@camstack/addon-tailscale 1.2.116 → 1.2.118

package/dist/client/tailscale.addon.js

@@ -24,7 +24,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-const require_dist = require("../dist-jCCe7qVD.js");
+const require_dist = require("../dist-B5khvoZj.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_fs = require("node:fs");
@@ -1294,15 +1294,15 @@ var TailscaleClientAddon = class extends require_dist.BaseAddon {
 							type: "boolean",
 							key: "acceptRoutes",
 							label: "Accept routes from peers",
-							description: "Install subnet routes other peers advertise (e.g. a peer router exposing `192.168.x.x/24`).",
+							description: "Install subnet routes other peers advertise (e.g. a peer router exposing `192.168.60.0/24`).",
 							default: false
 						}),
 						this.field({
 							type: "text",
 							key: "advertisedRoutes",
 							label: "Advertise subnet routes",
-							description: "Comma-separated CIDRs this host exposes to peers (e.g. `192.168.x.x/24,10.x.x.x/8`). Requires approval in the Tailscale admin console.",
-							placeholder: "192.168.x.x/24"
+							description: "Comma-separated CIDRs this host exposes to peers (e.g. `192.168.10.0/24,10.0.0.0/8`). Requires approval in the Tailscale admin console.",
+							placeholder: "192.168.10.0/24"
 						}),
 						this.field({
 							type: "text",

package/dist/client/tailscale.addon.mjs

@@ -1,4 +1,4 @@
-import { a as EventCategory, i as BaseAddon, n as networkAccessCapability, r as BOOT_RECOVERY_BACKOFF_MS, t as meshNetworkCapability } from "../dist-DOnpd-Z8.mjs";
+import { a as EventCategory, i as BaseAddon, n as networkAccessCapability, r as BOOT_RECOVERY_BACKOFF_MS, t as meshNetworkCapability } from "../dist-CnsQ7vyF.mjs";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import * as fs from "node:fs";
@@ -1266,15 +1266,15 @@ var TailscaleClientAddon = class extends BaseAddon {
 							type: "boolean",
 							key: "acceptRoutes",
 							label: "Accept routes from peers",
-							description: "Install subnet routes other peers advertise (e.g. a peer router exposing `192.168.x.x/24`).",
+							description: "Install subnet routes other peers advertise (e.g. a peer router exposing `192.168.60.0/24`).",
 							default: false
 						}),
 						this.field({
 							type: "text",
 							key: "advertisedRoutes",
 							label: "Advertise subnet routes",
-							description: "Comma-separated CIDRs this host exposes to peers (e.g. `192.168.x.x/24,10.x.x.x/8`). Requires approval in the Tailscale admin console.",
-							placeholder: "192.168.x.x/24"
+							description: "Comma-separated CIDRs this host exposes to peers (e.g. `192.168.10.0/24,10.0.0.0/8`). Requires approval in the Tailscale admin console.",
+							placeholder: "192.168.10.0/24"
 						}),
 						this.field({
 							type: "text",

package/dist/{dist-jCCe7qVD.js → dist-B5khvoZj.js}

@@ -10554,11 +10554,11 @@ var ModelVariantGroupSchema = object({
 	/** Quantization axis. Omit ⇒ the fp32 base build. */
 	precision: _enum(["fp32", "int8"]).optional(),
 	/**
-	* Speed-optimization axis. Omit ⇒ the standard build. `fast` marks a
-	* latency-optimized export (e.g. ReLU-activation variant) — the slot the
-	* future performance variants plug into.
+	* Training / latency-variant axis. Omit ⇒ the standard build. `test` marks
+	* an alternate training of the same family (Scrypted `relu_test`); chip
+	* label is "Test".
 	*/
-	optimization: _enum(["standard", "fast"]).optional(),
+	optimization: _enum(["standard", "test"]).optional(),
 	/**
 	* Input-resolution axis (square input side, px). Omit ⇒ the family's native
 	* resolution (640 for yolo26). Reduced-input builds (320 / 256) are a big,
@@ -10581,9 +10581,10 @@ var ModelProviderIdSchema = _enum([
 * are per upstream. A persisted custom-model row written when this field was a
 * string still parses — the string is lifted into `{ weights }`.
 *
-* Every licence surface (the admin "Models and licenses" page,
-* `THIRD_PARTY_MODELS.md`, the Hugging Face model table) is GENERATED from
-* these records by `scripts/gen-model-licenses.ts` (D661).
+* Every machine licence surface (`THIRD_PARTY_MODELS.md`, the Hugging Face
+* model table) is GENERATED from these records by
+* `scripts/gen-model-licenses.ts` (D661). Operator-facing docs live in
+* `camstack/docs` → `/docs/detection/models`.
