@camstack/addon-pipeline 1.2.18 → 1.2.27

package/dist/{dist-OjOsoSZG.mjs → dist-CsKaXmP8.mjs}

@@ -7371,35 +7371,22 @@ var EVENT_PAD_MS = {
 */
 var RecordingWeekdaySchema = number().int().min(0).max(6);
 var HHMM = /^([01]\d|2[0-3]):[0-5]\d$/;
-var RecordingScheduleSchema = discriminatedUnion("kind", [object({ kind: literal("always") }), object({
-	kind: literal("timeOfDay"),
-	start: string().regex(HHMM),
-	end: string().regex(HHMM),
-	/** Restrict to these weekdays; omit = every day. */
-	days: array(RecordingWeekdaySchema).optional()
-})]);
-var RecordingModeSchema = _enum([
-	"continuous",
-	"onMotion",
-	"onAudioThreshold"
-]);
 /**
-* First-class, authoritative per-camera storage mode — the explicit choice the
-* UI reads directly (never inferred from `rules`):
-*  - `off`        — not recording.
-*  - `events`     — record only around triggers (motion / audio threshold),
-*                   with pre/post-buffer.
-*  - `continuous` — record 24/7 within the schedule.
+* DERIVED per-camera storage summary — the single field cheap consumers read
+* (the viewer's status dot, the camera list) instead of walking `bands`:
+*  - `off`        — no band covers the camera (or it is disabled).
+*  - `events`     — every band records around triggers only.
+*  - `continuous` — at least one band records continuously.
 *
-* `mode` compiles one-way to the internal `rules[]` consumed by the policy
-* engine (see `compileRules`); `rules[]` is never authored directly anymore.
+* NEVER authored: the recorder stamps it from the authoritative `bands` on
+* every save (`activeModeForConfig`). Writing it has no effect.
 */
 var RecordingStorageModeSchema = _enum([
 	"off",
 	"events",
 	"continuous"
 ]);
-/** Which detectors trigger an `events`-mode recording. */
+/** Which detectors trigger an `events`-mode band. */
 var RecordingTriggersSchema = object({
 	motion: boolean().optional(),
 	audioThresholdDbfs: number().optional()
@@ -7435,18 +7422,6 @@ var RecordingBandSchema = object({
 	preBufferSec: number().min(0).optional(),
 	postBufferSec: number().min(0).optional()
 });
-var RecordingRuleSchema = object({
-	schedule: RecordingScheduleSchema,
-	mode: RecordingModeSchema,
-	/** Seconds of footage to retain BEFORE a trigger (applied at keep/discard). */
-	preBufferSec: number().min(0).default(0),
-	/** Keep recording until this many seconds after the last trigger. */
-	postBufferSec: number().min(0).default(0),
-	/** Each new trigger restarts the post-buffer window. */
-	resetTimeoutOnNewEvent: boolean().default(true),
-	/** onAudioThreshold only — dBFS level that counts as a trigger. */
-	thresholdDbfs: number().optional()
-});
 /**
 * Per-device retention overrides. Every field is optional; an unset or `0`
 * value inherits the node-wide recorder default. Only footage-lifetime limits
@@ -7480,40 +7455,28 @@ var ScrubThumbnailPresetSchema = _enum([
 /**
 * The full per-camera recording intent — the wire shape of a RecordingTarget.
 *
-* `mode` is the authoritative storage choice; `schedule`/`triggers`/`pre`/`post`
-* are its mode-specific parameters. `rules` is a DEPRECATED authoring input kept
-* only for transition + migration (`migrateRulesToMode`); the policy engine
-* consumes the compiled output of `compileRules(config)`, never `rules` directly.
+* `bands` is the ONLY authored recording intent: what to record, when, and on
+* which trigger. `mode` is a derived summary the recorder stamps on save; every
+* other field is a storage knob (profiles, segment length, retention, scrub).
+*
+* STRICT on purpose: the legacy authoring surface (`schedule`/`schedules`/
+* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30.
+* A stale caller must fail loudly — silently stripping its legacy intent would
+* persist a band-less config, i.e. silently stop recording the camera.
 */
 var RecordingConfigSchema = object({
 	enabled: boolean(),
-	/** Authoritative storage mode. Absent on legacy targets → derived once via
-	*  `migrateRulesToMode`, then persisted. */
+	/** DERIVED summary of `bands`, stamped by the recorder on every save.
