@camstack/addon-notifiers 1.2.7 → 1.2.9

package/dist/addon.mjs

@@ -1,5 +1,8 @@
 import { brotliCompressSync, deflateSync, gzipSync } from "node:zlib";
-//#region ../types/dist/event-category-BLcNejAE.mjs
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+//#region ../types/dist/event-category-Bz24uP1U.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -270,6 +273,19 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["DeviceStateChanged"] = "device.state-changed";
 	/**
+	* Frame occupancy for a camera CHANGED — a tracked object was gained or
+	* lost. Carries `{ deviceId, totalObjects, byClass, zones }`.
+	*
+	* Emitted only on a change, so a steady scene is silent. It exists so a
+	* client can stop polling `zoneAnalytics.getCurrentSnapshot`: that was the
+	* one live badge with no push signal at all, and it cost a request every
+	* four seconds per visible camera.
+	*
+	* Like every event it is telemetry and may be dropped ([D8]) — a consumer
+	* keeps a slow reconcile rather than trusting it alone.
+	*/
+	EventCategory["ZoneAnalyticsOccupancyChanged"] = "zone-analytics.occupancy-changed";
+	/**
 	* Cap event fired by every device that registers the `battery`
 	* capability. Mirrors the cap definition's `onStatusChanged`. Carries
 	* `{ deviceId, status: BatteryStatus }`. Subscribers (alert center,
@@ -7300,35 +7316,22 @@ function buildCapturingReply(envelope) {
 */
 var RecordingWeekdaySchema = number().int().min(0).max(6);
 var HHMM = /^([01]\d|2[0-3]):[0-5]\d$/;
-var RecordingScheduleSchema = discriminatedUnion("kind", [object({ kind: literal("always") }), object({
-	kind: literal("timeOfDay"),
-	start: string().regex(HHMM),
-	end: string().regex(HHMM),
-	/** Restrict to these weekdays; omit = every day. */
-	days: array(RecordingWeekdaySchema).optional()
-})]);
-var RecordingModeSchema = _enum([
-	"continuous",
-	"onMotion",
-	"onAudioThreshold"
-]);
 /**
-* First-class, authoritative per-camera storage mode — the explicit choice the
-* UI reads directly (never inferred from `rules`):
-*  - `off`        — not recording.
-*  - `events`     — record only around triggers (motion / audio threshold),
-*                   with pre/post-buffer.
-*  - `continuous` — record 24/7 within the schedule.
+* DERIVED per-camera storage summary — the single field cheap consumers read
+* (the viewer's status dot, the camera list) instead of walking `bands`:
+*  - `off`        — no band covers the camera (or it is disabled).
+*  - `events`     — every band records around triggers only.
+*  - `continuous` — at least one band records continuously.
 *
-* `mode` compiles one-way to the internal `rules[]` consumed by the policy
-* engine (see `compileRules`); `rules[]` is never authored directly anymore.
+* NEVER authored: the recorder stamps it from the authoritative `bands` on
+* every save (`activeModeForConfig`). Writing it has no effect.
 */
 var RecordingStorageModeSchema = _enum([
 	"off",
 	"events",
 	"continuous"
 ]);
-/** Which detectors trigger an `events`-mode recording. */
+/** Which detectors trigger an `events`-mode band. */
 var RecordingTriggersSchema = object({
 	motion: boolean().optional(),
 	audioThresholdDbfs: number().optional()
@@ -7364,18 +7367,6 @@ var RecordingBandSchema = object({
 	preBufferSec: number().min(0).optional(),
 	postBufferSec: number().min(0).optional()
 });
-var RecordingRuleSchema = object({
-	schedule: RecordingScheduleSchema,
-	mode: RecordingModeSchema,
-	/** Seconds of footage to retain BEFORE a trigger (applied at keep/discard). */
-	preBufferSec: number().min(0).default(0),
-	/** Keep recording until this many seconds after the last trigger. */
-	postBufferSec: number().min(0).default(0),
-	/** Each new trigger restarts the post-buffer window. */
-	resetTimeoutOnNewEvent: boolean().default(true),
-	/** onAudioThreshold only — dBFS level that counts as a trigger. */
-	thresholdDbfs: number().optional()
-});
 /**
 * Per-device retention overrides. Every field is optional; an unset or `0`
 * value inherits the node-wide recorder default. Only footage-lifetime limits
@@ -7409,40 +7400,28 @@ var ScrubThumbnailPresetSchema = _enum([
 /**
 * The full per-camera recording intent — the wire shape of a RecordingTarget.
 *
-* `mode` is the authoritative storage choice; `schedule`/`triggers`/`pre`/`post`
-* are its mode-specific parameters. `rules` is a DEPRECATED authoring input kept
-* only for transition + migration (`migrateRulesToMode`); the policy engine
-* consumes the compiled output of `compileRules(config)`, never `rules` directly.
+* `bands` is the ONLY authored recording intent: what to record, when, and on
+* which trigger. `mode` is a derived summary the recorder stamps on save; every
+* other field is a storage knob (profiles, segment length, retention, scrub).
