camstack 1.2.66 → 1.2.68

package/dist/{launcher-EJVL74UN.js → launcher-H2LQYCEY.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-CcvXUhHK.js
-var require_dist_CcvXUhHK = __commonJS({
-  "../system/dist/dist-CcvXUhHK.js"(exports) {
+// ../system/dist/dist-CCIBlacf.js
+var require_dist_CCIBlacf = __commonJS({
+  "../system/dist/dist-CCIBlacf.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -31940,6 +31940,80 @@ var require_dist_CcvXUhHK = __commonJS({
         getInfo: method(zod.z.void(), EmbeddingInfoSchema, { auth: "admin" })
       }
     };
+    var FailureReasonCountSchema = zod.z.object({
+      /**
+      * Why the attempt did not land, in the contributor's own vocabulary —
+      * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
+      * strings that already appear in this repo's logs and, where one exists, the
+      * same string the per-track `previewMissReason` records (D276): a second
+      * vocabulary for the same loss would make the row and the counter
+      * un-joinable.
+      */
+      reason: zod.z.string(),
+      count: zod.z.number().int().nonnegative()
+    });
+    var FailureContributionSchema = zod.z.object({
+      /**
+      * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
+      * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
+      * `unit` free: the families are owned by different addons and a shared enum
+      * is a central list that rots invisibly.
+      */
+      family: zod.z.string(),
+      /**
+      * The NUMERIC device id — the same value every log line carries as
+      * `tags.deviceId`. Never nullable and never absent: a contributor that
+      * cannot name the camera must not emit the entry, because a fleet total
+      * cannot answer the only question anybody asks of this surface.
+      */
+      deviceId: zod.z.number().int().positive(),
+      /**
+      * A second dimension inside the family: the model / step id for an inference
+      * timeout, so "which camera AND which model" is one read. Absent when the
+      * family has a single variant.
+      */
+      variant: zod.z.string().optional(),
+      /**
+      * Epoch ms this counter started — the INCARNATION MARKER. A consumer
+      * differencing two reads must drop the interval when it changes, because the
+      * counter restarted from zero in a respawned runner. Same discipline as
+      * `LoadContribution.startedAtMs`.
+      */
+      sinceMs: zod.z.number(),
+      /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
+      atMs: zod.z.number(),
+      /**
+      * THE DENOMINATOR — every attempt on this path for this camera in the
+      * window. A failure count published without it is the mistake this schema
+      * exists to make impossible.
+      */
+      attempts: zod.z.number().int().nonnegative(),
+      /** Attempts that landed. `attempts - succeeded` is the loss. */
+      succeeded: zod.z.number().int().nonnegative(),
+      /** The loss, partitioned. Sums to `attempts - succeeded`. */
+      reasons: zod.z.array(FailureReasonCountSchema).readonly()
+    });
+    var failureContributionCapability = {
+      name: "failure-contribution",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        /**
+        * This addon's per-camera failure counters, read live from bounded in-RAM
+        * state it already keeps. Inert: no persistence, no sampling, no timer.
+        *
+        * READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
+        * consumer that wants a rate differences two reads. A draining read would
+        * make two operators with the page open each destroy half of the other's
+        * numbers, and `load-contribution` already settled the same question the
+        * same way for `cpuSeconds`.
+        */
+        list: method(zod.z.void(), zod.z.array(FailureContributionSchema).readonly())
+      },
+      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+      mount: { kind: "skip" }
+    };
     var DirEntrySchema = zod.z.object({
       name: zod.z.string(),
       path: zod.z.string()
@@ -32477,145 +32551,6 @@ var require_dist_CcvXUhHK = __commonJS({
         })
       }
     };
-    var LogChannelApplyResultSchema = zod.z.object({
-      /** How many declared channels are armed in this process after the call. */
-      armed: zod.z.number().int().min(0),
-      /**
-      * Names the document armed that this process does not declare. Reported
-      * rather than swallowed: a name here is either a typo or an addon that has
-      * not booted, and both deserve a line instead of silence.
-      */
-      unknown: zod.z.array(zod.z.string()).readonly()
-    });
-    var logChannelsCapability = {
-      name: "log-channels",
-      scope: "system",
-      mode: "collection",
-      internal: true,
-      methods: {
-        /** The channels this addon declares. Inert: no value, no state. */
-        list: method(zod.z.void(), zod.z.array(LogChannelDescriptorSchema).readonly()),
-        /**
-        * Refresh this process's mirror from the document's FULL set of armed
-        * windows.
-        *
-        * Full and not incremental on purpose: the document is the authority, so a
-        * channel it does not name is disarmed here. An incremental apply would
-        * let a disarm get lost in transit and leave a channel running that
-        * nobody can see is running.
-        */
-        apply: method(zod.z.object({ windows: zod.z.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
-      },
-      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
-      mount: { kind: "skip" }
-    };
-    var LogLevelSchema = zod.z.enum([
-      "debug",
-      "info",
-      "warn",
-      "error"
-    ]);
-    var LogEntrySchema = zod.z.object({
-      timestamp: zod.z.date(),
-      level: LogLevelSchema,
-      scope: zod.z.array(zod.z.string()),
-      message: zod.z.string(),
-      meta: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-      tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
-    });
-    var logDestinationCapability = {
-      name: "log-destination",
-      scope: "system",
-      mode: "collection",
-      internal: true,
-      methods: {
-        write: method(LogEntrySchema, zod.z.void(), { kind: "mutation" }),
-        query: method(zod.z.object({
-          scope: zod.z.array(zod.z.string()).optional(),
-          level: LogLevelSchema.optional(),
-          since: zod.z.date().optional(),
-          until: zod.z.date().optional(),
-          limit: zod.z.number().optional(),
-          tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
-        }), zod.z.array(LogEntrySchema).readonly())
-      },
-      /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
-      mount: { kind: "skip" }
-    };
-    var FailureReasonCountSchema = zod.z.object({
-      /**
-      * Why the attempt did not land, in the contributor's own vocabulary —
-      * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
-      * strings that already appear in this repo's logs and, where one exists, the
-      * same string the per-track `previewMissReason` records (D276): a second
-      * vocabulary for the same loss would make the row and the counter
-      * un-joinable.
-      */
-      reason: zod.z.string(),
-      count: zod.z.number().int().nonnegative()
-    });
-    var FailureContributionSchema = zod.z.object({
-      /**
-      * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
-      * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
-      * `unit` free: the families are owned by different addons and a shared enum
-      * is a central list that rots invisibly.
-      */
-      family: zod.z.string(),
-      /**
-      * The NUMERIC device id — the same value every log line carries as
-      * `tags.deviceId`. Never nullable and never absent: a contributor that
-      * cannot name the camera must not emit the entry, because a fleet total
-      * cannot answer the only question anybody asks of this surface.