+	*  Authoring it has no effect — see {@link RecordingStorageModeSchema}. */
 	mode: RecordingStorageModeSchema.optional(),
 	profiles: array(CamProfileSchema).optional(),
 	segmentSeconds: number().int().positive().optional(),
-	/** Shared recording time-bands for `events` & `continuous` — record only when
-	*  the wall-clock falls inside one of these windows. Omit or empty = always.
-	*  `continuous` compiles to one rule per band; `events` to band × trigger. */
-	schedules: array(RecordingScheduleSchema).optional(),
-	/** Legacy single-band predecessor of `schedules`. Read-compat only — it is
-	*  normalized into `schedules` on read and never written going forward. (Not
-	*  tagged `@deprecated`: the normalization paths must read it cast-free.) */
-	schedule: RecordingScheduleSchema.optional(),
-	/** `events`-mode only — which detectors trigger a recording. */
-	triggers: RecordingTriggersSchema.optional(),
-	/** `events`-mode only — seconds retained before / after a trigger. */
-	preBufferSec: number().min(0).optional(),
-	postBufferSec: number().min(0).optional(),
-	/** DEPRECATED authoring input; retained for migration/transition. */
-	rules: array(RecordingRuleSchema).optional(),
 	/**
-	* AUTHORITATIVE mode-per-band recording model (recorder). When present it
-	* is the single source of truth; the legacy `mode`/`schedules`/`schedule`/
-	* `triggers`/`rules` fields above are kept for READ-COMPAT only and are
-	* derived into bands once via `migrateConfigToBands`.
+	* AUTHORITATIVE mode-per-band recording model — the single source of truth
+	* the recorder's band engine consumes. An empty array = record nothing;
+	* "off" is the absence of a covering band, never a band value.
 	*/
-	bands: array(RecordingBandSchema).optional(),
+	bands: array(RecordingBandSchema).default([]),
 	retention: RecordingRetentionSchema.optional(),
 	/**
 	* Per-camera scrub-thumbnail fidelity preset (resolution + JPEG quality for
@@ -7521,60 +7484,30 @@ var RecordingConfigSchema = object({
 	* windows only — existing sheets are immutable, and each window's index
 	* carries its own tile dims so mixed-preset history renders correctly.
 	*/
-	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
-});
-/** All seven weekdays (0 = Sunday … 6 = Saturday), used when a schedule omits a
-*  weekday filter. */
-var ALL_DAYS = [
-	0,
-	1,
-	2,
-	3,
-	4,
-	5,
-	6
-];
-/** Full-day span used to represent an `always` schedule as a band. The `HHMM`
-*  regex maxes out at 23:59, so a 00:00–23:59 same-day span ≈ all-day (the band
-*  engine treats `end > start` as a normal, non-wrapping span). */
-var ALL_DAY_START = "00:00";
-var ALL_DAY_END = "23:59";
-function bandFromSchedule(schedule, mode, config) {
-	const days = schedule.kind === "timeOfDay" && schedule.days ? schedule.days : [...ALL_DAYS];
-	const start = schedule.kind === "timeOfDay" ? schedule.start : ALL_DAY_START;
-	const end = schedule.kind === "timeOfDay" ? schedule.end : ALL_DAY_END;
-	if (mode === "continuous") return {
-		days,
-		start,
-		end,
-		mode
-	};
-	return {
-		days,
-		start,
-		end,
-		mode,
-		...config.triggers ? { triggers: config.triggers } : {},
-		...config.preBufferSec !== void 0 ? { preBufferSec: config.preBufferSec } : {},
-		...config.postBufferSec !== void 0 ? { postBufferSec: config.postBufferSec } : {}
-	};
-}
-/**
-* One-way migration from the legacy recording-config shape to the authoritative
-* mode-per-band model. Pure (no clock access).
-*
-* - If `config.bands` is present, it is authoritative and returned as-is.
-* - Otherwise the result is derived from the legacy fields: a disabled config or
-*   `mode: 'off'` yields no bands; every legacy schedule maps to one band whose
-*   mode is `continuous` when `config.mode === 'continuous'`, else `events`
-*   (carrying `triggers`/`preBufferSec`/`postBufferSec`).
