@camstack/addon-tailscale 1.2.25 → 1.2.27

package/dist/client/tailscale.addon.js

@@ -24,7 +24,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-const require_dist = require("../dist-B3cBbqzz.js");
+const require_dist = require("../dist-BrkbC1tE.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_fs = require("node:fs");

package/dist/client/tailscale.addon.mjs

@@ -1,4 +1,4 @@
-import { a as EventCategory, i as BaseAddon, n as networkAccessCapability, r as BOOT_RECOVERY_BACKOFF_MS, t as meshNetworkCapability } from "../dist-cyVteDFT.mjs";
+import { a as EventCategory, i as BaseAddon, n as networkAccessCapability, r as BOOT_RECOVERY_BACKOFF_MS, t as meshNetworkCapability } from "../dist-CovkuhH2.mjs";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import * as fs from "node:fs";

package/dist/{dist-B3cBbqzz.js → dist-BrkbC1tE.js}

@@ -1,4 +1,4 @@
-//#region ../types/dist/event-category-XfKNtfCc.mjs
+//#region ../types/dist/event-category-CIa_iT6b.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -14,6 +14,15 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
 	/**
+	* The hub reissued its own TLS certificate at boot (`ensureTlsCert`).
+	* Emitted only when the material on disk actually changed, so an
+	* operator who trusted the old certificate by hand is told rather than
+	* discovering it as a browser error. Payload `TlsCertChangedPayload`.
+	*
+	* Rule: docs/decisions/adr-0227-*.md
+	*/
+	EventCategory["SystemTlsCertChanged"] = "system.tls-cert-changed";
+	/**
 	* A newer addon or server-root package version was found by the
 	* authoritative registry check. Emitted once when any observed
 	* `latestVersion` changes (or a package/node first appears behind);
@@ -8028,6 +8037,15 @@ var LabelDefinitionSchema = object({
 	description: string().optional(),
 	icon: string().optional()
 });
+var ClassMapDefinitionSchema = object({
+	mapping: record(string(), _enum([
+		"person",
+		"vehicle",
+		"animal",
+		"package"
+	])),
+	preserveOriginal: boolean()
+});
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -8206,7 +8224,13 @@ var ModelCatalogEntrySchema = object({
 	* `id` stays the source of truth for resolution/download/persistence; grouping
 	* is a presentation overlay resolved back to an `id`.
 	*/
-	group: ModelVariantGroupSchema.optional()
+	group: ModelVariantGroupSchema.optional(),
+	/**
+	* Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
+	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
+	* labels already ARE the CamStack macros (Scrypted identity map).
+	*/
+	classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -8235,7 +8259,8 @@ var ModelConvertMetadataSchema = object({
 		"ocr",
 		"segmentation"
 	]),
-	faceAlignment: boolean().optional()
+	faceAlignment: boolean().optional(),
+	classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertResultSchema = object({
 	entry: ModelCatalogEntrySchema,
@@ -17243,6 +17268,33 @@ var NativeCropRefSchema = object({
 		h: number()
 	})
 });
+object({
+	crop: object({
+		left: number(),
+		top: number(),
+		width: number().positive(),
+		height: number().positive()
+	}).optional(),
+	content: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	fit: _enum(["stretch", "contain"]),
+	format: _enum([
+		"rgb",
+		"gray",
+		"jpeg"
+	])
+});
+var FrameRefSchema = object({
+	registryId: string().min(1),
+	id: string().min(1),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum(["rgb", "gray"]),
+	timestamp: number(),
+	capturedAt: number().optional()
+});
 var ModelFormatSchema$1 = _enum([
 	"onnx",
 	"coreml",
@@ -17487,6 +17539,12 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	steps: array(PipelineStepInputSchema).min(1),
 	frame: FrameInputSchema.optional(),
 	/**
+	* Process-local lazy frame. Valid only when caller and provider resolve
+	* in the same execution-group process; split/cross-node callers use
+	* `frame`/`image` inline compatibility instead.
+	*/
+	frameRef: FrameRefSchema.optional(),
+	/**
 	* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
 	* the decoded pixels live in. One more member of the one-of
 	* frame/frameHandle/image/imageBase64/referenceImage group.
