@camstack/addon-matter-broker 0.2.6 → 0.2.8

package/dist/addon.js

@@ -13,7 +13,7 @@ let node_stream_promises = require("node:stream/promises");
 let node_net = require("node:net");
 let node_dgram = require("node:dgram");
 node_dgram = require_esm.__toESM(node_dgram, 1);
-//#region ../types/dist/event-category-BLcNejAE.mjs
+//#region ../types/dist/event-category-Bz24uP1U.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -284,6 +284,19 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["DeviceStateChanged"] = "device.state-changed";
 	/**
+	* Frame occupancy for a camera CHANGED — a tracked object was gained or
+	* lost. Carries `{ deviceId, totalObjects, byClass, zones }`.
+	*
+	* Emitted only on a change, so a steady scene is silent. It exists so a
+	* client can stop polling `zoneAnalytics.getCurrentSnapshot`: that was the
+	* one live badge with no push signal at all, and it cost a request every
+	* four seconds per visible camera.
+	*
+	* Like every event it is telemetry and may be dropped ([D8]) — a consumer
+	* keeps a slow reconcile rather than trusting it alone.
+	*/
+	EventCategory["ZoneAnalyticsOccupancyChanged"] = "zone-analytics.occupancy-changed";
+	/**
 	* Cap event fired by every device that registers the `battery`
 	* capability. Mirrors the cap definition's `onStatusChanged`. Carries
 	* `{ deviceId, status: BatteryStatus }`. Subscribers (alert center,
@@ -7227,35 +7240,22 @@ var ConvertResultSchema = object({
 */
 var RecordingWeekdaySchema = number().int().min(0).max(6);
 var HHMM = /^([01]\d|2[0-3]):[0-5]\d$/;
-var RecordingScheduleSchema = discriminatedUnion("kind", [object({ kind: literal("always") }), object({
-	kind: literal("timeOfDay"),
-	start: string$2().regex(HHMM),
-	end: string$2().regex(HHMM),
-	/** Restrict to these weekdays; omit = every day. */
-	days: array(RecordingWeekdaySchema).optional()
-})]);
-var RecordingModeSchema = _enum([
-	"continuous",
-	"onMotion",
-	"onAudioThreshold"
-]);
 /**
-* First-class, authoritative per-camera storage mode — the explicit choice the
-* UI reads directly (never inferred from `rules`):
-*  - `off`        — not recording.
-*  - `events`     — record only around triggers (motion / audio threshold),
-*                   with pre/post-buffer.
-*  - `continuous` — record 24/7 within the schedule.
+* DERIVED per-camera storage summary — the single field cheap consumers read
+* (the viewer's status dot, the camera list) instead of walking `bands`:
+*  - `off`        — no band covers the camera (or it is disabled).
+*  - `events`     — every band records around triggers only.
+*  - `continuous` — at least one band records continuously.
 *
-* `mode` compiles one-way to the internal `rules[]` consumed by the policy
-* engine (see `compileRules`); `rules[]` is never authored directly anymore.
+* NEVER authored: the recorder stamps it from the authoritative `bands` on
+* every save (`activeModeForConfig`). Writing it has no effect.
 */
 var RecordingStorageModeSchema = _enum([
 	"off",
 	"events",
 	"continuous"
 ]);
-/** Which detectors trigger an `events`-mode recording. */
+/** Which detectors trigger an `events`-mode band. */
 var RecordingTriggersSchema = object({
 	motion: boolean().optional(),
 	audioThresholdDbfs: number().optional()
@@ -7291,18 +7291,6 @@ var RecordingBandSchema = object({
 	preBufferSec: number().min(0).optional(),
 	postBufferSec: number().min(0).optional()
 });
-var RecordingRuleSchema = object({
-	schedule: RecordingScheduleSchema,
-	mode: RecordingModeSchema,
-	/** Seconds of footage to retain BEFORE a trigger (applied at keep/discard). */
-	preBufferSec: number().min(0).default(0),
-	/** Keep recording until this many seconds after the last trigger. */
-	postBufferSec: number().min(0).default(0),
-	/** Each new trigger restarts the post-buffer window. */
-	resetTimeoutOnNewEvent: boolean().default(true),
-	/** onAudioThreshold only — dBFS level that counts as a trigger. */
-	thresholdDbfs: number().optional()
-});
 /**
 * Per-device retention overrides. Every field is optional; an unset or `0`
 * value inherits the node-wide recorder default. Only footage-lifetime limits
@@ -7336,40 +7324,28 @@ var ScrubThumbnailPresetSchema = _enum([
 /**
 * The full per-camera recording intent — the wire shape of a RecordingTarget.
