@camstack/addon-auth 1.2.141 → 1.2.142

package/dist/{dist-CBTStyBW.js → dist-D6yj-7NH.js}

@@ -32,7 +32,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 }) : target, mod));
 var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 require("node:crypto");
-//#region ../types/dist/event-category-DaIZi00R.mjs
+//#region ../types/dist/event-category-C4hVnRo8.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -251,7 +251,17 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["RecordingStopped"] = "recording.stopped";
 	EventCategory["RecordingError"] = "recording.error";
 	EventCategory["RecordingHealthDegraded"] = "recording.health.degraded";
+	/** Recording enabled but no segment finalized for the NC stall window. */
+	EventCategory["RecordingHealthStalled"] = "recording.health.stalled";
+	/** Recovery from {@link RecordingHealthStalled}. */
+	EventCategory["RecordingHealthOk"] = "recording.health.ok";
 	EventCategory["RecordingStorageCritical"] = "recording.storage.critical";
+	/** Free space on a storage location crossed the warn bar. */
+	EventCategory["StorageLocationLow"] = "storage.location.low";
+	/** Free space at/under the critical bar, or capacity probe failed (`null`). */
+	EventCategory["StorageLocationCritical"] = "storage.location.critical";
+	/** Recovery from low/critical on a storage location. */
+	EventCategory["StorageLocationOk"] = "storage.location.ok";
 	EventCategory["RecordingSegmentWritten"] = "recording.segment.written";
 	EventCategory["RecordingPolicyFallback"] = "recording.policy.fallback";
 	EventCategory["RecordingRetentionCompleted"] = "recording.retention.completed";
@@ -5410,7 +5420,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DwAQ9sqX.mjs
+//#region ../types/dist/sleep-BBF1iXUi.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8011,6 +8021,21 @@ var ProfileRtspEntrySchema = object({
 	codec: string().optional(),
 	resolution: CamStreamResolutionSchema.optional()
 });
+/**
+* The model weight formats a catalog entry can ship. Schema-free on purpose:
+* `types/models.ts` builds Zod schemas from it, but a runner-closure consumer
+* (the model downloader in `@camstack/system`) needs only the list and must
+* reach it through `@camstack/types/addon` without building the cap schema
+* graph (D28).
+*/
+var MODEL_FORMATS = [
+	"onnx",
+	"coreml",
+	"openvino",
+	"tflite",
+	"pt",
+	"gguf"
+];
 object({
 	field: string().min(1),
 	on: literal("advance")
@@ -8494,7 +8519,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-Bzr7GwgP.mjs
+//#region ../types/dist/composition-C-WpVYTX.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -8546,7 +8571,7 @@ var BASE = `https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/v${FFM
 function portable(target) {
 	return `${BASE}/jellyfin-ffmpeg_${FFMPEG_RELEASE}_portable_${target}-gpl.tar.xz`;
 }
-portable("linux64"), portable("linuxarm64"), portable("macarm64"), portable("mac64");
+portable("linux64"), portable("linuxarm64"), portable("macarm64"), portable("mac64"), `${BASE}${FFMPEG_RELEASE}`;
 /**
 * THE table "which boolean of this device type counts as HIGH", and the
 * pure evaluator of its EDGE.
@@ -10238,6 +10263,15 @@ discriminatedUnion("type", [
 		message: string()
 	})
 ]);
+/** Every status, in the order a summary lists them. */
+var RETRAIN_REVIEW_STATUSES = [
+	"unchanged",
+	"adjusted",
+	"reclassified",
+	"added",
+	"removed",
+	"model-error"
+];
 /**
 * What the gate decided about a birth, from the CALLER's point of view.
 *
@@ -11855,14 +11889,6 @@ var MASK_SUPPLY_STEP_IDS = ["segmentation"];
 	...CROP_SUPPLY_STEP_IDS,
 	...MASK_SUPPLY_STEP_IDS
 ];
-var MODEL_FORMATS = [
-	"onnx",
-	"coreml",
-	"openvino",
-	"tflite",
-	"pt",
-	"gguf"
-];
 /**
 * Multi-file format payload.
 *
@@ -13205,6 +13231,329 @@ var authProviderCapability = {
 	mount: { kind: "skip" }
 };
 /**
+* Query filter for settings-store collections.
+*/
+var QueryFilterSchema = object({
+	where: record(string(), unknown()).optional(),
+	whereIn: record(string(), array(unknown())).optional(),
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
+	/** NULL-safe exclusion: matches rows whose field is NULL OR != the value. */
+	whereNot: record(string(), unknown()).optional(),
+	/** NULL-safe exclusion of a SET — `whereNot` for more than one value. An
+	*  empty list excludes nothing. See `QueryFilter.whereNotIn`. */
+	whereNotIn: record(string(), array(unknown())).optional(),
+	orderBy: object({
+		field: string(),
+		direction: _enum(["asc", "desc"])
+	}).optional(),
+	limit: number().optional(),
+	offset: number().optional()
+});
+/**
+* The predicate half of a filter, for BULK MUTATIONS.
