@camstack/addon-tailscale 1.2.43 → 1.2.45

package/dist/client/tailscale.addon.js

@@ -24,7 +24,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-const require_dist = require("../dist-Bzn0_Gfg.js");
+const require_dist = require("../dist-ki6Kt6cL.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_fs = require("node:fs");

package/dist/client/tailscale.addon.mjs

@@ -1,4 +1,4 @@
-import { a as EventCategory, i as BaseAddon, n as networkAccessCapability, r as BOOT_RECOVERY_BACKOFF_MS, t as meshNetworkCapability } from "../dist-cWp3ATn9.mjs";
+import { a as EventCategory, i as BaseAddon, n as networkAccessCapability, r as BOOT_RECOVERY_BACKOFF_MS, t as meshNetworkCapability } from "../dist-RluxJbgF.mjs";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import * as fs from "node:fs";

package/dist/{dist-cWp3ATn9.mjs → dist-RluxJbgF.mjs}

@@ -8181,13 +8181,49 @@ var StorageMigrationParticipantSchema = _enum([
 	"recorder",
 	"analytics"
 ]);
+/**
+* The mover's own numbers, folded onto the coordinator's durable move record.
+*
+* The long half of a non-blocking migration is `draining`, and it is measured
+* in hours: 136 885 files at ~4 MB/s is about five of them. Before this shape
+* existed the only place those numbers appeared was a Loki line, so an operator
+* watching the Admin UI saw `phase: draining` and nothing else for a whole
+* afternoon.
+*
+* It is POLLED, never pushed. Events are telemetry and may be dropped
+* (D8/D11), and a dropped progress event is indistinguishable from a stalled
+* mover — which is the exact failure this is meant to end. The coordinator's
+* `waitForMoves` already fetches the whole {@link RelocateJob} on every tick to
+* read `state`; folding the counters costs no extra read and makes the durable
+* record say afterwards how far a move actually got.
+*
+* `filesTotal` is `null` for "no honest denominator" and is never zero-filled:
+* a windowed footage job (`sinceMs`) and a node with no ledger both genuinely
+* cannot say M, and a 0 there would render as "100 % done".
+*/
+var StorageMigrationMoveProgressSchema = object({
+	filesMoved: number().int().nonnegative(),
+	/** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
+	filesTotal: number().int().nonnegative().nullable(),
+	bytesMoved: number().int().nonnegative(),
+	/** The MOVER's start, not the migration's: a drain restarted after an addon
+	*  crash gets a new mover, and a rate computed from the migration's start
+	*  would silently average in the time nothing was running. */
+	startedAt: number(),
+	/** When the coordinator last read these numbers. Paired with `startedAt` it
+	*  is the only honest rate: both clocks are the hub's, so a UI never has to
+	*  subtract its own. */
+	observedAt: number()
+});
 var StorageMigrationMoveSchema = object({
 	storageClass: StorageMigrationClassSchema,
 	fromLocationId: string(),
 	toLocationId: string(),
 	moverJobId: string().nullable(),
 	state: RelocateJobStateSchema.nullable(),
-	error: string().nullable()
+	error: string().nullable(),
+	/** Last observed mover counters; `null` until the mover has been polled once. */
+	progress: StorageMigrationMoveProgressSchema.nullable()
 });
 var StorageMigrationJobSchema = object({
 	jobId: string(),
@@ -8233,6 +8269,98 @@ var StorageMigrationPlanSchema = object({
 	findings: array(StorageMigrationFindingSchema)
 });
 /**
+* A mover as it exists RIGHT NOW, whether or not a migration job owns it.
+*
+* The coordinator's job record is the state of record for a migration, and its
+* moves carry {@link StorageMigrationMoveProgress}. But the movers are usable
+* standalone — `recording.relocateFootage` and `pipelineAnalytics.relocateMedia`
+* are both operator-callable, and on 2026-08-29 a five-hour drain was armed that
+* way because no supported UI path existed. A mover armed like that has no job
+* to fold progress into, so it has to be readable on its own or it is invisible.
+*
+* `migrationJobId` is what tells the two apart: `null` means nothing here
+* orchestrated it.
+*/
+var StorageMigrationMoverSchema = object({
+	lane: _enum(["footage", "media"]),
+	job: RelocateJobSchema,
+	/** The coordinator job that armed this mover, or `null` for a mover armed
+	*  directly against the owning addon. */
+	migrationJobId: string().nullable(),
+	/** When the hub read these counters. Stamped here so a rate is `bytesMoved`
+	*  over (`observedAt` − `job.startedAt`) with BOTH ends on the hub's clock —
+	*  a browser subtracting its own `Date.now()` from a server `startedAt` is a
+	*  rate made of two different clocks. */
+	observedAt: number()
+});
+/**
+* What a SOURCE still holds for one storage class — the number that makes a
+* "drain remaining" action honest rather than hopeful.
+*
+* It comes from the archive (`SegmentHourLedger.census` for footage, the media
+* engine's own selection count for media), never from the resident index: a
+* drain sized off `RecordingIndex` is what reported `done` over 80.3 GB it had
+* never been told about (D295).
+*
+* `items`/`bytes` are `null` for "the archive could not be asked", which is
+* deliberately NOT zero: a drain is still offered for an unknown residue,
+* because refusing on an unanswerable read would hide exactly the case an
+* operator needs to act on.