 *
-* `mode` is the authoritative storage choice; `schedule`/`triggers`/`pre`/`post`
-* are its mode-specific parameters. `rules` is a DEPRECATED authoring input kept
-* only for transition + migration (`migrateRulesToMode`); the policy engine
-* consumes the compiled output of `compileRules(config)`, never `rules` directly.
+* `bands` is the ONLY authored recording intent: what to record, when, and on
+* which trigger. `mode` is a derived summary the recorder stamps on save; every
+* other field is a storage knob (profiles, segment length, retention, scrub).
+*
+* STRICT on purpose: the legacy authoring surface (`schedule`/`schedules`/
+* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30.
+* A stale caller must fail loudly — silently stripping its legacy intent would
+* persist a band-less config, i.e. silently stop recording the camera.
 */
 var RecordingConfigSchema = object({
 	enabled: boolean(),
-	/** Authoritative storage mode. Absent on legacy targets → derived once via
-	*  `migrateRulesToMode`, then persisted. */
+	/** DERIVED summary of `bands`, stamped by the recorder on every save.
+	*  Authoring it has no effect — see {@link RecordingStorageModeSchema}. */
 	mode: RecordingStorageModeSchema.optional(),
 	profiles: array(CamProfileSchema).optional(),
 	segmentSeconds: number().int().positive().optional(),
-	/** Shared recording time-bands for `events` & `continuous` — record only when
-	*  the wall-clock falls inside one of these windows. Omit or empty = always.
-	*  `continuous` compiles to one rule per band; `events` to band × trigger. */
-	schedules: array(RecordingScheduleSchema).optional(),
-	/** Legacy single-band predecessor of `schedules`. Read-compat only — it is
-	*  normalized into `schedules` on read and never written going forward. (Not
-	*  tagged `@deprecated`: the normalization paths must read it cast-free.) */
-	schedule: RecordingScheduleSchema.optional(),
-	/** `events`-mode only — which detectors trigger a recording. */
-	triggers: RecordingTriggersSchema.optional(),
-	/** `events`-mode only — seconds retained before / after a trigger. */
-	preBufferSec: number().min(0).optional(),
-	postBufferSec: number().min(0).optional(),
-	/** DEPRECATED authoring input; retained for migration/transition. */
-	rules: array(RecordingRuleSchema).optional(),
 	/**
-	* AUTHORITATIVE mode-per-band recording model (recorder). When present it
-	* is the single source of truth; the legacy `mode`/`schedules`/`schedule`/
-	* `triggers`/`rules` fields above are kept for READ-COMPAT only and are
-	* derived into bands once via `migrateConfigToBands`.
+	* AUTHORITATIVE mode-per-band recording model — the single source of truth
+	* the recorder's band engine consumes. An empty array = record nothing;
+	* "off" is the absence of a covering band, never a band value.
 	*/
-	bands: array(RecordingBandSchema).optional(),
+	bands: array(RecordingBandSchema).default([]),
 	retention: RecordingRetentionSchema.optional(),
 	/**
 	* Per-camera scrub-thumbnail fidelity preset (resolution + JPEG quality for
@@ -7377,8 +7353,15 @@ var RecordingConfigSchema = object({
 	* windows only — existing sheets are immutable, and each window's index
 	* carries its own tile dims so mixed-preset history renders correctly.
 	*/
-	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
-});
+	scrubThumbnails: ScrubThumbnailPresetSchema.optional(),
+	/**
+	* OPT-IN thumbnail-strip generation for this camera: every keyframe of the
+	* low recording saved as a JPEG (the fast-drag scrub depth), a derived
+	* cache that eviction reclaims with the footage. Absent/false = no strips
+	* are written and scrub reads exact keyframes at every velocity.
