@camstack/addon-tailscale 1.2.46 → 1.2.47

package/dist/client/tailscale.addon.js

@@ -24,7 +24,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-const require_dist = require("../dist-B81Rw6ym.js");
+const require_dist = require("../dist-CJS8Mo7l.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_fs = require("node:fs");

package/dist/client/tailscale.addon.mjs

@@ -1,4 +1,4 @@
-import { a as EventCategory, i as BaseAddon, n as networkAccessCapability, r as BOOT_RECOVERY_BACKOFF_MS, t as meshNetworkCapability } from "../dist-Tyu2rQxG.mjs";
+import { a as EventCategory, i as BaseAddon, n as networkAccessCapability, r as BOOT_RECOVERY_BACKOFF_MS, t as meshNetworkCapability } from "../dist-BO7-LQSt.mjs";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import * as fs from "node:fs";

package/dist/{dist-Tyu2rQxG.mjs → dist-BO7-LQSt.mjs}

@@ -12937,6 +12937,114 @@ method(object({
 	height: number()
 }), EmbeddingResultSchema, { auth: "admin" }), method(object({ text: string() }), EmbeddingResultSchema, { auth: "admin" }), method(_void(), EmbeddingInfoSchema, { auth: "admin" });
 /**
+* `failure-contribution` — the capability an addon reports its OWN losses
+* through, per camera, with the denominator attached. It stores nothing.
+*
+* ## The twin of `load-contribution`, and why it is a twin and not a field
+*
+* `load-contribution` answers *what did this camera COST*. This answers *what
+* did this camera LOSE*. The reporting discipline is identical and deliberately
+* copied: the contributor reports what it already knows, hub-main adds only
+* `addonId`, nothing needs global knowledge, and there is no central list for
+* somebody to forget to edit.
+*
+* They are not merged, because their invariants are opposites:
+*
+*  - a `load-contribution` measurement is **absent, never zero** — a zero would
+*    claim a camera cost nothing, which is a measurement nobody made;
+*  - a `failure-contribution` zero is the **most valuable value on the
+*    surface** — `attempts: 400, succeeded: 400` is the proof a fix landed,
+*    and it is exactly what an absent entry cannot say.
+*
+* Putting a loss counter on a cost entry would also break the reconciliation
+* that gives `load-contribution` its point: contributions are subtracted from
+* `metrics.node-processes-snapshot` to find processes nobody claims. A failure
+* has no process.
+*
+* ## Why not a log line, since the counters already exist
+*
+* Several of these paths already counted themselves — `CaptureScheduler`'s
+* per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
+* ends in a log line, and a log line is the thing the operator asked to stop
+* needing: *"possiamo armare questi errori intanto? Così al prossimo giro
+* ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
+* hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
+* media blackout were both diagnosed. The counters stay; this is where they can
+* be READ.
+*
+* ## The rate is served with its denominator or not at all
+*
+* Every entry carries `attempts` and `succeeded`. A miss count alone is
+* unreadable: on 2026-08-28 the enrichment-crop miss count read as "35x worse
+* than yesterday" and was **flat across twelve hours** once divided by the
+* successes on the same path. A surface that publishes only the numerator
+* reproduces that mistake on every read.
+*
+* ## Shape
+*
+* Copied from `load-contribution.cap.ts` (`mode: 'collection'`,
+* `internal: true`, `mount: { kind: 'skip' }`): no tRPC route of its own and no
+* generated hooks, while `addons.listCapabilityProviders` still enumerates it
+* and the hub's `CapabilityRegistry` still holds an RPC proxy per provider — so
+* a forked runner's entries reach hub-main over transport that already exists.
+* No new UDS message, no second registry (D3). The operator reads the assembled
+* result through `system.getFailureContributions`.
+*/
+var FailureReasonCountSchema = object({
+	/**
+	* Why the attempt did not land, in the contributor's own vocabulary —
+	* `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
+	* strings that already appear in this repo's logs and, where one exists, the
+	* same string the per-track `previewMissReason` records (D276): a second
+	* vocabulary for the same loss would make the row and the counter
+	* un-joinable.
+	*/
+	reason: string(),
+	count: number().int().nonnegative()
+});
+var FailureContributionSchema = object({
+	/**
+	* The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
+	* `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
+	* `unit` free: the families are owned by different addons and a shared enum
+	* is a central list that rots invisibly.
+	*/
+	family: string(),
+	/**
+	* The NUMERIC device id — the same value every log line carries as
+	* `tags.deviceId`. Never nullable and never absent: a contributor that
+	* cannot name the camera must not emit the entry, because a fleet total
+	* cannot answer the only question anybody asks of this surface.
+	*/
+	deviceId: number().int().positive(),
+	/**
+	* A second dimension inside the family: the model / step id for an inference
+	* timeout, so "which camera AND which model" is one read. Absent when the
+	* family has a single variant.
+	*/
+	variant: string().optional(),
+	/**
+	* Epoch ms this counter started — the INCARNATION MARKER. A consumer
+	* differencing two reads must drop the interval when it changes, because the
+	* counter restarted from zero in a respawned runner. Same discipline as
+	* `LoadContribution.startedAtMs`.
+	*/
+	sinceMs: number(),
+	/** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
+	atMs: number(),
+	/**
+	* THE DENOMINATOR — every attempt on this path for this camera in the
+	* window. A failure count published without it is the mistake this schema
+	* exists to make impossible.