+*/
+var StorageMigrationResidueSchema = object({
+	storageClass: StorageMigrationClassSchema,
+	/** The location still holding the data. `'*'` for the media lane, whose rows
+	*  move from wherever they are rather than from one named source. */
+	fromLocationId: string(),
+	/** Where a drain would move it — the class's CURRENT default. */
+	toLocationId: string(),
+	/** Segments (footage lane) or rows (media lane) still on the source. */
+	items: number().int().nonnegative().nullable(),
+	/** Bytes on the source; `null` when the lane counts rows rather than bytes. */
+	bytes: number().int().nonnegative().nullable()
+});
+/**
+* Run the DRAIN half and nothing else.
+*
+* A migration that reached `done` has already repointed, so `start` correctly
+* refuses its destination ("already the default") — there is nothing left to
+* repoint. But the drain can fail, be cancelled, be interrupted by a restart,
+* or finish against a work list that was a tenth of the archive (D295), and
+* before this there was no supported way to run only that half: the only way
+* through was calling `recording.relocateFootage` by hand over admin tRPC.
+*
+* `drain` NEVER calls `setDefaultLocations`. That is what keeps `start`'s
+* refusal meaningful: the two verbs are disjoint, so nothing here can silently
+* re-repoint a class that is already migrated.
+*/
+var StorageMigrationDrainInputSchema = object({
+	/** The classes to drain. Each must appear in `storageMigration.residue`, so
+	*  a class whose source is already empty is refused rather than started. */
+	classes: array(StorageMigrationClassSchema).min(1),
+	throttleMbps: number().min(1).max(1e3).optional()
+});
+/** What a footage source still holds, asked of the durable hour ledger. */
+var RelocateResidueInputSchema = object({
+	fromLocationId: string().min(1),
+	/** Narrow to one logical class; omit for every profile on the location. */
+	footageClass: RelocateFootageClassSchema.optional()
+});
+/** `null` = the archive could not answer (no ledger on this node, or the
+*  aggregate failed). Never conflated with an empty source. */
+var RelocateResidueSchema = object({
+	segments: number().int().nonnegative(),
+	bytes: number().int().nonnegative()
+}).nullable();
+/** How many rows a media pass would still act on against a given target — the
+*  media lane's denominator AND its residue, from ONE derivation so the two can
+*  never disagree. `null` = the count could not be taken. */
+var RelocatableMediaCountSchema = object({ rows: number().int().nonnegative() }).nullable();
+var RelocatableMediaCountInputSchema = object({
+	toLocationId: string().min(1),
+	/** Omitted = `move`. */
+	mode: MediaRelocateModeSchema.optional()
+});
+/**
 * `StorageLocationType` — an addon-declared id that identifies the *kind* of
 * storage a location serves. Defined here (not in `capabilities/storage.cap.ts`)
 * so the persisted record schema and the consumer-facing cap can both consume it
@@ -8336,6 +8464,32 @@ var StorageLocationRefSchema = union([StorageLocationTypeSchema, string().regex(
 *   two addons declaring the same `id` must agree on `cardinality` (validated
 *   at kernel aggregation time, not here).
 */
+/**
+* `StorageAccess` — how the service that DECLARED a storage-location kind
+* actually reaches the bytes. It is the constraint that decides which
+* `storage-provider`s may back a location of that kind.
+*
+* - `'local-path'` — the service asks `storage.resolve` for a path string and
+*   then does its own `node:fs` I/O on it (the recorder's segment writer, the
+*   post-analysis media roots). Only a provider that serves a genuine local
+*   filesystem (`getProviderInfo().nodeLocal === true`) can satisfy that: a
+*   remote provider's `resolve` returns a path on the REMOTE host, and
+*   `fs.readdir` of it on this node either fails or — far worse — succeeds
+*   against a same-named local directory that is something else entirely.
+*
+* - `'cap-mediated'` — every byte travels through the `storage` cap
+*   (`read`/`write`, or `beginUpload`/`writeChunk`/`finalizeUpload`). The
+*   service never sees a path, so any provider can back it. `backups` is the
+*   one kind that qualifies today.
+*
+* Before this existed, `recordings` was unreachable by SFTP/S3/WebDAV only as
+* an EMERGENT property of how the recorder happened to be written. Nothing
+* refused the configuration; the first write simply went somewhere wrong, and
+* a recording write that goes wrong surfaces as a silent black window rather
+* than an error (the read path does not `stat`). This turns that accident into
+* a declared, enforced, testable refusal.
+*/
+var StorageAccessSchema = _enum(["local-path", "cap-mediated"]);
 var StorageLocationDeclarationSchema = object({
 	/**
 	* Global location identifier, e.g. `recordings` or `recordingsLow`.
@@ -8355,6 +8509,19 @@ var StorageLocationDeclarationSchema = object({
 	*/
 	cardinality: _enum(["single", "multi"]),
 	/**
+	* HOW the declaring service reaches the bytes — and therefore WHICH
+	* providers may back a location of this kind. See {@link StorageAccessSchema}
+	* and {@link STORAGE_ACCESS_FALLBACK}.
+	*
+	* Absent means `'local-path'`. That default is FAIL-CLOSED on purpose: it
+	* can only over-restrict (refuse a remote provider for a kind that might
+	* have coped) and never under-restrict. Declaring `'cap-mediated'` is the
+	* permissive direction and is therefore never inferred — a repo guard
+	* (`scripts/check-storage-access-declarations.ts`) refuses to let it be
+	* reached by omission.
