@camstack/addon-pipeline 1.2.288 → 1.2.291

package/dist/{dist-mEtwupOP.mjs → dist-Bn6BQW8q.mjs}

@@ -5360,7 +5360,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-COWaSCAi.mjs
+//#region ../types/dist/sleep-D_4W7xuQ.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6544,6 +6544,24 @@ function normalizeAddonInitResult(result) {
 	if (Array.isArray(result)) return { providers: result };
 	return result;
 }
+/** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
+var PeerBytesTicketSchema = object({
+	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
+	url: string().min(1),
+	/**
+	* The HOST node this URL means something on — the hub or a named agent,
+	* never a runner. {@link AddonPeerBytes.open} compares it to its own and
+	* refuses `cross-node` by name when they differ, without dialling.
+	*/
+	hostNodeId: string().min(1),
+	expiresAtMs: number().int().nonnegative(),
+	/**
+	* What the producer DECLARED the body to be, when it knows — `null` when it
+	* does not. Never `0` for unknown (D393): a consumer sizing a bound off this
+	* must be able to tell "the producer did not say" from "the body is empty".
+	*/
+	declaredBytes: number().int().nonnegative().nullable()
+});
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = _enum([
 	"high",
@@ -7516,11 +7534,17 @@ var RawStateResultSchema = object({
 method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(object({ deviceId: number() }), array(ConfigEntrySchema$1)), method(object({
 	deviceId: number(),
 	values: record(string(), unknown())
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	deviceId: number(),
 	action: string().min(1),
 	input: unknown()
-}), unknown(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
+}), unknown(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
 /**
 * The ONE retry schedule for work that can fail simply because the node was
 * still booting.
@@ -8740,24 +8764,6 @@ object({
 		unreachable: number()
 	})
 });
-/** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
-var PeerBytesTicketSchema = object({
-	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
-	url: string().min(1),
-	/**
-	* The HOST node this URL means something on — the hub or a named agent,
-	* never a runner. {@link AddonPeerBytes.open} compares it to its own and
-	* refuses `cross-node` by name when they differ, without dialling.
-	*/
-	hostNodeId: string().min(1),
-	expiresAtMs: number().int().nonnegative(),
-	/**
-	* What the producer DECLARED the body to be, when it knows — `null` when it
-	* does not. Never `0` for unknown (D393): a consumer sizing a bound off this
-	* must be able to tell "the producer did not say" from "the body is empty".
-	*/
-	declaredBytes: number().int().nonnegative().nullable()
-});
 /**
 * Adoption job — the background form of `device-adoption.adopt`.
 *
@@ -8869,7 +8875,7 @@ var AdoptionJobSchema = object({
 * component's original options — detection to the detection-pipeline wrapper
 * binding, audio analysis to its own, recording to `RecordingConfig.enabled`
 * (which was always first-class; the switch was a veneer over
-* `recording.setDeviceConfig`), notifications to a notification-center
+* `recordingArchive.setDeviceConfig`), notifications to a notification-center
 * per-device setting, the two camera planes to their own components.
 *
 * What survives is {@link composeSwitchedOff}: `CameraStatus.switchedOff`, the
@@ -8895,7 +8901,7 @@ var AdoptionJobSchema = object({
 * | `stream-broker` | `deviceManager.setDisabled` | `StreamBrokerManager.reconcileAllCatalogs` releases the brokers; `ensureBroker` refuses re-creation |
 * | `object-detection` | `deviceManager.setWrapperActive('detection-pipeline')` | `PipelineSettingsStore.resolvePipelineForDevice` returns `{ steps: [], audio: null }` |
 * | `audio-analysis` | `deviceManager.setWrapperActive('audio-analysis')` | `AudioSubscriptionController.subscribeAudioStream` returns `null` before opening the stream |
-* | `recording` | `recording.setDeviceConfig` → `RecordingConfig.enabled` | `band-decision.shouldRecord` returns false; the controller detaches the device |
+* | `recording` | `recordingArchive.setDeviceConfig` → `RecordingConfig.enabled` | `band-decision.shouldRecord` returns false; the controller detaches the device |
 * | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
 * | `privacy-mask` | `privacyMask.setMask({ enabled })` → the CAMERA | the camera blanks the masked regions itself; every stream and recording carries the black boxes |
 * | `device-audio` | `privacyMask.setAudioEnabled` → the CAMERA | the camera stops encoding an audio track at all; every consumer sees silent video |
@@ -13608,60 +13614,8 @@ method(ListInputSchema, array(BrokerInfoSchema$1)), method(GetInputSchema, Broke
 }), method(UnsubscribeInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(GetStateInputSchema, unknown().nullable()), method(_void(), RegistryStatusSchema);
+}), method(GetStateInputSchema, unknown().nullable(), { auth: "admin" }), method(_void(), RegistryStatusSchema);
 DeviceType.Camera;
-/**
-* The signals a device can emit to WAKE its own stream.
-*
-* A camera whose stream is built on demand sleeps until something asks for it,
-* and "something" cannot be a consumer that is merely attached — a Frigate-style
-* puller holds a session open for ever, and treating that as demand would keep
-* a battery camera awake for ever, which is the whole thing the battery is for
-* (D173). So the wake has to come from the CAMERA: an event it noticed by
-* itself, with no stream running.
-*
-* ## The vocabulary is the PROVIDER'S, not ours
-*
-* Like `consumables`, this cap declares no vocabulary of its own. A provider
-* names each signal with a `code` it chooses and a `label` an operator reads.
-* Reolink offers motion and camera-native detection; another provider may offer
-* a tamper, a doorbell press, a PIR, or something no camera in this fleet has
-* yet. A fixed enum here would mean every new signal is a framework release.
-*
-* It is deliberately NOT derived from the caps a device already binds. Whether
-* a camera CAN push firmware motion is expressed by `motionSources` containing
-* `'onboard'`, and whether it does AI on-camera by the `native-object-detection`
-* binding — but both answer "what drives the detection pipeline", which is a
-* different question from "what may wake a sleeping stream". A camera can do
-* the first and not be trusted with the second, and the operator picks per
-* camera. Two questions, two authorities.
-*
-* ## Availability is not permission
-*
-* `listSignals` says what the device CAN emit. Whether a given signal actually
-* wakes the stream is the operator's per-camera choice, held by the broker
-* alongside the cooldown — see the stream-broker cap's wake settings. A
-* provider declaring a signal is not a provider enabling it.
-*/
-/** One signal a device can emit. */
-var StreamSignalSchema = object({
-	/** Stable id chosen by the provider, e.g. `'motion'`, `'person'`, `'tamper'`. */
-	code: string().min(1),
-	/** What an operator reads in the picker. The provider's own wording. */
-	label: string().min(1),
-	/**
-	* Whether the provider recommends this signal ON when a camera is first set
-	* up. A provider knows which of its signals are cheap and reliable; an
-	* operator should not have to discover that by trial. Reolink recommends
-	* both of its own.
-	*/
-	recommended: boolean()
-});
-object({
-	signals: array(StreamSignalSchema),
-	lastFetchedAt: number()
-});
-Object.values(DeviceType), method(_void(), array(StreamSignalSchema).readonly());
 /** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
 var StreamFormatSchema = _enum([
 	"webrtc",
@@ -15095,17 +15049,20 @@ method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string()
-}), unknown()), method(object({
+}), unknown(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string(),
 	value: unknown()
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: QueryFilterSchema.optional(),
 	columns: array(string()).readonly().optional()
-}), array(SettingsRecordSchema).readonly()), method(object({
+}), array(SettingsRecordSchema).readonly(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	/** Declared columns identifying the slot; must be covered by a UNIQUE
@@ -15115,7 +15072,10 @@ method(object({
 }), object({ 
 /** The id the row HAS: assigned by SQLite on an insert, or the existing
 *  row's own id on an update. */
-id: union([string(), number()]) }), { kind: "mutation" }), method(object({
+id: union([string(), number()]) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	record: object({
@@ -15128,38 +15088,56 @@ id: union([string(), number()]) }), { kind: "mutation" }), method(object({
 * for an absent one, or the ROWID SQLite assigned on an `INTEGER`
 * primary key — which is the only place an auto key is knowable.
 */
-id: union([string(), number()]) }), { kind: "mutation" }), method(object({
+id: union([string(), number()]) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	records: array(BulkRecordSchema).readonly()
-}), object({ inserted: number().int() }), { kind: "mutation" }), method(object({
+}), object({ inserted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	id: string(),
 	data: record(string(), unknown())
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string()
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: MutationFilterSchema
-}), object({ deleted: number().int() }), { kind: "mutation" }), method(object({
+}), object({ deleted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: MutationFilterSchema,
 	data: record(string(), unknown())
-}), object({ updated: number().int() }), { kind: "mutation" }), method(object({
+}), object({ updated: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: QueryFilterSchema.optional()
-}), number()), method(object({
+}), number(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	fields: array(AggregateFieldSchema).readonly(),
 	filter: QueryFilterSchema.optional()
-}), AggregateResultSchema), method(object({
+}), AggregateResultSchema, { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	field: string(),
@@ -15169,15 +15147,18 @@ id: union([string(), number()]) }), { kind: "mutation" }), method(object({
 }), array(object({
 	bucket: number().int(),
 	count: number().int()
-})).readonly()), method(object({
+})).readonly(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string()
-}), boolean()), method(object({
+}), boolean(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	columns: array(CollectionColumnSchema).readonly(),
 	indexes: array(CollectionIndexSchema).readonly().optional()
-}), _void(), { kind: "mutation" });
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * What one engine says about itself. The orchestrator uses `kind` to pick
 * a registrant for a collection; `engineId` is what a log line names when
@@ -15410,6 +15391,97 @@ var detectionPipelineCapability = {
 	methods: {}
 };
 /**
+* device-admin-link — "this device has a management page of its own, and here
+* is its address".
+*
+* ## Why this is not a `deviceConfig` cap
+*
+* There is nothing to edit. A `deviceConfig` cap (D14) exists so the framework
+* can DERIVE a settings form from `getOptions` + `getStatus` and route a flat
+* patch back through a setter; it costs a `builderId` reducer in
+* `device-config-contribution.ts` and a `*-config-schema.ts` beside it, and it
+* renders a form section. This cap answers ONE question with ONE read and
+* renders a button. Nothing about it is a form, so it carries no `deviceConfig`
+* block, no `settings`, no `runtimeState` and no reducer — exactly like
+* `reboot`, the other pure-RPC device-native cap.
+*
+* ## Absent, and the difference between "no page" and "we cannot say"
+*
+* The two are answered at DIFFERENT layers, on purpose:
+*
+*  - **"We cannot say"** → the provider never registers the cap for that
+*    device. A VeSync humidifier, a Petkit feeder, a Dreame vacuum and a Dreo
+*    fan are reached only through a vendor cloud; there is no address to hand
+*    out and no page to open. A Tuya plug, a Wyze camera and a Gree air
+*    conditioner DO have a LAN IP, and still have no HTTP management page
+*    behind it. None of them register, so `deviceManager.getBindings` never
+*    lists the cap and no surface asks.
+*  - **"This device has no page, and I know that"** → the provider registers
+*    and `getAdminLink` returns `null`. This is the answer for a device whose
+*    sibling DOES have a page: a Reolink battery camera reached over UDP by
+*    `uid` with a blank `host`, an Ecowitt gateway configured in `listener`
+*    transport, a Home Assistant broker authenticated by supervisor token
+*    (which carries no `baseUrl` at all).
+*
+* Both draw NOTHING. A button that opens a browser error is worse than no
+* button, and D62 is the same rule from the other side: an off switch is
+* reported off, never made to look broken. There is no third state where the
+* UI renders a disabled button "because the device might have a page".
+*
+* ## The URL never carries credentials
+*
+* Not in userinfo, not in a query string. Every provider builds through
+* `buildDeviceAdminUrl` (`device-admin-link-url.ts`), which takes host, port,
+* scheme and path as separate arguments — there is no parameter a secret could
+* arrive in — and re-checks its own output for the `scheme://user:pass@` shape
+* that `scripts/check-no-credential-urls-in-fixtures.ts` bans from recorded
+* output. `scripts/check-admin-link-builder-is-the-only-url-source.ts` is what
+* keeps providers from hand-rolling one anyway.
+*
+* This matters here more than anywhere else in the repo, because every provider
+* that knows a device's host knows its PASSWORD too: `{ host, port, username,
+* password }` sit in one object on Hikvision, Amcrest, Reolink and ONVIF alike,
+* and `http://admin:hunter2@192.168.50.139/` is a URL a browser accepts. The
+* camera's own page will ask for its own login. That is correct, and pre-
+* filling it is the operator's business, not ours.
+*
+* ## It is a LAN fact
+*
+* The URL addresses the device where the NODE can see it. It is not proxied,
+* not made reachable from outside, and not sent anywhere. A surface renders it
+* as a link the operator's own browser follows, on the operator's own network,
+* or renders nothing.
+*/
+/**
+* Whose page is it. The distinction is for the OPERATOR, who needs to know
+* before clicking whether he is about to land on a camera's own web server or
+* inside Home Assistant.
+*/
+var AdminLinkTargetEnum = _enum(["device", "integration"]);
+var DeviceAdminLinkSchema = object({
+	/**
+	* Absolute `http(s)://` URL. Built by `buildDeviceAdminUrl` and therefore
+	* free of userinfo and of any credential-shaped query key.
+	*/
+	url: string(),
+	/**
+	* What the surface calls it — "Web UI", "Home Assistant", "UniFi controller".
+	* The PROVIDER names it, because only the provider knows what the page is;
+	* a UI that invented the label from the addon id would call the Home
+	* Assistant device page "Provider Homeassistant".
+	*/
+	label: string(),
+	target: AdminLinkTargetEnum,
+	/**
+	* Host the URL points at, without scheme, port or path — for the tooltip, so
+	* an operator can see WHERE the button goes before he follows it. Redundant
+	* with `url` by construction; carried separately so no surface has to parse
+	* a URL to show it.
+	*/
+	host: string()
+});
+method(object({ deviceId: number().int().nonnegative() }), DeviceAdminLinkSchema.nullable(), { auth: "admin" });
+/**
 * Identity envelope for a device's upstream-system metadata.
 *
 * Two jobs:
@@ -15737,97 +15809,6 @@ method(object({ integrationId: string() }), object({ filters: array(AdoptionFilt
 	auth: "admin"
 });
 /**
-* device-admin-link — "this device has a management page of its own, and here
-* is its address".
-*
-* ## Why this is not a `deviceConfig` cap
-*
-* There is nothing to edit. A `deviceConfig` cap (D14) exists so the framework
-* can DERIVE a settings form from `getOptions` + `getStatus` and route a flat
-* patch back through a setter; it costs a `builderId` reducer in
-* `device-config-contribution.ts` and a `*-config-schema.ts` beside it, and it
-* renders a form section. This cap answers ONE question with ONE read and
-* renders a button. Nothing about it is a form, so it carries no `deviceConfig`
-* block, no `settings`, no `runtimeState` and no reducer — exactly like
-* `reboot`, the other pure-RPC device-native cap.
-*
-* ## Absent, and the difference between "no page" and "we cannot say"
-*
-* The two are answered at DIFFERENT layers, on purpose:
-*
-*  - **"We cannot say"** → the provider never registers the cap for that
-*    device. A VeSync humidifier, a Petkit feeder, a Dreame vacuum and a Dreo
-*    fan are reached only through a vendor cloud; there is no address to hand
-*    out and no page to open. A Tuya plug, a Wyze camera and a Gree air
-*    conditioner DO have a LAN IP, and still have no HTTP management page
-*    behind it. None of them register, so `deviceManager.getBindings` never
-*    lists the cap and no surface asks.
-*  - **"This device has no page, and I know that"** → the provider registers
-*    and `getAdminLink` returns `null`. This is the answer for a device whose
-*    sibling DOES have a page: a Reolink battery camera reached over UDP by
-*    `uid` with a blank `host`, an Ecowitt gateway configured in `listener`
-*    transport, a Home Assistant broker authenticated by supervisor token
-*    (which carries no `baseUrl` at all).
-*
-* Both draw NOTHING. A button that opens a browser error is worse than no
-* button, and D62 is the same rule from the other side: an off switch is
-* reported off, never made to look broken. There is no third state where the
-* UI renders a disabled button "because the device might have a page".
-*
-* ## The URL never carries credentials
-*
-* Not in userinfo, not in a query string. Every provider builds through
-* `buildDeviceAdminUrl` (`device-admin-link-url.ts`), which takes host, port,
-* scheme and path as separate arguments — there is no parameter a secret could
-* arrive in — and re-checks its own output for the `scheme://user:pass@` shape
-* that `scripts/check-no-credential-urls-in-fixtures.ts` bans from recorded
-* output. `scripts/check-admin-link-builder-is-the-only-url-source.ts` is what
-* keeps providers from hand-rolling one anyway.
-*
-* This matters here more than anywhere else in the repo, because every provider
-* that knows a device's host knows its PASSWORD too: `{ host, port, username,
-* password }` sit in one object on Hikvision, Amcrest, Reolink and ONVIF alike,
-* and `http://admin:hunter2@192.168.50.139/` is a URL a browser accepts. The
-* camera's own page will ask for its own login. That is correct, and pre-
-* filling it is the operator's business, not ours.