+*
+* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
+* meaning for a statement that rewrites a set, and accepting them would invite
+* a caller to believe `limit` bounds the damage. Every field is optional here
+* only so the shape stays composable — the implementation REJECTS a filter
+* that compiles to no predicate, because that is the whole collection.
+*/
+var MutationFilterSchema = object({
+	where: record(string(), unknown()).optional(),
+	whereIn: record(string(), array(unknown())).optional(),
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
+	whereNot: record(string(), unknown()).optional(),
+	whereNotIn: record(string(), array(unknown())).optional()
+});
+/**
+* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
+*
+* `as` names the slot in the result, so the SAME column may be asked twice with
+* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
+* a `Record<column, op>` shape could not express.
+*/
+var AggregateFieldSchema = object({
+	/** Result key. */
+	as: string().min(1),
+	/** Column to aggregate. Must be a real column of a declared collection. */
+	field: string().min(1),
+	op: _enum([
+		"sum",
+		"min",
+		"max"
+	])
+});
+/**
+* `COUNT(*)` plus one number per requested field.
+*
+* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
+* that really is 0 are different facts, and an accounting caller that renders
+* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
+*/
+var AggregateResultSchema = object({
+	count: number().int(),
+	values: record(string(), number().nullable())
+});
+/** A single stored record: `{ id, data }`. */
+var SettingsRecordSchema = object({
+	id: string(),
+	data: record(string(), unknown())
+});
+/**
+* One record of a BULK insert — {@link SettingsRecordSchema} with the id made
+* optional.
+*
+* A separate schema rather than loosening the shared one: every other method
+* on this cap addresses a row BY its id, and making that field optional
+* everywhere would turn a forgotten key into a silently generated one on
+* `update` and `delete` as well.
+*/
+var BulkRecordSchema = object({
+	id: string().optional(),
+	data: record(string(), unknown())
+});
+/**
+* The database FILES one `sqlite-settings` engine process owns (D851).
+* Closed on purpose: a file is a thing the engine opens, backs up and gives a
+* serving thread, so a new one is a code change, never a string a caller
+* invents. `settings` is `camstack.db` and the default for every collection
+* that names no file.
+*/
+var DataStoreDatabaseSchema = _enum([
+	"settings",
+	"events",
+	"history"
+]);
+DataStoreDatabaseSchema.options;
+/**
+* One write inside a {@link settingsStoreCapability.methods.transact} call.
+* The three that a "replace this set, bump that revision" write needs, plus
+* the batched upsert a rollup writer needs.
+*/
+var TransactOpSchema = discriminatedUnion("op", [
+	object({
+		op: literal("deleteWhere"),
+		collection: string(),
+		filter: MutationFilterSchema
+	}),
+	object({
+		op: literal("insertMany"),
+		collection: string(),
+		records: array(BulkRecordSchema).readonly()
+	}),
+	object({
+		op: literal("update"),
+		collection: string(),
+		id: string(),
+		data: record(string(), unknown())
+	}),
+	object({
+		op: literal("upsertMany"),
+		collection: string(),
+		conflict: array(string()).readonly(),
+		records: array(BulkRecordSchema).readonly()
+	})
+]);
+/**
+* The precondition of a transaction: the row `key` of `collection` must hold
+* `equals` in `column`, read INSIDE the transaction.
+*/
+var TransactGuardSchema = object({
+	collection: string(),
+	key: string(),
+	column: string(),
+	equals: unknown()
+});
+/**
+* Column declaration for a structured (SQL-backed) collection.
+*
+* Logical types — the backend translates each to the matching SQLite
+* storage class and handles per-type marshaling:
+*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
+*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
+*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
+*/
+var CollectionColumnSchema = object({
+	name: string(),
+	type: _enum([
+		"TEXT",
+		"INTEGER",
+		"REAL",
+		"JSON",
+		"BOOLEAN"
+	]),
+	primaryKey: boolean().optional(),
+	notNull: boolean().optional(),
+	unique: boolean().optional(),
+	/**
+	* Column DEFAULT. Required for B2: the four `ensureTable` consumers declare
+	* columns like `enabled INTEGER NOT NULL DEFAULT 1`, and without this the
+	* collection surface simply cannot express their existing tables — which is
+	* why they were still on the uncapped `table*` API.
+	*/
+	defaultValue: union([
+		string(),
+		number(),
+		boolean()
+	]).optional()
+});
+var CollectionIndexSchema = object({
+	name: string(),
+	columns: array(string()).readonly(),
+	unique: boolean().optional()
+});
+/**
+* The input of `declareCollection` — ONE schema for the door and for the
+* engine behind it, so the two surfaces cannot drift (the dispatcher forwards
+* the payload untouched).
+*
+* - `database` — the file the collection lives in (D851). Absent means
+*   `settings`. A declaration naming a file other than the one the table is
+*   already in is REFUSED by the engine, never moved.
+* - `primaryKey` — a COMPOSITE key, as column names. A single name is the same
+*   as `primaryKey: true` on that column. A composite-keyed collection has no
+*   `id`: it is written with `insertMany` / `upsertMany` / `transact` and read
+*   with `query` / `count` / `aggregate` / `deleteWhere`; the calls that
+*   address one row by id are refused.
