@camstack/addon-tailscale 1.2.33 → 1.2.35

package/dist/client/tailscale.addon.js

@@ -24,7 +24,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-const require_dist = require("../dist-DJdV0Zv8.js");
+const require_dist = require("../dist-KZM_ozLM.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_fs = require("node:fs");

package/dist/client/tailscale.addon.mjs

@@ -1,4 +1,4 @@
-import { a as EventCategory, i as BaseAddon, n as networkAccessCapability, r as BOOT_RECOVERY_BACKOFF_MS, t as meshNetworkCapability } from "../dist-Du--YFtK.mjs";
+import { a as EventCategory, i as BaseAddon, n as networkAccessCapability, r as BOOT_RECOVERY_BACKOFF_MS, t as meshNetworkCapability } from "../dist-CGnxfaPe.mjs";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import * as fs from "node:fs";

package/dist/{dist-Du--YFtK.mjs → dist-CGnxfaPe.mjs}

@@ -7485,6 +7485,111 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
+*
+* ## Two axes, deliberately separated
+*
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
+*
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
+*
+* ## The canonical call shape
+*
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
+*
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
+*
+* ## Why a channel emits at `info`
+*
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
+*/
+/**
+* The level a channel writes at once armed.
+*
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
+*/
+var LogChannelLevelSchema = _enum([
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
+*/
+var LogChannelDescriptorSchema = object({
+	/**
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
+	*/
+	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
+	/**
+	* Whether this channel can be narrowed to a camera.
+	*
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
+	*/
+	perDevice: boolean()
+});
+/**
+* An armed window over one channel, as the document hands it to a mirror.
+*
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
+*/
+var LogChannelWindowSchema = object({
+	channel: string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: array(number().int()).readonly().nullable()
+});
+/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -11003,6 +11108,35 @@ var MutationFilterSchema = object({
 	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
 	whereNot: record(string(), unknown()).optional()
 });
+/**
+* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
+*
+* `as` names the slot in the result, so the SAME column may be asked twice with
+* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
+* a `Record<column, op>` shape could not express.
+*/
+var AggregateFieldSchema = object({
+	/** Result key. */
+	as: string().min(1),
+	/** Column to aggregate. Must be a real column of a declared collection. */
+	field: string().min(1),
+	op: _enum([
+		"sum",
+		"min",
+		"max"
+	])
+});
+/**
+* `COUNT(*)` plus one number per requested field.
+*
+* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
+* that really is 0 are different facts, and an accounting caller that renders
+* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
+*/
+var AggregateResultSchema = object({
+	count: number().int(),
+	values: record(string(), number().nullable())
+});
 /** A single stored record: `{ id, data }`. */
 var SettingsRecordSchema = object({
 	id: string(),
@@ -11087,6 +11221,11 @@ method(object({
 	collection: string(),
 	filter: QueryFilterSchema.optional()
 }), number()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	fields: array(AggregateFieldSchema).readonly(),
+	filter: QueryFilterSchema.optional()
+}), AggregateResultSchema), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	field: string(),
@@ -11203,6 +11342,11 @@ method(_void(), EngineInfoSchema, { auth: "admin" }), method(object({
 	collection: string(),
 	filter: QueryFilterSchema.optional()
 }), number(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	fields: array(AggregateFieldSchema).readonly(),
+	filter: QueryFilterSchema.optional()
+}), AggregateResultSchema, { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	field: string(),
@@ -11764,24 +11908,6 @@ method(_void(), _void(), { kind: "mutation" }), method(_void(), _void(), { kind:
 	kind: "mutation",
 	auth: "admin"
 });
-/**
-* Device Manager capability — hub-side singleton that unifies device persistence,
-* live registry access, and all management operations into a single tRPC surface.
-*
-* Replaces:
-*   - `device-persistence` capability (persistence methods absorbed here)
-*   - `device-management.router.ts` (deleted in Phase 2)
-*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
-*
-* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
-* fork into separate processes but never run on remote cluster agents. Therefore:
-*   - No nodeId routing needed — this is a pure hub singleton.
