@camstack/addon-tailscale 1.2.100 → 1.2.102

package/dist/client/tailscale.addon.js

@@ -24,7 +24,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-const require_dist = require("../dist-DJhzrxHQ.js");
+const require_dist = require("../dist-BcyUFopm.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_fs = require("node:fs");

package/dist/client/tailscale.addon.mjs

@@ -1,4 +1,4 @@
-import { a as EventCategory, i as BaseAddon, n as networkAccessCapability, r as BOOT_RECOVERY_BACKOFF_MS, t as meshNetworkCapability } from "../dist-cjpimBLk.mjs";
+import { a as EventCategory, i as BaseAddon, n as networkAccessCapability, r as BOOT_RECOVERY_BACKOFF_MS, t as meshNetworkCapability } from "../dist-AkkjrQjN.mjs";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import * as fs from "node:fs";

package/dist/{dist-cjpimBLk.mjs → dist-AkkjrQjN.mjs}

@@ -1,4 +1,4 @@
-//#region ../types/dist/event-category-ZyX6jcse.mjs
+//#region ../types/dist/event-category-BVDXG4tB.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -615,6 +615,20 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	* pull-reconcile from the provider's `getStatus` on reconnect. */
 	EventCategory["MeshNetworkChanged"] = "network.mesh.changed";
 	EventCategory["BackupCompleted"] = "backup.completed";
+	/**
+	* A whole backup RUN finished — every destination attempted, win or lose.
+	*
+	* `backup.completed` fires once per DESTINATION, which is the right grain for
+	* a progress UI and the wrong one for a notification: an operator with three
+	* destinations would be told three times. And a run where two of three
+	* destinations succeeded is not a clean success — a single "backup
+	* completed" that hid the failed one would be a lie, so the count of each is
+	* carried here and the message says both.
+	*
+	* Emitted by the backup orchestrator only after the destination loop, so a
+	* run that dies during the BUILD phase produces no completion at all.
+	*/
+	EventCategory["BackupRunCompleted"] = "backup.run-completed";
 	EventCategory["BackupRestored"] = "backup.restored";
 	EventCategory["NotificationDispatched"] = "notification.dispatched";
 	EventCategory["NotificationFailed"] = "notification.failed";
@@ -5345,7 +5359,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-CnLyvg3w.mjs
+//#region ../types/dist/sleep-DEuj7E3j.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7392,7 +7406,23 @@ var EncodeProfileSchema = object({
 			"zerolatency",
 			"film",
 			"animation"
-		]).optional()
+		]).optional(),
+		/**
+		* ONE slice per access unit.
+		*
+		* `-tune zerolatency` turns on x264's sliced threads, and a frame then leaves
+		* the encoder as five NAL slices that share one RTP timestamp and carry one
+		* marker bit. A libwebrtc depacketiser sees five frame-starts and one
+		* frame-end per frame: the first pictures render and the video then freezes
+		* for good while the audio, on its own plane, plays on. Measured on this hub
+		* 2026-09-13 against the Echo, and reduced to one slice by this flag alone.
+		*
+		* A NAMED field and not a raw flag, because {@link EgressEncodeSchema} omits
+		* `outputArgs` on purpose: an opaque array is part of the sharing key, so two
+		* consumers meaning the same thing spelled differently would stop sharing one
+		* child. Absent means "whatever the encoder does" — today's behaviour.
+		*/
+		singleSlicePerFrame: boolean().optional()
 	}),
 	audio: union([literal("passthrough"), object({
 		codec: _enum([
@@ -7442,7 +7472,7 @@ var BASE_LIVE_EGRESS_PROFILE = {
 	audio: "passthrough"
 };
 ({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
-({ ...BASE_LIVE_EGRESS_PROFILE });
+({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
 /**
 * Deep wiring healthcheck — snapshot of active reachability probes across
 * every declared capability + widget of every installed plugin, on every
@@ -11491,6 +11521,58 @@ method(ListInputSchema, array(BrokerInfoSchema$1)), method(GetInputSchema, Broke
 	auth: "admin"
 }), method(GetStateInputSchema, unknown().nullable()), method(_void(), RegistryStatusSchema);
 DeviceType.Camera;
+/**
+* The signals a device can emit to WAKE its own stream.
+*
+* A camera whose stream is built on demand sleeps until something asks for it,
+* and "something" cannot be a consumer that is merely attached — a Frigate-style
+* puller holds a session open for ever, and treating that as demand would keep
+* a battery camera awake for ever, which is the whole thing the battery is for
+* (D173). So the wake has to come from the CAMERA: an event it noticed by
+* itself, with no stream running.
+*
+* ## The vocabulary is the PROVIDER'S, not ours
+*
+* Like `consumables`, this cap declares no vocabulary of its own. A provider
+* names each signal with a `code` it chooses and a `label` an operator reads.
+* Reolink offers motion and camera-native detection; another provider may offer
+* a tamper, a doorbell press, a PIR, or something no camera in this fleet has
+* yet. A fixed enum here would mean every new signal is a framework release.
+*
+* It is deliberately NOT derived from the caps a device already binds. Whether
+* a camera CAN push firmware motion is expressed by `motionSources` containing
+* `'onboard'`, and whether it does AI on-camera by the `native-object-detection`
+* binding — but both answer "what drives the detection pipeline", which is a
+* different question from "what may wake a sleeping stream". A camera can do
+* the first and not be trusted with the second, and the operator picks per
+* camera. Two questions, two authorities.