 */
 var ModelLicenseSchema = preprocess((value) => typeof value === "string" ? { weights: value } : value, object({
 	/** SPDX id of the WEIGHTS' terms, a `LicenseRef-*` for non-SPDX terms, or `UNKNOWN`. */
@@ -14112,7 +14113,7 @@ DeviceType.Camera;
 * This matters here more than anywhere else in the repo, because every provider
 * that knows a device's host knows its PASSWORD too: `{ host, port, username,
 * password }` sit in one object on Hikvision, Amcrest, Reolink and ONVIF alike,
-* and `http://admin:hunter2@192.168.x.x/` is a URL a browser accepts. The
+* and `http://admin:hunter2@192.168.60.139/` is a URL a browser accepts. The
 * camera's own page will ask for its own login. That is correct, and pre-
 * filling it is the operator's business, not ours.
 *
@@ -17096,7 +17097,7 @@ method(object({
 	timeoutMs: 6e5
 });
 method(object({
-	nodeId: string(),
+	targetNodeId: string(),
 	modelId: string(),
 	format: _enum(MODEL_FORMATS),
 	entry: ModelCatalogEntrySchema
@@ -19579,8 +19580,9 @@ var NcRuleSchema = NcRuleInputSchema.extend({
 	disabledTargetIds: array(string()).default([])
 });
 /**
-* The state-summary SECTIONS (D647 / D698): the D637 kind groups that report a
-* still-true state. `backups-exports` and `alarm` are not sections — a completed
+* The state-summary SECTIONS (D647 / D698 / D708): the D637 kind groups that
+* report a still-true state. `addons` is the crash-looped addons only and
+* `addon-updates` the addons that are behind (D708 split them). `backups-exports` and `alarm` are not sections — a completed
 * job is not an open state, and the alarm stays instant.
 */
 var NcStateSummarySectionIdSchema = _enum([
@@ -19592,6 +19594,7 @@ var NcStateSummarySectionIdSchema = _enum([
 	"detection-blind",
 	"nodes",
 	"addons",
+	"addon-updates",
 	"updates"
 ]);
 /** One section of a previewed state summary. `unavailable` = its state could not be read. */
@@ -20072,7 +20075,19 @@ var NcAlarmModeDelaysListSchema = array(object({
 	* When this mode may be armed. Absent / null = always allowed (same as a
 	* rule with no `schedule`). Evaluated with {@link isScheduleActive}.
 	*/
-	schedule: NcScheduleSchema.optional()
+	schedule: NcScheduleSchema.optional(),
+	/**
+	* D706: while this mode's ENTRY DELAY runs, do the alarm rules' own pushes go out (as an
+	* intrusion naming the locations)? Absent = false — the entry-delay notification is the
+	* only one, and the matches ride the triggered notification's mosaic (D705).
+	*/
+	notifyDuringEntryDelay: boolean().optional(),
+	/**
+	* D706: notify "watched again" when a sensor this arm bypassed closes and opens again.
+	* Absent = false (logged, not sent). Even when true it is not sent when that same sensor
+	* is the one that starts the entry delay — the entry-delay notification already names it.
+	*/
+	notifySensorRewatched: boolean().optional()
 })).max(8).refine(uniqueModes, { message: "modeDelays: at most one entry per arm mode" });
 var NcAlarmModeDelaysEditListSchema = array(object({
 	mode: AlarmArmModeSchema,
@@ -20081,7 +20096,11 @@ var NcAlarmModeDelaysEditListSchema = array(object({
 	triggeredDurationSec: NcAlarmTriggeredSecSchema.nullable().optional(),
 	postTriggeredAction: NcAlarmPostTriggeredActionSchema.nullable().optional(),
 	/** Set a schedule, or `null` to clear (mode always allowed again). */
-	schedule: NcScheduleSchema.nullable().optional()
+	schedule: NcScheduleSchema.nullable().optional(),
+	/** D706: set the switch, or `null` to clear it (back to the default, false). */
+	notifyDuringEntryDelay: boolean().nullable().optional(),
+	/** D706: set the switch, or `null` to clear it (back to the default, false). */
+	notifySensorRewatched: boolean().nullable().optional()
 })).max(8).refine(uniqueModes, { message: "modeDelays: at most one edit per arm mode" });
 /** One switch of the alarm table: put ONE device on, or take it off, ONE mode's list. */
 var NcAlarmNonBlockingEditSchema = object({
@@ -21042,39 +21061,19 @@ Object.freeze(Object.fromEntries([{
 	label: "Face recognition model",
 	defaultModelId: "auraface-r100",
 	indexName: "the enrolled face gallery",
-	options: [
-		{
-			id: "auraface-r100",
-			label: "AuraFace R100"
-		},
-		{
-			id: "arcface-r100",
-			label: "ArcFace (ResNet34)"
-		},
-		{
-			id: "inception-resnet-v1",
-			label: "Inception ResNet V1"
-		}
-	]
+	options: [{
+		id: "auraface-r100",
+		label: "AuraFace R100"
+	}]
 }, {
 	stepId: "clip-embedding",
 	label: "Semantic search model",
-	defaultModelId: "mobileclip-s1",
+	defaultModelId: "siglip2-b16-224",
 	indexName: "the object semantic-search index",
-	options: [
-		{
-			id: "mobileclip-s1",
-			label: "MobileCLIP S1"
-		},
-		{
-			id: "mobileclip-s2",
-			label: "MobileCLIP S2"
-		},
-		{
-			id: "siglip2-b16-224",
-			label: "SigLIP2 B/16 (Apache-2.0)"
-		}
-	]
+	options: [{
+		id: "siglip2-b16-224",
+		label: "SigLIP2 B/16 (Apache-2.0)"
+	}]
 }].map((s) => [s.stepId, s.defaultModelId])));
 var CLUSTER_STEP_SETTING_FIELDS = [{
 	stepId: "face-embedding",
@@ -23922,6 +23921,22 @@ var MotionSourceEnum = _enum([
 	"device-activity"
 ]);
 /**
+* What opened an on-motion detection SESSION: the motion source that passed the
+* camera's `motionSources` gate, and what raised it (the camera itself, or a
+* sensor the operator attached — D672). `sensorName` is the attached sensor's
+* device name as the orchestrator's camera-sensors resolution last read it;
+* absent when unknown or when the camera itself triggered.