-*   - The hub's DeviceRegistry is the single source of truth for all live devices.
-*   - No shadow registry or cross-node aggregation required.
-*
-* Forked workers register devices back to the hub via `ctx.devices`
-* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
-*/
 /** One child-placement directive on a container's `childLayout`. Structurally
 *  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
 *  shape for the same field. The child is identified by its re-sync-stable
@@ -12150,7 +12276,7 @@ method(object({
 	* it answers today and the caller filters as it already does.
 	*/
 	deviceIds: array(number()).optional()
-}), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
+}), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ parentDeviceIds: array(number()).max(256) }), record(string(), array(DeviceInfoSchema))), method(object({ deviceId: number() }), object({
 	mode: LinkedDevicesModeSchema,
 	devices: array(LinkedDeviceSchema)
 })), method(object({ deviceIds: array(number()) }), array(LinkedDevicesForDeviceSchema)), method(object({ deviceId: number() }), array(StreamSourceEntrySchema$1)), method(object({ deviceId: number() }), array(ConfigEntrySchema)), method(object({ deviceId: number() }), ConfigUISchemaOutput), method(object({
@@ -12874,6 +13000,59 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* `log-channels` — the capability an addon DECLARES its diagnostic channels
+* through. It stores nothing.
+*
+* ## Why a capability at all, and why this shape
+*
+* Which channels exist is knowledge only the addon has: `stream-broker` knows
+* webrtc/ICE/RTP, `provider-reolink` knows baichuan/handshake. A central list
+* maintained by hand rots at the first addition and rots INVISIBLY — nothing
+* fails, an operator just never sees the channel somebody added. So the list
+* is assembled from declarations at runtime.
+*
+* The shape is copied from `log-destination.cap.ts`, which already does
+* exactly this job: `mode: 'collection'`, `internal: true`,
+* `mount: { kind: 'skip' }` — no tRPC route, no generated hooks — while
+* `addons.listCapabilityProviders` still enumerates it, and the hub's
+* `CapabilityRegistry` still holds an RPC proxy per provider so a forked
+* runner's declarations reach hub-main over the transport that already exists.
+* No new UDS message, no second registry.
+*
+* ## What it deliberately does NOT own
+*
+* The VALUES — which channel is armed, for which cameras, until when — live in
+* ONE place: the logging settings document on the `system` cap
+* (`getLoggingSettings` / `setLoggingSettings`). Two authorities over the same
+* value is the defect the plan behind this work exists to remove, and
+* `setRequestCensus` was retired (D245) rather than allowed to be a second
+* one. {@link logChannelsCapability} therefore has no getter for a level, no
+* setter for a window and no persistence of any kind.
+*
+* ## Why `apply` is here even so
+*
+* The gate lives in the addon's PROCESS; the document lives in hub-main. Some
+* seam has to carry the value from the authority to the mirror, and a channel
+* that cannot be reached is precisely the dead knob this whole slice exists to
+* make impossible (D62 — `audioThresholdDbfs`, the HA entities with no source).
+* `apply` is that seam and nothing more: it writes an in-memory mirror, it
+* persists nothing, it is never the source of a value, and it is called only
+* with a set the hub actually read (D49 — a read that fails does not call it
+* at all, so no channel is silently disarmed by a bad read).
+*/
+/** What `apply` reports back — enough to log, not enough to be a second state. */
+var LogChannelApplyResultSchema = object({
+	/** How many declared channels are armed in this process after the call. */
+	armed: number().int().min(0),
+	/**
+	* Names the document armed that this process does not declare. Reported
+	* rather than swallowed: a name here is either a typo or an addon that has
+	* not booted, and both deserve a line instead of silence.
