@camstack/addon-pipeline 1.2.288 → 1.2.291

package/dist/{dist-CegiJ2Pw.js → dist-D7FonEUB.js}

@@ -5360,7 +5360,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-COWaSCAi.mjs
+//#region ../types/dist/sleep-D_4W7xuQ.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6544,6 +6544,24 @@ function normalizeAddonInitResult(result) {
 	if (Array.isArray(result)) return { providers: result };
 	return result;
 }
+/** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
+var PeerBytesTicketSchema = object({
+	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
+	url: string().min(1),
+	/**
+	* The HOST node this URL means something on — the hub or a named agent,
+	* never a runner. {@link AddonPeerBytes.open} compares it to its own and
+	* refuses `cross-node` by name when they differ, without dialling.
+	*/
+	hostNodeId: string().min(1),
+	expiresAtMs: number().int().nonnegative(),
+	/**
+	* What the producer DECLARED the body to be, when it knows — `null` when it
+	* does not. Never `0` for unknown (D393): a consumer sizing a bound off this
+	* must be able to tell "the producer did not say" from "the body is empty".
+	*/
+	declaredBytes: number().int().nonnegative().nullable()
+});
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = _enum([
 	"high",
@@ -7516,11 +7534,17 @@ var RawStateResultSchema = object({
 method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(object({ deviceId: number() }), array(ConfigEntrySchema$1)), method(object({
 	deviceId: number(),
 	values: record(string(), unknown())
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	deviceId: number(),
 	action: string().min(1),
 	input: unknown()
-}), unknown(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
+}), unknown(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
 /**
 * The ONE retry schedule for work that can fail simply because the node was
 * still booting.
@@ -8740,24 +8764,6 @@ object({
 		unreachable: number()
 	})
 });
-/** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
-var PeerBytesTicketSchema = object({
-	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
-	url: string().min(1),
-	/**
-	* The HOST node this URL means something on — the hub or a named agent,
-	* never a runner. {@link AddonPeerBytes.open} compares it to its own and
-	* refuses `cross-node` by name when they differ, without dialling.
-	*/
-	hostNodeId: string().min(1),
-	expiresAtMs: number().int().nonnegative(),
-	/**
-	* What the producer DECLARED the body to be, when it knows — `null` when it
-	* does not. Never `0` for unknown (D393): a consumer sizing a bound off this
-	* must be able to tell "the producer did not say" from "the body is empty".
-	*/
-	declaredBytes: number().int().nonnegative().nullable()
-});
 /**
 * Adoption job — the background form of `device-adoption.adopt`.
 *
@@ -8869,7 +8875,7 @@ var AdoptionJobSchema = object({
 * component's original options — detection to the detection-pipeline wrapper
 * binding, audio analysis to its own, recording to `RecordingConfig.enabled`
 * (which was always first-class; the switch was a veneer over
-* `recording.setDeviceConfig`), notifications to a notification-center
+* `recordingArchive.setDeviceConfig`), notifications to a notification-center
 * per-device setting, the two camera planes to their own components.
 *
 * What survives is {@link composeSwitchedOff}: `CameraStatus.switchedOff`, the
@@ -8895,7 +8901,7 @@ var AdoptionJobSchema = object({
 * | `stream-broker` | `deviceManager.setDisabled` | `StreamBrokerManager.reconcileAllCatalogs` releases the brokers; `ensureBroker` refuses re-creation |
 * | `object-detection` | `deviceManager.setWrapperActive('detection-pipeline')` | `PipelineSettingsStore.resolvePipelineForDevice` returns `{ steps: [], audio: null }` |
 * | `audio-analysis` | `deviceManager.setWrapperActive('audio-analysis')` | `AudioSubscriptionController.subscribeAudioStream` returns `null` before opening the stream |
-* | `recording` | `recording.setDeviceConfig` → `RecordingConfig.enabled` | `band-decision.shouldRecord` returns false; the controller detaches the device |
+* | `recording` | `recordingArchive.setDeviceConfig` → `RecordingConfig.enabled` | `band-decision.shouldRecord` returns false; the controller detaches the device |
 * | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
 * | `privacy-mask` | `privacyMask.setMask({ enabled })` → the CAMERA | the camera blanks the masked regions itself; every stream and recording carries the black boxes |
 * | `device-audio` | `privacyMask.setAudioEnabled` → the CAMERA | the camera stops encoding an audio track at all; every consumer sees silent video |
@@ -13608,60 +13614,8 @@ method(ListInputSchema, array(BrokerInfoSchema$1)), method(GetInputSchema, Broke
 }), method(UnsubscribeInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(GetStateInputSchema, unknown().nullable()), method(_void(), RegistryStatusSchema);
+}), method(GetStateInputSchema, unknown().nullable(), { auth: "admin" }), method(_void(), RegistryStatusSchema);
 DeviceType.Camera;
-/**
-* The signals a device can emit to WAKE its own stream.
-*
-* A camera whose stream is built on demand sleeps until something asks for it,
-* and "something" cannot be a consumer that is merely attached — a Frigate-style
-* puller holds a session open for ever, and treating that as demand would keep
-* a battery camera awake for ever, which is the whole thing the battery is for
-* (D173). So the wake has to come from the CAMERA: an event it noticed by
-* itself, with no stream running.
-*
-* ## The vocabulary is the PROVIDER'S, not ours
-*
-* Like `consumables`, this cap declares no vocabulary of its own. A provider
-* names each signal with a `code` it chooses and a `label` an operator reads.
-* Reolink offers motion and camera-native detection; another provider may offer
-* a tamper, a doorbell press, a PIR, or something no camera in this fleet has
-* yet. A fixed enum here would mean every new signal is a framework release.
-*
-* It is deliberately NOT derived from the caps a device already binds. Whether
-* a camera CAN push firmware motion is expressed by `motionSources` containing
-* `'onboard'`, and whether it does AI on-camera by the `native-object-detection`
-* binding — but both answer "what drives the detection pipeline", which is a
-* different question from "what may wake a sleeping stream". A camera can do
-* the first and not be trusted with the second, and the operator picks per
-* camera. Two questions, two authorities.
-*
-* ## Availability is not permission
-*
-* `listSignals` says what the device CAN emit. Whether a given signal actually
-* wakes the stream is the operator's per-camera choice, held by the broker
-* alongside the cooldown — see the stream-broker cap's wake settings. A
-* provider declaring a signal is not a provider enabling it.
-*/
-/** One signal a device can emit. */
-var StreamSignalSchema = object({
-	/** Stable id chosen by the provider, e.g. `'motion'`, `'person'`, `'tamper'`. */
-	code: string().min(1),
-	/** What an operator reads in the picker. The provider's own wording. */
-	label: string().min(1),
-	/**
-	* Whether the provider recommends this signal ON when a camera is first set
-	* up. A provider knows which of its signals are cheap and reliable; an
-	* operator should not have to discover that by trial. Reolink recommends
-	* both of its own.
-	*/
-	recommended: boolean()
-});
-object({
-	signals: array(StreamSignalSchema),
-	lastFetchedAt: number()
-});
-Object.values(DeviceType), method(_void(), array(StreamSignalSchema).readonly());
 /** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
 var StreamFormatSchema = _enum([
 	"webrtc",
@@ -15095,17 +15049,20 @@ method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string()
-}), unknown()), method(object({
+}), unknown(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string(),
 	value: unknown()
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: QueryFilterSchema.optional(),
 	columns: array(string()).readonly().optional()
-}), array(SettingsRecordSchema).readonly()), method(object({
+}), array(SettingsRecordSchema).readonly(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	/** Declared columns identifying the slot; must be covered by a UNIQUE
@@ -15115,7 +15072,10 @@ method(object({
 }), object({ 
 /** The id the row HAS: assigned by SQLite on an insert, or the existing
 *  row's own id on an update. */
-id: union([string(), number()]) }), { kind: "mutation" }), method(object({
+id: union([string(), number()]) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	record: object({
@@ -15128,38 +15088,56 @@ id: union([string(), number()]) }), { kind: "mutation" }), method(object({
 * for an absent one, or the ROWID SQLite assigned on an `INTEGER`
 * primary key — which is the only place an auto key is knowable.
 */
-id: union([string(), number()]) }), { kind: "mutation" }), method(object({
+id: union([string(), number()]) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	records: array(BulkRecordSchema).readonly()
-}), object({ inserted: number().int() }), { kind: "mutation" }), method(object({
+}), object({ inserted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	id: string(),
 	data: record(string(), unknown())
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string()
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: MutationFilterSchema
-}), object({ deleted: number().int() }), { kind: "mutation" }), method(object({
+}), object({ deleted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: MutationFilterSchema,
 	data: record(string(), unknown())
-}), object({ updated: number().int() }), { kind: "mutation" }), method(object({
+}), object({ updated: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: QueryFilterSchema.optional()
-}), number()), method(object({
+}), number(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	fields: array(AggregateFieldSchema).readonly(),
 	filter: QueryFilterSchema.optional()
-}), AggregateResultSchema), method(object({
+}), AggregateResultSchema, { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	field: string(),
@@ -15169,15 +15147,18 @@ id: union([string(), number()]) }), { kind: "mutation" }), method(object({
 }), array(object({
 	bucket: number().int(),
 	count: number().int()
-})).readonly()), method(object({
+})).readonly(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string()
-}), boolean()), method(object({
+}), boolean(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	columns: array(CollectionColumnSchema).readonly(),
 	indexes: array(CollectionIndexSchema).readonly().optional()
-}), _void(), { kind: "mutation" });
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * What one engine says about itself. The orchestrator uses `kind` to pick
 * a registrant for a collection; `engineId` is what a log line names when
@@ -15410,6 +15391,97 @@ var detectionPipelineCapability = {
 	methods: {}
 };
 /**
+* device-admin-link — "this device has a management page of its own, and here
+* is its address".
+*
+* ## Why this is not a `deviceConfig` cap
+*
+* There is nothing to edit. A `deviceConfig` cap (D14) exists so the framework
+* can DERIVE a settings form from `getOptions` + `getStatus` and route a flat
+* patch back through a setter; it costs a `builderId` reducer in
+* `device-config-contribution.ts` and a `*-config-schema.ts` beside it, and it
+* renders a form section. This cap answers ONE question with ONE read and
+* renders a button. Nothing about it is a form, so it carries no `deviceConfig`
+* block, no `settings`, no `runtimeState` and no reducer — exactly like
+* `reboot`, the other pure-RPC device-native cap.
+*
+* ## Absent, and the difference between "no page" and "we cannot say"
+*
+* The two are answered at DIFFERENT layers, on purpose:
+*
+*  - **"We cannot say"** → the provider never registers the cap for that
+*    device. A VeSync humidifier, a Petkit feeder, a Dreame vacuum and a Dreo
+*    fan are reached only through a vendor cloud; there is no address to hand
+*    out and no page to open. A Tuya plug, a Wyze camera and a Gree air
+*    conditioner DO have a LAN IP, and still have no HTTP management page
+*    behind it. None of them register, so `deviceManager.getBindings` never
+*    lists the cap and no surface asks.
+*  - **"This device has no page, and I know that"** → the provider registers
+*    and `getAdminLink` returns `null`. This is the answer for a device whose
+*    sibling DOES have a page: a Reolink battery camera reached over UDP by
+*    `uid` with a blank `host`, an Ecowitt gateway configured in `listener`
+*    transport, a Home Assistant broker authenticated by supervisor token
+*    (which carries no `baseUrl` at all).
+*
+* Both draw NOTHING. A button that opens a browser error is worse than no
+* button, and D62 is the same rule from the other side: an off switch is
+* reported off, never made to look broken. There is no third state where the
+* UI renders a disabled button "because the device might have a page".
+*
+* ## The URL never carries credentials
+*
+* Not in userinfo, not in a query string. Every provider builds through
+* `buildDeviceAdminUrl` (`device-admin-link-url.ts`), which takes host, port,
+* scheme and path as separate arguments — there is no parameter a secret could
+* arrive in — and re-checks its own output for the `scheme://user:pass@` shape
+* that `scripts/check-no-credential-urls-in-fixtures.ts` bans from recorded
+* output. `scripts/check-admin-link-builder-is-the-only-url-source.ts` is what
+* keeps providers from hand-rolling one anyway.
+*
+* This matters here more than anywhere else in the repo, because every provider
+* that knows a device's host knows its PASSWORD too: `{ host, port, username,
+* password }` sit in one object on Hikvision, Amcrest, Reolink and ONVIF alike,
+* and `http://admin:hunter2@192.168.50.139/` is a URL a browser accepts. The
+* camera's own page will ask for its own login. That is correct, and pre-
+* filling it is the operator's business, not ours.
+*
+* ## It is a LAN fact
+*
+* The URL addresses the device where the NODE can see it. It is not proxied,
+* not made reachable from outside, and not sent anywhere. A surface renders it
+* as a link the operator's own browser follows, on the operator's own network,
+* or renders nothing.
+*/
+/**
+* Whose page is it. The distinction is for the OPERATOR, who needs to know
+* before clicking whether he is about to land on a camera's own web server or
+* inside Home Assistant.