+*
+* Carried on the session attach ONLY so the runner's `DetectionPhaseTransition`
+* can say what started the session (D672 rule 11, amended 2026-10-06). The
+* runner never decides anything on it.
+*/
+var SessionTriggerSchema = object({
+	source: MotionSourceEnum,
+	triggeredBy: MotionTriggeredBySchema,
+	sensorName: string().optional()
+});
+/**
 * List of motion sources active on a camera. Empty array is valid:
 * "no source" — happens for battery cams without firmware motion when
 * the operator hasn't opted into the SW analyzer (would hold the
@@ -24173,6 +24188,14 @@ var RunnerCameraConfigSchema = object({
 	*/
 	motionSources: MotionSourcesSchema.default(["analyzer"]),
 	/**
+	* What opened this attach, on a SESSION attach only (see
+	* {@link SessionTriggerSchema}). OPTIONAL with no default: absent on a
+	* standing attach, an occupancy burst, a re-dispatch with no motion event
+	* behind it, and every attach from an orchestrator older than the field — the
+	* runner then names no source on the phase event.
+	*/
+	sessionTrigger: SessionTriggerSchema.optional(),
+	/**
 	* WHICH root detector runs for this camera. The detection counterpart of
 	* {@link motionSources}, same shape and same discipline: a per-camera list
 	* of sources the system understands, vendor-agnostic, owned here.
@@ -30396,7 +30419,7 @@ var LocalInterfaceSchema = object({
 	name: string(),
 	family: _enum(["IPv4", "IPv6"]),
 	address: string(),
-	/** CIDR shorthand (e.g. `192.168.x.x/24`). Empty when OS doesn't expose. */
+	/** CIDR shorthand (e.g. `192.168.10.10/24`). Empty when OS doesn't expose. */
 	cidr: string(),
 	/** OS netmask. Stable across calls so the SDK can hash on it. */
 	netmask: string(),
@@ -30450,7 +30473,8 @@ var ConnectionEndpointSchema = object({
 		"lan-ipv4",
 		"lan-ipv6",
 		"public",
-		"loopback"
+		"loopback",
+		"app-link"
 	]),
 	/**
 	* Originating-interface kind — `lan`/`wifi`/`docker`/`vpn`/`other`/
@@ -30519,15 +30543,27 @@ var GetConnectionEndpointsResultSchema = object({
 	localPort: AdvertisedLocalPortSchema
 });
 /**
-* The chosen outbound endpoint for notification artifacts. `baseUrl: null` =
-* AUTO (resolved from the candidate ranking at send time); `resolved` reports
-* what AUTO currently picks, so the UI can show the effective value either way.
+* The address flagged for notification links. `baseUrl: null` = AUTO, which
+* since D709 is the CamStack app link; `resolved` reports the effective value,
+* so the UI can show it either way.
 */
 var NotificationEndpointSchema = object({
 	/** The operator's explicit choice, or null for AUTO. */
 	baseUrl: string().nullable(),
-	/** What the ranking currently resolves to (null when nothing is reachable). */
-	resolved: string().nullable()
+	/**
+	* The effective flagged address: the explicit choice, else (AUTO) the
+	* CamStack app link `https://camstack.zentik.app` (D709). A pre-D709 hub
+	* answered the public tunnel / mesh here, or null.
+	*/
+	resolved: string().nullable(),
+	/**
+	* The hub origin an app link carries as `hub=` (D709): the hub's best
+	* public HTTPS address — the tunnel, then the mesh (Tailscale MagicDNS) —
+	* picked from this cap's own palette by `pickAppLinkHub`. `null` when the
+	* hub advertises neither; the app link is then minted without `hub=`.
+	* Absent on a pre-D709 hub.
