@camstack/addon-tailscale 1.1.26 → 1.1.28

package/dist/client/tailscale.addon.js

@@ -24,7 +24,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-const require_dist = require("../dist-AxWhb5Uh.js");
+const require_dist = require("../dist-CPFhFQVO.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_fs = require("node:fs");

package/dist/client/tailscale.addon.mjs

@@ -1,4 +1,4 @@
-import { i as EventCategory, n as networkAccessCapability, r as BaseAddon, t as meshNetworkCapability } from "../dist-D7Ao4Euk.mjs";
+import { i as EventCategory, n as networkAccessCapability, r as BaseAddon, t as meshNetworkCapability } from "../dist-C_oio-xb.mjs";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import * as fs from "node:fs";

package/dist/{dist-AxWhb5Uh.js → dist-CPFhFQVO.js}

@@ -7327,6 +7327,62 @@ var RecordingConfigSchema = object({
 	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
 });
 /**
+* Ops-log — the durable, append-only operations audit shared by the
+* recordings and events management surfaces.
+*
+* ONE row shape is reused for both domains so a single "Activity" view can
+* merge the recorder's DurableState ring (recordings ops-log) and the
+* pipeline-analytics SQLite collection (events ops-log). Each row records a
+* management operation, WHY it ran (reason), and its measurable effect
+* (itemsAffected + bytesReclaimed). Writes are best-effort — a failed log must
+* never fail the operation it records.
+*/
+/** Which management domain the operation belongs to. */
+var OpsLogDomainSchema = _enum(["recording", "events"]);
+/** The kind of management operation performed. */
+var OpsLogOpSchema = _enum([
+	"prune",
+	"manual-delete",
+	"rescan",
+	"retention-run"
+]);
+/** Why the operation ran. */
+var OpsLogReasonSchema = _enum([
+	"retention",
+	"quota",
+	"manual",
+	"operator"
+]);
+/** One audit row, shared verbatim by both domains. */
+var OpsLogEntrySchema = object({
+	/** Unique row id. */
+	id: string(),
+	/** Epoch ms the operation completed. */
+	at: number(),
+	domain: OpsLogDomainSchema,
+	op: OpsLogOpSchema,
+	reason: OpsLogReasonSchema,
+	/** The camera the op targeted; null for a cluster/global op. */
+	deviceId: number().nullable(),
+	/** Node that performed the op (the log carries nodeId — no cross-node aggregation). */
+	nodeId: string(),
+	/** Buckets / rows deleted (op-specific unit). */
+	itemsAffected: number(),
+	/** Bytes reclaimed by the op (0 when not measurable). */
+	bytesReclaimed: number(),
+	/** Free-text detail (e.g. "floor moved to <ts>"); null when none. */
+	detail: string().nullable(),
+	/** Who/what triggered the op. */
+	actor: string()
+});
+/** Shared query input for the per-domain `listOpsLog` cap methods. */
+var OpsLogQueryInputSchema = object({
+	/** Restrict to a single camera; omit for every row. */
+	deviceId: number().optional(),
+	/** Max rows returned, newest-first. */
+	limit: number().int().min(1).max(1e3).optional()
+});
+/**
 * `StorageLocationType` — an addon-declared id that identifies the *kind* of
 * storage a location serves. Defined here (not in `capabilities/storage.cap.ts`)
 * so the persisted record schema and the consumer-facing cap can both consume it
@@ -7570,6 +7626,160 @@ var EncodeProfileSchema = object({
 	*/
 	outputArgs: array(string()).optional()
 });
+var COCO_TO_MACRO = {
+	mapping: {
+		person: "person",
+		bicycle: "vehicle",
+		car: "vehicle",
+		motorcycle: "vehicle",
+		airplane: "vehicle",
+		bus: "vehicle",
+		train: "vehicle",
+		truck: "vehicle",
+		boat: "vehicle",
+		bird: "animal",
+		cat: "animal",
+		dog: "animal",
+		horse: "animal",
+		sheep: "animal",
+		cow: "animal",
+		elephant: "animal",
+		bear: "animal",
+		zebra: "animal",
+		giraffe: "animal",
+		suitcase: "package",
+		backpack: "package",
+		handbag: "package"
+	},
+	preserveOriginal: false
+};
+var AUDIO_MACRO_LABELS = [
+	{
+		id: "speech",
+		name: "Speech",
+		icon: "🗣️"
+	},
+	{
+		id: "scream",
+		name: "Scream / Shout",
+		icon: "😱"
+	},
+	{
+		id: "crying",
+		name: "Crying / Baby",
+		icon: "😢"
+	},
+	{
+		id: "laughter",
+		name: "Laughter",
+		icon: "😂"
+	},
+	{
+		id: "music",
+		name: "Music",
+		icon: "🎵"
+	},
+	{
+		id: "dog",
+		name: "Dog",
+		icon: "🐕"
+	},
+	{
+		id: "cat",