@@ -17742,7 +17800,10 @@ var NativeCropResultSchema = object({
 	* Which source served this crop, so a quality-sensitive consumer (the native
 	* `keyFrame`) can reject a degraded fallback:
 	* - `native` — cut from the decode worker's retained NATIVE surface (the
-	*   quality path).
+	*   quality path). A subject-tile serve is also native-resolution and stays
+	*   `native` here: the public enum cannot name `tile` without a breaking cap
+	*   change. Runner telemetry distinguishes lease vs tile via `source` on the
+	*   internal crop result (`nativeHits` vs `tileHits`).
 	* - `ram-fullframe` — the native surface MISSED but the request was full-frame,
 	*   so the ≤640 RAM `RetainedFrameStore` served it (honest lower-res; legit for
 	*   the blank-frame guard / 640-snapshot resolve, NOT for the clean keyFrame).
@@ -18233,12 +18294,41 @@ var RunnerLocalLoadSchema = object({
 * legacy `OrchestratorMetricsSchema` shape so existing dashboards keep
 * working unchanged when they switch to reading from the runner cap.
 */
+var FrameLazyCountersSchema = object({
+	framesDecoded: number(),
+	framesAdmitted: number(),
+	framesDroppedPixelFree: number(),
+	viewsMaterialized: number(),
+	viewsSkipped: number(),
+	workerToRunnerBytes: number(),
+	runnerToPoolRawBytes: number(),
+	runnerToPoolJpegBytes: number(),
+	onDemandFullFrameRequests: number(),
+	onDemandCropRequests: number(),
+	nativeHits: number(),
+	nativeMisses: number(),
+	tileHits: number(),
+	tileMisses: number(),
+	fallbackHits: number(),
+	fallbackMisses: number(),
+	retainedWritesAvoided: number(),
+	residentRefs: number(),
+	residentBytes: number(),
+	releases: number(),
+	evictions: number(),
+	staleMisses: number()
+});
+var FrameLazyMetricsSchema = object({
+	node: FrameLazyCountersSchema,
+	cameras: array(FrameLazyCountersSchema.extend({ deviceId: number() }))
+});
 var RunnerLocalMetricsSchema = object({
 	nodeId: string(),
 	activeCameras: number(),
 	throttledCameras: number(),
 	avgInferenceTimeMs: number(),
-	queueDepth: number()
+	queueDepth: number(),
+	frameLazy: FrameLazyMetricsSchema.optional()
 });
 method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mutation" }), method(object({ deviceId: number() }), object({ success: literal(true) }), { kind: "mutation" }), method(ReportMotionInputSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), RunnerLocalLoadSchema), method(_void(), RunnerLocalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(_void(), array(CameraMetricsWithDeviceIdSchema).readonly()), method(_void(), array(number()).readonly()), method(object({
 	handle: FrameHandleSchema,
@@ -19538,6 +19628,9 @@ method(_void(), ProviderInfoSchema), method(object({ config: record(string(), un
 	location: StorageLocationSchema,
 	relativePath: string()
 }), _void(), { kind: "mutation" }), method(object({ location: StorageLocationSchema }), number().nullable()), method(BeginUploadInputSchema, BeginUploadResultSchema, { kind: "mutation" }), method(WriteChunkInputSchema, _void(), { kind: "mutation" }), method(FinalizeUploadInputSchema, _void(), { kind: "mutation" }), method(AbortUploadInputSchema, _void(), { kind: "mutation" }), method(BeginDownloadInputSchema, BeginDownloadResultSchema, { kind: "mutation" }), method(ReadChunkInputSchema, _instanceof(Uint8Array)), method(EndDownloadInputSchema, _void(), { kind: "mutation" });
+/** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
+var ProfileSettingsSchemaBridge = unknown().nullable();
+var ProfileSettingsBagSchema = record(string(), unknown());
 /**
 * A live terminal session hosted by the provider addon. Output and input do
 * NOT flow through the capability — they use the addon data plane
@@ -19567,7 +19660,14 @@ var TerminalSessionInfoSchema = object({
 var TerminalProfileInfoSchema = object({
 	profileId: string(),
 	label: string(),
-	description: string().optional()
+	description: string().optional(),
+	/** Spawn defaults the instance form copies on create. */
+	executable: string().optional(),
+	args: array(string()).readonly().optional(),
+	cwd: string().optional(),
+	environment: array(string()).readonly().optional(),
+	/** ConfigUISchema for instance knobs, or null when the profile has none. */
+	settingsSchema: ProfileSettingsSchemaBridge.optional()
 });
 /**
 * A durable operator-created Terminal instance. Profiles are templates; only