-*
-* ## It is a LAN fact
-*
-* The URL addresses the device where the NODE can see it. It is not proxied,
-* not made reachable from outside, and not sent anywhere. A surface renders it
-* as a link the operator's own browser follows, on the operator's own network,
-* or renders nothing.
-*/
-/**
-* Whose page is it. The distinction is for the OPERATOR, who needs to know
-* before clicking whether he is about to land on a camera's own web server or
-* inside Home Assistant.
-*/
-var AdminLinkTargetEnum = _enum(["device", "integration"]);
-var DeviceAdminLinkSchema = object({
-	/**
-	* Absolute `http(s)://` URL. Built by `buildDeviceAdminUrl` and therefore
-	* free of userinfo and of any credential-shaped query key.
-	*/
-	url: string(),
-	/**
-	* What the surface calls it — "Web UI", "Home Assistant", "UniFi controller".
-	* The PROVIDER names it, because only the provider knows what the page is;
-	* a UI that invented the label from the addon id would call the Home
-	* Assistant device page "Provider Homeassistant".
-	*/
-	label: string(),
-	target: AdminLinkTargetEnum,
-	/**
-	* Host the URL points at, without scheme, port or path — for the tooltip, so
-	* an operator can see WHERE the button goes before he follows it. Redundant
-	* with `url` by construction; carried separately so no surface has to parse
-	* a URL to show it.
-	*/
-	host: string()
-});
-method(object({ deviceId: number().int().nonnegative() }), DeviceAdminLinkSchema.nullable(), { auth: "admin" });
-/**
 * `device-export` — collection cap for addons that export camstack
 * devices to external ecosystems (HomeAssistant via MQTT discovery,
 * HomeKit/HAP, Alexa Smart Home, …).
@@ -15892,7 +15873,13 @@ var ExposeInputSchema = object({
 	capabilities: array(string()).optional()
 });
 var UnexposeInputSchema = object({ deviceId: string() });
-method(_void(), DeviceExportStatusSchema), method(_void(), array(DeviceKindSchema)), method(_void(), array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), { kind: "mutation" }), method(UnexposeInputSchema, _void(), { kind: "mutation" });
+method(_void(), DeviceExportStatusSchema), method(_void(), array(DeviceKindSchema)), method(_void(), array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(UnexposeInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /** Wire/storage schema for one icon id. */
 var LocationIconIdSchema = _enum([
 	"map-pin",
@@ -16396,7 +16383,10 @@ method(object({
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 12 * 6e4
-}), method(DeviceRegisterPayloadSchema, _void(), { kind: "mutation" }), method(DeviceRemovePayloadSchema, _void(), { kind: "mutation" }), method(DevicePersistConfigPayloadSchema, _void(), { kind: "mutation" }), method(object({ deviceId: number() }), record(string(), unknown())), method(object({ deviceId: number() }), record(string(), unknown())), method(object({ deviceId: number() }), DeviceMetaSchema.nullable()), method(object({
+}), method(DeviceRegisterPayloadSchema, _void(), { kind: "mutation" }), method(DeviceRemovePayloadSchema, _void(), { kind: "mutation" }), method(DevicePersistConfigPayloadSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number() }), record(string(), unknown()), { auth: "admin" }), method(object({ deviceId: number() }), record(string(), unknown()), { auth: "admin" }), method(object({ deviceId: number() }), DeviceMetaSchema.nullable()), method(object({
 	deviceId: number(),
 	name: string()
 }), _void(), {
@@ -16601,7 +16591,7 @@ method(object({
 }), method(object({ deviceId: number() }), array(StreamProbeResultSchema), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceId: number() }), DeviceBindingsForDeviceSchema), method(object({ deviceIds: array(number()) }), array(DeviceBindingsForDeviceSchema)), method(object({}), array(DeviceBindingsForDeviceSchema)), method(object({
+}), method(object({ deviceId: number() }), DeviceBindingsForDeviceSchema), method(object({ deviceIds: array(number()) }), array(DeviceBindingsForDeviceSchema)), method(object({}), array(DeviceBindingsForDeviceSchema)), method(object({ capNames: array(string().min(1)).min(1).max(16) }), array(number())), method(object({
 	deviceId: number(),
 	capName: string(),
 	wrapperAddonId: string(),
@@ -18219,7 +18209,22 @@ var StatusSchema = object({
 	brokerCount: number(),
 	embeddedRunning: boolean()
 });
-method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema), method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(IdInputSchema, TestResultSchema$1, { kind: "mutation" }), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(_void(), StatusSchema);
+method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }), method(AddBrokerInputSchema, AddBrokerResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(IdInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(IdInputSchema, TestResultSchema$1, {
+	kind: "mutation",
+	auth: "admin"
+}), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(IdInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), StatusSchema);
 var NetworkEndpointSchema = object({
 	url: string(),
 	hostname: string(),
@@ -18514,6 +18519,18 @@ var TargetKindSchema = object({
 	*/
 	iconMediaType: string().optional(),
 	configSchema: ConfigSchemaPassthrough,
+	/**
+	* The config keys that decide WHERE this kind's secrets are sent (server,
+	* base URL, instance, chat, recipient). A save that changes any of them
+	* while leaving a secret redacted is refused by the provider (D634), so an
+	* editor uses this to ask for the secret on exactly those edits instead of
+	* on every edit.
+	*
+	* Optional: absent from a provider that holds no secret (the Home Assistant
+	* kinds) and from a provider older than this field — an editor that finds
+	* it absent must assume ANY edit may need the secret.
+	*/
+	destinationKeys: array(string()).optional(),
 	supportsDiscovery: boolean(),
 	caps: TargetKindCapsSchema
 });
@@ -18552,19 +18569,34 @@ var SendResultSchema = object({
 });
 /** Same shape as SendResult — kept as a distinct name for the test panel. */
 var TestResultSchema = SendResultSchema;
-method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema)), method(object({
+method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema), { auth: "admin" }), method(object({
 	kind: string(),
 	config: record(string(), unknown()).optional()
-}), array(DiscoveredTargetSchema)), method(object({
+}), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
 	targetId: string(),
 	notification: NotificationSchema
-}), SendResultSchema, { kind: "mutation" }), method(object({
+}), SendResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	targetId: string(),
 	sample: NotificationSchema.optional()
-}), TestResultSchema, { kind: "mutation" }), method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }), method(object({ targetId: string() }), _void(), { kind: "mutation" }), method(object({
+}), TestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ target: TargetSchema }), TargetSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ targetId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	targetId: string(),
 	enabled: boolean()
-}), _void(), { kind: "mutation" });
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 var COCO_80_LABELS = [
 	{
 		id: "person",
@@ -19411,6 +19443,7 @@ sub("presence", "sensor", "sensor", "#22c55e", "presence", "Presence");
 sub("enum-sensor", "sensor", "sensor", TAXONOMY_COLORS.sensor, "generic", "Sensor state");
 sub("device-event", "sensor", "sensor", "#10b981", "button", "Device event");
 sub("lock", "control", "control", "#0ea5e9", "lock", "Lock");
+sub("cover", "control", "control", "#0ea5e9", "door", "Cover");
 sub("switch", "control", "control", TAXONOMY_COLORS.control, "switch", "Switch");
 sub("siren", "control", "control", "#dc2626", "siren", "Siren");
 sub("button", "control", "control", "#10b981", "button", "Button");
@@ -19691,6 +19724,10 @@ var NcSystemEventKindSchema = _enum([
 	"alarm-disarmed",
 	"alarm-arming",
 	"alarm-arm-refused",
+	"alarm-pending",
+	"alarm-rearmed",
+	"alarm-sensor-bypass",
+	"alarm-check-failed",
 	"addon-updated",
 	"server-updated",
 	"export-completed",
@@ -19728,6 +19765,19 @@ var NcSystemEventConditionSchema = object({
 	* does not carry) matches no `deviceTypes` list.
 	*/
 	deviceTypes: array(string().min(1)).min(1).optional(),
+	/**
+	* Devices this rule NEVER speaks about, whatever else matched. Scoped to the
+	* same kind family as `deviceIds` (`systemEventFilterApplies(kind,
+	* 'deviceIds')`) and applied AFTER it: include first, then exclude. A
+	* consumable subject (`consumable:<id>:<key>`) is excluded by its device id.
+	*
+	* It never fails closed: a subject that carries no device id is not in the
+	* list, so it is not excluded. "Every battery except the one thermometer that
+	* reads 0 % forever" is the question this answers — expressed as an include
+	* list it would have to name every other battery device, and every device
+	* adopted later would be silently left out (D636).
+	*/
+	excludeDeviceIds: array(number().int()).min(1).optional(),
 	nodeIds: array(string().min(1)).min(1).optional(),
 	packageNames: array(string().min(1)).min(1).optional()
 });
@@ -20286,6 +20336,19 @@ var NcMediaFrameSchema = _enum([
 	"full",
 	"boxed"
 ]);
+/**
+* How a SENSOR notification shows the cameras that link the sensor.
+*
+* `mosaic` — one image composed of every linked camera's photograph, taken at
+* the trigger. `each` — one image per camera where the target takes several
+* attachments; a target that takes one keeps the first camera's (the degrade
+* engine drops the rest by order). Either way ONE notification per event.
+* Absent = `mosaic`, applied by the Notification Center and deliberately NOT
+* a Zod default (see NcRulePatchSchema: a default materialises on every
+* partial patch). Meaningless for a rule whose subject is not a sensor, and a
+* sensor linked to one camera ships that camera's plain snapshot either way.
+*/
+var NcLinkedCameraModeSchema = _enum(["mosaic", "each"]);
 var NcMediaPolicySchema = object({
 	attach: _enum([
 		"best",
@@ -20331,7 +20394,9 @@ var NcMediaPolicySchema = object({
 	* A profile that is not assigned falls back to the cheapest, and the render
 	* reports which one actually ran.
 	*/
-	profile: CamProfileSchema.optional()
+	profile: CamProfileSchema.optional(),
+	/** See {@link NcLinkedCameraModeSchema}. */
+	linkedCameras: NcLinkedCameraModeSchema.optional()
 });
 /**
 * Cooldown GRANULARITY over the subject's class — how much a fired
@@ -20451,7 +20516,7 @@ var NcRuleInputSchema = object({
 		cooldownSec: 60,
 		scope: "rule-device"
 	}),
-	/** `{{var}}` templating over camera/class/label/zones/confidence/time. */
+	/** `{{var}}` title/body. The variables are declared in `NC_TEMPLATE_VARS` (@camstack/types) and depend on the rule kind — see `templateVarsFor`. */
 	template: object({
 		title: string().max(500).optional(),
 		body: string().max(2e3).optional()
@@ -20631,6 +20696,22 @@ var NcRulePatchSchema = NcRuleInputSchema.partial().extend({
 	throttle: NcThrottleSchema.optional(),
 	priority: number().int().min(1).max(5).optional()
 });
+var NcRuleClearableKeySchema = _enum([
+	"template",
+	"schedule",
+	"targetUsers",
+	"snoozeOptions",
+	"snoozeAllowGlobal",
+	"waitForEnhancement",
+	"actions",
+	"confirm",
+	"groupIdleSec"
+]);
+var NcRuleUpdateInputSchema = object({
+	ruleId: string(),
+	patch: NcRulePatchSchema,
+	clear: array(NcRuleClearableKeySchema).optional()
+});
 /** A persisted rule. */
 var NcRuleSchema = NcRuleInputSchema.extend({
 	id: string(),
@@ -20662,6 +20743,85 @@ var NcTestResultSchema = object({
 	className: string().optional(),
 	label: string().optional()
 });
+/** The five rule kinds, as data. `NcRuleKind` in `notification/rule-kinds.ts`
+*  is the same union; the template-vars spec pins the two together. */
+var NcRuleKindSchema = _enum([
+	"detection",
+	"sensor",
+	"occupancy",
+	"sound",
+	"system"
+]);
+/** Which producer renders a template: an ordinary rule, a timelapse, a digest. */
+var NcTemplateFamilySchema = _enum([
+	"rule",
+	"timelapse",
+	"summary"
+]);
+/** Which text field of that producer. `previewText` is the timelapse frame
+*  caption, `captionText` the digest mosaic caption — both see fewer vars. */
+var NcTemplateFieldSchema = _enum([
+	"title",
+	"body",
+	"previewText",
+	"captionText"
+]);
+var NcTemplateVarGroupSchema = _enum([
+	"subject",
+	"place",
+	"time",
+	"rule",
+	"occupancy",
+	"sound",
+	"sensor",
+	"system",
+	"digest",
+	"ai"
+]);
+/**
+* ONE `{{var}}` a notification template may name.
+*
+* `families` / `fields` / `kinds` / `deliveries` / `systemEventKinds` say WHERE
+* it has a value; absent = no restriction on that axis. `systemEventKinds` is
+* read only for a `system` rule. `dynamic` declares a FAMILY of names
+* (`count_<class>`): the descriptor's `name` is the example member.
+*/
+var NcTemplateVarDescriptorSchema = object({
+	name: string().regex(/^\w+$/),
+	label: string(),
+	description: string().optional(),
+	example: string(),
+	group: NcTemplateVarGroupSchema,
+	families: array(NcTemplateFamilySchema).min(1),
+	fields: array(NcTemplateFieldSchema).optional(),
+	kinds: array(NcRuleKindSchema).optional(),
+	deliveries: array(NcDeliverySchema).optional(),
+	systemEventKinds: array(NcSystemEventKindSchema).optional(),
+	dynamic: object({
+		prefix: literal("count_"),
+		from: literal("classes")
+	}).optional()
+});
+/** Input to `previewTemplate` — the editor's own context, plus the draft text. */
+var NcTemplatePreviewInputSchema = object({
+	context: object({
+		family: NcTemplateFamilySchema,
+		field: NcTemplateFieldSchema,
+		kind: NcRuleKindSchema.optional(),
+		delivery: NcDeliverySchema.optional(),
+		systemEventKinds: array(NcSystemEventKindSchema).optional()
+	}),
+	template: object({
+		title: string().max(500).optional(),
+		body: string().max(2e3).optional()
+	})
+});
+var NcTemplatePreviewSchema = object({
+	title: string().nullable(),
+	body: string().nullable(),
+	/** Names the template uses that this context never fills — they render empty. */
+	unknown: array(string())
+});
 var NcConditionDescriptorSchema = object({
 	/** Field id inside `NcConditions` (or `'schedule'` for the rule-level group). */
 	id: string(),
@@ -20927,8 +21087,17 @@ object({
 	lastAt: number()
 });
 /**
-* The three durations the panel's state machine runs on, plus who hears about
-* an arm.
+* The per-mode lists, at most one per mode. Two lists for one mode have no
+* meaning a reader could agree on (union? the last one?), so they are refused
+* at the boundary rather than interpreted.
+*/
+var NcAlarmNonBlockingListSchema = array(object({
+	mode: AlarmArmModeSchema,
+	deviceIds: array(number().int()).max(200)
+})).max(8).refine((lists) => new Set(lists.map((l) => l.mode)).size === lists.length, { message: "nonBlocking: at most one list per arm mode" });
+/**
+* The three durations the panel's state machine runs on, who hears about its
+* transitions, and which openings each mode tolerates.
 *
 * They live on the NOTIFICATION-RULES cap, not on `alarm-panel`, on purpose:
 * `alarm-panel` is `deviceNative` and its other provider mirrors somebody
@@ -20947,21 +21116,39 @@ var NcAlarmSettingsSchema = object({
 	* existed, and therefore what an untouched install keeps doing.
 	*/
 	triggeredDurationSec: number().int().min(0).max(3600),
-	/** Send a notification when a mode takes effect. */
-	announceArm: boolean(),
 	/**
-	* Where that notification goes. Target ids from `notification-output`.
+	* Deprecated by D630 — every transition is announced. Parsed, never read;
+	* remove after one release. Optional so an older admin's patch (which still
+	* sends it) parses rather than failing the whole save.
+	*/
+	announceArm: boolean().optional(),
+	/**
+	* Target ids from `notification-output`: every alarm transition goes here.
 	*
-	* Explicit rather than "everyone": an arm announcement is a household
+	* Explicit rather than "everyone": an alarm announcement is a household
 	* message, and broadcasting it to every configured endpoint (including a
 	* webhook wired to something else) is not a default anybody would choose.
-	* Empty with `announceArm: true` sends nothing, and the server logs that —
-	* silence must be attributable.
+	* Empty sends nothing, and the server logs that — silence must be
+	* attributable.
+	*/
+	announceTargets: array(string().min(1)).max(16),
+	/**
+	* Per arm mode, the covered devices whose being OPEN does not refuse the
+	* arm (a window left ajar for the cat under `home`, say). At most one entry
+	* per mode is meaningful. Defaulted to `[]` so a blob stored before D630
+	* parses as "every opening blocks" — the behaviour it was written under.
 	*/
-	announceTargets: array(string().min(1)).max(16)
+	nonBlocking: NcAlarmNonBlockingListSchema.default([])
 });
-/** Every field optional — a tab edits one control at a time. */
-var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.partial();
+/**
+* Every field optional — a tab edits one control at a time.
+*
+* `nonBlocking` is re-declared WITHOUT its default: `.partial()` does not
+* remove an inner `.default()`, so a patch that never named the field would
+* parse to `nonBlocking: []` and wipe every mode's list on an unrelated edit
+* (the same trap {@link NcRulePatchSchema} documents).
+*/
+var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.extend({ nonBlocking: NcAlarmNonBlockingListSchema }).partial();
 /**
 * What one arm mode actually arms, DERIVED from the enabled rules gated on it.