+	*/
+	access: StorageAccessSchema.optional(),
+	/**
 	* When set, the default instance for this location inherits its resolved
 	* root from the named location's default instance. Useful for derivative
 	* slots (e.g. `recordingsLow` → `recordings`) so operators only need to
@@ -17897,8 +18064,10 @@ var TrackSchema = object({
 	lastSeen: number(),
 	/** Frame-rate position history (subject to maxPositionHistory cap). */
 	positions: array(TrackPositionSchema).readonly(),
-	/** Periodic snapshots at snapshotIntervalMs cadence (subject to
-	*  saveThumbnails policy). */
+	/** Periodic snapshots at snapshotIntervalMs cadence — DEBUG media, produced
+	*  only while `MediaSettings.debugMediaEnabled` is on for the camera (D299;
+	*  the retired `saveThumbnails` used to gate this and the rolling
+	*  `lastFrame` together). Empty is the healthy default, not a capture gap. */
 	snapshots: array(TrackSnapshotSchema).readonly(),
 	/** Deduplicated zones the track has entered at least once. Zone IDS. */
 	zonesVisited: array(string()).readonly(),
@@ -18758,7 +18927,10 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(RelocateMediaInputSchema, object({ jobId: string() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), UnstampedEventMediaCountSchema, { auth: "admin" }), method(object({}), array(RelocateJobSchema).readonly(), {
+}), method(object({}), UnstampedEventMediaCountSchema, { auth: "admin" }), method(RelocatableMediaCountInputSchema, RelocatableMediaCountSchema, {
+	kind: "query",
+	auth: "admin"
+}), method(object({}), array(RelocateJobSchema).readonly(), {
 	kind: "query",
 	auth: "admin"
 }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
@@ -20717,6 +20889,9 @@ method(StorageMigrationInputSchema, StorageMigrationPlanSchema, { auth: "admin"
 }), method(object({ jobId: string().optional() }), StorageMigrationJobSchema.nullable(), { auth: "admin" }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({}), array(StorageMigrationMoverSchema).readonly(), { auth: "admin" }), method(object({}), array(StorageMigrationResidueSchema).readonly(), { auth: "admin" }), method(StorageMigrationDrainInputSchema, object({ jobId: string() }), {
+	kind: "mutation",
+	auth: "admin"
 });
 var ProviderInfoSchema = discriminatedUnion("shouldSaveDiskSpace", [object({
 	providerId: string().min(1),
@@ -21115,12 +21290,38 @@ response: record(string(), unknown()) }), object({
 *
 * ## Why this is a capability and not a helper
 *
-* Six stores in `addon-post-analysis` already hold vectors — object CLIP, face,
-* plate, vehicle, identity, and the event store's derivatives — and every one of
-* them keeps its vectors in a `JSON` settings-store column and ranks them by
-* brute-force cosine in JS. Measured on the live hub that costs ~11.7 KB per row
-* (512 floats as TEXT, `JSON.parse`d on every search) and made semantic search
-* load 5,000 rows before ranking anything.
+* This capability was introduced with the claim that SIX stores in
+* `addon-post-analysis` held vectors in a `JSON` settings-store column — object
+* CLIP, face, plate, vehicle, identity, and the event store's derivatives. That
+* claim was never true, and leaving it here made five stores look like pending
+* work when three of them have no vector at all. Counted column by column on
+* 2026-08-30, exactly THREE ever held one:
+*
+*  - `object-clip`      — 512-dim CLIP image embedding, migrated 2026-08-06.
+*  - `faces.embedding`  — 512-dim ArcFace face embedding, migrated 2026-08-30.
+*  - `identity-samples.embedding` — the same ArcFace vector for an ENROLLED
+*    face, migrated 2026-08-30 into its OWN index (see below).
+*
+* `plates` and `vehicle-samples` store a plate STRING and a score; `vehicles`
+* and `identities` store a name; the event store stores no derivative vector.
+* They are not migration candidates and never were.
+*
+* Measured on the live hub the JSON encoding cost ~11.7 KB per row (512 floats
+* as TEXT, `JSON.parse`d on every search) and made semantic search load 5,000
+* rows before ranking anything.
+*
+* ## One index per COMPARISON, never per encoder
+*
+* `faces` and `identity-samples` hold the same 512 ArcFace dims from the same
+* model, and they still get two indexes. An index is a set of things that are
+* ranked against each other and that live and die together, and these two are
+* neither: a `faces` row is TRACK-OWNED and cascades away with its track under
+* a per-camera capacity cap, an `identity-samples` row is retention-EXEMPT
+* forever and is the gallery every recognition ranks against. One index would
+* mean every gallery load and every reconcile carried a filter whose failure
+* mode is either ranking a candidate against itself or reclaiming an enrolled
+* person's only sample. The dimension they share is not a reason to share an
+* index; the question they answer is, and it differs.
 *
 * The fix is not a faster loop, it is a different backend — and the backend
 * should be replaceable without touching six callers. So: a singleton
@@ -21225,7 +21426,20 @@ var VectorQueryResultSchema = object({
 	*/
 	scanned: number(),
 	/** True when the backend could not consider every row that passed the filter. */
-	truncated: boolean()
+	truncated: boolean(),
+	/**
+	* The `topK` the backend actually ran with.
+	*
+	* Every backend has a ceiling — sqlite-vec's is 4,096 — and a caller asking
+	* past it used to learn nothing but a boolean, from a WARN in the provider's
+	* own log rather than in its answer. That is how an audit asking for 20,000
+	* consumed 4,096 and reported `examined: 4096` as if it had walked the index,
+	* for weeks. `truncated` says THAT the answer was short; this says BY HOW
+	* MUCH, in the return value, where the caller cannot fail to see it.