@@ -19580,7 +19680,12 @@ var TerminalInstanceInfoSchema = object({
 	profileId: string(),
 	profileLabel: string(),
 	name: string(),
-	enabled: boolean()
+	enabled: boolean(),
+	executable: string(),
+	args: array(string()).readonly(),
+	cwd: string(),
+	environment: array(string()).readonly(),
+	profileSettings: ProfileSettingsBagSchema
 });
 var TerminalLegacyCameraSchema = object({
 	stableId: string(),
@@ -19610,7 +19715,23 @@ var TerminalOutputBatchSchema = object({
 method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }), method(_void(), array(TerminalInstanceInfoSchema).readonly(), { auth: "admin" }), method(object({
 	targetNodeId: string().min(1),
 	profileId: string().min(1),
-	name: string().trim().min(1).max(160).optional()
+	name: string().trim().min(1).max(160).optional(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional(),
+	profileSettings: ProfileSettingsBagSchema.optional()
+}), TerminalInstanceInfoSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	instanceId: string().min(1),
+	name: string().trim().min(1).max(160).optional(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional(),
+	profileSettings: ProfileSettingsBagSchema.optional()
 }), TerminalInstanceInfoSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -19632,7 +19753,11 @@ method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }),
 }), method(_void(), array(TerminalSessionInfoSchema).readonly(), { auth: "admin" }), method(object({
 	profileId: string(),
 	cols: number().int().positive(),
-	rows: number().int().positive()
+	rows: number().int().positive(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional()
 }), TerminalSessionInfoSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -22414,10 +22539,10 @@ DeviceType.LawnMower, method(object({ deviceId: number().int().nonnegative() }),
 *
 *  • The SDK (mobile / web client) consumes `getConnectionEndpoints()`
 *    to receive an ordered list of candidate base URLs it should race
-*    on connect — LAN IPv4 first (lowest latency when on same network),
-*    then public hostname (if a tunnel is up), then IPv6. The SDK can
-*    race them with short timeouts and stick with the winner for the
-*    session.
+*    on connect — LAN IPv4 and stable LAN IPv6 first (lowest latency
+*    when on the same network), then public hostname (if a tunnel is
+*    up). The SDK can race them with short timeouts and stick with the
+*    winner for the session.
 *
 * Why hub-only: agents are not directly addressable by the operator's
 * clients — they reverse-connect to the hub. Exposing their interfaces
@@ -22572,6 +22697,17 @@ var NotificationEndpointSchema = object({
 	/** What the ranking currently resolves to (null when nothing is reachable). */
 	resolved: string().nullable()
 });
+/**
+* The URLs the SDK / viewer should race for API access. `baseUrls` empty =
+* AUTO (every LAN IPv4 + the public tunnel). `resolved` is what that choice
+* currently expands to, so the UI can show the effective set either way.
+*/
+var ViewerEndpointsSchema = object({
+	/** The operator's explicit race set, or empty for AUTO. */
+	baseUrls: array(string()).readonly(),
+	/** What the ranking currently resolves to (may be empty if nothing is up). */
+	resolved: array(string()).readonly()
+});
 var AllowedAddressesSchema = object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -22580,6 +22716,20 @@ var AllowedAddressesSchema = object({
 * Network Addresses admin page and persisted by the addon.
 */
 addresses: array(string()).readonly() });
+var TlsStatusSchema = object({
+	mode: _enum([
+		"generated",
+		"uploaded",
+		"disabled"
+	]),
+	leafFingerprintSha256: string().nullable(),
+	caFingerprintSha256: string().nullable(),
+	validTo: string().nullable(),
+	sans: array(string()),
+	caCertPem: string().nullable(),
+	reissueError: string().nullable(),
+	restartRequired: boolean()
+});
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
 	/**
 	* LEGACY HINT — do not send from new code. Kept optional so clients
@@ -22589,17 +22739,31 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*/
 	port: number().int().min(1).max(65535).optional(),
 	/** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
-	*  candidate. Default `true`. */
+	*  candidate. Default `false` — loopback is not a client route. */
 	includeLoopback: boolean().optional(),
-	/** Skip IPv6 entries. Some legacy clients can't parse them.