+		name: "Cat",
+		icon: "🐈"
+	},
+	{
+		id: "bird",
+		name: "Bird",
+		icon: "🐦"
+	},
+	{
+		id: "animal",
+		name: "Animal (other)",
+		icon: "🐾"
+	},
+	{
+		id: "alarm",
+		name: "Alarm / Siren",
+		icon: "🚨"
+	},
+	{
+		id: "doorbell",
+		name: "Doorbell / Knock",
+		icon: "🔔"
+	},
+	{
+		id: "glass_breaking",
+		name: "Glass Breaking",
+		icon: "💥"
+	},
+	{
+		id: "gunshot",
+		name: "Gunshot / Explosion",
+		icon: "💣"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle",
+		icon: "🚗"
+	},
+	{
+		id: "siren",
+		name: "Emergency Siren",
+		icon: "🚑"
+	},
+	{
+		id: "fire",
+		name: "Fire / Smoke",
+		icon: "🔥"
+	},
+	{
+		id: "water",
+		name: "Water",
+		icon: "💧"
+	},
+	{
+		id: "wind",
+		name: "Wind / Weather",
+		icon: "🌬️"
+	},
+	{
+		id: "door",
+		name: "Door",
+		icon: "🚪"
+	},
+	{
+		id: "footsteps",
+		name: "Footsteps",
+		icon: "👣"
+	},
+	{
+		id: "crowd",
+		name: "Crowd / Chatter",
+		icon: "👥"
+	},
+	{
+		id: "telephone",
+		name: "Telephone",
+		icon: "📞"
+	},
+	{
+		id: "engine",
+		name: "Engine / Motor",
+		icon: "⚙️"
+	},
+	{
+		id: "tools",
+		name: "Tools / Construction",
+		icon: "🔨"
+	},
+	{
+		id: "silence",
+		name: "Silence",
+		icon: "🤫"
+	}
+];
 var YAMNET_TO_MACRO = {
 	mapping: {
 		Speech: "speech",
@@ -7836,6 +8046,125 @@ var _macroLookup = /* @__PURE__ */ new Map();
 for (const [k, v] of Object.entries(YAMNET_TO_MACRO.mapping)) _macroLookup.set(k.toLowerCase(), v);
 for (const [k, v] of Object.entries(APPLE_SA_TO_MACRO.mapping)) _macroLookup.set(k.toLowerCase(), v);
 /**
+* Unified event-kind taxonomy — THE single source of truth for
+* `kind → { parentKind, category, level, color, iconId, labelKey, label,
+* icon }`.
+*
+* This dictionary folds together what used to be scattered across four
+* copies:
+*   - `capabilities/sensor-event-kinds.ts` (sensor cap colors)
+*   - `addon-post-analysis/.../services/event-kinds.ts`
+*     (MOTION/PERSON/VEHICLE… _COLOR constants)
+*   - `ui-library/composites/detection-colors.ts` (CLASS_COLORS)
+*   - `addon-post-analysis/shared/frame/box-drawer.ts` (DEFAULT_COLOR)
+*   - the COCO / audio class maps (macro ↔ sub relationships)
+*
+* The DATA (serializable — color/iconId/labelKey/parentKind) lives here in
+* `@camstack/types`. The UI-side mapping `iconId → lucide component` and
+* `labelKey → t()` lives in `@camstack/ui-library`. UIs never hardcode a
+* color or an icon: they read this dictionary (server descriptors carry the
+* fields inline; the client resolves color/icon/label from `iconId`/`kind`).
+*
+* Two levels only (v1 YAGNI): macro → sub. `person` is a leaf macro.
+*/
+var TAXONOMY_COLORS = {
+	motion: "#f59e0b",
+	audio: "#06b6d4",
+	person: "#22c55e",
+	vehicle: "#3b82f6",
+	animal: "#f97316",
+	package: "#a855f7",
+	sensor: "#8b5cf6",
+	control: "#10b981",
+	genericDetection: "#64748b"
+};
+var DETECTION_SUB_COLORS = {
+	car: "#f59e0b",
+	truck: "#d97706",
+	bus: "#b45309",
+	motorcycle: "#eab308",
+	bicycle: "#ca8a04",
+	airplane: "#60a5fa",
+	boat: "#2563eb",
+	train: "#1d4ed8",
+	bird: "#14b8a6",
+	dog: "#84cc16",
+	cat: "#f97316",
+	horse: "#a16207",
+	sheep: "#a3a3a3",
+	cow: "#78716c",
+	elephant: "#6b7280",
+	bear: "#7c2d12",
+	zebra: "#404040",
+	giraffe: "#d4a373"
+};
+function titleCase(id) {
+	return id.split(/[-_ ]/).filter((p) => p.length > 0).map((p) => p.charAt(0).toUpperCase() + p.slice(1)).join(" ");
+}
+var entries = /* @__PURE__ */ new Map();
+function macro(kind, category, color, iconId, label) {
+	entries.set(kind, {
+		kind,
+		parentKind: null,
+		level: "macro",
+		category,
+		color,
+		iconId,
+		labelKey: `eventKind.${kind}`,
+		label
+	});
+}
+function sub(kind, parentKind, category, color, iconId, label) {
+	entries.set(kind, {
+		kind,
+		parentKind,
+		level: "sub",
+		category,
+		color,
+		iconId,
+		labelKey: `eventKind.${kind}`,
+		label
+	});
+}
+macro("motion", "motion", TAXONOMY_COLORS.motion, "motion", "Motion");
+macro("audio", "audio", TAXONOMY_COLORS.audio, "audio", "Audio");
+macro("person", "detection", TAXONOMY_COLORS.person, "person", "Person");
+macro("vehicle", "detection", TAXONOMY_COLORS.vehicle, "vehicle", "Vehicle");
+macro("animal", "detection", TAXONOMY_COLORS.animal, "animal", "Animal");