 * Never authored, never stored — see `alarm-mode-coverage.ts` for why a stored
@@ -21006,6 +21193,36 @@ var NcAlarmModeCoverageSchema = object({
 	*/
 	skippedDevices: array(NcAlarmSkippedDeviceSchema).default([])
 });
+/** One covered device that reads open, and whether that refuses the arm. */
+var NcAlarmOpeningSchema = object({
+	deviceId: number().int(),
+	name: string(),
+	/** The device's state word as read (`open`, `unlocked`, …). */
+	state: string(),
+	/** False when the mode's non-blocking list names this device. */
+	blocking: boolean()
+});
+/** A device the panel is currently ignoring, and which side of it it is on. */
+var NcAlarmExclusionViewSchema = object({
+	deviceId: number().int(),
+	name: string(),
+	phase: _enum(["open", "closed"])
+});
+/** One mode's openings: devices read open, plus those whose state is unknown. */
+var NcAlarmModeOpeningsSchema = object({
+	mode: AlarmArmModeSchema,
+	devices: array(NcAlarmOpeningSchema),
+	/** Covered devices whose state could not be read (D49): neither open nor closed. */
+	unknown: array(number().int())
+});
+var NcAlarmLiveSchema = object({
+	state: AlarmStateSchema,
+	/** The mode being armed into (exit delay) or held; null when disarmed. */
+	targetMode: AlarmArmModeSchema.nullable(),
+	availableModes: array(AlarmArmModeSchema),
+	openings: array(NcAlarmModeOpeningsSchema),
+	exclusions: array(NcAlarmExclusionViewSchema)
+});
 var NcAlarmConfigSchema = object({
 	/**
 	* The panel's device id, or null when this install has no panel (the ensure
@@ -21015,7 +21232,13 @@ var NcAlarmConfigSchema = object({
 	*/
 	deviceId: number().int().nullable(),
 	settings: NcAlarmSettingsSchema,
-	coverage: array(NcAlarmModeCoverageSchema)
+	coverage: array(NcAlarmModeCoverageSchema),
+	/**
+	* The panel as it is NOW — state, what each mode would find open, what is
+	* excluded. Optional: a panel-less hub answers without it, and a client
+	* must not read its absence as "nothing is open".
+	*/
+	live: NcAlarmLiveSchema.optional()
 });
 /**
 * ONE rule's demand on ONE camera's clip ring.
@@ -21063,10 +21286,7 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 	kind: "mutation",
 	auth: "admin",
 	caller: "required"
-}), method(object({
-	ruleId: string(),
-	patch: NcRulePatchSchema
-}), object({ rule: NcRuleSchema }), {
+}), method(NcRuleUpdateInputSchema, object({ rule: NcRuleSchema }), {
 	kind: "mutation",
 	auth: "admin",
 	caller: "required"
@@ -21094,7 +21314,10 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), method(object({}), object({
 	catalog: array(NcConditionDescriptorSchema),
 	taxonomy: NcTaxonomySchema.optional()
-})), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" }), method(object({ artifactId: string().min(1) }), object({ url: string().nullable() }), { auth: "admin" }), method(object({}), object({ snoozes: array(NcSnoozeSchema) }), { caller: "required" }), method(object({ snooze: NcSnoozeInputSchema }), object({ snooze: NcSnoozeSchema }), {
+})), method(object({}), object({ vars: array(NcTemplateVarDescriptorSchema) })), method(NcTemplatePreviewInputSchema, NcTemplatePreviewSchema, {
+	kind: "mutation",
+	access: "view"
+}), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" }), method(object({ artifactId: string().min(1) }), object({ url: string().nullable() }), { auth: "admin" }), method(object({}), object({ snoozes: array(NcSnoozeSchema) }), { caller: "required" }), method(object({ snooze: NcSnoozeInputSchema }), object({ snooze: NcSnoozeSchema }), {
 	kind: "mutation",
 	caller: "required"
 }), method(object({ snoozeId: string() }), object({ success: literal(true) }), {
@@ -25903,6 +26126,7 @@ var CAP_TO_KIND = {
 	"enum-sensor": "enum-sensor",
 	"event-emitter": "device-event",
 	"lock-control": "lock",
+	cover: "cover",
 	switch: "switch",
 	button: "button",
 	doorbell: "doorbell"
@@ -26463,41 +26687,65 @@ var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object(
 method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
-}), string()), method(object({
+}), string(), { auth: "admin" }), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string(),
 	data: _instanceof(Uint8Array)
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
-}), _instanceof(Uint8Array)), method(object({
+}), _instanceof(Uint8Array), { auth: "admin" }), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
-}), boolean()), method(object({
+}), boolean(), { auth: "admin" }), method(object({
 	location: StorageLocationRefSchema,
 	prefix: string().optional()
-}), array(string()).readonly()), method(object({
+}), array(string()).readonly(), { auth: "admin" }), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
-}), _void(), { kind: "mutation" }), method(object({ location: StorageLocationRefSchema }), number().nullable()), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ location: StorageLocationRefSchema }), number().nullable()), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string(),
 	sizeBytes: number().optional()
-}), object({ uploadId: string() }), { kind: "mutation" }), method(object({
+}), object({ uploadId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	uploadId: string(),
 	offset: number(),
 	data: _instanceof(Uint8Array)
-}), _void(), { kind: "mutation" }), method(object({ uploadId: string() }), _void(), { kind: "mutation" }), method(object({ uploadId: string() }), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ uploadId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ uploadId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
 }), object({
 	downloadId: string(),
 	sizeBytes: number()
-}), { kind: "mutation" }), method(object({
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	downloadId: string(),
 	offset: number(),
 	length: number()
-}), _instanceof(Uint8Array)), method(object({ downloadId: string() }), _void(), { kind: "mutation" }), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
+}), _instanceof(Uint8Array), { auth: "admin" }), method(object({ downloadId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
 	createdAt: true,
 	updatedAt: true
 }), StorageLocationSchema, {
@@ -26762,6 +27010,58 @@ method(_void(), ProviderInfoSchema, { auth: "admin" }), method(object({ config:
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* The signals a device can emit to WAKE its own stream.
+*
+* A camera whose stream is built on demand sleeps until something asks for it,
+* and "something" cannot be a consumer that is merely attached — a Frigate-style
+* puller holds a session open for ever, and treating that as demand would keep
+* a battery camera awake for ever, which is the whole thing the battery is for
+* (D173). So the wake has to come from the CAMERA: an event it noticed by
+* itself, with no stream running.
+*
+* ## The vocabulary is the PROVIDER'S, not ours
+*
+* Like `consumables`, this cap declares no vocabulary of its own. A provider
+* names each signal with a `code` it chooses and a `label` an operator reads.
+* Reolink offers motion and camera-native detection; another provider may offer
+* a tamper, a doorbell press, a PIR, or something no camera in this fleet has
+* yet. A fixed enum here would mean every new signal is a framework release.
+*
+* It is deliberately NOT derived from the caps a device already binds. Whether
+* a camera CAN push firmware motion is expressed by `motionSources` containing
+* `'onboard'`, and whether it does AI on-camera by the `native-object-detection`
+* binding — but both answer "what drives the detection pipeline", which is a
+* different question from "what may wake a sleeping stream". A camera can do
+* the first and not be trusted with the second, and the operator picks per
+* camera. Two questions, two authorities.
+*
+* ## Availability is not permission
+*
+* `listSignals` says what the device CAN emit. Whether a given signal actually
+* wakes the stream is the operator's per-camera choice, held by the broker
+* alongside the cooldown — see the stream-broker cap's wake settings. A
+* provider declaring a signal is not a provider enabling it.
+*/
+/** One signal a device can emit. */
+var StreamSignalSchema = object({
+	/** Stable id chosen by the provider, e.g. `'motion'`, `'person'`, `'tamper'`. */
+	code: string().min(1),
+	/** What an operator reads in the picker. The provider's own wording. */
+	label: string().min(1),
+	/**
+	* Whether the provider recommends this signal ON when a camera is first set
+	* up. A provider knows which of its signals are cheap and reliable; an
+	* operator should not have to discover that by trial. Reolink recommends
+	* both of its own.
+	*/
+	recommended: boolean()
+});
+object({
+	signals: array(StreamSignalSchema),
+	lastFetchedAt: number()
+});
+Object.values(DeviceType), method(_void(), array(StreamSignalSchema).readonly());
 /** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
 var ProfileSettingsSchemaBridge = unknown().nullable();
 var ProfileSettingsBagSchema = record(string(), unknown());
@@ -27745,25 +28045,44 @@ var ClipStreamDialSchema = object({
 	audioReason: ClipStreamAudioReasonSchema.optional()
 });
 /**
-* The playback rates a clip can be DELIVERED at, ascending, always with `1`.
+* The playback rates the broker can pace over media it HOLDS, ascending,
+* always with `1` — and the WIDEST ladder there is. It is the domain the
+* broker's `clampPlaybackRate` is derived from, at both ends.
 *
 * These are the BROKER's: it re-paces frames it has already demuxed — the
 * `MonotonicClock` divides source elapsed time by the factor and the pacer
-* pushes that much faster — so the domain is the recorded one, {0} ∪ [0.25, 4],
-* and this is the discrete ladder drawn from it. `1.5` is in it because a
-* re-pacer has no reason to refuse it.
-*
-* `8` and `16` are deliberately NOT here. They are the CAMERA's own
-* `<playSpeed>` (Reolink cmd-5 replay), a different mechanism, still unwired
-* (D597, D600) — a rate change there costs a new dial and a new stream, and
-* the camera's 8x would need a resample the clip audio path has no decoder
-* for. Offering them today accepts a rate and delivers 1x, which is the whole
-* defect this list exists to end (D612). When `playSpeed` IS wired its rates
-* join THIS array — a second list elsewhere is the second authority D62
-* forbids.
-*
-* Every entry must survive the broker's `clampPlaybackRate` unchanged: a set
-* that offers what the clamp then moves is the same lie one step later.
+* pushes that much faster. `1.5` is in it because a re-pacer has no reason to
+* refuse it.
+*
+* **`8` is here since D621, and it is the pacer's, not a camera's.** D620
+* measured the thing that was assumed for a year and was never true: a
+* Reolink `<playSpeed>` does not time-compress anything. At 1, 2, 4 and 8 the
+* transfer is byte-identical — same 947 472 bytes, same 594 access units,
+* same 39.855 s presentation span, same 624 AAC frames — and only the wall
+* clock moves. It buys SUPPLY, never speed. So there was never a second
+* mechanism to wire for 8×: there is one, this one, and what it needs is
+* media in hand and a clamp that does not move the number.
+*
+* **`16` is deliberately NOT here, and will not join by widening this array.**
+* The camera's `playSpeed 16` is not a rate at all but an I-frame-only MODE —
+* measured on 592: 10 access units for a whole 36.3 s sub clip, 20 for the
+* main twin at a 2 025 ms median spacing, and no audio track. That is
+* different CONTENT, a stream of its own, and the honest broker-side twin of
+* it would be a pacer that DROPS whole GOPs rather than one that pushes 16×
+* the bitrate at a live WebRTC track. Neither exists. A `16` in this array
+* today would be a rate accepted and delivered at 8 — D612's defect, which
+* this list exists to end, one number further along.
+*
+* Every entry must survive the broker's `clampPlaybackRate` unchanged. Since
+* D621 that is structural rather than a discipline: the clamp reads this
+* array's own ends. What still has to be proved behaviourally — and is, in
+* the broker's `clip-stream-feeder.spec` — is that the PACER really empties a
+* clip `rate` times faster, because a clamp agreeing with a ladder is a
+* constant compared against itself.
+*
+* Narrower ladders exist for transports whose SUPPLY is bounded; they are
+* subsets of this one ({@link CLIP_STREAM_SOURCE_RATES},
+* {@link CLIP_REALTIME_SOURCE_RATES}).
 */
 var CLIP_BROKER_PACED_RATES = [
 	.25,
@@ -27771,7 +28090,8 @@ var CLIP_BROKER_PACED_RATES = [
 	1,
 	1.5,
 	2,
-	4
+	4,
+	8
 ];
 /**
 * What a surface may DRAW for this provider's clips — the answer to
@@ -28297,7 +28617,67 @@ var WebrtcLadderDecisionSchema = object({
 	serverSending: boolean().nullable(),
 	/** Epoch ms. The overlay prints its age; a decision from 40 minutes ago
 	*  must not read like one from this second. */
-	at: number()
+	at: number(),
+	/** The broker's own cause when it is finer than `cause` can carry, e.g.
+	*  `trial-revert` (reported as `stall`/`loss` for older consumers). Optional:
+	*  an older server strips it instead of rejecting the answer. */
+	causeDetail: string().optional()
+});
+var WebrtcClimbHoldSchema = object({
+	/** `stall-building` — the client receives ≪ what is sent; `delivery` — the
+	*  current rung is not landing whole; `no-evidence` — no receiver feedback;
+	*  `warming` — healthy, accumulating the streak; `cooldown` — too soon after
+	*  a change; `capacity` — a MEASURED probe below the next rung's bar;
+	*  `try-unclean` — no capacity evidence, and the path is not clean enough to
+	*  try; `try-backoff` — a try reverted, waiting out its backoff; `trial` —
+	*  this rung IS a try, reverting if it does not land; `suspended` —
+	*  recorded playback on the track. */
+	code: string(),
+	/** The rung a climb would go to. */
+	nextTier: CamProfileSchema,
+	/** Bytes received ÷ bytes sent over the delivery window (≥ one GOP). */
+	deliveryRatio: number().nullable(),
+	deliveryWindowMs: number().nullable(),
+	/** The ratio a climb requires. */
+	climbDeliveryRatio: number(),
+	/** The receiver's bandwidth estimate (REMB), kbps. Capped by what is sent. */
+	capacityKbps: number().nullable(),
+	/** The viewer's downlink probe for this session, kbps. */
+	probeKbps: number().nullable(),
+	/** The next rung's measured bitrate, kbps. */
+	nextTierKbps: number().nullable(),
+	capacityMargin: number(),
+	/** The capacity a climb to `nextTier` needs, kbps (bitrate × margin, or the
+	*  client ladder threshold when the rung has measured nothing). */
+	neededKbps: number().nullable(),
+	/** For `try-unclean`: which clean-path condition failed (a `WebrtcTryBlocker`,
+	*  carried as a string for the same reason as `code`). */
+	tryBlockedBy: string().nullable(),
+	/** The delivery ratio and the loss ratio a try requires / must stay under.
+	*  Optional, like every field added to this schema after it first shipped:
+	*  the router validates output, so a REQUIRED new field makes a newer server
+	*  reject an older broker's whole answer (review m1). */
+	tryDeliveryRatio: number().optional(),
+	tryMaxLossRatio: number().optional(),
+	/** For `try-backoff`: time until the next try, ms. */
+	retryInMs: number().nullable(),
+	/** The last try that reverted in this viewer session. */
+	lastRevert: object({
+		tier: CamProfileSchema,
+		deliveryRatio: number().nullable(),
+		stalled: boolean(),
+		at: number()
+	}).nullable(),
+	/** For `trial`: how long this rung has been on trial, and for how long it must hold. */
+	trialForMs: number().nullable(),
+	trialMs: number().nullable(),
+	healthyForMs: number().nullable(),
+	requiredHealthyMs: number().nullable(),
+	/** Epoch ms this hold's code began. */
+	since: number(),
+	/** The same one-line account the broker logs, e.g.
+	*  `held: delivery 0.97 over 4.0s ok, REMB 480 kbps < mid 1800 kbps × 1.2`. */
+	summary: string()
 });
 /** Per-tier count of MEASURED downgrades this viewer session has suffered. */
 var WebrtcTierFailureSchema = object({
@@ -28361,7 +28741,12 @@ var WebrtcSessionDebugSchema = object({
 	tierFailures: array(WebrtcTierFailureSchema),
 	/** Successful promotions in this viewer session (drives the progressive
 	*  healthy timer). Null when no ladder is running. */
-	upgradeCount: number().nullable()
+	upgradeCount: number().nullable(),
+	/** Why the ladder is not climbing right now. Null when no ladder runs, it
+	*  is at the top rung, or it just moved. Optional because this output is
+	*  validated by the router: a server carrying this schema must still accept
+	*  the answer of a stream-broker deployed before the field existed. */
+	climbHold: WebrtcClimbHoldSchema.nullable().optional()
 });
 /**
 * WebRTC session — device-scoped facade over the system `webrtc` cap.
@@ -29442,6 +29827,143 @@ DeviceType.Camera, method(object({ deviceId: number() }), CameraCredentialsSchem
 	kind: "query",
 	auth: "admin"
 });
+/**
+* camera-grid-layout — the geometry of a COMPOSITE camera, on the camera's own
+* page.
+*
+* ## Why this is a capability and not an addon settings schema
+*
+* It was one, and it did not render. The addon declared the editor as a
+* `type: 'widget'` field inside its own `deviceSettingsSchema()`; the hub
+* returned that section correctly and `ConfigFormField` renders `type:'widget'`
+* perfectly well — and nothing ever asked camera-grid for it. The Cluster →
+* Pipeline → Device Overrides page interrogates a HAND-WRITTEN list of four
+* addons (`PIPELINE_CLUSTER_DEVICE_ADDONS`), whose own comment says an addon
+* not on it "falls off silently".