-      */
-      deviceId: zod.z.number().int().positive(),
-      /**
-      * A second dimension inside the family: the model / step id for an inference
-      * timeout, so "which camera AND which model" is one read. Absent when the
-      * family has a single variant.
-      */
-      variant: zod.z.string().optional(),
-      /**
-      * Epoch ms this counter started — the INCARNATION MARKER. A consumer
-      * differencing two reads must drop the interval when it changes, because the
-      * counter restarted from zero in a respawned runner. Same discipline as
-      * `LoadContribution.startedAtMs`.
-      */
-      sinceMs: zod.z.number(),
-      /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
-      atMs: zod.z.number(),
-      /**
-      * THE DENOMINATOR — every attempt on this path for this camera in the
-      * window. A failure count published without it is the mistake this schema
-      * exists to make impossible.
-      */
-      attempts: zod.z.number().int().nonnegative(),
-      /** Attempts that landed. `attempts - succeeded` is the loss. */
-      succeeded: zod.z.number().int().nonnegative(),
-      /** The loss, partitioned. Sums to `attempts - succeeded`. */
-      reasons: zod.z.array(FailureReasonCountSchema).readonly()
-    });
-    var failureContributionCapability = {
-      name: "failure-contribution",
-      scope: "system",
-      mode: "collection",
-      internal: true,
-      methods: {
-        /**
-        * This addon's per-camera failure counters, read live from bounded in-RAM
-        * state it already keeps. Inert: no persistence, no sampling, no timer.
-        *
-        * READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
-        * consumer that wants a rate differences two reads. A draining read would
-        * make two operators with the page open each destroy half of the other's
-        * numbers, and `load-contribution` already settled the same question the
-        * same way for `cpuSeconds`.
-        */
-        list: method(zod.z.void(), zod.z.array(FailureContributionSchema).readonly())
-      },
-      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
-      mount: { kind: "skip" }
-    };
     var LoadContributionSchema = zod.z.object({
       role: zod.z.enum([
         "decode",
@@ -32693,6 +32628,71 @@ var require_dist_CcvXUhHK = __commonJS({
       /** In-process only — enumerated through `addons.listCapabilityProviders`. */
       mount: { kind: "skip" }
     };
+    var LogChannelApplyResultSchema = zod.z.object({
+      /** How many declared channels are armed in this process after the call. */
+      armed: zod.z.number().int().min(0),
+      /**
+      * Names the document armed that this process does not declare. Reported
+      * rather than swallowed: a name here is either a typo or an addon that has
+      * not booted, and both deserve a line instead of silence.
+      */
+      unknown: zod.z.array(zod.z.string()).readonly()
+    });
+    var logChannelsCapability = {
+      name: "log-channels",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        /** The channels this addon declares. Inert: no value, no state. */
+        list: method(zod.z.void(), zod.z.array(LogChannelDescriptorSchema).readonly()),
+        /**
+        * Refresh this process's mirror from the document's FULL set of armed
+        * windows.
+        *
+        * Full and not incremental on purpose: the document is the authority, so a
+        * channel it does not name is disarmed here. An incremental apply would
+        * let a disarm get lost in transit and leave a channel running that
+        * nobody can see is running.
+        */
+        apply: method(zod.z.object({ windows: zod.z.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
+      },
+      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+      mount: { kind: "skip" }
+    };
+    var LogLevelSchema = zod.z.enum([
+      "debug",
+      "info",
+      "warn",
+      "error"
+    ]);
+    var LogEntrySchema = zod.z.object({
+      timestamp: zod.z.date(),
+      level: LogLevelSchema,
+      scope: zod.z.array(zod.z.string()),
+      message: zod.z.string(),
+      meta: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+      tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
+    });
+    var logDestinationCapability = {
+      name: "log-destination",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        write: method(LogEntrySchema, zod.z.void(), { kind: "mutation" }),
+        query: method(zod.z.object({
+          scope: zod.z.array(zod.z.string()).optional(),
+          level: LogLevelSchema.optional(),
+          since: zod.z.date().optional(),
+          until: zod.z.date().optional(),
+          limit: zod.z.number().optional(),
+          tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
+        }), zod.z.array(LogEntrySchema).readonly())
+      },
+      /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+      mount: { kind: "skip" }
+    };
     var LoginStageEnum = zod.z.enum(["primary", "second-factor"]);
     var RedirectLoginMethodSchema = zod.z.object({
       kind: zod.z.literal("redirect"),
@@ -36780,9 +36780,13 @@ var require_dist_CcvXUhHK = __commonJS({
     var MediaFileSchema = zod.z.object({
       key: zod.z.string(),
       kind: MediaFileKindEnum,
-      base64: zod.z.string(),
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
+    }).extend({
+      /** `/addon/<addonId>/event-media/<encoded stored key>`. Always present. */
+      url: zod.z.string(),
+      /** @deprecated Transitional — see the schema docblock. Use {@link url}. */
+      base64: zod.z.string()
     });
     var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
     var RetrainMacroClassSchema = zod.z.enum([
@@ -37090,6 +37094,25 @@ var require_dist_CcvXUhHK = __commonJS({
       totalBytes: zod.z.number().int(),
       devices: zod.z.array(EventStoreDeviceFootprintSchema).readonly()
     });
+    var EventMediaKindFootprintSchema = zod.z.object({
+      kind: MediaFileKindEnum,
+      /** Media rows of this kind. */
+      rows: zod.z.number().int(),
+      /** Bytes on disk held by those rows. */
+      bytes: zod.z.number().int()
+    });
+    var EventMediaKindBreakdownSchema = zod.z.object({
+      /** Every media row in scope, from one unfiltered aggregate. */
+      totalRows: zod.z.number().int(),
+      /** Every media byte in scope, from that same aggregate. */
+      totalBytes: zod.z.number().int(),
+      /** Per-kind footprint, ordered by bytes descending. */
+      kinds: zod.z.array(EventMediaKindFootprintSchema).readonly(),
+      /** `totalRows` minus the summed `kinds` rows — see the schema note. */
+      unaccountedRows: zod.z.number().int(),
+      /** `totalBytes` minus the summed `kinds` bytes — see the schema note. */
+      unaccountedBytes: zod.z.number().int()
+    });
     var EventPruneCountsSchema = zod.z.object({
       motion: zod.z.number().int(),
       object: zod.z.number().int(),
@@ -37445,6 +37468,22 @@ var require_dist_CcvXUhHK = __commonJS({
           auth: "admin"
         }),
         /**
+        * The same media footprint, broken down by {@link MediaFileKind} instead of
+        * by camera — fleet-wide, or for one camera with `deviceId`.