+	*/
+	appLinkHub: string().nullable()
 });
 /**
 * The URLs the SDK / viewer should race for API access. `baseUrls` empty =
@@ -30581,7 +30617,11 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*  Pass `'https'` when the caller is itself loaded over HTTPS
 	*  to avoid mixed-content blocks in the browser. The public
 	*  tunnel always emits `https://` regardless. */
-	scheme: _enum(["http", "https"]).optional()
+	scheme: _enum(["http", "https"]).optional(),
+	/** Append the CamStack app link entry (`kind: 'app-link'`, D709) —
+	*  an address notification links can be flagged with, not a hub
+	*  route. Default `false`: racers and rankers never see it. */
+	includeAppLink: boolean().optional()
 }), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), ViewerEndpointsSchema), method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -30842,7 +30882,7 @@ var MeshPeerSchema = object({
 	tags: array(string()).readonly(),
 	/** True when the peer advertises itself as an exit-node candidate. */
 	exitNodeOption: boolean(),
-	/** Subnet routes the peer advertises (e.g. `["192.168.x.x/24"]`). */
+	/** Subnet routes the peer advertises (e.g. `["192.168.10.0/24"]`). */
 	advertisedRoutes: array(string()).readonly(),
 	/** Owner account login (e.g. `foo@example.com`). Null for tagged peers. */
 	userLogin: string().nullable(),
@@ -31847,7 +31887,13 @@ var OsdStatusSchema = object({ overlays: array(object({
 	*/
 	availablePositions: array(OsdPositionEnum).readonly(),
 	/** Firmware does not allow editing the `text` field (e.g. timestamp). */
-	readOnly: boolean().optional()
+	readOnly: boolean().optional(),
+	/**
+	* Firmware text ceiling for this overlay. Absent = no known limit.
+	* The OSD manager truncates here on every write — never stores its own
+	* copy on the binding.
+	*/
+	maxCharacters: number().int().positive().optional()
 })).readonly() });
 var OsdOverlayPatchSchema = object({
 	enabled: boolean().optional(),
@@ -31898,7 +31944,9 @@ var OsdTemplateBindingSchema = object({
 	valuePath: string().min(1).max(64),
 	/** Convert TO this unit at render (`tryConvertUnit`). Absent = source unit. */
 	displayUnit: string().max(16).optional(),
-	maxDecimals: number().int().min(0).max(4).default(1)
+	maxDecimals: number().int().min(0).max(4).default(1),
+	/** Raw value → display text (same shape as slot binding). Empty string hides. */
+	valueMap: record(string(), string()).optional()
 });
 /**
 * A named template: bindings (alias → leaf field) + a parser that
@@ -31948,18 +31996,11 @@ var OsdSlotBindingSchema = object({
 	source: OsdSourceSchema,
 	/** `${value}` and `${unit}` are substituted; every occurrence. */
 	template: string().max(96).default("${value}"),
-	/** Truncate with an ellipsis past this length. Absent = no limit. */
-	maxCharacters: number().int().min(4).max(64).optional(),
 	/**
 	* Decimal places for a numeric value. `0` yields an integer — the
 	* documented workaround for firmwares that reject `.` in overlay text.
 	*/
 	maxDecimals: number().int().min(0).max(4).default(1),
-	/**
-	* Appended via `${unit}` when no unit conversion produces a label.
-	* Prefer `source.displayUnit` for converted device-state values.
-	*/
-	unitLabel: string().max(8).optional(),
 	/** Raw value → display text, e.g. `{"true":"MOTION","false":""}`. */
 	valueMap: record(string(), string()).optional(),
 	/** Time windows in which the slot is shown. Absent = always. */
@@ -31968,9 +32009,7 @@ var OsdSlotBindingSchema = object({
 	* Display gate, in the notification centre's condition vocabulary.
 	* Only the keys reported by `getConditionSupport` are accepted.