-	*  Default `false`. */
+	/** Skip IPv6 entries. Default `false` — the palette includes stable
+	*  LAN IPv6 (ICE/WebRTC uses dual-stack regardless). Pass `true` to
+	*  hide them. The viewer HTTP/WS race is `getViewerEndpoints`. */
 	ipv4Only: boolean().optional(),
 	/** Scheme to emit for LAN/loopback URLs. Default `'http'`.
 	*  Pass `'https'` when the caller is itself loaded over HTTPS
 	*  to avoid mixed-content blocks in the browser. The public
 	*  tunnel always emits `https://` regardless. */
 	scheme: _enum(["http", "https"]).optional()
-}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" });
+}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), ViewerEndpointsSchema), method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	certPem: string().min(1),
+	keyPem: string().min(1),
+	caPem: string().optional()
+}), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), object({ pem: string() })), method(_void(), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 object({
 	/** Lifecycle state of the lock. `jammed` means the motor reported
 	*  failure to reach the target — operator intervention required. */
@@ -28423,6 +28587,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.downloadCa": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -28447,18 +28617,42 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getTlsStatus": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"localNetwork.getViewerEndpoints": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.list": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.regenerateCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.resetAllowlistToBestMatch": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"localNetwork.revertToGeneratedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.setAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -28471,6 +28665,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.setViewerEndpoints": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"localNetwork.uploadCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -31351,6 +31557,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.updateInstance": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.writeInput": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -33838,6 +34050,35 @@ Object.freeze(Object.fromEntries([{
 	}]
 }].map((s) => [s.stepId, s.defaultModelId])));
 string().min(1);
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.

package/dist/{dist-cyVteDFT.mjs → dist-CovkuhH2.mjs}

@@ -1,4 +1,4 @@
-//#region ../types/dist/event-category-XfKNtfCc.mjs
+//#region ../types/dist/event-category-CIa_iT6b.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -14,6 +14,15 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
 	/**
+	* The hub reissued its own TLS certificate at boot (`ensureTlsCert`).
+	* Emitted only when the material on disk actually changed, so an
+	* operator who trusted the old certificate by hand is told rather than
+	* discovering it as a browser error. Payload `TlsCertChangedPayload`.
+	*
+	* Rule: docs/decisions/adr-0227-*.md
+	*/
+	EventCategory["SystemTlsCertChanged"] = "system.tls-cert-changed";
+	/**
 	* A newer addon or server-root package version was found by the
 	* authoritative registry check. Emitted once when any observed
 	* `latestVersion` changes (or a package/node first appears behind);
@@ -8028,6 +8037,15 @@ var LabelDefinitionSchema = object({
 	description: string().optional(),
 	icon: string().optional()
 });
+var ClassMapDefinitionSchema = object({
+	mapping: record(string(), _enum([
+		"person",
+		"vehicle",
+		"animal",
+		"package"
+	])),
+	preserveOriginal: boolean()
+});
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -8206,7 +8224,13 @@ var ModelCatalogEntrySchema = object({
 	* `id` stays the source of truth for resolution/download/persistence; grouping
 	* is a presentation overlay resolved back to an `id`.
 	*/
-	group: ModelVariantGroupSchema.optional()
+	group: ModelVariantGroupSchema.optional(),
+	/**
+	* Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
+	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
+	* labels already ARE the CamStack macros (Scrypted identity map).