+        *
+        * Separate from {@link getEventStoreFootprint} rather than a field on it:
+        * the two answer different questions on different axes, the per-camera one
+        * is what the management table renders on every open, and nothing should
+        * pay for a per-kind pass to draw it. See
+        * {@link EventMediaKindBreakdownSchema} for why `unaccounted*` exists —
+        * `kinds` is enumerated, `totalBytes` is not, and the gap must be visible
+        * to anyone sizing a deletion against it.
+        */
+        getEventMediaFootprintByKind: method(zod.z.object({ deviceId: zod.z.number().int().optional() }), EventMediaKindBreakdownSchema, {
+          kind: "query",
+          auth: "admin"
+        }),
+        /**
         * Cluster-wide prune of events older than `olderThanMs` (exclusive) across
         * every camera, deleting each event's media in lockstep. Logged to the
         * events ops-log with `reason` (default `'retention'`). Returns the summed
@@ -37849,6 +37888,26 @@ var require_dist_CcvXUhHK = __commonJS({
           deviceId: zod.z.number()
         }), zod.z.array(MediaFileInfoSchema).readonly()),
         /**
+        * What media an EVENT has, without any of it — the twin `getEventMedia`
+        * never had.
+        *
+        * `listTrackMedia` above got this treatment because a track's media is
+        * 5-8 MB. An event's is worse per row, not better: an old-style event owns
+        * a `crop` AND a native-resolution `fullFrameBoxed`, and the track DETAIL
+        * modal — the one surface that legitimately shows the big kinds — unions
+        * both listings to build its filmstrip. It then renders every tile from
+        * the `event-media` plane by key and throws the bytes away. Measured on
+        * the live hub: one event's `fullFrameBoxed` is 2 824 077 B, base64'd to
+        * ~3.8 MB, allocated whole in hub-main's heap, for a list of keys.
+        *
+        * Same `deviceId` authorization subject as `getEventMedia`, and the same
+        * rows — this is a projection of that method, never a different question.
+        */
+        listEventMedia: method(zod.z.object({
+          eventId: zod.z.string(),
+          deviceId: zod.z.number()
+        }), zod.z.array(MediaFileInfoSchema).readonly()),
+        /**
         * Search object events by text query using CLIP cosine similarity.
         * Encodes `text` via the `embedding-encoder` cap, queries the
         * `ObjectEmbeddingStore` with optional prefilters, ranks all matching
@@ -40023,6 +40082,20 @@ var require_dist_CcvXUhHK = __commonJS({
         listProviders: method(zod.z.void(), zod.z.array(ProviderListEntrySchema).readonly()),
         testConfig: method(zod.z.object({
           providerId: zod.z.string(),
+          /**
+          * The location this config is an UNSAVED edit of, when there is one.
+          *
+          * `listLocations` replaces every declared secret with the redaction
+          * sentinel, so the edit modal's form state holds the sentinel for any
+          * credential the operator did not retype — and posting that here
+          * without a way to resolve it makes the provider try to authenticate
+          * as `__camstack_redacted__` and report the operator's own working
+          * password as wrong. Given this id, the orchestrator restores each
+          * sentinel from the stored config (same rule as `upsertLocation`)
+          * before dispatching. Omitted by the "Add location" wizard, where
+          * every value was typed just now and nothing is stored yet.
+          */
+          locationId: zod.z.string().optional(),
           config: zod.z.record(zod.z.string(), zod.z.unknown())
         }), zod.z.object({
           ok: zod.z.boolean(),
@@ -43144,7 +43217,7 @@ var require_dist_CcvXUhHK = __commonJS({
     var MediaFileLiteSchema$1 = zod.z.object({
       key: zod.z.string(),
       kind: zod.z.string(),
-      base64: zod.z.string(),
+      url: zod.z.string(),
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
     });
@@ -46037,7 +46110,7 @@ var require_dist_CcvXUhHK = __commonJS({
     var MediaFileLiteSchema = zod.z.object({
       key: zod.z.string(),
       kind: zod.z.string(),
-      base64: zod.z.string(),
+      url: zod.z.string(),
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
     });
@@ -53249,6 +53322,12 @@ var require_dist_CcvXUhHK = __commonJS({
         addonId: null,
         access: "view"
       },
+      "pipelineAnalytics.getEventMediaFootprintByKind": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.getEventStoreFootprint": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -53345,6 +53424,12 @@ var require_dist_CcvXUhHK = __commonJS({
         addonId: null,
         access: "view"
       },
+      "pipelineAnalytics.listEventMedia": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.listGroups": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -56908,6 +56993,11 @@ var require_dist_CcvXUhHK = __commonJS({
         form: "single",
         optional: false
       }],
+      "pipelineAnalytics.getEventMediaFootprintByKind": [{
+        name: "deviceId",
+        form: "single",
+        optional: true
+      }],
       "pipelineAnalytics.getGroup": [{
         name: "deviceId",
         form: "single",
@@ -56968,6 +57058,11 @@ var require_dist_CcvXUhHK = __commonJS({
         form: "array",
         optional: false
       }],
+      "pipelineAnalytics.listEventMedia": [{
+        name: "deviceId",
+        form: "single",
+        optional: false
+      }],
       "pipelineAnalytics.listGroups": [{
         name: "deviceIds",
         form: "array",
@@ -59112,7 +59207,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_CCIBlacf();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -59931,7 +60026,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_CCIBlacf();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -60025,7 +60120,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_CCIBlacf();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -60922,11 +61017,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-DXZ2xe7C.js
-var require_retired_settings_keys_DXZ2xe7C = __commonJS({
-  "../system/dist/retired-settings-keys-DXZ2xe7C.js"(exports) {
+// ../system/dist/retired-settings-keys-BxV3e2Km.js
+var require_retired_settings_keys_BxV3e2Km = __commonJS({
+  "../system/dist/retired-settings-keys-BxV3e2Km.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_CCIBlacf();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -63140,8 +63235,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
-    var require_retired_settings_keys = require_retired_settings_keys_DXZ2xe7C();
+    var require_dist10 = require_dist_CCIBlacf();
+    var require_retired_settings_keys = require_retired_settings_keys_BxV3e2Km();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -67954,7 +68049,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_CCIBlacf();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -68091,7 +68186,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_CCIBlacf();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -68281,7 +68376,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_CCIBlacf();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -76094,7 +76189,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_CCIBlacf();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -76659,7 +76754,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_CCIBlacf();
     var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
@@ -79281,7 +79376,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_CCIBlacf();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -80397,8 +80492,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
-    var require_retired_settings_keys = require_retired_settings_keys_DXZ2xe7C();
+    var require_dist10 = require_dist_CCIBlacf();