+* - `withoutRowid` — emit `WITHOUT ROWID`. Requires a primary key.
+*/
+var DeclareCollectionInputSchema = object({
+	namespace: string().optional(),
+	collection: string(),
+	columns: array(CollectionColumnSchema).readonly(),
+	indexes: array(CollectionIndexSchema).readonly().optional(),
+	database: DataStoreDatabaseSchema.optional(),
+	primaryKey: array(string()).readonly().optional(),
+	withoutRowid: boolean().optional()
+});
+method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), unknown(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string(),
+	value: unknown()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional(),
+	columns: array(string()).readonly().optional()
+}), array(SettingsRecordSchema).readonly(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	/** Declared columns identifying the slot; must be covered by a UNIQUE
+	*  index on the collection. Never empty. */
+	conflict: array(string()).readonly(),
+	record: BulkRecordSchema
+}), object({ 
+/** The id the row HAS: assigned by SQLite on an insert, or the existing
+*  row's own id on an update. */
+id: union([string(), number()]) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	conflict: array(string()).readonly(),
+	records: array(BulkRecordSchema).readonly()
+}), object({ upserted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	record: object({
+		id: string().optional(),
+		data: record(string(), unknown())
+	})
+}), object({ 
+/**
+* The id the row ACTUALLY got (D473): the one supplied, the UUID minted
+* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
+* primary key — which is the only place an auto key is knowable.
+*/
+id: union([string(), number()]) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	records: array(BulkRecordSchema).readonly()
+}), object({ inserted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	guard: TransactGuardSchema.optional(),
+	ops: array(TransactOpSchema).readonly()
+}), object({
+	applied: boolean(),
+	current: unknown().optional()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	id: string(),
+	data: record(string(), unknown())
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema
+}), object({ deleted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema,
+	data: record(string(), unknown())
+}), object({ updated: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), number(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	fields: array(AggregateFieldSchema).readonly(),
+	filter: QueryFilterSchema.optional()
+}), AggregateResultSchema, { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	field: string(),
+	bucketSize: number().int().positive(),
+	origin: number().int(),
+	filter: QueryFilterSchema.optional()
+}), array(object({
+	bucket: number().int(),
+	count: number().int()
+})).readonly(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string()
+}), boolean(), { auth: "admin" }), method(DeclareCollectionInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * How long one snapshot may take end to end: the pinned copy of the whole
 * database plus `PRAGMA integrity_check` over the copy, on the hub's slowest
 * disk. ~800 MB at a pessimistic 10 MB/s is under 3 minutes; the bound is
@@ -13217,7 +13566,11 @@ var DATABASE_SNAPSHOT_TIMEOUT_MS = 30 * 6e4;
 * database has no sidecars and is just as owned). Paths are absolute on the
 * owner's host.
 */
-var DatabaseSnapshotTargetsSchema = object({ databases: array(object({ livePath: string() })) });
+var DatabaseSnapshotTargetsSchema = object({ databases: array(object({
+	/** Which owned file this is — the handle `writeSnapshot` takes. */
+	databaseId: DataStoreDatabaseSchema,
+	livePath: string()
+})) });
 /** One b-tree table of the snapshot and the rows it holds. */
 var DatabaseSnapshotTableSchema = object({
 	name: string(),
@@ -13250,6 +13603,10 @@ var DatabaseSnapshotResultSchema = object({
 	/** When the pinned read transaction began (ms epoch) — the snapshot's instant. */
 	takenAt: number()
 });
+/** A snapshot the owner wrote, with the file it belongs to. */
+var DatabaseSnapshotWrittenSchema = DatabaseSnapshotResultSchema.extend({ databaseId: DataStoreDatabaseSchema });
+/** Which database `writeSnapshot` copies. Required: an unstated ask is not guessed. */
+var DatabaseSnapshotRequestSchema = object({ databaseId: DataStoreDatabaseSchema });
 /**
 * A snapshot as an ARCHIVE records it (`ArchiveManifest.sqliteSnapshots`):
 * the same facts, with both paths relative to the archive root (the node's
@@ -13259,9 +13616,11 @@ var ArchiveSqliteSnapshotSchema = DatabaseSnapshotResultSchema.extend({
 	/** Archive-relative path of the live database the archive does NOT carry. */
 	livePath: string(),
 	/** Archive-relative path of the verified copy it carries in its place. */
-	snapshotPath: string()
+	snapshotPath: string(),
+	/** Absent on an archive made before several files were owned: that was `settings`. */
+	databaseId: DataStoreDatabaseSchema.optional()
 });
-method(object({}), DatabaseSnapshotTargetsSchema, { auth: "admin" }), method(object({}), DatabaseSnapshotResultSchema, {
+method(object({}), DatabaseSnapshotTargetsSchema, { auth: "admin" }), method(DatabaseSnapshotRequestSchema, DatabaseSnapshotWrittenSchema, {
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: DATABASE_SNAPSHOT_TIMEOUT_MS
@@ -13382,7 +13741,12 @@ var BackupArchiveEntrySchema = object({
 	/** Top-level locations included in the archive (db, addons, tls, …). */
 	locations: array(string()).readonly(),
 	/** Present when the archive is encrypted; restore then needs that key. */
-	encryption: BackupArchiveEncryptionSchema.optional()
+	encryption: BackupArchiveEncryptionSchema.optional(),
+	/**
+	* The databases the run asked to carry (its retention class). Absent on an
+	* archive made before several files were owned: that was `['settings']`.
