zod.z.number().int().positive(),
+      /**
+      * A second dimension inside the family: the model / step id for an inference
+      * timeout, so "which camera AND which model" is one read. Absent when the
+      * family has a single variant.
+      */
+      variant: zod.z.string().optional(),
+      /**
+      * Epoch ms this counter started — the INCARNATION MARKER. A consumer
+      * differencing two reads must drop the interval when it changes, because the
+      * counter restarted from zero in a respawned runner. Same discipline as
+      * `LoadContribution.startedAtMs`.
+      */
+      sinceMs: zod.z.number(),
+      /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
+      atMs: zod.z.number(),
+      /**
+      * THE DENOMINATOR — every attempt on this path for this camera in the
+      * window. A failure count published without it is the mistake this schema
+      * exists to make impossible.
+      */
+      attempts: zod.z.number().int().nonnegative(),
+      /** Attempts that landed. `attempts - succeeded` is the loss. */
+      succeeded: zod.z.number().int().nonnegative(),
+      /** The loss, partitioned. Sums to `attempts - succeeded`. */
+      reasons: zod.z.array(FailureReasonCountSchema).readonly()
+    });
+    var failureContributionCapability = {
+      name: "failure-contribution",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        /**
+        * This addon's per-camera failure counters, read live from bounded in-RAM
+        * state it already keeps. Inert: no persistence, no sampling, no timer.
+        *
+        * READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
+        * consumer that wants a rate differences two reads. A draining read would
+        * make two operators with the page open each destroy half of the other's
+        * numbers, and `load-contribution` already settled the same question the
+        * same way for `cpuSeconds`.
+        */
+        list: method(zod.z.void(), zod.z.array(FailureContributionSchema).readonly())
+      },
+      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+      mount: { kind: "skip" }
+    };
     var DirEntrySchema = zod.z.object({
       name: zod.z.string(),
       path: zod.z.string()
@@ -32477,145 +32551,6 @@ var require_dist_CcvXUhHK = __commonJS({
         })
       }
     };
-    var LogChannelApplyResultSchema = zod.z.object({
-      /** How many declared channels are armed in this process after the call. */
-      armed: zod.z.number().int().min(0),
-      /**
-      * Names the document armed that this process does not declare. Reported
-      * rather than swallowed: a name here is either a typo or an addon that has
-      * not booted, and both deserve a line instead of silence.
-      */
-      unknown: zod.z.array(zod.z.string()).readonly()
-    });
-    var logChannelsCapability = {
-      name: "log-channels",
-      scope: "system",
-      mode: "collection",
-      internal: true,
-      methods: {
-        /** The channels this addon declares. Inert: no value, no state. */
-        list: method(zod.z.void(), zod.z.array(LogChannelDescriptorSchema).readonly()),
-        /**
-        * Refresh this process's mirror from the document's FULL set of armed
-        * windows.
-        *
-        * Full and not incremental on purpose: the document is the authority, so a
-        * channel it does not name is disarmed here. An incremental apply would
-        * let a disarm get lost in transit and leave a channel running that
-        * nobody can see is running.
-        */
-        apply: method(zod.z.object({ windows: zod.z.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
-      },
-      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
-      mount: { kind: "skip" }
-    };
-    var LogLevelSchema = zod.z.enum([
-      "debug",
-      "info",
-      "warn",
-      "error"
-    ]);
-    var LogEntrySchema = zod.z.object({
-      timestamp: zod.z.date(),
-      level: LogLevelSchema,
-      scope: zod.z.array(zod.z.string()),
-      message: zod.z.string(),
-      meta: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-      tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
-    });
-    var logDestinationCapability = {
-      name: "log-destination",
-      scope: "system",
-      mode: "collection",
-      internal: true,
-      methods: {
-        write: method(LogEntrySchema, zod.z.void(), { kind: "mutation" }),
-        query: method(zod.z.object({
-          scope: zod.z.array(zod.z.string()).optional(),
-          level: LogLevelSchema.optional(),
-          since: zod.z.date().optional(),
-          until: zod.z.date().optional(),
-          limit: zod.z.number().optional(),
-          tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
-        }), zod.z.array(LogEntrySchema).readonly())
-      },
-      /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
-      mount: { kind: "skip" }
-    };
-    var FailureReasonCountSchema = zod.z.object({
-      /**
-      * Why the attempt did not land, in the contributor's own vocabulary —
-      * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
-      * strings that already appear in this repo's logs and, where one exists, the
-      * same string the per-track `previewMissReason` records (D276): a second
-      * vocabulary for the same loss would make the row and the counter
-      * un-joinable.
-      */
-      reason: zod.z.string(),
-      count: zod.z.number().int().nonnegative()
-    });
-    var FailureContributionSchema = zod.z.object({
-      /**
-      * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
-      * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
-      * `unit` free: the families are owned by different addons and a shared enum
-      * is a central list that rots invisibly.
-      */
-      family: zod.z.string(),
-      /**
-      * The NUMERIC device id — the same value every log line carries as
-      * `tags.deviceId`. Never nullable and never absent: a contributor that
-      * cannot name the camera must not emit the entry, because a fleet total
-      * cannot answer the only question anybody asks of this surface.
