@camstack/addon-ai 0.2.9 → 0.2.11

package/dist/addon.mjs

@@ -5,7 +5,7 @@ import { createReadStream } from "node:fs";
 import * as fsp from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { createServer } from "node:net";
-//#region ../types/dist/event-category-BLcNejAE.mjs
+//#region ../types/dist/event-category-Bz24uP1U.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -276,6 +276,19 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["DeviceStateChanged"] = "device.state-changed";
 	/**
+	* Frame occupancy for a camera CHANGED — a tracked object was gained or
+	* lost. Carries `{ deviceId, totalObjects, byClass, zones }`.
+	*
+	* Emitted only on a change, so a steady scene is silent. It exists so a
+	* client can stop polling `zoneAnalytics.getCurrentSnapshot`: that was the
+	* one live badge with no push signal at all, and it cost a request every
+	* four seconds per visible camera.
+	*
+	* Like every event it is telemetry and may be dropped ([D8]) — a consumer
+	* keeps a slow reconcile rather than trusting it alone.
+	*/
+	EventCategory["ZoneAnalyticsOccupancyChanged"] = "zone-analytics.occupancy-changed";
+	/**
 	* Cap event fired by every device that registers the `battery`
 	* capability. Mirrors the cap definition's `onStatusChanged`. Carries
 	* `{ deviceId, status: BatteryStatus }`. Subscribers (alert center,
@@ -7219,35 +7232,22 @@ var ConvertResultSchema = object({
 */
 var RecordingWeekdaySchema = number().int().min(0).max(6);
 var HHMM = /^([01]\d|2[0-3]):[0-5]\d$/;
-var RecordingScheduleSchema = discriminatedUnion("kind", [object({ kind: literal("always") }), object({
-	kind: literal("timeOfDay"),
-	start: string().regex(HHMM),
-	end: string().regex(HHMM),
-	/** Restrict to these weekdays; omit = every day. */
-	days: array(RecordingWeekdaySchema).optional()
-})]);
-var RecordingModeSchema = _enum([
-	"continuous",
-	"onMotion",
-	"onAudioThreshold"
-]);
 /**
-* First-class, authoritative per-camera storage mode — the explicit choice the
-* UI reads directly (never inferred from `rules`):
-*  - `off`        — not recording.
-*  - `events`     — record only around triggers (motion / audio threshold),
-*                   with pre/post-buffer.
-*  - `continuous` — record 24/7 within the schedule.
+* DERIVED per-camera storage summary — the single field cheap consumers read
+* (the viewer's status dot, the camera list) instead of walking `bands`:
+*  - `off`        — no band covers the camera (or it is disabled).
+*  - `events`     — every band records around triggers only.
+*  - `continuous` — at least one band records continuously.
 *
-* `mode` compiles one-way to the internal `rules[]` consumed by the policy
-* engine (see `compileRules`); `rules[]` is never authored directly anymore.
+* NEVER authored: the recorder stamps it from the authoritative `bands` on
+* every save (`activeModeForConfig`). Writing it has no effect.
 */
 var RecordingStorageModeSchema = _enum([
 	"off",
 	"events",
 	"continuous"
 ]);
-/** Which detectors trigger an `events`-mode recording. */
+/** Which detectors trigger an `events`-mode band. */
 var RecordingTriggersSchema = object({
 	motion: boolean().optional(),
 	audioThresholdDbfs: number().optional()
@@ -7283,18 +7283,6 @@ var RecordingBandSchema = object({
 	preBufferSec: number().min(0).optional(),
 	postBufferSec: number().min(0).optional()
 });
-var RecordingRuleSchema = object({
-	schedule: RecordingScheduleSchema,
-	mode: RecordingModeSchema,
-	/** Seconds of footage to retain BEFORE a trigger (applied at keep/discard). */
-	preBufferSec: number().min(0).default(0),
-	/** Keep recording until this many seconds after the last trigger. */
-	postBufferSec: number().min(0).default(0),
-	/** Each new trigger restarts the post-buffer window. */
-	resetTimeoutOnNewEvent: boolean().default(true),
-	/** onAudioThreshold only — dBFS level that counts as a trigger. */
-	thresholdDbfs: number().optional()
-});
 /**
 * Per-device retention overrides. Every field is optional; an unset or `0`
 * value inherits the node-wide recorder default. Only footage-lifetime limits
@@ -7328,40 +7316,28 @@ var ScrubThumbnailPresetSchema = _enum([
 /**
 * The full per-camera recording intent — the wire shape of a RecordingTarget.