+*/
+var AdminLinkTargetEnum = _enum(["device", "integration"]);
+var DeviceAdminLinkSchema = object({
+	/**
+	* Absolute `http(s)://` URL. Built by `buildDeviceAdminUrl` and therefore
+	* free of userinfo and of any credential-shaped query key.
+	*/
+	url: string(),
+	/**
+	* What the surface calls it — "Web UI", "Home Assistant", "UniFi controller".
+	* The PROVIDER names it, because only the provider knows what the page is;
+	* a UI that invented the label from the addon id would call the Home
+	* Assistant device page "Provider Homeassistant".
+	*/
+	label: string(),
+	target: AdminLinkTargetEnum,
+	/**
+	* Host the URL points at, without scheme, port or path — for the tooltip, so
+	* an operator can see WHERE the button goes before he follows it. Redundant
+	* with `url` by construction; carried separately so no surface has to parse
+	* a URL to show it.
+	*/
+	host: string()
+});
+method(object({ deviceId: number().int().nonnegative() }), DeviceAdminLinkSchema.nullable(), { auth: "admin" });
+/**
 * Identity envelope for a device's upstream-system metadata.
 *
 * Two jobs:
@@ -15737,97 +15809,6 @@ method(object({ integrationId: string() }), object({ filters: array(AdoptionFilt
 	auth: "admin"
 });
 /**
-* device-admin-link — "this device has a management page of its own, and here
-* is its address".
-*
-* ## Why this is not a `deviceConfig` cap
-*
-* There is nothing to edit. A `deviceConfig` cap (D14) exists so the framework
-* can DERIVE a settings form from `getOptions` + `getStatus` and route a flat
-* patch back through a setter; it costs a `builderId` reducer in
-* `device-config-contribution.ts` and a `*-config-schema.ts` beside it, and it
-* renders a form section. This cap answers ONE question with ONE read and
-* renders a button. Nothing about it is a form, so it carries no `deviceConfig`
-* block, no `settings`, no `runtimeState` and no reducer — exactly like
-* `reboot`, the other pure-RPC device-native cap.
-*
-* ## Absent, and the difference between "no page" and "we cannot say"
-*
-* The two are answered at DIFFERENT layers, on purpose:
-*
-*  - **"We cannot say"** → the provider never registers the cap for that
-*    device. A VeSync humidifier, a Petkit feeder, a Dreame vacuum and a Dreo
-*    fan are reached only through a vendor cloud; there is no address to hand
-*    out and no page to open. A Tuya plug, a Wyze camera and a Gree air
-*    conditioner DO have a LAN IP, and still have no HTTP management page
-*    behind it. None of them register, so `deviceManager.getBindings` never
-*    lists the cap and no surface asks.
-*  - **"This device has no page, and I know that"** → the provider registers
-*    and `getAdminLink` returns `null`. This is the answer for a device whose
-*    sibling DOES have a page: a Reolink battery camera reached over UDP by
-*    `uid` with a blank `host`, an Ecowitt gateway configured in `listener`
-*    transport, a Home Assistant broker authenticated by supervisor token
-*    (which carries no `baseUrl` at all).
-*
-* Both draw NOTHING. A button that opens a browser error is worse than no
-* button, and D62 is the same rule from the other side: an off switch is
-* reported off, never made to look broken. There is no third state where the
-* UI renders a disabled button "because the device might have a page".
-*
-* ## The URL never carries credentials
-*
-* Not in userinfo, not in a query string. Every provider builds through
-* `buildDeviceAdminUrl` (`device-admin-link-url.ts`), which takes host, port,
-* scheme and path as separate arguments — there is no parameter a secret could
-* arrive in — and re-checks its own output for the `scheme://user:pass@` shape
-* that `scripts/check-no-credential-urls-in-fixtures.ts` bans from recorded
-* output. `scripts/check-admin-link-builder-is-the-only-url-source.ts` is what
-* keeps providers from hand-rolling one anyway.
-*
-* This matters here more than anywhere else in the repo, because every provider
-* that knows a device's host knows its PASSWORD too: `{ host, port, username,
-* password }` sit in one object on Hikvision, Amcrest, Reolink and ONVIF alike,
-* and `http://admin:hunter2@192.168.50.139/` is a URL a browser accepts. The
-* camera's own page will ask for its own login. That is correct, and pre-
-* filling it is the operator's business, not ours.
-*
-* ## It is a LAN fact
-*
-* The URL addresses the device where the NODE can see it. It is not proxied,
-* not made reachable from outside, and not sent anywhere. A surface renders it
-* as a link the operator's own browser follows, on the operator's own network,
-* or renders nothing.
-*/
-/**
-* Whose page is it. The distinction is for the OPERATOR, who needs to know
-* before clicking whether he is about to land on a camera's own web server or
-* inside Home Assistant.
-*/
-var AdminLinkTargetEnum = _enum(["device", "integration"]);
-var DeviceAdminLinkSchema = object({
-	/**
-	* Absolute `http(s)://` URL. Built by `buildDeviceAdminUrl` and therefore
-	* free of userinfo and of any credential-shaped query key.
-	*/
-	url: string(),
-	/**
-	* What the surface calls it — "Web UI", "Home Assistant", "UniFi controller".
-	* The PROVIDER names it, because only the provider knows what the page is;
-	* a UI that invented the label from the addon id would call the Home
-	* Assistant device page "Provider Homeassistant".
-	*/
-	label: string(),
-	target: AdminLinkTargetEnum,
-	/**
-	* Host the URL points at, without scheme, port or path — for the tooltip, so
-	* an operator can see WHERE the button goes before he follows it. Redundant
-	* with `url` by construction; carried separately so no surface has to parse
-	* a URL to show it.
-	*/
-	host: string()
-});
-method(object({ deviceId: number().int().nonnegative() }), DeviceAdminLinkSchema.nullable(), { auth: "admin" });
-/**
 * `device-export` — collection cap for addons that export camstack
 * devices to external ecosystems (HomeAssistant via MQTT discovery,
 * HomeKit/HAP, Alexa Smart Home, …).
@@ -15892,7 +15873,13 @@ var ExposeInputSchema = object({
 	capabilities: array(string()).optional()
 });
 var UnexposeInputSchema = object({ deviceId: string() });
-method(_void(), DeviceExportStatusSchema), method(_void(), array(DeviceKindSchema)), method(_void(), array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), { kind: "mutation" }), method(UnexposeInputSchema, _void(), { kind: "mutation" });
+method(_void(), DeviceExportStatusSchema), method(_void(), array(DeviceKindSchema)), method(_void(), array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(UnexposeInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /** Wire/storage schema for one icon id. */
 var LocationIconIdSchema = _enum([
 	"map-pin",
@@ -16396,7 +16383,10 @@ method(object({
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 12 * 6e4
-}), method(DeviceRegisterPayloadSchema, _void(), { kind: "mutation" }), method(DeviceRemovePayloadSchema, _void(), { kind: "mutation" }), method(DevicePersistConfigPayloadSchema, _void(), { kind: "mutation" }), method(object({ deviceId: number() }), record(string(), unknown())), method(object({ deviceId: number() }), record(string(), unknown())), method(object({ deviceId: number() }), DeviceMetaSchema.nullable()), method(object({
+}), method(DeviceRegisterPayloadSchema, _void(), { kind: "mutation" }), method(DeviceRemovePayloadSchema, _void(), { kind: "mutation" }), method(DevicePersistConfigPayloadSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number() }), record(string(), unknown()), { auth: "admin" }), method(object({ deviceId: number() }), record(string(), unknown()), { auth: "admin" }), method(object({ deviceId: number() }), DeviceMetaSchema.nullable()), method(object({
 	deviceId: number(),
 	name: string()
 }), _void(), {
@@ -16601,7 +16591,7 @@ method(object({
 }), method(object({ deviceId: number() }), array(StreamProbeResultSchema), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceId: number() }), DeviceBindingsForDeviceSchema), method(object({ deviceIds: array(number()) }), array(DeviceBindingsForDeviceSchema)), method(object({}), array(DeviceBindingsForDeviceSchema)), method(object({
+}), method(object({ deviceId: number() }), DeviceBindingsForDeviceSchema), method(object({ deviceIds: array(number()) }), array(DeviceBindingsForDeviceSchema)), method(object({}), array(DeviceBindingsForDeviceSchema)), method(object({ capNames: array(string().min(1)).min(1).max(16) }), array(number())), method(object({
 	deviceId: number(),
 	capName: string(),
 	wrapperAddonId: string(),
@@ -18219,7 +18209,22 @@ var StatusSchema = object({
 	brokerCount: number(),
 	embeddedRunning: boolean()
 });
-method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema), method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(IdInputSchema, TestResultSchema$1, { kind: "mutation" }), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(_void(), StatusSchema);
+method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }), method(AddBrokerInputSchema, AddBrokerResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(IdInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(IdInputSchema, TestResultSchema$1, {
+	kind: "mutation",
+	auth: "admin"
+}), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(IdInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), StatusSchema);
 var NetworkEndpointSchema = object({
 	url: string(),
 	hostname: string(),
@@ -18514,6 +18519,18 @@ var TargetKindSchema = object({
 	*/
 	iconMediaType: string().optional(),
 	configSchema: ConfigSchemaPassthrough,
+	/**
+	* The config keys that decide WHERE this kind's secrets are sent (server,
+	* base URL, instance, chat, recipient). A save that changes any of them
+	* while leaving a secret redacted is refused by the provider (D634), so an
+	* editor uses this to ask for the secret on exactly those edits instead of
+	* on every edit.
+	*
+	* Optional: absent from a provider that holds no secret (the Home Assistant
+	* kinds) and from a provider older than this field — an editor that finds
+	* it absent must assume ANY edit may need the secret.
+	*/
+	destinationKeys: array(string()).optional(),
 	supportsDiscovery: boolean(),
 	caps: TargetKindCapsSchema
 });
@@ -18552,19 +18569,34 @@ var SendResultSchema = object({
 });
 /** Same shape as SendResult — kept as a distinct name for the test panel. */
 var TestResultSchema = SendResultSchema;
-method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema)), method(object({
+method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema), { auth: "admin" }), method(object({
 	kind: string(),
 	config: record(string(), unknown()).optional()
-}), array(DiscoveredTargetSchema)), method(object({
+}), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
 	targetId: string(),
 	notification: NotificationSchema
-}), SendResultSchema, { kind: "mutation" }), method(object({
+}), SendResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	targetId: string(),
 	sample: NotificationSchema.optional()
-}), TestResultSchema, { kind: "mutation" }), method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }), method(object({ targetId: string() }), _void(), { kind: "mutation" }), method(object({
+}), TestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ target: TargetSchema }), TargetSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ targetId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	targetId: string(),
 	enabled: boolean()
-}), _void(), { kind: "mutation" });
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 var COCO_80_LABELS = [
 	{
 		id: "person",
@@ -19411,6 +19443,7 @@ sub("presence", "sensor", "sensor", "#22c55e", "presence", "Presence");
 sub("enum-sensor", "sensor", "sensor", TAXONOMY_COLORS.sensor, "generic", "Sensor state");
 sub("device-event", "sensor", "sensor", "#10b981", "button", "Device event");
 sub("lock", "control", "control", "#0ea5e9", "lock", "Lock");
+sub("cover", "control", "control", "#0ea5e9", "door", "Cover");
 sub("switch", "control", "control", TAXONOMY_COLORS.control, "switch", "Switch");
 sub("siren", "control", "control", "#dc2626", "siren", "Siren");
 sub("button", "control", "control", "#10b981", "button", "Button");
@@ -19691,6 +19724,10 @@ var NcSystemEventKindSchema = _enum([
 	"alarm-disarmed",
 	"alarm-arming",
 	"alarm-arm-refused",
+	"alarm-pending",
+	"alarm-rearmed",
+	"alarm-sensor-bypass",
+	"alarm-check-failed",
 	"addon-updated",
 	"server-updated",
 	"export-completed",
@@ -19728,6 +19765,19 @@ var NcSystemEventConditionSchema = object({
 	* does not carry) matches no `deviceTypes` list.
 	*/
 	deviceTypes: array(string().min(1)).min(1).optional(),
+	/**
+	* Devices this rule NEVER speaks about, whatever else matched. Scoped to the
+	* same kind family as `deviceIds` (`systemEventFilterApplies(kind,
+	* 'deviceIds')`) and applied AFTER it: include first, then exclude. A
+	* consumable subject (`consumable:<id>:<key>`) is excluded by its device id.
+	*
+	* It never fails closed: a subject that carries no device id is not in the
+	* list, so it is not excluded. "Every battery except the one thermometer that
+	* reads 0 % forever" is the question this answers — expressed as an include
+	* list it would have to name every other battery device, and every device
+	* adopted later would be silently left out (D636).
+	*/
+	excludeDeviceIds: array(number().int()).min(1).optional(),
 	nodeIds: array(string().min(1)).min(1).optional(),
 	packageNames: array(string().min(1)).min(1).optional()
 });
@@ -20286,6 +20336,19 @@ var NcMediaFrameSchema = _enum([
 	"full",
 	"boxed"
 ]);
+/**
+* How a SENSOR notification shows the cameras that link the sensor.