+*
+* Adding a fifth name to that list would have been the wrong fix twice over:
+* that page is per-camera DETECTION tuning, and a grid's geometry belongs
+* beside PTZ and motion zones on the camera itself. The device page is
+* BINDING-driven (D12), so the way in is a capability bound to the device —
+* and this cap carries its section the way `recording` does, by RETURNING it
+* from `getDeviceSettingsContribution`.
+*
+* Seven other widgets are still declared the other way, through a
+* `deviceConfig.ui` block the framework derives a section from. That route
+* gives the addon no say in where its own panel lands and no way to decline
+* for a device the panel does not suit, which is why this one does not use it.
+*
+* ## Why one addon may implement it
+*
+* It is a device-scoped NATIVE cap, registered by the grid camera device
+* itself. Nothing else declares a composite camera, so nothing else has a
+* layout — and the device-scoped route means the widget asks THE camera, not
+* "the camera-grid addon", which is what let the old custom-action pair be
+* reached only by a caller that already knew the addon id.
+*
+* ## The tab
+*
+* `streaming`, not a top-tab of its own. A grid's geometry IS what its stream
+* is, so the Streaming tab is where it belongs; a `grid` top-tab would need an
+* entry in `WELL_KNOWN_TAB_MAP` or the device page renders the raw id as the
+* label (measured on the robot camera, 2026-09-06 — a tab called "navigation"
+* next to "PTZ").
+*/
+/** A rectangle in normalized [0,1] coordinates of whatever contains it. */
+var GridNormalizedRectSchema = object({
+	x: number().min(0).max(1),
+	y: number().min(0).max(1),
+	width: number().gt(0).max(1),
+	height: number().gt(0).max(1)
+});
+/**
+* One source camera, the part of its picture taken, and where that part lands.
+*
+* Both rectangles are NORMALIZED (D519): a source camera can change resolution
+* — a profile switch, a firmware update, a substream that comes back different
+* — and a stored PIXEL rectangle would quietly start cutting the wrong region,
+* which is the class of bug nobody files.
+*/
+var GridLayoutCellSchema = object({
+	deviceId: number().int().positive(),
+	/** The part of the SOURCE taken, normalized against the source. */
+	source: GridNormalizedRectSchema,
+	/** Where it lands, normalized against the CANVAS. */
+	cell: GridNormalizedRectSchema
+});
+/**
+* Which profiles this grid can actually compose, and why not.
+*
+* A grid's `high` composes its sources' `high` and its `low` their `low`, so a
+* profile is on offer only when EVERY source can serve it. The refusal NAMES
+* the sources, because "this grid has no low" is not a finding — "615 has no
+* low" is, and it is the one an operator can act on.
+*/
+var GridProfileOfferSchema = object({
+	profile: _enum([
+		"high",
+		"mid",
+		"low"
+	]),
+	offered: boolean(),
+	/** Sources that cannot serve it. Empty when it is offered, or when there are no cells. */
+	missingSources: array(number().int().positive()),
+	/**
+	* The canvas this profile composes onto, `WxH`, or empty when it is not
+	* offered. DERIVED from the cells and the sources' own size at this profile —
+	* it is reported because nothing else in the system would ever say what the
+	* grid came out as, and because it is the number an operator would otherwise
+	* expect to type.
+	*/
+	canvas: string(),
+	/**
+	* Whether this profile is PUBLISHED, of the ones the grid could serve.
+	*
+	* A grid's `high` is composed of its sources' `high`, so on a 4K fleet it is
+	* a 4K canvas built from 4K decodes — something to opt into, not something a
+	* viewer's adaptive should be handed by climbing to the top rung it can see.
+	* Default is `mid` + `low`.
+	*/
+	published: boolean()
+});
+var GridLayoutViewSchema = object({
+	/** The persisted grid row this camera was declared from. */
+	instanceId: string(),
+	deviceId: number().int().nonnegative(),
+	name: string(),
+	/**
+	* NO canvas size. A grid's resolution is not authored: each profile derives
+	* its own from the cells and its sources' dimensions. The two numbers that
+	* used to be here were a text field that silently decided both how much the
+	* composite cost and how sharp it was — see `profiles[].canvas` for what it
+	* came out as.
+	*/
+	fps: number().int(),
+	cells: array(GridLayoutCellSchema),
+	/** What the catalog will publish, and what it refuses to. Read-only. */
+	profiles: array(GridProfileOfferSchema)
+});
+var GridLayoutPatchSchema = object({
+	deviceId: number().int().nonnegative(),
+	name: string().min(1).max(160).optional(),
+	fps: number().int().min(1).max(60).optional(),
+	/** Which profiles to publish. See `GridProfileOffer.published`. */
+	publishedProfiles: array(_enum([
+		"high",
+		"mid",
+		"low"
+	])).max(3).optional(),
+	/**
+	* The whole cell list at once. A per-cell patch would need an ordering the
+	* editor does not have, and a half-applied layout is a picture nobody asked
+	* for.
+	*/
+	cells: array(GridLayoutCellSchema).max(16)
+});
+DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), GridLayoutViewSchema.nullable(), { auth: "admin" }), method(GridLayoutPatchSchema, GridLayoutViewSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 object({
 	detected: boolean(),
 	/** Ms epoch of the last transition. 0 if never observed. */
@@ -29915,307 +30437,6 @@ DeviceType.Camera, method(object({ deviceId: number() }), DayNightOptionsSchema)
 	auth: "admin"
 });
 /**
-* Vendor-neutral **onboard** recording + storage cap — what the CAMERA
-* writes to the CAMERA's own card, on the camera's own schedule.
-*
-* This is NOT `recording.cap.ts`. That one is CamStack's recorder: our
-* footage ledger, our storage locations, our retention. This one has a
-* different authority — the camera's firmware — and per D62 it stores
-* nothing of its own. Every value here is read from the camera and every
-* write goes back to the camera; there is no CamStack-side mirror that
-* could disagree with the device.
-*
-* ## One shape, two firmwares
-*
-* Measured 2026-09-22 against the live fleet:
-*
-* | fact | Hikvision (ISAPI) | Reolink (Baichuan) |
-* | --- | --- | --- |
-* | storage | `ContentMgmt/Storage` `<hdd>` rows: status, capacity, freeSpace (MB) | `getHddInfoList` (cmd 102): `mount`, `format`, `capacity` GB + `capacityM` MB remainder |
-* | tracks | several (101 **and** 103 on both 1436 and 3833), each with its own schedule | one per channel |
-* | schedule | per track, 7 `ScheduleAction` blocks: DayOfWeek + TimeOfDay range + ONE `ActionRecordingMode` | per trigger type, a 168-char weekly HOUR mask |
-* | triggers | `CMR`, `MOTION` | `Normal`, `MD`, `people`, `vehicle`, `dog_cat`, `crossline`, `intrude`, `loitering` |
-* | pre-record | `PreRecordTimeSeconds` | `preRecordTime` |
-* | post-record | `PostRecordTimeSeconds` | `recordDelayTime` |
-* | overwrite | per track `LoopEnable` | `cycle`, with `cycleList` enumerating the accepted values |
-* | segment length | not exposed on V5.7.1 | `packageTime` (minutes) |
-*
-* The two schedule models look different and are the same thing in
-* different coordinates: both answer "for this trigger, during which
-* weekly windows does the camera record". {@link RecordWindow} is that
-* question in one shape — Hikvision's ranges map straight onto it,
-* Reolink's mask expands into hour-aligned windows.
-*
-* ## Union, not intersection
-*
-* **The same fields exist on every camera.** What differs per device is
-* which VALUES that device accepts, and that is what {@link
-* RecordingOnboardOptions} reports — a `{ readable, writable, reason }`
-* per field plus the schedule's own limits. A control a camera cannot
-* honour is rendered DISABLED WITH ITS REASON, never missing and never
-* dead: disabled must not look like broken.
-*
-* ## Refusal by name
-*
-* A write a camera cannot honour is refused with a sentence the operator
-* can read — never accepted and dropped. Both providers refuse through
-* {@link describeOnboardRefusal}, so the vocabulary is one function and
-* one test, not two hand-written vendor opinions.
-*
-* Follows the D14 `deviceConfig` archetype (see `stream-params.cap.ts`):
-* `getOptions` advertises per-camera availability, `getStatus` (auto-
-* injected from `status`) reports the live values, and a single
-* `setSettings` mutation applies a partial change. No hand-written
-* settings-contribution methods.
-*/
-/**
-* What makes the camera start recording during a window.
-*
-* The union of both vendors' vocabularies. `continuous` is Hikvision's
-* `CMR` and Reolink's `Normal`; `motion` is `MOTION` / `MD`. The
-* object-class triggers are Reolink-only today and the smart-event ones
-* (`lineCrossing`, `intrusion`, `loitering`) are Reolink-only on the
-* firmwares measured — a camera that cannot record on a trigger simply
-* does not list it in `options.schedule.triggers`, and a window naming
-* it is REFUSED, not dropped.
-*/
-var RecordTriggerSchema = _enum([
-	"continuous",
-	"motion",
-	"person",
-	"vehicle",
-	"animal",
-	"lineCrossing",
-	"intrusion",
-	"loitering",
-	"alarmInput"
-]);
-/**
-* One weekly recording window: "on `day`, from `startMinute` to
-* `endMinute`, record on `trigger`".
-*
-* `day` is 0 = Monday … 6 = Sunday (ISO order, which is also the order
-* both firmwares enumerate). Minutes are local camera time since
-* midnight; `endMinute` may be 1440, meaning end of day — that is
-* Hikvision's literal `24:00` and Reolink's 24th mask slot, and
-* collapsing it to 0 would turn a whole-day window into an empty one.
-*/
-var RecordWindowSchema = object({
-	trigger: RecordTriggerSchema,
-	day: number().int().min(0).max(6),
-	startMinute: number().int().min(0).max(1439),
-	endMinute: number().int().min(1).max(1440)
-});
-/** Status of one physical volume, as the camera itself describes it. */
-var OnboardStorageVolumeSchema = object({
-	/** The camera's own id for the volume (`hdd/id`, Reolink `HddInfo/number`). */
-	id: string(),
-	/** The camera's own name for it, when it gives one (`hddName`). */
-	label: string().optional(),
-	status: _enum([
-		"ok",
-		"unformatted",
-		"error",
-		"offline",
-		"unknown"
-	]),
-	/**
-	* Total size in MB, or **null when the camera did not say**.
-	*
-	* Never 0 for an unreadable value: a measurement that failed is not a
-	* measurement (D393), and a card whose size is unknown must not be
-	* rendered as a card of size zero.
-	*/
-	capacityMb: number().nullable(),
-	/**
-	* Free space in MB, or null when unknown.
-	*
-	* **Not a proxy for "has footage".** Measured 2026-09-22: 1436 and
-	* 1439 both report exactly 11776 MB free — the fixed reserve a looping
-	* card converges on once it has wrapped. At loop steady state the
-	* number is identical whether the camera recorded yesterday or stopped
-	* a month ago.
-	*/
-	freeMb: number().nullable(),
-	/** True when the camera reports the volume writable (`property` RW). */
-	writable: boolean().optional()
-});
-object({
-	storage: discriminatedUnion("kind", [
-		object({
-			kind: literal("present"),
-			volumes: array(OnboardStorageVolumeSchema)
-		}),
-		object({
-			kind: literal("absent"),
-			reason: string()
-		}),
-		object({
-			kind: literal("unknown"),
-			reason: string()
-		})
-	]),
-	tracks: array(object({
-		id: string(),
-		enabled: boolean(),
-		isVideo: boolean(),
-		/** From the camera's own track description. Null when it does not say. */
-		codec: string().nullable(),
-		resolution: string().nullable(),
-		/** Per-track overwrite flag, where the firmware keeps it per track. */
-		overwriteWhenFull: boolean().nullable()
-	})),
-	/**
-	* The track the write path targets — the enabled VIDEO one. Null when
-	* no track could be identified, which is itself a refusal reason.
-	*/
-	primaryTrackId: string().nullable(),
-	/** Master "record to the card at all" switch. */
-	enabled: boolean().nullable(),
-	overwriteWhenFull: boolean().nullable(),
-	preRecordSec: number().nullable(),
-	postRecordSec: number().nullable(),
-	/** Length of one recorded file, in minutes. */
-	segmentMinutes: number().nullable(),
-	/** The primary track's weekly windows, flattened. */
-	windows: array(RecordWindowSchema),
-	/**
-	* How many windows the camera described that CamStack could NOT read —
-	* an unrecognised trigger, an unparseable clock, a weekday it does not
-	* name.
-	*
-	* A dropped window is work the reader threw away, and a schedule that
-	* silently shows fewer rows than the camera holds is how an operator
-	* saves back a schedule shorter than the one they were looking at
-	* (D391). Non-zero means the window list is INCOMPLETE and a write
-	* that replaces it would delete what was not shown — which is why a
-	* provider reporting a non-zero count also reports the schedule as not
-	* writable.
-	*/
-	unreadableWindows: number(),
-	/**
-	* The camera is scheduled to record and has NO usable storage.
-	*
-	* A first-class fact because it is the fleet's most common silent
-	* defect: measured 2026-09-22, 1441 and 3831 are both motion-recording
-	* to a card that is not there. Neither the schedule nor the storage
-	* read says anything wrong on its own; only the pair does.
-	*/
-	recordingToNowhere: boolean(),
-	lastFetchedAt: number()
-});
-/** Numeric range descriptor — `{ min, max, step }` per the getOptions convention. */
-var RangeSchema = object({
-	min: number(),
-	max: number(),
-	step: number()
-});
-/**
-* The values a camera actually takes for a numeric field, when they are a SET
-* rather than a range.
-*
-* `{min,max,step}` cannot say what these two firmwares do. Measured on 1436
-* (I91DN) on 2026-09-22 by writing each value and reading it back:
-*
-* - pre-record: `0, 5, 10, 15, 20, 25, 30` and `2147483647` (INT32_MAX, the
-*   camera's "no limit" — `-1` and `4294967295` both land on it);
-* - post-record: `5, 10, 30, 60, 120, 300, 600`.
-*
-* Neither is expressible as a step: the first has a sentinel two billion away
-* from its neighbours, the second doubles and then jumps. A range that tried
-* would forbid values the camera takes AND permit values it silently replaces
-* with 5 — wrong in both directions at once.
-*
-* `sentinel` names the member that is not a duration, so a surface can render
-* "no limit" instead of `2147483647` seconds.
-*/
-var AllowedValuesSchema = object({
-	values: array(number()).min(1),
-	sentinel: object({
-		value: number(),
-		meaning: _enum(["no-limit", "disabled"])
-	}).optional()
-});
-/**
-* Per-field availability on ONE camera.
-*
-* The field exists on every camera — this says whether this one can be
-* read and whether it can be written, and `reason` says why not when
-* either is false. The UI renders the control DISABLED with the reason
-* rather than hiding it, so a limitation is legible instead of looking
-* like a missing feature.
-*/
-var OnboardFieldSupportSchema = object({
-	readable: boolean(),
-	writable: boolean(),
-	/** Required whenever `readable` or `writable` is false. */
-	reason: string().optional()
-});
-/** What this camera's schedule model can express. */
-var OnboardScheduleSupportSchema = object({
-	support: OnboardFieldSupportSchema,
-	/**
-	* The smallest time step the camera can express, in minutes.
-	*
-	* Hikvision takes arbitrary minutes (`00:05:00`–`23:57:00` observed on
-	* 1436's track 103). Reolink's schedule is a 7×24 HOUR mask, so 60. A
-	* window whose edges are not a multiple of this is REFUSED rather than
-	* quietly rounded — rounding is how an operator's 06:30 becomes 06:00
-	* and nothing says so.
-	*/
-	granularityMinutes: number(),
-	/** Triggers this camera can record on. A window naming another is refused. */
-	triggers: array(RecordTriggerSchema),
-	/**
-	* False when the camera stores ONE trigger per time range, so two
-	* windows overlapping on the same day cannot carry different triggers.
-	* True on Reolink, whose mask is per-trigger and independent.
-	*/
-	supportsOverlappingTriggers: boolean()
-});
-var RecordingOnboardOptionsSchema = object({
-	enabled: OnboardFieldSupportSchema,
-	overwriteWhenFull: OnboardFieldSupportSchema,
-	preRecordSec: OnboardFieldSupportSchema,
-	preRecordSecRange: RangeSchema.optional(),
-	/** Preferred over the range when the camera takes a SET, not a span. */
-	preRecordSecAllowed: AllowedValuesSchema.optional(),
-	postRecordSec: OnboardFieldSupportSchema,
-	postRecordSecRange: RangeSchema.optional(),
-	/** Preferred over the range when the camera takes a SET, not a span. */
-	postRecordSecAllowed: AllowedValuesSchema.optional(),
-	segmentMinutes: OnboardFieldSupportSchema,
-	segmentMinutesRange: RangeSchema.optional(),
-	/** Preferred over the range when the camera takes a SET, not a span. */
-	segmentMinutesAllowed: AllowedValuesSchema.optional(),
-	schedule: OnboardScheduleSupportSchema
-});
-/**
-* A partial change. Every field optional.
-*
-* Unlike the other `deviceConfig` caps, a provider here does **NOT**
-* silently ignore a field it cannot support — it refuses, by name,
-* through {@link describeOnboardRefusal}. Silence on a recording setting
-* is the failure D62 exists to prevent: the operator believes the camera
-* is recording the way the form says, and it is not.