+	*/
+	stripsEnabled: boolean().optional()
+}).strict();
 /**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
@@ -7397,7 +7380,8 @@ var OpsLogOpSchema = _enum([
 	"prune",
 	"manual-delete",
 	"rescan",
-	"retention-run"
+	"retention-run",
+	"relocate"
 ]);
 /** Why the operation ran. */
 var OpsLogReasonSchema = _enum([
@@ -7436,6 +7420,55 @@ var OpsLogQueryInputSchema = object({
 	limit: number().int().min(1).max(1e3).optional()
 });
 /**
+* Entity-relocation job state (storage entity-routing spec, Phase 4).
+*
+* One shape shared by the recorder's `relocateFootage` (segments + strips) and
+* pipeline-analytics' `relocateMedia` (event media blobs) so the admin Data
+* page renders both movers with one component. Jobs are in-RAM (a restart
+* forgets them — re-running is safe by construction: copy-if-absent, delete
+* after verify) and each completed/failed run also lands one durable ops-log
+* row on the owning addon's surface.
+*/
+var RelocateJobStateSchema = _enum([
+	"running",
+	"done",
+	"failed",
+	"cancelled"
+]);
+var RelocateJobSchema = object({
+	jobId: string$2(),
+	state: RelocateJobStateSchema,
+	/** Source location — for media relocation this is informational ('*': rows
+	*  move from wherever they are to the target). */
+	fromLocationId: string$2(),
+	toLocationId: string$2(),
+	/** Scoped device, or null = every device. */
+	deviceId: number().nullable(),
+	/** What the job moves (owner-addon specific: segments/strips or media). */
+	entities: array(string$2()),
+	filesMoved: number().int(),
+	bytesMoved: number().int(),
+	/** Total files discovered up front; null while (or when) unknown. */
+	filesTotal: number().int().nullable(),
+	startedAt: number(),
+	finishedAt: number().nullable(),
+	error: string$2().nullable()
+});
+var RelocateFootageInputSchema = object({
+	deviceId: number().optional(),
+	fromLocationId: string$2(),
+	toLocationId: string$2(),
+	entities: array(_enum(["segments", "strips"])).optional(),
+	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
+	*  never allowed to starve live writers. */
+	throttleMbps: number().min(1).max(1e3).optional()
+});
+var RelocateMediaInputSchema = object({
+	deviceId: number().optional(),
+	toLocationId: string$2(),
+	throttleMbps: number().min(1).max(1e3).optional()
+});
+/**
 * `StorageLocationType` — an addon-declared id that identifies the *kind* of
 * storage a location serves. Defined here (not in `capabilities/storage.cap.ts`)
 * so the persisted record schema and the consumer-facing cap can both consume it
@@ -7485,6 +7518,13 @@ var StorageLocationSchema = object({
 	nodeId: string$2().optional(),
 	isDefault: boolean().default(false),
 	isSystem: boolean().default(false),
+	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
+	*  for node-local locations it can reach) — never persisted, absent when the
+	*  volume is remote/unreachable. The single capacity truth every UI reads. */
+	capacity: object({
+		totalBytes: number(),
+		availableBytes: number()
+	}).nullable().optional(),
 	createdAt: number(),
 	updatedAt: number()
 });
@@ -8252,7 +8292,8 @@ var NcTaxonomyEntrySchema = object({
 	/** Macro/category parent for grouping ('car' → 'vehicle'); null for a top. */
 	parentKind: string$2().nullable()
 });
-object({
+/** The complete NC picker taxonomy — three grouped buckets. */
+var NcTaxonomySchema = object({
 	videoClasses: array(NcTaxonomyEntrySchema),
 	audioKinds: array(NcTaxonomyEntrySchema),
 	labels: array(NcTaxonomyEntrySchema)
@@ -9155,6 +9196,7 @@ function shallowEqual$1(a, b) {
 	for (const k of ak) if (a[k] !== b[k]) return false;
 	return true;
 }
+new Set(["devices", "classes"]);
 /**
 * Shared geometry vocabulary for on-frame shape caps — privacy-mask,
 * motion-zones, and the detection zones/lines editor all speak this one
@@ -9313,6 +9355,29 @@ var NcOccupancyConditionSchema = object({
 	count: number().int().min(0).default(1),
 	sustainSeconds: number().int().min(0).max(3600).default(15)
 });
+/**
+* Which zone-crossing DIRECTION a rule accepts (`ObjectEvent.zoneCrossing`).
+*
+* The values are not symmetric, and deliberately so — the absent value has to
+* mean exactly what every rule authored before this condition existed already
+* does:
+*  - `enter` — entries and every NON-crossing record (movement state,
+*    package, sensor). Exits are rejected. **This is the absent behaviour**:
+*    an operator who never asked for exits must not start receiving them.