+*
+* ## Availability is not permission
+*
+* `listSignals` says what the device CAN emit. Whether a given signal actually
+* wakes the stream is the operator's per-camera choice, held by the broker
+* alongside the cooldown — see the stream-broker cap's wake settings. A
+* provider declaring a signal is not a provider enabling it.
+*/
+/** One signal a device can emit. */
+var StreamSignalSchema = object({
+	/** Stable id chosen by the provider, e.g. `'motion'`, `'person'`, `'tamper'`. */
+	code: string().min(1),
+	/** What an operator reads in the picker. The provider's own wording. */
+	label: string().min(1),
+	/**
+	* Whether the provider recommends this signal ON when a camera is first set
+	* up. A provider knows which of its signals are cheap and reliable; an
+	* operator should not have to discover that by trial. Reolink recommends
+	* both of its own.
+	*/
+	recommended: boolean()
+});
+object({
+	signals: array(StreamSignalSchema),
+	lastFetchedAt: number()
+});
+Object.values(DeviceType), method(_void(), array(StreamSignalSchema).readonly());
 /** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
 var StreamFormatSchema = _enum([
 	"webrtc",
@@ -11887,6 +11969,22 @@ var EgressTranscodeSchema = object({
 	camStreamId: string().nullable()
 });
 method(object({
+	deviceId: number().int().nonnegative(),
+	/** The provider's signal code. */
+	code: string().min(1),
+	/** Ms epoch. Absent ⇒ now. */
+	at: number().optional()
+}), object({
+	/** Whether the broker acted on it, and if not, why. */
+	accepted: boolean(),
+	reason: _enum([
+		"woke",
+		"hold-extended",
+		"not-enabled",
+		"no-consumer",
+		"unknown-code"
+	])
+}), { kind: "mutation" }), method(object({
 	deviceId: number().int().nonnegative(),
 	camStreamId: string().min(1),
 	kind: CamStreamKindSchema,
@@ -12141,6 +12239,16 @@ var PickStreamRequirementsSchema = object({
 	acceptCodecs: array(StreamCodecSchema).readonly().optional(),
 	/** Minimum vertical resolution. Streams shorter than this are dropped. */
 	minHeight: number().int().positive().optional(),
+	/**
+	* Maximum vertical resolution. Streams TALLER than this are dropped.
+	*
+	* A consumer can have a ceiling as real as its floor: Alexa documents
+	* 480p to 1080p, and a 4K stream is as unusable to an Echo as a 360p one.
+	* Without this the ceiling had to be re-implemented by every caller — and
+	* one caller implementing it privately is how a second scoring authority
+	* gets born.
+	*/
+	maxHeight: number().int().positive().optional(),
 	/** Minimum horizontal resolution. */
 	minWidth: number().int().positive().optional(),
 	/**
@@ -12157,7 +12265,22 @@ var PickStreamRequirementsSchema = object({
 	* transcoded" guard: if the device is already serving the consumer's
 	* codec end-to-end, there's nothing to optimise.
 	*/
-	requireSiblingCodec: array(StreamCodecSchema).readonly().optional()
+	requireSiblingCodec: array(StreamCodecSchema).readonly().optional(),
+	/**
+	* Whether a stream the consumer CANNOT decode may still be picked, on the
+	* understanding that it will be transcoded.
+	*
+	* Default `false` — today's behaviour, and the right one for a bypass
+	* question ("is there a stream I can forward untouched?"). Set `true` to
+	* ask the larger question: "what is the best stream for me, transcoding if
+	* I must?" A stream that satisfies `acceptCodecs` always outranks one that
+	* does not, so a passthrough is never lost to a transcode; the answer says
+	* which it is in {@link PickedCamStreamSchema.transcodes}.
+	*
+	* This is what lets one picker serve both the bypass and the full source
+	* choice, instead of a consumer scoring privately when the bypass misses.
+	*/
+	allowTranscode: boolean().optional()
 }).readonly();
 var PickStreamPreferencesSchema = object({
 	/**
@@ -12171,12 +12294,32 @@ var PickStreamPreferencesSchema = object({
 	* picks the tallest stream; `'lowest'` picks the shortest (used by
 	* memory-constrained consumers / Apple Home guest sessions).
 	*/
-	resolutionPreference: _enum(["highest", "lowest"]).optional()
+	resolutionPreference: _enum(["highest", "lowest"]).optional(),
+	/**
+	* The height the consumer actually wants to DELIVER.
+	*
+	* Not a constraint — an ordering. With it set, the SMALLEST stream at or
+	* above the target wins, and only if nothing reaches it does the tallest
+	* take over. Pulling 1296 lines to draw 720 on a 1280x800 Echo panel costs
+	* a decode and buys nothing, and `resolutionPreference: 'highest'` cannot
+	* express that: it says "as big as possible", which is a different wish.
+	*
+	* Ignored when absent, so every existing caller keeps its ordering.
+	*/
+	targetHeight: number().int().positive().optional()
 }).readonly();
 var PickedCamStreamSchema = object({
 	camStreamId: string(),
 	codec: string().optional(),
 	resolution: CamStreamResolutionSchema.optional(),
+	/**
+	* Whether serving this stream requires a decode + re-encode.
+	*
+	* `false` is a stream the consumer can take as it stands. Only ever `true`
+	* when the caller asked for it with `allowTranscode`, so a caller that did
+	* not ask cannot be handed a cost it never agreed to pay.