-*/
-function migrateConfigToBands(config) {
-	if (config.bands) return config.bands;
-	if (!config.enabled || config.mode === "off") return [];
-	const schedules = config.schedules ?? (config.schedule ? [config.schedule] : [{ kind: "always" }]);
-	const bandMode = config.mode === "continuous" ? "continuous" : "events";
-	return schedules.map((schedule) => bandFromSchedule(schedule, bandMode, config));
+	scrubThumbnails: ScrubThumbnailPresetSchema.optional(),
+	/**
+	* OPT-IN thumbnail-strip generation for this camera: every keyframe of the
+	* low recording saved as a JPEG (the fast-drag scrub depth), a derived
+	* cache that eviction reclaims with the footage. Absent/false = no strips
+	* are written and scrub reads exact keyframes at every velocity.
+	*/
+	stripsEnabled: boolean().optional()
+}).strict();
+/**
+* Derive the {@link RecordingStorageModeSchema} summary from the authoritative
+* bands: `continuous` when any band records continuously, `events` when a band
+* exists at all, else `off`. Pure.
+*
+* THE one definition: the recorder stamps `config.mode` with it on save and
+* reports it as the cap's `activeMode`, and the settings UI reads it back to
+* decide which authoring tab a config opens in. Two copies would drift, and the
+* symptom (a status dot disagreeing with what is being recorded) is exactly the
+* bug this field was added to fix.
+*/
+function deriveRecordingMode(config) {
+	if (!config.enabled || config.bands.length === 0) return "off";
+	if (config.bands.some((band) => band.mode === "continuous")) return "continuous";
+	return "events";
 }
 /**
 * Ops-log — the durable, append-only operations audit shared by the
@@ -7594,7 +7527,8 @@ var OpsLogOpSchema = _enum([
 	"prune",
 	"manual-delete",
 	"rescan",
-	"retention-run"
+	"retention-run",
+	"relocate"
 ]);
 /** Why the operation ran. */
 var OpsLogReasonSchema = _enum([
@@ -7633,6 +7567,55 @@ var OpsLogQueryInputSchema = object({
 	limit: number().int().min(1).max(1e3).optional()
 });
 /**
+* Entity-relocation job state (storage entity-routing spec, Phase 4).
+*
+* One shape shared by the recorder's `relocateFootage` (segments + strips) and
+* pipeline-analytics' `relocateMedia` (event media blobs) so the admin Data
+* page renders both movers with one component. Jobs are in-RAM (a restart
+* forgets them — re-running is safe by construction: copy-if-absent, delete
+* after verify) and each completed/failed run also lands one durable ops-log
+* row on the owning addon's surface.
+*/
+var RelocateJobStateSchema = _enum([
+	"running",
+	"done",
+	"failed",
+	"cancelled"
+]);
+var RelocateJobSchema = object({
+	jobId: string(),
+	state: RelocateJobStateSchema,
+	/** Source location — for media relocation this is informational ('*': rows
+	*  move from wherever they are to the target). */
+	fromLocationId: string(),
+	toLocationId: string(),
+	/** Scoped device, or null = every device. */
+	deviceId: number().nullable(),
+	/** What the job moves (owner-addon specific: segments/strips or media). */
+	entities: array(string()),
+	filesMoved: number().int(),
+	bytesMoved: number().int(),
+	/** Total files discovered up front; null while (or when) unknown. */
+	filesTotal: number().int().nullable(),
+	startedAt: number(),
+	finishedAt: number().nullable(),
+	error: string().nullable()
+});
+var RelocateFootageInputSchema = object({
+	deviceId: number().optional(),
+	fromLocationId: string(),
+	toLocationId: string(),
+	entities: array(_enum(["segments", "strips"])).optional(),
+	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
+	*  never allowed to starve live writers. */
+	throttleMbps: number().min(1).max(1e3).optional()
+});
+var RelocateMediaInputSchema = object({
+	deviceId: number().optional(),
+	toLocationId: string(),
+	throttleMbps: number().min(1).max(1e3).optional()
+});
+/**
 * `StorageLocationType` — an addon-declared id that identifies the *kind* of
 * storage a location serves. Defined here (not in `capabilities/storage.cap.ts`)
 * so the persisted record schema and the consumer-facing cap can both consume it
@@ -7682,6 +7665,13 @@ var StorageLocationSchema = object({
 	nodeId: string().optional(),
 	isDefault: boolean().default(false),
 	isSystem: boolean().default(false),
+	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
+	*  for node-local locations it can reach) — never persisted, absent when the
+	*  volume is remote/unreachable. The single capacity truth every UI reads. */
+	capacity: object({
+		totalBytes: number(),
+		availableBytes: number()
+	}).nullable().optional(),
 	createdAt: number(),
 	updatedAt: number()
 });
@@ -7743,16 +7733,23 @@ var StorageLocationDeclarationSchema = object({
 	* Which node root the seeded `<id>:default` instance is placed under on a
 	* FRESH install:
 	* - `'data'` (default) — the node's data dir (`CAMSTACK_DATA` / boot dir),
-	*   the appData volume. Right for small/durable data (backups, logs, models).