+macro("package", "package", TAXONOMY_COLORS.package, "package", "Package");
+macro("sensor", "sensor", TAXONOMY_COLORS.sensor, "sensor", "Sensor");
+macro("control", "control", TAXONOMY_COLORS.control, "control", "Control");
+for (const [cocoClass, macroClass] of Object.entries(COCO_TO_MACRO.mapping)) {
+	if (macroClass !== "vehicle" && macroClass !== "animal") continue;
+	if (entries.has(cocoClass)) continue;
+	sub(cocoClass, macroClass, "detection", DETECTION_SUB_COLORS[cocoClass] ?? TAXONOMY_COLORS.genericDetection, cocoClass, titleCase(cocoClass));
+}
+sub("package-delivered", "package", "package", TAXONOMY_COLORS.package, "package", "Package delivered");
+sub("package-picked-up", "package", "package", TAXONOMY_COLORS.package, "package", "Package picked up");
+sub("contact", "sensor", "sensor", "#f59e0b", "door", "Contact");
+sub("motion-sensor", "sensor", "sensor", TAXONOMY_COLORS.sensor, "pir", "Motion sensor");
+sub("smoke", "sensor", "sensor", "#ef4444", "smoke", "Smoke");
+sub("flood", "sensor", "sensor", "#3b82f6", "water", "Water leak");
+sub("gas", "sensor", "sensor", "#ef4444", "gas", "Gas");
+sub("carbon-monoxide", "sensor", "sensor", "#dc2626", "smoke", "Carbon monoxide");
+sub("vibration", "sensor", "sensor", "#eab308", "vibration", "Vibration");
+sub("tamper", "sensor", "sensor", "#f97316", "tamper", "Tamper");
+sub("presence", "sensor", "sensor", "#22c55e", "presence", "Presence");
+sub("enum-sensor", "sensor", "sensor", TAXONOMY_COLORS.sensor, "generic", "Sensor state");
+sub("device-event", "sensor", "sensor", "#10b981", "button", "Device event");
+sub("lock", "control", "control", "#0ea5e9", "lock", "Lock");
+sub("switch", "control", "control", TAXONOMY_COLORS.control, "switch", "Switch");
+sub("siren", "control", "control", "#dc2626", "siren", "Siren");
+sub("button", "control", "control", "#10b981", "button", "Button");
+sub("doorbell", "control", "control", "#a855f7", "doorbell", "Doorbell");
+for (const l of AUDIO_MACRO_LABELS) {
+	const kind = `audio-${l.id}`;
+	if (entries.has(kind)) continue;
+	sub(kind, "audio", "audio", TAXONOMY_COLORS.audio, kind, l.name);
+}
+/** The complete taxonomy dictionary, keyed by kind. */
+var EVENT_TAXONOMY = Object.freeze(Object.fromEntries(entries));
+/**
 * Error types for the safe expression engine. Two distinct classes so callers
 * can tell a compile-time (grammar) failure from a runtime (evaluation)
 * failure — both are non-fatal to the host: read paths degrade to "skip link".
@@ -15802,17 +16131,30 @@ var EventKindCategorySchema = _enum([
 	"audio",
 	"detection",
 	"sensor",
+	"control",
 	"custom",
 	"package"
 ]);
+/** Taxonomy level — macro (timeline lane) vs sub (events-page leaf). */
+var EventKindLevelSchema = _enum(["macro", "sub"]);
 var EventKindDescriptorSchema = object({
-	/** Stable kind id (e.g. 'motion', 'person', 'contact'). */
+	/** Stable kind id (e.g. 'motion', 'vehicle', 'car', 'lock'). */
 	kind: string(),
+	/** i18n key resolved on the UI side; `label` is the English fallback. */
+	labelKey: string(),
+	/** English fallback label (kept for clients that don't translate). */
 	label: string(),
 	/** Hex color for timeline/legend rendering. */
 	color: string(),
+	/** Dictionary id → lucide component on the UI side. */
+	iconId: string(),
+	/** Legacy closed-vocab glyph — fallback for `iconId`. */
 	icon: EventKindIconSchema,
 	category: EventKindCategorySchema,
+	/** Macro parent for this kind ('car' → 'vehicle'); null for a macro. */
+	parentKind: string().nullable(),
+	/** Derived from `parentKind`, explicit for the client tree. */
+	level: EventKindLevelSchema,
 	/** Which cap + device contributes this kind. For built-ins the camera
 	*  itself; for sensor kinds the LINKED source device. */
 	source: object({
@@ -15885,11 +16227,21 @@ var TrackAudioLabelSchema = object({
 	firstAt: number(),
 	lastAt: number()
 });
+/**
+* How a track was produced. `pipeline` (default / absent) = the spatial
+* detection+tracking pipeline. `sensor` = a SYNTHETIC track projected from a
+* linked sensor/control state change (no positions; carries a snapshot). The
+* spatial subsystems (tracker association, occupancy count, re-id/embedding,
+* resurrection) MUST skip `sensor` tracks — they have no bbox trajectory.