+	*/
+	databases: array(DataStoreDatabaseSchema).readonly().optional()
 });
 var BackupEntrySchema = object({
 	id: string(),
@@ -13416,7 +13780,12 @@ var ArchiveManifestSchema = object({
 	* Live SQLite databases this archive carries as their OWNER's verified
 	* snapshot instead of as files (D693). Absent on archives made before.
 	*/
-	sqliteSnapshots: array(ArchiveSqliteSnapshotSchema).optional()
+	sqliteSnapshots: array(ArchiveSqliteSnapshotSchema).optional(),
+	/**
+	* Owned database files the run did NOT carry (not selected): left out of the
+	* tar and the entry list alike. Absent when every owned file was carried.
+	*/
+	omittedDatabases: array(DataStoreDatabaseSchema).optional()
 });
 var LocationStatSchema = object({
 	name: string(),
@@ -13538,6 +13907,12 @@ var BackupScheduleSchema = object({
 	/** Optional subset of source locations to include; omitted = all. */
 	dataSources: array(string()).readonly().optional(),
 	/**
+	* Which database files this schedule carries. Absent = `['settings']`
+	* (an unstated ask is the minimum, D382). Events and history run weekly,
+	* settings nightly (D852).
+	*/
+	databases: array(DataStoreDatabaseSchema).readonly().optional(),
+	/**
 	* ms-epoch of the last tick that FIRED this schedule. Stamped before the
 	* archive runs (it is the dedupe anchor), so it says "attempted", never
 	* "succeeded" — a run refused by every destination stamps it too.
@@ -13561,7 +13936,9 @@ method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }
 	* retention). Omitted = each destination's own policy
 	* retention (manual runs).
 	*/
-	retentionCount: number().int().min(1).max(1e3).optional()
+	retentionCount: number().int().min(1).max(1e3).optional(),
+	/** Database files to carry; omitted = `['settings']`. */
+	databases: array(DataStoreDatabaseSchema).optional()
 }).optional(), BackupTriggerResultSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -13636,14 +14013,18 @@ method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }
 	ok: boolean(),
 	error: string().optional(),
 	nextRuns: array(number()).readonly()
-})), method(_void(), array(BackupScheduleSchema).readonly(), { auth: "admin" }), method(object({
+})), method(_void(), array(BackupScheduleSchema).readonly(), { auth: "admin" }), method(_void(), object({
+	answered: boolean(),
+	databases: array(DataStoreDatabaseSchema).readonly()
+}), { auth: "admin" }), method(object({
 	id: string().optional(),
 	label: string(),
 	cron: string(),
 	enabled: boolean(),
 	locationIds: array(string()).readonly(),
 	retentionCount: number().int().min(1).max(1e3),
-	dataSources: array(string()).readonly().optional()
+	dataSources: array(string()).readonly().optional(),
+	databases: array(DataStoreDatabaseSchema).readonly().optional()
 }), BackupScheduleSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -14074,6 +14455,16 @@ var BrokerClientsSchema = object({
 	/** Total encoded + raw-RTP callback subscriber count (sum of `encoded[].length`). */
 	encodedSubscribers: number()
 });
+/**
+* How many people are watching one camera LIVE right now — see
+* `getLiveViewerCounts`. A camera with nobody watching is absent from the list
+* (so `viewers` is always at least 1): the listing carries the cameras that
+* have viewers, never a row of zeros.
+*/
+var LiveViewerCountSchema = object({
+	deviceId: number().int().nonnegative(),
+	viewers: number().int().positive()
+});
 _enum([
 	"reconnecting",
 	"sleeping",
@@ -14434,7 +14825,7 @@ method(object({
 }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ brokerId: string() }), BrokerClientsSchema), method(object({
+}), method(object({ brokerId: string() }), BrokerClientsSchema), method(_void(), array(LiveViewerCountSchema).readonly()), method(object({
 	brokerId: string(),
 	channel: _enum(["rtsp", "audio"]),
 	handle: string()
@@ -15300,240 +15691,6 @@ method(_void(), array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }
 	timeoutMs: 30 * 6e4
 });
 /**
-* Query filter for settings-store collections.
-*/
-var QueryFilterSchema = object({
-	where: record(string(), unknown()).optional(),
-	whereIn: record(string(), array(unknown())).optional(),
-	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
-	/** NULL-safe exclusion: matches rows whose field is NULL OR != the value. */
-	whereNot: record(string(), unknown()).optional(),
-	/** NULL-safe exclusion of a SET — `whereNot` for more than one value. An
-	*  empty list excludes nothing. See `QueryFilter.whereNotIn`. */
-	whereNotIn: record(string(), array(unknown())).optional(),
-	orderBy: object({
-		field: string(),
-		direction: _enum(["asc", "desc"])
-	}).optional(),
-	limit: number().optional(),
-	offset: number().optional()
-});
-/**
-* The predicate half of a filter, for BULK MUTATIONS.