+	*   the appData volume. Right for small/durable data (logs, models).
 	* - `'media'` — the dedicated media volume (`CAMSTACK_MEDIA_ROOT`) when that
 	*   env is set, else falls back to the data root. Right for bulky, hot media
 	*   (recordings, event media) that should stay off the appData disk.
+	* - `'backup'` — the dedicated backup volume (`CAMSTACK_BACKUP_ROOT`, default
+	*   `/backups` in the image) so archives live on their own mount rather than
+	*   filling the appData disk. Falls back to the data root when unset.
 	*
 	* Only affects the seeded default's `basePath`; operators can repoint any
 	* location afterwards, and a `defaultsTo` slot inherits its parent's root
 	* regardless of this field. Absent (the common case) is treated as `'data'`.
 	*/
-	defaultRoot: _enum(["data", "media"]).optional()
+	defaultRoot: _enum([
+		"data",
+		"media",
+		"backup"
+	]).optional()
 });
 var DecoderStatsSchema = object({
 	inputFps: number(),
@@ -8790,7 +8787,8 @@ var NcTaxonomyEntrySchema = object({
 	/** Macro/category parent for grouping ('car' → 'vehicle'); null for a top. */
 	parentKind: string().nullable()
 });
-object({
+/** The complete NC picker taxonomy — three grouped buckets. */
+var NcTaxonomySchema = object({
 	videoClasses: array(NcTaxonomyEntrySchema),
 	audioKinds: array(NcTaxonomyEntrySchema),
 	labels: array(NcTaxonomyEntrySchema)
@@ -9450,6 +9448,7 @@ var AccessoryKind = {
 };
 AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
 DeviceFeature.BatteryOperated;
+new Set(["devices", "classes"]);
 /**
 * Shared geometry vocabulary for on-frame shape caps — privacy-mask,
 * motion-zones, and the detection zones/lines editor all speak this one
@@ -9766,12 +9765,60 @@ var NcRuleTargetSchema = object({
 *  - `keyFrame` — the clean scene frame (no subject box).
 *  - `none` — no attachment.
 */
-var NcMediaPolicySchema = object({ attach: _enum([
-	"best",
-	"best-matching",
-	"keyFrame",
-	"none"
-]).default("best") });
+/**
+* WHAT THE PICTURE SHOWS — chosen explicitly, because the implicit ladders
+* conflate it with the selection strategy and betray the request: asking for
+* the clean scene frame on an object-event owner used to start at
+* `fullFrameBoxed`, i.e. the annotated frame (2026-07-30).
+*  - `cropped` — the subject, tight. What "who is at the door" wants.
+*  - `full`    — the clean scene, no annotation. What "what is going on" wants.
+*  - `boxed`   — the scene WITH the detection boxes drawn, for verifying what
+*                the pipeline actually saw.
+*/
+var NcMediaFrameSchema = _enum([
+	"cropped",
+	"full",
+	"boxed"
+]);
+var NcMediaPolicySchema = object({
+	attach: _enum([
+		"best",
+		"best-matching",
+		"keyFrame",
+		"none"
+	]).default("best"),
+	/** What the still shows. Absent = `cropped` (the historical `best` shape). */
+	frame: NcMediaFrameSchema.optional(),
+	/** Crop the attached still to the rule's condition-zone bbox (padded) —
+	*  "show me the ZONE", not the whole scene or the subject crop. */
+	zoneCrop: boolean().optional(),
+	/**
+	* Also attach a short GIF cut from the stream broker's clip ring around the
+	* event — NOT from the recording, so the camera does not have to be
+	* recording, and the window sits AROUND the moment instead of a segment
+	* behind it. Fail-closed: a window the ring does not cover contributes no
+	* gif, never a failed notification.
+	*/
+	gif: boolean().optional(),
+	/**
+	* Also attach a short MP4 CLIP of the same cut. Same source and the same
+	* fail-closed rule as `gif`. Prefer it where the backend takes video
+	* (telegram, discord, zentik, webhook); backends that do not are handled by
+	* the degrade engine, which drops the video and keeps the still.