+*
+* STRICT on purpose: the legacy authoring surface (`schedule`/`schedules`/
+* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30.
+* A stale caller must fail loudly — silently stripping its legacy intent would
+* persist a band-less config, i.e. silently stop recording the camera.
 */
 var RecordingConfigSchema = object({
 	enabled: boolean(),
-	/** Authoritative storage mode. Absent on legacy targets → derived once via
-	*  `migrateRulesToMode`, then persisted. */
+	/** DERIVED summary of `bands`, stamped by the recorder on every save.
+	*  Authoring it has no effect — see {@link RecordingStorageModeSchema}. */
 	mode: RecordingStorageModeSchema.optional(),
 	profiles: array(CamProfileSchema).optional(),
 	segmentSeconds: number().int().positive().optional(),
-	/** Shared recording time-bands for `events` & `continuous` — record only when
-	*  the wall-clock falls inside one of these windows. Omit or empty = always.
-	*  `continuous` compiles to one rule per band; `events` to band × trigger. */
-	schedules: array(RecordingScheduleSchema).optional(),
-	/** Legacy single-band predecessor of `schedules`. Read-compat only — it is
-	*  normalized into `schedules` on read and never written going forward. (Not
-	*  tagged `@deprecated`: the normalization paths must read it cast-free.) */
-	schedule: RecordingScheduleSchema.optional(),
-	/** `events`-mode only — which detectors trigger a recording. */
-	triggers: RecordingTriggersSchema.optional(),
-	/** `events`-mode only — seconds retained before / after a trigger. */
-	preBufferSec: number().min(0).optional(),
-	postBufferSec: number().min(0).optional(),
-	/** DEPRECATED authoring input; retained for migration/transition. */
-	rules: array(RecordingRuleSchema).optional(),
 	/**
-	* AUTHORITATIVE mode-per-band recording model (recorder). When present it
-	* is the single source of truth; the legacy `mode`/`schedules`/`schedule`/
-	* `triggers`/`rules` fields above are kept for READ-COMPAT only and are
-	* derived into bands once via `migrateConfigToBands`.
+	* AUTHORITATIVE mode-per-band recording model — the single source of truth
+	* the recorder's band engine consumes. An empty array = record nothing;
+	* "off" is the absence of a covering band, never a band value.
 	*/
-	bands: array(RecordingBandSchema).optional(),
+	bands: array(RecordingBandSchema).default([]),
 	retention: RecordingRetentionSchema.optional(),
 	/**
 	* Per-camera scrub-thumbnail fidelity preset (resolution + JPEG quality for
@@ -7450,8 +7429,15 @@ var RecordingConfigSchema = object({
 	* windows only — existing sheets are immutable, and each window's index
 	* carries its own tile dims so mixed-preset history renders correctly.
 	*/
-	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
-});
+	scrubThumbnails: ScrubThumbnailPresetSchema.optional(),
+	/**
+	* OPT-IN thumbnail-strip generation for this camera: every keyframe of the
+	* low recording saved as a JPEG (the fast-drag scrub depth), a derived
+	* cache that eviction reclaims with the footage. Absent/false = no strips
+	* are written and scrub reads exact keyframes at every velocity.
+	*/
+	stripsEnabled: boolean().optional()
+}).strict();
 /**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
@@ -7470,7 +7456,8 @@ var OpsLogOpSchema = _enum([
 	"prune",
 	"manual-delete",
 	"rescan",
-	"retention-run"
+	"retention-run",
+	"relocate"
 ]);
 /** Why the operation ran. */
 var OpsLogReasonSchema = _enum([
@@ -7509,6 +7496,55 @@ var OpsLogQueryInputSchema = object({
 	limit: number().int().min(1).max(1e3).optional()
 });
 /**
+* Entity-relocation job state (storage entity-routing spec, Phase 4).
+*
+* One shape shared by the recorder's `relocateFootage` (segments + strips) and
+* pipeline-analytics' `relocateMedia` (event media blobs) so the admin Data
+* page renders both movers with one component. Jobs are in-RAM (a restart
+* forgets them — re-running is safe by construction: copy-if-absent, delete
+* after verify) and each completed/failed run also lands one durable ops-log
+* row on the owning addon's surface.