-*
-* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
-* meaning for a statement that rewrites a set, and accepting them would invite
-* a caller to believe `limit` bounds the damage. Every field is optional here
-* only so the shape stays composable — the implementation REJECTS a filter
-* that compiles to no predicate, because that is the whole collection.
-*/
-var MutationFilterSchema = object({
-	where: record(string(), unknown()).optional(),
-	whereIn: record(string(), array(unknown())).optional(),
-	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
-	whereNot: record(string(), unknown()).optional(),
-	whereNotIn: record(string(), array(unknown())).optional()
-});
-/**
-* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
-*
-* `as` names the slot in the result, so the SAME column may be asked twice with
-* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
-* a `Record<column, op>` shape could not express.
-*/
-var AggregateFieldSchema = object({
-	/** Result key. */
-	as: string().min(1),
-	/** Column to aggregate. Must be a real column of a declared collection. */
-	field: string().min(1),
-	op: _enum([
-		"sum",
-		"min",
-		"max"
-	])
-});
-/**
-* `COUNT(*)` plus one number per requested field.
-*
-* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
-* that really is 0 are different facts, and an accounting caller that renders
-* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
-*/
-var AggregateResultSchema = object({
-	count: number().int(),
-	values: record(string(), number().nullable())
-});
-/** A single stored record: `{ id, data }`. */
-var SettingsRecordSchema = object({
-	id: string(),
-	data: record(string(), unknown())
-});
-/**
-* One record of a BULK insert — {@link SettingsRecordSchema} with the id made
-* optional.
-*
-* A separate schema rather than loosening the shared one: every other method
-* on this cap addresses a row BY its id, and making that field optional
-* everywhere would turn a forgotten key into a silently generated one on
-* `update` and `delete` as well.
-*/
-var BulkRecordSchema = object({
-	id: string().optional(),
-	data: record(string(), unknown())
-});
-/**
-* Column declaration for a structured (SQL-backed) collection.
-*
-* Logical types — the backend translates each to the matching SQLite
-* storage class and handles per-type marshaling:
-*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
-*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
-*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
-*/
-var CollectionColumnSchema = object({
-	name: string(),
-	type: _enum([
-		"TEXT",
-		"INTEGER",
-		"REAL",
-		"JSON",
-		"BOOLEAN"
-	]),
-	primaryKey: boolean().optional(),
-	notNull: boolean().optional(),
-	unique: boolean().optional(),
-	/**
-	* Column DEFAULT. Required for B2: the four `ensureTable` consumers declare
-	* columns like `enabled INTEGER NOT NULL DEFAULT 1`, and without this the
-	* collection surface simply cannot express their existing tables — which is
-	* why they were still on the uncapped `table*` API.
-	*/
-	defaultValue: union([
-		string(),
-		number(),
-		boolean()
-	]).optional()
-});
-var CollectionIndexSchema = object({
-	name: string(),
-	columns: array(string()).readonly(),
-	unique: boolean().optional()
-});
-method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string()
-}), unknown(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string(),
-	value: unknown()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: QueryFilterSchema.optional(),
-	columns: array(string()).readonly().optional()
-}), array(SettingsRecordSchema).readonly(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	/** Declared columns identifying the slot; must be covered by a UNIQUE
-	*  index on the collection. Never empty. */
-	conflict: array(string()).readonly(),
-	record: BulkRecordSchema
-}), object({ 
-/** The id the row HAS: assigned by SQLite on an insert, or the existing
-*  row's own id on an update. */
-id: union([string(), number()]) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	record: object({
-		id: string().optional(),
-		data: record(string(), unknown())
-	})
-}), object({ 
-/**
-* The id the row ACTUALLY got (D473): the one supplied, the UUID minted
-* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
-* primary key — which is the only place an auto key is knowable.
-*/
-id: union([string(), number()]) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	records: array(BulkRecordSchema).readonly()
-}), object({ inserted: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	id: string(),
-	data: record(string(), unknown())
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: MutationFilterSchema
-}), object({ deleted: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: MutationFilterSchema,
-	data: record(string(), unknown())
-}), object({ updated: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: QueryFilterSchema.optional()
-}), number(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	fields: array(AggregateFieldSchema).readonly(),
-	filter: QueryFilterSchema.optional()
-}), AggregateResultSchema, { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	field: string(),
-	bucketSize: number().int().positive(),
-	origin: number().int(),
-	filter: QueryFilterSchema.optional()
-}), array(object({
-	bucket: number().int(),
-	count: number().int()
-})).readonly(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string()
-}), boolean(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	columns: array(CollectionColumnSchema).readonly(),
-	indexes: array(CollectionIndexSchema).readonly().optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * What one engine says about itself. The orchestrator uses `kind` to pick
 * a registrant for a collection; `engineId` is what a log line names when
 * a call is routed or refused.