+*  - `exit`  — ONLY an exit crossing. A record that is not a crossing at all
+*    fails closed, because "the car left the drive" is a question about a
+*    boundary, not about a detection.
+*  - `any`   — no direction filter; entries, exits and non-crossings alike.
+*
+* A rule asking for a direction should normally also scope `zones`, which the
+* engine evaluates against the crossed zone as well as the current membership
+* (an exit's membership no longer contains the zone it just left).
+*/
+var NcCrossingSchema = _enum([
+	"enter",
+	"exit",
+	"any"
+]);
 /** Admin-zone membership condition (zone IDs as stamped by the ZoneEngine). */
 var NcZoneConditionSchema = object({
 	ids: array(string$2().min(1)).min(1),
@@ -9337,6 +9402,13 @@ var NcConditionsSchema = object({
 	/** Veto zones — any hit fails the rule. */
 	zonesExclude: array(string$2().min(1)).optional(),
 	/**
+	* Zone-crossing direction. IMMEDIATE only — a crossing is a per-event fact
+	* and a closed track carries none, so a `track-end` rule asking for one
+	* fails closed (use `zones`, which tests `zonesVisited`). ABSENT = `enter`,
+	* which is exactly today's behaviour. See {@link NcCrossingSchema}.
+	*/
+	crossing: NcCrossingSchema.optional(),
+	/**
 	* Exact (case-insensitive) match on the record's collapsed `label`
 	* (identity name / plate text / subclass).
 	*/
@@ -9471,17 +9543,85 @@ var NcRuleTargetSchema = object({
 *  - `keyFrame` — the clean scene frame (no subject box).
 *  - `none` — no attachment.
 */
-var NcMediaPolicySchema = object({ attach: _enum([
-	"best",
-	"best-matching",
-	"keyFrame",
-	"none"
-]).default("best") });
+/**
+* WHAT THE PICTURE SHOWS — chosen explicitly, because the implicit ladders
+* conflate it with the selection strategy and betray the request: asking for
+* the clean scene frame on an object-event owner used to start at
+* `fullFrameBoxed`, i.e. the annotated frame (2026-07-30).
+*  - `cropped` — the subject, tight. What "who is at the door" wants.
+*  - `full`    — the clean scene, no annotation. What "what is going on" wants.
+*  - `boxed`   — the scene WITH the detection boxes drawn, for verifying what
+*                the pipeline actually saw.
+*/
+var NcMediaFrameSchema = _enum([
+	"cropped",
+	"full",
+	"boxed"
+]);
+var NcMediaPolicySchema = object({
+	attach: _enum([
+		"best",
+		"best-matching",
+		"keyFrame",
+		"none"
+	]).default("best"),
+	/** What the still shows. Absent = `cropped` (the historical `best` shape). */
+	frame: NcMediaFrameSchema.optional(),
+	/** Crop the attached still to the rule's condition-zone bbox (padded) —
+	*  "show me the ZONE", not the whole scene or the subject crop. */
+	zoneCrop: boolean().optional(),
+	/**
+	* Also attach a short GIF cut from the stream broker's clip ring around the
+	* event — NOT from the recording, so the camera does not have to be
+	* recording, and the window sits AROUND the moment instead of a segment
+	* behind it. Fail-closed: a window the ring does not cover contributes no
+	* gif, never a failed notification.
+	*/
+	gif: boolean().optional(),
+	/**
+	* Also attach a short MP4 CLIP of the same cut. Same source and the same
+	* fail-closed rule as `gif`. Prefer it where the backend takes video
+	* (telegram, discord, zentik, webhook); backends that do not are handled by
+	* the degrade engine, which drops the video and keeps the still.
+	*/
+	clip: boolean().optional(),
+	/** Seconds of footage BEFORE / AFTER the event instant. Defaults 3 / 7. */
+	clipPreRollSec: number().int().min(0).max(30).optional(),
+	clipPostRollSec: number().int().min(0).max(30).optional(),
+	/**
+	* Which stream profile the footage is cut from. Absent = the CHEAPEST
+	* assigned profile: a notification is watched on a phone, so the 4K
+	* rendition would burn CPU to produce a file the client downscales anyway.