 *
-* `mode` is the authoritative storage choice; `schedule`/`triggers`/`pre`/`post`
-* are its mode-specific parameters. `rules` is a DEPRECATED authoring input kept
-* only for transition + migration (`migrateRulesToMode`); the policy engine
-* consumes the compiled output of `compileRules(config)`, never `rules` directly.
+* `bands` is the ONLY authored recording intent: what to record, when, and on
+* which trigger. `mode` is a derived summary the recorder stamps on save; every
+* other field is a storage knob (profiles, segment length, retention, scrub).
+*
+* STRICT on purpose: the legacy authoring surface (`schedule`/`schedules`/
+* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30.
+* A stale caller must fail loudly — silently stripping its legacy intent would
+* persist a band-less config, i.e. silently stop recording the camera.
 */
 var RecordingConfigSchema = object({
 	enabled: boolean(),
-	/** Authoritative storage mode. Absent on legacy targets → derived once via
-	*  `migrateRulesToMode`, then persisted. */
+	/** DERIVED summary of `bands`, stamped by the recorder on every save.
+	*  Authoring it has no effect — see {@link RecordingStorageModeSchema}. */
 	mode: RecordingStorageModeSchema.optional(),
 	profiles: array(CamProfileSchema).optional(),
 	segmentSeconds: number().int().positive().optional(),
-	/** Shared recording time-bands for `events` & `continuous` — record only when
-	*  the wall-clock falls inside one of these windows. Omit or empty = always.
-	*  `continuous` compiles to one rule per band; `events` to band × trigger. */
-	schedules: array(RecordingScheduleSchema).optional(),
-	/** Legacy single-band predecessor of `schedules`. Read-compat only — it is
-	*  normalized into `schedules` on read and never written going forward. (Not
-	*  tagged `@deprecated`: the normalization paths must read it cast-free.) */
-	schedule: RecordingScheduleSchema.optional(),
-	/** `events`-mode only — which detectors trigger a recording. */
-	triggers: RecordingTriggersSchema.optional(),
-	/** `events`-mode only — seconds retained before / after a trigger. */
-	preBufferSec: number().min(0).optional(),
-	postBufferSec: number().min(0).optional(),
-	/** DEPRECATED authoring input; retained for migration/transition. */
-	rules: array(RecordingRuleSchema).optional(),
 	/**
-	* AUTHORITATIVE mode-per-band recording model (recorder). When present it
-	* is the single source of truth; the legacy `mode`/`schedules`/`schedule`/
-	* `triggers`/`rules` fields above are kept for READ-COMPAT only and are
-	* derived into bands once via `migrateConfigToBands`.
+	* AUTHORITATIVE mode-per-band recording model — the single source of truth
+	* the recorder's band engine consumes. An empty array = record nothing;
+	* "off" is the absence of a covering band, never a band value.
 	*/
-	bands: array(RecordingBandSchema).optional(),
+	bands: array(RecordingBandSchema).default([]),
 	retention: RecordingRetentionSchema.optional(),
 	/**
 	* Per-camera scrub-thumbnail fidelity preset (resolution + JPEG quality for
@@ -7369,8 +7345,15 @@ var RecordingConfigSchema = object({
 	* windows only — existing sheets are immutable, and each window's index
 	* carries its own tile dims so mixed-preset history renders correctly.
 	*/
-	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
-});
+	scrubThumbnails: ScrubThumbnailPresetSchema.optional(),
+	/**
+	* OPT-IN thumbnail-strip generation for this camera: every keyframe of the
+	* low recording saved as a JPEG (the fast-drag scrub depth), a derived
+	* cache that eviction reclaims with the footage. Absent/false = no strips
+	* are written and scrub reads exact keyframes at every velocity.