+	*
+	* Equals the requested `topK` whenever nothing was lowered.
+	*/
+	effectiveTopK: number().int().positive()
 });
 var VectorDeleteInputSchema = object({
 	index: string(),
@@ -21254,6 +21468,68 @@ var VectorGetResultSchema = object({ items: array(object({
 	id: string(),
 	metadata: VectorMetadataSchema
 })) });
+/**
+* Ids to read back WITH their vectors.
+*
+* The sibling of {@link VectorGetResultSchema}, and deliberately a separate
+* method rather than a flag on it: `getByIds` promises no vectors and its one
+* caller depends on that promise. This one promises the opposite.
+*
+* It exists because a store cannot put its vectors here otherwise. An ArcFace
+* gallery is ranked IN PROCESS, per detection, against every enrolled sample —
+* a per-face cross-process KNN would be a network round trip inside the
+* recognition loop. So the gallery is loaded once and held in RAM, and loading
+* it requires the index to hand the floats back. Without this method the only
+* way to keep a readable vector is a JSON column, which is the thing this
+* capability exists to delete.
+*
+* BOUNDED BY THE CALLER: ids are named, never "everything". Enumerating an
+* index is {@link VectorScanInputSchema}'s job, and it returns no vectors.
+*/
+var VectorFetchInputSchema = object({
+	index: string(),
+	ids: array(string())
+});
+var VectorFetchResultSchema = object({ items: array(object({
+	id: string(),
+	/** base64 Float32LE — the same wire form `upsert` accepts. */
+	vector: string(),
+	metadata: VectorMetadataSchema
+})) });
+/**
+* ENUMERATE an index: one page of rows in a stable order, no ranking.
+*
+* A reconcile does not want the nearest rows, it wants ALL of them, and asking
+* a KNN for "all" is the wrong question twice over. It hits the backend's `k`
+* ceiling — 4,096 on sqlite-vec against a 22,128-row index — and it needs a
+* probe vector it does not have, so the audit passed a ZERO vector whose cosine
+* distance to every row is degenerate. `examined: 4096` then read as "we
+* looked" for as long as anyone cared to read it.
+*
+* This is the primitive that question actually needs: a bounded page, ordered
+* by the backend's own row order, costing no distance computation at all.
+* Vectors are NOT returned — an enumeration that shipped 2 KB per row would be
+* the full-table read this capability was built to stop.
+*/
+var VectorScanInputSchema = object({
+	index: string(),
+	/** Opaque resume point. `0` starts at the top; pass back `nextCursor`. */
+	cursor: number().int().nonnegative().default(0),
+	limit: number().int().positive()
+});
+var VectorScanResultSchema = object({
+	items: array(object({
+		id: string(),
+		metadata: VectorMetadataSchema
+	})),
+	/**
+	* Where the next page starts, or `null` when the walk reached the end.
+	*
+	* `null` is the ONLY end-of-index signal. A caller must not infer the end
+	* from a short page: a backend is free to return fewer rows than asked.
+	*/
+	nextCursor: number().int().nonnegative().nullable()
+});
 var VectorStatsInputSchema = object({ index: string() });
 var VectorStatsResultSchema = object({
 	/** Provider id, so an operator can tell brute force from an ANN index. */
@@ -21272,7 +21548,7 @@ method(VectorDeclareIndexInputSchema, _void(), {
 }), method(VectorUpsertInputSchema, VectorUpsertResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(VectorQueryInputSchema, VectorQueryResultSchema, { auth: "admin" }), method(VectorGetInputSchema, VectorGetResultSchema, { auth: "admin" }), method(VectorDeleteInputSchema, VectorDeleteResultSchema, {
+}), method(VectorQueryInputSchema, VectorQueryResultSchema, { auth: "admin" }), method(VectorGetInputSchema, VectorGetResultSchema, { auth: "admin" }), method(VectorFetchInputSchema, VectorFetchResultSchema, { auth: "admin" }), method(VectorScanInputSchema, VectorScanResultSchema, { auth: "admin" }), method(VectorDeleteInputSchema, VectorDeleteResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, {
@@ -26237,6 +26513,9 @@ method(object({
 }), method(object({}), array(RelocateJobSchema).readonly(), {
 	kind: "query",
 	auth: "admin"
+}), method(RelocateResidueInputSchema, RelocateResidueSchema, {
+	kind: "query",
+	auth: "admin"
 }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -31202,6 +31481,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.countRelocatableMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.countUnstampedEventMedia": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -32366,6 +32651,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.getRelocateResidue": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.getStorageMigrationMoveStatus": {
 		capName: "recording",
 		capScope: "system",
@@ -32912,12 +33203,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"storageMigration.drain": {
+		capName: "storage-migration",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"storageMigration.movers": {
+		capName: "storage-migration",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageMigration.plan": {
 		capName: "storage-migration",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"storageMigration.residue": {
+		capName: "storage-migration",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageMigration.start": {
 		capName: "storage-migration",
 		capScope: "system",
@@ -33752,6 +34061,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"vectorStore.fetchByIds": {
+		capName: "vector-store",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"vectorStore.getByIds": {
 		capName: "vector-store",
 		capScope: "system",
@@ -33764,6 +34079,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"vectorStore.scan": {
+		capName: "vector-store",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"vectorStore.stats": {
 		capName: "vector-store",
 		capScope: "system",

package/dist/{dist-Bzn0_Gfg.js → dist-ki6Kt6cL.js}

@@ -8181,13 +8181,49 @@ var StorageMigrationParticipantSchema = _enum([
 	"recorder",
 	"analytics"
 ]);
+/**
+* The mover's own numbers, folded onto the coordinator's durable move record.