+*
+* `mosaic` — one image composed of every linked camera's photograph, taken at
+* the trigger. `each` — one image per camera where the target takes several
+* attachments; a target that takes one keeps the first camera's (the degrade
+* engine drops the rest by order). Either way ONE notification per event.
+* Absent = `mosaic`, applied by the Notification Center and deliberately NOT
+* a Zod default (see NcRulePatchSchema: a default materialises on every
+* partial patch). Meaningless for a rule whose subject is not a sensor, and a
+* sensor linked to one camera ships that camera's plain snapshot either way.
+*/
+var NcLinkedCameraModeSchema = _enum(["mosaic", "each"]);
 var NcMediaPolicySchema = object({
 	attach: _enum([
 		"best",
@@ -20331,7 +20394,9 @@ var NcMediaPolicySchema = object({
 	* A profile that is not assigned falls back to the cheapest, and the render
 	* reports which one actually ran.
 	*/
-	profile: CamProfileSchema.optional()
+	profile: CamProfileSchema.optional(),
+	/** See {@link NcLinkedCameraModeSchema}. */
+	linkedCameras: NcLinkedCameraModeSchema.optional()
 });
 /**
 * Cooldown GRANULARITY over the subject's class — how much a fired
@@ -20451,7 +20516,7 @@ var NcRuleInputSchema = object({
 		cooldownSec: 60,
 		scope: "rule-device"
 	}),
-	/** `{{var}}` templating over camera/class/label/zones/confidence/time. */
+	/** `{{var}}` title/body. The variables are declared in `NC_TEMPLATE_VARS` (@camstack/types) and depend on the rule kind — see `templateVarsFor`. */
 	template: object({
 		title: string().max(500).optional(),
 		body: string().max(2e3).optional()
@@ -20631,6 +20696,22 @@ var NcRulePatchSchema = NcRuleInputSchema.partial().extend({
 	throttle: NcThrottleSchema.optional(),
 	priority: number().int().min(1).max(5).optional()
 });
+var NcRuleClearableKeySchema = _enum([
+	"template",
+	"schedule",
+	"targetUsers",
+	"snoozeOptions",
+	"snoozeAllowGlobal",
+	"waitForEnhancement",
+	"actions",
+	"confirm",
+	"groupIdleSec"
+]);
+var NcRuleUpdateInputSchema = object({
+	ruleId: string(),
+	patch: NcRulePatchSchema,
+	clear: array(NcRuleClearableKeySchema).optional()
+});
 /** A persisted rule. */
 var NcRuleSchema = NcRuleInputSchema.extend({
 	id: string(),
@@ -20662,6 +20743,85 @@ var NcTestResultSchema = object({
 	className: string().optional(),
 	label: string().optional()
 });
+/** The five rule kinds, as data. `NcRuleKind` in `notification/rule-kinds.ts`
+*  is the same union; the template-vars spec pins the two together. */
+var NcRuleKindSchema = _enum([
+	"detection",
+	"sensor",
+	"occupancy",
+	"sound",
+	"system"
+]);
+/** Which producer renders a template: an ordinary rule, a timelapse, a digest. */
+var NcTemplateFamilySchema = _enum([
+	"rule",
+	"timelapse",
+	"summary"
+]);
+/** Which text field of that producer. `previewText` is the timelapse frame
+*  caption, `captionText` the digest mosaic caption — both see fewer vars. */
+var NcTemplateFieldSchema = _enum([
+	"title",
+	"body",
+	"previewText",
+	"captionText"
+]);
+var NcTemplateVarGroupSchema = _enum([
+	"subject",
+	"place",
+	"time",
+	"rule",
+	"occupancy",
+	"sound",
+	"sensor",
+	"system",
+	"digest",
+	"ai"
+]);
+/**
+* ONE `{{var}}` a notification template may name.
+*
+* `families` / `fields` / `kinds` / `deliveries` / `systemEventKinds` say WHERE
+* it has a value; absent = no restriction on that axis. `systemEventKinds` is
+* read only for a `system` rule. `dynamic` declares a FAMILY of names
+* (`count_<class>`): the descriptor's `name` is the example member.
+*/
+var NcTemplateVarDescriptorSchema = object({
+	name: string().regex(/^\w+$/),
+	label: string(),
+	description: string().optional(),
+	example: string(),
+	group: NcTemplateVarGroupSchema,
+	families: array(NcTemplateFamilySchema).min(1),
+	fields: array(NcTemplateFieldSchema).optional(),
+	kinds: array(NcRuleKindSchema).optional(),
+	deliveries: array(NcDeliverySchema).optional(),
+	systemEventKinds: array(NcSystemEventKindSchema).optional(),
+	dynamic: object({
+		prefix: literal("count_"),
+		from: literal("classes")
+	}).optional()
+});
+/** Input to `previewTemplate` — the editor's own context, plus the draft text. */
+var NcTemplatePreviewInputSchema = object({
+	context: object({
+		family: NcTemplateFamilySchema,
+		field: NcTemplateFieldSchema,
+		kind: NcRuleKindSchema.optional(),
+		delivery: NcDeliverySchema.optional(),
+		systemEventKinds: array(NcSystemEventKindSchema).optional()
+	}),
+	template: object({
+		title: string().max(500).optional(),
+		body: string().max(2e3).optional()
+	})
+});
+var NcTemplatePreviewSchema = object({
+	title: string().nullable(),
+	body: string().nullable(),
+	/** Names the template uses that this context never fills — they render empty. */
+	unknown: array(string())
+});
 var NcConditionDescriptorSchema = object({
 	/** Field id inside `NcConditions` (or `'schedule'` for the rule-level group). */
 	id: string(),
@@ -20927,8 +21087,17 @@ object({
 	lastAt: number()
 });
 /**
-* The three durations the panel's state machine runs on, plus who hears about
-* an arm.
+* The per-mode lists, at most one per mode. Two lists for one mode have no
+* meaning a reader could agree on (union? the last one?), so they are refused
+* at the boundary rather than interpreted.
+*/
+var NcAlarmNonBlockingListSchema = array(object({
+	mode: AlarmArmModeSchema,
+	deviceIds: array(number().int()).max(200)
+})).max(8).refine((lists) => new Set(lists.map((l) => l.mode)).size === lists.length, { message: "nonBlocking: at most one list per arm mode" });
+/**
+* The three durations the panel's state machine runs on, who hears about its
+* transitions, and which openings each mode tolerates.
 *
 * They live on the NOTIFICATION-RULES cap, not on `alarm-panel`, on purpose:
 * `alarm-panel` is `deviceNative` and its other provider mirrors somebody
@@ -20947,21 +21116,39 @@ var NcAlarmSettingsSchema = object({
 	* existed, and therefore what an untouched install keeps doing.
 	*/
 	triggeredDurationSec: number().int().min(0).max(3600),
-	/** Send a notification when a mode takes effect. */
-	announceArm: boolean(),
 	/**
-	* Where that notification goes. Target ids from `notification-output`.
+	* Deprecated by D630 — every transition is announced. Parsed, never read;
+	* remove after one release. Optional so an older admin's patch (which still
+	* sends it) parses rather than failing the whole save.
+	*/
+	announceArm: boolean().optional(),
+	/**
+	* Target ids from `notification-output`: every alarm transition goes here.
 	*
-	* Explicit rather than "everyone": an arm announcement is a household
+	* Explicit rather than "everyone": an alarm announcement is a household
 	* message, and broadcasting it to every configured endpoint (including a
 	* webhook wired to something else) is not a default anybody would choose.
-	* Empty with `announceArm: true` sends nothing, and the server logs that —
-	* silence must be attributable.
+	* Empty sends nothing, and the server logs that — silence must be
+	* attributable.
+	*/
+	announceTargets: array(string().min(1)).max(16),
+	/**
+	* Per arm mode, the covered devices whose being OPEN does not refuse the
+	* arm (a window left ajar for the cat under `home`, say). At most one entry
+	* per mode is meaningful. Defaulted to `[]` so a blob stored before D630
+	* parses as "every opening blocks" — the behaviour it was written under.
 	*/
-	announceTargets: array(string().min(1)).max(16)
+	nonBlocking: NcAlarmNonBlockingListSchema.default([])
 });
-/** Every field optional — a tab edits one control at a time. */
-var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.partial();
+/**
+* Every field optional — a tab edits one control at a time.
+*
+* `nonBlocking` is re-declared WITHOUT its default: `.partial()` does not
+* remove an inner `.default()`, so a patch that never named the field would
+* parse to `nonBlocking: []` and wipe every mode's list on an unrelated edit
+* (the same trap {@link NcRulePatchSchema} documents).
+*/
+var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.extend({ nonBlocking: NcAlarmNonBlockingListSchema }).partial();
 /**
 * What one arm mode actually arms, DERIVED from the enabled rules gated on it.
 * Never authored, never stored — see `alarm-mode-coverage.ts` for why a stored
@@ -21006,6 +21193,36 @@ var NcAlarmModeCoverageSchema = object({
 	*/
 	skippedDevices: array(NcAlarmSkippedDeviceSchema).default([])
 });
+/** One covered device that reads open, and whether that refuses the arm. */
+var NcAlarmOpeningSchema = object({
+	deviceId: number().int(),
+	name: string(),
+	/** The device's state word as read (`open`, `unlocked`, …). */
+	state: string(),
+	/** False when the mode's non-blocking list names this device. */
+	blocking: boolean()
+});
+/** A device the panel is currently ignoring, and which side of it it is on. */
+var NcAlarmExclusionViewSchema = object({
+	deviceId: number().int(),
+	name: string(),
+	phase: _enum(["open", "closed"])
+});
+/** One mode's openings: devices read open, plus those whose state is unknown. */
+var NcAlarmModeOpeningsSchema = object({
+	mode: AlarmArmModeSchema,
+	devices: array(NcAlarmOpeningSchema),
+	/** Covered devices whose state could not be read (D49): neither open nor closed. */
+	unknown: array(number().int())
+});
+var NcAlarmLiveSchema = object({
+	state: AlarmStateSchema,
+	/** The mode being armed into (exit delay) or held; null when disarmed. */
+	targetMode: AlarmArmModeSchema.nullable(),
+	availableModes: array(AlarmArmModeSchema),
+	openings: array(NcAlarmModeOpeningsSchema),
+	exclusions: array(NcAlarmExclusionViewSchema)
+});
 var NcAlarmConfigSchema = object({
 	/**
 	* The panel's device id, or null when this install has no panel (the ensure
@@ -21015,7 +21232,13 @@ var NcAlarmConfigSchema = object({
 	*/
 	deviceId: number().int().nullable(),
 	settings: NcAlarmSettingsSchema,
-	coverage: array(NcAlarmModeCoverageSchema)
+	coverage: array(NcAlarmModeCoverageSchema),
+	/**
+	* The panel as it is NOW — state, what each mode would find open, what is
+	* excluded. Optional: a panel-less hub answers without it, and a client
+	* must not read its absence as "nothing is open".
+	*/
+	live: NcAlarmLiveSchema.optional()
 });
 /**
 * ONE rule's demand on ONE camera's clip ring.
@@ -21063,10 +21286,7 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 	kind: "mutation",
 	auth: "admin",
 	caller: "required"
-}), method(object({
-	ruleId: string(),
-	patch: NcRulePatchSchema
-}), object({ rule: NcRuleSchema }), {
+}), method(NcRuleUpdateInputSchema, object({ rule: NcRuleSchema }), {
 	kind: "mutation",
 	auth: "admin",
 	caller: "required"
@@ -21094,7 +21314,10 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), method(object({}), object({
 	catalog: array(NcConditionDescriptorSchema),
 	taxonomy: NcTaxonomySchema.optional()
-})), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" }), method(object({ artifactId: string().min(1) }), object({ url: string().nullable() }), { auth: "admin" }), method(object({}), object({ snoozes: array(NcSnoozeSchema) }), { caller: "required" }), method(object({ snooze: NcSnoozeInputSchema }), object({ snooze: NcSnoozeSchema }), {
+})), method(object({}), object({ vars: array(NcTemplateVarDescriptorSchema) })), method(NcTemplatePreviewInputSchema, NcTemplatePreviewSchema, {
+	kind: "mutation",
+	access: "view"
+}), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" }), method(object({ artifactId: string().min(1) }), object({ url: string().nullable() }), { auth: "admin" }), method(object({}), object({ snoozes: array(NcSnoozeSchema) }), { caller: "required" }), method(object({ snooze: NcSnoozeInputSchema }), object({ snooze: NcSnoozeSchema }), {
 	kind: "mutation",
 	caller: "required"
 }), method(object({ snoozeId: string() }), object({ success: literal(true) }), {
@@ -25903,6 +26126,7 @@ var CAP_TO_KIND = {
 	"enum-sensor": "enum-sensor",
 	"event-emitter": "device-event",
 	"lock-control": "lock",
+	cover: "cover",
 	switch: "switch",
 	button: "button",
 	doorbell: "doorbell"
@@ -26463,41 +26687,65 @@ var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object(
 method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
-}), string()), method(object({
+}), string(), { auth: "admin" }), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string(),
 	data: _instanceof(Uint8Array)
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
-}), _instanceof(Uint8Array)), method(object({
+}), _instanceof(Uint8Array), { auth: "admin" }), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
-}), boolean()), method(object({
+}), boolean(), { auth: "admin" }), method(object({
 	location: StorageLocationRefSchema,
 	prefix: string().optional()
-}), array(string()).readonly()), method(object({
+}), array(string()).readonly(), { auth: "admin" }), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
-}), _void(), { kind: "mutation" }), method(object({ location: StorageLocationRefSchema }), number().nullable()), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ location: StorageLocationRefSchema }), number().nullable()), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string(),
 	sizeBytes: number().optional()
-}), object({ uploadId: string() }), { kind: "mutation" }), method(object({
+}), object({ uploadId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	uploadId: string(),
 	offset: number(),
 	data: _instanceof(Uint8Array)
-}), _void(), { kind: "mutation" }), method(object({ uploadId: string() }), _void(), { kind: "mutation" }), method(object({ uploadId: string() }), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ uploadId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ uploadId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
 }), object({
 	downloadId: string(),
 	sizeBytes: number()
-}), { kind: "mutation" }), method(object({
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	downloadId: string(),
 	offset: number(),
 	length: number()
-}), _instanceof(Uint8Array)), method(object({ downloadId: string() }), _void(), { kind: "mutation" }), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
+}), _instanceof(Uint8Array), { auth: "admin" }), method(object({ downloadId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
 	createdAt: true,
 	updatedAt: true
 }), StorageLocationSchema, {
@@ -26762,6 +27010,58 @@ method(_void(), ProviderInfoSchema, { auth: "admin" }), method(object({ config:
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* The signals a device can emit to WAKE its own stream.