+	*/
+	attempts: number().int().nonnegative(),
+	/** Attempts that landed. `attempts - succeeded` is the loss. */
+	succeeded: number().int().nonnegative(),
+	/** The loss, partitioned. Sums to `attempts - succeeded`. */
+	reasons: array(FailureReasonCountSchema).readonly()
+});
+method(_void(), array(FailureContributionSchema).readonly());
+/**
 * filesystem-browse — per-node capability for browsing the node's local
 * filesystem. Reads are unconfined (whole filesystem, from `/` down); WRITES
 * are sandboxed to operator-configured allowed roots (D115). Used by the
@@ -13458,6 +13566,68 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }
 	kind: "mutation",
 	auth: "admin"
 });
+var LoadContributionSchema = object({
+	role: _enum([
+		"decode",
+		"transcode",
+		"recording",
+		"streaming",
+		"detection"
+	]),
+	/**
+	* The NUMERIC device id — the same value every log line carries as
+	* `tags.deviceId`. `null` means this cost genuinely belongs to no single
+	* camera (a shared pool), NOT that the contributor forgot to look it up: a
+	* contributor that cannot name its camera must not emit the entry at all,
+	* because an unnamed per-camera entry is indistinguishable from a shared one
+	* and would quietly turn one camera's cost into everybody's.
+	*/
+	deviceId: number().int().positive().nullable(),
+	attribution: _enum([
+		"measured",
+		"accounted",
+		"unattributable"
+	]),
+	/**
+	* What ONE entry is, in the contributor's own words — `615/high`,
+	* `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
+	* family and inventing a common one would lose the only information that
+	* makes two entries for the same camera distinguishable.
+	*/
+	unit: string(),
+	/**
+	* The OS process this cost lives in, when there is one. Present so a
+	* consumer can (a) tell two generations of the same unit apart across a
+	* restart, and (b) subtract claimed processes from the node's process
+	* snapshot to see what NOBODY claimed. Absent for an entry that owns no
+	* process of its own.
+	*/
+	pid: number().int().positive().optional(),
+	/**
+	* When this generation started. The pid's incarnation marker: a consumer
+	* differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
+	* window when this changes, because the counter restarted from zero in a new
+	* process.
+	*/
+	startedAtMs: number().optional(),
+	/**
+	* CUMULATIVE CPU seconds this unit has consumed since it started — user +
+	* system, read from the child's own `/proc/<pid>/stat` at the moment the
+	* contribution is asked for.
+	*
+	* Cumulative and not a rate on purpose: a rate needs a window, a window
+	* needs a sampler, and a new per-node sampler is the defect half of
+	* `docs/architecture/load-ledger.md` documents. A counter can be differenced
+	* by whoever already keeps a history; a rate cannot be un-averaged.
+	*
+	* Absent — never zero — on a node with no `/proc`, on a read failure, and on
+	* an entry with no process.
+	*/
+	cpuSeconds: number().optional(),
+	/** Resident bytes of this unit's process, same source and same rules. */
+	rssBytes: number().optional()
+});
+method(_void(), array(LoadContributionSchema).readonly());
 /**
 * `log-channels` — the capability an addon DECLARES its diagnostic channels
 * through. It stores nothing.
@@ -13534,176 +13704,6 @@ method(LogEntrySchema, _void(), { kind: "mutation" }), method(object({
 	tags: record(string(), string()).optional()
 }), array(LogEntrySchema).readonly());
 /**
-* `failure-contribution` — the capability an addon reports its OWN losses
-* through, per camera, with the denominator attached. It stores nothing.
-*
-* ## The twin of `load-contribution`, and why it is a twin and not a field
-*
-* `load-contribution` answers *what did this camera COST*. This answers *what
-* did this camera LOSE*. The reporting discipline is identical and deliberately
-* copied: the contributor reports what it already knows, hub-main adds only
-* `addonId`, nothing needs global knowledge, and there is no central list for
-* somebody to forget to edit.
-*
-* They are not merged, because their invariants are opposites:
-*
-*  - a `load-contribution` measurement is **absent, never zero** — a zero would
-*    claim a camera cost nothing, which is a measurement nobody made;
-*  - a `failure-contribution` zero is the **most valuable value on the
-*    surface** — `attempts: 400, succeeded: 400` is the proof a fix landed,
-*    and it is exactly what an absent entry cannot say.
-*
-* Putting a loss counter on a cost entry would also break the reconciliation
-* that gives `load-contribution` its point: contributions are subtracted from
-* `metrics.node-processes-snapshot` to find processes nobody claims. A failure
-* has no process.
-*
-* ## Why not a log line, since the counters already exist
-*
-* Several of these paths already counted themselves — `CaptureScheduler`'s
-* per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
-* ends in a log line, and a log line is the thing the operator asked to stop
-* needing: *"possiamo armare questi errori intanto? Così al prossimo giro
-* ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
-* hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
-* media blackout were both diagnosed. The counters stay; this is where they can
-* be READ.
-*
-* ## The rate is served with its denominator or not at all
-*
-* Every entry carries `attempts` and `succeeded`. A miss count alone is
-* unreadable: on 2026-08-28 the enrichment-crop miss count read as "35x worse
-* than yesterday" and was **flat across twelve hours** once divided by the
-* successes on the same path. A surface that publishes only the numerator
-* reproduces that mistake on every read.