+	*/
+	stripsEnabled: boolean().optional()
+}).strict();
 /**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
@@ -7389,7 +7372,8 @@ var OpsLogOpSchema = _enum([
 	"prune",
 	"manual-delete",
 	"rescan",
-	"retention-run"
+	"retention-run",
+	"relocate"
 ]);
 /** Why the operation ran. */
 var OpsLogReasonSchema = _enum([
@@ -7428,6 +7412,55 @@ var OpsLogQueryInputSchema = object({
 	limit: number().int().min(1).max(1e3).optional()
 });
 /**
+* Entity-relocation job state (storage entity-routing spec, Phase 4).
+*
+* One shape shared by the recorder's `relocateFootage` (segments + strips) and
+* pipeline-analytics' `relocateMedia` (event media blobs) so the admin Data
+* page renders both movers with one component. Jobs are in-RAM (a restart
+* forgets them — re-running is safe by construction: copy-if-absent, delete
+* after verify) and each completed/failed run also lands one durable ops-log
+* row on the owning addon's surface.
+*/
+var RelocateJobStateSchema = _enum([
+	"running",
+	"done",
+	"failed",
+	"cancelled"
+]);
+var RelocateJobSchema = object({
+	jobId: string(),
+	state: RelocateJobStateSchema,
+	/** Source location — for media relocation this is informational ('*': rows
+	*  move from wherever they are to the target). */
+	fromLocationId: string(),
+	toLocationId: string(),
+	/** Scoped device, or null = every device. */
+	deviceId: number().nullable(),
+	/** What the job moves (owner-addon specific: segments/strips or media). */
+	entities: array(string()),
+	filesMoved: number().int(),
+	bytesMoved: number().int(),
+	/** Total files discovered up front; null while (or when) unknown. */
+	filesTotal: number().int().nullable(),
+	startedAt: number(),
+	finishedAt: number().nullable(),
+	error: string().nullable()
+});
+var RelocateFootageInputSchema = object({
+	deviceId: number().optional(),
+	fromLocationId: string(),
+	toLocationId: string(),
+	entities: array(_enum(["segments", "strips"])).optional(),
+	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
+	*  never allowed to starve live writers. */
+	throttleMbps: number().min(1).max(1e3).optional()
+});
+var RelocateMediaInputSchema = object({
+	deviceId: number().optional(),
+	toLocationId: string(),
+	throttleMbps: number().min(1).max(1e3).optional()
+});
+/**
 * `StorageLocationType` — an addon-declared id that identifies the *kind* of
 * storage a location serves. Defined here (not in `capabilities/storage.cap.ts`)
 * so the persisted record schema and the consumer-facing cap can both consume it
@@ -7477,6 +7510,13 @@ var StorageLocationSchema = object({
 	nodeId: string().optional(),
 	isDefault: boolean().default(false),
 	isSystem: boolean().default(false),
+	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
+	*  for node-local locations it can reach) — never persisted, absent when the
+	*  volume is remote/unreachable. The single capacity truth every UI reads. */
+	capacity: object({
+		totalBytes: number(),
+		availableBytes: number()
+	}).nullable().optional(),
 	createdAt: number(),
 	updatedAt: number()
 });
@@ -7538,16 +7578,23 @@ var StorageLocationDeclarationSchema = object({
 	* Which node root the seeded `<id>:default` instance is placed under on a
 	* FRESH install:
 	* - `'data'` (default) — the node's data dir (`CAMSTACK_DATA` / boot dir),
-	*   the appData volume. Right for small/durable data (backups, logs, models).
+	*   the appData volume. Right for small/durable data (logs, models).
 	* - `'media'` — the dedicated media volume (`CAMSTACK_MEDIA_ROOT`) when that
 	*   env is set, else falls back to the data root. Right for bulky, hot media
 	*   (recordings, event media) that should stay off the appData disk.
+	* - `'backup'` — the dedicated backup volume (`CAMSTACK_BACKUP_ROOT`, default
+	*   `/backups` in the image) so archives live on their own mount rather than
+	*   filling the appData disk. Falls back to the data root when unset.
 	*
 	* Only affects the seeded default's `basePath`; operators can repoint any
 	* location afterwards, and a `defaultsTo` slot inherits its parent's root
 	* regardless of this field. Absent (the common case) is treated as `'data'`.