-*/
-var RecordingOnboardPatchSchema = object({
-	enabled: boolean().optional(),
-	overwriteWhenFull: boolean().optional(),
-	preRecordSec: number().optional(),
-	postRecordSec: number().optional(),
-	segmentMinutes: number().optional(),
-	/** The complete new window set for the primary track — not a delta. */
-	windows: array(RecordWindowSchema).optional()
-});
-DeviceType.Camera, method(object({ deviceId: number() }), RecordingOnboardOptionsSchema), method(object({
-	deviceId: number(),
-	settings: RecordingOnboardPatchSchema
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * Generic device-level status snapshot. Auto-registered by `BaseDevice`
 * for every device, regardless of provider — the kernel needs a uniform
 * cap-keyed slice for the basic device flags every consumer expects to
@@ -30309,30 +30530,6 @@ object({
 	eventCountSinceStart: number()
 });
 DeviceType.EventEmitter;
-var EventItemSchema = object({
-	id: string(),
-	type: string(),
-	timestamp: number(),
-	label: string().optional(),
-	thumbnailUrl: string().optional(),
-	clipUrl: string().optional(),
-	metadata: record(string(), unknown()).optional()
-});
-DeviceType.Camera, method(object({
-	deviceId: number(),
-	from: number().optional(),
-	to: number().optional(),
-	limit: number().optional()
-}), array(EventItemSchema)), method(object({
-	deviceId: number(),
-	eventId: string()
-}), object({
-	base64: string(),
-	contentType: string()
-}).nullable()), method(object({
-	deviceId: number(),
-	eventId: string()
-}), string().nullable());
 var IdentitySchema = object({
 	id: string(),
 	name: string(),
@@ -32029,143 +32226,6 @@ DeviceType.Light, DeviceType.Siren, DeviceType.Switch, method(object({
 	lastChangedAt: number()
 });
 /**
-* camera-grid-layout — the geometry of a COMPOSITE camera, on the camera's own
-* page.
-*
-* ## Why this is a capability and not an addon settings schema
-*
-* It was one, and it did not render. The addon declared the editor as a
-* `type: 'widget'` field inside its own `deviceSettingsSchema()`; the hub
-* returned that section correctly and `ConfigFormField` renders `type:'widget'`
-* perfectly well — and nothing ever asked camera-grid for it. The Cluster →
-* Pipeline → Device Overrides page interrogates a HAND-WRITTEN list of four
-* addons (`PIPELINE_CLUSTER_DEVICE_ADDONS`), whose own comment says an addon
-* not on it "falls off silently".
-*
-* Adding a fifth name to that list would have been the wrong fix twice over:
-* that page is per-camera DETECTION tuning, and a grid's geometry belongs
-* beside PTZ and motion zones on the camera itself. The device page is
-* BINDING-driven (D12), so the way in is a capability bound to the device —
-* and this cap carries its section the way `recording` does, by RETURNING it
-* from `getDeviceSettingsContribution`.
-*
-* Seven other widgets are still declared the other way, through a
-* `deviceConfig.ui` block the framework derives a section from. That route
-* gives the addon no say in where its own panel lands and no way to decline
-* for a device the panel does not suit, which is why this one does not use it.
-*
-* ## Why one addon may implement it
-*
-* It is a device-scoped NATIVE cap, registered by the grid camera device
-* itself. Nothing else declares a composite camera, so nothing else has a
-* layout — and the device-scoped route means the widget asks THE camera, not
-* "the camera-grid addon", which is what let the old custom-action pair be
-* reached only by a caller that already knew the addon id.
-*
-* ## The tab
-*
-* `streaming`, not a top-tab of its own. A grid's geometry IS what its stream
-* is, so the Streaming tab is where it belongs; a `grid` top-tab would need an
-* entry in `WELL_KNOWN_TAB_MAP` or the device page renders the raw id as the
-* label (measured on the robot camera, 2026-09-06 — a tab called "navigation"
-* next to "PTZ").
-*/
-/** A rectangle in normalized [0,1] coordinates of whatever contains it. */
-var GridNormalizedRectSchema = object({
-	x: number().min(0).max(1),
-	y: number().min(0).max(1),
-	width: number().gt(0).max(1),
-	height: number().gt(0).max(1)
-});
-/**
-* One source camera, the part of its picture taken, and where that part lands.
-*
-* Both rectangles are NORMALIZED (D519): a source camera can change resolution
-* — a profile switch, a firmware update, a substream that comes back different
-* — and a stored PIXEL rectangle would quietly start cutting the wrong region,
-* which is the class of bug nobody files.
-*/
-var GridLayoutCellSchema = object({
-	deviceId: number().int().positive(),
-	/** The part of the SOURCE taken, normalized against the source. */
-	source: GridNormalizedRectSchema,
-	/** Where it lands, normalized against the CANVAS. */
-	cell: GridNormalizedRectSchema
-});
-/**
-* Which profiles this grid can actually compose, and why not.
-*
-* A grid's `high` composes its sources' `high` and its `low` their `low`, so a
-* profile is on offer only when EVERY source can serve it. The refusal NAMES
-* the sources, because "this grid has no low" is not a finding — "615 has no
-* low" is, and it is the one an operator can act on.
-*/
-var GridProfileOfferSchema = object({
-	profile: _enum([
-		"high",
-		"mid",
-		"low"
-	]),
-	offered: boolean(),
-	/** Sources that cannot serve it. Empty when it is offered, or when there are no cells. */
-	missingSources: array(number().int().positive()),
-	/**
-	* The canvas this profile composes onto, `WxH`, or empty when it is not
-	* offered. DERIVED from the cells and the sources' own size at this profile —
-	* it is reported because nothing else in the system would ever say what the
-	* grid came out as, and because it is the number an operator would otherwise
-	* expect to type.
-	*/
-	canvas: string(),
-	/**
-	* Whether this profile is PUBLISHED, of the ones the grid could serve.
-	*
-	* A grid's `high` is composed of its sources' `high`, so on a 4K fleet it is
-	* a 4K canvas built from 4K decodes — something to opt into, not something a
-	* viewer's adaptive should be handed by climbing to the top rung it can see.
-	* Default is `mid` + `low`.
-	*/
-	published: boolean()
-});
-var GridLayoutViewSchema = object({
-	/** The persisted grid row this camera was declared from. */
-	instanceId: string(),
-	deviceId: number().int().nonnegative(),
-	name: string(),
-	/**
-	* NO canvas size. A grid's resolution is not authored: each profile derives
-	* its own from the cells and its sources' dimensions. The two numbers that
-	* used to be here were a text field that silently decided both how much the
-	* composite cost and how sharp it was — see `profiles[].canvas` for what it
-	* came out as.
-	*/
-	fps: number().int(),
-	cells: array(GridLayoutCellSchema),
-	/** What the catalog will publish, and what it refuses to. Read-only. */
-	profiles: array(GridProfileOfferSchema)
-});
-var GridLayoutPatchSchema = object({
-	deviceId: number().int().nonnegative(),
-	name: string().min(1).max(160).optional(),
-	fps: number().int().min(1).max(60).optional(),
-	/** Which profiles to publish. See `GridProfileOffer.published`. */
-	publishedProfiles: array(_enum([
-		"high",
-		"mid",
-		"low"
-	])).max(3).optional(),
-	/**
-	* The whole cell list at once. A per-cell patch would need an ordering the
-	* editor does not have, and a half-applied layout is a picture nobody asked
-	* for.
-	*/
-	cells: array(GridLayoutCellSchema).max(16)
-});
-DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), GridLayoutViewSchema.nullable(), { auth: "admin" }), method(GridLayoutPatchSchema, GridLayoutViewSchema, {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * Motion-zones share the same MaskShape vocabulary as privacy-mask — the
 * on-camera motion-detection mask is a single `grid` region (a row-major
 * boolean cell lattice the camera's onboard VMD evaluates). Composing it as
@@ -32567,6 +32627,11 @@ var ClientNetworkStatsSchema = object({
 	jitterMs: number(),
 	estimatedBandwidthKbps: number(),
 	packetLossPercent: number().min(0).max(100),
+	/** The viewer's latest `/adaptive-probe` reading, Mbps — whatever it read
+	*  (D635 I4). Absent when it never probed or the probe failed (unknown). */
+	downlinkMbps: number().optional(),
+	/** Age of that reading when this report was sent, ms. */
+	downlinkAgeMs: number().optional(),
 	lastUpdated: number()
 });
 var DeviceNetworkStatsSchema = object({
@@ -32579,7 +32644,11 @@ method(object({ deviceId: number() }), DeviceNetworkStatsSchema.nullable()), met
 	rttMs: number().min(0).max(6e4),
 	jitterMs: number().min(0).max(1e4),
 	estimatedBandwidthKbps: number().min(0).max(1e6),
-	packetLossPercent: number().min(0).max(100)
+	packetLossPercent: number().min(0).max(100),
+	/** Latest downlink probe, Mbps, whatever it read; absent = never / failed. */
+	downlinkMbps: number().min(0).max(1e5).optional(),
+	/** Age of that probe when this report is sent, ms. */
+	downlinkAgeMs: number().min(0).max(864e5).optional()
 }), _void(), { kind: "mutation" });
 /**
 * nodes — system-scoped singleton capability for cluster topology
@@ -33978,36 +34047,95 @@ DeviceType.Camera, DeviceType.Sensor, DeviceType.Switch, method(object({ deviceI
 	auth: "admin"
 });
 /**
-* `recording` cap — footage availability + HLS playback manifests + per-device
-* recording config. NOTE on events (source of truth, R5/C3): this cap carries
-* NO event surface — `getPlaybackManifest` returns playlist URLs only. Timeline
-* events (motion/object/audio) come from `pipelineAnalytics` (durable SQLite
-* rows) and are the ONLY event surface — the recorder has none. The in-RAM
-* playback markers it used to build were deleted on 2026-08-29 because nothing
-* ever read them. Event<->footage joins are by time, padded with the shared
-* `EVENT_PAD_MS` (`interfaces/recording-config.ts`).
+* `recording` — a camera's recorded COVERAGE and PLAYBACK, from whichever
+* source the operator picked.
+*
+* A device-scoped wrapper COLLECTION since D625, and the five lines that make
+* it one (`scope`/`mode`/`kind`/`defaultActive`/`deviceTypes`) are copied from
+* `videoclips.cap.ts` deliberately: `scope: 'device'` + `mode: 'collection'` is
+* what makes `resolveCapMount` keep the PER-DEVICE mount while the collection
+* dispatcher fans out, and a device's sources are then its BINDINGS
+* (`deviceManager.getBindings`, D554 amended) rather than "every addon that
+* registered the cap somewhere".
+*
+* ## What is here and what is not
+*
+* FIVE of them — `listSources`, `getAvailability`, `getDaysWithRecordings`,
+* `getPlayback`, `getPlaybackOptions`. Every source must be able to answer
+* these or it is not a source. Everything else that used to live on this cap —
+* storage locations, retention, relocation, rebalance, the ops log, the
+* placement table, the `mfra` byte plane, `getDeviceConfig`/`setDeviceConfig`
+* and the two batch reads — is on `recording-archive`, a system singleton, and
+* the reasons are argued there.
+*
+* ## The default is OURS, and there is nowhere to say otherwise
+*
+* {@link RECORDING_SOURCE_CAMSTACK} is RESERVED. The absence of an operator
+* choice MEANS that value; it is not a row that happened to sort first. Clips
+* end their resolver with `?? sources[0]` and that is right for clips — a
+* camera full of onboard clips that says "no clips" is the defect that work
+* exists to end. For a TIMELINE it is wrong and the measurement says why: on
+* 592, ours covers 85 362 s of the day and the card 21 388 s, and
+* `videoclips.listSources` answers the ONBOARD row first. A silent fall to the
+* first row would swap a 98.8 % bar for a 24.8 % one with nothing saying so.
+*
+* So a surface that cannot find our row says `ours-absent` and offers the
+* others as a CHOICE; it never takes one on the operator's behalf. The
+* reservation is enforced in the collection dispatcher — a `listSources` row
+* carrying this id from any addon but the recorder is refused by name — and by
+* `scripts/check-reserved-collection-sources.ts` in CI.
+*
+* NOTE on events (source of truth, R5/C3): this cap carries NO event surface.
+* Timeline events (motion/object/audio) come from `pipelineAnalytics` (durable
+* SQLite rows) and are the ONLY event surface — the recorder has none.
+* Event<->footage joins are by time, padded with the shared `EVENT_PAD_MS`
+* (`interfaces/recording-config.ts`).
 */
-var RecordingStatusSchema = object({
-	deviceId: number(),
-	enabled: boolean(),
-	/** THE derived storage mode, from the one definition
-	*  (`deriveRecordingMode`) — never a second enum. A duplicated list is how
-	*  `on-device-decision` could have reached the recorder and not the status. */
-	activeMode: RecordingStorageModeSchema,
-	nodeId: string(),
-	storageBytes: number()
-});
+/**
+* OUR recorder's source id. RESERVED: no other provider may return it from
+* `listSources`, and the absence of an operator choice MEANS this value.
+*
+* Reserved is ENFORCED, not requested — `device-collection-dispatch.ts` drops a
+* row spelling it from any addon but {@link RECORDING_SOURCE_CAMSTACK_ADDON},
+* naming the impostor, and `scripts/check-reserved-collection-sources.ts`
+* fails CI on a provider package that spells it at all. A rule nothing checks
+* has already been broken somewhere.
+*/
+var RECORDING_SOURCE_CAMSTACK = "camstack";
+/** The one addon allowed to serve {@link RECORDING_SOURCE_CAMSTACK}: the
+*  recorder, which is the addon that writes the footage (D560). */
+var RECORDING_SOURCE_CAMSTACK_ADDON = "recorder";
 var RecordingRangeSchema = object({
 	profile: string(),
 	startMs: number(),
 	endMs: number()
 });
+/**
+* How a source ANSWERED, on every singular read of this cap.
+*
+* `'read'` — it looked. `ranges: []` / `days: []` is then a real claim: this
+* source has no coverage in the window. `'unreadable'` — nobody could look
+* (the camera was unreachable, the calendar rung threw, the location is
+* unmounted, the node is still on the old build), and the emptiness beside it
+* means NOTHING.
+*
+* The batch rows have carried this since the grid existed; the SINGULAR
+* answers gained it with the collection (D625 §10.4), because they are the
+* ones the single-camera picker uses and because a half-converted fleet makes
+* "nobody looked" common for the length of a deploy. Without it the timeline
+* has no vocabulary for it, and `(data ?? [])` in a viewer turns a rollout into
+* a fleet of cameras that appear to have lost their recordings (D315, D393).
+*/
+var RecordingReadSchema = _enum(["read", "unreadable"]);
 var RecordingAvailabilitySchema = object({
 	deviceId: number(),
+	/** See {@link RecordingReadSchema}. An `'unreadable'` answer carries an empty
+	*  `ranges` that means nothing — never draw it as "no footage". */
+	read: RecordingReadSchema,
 	ranges: array(RecordingRangeSchema),
 	/**
-	* Every profile this camera has footage in — not only the one `ranges`
-	* describes (D433).
+	* Every profile this camera has footage in AT THIS SOURCE — not only the one
+	* `ranges` describes (D433).
 	*
 	* `ranges` answers for ONE profile by design: the timeline is a single bar,
 	* and enumerating all of them triples the directory reads for a bar that
@@ -34024,15 +34152,344 @@ var RecordingAvailabilitySchema = object({
 });
 var RecordingDaysSchema = object({
 	deviceId: number(),
+	/** See {@link RecordingReadSchema}. `days: []` on an `'unreadable'` answer is
+	*  "nobody could look", and the date-picker must not spell it the same as
+	*  "no footage this month". */
+	read: RecordingReadSchema,
 	/** Local-midnight epochs (UTC ms) of days that have ≥1 recorded segment. */
 	days: array(number())
 });
+var RecordingManifestSchema = object({
+	deviceId: number(),
+	/** Local filesystem path to the master playlist; null when no recording exists for the requested range. */
+	localMasterPath: string().nullable(),
+	/** HTTP(S) URL to the master playlist on the recording node's playback server
+	*  (the PRIMARY candidate); null when no recording / server. Carries the
+	*  scoped playback token in its path. */
+	playbackUrl: string().nullable(),
+	/**
+	* Candidate master-playlist URLs the client tries in order (LAN first, then
+	* remote — Tailscale/Cloudflare if the operator configured extra hosts), each
+	* carrying the same scoped token. `playbackUrl` is the first entry. Empty when
+	* there is no recording / server.
+	*/
+	playbackEndpoints: array(string())
+});
+var RecordingSourceAvailabilitySchema = object({
+	state: _enum([
+		"ok",
+		"sleeping",
+		"unreachable",
+		"no-storage",
+		"index-empty"
+	]),
+	/** Free text, shown verbatim. Names the camera's own refusal when there is one. */
+	reason: string().optional(),
+	/** When this source's coverage was last CONFIRMED. A cached answer is never
+	*  drawn as current: the surface shows the age whenever it is older than the
+	*  refresh interval. The clip catalog's `catalogAsOf`, under the name the
+	*  timeline uses for it. */
+	coverageAsOf: number().optional()
+});
+/**
+* One SOURCE of recorded coverage for a camera — a row of the picker.