+	*/
+	unknown: array(string()).readonly()
+});
+method(_void(), array(LogChannelDescriptorSchema).readonly()), method(object({ windows: array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" });
 var LogLevelSchema = _enum([
 	"debug",
 	"info",
@@ -26369,10 +26548,11 @@ var DiagnosticIdSchema = _enum(["request-census"]);
 * The layers of the level hierarchy, general → specific. The most specific
 * layer that carries an explicit value wins.
 *
-* `component` is DECLARED and not yet resolvable: the per-component channels
-* are a later slice of the same plan, and a `levelSource` enum that has to
-* grow later would force every consumer of this document to change with it.
-* Nothing returns `component` today.
+* `component` became RESOLVABLE on 2026-08-27: a component is a declared log
+* CHANNEL (`stream-broker.webrtc`, `provider-reolink.baichuan`), named by
+* `scopeComponent`. It was declared-but-dark in the first slice precisely so
+* that turning it on would not force every consumer of this document to widen
+* a `levelSource` enum — which is what has now not happened.
 */
 var LoggingScopeKindSchema = _enum([
 	"cluster",
@@ -26399,6 +26579,14 @@ var LoggingLevelLayerSchema = object({
 	scope: LoggingScopeKindSchema,
 	/** The node this layer speaks for; `null` on the cluster layer. */
 	nodeId: string().nullable(),
+	/**
+	* The declared channel this layer speaks for; `null` on every layer but
+	* `component`. Never folded into `nodeId`: a component level is CLUSTER-WIDE
+	* by design — the convention this repo settled on is one orchestrator-wide
+	* setting, never per node (D52) — so a component layer that carried a node
+	* would invite a per-node copy of a value that has no per-node meaning.
+	*/
+	component: string().nullable(),
 	/** Explicitly set here, or `null` when this layer inherits. */
 	level: LogLevelSchema$1.nullable()
 });
@@ -26440,6 +26628,49 @@ var DiagnosticWindowPatchSchema = object({
 	reportEveryMs: number().int().positive().optional()
 });
 /**
+* A channel ARMED, as the document reports it.
+*
+* `armMs` is not echoed back: what an operator needs to see is the deadline
+* and the time left, because a diagnostic left running is itself an incident
+* and "armed for 10 minutes" said an hour ago is not an answer.
+*/
+var LogChannelWindowStateSchema = object({
+	channel: string(),
+	armed: boolean(),
+	/** Epoch ms the window closes at. 0 when disarmed. */
+	armedUntilMs: number(),
+	/** Ms left before it expires on its own. 0 when disarmed. */
+	remainingMs: number(),
+	/**
+	* The cameras it is narrowed to, or `null` for every camera.
+	*
+	* A channel declared `perDevice: false` can only ever report `null` here:
+	* its lines do not carry `tags: { deviceId }`, so narrowing them would
+	* produce a filter that silently matches nothing. The server REFUSES such a
+	* patch rather than quietly widening it — ignoring the request would teach
+	* the operator that per-camera filtering works on that channel when it does
+	* not.
+	*/
+	deviceIds: array(number().int()).readonly().nullable()
+});
+/**
+* `armMs: 0` DISARMS. Same grammar as {@link DiagnosticWindowPatchSchema}, and
+* for the same reason: a channel is a window with a deadline, never a switch.
+*/
+var LogChannelWindowPatchSchema = object({
+	channel: string().min(1),
+	armMs: number().int().min(0),
+	/**
+	* Narrow to these numeric device ids. Absent or `null` = every camera.
+	*
+	* Numeric because the repo's own rule makes it possible: every log line
+	* about a device carries `tags: { deviceId }` with the numeric id. That rule
+	* was paid for with a 22% thumbnail gap and a 3-hour media blackout both
+	* diagnosed by hand, and this is the first thing that collects on it.
+	*/
+	deviceIds: array(number().int()).readonly().nullable().optional()
+});
+/**
 * A PATCH, and patches MERGE.