+*/
+var RelocateJobStateSchema = _enum([
+	"running",
+	"done",
+	"failed",
+	"cancelled"
+]);
+var RelocateJobSchema = object({
+	jobId: string(),
+	state: RelocateJobStateSchema,
+	/** Source location — for media relocation this is informational ('*': rows
+	*  move from wherever they are to the target). */
+	fromLocationId: string(),
+	toLocationId: string(),
+	/** Scoped device, or null = every device. */
+	deviceId: number().nullable(),
+	/** What the job moves (owner-addon specific: segments/strips or media). */
+	entities: array(string()),
+	filesMoved: number().int(),
+	bytesMoved: number().int(),
+	/** Total files discovered up front; null while (or when) unknown. */
+	filesTotal: number().int().nullable(),
+	startedAt: number(),
+	finishedAt: number().nullable(),
+	error: string().nullable()
+});
+var RelocateFootageInputSchema = object({
+	deviceId: number().optional(),
+	fromLocationId: string(),
+	toLocationId: string(),
+	entities: array(_enum(["segments", "strips"])).optional(),
+	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
+	*  never allowed to starve live writers. */
+	throttleMbps: number().min(1).max(1e3).optional()
+});
+var RelocateMediaInputSchema = object({
+	deviceId: number().optional(),
+	toLocationId: string(),
+	throttleMbps: number().min(1).max(1e3).optional()
+});
+/**
 * `StorageLocationType` — an addon-declared id that identifies the *kind* of
 * storage a location serves. Defined here (not in `capabilities/storage.cap.ts`)
 * so the persisted record schema and the consumer-facing cap can both consume it
@@ -7558,6 +7594,13 @@ var StorageLocationSchema = object({
 	nodeId: string().optional(),
 	isDefault: boolean().default(false),
 	isSystem: boolean().default(false),
+	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
+	*  for node-local locations it can reach) — never persisted, absent when the
+	*  volume is remote/unreachable. The single capacity truth every UI reads. */
+	capacity: object({
+		totalBytes: number(),
+		availableBytes: number()
+	}).nullable().optional(),
 	createdAt: number(),
 	updatedAt: number()
 });
@@ -8325,7 +8368,8 @@ var NcTaxonomyEntrySchema = object({
 	/** Macro/category parent for grouping ('car' → 'vehicle'); null for a top. */
 	parentKind: string().nullable()
 });
-object({
+/** The complete NC picker taxonomy — three grouped buckets. */
+var NcTaxonomySchema = object({
 	videoClasses: array(NcTaxonomyEntrySchema),
 	audioKinds: array(NcTaxonomyEntrySchema),
 	labels: array(NcTaxonomyEntrySchema)
@@ -9048,9 +9092,20 @@ var DEGRADE_ORDER = {
 		"markdown"
 	]
 };
-/** Pick the best target format the kind supports for a given source format. */
+/**
+* Pick the best target format the kind supports for a given source format.
+*
+* TOLERANT of a source outside the union. `NotificationSchema.format` carries
+* `.default('text')`, but that default only runs where the schema is PARSED —
+* the tRPC router. A cap call arriving from another addon (`ctx.api`) skips
+* that parse, so `format` reaches here `undefined`, and the bare
+* `DEGRADE_ORDER[source]` threw `is not iterable`. That broke the one promise
+* the degrade path makes ("never throws — degradation is reported, never
+* surfaced as an error") and dead-lettered every Notification-Center delivery
+* for a day (2026-07-30). An unknown source degrades like `text`.
+*/
 function resolveFormat(source, supported) {
-	for (const candidate of DEGRADE_ORDER[source]) if (supported.includes(candidate)) return candidate;
+	for (const candidate of DEGRADE_ORDER[source] ?? DEGRADE_ORDER.text) if (supported.includes(candidate)) return candidate;
 	return supported[0] ?? "text";
 }
 /** Transcode a body between formats. */
@@ -9095,7 +9150,7 @@ function resolveLevel(levels, n) {
 	})[0]);
 }
 function splitBody(body, maxLen) {
-	if (maxLen <= 0 || body.length <= maxLen) return [body];
+	if (!Number.isFinite(maxLen) || maxLen <= 0 || body.length <= maxLen) return [body];
 	const parts = [];
 	for (let i = 0; i < body.length; i += maxLen) parts.push(body.slice(i, i + maxLen));
 	return parts;
@@ -9178,6 +9233,7 @@ function prepareNotification(caps, n) {
 		renderedAs
 	};
 }
+new Set(["devices", "classes"]);
 /**
 * Shared geometry vocabulary for on-frame shape caps — privacy-mask,
 * motion-zones, and the detection zones/lines editor all speak this one
@@ -9336,6 +9392,29 @@ var NcOccupancyConditionSchema = object({
 	count: number().int().min(0).default(1),
 	sustainSeconds: number().int().min(0).max(3600).default(15)
 });
+/**
+* Which zone-crossing DIRECTION a rule accepts (`ObjectEvent.zoneCrossing`).
+*
+* The values are not symmetric, and deliberately so — the absent value has to
+* mean exactly what every rule authored before this condition existed already
+* does:
+*  - `enter` — entries and every NON-crossing record (movement state,
+*    package, sensor). Exits are rejected. **This is the absent behaviour**:
+*    an operator who never asked for exits must not start receiving them.
+*  - `exit`  — ONLY an exit crossing. A record that is not a crossing at all
+*    fails closed, because "the car left the drive" is a question about a
+*    boundary, not about a detection.
+*  - `any`   — no direction filter; entries, exits and non-crossings alike.
+*
+* A rule asking for a direction should normally also scope `zones`, which the
+* engine evaluates against the crossed zone as well as the current membership
+* (an exit's membership no longer contains the zone it just left).