+*/
+var TrackSourceSchema = _enum(["pipeline", "sensor"]);
 var TrackSchema = object({
 	trackId: string(),
 	deviceId: number(),
 	className: string(),
 	label: string().optional(),
+	/** Track provenance. Absent ⇒ `pipeline` (legacy rows). */
+	source: TrackSourceSchema.optional(),
 	firstSeen: number(),
 	lastSeen: number(),
 	/** Frame-rate position history (subject to maxPositionHistory cap). */
@@ -16144,6 +16496,26 @@ var TrackCascadeCountsSchema = object({
 	/** Per-track CLIP search vectors removed (best-effort). */
 	embeddings: number().int()
 });
+/** Event-store footprint for one camera. */
+var EventStoreDeviceFootprintSchema = object({
+	deviceId: number(),
+	/** Persisted event rows (motion + object + audio) for the camera. */
+	rows: number().int(),
+	/** Event-owned media bytes on disk for the camera. */
+	bytes: number().int()
+});
+/** Aggregate event-store footprint: global totals + per-camera breakdown. */
+var EventStoreFootprintSchema = object({
+	totalRows: number().int(),
+	totalBytes: number().int(),
+	devices: array(EventStoreDeviceFootprintSchema).readonly()
+});
+/** Per-kind counts returned by the event-prune / device-delete mutations. */
+var EventPruneCountsSchema = object({
+	motion: number().int(),
+	object: number().int(),
+	audio: number().int()
+});
 DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).readonly()), method(object({
 	deviceId: number(),
 	trackId: string()
@@ -16207,6 +16579,21 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({}), EventStoreFootprintSchema, {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	olderThanMs: number(),
+	reason: OpsLogReasonSchema.optional()
+}), EventPruneCountsSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number() }), EventPruneCountsSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
+	kind: "query",
+	auth: "admin"
 }), method(object({
 	eventId: string(),
 	kind: MediaFileKindEnum.optional()
@@ -16231,6 +16618,76 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	eventId: string(),
 	timestamp: number()
 });
+/**
+* Cap → event-kind mapping for the SENSOR / CONTROL cap families — the table
+* `pipeline-analytics.listEventKinds` uses to turn a linked device's bound
+* caps into per-camera event-kind descriptors.
+*
+* The descriptor DATA (color / iconId / labelKey / parentKind / category)
+* is NOT duplicated here — every entry is derived from the single
+* `EVENT_TAXONOMY` dictionary (`catalogs/event-taxonomy.ts`). This file owns
+* ONLY the cap-name → taxonomy-kind mapping. Adding a new eventful sensor /
+* control cap means adding one line here (and a taxonomy entry); the anti-
+* drift guard `scripts/check-event-kind-coverage.ts` fails the build if an
+* eventful cap is missing.
+*/
+/** Map a taxonomy `iconId` onto the legacy closed `EventKindIcon` enum. */
+var LEGACY_ICON = {
+	motion: "motion",
+	audio: "audio",
+	person: "person",
+	vehicle: "vehicle",
+	animal: "animal",
+	package: "package",
+	door: "door",
+	pir: "pir",
+	smoke: "smoke",
+	water: "water",
+	button: "button",
+	generic: "generic",
+	gas: "smoke",
+	vibration: "generic",
+	tamper: "generic",
+	presence: "person",
+	lock: "generic",
+	siren: "generic",
+	switch: "generic",
+	doorbell: "button"
+};
+function legacyIcon(iconId) {
+	return LEGACY_ICON[iconId] ?? "generic";
+}
+/**
+* Cap name → taxonomy kind id. Covers EVERY eventful sensor / control cap.
+* The anti-drift guard cross-checks this against the eventful caps declared
+* in `packages/types/src/capabilities/*.cap.ts`.
+*/
+var CAP_TO_KIND = {
+	contact: "contact",
+	motion: "motion-sensor",
+	smoke: "smoke",
+	flood: "flood",
+	gas: "gas",
+	"carbon-monoxide": "carbon-monoxide",
+	vibration: "vibration",
+	tamper: "tamper",
+	presence: "presence",
+	"enum-sensor": "enum-sensor",
+	"event-emitter": "device-event",
+	"lock-control": "lock",
+	switch: "switch",
+	button: "button",
+	doorbell: "doorbell"
+};
+function buildDescriptor(capName, kind) {
+	const t = EVENT_TAXONOMY[kind];
+	if (t === void 0) throw new Error(`EVENT_KIND_BY_CAP: cap '${capName}' maps to unknown taxonomy kind '${kind}'`);
+	return {
+		...t,
+		icon: legacyIcon(t.iconId)
+	};
+}
+Object.freeze(Object.fromEntries(Object.entries(CAP_TO_KIND).map(([capName, kind]) => [capName, buildDescriptor(capName, kind)])));
 var CameraPipelineConfigSchema = object({
 	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).readonly(),
@@ -19501,13 +19958,29 @@ method(object({
 }), method(object({ deviceId: number() }), RecordingStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceId: number() }), object({
+}), method(object({
+	deviceId: number(),
+	reason: OpsLogReasonSchema.optional()
+}), object({
 	floorMs: number().nullable(),
 	deletedBuckets: number().int(),
 	reclaimedBytes: number().int()
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	fromMs: number().optional(),
+	toMs: number().optional()
+}), object({
+	deletedBuckets: number().int(),
+	reclaimedBytes: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
+	kind: "query",
+	auth: "admin"
 });
 /**
 * `recordingExport` cap — render a footage time range into a single downloadable
@@ -22629,6 +23102,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.deleteDeviceEvents": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineAnalytics.deleteTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -22659,6 +23138,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getEventStoreFootprint": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getKeyEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -22701,6 +23186,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listOpsLog": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRecentTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -22713,6 +23204,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.pruneEvents": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.pruneEventsBefore": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -23475,6 +23972,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.deleteFootprint": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"recording.getAvailability": {
 		capName: "recording",
 		capScope: "system",
@@ -23505,6 +24008,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.listOpsLog": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.locateSegment": {
 		capName: "recording",
 		capScope: "system",

package/dist/{dist-D7Ao4Euk.mjs → dist-C_oio-xb.mjs}

@@ -7327,6 +7327,62 @@ var RecordingConfigSchema = object({
 	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
 });
 /**
+* Ops-log — the durable, append-only operations audit shared by the
+* recordings and events management surfaces.