+*
+* The long half of a non-blocking migration is `draining`, and it is measured
+* in hours: 136 885 files at ~4 MB/s is about five of them. Before this shape
+* existed the only place those numbers appeared was a Loki line, so an operator
+* watching the Admin UI saw `phase: draining` and nothing else for a whole
+* afternoon.
+*
+* It is POLLED, never pushed. Events are telemetry and may be dropped
+* (D8/D11), and a dropped progress event is indistinguishable from a stalled
+* mover — which is the exact failure this is meant to end. The coordinator's
+* `waitForMoves` already fetches the whole {@link RelocateJob} on every tick to
+* read `state`; folding the counters costs no extra read and makes the durable
+* record say afterwards how far a move actually got.
+*
+* `filesTotal` is `null` for "no honest denominator" and is never zero-filled:
+* a windowed footage job (`sinceMs`) and a node with no ledger both genuinely
+* cannot say M, and a 0 there would render as "100 % done".
+*/
+var StorageMigrationMoveProgressSchema = object({
+	filesMoved: number().int().nonnegative(),
+	/** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
+	filesTotal: number().int().nonnegative().nullable(),
+	bytesMoved: number().int().nonnegative(),
+	/** The MOVER's start, not the migration's: a drain restarted after an addon
+	*  crash gets a new mover, and a rate computed from the migration's start
+	*  would silently average in the time nothing was running. */
+	startedAt: number(),
+	/** When the coordinator last read these numbers. Paired with `startedAt` it
+	*  is the only honest rate: both clocks are the hub's, so a UI never has to
+	*  subtract its own. */
+	observedAt: number()
+});
 var StorageMigrationMoveSchema = object({
 	storageClass: StorageMigrationClassSchema,
 	fromLocationId: string(),
 	toLocationId: string(),
 	moverJobId: string().nullable(),
 	state: RelocateJobStateSchema.nullable(),
-	error: string().nullable()
+	error: string().nullable(),
+	/** Last observed mover counters; `null` until the mover has been polled once. */
+	progress: StorageMigrationMoveProgressSchema.nullable()
 });
 var StorageMigrationJobSchema = object({
 	jobId: string(),
@@ -8233,6 +8269,98 @@ var StorageMigrationPlanSchema = object({
 	findings: array(StorageMigrationFindingSchema)
 });
 /**
+* A mover as it exists RIGHT NOW, whether or not a migration job owns it.
+*
+* The coordinator's job record is the state of record for a migration, and its
+* moves carry {@link StorageMigrationMoveProgress}. But the movers are usable
+* standalone — `recording.relocateFootage` and `pipelineAnalytics.relocateMedia`
+* are both operator-callable, and on 2026-08-29 a five-hour drain was armed that
+* way because no supported UI path existed. A mover armed like that has no job
+* to fold progress into, so it has to be readable on its own or it is invisible.
+*
+* `migrationJobId` is what tells the two apart: `null` means nothing here
+* orchestrated it.
+*/
+var StorageMigrationMoverSchema = object({
+	lane: _enum(["footage", "media"]),
+	job: RelocateJobSchema,
+	/** The coordinator job that armed this mover, or `null` for a mover armed
+	*  directly against the owning addon. */
+	migrationJobId: string().nullable(),
+	/** When the hub read these counters. Stamped here so a rate is `bytesMoved`
+	*  over (`observedAt` − `job.startedAt`) with BOTH ends on the hub's clock —
+	*  a browser subtracting its own `Date.now()` from a server `startedAt` is a
+	*  rate made of two different clocks. */
+	observedAt: number()
+});
+/**
+* What a SOURCE still holds for one storage class — the number that makes a
+* "drain remaining" action honest rather than hopeful.
+*
+* It comes from the archive (`SegmentHourLedger.census` for footage, the media
+* engine's own selection count for media), never from the resident index: a
+* drain sized off `RecordingIndex` is what reported `done` over 80.3 GB it had
+* never been told about (D295).
+*
+* `items`/`bytes` are `null` for "the archive could not be asked", which is
+* deliberately NOT zero: a drain is still offered for an unknown residue,
+* because refusing on an unanswerable read would hide exactly the case an
+* operator needs to act on.
+*/
+var StorageMigrationResidueSchema = object({
+	storageClass: StorageMigrationClassSchema,
+	/** The location still holding the data. `'*'` for the media lane, whose rows
+	*  move from wherever they are rather than from one named source. */
+	fromLocationId: string(),
+	/** Where a drain would move it — the class's CURRENT default. */
+	toLocationId: string(),
+	/** Segments (footage lane) or rows (media lane) still on the source. */
+	items: number().int().nonnegative().nullable(),
+	/** Bytes on the source; `null` when the lane counts rows rather than bytes. */
+	bytes: number().int().nonnegative().nullable()
+});
+/**
+* Run the DRAIN half and nothing else.
+*
+* A migration that reached `done` has already repointed, so `start` correctly
+* refuses its destination ("already the default") — there is nothing left to
+* repoint. But the drain can fail, be cancelled, be interrupted by a restart,
+* or finish against a work list that was a tenth of the archive (D295), and
+* before this there was no supported way to run only that half: the only way
+* through was calling `recording.relocateFootage` by hand over admin tRPC.