+    var require_retired_settings_keys = require_retired_settings_keys_BxV3e2Km();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -82777,7 +82872,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_CCIBlacf();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -83760,10 +83855,21 @@ var require_storage_orchestrator_addon = __commonJS({
         declareCollection: async (input) => (await engine()).declareCollection(input)
       };
     }
-    var EMPTY_SECRET_KEYS = /* @__PURE__ */ new Set();
+    var FRAMEWORK_CONFIG_KEYS = /* @__PURE__ */ new Set([
+      "basePath",
+      "readOnly",
+      "maxUsedGb",
+      "minFreePercent"
+    ]);
     function secretKeysOfProviderInfo(info) {
       return require_dist10.collectSecretConfigKeys(info.configSchema);
     }
+    function secretKeysForConfig(config, declared) {
+      if (declared !== void 0) return declared;
+      const out = /* @__PURE__ */ new Set();
+      for (const key of Object.keys(config)) if (!FRAMEWORK_CONFIG_KEYS.has(key)) out.add(key);
+      return out;
+    }
     function redactLocationConfig(config, secretKeys) {
       if (secretKeys.size === 0) return config;
       let touched = false;
@@ -84749,7 +84855,7 @@ var require_storage_orchestrator_addon = __commonJS({
           listLocationDeclarations: async () => service.listDeclarations(),
           upsertLocation: async (input) => {
             const stored = service.getLocationById(input.id);
-            const config = restoreRedactedSecrets(input.config, stored?.config, this.secretKeysFor(input.providerId));
+            const config = restoreRedactedSecrets(input.config, stored?.config, this.secretKeysFor(input.providerId, stored?.config ?? {}));
             const saved = service.upsertLocation(config === input.config ? input : {
               ...input,
               config
@@ -84782,11 +84888,14 @@ var require_storage_orchestrator_addon = __commonJS({
               } });
             });
           },
-          testConfig: async ({ providerId, config }) => {
+          testConfig: async ({ providerId, locationId, config }) => {
+            const stored = locationId === void 0 ? void 0 : service.getLocationById(locationId);
+            const base = stored?.providerId === providerId ? stored.config : void 0;
+            const resolved = restoreRedactedSecrets(config, base, this.secretKeysFor(providerId, base ?? {}));
             const providers = getProviders();
             for (const p of providers) try {
               if ((await p.getProviderInfo()).providerId !== providerId) continue;
-              return p.testLocation({ config });
+              return p.testLocation({ config: resolved });
             } catch (err) {
               return {
                 ok: false,
@@ -85106,13 +85215,21 @@ var require_storage_orchestrator_addon = __commonJS({
         }
         return out;
       }
-      /** Declared secret config keys for a provider; empty when unknown. */
-      secretKeysFor(providerId) {
-        return this.secretKeysByProvider.get(providerId) ?? EMPTY_SECRET_KEYS;
+      /**
+      * What the provider's own schema declared secret, or `undefined` when this
+      * node has never heard from that provider. The distinction is the whole
+      * point — see `secretKeysForConfig`, which fails CLOSED on `undefined`.
+      */
+      declaredSecretKeys(providerId) {
+        return this.secretKeysByProvider.get(providerId);
+      }
+      /** Which keys of a given stored config must never leave this process. */
+      secretKeysFor(providerId, config) {
+        return secretKeysForConfig(config, this.declaredSecretKeys(providerId));
       }
       /** A location with its provider's declared secrets replaced by the sentinel. */
       redacted(location) {
-        return redactLocation(location, this.secretKeysFor(location.providerId));
+        return redactLocation(location, this.secretKeysFor(location.providerId, location.config));
       }
       /**
       * Is this location backed by a provider that serves a genuine local
@@ -85352,7 +85469,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_CCIBlacf();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -103413,7 +103530,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_CCIBlacf();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -105356,9 +105473,9 @@ var require_event_category_BaEgqJNv = __commonJS({
   }
 });
 
-// ../types/dist/sleep-CWWLTM6W.js
-var require_sleep_CWWLTM6W = __commonJS({
-  "../types/dist/sleep-CWWLTM6W.js"(exports) {
+// ../types/dist/sleep-D5821NGq.js
+var require_sleep_D5821NGq = __commonJS({
+  "../types/dist/sleep-D5821NGq.js"(exports) {
     "use strict";
     var require_event_category = require_event_category_BaEgqJNv();
     var zod = require_zod();
@@ -108049,6 +108166,7 @@ var require_sleep_CWWLTM6W = __commonJS({
           deleteTracks: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "deleteTracks", "mutation", input),
           setTrackFlags: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "setTrackFlags", "mutation", input),
           getEventStoreFootprint: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getEventStoreFootprint", "query", input),
+          getEventMediaFootprintByKind: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getEventMediaFootprintByKind", "query", input),
           pruneEvents: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "pruneEvents", "mutation", input),
           deleteDeviceEvents: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "deleteDeviceEvents", "mutation", input),
           pauseForStorageMigration: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "pauseForStorageMigration", "mutation", input),
@@ -108080,6 +108198,7 @@ var require_sleep_CWWLTM6W = __commonJS({
           getEventMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getEventMedia", "query", input),
           getTrackMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getTrackMedia", "query", input),
           listTrackMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listTrackMedia", "query", input),
+          listEventMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listEventMedia", "query", input),
           searchObjectEvents: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "searchObjectEvents", "query", input),
           wipeObjectEmbeddings: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "wipeObjectEmbeddings", "mutation", input),
           rebuildObjectEmbeddings: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "rebuildObjectEmbeddings", "mutation", input),
@@ -109024,7 +109143,7 @@ var require_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_CWWLTM6W();
+    var require_sleep = require_sleep_D5821NGq();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -115906,12 +116025,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-system-deps-oJMkWSX-.js
-var require_manifest_system_deps_oJMkWSX = __commonJS({
-  "../system/dist/manifest-system-deps-oJMkWSX-.js"(exports) {
+// ../system/dist/manifest-system-deps-alrkBKVQ.js
+var require_manifest_system_deps_alrkBKVQ = __commonJS({
+  "../system/dist/manifest-system-deps-alrkBKVQ.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    require_dist_CcvXUhHK();
+    require_dist_CCIBlacf();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var _camstack_types_node = require_node();
@@ -127940,7 +128059,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CcvXUhHK();
+    var require_dist10 = require_dist_CCIBlacf();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -127966,7 +128085,7 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DO8KbxCe();
     var require_tls$1 = require_tls_BxQlomxd();
-    var require_manifest_system_deps = require_manifest_system_deps_oJMkWSX();
+    var require_manifest_system_deps = require_manifest_system_deps_alrkBKVQ();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -208178,6 +208297,19 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       * per-task abort timeout. On success the resolved `stagedPath` is returned; on
       * failure the task is marked `failed` and `null` is returned (so the apply
       * phase skips it). Other tasks are unaffected.