+	* A profile that is not assigned falls back to the cheapest, and the render
+	* reports which one actually ran.
+	*/
+	profile: CamProfileSchema.optional()
+});
+/**
+* Cooldown GRANULARITY over the subject's class — how much a fired
+* notification suppresses.
+*  - `shared` (default, and the absent value) — one window for the whole
+*    rule/scope: a cat silences the next dog for `cooldownSec`.
+*  - `per-class` — an independent window per detected class, so cat→dog fires
+*    at once and cat→cat still waits.
+*
+* AUDIO subjects are ALWAYS per-class regardless of this setting: a scream
+* must not be swallowed by a bark's window (the precedent this generalizes —
+* see `cooldownKey` in the rule engine).
+*/
+var NcThrottleGranularitySchema = _enum(["shared", "per-class"]);
 /** Throttle — cooldown survives restarts (rebuilt from the outbox on boot). */
 var NcThrottleSchema = object({
 	cooldownSec: number().int().min(0).max(86400).default(60),
 	/** `rule` = one shared cooldown; `rule-device` = per-camera cooldown. */
-	scope: _enum(["rule", "rule-device"]).default("rule-device")
+	scope: _enum(["rule", "rule-device"]).default("rule-device"),
+	/**
+	* Class granularity of the cooldown key. Optional rather than defaulted:
+	* a Zod default does NOT run on the addon→addon cap path, so a persisted
+	* rule authored before this field simply carries none — and the engine
+	* reads absent as `shared`, the pre-existing behaviour.
+	*/
+	granularity: NcThrottleGranularitySchema.optional()
 });
 /** Client-supplied rule fields (server stamps id/createdBy/createdAt/updatedAt). */
 var NcRuleInputSchema = object({
@@ -9490,7 +9630,19 @@ var NcRuleInputSchema = object({
 	delivery: NcDeliverySchema,
 	conditions: NcConditionsSchema.default({}),
 	schedule: NcScheduleSchema.optional(),
-	targets: array(NcRuleTargetSchema).min(1),
+	/** May be empty when `targetUsers` addresses at least one user — the
+	*  "at least one addressee" invariant is enforced by the provider, because
+	*  a cross-field refine here would break `NcRulePatchSchema.partial()`. */
+	targets: array(NcRuleTargetSchema),
+	/**
+	* USERS this rule addresses in addition to `targets` (Phase 4). At fire
+	* time each user fans out to the personal targets they own
+	* (`config.ownerUserId`), filtered by that user's `allowedDevices` for the
+	* firing camera — a user is never notified about a device they cannot open.
+	* Per-user opt-outs (`disabledTargetIds`) still apply to the fanned-out
+	* targets.
+	*/
+	targetUsers: array(string$2()).optional(),
 	media: NcMediaPolicySchema.default({ attach: "best" }),
 	throttle: NcThrottleSchema.default({
 		cooldownSec: 60,
@@ -9577,6 +9729,7 @@ var NcConditionDescriptorSchema = object({
 		"schedule",
 		"plateMatcher",
 		"packagePhase",
+		"crossingSelect",
 		"polygonDraw",
 		"occupancy"
 	]),
@@ -9703,7 +9856,10 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), object({ results: array(NcTestResultSchema) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), object({ catalog: array(NcConditionDescriptorSchema) })), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" });
+}), method(object({}), object({
+	catalog: array(NcConditionDescriptorSchema),
+	taxonomy: NcTaxonomySchema.optional()
+})), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" });
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -10712,6 +10868,28 @@ method(object({
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	/** Absent = the LOWEST assigned profile — a notification attachment is
+	*  watched on a phone, and the cheap rendition is the right default. */
+	profile: CamProfileSchema.optional(),
+	aroundMs: number(),
+	preRollSec: number().min(0).max(20).default(3),
+	postRollSec: number().min(0).max(20).default(5),
+	format: _enum(["gif", "mp4"]).default("gif"),
+	maxWidth: number().int().min(120).max(1920).default(480),
+	/** GIF only — MP4 keeps the source cadence. */
+	fps: number().int().min(1).max(15).default(5)
+}), object({
+	base64: string$2(),
+	mime: string$2(),
+	bytes: number().int(),
+	/** The profile actually rendered (what the default resolved to). */
+	profile: CamProfileSchema,
+	durationMs: number()
+}), {
+	kind: "mutation",
+	auth: "admin"
 }), method(_void(), array(CameraStreamSchema).readonly()), method(_void(), array(ProfileSlotSchema).readonly()), method(object({ brokerId: string$2() }), BrokerStatsSchema), method(object({ brokerId: string$2() }), object({
 	probed: boolean(),
 	summary: string$2()
@@ -13842,6 +14020,18 @@ var motionCapability = {
 	name: "motion",
 	scope: "device",
 	mode: "singleton",
+	/**
+	* Providers register per-device natives via `ctx.registerNativeCap`
+	* (Hikvision/Reolink/Amcrest/Wyze/HA/Homematic/Alexa/Matter) — there is
+	* NO system singleton provider. Without this flag `resolveCapMount`
+	* derived `{ kind: 'singleton' }`, so `motion.getStatus`/`isDetected`
+	* resolved via `registry.getSingleton('motion')` (always null) and every
+	* call 412'd "provider not available" while bindings listed a live
+	* `motion` native (2026-08-02). The flag routes the router through
+	* `requireDeviceScoped` → `getProviderForDevice`, like `motion-trigger`,
+	* `snapshot` and every other per-device native cap.