+*
+* A camera whose stream is built on demand sleeps until something asks for it,
+* and "something" cannot be a consumer that is merely attached — a Frigate-style
+* puller holds a session open for ever, and treating that as demand would keep
+* a battery camera awake for ever, which is the whole thing the battery is for
+* (D173). So the wake has to come from the CAMERA: an event it noticed by
+* itself, with no stream running.
+*
+* ## The vocabulary is the PROVIDER'S, not ours
+*
+* Like `consumables`, this cap declares no vocabulary of its own. A provider
+* names each signal with a `code` it chooses and a `label` an operator reads.
+* Reolink offers motion and camera-native detection; another provider may offer
+* a tamper, a doorbell press, a PIR, or something no camera in this fleet has
+* yet. A fixed enum here would mean every new signal is a framework release.
+*
+* It is deliberately NOT derived from the caps a device already binds. Whether
+* a camera CAN push firmware motion is expressed by `motionSources` containing
+* `'onboard'`, and whether it does AI on-camera by the `native-object-detection`
+* binding — but both answer "what drives the detection pipeline", which is a
+* different question from "what may wake a sleeping stream". A camera can do
+* the first and not be trusted with the second, and the operator picks per
+* camera. Two questions, two authorities.
+*
+* ## Availability is not permission
+*
+* `listSignals` says what the device CAN emit. Whether a given signal actually
+* wakes the stream is the operator's per-camera choice, held by the broker
+* alongside the cooldown — see the stream-broker cap's wake settings. A
+* provider declaring a signal is not a provider enabling it.
+*/
+/** One signal a device can emit. */
+var StreamSignalSchema = object({
+	/** Stable id chosen by the provider, e.g. `'motion'`, `'person'`, `'tamper'`. */
+	code: string().min(1),
+	/** What an operator reads in the picker. The provider's own wording. */
+	label: string().min(1),
+	/**
+	* Whether the provider recommends this signal ON when a camera is first set
+	* up. A provider knows which of its signals are cheap and reliable; an
+	* operator should not have to discover that by trial. Reolink recommends
+	* both of its own.
+	*/
+	recommended: boolean()
+});
+object({
+	signals: array(StreamSignalSchema),
+	lastFetchedAt: number()
+});
+Object.values(DeviceType), method(_void(), array(StreamSignalSchema).readonly());
 /** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
 var ProfileSettingsSchemaBridge = unknown().nullable();
 var ProfileSettingsBagSchema = record(string(), unknown());
@@ -27745,25 +28045,44 @@ var ClipStreamDialSchema = object({
 	audioReason: ClipStreamAudioReasonSchema.optional()
 });
 /**
-* The playback rates a clip can be DELIVERED at, ascending, always with `1`.
+* The playback rates the broker can pace over media it HOLDS, ascending,
+* always with `1` — and the WIDEST ladder there is. It is the domain the
+* broker's `clampPlaybackRate` is derived from, at both ends.
 *
 * These are the BROKER's: it re-paces frames it has already demuxed — the
 * `MonotonicClock` divides source elapsed time by the factor and the pacer
-* pushes that much faster — so the domain is the recorded one, {0} ∪ [0.25, 4],
-* and this is the discrete ladder drawn from it. `1.5` is in it because a
-* re-pacer has no reason to refuse it.
-*
-* `8` and `16` are deliberately NOT here. They are the CAMERA's own
-* `<playSpeed>` (Reolink cmd-5 replay), a different mechanism, still unwired
-* (D597, D600) — a rate change there costs a new dial and a new stream, and
-* the camera's 8x would need a resample the clip audio path has no decoder
-* for. Offering them today accepts a rate and delivers 1x, which is the whole
-* defect this list exists to end (D612). When `playSpeed` IS wired its rates
-* join THIS array — a second list elsewhere is the second authority D62
-* forbids.
-*
-* Every entry must survive the broker's `clampPlaybackRate` unchanged: a set
-* that offers what the clamp then moves is the same lie one step later.
+* pushes that much faster. `1.5` is in it because a re-pacer has no reason to
+* refuse it.
+*
+* **`8` is here since D621, and it is the pacer's, not a camera's.** D620
+* measured the thing that was assumed for a year and was never true: a
+* Reolink `<playSpeed>` does not time-compress anything. At 1, 2, 4 and 8 the
+* transfer is byte-identical — same 947 472 bytes, same 594 access units,
+* same 39.855 s presentation span, same 624 AAC frames — and only the wall
+* clock moves. It buys SUPPLY, never speed. So there was never a second
+* mechanism to wire for 8×: there is one, this one, and what it needs is
+* media in hand and a clamp that does not move the number.
+*
+* **`16` is deliberately NOT here, and will not join by widening this array.**
+* The camera's `playSpeed 16` is not a rate at all but an I-frame-only MODE —
+* measured on 592: 10 access units for a whole 36.3 s sub clip, 20 for the
+* main twin at a 2 025 ms median spacing, and no audio track. That is
+* different CONTENT, a stream of its own, and the honest broker-side twin of
+* it would be a pacer that DROPS whole GOPs rather than one that pushes 16×
+* the bitrate at a live WebRTC track. Neither exists. A `16` in this array
+* today would be a rate accepted and delivered at 8 — D612's defect, which
+* this list exists to end, one number further along.
+*
+* Every entry must survive the broker's `clampPlaybackRate` unchanged. Since
+* D621 that is structural rather than a discipline: the clamp reads this
+* array's own ends. What still has to be proved behaviourally — and is, in
+* the broker's `clip-stream-feeder.spec` — is that the PACER really empties a
+* clip `rate` times faster, because a clamp agreeing with a ladder is a
+* constant compared against itself.
+*
+* Narrower ladders exist for transports whose SUPPLY is bounded; they are
+* subsets of this one ({@link CLIP_STREAM_SOURCE_RATES},
+* {@link CLIP_REALTIME_SOURCE_RATES}).
 */
 var CLIP_BROKER_PACED_RATES = [
 	.25,
@@ -27771,7 +28090,8 @@ var CLIP_BROKER_PACED_RATES = [
 	1,
 	1.5,
 	2,
-	4
+	4,
+	8
 ];
 /**
 * What a surface may DRAW for this provider's clips — the answer to
@@ -28297,7 +28617,67 @@ var WebrtcLadderDecisionSchema = object({
 	serverSending: boolean().nullable(),
 	/** Epoch ms. The overlay prints its age; a decision from 40 minutes ago
 	*  must not read like one from this second. */
-	at: number()
+	at: number(),
+	/** The broker's own cause when it is finer than `cause` can carry, e.g.
+	*  `trial-revert` (reported as `stall`/`loss` for older consumers). Optional:
+	*  an older server strips it instead of rejecting the answer. */
+	causeDetail: string().optional()
+});
+var WebrtcClimbHoldSchema = object({
+	/** `stall-building` — the client receives ≪ what is sent; `delivery` — the
+	*  current rung is not landing whole; `no-evidence` — no receiver feedback;
+	*  `warming` — healthy, accumulating the streak; `cooldown` — too soon after
+	*  a change; `capacity` — a MEASURED probe below the next rung's bar;
+	*  `try-unclean` — no capacity evidence, and the path is not clean enough to
+	*  try; `try-backoff` — a try reverted, waiting out its backoff; `trial` —
+	*  this rung IS a try, reverting if it does not land; `suspended` —
+	*  recorded playback on the track. */
+	code: string(),
+	/** The rung a climb would go to. */
+	nextTier: CamProfileSchema,
+	/** Bytes received ÷ bytes sent over the delivery window (≥ one GOP). */
+	deliveryRatio: number().nullable(),
+	deliveryWindowMs: number().nullable(),
+	/** The ratio a climb requires. */
+	climbDeliveryRatio: number(),
+	/** The receiver's bandwidth estimate (REMB), kbps. Capped by what is sent. */
+	capacityKbps: number().nullable(),
+	/** The viewer's downlink probe for this session, kbps. */
+	probeKbps: number().nullable(),
+	/** The next rung's measured bitrate, kbps. */
+	nextTierKbps: number().nullable(),
+	capacityMargin: number(),
+	/** The capacity a climb to `nextTier` needs, kbps (bitrate × margin, or the
+	*  client ladder threshold when the rung has measured nothing). */
+	neededKbps: number().nullable(),
+	/** For `try-unclean`: which clean-path condition failed (a `WebrtcTryBlocker`,
+	*  carried as a string for the same reason as `code`). */
+	tryBlockedBy: string().nullable(),
+	/** The delivery ratio and the loss ratio a try requires / must stay under.
+	*  Optional, like every field added to this schema after it first shipped:
+	*  the router validates output, so a REQUIRED new field makes a newer server
+	*  reject an older broker's whole answer (review m1). */
+	tryDeliveryRatio: number().optional(),
+	tryMaxLossRatio: number().optional(),
+	/** For `try-backoff`: time until the next try, ms. */
+	retryInMs: number().nullable(),
+	/** The last try that reverted in this viewer session. */
+	lastRevert: object({
+		tier: CamProfileSchema,
+		deliveryRatio: number().nullable(),
+		stalled: boolean(),
+		at: number()
+	}).nullable(),
+	/** For `trial`: how long this rung has been on trial, and for how long it must hold. */
+	trialForMs: number().nullable(),
+	trialMs: number().nullable(),
+	healthyForMs: number().nullable(),
+	requiredHealthyMs: number().nullable(),
+	/** Epoch ms this hold's code began. */
+	since: number(),
+	/** The same one-line account the broker logs, e.g.
+	*  `held: delivery 0.97 over 4.0s ok, REMB 480 kbps < mid 1800 kbps × 1.2`. */
+	summary: string()
 });
 /** Per-tier count of MEASURED downgrades this viewer session has suffered. */
 var WebrtcTierFailureSchema = object({
@@ -28361,7 +28741,12 @@ var WebrtcSessionDebugSchema = object({
 	tierFailures: array(WebrtcTierFailureSchema),
 	/** Successful promotions in this viewer session (drives the progressive
 	*  healthy timer). Null when no ladder is running. */
-	upgradeCount: number().nullable()
+	upgradeCount: number().nullable(),
+	/** Why the ladder is not climbing right now. Null when no ladder runs, it
+	*  is at the top rung, or it just moved. Optional because this output is
+	*  validated by the router: a server carrying this schema must still accept
+	*  the answer of a stream-broker deployed before the field existed. */
+	climbHold: WebrtcClimbHoldSchema.nullable().optional()
 });
 /**
 * WebRTC session — device-scoped facade over the system `webrtc` cap.
@@ -29442,6 +29827,143 @@ DeviceType.Camera, method(object({ deviceId: number() }), CameraCredentialsSchem
 	kind: "query",
 	auth: "admin"
 });
+/**
+* camera-grid-layout — the geometry of a COMPOSITE camera, on the camera's own
+* page.
+*
+* ## Why this is a capability and not an addon settings schema
+*
+* It was one, and it did not render. The addon declared the editor as a
+* `type: 'widget'` field inside its own `deviceSettingsSchema()`; the hub
+* returned that section correctly and `ConfigFormField` renders `type:'widget'`
+* perfectly well — and nothing ever asked camera-grid for it. The Cluster →
+* Pipeline → Device Overrides page interrogates a HAND-WRITTEN list of four
+* addons (`PIPELINE_CLUSTER_DEVICE_ADDONS`), whose own comment says an addon
+* not on it "falls off silently".
+*
+* Adding a fifth name to that list would have been the wrong fix twice over:
+* that page is per-camera DETECTION tuning, and a grid's geometry belongs
+* beside PTZ and motion zones on the camera itself. The device page is
+* BINDING-driven (D12), so the way in is a capability bound to the device —
+* and this cap carries its section the way `recording` does, by RETURNING it
+* from `getDeviceSettingsContribution`.