+	*/
+	clip: boolean().optional(),
+	/** Seconds of footage BEFORE / AFTER the event instant. Defaults 3 / 7. */
+	clipPreRollSec: number().int().min(0).max(30).optional(),
+	clipPostRollSec: number().int().min(0).max(30).optional(),
+	/**
+	* Which stream profile the footage is cut from. Absent = the CHEAPEST
+	* assigned profile: a notification is watched on a phone, so the 4K
+	* rendition would burn CPU to produce a file the client downscales anyway.
+	* A profile that is not assigned falls back to the cheapest, and the render
+	* reports which one actually ran.
+	*/
+	profile: CamProfileSchema.optional()
+});
 /** Throttle — cooldown survives restarts (rebuilt from the outbox on boot). */
 var NcThrottleSchema = object({
 	cooldownSec: number().int().min(0).max(86400).default(60),
@@ -9785,7 +9832,19 @@ var NcRuleInputSchema = object({
 	delivery: NcDeliverySchema,
 	conditions: NcConditionsSchema.default({}),
 	schedule: NcScheduleSchema.optional(),
-	targets: array(NcRuleTargetSchema).min(1),
+	/** May be empty when `targetUsers` addresses at least one user — the
+	*  "at least one addressee" invariant is enforced by the provider, because
+	*  a cross-field refine here would break `NcRulePatchSchema.partial()`. */
+	targets: array(NcRuleTargetSchema),
+	/**
+	* USERS this rule addresses in addition to `targets` (Phase 4). At fire
+	* time each user fans out to the personal targets they own
+	* (`config.ownerUserId`), filtered by that user's `allowedDevices` for the
+	* firing camera — a user is never notified about a device they cannot open.
+	* Per-user opt-outs (`disabledTargetIds`) still apply to the fanned-out
+	* targets.
+	*/
+	targetUsers: array(string()).optional(),
 	media: NcMediaPolicySchema.default({ attach: "best" }),
 	throttle: NcThrottleSchema.default({
 		cooldownSec: 60,
@@ -9998,7 +10057,10 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), object({ results: array(NcTestResultSchema) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), object({ catalog: array(NcConditionDescriptorSchema) })), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" });
+}), method(object({}), object({
+	catalog: array(NcConditionDescriptorSchema),
+	taxonomy: NcTaxonomySchema.optional()
+})), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" });
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -10745,6 +10807,48 @@ var streamBrokerCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* Render a short GIF or MP4 from the broker's PRE-BUFFER around an instant.
+		*
+		* The pre-buffer is the only source that already holds the seconds BEFORE
+		* an event (it is what it exists for — "when an addon needs the last N
+		* seconds of video for clip creation"). Cutting from recorded segments
+		* cannot: only finalized segments are addressable and the one covering the
+		* moment is still being written, so a segment-sourced clip is either
+		* delayed or shows the approach instead of the event (operator,
+		* 2026-07-30). It also means a camera does not have to be RECORDING to
+		* produce a notification clip.
+		*
+		* Returns muxed BYTES, never packets: the frame plane never crosses a
+		* process boundary at frame rate (D9/D18) — this is one compressed,
+		* on-demand payload per notification.
+		*
+		* Waits up to `postRollSec` for the tail to accumulate, so the window is
+		* CENTRED on `aroundMs`.
+		*/
+		renderPreBufferClip: method(object({
+			deviceId: number(),
+			/** Absent = the LOWEST assigned profile — a notification attachment is
+			*  watched on a phone, and the cheap rendition is the right default. */
+			profile: CamProfileSchema.optional(),
+			aroundMs: number(),
+			preRollSec: number().min(0).max(20).default(3),
+			postRollSec: number().min(0).max(20).default(5),
+			format: _enum(["gif", "mp4"]).default("gif"),
+			maxWidth: number().int().min(120).max(1920).default(480),
+			/** GIF only — MP4 keeps the source cadence. */
+			fps: number().int().min(1).max(15).default(5)
+		}), object({
+			base64: string(),
+			mime: string(),
+			bytes: number().int(),
+			/** The profile actually rendered (what the default resolved to). */
+			profile: CamProfileSchema,
+			durationMs: number()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		listAllCameraStreams: method(_void(), array(CameraStreamSchema).readonly()),
 		listAllProfileSlots: method(_void(), array(ProfileSlotSchema).readonly()),
 		getBrokerStats: method(object({ brokerId: string() }), BrokerStatsSchema),
@@ -15691,11 +15795,53 @@ var LocationStatSchema = object({
 	fileCount: number(),
 	present: boolean()
 });
+/**
+* A backup schedule — the N:M "entry" that binds one cron cadence to a
+* SET of destination locations. Supersedes the per-location cron on
+* `BackupDestinationPolicy`: an operator creates a schedule, picks the
+* `backups` locations it should write to, and the orchestrator fans a
+* single archive out to all of them when the cron fires.