+      *
+      * **`toVersion` is REWRITTEN here, to the version that was actually
+      * fetched.** A task's `toVersion` starts as the REQUEST, and the request is
+      * routinely a dist-tag: `addons.updatePackage` with no version resolves to
+      * the literal `'latest'`. The staging area already resolves it — it reads
+      * the version out of the unpacked tarball and returns `resolvedVersion` —
+      * and dropping that answer sent the string `'latest'` onward as if it were a
+      * version. It became the manifest's recorded version, the version the Addons
+      * page displayed, and the `toVersion` on the `addon.updated` event, which an
+      * operator read on his phone as "@camstack/addon-terminal 0.0.0 → latest"
+      * (2026-08-30). Everything downstream of the apply reads a version; none of
+      * it can resolve a tag, and none of it could tell that it had been handed
+      * one.
       */
       async fetchAddonTask(job, task) {
         try {
@@ -208187,20 +208319,28 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
           });
           const ac = new AbortController();
           const timer = setTimeout(() => ac.abort(), this.deps.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS);
-          let stagedPath;
+          let staged;
           try {
-            stagedPath = (await this.deps.staging.fetchAndStage({
+            staged = await this.deps.staging.fetchAndStage({
               jobId: job.jobId,
               name: task.packageName,
               version: task.toVersion,
               signal: ac.signal
-            })).stagedPath;
+            });
           } finally {
             clearTimeout(timer);
           }
-          this.advance(job.jobId, task, "staged", { stagedPath });
+          const stagedPath = staged.stagedPath;
+          const resolved = {
+            ...task,
+            toVersion: staged.resolvedVersion
+          };
+          this.advance(job.jobId, task, "staged", {
+            stagedPath,
+            toVersion: resolved.toVersion
+          });
           return {
-            task,
+            task: resolved,
             stagedPath
           };
         } catch (err) {
@@ -208769,7 +208909,7 @@ var require_dist4 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_CWWLTM6W();
+    var require_sleep = require_sleep_D5821NGq();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -216951,6 +217091,80 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         getInfo: require_sleep.method(zod.z.void(), EmbeddingInfoSchema, { auth: "admin" })
       }
     };
+    var FailureReasonCountSchema = zod.z.object({
+      /**
+      * Why the attempt did not land, in the contributor's own vocabulary —
+      * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
+      * strings that already appear in this repo's logs and, where one exists, the
+      * same string the per-track `previewMissReason` records (D276): a second
+      * vocabulary for the same loss would make the row and the counter
+      * un-joinable.
+      */
+      reason: zod.z.string(),
+      count: zod.z.number().int().nonnegative()
+    });
+    var FailureContributionSchema = zod.z.object({
+      /**
+      * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
+      * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
+      * `unit` free: the families are owned by different addons and a shared enum
+      * is a central list that rots invisibly.
+      */
+      family: zod.z.string(),
+      /**
+      * The NUMERIC device id — the same value every log line carries as
+      * `tags.deviceId`. Never nullable and never absent: a contributor that
+      * cannot name the camera must not emit the entry, because a fleet total
+      * cannot answer the only question anybody asks of this surface.
+      */
+      deviceId: zod.z.number().int().positive(),
+      /**
+      * A second dimension inside the family: the model / step id for an inference
+      * timeout, so "which camera AND which model" is one read. Absent when the
+      * family has a single variant.
+      */
+      variant: zod.z.string().optional(),
+      /**
+      * Epoch ms this counter started — the INCARNATION MARKER. A consumer
+      * differencing two reads must drop the interval when it changes, because the
+      * counter restarted from zero in a respawned runner. Same discipline as
+      * `LoadContribution.startedAtMs`.
+      */
+      sinceMs: zod.z.number(),
+      /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
+      atMs: zod.z.number(),
+      /**
+      * THE DENOMINATOR — every attempt on this path for this camera in the
+      * window. A failure count published without it is the mistake this schema
+      * exists to make impossible.
+      */
+      attempts: zod.z.number().int().nonnegative(),
+      /** Attempts that landed. `attempts - succeeded` is the loss. */
+      succeeded: zod.z.number().int().nonnegative(),
+      /** The loss, partitioned. Sums to `attempts - succeeded`. */
+      reasons: zod.z.array(FailureReasonCountSchema).readonly()
+    });
+    var failureContributionCapability = {
+      name: "failure-contribution",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        /**
+        * This addon's per-camera failure counters, read live from bounded in-RAM
+        * state it already keeps. Inert: no persistence, no sampling, no timer.
+        *
+        * READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
+        * consumer that wants a rate differences two reads. A draining read would
+        * make two operators with the page open each destroy half of the other's
+        * numbers, and `load-contribution` already settled the same question the
+        * same way for `cpuSeconds`.
+        */
+        list: require_sleep.method(zod.z.void(), zod.z.array(FailureContributionSchema).readonly())
+      },
+      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+      mount: { kind: "skip" }
+    };
     var DirEntrySchema = zod.z.object({
       name: zod.z.string(),
       path: zod.z.string()
@@ -217495,145 +217709,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         })
       }
     };
-    var LogChannelApplyResultSchema = zod.z.object({
-      /** How many declared channels are armed in this process after the call. */
-      armed: zod.z.number().int().min(0),
-      /**
-      * Names the document armed that this process does not declare. Reported
-      * rather than swallowed: a name here is either a typo or an addon that has
-      * not booted, and both deserve a line instead of silence.
-      */
-      unknown: zod.z.array(zod.z.string()).readonly()
-    });
-    var logChannelsCapability = {
-      name: "log-channels",
-      scope: "system",
-      mode: "collection",
-      internal: true,
-      methods: {
-        /** The channels this addon declares. Inert: no value, no state. */
-        list: require_sleep.method(zod.z.void(), zod.z.array(LogChannelDescriptorSchema).readonly()),
-        /**
-        * Refresh this process's mirror from the document's FULL set of armed
-        * windows.
-        *
-        * Full and not incremental on purpose: the document is the authority, so a
-        * channel it does not name is disarmed here. An incremental apply would
-        * let a disarm get lost in transit and leave a channel running that
-        * nobody can see is running.
-        */
-        apply: require_sleep.method(zod.z.object({ windows: zod.z.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
-      },
-      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
-      mount: { kind: "skip" }
-    };
-    var LogLevelSchema = zod.z.enum([
-      "debug",
-      "info",
-      "warn",
-      "error"
-    ]);
-    var LogEntrySchema = zod.z.object({
-      timestamp: zod.z.date(),
-      level: LogLevelSchema,
-      scope: zod.z.array(zod.z.string()),
-      message: zod.z.string(),
-      meta: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-      tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
-    });
-    var logDestinationCapability = {
-      name: "log-destination",
-      scope: "system",
-      mode: "collection",
-      internal: true,
-      methods: {
-        write: require_sleep.method(LogEntrySchema, zod.z.void(), { kind: "mutation" }),
-        query: require_sleep.method(zod.z.object({
-          scope: zod.z.array(zod.z.string()).optional(),
-          level: LogLevelSchema.optional(),
-          since: zod.z.date().optional(),
-          until: zod.z.date().optional(),
-          limit: zod.z.number().optional(),
-          tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
-        }), zod.z.array(LogEntrySchema).readonly())
-      },
-      /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
-      mount: { kind: "skip" }
-    };
-    var FailureReasonCountSchema = zod.z.object({
-      /**
-      * Why the attempt did not land, in the contributor's own vocabulary —
-      * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
-      * strings that already appear in this repo's logs and, where one exists, the
-      * same string the per-track `previewMissReason` records (D276): a second
-      * vocabulary for the same loss would make the row and the counter
-      * un-joinable.