+	*/
+	transcodes: boolean(),
 	/** One-line explanation of why this stream won — for logs / debug UI. */
 	reason: string()
 });
@@ -16382,6 +16525,8 @@ var NcSystemEventKindSchema = _enum([
 	"device-enabled",
 	"device-battery-low",
 	"device-battery-normal",
+	"device-consumable-low",
+	"device-consumable-normal",
 	"stream-online",
 	"stream-offline",
 	"node-online",
@@ -16400,6 +16545,7 @@ var NcSystemEventKindSchema = _enum([
 	"addon-updated",
 	"server-updated",
 	"export-completed",
+	"backup-completed",
 	"camera-online",
 	"camera-offline",
 	"camera-disabled",
@@ -19796,13 +19942,109 @@ var SummariesQueryInput = object({
 	deviceIds: array(number()).min(1),
 	since: number().optional(),
 	until: number().optional(),
-	limit: number().int().min(1).max(200).default(50)
+	limit: number().int().min(1).max(200).default(50),
+	/** The same member-wise filter {@link listRecentSummaries} takes — one
+	*  meaning of "dog" on every summary surface. */
+	classes: array(string().min(1).max(60)).max(40).optional()
 });
-var SummariesPageSchema = object({ summaries: array(SummarySchema).readonly() });
 var SummaryDetailSchema = object({
 	summary: SummarySchema,
-	/** Member track ids, in absorption order. */
-	trackIds: array(string()).readonly()
+	/** Members in absorption order, oldest join first. */
+	members: array(object({
+		trackId: string(),
+		/**
+		* The track's class at the time it JOINED, or `null` when it was unresolved
+		* and the track no longer exists to fill it.
+		*
+		* The join, not the latest opinion: class voting can re-decide a track's
+		* class afterwards, and a group's composition is the history of who came
+		* together. A consumer counts these to badge a thumbnail — "two people and a
+		* dog" — rather than being handed a second, denormalised tally that would
+		* drift from the members it claims to describe.
+		*/
+		className: string().nullable(),
+		/** `primary` is the one member that carries the group's identity. */
+		role: _enum([
+			"primary",
+			"sibling",
+			"child"
+		]).nullable(),
+		joinedAt: number(),
+		/** Tier 1 — the sub-class (`dog`, `van`), resolved from the member's track
+		*  at read time. Absent when nothing resolved, never an empty string. */
+		label: string().optional(),
+		/** Tier 2 — the instance: a person's name, a plate. Absent when the pipeline
+		*  recognised nobody, and absent for a member whose track has been pruned —
+		*  a thumbnail that names the wrong person is worse than one naming nobody. */
+		subLabel: string().optional()
+	})).readonly()
+});
+/**
+* What a LIST of groups carries: the envelope plus what it is MADE OF.
+*
+* Coarse on purpose — the operator's rule is "only the rough data on the list,
+* we extend when we notice we need more". Enough to draw the card ("two people
+* and a dog") and no more. The MEMBERS, their names and the per-member links
+* are on {@link getSummary}: shipping every member of every group so a client
+* can count them turns a page of two hundred groups into a thousand records to
+* draw two hundred badges.
+*/
+var SummaryListItemSchema = object({
+	summary: SummarySchema,
+	/** Class counts, most numerous first; `className: null` is a member whose
+	*  class never resolved, counted so the counts add up to `memberCount`. */
+	classes: array(object({
+		className: string().nullable(),
+		count: number().int().positive()
+	})).readonly()
+});
+var SummariesPageSchema = object({ summaries: array(SummaryListItemSchema).readonly() });
+/**
+* The paged feed, deliberately the SAME shape as {@link RecentTracksQueryInput}.
+*
+* The reel on the cameras page and the Events gallery both ride a cursor, so a
+* summaries feed that could only answer "the last N for these cameras"
+* (`listSummaries`) would make groups available in the timeline and nowhere
+* else. Two feeds with different ordering contracts would be two ideas of what
+* "newest" means, on one screen.
+*/
+var RecentSummariesQueryInput = object({
+	/** Devices to merge. An empty array yields an empty page. */
+	deviceIds: array(number()),
+	/** Window lower bound on `lastActiveAt` (inclusive). */
+	since: number().optional(),
+	/** Window upper bound on `lastActiveAt` (inclusive). */
+	until: number().optional(),
+	limit: number().int().min(1).max(500).default(100),
+	/** Opaque continuation cursor from a previous page's `nextCursor`. */
+	cursor: string().optional(),
+	/**
+	* Restrict to these classes — THE SAME FIELD `listRecentTracks` takes, and
+	* deliberately the same name: the events filter tree emits one list of ticked
+	* taxonomy nodes, and a summaries feed that called it something else would
+	* make the operator's one filter component produce two shapes.
+	*
+	* A question about the MEMBERS: a group matches when ANY of them does. "Show
+	* me the arrivals with a dog" has to return the group of four people who had
+	* one with them; a filter on the group's own fields could only ever answer
+	* about its primary.
+	*
+	* Matched against all THREE tiers of a member — the class (`animal`), the
+	* sub-class (`dog`) and the instance (a name, a plate) — because which tier a
+	* ticked node lives on is the taxonomy's business, not the caller's. `dog` is
+	* an event kind in the tree and a tier-1 label on an `animal` track; a filter
+	* that read only the class would answer "animal" and never "dog".
+	*
+	* ABSENT or EMPTY means no filter — absent is not a selection of none.