-*
-* ## Shape
-*
-* Copied from `load-contribution.cap.ts` (`mode: 'collection'`,
-* `internal: true`, `mount: { kind: 'skip' }`): no tRPC route of its own and no
-* generated hooks, while `addons.listCapabilityProviders` still enumerates it
-* and the hub's `CapabilityRegistry` still holds an RPC proxy per provider — so
-* a forked runner's entries reach hub-main over transport that already exists.
-* No new UDS message, no second registry (D3). The operator reads the assembled
-* result through `system.getFailureContributions`.
-*/
-var FailureReasonCountSchema = object({
-	/**
-	* Why the attempt did not land, in the contributor's own vocabulary —
-	* `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
-	* strings that already appear in this repo's logs and, where one exists, the
-	* same string the per-track `previewMissReason` records (D276): a second
-	* vocabulary for the same loss would make the row and the counter
-	* un-joinable.
-	*/
-	reason: string(),
-	count: number().int().nonnegative()
-});
-var FailureContributionSchema = object({
-	/**
-	* The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
-	* `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
-	* `unit` free: the families are owned by different addons and a shared enum
-	* is a central list that rots invisibly.
-	*/
-	family: string(),
-	/**
-	* The NUMERIC device id — the same value every log line carries as
-	* `tags.deviceId`. Never nullable and never absent: a contributor that
-	* cannot name the camera must not emit the entry, because a fleet total
-	* cannot answer the only question anybody asks of this surface.
-	*/
-	deviceId: number().int().positive(),
-	/**
-	* A second dimension inside the family: the model / step id for an inference
-	* timeout, so "which camera AND which model" is one read. Absent when the
-	* family has a single variant.
-	*/
-	variant: string().optional(),
-	/**
-	* Epoch ms this counter started — the INCARNATION MARKER. A consumer
-	* differencing two reads must drop the interval when it changes, because the
-	* counter restarted from zero in a respawned runner. Same discipline as
-	* `LoadContribution.startedAtMs`.
-	*/
-	sinceMs: number(),
-	/** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
-	atMs: number(),
-	/**
-	* THE DENOMINATOR — every attempt on this path for this camera in the
-	* window. A failure count published without it is the mistake this schema
-	* exists to make impossible.
-	*/
-	attempts: number().int().nonnegative(),
-	/** Attempts that landed. `attempts - succeeded` is the loss. */
-	succeeded: number().int().nonnegative(),
-	/** The loss, partitioned. Sums to `attempts - succeeded`. */
-	reasons: array(FailureReasonCountSchema).readonly()
-});
-method(_void(), array(FailureContributionSchema).readonly());
-var LoadContributionSchema = object({
-	role: _enum([
-		"decode",
-		"transcode",
-		"recording",
-		"streaming",
-		"detection"
-	]),
-	/**
-	* The NUMERIC device id — the same value every log line carries as
-	* `tags.deviceId`. `null` means this cost genuinely belongs to no single
-	* camera (a shared pool), NOT that the contributor forgot to look it up: a
-	* contributor that cannot name its camera must not emit the entry at all,
-	* because an unnamed per-camera entry is indistinguishable from a shared one
-	* and would quietly turn one camera's cost into everybody's.
-	*/
-	deviceId: number().int().positive().nullable(),
-	attribution: _enum([
-		"measured",
-		"accounted",
-		"unattributable"
-	]),
-	/**
-	* What ONE entry is, in the contributor's own words — `615/high`,
-	* `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
-	* family and inventing a common one would lose the only information that
-	* makes two entries for the same camera distinguishable.
-	*/
-	unit: string(),
-	/**
-	* The OS process this cost lives in, when there is one. Present so a
-	* consumer can (a) tell two generations of the same unit apart across a
-	* restart, and (b) subtract claimed processes from the node's process
-	* snapshot to see what NOBODY claimed. Absent for an entry that owns no
-	* process of its own.
-	*/
-	pid: number().int().positive().optional(),
-	/**
-	* When this generation started. The pid's incarnation marker: a consumer
-	* differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
-	* window when this changes, because the counter restarted from zero in a new
-	* process.
-	*/
-	startedAtMs: number().optional(),
-	/**
-	* CUMULATIVE CPU seconds this unit has consumed since it started — user +
-	* system, read from the child's own `/proc/<pid>/stat` at the moment the
-	* contribution is asked for.
-	*
-	* Cumulative and not a rate on purpose: a rate needs a window, a window
-	* needs a sampler, and a new per-node sampler is the defect half of
-	* `docs/architecture/load-ledger.md` documents. A counter can be differenced
-	* by whoever already keeps a history; a rate cannot be un-averaged.
-	*
-	* Absent — never zero — on a node with no `/proc`, on a read failure, and on
-	* an entry with no process.
-	*/
-	cpuSeconds: number().optional(),
-	/** Resident bytes of this unit's process, same source and same rules. */
-	rssBytes: number().optional()
-});
-method(_void(), array(LoadContributionSchema).readonly());
-/**
 * `login-method` — collection cap through which auth addons contribute
 * their pre-auth login surfaces to the login page. This is the SINGLE,
 * generic mechanism that supersedes the dead `auth.listProviders` reader:
@@ -18380,12 +18380,53 @@ var MediaFileKindEnum = _enum([
 	"keyFrameSmall",
 	"thumbnailSmall"
 ]);
+/**
+* One media row ON THE WIRE: what it is, how big it is, and WHERE ITS BYTES
+* ARE — never the bytes themselves.