-      */
-      reason: zod.z.string(),
-      count: zod.z.number().int().nonnegative()
-    });
-    var FailureContributionSchema = zod.z.object({
-      /**
-      * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
-      * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
-      * `unit` free: the families are owned by different addons and a shared enum
-      * is a central list that rots invisibly.
-      */
-      family: zod.z.string(),
-      /**
-      * The NUMERIC device id — the same value every log line carries as
-      * `tags.deviceId`. Never nullable and never absent: a contributor that
-      * cannot name the camera must not emit the entry, because a fleet total
-      * cannot answer the only question anybody asks of this surface.
-      */
-      deviceId: zod.z.number().int().positive(),
-      /**
-      * A second dimension inside the family: the model / step id for an inference
-      * timeout, so "which camera AND which model" is one read. Absent when the
-      * family has a single variant.
-      */
-      variant: zod.z.string().optional(),
-      /**
-      * Epoch ms this counter started — the INCARNATION MARKER. A consumer
-      * differencing two reads must drop the interval when it changes, because the
-      * counter restarted from zero in a respawned runner. Same discipline as
-      * `LoadContribution.startedAtMs`.
-      */
-      sinceMs: zod.z.number(),
-      /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
-      atMs: zod.z.number(),
-      /**
-      * THE DENOMINATOR — every attempt on this path for this camera in the
-      * window. A failure count published without it is the mistake this schema
-      * exists to make impossible.
-      */
-      attempts: zod.z.number().int().nonnegative(),
-      /** Attempts that landed. `attempts - succeeded` is the loss. */
-      succeeded: zod.z.number().int().nonnegative(),
-      /** The loss, partitioned. Sums to `attempts - succeeded`. */
-      reasons: zod.z.array(FailureReasonCountSchema).readonly()
-    });
-    var failureContributionCapability = {
-      name: "failure-contribution",
-      scope: "system",
-      mode: "collection",
-      internal: true,
-      methods: {
-        /**
-        * This addon's per-camera failure counters, read live from bounded in-RAM
-        * state it already keeps. Inert: no persistence, no sampling, no timer.
-        *
-        * READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
-        * consumer that wants a rate differences two reads. A draining read would
-        * make two operators with the page open each destroy half of the other's
-        * numbers, and `load-contribution` already settled the same question the
-        * same way for `cpuSeconds`.
-        */
-        list: require_sleep.method(zod.z.void(), zod.z.array(FailureContributionSchema).readonly())
-      },
-      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
-      mount: { kind: "skip" }
-    };
     var LOAD_CONTRIBUTION_ROLES = [
       "decode",
       "transcode",
@@ -217713,6 +217788,71 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** In-process only — enumerated through `addons.listCapabilityProviders`. */
       mount: { kind: "skip" }
     };
+    var LogChannelApplyResultSchema = zod.z.object({
+      /** How many declared channels are armed in this process after the call. */
+      armed: zod.z.number().int().min(0),
+      /**
+      * Names the document armed that this process does not declare. Reported
+      * rather than swallowed: a name here is either a typo or an addon that has
+      * not booted, and both deserve a line instead of silence.
+      */
+      unknown: zod.z.array(zod.z.string()).readonly()
+    });
+    var logChannelsCapability = {
+      name: "log-channels",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        /** The channels this addon declares. Inert: no value, no state. */
+        list: require_sleep.method(zod.z.void(), zod.z.array(LogChannelDescriptorSchema).readonly()),
+        /**
+        * Refresh this process's mirror from the document's FULL set of armed
+        * windows.
+        *
+        * Full and not incremental on purpose: the document is the authority, so a
+        * channel it does not name is disarmed here. An incremental apply would
+        * let a disarm get lost in transit and leave a channel running that
+        * nobody can see is running.
+        */
+        apply: require_sleep.method(zod.z.object({ windows: zod.z.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
+      },
+      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+      mount: { kind: "skip" }
+    };
+    var LogLevelSchema = zod.z.enum([
+      "debug",
+      "info",
+      "warn",
+      "error"
+    ]);
+    var LogEntrySchema = zod.z.object({
+      timestamp: zod.z.date(),
+      level: LogLevelSchema,
+      scope: zod.z.array(zod.z.string()),
+      message: zod.z.string(),
+      meta: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+      tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
+    });
+    var logDestinationCapability = {
+      name: "log-destination",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        write: require_sleep.method(LogEntrySchema, zod.z.void(), { kind: "mutation" }),
+        query: require_sleep.method(zod.z.object({
+          scope: zod.z.array(zod.z.string()).optional(),
+          level: LogLevelSchema.optional(),
+          since: zod.z.date().optional(),
+          until: zod.z.date().optional(),
+          limit: zod.z.number().optional(),
+          tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
+        }), zod.z.array(LogEntrySchema).readonly())
+      },
+      /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+      mount: { kind: "skip" }
+    };
     var LoginStageEnum = zod.z.enum(["primary", "second-factor"]);
     var RedirectLoginMethodSchema = zod.z.object({
       kind: zod.z.literal("redirect"),
@@ -222600,13 +222740,18 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "keyFrameSmall",
       "thumbnailSmall"
     ]);
-    var MediaFileSchema = zod.z.object({
+    var MediaFileRefSchema = zod.z.object({
       key: zod.z.string(),
       kind: MediaFileKindEnum,
-      base64: zod.z.string(),
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
     });
+    var MediaFileSchema = MediaFileRefSchema.extend({
+      /** `/addon/<addonId>/event-media/<encoded stored key>`. Always present. */
+      url: zod.z.string(),
+      /** @deprecated Transitional — see the schema docblock. Use {@link url}. */
+      base64: zod.z.string()
+    });
     var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
     var RetrainMacroClassSchema = zod.z.enum([
       "person",
@@ -222913,6 +223058,25 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       totalBytes: zod.z.number().int(),
       devices: zod.z.array(EventStoreDeviceFootprintSchema).readonly()
     });
+    var EventMediaKindFootprintSchema = zod.z.object({
+      kind: MediaFileKindEnum,
+      /** Media rows of this kind. */
+      rows: zod.z.number().int(),
+      /** Bytes on disk held by those rows. */
+      bytes: zod.z.number().int()
+    });
+    var EventMediaKindBreakdownSchema = zod.z.object({
+      /** Every media row in scope, from one unfiltered aggregate. */
+      totalRows: zod.z.number().int(),
+      /** Every media byte in scope, from that same aggregate. */
+      totalBytes: zod.z.number().int(),
+      /** Per-kind footprint, ordered by bytes descending. */
+      kinds: zod.z.array(EventMediaKindFootprintSchema).readonly(),
+      /** `totalRows` minus the summed `kinds` rows — see the schema note. */
+      unaccountedRows: zod.z.number().int(),
+      /** `totalBytes` minus the summed `kinds` bytes — see the schema note. */
+      unaccountedBytes: zod.z.number().int()
+    });
     var EventPruneCountsSchema = zod.z.object({
       motion: zod.z.number().int(),
       object: zod.z.number().int(),
@@ -223268,6 +223432,22 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           auth: "admin"
         }),
         /**
+        * The same media footprint, broken down by {@link MediaFileKind} instead of
+        * by camera — fleet-wide, or for one camera with `deviceId`.