-      */
-      deviceId: zod.z.number().int().positive(),
-      /**
-      * A second dimension inside the family: the model / step id for an inference
-      * timeout, so "which camera AND which model" is one read. Absent when the
-      * family has a single variant.
-      */
-      variant: zod.z.string().optional(),
-      /**
-      * Epoch ms this counter started — the INCARNATION MARKER. A consumer
-      * differencing two reads must drop the interval when it changes, because the
-      * counter restarted from zero in a respawned runner. Same discipline as
-      * `LoadContribution.startedAtMs`.
-      */
-      sinceMs: zod.z.number(),
-      /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
-      atMs: zod.z.number(),
-      /**
-      * THE DENOMINATOR — every attempt on this path for this camera in the
-      * window. A failure count published without it is the mistake this schema
-      * exists to make impossible.
-      */
-      attempts: zod.z.number().int().nonnegative(),
-      /** Attempts that landed. `attempts - succeeded` is the loss. */
-      succeeded: zod.z.number().int().nonnegative(),
-      /** The loss, partitioned. Sums to `attempts - succeeded`. */
-      reasons: zod.z.array(FailureReasonCountSchema).readonly()
-    });
-    var failureContributionCapability = {
-      name: "failure-contribution",
-      scope: "system",
-      mode: "collection",
-      internal: true,
-      methods: {
-        /**
-        * This addon's per-camera failure counters, read live from bounded in-RAM
-        * state it already keeps. Inert: no persistence, no sampling, no timer.
-        *
-        * READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
-        * consumer that wants a rate differences two reads. A draining read would
-        * make two operators with the page open each destroy half of the other's
-        * numbers, and `load-contribution` already settled the same question the
-        * same way for `cpuSeconds`.
-        */
-        list: method(zod.z.void(), zod.z.array(FailureContributionSchema).readonly())
-      },
-      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
-      mount: { kind: "skip" }
-    };
     var LoadContributionSchema = zod.z.object({
       role: zod.z.enum([
         "decode",
@@ -32693,6 +32628,71 @@ var require_dist_CcvXUhHK = __commonJS({
       /** In-process only — enumerated through `addons.listCapabilityProviders`. */
       mount: { kind: "skip" }
     };
+    var LogChannelApplyResultSchema = zod.z.object({
+      /** How many declared channels are armed in this process after the call. */
+      armed: zod.z.number().int().min(0),
+      /**
+      * Names the document armed that this process does not declare. Reported
+      * rather than swallowed: a name here is either a typo or an addon that has
+      * not booted, and both deserve a line instead of silence.
+      */
+      unknown: zod.z.array(zod.z.string()).readonly()
+    });
+    var logChannelsCapability = {
+      name: "log-channels",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        /** The channels this addon declares. Inert: no value, no state. */
+        list: method(zod.z.void(), zod.z.array(LogChannelDescriptorSchema).readonly()),
+        /**
+        * Refresh this process's mirror from the document's FULL set of armed
+        * windows.
+        *
+        * Full and not incremental on purpose: the document is the authority, so a
+        * channel it does not name is disarmed here. An incremental apply would
+        * let a disarm get lost in transit and leave a channel running that
+        * nobody can see is running.
+        */
+        apply: method(zod.z.object({ windows: zod.z.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
+      },
+      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+      mount: { kind: "skip" }
+    };
+    var LogLevelSchema = zod.z.enum([
+      "debug",
+      "info",
+      "warn",
+      "error"
+    ]);
+    var LogEntrySchema = zod.z.object({
+      timestamp: zod.z.date(),
+      level: LogLevelSchema,
+      scope: zod.z.array(zod.z.string()),
+      message: zod.z.string(),
+      meta: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+      tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
+    });
+    var logDestinationCapability = {
+      name: "log-destination",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        write: method(LogEntrySchema, zod.z.void(), { kind: "mutation" }),
+        query: method(zod.z.object({
+          scope: zod.z.array(zod.z.string()).optional(),
+          level: LogLevelSchema.optional(),
+          since: zod.z.date().optional(),
+          until: zod.z.date().optional(),
+          limit: zod.z.number().optional(),
+          tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
+        }), zod.z.array(LogEntrySchema).readonly())
+      },
+      /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+      mount: { kind: "skip" }
+    };
     var LoginStageEnum = zod.z.enum(["primary", "second-factor"]);
     var RedirectLoginMethodSchema = zod.z.object({
       kind: zod.z.literal("redirect"),
@@ -36780,9 +36780,13 @@ var require_dist_CcvXUhHK = __commonJS({
     var MediaFileSchema = zod.z.object({
       key: zod.z.string(),
       kind: MediaFileKindEnum,
-      base64: zod.z.string(),
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
+    }).extend({
+      /** `/addon/<addonId>/event-media/<encoded stored key>`. Always present. */
+      url: zod.z.string(),
+      /** @deprecated Transitional — see the schema docblock. Use {@link url}. */
+      base64: zod.z.string()
     });
     var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
     var RetrainMacroClassSchema = zod.z.enum([
@@ -37849,6 +37853,26 @@ var require_dist_CcvXUhHK = __commonJS({
           deviceId: zod.z.number()
         }), zod.z.array(MediaFileInfoSchema).readonly()),
         /**
+        * What media an EVENT has, without any of it — the twin `getEventMedia`
+        * never had.