 	*/
-	conditions: NcConditionsSchema.optional(),
-	/** Rendered when the gate is closed or the value unreadable. Empty = hide. */
-	fallbackText: string().max(64).default("")
+	conditions: NcConditionsSchema.optional()
 });
 /** One camera slot, as the operator sees it: firmware truth + our binding. */
 var OsdSlotViewSchema = object({
@@ -47647,12 +47686,14 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 	{
 		id: "addons",
 		family: "system",
-		label: "Addons",
-		kinds: [
-			"addon-crash-loop",
-			"addon-update-available",
-			"addon-updated"
-		]
+		label: "Addons stopped",
+		kinds: ["addon-crash-loop"]
+	},
+	{
+		id: "addon-updates",
+		family: "system",
+		label: "Addon updates",
+		kinds: ["addon-update-available", "addon-updated"]
 	},
 	{
 		id: "updates",
@@ -47812,13 +47853,15 @@ var STATE_SUMMARY_SECTION_VARS = [
 	},
 	{
 		name: "summaryAddons",
-		label: "Summary: addons",
-		example: "@camstack/addon-recorder 1.2.3 → 1.2.4",
-		kinds: [
-			"addon-crash-loop",
-			"addon-update-available",
-			"addon-updated"
-		]
+		label: "Summary: addons stopped",
+		example: "hub — recorder stopped after repeated crashes",
+		kinds: ["addon-crash-loop"]
+	},
+	{
+		name: "summaryAddonUpdates",
+		label: "Summary: addon updates",
+		example: "hub:\n• @camstack/addon-recorder 1.2.3 → 1.2.4",
+		kinds: ["addon-update-available", "addon-updated"]
 	},
 	{
 		name: "summaryUpdates",
@@ -47902,6 +47945,7 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_BODY_ONLY],
 	[...RULE_TEXT],
 	([...RULE_TEXT], [...DEVICE_EVENTS]),
+	([...RULE_TEXT], [...COMBINED_ALARM]),
 	([...RULE_TEXT], [...DEVICE_EVENTS]),
 	([...RULE_TEXT], [...BATTERY, ...CONSUMABLE]),
 	([...RULE_TEXT], [...CONSUMABLE]),
@@ -47942,6 +47986,8 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
 	...STATE_SUMMARY_VARS
 ];
 new Set([

package/dist/{dist-DOnpd-Z8.mjs → dist-CnsQ7vyF.mjs}

@@ -10553,11 +10553,11 @@ var ModelVariantGroupSchema = object({
 	/** Quantization axis. Omit ⇒ the fp32 base build. */
 	precision: _enum(["fp32", "int8"]).optional(),
 	/**
-	* Speed-optimization axis. Omit ⇒ the standard build. `fast` marks a
-	* latency-optimized export (e.g. ReLU-activation variant) — the slot the
-	* future performance variants plug into.
+	* Training / latency-variant axis. Omit ⇒ the standard build. `test` marks
+	* an alternate training of the same family (Scrypted `relu_test`); chip
+	* label is "Test".
 	*/
-	optimization: _enum(["standard", "fast"]).optional(),
+	optimization: _enum(["standard", "test"]).optional(),
 	/**
 	* Input-resolution axis (square input side, px). Omit ⇒ the family's native
 	* resolution (640 for yolo26). Reduced-input builds (320 / 256) are a big,
@@ -10580,9 +10580,10 @@ var ModelProviderIdSchema = _enum([
 * are per upstream. A persisted custom-model row written when this field was a
 * string still parses — the string is lifted into `{ weights }`.
 *
-* Every licence surface (the admin "Models and licenses" page,
-* `THIRD_PARTY_MODELS.md`, the Hugging Face model table) is GENERATED from
-* these records by `scripts/gen-model-licenses.ts` (D661).
+* Every machine licence surface (`THIRD_PARTY_MODELS.md`, the Hugging Face
+* model table) is GENERATED from these records by
+* `scripts/gen-model-licenses.ts` (D661). Operator-facing docs live in
+* `camstack/docs` → `/docs/detection/models`.
 */
 var ModelLicenseSchema = preprocess((value) => typeof value === "string" ? { weights: value } : value, object({
 	/** SPDX id of the WEIGHTS' terms, a `LicenseRef-*` for non-SPDX terms, or `UNKNOWN`. */
@@ -14111,7 +14112,7 @@ DeviceType.Camera;
 * This matters here more than anywhere else in the repo, because every provider
 * that knows a device's host knows its PASSWORD too: `{ host, port, username,
 * password }` sit in one object on Hikvision, Amcrest, Reolink and ONVIF alike,
-* and `http://admin:hunter2@192.168.x.x/` is a URL a browser accepts. The
+* and `http://admin:hunter2@192.168.60.139/` is a URL a browser accepts. The
 * camera's own page will ask for its own login. That is correct, and pre-
 * filling it is the operator's business, not ours.
 *
@@ -17095,7 +17096,7 @@ method(object({
 	timeoutMs: 6e5
 });
 method(object({
-	nodeId: string(),
+	targetNodeId: string(),
 	modelId: string(),
 	format: _enum(MODEL_FORMATS),
 	entry: ModelCatalogEntrySchema
@@ -19578,8 +19579,9 @@ var NcRuleSchema = NcRuleInputSchema.extend({
 	disabledTargetIds: array(string()).default([])
 });
 /**
-* The state-summary SECTIONS (D647 / D698): the D637 kind groups that report a
-* still-true state. `backups-exports` and `alarm` are not sections — a completed
+* The state-summary SECTIONS (D647 / D698 / D708): the D637 kind groups that
+* report a still-true state. `addons` is the crash-looped addons only and
+* `addon-updates` the addons that are behind (D708 split them). `backups-exports` and `alarm` are not sections — a completed
 * job is not an open state, and the alarm stays instant.
 */
 var NcStateSummarySectionIdSchema = _enum([
@@ -19591,6 +19593,7 @@ var NcStateSummarySectionIdSchema = _enum([
 	"detection-blind",
 	"nodes",
 	"addons",
+	"addon-updates",
 	"updates"
 ]);
 /** One section of a previewed state summary. `unavailable` = its state could not be read. */
@@ -20071,7 +20074,19 @@ var NcAlarmModeDelaysListSchema = array(object({
 	* When this mode may be armed. Absent / null = always allowed (same as a
 	* rule with no `schedule`). Evaluated with {@link isScheduleActive}.