+        *
+        * Separate from {@link getEventStoreFootprint} rather than a field on it:
+        * the two answer different questions on different axes, the per-camera one
+        * is what the management table renders on every open, and nothing should
+        * pay for a per-kind pass to draw it. See
+        * {@link EventMediaKindBreakdownSchema} for why `unaccounted*` exists —
+        * `kinds` is enumerated, `totalBytes` is not, and the gap must be visible
+        * to anyone sizing a deletion against it.
+        */
+        getEventMediaFootprintByKind: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int().optional() }), EventMediaKindBreakdownSchema, {
+          kind: "query",
+          auth: "admin"
+        }),
+        /**
         * Cluster-wide prune of events older than `olderThanMs` (exclusive) across
         * every camera, deleting each event's media in lockstep. Logged to the
         * events ops-log with `reason` (default `'retention'`). Returns the summed
@@ -223672,6 +223852,26 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           deviceId: zod.z.number()
         }), zod.z.array(MediaFileInfoSchema).readonly()),
         /**
+        * What media an EVENT has, without any of it — the twin `getEventMedia`
+        * never had.
+        *
+        * `listTrackMedia` above got this treatment because a track's media is
+        * 5-8 MB. An event's is worse per row, not better: an old-style event owns
+        * a `crop` AND a native-resolution `fullFrameBoxed`, and the track DETAIL
+        * modal — the one surface that legitimately shows the big kinds — unions
+        * both listings to build its filmstrip. It then renders every tile from
+        * the `event-media` plane by key and throws the bytes away. Measured on
+        * the live hub: one event's `fullFrameBoxed` is 2 824 077 B, base64'd to
+        * ~3.8 MB, allocated whole in hub-main's heap, for a list of keys.
+        *
+        * Same `deviceId` authorization subject as `getEventMedia`, and the same
+        * rows — this is a projection of that method, never a different question.
+        */
+        listEventMedia: require_sleep.method(zod.z.object({
+          eventId: zod.z.string(),
+          deviceId: zod.z.number()
+        }), zod.z.array(MediaFileInfoSchema).readonly()),
+        /**
         * Search object events by text query using CLIP cosine similarity.
         * Encodes `text` via the `embedding-encoder` cap, queries the
         * `ObjectEmbeddingStore` with optional prefilters, ranks all matching
@@ -226010,6 +226210,20 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         listProviders: require_sleep.method(zod.z.void(), zod.z.array(ProviderListEntrySchema).readonly()),
         testConfig: require_sleep.method(zod.z.object({
           providerId: zod.z.string(),
+          /**
+          * The location this config is an UNSAVED edit of, when there is one.
+          *
+          * `listLocations` replaces every declared secret with the redaction
+          * sentinel, so the edit modal's form state holds the sentinel for any
+          * credential the operator did not retype — and posting that here
+          * without a way to resolve it makes the provider try to authenticate
+          * as `__camstack_redacted__` and report the operator's own working
+          * password as wrong. Given this id, the orchestrator restores each
+          * sentinel from the stored config (same rule as `upsertLocation`)
+          * before dispatching. Omitted by the "Add location" wizard, where
+          * every value was typed just now and nothing is stored yet.
+          */
+          locationId: zod.z.string().optional(),
           config: zod.z.record(zod.z.string(), zod.z.unknown())
         }), zod.z.object({
           ok: zod.z.boolean(),
@@ -229134,7 +229348,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     var MediaFileLiteSchema$1 = zod.z.object({
       key: zod.z.string(),
       kind: zod.z.string(),
-      base64: zod.z.string(),
+      url: zod.z.string(),
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
     });
@@ -232029,7 +232243,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     var MediaFileLiteSchema = zod.z.object({
       key: zod.z.string(),
       kind: zod.z.string(),
-      base64: zod.z.string(),
+      url: zod.z.string(),
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
     });
@@ -242181,6 +242395,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "pipelineAnalytics.getEventMediaFootprintByKind": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.getEventStoreFootprint": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -242277,6 +242497,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "pipelineAnalytics.listEventMedia": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.listGroups": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -246098,6 +246324,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         form: "single",
         optional: false
       }],
+      "pipelineAnalytics.getEventMediaFootprintByKind": [{
+        name: "deviceId",
+        form: "single",
+        optional: true
+      }],
       "pipelineAnalytics.getGroup": [{
         name: "deviceId",
         form: "single",
@@ -246158,6 +246389,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         form: "array",
         optional: false
       }],
+      "pipelineAnalytics.listEventMedia": [{
+        name: "deviceId",
+        form: "single",
+        optional: false
+      }],
       "pipelineAnalytics.listGroups": [{
         name: "deviceIds",
         form: "array",
@@ -251198,6 +251434,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.MaskShapeKindSchema = MaskShapeKindSchema;
     exports.MaskShapeSchema = MaskShapeSchema;
     exports.MediaFileInfoSchema = MediaFileInfoSchema;
+    exports.MediaFileKindEnum = MediaFileKindEnum;
+    exports.MediaFileRefSchema = MediaFileRefSchema;
     exports.MediaFileSchema = MediaFileSchema;
     exports.MediaPlayerRepeatSchema = MediaPlayerRepeatSchema;
     exports.MediaPlayerStateSchema = MediaPlayerStateSchema;
@@ -402904,7 +403142,7 @@ var require_addon_package_service = __commonJS({
             this.requireInstaller();
             const addonInstaller = this.installer;
             const previousVersion = this.getInstalledPackageVersion(name);
-            const isFirstInstall = !previousVersion;
+            const isFirstInstall = previousVersion === null;
             let result;
             if (isFirstInstall) {
               const r = await addonInstaller.installFromNpm(name, version);
@@ -402930,12 +403168,13 @@ var require_addon_package_service = __commonJS({
           const targetDir = path.join(addonsDir, dirName);
           const packageSpec = version ? `${name}@${version}` : name;
           await installPackageFromNpm(packageSpec, targetDir);
-          updatedVersion = this.getInstalledPackageVersion(name);
+          const installedVersion = this.getInstalledPackageVersion(name);
+          updatedVersion = installedVersion ?? "";
           this.cachedUpdates = null;
           this.logger.info("Core package updated -- restart required", {
-            meta: { name, updatedVersion }
+            meta: { name, updatedVersion: installedVersion }
           });
-          this.sendUpdateNotification(name, updatedVersion);
+          this.sendUpdateNotification(name, installedVersion);
           return { success: true, version: updatedVersion, requiresRestart: true };
         } catch (error) {
           const msg = (0, types_1.errMsg)(error);
@@ -403622,36 +403861,39 @@ var require_addon_package_service = __commonJS({
       // Private: general helpers
       // =========================================================================
       /**
-       * Read the currently installed version of a package.