+        *
+        * `listTrackMedia` above got this treatment because a track's media is
+        * 5-8 MB. An event's is worse per row, not better: an old-style event owns
+        * a `crop` AND a native-resolution `fullFrameBoxed`, and the track DETAIL
+        * modal — the one surface that legitimately shows the big kinds — unions
+        * both listings to build its filmstrip. It then renders every tile from
+        * the `event-media` plane by key and throws the bytes away. Measured on
+        * the live hub: one event's `fullFrameBoxed` is 2 824 077 B, base64'd to
+        * ~3.8 MB, allocated whole in hub-main's heap, for a list of keys.
+        *
+        * Same `deviceId` authorization subject as `getEventMedia`, and the same
+        * rows — this is a projection of that method, never a different question.
+        */
+        listEventMedia: method(zod.z.object({
+          eventId: zod.z.string(),
+          deviceId: zod.z.number()
+        }), zod.z.array(MediaFileInfoSchema).readonly()),
+        /**
         * Search object events by text query using CLIP cosine similarity.
         * Encodes `text` via the `embedding-encoder` cap, queries the
         * `ObjectEmbeddingStore` with optional prefilters, ranks all matching
@@ -43144,7 +43168,7 @@ var require_dist_CcvXUhHK = __commonJS({
     var MediaFileLiteSchema$1 = zod.z.object({
       key: zod.z.string(),
       kind: zod.z.string(),
-      base64: zod.z.string(),
+      url: zod.z.string(),
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
     });
@@ -46037,7 +46061,7 @@ var require_dist_CcvXUhHK = __commonJS({
     var MediaFileLiteSchema = zod.z.object({
       key: zod.z.string(),
       kind: zod.z.string(),
-      base64: zod.z.string(),
+      url: zod.z.string(),
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
     });
@@ -53345,6 +53369,12 @@ var require_dist_CcvXUhHK = __commonJS({
         addonId: null,
         access: "view"
       },
+      "pipelineAnalytics.listEventMedia": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.listGroups": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -56968,6 +56998,11 @@ var require_dist_CcvXUhHK = __commonJS({
         form: "array",
         optional: false
       }],
+      "pipelineAnalytics.listEventMedia": [{
+        name: "deviceId",
+        form: "single",
+        optional: false
+      }],
       "pipelineAnalytics.listGroups": [{
         name: "deviceIds",
         form: "array",
@@ -59112,7 +59147,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_Keu5TDO7();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -59931,7 +59966,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_Keu5TDO7();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -60025,7 +60060,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_Keu5TDO7();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -60922,11 +60957,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-DXZ2xe7C.js
-var require_retired_settings_keys_DXZ2xe7C = __commonJS({
-  "../system/dist/retired-settings-keys-DXZ2xe7C.js"(exports) {
+// ../system/dist/retired-settings-keys-BBohF-eC.js
+var require_retired_settings_keys_BBohF_eC = __commonJS({
+  "../system/dist/retired-settings-keys-BBohF-eC.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_Keu5TDO7();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -63140,8 +63175,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
-    var require_retired_settings_keys = require_retired_settings_keys_DXZ2xe7C();
+    var require_dist10 = require_dist_Keu5TDO7();
+    var require_retired_settings_keys = require_retired_settings_keys_BBohF_eC();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -67954,7 +67989,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_Keu5TDO7();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -68091,7 +68126,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_Keu5TDO7();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -68281,7 +68316,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_Keu5TDO7();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -76094,7 +76129,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_Keu5TDO7();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -76659,7 +76694,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_Keu5TDO7();
     var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
@@ -79281,7 +79316,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_Keu5TDO7();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -80397,8 +80432,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
-    var require_retired_settings_keys = require_retired_settings_keys_DXZ2xe7C();
+    var require_dist10 = require_dist_Keu5TDO7();
+    var require_retired_settings_keys = require_retired_settings_keys_BBohF_eC();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -82777,7 +82812,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_Keu5TDO7();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -85352,7 +85387,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_Keu5TDO7();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -103413,7 +103448,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_Keu5TDO7();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -105356,9 +105391,9 @@ var require_event_category_BaEgqJNv = __commonJS({
   }
 });
 
-// ../types/dist/sleep-CWWLTM6W.js
-var require_sleep_CWWLTM6W = __commonJS({
-  "../types/dist/sleep-CWWLTM6W.js"(exports) {
+// ../types/dist/sleep-C3AniWy-.js
+var require_sleep_C3AniWy = __commonJS({
+  "../types/dist/sleep-C3AniWy-.js"(exports) {
     "use strict";
     var require_event_category = require_event_category_BaEgqJNv();
     var zod = require_zod();
@@ -108080,6 +108115,7 @@ var require_sleep_CWWLTM6W = __commonJS({
           getEventMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getEventMedia", "query", input),
           getTrackMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getTrackMedia", "query", input),
           listTrackMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listTrackMedia", "query", input),