+*
+* ## Why `url` and not `base64`
+*
+* Measured on the live hub 2026-08-30: `getTrackMedia {trackId, deviceId}`
+* with no `kinds` returned 6 rows / **3 597 219 B**, of which `keyFrame` alone
+* was **2 824 077 B** — one full-resolution frame, base64, so +33 % on the
+* wire. Forty events is ~144 MB. Every byte of it was read off disk,
+* base64-encoded, held whole in a unary tRPC envelope, and materialised in
+* hub-main's heap on the way past — for an `<img>` that would have cached it.
+*
+* `url` points at the `event-media` data plane
+* (`/addon/<addonId>/event-media/<storedKey>`), which serves the same blob
+* with an ETag and `Cache-Control: immutable`, honours conditional GETs, can
+* render a `?variant=thumb`, and streams. The hub gate in front of it requires
+* a bearer or the session cookie (`access: 'authenticated'`), so the bytes are
+* no less protected than they were inside a `view`-level cap response — see
+* `data-plane-access.ts` for the rule and the one gap it does not close
+* (per-device scoping).
+*
+* The URL is built from the row's **stored** key, which is not always its
+* published `kind`: a track's face/plate crop is stored as `crop` under
+* `('face'|'plate', '<prefix>-<trackId>')` and published as
+* `faceCrop`/`plateCrop`. `MediaStore.getByKey` knows only the stored key.
+*
+* ## `base64` is TRANSITIONAL and is going away
+*
+* It is still populated for one reason: the deployed viewer's track-detail
+* HERO tile reads it (`use-track-media-entry.ts` → `parseMediaFiles`, which
+* REQUIRES the field), and a row without it parses as a FAILED read — the red
+* triangle — not as absence. Removing the field before that viewer ships is an
+* outage, not a cleanup. Once the viewer takes its hero bytes from `url`,
+* delete this line and the `withBytes` pass-through in
+* `analytics-query-facade.ts`; nothing else reads it.
+*/
 var MediaFileSchema = object({
 	key: string(),
 	kind: MediaFileKindEnum,
-	base64: string(),
 	sizeBytes: number(),
 	timestamp: number()
+}).extend({
+	/** `/addon/<addonId>/event-media/<encoded stored key>`. Always present. */
+	url: string(),
+	/** @deprecated Transitional — see the schema docblock. Use {@link url}. */
+	base64: string()
 });
 /**
 * One media row WITHOUT its bytes.
@@ -18397,7 +18438,9 @@ var MediaFileSchema = object({
 * blocks the whole view.
 *
 * `sizeBytes` is carried because it is what lets a client decide between the
-* stored blob and a `?variant=thumb` rendering without fetching either.
+* stored blob and a `?variant=thumb` rendering without fetching either, and
+* `url` because a client that had to build the plane path itself is a second
+* copy of a route — the embed, the viewer and the admin UI each grew one.
 */
 var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
 /**
@@ -19086,6 +19129,9 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), array(MediaFileSchema).readonly()), method(object({
 	trackId: string(),
 	deviceId: number()
+}), array(MediaFileInfoSchema).readonly()), method(object({
+	eventId: string(),
+	deviceId: number()
 }), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -23346,10 +23392,24 @@ var FaceClusterSchema = object({
 	size: number().int(),
 	cohesion: number()
 });
+/**
+* One gallery media row: what the crop is, how big it is, and WHERE its bytes
+* are — never the bytes.
+*
+* `base64` was deleted here rather than deprecated. `MediaFile.base64` (the
+* track/event contract) is still populated because a deployed viewer requires
+* the field to parse a row at all; this method has no such reader. Its ONE
+* caller is the admin UI's detail modal, which was building
+* `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
+* dialog already rendering its key FRAME from the `event-media` plane.
+*
+* `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
+* media key directly, so this needed no new plane and no new access decision.
+*/
 var MediaFileLiteSchema$1 = object({
 	key: string(),
 	kind: string(),
-	base64: string(),
+	url: string(),
 	sizeBytes: number(),
 	timestamp: number()
 });
@@ -25662,10 +25722,24 @@ var PlateInfoSchema = object({
 	*/
 	cropUrl: string().optional()
 });
+/**
+* One gallery media row: what the crop is, how big it is, and WHERE its bytes
+* are — never the bytes.
+*
+* `base64` was deleted here rather than deprecated. `MediaFile.base64` (the
+* track/event contract) is still populated because a deployed viewer requires
+* the field to parse a row at all; this method has no such reader. Its ONE
+* caller is the admin UI's detail modal, which was building
+* `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
+* dialog already rendering its key FRAME from the `event-media` plane.
+*
+* `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
+* media key directly, so this needed no new plane and no new access decision.
+*/
 var MediaFileLiteSchema = object({
 	key: string(),
 	kind: string(),
-	base64: string(),
+	url: string(),
 	sizeBytes: number(),
 	timestamp: number()
 });
@@ -31678,6 +31752,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listEventMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listGroups": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -35301,6 +35381,11 @@ Object.freeze({
 		form: "array",
 		optional: false
 	}],
+	"pipelineAnalytics.listEventMedia": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.listGroups": [{
 		name: "deviceIds",
 		form: "array",

package/dist/{dist-B81Rw6ym.js → dist-CJS8Mo7l.js}

@@ -12937,6 +12937,114 @@ method(object({
 	height: number()
 }), EmbeddingResultSchema, { auth: "admin" }), method(object({ text: string() }), EmbeddingResultSchema, { auth: "admin" }), method(_void(), EmbeddingInfoSchema, { auth: "admin" });
 /**
+* `failure-contribution` — the capability an addon reports its OWN losses
+* through, per camera, with the denominator attached. It stores nothing.