+*
+* `retentionCount` is per-schedule (D-decision 2026-07-28): every
+* location targeted by this schedule keeps this many archives from
+* this schedule's runs.
+*
+* `dataSources` optionally narrows which top-level state locations
+* (db, addons, tls, …) are archived; omitted = the orchestrator's
+* default full set.
+*/
+var BackupScheduleSchema = object({
+	/** Stable id. Generated by the orchestrator on first upsert if absent. */
+	id: string(),
+	/** Operator-facing display name. */
+	label: string(),
+	/** 5-field POSIX cron. Empty = disabled cadence (kept for editing). */
+	cron: string(),
+	/** Master on/off toggle for the whole schedule. */
+	enabled: boolean(),
+	/** `backups`-location ids this schedule writes to (fan-out set). */
+	locationIds: array(string()).readonly(),
+	/** Archives kept per targeted location for this schedule. */
+	retentionCount: number().int().min(1).max(1e3),
+	/** Optional subset of source locations to include; omitted = all. */
+	dataSources: array(string()).readonly().optional(),
+	/** ms-epoch of last successful run. */
+	lastRunAt: number().optional(),
+	/** ms-epoch of next computed firing (read-only, filled on list). */
+	nextRunAt: number().optional()
+});
 method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }), method(object({
 	/** Subset of registered `backup-destination` addon ids to write to. */
 	destinations: array(string()).optional(),
 	locations: array(string()).optional(),
-	label: string().optional()
+	label: string().optional(),
+	/**
+	* Per-run retention override applied to every targeted
+	* destination. Used by schedule-driven runs (per-entry
+	* retention). Omitted = each destination's own policy
+	* retention (manual runs).
+	*/
+	retentionCount: number().int().min(1).max(1e3).optional()
 }).optional(), array(BackupEntrySchema).readonly(), {
 	kind: "mutation",
 	auth: "admin"
@@ -15744,7 +15890,21 @@ method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }
 	ok: boolean(),
 	error: string().optional(),
 	nextRuns: array(number()).readonly()
-}));
+})), method(_void(), array(BackupScheduleSchema).readonly(), { auth: "admin" }), method(object({
+	id: string().optional(),
+	label: string(),
+	cron: string(),
+	enabled: boolean(),
+	locationIds: array(string()).readonly(),
+	retentionCount: number().int().min(1).max(1e3),
+	dataSources: array(string()).readonly().optional()
+}), BackupScheduleSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * `broker` — unified pub/sub broker registry, system-scoped collection.
 *
@@ -17863,6 +18023,36 @@ var TargetKindSchema = object({
 	icon: string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: string().optional(),
 	configSchema: ConfigSchemaPassthrough,
 	supportsDiscovery: boolean(),
 	caps: TargetKindCapsSchema
@@ -18594,6 +18784,15 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(object({ deviceId: number() }), EventPruneCountsSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(RelocateMediaInputSchema, object({ jobId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(RelocateJobSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
 	kind: "query",
 	auth: "admin"
@@ -21168,6 +21367,17 @@ var GetConnectionEndpointsResultSchema = object({ endpoints: array(object({
 	*/
 	priority: number()
 })).readonly() });
+/**
+* The chosen outbound endpoint for notification artifacts. `baseUrl: null` =
+* AUTO (resolved from the candidate ranking at send time); `resolved` reports
+* what AUTO currently picks, so the UI can show the effective value either way.
+*/
+var NotificationEndpointSchema = object({
+	/** The operator's explicit choice, or null for AUTO. */
+	baseUrl: string().nullable(),
+	/** What the ranking currently resolves to (null when nothing is reachable). */
+	resolved: string().nullable()
+});
 var AllowedAddressesSchema = object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -21190,7 +21400,7 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*  to avoid mixed-content blocks in the browser. The public
 	*  tunnel always emits `https://` regardless. */
 	scheme: _enum(["http", "https"]).optional()
-}), GetConnectionEndpointsResultSchema), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" });
+}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" });
 /**
 * mesh-network — collection cap for mesh-VPN providers.