+	*/
+	classes: array(string().min(1).max(60)).max(40).optional()
+});
+var RecentSummariesPageSchema = object({
+	/** Ordered by (`lastActiveAt` DESC, id DESC). Same light item as
+	*  {@link listSummaries} — one list shape, so a card renders the same
+	*  whichever feed drew it. */
+	summaries: array(SummaryListItemSchema).readonly(),
+	nextCursor: string().nullable()
 });
 var RecentTracksPageSchema = object({
 	/** Merged page, ordered by (`lastSeen` DESC, `trackId` DESC). */
@@ -20216,7 +20458,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	classes: array(string()).optional(),
 	/** See {@link ExcludeSourcesDoc}. */
 	excludeSources: array(TrackSourceSchema).optional()
-}), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(SummariesQueryInput, SummariesPageSchema), method(object({ id: string() }), SummaryDetailSchema.nullable()), method(object({ deviceId: number() }), _void(), {
+}), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(SummariesQueryInput, SummariesPageSchema), method(RecentSummariesQueryInput, RecentSummariesPageSchema), method(object({ id: string() }), SummaryDetailSchema.nullable()), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number() }), array(EventKindDescriptorSchema).readonly()), method(object({ deviceIds: array(number()).min(1).max(200) }), array(EventKindsForDeviceSchema).readonly()), method(object({
@@ -23545,10 +23787,28 @@ DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), ar
 }), boolean()), method(object({
 	deviceId: number().int().nonnegative(),
 	sessionId: string()
-}), object({ pendingRenegotiation: object({
-	target: WebrtcStreamTargetSchema,
-	epoch: number()
-}).nullable() }));
+}), object({
+	pendingRenegotiation: object({
+		target: WebrtcStreamTargetSchema,
+		epoch: number()
+	}).nullable(),
+	/**
+	* Whether the session still EXISTS.
+	*
+	* A consumer that holds a resource for the life of a session needs to
+	* be able to ask, because a session does not always end the way it
+	* began. Measured on this hub 2026-09-13: an Echo that got stuck never
+	* sent `SessionDisconnected`, so the Alexa exporter's
+	* `releaseEgressTranscode` never ran, and a 2304x1296 HEVC to 720p
+	* H.264 transcode kept running for NOBODY for more than twenty
+	* minutes. The WebRTC session had logged `WebRTC session closed`
+	* minutes earlier — the broker knew; the holder had no way to ask.
+	*
+	* `false` for a session id the provider has never heard of, which is
+	* the same answer as "it ended": either way nothing is holding it up.
+	*/
+	alive: boolean()
+}));
 object({
 	/** All accessory children of the parent. */
 	childDeviceIds: array(number()).readonly(),
@@ -29883,7 +30143,29 @@ var LoggingSettingsPatchSchema = object({
 	* disarmed the channels it did not mention would make the Levels page and
 	* the Diagnostics page fight over the same value.
 	*/
-	channels: array(LogChannelWindowPatchSchema).readonly().optional()
+	channels: array(LogChannelWindowPatchSchema).readonly().optional(),
+	/**
+	* How many days the analytics OPS LOG is kept — the audit trail of what
+	* retention actually deleted.
+	*
+	* It lives HERE, on the logging document, and not on the analytics addon's
+	* settings form, on the operator's instruction: every other log-ish window in
+	* this system is configured through this one document, and a retention audit
+	* configured somewhere else is a second place to look when the question is
+	* "what happened to my data".
+	*
+	* That placement has a cost worth stating: this document ships in the
+	* framework closure, so this knob needs a published `@camstack/server` while
+	* the four windows beside it (D485) reach a node on `camstack deploy`.
+	*
+	* `retention-model.ts` argued this one must NOT follow a device window,
+	* because the audit trail is the history of the SWEEP and not of the camera.
+	* That argument stands and is untouched — what changes is that 30 days stops
+	* being a constant nobody can reach. `0` keeps it forever. The floor is 1 day
+	* rather than 0-as-delete: an audit log truncated to nothing is precisely the
+	* state in which the next 9.5 GiB leak cannot be explained.
+	*/
+	opsLogRetentionDays: number().int().min(0).max(3650).optional()
 });
 /**
 * Which LAYER of the hierarchy is addressed. Absent = the cluster layer.
@@ -29956,6 +30238,14 @@ var LoggingSettingsStateSchema = object({
 	channels: array(LogChannelDescriptorSchema).readonly(),
 	/** The channels ARMED right now, each with its deadline. */
 	activeChannels: array(LogChannelWindowStateSchema).readonly(),
+	/**
+	* The ops-log window in days, as it is in force. `0` = kept forever.
+	*
+	* Reported rather than left to the caller's memory of what it wrote: this is
+	* the value the analytics sweep will actually use, and an operator asking how
+	* long their audit trail lives should not have to infer it from a default.
+	*/
+	opsLogRetentionDays: number().int().min(0),
 	persisted: boolean()
 });
 method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
@@ -34115,6 +34405,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRecentSummaries": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRecentTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -36077,6 +36373,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.reportStreamSignal": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.restartProfile": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -36161,6 +36463,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamSignals.listSignals": {
+		capName: "stream-signals",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"switch.setState": {
 		capName: "switch",
 		capScope: "device",
@@ -37942,6 +38250,11 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"pipelineAnalytics.listRecentSummaries": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"pipelineAnalytics.listRecentTracks": [{
 		name: "deviceIds",
 		form: "array",
@@ -38528,6 +38841,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"streamBroker.reportStreamSignal": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"streamBroker.restartProfile": [{
 		name: "deviceId",
 		form: "single",

package/dist/{dist-DJhzrxHQ.js → dist-BcyUFopm.js}

@@ -1,4 +1,4 @@
-//#region ../types/dist/event-category-ZyX6jcse.mjs
+//#region ../types/dist/event-category-BVDXG4tB.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -615,6 +615,20 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	* pull-reconcile from the provider's `getStatus` on reconnect. */
 	EventCategory["MeshNetworkChanged"] = "network.mesh.changed";
 	EventCategory["BackupCompleted"] = "backup.completed";
+	/**
+	* A whole backup RUN finished — every destination attempted, win or lose.