+*
+* `drain` NEVER calls `setDefaultLocations`. That is what keeps `start`'s
+* refusal meaningful: the two verbs are disjoint, so nothing here can silently
+* re-repoint a class that is already migrated.
+*/
+var StorageMigrationDrainInputSchema = object({
+	/** The classes to drain. Each must appear in `storageMigration.residue`, so
+	*  a class whose source is already empty is refused rather than started. */
+	classes: array(StorageMigrationClassSchema).min(1),
+	throttleMbps: number().min(1).max(1e3).optional()
+});
+/** What a footage source still holds, asked of the durable hour ledger. */
+var RelocateResidueInputSchema = object({
+	fromLocationId: string().min(1),
+	/** Narrow to one logical class; omit for every profile on the location. */
+	footageClass: RelocateFootageClassSchema.optional()
+});
+/** `null` = the archive could not answer (no ledger on this node, or the
+*  aggregate failed). Never conflated with an empty source. */
+var RelocateResidueSchema = object({
+	segments: number().int().nonnegative(),
+	bytes: number().int().nonnegative()
+}).nullable();
+/** How many rows a media pass would still act on against a given target — the
+*  media lane's denominator AND its residue, from ONE derivation so the two can
+*  never disagree. `null` = the count could not be taken. */
+var RelocatableMediaCountSchema = object({ rows: number().int().nonnegative() }).nullable();
+var RelocatableMediaCountInputSchema = object({
+	toLocationId: string().min(1),
+	/** Omitted = `move`. */
+	mode: MediaRelocateModeSchema.optional()
+});
+/**
 * `StorageLocationType` — an addon-declared id that identifies the *kind* of
 * storage a location serves. Defined here (not in `capabilities/storage.cap.ts`)
 * so the persisted record schema and the consumer-facing cap can both consume it
@@ -8336,6 +8464,32 @@ var StorageLocationRefSchema = union([StorageLocationTypeSchema, string().regex(
 *   two addons declaring the same `id` must agree on `cardinality` (validated
 *   at kernel aggregation time, not here).
 */
+/**
+* `StorageAccess` — how the service that DECLARED a storage-location kind
+* actually reaches the bytes. It is the constraint that decides which
+* `storage-provider`s may back a location of that kind.
+*
+* - `'local-path'` — the service asks `storage.resolve` for a path string and
+*   then does its own `node:fs` I/O on it (the recorder's segment writer, the
+*   post-analysis media roots). Only a provider that serves a genuine local
+*   filesystem (`getProviderInfo().nodeLocal === true`) can satisfy that: a
+*   remote provider's `resolve` returns a path on the REMOTE host, and
+*   `fs.readdir` of it on this node either fails or — far worse — succeeds
+*   against a same-named local directory that is something else entirely.
+*
+* - `'cap-mediated'` — every byte travels through the `storage` cap
+*   (`read`/`write`, or `beginUpload`/`writeChunk`/`finalizeUpload`). The
+*   service never sees a path, so any provider can back it. `backups` is the
+*   one kind that qualifies today.
+*
+* Before this existed, `recordings` was unreachable by SFTP/S3/WebDAV only as
+* an EMERGENT property of how the recorder happened to be written. Nothing
+* refused the configuration; the first write simply went somewhere wrong, and
+* a recording write that goes wrong surfaces as a silent black window rather
+* than an error (the read path does not `stat`). This turns that accident into
+* a declared, enforced, testable refusal.
+*/
+var StorageAccessSchema = _enum(["local-path", "cap-mediated"]);
 var StorageLocationDeclarationSchema = object({
 	/**
 	* Global location identifier, e.g. `recordings` or `recordingsLow`.
@@ -8355,6 +8509,19 @@ var StorageLocationDeclarationSchema = object({
 	*/
 	cardinality: _enum(["single", "multi"]),
 	/**
+	* HOW the declaring service reaches the bytes — and therefore WHICH
+	* providers may back a location of this kind. See {@link StorageAccessSchema}
+	* and {@link STORAGE_ACCESS_FALLBACK}.
+	*
+	* Absent means `'local-path'`. That default is FAIL-CLOSED on purpose: it
+	* can only over-restrict (refuse a remote provider for a kind that might
+	* have coped) and never under-restrict. Declaring `'cap-mediated'` is the
+	* permissive direction and is therefore never inferred — a repo guard
+	* (`scripts/check-storage-access-declarations.ts`) refuses to let it be
+	* reached by omission.