+*/
+var NcCrossingSchema = _enum([
+	"enter",
+	"exit",
+	"any"
+]);
 /** Admin-zone membership condition (zone IDs as stamped by the ZoneEngine). */
 var NcZoneConditionSchema = object({
 	ids: array(string().min(1)).min(1),
@@ -9360,6 +9439,13 @@ var NcConditionsSchema = object({
 	/** Veto zones — any hit fails the rule. */
 	zonesExclude: array(string().min(1)).optional(),
 	/**
+	* Zone-crossing direction. IMMEDIATE only — a crossing is a per-event fact
+	* and a closed track carries none, so a `track-end` rule asking for one
+	* fails closed (use `zones`, which tests `zonesVisited`). ABSENT = `enter`,
+	* which is exactly today's behaviour. See {@link NcCrossingSchema}.
+	*/
+	crossing: NcCrossingSchema.optional(),
+	/**
 	* Exact (case-insensitive) match on the record's collapsed `label`
 	* (identity name / plate text / subclass).
 	*/
@@ -9494,17 +9580,85 @@ var NcRuleTargetSchema = object({
 *  - `keyFrame` — the clean scene frame (no subject box).
 *  - `none` — no attachment.
 */
-var NcMediaPolicySchema = object({ attach: _enum([
-	"best",
-	"best-matching",
-	"keyFrame",
-	"none"
-]).default("best") });
+/**
+* WHAT THE PICTURE SHOWS — chosen explicitly, because the implicit ladders
+* conflate it with the selection strategy and betray the request: asking for
+* the clean scene frame on an object-event owner used to start at
+* `fullFrameBoxed`, i.e. the annotated frame (2026-07-30).
+*  - `cropped` — the subject, tight. What "who is at the door" wants.
+*  - `full`    — the clean scene, no annotation. What "what is going on" wants.
+*  - `boxed`   — the scene WITH the detection boxes drawn, for verifying what
+*                the pipeline actually saw.
+*/
+var NcMediaFrameSchema = _enum([
+	"cropped",
+	"full",
+	"boxed"
+]);
+var NcMediaPolicySchema = object({
+	attach: _enum([
+		"best",
+		"best-matching",
+		"keyFrame",
+		"none"
+	]).default("best"),
+	/** What the still shows. Absent = `cropped` (the historical `best` shape). */
+	frame: NcMediaFrameSchema.optional(),
+	/** Crop the attached still to the rule's condition-zone bbox (padded) —
+	*  "show me the ZONE", not the whole scene or the subject crop. */
+	zoneCrop: boolean().optional(),
+	/**
+	* Also attach a short GIF cut from the stream broker's clip ring around the
+	* event — NOT from the recording, so the camera does not have to be
+	* recording, and the window sits AROUND the moment instead of a segment
+	* behind it. Fail-closed: a window the ring does not cover contributes no
+	* gif, never a failed notification.
+	*/
+	gif: boolean().optional(),
+	/**
+	* Also attach a short MP4 CLIP of the same cut. Same source and the same
+	* fail-closed rule as `gif`. Prefer it where the backend takes video
+	* (telegram, discord, zentik, webhook); backends that do not are handled by
+	* the degrade engine, which drops the video and keeps the still.
+	*/
+	clip: boolean().optional(),
+	/** Seconds of footage BEFORE / AFTER the event instant. Defaults 3 / 7. */
+	clipPreRollSec: number().int().min(0).max(30).optional(),
+	clipPostRollSec: number().int().min(0).max(30).optional(),
+	/**
+	* Which stream profile the footage is cut from. Absent = the CHEAPEST
+	* assigned profile: a notification is watched on a phone, so the 4K
+	* rendition would burn CPU to produce a file the client downscales anyway.
+	* A profile that is not assigned falls back to the cheapest, and the render
+	* reports which one actually ran.
+	*/
+	profile: CamProfileSchema.optional()
+});
+/**
+* Cooldown GRANULARITY over the subject's class — how much a fired
+* notification suppresses.
+*  - `shared` (default, and the absent value) — one window for the whole
+*    rule/scope: a cat silences the next dog for `cooldownSec`.
+*  - `per-class` — an independent window per detected class, so cat→dog fires
+*    at once and cat→cat still waits.
+*
+* AUDIO subjects are ALWAYS per-class regardless of this setting: a scream
+* must not be swallowed by a bark's window (the precedent this generalizes —
+* see `cooldownKey` in the rule engine).
+*/
+var NcThrottleGranularitySchema = _enum(["shared", "per-class"]);
 /** Throttle — cooldown survives restarts (rebuilt from the outbox on boot). */
 var NcThrottleSchema = object({
 	cooldownSec: number().int().min(0).max(86400).default(60),
 	/** `rule` = one shared cooldown; `rule-device` = per-camera cooldown. */
-	scope: _enum(["rule", "rule-device"]).default("rule-device")
+	scope: _enum(["rule", "rule-device"]).default("rule-device"),
+	/**
+	* Class granularity of the cooldown key. Optional rather than defaulted:
+	* a Zod default does NOT run on the addon→addon cap path, so a persisted
+	* rule authored before this field simply carries none — and the engine
+	* reads absent as `shared`, the pre-existing behaviour.