+*
+* Seven other widgets are still declared the other way, through a
+* `deviceConfig.ui` block the framework derives a section from. That route
+* gives the addon no say in where its own panel lands and no way to decline
+* for a device the panel does not suit, which is why this one does not use it.
+*
+* ## Why one addon may implement it
+*
+* It is a device-scoped NATIVE cap, registered by the grid camera device
+* itself. Nothing else declares a composite camera, so nothing else has a
+* layout — and the device-scoped route means the widget asks THE camera, not
+* "the camera-grid addon", which is what let the old custom-action pair be
+* reached only by a caller that already knew the addon id.
+*
+* ## The tab
+*
+* `streaming`, not a top-tab of its own. A grid's geometry IS what its stream
+* is, so the Streaming tab is where it belongs; a `grid` top-tab would need an
+* entry in `WELL_KNOWN_TAB_MAP` or the device page renders the raw id as the
+* label (measured on the robot camera, 2026-09-06 — a tab called "navigation"
+* next to "PTZ").
+*/
+/** A rectangle in normalized [0,1] coordinates of whatever contains it. */
+var GridNormalizedRectSchema = object({
+	x: number().min(0).max(1),
+	y: number().min(0).max(1),
+	width: number().gt(0).max(1),
+	height: number().gt(0).max(1)
+});
+/**
+* One source camera, the part of its picture taken, and where that part lands.
+*
+* Both rectangles are NORMALIZED (D519): a source camera can change resolution
+* — a profile switch, a firmware update, a substream that comes back different
+* — and a stored PIXEL rectangle would quietly start cutting the wrong region,
+* which is the class of bug nobody files.
+*/
+var GridLayoutCellSchema = object({
+	deviceId: number().int().positive(),
+	/** The part of the SOURCE taken, normalized against the source. */
+	source: GridNormalizedRectSchema,
+	/** Where it lands, normalized against the CANVAS. */
+	cell: GridNormalizedRectSchema
+});
+/**
+* Which profiles this grid can actually compose, and why not.
+*
+* A grid's `high` composes its sources' `high` and its `low` their `low`, so a
+* profile is on offer only when EVERY source can serve it. The refusal NAMES
+* the sources, because "this grid has no low" is not a finding — "615 has no
+* low" is, and it is the one an operator can act on.
+*/
+var GridProfileOfferSchema = object({
+	profile: _enum([
+		"high",
+		"mid",
+		"low"
+	]),
+	offered: boolean(),
+	/** Sources that cannot serve it. Empty when it is offered, or when there are no cells. */
+	missingSources: array(number().int().positive()),
+	/**
+	* The canvas this profile composes onto, `WxH`, or empty when it is not
+	* offered. DERIVED from the cells and the sources' own size at this profile —
+	* it is reported because nothing else in the system would ever say what the
+	* grid came out as, and because it is the number an operator would otherwise
+	* expect to type.
+	*/
+	canvas: string(),
+	/**
+	* Whether this profile is PUBLISHED, of the ones the grid could serve.
+	*
+	* A grid's `high` is composed of its sources' `high`, so on a 4K fleet it is
+	* a 4K canvas built from 4K decodes — something to opt into, not something a
+	* viewer's adaptive should be handed by climbing to the top rung it can see.
+	* Default is `mid` + `low`.
+	*/
+	published: boolean()
+});
+var GridLayoutViewSchema = object({
+	/** The persisted grid row this camera was declared from. */
+	instanceId: string(),
+	deviceId: number().int().nonnegative(),
+	name: string(),
+	/**
+	* NO canvas size. A grid's resolution is not authored: each profile derives
+	* its own from the cells and its sources' dimensions. The two numbers that
+	* used to be here were a text field that silently decided both how much the
+	* composite cost and how sharp it was — see `profiles[].canvas` for what it
+	* came out as.
+	*/
+	fps: number().int(),
+	cells: array(GridLayoutCellSchema),
+	/** What the catalog will publish, and what it refuses to. Read-only. */
+	profiles: array(GridProfileOfferSchema)
+});
+var GridLayoutPatchSchema = object({
+	deviceId: number().int().nonnegative(),
+	name: string().min(1).max(160).optional(),
+	fps: number().int().min(1).max(60).optional(),
+	/** Which profiles to publish. See `GridProfileOffer.published`. */
+	publishedProfiles: array(_enum([
+		"high",
+		"mid",
+		"low"
+	])).max(3).optional(),
+	/**
+	* The whole cell list at once. A per-cell patch would need an ordering the
+	* editor does not have, and a half-applied layout is a picture nobody asked
+	* for.
+	*/
+	cells: array(GridLayoutCellSchema).max(16)
+});
+DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), GridLayoutViewSchema.nullable(), { auth: "admin" }), method(GridLayoutPatchSchema, GridLayoutViewSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 object({
 	detected: boolean(),
 	/** Ms epoch of the last transition. 0 if never observed. */
@@ -29915,307 +30437,6 @@ DeviceType.Camera, method(object({ deviceId: number() }), DayNightOptionsSchema)
 	auth: "admin"
 });
 /**
-* Vendor-neutral **onboard** recording + storage cap — what the CAMERA
-* writes to the CAMERA's own card, on the camera's own schedule.
-*
-* This is NOT `recording.cap.ts`. That one is CamStack's recorder: our
-* footage ledger, our storage locations, our retention. This one has a
-* different authority — the camera's firmware — and per D62 it stores
-* nothing of its own. Every value here is read from the camera and every
-* write goes back to the camera; there is no CamStack-side mirror that
-* could disagree with the device.
-*
-* ## One shape, two firmwares
-*
-* Measured 2026-09-22 against the live fleet:
-*
-* | fact | Hikvision (ISAPI) | Reolink (Baichuan) |
-* | --- | --- | --- |
-* | storage | `ContentMgmt/Storage` `<hdd>` rows: status, capacity, freeSpace (MB) | `getHddInfoList` (cmd 102): `mount`, `format`, `capacity` GB + `capacityM` MB remainder |
-* | tracks | several (101 **and** 103 on both 1436 and 3833), each with its own schedule | one per channel |
-* | schedule | per track, 7 `ScheduleAction` blocks: DayOfWeek + TimeOfDay range + ONE `ActionRecordingMode` | per trigger type, a 168-char weekly HOUR mask |
-* | triggers | `CMR`, `MOTION` | `Normal`, `MD`, `people`, `vehicle`, `dog_cat`, `crossline`, `intrude`, `loitering` |
-* | pre-record | `PreRecordTimeSeconds` | `preRecordTime` |
-* | post-record | `PostRecordTimeSeconds` | `recordDelayTime` |
-* | overwrite | per track `LoopEnable` | `cycle`, with `cycleList` enumerating the accepted values |
-* | segment length | not exposed on V5.7.1 | `packageTime` (minutes) |
-*
-* The two schedule models look different and are the same thing in
-* different coordinates: both answer "for this trigger, during which
-* weekly windows does the camera record". {@link RecordWindow} is that
-* question in one shape — Hikvision's ranges map straight onto it,
-* Reolink's mask expands into hour-aligned windows.
-*
-* ## Union, not intersection
-*
-* **The same fields exist on every camera.** What differs per device is
-* which VALUES that device accepts, and that is what {@link
-* RecordingOnboardOptions} reports — a `{ readable, writable, reason }`
-* per field plus the schedule's own limits. A control a camera cannot
-* honour is rendered DISABLED WITH ITS REASON, never missing and never
-* dead: disabled must not look like broken.
-*
-* ## Refusal by name
-*
-* A write a camera cannot honour is refused with a sentence the operator
-* can read — never accepted and dropped. Both providers refuse through
-* {@link describeOnboardRefusal}, so the vocabulary is one function and
-* one test, not two hand-written vendor opinions.
-*
-* Follows the D14 `deviceConfig` archetype (see `stream-params.cap.ts`):
-* `getOptions` advertises per-camera availability, `getStatus` (auto-
-* injected from `status`) reports the live values, and a single
-* `setSettings` mutation applies a partial change. No hand-written
-* settings-contribution methods.
-*/
-/**
-* What makes the camera start recording during a window.
-*
-* The union of both vendors' vocabularies. `continuous` is Hikvision's
-* `CMR` and Reolink's `Normal`; `motion` is `MOTION` / `MD`. The
-* object-class triggers are Reolink-only today and the smart-event ones
-* (`lineCrossing`, `intrusion`, `loitering`) are Reolink-only on the
-* firmwares measured — a camera that cannot record on a trigger simply
-* does not list it in `options.schedule.triggers`, and a window naming
-* it is REFUSED, not dropped.
-*/
-var RecordTriggerSchema = _enum([
-	"continuous",
-	"motion",
-	"person",
-	"vehicle",
-	"animal",
-	"lineCrossing",
-	"intrusion",
-	"loitering",
-	"alarmInput"
-]);
-/**
-* One weekly recording window: "on `day`, from `startMinute` to
-* `endMinute`, record on `trigger`".
-*
-* `day` is 0 = Monday … 6 = Sunday (ISO order, which is also the order
-* both firmwares enumerate). Minutes are local camera time since
-* midnight; `endMinute` may be 1440, meaning end of day — that is
-* Hikvision's literal `24:00` and Reolink's 24th mask slot, and
-* collapsing it to 0 would turn a whole-day window into an empty one.
-*/
-var RecordWindowSchema = object({
-	trigger: RecordTriggerSchema,
-	day: number().int().min(0).max(6),
-	startMinute: number().int().min(0).max(1439),
-	endMinute: number().int().min(1).max(1440)
-});
-/** Status of one physical volume, as the camera itself describes it. */
-var OnboardStorageVolumeSchema = object({
-	/** The camera's own id for the volume (`hdd/id`, Reolink `HddInfo/number`). */
-	id: string(),
-	/** The camera's own name for it, when it gives one (`hddName`). */
-	label: string().optional(),
-	status: _enum([
-		"ok",
-		"unformatted",
-		"error",
-		"offline",
-		"unknown"
-	]),
-	/**
-	* Total size in MB, or **null when the camera did not say**.
-	*
-	* Never 0 for an unreadable value: a measurement that failed is not a
-	* measurement (D393), and a card whose size is unknown must not be
-	* rendered as a card of size zero.
-	*/
-	capacityMb: number().nullable(),
-	/**
-	* Free space in MB, or null when unknown.
-	*
-	* **Not a proxy for "has footage".** Measured 2026-09-22: 1436 and
-	* 1439 both report exactly 11776 MB free — the fixed reserve a looping
-	* card converges on once it has wrapped. At loop steady state the
-	* number is identical whether the camera recorded yesterday or stopped
-	* a month ago.
-	*/
-	freeMb: number().nullable(),
-	/** True when the camera reports the volume writable (`property` RW). */
-	writable: boolean().optional()
-});
-object({
-	storage: discriminatedUnion("kind", [
-		object({
-			kind: literal("present"),
-			volumes: array(OnboardStorageVolumeSchema)
-		}),
-		object({
-			kind: literal("absent"),
-			reason: string()
-		}),
-		object({
-			kind: literal("unknown"),
-			reason: string()
-		})
-	]),
-	tracks: array(object({
-		id: string(),
-		enabled: boolean(),
-		isVideo: boolean(),
-		/** From the camera's own track description. Null when it does not say. */
-		codec: string().nullable(),
-		resolution: string().nullable(),
-		/** Per-track overwrite flag, where the firmware keeps it per track. */
-		overwriteWhenFull: boolean().nullable()
-	})),
-	/**
-	* The track the write path targets — the enabled VIDEO one. Null when
-	* no track could be identified, which is itself a refusal reason.
-	*/
-	primaryTrackId: string().nullable(),
-	/** Master "record to the card at all" switch. */
-	enabled: boolean().nullable(),
-	overwriteWhenFull: boolean().nullable(),
-	preRecordSec: number().nullable(),
-	postRecordSec: number().nullable(),
-	/** Length of one recorded file, in minutes. */
-	segmentMinutes: number().nullable(),
-	/** The primary track's weekly windows, flattened. */
-	windows: array(RecordWindowSchema),
-	/**
-	* How many windows the camera described that CamStack could NOT read —
-	* an unrecognised trigger, an unparseable clock, a weekday it does not
-	* name.
-	*
-	* A dropped window is work the reader threw away, and a schedule that
-	* silently shows fewer rows than the camera holds is how an operator
-	* saves back a schedule shorter than the one they were looking at
-	* (D391). Non-zero means the window list is INCOMPLETE and a write
-	* that replaces it would delete what was not shown — which is why a
-	* provider reporting a non-zero count also reports the schedule as not
-	* writable.
-	*/
-	unreadableWindows: number(),
-	/**
-	* The camera is scheduled to record and has NO usable storage.
-	*
-	* A first-class fact because it is the fleet's most common silent
-	* defect: measured 2026-09-22, 1441 and 3831 are both motion-recording
-	* to a card that is not there. Neither the schedule nor the storage
-	* read says anything wrong on its own; only the pair does.
-	*/
-	recordingToNowhere: boolean(),
-	lastFetchedAt: number()
-});
-/** Numeric range descriptor — `{ min, max, step }` per the getOptions convention. */
-var RangeSchema = object({
-	min: number(),
-	max: number(),
-	step: number()
-});
-/**
-* The values a camera actually takes for a numeric field, when they are a SET
-* rather than a range.