+*
+* ## The twin of `load-contribution`, and why it is a twin and not a field
+*
+* `load-contribution` answers *what did this camera COST*. This answers *what
+* did this camera LOSE*. The reporting discipline is identical and deliberately
+* copied: the contributor reports what it already knows, hub-main adds only
+* `addonId`, nothing needs global knowledge, and there is no central list for
+* somebody to forget to edit.
+*
+* They are not merged, because their invariants are opposites:
+*
+*  - a `load-contribution` measurement is **absent, never zero** — a zero would
+*    claim a camera cost nothing, which is a measurement nobody made;
+*  - a `failure-contribution` zero is the **most valuable value on the
+*    surface** — `attempts: 400, succeeded: 400` is the proof a fix landed,
+*    and it is exactly what an absent entry cannot say.
+*
+* Putting a loss counter on a cost entry would also break the reconciliation
+* that gives `load-contribution` its point: contributions are subtracted from
+* `metrics.node-processes-snapshot` to find processes nobody claims. A failure
+* has no process.
+*
+* ## Why not a log line, since the counters already exist
+*
+* Several of these paths already counted themselves — `CaptureScheduler`'s
+* per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
+* ends in a log line, and a log line is the thing the operator asked to stop
+* needing: *"possiamo armare questi errori intanto? Così al prossimo giro
+* ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
+* hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
+* media blackout were both diagnosed. The counters stay; this is where they can
+* be READ.
+*
+* ## The rate is served with its denominator or not at all
+*
+* Every entry carries `attempts` and `succeeded`. A miss count alone is
+* unreadable: on 2026-08-28 the enrichment-crop miss count read as "35x worse
+* than yesterday" and was **flat across twelve hours** once divided by the
+* successes on the same path. A surface that publishes only the numerator
+* reproduces that mistake on every read.
+*
+* ## Shape
+*
+* Copied from `load-contribution.cap.ts` (`mode: 'collection'`,
+* `internal: true`, `mount: { kind: 'skip' }`): no tRPC route of its own and no
+* generated hooks, while `addons.listCapabilityProviders` still enumerates it
+* and the hub's `CapabilityRegistry` still holds an RPC proxy per provider — so
+* a forked runner's entries reach hub-main over transport that already exists.
+* No new UDS message, no second registry (D3). The operator reads the assembled
+* result through `system.getFailureContributions`.
+*/
+var FailureReasonCountSchema = object({
+	/**
+	* Why the attempt did not land, in the contributor's own vocabulary —
+	* `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
+	* strings that already appear in this repo's logs and, where one exists, the
+	* same string the per-track `previewMissReason` records (D276): a second
+	* vocabulary for the same loss would make the row and the counter
+	* un-joinable.
+	*/
+	reason: string(),
+	count: number().int().nonnegative()
+});
+var FailureContributionSchema = object({
+	/**
+	* The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
+	* `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
+	* `unit` free: the families are owned by different addons and a shared enum
+	* is a central list that rots invisibly.
+	*/
+	family: string(),
+	/**
+	* The NUMERIC device id — the same value every log line carries as
+	* `tags.deviceId`. Never nullable and never absent: a contributor that
+	* cannot name the camera must not emit the entry, because a fleet total
+	* cannot answer the only question anybody asks of this surface.
+	*/
+	deviceId: number().int().positive(),
+	/**
+	* A second dimension inside the family: the model / step id for an inference
+	* timeout, so "which camera AND which model" is one read. Absent when the
+	* family has a single variant.
+	*/
+	variant: string().optional(),
+	/**
+	* Epoch ms this counter started — the INCARNATION MARKER. A consumer
+	* differencing two reads must drop the interval when it changes, because the
+	* counter restarted from zero in a respawned runner. Same discipline as
+	* `LoadContribution.startedAtMs`.
+	*/
+	sinceMs: number(),
+	/** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
+	atMs: number(),
+	/**
+	* THE DENOMINATOR — every attempt on this path for this camera in the
+	* window. A failure count published without it is the mistake this schema
+	* exists to make impossible.
+	*/
+	attempts: number().int().nonnegative(),
+	/** Attempts that landed. `attempts - succeeded` is the loss. */
+	succeeded: number().int().nonnegative(),
+	/** The loss, partitioned. Sums to `attempts - succeeded`. */
+	reasons: array(FailureReasonCountSchema).readonly()
+});
+method(_void(), array(FailureContributionSchema).readonly());
+/**
 * filesystem-browse — per-node capability for browsing the node's local
 * filesystem. Reads are unconfined (whole filesystem, from `/` down); WRITES
 * are sandboxed to operator-configured allowed roots (D115). Used by the
@@ -13458,6 +13566,68 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }
 	kind: "mutation",
 	auth: "admin"
 });
+var LoadContributionSchema = object({
+	role: _enum([
+		"decode",
+		"transcode",
+		"recording",
+		"streaming",
+		"detection"
+	]),
+	/**
+	* The NUMERIC device id — the same value every log line carries as
+	* `tags.deviceId`. `null` means this cost genuinely belongs to no single
+	* camera (a shared pool), NOT that the contributor forgot to look it up: a
+	* contributor that cannot name its camera must not emit the entry at all,
+	* because an unnamed per-camera entry is indistinguishable from a shared one
+	* and would quietly turn one camera's cost into everybody's.