+*
+* ONE row shape is reused for both domains so a single "Activity" view can
+* merge the recorder's DurableState ring (recordings ops-log) and the
+* pipeline-analytics SQLite collection (events ops-log). Each row records a
+* management operation, WHY it ran (reason), and its measurable effect
+* (itemsAffected + bytesReclaimed). Writes are best-effort — a failed log must
+* never fail the operation it records.
+*/
+/** Which management domain the operation belongs to. */
+var OpsLogDomainSchema = _enum(["recording", "events"]);
+/** The kind of management operation performed. */
+var OpsLogOpSchema = _enum([
+	"prune",
+	"manual-delete",
+	"rescan",
+	"retention-run"
+]);
+/** Why the operation ran. */
+var OpsLogReasonSchema = _enum([
+	"retention",
+	"quota",
+	"manual",
+	"operator"
+]);
+/** One audit row, shared verbatim by both domains. */
+var OpsLogEntrySchema = object({
+	/** Unique row id. */
+	id: string(),
+	/** Epoch ms the operation completed. */
+	at: number(),
+	domain: OpsLogDomainSchema,
+	op: OpsLogOpSchema,
+	reason: OpsLogReasonSchema,
+	/** The camera the op targeted; null for a cluster/global op. */
+	deviceId: number().nullable(),
+	/** Node that performed the op (the log carries nodeId — no cross-node aggregation). */
+	nodeId: string(),
+	/** Buckets / rows deleted (op-specific unit). */
+	itemsAffected: number(),
+	/** Bytes reclaimed by the op (0 when not measurable). */
+	bytesReclaimed: number(),
+	/** Free-text detail (e.g. "floor moved to <ts>"); null when none. */
+	detail: string().nullable(),
+	/** Who/what triggered the op. */
+	actor: string()
+});
+/** Shared query input for the per-domain `listOpsLog` cap methods. */
+var OpsLogQueryInputSchema = object({
+	/** Restrict to a single camera; omit for every row. */
+	deviceId: number().optional(),
+	/** Max rows returned, newest-first. */
+	limit: number().int().min(1).max(1e3).optional()
+});
+/**
 * `StorageLocationType` — an addon-declared id that identifies the *kind* of
 * storage a location serves. Defined here (not in `capabilities/storage.cap.ts`)
 * so the persisted record schema and the consumer-facing cap can both consume it
@@ -7570,6 +7626,160 @@ var EncodeProfileSchema = object({
 	*/
 	outputArgs: array(string()).optional()
 });
+var COCO_TO_MACRO = {
+	mapping: {
+		person: "person",
+		bicycle: "vehicle",
+		car: "vehicle",
+		motorcycle: "vehicle",
+		airplane: "vehicle",
+		bus: "vehicle",
+		train: "vehicle",
+		truck: "vehicle",
+		boat: "vehicle",
+		bird: "animal",
+		cat: "animal",
+		dog: "animal",
+		horse: "animal",
+		sheep: "animal",
+		cow: "animal",
+		elephant: "animal",
+		bear: "animal",
+		zebra: "animal",
+		giraffe: "animal",
+		suitcase: "package",
+		backpack: "package",
+		handbag: "package"
+	},
+	preserveOriginal: false
+};
+var AUDIO_MACRO_LABELS = [
+	{
+		id: "speech",
+		name: "Speech",
+		icon: "🗣️"
+	},
+	{
+		id: "scream",
+		name: "Scream / Shout",
+		icon: "😱"
+	},
+	{
+		id: "crying",
+		name: "Crying / Baby",
+		icon: "😢"
+	},
+	{
+		id: "laughter",
+		name: "Laughter",
+		icon: "😂"
+	},
+	{
+		id: "music",
+		name: "Music",
+		icon: "🎵"
+	},
+	{
+		id: "dog",
+		name: "Dog",
+		icon: "🐕"
+	},
+	{
+		id: "cat",
+		name: "Cat",
+		icon: "🐈"
+	},
+	{
+		id: "bird",
+		name: "Bird",
+		icon: "🐦"
+	},
+	{
+		id: "animal",
+		name: "Animal (other)",
+		icon: "🐾"
+	},
+	{
+		id: "alarm",
+		name: "Alarm / Siren",
+		icon: "🚨"
+	},
+	{
+		id: "doorbell",
+		name: "Doorbell / Knock",
+		icon: "🔔"
+	},
+	{
+		id: "glass_breaking",
+		name: "Glass Breaking",
+		icon: "💥"
+	},
+	{
+		id: "gunshot",
+		name: "Gunshot / Explosion",
+		icon: "💣"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle",
+		icon: "🚗"
+	},
+	{
+		id: "siren",
+		name: "Emergency Siren",
+		icon: "🚑"
+	},
+	{
+		id: "fire",
+		name: "Fire / Smoke",
+		icon: "🔥"
+	},
+	{
+		id: "water",
+		name: "Water",
+		icon: "💧"
+	},
+	{
+		id: "wind",
+		name: "Wind / Weather",
+		icon: "🌬️"
+	},
+	{
+		id: "door",
+		name: "Door",
+		icon: "🚪"
+	},
+	{
+		id: "footsteps",
+		name: "Footsteps",
+		icon: "👣"
+	},
+	{
+		id: "crowd",
+		name: "Crowd / Chatter",
+		icon: "👥"
+	},
+	{
+		id: "telephone",
+		name: "Telephone",
+		icon: "📞"
+	},
+	{
+		id: "engine",
+		name: "Engine / Motor",
+		icon: "⚙️"
+	},
+	{
+		id: "tools",
+		name: "Tools / Construction",
+		icon: "🔨"
+	},
+	{
+		id: "silence",
+		name: "Silence",
+		icon: "🤫"
+	}
+];
 var YAMNET_TO_MACRO = {
 	mapping: {
 		Speech: "speech",
@@ -7836,6 +8046,125 @@ var _macroLookup = /* @__PURE__ */ new Map();
 for (const [k, v] of Object.entries(YAMNET_TO_MACRO.mapping)) _macroLookup.set(k.toLowerCase(), v);
 for (const [k, v] of Object.entries(APPLE_SA_TO_MACRO.mapping)) _macroLookup.set(k.toLowerCase(), v);
 /**
+* Unified event-kind taxonomy — THE single source of truth for
+* `kind → { parentKind, category, level, color, iconId, labelKey, label,
+* icon }`.