+	*/
+	classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -8235,7 +8259,8 @@ var ModelConvertMetadataSchema = object({
 		"ocr",
 		"segmentation"
 	]),
-	faceAlignment: boolean().optional()
+	faceAlignment: boolean().optional(),
+	classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertResultSchema = object({
 	entry: ModelCatalogEntrySchema,
@@ -17243,6 +17268,33 @@ var NativeCropRefSchema = object({
 		h: number()
 	})
 });
+object({
+	crop: object({
+		left: number(),
+		top: number(),
+		width: number().positive(),
+		height: number().positive()
+	}).optional(),
+	content: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	fit: _enum(["stretch", "contain"]),
+	format: _enum([
+		"rgb",
+		"gray",
+		"jpeg"
+	])
+});
+var FrameRefSchema = object({
+	registryId: string().min(1),
+	id: string().min(1),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum(["rgb", "gray"]),
+	timestamp: number(),
+	capturedAt: number().optional()
+});
 var ModelFormatSchema$1 = _enum([
 	"onnx",
 	"coreml",
@@ -17487,6 +17539,12 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	steps: array(PipelineStepInputSchema).min(1),
 	frame: FrameInputSchema.optional(),
 	/**
+	* Process-local lazy frame. Valid only when caller and provider resolve
+	* in the same execution-group process; split/cross-node callers use
+	* `frame`/`image` inline compatibility instead.
+	*/
+	frameRef: FrameRefSchema.optional(),
+	/**
 	* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
 	* the decoded pixels live in. One more member of the one-of
 	* frame/frameHandle/image/imageBase64/referenceImage group.
@@ -17742,7 +17800,10 @@ var NativeCropResultSchema = object({
 	* Which source served this crop, so a quality-sensitive consumer (the native
 	* `keyFrame`) can reject a degraded fallback:
 	* - `native` — cut from the decode worker's retained NATIVE surface (the
-	*   quality path).
+	*   quality path). A subject-tile serve is also native-resolution and stays
+	*   `native` here: the public enum cannot name `tile` without a breaking cap
+	*   change. Runner telemetry distinguishes lease vs tile via `source` on the
+	*   internal crop result (`nativeHits` vs `tileHits`).
 	* - `ram-fullframe` — the native surface MISSED but the request was full-frame,
 	*   so the ≤640 RAM `RetainedFrameStore` served it (honest lower-res; legit for
 	*   the blank-frame guard / 640-snapshot resolve, NOT for the clean keyFrame).
@@ -18233,12 +18294,41 @@ var RunnerLocalLoadSchema = object({
 * legacy `OrchestratorMetricsSchema` shape so existing dashboards keep
 * working unchanged when they switch to reading from the runner cap.
 */
+var FrameLazyCountersSchema = object({
+	framesDecoded: number(),
+	framesAdmitted: number(),
+	framesDroppedPixelFree: number(),
+	viewsMaterialized: number(),
+	viewsSkipped: number(),
+	workerToRunnerBytes: number(),
+	runnerToPoolRawBytes: number(),
+	runnerToPoolJpegBytes: number(),
+	onDemandFullFrameRequests: number(),
+	onDemandCropRequests: number(),
+	nativeHits: number(),
+	nativeMisses: number(),
+	tileHits: number(),
+	tileMisses: number(),
+	fallbackHits: number(),
+	fallbackMisses: number(),
+	retainedWritesAvoided: number(),
+	residentRefs: number(),
+	residentBytes: number(),
+	releases: number(),
+	evictions: number(),
+	staleMisses: number()
+});
+var FrameLazyMetricsSchema = object({
+	node: FrameLazyCountersSchema,
+	cameras: array(FrameLazyCountersSchema.extend({ deviceId: number() }))
+});
 var RunnerLocalMetricsSchema = object({
 	nodeId: string(),
 	activeCameras: number(),
 	throttledCameras: number(),
 	avgInferenceTimeMs: number(),
-	queueDepth: number()
+	queueDepth: number(),
+	frameLazy: FrameLazyMetricsSchema.optional()
 });
 method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mutation" }), method(object({ deviceId: number() }), object({ success: literal(true) }), { kind: "mutation" }), method(ReportMotionInputSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), RunnerLocalLoadSchema), method(_void(), RunnerLocalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(_void(), array(CameraMetricsWithDeviceIdSchema).readonly()), method(_void(), array(number()).readonly()), method(object({
 	handle: FrameHandleSchema,
@@ -19538,6 +19628,9 @@ method(_void(), ProviderInfoSchema), method(object({ config: record(string(), un
 	location: StorageLocationSchema,
 	relativePath: string()