@@ -15613,6 +15770,14 @@ id: union([string(), number()]) }), {
 }), object({ id: union([string(), number()]) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	conflict: array(string()).readonly(),
+	records: array(BulkRecordSchema).readonly()
+}), object({ upserted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	namespace: string().optional(),
 	collection: string(),
@@ -15620,6 +15785,16 @@ id: union([string(), number()]) }), {
 }), object({ inserted: number().int() }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	guard: TransactGuardSchema.optional(),
+	ops: array(TransactOpSchema).readonly()
+}), object({
+	applied: boolean(),
+	current: unknown().optional()
+}), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	namespace: string().optional(),
 	collection: string(),
@@ -15672,12 +15847,7 @@ id: union([string(), number()]) }), {
 })).readonly(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string()
-}), boolean(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	columns: array(CollectionColumnSchema).readonly(),
-	indexes: array(CollectionIndexSchema).readonly().optional()
-}), _void(), {
+}), boolean(), { auth: "admin" }), method(DeclareCollectionInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -20379,6 +20549,12 @@ var NcSystemEventKindSchema = _enum([
 	"node-updating",
 	"node-inference-unavailable",
 	"detection-blind",
+	"recording-stalled",
+	"recording-healthy",
+	"recording-degraded",
+	"storage-location-low",
+	"storage-location-critical",
+	"storage-location-ok",
 	"addon-crash-loop",
 	"addon-update-available",
 	"server-update-available",
@@ -24050,6 +24226,58 @@ var RetrainBboxSchema = object({
 	h: number()
 });
 /**
+* What a box LOOKED LIKE when it was offered, snapshotted at the moment the
+* operator accepted it. The saved row keeps only the final rectangle; this is
+* the other half of the pair, and the pair is what says whether the operator
+* accepted, nudged, relabelled or replaced a proposal (`retrain-review.ts`).
+*
+* `ref` names the proposal inside its frame: `pipeline:<trackId>` for a box the
+* live pipeline drew, `assist:<n>` for the n-th box of a detector or LLM run,
+* and anything unique for an operator-drawn box (`operator:<n>`). Re-derived
+* pipeline boxes carry the same ref every time, which is what lets a dismissal
+* stay dismissed.
+*/
+var RetrainOriginSchema = object({
+	source: RetrainAnnotationSourceSchema,
+	ref: string().min(1),
+	bbox: RetrainBboxSchema,
+	macroClass: RetrainMacroClassSchema,
+	label: string().optional(),
+	score: number().optional(),
+	modelId: string().optional()
+});
+/**
+* A proposal the operator deleted. Durable on the frame, so a deleted pipeline
+* box does not come back as a draft every time the frame is reopened, and so
+* the deletion itself is a recorded fact rather than an absence.
+*/
+var RetrainDismissedSchema = object({
+	ref: string().min(1),
+	snapshot: RetrainOriginSchema
+});
+/** What the operator did with a proposal (see `retrain-review.ts`). */
+var RetrainReviewStatusSchema = _enum(RETRAIN_REVIEW_STATUSES);
+var RetrainFrameReviewSchema = object({
+	boxes: array(object({
+		ref: string(),
+		savedId: string().optional(),
+		status: RetrainReviewStatusSchema,
+		/** The baseline was re-derived, not snapshotted (a pre-origin row). */
+		approximate: boolean(),
+		origin: RetrainOriginSchema.optional(),
+		/** The class / label the box carries NOW (a removed box: its origin's). Absent on an older hub. */
+		macroClass: RetrainMacroClassSchema.optional(),
+		label: string().optional(),
+		iou: number().optional()
+	})).readonly(),
+	summary: object({
+		counts: record(RetrainReviewStatusSchema, number().int()),
+		total: number().int(),
+		changed: number().int(),
+		approximate: boolean()
+	})
+});
+/**
 * One annotated subject.