+*
+* This dictionary folds together what used to be scattered across four
+* copies:
+*   - `capabilities/sensor-event-kinds.ts` (sensor cap colors)
+*   - `addon-post-analysis/.../services/event-kinds.ts`
+*     (MOTION/PERSON/VEHICLE… _COLOR constants)
+*   - `ui-library/composites/detection-colors.ts` (CLASS_COLORS)
+*   - `addon-post-analysis/shared/frame/box-drawer.ts` (DEFAULT_COLOR)
+*   - the COCO / audio class maps (macro ↔ sub relationships)
+*
+* The DATA (serializable — color/iconId/labelKey/parentKind) lives here in
+* `@camstack/types`. The UI-side mapping `iconId → lucide component` and
+* `labelKey → t()` lives in `@camstack/ui-library`. UIs never hardcode a
+* color or an icon: they read this dictionary (server descriptors carry the
+* fields inline; the client resolves color/icon/label from `iconId`/`kind`).
+*
+* Two levels only (v1 YAGNI): macro → sub. `person` is a leaf macro.
+*/
+var TAXONOMY_COLORS = {
+	motion: "#f59e0b",
+	audio: "#06b6d4",
+	person: "#22c55e",
+	vehicle: "#3b82f6",
+	animal: "#f97316",
+	package: "#a855f7",
+	sensor: "#8b5cf6",
+	control: "#10b981",
+	genericDetection: "#64748b"
+};
+var DETECTION_SUB_COLORS = {
+	car: "#f59e0b",
+	truck: "#d97706",
+	bus: "#b45309",
+	motorcycle: "#eab308",
+	bicycle: "#ca8a04",
+	airplane: "#60a5fa",
+	boat: "#2563eb",
+	train: "#1d4ed8",
+	bird: "#14b8a6",
+	dog: "#84cc16",
+	cat: "#f97316",
+	horse: "#a16207",
+	sheep: "#a3a3a3",
+	cow: "#78716c",
+	elephant: "#6b7280",
+	bear: "#7c2d12",
+	zebra: "#404040",
+	giraffe: "#d4a373"
+};
+function titleCase(id) {
+	return id.split(/[-_ ]/).filter((p) => p.length > 0).map((p) => p.charAt(0).toUpperCase() + p.slice(1)).join(" ");
+}
+var entries = /* @__PURE__ */ new Map();
+function macro(kind, category, color, iconId, label) {
+	entries.set(kind, {
+		kind,
+		parentKind: null,
+		level: "macro",
+		category,
+		color,
+		iconId,
+		labelKey: `eventKind.${kind}`,
+		label
+	});
+}
+function sub(kind, parentKind, category, color, iconId, label) {
+	entries.set(kind, {
+		kind,
+		parentKind,
+		level: "sub",
+		category,
+		color,
+		iconId,
+		labelKey: `eventKind.${kind}`,
+		label
+	});
+}
+macro("motion", "motion", TAXONOMY_COLORS.motion, "motion", "Motion");
+macro("audio", "audio", TAXONOMY_COLORS.audio, "audio", "Audio");
+macro("person", "detection", TAXONOMY_COLORS.person, "person", "Person");
+macro("vehicle", "detection", TAXONOMY_COLORS.vehicle, "vehicle", "Vehicle");
+macro("animal", "detection", TAXONOMY_COLORS.animal, "animal", "Animal");
+macro("package", "package", TAXONOMY_COLORS.package, "package", "Package");
+macro("sensor", "sensor", TAXONOMY_COLORS.sensor, "sensor", "Sensor");
+macro("control", "control", TAXONOMY_COLORS.control, "control", "Control");
+for (const [cocoClass, macroClass] of Object.entries(COCO_TO_MACRO.mapping)) {
+	if (macroClass !== "vehicle" && macroClass !== "animal") continue;
+	if (entries.has(cocoClass)) continue;
+	sub(cocoClass, macroClass, "detection", DETECTION_SUB_COLORS[cocoClass] ?? TAXONOMY_COLORS.genericDetection, cocoClass, titleCase(cocoClass));
+}
+sub("package-delivered", "package", "package", TAXONOMY_COLORS.package, "package", "Package delivered");
+sub("package-picked-up", "package", "package", TAXONOMY_COLORS.package, "package", "Package picked up");
+sub("contact", "sensor", "sensor", "#f59e0b", "door", "Contact");
+sub("motion-sensor", "sensor", "sensor", TAXONOMY_COLORS.sensor, "pir", "Motion sensor");
+sub("smoke", "sensor", "sensor", "#ef4444", "smoke", "Smoke");
+sub("flood", "sensor", "sensor", "#3b82f6", "water", "Water leak");
+sub("gas", "sensor", "sensor", "#ef4444", "gas", "Gas");
+sub("carbon-monoxide", "sensor", "sensor", "#dc2626", "smoke", "Carbon monoxide");
+sub("vibration", "sensor", "sensor", "#eab308", "vibration", "Vibration");
+sub("tamper", "sensor", "sensor", "#f97316", "tamper", "Tamper");
+sub("presence", "sensor", "sensor", "#22c55e", "presence", "Presence");
+sub("enum-sensor", "sensor", "sensor", TAXONOMY_COLORS.sensor, "generic", "Sensor state");
+sub("device-event", "sensor", "sensor", "#10b981", "button", "Device event");
+sub("lock", "control", "control", "#0ea5e9", "lock", "Lock");
+sub("switch", "control", "control", TAXONOMY_COLORS.control, "switch", "Switch");
+sub("siren", "control", "control", "#dc2626", "siren", "Siren");
+sub("button", "control", "control", "#10b981", "button", "Button");
+sub("doorbell", "control", "control", "#a855f7", "doorbell", "Doorbell");
+for (const l of AUDIO_MACRO_LABELS) {