+	*/
+	deviceNative: true,
 	deviceTypes: [DeviceType.Camera, DeviceType.Sensor],
 	methods: { 
 	/**
@@ -18840,7 +19030,10 @@ method(object({
 }), method(object({
 	deviceId: number(),
 	caps: array(string$2()).readonly().optional()
-}), record(string$2(), unknown().nullable()));
+}), record(string$2(), unknown().nullable())), method(object({
+	deviceIds: array(number()).readonly(),
+	caps: array(string$2()).readonly().optional()
+}), record(string$2(), record(string$2(), unknown().nullable())));
 method(object({ deviceId: number() }), record(string$2(), record(string$2(), unknown()))), method(object({
 	deviceId: number(),
 	capName: string$2()
@@ -19771,6 +19964,36 @@ var TargetKindSchema = object({
 	icon: string$2(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string$2(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: string$2().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: string$2().optional(),
 	configSchema: ConfigSchemaPassthrough,
 	supportsDiscovery: boolean(),
 	caps: TargetKindCapsSchema
@@ -20218,6 +20441,29 @@ var MotionEventSchema = object({
 * Absent on legacy rows ⇒ treat as `pipeline`.
 */
 var DetectionSourceSchema = _enum(["pipeline", "onboard"]);
+/**
+* The confirmed zone crossing that produced an object event. Present ONLY on
+* an event emitted BY a crossing (`zone.enter` / `zone.exit`); a movement-state
+* event (`object.entering` / `leaving` / `stationary` / `loitering`) and an
+* appearance event carry none, so a rule asking for a direction fails closed
+* on them.
+*
+* Exactly ONE crossing per event: the emitter turns each confirmed crossing
+* into its own event, so a frame in which a track enters A while leaving B
+* produces two events with two directions — never one ambiguous row.
+*
+* `zoneId` is load-bearing for an EXIT: the event's `zones` list is the
+* membership the box has NOW, and by definition it no longer contains the zone
+* that was just left. Without the id here, a zone-scoped rule could never match
+* the exit it asked for.
+*/
+var ZoneCrossingSchema = object({
+	direction: _enum(["enter", "exit"]),
+	/** Admin zone id crossed. */
+	zoneId: string$2(),
+	/** Zone display name at crossing time (falls back to the id). */
+	zoneName: string$2().optional()
+});
 var ObjectEventSchema = object({
 	...BaseEventFields,
 	kind: literal("object"),
@@ -20244,6 +20490,12 @@ var ObjectEventSchema = object({
 	zones: array(string$2()).readonly().optional(),
 	/** Omitted in slim projection. */
 	state: TrackStateSchema.optional(),
+	/**
+	* The zone crossing this event IS, when it is one. Absent on every other
+	* event kind (movement state, appearance, package) — see
+	* {@link ZoneCrossingSchema}. Omitted in slim projection.