+	*/
+	deviceId: number().int().positive().nullable(),
+	attribution: _enum([
+		"measured",
+		"accounted",
+		"unattributable"
+	]),
+	/**
+	* What ONE entry is, in the contributor's own words — `615/high`,
+	* `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
+	* family and inventing a common one would lose the only information that
+	* makes two entries for the same camera distinguishable.
+	*/
+	unit: string(),
+	/**
+	* The OS process this cost lives in, when there is one. Present so a
+	* consumer can (a) tell two generations of the same unit apart across a
+	* restart, and (b) subtract claimed processes from the node's process
+	* snapshot to see what NOBODY claimed. Absent for an entry that owns no
+	* process of its own.
+	*/
+	pid: number().int().positive().optional(),
+	/**
+	* When this generation started. The pid's incarnation marker: a consumer
+	* differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
+	* window when this changes, because the counter restarted from zero in a new
+	* process.
+	*/
+	startedAtMs: number().optional(),
+	/**
+	* CUMULATIVE CPU seconds this unit has consumed since it started — user +
+	* system, read from the child's own `/proc/<pid>/stat` at the moment the
+	* contribution is asked for.
+	*
+	* Cumulative and not a rate on purpose: a rate needs a window, a window
+	* needs a sampler, and a new per-node sampler is the defect half of
+	* `docs/architecture/load-ledger.md` documents. A counter can be differenced
+	* by whoever already keeps a history; a rate cannot be un-averaged.
+	*
+	* Absent — never zero — on a node with no `/proc`, on a read failure, and on
+	* an entry with no process.
+	*/
+	cpuSeconds: number().optional(),
+	/** Resident bytes of this unit's process, same source and same rules. */
+	rssBytes: number().optional()
+});
+method(_void(), array(LoadContributionSchema).readonly());
 /**
 * `log-channels` — the capability an addon DECLARES its diagnostic channels
 * through. It stores nothing.
@@ -13534,176 +13704,6 @@ method(LogEntrySchema, _void(), { kind: "mutation" }), method(object({
 	tags: record(string(), string()).optional()
 }), array(LogEntrySchema).readonly());
 /**
-* `failure-contribution` — the capability an addon reports its OWN losses
-* through, per camera, with the denominator attached. It stores nothing.
-*
-* ## The twin of `load-contribution`, and why it is a twin and not a field
-*
-* `load-contribution` answers *what did this camera COST*. This answers *what
-* did this camera LOSE*. The reporting discipline is identical and deliberately
-* copied: the contributor reports what it already knows, hub-main adds only
-* `addonId`, nothing needs global knowledge, and there is no central list for
-* somebody to forget to edit.
-*
-* They are not merged, because their invariants are opposites:
-*
-*  - a `load-contribution` measurement is **absent, never zero** — a zero would
-*    claim a camera cost nothing, which is a measurement nobody made;
-*  - a `failure-contribution` zero is the **most valuable value on the
-*    surface** — `attempts: 400, succeeded: 400` is the proof a fix landed,
-*    and it is exactly what an absent entry cannot say.
-*
-* Putting a loss counter on a cost entry would also break the reconciliation
-* that gives `load-contribution` its point: contributions are subtracted from
-* `metrics.node-processes-snapshot` to find processes nobody claims. A failure
-* has no process.
-*
-* ## Why not a log line, since the counters already exist
-*
-* Several of these paths already counted themselves — `CaptureScheduler`'s
-* per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
-* ends in a log line, and a log line is the thing the operator asked to stop
-* needing: *"possiamo armare questi errori intanto? Così al prossimo giro
-* ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
-* hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
-* media blackout were both diagnosed. The counters stay; this is where they can
-* be READ.
-*
-* ## The rate is served with its denominator or not at all
-*
-* Every entry carries `attempts` and `succeeded`. A miss count alone is
-* unreadable: on 2026-08-28 the enrichment-crop miss count read as "35x worse
-* than yesterday" and was **flat across twelve hours** once divided by the
-* successes on the same path. A surface that publishes only the numerator
-* reproduces that mistake on every read.
-*
-* ## Shape
-*
-* Copied from `load-contribution.cap.ts` (`mode: 'collection'`,
-* `internal: true`, `mount: { kind: 'skip' }`): no tRPC route of its own and no
-* generated hooks, while `addons.listCapabilityProviders` still enumerates it
-* and the hub's `CapabilityRegistry` still holds an RPC proxy per provider — so
-* a forked runner's entries reach hub-main over transport that already exists.
-* No new UDS message, no second registry (D3). The operator reads the assembled
-* result through `system.getFailureContributions`.
-*/
-var FailureReasonCountSchema = object({
-	/**
-	* Why the attempt did not land, in the contributor's own vocabulary —
-	* `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
-	* strings that already appear in this repo's logs and, where one exists, the
-	* same string the per-track `previewMissReason` records (D276): a second
-	* vocabulary for the same loss would make the row and the counter
-	* un-joinable.