+	const kind = `audio-${l.id}`;
+	if (entries.has(kind)) continue;
+	sub(kind, "audio", "audio", TAXONOMY_COLORS.audio, kind, l.name);
+}
+/** The complete taxonomy dictionary, keyed by kind. */
+var EVENT_TAXONOMY = Object.freeze(Object.fromEntries(entries));
+/**
 * Error types for the safe expression engine. Two distinct classes so callers
 * can tell a compile-time (grammar) failure from a runtime (evaluation)
 * failure — both are non-fatal to the host: read paths degrade to "skip link".
@@ -15802,17 +16131,30 @@ var EventKindCategorySchema = _enum([
 	"audio",
 	"detection",
 	"sensor",
+	"control",
 	"custom",
 	"package"
 ]);
+/** Taxonomy level — macro (timeline lane) vs sub (events-page leaf). */
+var EventKindLevelSchema = _enum(["macro", "sub"]);
 var EventKindDescriptorSchema = object({
-	/** Stable kind id (e.g. 'motion', 'person', 'contact'). */
+	/** Stable kind id (e.g. 'motion', 'vehicle', 'car', 'lock'). */
 	kind: string(),
+	/** i18n key resolved on the UI side; `label` is the English fallback. */
+	labelKey: string(),
+	/** English fallback label (kept for clients that don't translate). */
 	label: string(),
 	/** Hex color for timeline/legend rendering. */
 	color: string(),
+	/** Dictionary id → lucide component on the UI side. */
+	iconId: string(),
+	/** Legacy closed-vocab glyph — fallback for `iconId`. */
 	icon: EventKindIconSchema,
 	category: EventKindCategorySchema,
+	/** Macro parent for this kind ('car' → 'vehicle'); null for a macro. */
+	parentKind: string().nullable(),
+	/** Derived from `parentKind`, explicit for the client tree. */
+	level: EventKindLevelSchema,
 	/** Which cap + device contributes this kind. For built-ins the camera
 	*  itself; for sensor kinds the LINKED source device. */
 	source: object({
@@ -15885,11 +16227,21 @@ var TrackAudioLabelSchema = object({
 	firstAt: number(),
 	lastAt: number()
 });
+/**
+* How a track was produced. `pipeline` (default / absent) = the spatial
+* detection+tracking pipeline. `sensor` = a SYNTHETIC track projected from a
+* linked sensor/control state change (no positions; carries a snapshot). The
+* spatial subsystems (tracker association, occupancy count, re-id/embedding,
+* resurrection) MUST skip `sensor` tracks — they have no bbox trajectory.
+*/
+var TrackSourceSchema = _enum(["pipeline", "sensor"]);
 var TrackSchema = object({
 	trackId: string(),
 	deviceId: number(),
 	className: string(),
 	label: string().optional(),
+	/** Track provenance. Absent ⇒ `pipeline` (legacy rows). */
+	source: TrackSourceSchema.optional(),
 	firstSeen: number(),
 	lastSeen: number(),
 	/** Frame-rate position history (subject to maxPositionHistory cap). */
@@ -16144,6 +16496,26 @@ var TrackCascadeCountsSchema = object({
 	/** Per-track CLIP search vectors removed (best-effort). */
 	embeddings: number().int()
 });
+/** Event-store footprint for one camera. */
+var EventStoreDeviceFootprintSchema = object({
+	deviceId: number(),
+	/** Persisted event rows (motion + object + audio) for the camera. */
+	rows: number().int(),
+	/** Event-owned media bytes on disk for the camera. */
+	bytes: number().int()
+});
+/** Aggregate event-store footprint: global totals + per-camera breakdown. */
+var EventStoreFootprintSchema = object({
+	totalRows: number().int(),
+	totalBytes: number().int(),
+	devices: array(EventStoreDeviceFootprintSchema).readonly()
+});
+/** Per-kind counts returned by the event-prune / device-delete mutations. */
+var EventPruneCountsSchema = object({
+	motion: number().int(),
+	object: number().int(),
+	audio: number().int()
+});
 DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).readonly()), method(object({
 	deviceId: number(),
 	trackId: string()
@@ -16207,6 +16579,21 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({}), EventStoreFootprintSchema, {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	olderThanMs: number(),
+	reason: OpsLogReasonSchema.optional()
+}), EventPruneCountsSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number() }), EventPruneCountsSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
+	kind: "query",
+	auth: "admin"
 }), method(object({
 	eventId: string(),
 	kind: MediaFileKindEnum.optional()
@@ -16231,6 +16618,76 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	eventId: string(),
 	timestamp: number()
 });
+/**
+* Cap → event-kind mapping for the SENSOR / CONTROL cap families — the table
+* `pipeline-analytics.listEventKinds` uses to turn a linked device's bound
+* caps into per-camera event-kind descriptors.