 	*/
-	schedule: NcScheduleSchema.optional()
+	schedule: NcScheduleSchema.optional(),
+	/**
+	* D706: while this mode's ENTRY DELAY runs, do the alarm rules' own pushes go out (as an
+	* intrusion naming the locations)? Absent = false — the entry-delay notification is the
+	* only one, and the matches ride the triggered notification's mosaic (D705).
+	*/
+	notifyDuringEntryDelay: boolean().optional(),
+	/**
+	* D706: notify "watched again" when a sensor this arm bypassed closes and opens again.
+	* Absent = false (logged, not sent). Even when true it is not sent when that same sensor
+	* is the one that starts the entry delay — the entry-delay notification already names it.
+	*/
+	notifySensorRewatched: boolean().optional()
 })).max(8).refine(uniqueModes, { message: "modeDelays: at most one entry per arm mode" });
 var NcAlarmModeDelaysEditListSchema = array(object({
 	mode: AlarmArmModeSchema,
@@ -20080,7 +20095,11 @@ var NcAlarmModeDelaysEditListSchema = array(object({
 	triggeredDurationSec: NcAlarmTriggeredSecSchema.nullable().optional(),
 	postTriggeredAction: NcAlarmPostTriggeredActionSchema.nullable().optional(),
 	/** Set a schedule, or `null` to clear (mode always allowed again). */
-	schedule: NcScheduleSchema.nullable().optional()
+	schedule: NcScheduleSchema.nullable().optional(),
+	/** D706: set the switch, or `null` to clear it (back to the default, false). */
+	notifyDuringEntryDelay: boolean().nullable().optional(),
+	/** D706: set the switch, or `null` to clear it (back to the default, false). */
+	notifySensorRewatched: boolean().nullable().optional()
 })).max(8).refine(uniqueModes, { message: "modeDelays: at most one edit per arm mode" });
 /** One switch of the alarm table: put ONE device on, or take it off, ONE mode's list. */
 var NcAlarmNonBlockingEditSchema = object({
@@ -21041,39 +21060,19 @@ Object.freeze(Object.fromEntries([{
 	label: "Face recognition model",
 	defaultModelId: "auraface-r100",
 	indexName: "the enrolled face gallery",
-	options: [
-		{
-			id: "auraface-r100",
-			label: "AuraFace R100"
-		},
-		{
-			id: "arcface-r100",
-			label: "ArcFace (ResNet34)"
-		},
-		{
-			id: "inception-resnet-v1",
-			label: "Inception ResNet V1"
-		}
-	]
+	options: [{
+		id: "auraface-r100",
+		label: "AuraFace R100"
+	}]
 }, {
 	stepId: "clip-embedding",
 	label: "Semantic search model",
-	defaultModelId: "mobileclip-s1",
+	defaultModelId: "siglip2-b16-224",
 	indexName: "the object semantic-search index",
-	options: [
-		{
-			id: "mobileclip-s1",
-			label: "MobileCLIP S1"
-		},
-		{
-			id: "mobileclip-s2",
-			label: "MobileCLIP S2"
-		},
-		{
-			id: "siglip2-b16-224",
-			label: "SigLIP2 B/16 (Apache-2.0)"
-		}
-	]
+	options: [{
+		id: "siglip2-b16-224",
+		label: "SigLIP2 B/16 (Apache-2.0)"
+	}]
 }].map((s) => [s.stepId, s.defaultModelId])));
 var CLUSTER_STEP_SETTING_FIELDS = [{
 	stepId: "face-embedding",
@@ -23921,6 +23920,22 @@ var MotionSourceEnum = _enum([
 	"device-activity"
 ]);
 /**
+* What opened an on-motion detection SESSION: the motion source that passed the
+* camera's `motionSources` gate, and what raised it (the camera itself, or a
+* sensor the operator attached — D672). `sensorName` is the attached sensor's
+* device name as the orchestrator's camera-sensors resolution last read it;
+* absent when unknown or when the camera itself triggered.
+*
+* Carried on the session attach ONLY so the runner's `DetectionPhaseTransition`
+* can say what started the session (D672 rule 11, amended 2026-10-06). The
+* runner never decides anything on it.
+*/
+var SessionTriggerSchema = object({
+	source: MotionSourceEnum,
+	triggeredBy: MotionTriggeredBySchema,
+	sensorName: string().optional()
+});
+/**
 * List of motion sources active on a camera. Empty array is valid:
 * "no source" — happens for battery cams without firmware motion when
 * the operator hasn't opted into the SW analyzer (would hold the
@@ -24172,6 +24187,14 @@ var RunnerCameraConfigSchema = object({
 	*/
 	motionSources: MotionSourcesSchema.default(["analyzer"]),
 	/**
+	* What opened this attach, on a SESSION attach only (see
+	* {@link SessionTriggerSchema}). OPTIONAL with no default: absent on a
+	* standing attach, an occupancy burst, a re-dispatch with no motion event
+	* behind it, and every attach from an orchestrator older than the field — the
+	* runner then names no source on the phase event.