 *
@@ -21989,7 +22199,12 @@ var RecordingDeviceUsageSchema = object({
 var RecordingLocationUsageSchema = object({
 	/** StorageLocation id; null for the legacy/degraded single-root fallback. */
 	locationId: string().nullable(),
-	/** Bytes of recordings stored on this location. */
+	/** Every location id sharing this row's PHYSICAL volume (aliases). One row
+	*  is emitted per physical disk (2026-07-29): two locations on one root
+	*  previously rendered as two identical "disks" with a nonsensical used
+	*  split — hydrate attribution across aliases is arbitrary by nature. */
+	locationIds: array(string()).optional(),
+	/** Bytes of recordings stored on this PHYSICAL volume (all aliases). */
 	usedBytes: number(),
 	/** Free bytes on the location's volume; null when capacity is unknown (remote). */
 	availableBytes: number().nullable(),
@@ -22145,6 +22360,77 @@ var recordingCapability = {
 		listOpsLog: method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
 			kind: "query",
 			auth: "admin"
+		}),
+		/**
+		* Move footage (segments and/or strips) from one recordings location to
+		* another — the drain workflow's mover (entity-routing spec Phase 4).
+		* Throttled copy → size-verify → delete source → index refresh; resumable
+		* by construction (copy-if-absent). Single-flight: one job at a time.
+		*/
+		/**
+		* Render a short GIF from recorded footage around `aroundMs` (low profile,
+		* palette-free ffmpeg gif). Synchronous — the window is a few seconds of
+		* `low`, rendering in ~1-2s. Built for notification attachments: the
+		* caller gets bytes, nothing persists. Fails when no footage covers the
+		* window (camera not recording → caller skips the attachment).
+		*/
+		renderGif: method(object({
+			deviceId: number(),
+			aroundMs: number(),
+			preRollSec: number().min(0).max(30).default(2),
+			postRollSec: number().min(0).max(30).default(5),
+			maxWidth: number().int().min(120).max(1280).default(480),
+			fps: number().int().min(1).max(15).default(5)
+		}), object({
+			gifBase64: string(),
+			fromMs: number(),
+			toMs: number()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Render a short MP4 clip from recorded footage around `aroundMs` — the
+		* "send a clip, not a gif" notification attachment. Same window, source
+		* and fail-closed contract as {@link renderGif}: no footage covering the
+		* window ⇒ it throws and the caller ships no attachment. Re-encoded (never
+		* stream-copied) so a concat across segments with different encoder
+		* parameters still plays. Silent by contract.
+		*
+		* The returned window is SEGMENT-GRANULAR: the source playlist is built
+		* from whole segments, so the clip starts at or before `fromMs` and ends
+		* at or after `toMs` — overshoot bounded by one segment per side (an 8 s
+		* ask over 4 s segments measured 12 s). `fromMs`/`toMs` report the window
+		* ASKED for, not the encoded duration.
+		*/
+		renderClip: method(object({
+			deviceId: number(),
+			aroundMs: number(),
+			preRollSec: number().min(0).max(30).default(3),
+			postRollSec: number().min(0).max(30).default(7),
+			maxWidth: number().int().min(160).max(1920).default(640)
+		}), object({
+			clipBase64: string(),
+			mime: string(),
+			fromMs: number(),
+			toMs: number(),
+			bytes: number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		relocateFootage: method(RelocateFootageInputSchema, object({ jobId: string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Every known relocate job (in-RAM, newest-first). */
+		getRelocateStatus: method(object({}), array(RelocateJobSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		cancelRelocate: method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+			kind: "mutation",
+			auth: "admin"
 		})
 	}
 };
@@ -23077,6 +23363,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"backup.deleteSchedule": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"backup.getEntries": {
 		capName: "backup",
 		capScope: "system",
@@ -23107,6 +23399,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"backup.listSchedules": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"backup.previewSchedule": {
 		capName: "backup",
 		capScope: "system",
@@ -23131,6 +23429,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"backup.upsertSchedule": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"battery.wakeForStream": {
 		capName: "battery",
 		capScope: "device",
@@ -24631,6 +24935,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getNotificationEndpoint": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getPreferred": {
 		capName: "local-network",
 		capScope: "system",