 *
 * A field absent from the patch is left exactly as it was — arming a
@@ -26458,7 +26689,14 @@ var LoggingSettingsPatchSchema = object({
 	* Only the diagnostics NAMED here change. An armed window that is not listed
 	* keeps running — a patch is never a full replacement.
 	*/
-	diagnostics: array(DiagnosticWindowPatchSchema).readonly().optional()
+	diagnostics: array(DiagnosticWindowPatchSchema).readonly().optional(),
+	/**
+	* Only the channels NAMED here change. An armed channel that is not listed
+	* keeps running — same rule as `diagnostics`, because a patch that silently
+	* disarmed the channels it did not mention would make the Levels page and
+	* the Diagnostics page fight over the same value.
+	*/
+	channels: array(LogChannelWindowPatchSchema).readonly().optional()
 });
 /**
 * Which LAYER of the hierarchy is addressed. Absent = the cluster layer.
@@ -26471,9 +26709,22 @@ var LoggingSettingsPatchSchema = object({
 * authority over the whole hierarchy and answers for every layer, so the
 * layer selector needs a name the transport does not already own.
 */
-var GetLoggingSettingsInputSchema = object({ scopeNodeId: string().optional() });
+var GetLoggingSettingsInputSchema = object({
+	scopeNodeId: string().optional(),
+	/**
+	* The declared CHANNEL this document is addressed at, when the caller wants
+	* the `component` layer. Absent = the node/cluster hierarchy only.
+	*
+	* Naming it separately rather than overloading `scopeNodeId` keeps the two
+	* axes from collapsing: a component level is cluster-wide, a node level is
+	* not, and one selector for both would make "which of these two did I just
+	* set" unanswerable — the exact ambiguity `explicit` exists to remove.
+	*/
+	scopeComponent: string().optional()
+});
 var SetLoggingSettingsInputSchema = object({
 	scopeNodeId: string().optional(),
+	scopeComponent: string().optional(),
 	patch: LoggingSettingsPatchSchema
 });
 /**
@@ -26488,9 +26739,20 @@ var SetLoggingSettingsInputSchema = object({
 var LoggingSettingsStateSchema = object({
 	/** The layer this document was read at. `null` = the cluster layer. */
 	scopeNodeId: string().nullable(),
+	/** The channel this document was read at. `null` = no component layer. */
+	scopeComponent: string().nullable(),
 	effective: LoggingEffectiveSchema,
 	explicit: LoggingExplicitSchema,
 	activeWindows: array(DiagnosticWindowSchema).readonly(),
+	/**
+	* Every channel the cluster's addons DECLARE, gathered from the
+	* `log-channels` providers. Not stored anywhere: assembled per read, so a
+	* channel added by a redeployed addon appears without anybody editing a
+	* list, and a channel whose addon is gone stops being offered.
+	*/
+	channels: array(LogChannelDescriptorSchema).readonly(),
+	/** The channels ARMED right now, each with its deadline. */
+	activeChannels: array(LogChannelWindowStateSchema).readonly(),
 	persisted: boolean()
 });
 method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
@@ -28067,6 +28329,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"dataStoreProvider.aggregate": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"dataStoreProvider.count": {
 		capName: "data-store-provider",
 		capScope: "system",
@@ -28481,6 +28749,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getChildrenBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getConfigSchema": {
 		capName: "device-manager",
 		capScope: "system",
@@ -29531,6 +29805,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"logChannels.apply": {
+		capName: "log-channels",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"logChannels.list": {
+		capName: "log-channels",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"logDestination.query": {
 		capName: "log-destination",
 		capScope: "system",
@@ -31685,6 +31971,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.aggregate": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"settingsStore.count": {
 		capName: "settings-store",
 		capScope: "system",
@@ -33264,6 +33556,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.getChildrenBatch": [{
+		name: "parentDeviceIds",
+		form: "array",
+		optional: false
+	}],
 	"deviceManager.getConfigSchema": [{
 		name: "deviceId",
 		form: "single",

package/dist/{dist-DJdV0Zv8.js → dist-KZM_ozLM.js}

@@ -7485,6 +7485,111 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
+*
+* ## Two axes, deliberately separated
+*
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
+*
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
+*
+* ## The canonical call shape
+*
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
+*
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
+*
+* ## Why a channel emits at `info`
+*
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
+*/
+/**
+* The level a channel writes at once armed.