+          listEventMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listEventMedia", "query", input),
           searchObjectEvents: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "searchObjectEvents", "query", input),
           wipeObjectEmbeddings: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "wipeObjectEmbeddings", "mutation", input),
           rebuildObjectEmbeddings: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "rebuildObjectEmbeddings", "mutation", input),
@@ -109024,7 +109060,7 @@ var require_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_CWWLTM6W();
+    var require_sleep = require_sleep_C3AniWy();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -115906,12 +115942,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-system-deps-oJMkWSX-.js
-var require_manifest_system_deps_oJMkWSX = __commonJS({
-  "../system/dist/manifest-system-deps-oJMkWSX-.js"(exports) {
+// ../system/dist/manifest-system-deps-DYv4ZPo2.js
+var require_manifest_system_deps_DYv4ZPo2 = __commonJS({
+  "../system/dist/manifest-system-deps-DYv4ZPo2.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    require_dist_CcvXUhHK();
+    require_dist_Keu5TDO7();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var _camstack_types_node = require_node();
@@ -127940,7 +127976,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_Keu5TDO7();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -127966,7 +128002,7 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DO8KbxCe();
     var require_tls$1 = require_tls_BxQlomxd();
-    var require_manifest_system_deps = require_manifest_system_deps_oJMkWSX();
+    var require_manifest_system_deps = require_manifest_system_deps_DYv4ZPo2();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -208178,6 +208214,19 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       * per-task abort timeout. On success the resolved `stagedPath` is returned; on
       * failure the task is marked `failed` and `null` is returned (so the apply
       * phase skips it). Other tasks are unaffected.
+      *
+      * **`toVersion` is REWRITTEN here, to the version that was actually
+      * fetched.** A task's `toVersion` starts as the REQUEST, and the request is
+      * routinely a dist-tag: `addons.updatePackage` with no version resolves to
+      * the literal `'latest'`. The staging area already resolves it — it reads
+      * the version out of the unpacked tarball and returns `resolvedVersion` —
+      * and dropping that answer sent the string `'latest'` onward as if it were a
+      * version. It became the manifest's recorded version, the version the Addons
+      * page displayed, and the `toVersion` on the `addon.updated` event, which an
+      * operator read on his phone as "@camstack/addon-terminal 0.0.0 → latest"
+      * (2026-08-30). Everything downstream of the apply reads a version; none of
+      * it can resolve a tag, and none of it could tell that it had been handed
+      * one.
       */
       async fetchAddonTask(job, task) {
         try {
@@ -208187,20 +208236,28 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
           });
           const ac = new AbortController();
           const timer = setTimeout(() => ac.abort(), this.deps.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS);
-          let stagedPath;
+          let staged;
           try {
-            stagedPath = (await this.deps.staging.fetchAndStage({
+            staged = await this.deps.staging.fetchAndStage({
               jobId: job.jobId,
               name: task.packageName,
               version: task.toVersion,
               signal: ac.signal
-            })).stagedPath;
+            });
           } finally {
             clearTimeout(timer);
           }
-          this.advance(job.jobId, task, "staged", { stagedPath });
+          const stagedPath = staged.stagedPath;
+          const resolved = {
+            ...task,
+            toVersion: staged.resolvedVersion
+          };
+          this.advance(job.jobId, task, "staged", {
+            stagedPath,
+            toVersion: resolved.toVersion
+          });
           return {
-            task,
+            task: resolved,
             stagedPath
           };
         } catch (err) {
@@ -208769,7 +208826,7 @@ var require_dist4 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_CWWLTM6W();
+    var require_sleep = require_sleep_C3AniWy();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -216951,6 +217008,80 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         getInfo: require_sleep.method(zod.z.void(), EmbeddingInfoSchema, { auth: "admin" })
       }
     };
+    var FailureReasonCountSchema = zod.z.object({
+      /**
+      * Why the attempt did not land, in the contributor's own vocabulary —
+      * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
+      * strings that already appear in this repo's logs and, where one exists, the
+      * same string the per-track `previewMissReason` records (D276): a second
+      * vocabulary for the same loss would make the row and the counter
+      * un-joinable.
+      */
+      reason: zod.z.string(),
+      count: zod.z.number().int().nonnegative()
+    });
+    var FailureContributionSchema = zod.z.object({
+      /**
+      * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
+      * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
+      * `unit` free: the families are owned by different addons and a shared enum
+      * is a central list that rots invisibly.
+      */
+      family: zod.z.string(),
+      /**
+      * The NUMERIC device id — the same value every log line carries as
+      * `tags.deviceId`. Never nullable and never absent: a contributor that
+      * cannot name the camera must not emit the entry, because a fleet total
+      * cannot answer the only question anybody asks of this surface.
+      */
+      deviceId: zod.z.number().int().positive(),
+      /**
+      * A second dimension inside the family: the model / step id for an inference
+      * timeout, so "which camera AND which model" is one read. Absent when the
+      * family has a single variant.