+*
+* The descriptor DATA (color / iconId / labelKey / parentKind / category)
+* is NOT duplicated here — every entry is derived from the single
+* `EVENT_TAXONOMY` dictionary (`catalogs/event-taxonomy.ts`). This file owns
+* ONLY the cap-name → taxonomy-kind mapping. Adding a new eventful sensor /
+* control cap means adding one line here (and a taxonomy entry); the anti-
+* drift guard `scripts/check-event-kind-coverage.ts` fails the build if an
+* eventful cap is missing.
+*/
+/** Map a taxonomy `iconId` onto the legacy closed `EventKindIcon` enum. */
+var LEGACY_ICON = {
+	motion: "motion",
+	audio: "audio",
+	person: "person",
+	vehicle: "vehicle",
+	animal: "animal",
+	package: "package",
+	door: "door",
+	pir: "pir",
+	smoke: "smoke",
+	water: "water",
+	button: "button",
+	generic: "generic",
+	gas: "smoke",
+	vibration: "generic",
+	tamper: "generic",
+	presence: "person",
+	lock: "generic",
+	siren: "generic",
+	switch: "generic",
+	doorbell: "button"
+};
+function legacyIcon(iconId) {
+	return LEGACY_ICON[iconId] ?? "generic";
+}
+/**
+* Cap name → taxonomy kind id. Covers EVERY eventful sensor / control cap.
+* The anti-drift guard cross-checks this against the eventful caps declared
+* in `packages/types/src/capabilities/*.cap.ts`.
+*/
+var CAP_TO_KIND = {
+	contact: "contact",
+	motion: "motion-sensor",
+	smoke: "smoke",
+	flood: "flood",
+	gas: "gas",
+	"carbon-monoxide": "carbon-monoxide",
+	vibration: "vibration",
+	tamper: "tamper",
+	presence: "presence",
+	"enum-sensor": "enum-sensor",
+	"event-emitter": "device-event",
+	"lock-control": "lock",
+	switch: "switch",
+	button: "button",
+	doorbell: "doorbell"
+};
+function buildDescriptor(capName, kind) {
+	const t = EVENT_TAXONOMY[kind];
+	if (t === void 0) throw new Error(`EVENT_KIND_BY_CAP: cap '${capName}' maps to unknown taxonomy kind '${kind}'`);
+	return {
+		...t,
+		icon: legacyIcon(t.iconId)
+	};
+}
+Object.freeze(Object.fromEntries(Object.entries(CAP_TO_KIND).map(([capName, kind]) => [capName, buildDescriptor(capName, kind)])));
 var CameraPipelineConfigSchema = object({
 	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).readonly(),
@@ -19501,13 +19958,29 @@ method(object({
 }), method(object({ deviceId: number() }), RecordingStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceId: number() }), object({
+}), method(object({
+	deviceId: number(),
+	reason: OpsLogReasonSchema.optional()
+}), object({
 	floorMs: number().nullable(),
 	deletedBuckets: number().int(),
 	reclaimedBytes: number().int()
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	fromMs: number().optional(),
+	toMs: number().optional()
+}), object({
+	deletedBuckets: number().int(),
+	reclaimedBytes: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
+	kind: "query",
+	auth: "admin"
 });
 /**
 * `recordingExport` cap — render a footage time range into a single downloadable
@@ -22629,6 +23102,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.deleteDeviceEvents": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineAnalytics.deleteTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -22659,6 +23138,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getEventStoreFootprint": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getKeyEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -22701,6 +23186,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listOpsLog": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRecentTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -22713,6 +23204,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.pruneEvents": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.pruneEventsBefore": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -23475,6 +23972,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.deleteFootprint": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"recording.getAvailability": {
 		capName: "recording",
 		capScope: "system",
@@ -23505,6 +24008,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.listOpsLog": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.locateSegment": {
 		capName: "recording",
 		capScope: "system",

package/dist/ingress/tailscale-ingress.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-AxWhb5Uh.js");
+const require_dist = require("../dist-CPFhFQVO.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_crypto = require("node:crypto");

package/dist/ingress/tailscale-ingress.addon.mjs

@@ -1,4 +1,4 @@
-import { i as EventCategory, n as networkAccessCapability, r as BaseAddon } from "../dist-D7Ao4Euk.mjs";
+import { i as EventCategory, n as networkAccessCapability, r as BaseAddon } from "../dist-C_oio-xb.mjs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { randomUUID } from "node:crypto";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-tailscale",
-  "version": "1.1.26",
+  "version": "1.1.28",
   "description": "Tailscale bundle for CamStack — joins the host to a tailnet (client) and exposes the hub via Serve/Funnel (ingress). Multi-entry npm package shipping 2 addons under a single bundle.",
   "keywords": [
     "camstack",