 }), _void(), { kind: "mutation" }), method(object({ location: StorageLocationSchema }), number().nullable()), method(BeginUploadInputSchema, BeginUploadResultSchema, { kind: "mutation" }), method(WriteChunkInputSchema, _void(), { kind: "mutation" }), method(FinalizeUploadInputSchema, _void(), { kind: "mutation" }), method(AbortUploadInputSchema, _void(), { kind: "mutation" }), method(BeginDownloadInputSchema, BeginDownloadResultSchema, { kind: "mutation" }), method(ReadChunkInputSchema, _instanceof(Uint8Array)), method(EndDownloadInputSchema, _void(), { kind: "mutation" });
+/** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
+var ProfileSettingsSchemaBridge = unknown().nullable();
+var ProfileSettingsBagSchema = record(string(), unknown());
 /**
 * A live terminal session hosted by the provider addon. Output and input do
 * NOT flow through the capability — they use the addon data plane
@@ -19567,7 +19660,14 @@ var TerminalSessionInfoSchema = object({
 var TerminalProfileInfoSchema = object({
 	profileId: string(),
 	label: string(),
-	description: string().optional()
+	description: string().optional(),
+	/** Spawn defaults the instance form copies on create. */
+	executable: string().optional(),
+	args: array(string()).readonly().optional(),
+	cwd: string().optional(),
+	environment: array(string()).readonly().optional(),
+	/** ConfigUISchema for instance knobs, or null when the profile has none. */
+	settingsSchema: ProfileSettingsSchemaBridge.optional()
 });
 /**
 * A durable operator-created Terminal instance. Profiles are templates; only
@@ -19580,7 +19680,12 @@ var TerminalInstanceInfoSchema = object({
 	profileId: string(),
 	profileLabel: string(),
 	name: string(),
-	enabled: boolean()
+	enabled: boolean(),
+	executable: string(),
+	args: array(string()).readonly(),
+	cwd: string(),
+	environment: array(string()).readonly(),
+	profileSettings: ProfileSettingsBagSchema
 });
 var TerminalLegacyCameraSchema = object({
 	stableId: string(),
@@ -19610,7 +19715,23 @@ var TerminalOutputBatchSchema = object({
 method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }), method(_void(), array(TerminalInstanceInfoSchema).readonly(), { auth: "admin" }), method(object({
 	targetNodeId: string().min(1),
 	profileId: string().min(1),
-	name: string().trim().min(1).max(160).optional()
+	name: string().trim().min(1).max(160).optional(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional(),
+	profileSettings: ProfileSettingsBagSchema.optional()
+}), TerminalInstanceInfoSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	instanceId: string().min(1),
+	name: string().trim().min(1).max(160).optional(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional(),
+	profileSettings: ProfileSettingsBagSchema.optional()
 }), TerminalInstanceInfoSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -19632,7 +19753,11 @@ method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }),
 }), method(_void(), array(TerminalSessionInfoSchema).readonly(), { auth: "admin" }), method(object({
 	profileId: string(),
 	cols: number().int().positive(),
-	rows: number().int().positive()
+	rows: number().int().positive(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional()
 }), TerminalSessionInfoSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -22414,10 +22539,10 @@ DeviceType.LawnMower, method(object({ deviceId: number().int().nonnegative() }),
 *
 *  • The SDK (mobile / web client) consumes `getConnectionEndpoints()`
 *    to receive an ordered list of candidate base URLs it should race
-*    on connect — LAN IPv4 first (lowest latency when on same network),
-*    then public hostname (if a tunnel is up), then IPv6. The SDK can
-*    race them with short timeouts and stick with the winner for the
-*    session.
+*    on connect — LAN IPv4 and stable LAN IPv6 first (lowest latency
+*    when on the same network), then public hostname (if a tunnel is
+*    up). The SDK can race them with short timeouts and stick with the
+*    winner for the session.
 *
 * Why hub-only: agents are not directly addressable by the operator's
 * clients — they reverse-connect to the hub. Exposing their interfaces
@@ -22572,6 +22697,17 @@ var NotificationEndpointSchema = object({
 	/** What the ranking currently resolves to (null when nothing is reachable). */
 	resolved: string().nullable()
 });
+/**
+* The URLs the SDK / viewer should race for API access. `baseUrls` empty =
+* AUTO (every LAN IPv4 + the public tunnel). `resolved` is what that choice
+* currently expands to, so the UI can show the effective set either way.