+*
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
+*/
+var LogChannelLevelSchema = _enum([
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
+*/
+var LogChannelDescriptorSchema = object({
+	/**
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
+	*/
+	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
+	/**
+	* Whether this channel can be narrowed to a camera.
+	*
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
+	*/
+	perDevice: boolean()
+});
+/**
+* An armed window over one channel, as the document hands it to a mirror.
+*
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
+*/
+var LogChannelWindowSchema = object({
+	channel: string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: array(number().int()).readonly().nullable()
+});
+/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -11003,6 +11108,35 @@ var MutationFilterSchema = object({
 	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
 	whereNot: record(string(), unknown()).optional()
 });
+/**
+* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
+*
+* `as` names the slot in the result, so the SAME column may be asked twice with
+* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
+* a `Record<column, op>` shape could not express.
+*/
+var AggregateFieldSchema = object({
+	/** Result key. */
+	as: string().min(1),
+	/** Column to aggregate. Must be a real column of a declared collection. */
+	field: string().min(1),
+	op: _enum([
+		"sum",
+		"min",
+		"max"
+	])
+});
+/**
+* `COUNT(*)` plus one number per requested field.
+*
+* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
+* that really is 0 are different facts, and an accounting caller that renders
+* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
+*/
+var AggregateResultSchema = object({
+	count: number().int(),
+	values: record(string(), number().nullable())
+});
 /** A single stored record: `{ id, data }`. */
 var SettingsRecordSchema = object({
 	id: string(),
@@ -11087,6 +11221,11 @@ method(object({
 	collection: string(),
 	filter: QueryFilterSchema.optional()
 }), number()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	fields: array(AggregateFieldSchema).readonly(),
+	filter: QueryFilterSchema.optional()
+}), AggregateResultSchema), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	field: string(),
@@ -11203,6 +11342,11 @@ method(_void(), EngineInfoSchema, { auth: "admin" }), method(object({
 	collection: string(),
 	filter: QueryFilterSchema.optional()
 }), number(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	fields: array(AggregateFieldSchema).readonly(),
+	filter: QueryFilterSchema.optional()
+}), AggregateResultSchema, { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	field: string(),
@@ -11764,24 +11908,6 @@ method(_void(), _void(), { kind: "mutation" }), method(_void(), _void(), { kind:
 	kind: "mutation",
 	auth: "admin"
 });
-/**
-* Device Manager capability — hub-side singleton that unifies device persistence,
-* live registry access, and all management operations into a single tRPC surface.
-*
-* Replaces:
-*   - `device-persistence` capability (persistence methods absorbed here)
-*   - `device-management.router.ts` (deleted in Phase 2)
-*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
-*
-* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
-* fork into separate processes but never run on remote cluster agents. Therefore:
-*   - No nodeId routing needed — this is a pure hub singleton.
-*   - The hub's DeviceRegistry is the single source of truth for all live devices.
-*   - No shadow registry or cross-node aggregation required.
-*
-* Forked workers register devices back to the hub via `ctx.devices`
-* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
-*/
 /** One child-placement directive on a container's `childLayout`. Structurally
 *  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
 *  shape for the same field. The child is identified by its re-sync-stable
@@ -12150,7 +12276,7 @@ method(object({
 	* it answers today and the caller filters as it already does.