@@ -24655,6 +24965,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.setNotificationEndpoint": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -25297,6 +25613,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.cancelMediaRelocate": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.clearTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -25351,6 +25673,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getMediaRelocateStatus": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getMotionEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -25423,6 +25751,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.relocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.searchObjectEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -26185,6 +26519,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.cancelRelocate": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.deleteFootprint": {
 		capName: "recording",
 		capScope: "system",
@@ -26215,6 +26555,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.getRelocateStatus": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.getStorageUsage": {
 		capName: "recording",
 		capScope: "system",
@@ -26245,6 +26591,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.relocateFootage": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"recording.renderClip": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"recording.renderGif": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.rescanStorage": {
 		capName: "recording",
 		capScope: "system",
@@ -26839,6 +27203,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.renderPreBufferClip": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.restartProfile": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -27771,4 +28141,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { selectAssignedProfileSlots as $, motionDetectionCapability as A, errMsg as B, detectionPipelineCapability as C, mapAudioLabelToMacro as D, hfModelUrl as E, runtimeDevices as F, createEvent as G, CAM_PROFILE_ORDER as H, storageEvictableCapability as I, makeProfileBrokerId as J, hydrateSchema as K, streamBrokerCapability as L, pipelineRunnerCapability as M, recordingCapability as N, maskUrlCredentials as O, recordingExportCapability as P, parseProfileBrokerId as Q, supportedRuntimes as R, defineCustomActions as S, evaluateZoneRules as T, DeviceFeature as U, BaseAddon as V, DeviceType as W, nodePin as X, makeSourceBrokerId as Y, parseJsonUnknown as Z, audioAnalysisCapability as _, COCO_TO_MACRO as a, lazy as at, customAction as b, EVENT_PAD_MS as c, object as ct, HF_BASE_URL as d, union as dt, sleep as et, OpsLogEntrySchema as f, EventCategory as ft, addonWidgetsSourceCapability as g, YAMNET_TO_MACRO as h, COCO_80_LABELS as i, discriminatedUnion as it, pipelineExecutorCapability as j, migrateConfigToBands as k, EncodeProfileSchema as l, record as lt, RingBuffer as m, AUDIO_BACKEND_CHOICES as n, array as nt, DEFAULT_AUDIO_ANALYZER_CONFIG as o, literal as ot, RecordingConfigSchema as p, isEvent as q, AUDIO_MACRO_LABELS as r, boolean as rt, DEVICE_BACKEND_TO_FORMAT as s, number as st, APPLE_SA_TO_MACRO as t, _enum as tt, ExportRecordSchema as u, string as ut, audioAnalyzerCapability as v, enumerateInferenceDevices as w, defaultDeviceFor as x, cameraStreamsCapability as y, webrtcSessionCapability as z };
+export { selectAssignedProfileSlots as $, motionDetectionCapability as A, errMsg as B, deriveRecordingMode as C, hfModelUrl as D, evaluateZoneRules as E, runtimeDevices as F, createEvent as G, CAM_PROFILE_ORDER as H, storageEvictableCapability as I, makeProfileBrokerId as J, hydrateSchema as K, streamBrokerCapability as L, pipelineRunnerCapability as M, recordingCapability as N, mapAudioLabelToMacro as O, recordingExportCapability as P, parseProfileBrokerId as Q, supportedRuntimes as R, defineCustomActions as S, enumerateInferenceDevices as T, DeviceFeature as U, BaseAddon as V, DeviceType as W, nodePin as X, makeSourceBrokerId as Y, parseJsonUnknown as Z, audioAnalysisCapability as _, COCO_TO_MACRO as a, lazy as at, customAction as b, EVENT_PAD_MS as c, object as ct, HF_BASE_URL as d, union as dt, sleep as et, OpsLogEntrySchema as f, EventCategory as ft, addonWidgetsSourceCapability as g, YAMNET_TO_MACRO as h, COCO_80_LABELS as i, discriminatedUnion as it, pipelineExecutorCapability as j, maskUrlCredentials as k, EncodeProfileSchema as l, record as lt, RingBuffer as m, AUDIO_BACKEND_CHOICES as n, array as nt, DEFAULT_AUDIO_ANALYZER_CONFIG as o, literal as ot, RecordingConfigSchema as p, isEvent as q, AUDIO_MACRO_LABELS as r, boolean as rt, DEVICE_BACKEND_TO_FORMAT as s, number as st, APPLE_SA_TO_MACRO as t, _enum as tt, ExportRecordSchema as u, string as ut, audioAnalyzerCapability as v, detectionPipelineCapability as w, defaultDeviceFor as x, cameraStreamsCapability as y, webrtcSessionCapability as z };