+	*
+	* `backup.completed` fires once per DESTINATION, which is the right grain for
+	* a progress UI and the wrong one for a notification: an operator with three
+	* destinations would be told three times. And a run where two of three
+	* destinations succeeded is not a clean success — a single "backup
+	* completed" that hid the failed one would be a lie, so the count of each is
+	* carried here and the message says both.
+	*
+	* Emitted by the backup orchestrator only after the destination loop, so a
+	* run that dies during the BUILD phase produces no completion at all.
+	*/
+	EventCategory["BackupRunCompleted"] = "backup.run-completed";
 	EventCategory["BackupRestored"] = "backup.restored";
 	EventCategory["NotificationDispatched"] = "notification.dispatched";
 	EventCategory["NotificationFailed"] = "notification.failed";
@@ -5345,7 +5359,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-CnLyvg3w.mjs
+//#region ../types/dist/sleep-DEuj7E3j.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7392,7 +7406,23 @@ var EncodeProfileSchema = object({
 			"zerolatency",
 			"film",
 			"animation"
-		]).optional()
+		]).optional(),
+		/**
+		* ONE slice per access unit.
+		*
+		* `-tune zerolatency` turns on x264's sliced threads, and a frame then leaves
+		* the encoder as five NAL slices that share one RTP timestamp and carry one
+		* marker bit. A libwebrtc depacketiser sees five frame-starts and one
+		* frame-end per frame: the first pictures render and the video then freezes
+		* for good while the audio, on its own plane, plays on. Measured on this hub
+		* 2026-09-13 against the Echo, and reduced to one slice by this flag alone.
+		*
+		* A NAMED field and not a raw flag, because {@link EgressEncodeSchema} omits
+		* `outputArgs` on purpose: an opaque array is part of the sharing key, so two
+		* consumers meaning the same thing spelled differently would stop sharing one
+		* child. Absent means "whatever the encoder does" — today's behaviour.
+		*/
+		singleSlicePerFrame: boolean().optional()
 	}),
 	audio: union([literal("passthrough"), object({
 		codec: _enum([
@@ -7442,7 +7472,7 @@ var BASE_LIVE_EGRESS_PROFILE = {
 	audio: "passthrough"
 };
 ({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
-({ ...BASE_LIVE_EGRESS_PROFILE });
+({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
 /**
 * Deep wiring healthcheck — snapshot of active reachability probes across
 * every declared capability + widget of every installed plugin, on every
@@ -11491,6 +11521,58 @@ method(ListInputSchema, array(BrokerInfoSchema$1)), method(GetInputSchema, Broke
 	auth: "admin"
 }), method(GetStateInputSchema, unknown().nullable()), method(_void(), RegistryStatusSchema);
 DeviceType.Camera;
+/**
+* The signals a device can emit to WAKE its own stream.
+*
+* A camera whose stream is built on demand sleeps until something asks for it,
+* and "something" cannot be a consumer that is merely attached — a Frigate-style
+* puller holds a session open for ever, and treating that as demand would keep
+* a battery camera awake for ever, which is the whole thing the battery is for
+* (D173). So the wake has to come from the CAMERA: an event it noticed by
+* itself, with no stream running.
+*
+* ## The vocabulary is the PROVIDER'S, not ours
+*
+* Like `consumables`, this cap declares no vocabulary of its own. A provider
+* names each signal with a `code` it chooses and a `label` an operator reads.
+* Reolink offers motion and camera-native detection; another provider may offer
+* a tamper, a doorbell press, a PIR, or something no camera in this fleet has
+* yet. A fixed enum here would mean every new signal is a framework release.
+*
+* It is deliberately NOT derived from the caps a device already binds. Whether
+* a camera CAN push firmware motion is expressed by `motionSources` containing
+* `'onboard'`, and whether it does AI on-camera by the `native-object-detection`
+* binding — but both answer "what drives the detection pipeline", which is a
+* different question from "what may wake a sleeping stream". A camera can do
+* the first and not be trusted with the second, and the operator picks per
+* camera. Two questions, two authorities.
+*
+* ## Availability is not permission
+*
+* `listSignals` says what the device CAN emit. Whether a given signal actually
+* wakes the stream is the operator's per-camera choice, held by the broker
+* alongside the cooldown — see the stream-broker cap's wake settings. A
+* provider declaring a signal is not a provider enabling it.
+*/
+/** One signal a device can emit. */
+var StreamSignalSchema = object({
+	/** Stable id chosen by the provider, e.g. `'motion'`, `'person'`, `'tamper'`. */
+	code: string().min(1),
+	/** What an operator reads in the picker. The provider's own wording. */
+	label: string().min(1),
+	/**
+	* Whether the provider recommends this signal ON when a camera is first set
+	* up. A provider knows which of its signals are cheap and reliable; an
+	* operator should not have to discover that by trial. Reolink recommends
+	* both of its own.