 	*/
-	defaultRoot: _enum(["data", "media"]).optional()
+	defaultRoot: _enum([
+		"data",
+		"media",
+		"backup"
+	]).optional()
 });
 var DecoderStatsSchema = object({
 	inputFps: number(),
@@ -8237,7 +8284,8 @@ var NcTaxonomyEntrySchema = object({
 	/** Macro/category parent for grouping ('car' → 'vehicle'); null for a top. */
 	parentKind: string().nullable()
 });
-object({
+/** The complete NC picker taxonomy — three grouped buckets. */
+var NcTaxonomySchema = object({
 	videoClasses: array(NcTaxonomyEntrySchema),
 	audioKinds: array(NcTaxonomyEntrySchema),
 	labels: array(NcTaxonomyEntrySchema)
@@ -8897,6 +8945,7 @@ var AccessoryKind = {
 };
 AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
 DeviceFeature.BatteryOperated;
+new Set(["devices", "classes"]);
 /**
 * Shared geometry vocabulary for on-frame shape caps — privacy-mask,
 * motion-zones, and the detection zones/lines editor all speak this one
@@ -9055,6 +9104,29 @@ var NcOccupancyConditionSchema = object({
 	count: number().int().min(0).default(1),
 	sustainSeconds: number().int().min(0).max(3600).default(15)
 });
+/**
+* Which zone-crossing DIRECTION a rule accepts (`ObjectEvent.zoneCrossing`).
+*
+* The values are not symmetric, and deliberately so — the absent value has to
+* mean exactly what every rule authored before this condition existed already
+* does:
+*  - `enter` — entries and every NON-crossing record (movement state,
+*    package, sensor). Exits are rejected. **This is the absent behaviour**:
+*    an operator who never asked for exits must not start receiving them.
+*  - `exit`  — ONLY an exit crossing. A record that is not a crossing at all
+*    fails closed, because "the car left the drive" is a question about a
+*    boundary, not about a detection.
+*  - `any`   — no direction filter; entries, exits and non-crossings alike.
+*
+* A rule asking for a direction should normally also scope `zones`, which the
+* engine evaluates against the crossed zone as well as the current membership
+* (an exit's membership no longer contains the zone it just left).
+*/
+var NcCrossingSchema = _enum([
+	"enter",
+	"exit",
+	"any"
+]);
 /** Admin-zone membership condition (zone IDs as stamped by the ZoneEngine). */
 var NcZoneConditionSchema = object({
 	ids: array(string().min(1)).min(1),
@@ -9079,6 +9151,13 @@ var NcConditionsSchema = object({
 	/** Veto zones — any hit fails the rule. */
 	zonesExclude: array(string().min(1)).optional(),
 	/**
+	* Zone-crossing direction. IMMEDIATE only — a crossing is a per-event fact
+	* and a closed track carries none, so a `track-end` rule asking for one
+	* fails closed (use `zones`, which tests `zonesVisited`). ABSENT = `enter`,
+	* which is exactly today's behaviour. See {@link NcCrossingSchema}.
+	*/
+	crossing: NcCrossingSchema.optional(),
+	/**
 	* Exact (case-insensitive) match on the record's collapsed `label`
 	* (identity name / plate text / subclass).
 	*/
@@ -9213,17 +9292,85 @@ var NcRuleTargetSchema = object({
 *  - `keyFrame` — the clean scene frame (no subject box).
 *  - `none` — no attachment.
 */
-var NcMediaPolicySchema = object({ attach: _enum([
-	"best",
-	"best-matching",
-	"keyFrame",
-	"none"
-]).default("best") });
+/**
+* WHAT THE PICTURE SHOWS — chosen explicitly, because the implicit ladders
+* conflate it with the selection strategy and betray the request: asking for
+* the clean scene frame on an object-event owner used to start at
+* `fullFrameBoxed`, i.e. the annotated frame (2026-07-30).
+*  - `cropped` — the subject, tight. What "who is at the door" wants.
+*  - `full`    — the clean scene, no annotation. What "what is going on" wants.
+*  - `boxed`   — the scene WITH the detection boxes drawn, for verifying what
+*                the pipeline actually saw.