+	*/
+	access: StorageAccessSchema.optional(),
+	/**
 	* When set, the default instance for this location inherits its resolved
 	* root from the named location's default instance. Useful for derivative
 	* slots (e.g. `recordingsLow` → `recordings`) so operators only need to
@@ -17897,8 +18064,10 @@ var TrackSchema = object({
 	lastSeen: number(),
 	/** Frame-rate position history (subject to maxPositionHistory cap). */
 	positions: array(TrackPositionSchema).readonly(),
-	/** Periodic snapshots at snapshotIntervalMs cadence (subject to
-	*  saveThumbnails policy). */
+	/** Periodic snapshots at snapshotIntervalMs cadence — DEBUG media, produced
+	*  only while `MediaSettings.debugMediaEnabled` is on for the camera (D299;
+	*  the retired `saveThumbnails` used to gate this and the rolling
+	*  `lastFrame` together). Empty is the healthy default, not a capture gap. */
 	snapshots: array(TrackSnapshotSchema).readonly(),
 	/** Deduplicated zones the track has entered at least once. Zone IDS. */
 	zonesVisited: array(string()).readonly(),
@@ -18758,7 +18927,10 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(RelocateMediaInputSchema, object({ jobId: string() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), UnstampedEventMediaCountSchema, { auth: "admin" }), method(object({}), array(RelocateJobSchema).readonly(), {
+}), method(object({}), UnstampedEventMediaCountSchema, { auth: "admin" }), method(RelocatableMediaCountInputSchema, RelocatableMediaCountSchema, {
+	kind: "query",
+	auth: "admin"
+}), method(object({}), array(RelocateJobSchema).readonly(), {
 	kind: "query",
 	auth: "admin"
 }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
@@ -20717,6 +20889,9 @@ method(StorageMigrationInputSchema, StorageMigrationPlanSchema, { auth: "admin"
 }), method(object({ jobId: string().optional() }), StorageMigrationJobSchema.nullable(), { auth: "admin" }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({}), array(StorageMigrationMoverSchema).readonly(), { auth: "admin" }), method(object({}), array(StorageMigrationResidueSchema).readonly(), { auth: "admin" }), method(StorageMigrationDrainInputSchema, object({ jobId: string() }), {
+	kind: "mutation",
+	auth: "admin"
 });
 var ProviderInfoSchema = discriminatedUnion("shouldSaveDiskSpace", [object({
 	providerId: string().min(1),
@@ -21115,12 +21290,38 @@ response: record(string(), unknown()) }), object({
 *
 * ## Why this is a capability and not a helper
 *
-* Six stores in `addon-post-analysis` already hold vectors — object CLIP, face,
-* plate, vehicle, identity, and the event store's derivatives — and every one of
-* them keeps its vectors in a `JSON` settings-store column and ranks them by
-* brute-force cosine in JS. Measured on the live hub that costs ~11.7 KB per row
-* (512 floats as TEXT, `JSON.parse`d on every search) and made semantic search
-* load 5,000 rows before ranking anything.
+* This capability was introduced with the claim that SIX stores in
+* `addon-post-analysis` held vectors in a `JSON` settings-store column — object
+* CLIP, face, plate, vehicle, identity, and the event store's derivatives. That
+* claim was never true, and leaving it here made five stores look like pending
+* work when three of them have no vector at all. Counted column by column on
+* 2026-08-30, exactly THREE ever held one:
+*
+*  - `object-clip`      — 512-dim CLIP image embedding, migrated 2026-08-06.
+*  - `faces.embedding`  — 512-dim ArcFace face embedding, migrated 2026-08-30.
+*  - `identity-samples.embedding` — the same ArcFace vector for an ENROLLED
+*    face, migrated 2026-08-30 into its OWN index (see below).
+*
+* `plates` and `vehicle-samples` store a plate STRING and a score; `vehicles`
+* and `identities` store a name; the event store stores no derivative vector.
+* They are not migration candidates and never were.
+*
+* Measured on the live hub the JSON encoding cost ~11.7 KB per row (512 floats
+* as TEXT, `JSON.parse`d on every search) and made semantic search load 5,000
+* rows before ranking anything.
+*
+* ## One index per COMPARISON, never per encoder
+*
+* `faces` and `identity-samples` hold the same 512 ArcFace dims from the same
+* model, and they still get two indexes. An index is a set of things that are
+* ranked against each other and that live and die together, and these two are
+* neither: a `faces` row is TRACK-OWNED and cascades away with its track under
+* a per-camera capacity cap, an `identity-samples` row is retention-EXEMPT
+* forever and is the gallery every recognition ranks against. One index would
+* mean every gallery load and every reconcile carried a filter whose failure
+* mode is either ranking a candidate against itself or reclaiming an enrolled
+* person's only sample. The dimension they share is not a reason to share an
+* index; the question they answer is, and it differs.
 *
 * The fix is not a faster loop, it is a different backend — and the backend
 * should be replaceable without touching six callers. So: a singleton
@@ -21225,7 +21426,20 @@ var VectorQueryResultSchema = object({
 	*/
 	scanned: number(),
 	/** True when the backend could not consider every row that passed the filter. */
-	truncated: boolean()
+	truncated: boolean(),
+	/**
+	* The `topK` the backend actually ran with.
+	*
+	* Every backend has a ceiling — sqlite-vec's is 4,096 — and a caller asking
+	* past it used to learn nothing but a boolean, from a WARN in the provider's
+	* own log rather than in its answer. That is how an audit asking for 20,000
+	* consumed 4,096 and reported `examined: 4096` as if it had walked the index,
+	* for weeks. `truncated` says THAT the answer was short; this says BY HOW
+	* MUCH, in the return value, where the caller cannot fail to see it.
+	*
+	* Equals the requested `topK` whenever nothing was lowered.
+	*/
+	effectiveTopK: number().int().positive()
 });
 var VectorDeleteInputSchema = object({
 	index: string(),
@@ -21254,6 +21468,68 @@ var VectorGetResultSchema = object({ items: array(object({
 	id: string(),
 	metadata: VectorMetadataSchema
 })) });
+/**
+* Ids to read back WITH their vectors.
+*
+* The sibling of {@link VectorGetResultSchema}, and deliberately a separate
+* method rather than a flag on it: `getByIds` promises no vectors and its one
+* caller depends on that promise. This one promises the opposite.
+*
+* It exists because a store cannot put its vectors here otherwise. An ArcFace
+* gallery is ranked IN PROCESS, per detection, against every enrolled sample —
+* a per-face cross-process KNN would be a network round trip inside the
+* recognition loop. So the gallery is loaded once and held in RAM, and loading
+* it requires the index to hand the floats back. Without this method the only
+* way to keep a readable vector is a JSON column, which is the thing this
+* capability exists to delete.