+	*/
+	sessionTrigger: SessionTriggerSchema.optional(),
+	/**
 	* WHICH root detector runs for this camera. The detection counterpart of
 	* {@link motionSources}, same shape and same discipline: a per-camera list
 	* of sources the system understands, vendor-agnostic, owned here.
@@ -30395,7 +30418,7 @@ var LocalInterfaceSchema = object({
 	name: string(),
 	family: _enum(["IPv4", "IPv6"]),
 	address: string(),
-	/** CIDR shorthand (e.g. `192.168.x.x/24`). Empty when OS doesn't expose. */
+	/** CIDR shorthand (e.g. `192.168.10.10/24`). Empty when OS doesn't expose. */
 	cidr: string(),
 	/** OS netmask. Stable across calls so the SDK can hash on it. */
 	netmask: string(),
@@ -30449,7 +30472,8 @@ var ConnectionEndpointSchema = object({
 		"lan-ipv4",
 		"lan-ipv6",
 		"public",
-		"loopback"
+		"loopback",
+		"app-link"
 	]),
 	/**
 	* Originating-interface kind — `lan`/`wifi`/`docker`/`vpn`/`other`/
@@ -30518,15 +30542,27 @@ var GetConnectionEndpointsResultSchema = object({
 	localPort: AdvertisedLocalPortSchema
 });
 /**
-* The chosen outbound endpoint for notification artifacts. `baseUrl: null` =
-* AUTO (resolved from the candidate ranking at send time); `resolved` reports
-* what AUTO currently picks, so the UI can show the effective value either way.
+* The address flagged for notification links. `baseUrl: null` = AUTO, which
+* since D709 is the CamStack app link; `resolved` reports the effective value,
+* so the UI can show it either way.
 */
 var NotificationEndpointSchema = object({
 	/** The operator's explicit choice, or null for AUTO. */
 	baseUrl: string().nullable(),
-	/** What the ranking currently resolves to (null when nothing is reachable). */
-	resolved: string().nullable()
+	/**
+	* The effective flagged address: the explicit choice, else (AUTO) the
+	* CamStack app link `https://camstack.zentik.app` (D709). A pre-D709 hub
+	* answered the public tunnel / mesh here, or null.
+	*/
+	resolved: string().nullable(),
+	/**
+	* The hub origin an app link carries as `hub=` (D709): the hub's best
+	* public HTTPS address — the tunnel, then the mesh (Tailscale MagicDNS) —
+	* picked from this cap's own palette by `pickAppLinkHub`. `null` when the
+	* hub advertises neither; the app link is then minted without `hub=`.
+	* Absent on a pre-D709 hub.
+	*/
+	appLinkHub: string().nullable()
 });
 /**
 * The URLs the SDK / viewer should race for API access. `baseUrls` empty =
@@ -30580,7 +30616,11 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*  Pass `'https'` when the caller is itself loaded over HTTPS
 	*  to avoid mixed-content blocks in the browser. The public
 	*  tunnel always emits `https://` regardless. */
-	scheme: _enum(["http", "https"]).optional()
+	scheme: _enum(["http", "https"]).optional(),
+	/** Append the CamStack app link entry (`kind: 'app-link'`, D709) —
+	*  an address notification links can be flagged with, not a hub
+	*  route. Default `false`: racers and rankers never see it. */
+	includeAppLink: boolean().optional()
 }), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), ViewerEndpointsSchema), method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -30841,7 +30881,7 @@ var MeshPeerSchema = object({
 	tags: array(string()).readonly(),
 	/** True when the peer advertises itself as an exit-node candidate. */
 	exitNodeOption: boolean(),
-	/** Subnet routes the peer advertises (e.g. `["192.168.x.x/24"]`). */
+	/** Subnet routes the peer advertises (e.g. `["192.168.10.0/24"]`). */
 	advertisedRoutes: array(string()).readonly(),
 	/** Owner account login (e.g. `foo@example.com`). Null for tagged peers. */
 	userLogin: string().nullable(),
@@ -31846,7 +31886,13 @@ var OsdStatusSchema = object({ overlays: array(object({
 	*/
 	availablePositions: array(OsdPositionEnum).readonly(),
 	/** Firmware does not allow editing the `text` field (e.g. timestamp). */
-	readOnly: boolean().optional()
+	readOnly: boolean().optional(),
+	/**
+	* Firmware text ceiling for this overlay. Absent = no known limit.
+	* The OSD manager truncates here on every write — never stores its own
+	* copy on the binding.