+	*/
+	granularity: NcThrottleGranularitySchema.optional()
 });
 /** Client-supplied rule fields (server stamps id/createdBy/createdAt/updatedAt). */
 var NcRuleInputSchema = object({
@@ -9513,7 +9667,19 @@ var NcRuleInputSchema = object({
 	delivery: NcDeliverySchema,
 	conditions: NcConditionsSchema.default({}),
 	schedule: NcScheduleSchema.optional(),
-	targets: array(NcRuleTargetSchema).min(1),
+	/** May be empty when `targetUsers` addresses at least one user — the
+	*  "at least one addressee" invariant is enforced by the provider, because
+	*  a cross-field refine here would break `NcRulePatchSchema.partial()`. */
+	targets: array(NcRuleTargetSchema),
+	/**
+	* USERS this rule addresses in addition to `targets` (Phase 4). At fire
+	* time each user fans out to the personal targets they own
+	* (`config.ownerUserId`), filtered by that user's `allowedDevices` for the
+	* firing camera — a user is never notified about a device they cannot open.
+	* Per-user opt-outs (`disabledTargetIds`) still apply to the fanned-out
+	* targets.
+	*/
+	targetUsers: array(string()).optional(),
 	media: NcMediaPolicySchema.default({ attach: "best" }),
 	throttle: NcThrottleSchema.default({
 		cooldownSec: 60,
@@ -9600,6 +9766,7 @@ var NcConditionDescriptorSchema = object({
 		"schedule",
 		"plateMatcher",
 		"packagePhase",
+		"crossingSelect",
 		"polygonDraw",
 		"occupancy"
 	]),
@@ -9726,7 +9893,10 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), object({ results: array(NcTestResultSchema) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), object({ catalog: array(NcConditionDescriptorSchema) })), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" });
+}), method(object({}), object({
+	catalog: array(NcConditionDescriptorSchema),
+	taxonomy: NcTaxonomySchema.optional()
+})), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" });
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -10463,6 +10633,28 @@ method(object({
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	/** Absent = the LOWEST assigned profile — a notification attachment is
+	*  watched on a phone, and the cheap rendition is the right default. */
+	profile: CamProfileSchema.optional(),
+	aroundMs: number(),
+	preRollSec: number().min(0).max(20).default(3),
+	postRollSec: number().min(0).max(20).default(5),
+	format: _enum(["gif", "mp4"]).default("gif"),
+	maxWidth: number().int().min(120).max(1920).default(480),
+	/** GIF only — MP4 keeps the source cadence. */
+	fps: number().int().min(1).max(15).default(5)
+}), object({
+	base64: string(),
+	mime: string(),
+	bytes: number().int(),
+	/** The profile actually rendered (what the default resolved to). */
+	profile: CamProfileSchema,
+	durationMs: number()
+}), {
+	kind: "mutation",
+	auth: "admin"
 }), method(_void(), array(CameraStreamSchema).readonly()), method(_void(), array(ProfileSlotSchema).readonly()), method(object({ brokerId: string() }), BrokerStatsSchema), method(object({ brokerId: string() }), object({
 	probed: boolean(),
 	summary: string()
@@ -16098,7 +16290,10 @@ method(object({
 }), method(object({
 	deviceId: number(),
 	caps: array(string()).readonly().optional()
-}), record(string(), unknown().nullable()));
+}), record(string(), unknown().nullable())), method(object({
+	deviceIds: array(number()).readonly(),
+	caps: array(string()).readonly().optional()
+}), record(string(), record(string(), unknown().nullable())));
 method(object({ deviceId: number() }), record(string(), record(string(), unknown()))), method(object({
 	deviceId: number(),
 	capName: string()
@@ -17029,6 +17224,36 @@ var TargetKindSchema = object({
 	icon: string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: string().optional(),
 	configSchema: ConfigSchemaPassthrough,
 	supportsDiscovery: boolean(),
 	caps: TargetKindCapsSchema
@@ -17490,6 +17715,29 @@ var MotionEventSchema = object({
 * Absent on legacy rows ⇒ treat as `pipeline`.
 */
 var DetectionSourceSchema = _enum(["pipeline", "onboard"]);
+/**
+* The confirmed zone crossing that produced an object event. Present ONLY on
+* an event emitted BY a crossing (`zone.enter` / `zone.exit`); a movement-state
+* event (`object.entering` / `leaving` / `stationary` / `loitering`) and an
+* appearance event carry none, so a rule asking for a direction fails closed
+* on them.
+*
+* Exactly ONE crossing per event: the emitter turns each confirmed crossing
+* into its own event, so a frame in which a track enters A while leaving B
+* produces two events with two directions — never one ambiguous row.
+*
+* `zoneId` is load-bearing for an EXIT: the event's `zones` list is the
+* membership the box has NOW, and by definition it no longer contains the zone
+* that was just left. Without the id here, a zone-scoped rule could never match
+* the exit it asked for.