+*
+* A provider lists the sources IT serves for that device, and answers for each
+* of them whether it can answer at all. A provider with nothing to offer on a
+* camera returns `[]` — it is not that camera's business. The five availability
+* states are `ClipSourceAvailability`'s verbatim: they mean exactly the same
+* things about a coverage index as about a clip catalog, and `sleeping` in
+* particular is what stops a battery camera being woken to paint a bar.
+*/
+var RecordingSourceSchema = object({
+	/** The source id. {@link RECORDING_SOURCE_CAMSTACK} for ours (RESERVED), a
+	*  vendor namespace (`native:reolink:onboard`, …) for a camera's own store. */
+	source: string(),
+	/** Operator-facing name of the source ("CamStack recordings", "SD card"). */
+	label: string(),
+	/**
+	* The addon that SERVES this row, and the value a later call passes as
+	* `provider`.
+	*
+	* Optional for version skew only. The collection dispatcher stamps it from
+	* the registry, so a row that travelled through the fan-out carries the
+	* authoritative id whatever the provider filled in (D557 §4).
+	*/
+	addonId: string().optional(),
+	availability: RecordingSourceAvailabilitySchema
+});
+/**
+* What a surface may DRAW for this (camera, source) — D612's rule applied to a
+* timeline: **the source declares what it can do, and the surface draws what
+* was declared. It never assumes, and never offers a gesture it will then
+* refuse.** D612 exists because `8` and `16` were offered as clip rates, the
+* broker clamped them to `4`, and no line anywhere said so.
+*
+* Asked once per (camera, source) before anything is drawn — never replaced by
+* a constant the surface keeps, which is the second authority D612 ends.
+*/
+var RecordingSourceOptionsSchema = object({
+	/** How this source's media reaches the player.
+	*  `archive` = our own indexed segment tree; `stream` = the provider's
+	*  forward-only fMP4 (D597); `realtime` = a replay bound to wall clock. */
+	transport: _enum([
+		"archive",
+		"stream",
+		"realtime"
+	]),
+	/** What the BAR means. `continuous` = gaps are holes in a recording;
+	*  `sparse` = gaps are the absence of one, and must be drawn as such.
+	*
+	*  Not an onboard-only concession: measured 2026-09-24, OUR bar covers 98.8 %
+	*  of 592's day and 1.2 % of 1436's. It is a fact about a (source, camera)
+	*  pair, and ours answers it per camera from `deriveRecordingMode`. */
+	coverage: _enum(["continuous", "sparse"]),
+	/** Where the playhead may be put.
+	*  `free`    — anywhere, to the frame.
+	*  `forward` — only ahead of the current position.
+	*  `segment` — a position SNAPS to the head of the covering segment; a finer
+	*              ask is accepted by the camera and SILENTLY IGNORED. Measured
+	*              on 1436 (Hikvision V5.7.1, 2026-09-23): a window-narrowed
+	*              `ContentMgmt/search` returns a row and a `playbackURI`, the
+	*              replay opens 200 and delivers media — and the burned-in OSD of
+	*              the first frame reads the SEGMENT HEAD every time. Calling
+	*              that `forward` would tell the surface it may move the playhead
+	*              ahead within a loaded segment, which it may not. */
+	seek: _enum([
+		"free",
+		"forward",
+		"segment"
+	]),
+	/** Frame-step BACKWARD is meaningful. */
+	stepBack: boolean(),
+	/** Whether the drag-scrub gesture is served, as opposed to refused by name. */
+	scrub: boolean(),
+	/** Deliverable rates, ascending, always containing `1`. The surface draws its
+	*  picker from this and from NOTHING else (D612, D620, D621). `0` is not a
+	*  member: pause is the absence of a rate. */
+	rates: array(number().positive()).min(1).readonly(),
+	/** TRUE when a read of this source HOLDS the camera's only playback session.
+	*  A surface with this set makes at most ONE read at a time and draws no
+	*  scrub-thumbnail strip, no hover preview, no prefetch and no background
+	*  refresh. The precedent is exact and expensive: filling one screen of
+	*  Hikvision thumbnails at 1.01× realtime consumed fifteen minutes of that
+	*  camera's only playback session (1.2.126, reported within minutes), and a
+	*  timeline is a screenful of reads by construction. */
+	exclusive: boolean()
+});
+/**
+* How to PLAY the instant that was asked for, from the chosen source.
+*
+* No new media transport is built for onboard sources: the `clip` arm is a
+* DELEGATION to the `videoclips` transport that vendor already has (D597 /
+* D616 / D617). The onboard half of this collection is a PROJECTION of
+* `videoclips` for coverage and a delegation to it for bytes.
+*/
+var RecordingPlaybackSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("hls"),
+		manifest: RecordingManifestSchema
+	}),
+	object({
+		kind: literal("clip"),
+		/** The `videoclips` source namespace this clip id belongs to. */
+		source: string(),
+		clipId: string(),
+		/** Where this clip actually STARTS. On a `seek: 'segment'` source the
+		*  playhead lands here, not at the requested instant — the surface must be
+		*  TOLD, not left to discover it from a burned-in OSD. */
+		startsAtMs: number()
+	}),
+	object({
+		kind: literal("none"),
+		reason: string()
+	})
+]);
+var recordingCapability = {
+	name: "recording",
+	scope: "device",
+	/** Several sources per camera, listed beside each other. The mount stays
+	*  `device-scoped` — see `resolveCapMount`'s ordering and D554: per-device
+	*  wins over the global collection fan-out. */
+	mode: "collection",
+	kind: "wrapper",
+	defaultActive: true,
+	/** Recorded coverage is a property of a camera — the cap is meaningless on a
+	*  sensor, a button or an event emitter, and the `defaultActive` auto-bind
+	*  reads this to decide which devices it may claim. */
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		/**
+		* The sources this camera has, WITH the reason any of them cannot answer.
+		*
+		* Asked separately from `getAvailability` because an empty bar is
+		* ambiguous and this is the only place the ambiguity is resolved: every
+		* bound provider contributes its own rows, and a provider that could not be
+		* reached at all still produces one row saying so. A surface that draws "no
+		* recordings" without reading this is drawing a guess.
+		*
+		* The ONLY method here without a `provider` — it is the call that tells the
+		* caller what to put there.
+		*/
+		listSources: method(object({ deviceId: number() }), array(RecordingSourceSchema).readonly(), {
+			kind: "query",
+			auth: "protected"
+		}),
+		/**
+		* Recorded coverage of `[fromMs, toMs)` at ONE source — the timeline bar.
+		*
+		* `protected`, not `admin`: a per-camera read is exactly what a camera
+		* viewer is FOR, and the device-scoped mount routes through
+		* `getProviderForDevice`, so a camera outside the caller's scope is refused
+		* before a provider is reached.
+		*/
+		getAvailability: method(object({
+			deviceId: number(),
+			/**
+			* WHICH provider to ask — the `addonId` a {@link RecordingSourceSchema}
+			* row carries, never a source id and never a list. **REQUIRED**, in the
+			* schema, where the generated types make it unomittable rather than
+			* merely discouraged (D554 amended).
+			*
+			* It was learned the expensive way on `videoclips.listClips`: measured
+			* on the live hub 2026-09-20, device 592 bound to `recorder` AND
+			* `provider-reolink`, a bare call with `limit: 3` answered SIX rows,
+			* three from each source, merged — `device-collection-dispatch.ts`
+			* leaves an unpinned fan-out un-narrowed, so absence buys the union the
+			* method exists not to be. An un-narrowed `getAvailability` would do
+			* that to a TIMELINE: our ranges and the card's clips unioned into one
+			* bar, which is "two sources are never drawn together" broken in the
+			* one place it matters most.
+			*
+			* A provider the device is not bound to is refused BY NAME (D552's
+			* `rejectUnresolvedAddonPin`), never answered by another one.
+			*/
+			provider: string().min(1),
+			fromMs: number(),
+			toMs: number(),
+			/**
+			* Answer for THIS profile instead of the source's preferred one (D433).
+			* Absent keeps the timeline's behaviour — one bar, one profile, one set
+			* of reads. `profilesWithFootage` on the answer says what may be asked
+			* for.
+			*/
+			profile: string().optional()
+		}), RecordingAvailabilitySchema, {
+			kind: "query",
+			auth: "protected"
+		}),
+		/** Which calendar days in [fromMs,toMs) this source has ≥1 recording in,
+		*  bucketed by the client's local day (`tzOffsetMinutes` = minutes to add
+		*  to UTC). Drives the theater date-picker's day dots. `provider` is
+		*  REQUIRED for the reason `getAvailability` states. */
+		getDaysWithRecordings: method(object({
+			deviceId: number(),
+			provider: string().min(1),
+			fromMs: number(),
+			toMs: number(),
+			tzOffsetMinutes: number()
+		}), RecordingDaysSchema, {
+			kind: "query",
+			auth: "protected"
+		}),
+		/**
+		* How to PLAY `[fromMs, toMs)` at this source.
+		*
+		* It was `getPlaybackManifest`, and the rename is not cosmetic: a
+		* "manifest" is an HLS master playlist, which is a property of OUR recorder
+		* and of nothing else. Keeping the name would make every onboard
+		* implementation a lie in its signature. The old shape survives verbatim
+		* inside the union's `hls` arm, so the recorder's implementation is
+		* unchanged behind it.
+		*/
+		getPlayback: method(object({
+			deviceId: number(),
+			provider: string().min(1),
+			fromMs: number(),
+			toMs: number(),
+			profile: CamProfileSchema.optional()
+		}), RecordingPlaybackSchema, {
+			kind: "query",
+			auth: "protected"
+		}),
+		/**
+		* What this (camera, source) can actually DO — asked before anything is
+		* drawn. See {@link RecordingSourceOptionsSchema}; a constant the surface
+		* keeps instead is the second authority D612 exists to end.
+		*/
+		getPlaybackOptions: method(object({
+			deviceId: number(),
+			provider: string().min(1)
+		}), RecordingSourceOptionsSchema, {
+			kind: "query",
+			auth: "protected"
+		})
+	}
+};
+/**
+* `recording-archive` — OUR archive, and the intent that fills it.
+*
+* The system-singleton half of the 2026-09-24 cut (D625). `recording` used to
+* be one 33-method system singleton holding two unrelated subjects: three
+* per-camera READS about coverage and playback, and everything else — storage
+* locations, retention, relocation, rebalance, the ops log, the placement
+* table and the byte-plane primitives our scrub and export are built on.
+*
+* The reads became a device-scoped COLLECTION, so a camera's own card can be a
+* source beside ours (`recording.cap.ts`). Everything that is about OUR store,
+* or unimplementable by a camera, stayed here.
+*
+* ## On the name
+*
+* `recording-storage` was the obvious choice and is wrong: this cap also holds
+* `getDeviceConfig`/`setDeviceConfig`, which are recording INTENT — bands,
+* retention, the D62 switch authority — and a name that says "storage" invites
+* the next reader to move them out again. An archive is a thing we keep, and
+* what we keep it under is a policy; the name covers both halves honestly and
+* sits in the existing family (`recording-onboard`, `recording-export`,
+* `recording-signal`).
+*
+* ## What must NOT happen to it
+*
+* It stays a SINGLETON. It is registered by `recorder`, which is
+* `placement: 'any-node'` and runs on every recording node; the hub dispatches
+* to one of them. Putting the ledger, the placement table or the relocation
+* jobs behind a fan-out is the one genuinely dangerous move in this cut.
+*
+* `getDeviceConfig` / `setDeviceConfig` in particular are the D62 recording
+* authority (`CameraSwitch.authority`). If a write reached a different provider
+* than the read — which a collection fan-out permits — two authorities would
+* decide when one camera records, and the symptom (recording silently off, or
+* a `bands` array clobbered by a partial write) is durable and silent. Keeping
+* them here means the worst case during a rollout is a 412: the switch refuses
+* to flip and SAYS so. **Do not move them into the collection, at any point,
+* for any reason.**
+*
+* ## The two batch reads
+*
+* `getAvailabilityBatch` / `getDaysWithRecordingsBatch` take `deviceIds:
+* number[]` with no single `deviceId`, and a device-scoped mount routes
+* through `getProviderForDevice(deviceId)` — there is nothing for it to route
+* on. They stay here, and on this cap the batch is explicitly OURS: a grid has
+* no per-camera picker, and a caller that wants another source's coverage asks
+* `recording.getAvailability` per device with that source's `provider`.
+*/
+var RecordingStatusSchema = object({
+	deviceId: number(),
+	enabled: boolean(),
+	/** THE derived storage mode, from the one definition
+	*  (`deriveRecordingMode`) — never a second enum. A duplicated list is how
+	*  `on-device-decision` could have reached the recorder and not the status. */
+	activeMode: RecordingStorageModeSchema,
+	nodeId: string(),
+	storageBytes: number()
+});
 /**
 * One camera's row in a `getAvailabilityBatch` answer.
 *
-* `ranges` is EXACTLY what `getAvailability` returns for that camera — the
-* batch collapses the transport, not the work — plus the one thing the singular
-* method never had to say:
+* `ranges` is EXACTLY what `recording.getAvailability` returns for that camera
+* at OUR source — the batch collapses the transport, not the work — plus the
+* `read` mark the singular answer now carries too (D625):
 *
 *  - `read: 'read'` — answered. `ranges: []` means "read, and this camera has
 *    no footage in the window", which is a real claim.
@@ -34064,22 +34521,6 @@ var RecordingDaysForDeviceSchema = object({
 	/** Local-midnight epochs (UTC ms) of days that have ≥1 recorded segment. */
 	days: array(number()).readonly()
 });
-var RecordingManifestSchema = object({
-	deviceId: number(),
-	/** Local filesystem path to the master playlist; null when no recording exists for the requested range. */
-	localMasterPath: string().nullable(),
-	/** HTTP(S) URL to the master playlist on the recording node's playback server
-	*  (the PRIMARY candidate); null when no recording / server. Carries the
-	*  scoped playback token in its path. */
-	playbackUrl: string().nullable(),
-	/**
-	* Candidate master-playlist URLs the client tries in order (LAN first, then
-	* remote — Tailscale/Cloudflare if the operator configured extra hosts), each
-	* carrying the same scoped token. `playbackUrl` is the first entry. Empty when
-	* there is no recording / server.
-	*/
-	playbackEndpoints: array(string())
-});
 /**
 * Recording storage usage for one camera — what the ARCHIVE holds for it,
 * across every profile and every resolvable location on this node.
@@ -34337,33 +34778,22 @@ var ReadWindowBytesResultSchema = discriminatedUnion("kind", [object({
 	*  not a retry hint (retrying the same window would refuse again). */
 	segmentEndMs: number()
 })]);
-var recordingCapability = {
-	name: "recording",
+var recordingArchiveCapability = {
+	name: "recording-archive",
 	scope: "system",
 	mode: "singleton",
+	/** Moves here with the config pair — the derived Recording settings
+	*  section is a view over `getDeviceConfig`/`setDeviceConfig` (D14), and
+	*  those did not move (D625). */
 	exposesDeviceSettings: true,
 	status: {
 		schema: RecordingStatusSchema,
 		kind: "command-driven"
 	},
 	methods: {
-		getAvailability: method(object({
-			deviceId: number(),
-			fromMs: number(),
-			toMs: number(),
-			/**
-			* Answer for THIS profile instead of the preferred one (D433). Absent
-			* keeps the timeline's behaviour — one bar, one profile, one set of
-			* reads. `profilesWithFootage` on the answer says what may be asked
-			* for.
-			*/
-			profile: string().optional()
-		}), RecordingAvailabilitySchema, {
-			kind: "query",
-			auth: "protected"
-		}),
 		/**
-		* `getAvailability` for a SET of cameras, in one round trip.
+		* `recording.getAvailability` for a SET of cameras, in one round trip, at
+		* OUR source.
 		*
 		* A multi-camera timeline re-asks availability for every camera in the grid
 		* on every day change; fanned out that is one request per camera for N
@@ -34371,6 +34801,13 @@ var recordingCapability = {
 		* `availabilityProfileFor` + `rangesIn`, run concurrently inside the
 		* recorder) — only the transport collapses.
 		*
+		* It lives on the ARCHIVE, not on the `recording` collection, because it
+		* takes `deviceIds` with no single `deviceId` and a device-scoped mount has
+		* nothing to route on (D625 §10.2). The consequence is stated rather than
+		* hidden: the batch answers for OURS. A caller that needs another source's
+		* coverage asks `recording.getAvailability` per device, naming that
+		* source's provider.
+		*
 		* `protected` for the same reason the singular method is: every id in
 		* `deviceIds` is a device reference, so the F1 #3 gate refuses any camera
 		* outside the caller's scope — one id out of scope refuses the CALL, it
@@ -34388,20 +34825,10 @@ var recordingCapability = {
 			kind: "query",
 			auth: "protected"
 		}),
-		/** Which calendar days in [fromMs,toMs) have ≥1 recorded segment, bucketed by
-		*  the client's local day (`tzOffsetMinutes` = minutes to add to UTC). Drives
-		*  the theater date-picker's day dots. */
-		getDaysWithRecordings: method(object({
-			deviceId: number(),
-			fromMs: number(),
-			toMs: number(),
-			tzOffsetMinutes: number()
-		}), RecordingDaysSchema, {
-			kind: "query",
-			auth: "protected"
-		}),
 		/**
-		* `getDaysWithRecordings` for a SET of cameras, in one round trip.
+		* `recording.getDaysWithRecordings` for a SET of cameras, in one round
+		* trip, at OUR source. Same placement argument as
+		* {@link getAvailabilityBatch}.