+	*/
+	maxCharacters: number().int().positive().optional()
 })).readonly() });
 var OsdOverlayPatchSchema = object({
 	enabled: boolean().optional(),
@@ -31897,7 +31943,9 @@ var OsdTemplateBindingSchema = object({
 	valuePath: string().min(1).max(64),
 	/** Convert TO this unit at render (`tryConvertUnit`). Absent = source unit. */
 	displayUnit: string().max(16).optional(),
-	maxDecimals: number().int().min(0).max(4).default(1)
+	maxDecimals: number().int().min(0).max(4).default(1),
+	/** Raw value → display text (same shape as slot binding). Empty string hides. */
+	valueMap: record(string(), string()).optional()
 });
 /**
 * A named template: bindings (alias → leaf field) + a parser that
@@ -31947,18 +31995,11 @@ var OsdSlotBindingSchema = object({
 	source: OsdSourceSchema,
 	/** `${value}` and `${unit}` are substituted; every occurrence. */
 	template: string().max(96).default("${value}"),
-	/** Truncate with an ellipsis past this length. Absent = no limit. */
-	maxCharacters: number().int().min(4).max(64).optional(),
 	/**
 	* Decimal places for a numeric value. `0` yields an integer — the
 	* documented workaround for firmwares that reject `.` in overlay text.
 	*/
 	maxDecimals: number().int().min(0).max(4).default(1),
-	/**
-	* Appended via `${unit}` when no unit conversion produces a label.
-	* Prefer `source.displayUnit` for converted device-state values.
-	*/
-	unitLabel: string().max(8).optional(),
 	/** Raw value → display text, e.g. `{"true":"MOTION","false":""}`. */
 	valueMap: record(string(), string()).optional(),
 	/** Time windows in which the slot is shown. Absent = always. */
@@ -31967,9 +32008,7 @@ var OsdSlotBindingSchema = object({
 	* Display gate, in the notification centre's condition vocabulary.
 	* Only the keys reported by `getConditionSupport` are accepted.
 	*/
-	conditions: NcConditionsSchema.optional(),
-	/** Rendered when the gate is closed or the value unreadable. Empty = hide. */
-	fallbackText: string().max(64).default("")
+	conditions: NcConditionsSchema.optional()
 });
 /** One camera slot, as the operator sees it: firmware truth + our binding. */
 var OsdSlotViewSchema = object({
@@ -47646,12 +47685,14 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 	{
 		id: "addons",
 		family: "system",
-		label: "Addons",
-		kinds: [
-			"addon-crash-loop",
-			"addon-update-available",
-			"addon-updated"
-		]
+		label: "Addons stopped",
+		kinds: ["addon-crash-loop"]
+	},
+	{
+		id: "addon-updates",
+		family: "system",
+		label: "Addon updates",
+		kinds: ["addon-update-available", "addon-updated"]
 	},
 	{
 		id: "updates",
@@ -47811,13 +47852,15 @@ var STATE_SUMMARY_SECTION_VARS = [
 	},
 	{
 		name: "summaryAddons",
-		label: "Summary: addons",
-		example: "@camstack/addon-recorder 1.2.3 → 1.2.4",
-		kinds: [
-			"addon-crash-loop",
-			"addon-update-available",
-			"addon-updated"
-		]
+		label: "Summary: addons stopped",
+		example: "hub — recorder stopped after repeated crashes",
+		kinds: ["addon-crash-loop"]
+	},
+	{
+		name: "summaryAddonUpdates",
+		label: "Summary: addon updates",
+		example: "hub:\n• @camstack/addon-recorder 1.2.3 → 1.2.4",
+		kinds: ["addon-update-available", "addon-updated"]
 	},
 	{
 		name: "summaryUpdates",
@@ -47901,6 +47944,7 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_BODY_ONLY],
 	[...RULE_TEXT],
 	([...RULE_TEXT], [...DEVICE_EVENTS]),
+	([...RULE_TEXT], [...COMBINED_ALARM]),
 	([...RULE_TEXT], [...DEVICE_EVENTS]),
 	([...RULE_TEXT], [...BATTERY, ...CONSUMABLE]),
 	([...RULE_TEXT], [...CONSUMABLE]),
@@ -47941,6 +47985,8 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
 	...STATE_SUMMARY_VARS
 ];
 new Set([

package/dist/ingress/tailscale-ingress.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-jCCe7qVD.js");
+const require_dist = require("../dist-B5khvoZj.js");
 let node_crypto = require("node:crypto");
 let node_child_process = require("node:child_process");
 //#region src/ingress/tailscale-cli.ts

package/dist/ingress/tailscale-ingress.addon.mjs

@@ -1,4 +1,4 @@
-import { a as EventCategory, i as BaseAddon, n as networkAccessCapability } from "../dist-DOnpd-Z8.mjs";
+import { a as EventCategory, i as BaseAddon, n as networkAccessCapability } from "../dist-CnsQ7vyF.mjs";
 import { randomUUID } from "node:crypto";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-tailscale",
-  "version": "1.2.116",
+  "version": "1.2.118",
   "description": "Tailscale bundle for CamStack — joins the host to a tailnet (client) and exposes the hub via Serve/Funnel (ingress). Multi-entry npm package shipping 2 addons under a single bundle.",
   "keywords": [
     "camstack",