-	*/
-	reason: string(),
-	count: number().int().nonnegative()
-});
-var FailureContributionSchema = object({
-	/**
-	* The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
-	* `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
-	* `unit` free: the families are owned by different addons and a shared enum
-	* is a central list that rots invisibly.
-	*/
-	family: string(),
-	/**
-	* The NUMERIC device id — the same value every log line carries as
-	* `tags.deviceId`. Never nullable and never absent: a contributor that
-	* cannot name the camera must not emit the entry, because a fleet total
-	* cannot answer the only question anybody asks of this surface.
-	*/
-	deviceId: number().int().positive(),
-	/**
-	* A second dimension inside the family: the model / step id for an inference
-	* timeout, so "which camera AND which model" is one read. Absent when the
-	* family has a single variant.
-	*/
-	variant: string().optional(),
-	/**
-	* Epoch ms this counter started — the INCARNATION MARKER. A consumer
-	* differencing two reads must drop the interval when it changes, because the
-	* counter restarted from zero in a respawned runner. Same discipline as
-	* `LoadContribution.startedAtMs`.
-	*/
-	sinceMs: number(),
-	/** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
-	atMs: number(),
-	/**
-	* THE DENOMINATOR — every attempt on this path for this camera in the
-	* window. A failure count published without it is the mistake this schema
-	* exists to make impossible.
-	*/
-	attempts: number().int().nonnegative(),
-	/** Attempts that landed. `attempts - succeeded` is the loss. */
-	succeeded: number().int().nonnegative(),
-	/** The loss, partitioned. Sums to `attempts - succeeded`. */
-	reasons: array(FailureReasonCountSchema).readonly()
-});
-method(_void(), array(FailureContributionSchema).readonly());
-var LoadContributionSchema = object({
-	role: _enum([
-		"decode",
-		"transcode",
-		"recording",
-		"streaming",
-		"detection"
-	]),
-	/**
-	* The NUMERIC device id — the same value every log line carries as
-	* `tags.deviceId`. `null` means this cost genuinely belongs to no single
-	* camera (a shared pool), NOT that the contributor forgot to look it up: a
-	* contributor that cannot name its camera must not emit the entry at all,
-	* because an unnamed per-camera entry is indistinguishable from a shared one
-	* and would quietly turn one camera's cost into everybody's.
-	*/
-	deviceId: number().int().positive().nullable(),
-	attribution: _enum([
-		"measured",
-		"accounted",
-		"unattributable"
-	]),
-	/**
-	* What ONE entry is, in the contributor's own words — `615/high`,
-	* `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
-	* family and inventing a common one would lose the only information that
-	* makes two entries for the same camera distinguishable.
-	*/
-	unit: string(),
-	/**
-	* The OS process this cost lives in, when there is one. Present so a
-	* consumer can (a) tell two generations of the same unit apart across a
-	* restart, and (b) subtract claimed processes from the node's process
-	* snapshot to see what NOBODY claimed. Absent for an entry that owns no
-	* process of its own.
-	*/
-	pid: number().int().positive().optional(),
-	/**
-	* When this generation started. The pid's incarnation marker: a consumer
-	* differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
-	* window when this changes, because the counter restarted from zero in a new
-	* process.
-	*/
-	startedAtMs: number().optional(),
-	/**
-	* CUMULATIVE CPU seconds this unit has consumed since it started — user +
-	* system, read from the child's own `/proc/<pid>/stat` at the moment the
-	* contribution is asked for.
-	*
-	* Cumulative and not a rate on purpose: a rate needs a window, a window
-	* needs a sampler, and a new per-node sampler is the defect half of
-	* `docs/architecture/load-ledger.md` documents. A counter can be differenced
-	* by whoever already keeps a history; a rate cannot be un-averaged.
-	*
-	* Absent — never zero — on a node with no `/proc`, on a read failure, and on
-	* an entry with no process.
-	*/
-	cpuSeconds: number().optional(),
-	/** Resident bytes of this unit's process, same source and same rules. */
-	rssBytes: number().optional()
-});
-method(_void(), array(LoadContributionSchema).readonly());
-/**
 * `login-method` — collection cap through which auth addons contribute
 * their pre-auth login surfaces to the login page. This is the SINGLE,
 * generic mechanism that supersedes the dead `auth.listProviders` reader:
@@ -18380,12 +18380,53 @@ var MediaFileKindEnum = _enum([
 	"keyFrameSmall",
 	"thumbnailSmall"
 ]);
+/**
+* One media row ON THE WIRE: what it is, how big it is, and WHERE ITS BYTES
+* ARE — never the bytes themselves.
+*
+* ## Why `url` and not `base64`
+*
+* Measured on the live hub 2026-08-30: `getTrackMedia {trackId, deviceId}`
+* with no `kinds` returned 6 rows / **3 597 219 B**, of which `keyFrame` alone
+* was **2 824 077 B** — one full-resolution frame, base64, so +33 % on the
+* wire. Forty events is ~144 MB. Every byte of it was read off disk,
+* base64-encoded, held whole in a unary tRPC envelope, and materialised in
+* hub-main's heap on the way past — for an `<img>` that would have cached it.
+*
+* `url` points at the `event-media` data plane
+* (`/addon/<addonId>/event-media/<storedKey>`), which serves the same blob
+* with an ETag and `Cache-Control: immutable`, honours conditional GETs, can
+* render a `?variant=thumb`, and streams. The hub gate in front of it requires
+* a bearer or the session cookie (`access: 'authenticated'`), so the bytes are
+* no less protected than they were inside a `view`-level cap response — see
+* `data-plane-access.ts` for the rule and the one gap it does not close
+* (per-device scoping).