 	*/
 	deviceIds: array(number()).optional()
-}), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
+}), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ parentDeviceIds: array(number()).max(256) }), record(string(), array(DeviceInfoSchema))), method(object({ deviceId: number() }), object({
 	mode: LinkedDevicesModeSchema,
 	devices: array(LinkedDeviceSchema)
 })), method(object({ deviceIds: array(number()) }), array(LinkedDevicesForDeviceSchema)), method(object({ deviceId: number() }), array(StreamSourceEntrySchema$1)), method(object({ deviceId: number() }), array(ConfigEntrySchema)), method(object({ deviceId: number() }), ConfigUISchemaOutput), method(object({
@@ -12874,6 +13000,59 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* `log-channels` — the capability an addon DECLARES its diagnostic channels
+* through. It stores nothing.
+*
+* ## Why a capability at all, and why this shape
+*
+* Which channels exist is knowledge only the addon has: `stream-broker` knows
+* webrtc/ICE/RTP, `provider-reolink` knows baichuan/handshake. A central list
+* maintained by hand rots at the first addition and rots INVISIBLY — nothing
+* fails, an operator just never sees the channel somebody added. So the list
+* is assembled from declarations at runtime.
+*
+* The shape is copied from `log-destination.cap.ts`, which already does
+* exactly this job: `mode: 'collection'`, `internal: true`,
+* `mount: { kind: 'skip' }` — no tRPC route, no generated hooks — while
+* `addons.listCapabilityProviders` still enumerates it, and the hub's
+* `CapabilityRegistry` still holds an RPC proxy per provider so a forked
+* runner's declarations reach hub-main over the transport that already exists.
+* No new UDS message, no second registry.
+*
+* ## What it deliberately does NOT own
+*
+* The VALUES — which channel is armed, for which cameras, until when — live in
+* ONE place: the logging settings document on the `system` cap
+* (`getLoggingSettings` / `setLoggingSettings`). Two authorities over the same
+* value is the defect the plan behind this work exists to remove, and
+* `setRequestCensus` was retired (D245) rather than allowed to be a second
+* one. {@link logChannelsCapability} therefore has no getter for a level, no
+* setter for a window and no persistence of any kind.
+*
+* ## Why `apply` is here even so
+*
+* The gate lives in the addon's PROCESS; the document lives in hub-main. Some
+* seam has to carry the value from the authority to the mirror, and a channel
+* that cannot be reached is precisely the dead knob this whole slice exists to
+* make impossible (D62 — `audioThresholdDbfs`, the HA entities with no source).
+* `apply` is that seam and nothing more: it writes an in-memory mirror, it
+* persists nothing, it is never the source of a value, and it is called only
+* with a set the hub actually read (D49 — a read that fails does not call it
+* at all, so no channel is silently disarmed by a bad read).
+*/
+/** What `apply` reports back — enough to log, not enough to be a second state. */
+var LogChannelApplyResultSchema = object({
+	/** How many declared channels are armed in this process after the call. */
+	armed: number().int().min(0),
+	/**
+	* Names the document armed that this process does not declare. Reported
+	* rather than swallowed: a name here is either a typo or an addon that has
+	* not booted, and both deserve a line instead of silence.
+	*/
+	unknown: array(string()).readonly()
+});
+method(_void(), array(LogChannelDescriptorSchema).readonly()), method(object({ windows: array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" });
 var LogLevelSchema = _enum([
 	"debug",
 	"info",
@@ -26369,10 +26548,11 @@ var DiagnosticIdSchema = _enum(["request-census"]);
 * The layers of the level hierarchy, general → specific. The most specific
 * layer that carries an explicit value wins.
 *
-* `component` is DECLARED and not yet resolvable: the per-component channels
-* are a later slice of the same plan, and a `levelSource` enum that has to
-* grow later would force every consumer of this document to change with it.
-* Nothing returns `component` today.
+* `component` became RESOLVABLE on 2026-08-27: a component is a declared log
+* CHANNEL (`stream-broker.webrtc`, `provider-reolink.baichuan`), named by
+* `scopeComponent`. It was declared-but-dark in the first slice precisely so
+* that turning it on would not force every consumer of this document to widen
+* a `levelSource` enum — which is what has now not happened.