+	*/
+	zoneCrossing: ZoneCrossingSchema.optional(),
 	/** Detection-frame dimensions in pixels — let consumers normalize the
 	*  pixel-space `bbox` onto a displayed image. Omitted in slim projection. */
 	frameWidth: number().optional(),
@@ -20502,6 +20754,15 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(object({ deviceId: number() }), EventPruneCountsSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(RelocateMediaInputSchema, object({ jobId: string$2() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(RelocateJobSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({ jobId: string$2() }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
 	kind: "query",
 	auth: "admin"
@@ -22998,6 +23259,17 @@ var GetConnectionEndpointsResultSchema = object({ endpoints: array(object({
 	*/
 	priority: number()
 })).readonly() });
+/**
+* The chosen outbound endpoint for notification artifacts. `baseUrl: null` =
+* AUTO (resolved from the candidate ranking at send time); `resolved` reports
+* what AUTO currently picks, so the UI can show the effective value either way.
+*/
+var NotificationEndpointSchema = object({
+	/** The operator's explicit choice, or null for AUTO. */
+	baseUrl: string$2().nullable(),
+	/** What the ranking currently resolves to (null when nothing is reachable). */
+	resolved: string$2().nullable()
+});
 var AllowedAddressesSchema = object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -23020,7 +23292,7 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*  to avoid mixed-content blocks in the browser. The public
 	*  tunnel always emits `https://` regardless. */
 	scheme: _enum(["http", "https"]).optional()
-}), GetConnectionEndpointsResultSchema), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" });
+}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string$2().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" });
 /**
 * mesh-network — collection cap for mesh-VPN providers.
 *
@@ -23819,7 +24091,12 @@ var RecordingDeviceUsageSchema = object({
 var RecordingLocationUsageSchema = object({
 	/** StorageLocation id; null for the legacy/degraded single-root fallback. */
 	locationId: string$2().nullable(),
-	/** Bytes of recordings stored on this location. */
+	/** Every location id sharing this row's PHYSICAL volume (aliases). One row
+	*  is emitted per physical disk (2026-07-29): two locations on one root
+	*  previously rendered as two identical "disks" with a nonsensical used
+	*  split — hydrate attribution across aliases is arbitrary by nature. */
+	locationIds: array(string$2()).optional(),
+	/** Bytes of recordings stored on this PHYSICAL volume (all aliases). */
 	usedBytes: number(),
 	/** Free bytes on the location's volume; null when capacity is unknown (remote). */
 	availableBytes: number().nullable(),
@@ -23931,6 +24208,44 @@ method(object({
 }), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
 	kind: "query",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	aroundMs: number(),
+	preRollSec: number().min(0).max(30).default(2),
+	postRollSec: number().min(0).max(30).default(5),
+	maxWidth: number().int().min(120).max(1280).default(480),
+	fps: number().int().min(1).max(15).default(5)
+}), object({
+	gifBase64: string$2(),
+	fromMs: number(),
+	toMs: number()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	aroundMs: number(),
+	preRollSec: number().min(0).max(30).default(3),
+	postRollSec: number().min(0).max(30).default(7),
+	maxWidth: number().int().min(160).max(1920).default(640)
+}), object({
+	clipBase64: string$2(),
+	mime: string$2(),
+	fromMs: number(),
+	toMs: number(),
+	bytes: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(RelocateFootageInputSchema, object({ jobId: string$2() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(RelocateJobSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({ jobId: string$2() }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
 });
 /**
 * `recordingExport` cap — render a footage time range into a single downloadable
@@ -25522,6 +25837,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getDeviceStatusAggregateBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getLinkedDevices": {
 		capName: "device-manager",
 		capScope: "system",
@@ -26416,6 +26737,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getNotificationEndpoint": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getPreferred": {
 		capName: "local-network",
 		capScope: "system",
@@ -26440,6 +26767,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.setNotificationEndpoint": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -27082,6 +27415,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.cancelMediaRelocate": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.clearTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -27136,6 +27475,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getMediaRelocateStatus": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getMotionEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -27208,6 +27553,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.relocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.searchObjectEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -27970,6 +28321,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.cancelRelocate": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.deleteFootprint": {
 		capName: "recording",
 		capScope: "system",
@@ -28000,6 +28357,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.getRelocateStatus": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.getStorageUsage": {
 		capName: "recording",
 		capScope: "system",
@@ -28030,6 +28393,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.relocateFootage": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"recording.renderClip": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"recording.renderGif": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.rescanStorage": {
 		capName: "recording",
 		capScope: "system",
@@ -28624,6 +29005,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.renderPreBufferClip": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.restartProfile": {
 		capName: "stream-broker",
 		capScope: "system",