+*
+* The URL is built from the row's **stored** key, which is not always its
+* published `kind`: a track's face/plate crop is stored as `crop` under
+* `('face'|'plate', '<prefix>-<trackId>')` and published as
+* `faceCrop`/`plateCrop`. `MediaStore.getByKey` knows only the stored key.
+*
+* ## `base64` is TRANSITIONAL and is going away
+*
+* It is still populated for one reason: the deployed viewer's track-detail
+* HERO tile reads it (`use-track-media-entry.ts` → `parseMediaFiles`, which
+* REQUIRES the field), and a row without it parses as a FAILED read — the red
+* triangle — not as absence. Removing the field before that viewer ships is an
+* outage, not a cleanup. Once the viewer takes its hero bytes from `url`,
+* delete this line and the `withBytes` pass-through in
+* `analytics-query-facade.ts`; nothing else reads it.
+*/
 var MediaFileSchema = object({
 	key: string(),
 	kind: MediaFileKindEnum,
-	base64: string(),
 	sizeBytes: number(),
 	timestamp: number()
+}).extend({
+	/** `/addon/<addonId>/event-media/<encoded stored key>`. Always present. */
+	url: string(),
+	/** @deprecated Transitional — see the schema docblock. Use {@link url}. */
+	base64: string()
 });
 /**
 * One media row WITHOUT its bytes.
@@ -18397,7 +18438,9 @@ var MediaFileSchema = object({
 * blocks the whole view.
 *
 * `sizeBytes` is carried because it is what lets a client decide between the
-* stored blob and a `?variant=thumb` rendering without fetching either.
+* stored blob and a `?variant=thumb` rendering without fetching either, and
+* `url` because a client that had to build the plane path itself is a second
+* copy of a route — the embed, the viewer and the admin UI each grew one.
 */
 var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
 /**
@@ -19086,6 +19129,9 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), array(MediaFileSchema).readonly()), method(object({
 	trackId: string(),
 	deviceId: number()
+}), array(MediaFileInfoSchema).readonly()), method(object({
+	eventId: string(),
+	deviceId: number()
 }), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -23346,10 +23392,24 @@ var FaceClusterSchema = object({
 	size: number().int(),
 	cohesion: number()
 });
+/**
+* One gallery media row: what the crop is, how big it is, and WHERE its bytes
+* are — never the bytes.
+*
+* `base64` was deleted here rather than deprecated. `MediaFile.base64` (the
+* track/event contract) is still populated because a deployed viewer requires
+* the field to parse a row at all; this method has no such reader. Its ONE
+* caller is the admin UI's detail modal, which was building
+* `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
+* dialog already rendering its key FRAME from the `event-media` plane.
+*
+* `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
+* media key directly, so this needed no new plane and no new access decision.
+*/
 var MediaFileLiteSchema$1 = object({
 	key: string(),
 	kind: string(),
-	base64: string(),
+	url: string(),
 	sizeBytes: number(),
 	timestamp: number()
 });
@@ -25662,10 +25722,24 @@ var PlateInfoSchema = object({
 	*/
 	cropUrl: string().optional()
 });
+/**
+* One gallery media row: what the crop is, how big it is, and WHERE its bytes
+* are — never the bytes.
+*
+* `base64` was deleted here rather than deprecated. `MediaFile.base64` (the
+* track/event contract) is still populated because a deployed viewer requires
+* the field to parse a row at all; this method has no such reader. Its ONE
+* caller is the admin UI's detail modal, which was building
+* `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
+* dialog already rendering its key FRAME from the `event-media` plane.
+*
+* `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
+* media key directly, so this needed no new plane and no new access decision.
+*/
 var MediaFileLiteSchema = object({
 	key: string(),
 	kind: string(),
-	base64: string(),
+	url: string(),
 	sizeBytes: number(),
 	timestamp: number()
 });
@@ -31678,6 +31752,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listEventMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listGroups": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -35301,6 +35381,11 @@ Object.freeze({
 		form: "array",
 		optional: false
 	}],
+	"pipelineAnalytics.listEventMedia": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.listGroups": [{
 		name: "deviceIds",
 		form: "array",

package/dist/ingress/tailscale-ingress.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-B81Rw6ym.js");
+const require_dist = require("../dist-CJS8Mo7l.js");
 let node_crypto = require("node:crypto");
 let node_child_process = require("node:child_process");
 //#region src/ingress/tailscale-cli.ts

package/dist/ingress/tailscale-ingress.addon.mjs

@@ -1,4 +1,4 @@
-import { a as EventCategory, i as BaseAddon, n as networkAccessCapability } from "../dist-Tyu2rQxG.mjs";
+import { a as EventCategory, i as BaseAddon, n as networkAccessCapability } from "../dist-BO7-LQSt.mjs";
 import { randomUUID } from "node:crypto";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-tailscale",
-  "version": "1.2.46",
+  "version": "1.2.47",
   "description": "Tailscale bundle for CamStack — joins the host to a tailnet (client) and exposes the hub via Serve/Funnel (ingress). Multi-entry npm package shipping 2 addons under a single bundle.",
   "keywords": [
     "camstack",