+      */
+      variant: zod.z.string().optional(),
+      /**
+      * Epoch ms this counter started — the INCARNATION MARKER. A consumer
+      * differencing two reads must drop the interval when it changes, because the
+      * counter restarted from zero in a respawned runner. Same discipline as
+      * `LoadContribution.startedAtMs`.
+      */
+      sinceMs: zod.z.number(),
+      /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
+      atMs: zod.z.number(),
+      /**
+      * THE DENOMINATOR — every attempt on this path for this camera in the
+      * window. A failure count published without it is the mistake this schema
+      * exists to make impossible.
+      */
+      attempts: zod.z.number().int().nonnegative(),
+      /** Attempts that landed. `attempts - succeeded` is the loss. */
+      succeeded: zod.z.number().int().nonnegative(),
+      /** The loss, partitioned. Sums to `attempts - succeeded`. */
+      reasons: zod.z.array(FailureReasonCountSchema).readonly()
+    });
+    var failureContributionCapability = {
+      name: "failure-contribution",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        /**
+        * This addon's per-camera failure counters, read live from bounded in-RAM
+        * state it already keeps. Inert: no persistence, no sampling, no timer.
+        *
+        * READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
+        * consumer that wants a rate differences two reads. A draining read would
+        * make two operators with the page open each destroy half of the other's
+        * numbers, and `load-contribution` already settled the same question the
+        * same way for `cpuSeconds`.
+        */
+        list: require_sleep.method(zod.z.void(), zod.z.array(FailureContributionSchema).readonly())
+      },
+      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+      mount: { kind: "skip" }
+    };
     var DirEntrySchema = zod.z.object({
       name: zod.z.string(),
       path: zod.z.string()
@@ -217495,145 +217626,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         })
       }
     };
-    var LogChannelApplyResultSchema = zod.z.object({
-      /** How many declared channels are armed in this process after the call. */
-      armed: zod.z.number().int().min(0),
-      /**
-      * Names the document armed that this process does not declare. Reported
-      * rather than swallowed: a name here is either a typo or an addon that has
-      * not booted, and both deserve a line instead of silence.
-      */
-      unknown: zod.z.array(zod.z.string()).readonly()
-    });
-    var logChannelsCapability = {
-      name: "log-channels",
-      scope: "system",
-      mode: "collection",
-      internal: true,
-      methods: {
-        /** The channels this addon declares. Inert: no value, no state. */
-        list: require_sleep.method(zod.z.void(), zod.z.array(LogChannelDescriptorSchema).readonly()),
-        /**
-        * Refresh this process's mirror from the document's FULL set of armed
-        * windows.
-        *
-        * Full and not incremental on purpose: the document is the authority, so a
-        * channel it does not name is disarmed here. An incremental apply would
-        * let a disarm get lost in transit and leave a channel running that
-        * nobody can see is running.
-        */
-        apply: require_sleep.method(zod.z.object({ windows: zod.z.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
-      },
-      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
-      mount: { kind: "skip" }
-    };
-    var LogLevelSchema = zod.z.enum([
-      "debug",
-      "info",
-      "warn",
-      "error"
-    ]);
-    var LogEntrySchema = zod.z.object({
-      timestamp: zod.z.date(),
-      level: LogLevelSchema,
-      scope: zod.z.array(zod.z.string()),
-      message: zod.z.string(),
-      meta: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-      tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
-    });
-    var logDestinationCapability = {
-      name: "log-destination",
-      scope: "system",
-      mode: "collection",
-      internal: true,
-      methods: {
-        write: require_sleep.method(LogEntrySchema, zod.z.void(), { kind: "mutation" }),
-        query: require_sleep.method(zod.z.object({
-          scope: zod.z.array(zod.z.string()).optional(),
-          level: LogLevelSchema.optional(),
-          since: zod.z.date().optional(),
-          until: zod.z.date().optional(),
-          limit: zod.z.number().optional(),
-          tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
-        }), zod.z.array(LogEntrySchema).readonly())
-      },
-      /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
-      mount: { kind: "skip" }
-    };
-    var FailureReasonCountSchema = zod.z.object({
-      /**
-      * Why the attempt did not land, in the contributor's own vocabulary —
-      * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
-      * strings that already appear in this repo's logs and, where one exists, the
-      * same string the per-track `previewMissReason` records (D276): a second
-      * vocabulary for the same loss would make the row and the counter
-      * un-joinable.
-      */
-      reason: zod.z.string(),
-      count: zod.z.number().int().nonnegative()
-    });
-    var FailureContributionSchema = zod.z.object({
-      /**
-      * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
-      * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
-      * `unit` free: the families are owned by different addons and a shared enum
-      * is a central list that rots invisibly.
-      */
-      family: zod.z.string(),
-      /**
-      * The NUMERIC device id — the same value every log line carries as
-      * `tags.deviceId`. Never nullable and never absent: a contributor that
-      * cannot name the camera must not emit the entry, because a fleet total
-      * cannot answer the only question anybody asks of this surface.