+*/
+var NcMediaFrameSchema = _enum([
+	"cropped",
+	"full",
+	"boxed"
+]);
+var NcMediaPolicySchema = object({
+	attach: _enum([
+		"best",
+		"best-matching",
+		"keyFrame",
+		"none"
+	]).default("best"),
+	/** What the still shows. Absent = `cropped` (the historical `best` shape). */
+	frame: NcMediaFrameSchema.optional(),
+	/** Crop the attached still to the rule's condition-zone bbox (padded) —
+	*  "show me the ZONE", not the whole scene or the subject crop. */
+	zoneCrop: boolean().optional(),
+	/**
+	* Also attach a short GIF cut from the stream broker's clip ring around the
+	* event — NOT from the recording, so the camera does not have to be
+	* recording, and the window sits AROUND the moment instead of a segment
+	* behind it. Fail-closed: a window the ring does not cover contributes no
+	* gif, never a failed notification.
+	*/
+	gif: boolean().optional(),
+	/**
+	* Also attach a short MP4 CLIP of the same cut. Same source and the same
+	* fail-closed rule as `gif`. Prefer it where the backend takes video
+	* (telegram, discord, zentik, webhook); backends that do not are handled by
+	* the degrade engine, which drops the video and keeps the still.
+	*/
+	clip: boolean().optional(),
+	/** Seconds of footage BEFORE / AFTER the event instant. Defaults 3 / 7. */
+	clipPreRollSec: number().int().min(0).max(30).optional(),
+	clipPostRollSec: number().int().min(0).max(30).optional(),
+	/**
+	* Which stream profile the footage is cut from. Absent = the CHEAPEST
+	* assigned profile: a notification is watched on a phone, so the 4K
+	* rendition would burn CPU to produce a file the client downscales anyway.
+	* A profile that is not assigned falls back to the cheapest, and the render
+	* reports which one actually ran.
+	*/
+	profile: CamProfileSchema.optional()
+});
+/**
+* Cooldown GRANULARITY over the subject's class — how much a fired
+* notification suppresses.
+*  - `shared` (default, and the absent value) — one window for the whole
+*    rule/scope: a cat silences the next dog for `cooldownSec`.
+*  - `per-class` — an independent window per detected class, so cat→dog fires
+*    at once and cat→cat still waits.
+*
+* AUDIO subjects are ALWAYS per-class regardless of this setting: a scream
+* must not be swallowed by a bark's window (the precedent this generalizes —
+* see `cooldownKey` in the rule engine).
+*/
+var NcThrottleGranularitySchema = _enum(["shared", "per-class"]);
 /** Throttle — cooldown survives restarts (rebuilt from the outbox on boot). */
 var NcThrottleSchema = object({
 	cooldownSec: number().int().min(0).max(86400).default(60),
 	/** `rule` = one shared cooldown; `rule-device` = per-camera cooldown. */
-	scope: _enum(["rule", "rule-device"]).default("rule-device")
+	scope: _enum(["rule", "rule-device"]).default("rule-device"),
+	/**
+	* Class granularity of the cooldown key. Optional rather than defaulted:
+	* a Zod default does NOT run on the addon→addon cap path, so a persisted
+	* rule authored before this field simply carries none — and the engine
+	* reads absent as `shared`, the pre-existing behaviour.
+	*/
+	granularity: NcThrottleGranularitySchema.optional()
 });
 /** Client-supplied rule fields (server stamps id/createdBy/createdAt/updatedAt). */
 var NcRuleInputSchema = object({
@@ -9232,7 +9379,19 @@ var NcRuleInputSchema = object({
 	delivery: NcDeliverySchema,
 	conditions: NcConditionsSchema.default({}),
 	schedule: NcScheduleSchema.optional(),
-	targets: array(NcRuleTargetSchema).min(1),
+	/** May be empty when `targetUsers` addresses at least one user — the
+	*  "at least one addressee" invariant is enforced by the provider, because
+	*  a cross-field refine here would break `NcRulePatchSchema.partial()`. */
+	targets: array(NcRuleTargetSchema),
+	/**
+	* USERS this rule addresses in addition to `targets` (Phase 4). At fire
+	* time each user fans out to the personal targets they own
+	* (`config.ownerUserId`), filtered by that user's `allowedDevices` for the
+	* firing camera — a user is never notified about a device they cannot open.