 		*
 		* The cheapest question in the product, asked once per camera per month
 		* change. One directory read per day per camera at the owner, unchanged;
@@ -34420,14 +34847,6 @@ var recordingCapability = {
 			kind: "query",
 			auth: "protected"
 		}),
-		getPlaybackManifest: method(object({
-			deviceId: number(),
-			fromMs: number(),
-			toMs: number()
-		}), RecordingManifestSchema, {
-			kind: "query",
-			auth: "protected"
-		}),
 		getStorageUsage: method(object({}), RecordingStorageUsageSchema, {
 			kind: "query",
 			auth: "admin"
@@ -34443,6 +34862,10 @@ var recordingCapability = {
 		* value (D315, D393, D590). It carries schedules and retention, no secret,
 		* and the per-device gate in `scope-access.ts` still applies; `setDeviceConfig`
 		* stays `admin`.
+		*
+		* It is a SINGLETON method and stays one (D625 §16.2): it is the D62
+		* recording authority, and an authority that several providers could answer
+		* is the "two knobs over one decision" D62 forbids.
 		*/
 		getDeviceConfig: method(object({ deviceId: number() }), RecordingConfigSchema, {
 			kind: "query",
@@ -34450,7 +34873,13 @@ var recordingCapability = {
 		}),
 		/** Locate footage at a wall-clock instant: the covering segment's window,
 		*  or a gap with the forward nearest covered edge. Used by a feeder running
-		*  in another addon process to seek recorded footage over tRPC. */
+		*  in another addon process to seek recorded footage over tRPC.
+		*
+		*  BYTE PLANE: defined by `mfra` byte ranges over OUR own MP4 segment tree.
+		*  There is no vendor-neutral statement of it, its only callers are feeders
+		*  in other addon processes (the stream broker, the replay-clip source),
+		*  and an onboard source that ever needs bytes delegates to the
+		*  `videoclips` transport its vendor already has (D625 §9.3, §10.5). */
 		locateSegment: method(object({
 			deviceId: number(),
 			profile: string(),
@@ -35183,6 +35612,307 @@ var recordingExportCapability = {
 	}
 };
 /**
+* Vendor-neutral **onboard** recording + storage cap — what the CAMERA
+* writes to the CAMERA's own card, on the camera's own schedule.
+*
+* This is NOT `recording.cap.ts`. That one is CamStack's recorder: our
+* footage ledger, our storage locations, our retention. This one has a
+* different authority — the camera's firmware — and per D62 it stores
+* nothing of its own. Every value here is read from the camera and every
+* write goes back to the camera; there is no CamStack-side mirror that
+* could disagree with the device.
+*
+* ## One shape, two firmwares
+*
+* Measured 2026-09-22 against the live fleet:
+*
+* | fact | Hikvision (ISAPI) | Reolink (Baichuan) |
+* | --- | --- | --- |
+* | storage | `ContentMgmt/Storage` `<hdd>` rows: status, capacity, freeSpace (MB) | `getHddInfoList` (cmd 102): `mount`, `format`, `capacity` GB + `capacityM` MB remainder |
+* | tracks | several (101 **and** 103 on both 1436 and 3833), each with its own schedule | one per channel |
+* | schedule | per track, 7 `ScheduleAction` blocks: DayOfWeek + TimeOfDay range + ONE `ActionRecordingMode` | per trigger type, a 168-char weekly HOUR mask |
+* | triggers | `CMR`, `MOTION` | `Normal`, `MD`, `people`, `vehicle`, `dog_cat`, `crossline`, `intrude`, `loitering` |
+* | pre-record | `PreRecordTimeSeconds` | `preRecordTime` |
+* | post-record | `PostRecordTimeSeconds` | `recordDelayTime` |
+* | overwrite | per track `LoopEnable` | `cycle`, with `cycleList` enumerating the accepted values |
+* | segment length | not exposed on V5.7.1 | `packageTime` (minutes) |
+*
+* The two schedule models look different and are the same thing in
+* different coordinates: both answer "for this trigger, during which
+* weekly windows does the camera record". {@link RecordWindow} is that
+* question in one shape — Hikvision's ranges map straight onto it,
+* Reolink's mask expands into hour-aligned windows.
+*
+* ## Union, not intersection
+*
+* **The same fields exist on every camera.** What differs per device is
+* which VALUES that device accepts, and that is what {@link
+* RecordingOnboardOptions} reports — a `{ readable, writable, reason }`
+* per field plus the schedule's own limits. A control a camera cannot
+* honour is rendered DISABLED WITH ITS REASON, never missing and never
+* dead: disabled must not look like broken.
+*
+* ## Refusal by name
+*
+* A write a camera cannot honour is refused with a sentence the operator
+* can read — never accepted and dropped. Both providers refuse through
+* {@link describeOnboardRefusal}, so the vocabulary is one function and
+* one test, not two hand-written vendor opinions.
+*
+* Follows the D14 `deviceConfig` archetype (see `stream-params.cap.ts`):
+* `getOptions` advertises per-camera availability, `getStatus` (auto-
+* injected from `status`) reports the live values, and a single
+* `setSettings` mutation applies a partial change. No hand-written
+* settings-contribution methods.
+*/
+/**
+* What makes the camera start recording during a window.
+*
+* The union of both vendors' vocabularies. `continuous` is Hikvision's
+* `CMR` and Reolink's `Normal`; `motion` is `MOTION` / `MD`. The
+* object-class triggers are Reolink-only today and the smart-event ones
+* (`lineCrossing`, `intrusion`, `loitering`) are Reolink-only on the
+* firmwares measured — a camera that cannot record on a trigger simply
+* does not list it in `options.schedule.triggers`, and a window naming
+* it is REFUSED, not dropped.
+*/
+var RecordTriggerSchema = _enum([
+	"continuous",
+	"motion",
+	"person",
+	"vehicle",
+	"animal",
+	"lineCrossing",
+	"intrusion",
+	"loitering",
+	"alarmInput"
+]);
+/**
+* One weekly recording window: "on `day`, from `startMinute` to
+* `endMinute`, record on `trigger`".
+*
+* `day` is 0 = Monday … 6 = Sunday (ISO order, which is also the order
+* both firmwares enumerate). Minutes are local camera time since
+* midnight; `endMinute` may be 1440, meaning end of day — that is
+* Hikvision's literal `24:00` and Reolink's 24th mask slot, and
+* collapsing it to 0 would turn a whole-day window into an empty one.
+*/
+var RecordWindowSchema = object({
+	trigger: RecordTriggerSchema,
+	day: number().int().min(0).max(6),
+	startMinute: number().int().min(0).max(1439),
+	endMinute: number().int().min(1).max(1440)
+});
+/** Status of one physical volume, as the camera itself describes it. */
+var OnboardStorageVolumeSchema = object({
+	/** The camera's own id for the volume (`hdd/id`, Reolink `HddInfo/number`). */
+	id: string(),
+	/** The camera's own name for it, when it gives one (`hddName`). */
+	label: string().optional(),
+	status: _enum([
+		"ok",
+		"unformatted",
+		"error",
+		"offline",
+		"unknown"
+	]),
+	/**
+	* Total size in MB, or **null when the camera did not say**.
+	*
+	* Never 0 for an unreadable value: a measurement that failed is not a
+	* measurement (D393), and a card whose size is unknown must not be
+	* rendered as a card of size zero.
+	*/
+	capacityMb: number().nullable(),
+	/**
+	* Free space in MB, or null when unknown.
+	*
+	* **Not a proxy for "has footage".** Measured 2026-09-22: 1436 and
+	* 1439 both report exactly 11776 MB free — the fixed reserve a looping
+	* card converges on once it has wrapped. At loop steady state the
+	* number is identical whether the camera recorded yesterday or stopped
+	* a month ago.
+	*/
+	freeMb: number().nullable(),
+	/** True when the camera reports the volume writable (`property` RW). */
+	writable: boolean().optional()
+});
+object({
+	storage: discriminatedUnion("kind", [
+		object({
+			kind: literal("present"),
+			volumes: array(OnboardStorageVolumeSchema)
+		}),
+		object({
+			kind: literal("absent"),
+			reason: string()
+		}),
+		object({
+			kind: literal("unknown"),
+			reason: string()
+		})
+	]),
+	tracks: array(object({
+		id: string(),
+		enabled: boolean(),
+		isVideo: boolean(),
+		/** From the camera's own track description. Null when it does not say. */
+		codec: string().nullable(),
+		resolution: string().nullable(),
+		/** Per-track overwrite flag, where the firmware keeps it per track. */
+		overwriteWhenFull: boolean().nullable()
+	})),
+	/**
+	* The track the write path targets — the enabled VIDEO one. Null when
+	* no track could be identified, which is itself a refusal reason.
+	*/
+	primaryTrackId: string().nullable(),
+	/** Master "record to the card at all" switch. */
+	enabled: boolean().nullable(),
+	overwriteWhenFull: boolean().nullable(),
+	preRecordSec: number().nullable(),
+	postRecordSec: number().nullable(),
+	/** Length of one recorded file, in minutes. */
+	segmentMinutes: number().nullable(),
+	/** The primary track's weekly windows, flattened. */
+	windows: array(RecordWindowSchema),
+	/**
+	* How many windows the camera described that CamStack could NOT read —
+	* an unrecognised trigger, an unparseable clock, a weekday it does not
+	* name.
+	*
+	* A dropped window is work the reader threw away, and a schedule that
+	* silently shows fewer rows than the camera holds is how an operator
+	* saves back a schedule shorter than the one they were looking at
+	* (D391). Non-zero means the window list is INCOMPLETE and a write
+	* that replaces it would delete what was not shown — which is why a
+	* provider reporting a non-zero count also reports the schedule as not
+	* writable.
+	*/
+	unreadableWindows: number(),
+	/**
+	* The camera is scheduled to record and has NO usable storage.
+	*
+	* A first-class fact because it is the fleet's most common silent
+	* defect: measured 2026-09-22, 1441 and 3831 are both motion-recording
+	* to a card that is not there. Neither the schedule nor the storage
+	* read says anything wrong on its own; only the pair does.
+	*/
+	recordingToNowhere: boolean(),
+	lastFetchedAt: number()
+});
+/** Numeric range descriptor — `{ min, max, step }` per the getOptions convention. */
+var RangeSchema = object({
+	min: number(),
+	max: number(),
+	step: number()
+});
+/**
+* The values a camera actually takes for a numeric field, when they are a SET
+* rather than a range.
+*
+* `{min,max,step}` cannot say what these two firmwares do. Measured on 1436
+* (I91DN) on 2026-09-22 by writing each value and reading it back:
+*
+* - pre-record: `0, 5, 10, 15, 20, 25, 30` and `2147483647` (INT32_MAX, the
+*   camera's "no limit" — `-1` and `4294967295` both land on it);
+* - post-record: `5, 10, 30, 60, 120, 300, 600`.
+*
+* Neither is expressible as a step: the first has a sentinel two billion away
+* from its neighbours, the second doubles and then jumps. A range that tried
+* would forbid values the camera takes AND permit values it silently replaces
+* with 5 — wrong in both directions at once.
+*
+* `sentinel` names the member that is not a duration, so a surface can render
+* "no limit" instead of `2147483647` seconds.
+*/
+var AllowedValuesSchema = object({
+	values: array(number()).min(1),
+	sentinel: object({
+		value: number(),
+		meaning: _enum(["no-limit", "disabled"])
+	}).optional()
+});
+/**
+* Per-field availability on ONE camera.
+*
+* The field exists on every camera — this says whether this one can be
+* read and whether it can be written, and `reason` says why not when
+* either is false. The UI renders the control DISABLED with the reason
+* rather than hiding it, so a limitation is legible instead of looking
+* like a missing feature.
+*/
+var OnboardFieldSupportSchema = object({
+	readable: boolean(),
+	writable: boolean(),
+	/** Required whenever `readable` or `writable` is false. */
+	reason: string().optional()
+});
+/** What this camera's schedule model can express. */
+var OnboardScheduleSupportSchema = object({
+	support: OnboardFieldSupportSchema,
+	/**
+	* The smallest time step the camera can express, in minutes.
+	*
+	* Hikvision takes arbitrary minutes (`00:05:00`–`23:57:00` observed on
+	* 1436's track 103). Reolink's schedule is a 7×24 HOUR mask, so 60. A
+	* window whose edges are not a multiple of this is REFUSED rather than
+	* quietly rounded — rounding is how an operator's 06:30 becomes 06:00
+	* and nothing says so.
+	*/
+	granularityMinutes: number(),
+	/** Triggers this camera can record on. A window naming another is refused. */
+	triggers: array(RecordTriggerSchema),
+	/**
+	* False when the camera stores ONE trigger per time range, so two
+	* windows overlapping on the same day cannot carry different triggers.
+	* True on Reolink, whose mask is per-trigger and independent.
+	*/
+	supportsOverlappingTriggers: boolean()
+});
+var RecordingOnboardOptionsSchema = object({
+	enabled: OnboardFieldSupportSchema,
+	overwriteWhenFull: OnboardFieldSupportSchema,
+	preRecordSec: OnboardFieldSupportSchema,
+	preRecordSecRange: RangeSchema.optional(),
+	/** Preferred over the range when the camera takes a SET, not a span. */
+	preRecordSecAllowed: AllowedValuesSchema.optional(),
+	postRecordSec: OnboardFieldSupportSchema,
+	postRecordSecRange: RangeSchema.optional(),
+	/** Preferred over the range when the camera takes a SET, not a span. */
+	postRecordSecAllowed: AllowedValuesSchema.optional(),
+	segmentMinutes: OnboardFieldSupportSchema,
+	segmentMinutesRange: RangeSchema.optional(),
+	/** Preferred over the range when the camera takes a SET, not a span. */
+	segmentMinutesAllowed: AllowedValuesSchema.optional(),
+	schedule: OnboardScheduleSupportSchema
+});
+/**
+* A partial change. Every field optional.
+*
+* Unlike the other `deviceConfig` caps, a provider here does **NOT**
+* silently ignore a field it cannot support — it refuses, by name,
+* through {@link describeOnboardRefusal}. Silence on a recording setting
+* is the failure D62 exists to prevent: the operator believes the camera
+* is recording the way the form says, and it is not.
+*/
+var RecordingOnboardPatchSchema = object({
+	enabled: boolean().optional(),
+	overwriteWhenFull: boolean().optional(),
+	preRecordSec: number().optional(),
+	postRecordSec: number().optional(),
+	segmentMinutes: number().optional(),
+	/** The complete new window set for the primary track — not a delta. */
+	windows: array(RecordWindowSchema).optional()
+});
+DeviceType.Camera, method(object({ deviceId: number() }), RecordingOnboardOptionsSchema), method(object({
+	deviceId: number(),
+	settings: RecordingOnboardPatchSchema
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * A camera's own "record me NOW" LEVEL — a signal the device raises while
 * something it knows about is happening (a robot vacuum cleaning, a machine
 * running, a gate open) and lowers when it stops.