-      */
-      deviceId: zod.z.number().int().positive(),
-      /**
-      * A second dimension inside the family: the model / step id for an inference
-      * timeout, so "which camera AND which model" is one read. Absent when the
-      * family has a single variant.
-      */
-      variant: zod.z.string().optional(),
-      /**
-      * Epoch ms this counter started — the INCARNATION MARKER. A consumer
-      * differencing two reads must drop the interval when it changes, because the
-      * counter restarted from zero in a respawned runner. Same discipline as
-      * `LoadContribution.startedAtMs`.
-      */
-      sinceMs: zod.z.number(),
-      /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
-      atMs: zod.z.number(),
-      /**
-      * THE DENOMINATOR — every attempt on this path for this camera in the
-      * window. A failure count published without it is the mistake this schema
-      * exists to make impossible.
-      */
-      attempts: zod.z.number().int().nonnegative(),
-      /** Attempts that landed. `attempts - succeeded` is the loss. */
-      succeeded: zod.z.number().int().nonnegative(),
-      /** The loss, partitioned. Sums to `attempts - succeeded`. */
-      reasons: zod.z.array(FailureReasonCountSchema).readonly()
-    });
-    var failureContributionCapability = {
-      name: "failure-contribution",
-      scope: "system",
-      mode: "collection",
-      internal: true,
-      methods: {
-        /**
-        * This addon's per-camera failure counters, read live from bounded in-RAM
-        * state it already keeps. Inert: no persistence, no sampling, no timer.
-        *
-        * READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
-        * consumer that wants a rate differences two reads. A draining read would
-        * make two operators with the page open each destroy half of the other's
-        * numbers, and `load-contribution` already settled the same question the
-        * same way for `cpuSeconds`.
-        */
-        list: require_sleep.method(zod.z.void(), zod.z.array(FailureContributionSchema).readonly())
-      },
-      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
-      mount: { kind: "skip" }
-    };
     var LOAD_CONTRIBUTION_ROLES = [
       "decode",
       "transcode",
@@ -217713,6 +217705,71 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** In-process only — enumerated through `addons.listCapabilityProviders`. */
       mount: { kind: "skip" }
     };
+    var LogChannelApplyResultSchema = zod.z.object({
+      /** How many declared channels are armed in this process after the call. */
+      armed: zod.z.number().int().min(0),
+      /**
+      * Names the document armed that this process does not declare. Reported
+      * rather than swallowed: a name here is either a typo or an addon that has
+      * not booted, and both deserve a line instead of silence.
+      */
+      unknown: zod.z.array(zod.z.string()).readonly()
+    });
+    var logChannelsCapability = {
+      name: "log-channels",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        /** The channels this addon declares. Inert: no value, no state. */
+        list: require_sleep.method(zod.z.void(), zod.z.array(LogChannelDescriptorSchema).readonly()),
+        /**
+        * Refresh this process's mirror from the document's FULL set of armed
+        * windows.
+        *
+        * Full and not incremental on purpose: the document is the authority, so a
+        * channel it does not name is disarmed here. An incremental apply would
+        * let a disarm get lost in transit and leave a channel running that
+        * nobody can see is running.
+        */
+        apply: require_sleep.method(zod.z.object({ windows: zod.z.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
+      },
+      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+      mount: { kind: "skip" }
+    };
+    var LogLevelSchema = zod.z.enum([
+      "debug",
+      "info",
+      "warn",
+      "error"
+    ]);
+    var LogEntrySchema = zod.z.object({
+      timestamp: zod.z.date(),
+      level: LogLevelSchema,
+      scope: zod.z.array(zod.z.string()),
+      message: zod.z.string(),
+      meta: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+      tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
+    });
+    var logDestinationCapability = {
+      name: "log-destination",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        write: require_sleep.method(LogEntrySchema, zod.z.void(), { kind: "mutation" }),
+        query: require_sleep.method(zod.z.object({
+          scope: zod.z.array(zod.z.string()).optional(),
+          level: LogLevelSchema.optional(),
+          since: zod.z.date().optional(),
+          until: zod.z.date().optional(),
+          limit: zod.z.number().optional(),
+          tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
+        }), zod.z.array(LogEntrySchema).readonly())
+      },
+      /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+      mount: { kind: "skip" }
+    };
     var LoginStageEnum = zod.z.enum(["primary", "second-factor"]);
     var RedirectLoginMethodSchema = zod.z.object({
       kind: zod.z.literal("redirect"),
@@ -222600,13 +222657,18 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "keyFrameSmall",
       "thumbnailSmall"
     ]);
-    var MediaFileSchema = zod.z.object({
+    var MediaFileRefSchema = zod.z.object({
       key: zod.z.string(),
       kind: MediaFileKindEnum,
-      base64: zod.z.string(),
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
     });
+    var MediaFileSchema = MediaFileRefSchema.extend({
+      /** `/addon/<addonId>/event-media/<encoded stored key>`. Always present. */
+      url: zod.z.string(),
+      /** @deprecated Transitional — see the schema docblock. Use {@link url}. */
+      base64: zod.z.string()
+    });
     var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
     var RetrainMacroClassSchema = zod.z.enum([
       "person",
@@ -223672,6 +223734,26 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           deviceId: zod.z.number()
         }), zod.z.array(MediaFileInfoSchema).readonly()),
         /**
+        * What media an EVENT has, without any of it — the twin `getEventMedia`
+        * never had.