+*
+* BOUNDED BY THE CALLER: ids are named, never "everything". Enumerating an
+* index is {@link VectorScanInputSchema}'s job, and it returns no vectors.
+*/
+var VectorFetchInputSchema = object({
+	index: string(),
+	ids: array(string())
+});
+var VectorFetchResultSchema = object({ items: array(object({
+	id: string(),
+	/** base64 Float32LE — the same wire form `upsert` accepts. */
+	vector: string(),
+	metadata: VectorMetadataSchema
+})) });
+/**
+* ENUMERATE an index: one page of rows in a stable order, no ranking.
+*
+* A reconcile does not want the nearest rows, it wants ALL of them, and asking
+* a KNN for "all" is the wrong question twice over. It hits the backend's `k`
+* ceiling — 4,096 on sqlite-vec against a 22,128-row index — and it needs a
+* probe vector it does not have, so the audit passed a ZERO vector whose cosine
+* distance to every row is degenerate. `examined: 4096` then read as "we
+* looked" for as long as anyone cared to read it.
+*
+* This is the primitive that question actually needs: a bounded page, ordered
+* by the backend's own row order, costing no distance computation at all.
+* Vectors are NOT returned — an enumeration that shipped 2 KB per row would be
+* the full-table read this capability was built to stop.
+*/
+var VectorScanInputSchema = object({
+	index: string(),
+	/** Opaque resume point. `0` starts at the top; pass back `nextCursor`. */
+	cursor: number().int().nonnegative().default(0),
+	limit: number().int().positive()
+});
+var VectorScanResultSchema = object({
+	items: array(object({
+		id: string(),
+		metadata: VectorMetadataSchema
+	})),
+	/**
+	* Where the next page starts, or `null` when the walk reached the end.
+	*
+	* `null` is the ONLY end-of-index signal. A caller must not infer the end
+	* from a short page: a backend is free to return fewer rows than asked.
+	*/
+	nextCursor: number().int().nonnegative().nullable()
+});
 var VectorStatsInputSchema = object({ index: string() });
 var VectorStatsResultSchema = object({
 	/** Provider id, so an operator can tell brute force from an ANN index. */
@@ -21272,7 +21548,7 @@ method(VectorDeclareIndexInputSchema, _void(), {
 }), method(VectorUpsertInputSchema, VectorUpsertResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(VectorQueryInputSchema, VectorQueryResultSchema, { auth: "admin" }), method(VectorGetInputSchema, VectorGetResultSchema, { auth: "admin" }), method(VectorDeleteInputSchema, VectorDeleteResultSchema, {
+}), method(VectorQueryInputSchema, VectorQueryResultSchema, { auth: "admin" }), method(VectorGetInputSchema, VectorGetResultSchema, { auth: "admin" }), method(VectorFetchInputSchema, VectorFetchResultSchema, { auth: "admin" }), method(VectorScanInputSchema, VectorScanResultSchema, { auth: "admin" }), method(VectorDeleteInputSchema, VectorDeleteResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, {
@@ -26237,6 +26513,9 @@ method(object({
 }), method(object({}), array(RelocateJobSchema).readonly(), {
 	kind: "query",
 	auth: "admin"
+}), method(RelocateResidueInputSchema, RelocateResidueSchema, {
+	kind: "query",
+	auth: "admin"
 }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -31202,6 +31481,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.countRelocatableMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.countUnstampedEventMedia": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -32366,6 +32651,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.getRelocateResidue": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.getStorageMigrationMoveStatus": {
 		capName: "recording",
 		capScope: "system",
@@ -32912,12 +33203,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"storageMigration.drain": {
+		capName: "storage-migration",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"storageMigration.movers": {
+		capName: "storage-migration",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageMigration.plan": {
 		capName: "storage-migration",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"storageMigration.residue": {
+		capName: "storage-migration",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageMigration.start": {
 		capName: "storage-migration",
 		capScope: "system",
@@ -33752,6 +34061,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"vectorStore.fetchByIds": {
+		capName: "vector-store",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"vectorStore.getByIds": {
 		capName: "vector-store",
 		capScope: "system",
@@ -33764,6 +34079,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"vectorStore.scan": {
+		capName: "vector-store",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"vectorStore.stats": {
 		capName: "vector-store",
 		capScope: "system",

package/dist/ingress/tailscale-ingress.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-Bzn0_Gfg.js");
+const require_dist = require("../dist-ki6Kt6cL.js");
 let node_crypto = require("node:crypto");
 let node_child_process = require("node:child_process");
 //#region src/ingress/tailscale-cli.ts

package/dist/ingress/tailscale-ingress.addon.mjs

@@ -1,4 +1,4 @@
-import { a as EventCategory, i as BaseAddon, n as networkAccessCapability } from "../dist-cWp3ATn9.mjs";
+import { a as EventCategory, i as BaseAddon, n as networkAccessCapability } from "../dist-RluxJbgF.mjs";
 import { randomUUID } from "node:crypto";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-tailscale",
-  "version": "1.2.43",
+  "version": "1.2.45",
   "description": "Tailscale bundle for CamStack — joins the host to a tailnet (client) and exposes the hub via Serve/Funnel (ingress). Multi-entry npm package shipping 2 addons under a single bundle.",
   "keywords": [
     "camstack",