 */
 var LoggingScopeKindSchema = _enum([
 	"cluster",
@@ -26399,6 +26579,14 @@ var LoggingLevelLayerSchema = object({
 	scope: LoggingScopeKindSchema,
 	/** The node this layer speaks for; `null` on the cluster layer. */
 	nodeId: string().nullable(),
+	/**
+	* The declared channel this layer speaks for; `null` on every layer but
+	* `component`. Never folded into `nodeId`: a component level is CLUSTER-WIDE
+	* by design — the convention this repo settled on is one orchestrator-wide
+	* setting, never per node (D52) — so a component layer that carried a node
+	* would invite a per-node copy of a value that has no per-node meaning.
+	*/
+	component: string().nullable(),
 	/** Explicitly set here, or `null` when this layer inherits. */
 	level: LogLevelSchema$1.nullable()
 });
@@ -26440,6 +26628,49 @@ var DiagnosticWindowPatchSchema = object({
 	reportEveryMs: number().int().positive().optional()
 });
 /**
+* A channel ARMED, as the document reports it.
+*
+* `armMs` is not echoed back: what an operator needs to see is the deadline
+* and the time left, because a diagnostic left running is itself an incident
+* and "armed for 10 minutes" said an hour ago is not an answer.
+*/
+var LogChannelWindowStateSchema = object({
+	channel: string(),
+	armed: boolean(),
+	/** Epoch ms the window closes at. 0 when disarmed. */
+	armedUntilMs: number(),
+	/** Ms left before it expires on its own. 0 when disarmed. */
+	remainingMs: number(),
+	/**
+	* The cameras it is narrowed to, or `null` for every camera.
+	*
+	* A channel declared `perDevice: false` can only ever report `null` here:
+	* its lines do not carry `tags: { deviceId }`, so narrowing them would
+	* produce a filter that silently matches nothing. The server REFUSES such a
+	* patch rather than quietly widening it — ignoring the request would teach
+	* the operator that per-camera filtering works on that channel when it does
+	* not.
+	*/
+	deviceIds: array(number().int()).readonly().nullable()
+});
+/**
+* `armMs: 0` DISARMS. Same grammar as {@link DiagnosticWindowPatchSchema}, and
+* for the same reason: a channel is a window with a deadline, never a switch.
+*/
+var LogChannelWindowPatchSchema = object({
+	channel: string().min(1),
+	armMs: number().int().min(0),
+	/**
+	* Narrow to these numeric device ids. Absent or `null` = every camera.
+	*
+	* Numeric because the repo's own rule makes it possible: every log line
+	* about a device carries `tags: { deviceId }` with the numeric id. That rule
+	* was paid for with a 22% thumbnail gap and a 3-hour media blackout both
+	* diagnosed by hand, and this is the first thing that collects on it.
+	*/
+	deviceIds: array(number().int()).readonly().nullable().optional()
+});
+/**
 * A PATCH, and patches MERGE.
 *
 * A field absent from the patch is left exactly as it was — arming a
@@ -26458,7 +26689,14 @@ var LoggingSettingsPatchSchema = object({
 	* Only the diagnostics NAMED here change. An armed window that is not listed
 	* keeps running — a patch is never a full replacement.
 	*/
-	diagnostics: array(DiagnosticWindowPatchSchema).readonly().optional()
+	diagnostics: array(DiagnosticWindowPatchSchema).readonly().optional(),
+	/**
+	* Only the channels NAMED here change. An armed channel that is not listed
+	* keeps running — same rule as `diagnostics`, because a patch that silently
+	* disarmed the channels it did not mention would make the Levels page and
+	* the Diagnostics page fight over the same value.
+	*/
+	channels: array(LogChannelWindowPatchSchema).readonly().optional()
 });
 /**
 * Which LAYER of the hierarchy is addressed. Absent = the cluster layer.
@@ -26471,9 +26709,22 @@ var LoggingSettingsPatchSchema = object({
 * authority over the whole hierarchy and answers for every layer, so the
 * layer selector needs a name the transport does not already own.