+*/
+var ZoneCrossingSchema = object({
+	direction: _enum(["enter", "exit"]),
+	/** Admin zone id crossed. */
+	zoneId: string(),
+	/** Zone display name at crossing time (falls back to the id). */
+	zoneName: string().optional()
+});
 var ObjectEventSchema = object({
 	...BaseEventFields,
 	kind: literal("object"),
@@ -17516,6 +17764,12 @@ var ObjectEventSchema = object({
 	zones: array(string()).readonly().optional(),
 	/** Omitted in slim projection. */
 	state: TrackStateSchema.optional(),
+	/**
+	* The zone crossing this event IS, when it is one. Absent on every other
+	* event kind (movement state, appearance, package) — see
+	* {@link ZoneCrossingSchema}. Omitted in slim projection.
+	*/
+	zoneCrossing: ZoneCrossingSchema.optional(),
 	/** Detection-frame dimensions in pixels — let consumers normalize the
 	*  pixel-space `bbox` onto a displayed image. Omitted in slim projection. */
 	frameWidth: number().optional(),
@@ -17774,6 +18028,15 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(object({ deviceId: number() }), EventPruneCountsSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(RelocateMediaInputSchema, object({ jobId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(RelocateJobSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
 	kind: "query",
 	auth: "admin"
@@ -20253,6 +20516,17 @@ var GetConnectionEndpointsResultSchema = object({ endpoints: array(object({
 	*/
 	priority: number()
 })).readonly() });
+/**
+* The chosen outbound endpoint for notification artifacts. `baseUrl: null` =
+* AUTO (resolved from the candidate ranking at send time); `resolved` reports
+* what AUTO currently picks, so the UI can show the effective value either way.
+*/
+var NotificationEndpointSchema = object({
+	/** The operator's explicit choice, or null for AUTO. */
+	baseUrl: string().nullable(),
+	/** What the ranking currently resolves to (null when nothing is reachable). */
+	resolved: string().nullable()
+});
 var AllowedAddressesSchema = object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -20275,7 +20549,7 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*  to avoid mixed-content blocks in the browser. The public
 	*  tunnel always emits `https://` regardless. */
 	scheme: _enum(["http", "https"]).optional()
-}), GetConnectionEndpointsResultSchema), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" });
+}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" });
 /**
 * mesh-network — collection cap for mesh-VPN providers.
 *
@@ -21074,7 +21348,12 @@ var RecordingDeviceUsageSchema = object({
 var RecordingLocationUsageSchema = object({
 	/** StorageLocation id; null for the legacy/degraded single-root fallback. */
 	locationId: string().nullable(),
-	/** Bytes of recordings stored on this location. */
+	/** Every location id sharing this row's PHYSICAL volume (aliases). One row
+	*  is emitted per physical disk (2026-07-29): two locations on one root
+	*  previously rendered as two identical "disks" with a nonsensical used
+	*  split — hydrate attribution across aliases is arbitrary by nature. */
+	locationIds: array(string()).optional(),
+	/** Bytes of recordings stored on this PHYSICAL volume (all aliases). */
 	usedBytes: number(),
 	/** Free bytes on the location's volume; null when capacity is unknown (remote). */
 	availableBytes: number().nullable(),
@@ -21186,6 +21465,44 @@ method(object({
 }), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
 	kind: "query",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	aroundMs: number(),
+	preRollSec: number().min(0).max(30).default(2),
+	postRollSec: number().min(0).max(30).default(5),
+	maxWidth: number().int().min(120).max(1280).default(480),
+	fps: number().int().min(1).max(15).default(5)
+}), object({
+	gifBase64: string(),
+	fromMs: number(),
+	toMs: number()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	aroundMs: number(),
+	preRollSec: number().min(0).max(30).default(3),
+	postRollSec: number().min(0).max(30).default(7),
+	maxWidth: number().int().min(160).max(1920).default(640)
+}), object({
+	clipBase64: string(),
+	mime: string(),
+	fromMs: number(),
+	toMs: number(),
+	bytes: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(RelocateFootageInputSchema, object({ jobId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(RelocateJobSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
 });
 /**
 * `recordingExport` cap — render a footage time range into a single downloadable
@@ -22777,6 +23094,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getDeviceStatusAggregateBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getLinkedDevices": {
 		capName: "device-manager",
 		capScope: "system",
@@ -23671,6 +23994,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getNotificationEndpoint": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getPreferred": {
 		capName: "local-network",
 		capScope: "system",
@@ -23695,6 +24024,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.setNotificationEndpoint": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -24337,6 +24672,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.cancelMediaRelocate": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.clearTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -24391,6 +24732,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getMediaRelocateStatus": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getMotionEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -24463,6 +24810,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.relocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.searchObjectEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -25225,6 +25578,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.cancelRelocate": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.deleteFootprint": {
 		capName: "recording",
 		capScope: "system",
@@ -25255,6 +25614,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.getRelocateStatus": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.getStorageUsage": {
 		capName: "recording",
 		capScope: "system",
@@ -25285,6 +25650,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.relocateFootage": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"recording.renderClip": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"recording.renderGif": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.rescanStorage": {
 		capName: "recording",
 		capScope: "system",
@@ -25879,6 +26262,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.renderPreBufferClip": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.restartProfile": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -26573,7 +26962,7 @@ var NOTIFIER_ICONS = {
 /** The addon id — also the `/addon/<id>/…` route prefix. Mirrors `NOTIFIERS_ADDON_ID`. */
 var NOTIFIERS_ROUTE_ID = "notifiers";
 /** One day; icons are immutable per addon version. */
-var CACHE_CONTROL = "public, max-age=86400, immutable";
+var CACHE_CONTROL$1 = "public, max-age=86400, immutable";
 var ICON_KINDS = new Set(Object.keys(NOTIFIER_ICONS));
 /** `true` when a bundled brand icon exists for `kind`. */
 function hasIcon(kind) {
@@ -26587,6 +26976,15 @@ function hasIcon(kind) {
 function iconUrlFor(kind) {
 	return hasIcon(kind) ? `/addon/${NOTIFIERS_ROUTE_ID}/icons/${kind}` : void 0;
 }
+/**
+* The media type `iconUrlFor(kind)` serves, or `undefined` when no icon is
+* bundled. The client needs it because SVG and raster render through different
+* components on React Native, and it cannot be guessed from the URL — the route
+* path deliberately carries no file extension.