+	* Per-user opt-outs (`disabledTargetIds`) still apply to the fanned-out
+	* targets.
+	*/
+	targetUsers: array(string()).optional(),
 	media: NcMediaPolicySchema.default({ attach: "best" }),
 	throttle: NcThrottleSchema.default({
 		cooldownSec: 60,
@@ -9319,6 +9478,7 @@ var NcConditionDescriptorSchema = object({
 		"schedule",
 		"plateMatcher",
 		"packagePhase",
+		"crossingSelect",
 		"polygonDraw",
 		"occupancy"
 	]),
@@ -9445,7 +9605,10 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), object({ results: array(NcTestResultSchema) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), object({ catalog: array(NcConditionDescriptorSchema) })), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" });
+}), method(object({}), object({
+	catalog: array(NcConditionDescriptorSchema),
+	taxonomy: NcTaxonomySchema.optional()
+})), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" });
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -10182,6 +10345,28 @@ method(object({
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	/** Absent = the LOWEST assigned profile — a notification attachment is
+	*  watched on a phone, and the cheap rendition is the right default. */
+	profile: CamProfileSchema.optional(),
+	aroundMs: number(),
+	preRollSec: number().min(0).max(20).default(3),
+	postRollSec: number().min(0).max(20).default(5),
+	format: _enum(["gif", "mp4"]).default("gif"),
+	maxWidth: number().int().min(120).max(1920).default(480),
+	/** GIF only — MP4 keeps the source cadence. */
+	fps: number().int().min(1).max(15).default(5)
+}), object({
+	base64: string(),
+	mime: string(),
+	bytes: number().int(),
+	/** The profile actually rendered (what the default resolved to). */
+	profile: CamProfileSchema,
+	durationMs: number()
+}), {
+	kind: "mutation",
+	auth: "admin"
 }), method(_void(), array(CameraStreamSchema).readonly()), method(_void(), array(ProfileSlotSchema).readonly()), method(object({ brokerId: string() }), BrokerStatsSchema), method(object({ brokerId: string() }), object({
 	probed: boolean(),
 	summary: string()
@@ -14532,11 +14717,53 @@ var LocationStatSchema = object({
 	fileCount: number(),
 	present: boolean()
 });
+/**
+* A backup schedule — the N:M "entry" that binds one cron cadence to a
+* SET of destination locations. Supersedes the per-location cron on
+* `BackupDestinationPolicy`: an operator creates a schedule, picks the
+* `backups` locations it should write to, and the orchestrator fans a
+* single archive out to all of them when the cron fires.
+*
+* `retentionCount` is per-schedule (D-decision 2026-07-28): every
+* location targeted by this schedule keeps this many archives from
+* this schedule's runs.
+*
+* `dataSources` optionally narrows which top-level state locations
+* (db, addons, tls, …) are archived; omitted = the orchestrator's
+* default full set.
+*/
+var BackupScheduleSchema = object({
+	/** Stable id. Generated by the orchestrator on first upsert if absent. */
+	id: string(),
+	/** Operator-facing display name. */
+	label: string(),
+	/** 5-field POSIX cron. Empty = disabled cadence (kept for editing). */
+	cron: string(),
+	/** Master on/off toggle for the whole schedule. */
+	enabled: boolean(),
+	/** `backups`-location ids this schedule writes to (fan-out set). */
+	locationIds: array(string()).readonly(),
+	/** Archives kept per targeted location for this schedule. */
+	retentionCount: number().int().min(1).max(1e3),
+	/** Optional subset of source locations to include; omitted = all. */
+	dataSources: array(string()).readonly().optional(),
+	/** ms-epoch of last successful run. */
+	lastRunAt: number().optional(),
+	/** ms-epoch of next computed firing (read-only, filled on list). */
+	nextRunAt: number().optional()
+});
 method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }), method(object({
 	/** Subset of registered `backup-destination` addon ids to write to. */
 	destinations: array(string()).optional(),
 	locations: array(string()).optional(),
-	label: string().optional()
+	label: string().optional(),
+	/**
+	* Per-run retention override applied to every targeted
+	* destination. Used by schedule-driven runs (per-entry
+	* retention). Omitted = each destination's own policy
+	* retention (manual runs).