+	*/
+	recommended: boolean()
+});
+object({
+	signals: array(StreamSignalSchema),
+	lastFetchedAt: number()
+});
+Object.values(DeviceType), method(_void(), array(StreamSignalSchema).readonly());
 /** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
 var StreamFormatSchema = _enum([
 	"webrtc",
@@ -11887,6 +11969,22 @@ var EgressTranscodeSchema = object({
 	camStreamId: string().nullable()
 });
 method(object({
+	deviceId: number().int().nonnegative(),
+	/** The provider's signal code. */
+	code: string().min(1),
+	/** Ms epoch. Absent ⇒ now. */
+	at: number().optional()
+}), object({
+	/** Whether the broker acted on it, and if not, why. */
+	accepted: boolean(),
+	reason: _enum([
+		"woke",
+		"hold-extended",
+		"not-enabled",
+		"no-consumer",
+		"unknown-code"
+	])
+}), { kind: "mutation" }), method(object({
 	deviceId: number().int().nonnegative(),
 	camStreamId: string().min(1),
 	kind: CamStreamKindSchema,
@@ -12141,6 +12239,16 @@ var PickStreamRequirementsSchema = object({
 	acceptCodecs: array(StreamCodecSchema).readonly().optional(),
 	/** Minimum vertical resolution. Streams shorter than this are dropped. */
 	minHeight: number().int().positive().optional(),
+	/**
+	* Maximum vertical resolution. Streams TALLER than this are dropped.
+	*
+	* A consumer can have a ceiling as real as its floor: Alexa documents
+	* 480p to 1080p, and a 4K stream is as unusable to an Echo as a 360p one.
+	* Without this the ceiling had to be re-implemented by every caller — and
+	* one caller implementing it privately is how a second scoring authority
+	* gets born.
+	*/
+	maxHeight: number().int().positive().optional(),
 	/** Minimum horizontal resolution. */
 	minWidth: number().int().positive().optional(),
 	/**
@@ -12157,7 +12265,22 @@ var PickStreamRequirementsSchema = object({
 	* transcoded" guard: if the device is already serving the consumer's
 	* codec end-to-end, there's nothing to optimise.
 	*/
-	requireSiblingCodec: array(StreamCodecSchema).readonly().optional()
+	requireSiblingCodec: array(StreamCodecSchema).readonly().optional(),
+	/**
+	* Whether a stream the consumer CANNOT decode may still be picked, on the
+	* understanding that it will be transcoded.
+	*
+	* Default `false` — today's behaviour, and the right one for a bypass
+	* question ("is there a stream I can forward untouched?"). Set `true` to
+	* ask the larger question: "what is the best stream for me, transcoding if
+	* I must?" A stream that satisfies `acceptCodecs` always outranks one that
+	* does not, so a passthrough is never lost to a transcode; the answer says
+	* which it is in {@link PickedCamStreamSchema.transcodes}.
+	*
+	* This is what lets one picker serve both the bypass and the full source
+	* choice, instead of a consumer scoring privately when the bypass misses.
+	*/
+	allowTranscode: boolean().optional()
 }).readonly();
 var PickStreamPreferencesSchema = object({
 	/**
@@ -12171,12 +12294,32 @@ var PickStreamPreferencesSchema = object({
 	* picks the tallest stream; `'lowest'` picks the shortest (used by
 	* memory-constrained consumers / Apple Home guest sessions).
 	*/
-	resolutionPreference: _enum(["highest", "lowest"]).optional()
+	resolutionPreference: _enum(["highest", "lowest"]).optional(),
+	/**
+	* The height the consumer actually wants to DELIVER.
+	*
+	* Not a constraint — an ordering. With it set, the SMALLEST stream at or
+	* above the target wins, and only if nothing reaches it does the tallest
+	* take over. Pulling 1296 lines to draw 720 on a 1280x800 Echo panel costs
+	* a decode and buys nothing, and `resolutionPreference: 'highest'` cannot
+	* express that: it says "as big as possible", which is a different wish.
+	*
+	* Ignored when absent, so every existing caller keeps its ordering.
+	*/
+	targetHeight: number().int().positive().optional()
 }).readonly();
 var PickedCamStreamSchema = object({
 	camStreamId: string(),
 	codec: string().optional(),
 	resolution: CamStreamResolutionSchema.optional(),
+	/**
+	* Whether serving this stream requires a decode + re-encode.
+	*
+	* `false` is a stream the consumer can take as it stands. Only ever `true`
+	* when the caller asked for it with `allowTranscode`, so a caller that did
+	* not ask cannot be handed a cost it never agreed to pay.
+	*/
+	transcodes: boolean(),
 	/** One-line explanation of why this stream won — for logs / debug UI. */
 	reason: string()
 });
@@ -16382,6 +16525,8 @@ var NcSystemEventKindSchema = _enum([
 	"device-enabled",
 	"device-battery-low",
 	"device-battery-normal",
+	"device-consumable-low",
+	"device-consumable-normal",
 	"stream-online",
 	"stream-offline",
 	"node-online",
@@ -16400,6 +16545,7 @@ var NcSystemEventKindSchema = _enum([
 	"addon-updated",
 	"server-updated",
 	"export-completed",
+	"backup-completed",
 	"camera-online",
 	"camera-offline",
 	"camera-disabled",
@@ -19796,13 +19942,109 @@ var SummariesQueryInput = object({
 	deviceIds: array(number()).min(1),
 	since: number().optional(),
 	until: number().optional(),
-	limit: number().int().min(1).max(200).default(50)
+	limit: number().int().min(1).max(200).default(50),
+	/** The same member-wise filter {@link listRecentSummaries} takes — one
+	*  meaning of "dog" on every summary surface. */
+	classes: array(string().min(1).max(60)).max(40).optional()
 });
-var SummariesPageSchema = object({ summaries: array(SummarySchema).readonly() });
 var SummaryDetailSchema = object({
 	summary: SummarySchema,
-	/** Member track ids, in absorption order. */
-	trackIds: array(string()).readonly()
+	/** Members in absorption order, oldest join first. */
+	members: array(object({
+		trackId: string(),
+		/**
+		* The track's class at the time it JOINED, or `null` when it was unresolved
+		* and the track no longer exists to fill it.