 *
 * `bbox` is normalised against the full frame, ALWAYS. The per-model shapes
@@ -24073,6 +24301,9 @@ var RetrainAnnotationSchema = object({
 	/** Which model proposed this box — or, on a `model_error`, drew the phantom. */
 	assistModelId: string().optional(),
 	assistScore: number().optional(),
+	/** The proposal this box started from, snapshotted at accept time. `null` on
+	*  a row saved before origins existed; absent on a draft nobody snapshotted. */
+	origin: RetrainOriginSchema.nullable().optional(),
 	exportedInBatch: string().optional(),
 	createdAt: number()
 });
@@ -24165,7 +24396,19 @@ var RetrainFrameSchema = object({
 	*  empty when nothing the track store holds can be placed on it. */
 	pipelineBoxes: array(RetrainPipelineBoxSchema).readonly().optional(),
 	/** The named collections this frame belongs to. Present on list answers. */
-	collectionIds: array(string()).readonly().optional()
+	collectionIds: array(string()).readonly().optional(),
+	/** Bumped by every annotation save. A save that names a stale
+	*  `expectedRevision` is refused, so two surfaces cannot overwrite each other. */
+	revision: number().int().optional(),
+	/** Proposals the operator deleted — never re-seeded as drafts. */
+	dismissed: array(RetrainDismissedSchema).readonly().optional(),
+	/** What the operator did with the proposals, computed by the server. */
+	review: RetrainFrameReviewSchema.optional(),
+	/** The frame's pixels over the admin data plane (full size). Fetch with the
+	*  admin bearer token; relative to the hub root. */
+	imageUrl: string().optional(),
+	/** The same, as a ~480 px thumbnail for grids. */
+	thumbnailUrl: string().optional()
 });
 /** Why a copy-on-select could not be honoured — named, never a silent skip. */
 var RetrainCopyRefusalSchema = _enum([
@@ -25244,10 +25487,33 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	/** The frame's track, when it has one — checked against the frame. */
 	trackId: string().optional(),
 	frameId: string(),
-	annotations: array(RetrainAnnotationDraftSchema)
+	annotations: array(RetrainAnnotationDraftSchema),
+	/** The frame's `revision` the caller saw. A different current revision
+	*  refuses the save with a `retrain-revision-conflict` error
+	*  (`parseRetrainRevisionConflict`). Absent ⇒ last write wins. */
+	expectedRevision: number().int().optional(),
+	/** The proposals the operator deleted. Absent ⇒ keep the frame's
+	*  current set; present ⇒ replace it (an empty array un-dismisses). */
+	dismissed: array(RetrainDismissedSchema).optional()
 }), array(RetrainAnnotationSchema).readonly(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string().optional(),
+	frameId: string(),
+	expectedRevision: number().int().optional(),
+	origins: array(object({
+		annotationId: string(),
+		origin: RetrainOriginSchema
+	})).min(1).max(500)
+}), object({
+	updated: number().int(),
+	skipped: number().int(),
+	revision: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	trackId: string()
@@ -27863,6 +28129,12 @@ var CameraStepOverridePatchSchema = object({
 	settings: record(string(), unknown()).readonly().optional()
 });
 var CameraStepSettingsSchema = record(string(), record(string(), unknown()).readonly());
+/** The three root-detector choices a camera has (D507: at most one root). */
+var CameraDetectionSourceSchema = _enum([
+	"pipeline",
+	"onboard",
+	"none"
+]);
 var CameraPipelineSettingsSchema = object({
 	stepToggles: record(string(), boolean()).optional(),
 	stepSettings: CameraStepSettingsSchema.optional(),
@@ -28440,6 +28712,26 @@ method(object({
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ deviceId: number() }), object({
+	source: CameraDetectionSourceSchema,
+	explicit: boolean(),
+	onboard: object({
+		/** The camera has an onboard detector this system can read. */
+		available: boolean(),
+		/** What its detections carry — a camera with no box cannot be a root step. */
+		geometry: _enum([
+			"boxed",
+			"while-streaming",
+			"flag-only",
+			"unknown"
+		])
+	})
+})), method(object({
+	deviceId: number(),
+	source: CameraDetectionSourceSchema
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ deviceId: number() }), record(string(), record(string(), record(string(), CameraStepOverridePatchSchema))).nullable()), method(object({
 	deviceId: number(),
 	agentNodeId: string(),
@@ -31806,6 +32098,17 @@ var BatteryStatusSchema = object({
 	*/
 	lastContactAt: number().optional(),
 	/**
+	* Ms epoch of the last COMPLETE scheduled refresh — every fact the provider
+	* holds for the device (level, charging, link, device info, state slices) and
+	* its cached snapshot, read together. Absent = never since this slice was
+	* born. Unlike `lastUpdated` (any write, even a push of one field) this is
+	* the staleness an operator can trust: the provider owns the device fact and
+	* so owns the window on its age (D224, D847). Not a clock in the
+	* runtime-state-durability sense: it moves once per window and must survive
+	* a restart, or every restart would owe the camera a wake.
+	*/
+	lastFullRefreshAt: number().optional(),
+	/**
 	* True when the source is a BINARY low-battery indicator (HA
 	* `binary_sensor` device_class=battery / `LOW_BAT`) that has no real
 	* charge level — `percentage` is then a coarse stand-in (100 = normal,
@@ -31869,6 +32172,18 @@ var CalendarInfoSchema = object({
 	source: CalendarSourceKindSchema,
 	enabled: boolean()
 });
+/**
+* Time contract of {@link CalendarEvent}.
+*
+* - Timed event: `startMs` / `endMs` are real instants; `endMs` is exclusive.
+* - All-day event (`allDay: true`): the event is a run of calendar DATES, not
+*   instants. `startMs` is UTC midnight of the first date and `endMs` is UTC
+*   midnight of the day AFTER the last date (RFC 5545 exclusive DTEND), so a
+*   one-day event spans exactly 24 h. Every provider produces that and no
+*   consumer may read the instants in a local timezone: use
+*   {@link calendarEventLocalSpan}. Reading UTC midnight as local time put an
+*   all-day event on the following day for any viewer ahead of UTC.