-       * Checks data/addons/ first, then falls back to Node module resolution.
-       * Returns '0.0.0' if not found.
+       * The version of `packageName` INSTALLED RIGHT NOW, or `null` when the hub
+       * has no readable copy.
+       *
+       * Delegates to the installer, which is the one place that knows the on-disk
+       * layout (`<addonsDir>/@camstack/<pkg>/`, with the pre-scope flat form as a
+       * fallback). This method used to restate that path and got it wrong —
+       * `packageName.replace(/^@camstack\//, '')` looked ONLY in the flat form, so
+       * every scoped install missed. It then fell back to
+       * `require.resolve('<pkg>/package.json')`, which cannot succeed either: an
+       * addon is installed under the data directory, not in the hub's own
+       * node_modules. Both misses landed on the literal `'0.0.0'`, and that string
+       * was published on the `addon.updated` event as the version the operator had
+       * been running ("@camstack/addon-terminal 0.0.0 → latest", 2026-08-30).
+       *
+       * `null`, not `'0.0.0'`: a version nobody installed is indistinguishable
+       * from one that was, and the caller must be forced to decide what to say
+       * about "unknown" rather than inherit a number that looks like an answer.
        */
       getInstalledPackageVersion(packageName) {
         try {
-          const addonsDir = this.resolveAddonsDir();
-          const dirName = packageName.replace(/^@camstack\//, "");
-          const pkgJsonPath = path.join(addonsDir, dirName, "package.json");
-          if (fs.existsSync(pkgJsonPath)) {
-            const pkgJson = readJsonObject(pkgJsonPath);
-            const v = asString(pkgJson?.["version"]);
-            if (v)
-              return v;
-          }
-        } catch (err) {
-          this.logger.debug("Version lookup via fs failed, trying require.resolve", {
-            meta: { packageName, error: (0, types_1.errMsg)(err) }
-          });
-        }
-        try {
-          const pkgJsonPath = __require.resolve(`${packageName}/package.json`);
-          const pkgJson = readJsonObject(pkgJsonPath);
-          return asString(pkgJson?.["version"], "0.0.0");
+          const installed = this.installer?.getInstalledPackage(packageName) ?? null;
+          const version = installed === null ? "" : asString(installed.version);
+          if (version)
+            return version;
         } catch (err) {
-          this.logger.debug("Could not resolve version, returning 0.0.0", {
+          this.logger.debug("Installed-version lookup failed", {
             meta: { packageName, error: (0, types_1.errMsg)(err) }
           });
-          return "0.0.0";
         }
+        this.logger.debug("No readable installed copy \u2014 previous version is unknown", {
+          meta: { packageName }
+        });
+        return null;
       }
       /** Only allow @camstack/* scoped packages */
       isAllowedPackage(name) {
@@ -403703,11 +403945,18 @@ var require_addon_package_service = __commonJS({
           throw new Error("AddonInstaller is not available -- @camstack/system may not be installed");
         }
       }
-      /** Send notification and toast for a successful package update */
+      /**
+       * Send notification and toast for a successful package update.
+       *
+       * `version === null` means the hub could not read back what it just
+       * installed. The sentence then says the package was updated and stops —
+       * never "updated to v0.0.0", which reads as a real version.
+       */
       sendUpdateNotification(name, version) {
+        const sentence = version === null ? `${name} updated` : `${name} updated to v${version}`;
         this.notificationService.notify({
           title: "Package Updated",
-          body: `${name} updated to v${version}`,
+          body: sentence,
           format: "text",
           priority: 3,
           category: "system",
@@ -403718,7 +403967,7 @@ var require_addon_package_service = __commonJS({
         });
         this.toastService.broadcast({
           title: "Package Updated",
-          message: `${name} updated to v${version}`,
+          message: sentence,
           severity: "info",
           duration: 5e3
         });
@@ -417257,6 +417506,7 @@ var require_addon_registry_service = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.AddonRegistryService = void 0;
     exports.shouldEvictMissingOnDisk = shouldEvictMissingOnDisk;
+    exports.addonUpdatePayload = addonUpdatePayload;
     exports.shouldEmitProviderRegisteredReady = shouldEmitProviderRegisteredReady;
     var node_crypto_1 = __require("crypto");
     var fs = __importStar(__require("fs"));
@@ -417279,6 +417529,12 @@ var require_addon_registry_service = __commonJS({
     function shouldEvictMissingOnDisk(entry, id, onDiskIds) {
       return entry.source === "installed" && entry.packageName !== "@camstack/system" && !onDiskIds.has(id);
     }
+    function addonUpdatePayload(fromVersion, toVersion) {
+      return {
+        ...fromVersion !== null ? { fromVersion } : {},
+        toVersion
+      };
+    }
     function isSettingsStore(backend) {
       const required = [
         "getSystem",
@@ -418354,14 +418610,17 @@ var require_addon_registry_service = __commonJS({
         this.healthMonitor.forget(packageName);
         this.addonLoader.clearLoadFailures(packageName);
       }
-      /** Emit addon.updated lifecycle event for all addons belonging to a package */
+      /**
+       * Emit `addon.updated` for every addon belonging to a package.
+       *
+       * The payload shape is {@link addonUpdatePayload} — an unknown predecessor
+       * is an ABSENT key, never a placeholder.
+       */
       emitUpdateEvent(packageName, fromVersion, toVersion) {
+        const payload = addonUpdatePayload(fromVersion, toVersion);
         for (const [id, entry] of this.addonEntries) {
           if (entry.packageName === packageName) {
-            this.emitAddonLifecycleEvent("addon.updated", id, {
-              fromVersion,
-              toVersion
-            });
+            this.emitAddonLifecycleEvent("addon.updated", id, payload);
           }
         }
       }