@@ -40179,6 +40909,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.listDeviceIdsByCaps": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.listLocationDescriptions": {
 		capName: "device-manager",
 		capScope: "system",
@@ -40665,24 +41401,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"events.getEventClipUrl": {
-		capName: "events",
-		capScope: "device",
-		addonId: null,
-		access: "view"
-	},
-	"events.getEvents": {
-		capName: "events",
-		capScope: "device",
-		addonId: null,
-		access: "view"
-	},
-	"events.getEventThumbnail": {
-		capName: "events",
-		capScope: "device",
-		addonId: null,
-		access: "view"
-	},
 	"faceGallery.assignFace": {
 		capName: "face-gallery",
 		capScope: "system",
@@ -42003,6 +42721,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.getTemplateCatalog": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.listDeviceMutes": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -42021,6 +42745,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.previewTemplate": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.resolveArtifactUrl": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -43557,224 +44287,236 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"recording.applyDeviceSettingsPatch": {
+	"recording.getAvailability": {
 		capName: "recording",
-		capScope: "system",
+		capScope: "device",
 		addonId: null,
-		access: "create"
+		access: "view"
 	},
-	"recording.cancelRelocateJob": {
+	"recording.getDaysWithRecordings": {
 		capName: "recording",
-		capScope: "system",
+		capScope: "device",
 		addonId: null,
-		access: "create"
+		access: "view"
 	},
-	"recording.cancelStorageMigrationMove": {
+	"recording.getPlayback": {
 		capName: "recording",
-		capScope: "system",
+		capScope: "device",
 		addonId: null,
-		access: "create"
+		access: "view"
 	},
-	"recording.deleteFootprint": {
+	"recording.getPlaybackOptions": {
 		capName: "recording",
-		capScope: "system",
+		capScope: "device",
 		addonId: null,
-		access: "delete"
+		access: "view"
 	},
-	"recording.getAvailability": {
+	"recording.listSources": {
 		capName: "recording",
-		capScope: "system",
+		capScope: "device",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getAvailabilityBatch": {
-		capName: "recording",
+	"recordingArchive.applyDeviceSettingsPatch": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "create"
 	},
-	"recording.getDaysWithRecordings": {
-		capName: "recording",
+	"recordingArchive.cancelRelocateJob": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "create"
 	},
-	"recording.getDaysWithRecordingsBatch": {
-		capName: "recording",
+	"recordingArchive.cancelStorageMigrationMove": {
+		capName: "recording-archive",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"recordingArchive.deleteFootprint": {
+		capName: "recording-archive",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"recordingArchive.getAvailabilityBatch": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getDeviceConfig": {
-		capName: "recording",
+	"recordingArchive.getDaysWithRecordingsBatch": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getDeviceLiveContribution": {
-		capName: "recording",
+	"recordingArchive.getDeviceConfig": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getDeviceSettingsContribution": {
-		capName: "recording",
+	"recordingArchive.getDeviceLiveContribution": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getPlacement": {
-		capName: "recording",
+	"recordingArchive.getDeviceSettingsContribution": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getPlaybackManifest": {
-		capName: "recording",
+	"recordingArchive.getPlacement": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getRelocateResidue": {
-		capName: "recording",
+	"recordingArchive.getRelocateResidue": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getStatus": {
-		capName: "recording",
+	"recordingArchive.getStatus": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getStorageMigrationMoveStatus": {
-		capName: "recording",
+	"recordingArchive.getStorageMigrationMoveStatus": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getStorageUsage": {
-		capName: "recording",
+	"recordingArchive.getStorageUsage": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.listOpsLog": {
-		capName: "recording",
+	"recordingArchive.listOpsLog": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.listRelocateJobs": {
-		capName: "recording",
+	"recordingArchive.listRelocateJobs": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.locateSegment": {
-		capName: "recording",
+	"recordingArchive.locateSegment": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.pauseForStorageMigration": {
-		capName: "recording",
+	"recordingArchive.pauseForStorageMigration": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.planStorageRebalance": {
-		capName: "recording",
+	"recordingArchive.planStorageRebalance": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.pruneFootage": {
-		capName: "recording",
+	"recordingArchive.pruneFootage": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.readGopBytes": {
-		capName: "recording",
+	"recordingArchive.readGopBytes": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.readSegmentBytes": {
-		capName: "recording",
+	"recordingArchive.readSegmentBytes": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.readWindowBytes": {
-		capName: "recording",
+	"recordingArchive.readWindowBytes": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.reconcileLedgerAgainstDisk": {
-		capName: "recording",
+	"recordingArchive.reconcileLedgerAgainstDisk": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.refreshStorageLocationsForMigration": {
-		capName: "recording",
+	"recordingArchive.refreshStorageLocationsForMigration": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.relocateFootage": {
-		capName: "recording",
+	"recordingArchive.relocateFootage": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.renderClip": {
-		capName: "recording",
+	"recordingArchive.renderClip": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.renderGif": {
-		capName: "recording",
+	"recordingArchive.renderGif": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.rescanStorage": {
-		capName: "recording",
+	"recordingArchive.rescanStorage": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.resumeForStorageMigration": {
-		capName: "recording",
+	"recordingArchive.resumeForStorageMigration": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.setDeviceConfig": {
-		capName: "recording",
+	"recordingArchive.setDeviceConfig": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.setDevicePlacement": {
-		capName: "recording",
+	"recordingArchive.setDevicePlacement": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.startStorageMigrationMove": {
-		capName: "recording",
+	"recordingArchive.startStorageMigrationMove": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.startStorageRebalance": {
-		capName: "recording",
+	"recordingArchive.startStorageRebalance": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
@@ -46079,21 +46821,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"events.getEventClipUrl": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
-	"events.getEvents": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
-	"events.getEventThumbnail": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
 	"faceGallery.getFaceByTrack": [{
 		name: "deviceId",
 		form: "single",
@@ -47012,107 +47739,117 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"recording.deleteFootprint": [{
+	"recording.getAvailability": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.getAvailability": [{
+	"recording.getDaysWithRecordings": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.getAvailabilityBatch": [{
-		name: "deviceIds",
-		form: "array",
+	"recording.getPlayback": [{
+		name: "deviceId",
+		form: "single",
 		optional: false
 	}],
-	"recording.getDaysWithRecordings": [{
+	"recording.getPlaybackOptions": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.getDaysWithRecordingsBatch": [{
-		name: "deviceIds",
-		form: "array",
+	"recording.listSources": [{
+		name: "deviceId",
+		form: "single",
 		optional: false
 	}],
-	"recording.getDeviceConfig": [{
+	"recordingArchive.deleteFootprint": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.getPlaybackManifest": [{
+	"recordingArchive.getAvailabilityBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
+	"recordingArchive.getDaysWithRecordingsBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
+	"recordingArchive.getDeviceConfig": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.listOpsLog": [{
+	"recordingArchive.listOpsLog": [{
 		name: "deviceId",
 		form: "single",
 		optional: true
 	}],
-	"recording.locateSegment": [{
+	"recordingArchive.locateSegment": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.pruneFootage": [{
+	"recordingArchive.pruneFootage": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.readGopBytes": [{
+	"recordingArchive.readGopBytes": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.readSegmentBytes": [{
+	"recordingArchive.readSegmentBytes": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.readWindowBytes": [{
+	"recordingArchive.readWindowBytes": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.reconcileLedgerAgainstDisk": [{
+	"recordingArchive.reconcileLedgerAgainstDisk": [{
 		name: "deviceId",
 		form: "single",
 		optional: true
 	}],
-	"recording.relocateFootage": [{
+	"recordingArchive.relocateFootage": [{
 		name: "deviceId",
 		form: "single",
 		optional: true
 	}],
-	"recording.renderClip": [{
+	"recordingArchive.renderClip": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.renderGif": [{
+	"recordingArchive.renderGif": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.rescanStorage": [{
+	"recordingArchive.rescanStorage": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.setDeviceConfig": [{
+	"recordingArchive.setDeviceConfig": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.setDevicePlacement": [{
+	"recordingArchive.setDevicePlacement": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.startStorageMigrationMove": [{
+	"recordingArchive.startStorageMigrationMove": [{
 		name: "deviceId",
 		form: "single",
 		optional: true
@@ -47631,6 +48368,41 @@ var NC_AUDIO_DEFAULTS = {
 };
 new Set(["devices", "classes"]);
 NC_AUDIO_DEFAULTS.hitPercent, NC_AUDIO_DEFAULTS.samplingSeconds;
+var RULE_BODY_ONLY = ["body"];
+var RULE_TEXT = ["title", "body"];
+var BATTERY = ["device-battery-low", "device-battery-normal"];
+var CONSUMABLE = ["device-consumable-low", "device-consumable-normal"];
+var UPDATES = [
+	"addon-update-available",
+	"server-update-available",
+	"wrapper-update-available"
+];
+var PACKAGE_UPDATES = ["addon-update-available", "server-update-available"];
+var ALARM = [
+	"alarm-triggered",
+	"alarm-armed",
+	"alarm-disarmed",
+	"alarm-arming",
+	"alarm-arm-refused",
+	"alarm-pending",
+	"alarm-rearmed",
+	"alarm-sensor-bypass",
+	"alarm-check-failed"
+];
+var COMBINED_ALARM = ["alarm-triggered"];
+var DEVICE_EVENTS = [
+	"device-online",
+	"device-offline",
+	"device-disabled",
+	"device-enabled",
+	...BATTERY,
+	...CONSUMABLE,
+	"stream-online",
+	"stream-offline",
+	"detection-blind",
+	...ALARM
+];
+[...DEVICE_EVENTS], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_BODY_ONLY], [...RULE_TEXT], [...RULE_TEXT], [...DEVICE_EVENTS], [...RULE_TEXT], [...DEVICE_EVENTS], [...RULE_TEXT], [...BATTERY, ...CONSUMABLE], [...RULE_TEXT], [...CONSUMABLE], [...RULE_TEXT], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT];
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -49157,4 +49929,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { deriveDetailCropRect as $, buildFfmpegArgs as $t, PoolMemoryWatchdog as A, preprocess as An, pipelineExecutorCapability as At, addonWidgetsSourceCapability as B, resolvePoolMemoryPolicy as Bt, FailureCounters as C, array as Cn, motionDetectionCapability as Ct, NativeLeaseAdmissionSchema as D, literal as Dn, pickClusterStepSettings as Dt, MOTION_CLOSE_AFTER_MS as E, lazy as En, pickClusterStepModels as Et, RecordingSignalStatusSchema as F, recordingSignalCapability as Ft, cameraStreamsCapability as G, streamBrokerCapability as Gt, audioAnalyzerCapability as H, runtimeDevices as Ht, RingBuffer as I, resolveClusterStepModelId as It, createHwAccelCache as J, videoclipsCapability as Jt, clipExportFailure as K, stripRetiredBandPreBufferSec as Kt, VIDEOCLIPS_MAX_OFFER_BYTES as L, resolveCreateExportSubject as Lt, RATE_CONTROL_TIGHT as M, string as Mn, rankStreams as Mt, RECORDING_EXPORT_MAX_READ_BYTES as N, union as Nn, recordingCapability as Nt, NativeLeaseSettingsSchema as O, number as On, pickDetailCropConvention as Ot, RecordingConfigSchema as P, EventCategory as Pn, recordingExportCapability as Pt, deriveBatteryPresence as Q, Fmp4BoxSplitter as Qt, VISIT_MERGE_GAP_MS as R, resolveEgressDecodeHwAccel as Rt, ExportRecordSchema as S, _enum as Sn, modeMayWrite as St, HF_BASE_URL as T, discriminatedUnion as Tn, parseProcStatus as Tt, audioKindId as U, storageEvictableCapability as Ut, audioAnalysisCapability as V, resolveRecordingProfiles as Vt, batteryCapability as W, storageOccupancyCapability as Wt, declareLogChannel as X, errMsg as Xt, createLogChannelsProvider as Y, webrtcSessionCapability as Yt, defaultDeviceFor as Z, AUDIO_PRESETS as Zt, DEFAULT_NATIVE_LEASE_SETTINGS as _, nodePin as _n, mapAudioLabelToMacro as _t, CLIP_BROKER_PACED_RATES as a, CamProfileSchema as an, evaluateSensorEdge as at, EVENT_PAD_MS as b, selectAssignedProfileSlots as bn, mayWriteToLocation as bt, CLIP_STREAM_TRANSPORT_HEADER as c, audioChunkBytesPerSample as cn, evictionPolicyOfLocation as ct, DEFAULT_AUDIO_ANALYZER_CONFIG as d, defineCustomActions as dn, gbToBytes as dt, invocationFromEncodeProfile as en, deriveRecordingMode as et, DEFAULT_CLUSTER_STEP_MODELS as f, expandAudioChunkToF32le as fn, hfModelUrl as ft, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as g, makeSourceBrokerId as gn, logChannelsCapability as gt, DEFAULT_EVENTS_BAND_BUFFER_SEC as h, makeProfileBrokerId as hn, loadContributionCapability as ht, BatteryStatusSchema as i, CAM_PROFILE_ORDER as in, enumerateInferenceDevices as it, RATE_CONTROL_RELAXED as j, record as jn, pipelineRunnerCapability as jt, OpsLogEntrySchema as k, object as kn, pickNativeLeaseOverride as kt, COCO_80_LABELS as l, createEvent as ln, exportSubjectOf as lt, DEFAULT_DETAIL_CROP_CONVENTION as m, isEvent as mn, isFirstLevelMacroClass as mt, AUDIO_BACKEND_CHOICES as n, BOOT_RECOVERY_BACKOFF_MS as nn, egressTranscodeSharingKey as nt, CLIP_STILL_REASON_CODE_HEADER as o, DeviceFeature as on, evaluateZoneRules as ot, DEFAULT_CLUSTER_STEP_SETTINGS as p, hydrateSchema as pn, inferModelProvider as pt, clipExportFailureOf as q, supportedRuntimes as qt, AUDIO_MACRO_LABELS as r, BaseAddon as rn, egressTransportFromRequest as rt, CLIP_STILL_REASON_HEADER as s, DeviceType as sn, evictionPolicyForMode as st, APPLE_SA_TO_MACRO as t, isSoftwareDecode as tn, detectionPipelineCapability as tt, COCO_TO_MACRO as u, customAction as un, failureContributionCapability as ut, DEVICE_BACKEND_TO_FORMAT as v, parseJsonUnknown as vn, maskUrlCredentials as vt, G711_SCALE_CORRECTION_DB as w, boolean as wn, overlayClusterStepSettings as wt, EncodeProfileSchema as x, sleep as xn, migrateLegacyDeviceSignalConfig as xt, EVENT_OWNER_TYPES as y, parseProfileBrokerId as yn, mayReadLocation as yt, YAMNET_TO_MACRO as z, resolveLocationMode as zt };
+export { defaultDeviceFor as $, errMsg as $t, PoolMemoryWatchdog as A, literal as An, pickDetailCropConvention as At, VISIT_MERGE_GAP_MS as B, resolveCreateExportSubject as Bt, FailureCounters as C, selectAssignedProfileSlots as Cn, migrateLegacyDeviceSignalConfig as Ct, NativeLeaseAdmissionSchema as D, boolean as Dn, parseProcStatus as Dt, MOTION_CLOSE_AFTER_MS as E, array as En, overlayClusterStepSettings as Et, RECORDING_SOURCE_CAMSTACK_ADDON as F, string as Fn, recordingArchiveCapability as Ft, audioKindId as G, runtimeDevices as Gt, addonWidgetsSourceCapability as H, resolveLocationMode as Ht, RecordingConfigSchema as I, union as In, recordingCapability as It, clipExportFailure as J, streamBrokerCapability as Jt, batteryCapability as K, storageEvictableCapability as Kt, RecordingSignalStatusSchema as L, EventCategory as Ln, recordingExportCapability as Lt, RATE_CONTROL_TIGHT as M, object as Mn, pipelineExecutorCapability as Mt, RECORDING_EXPORT_MAX_READ_BYTES as N, preprocess as Nn, pipelineRunnerCapability as Nt, NativeLeaseSettingsSchema as O, discriminatedUnion as On, pickClusterStepModels as Ot, RECORDING_SOURCE_CAMSTACK as P, record as Pn, rankStreams as Pt, declareLogChannel as Q, webrtcSessionCapability as Qt, RingBuffer as R, recordingSignalCapability as Rt, ExportRecordSchema as S, parseProfileBrokerId as Sn, mayWriteToLocation as St, HF_BASE_URL as T, _enum as Tn, motionDetectionCapability as Tt, audioAnalysisCapability as U, resolvePoolMemoryPolicy as Ut, YAMNET_TO_MACRO as V, resolveEgressDecodeHwAccel as Vt, audioAnalyzerCapability as W, resolveRecordingProfiles as Wt, createHwAccelCache as X, supportedRuntimes as Xt, clipExportFailureOf as Y, stripRetiredBandPreBufferSec as Yt, createLogChannelsProvider as Z, videoclipsCapability as Zt, DEFAULT_NATIVE_LEASE_SETTINGS as _, isEvent as _n, loadContributionCapability as _t, CLIP_BROKER_PACED_RATES as a, BOOT_RECOVERY_BACKOFF_MS as an, egressTransportFromRequest as at, EVENT_PAD_MS as b, nodePin as bn, maskUrlCredentials as bt, CLIP_STREAM_TRANSPORT_HEADER as c, CamProfileSchema as cn, evaluateZoneRules as ct, DEFAULT_AUDIO_ANALYZER_CONFIG as d, audioChunkBytesPerSample as dn, exportSubjectOf as dt, AUDIO_PRESETS as en, deriveBatteryPresence as et, DEFAULT_CLUSTER_STEP_MODELS as f, createEvent as fn, failureContributionCapability as ft, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as g, hydrateSchema as gn, isFirstLevelMacroClass as gt, DEFAULT_EVENTS_BAND_BUFFER_SEC as h, expandAudioChunkToF32le as hn, inferModelProvider as ht, BatteryStatusSchema as i, isSoftwareDecode as in, egressTranscodeSharingKey as it, RATE_CONTROL_RELAXED as j, number as jn, pickNativeLeaseOverride as jt, OpsLogEntrySchema as k, lazy as kn, pickClusterStepSettings as kt, COCO_80_LABELS as l, DeviceFeature as ln, evictionPolicyForMode as lt, DEFAULT_DETAIL_CROP_CONVENTION as m, defineCustomActions as mn, hfModelUrl as mt, AUDIO_BACKEND_CHOICES as n, buildFfmpegArgs as nn, deriveRecordingMode as nt, CLIP_STILL_REASON_CODE_HEADER as o, BaseAddon as on, enumerateInferenceDevices as ot, DEFAULT_CLUSTER_STEP_SETTINGS as p, customAction as pn, gbToBytes as pt, cameraStreamsCapability as q, storageOccupancyCapability as qt, AUDIO_MACRO_LABELS as r, invocationFromEncodeProfile as rn, detectionPipelineCapability as rt, CLIP_STILL_REASON_HEADER as s, CAM_PROFILE_ORDER as sn, evaluateSensorEdge as st, APPLE_SA_TO_MACRO as t, Fmp4BoxSplitter as tn, deriveDetailCropRect as tt, COCO_TO_MACRO as u, DeviceType as un, evictionPolicyOfLocation as ut, DEVICE_BACKEND_TO_FORMAT as v, makeProfileBrokerId as vn, logChannelsCapability as vt, G711_SCALE_CORRECTION_DB as w, sleep as wn, modeMayWrite as wt, EncodeProfileSchema as x, parseJsonUnknown as xn, mayReadLocation as xt, EVENT_OWNER_TYPES as y, makeSourceBrokerId as yn, mapAudioLabelToMacro as yt, VIDEOCLIPS_MAX_OFFER_BYTES as z, resolveClusterStepModelId as zt };