+	*/
+	retentionCount: number().int().min(1).max(1e3).optional()
 }).optional(), array(BackupEntrySchema).readonly(), {
 	kind: "mutation",
 	auth: "admin"
@@ -14585,7 +14812,21 @@ method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }
 	ok: boolean(),
 	error: string().optional(),
 	nextRuns: array(number()).readonly()
-}));
+})), method(_void(), array(BackupScheduleSchema).readonly(), { auth: "admin" }), method(object({
+	id: string().optional(),
+	label: string(),
+	cron: string(),
+	enabled: boolean(),
+	locationIds: array(string()).readonly(),
+	retentionCount: number().int().min(1).max(1e3),
+	dataSources: array(string()).readonly().optional()
+}), BackupScheduleSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * `broker` — unified pub/sub broker registry, system-scoped collection.
 *
@@ -15720,7 +15961,10 @@ method(object({
 }), method(object({
 	deviceId: number(),
 	caps: array(string()).readonly().optional()
-}), record(string(), unknown().nullable()));
+}), record(string(), unknown().nullable())), method(object({
+	deviceIds: array(number()).readonly(),
+	caps: array(string()).readonly().optional()
+}), record(string(), record(string(), unknown().nullable())));
 method(object({ deviceId: number() }), record(string(), record(string(), unknown()))), method(object({
 	deviceId: number(),
 	capName: string()
@@ -16696,6 +16940,36 @@ var TargetKindSchema = object({
 	icon: string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: string().optional(),
 	configSchema: ConfigSchemaPassthrough,
 	supportsDiscovery: boolean(),
 	caps: TargetKindCapsSchema
@@ -17143,6 +17417,29 @@ var MotionEventSchema = object({
 * Absent on legacy rows ⇒ treat as `pipeline`.
 */
 var DetectionSourceSchema = _enum(["pipeline", "onboard"]);
+/**
+* The confirmed zone crossing that produced an object event. Present ONLY on
+* an event emitted BY a crossing (`zone.enter` / `zone.exit`); a movement-state
+* event (`object.entering` / `leaving` / `stationary` / `loitering`) and an
+* appearance event carry none, so a rule asking for a direction fails closed
+* on them.
+*
+* Exactly ONE crossing per event: the emitter turns each confirmed crossing
+* into its own event, so a frame in which a track enters A while leaving B
+* produces two events with two directions — never one ambiguous row.
+*
+* `zoneId` is load-bearing for an EXIT: the event's `zones` list is the
+* membership the box has NOW, and by definition it no longer contains the zone
+* that was just left. Without the id here, a zone-scoped rule could never match
+* the exit it asked for.
+*/
+var ZoneCrossingSchema = object({
+	direction: _enum(["enter", "exit"]),
+	/** Admin zone id crossed. */
+	zoneId: string(),
+	/** Zone display name at crossing time (falls back to the id). */
+	zoneName: string().optional()
+});
 var ObjectEventSchema = object({
 	...BaseEventFields,
 	kind: literal("object"),
@@ -17169,6 +17466,12 @@ var ObjectEventSchema = object({
 	zones: array(string()).readonly().optional(),
 	/** Omitted in slim projection. */
 	state: TrackStateSchema.optional(),
+	/**
+	* The zone crossing this event IS, when it is one. Absent on every other
+	* event kind (movement state, appearance, package) — see
+	* {@link ZoneCrossingSchema}. Omitted in slim projection.
+	*/
+	zoneCrossing: ZoneCrossingSchema.optional(),
 	/** Detection-frame dimensions in pixels — let consumers normalize the
 	*  pixel-space `bbox` onto a displayed image. Omitted in slim projection. */
 	frameWidth: number().optional(),
@@ -17427,6 +17730,15 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(object({ deviceId: number() }), EventPruneCountsSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(RelocateMediaInputSchema, object({ jobId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(RelocateJobSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
 	kind: "query",
 	auth: "admin"
@@ -19906,6 +20218,17 @@ var GetConnectionEndpointsResultSchema = object({ endpoints: array(object({
 	*/
 	priority: number()
 })).readonly() });
+/**
+* The chosen outbound endpoint for notification artifacts. `baseUrl: null` =
+* AUTO (resolved from the candidate ranking at send time); `resolved` reports
+* what AUTO currently picks, so the UI can show the effective value either way.