+		*
+		* The join, not the latest opinion: class voting can re-decide a track's
+		* class afterwards, and a group's composition is the history of who came
+		* together. A consumer counts these to badge a thumbnail — "two people and a
+		* dog" — rather than being handed a second, denormalised tally that would
+		* drift from the members it claims to describe.
+		*/
+		className: string().nullable(),
+		/** `primary` is the one member that carries the group's identity. */
+		role: _enum([
+			"primary",
+			"sibling",
+			"child"
+		]).nullable(),
+		joinedAt: number(),
+		/** Tier 1 — the sub-class (`dog`, `van`), resolved from the member's track
+		*  at read time. Absent when nothing resolved, never an empty string. */
+		label: string().optional(),
+		/** Tier 2 — the instance: a person's name, a plate. Absent when the pipeline
+		*  recognised nobody, and absent for a member whose track has been pruned —
+		*  a thumbnail that names the wrong person is worse than one naming nobody. */
+		subLabel: string().optional()
+	})).readonly()
+});
+/**
+* What a LIST of groups carries: the envelope plus what it is MADE OF.
+*
+* Coarse on purpose — the operator's rule is "only the rough data on the list,
+* we extend when we notice we need more". Enough to draw the card ("two people
+* and a dog") and no more. The MEMBERS, their names and the per-member links
+* are on {@link getSummary}: shipping every member of every group so a client
+* can count them turns a page of two hundred groups into a thousand records to
+* draw two hundred badges.
+*/
+var SummaryListItemSchema = object({
+	summary: SummarySchema,
+	/** Class counts, most numerous first; `className: null` is a member whose
+	*  class never resolved, counted so the counts add up to `memberCount`. */
+	classes: array(object({
+		className: string().nullable(),
+		count: number().int().positive()
+	})).readonly()
+});
+var SummariesPageSchema = object({ summaries: array(SummaryListItemSchema).readonly() });
+/**
+* The paged feed, deliberately the SAME shape as {@link RecentTracksQueryInput}.
+*
+* The reel on the cameras page and the Events gallery both ride a cursor, so a
+* summaries feed that could only answer "the last N for these cameras"
+* (`listSummaries`) would make groups available in the timeline and nowhere
+* else. Two feeds with different ordering contracts would be two ideas of what
+* "newest" means, on one screen.
+*/
+var RecentSummariesQueryInput = object({
+	/** Devices to merge. An empty array yields an empty page. */
+	deviceIds: array(number()),
+	/** Window lower bound on `lastActiveAt` (inclusive). */
+	since: number().optional(),
+	/** Window upper bound on `lastActiveAt` (inclusive). */
+	until: number().optional(),
+	limit: number().int().min(1).max(500).default(100),
+	/** Opaque continuation cursor from a previous page's `nextCursor`. */
+	cursor: string().optional(),
+	/**
+	* Restrict to these classes — THE SAME FIELD `listRecentTracks` takes, and
+	* deliberately the same name: the events filter tree emits one list of ticked
+	* taxonomy nodes, and a summaries feed that called it something else would
+	* make the operator's one filter component produce two shapes.
+	*
+	* A question about the MEMBERS: a group matches when ANY of them does. "Show
+	* me the arrivals with a dog" has to return the group of four people who had
+	* one with them; a filter on the group's own fields could only ever answer
+	* about its primary.
+	*
+	* Matched against all THREE tiers of a member — the class (`animal`), the
+	* sub-class (`dog`) and the instance (a name, a plate) — because which tier a
+	* ticked node lives on is the taxonomy's business, not the caller's. `dog` is
+	* an event kind in the tree and a tier-1 label on an `animal` track; a filter
+	* that read only the class would answer "animal" and never "dog".
+	*
+	* ABSENT or EMPTY means no filter — absent is not a selection of none.
+	*/
+	classes: array(string().min(1).max(60)).max(40).optional()
+});
+var RecentSummariesPageSchema = object({
+	/** Ordered by (`lastActiveAt` DESC, id DESC). Same light item as
+	*  {@link listSummaries} — one list shape, so a card renders the same
+	*  whichever feed drew it. */
+	summaries: array(SummaryListItemSchema).readonly(),
+	nextCursor: string().nullable()
 });
 var RecentTracksPageSchema = object({
 	/** Merged page, ordered by (`lastSeen` DESC, `trackId` DESC). */
@@ -20216,7 +20458,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	classes: array(string()).optional(),
 	/** See {@link ExcludeSourcesDoc}. */
 	excludeSources: array(TrackSourceSchema).optional()
-}), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(SummariesQueryInput, SummariesPageSchema), method(object({ id: string() }), SummaryDetailSchema.nullable()), method(object({ deviceId: number() }), _void(), {
+}), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(SummariesQueryInput, SummariesPageSchema), method(RecentSummariesQueryInput, RecentSummariesPageSchema), method(object({ id: string() }), SummaryDetailSchema.nullable()), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number() }), array(EventKindDescriptorSchema).readonly()), method(object({ deviceIds: array(number()).min(1).max(200) }), array(EventKindsForDeviceSchema).readonly()), method(object({
@@ -23545,10 +23787,28 @@ DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), ar
 }), boolean()), method(object({
 	deviceId: number().int().nonnegative(),
 	sessionId: string()
-}), object({ pendingRenegotiation: object({
-	target: WebrtcStreamTargetSchema,
-	epoch: number()
-}).nullable() }));
+}), object({
+	pendingRenegotiation: object({
+		target: WebrtcStreamTargetSchema,
+		epoch: number()
+	}).nullable(),
+	/**
+	* Whether the session still EXISTS.