+*/
 var CalendarEventSchema = object({
 	id: string().min(1),
 	calendarId: string().min(1),
@@ -34011,7 +34326,15 @@ var HubAddressBookSchema = object({
 		publicEndpoint: HubAddressRoleResolutionSchema
 	}),
 	/** The `hub=` an app link carries (D709), or null. */
-	appLinkHub: string().nullable()
+	appLinkHub: string().nullable(),
+	/**
+	* Every origin a browser can really reach this hub at, in the scheme each
+	* listener serves: `https://<lan>:<httpsPort>`, and `http://<lan>:<httpPort>`
+	* while LAN HTTP is on, plus the public and custom addresses. Distinct from
+	* `rows`, which show `http://` only while LAN HTTP is on. Never loopback,
+	* never the app link. Absent on a hub older than D794's amendment.
+	*/
+	listenerOrigins: array(string()).readonly().optional()
 });
 var AllowedAddressesSchema = object({ 
 /**
@@ -35021,7 +35344,14 @@ var TopologyNodeSchema = object({
 	* completed a mutual-TLS handshake, `clear` otherwise. Absent for the hub,
 	* for offline rows and when the hub cannot tell.
 	*/
-	meshTransport: _enum(["tls", "clear"]).optional()
+	meshTransport: _enum(["tls", "clear"]).optional(),
+	/**
+	* Whether the hub holds this online AGENT's capability registration (its
+	* `registerNode` manifest). `false` = online in the mesh but not ready: the
+	* hub dropped the registration on a disconnect only it saw and the agent has
+	* not re-sent it. Absent for the hub and offline rows.
+	*/
+	capabilitiesRegistered: boolean().optional()
 });
 var CapUsageEdgeSchema = object({
 	callerAddonId: string(),
@@ -40863,6 +41193,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"backup.listAvailableDatabases": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"backup.listDestinations": {
 		capName: "backup",
 		capScope: "system",
@@ -41559,6 +41895,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"dataStoreProvider.transact": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dataStoreProvider.update": {
 		capName: "data-store-provider",
 		capScope: "system",
@@ -41577,6 +41919,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"dataStoreProvider.upsertMany": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dayNight.getOptions": {
 		capName: "day-night",
 		capScope: "device",
@@ -44403,6 +44751,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.backfillRetrainOrigins": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.cancelRelocateMedia": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -45183,6 +45537,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getCameraDetectionSource": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getCameraMetrics": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -45411,6 +45771,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraDetectionSource": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCameraPipelineForAgent": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -46383,6 +46749,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.transact": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"settingsStore.update": {
 		capName: "settings-store",
 		capScope: "system",
@@ -46401,6 +46773,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.upsertMany": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"smoke.getStatus": {
 		capName: "smoke",
 		capScope: "device",
@@ -46863,6 +47241,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"streamBroker.getLiveViewerCounts": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"streamBroker.getPreBufferInfo": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -50707,6 +51091,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.backfillRetrainOrigins": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.clearTrackRelation": [{
 		name: "deviceId",
 		form: "single",
@@ -51012,6 +51401,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.getCameraDetectionSource": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.getCameraMetrics": [{
 		name: "deviceId",
 		form: "single",
@@ -51072,6 +51466,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.setCameraDetectionSource": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.setCameraPipelineForAgent": [{
 		name: "deviceId",
 		form: "single",
@@ -52101,6 +52500,9 @@ new Map(Object.entries({
 	"stream-online": "device-events",
 	"stream-offline": "device-events",
 	"detection-blind": "device-events",
+	"recording-stalled": "device-events",
+	"recording-healthy": "device-events",
+	"recording-degraded": "device-events",
 	"node-online": "system",
 	"node-offline": "system",
 	"node-restarting": "system",
@@ -52114,6 +52516,9 @@ new Map(Object.entries({
 	"wrapper-update-available": "system",
 	"backup-completed": "system",
 	"export-completed": "system",
+	"storage-location-low": "system",
+	"storage-location-critical": "system",
+	"storage-location-ok": "system",
 	"alarm-triggered": "alarm",
 	"alarm-armed": "alarm",
 	"alarm-disarmed": "alarm",
@@ -52175,6 +52580,16 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 		label: "Detecting nothing",
 		kinds: ["detection-blind"]
 	},
+	{
+		id: "recording",
+		family: "device-events",
+		label: "Recording",
+		kinds: [
+			"recording-stalled",
+			"recording-healthy",
+			"recording-degraded"
+		]
+	},
 	{
 		id: "nodes",
 		family: "system",
@@ -52215,6 +52630,16 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 		label: "Backups & exports",
 		kinds: ["backup-completed", "export-completed"]
 	},
+	{
+		id: "storage",
+		family: "system",
+		label: "Storage locations",
+		kinds: [
+			"storage-location-low",
+			"storage-location-critical",
+			"storage-location-ok"
+		]
+	},
 	{
 		id: "alarm",
 		family: "alarm",
@@ -52297,6 +52722,9 @@ var DEVICE_EVENTS = [
 	"stream-online",
 	"stream-offline",
 	"detection-blind",
+	"recording-stalled",
+	"recording-healthy",
+	"recording-degraded",
 	...ALARM
 ];
 /** Every kind a summary may speak about — the two summarisable families. */
@@ -52464,6 +52892,11 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
 	([...RULE_TEXT], [...UPDATES]),
 	([...RULE_TEXT], [...PACKAGE_UPDATES]),
 	([...RULE_TEXT], [...PACKAGE_UPDATES]),