+        *
+        * `listTrackMedia` above got this treatment because a track's media is
+        * 5-8 MB. An event's is worse per row, not better: an old-style event owns
+        * a `crop` AND a native-resolution `fullFrameBoxed`, and the track DETAIL
+        * modal — the one surface that legitimately shows the big kinds — unions
+        * both listings to build its filmstrip. It then renders every tile from
+        * the `event-media` plane by key and throws the bytes away. Measured on
+        * the live hub: one event's `fullFrameBoxed` is 2 824 077 B, base64'd to
+        * ~3.8 MB, allocated whole in hub-main's heap, for a list of keys.
+        *
+        * Same `deviceId` authorization subject as `getEventMedia`, and the same
+        * rows — this is a projection of that method, never a different question.
+        */
+        listEventMedia: require_sleep.method(zod.z.object({
+          eventId: zod.z.string(),
+          deviceId: zod.z.number()
+        }), zod.z.array(MediaFileInfoSchema).readonly()),
+        /**
         * Search object events by text query using CLIP cosine similarity.
         * Encodes `text` via the `embedding-encoder` cap, queries the
         * `ObjectEmbeddingStore` with optional prefilters, ranks all matching
@@ -229134,7 +229216,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     var MediaFileLiteSchema$1 = zod.z.object({
       key: zod.z.string(),
       kind: zod.z.string(),
-      base64: zod.z.string(),
+      url: zod.z.string(),
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
     });
@@ -232029,7 +232111,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     var MediaFileLiteSchema = zod.z.object({
       key: zod.z.string(),
       kind: zod.z.string(),
-      base64: zod.z.string(),
+      url: zod.z.string(),
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
     });
@@ -242277,6 +242359,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "pipelineAnalytics.listEventMedia": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.listGroups": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -246158,6 +246246,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         form: "array",
         optional: false
       }],
+      "pipelineAnalytics.listEventMedia": [{
+        name: "deviceId",
+        form: "single",
+        optional: false
+      }],
       "pipelineAnalytics.listGroups": [{
         name: "deviceIds",
         form: "array",
@@ -251198,6 +251291,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.MaskShapeKindSchema = MaskShapeKindSchema;
     exports.MaskShapeSchema = MaskShapeSchema;
     exports.MediaFileInfoSchema = MediaFileInfoSchema;
+    exports.MediaFileRefSchema = MediaFileRefSchema;
     exports.MediaFileSchema = MediaFileSchema;
     exports.MediaPlayerRepeatSchema = MediaPlayerRepeatSchema;
     exports.MediaPlayerStateSchema = MediaPlayerStateSchema;
@@ -402904,7 +402998,7 @@ var require_addon_package_service = __commonJS({
             this.requireInstaller();
             const addonInstaller = this.installer;
             const previousVersion = this.getInstalledPackageVersion(name);
-            const isFirstInstall = !previousVersion;
+            const isFirstInstall = previousVersion === null;
             let result;
             if (isFirstInstall) {
               const r = await addonInstaller.installFromNpm(name, version);
@@ -402930,12 +403024,13 @@ var require_addon_package_service = __commonJS({
           const targetDir = path.join(addonsDir, dirName);
           const packageSpec = version ? `${name}@${version}` : name;
           await installPackageFromNpm(packageSpec, targetDir);
-          updatedVersion = this.getInstalledPackageVersion(name);
+          const installedVersion = this.getInstalledPackageVersion(name);
+          updatedVersion = installedVersion ?? "";
           this.cachedUpdates = null;
           this.logger.info("Core package updated -- restart required", {
-            meta: { name, updatedVersion }
+            meta: { name, updatedVersion: installedVersion }
           });
-          this.sendUpdateNotification(name, updatedVersion);
+          this.sendUpdateNotification(name, installedVersion);
           return { success: true, version: updatedVersion, requiresRestart: true };
         } catch (error) {
           const msg = (0, types_1.errMsg)(error);
@@ -403622,36 +403717,39 @@ var require_addon_package_service = __commonJS({
       // Private: general helpers
       // =========================================================================
       /**
-       * Read the currently installed version of a package.
-       * Checks data/addons/ first, then falls back to Node module resolution.
-       * Returns '0.0.0' if not found.
+       * The version of `packageName` INSTALLED RIGHT NOW, or `null` when the hub
+       * has no readable copy.
+       *
+       * Delegates to the installer, which is the one place that knows the on-disk
+       * layout (`<addonsDir>/@camstack/<pkg>/`, with the pre-scope flat form as a
+       * fallback). This method used to restate that path and got it wrong —
+       * `packageName.replace(/^@camstack\//, '')` looked ONLY in the flat form, so
+       * every scoped install missed. It then fell back to
+       * `require.resolve('<pkg>/package.json')`, which cannot succeed either: an
+       * addon is installed under the data directory, not in the hub's own
+       * node_modules. Both misses landed on the literal `'0.0.0'`, and that string
+       * was published on the `addon.updated` event as the version the operator had
+       * been running ("@camstack/addon-terminal 0.0.0 → latest", 2026-08-30).