+	*
+	* A consumer that holds a resource for the life of a session needs to
+	* be able to ask, because a session does not always end the way it
+	* began. Measured on this hub 2026-09-13: an Echo that got stuck never
+	* sent `SessionDisconnected`, so the Alexa exporter's
+	* `releaseEgressTranscode` never ran, and a 2304x1296 HEVC to 720p
+	* H.264 transcode kept running for NOBODY for more than twenty
+	* minutes. The WebRTC session had logged `WebRTC session closed`
+	* minutes earlier — the broker knew; the holder had no way to ask.
+	*
+	* `false` for a session id the provider has never heard of, which is
+	* the same answer as "it ended": either way nothing is holding it up.
+	*/
+	alive: boolean()
+}));
 object({
 	/** All accessory children of the parent. */
 	childDeviceIds: array(number()).readonly(),
@@ -29883,7 +30143,29 @@ var LoggingSettingsPatchSchema = object({
 	* disarmed the channels it did not mention would make the Levels page and
 	* the Diagnostics page fight over the same value.
 	*/
-	channels: array(LogChannelWindowPatchSchema).readonly().optional()
+	channels: array(LogChannelWindowPatchSchema).readonly().optional(),
+	/**
+	* How many days the analytics OPS LOG is kept — the audit trail of what
+	* retention actually deleted.
+	*
+	* It lives HERE, on the logging document, and not on the analytics addon's
+	* settings form, on the operator's instruction: every other log-ish window in
+	* this system is configured through this one document, and a retention audit
+	* configured somewhere else is a second place to look when the question is
+	* "what happened to my data".
+	*
+	* That placement has a cost worth stating: this document ships in the
+	* framework closure, so this knob needs a published `@camstack/server` while
+	* the four windows beside it (D485) reach a node on `camstack deploy`.
+	*
+	* `retention-model.ts` argued this one must NOT follow a device window,
+	* because the audit trail is the history of the SWEEP and not of the camera.
+	* That argument stands and is untouched — what changes is that 30 days stops
+	* being a constant nobody can reach. `0` keeps it forever. The floor is 1 day
+	* rather than 0-as-delete: an audit log truncated to nothing is precisely the
+	* state in which the next 9.5 GiB leak cannot be explained.
+	*/
+	opsLogRetentionDays: number().int().min(0).max(3650).optional()
 });
 /**
 * Which LAYER of the hierarchy is addressed. Absent = the cluster layer.
@@ -29956,6 +30238,14 @@ var LoggingSettingsStateSchema = object({
 	channels: array(LogChannelDescriptorSchema).readonly(),
 	/** The channels ARMED right now, each with its deadline. */
 	activeChannels: array(LogChannelWindowStateSchema).readonly(),
+	/**
+	* The ops-log window in days, as it is in force. `0` = kept forever.
+	*
+	* Reported rather than left to the caller's memory of what it wrote: this is
+	* the value the analytics sweep will actually use, and an operator asking how
+	* long their audit trail lives should not have to infer it from a default.
+	*/
+	opsLogRetentionDays: number().int().min(0),
 	persisted: boolean()
 });
 method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
@@ -34115,6 +34405,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRecentSummaries": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRecentTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -36077,6 +36373,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.reportStreamSignal": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.restartProfile": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -36161,6 +36463,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamSignals.listSignals": {
+		capName: "stream-signals",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"switch.setState": {
 		capName: "switch",
 		capScope: "device",
@@ -37942,6 +38250,11 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"pipelineAnalytics.listRecentSummaries": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"pipelineAnalytics.listRecentTracks": [{
 		name: "deviceIds",
 		form: "array",
@@ -38528,6 +38841,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"streamBroker.reportStreamSignal": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"streamBroker.restartProfile": [{
 		name: "deviceId",
 		form: "single",

package/dist/ingress/tailscale-ingress.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-DJhzrxHQ.js");
+const require_dist = require("../dist-BcyUFopm.js");
 let node_crypto = require("node:crypto");
 let node_child_process = require("node:child_process");
 //#region src/ingress/tailscale-cli.ts

package/dist/ingress/tailscale-ingress.addon.mjs

@@ -1,4 +1,4 @@
-import { a as EventCategory, i as BaseAddon, n as networkAccessCapability } from "../dist-cjpimBLk.mjs";
+import { a as EventCategory, i as BaseAddon, n as networkAccessCapability } from "../dist-AkkjrQjN.mjs";
 import { randomUUID } from "node:crypto";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-tailscale",
-  "version": "1.2.100",
+  "version": "1.2.102",
   "description": "Tailscale bundle for CamStack — joins the host to a tailnet (client) and exposes the hub via Serve/Funnel (ingress). Multi-entry npm package shipping 2 addons under a single bundle.",
   "keywords": [
     "camstack",