+*/
+var NotificationEndpointSchema = object({
+	/** The operator's explicit choice, or null for AUTO. */
+	baseUrl: string().nullable(),
+	/** What the ranking currently resolves to (null when nothing is reachable). */
+	resolved: string().nullable()
+});
 var AllowedAddressesSchema = object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -19928,7 +20251,7 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*  to avoid mixed-content blocks in the browser. The public
 	*  tunnel always emits `https://` regardless. */
 	scheme: _enum(["http", "https"]).optional()
-}), GetConnectionEndpointsResultSchema), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" });
+}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" });
 /**
 * mesh-network — collection cap for mesh-VPN providers.
 *
@@ -20727,7 +21050,12 @@ var RecordingDeviceUsageSchema = object({
 var RecordingLocationUsageSchema = object({
 	/** StorageLocation id; null for the legacy/degraded single-root fallback. */
 	locationId: string().nullable(),
-	/** Bytes of recordings stored on this location. */
+	/** Every location id sharing this row's PHYSICAL volume (aliases). One row
+	*  is emitted per physical disk (2026-07-29): two locations on one root
+	*  previously rendered as two identical "disks" with a nonsensical used
+	*  split — hydrate attribution across aliases is arbitrary by nature. */
+	locationIds: array(string()).optional(),
+	/** Bytes of recordings stored on this PHYSICAL volume (all aliases). */
 	usedBytes: number(),
 	/** Free bytes on the location's volume; null when capacity is unknown (remote). */
 	availableBytes: number().nullable(),
@@ -20839,6 +21167,44 @@ method(object({
 }), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
 	kind: "query",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	aroundMs: number(),
+	preRollSec: number().min(0).max(30).default(2),
+	postRollSec: number().min(0).max(30).default(5),
+	maxWidth: number().int().min(120).max(1280).default(480),
+	fps: number().int().min(1).max(15).default(5)
+}), object({
+	gifBase64: string(),
+	fromMs: number(),
+	toMs: number()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	aroundMs: number(),
+	preRollSec: number().min(0).max(30).default(3),
+	postRollSec: number().min(0).max(30).default(7),
+	maxWidth: number().int().min(160).max(1920).default(640)
+}), object({
+	clipBase64: string(),
+	mime: string(),
+	fromMs: number(),
+	toMs: number(),
+	bytes: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(RelocateFootageInputSchema, object({ jobId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(RelocateJobSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
 });
 /**
 * `recordingExport` cap — render a footage time range into a single downloadable
@@ -21752,6 +22118,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"backup.deleteSchedule": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"backup.getEntries": {
 		capName: "backup",
 		capScope: "system",
@@ -21782,6 +22154,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"backup.listSchedules": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"backup.previewSchedule": {
 		capName: "backup",
 		capScope: "system",
@@ -21806,6 +22184,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"backup.upsertSchedule": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"battery.wakeForStream": {
 		capName: "battery",
 		capScope: "device",
@@ -22412,6 +22796,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getDeviceStatusAggregateBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getLinkedDevices": {
 		capName: "device-manager",
 		capScope: "system",
@@ -23306,6 +23696,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getNotificationEndpoint": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getPreferred": {
 		capName: "local-network",
 		capScope: "system",
@@ -23330,6 +23726,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.setNotificationEndpoint": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -23972,6 +24374,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.cancelMediaRelocate": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.clearTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -24026,6 +24434,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getMediaRelocateStatus": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getMotionEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -24098,6 +24512,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.relocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.searchObjectEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -24860,6 +25280,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.cancelRelocate": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.deleteFootprint": {
 		capName: "recording",
 		capScope: "system",
@@ -24890,6 +25316,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.getRelocateStatus": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.getStorageUsage": {
 		capName: "recording",
 		capScope: "system",
@@ -24920,6 +25352,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.relocateFootage": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"recording.renderClip": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"recording.renderGif": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.rescanStorage": {
 		capName: "recording",
 		capScope: "system",
@@ -25514,6 +25964,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.renderPreBufferClip": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.restartProfile": {
 		capName: "stream-broker",
 		capScope: "system",