 */
-var GetLoggingSettingsInputSchema = object({ scopeNodeId: string().optional() });
+var GetLoggingSettingsInputSchema = object({
+	scopeNodeId: string().optional(),
+	/**
+	* The declared CHANNEL this document is addressed at, when the caller wants
+	* the `component` layer. Absent = the node/cluster hierarchy only.
+	*
+	* Naming it separately rather than overloading `scopeNodeId` keeps the two
+	* axes from collapsing: a component level is cluster-wide, a node level is
+	* not, and one selector for both would make "which of these two did I just
+	* set" unanswerable — the exact ambiguity `explicit` exists to remove.
+	*/
+	scopeComponent: string().optional()
+});
 var SetLoggingSettingsInputSchema = object({
 	scopeNodeId: string().optional(),
+	scopeComponent: string().optional(),
 	patch: LoggingSettingsPatchSchema
 });
 /**
@@ -26488,9 +26739,20 @@ var SetLoggingSettingsInputSchema = object({
 var LoggingSettingsStateSchema = object({
 	/** The layer this document was read at. `null` = the cluster layer. */
 	scopeNodeId: string().nullable(),
+	/** The channel this document was read at. `null` = no component layer. */
+	scopeComponent: string().nullable(),
 	effective: LoggingEffectiveSchema,
 	explicit: LoggingExplicitSchema,
 	activeWindows: array(DiagnosticWindowSchema).readonly(),
+	/**
+	* Every channel the cluster's addons DECLARE, gathered from the
+	* `log-channels` providers. Not stored anywhere: assembled per read, so a
+	* channel added by a redeployed addon appears without anybody editing a
+	* list, and a channel whose addon is gone stops being offered.
+	*/
+	channels: array(LogChannelDescriptorSchema).readonly(),
+	/** The channels ARMED right now, each with its deadline. */
+	activeChannels: array(LogChannelWindowStateSchema).readonly(),
 	persisted: boolean()
 });
 method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
@@ -28067,6 +28329,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"dataStoreProvider.aggregate": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"dataStoreProvider.count": {
 		capName: "data-store-provider",
 		capScope: "system",
@@ -28481,6 +28749,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getChildrenBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getConfigSchema": {
 		capName: "device-manager",
 		capScope: "system",
@@ -29531,6 +29805,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"logChannels.apply": {
+		capName: "log-channels",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"logChannels.list": {
+		capName: "log-channels",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"logDestination.query": {
 		capName: "log-destination",
 		capScope: "system",
@@ -31685,6 +31971,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.aggregate": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"settingsStore.count": {
 		capName: "settings-store",
 		capScope: "system",
@@ -33264,6 +33556,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.getChildrenBatch": [{
+		name: "parentDeviceIds",
+		form: "array",
+		optional: false
+	}],
 	"deviceManager.getConfigSchema": [{
 		name: "deviceId",
 		form: "single",

package/dist/ingress/tailscale-ingress.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-DJdV0Zv8.js");
+const require_dist = require("../dist-KZM_ozLM.js");
 let node_crypto = require("node:crypto");
 let node_child_process = require("node:child_process");
 //#region src/ingress/tailscale-cli.ts

package/dist/ingress/tailscale-ingress.addon.mjs

@@ -1,4 +1,4 @@
-import { a as EventCategory, i as BaseAddon, n as networkAccessCapability } from "../dist-Du--YFtK.mjs";
+import { a as EventCategory, i as BaseAddon, n as networkAccessCapability } from "../dist-CGnxfaPe.mjs";
 import { randomUUID } from "node:crypto";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-tailscale",
-  "version": "1.2.33",
+  "version": "1.2.35",
   "description": "Tailscale bundle for CamStack — joins the host to a tailnet (client) and exposes the hub via Serve/Funnel (ingress). Multi-entry npm package shipping 2 addons under a single bundle.",
   "keywords": [
     "camstack",