+*/
+var ViewerEndpointsSchema = object({
+	/** The operator's explicit race set, or empty for AUTO. */
+	baseUrls: array(string()).readonly(),
+	/** What the ranking currently resolves to (may be empty if nothing is up). */
+	resolved: array(string()).readonly()
+});
 var AllowedAddressesSchema = object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -22580,6 +22716,20 @@ var AllowedAddressesSchema = object({
 * Network Addresses admin page and persisted by the addon.
 */
 addresses: array(string()).readonly() });
+var TlsStatusSchema = object({
+	mode: _enum([
+		"generated",
+		"uploaded",
+		"disabled"
+	]),
+	leafFingerprintSha256: string().nullable(),
+	caFingerprintSha256: string().nullable(),
+	validTo: string().nullable(),
+	sans: array(string()),
+	caCertPem: string().nullable(),
+	reissueError: string().nullable(),
+	restartRequired: boolean()
+});
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
 	/**
 	* LEGACY HINT — do not send from new code. Kept optional so clients
@@ -22589,17 +22739,31 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*/
 	port: number().int().min(1).max(65535).optional(),
 	/** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
-	*  candidate. Default `true`. */
+	*  candidate. Default `false` — loopback is not a client route. */
 	includeLoopback: boolean().optional(),
-	/** Skip IPv6 entries. Some legacy clients can't parse them.
-	*  Default `false`. */
+	/** Skip IPv6 entries. Default `false` — the palette includes stable
+	*  LAN IPv6 (ICE/WebRTC uses dual-stack regardless). Pass `true` to
+	*  hide them. The viewer HTTP/WS race is `getViewerEndpoints`. */
 	ipv4Only: boolean().optional(),
 	/** Scheme to emit for LAN/loopback URLs. Default `'http'`.
 	*  Pass `'https'` when the caller is itself loaded over HTTPS
 	*  to avoid mixed-content blocks in the browser. The public
 	*  tunnel always emits `https://` regardless. */
 	scheme: _enum(["http", "https"]).optional()
-}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" });
+}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), ViewerEndpointsSchema), method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	certPem: string().min(1),
+	keyPem: string().min(1),
+	caPem: string().optional()
+}), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), object({ pem: string() })), method(_void(), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 object({
 	/** Lifecycle state of the lock. `jammed` means the motor reported
 	*  failure to reach the target — operator intervention required. */
@@ -28423,6 +28587,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.downloadCa": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -28447,18 +28617,42 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getTlsStatus": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"localNetwork.getViewerEndpoints": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.list": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.regenerateCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.resetAllowlistToBestMatch": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"localNetwork.revertToGeneratedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.setAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -28471,6 +28665,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.setViewerEndpoints": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"localNetwork.uploadCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -31351,6 +31557,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.updateInstance": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.writeInput": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -33838,6 +34050,35 @@ Object.freeze(Object.fromEntries([{
 	}]
 }].map((s) => [s.stepId, s.defaultModelId])));
 string().min(1);
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.

package/dist/ingress/tailscale-ingress.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-B3cBbqzz.js");
+const require_dist = require("../dist-BrkbC1tE.js");
 let node_crypto = require("node:crypto");
 let node_child_process = require("node:child_process");
 //#region src/ingress/tailscale-cli.ts

package/dist/ingress/tailscale-ingress.addon.mjs

@@ -1,4 +1,4 @@
-import { a as EventCategory, i as BaseAddon, n as networkAccessCapability } from "../dist-cyVteDFT.mjs";
+import { a as EventCategory, i as BaseAddon, n as networkAccessCapability } from "../dist-CovkuhH2.mjs";
 import { randomUUID } from "node:crypto";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-tailscale",
-  "version": "1.2.25",
+  "version": "1.2.27",
   "description": "Tailscale bundle for CamStack — joins the host to a tailnet (client) and exposes the hub via Serve/Funnel (ingress). Multi-entry npm package shipping 2 addons under a single bundle.",
   "keywords": [
     "camstack",