+       *
+       * `null`, not `'0.0.0'`: a version nobody installed is indistinguishable
+       * from one that was, and the caller must be forced to decide what to say
+       * about "unknown" rather than inherit a number that looks like an answer.
        */
       getInstalledPackageVersion(packageName) {
         try {
-          const addonsDir = this.resolveAddonsDir();
-          const dirName = packageName.replace(/^@camstack\//, "");
-          const pkgJsonPath = path.join(addonsDir, dirName, "package.json");
-          if (fs.existsSync(pkgJsonPath)) {
-            const pkgJson = readJsonObject(pkgJsonPath);
-            const v = asString(pkgJson?.["version"]);
-            if (v)
-              return v;
-          }
+          const installed = this.installer?.getInstalledPackage(packageName) ?? null;
+          const version = installed === null ? "" : asString(installed.version);
+          if (version)
+            return version;
         } catch (err) {
-          this.logger.debug("Version lookup via fs failed, trying require.resolve", {
+          this.logger.debug("Installed-version lookup failed", {
             meta: { packageName, error: (0, types_1.errMsg)(err) }
           });
         }
-        try {
-          const pkgJsonPath = __require.resolve(`${packageName}/package.json`);
-          const pkgJson = readJsonObject(pkgJsonPath);
-          return asString(pkgJson?.["version"], "0.0.0");
-        } catch (err) {
-          this.logger.debug("Could not resolve version, returning 0.0.0", {
-            meta: { packageName, error: (0, types_1.errMsg)(err) }
-          });
-          return "0.0.0";
-        }
+        this.logger.debug("No readable installed copy \u2014 previous version is unknown", {
+          meta: { packageName }
+        });
+        return null;
       }
       /** Only allow @camstack/* scoped packages */
       isAllowedPackage(name) {
@@ -403703,11 +403801,18 @@ var require_addon_package_service = __commonJS({
           throw new Error("AddonInstaller is not available -- @camstack/system may not be installed");
         }
       }
-      /** Send notification and toast for a successful package update */
+      /**
+       * Send notification and toast for a successful package update.
+       *
+       * `version === null` means the hub could not read back what it just
+       * installed. The sentence then says the package was updated and stops —
+       * never "updated to v0.0.0", which reads as a real version.
+       */
       sendUpdateNotification(name, version) {
+        const sentence = version === null ? `${name} updated` : `${name} updated to v${version}`;
         this.notificationService.notify({
           title: "Package Updated",
-          body: `${name} updated to v${version}`,
+          body: sentence,
           format: "text",
           priority: 3,
           category: "system",
@@ -403718,7 +403823,7 @@ var require_addon_package_service = __commonJS({
         });
         this.toastService.broadcast({
           title: "Package Updated",
-          message: `${name} updated to v${version}`,
+          message: sentence,
           severity: "info",
           duration: 5e3
         });
@@ -417257,6 +417362,7 @@ var require_addon_registry_service = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.AddonRegistryService = void 0;
     exports.shouldEvictMissingOnDisk = shouldEvictMissingOnDisk;
+    exports.addonUpdatePayload = addonUpdatePayload;
     exports.shouldEmitProviderRegisteredReady = shouldEmitProviderRegisteredReady;
     var node_crypto_1 = __require("crypto");
     var fs = __importStar(__require("fs"));
@@ -417279,6 +417385,12 @@ var require_addon_registry_service = __commonJS({
     function shouldEvictMissingOnDisk(entry, id, onDiskIds) {
       return entry.source === "installed" && entry.packageName !== "@camstack/system" && !onDiskIds.has(id);
     }
+    function addonUpdatePayload(fromVersion, toVersion) {
+      return {
+        ...fromVersion !== null ? { fromVersion } : {},
+        toVersion
+      };
+    }
     function isSettingsStore(backend) {
       const required = [
         "getSystem",
@@ -418354,14 +418466,17 @@ var require_addon_registry_service = __commonJS({
         this.healthMonitor.forget(packageName);
         this.addonLoader.clearLoadFailures(packageName);
       }
-      /** Emit addon.updated lifecycle event for all addons belonging to a package */
+      /**
+       * Emit `addon.updated` for every addon belonging to a package.
+       *
+       * The payload shape is {@link addonUpdatePayload} — an unknown predecessor
+       * is an ABSENT key, never a placeholder.
+       */
       emitUpdateEvent(packageName, fromVersion, toVersion) {
+        const payload = addonUpdatePayload(fromVersion, toVersion);
         for (const [id, entry] of this.addonEntries) {
           if (entry.packageName === packageName) {
-            this.emitAddonLifecycleEvent("addon.updated", id, {
-              fromVersion,
-              toVersion
-            });
+            this.emitAddonLifecycleEvent("addon.updated", id, payload);
           }
         }
       }