-*
-* `{min,max,step}` cannot say what these two firmwares do. Measured on 1436
-* (I91DN) on 2026-09-22 by writing each value and reading it back:
-*
-* - pre-record: `0, 5, 10, 15, 20, 25, 30` and `2147483647` (INT32_MAX, the
-*   camera's "no limit" — `-1` and `4294967295` both land on it);
-* - post-record: `5, 10, 30, 60, 120, 300, 600`.
-*
-* Neither is expressible as a step: the first has a sentinel two billion away
-* from its neighbours, the second doubles and then jumps. A range that tried
-* would forbid values the camera takes AND permit values it silently replaces
-* with 5 — wrong in both directions at once.
-*
-* `sentinel` names the member that is not a duration, so a surface can render
-* "no limit" instead of `2147483647` seconds.
-*/
-var AllowedValuesSchema = object({
-	values: array(number()).min(1),
-	sentinel: object({
-		value: number(),
-		meaning: _enum(["no-limit", "disabled"])
-	}).optional()
-});
-/**
-* Per-field availability on ONE camera.
-*
-* The field exists on every camera — this says whether this one can be
-* read and whether it can be written, and `reason` says why not when
-* either is false. The UI renders the control DISABLED with the reason
-* rather than hiding it, so a limitation is legible instead of looking
-* like a missing feature.
-*/
-var OnboardFieldSupportSchema = object({
-	readable: boolean(),
-	writable: boolean(),
-	/** Required whenever `readable` or `writable` is false. */
-	reason: string().optional()
-});
-/** What this camera's schedule model can express. */
-var OnboardScheduleSupportSchema = object({
-	support: OnboardFieldSupportSchema,
-	/**
-	* The smallest time step the camera can express, in minutes.
-	*
-	* Hikvision takes arbitrary minutes (`00:05:00`–`23:57:00` observed on
-	* 1436's track 103). Reolink's schedule is a 7×24 HOUR mask, so 60. A
-	* window whose edges are not a multiple of this is REFUSED rather than
-	* quietly rounded — rounding is how an operator's 06:30 becomes 06:00
-	* and nothing says so.
-	*/
-	granularityMinutes: number(),
-	/** Triggers this camera can record on. A window naming another is refused. */
-	triggers: array(RecordTriggerSchema),
-	/**
-	* False when the camera stores ONE trigger per time range, so two
-	* windows overlapping on the same day cannot carry different triggers.
-	* True on Reolink, whose mask is per-trigger and independent.
-	*/
-	supportsOverlappingTriggers: boolean()
-});
-var RecordingOnboardOptionsSchema = object({
-	enabled: OnboardFieldSupportSchema,
-	overwriteWhenFull: OnboardFieldSupportSchema,
-	preRecordSec: OnboardFieldSupportSchema,
-	preRecordSecRange: RangeSchema.optional(),
-	/** Preferred over the range when the camera takes a SET, not a span. */
-	preRecordSecAllowed: AllowedValuesSchema.optional(),
-	postRecordSec: OnboardFieldSupportSchema,
-	postRecordSecRange: RangeSchema.optional(),
-	/** Preferred over the range when the camera takes a SET, not a span. */
-	postRecordSecAllowed: AllowedValuesSchema.optional(),
-	segmentMinutes: OnboardFieldSupportSchema,
-	segmentMinutesRange: RangeSchema.optional(),
-	/** Preferred over the range when the camera takes a SET, not a span. */
-	segmentMinutesAllowed: AllowedValuesSchema.optional(),
-	schedule: OnboardScheduleSupportSchema
-});
-/**
-* A partial change. Every field optional.
-*
-* Unlike the other `deviceConfig` caps, a provider here does **NOT**
-* silently ignore a field it cannot support — it refuses, by name,
-* through {@link describeOnboardRefusal}. Silence on a recording setting
-* is the failure D62 exists to prevent: the operator believes the camera
-* is recording the way the form says, and it is not.
-*/
-var RecordingOnboardPatchSchema = object({
-	enabled: boolean().optional(),
-	overwriteWhenFull: boolean().optional(),
-	preRecordSec: number().optional(),
-	postRecordSec: number().optional(),
-	segmentMinutes: number().optional(),
-	/** The complete new window set for the primary track — not a delta. */
-	windows: array(RecordWindowSchema).optional()
-});
-DeviceType.Camera, method(object({ deviceId: number() }), RecordingOnboardOptionsSchema), method(object({
-	deviceId: number(),
-	settings: RecordingOnboardPatchSchema
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * Generic device-level status snapshot. Auto-registered by `BaseDevice`
 * for every device, regardless of provider — the kernel needs a uniform
 * cap-keyed slice for the basic device flags every consumer expects to
@@ -30309,30 +30530,6 @@ object({
 	eventCountSinceStart: number()
 });
 DeviceType.EventEmitter;
-var EventItemSchema = object({
-	id: string(),
-	type: string(),
-	timestamp: number(),
-	label: string().optional(),
-	thumbnailUrl: string().optional(),
-	clipUrl: string().optional(),
-	metadata: record(string(), unknown()).optional()
-});
-DeviceType.Camera, method(object({
-	deviceId: number(),
-	from: number().optional(),
-	to: number().optional(),
-	limit: number().optional()
-}), array(EventItemSchema)), method(object({
-	deviceId: number(),
-	eventId: string()
-}), object({
-	base64: string(),
-	contentType: string()
-}).nullable()), method(object({
-	deviceId: number(),
-	eventId: string()
-}), string().nullable());
 var IdentitySchema = object({
 	id: string(),
 	name: string(),
@@ -32029,143 +32226,6 @@ DeviceType.Light, DeviceType.Siren, DeviceType.Switch, method(object({
 	lastChangedAt: number()
 });
 /**
-* camera-grid-layout — the geometry of a COMPOSITE camera, on the camera's own
-* page.
-*
-* ## Why this is a capability and not an addon settings schema
-*
-* It was one, and it did not render. The addon declared the editor as a
-* `type: 'widget'` field inside its own `deviceSettingsSchema()`; the hub
-* returned that section correctly and `ConfigFormField` renders `type:'widget'`
-* perfectly well — and nothing ever asked camera-grid for it. The Cluster →
-* Pipeline → Device Overrides page interrogates a HAND-WRITTEN list of four
-* addons (`PIPELINE_CLUSTER_DEVICE_ADDONS`), whose own comment says an addon
-* not on it "falls off silently".
-*
-* Adding a fifth name to that list would have been the wrong fix twice over:
-* that page is per-camera DETECTION tuning, and a grid's geometry belongs
-* beside PTZ and motion zones on the camera itself. The device page is
-* BINDING-driven (D12), so the way in is a capability bound to the device —
-* and this cap carries its section the way `recording` does, by RETURNING it
-* from `getDeviceSettingsContribution`.
-*
-* Seven other widgets are still declared the other way, through a
-* `deviceConfig.ui` block the framework derives a section from. That route
-* gives the addon no say in where its own panel lands and no way to decline
-* for a device the panel does not suit, which is why this one does not use it.
-*
-* ## Why one addon may implement it
-*
-* It is a device-scoped NATIVE cap, registered by the grid camera device
-* itself. Nothing else declares a composite camera, so nothing else has a
-* layout — and the device-scoped route means the widget asks THE camera, not
-* "the camera-grid addon", which is what let the old custom-action pair be
-* reached only by a caller that already knew the addon id.
-*
-* ## The tab
-*
-* `streaming`, not a top-tab of its own. A grid's geometry IS what its stream
-* is, so the Streaming tab is where it belongs; a `grid` top-tab would need an
-* entry in `WELL_KNOWN_TAB_MAP` or the device page renders the raw id as the
-* label (measured on the robot camera, 2026-09-06 — a tab called "navigation"
-* next to "PTZ").
-*/
-/** A rectangle in normalized [0,1] coordinates of whatever contains it. */
-var GridNormalizedRectSchema = object({
-	x: number().min(0).max(1),
-	y: number().min(0).max(1),
-	width: number().gt(0).max(1),
-	height: number().gt(0).max(1)
-});
-/**
-* One source camera, the part of its picture taken, and where that part lands.
-*
-* Both rectangles are NORMALIZED (D519): a source camera can change resolution
-* — a profile switch, a firmware update, a substream that comes back different
-* — and a stored PIXEL rectangle would quietly start cutting the wrong region,
-* which is the class of bug nobody files.
-*/
-var GridLayoutCellSchema = object({
-	deviceId: number().int().positive(),
-	/** The part of the SOURCE taken, normalized against the source. */
-	source: GridNormalizedRectSchema,
-	/** Where it lands, normalized against the CANVAS. */
-	cell: GridNormalizedRectSchema
-});
-/**
-* Which profiles this grid can actually compose, and why not.
-*
-* A grid's `high` composes its sources' `high` and its `low` their `low`, so a
-* profile is on offer only when EVERY source can serve it. The refusal NAMES
-* the sources, because "this grid has no low" is not a finding — "615 has no
-* low" is, and it is the one an operator can act on.
-*/
-var GridProfileOfferSchema = object({
-	profile: _enum([
-		"high",
-		"mid",
-		"low"
-	]),
-	offered: boolean(),
-	/** Sources that cannot serve it. Empty when it is offered, or when there are no cells. */
-	missingSources: array(number().int().positive()),
-	/**
-	* The canvas this profile composes onto, `WxH`, or empty when it is not
-	* offered. DERIVED from the cells and the sources' own size at this profile —
-	* it is reported because nothing else in the system would ever say what the
-	* grid came out as, and because it is the number an operator would otherwise
-	* expect to type.
-	*/
-	canvas: string(),
-	/**
-	* Whether this profile is PUBLISHED, of the ones the grid could serve.
-	*
-	* A grid's `high` is composed of its sources' `high`, so on a 4K fleet it is
-	* a 4K canvas built from 4K decodes — something to opt into, not something a
-	* viewer's adaptive should be handed by climbing to the top rung it can see.
-	* Default is `mid` + `low`.
-	*/
-	published: boolean()
-});
-var GridLayoutViewSchema = object({
-	/** The persisted grid row this camera was declared from. */
-	instanceId: string(),
-	deviceId: number().int().nonnegative(),
-	name: string(),
-	/**
-	* NO canvas size. A grid's resolution is not authored: each profile derives
-	* its own from the cells and its sources' dimensions. The two numbers that
-	* used to be here were a text field that silently decided both how much the
-	* composite cost and how sharp it was — see `profiles[].canvas` for what it
-	* came out as.
-	*/
-	fps: number().int(),
-	cells: array(GridLayoutCellSchema),
-	/** What the catalog will publish, and what it refuses to. Read-only. */
-	profiles: array(GridProfileOfferSchema)
-});
-var GridLayoutPatchSchema = object({
-	deviceId: number().int().nonnegative(),
-	name: string().min(1).max(160).optional(),
-	fps: number().int().min(1).max(60).optional(),
-	/** Which profiles to publish. See `GridProfileOffer.published`. */
-	publishedProfiles: array(_enum([
-		"high",
-		"mid",
-		"low"
-	])).max(3).optional(),
-	/**
-	* The whole cell list at once. A per-cell patch would need an ordering the
-	* editor does not have, and a half-applied layout is a picture nobody asked
-	* for.
-	*/
-	cells: array(GridLayoutCellSchema).max(16)
-});
-DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), GridLayoutViewSchema.nullable(), { auth: "admin" }), method(GridLayoutPatchSchema, GridLayoutViewSchema, {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * Motion-zones share the same MaskShape vocabulary as privacy-mask — the
 * on-camera motion-detection mask is a single `grid` region (a row-major
 * boolean cell lattice the camera's onboard VMD evaluates). Composing it as
@@ -32567,6 +32627,11 @@ var ClientNetworkStatsSchema = object({
 	jitterMs: number(),
 	estimatedBandwidthKbps: number(),
 	packetLossPercent: number().min(0).max(100),
+	/** The viewer's latest `/adaptive-probe` reading, Mbps — whatever it read
+	*  (D635 I4). Absent when it never probed or the probe failed (unknown). */
+	downlinkMbps: number().optional(),
+	/** Age of that reading when this report was sent, ms. */
+	downlinkAgeMs: number().optional(),
 	lastUpdated: number()
 });
 var DeviceNetworkStatsSchema = object({
@@ -32579,7 +32644,11 @@ method(object({ deviceId: number() }), DeviceNetworkStatsSchema.nullable()), met
 	rttMs: number().min(0).max(6e4),
 	jitterMs: number().min(0).max(1e4),
 	estimatedBandwidthKbps: number().min(0).max(1e6),
-	packetLossPercent: number().min(0).max(100)
+	packetLossPercent: number().min(0).max(100),
+	/** Latest downlink probe, Mbps, whatever it read; absent = never / failed. */
+	downlinkMbps: number().min(0).max(1e5).optional(),
+	/** Age of that probe when this report is sent, ms. */
+	downlinkAgeMs: number().min(0).max(864e5).optional()
 }), _void(), { kind: "mutation" });
 /**
 * nodes — system-scoped singleton capability for cluster topology
@@ -33978,36 +34047,95 @@ DeviceType.Camera, DeviceType.Sensor, DeviceType.Switch, method(object({ deviceI
 	auth: "admin"
 });
 /**
-* `recording` cap — footage availability + HLS playback manifests + per-device
-* recording config. NOTE on events (source of truth, R5/C3): this cap carries
-* NO event surface — `getPlaybackManifest` returns playlist URLs only. Timeline
-* events (motion/object/audio) come from `pipelineAnalytics` (durable SQLite
-* rows) and are the ONLY event surface — the recorder has none. The in-RAM
-* playback markers it used to build were deleted on 2026-08-29 because nothing
-* ever read them. Event<->footage joins are by time, padded with the shared
-* `EVENT_PAD_MS` (`interfaces/recording-config.ts`).