+*/
+function iconMediaTypeFor(kind) {
+	return hasIcon(kind) ? NOTIFIER_ICONS[kind].contentType : void 0;
+}
 /** Pre-encode one bundled icon into every content coding. */
 function encodeIcon(icon) {
 	const identity = typeof icon.body === "string" ? Buffer.from(icon.body, "utf8") : Buffer.from(icon.body);
@@ -26622,15 +27020,143 @@ function iconRoute(kind) {
 		description: `Official brand icon (${encoded.contentType}) for the '${kind}' notifier kind.`,
 		handler: async (request, reply) => {
 			const coding = negotiateEncoding(String(request.headers["accept-encoding"] ?? ""));
-			reply.code(200).type(encoded.contentType).header("cache-control", CACHE_CONTROL).header("vary", "accept-encoding");
+			reply.code(200).type(encoded.contentType).header("cache-control", CACHE_CONTROL$1).header("vary", "accept-encoding");
 			if (coding !== null) reply.header("content-encoding", coding);
 			reply.send(coding !== null ? encoded[coding] : encoded.identity);
 		}
 	};
 }
-/** Build the `addon-routes` provider that serves the bundled icons. */
-function createIconRouteProvider() {
-	return buildAddonRouteProvider(NOTIFIERS_ROUTE_ID, Object.keys(NOTIFIER_ICONS).map(iconRoute));
+/**
+* The icon routes, for composition into the addon's SINGLE `addon-routes`
+* provider. Not a provider of its own: a provider owns one route id and matches
+* paths within it, so the icons and the test samples must share one route set
+* (see `sample-routes.ts`).
+*/
+function iconRoutes() {
+	return Object.keys(NOTIFIER_ICONS).map(iconRoute);
+}
+//#endregion
+//#region src/sample-routes.ts
+/**
+* Serves the bundled test-notification sample media over the addon's own HTTP
+* surface via the `addon-routes` cap. One public GET route per sample:
+*
+*   GET /addon/notifiers/samples/<name>  →  the bundled sample bytes
+*
+* WHY THIS EXISTS
+* ───────────────
+* The test panel used to attach `https://example.com/sample.jpg` — the IANA
+* reserved documentation domain, which serves no media. Every "does my target
+* deliver an image / gif / video" test was therefore broken by construction and
+* had never verified anything. The samples have to live somewhere the addon can
+* actually fetch, on an install with no internet, so they ship with the addon.
+*
+* The bytes are read from `assets/samples/` (not embedded in TS): a 128 KB mp4
+* as a base64 literal would inflate the bundle by ~170 KB of source. Path
+* resolution mirrors `addon-benchmark`'s `resolveFixturesDir` — `import.meta.url`
+* always points at the compiled bundle under `dist/`, so walking up one
+* directory lands on the package root whether the addon runs from source (tsx)
+* or from its built bundle.
+*
+* CONTENT-ENCODING IS OURS, DELIBERATELY
+* ──────────────────────────────────────
+* Same hazard `icon-routes.ts` documents: the hub pipes an addon route's reply
+* through its global `@fastify/compress`, and on the forked-addon UDS route
+* bridge that compressor emits an EMPTY brotli stream for a compressible body
+* over 1 KiB. The compressor skips a response that already declares a
+* non-identity `content-encoding`, so we negotiate and stamp it ourselves.
+*
+* Media types here are all ALREADY compressed (JPEG/GIF/MP4/MP3), so we serve
+* identity bytes and stamp `content-encoding: identity` — re-compressing them
+* wastes CPU for no gain, and the explicit header is what keeps the hub's
+* compressor off a body it would corrupt.