+* `recording` — a camera's recorded COVERAGE and PLAYBACK, from whichever
+* source the operator picked.
+*
+* A device-scoped wrapper COLLECTION since D625, and the five lines that make
+* it one (`scope`/`mode`/`kind`/`defaultActive`/`deviceTypes`) are copied from
+* `videoclips.cap.ts` deliberately: `scope: 'device'` + `mode: 'collection'` is
+* what makes `resolveCapMount` keep the PER-DEVICE mount while the collection
+* dispatcher fans out, and a device's sources are then its BINDINGS
+* (`deviceManager.getBindings`, D554 amended) rather than "every addon that
+* registered the cap somewhere".
+*
+* ## What is here and what is not
+*
+* FIVE of them — `listSources`, `getAvailability`, `getDaysWithRecordings`,
+* `getPlayback`, `getPlaybackOptions`. Every source must be able to answer
+* these or it is not a source. Everything else that used to live on this cap —
+* storage locations, retention, relocation, rebalance, the ops log, the
+* placement table, the `mfra` byte plane, `getDeviceConfig`/`setDeviceConfig`
+* and the two batch reads — is on `recording-archive`, a system singleton, and
+* the reasons are argued there.
+*
+* ## The default is OURS, and there is nowhere to say otherwise
+*
+* {@link RECORDING_SOURCE_CAMSTACK} is RESERVED. The absence of an operator
+* choice MEANS that value; it is not a row that happened to sort first. Clips
+* end their resolver with `?? sources[0]` and that is right for clips — a
+* camera full of onboard clips that says "no clips" is the defect that work
+* exists to end. For a TIMELINE it is wrong and the measurement says why: on
+* 592, ours covers 85 362 s of the day and the card 21 388 s, and
+* `videoclips.listSources` answers the ONBOARD row first. A silent fall to the
+* first row would swap a 98.8 % bar for a 24.8 % one with nothing saying so.
+*
+* So a surface that cannot find our row says `ours-absent` and offers the
+* others as a CHOICE; it never takes one on the operator's behalf. The
+* reservation is enforced in the collection dispatcher — a `listSources` row
+* carrying this id from any addon but the recorder is refused by name — and by
+* `scripts/check-reserved-collection-sources.ts` in CI.
+*
+* NOTE on events (source of truth, R5/C3): this cap carries NO event surface.
+* Timeline events (motion/object/audio) come from `pipelineAnalytics` (durable
+* SQLite rows) and are the ONLY event surface — the recorder has none.
+* Event<->footage joins are by time, padded with the shared `EVENT_PAD_MS`
+* (`interfaces/recording-config.ts`).
 */
-var RecordingStatusSchema = object({
-	deviceId: number(),
-	enabled: boolean(),
-	/** THE derived storage mode, from the one definition
-	*  (`deriveRecordingMode`) — never a second enum. A duplicated list is how
-	*  `on-device-decision` could have reached the recorder and not the status. */
-	activeMode: RecordingStorageModeSchema,
-	nodeId: string(),
-	storageBytes: number()
-});
+/**
+* OUR recorder's source id. RESERVED: no other provider may return it from
+* `listSources`, and the absence of an operator choice MEANS this value.
+*
+* Reserved is ENFORCED, not requested — `device-collection-dispatch.ts` drops a
+* row spelling it from any addon but {@link RECORDING_SOURCE_CAMSTACK_ADDON},
+* naming the impostor, and `scripts/check-reserved-collection-sources.ts`
+* fails CI on a provider package that spells it at all. A rule nothing checks
+* has already been broken somewhere.
+*/
+var RECORDING_SOURCE_CAMSTACK = "camstack";
+/** The one addon allowed to serve {@link RECORDING_SOURCE_CAMSTACK}: the
+*  recorder, which is the addon that writes the footage (D560). */
+var RECORDING_SOURCE_CAMSTACK_ADDON = "recorder";
 var RecordingRangeSchema = object({
 	profile: string(),
 	startMs: number(),
 	endMs: number()
 });
+/**
+* How a source ANSWERED, on every singular read of this cap.
+*
+* `'read'` — it looked. `ranges: []` / `days: []` is then a real claim: this
+* source has no coverage in the window. `'unreadable'` — nobody could look
+* (the camera was unreachable, the calendar rung threw, the location is
+* unmounted, the node is still on the old build), and the emptiness beside it
+* means NOTHING.
+*
+* The batch rows have carried this since the grid existed; the SINGULAR
+* answers gained it with the collection (D625 §10.4), because they are the
+* ones the single-camera picker uses and because a half-converted fleet makes
+* "nobody looked" common for the length of a deploy. Without it the timeline
+* has no vocabulary for it, and `(data ?? [])` in a viewer turns a rollout into
+* a fleet of cameras that appear to have lost their recordings (D315, D393).
+*/
+var RecordingReadSchema = _enum(["read", "unreadable"]);
 var RecordingAvailabilitySchema = object({
 	deviceId: number(),
+	/** See {@link RecordingReadSchema}. An `'unreadable'` answer carries an empty
+	*  `ranges` that means nothing — never draw it as "no footage". */
+	read: RecordingReadSchema,
 	ranges: array(RecordingRangeSchema),
 	/**
-	* Every profile this camera has footage in — not only the one `ranges`
-	* describes (D433).
+	* Every profile this camera has footage in AT THIS SOURCE — not only the one
+	* `ranges` describes (D433).
 	*
 	* `ranges` answers for ONE profile by design: the timeline is a single bar,
 	* and enumerating all of them triples the directory reads for a bar that
@@ -34024,15 +34152,344 @@ var RecordingAvailabilitySchema = object({
 });
 var RecordingDaysSchema = object({
 	deviceId: number(),
+	/** See {@link RecordingReadSchema}. `days: []` on an `'unreadable'` answer is
+	*  "nobody could look", and the date-picker must not spell it the same as
+	*  "no footage this month". */
+	read: RecordingReadSchema,
 	/** Local-midnight epochs (UTC ms) of days that have ≥1 recorded segment. */
 	days: array(number())
 });
+var RecordingManifestSchema = object({
+	deviceId: number(),
+	/** Local filesystem path to the master playlist; null when no recording exists for the requested range. */
+	localMasterPath: string().nullable(),
+	/** HTTP(S) URL to the master playlist on the recording node's playback server
+	*  (the PRIMARY candidate); null when no recording / server. Carries the
+	*  scoped playback token in its path. */
+	playbackUrl: string().nullable(),
+	/**
+	* Candidate master-playlist URLs the client tries in order (LAN first, then
+	* remote — Tailscale/Cloudflare if the operator configured extra hosts), each
+	* carrying the same scoped token. `playbackUrl` is the first entry. Empty when
+	* there is no recording / server.
+	*/
+	playbackEndpoints: array(string())
+});
+var RecordingSourceAvailabilitySchema = object({
+	state: _enum([
+		"ok",
+		"sleeping",
+		"unreachable",
+		"no-storage",
+		"index-empty"
+	]),
+	/** Free text, shown verbatim. Names the camera's own refusal when there is one. */
+	reason: string().optional(),
+	/** When this source's coverage was last CONFIRMED. A cached answer is never
+	*  drawn as current: the surface shows the age whenever it is older than the
+	*  refresh interval. The clip catalog's `catalogAsOf`, under the name the
+	*  timeline uses for it. */
+	coverageAsOf: number().optional()
+});
+/**
+* One SOURCE of recorded coverage for a camera — a row of the picker.
+*
+* A provider lists the sources IT serves for that device, and answers for each
+* of them whether it can answer at all. A provider with nothing to offer on a
+* camera returns `[]` — it is not that camera's business. The five availability
+* states are `ClipSourceAvailability`'s verbatim: they mean exactly the same
+* things about a coverage index as about a clip catalog, and `sleeping` in
+* particular is what stops a battery camera being woken to paint a bar.
+*/
+var RecordingSourceSchema = object({
+	/** The source id. {@link RECORDING_SOURCE_CAMSTACK} for ours (RESERVED), a
+	*  vendor namespace (`native:reolink:onboard`, …) for a camera's own store. */
+	source: string(),
+	/** Operator-facing name of the source ("CamStack recordings", "SD card"). */
+	label: string(),
+	/**
+	* The addon that SERVES this row, and the value a later call passes as
+	* `provider`.
+	*
+	* Optional for version skew only. The collection dispatcher stamps it from
+	* the registry, so a row that travelled through the fan-out carries the
+	* authoritative id whatever the provider filled in (D557 §4).
+	*/
+	addonId: string().optional(),
+	availability: RecordingSourceAvailabilitySchema
+});
+/**
+* What a surface may DRAW for this (camera, source) — D612's rule applied to a
+* timeline: **the source declares what it can do, and the surface draws what
+* was declared. It never assumes, and never offers a gesture it will then
+* refuse.** D612 exists because `8` and `16` were offered as clip rates, the
+* broker clamped them to `4`, and no line anywhere said so.
+*
+* Asked once per (camera, source) before anything is drawn — never replaced by
+* a constant the surface keeps, which is the second authority D612 ends.
+*/
+var RecordingSourceOptionsSchema = object({
+	/** How this source's media reaches the player.
+	*  `archive` = our own indexed segment tree; `stream` = the provider's
+	*  forward-only fMP4 (D597); `realtime` = a replay bound to wall clock. */
+	transport: _enum([
+		"archive",
+		"stream",
+		"realtime"
+	]),
+	/** What the BAR means. `continuous` = gaps are holes in a recording;
+	*  `sparse` = gaps are the absence of one, and must be drawn as such.
+	*
+	*  Not an onboard-only concession: measured 2026-09-24, OUR bar covers 98.8 %
+	*  of 592's day and 1.2 % of 1436's. It is a fact about a (source, camera)
+	*  pair, and ours answers it per camera from `deriveRecordingMode`. */
+	coverage: _enum(["continuous", "sparse"]),
+	/** Where the playhead may be put.
+	*  `free`    — anywhere, to the frame.
+	*  `forward` — only ahead of the current position.
+	*  `segment` — a position SNAPS to the head of the covering segment; a finer
+	*              ask is accepted by the camera and SILENTLY IGNORED. Measured
+	*              on 1436 (Hikvision V5.7.1, 2026-09-23): a window-narrowed
+	*              `ContentMgmt/search` returns a row and a `playbackURI`, the
+	*              replay opens 200 and delivers media — and the burned-in OSD of
+	*              the first frame reads the SEGMENT HEAD every time. Calling
+	*              that `forward` would tell the surface it may move the playhead
+	*              ahead within a loaded segment, which it may not. */
+	seek: _enum([
+		"free",
+		"forward",
+		"segment"
+	]),
+	/** Frame-step BACKWARD is meaningful. */
+	stepBack: boolean(),
+	/** Whether the drag-scrub gesture is served, as opposed to refused by name. */
+	scrub: boolean(),
+	/** Deliverable rates, ascending, always containing `1`. The surface draws its
+	*  picker from this and from NOTHING else (D612, D620, D621). `0` is not a
+	*  member: pause is the absence of a rate. */
+	rates: array(number().positive()).min(1).readonly(),
+	/** TRUE when a read of this source HOLDS the camera's only playback session.
+	*  A surface with this set makes at most ONE read at a time and draws no
+	*  scrub-thumbnail strip, no hover preview, no prefetch and no background
+	*  refresh. The precedent is exact and expensive: filling one screen of
+	*  Hikvision thumbnails at 1.01× realtime consumed fifteen minutes of that
+	*  camera's only playback session (1.2.126, reported within minutes), and a
+	*  timeline is a screenful of reads by construction. */
+	exclusive: boolean()
+});
+/**
+* How to PLAY the instant that was asked for, from the chosen source.
+*
+* No new media transport is built for onboard sources: the `clip` arm is a
+* DELEGATION to the `videoclips` transport that vendor already has (D597 /
+* D616 / D617). The onboard half of this collection is a PROJECTION of
+* `videoclips` for coverage and a delegation to it for bytes.