+*/
+/** Samples are immutable per addon version. */
+var CACHE_CONTROL = "public, max-age=86400, immutable";
+/**
+* The bundled set. Keyed by the `AttachmentMediaType` each one exercises, so a
+* caps-driven test panel can ask for "the sample for this media type" without
+* knowing filenames. `icon` deliberately reuses the image sample — an icon slot
+* wants a small raster, and shipping a fifth file to say the same thing is
+* waste.
+*/
+var SAMPLES = [
+	{
+		name: "image",
+		file: "image.jpg",
+		contentType: "image/jpeg"
+	},
+	{
+		name: "gif",
+		file: "animation.gif",
+		contentType: "image/gif"
+	},
+	{
+		name: "video",
+		file: "clip.mp4",
+		contentType: "video/mp4"
+	},
+	{
+		name: "audio",
+		file: "tone.mp3",
+		contentType: "audio/mpeg"
+	},
+	{
+		name: "icon",
+		file: "image.jpg",
+		contentType: "image/jpeg"
+	}
+];
+new Set(SAMPLES.map((s) => s.name));
+/** Resolve the addon's bundled samples directory (see the file header). */
+function resolveSamplesDir() {
+	const here = fileURLToPath(import.meta.url);
+	const pkgRoot = path.resolve(path.dirname(here), "..");
+	return path.join(pkgRoot, "assets", "samples");
+}
+/**
+* Read every sample eagerly so a missing asset fails at BOOT with a clear
+* error, rather than on the first operator click with a 500 that reads as a
+* broken notifier.
+*/
+function loadSamples() {
+	const dir = resolveSamplesDir();
+	const out = /* @__PURE__ */ new Map();
+	for (const sample of SAMPLES) {
+		const bytes = readFileSync(path.join(dir, sample.file));
+		out.set(sample.name, {
+			contentType: sample.contentType,
+			bytes
+		});
+	}
+	return out;
+}
+/** One static GET route serving a single bundled sample. */
+function sampleRoute(sample, loaded) {
+	return {
+		method: "GET",
+		path: `/samples/${sample.name}`,
+		access: "public",
+		description: `Bundled ${sample.contentType} test sample for the '${sample.name}' attachment slot.`,
+		handler: async (_request, reply) => {
+			reply.code(200).type(loaded.contentType).header("cache-control", CACHE_CONTROL).header("content-encoding", "identity").header("content-length", String(loaded.bytes.byteLength));
+			reply.send(loaded.bytes);
+		}
+	};
+}
+/**
+* The sample routes, for composition into the addon's SINGLE `addon-routes`
+* provider. Deliberately not a provider of its own: a provider owns one route
+* id and matches paths within it, so two providers sharing `notifiers` would
+* collide — the icons and the samples must travel in one route set.
+*/
+function sampleRoutes() {
+	const loaded = loadSamples();
+	return SAMPLES.map((sample) => {
+		const bytes = loaded.get(sample.name);
+		if (bytes === void 0) throw new Error(`notifiers: sample '${sample.name}' failed to load`);
+		return sampleRoute(sample, bytes);
+	});
 }
 //#endregion
 //#region src/nc-target-actions.ts
@@ -29219,6 +29745,7 @@ function createNotificationOutputProvider(deps) {
 		};
 	}
 	const iconUrlFor = deps.iconUrlFor;
+	const iconMediaTypeFor = deps.iconMediaTypeFor;
 	return {
 		listTargetKinds: async () => deps.adapters.map((a) => {
 			const descriptor = {
@@ -29226,10 +29753,16 @@ function createNotificationOutputProvider(deps) {
 				addonId
 			};
 			const iconUrl = iconUrlFor?.(a.descriptor.kind);
-			return iconUrl !== void 0 ? {
+			if (iconUrl === void 0) return descriptor;
+			const iconMediaType = iconMediaTypeFor?.(a.descriptor.kind);
+			return iconMediaType !== void 0 ? {
+				...descriptor,
+				iconUrl,
+				iconMediaType
+			} : {
 				...descriptor,
 				iconUrl
-			} : descriptor;
+			};
 		}),
 		listTargets: async () => {
 			return (await store.list()).map((target) => {
@@ -29500,9 +30033,10 @@ var NotifiersAddon = class extends BaseAddon {
 			store,
 			adapters: ADAPTERS,
 			logger: this.ctx.logger.child("notification-output"),
-			iconUrlFor
+			iconUrlFor,
+			iconMediaTypeFor
 		});
-		const iconRouteProvider = createIconRouteProvider();
+		const routeProvider = buildAddonRouteProvider(NOTIFIERS_ADDON_ID, [...iconRoutes(), ...sampleRoutes()]);
 		const ncHandlers = makeNcTargetHandlers({
 			provider,
 			logger: this.ctx.logger.child("nc-target-actions")
@@ -29514,7 +30048,7 @@ var NotifiersAddon = class extends BaseAddon {
 				provider
 			}, {
 				capability: addonRoutesCapability,
-				provider: iconRouteProvider
+				provider: routeProvider
 			}],
 			customActions: ncTargetActions,
 			actionHandlers: ncHandlers