+*/
+var RecordingPlaybackSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("hls"),
+		manifest: RecordingManifestSchema
+	}),
+	object({
+		kind: literal("clip"),
+		/** The `videoclips` source namespace this clip id belongs to. */
+		source: string(),
+		clipId: string(),
+		/** Where this clip actually STARTS. On a `seek: 'segment'` source the
+		*  playhead lands here, not at the requested instant — the surface must be
+		*  TOLD, not left to discover it from a burned-in OSD. */
+		startsAtMs: number()
+	}),
+	object({
+		kind: literal("none"),
+		reason: string()
+	})
+]);
+var recordingCapability = {
+	name: "recording",
+	scope: "device",
+	/** Several sources per camera, listed beside each other. The mount stays
+	*  `device-scoped` — see `resolveCapMount`'s ordering and D554: per-device
+	*  wins over the global collection fan-out. */
+	mode: "collection",
+	kind: "wrapper",
+	defaultActive: true,
+	/** Recorded coverage is a property of a camera — the cap is meaningless on a
+	*  sensor, a button or an event emitter, and the `defaultActive` auto-bind
+	*  reads this to decide which devices it may claim. */
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		/**
+		* The sources this camera has, WITH the reason any of them cannot answer.
+		*
+		* Asked separately from `getAvailability` because an empty bar is
+		* ambiguous and this is the only place the ambiguity is resolved: every
+		* bound provider contributes its own rows, and a provider that could not be
+		* reached at all still produces one row saying so. A surface that draws "no
+		* recordings" without reading this is drawing a guess.
+		*
+		* The ONLY method here without a `provider` — it is the call that tells the
+		* caller what to put there.
+		*/
+		listSources: method(object({ deviceId: number() }), array(RecordingSourceSchema).readonly(), {
+			kind: "query",
+			auth: "protected"
+		}),
+		/**
+		* Recorded coverage of `[fromMs, toMs)` at ONE source — the timeline bar.
+		*
+		* `protected`, not `admin`: a per-camera read is exactly what a camera
+		* viewer is FOR, and the device-scoped mount routes through
+		* `getProviderForDevice`, so a camera outside the caller's scope is refused
+		* before a provider is reached.
+		*/
+		getAvailability: method(object({
+			deviceId: number(),
+			/**
+			* WHICH provider to ask — the `addonId` a {@link RecordingSourceSchema}
+			* row carries, never a source id and never a list. **REQUIRED**, in the
+			* schema, where the generated types make it unomittable rather than
+			* merely discouraged (D554 amended).
+			*
+			* It was learned the expensive way on `videoclips.listClips`: measured
+			* on the live hub 2026-09-20, device 592 bound to `recorder` AND
+			* `provider-reolink`, a bare call with `limit: 3` answered SIX rows,
+			* three from each source, merged — `device-collection-dispatch.ts`
+			* leaves an unpinned fan-out un-narrowed, so absence buys the union the
+			* method exists not to be. An un-narrowed `getAvailability` would do
+			* that to a TIMELINE: our ranges and the card's clips unioned into one
+			* bar, which is "two sources are never drawn together" broken in the
+			* one place it matters most.
+			*
+			* A provider the device is not bound to is refused BY NAME (D552's
+			* `rejectUnresolvedAddonPin`), never answered by another one.
+			*/
+			provider: string().min(1),
+			fromMs: number(),
+			toMs: number(),
+			/**
+			* Answer for THIS profile instead of the source's preferred one (D433).
+			* Absent keeps the timeline's behaviour — one bar, one profile, one set
+			* of reads. `profilesWithFootage` on the answer says what may be asked
+			* for.
+			*/
+			profile: string().optional()
+		}), RecordingAvailabilitySchema, {
+			kind: "query",
+			auth: "protected"
+		}),
+		/** Which calendar days in [fromMs,toMs) this source has ≥1 recording in,
+		*  bucketed by the client's local day (`tzOffsetMinutes` = minutes to add
+		*  to UTC). Drives the theater date-picker's day dots. `provider` is
+		*  REQUIRED for the reason `getAvailability` states. */
+		getDaysWithRecordings: method(object({
+			deviceId: number(),
+			provider: string().min(1),
+			fromMs: number(),
+			toMs: number(),
+			tzOffsetMinutes: number()
+		}), RecordingDaysSchema, {
+			kind: "query",
+			auth: "protected"
+		}),
+		/**
+		* How to PLAY `[fromMs, toMs)` at this source.
+		*
+		* It was `getPlaybackManifest`, and the rename is not cosmetic: a
+		* "manifest" is an HLS master playlist, which is a property of OUR recorder
+		* and of nothing else. Keeping the name would make every onboard
+		* implementation a lie in its signature. The old shape survives verbatim
+		* inside the union's `hls` arm, so the recorder's implementation is
+		* unchanged behind it.
+		*/
+		getPlayback: method(object({
+			deviceId: number(),
+			provider: string().min(1),
+			fromMs: number(),
+			toMs: number(),
+			profile: CamProfileSchema.optional()
+		}), RecordingPlaybackSchema, {
+			kind: "query",
+			auth: "protected"
+		}),
+		/**
+		* What this (camera, source) can actually DO — asked before anything is
+		* drawn. See {@link RecordingSourceOptionsSchema}; a constant the surface
+		* keeps instead is the second authority D612 exists to end.
+		*/
+		getPlaybackOptions: method(object({
+			deviceId: number(),
+			provider: string().min(1)
+		}), RecordingSourceOptionsSchema, {
+			kind: "query",
+			auth: "protected"
+		})
+	}
+};
+/**
+* `recording-archive` — OUR archive, and the intent that fills it.
+*
+* The system-singleton half of the 2026-09-24 cut (D625). `recording` used to
+* be one 33-method system singleton holding two unrelated subjects: three
+* per-camera READS about coverage and playback, and everything else — storage
+* locations, retention, relocation, rebalance, the ops log, the placement
+* table and the byte-plane primitives our scrub and export are built on.
+*
+* The reads became a device-scoped COLLECTION, so a camera's own card can be a
+* source beside ours (`recording.cap.ts`). Everything that is about OUR store,
+* or unimplementable by a camera, stayed here.
+*
+* ## On the name
+*
+* `recording-storage` was the obvious choice and is wrong: this cap also holds
+* `getDeviceConfig`/`setDeviceConfig`, which are recording INTENT — bands,
+* retention, the D62 switch authority — and a name that says "storage" invites
+* the next reader to move them out again. An archive is a thing we keep, and
+* what we keep it under is a policy; the name covers both halves honestly and
+* sits in the existing family (`recording-onboard`, `recording-export`,
+* `recording-signal`).
+*
+* ## What must NOT happen to it
+*
+* It stays a SINGLETON. It is registered by `recorder`, which is
+* `placement: 'any-node'` and runs on every recording node; the hub dispatches
+* to one of them. Putting the ledger, the placement table or the relocation
+* jobs behind a fan-out is the one genuinely dangerous move in this cut.
+*
+* `getDeviceConfig` / `setDeviceConfig` in particular are the D62 recording
+* authority (`CameraSwitch.authority`). If a write reached a different provider
+* than the read — which a collection fan-out permits — two authorities would
+* decide when one camera records, and the symptom (recording silently off, or
+* a `bands` array clobbered by a partial write) is durable and silent. Keeping
+* them here means the worst case during a rollout is a 412: the switch refuses
+* to flip and SAYS so. **Do not move them into the collection, at any point,
+* for any reason.**
+*
+* ## The two batch reads
+*
+* `getAvailabilityBatch` / `getDaysWithRecordingsBatch` take `deviceIds:
+* number[]` with no single `deviceId`, and a device-scoped mount routes
+* through `getProviderForDevice(deviceId)` — there is nothing for it to route
+* on. They stay here, and on this cap the batch is explicitly OURS: a grid has
+* no per-camera picker, and a caller that wants another source's coverage asks
+* `recording.getAvailability` per device with that source's `provider`.
+*/
+var RecordingStatusSchema = object({
+	deviceId: number(),
+	enabled: boolean(),
+	/** THE derived storage mode, from the one definition
+	*  (`deriveRecordingMode`) — never a second enum. A duplicated list is how
+	*  `on-device-decision` could have reached the recorder and not the status. */
+	activeMode: RecordingStorageModeSchema,
+	nodeId: string(),
+	storageBytes: number()
+});
 /**
 * One camera's row in a `getAvailabilityBatch` answer.
 *
-* `ranges` is EXACTLY what `getAvailability` returns for that camera — the
-* batch collapses the transport, not the work — plus the one thing the singular
-* method never had to say:
+* `ranges` is EXACTLY what `recording.getAvailability` returns for that camera
+* at OUR source — the batch collapses the transport, not the work — plus the
+* `read` mark the singular answer now carries too (D625):
 *
 *  - `read: 'read'` — answered. `ranges: []` means "read, and this camera has
 *    no footage in the window", which is a real claim.
@@ -34064,22 +34521,6 @@ var RecordingDaysForDeviceSchema = object({
 	/** Local-midnight epochs (UTC ms) of days that have ≥1 recorded segment. */
 	days: array(number()).readonly()
 });
-var RecordingManifestSchema = object({
-	deviceId: number(),
-	/** Local filesystem path to the master playlist; null when no recording exists for the requested range. */
-	localMasterPath: string().nullable(),
-	/** HTTP(S) URL to the master playlist on the recording node's playback server
-	*  (the PRIMARY candidate); null when no recording / server. Carries the
-	*  scoped playback token in its path. */
-	playbackUrl: string().nullable(),
-	/**
-	* Candidate master-playlist URLs the client tries in order (LAN first, then
-	* remote — Tailscale/Cloudflare if the operator configured extra hosts), each
-	* carrying the same scoped token. `playbackUrl` is the first entry. Empty when
-	* there is no recording / server.
-	*/
-	playbackEndpoints: array(string())
-});
 /**
 * Recording storage usage for one camera — what the ARCHIVE holds for it,
 * across every profile and every resolvable location on this node.
@@ -34337,33 +34778,22 @@ var ReadWindowBytesResultSchema = discriminatedUnion("kind", [object({
 	*  not a retry hint (retrying the same window would refuse again). */
 	segmentEndMs: number()
 })]);
-var recordingCapability = {
-	name: "recording",
+var recordingArchiveCapability = {
+	name: "recording-archive",
 	scope: "system",
 	mode: "singleton",
+	/** Moves here with the config pair — the derived Recording settings
+	*  section is a view over `getDeviceConfig`/`setDeviceConfig` (D14), and
+	*  those did not move (D625). */
 	exposesDeviceSettings: true,
 	status: {
 		schema: RecordingStatusSchema,
 		kind: "command-driven"
 	},
 	methods: {
-		getAvailability: method(object({
-			deviceId: number(),
-			fromMs: number(),
-			toMs: number(),
-			/**
-			* Answer for THIS profile instead of the preferred one (D433). Absent
-			* keeps the timeline's behaviour — one bar, one profile, one set of
-			* reads. `profilesWithFootage` on the answer says what may be asked
-			* for.
-			*/
-			profile: string().optional()
-		}), RecordingAvailabilitySchema, {
-			kind: "query",
-			auth: "protected"
-		}),
 		/**
-		* `getAvailability` for a SET of cameras, in one round trip.
+		* `recording.getAvailability` for a SET of cameras, in one round trip, at
+		* OUR source.
 		*
 		* A multi-camera timeline re-asks availability for every camera in the grid
 		* on every day change; fanned out that is one request per camera for N
@@ -34371,6 +34801,13 @@ var recordingCapability = {
 		* `availabilityProfileFor` + `rangesIn`, run concurrently inside the
 		* recorder) — only the transport collapses.
 		*
+		* It lives on the ARCHIVE, not on the `recording` collection, because it
+		* takes `deviceIds` with no single `deviceId` and a device-scoped mount has
+		* nothing to route on (D625 §10.2). The consequence is stated rather than
+		* hidden: the batch answers for OURS. A caller that needs another source's
+		* coverage asks `recording.getAvailability` per device, naming that
+		* source's provider.
+		*
 		* `protected` for the same reason the singular method is: every id in
 		* `deviceIds` is a device reference, so the F1 #3 gate refuses any camera
 		* outside the caller's scope — one id out of scope refuses the CALL, it
@@ -34388,20 +34825,10 @@ var recordingCapability = {
 			kind: "query",
 			auth: "protected"
 		}),
-		/** Which calendar days in [fromMs,toMs) have ≥1 recorded segment, bucketed by
-		*  the client's local day (`tzOffsetMinutes` = minutes to add to UTC). Drives
-		*  the theater date-picker's day dots. */
-		getDaysWithRecordings: method(object({
-			deviceId: number(),
-			fromMs: number(),
-			toMs: number(),
-			tzOffsetMinutes: number()
-		}), RecordingDaysSchema, {
-			kind: "query",
-			auth: "protected"
-		}),
 		/**
-		* `getDaysWithRecordings` for a SET of cameras, in one round trip.
+		* `recording.getDaysWithRecordings` for a SET of cameras, in one round
+		* trip, at OUR source. Same placement argument as
+		* {@link getAvailabilityBatch}.
 		*
 		* The cheapest question in the product, asked once per camera per month
 		* change. One directory read per day per camera at the owner, unchanged;
@@ -34420,14 +34847,6 @@ var recordingCapability = {
 			kind: "query",
 			auth: "protected"
 		}),
-		getPlaybackManifest: method(object({
-			deviceId: number(),
-			fromMs: number(),
-			toMs: number()
-		}), RecordingManifestSchema, {
-			kind: "query",
-			auth: "protected"
-		}),
 		getStorageUsage: method(object({}), RecordingStorageUsageSchema, {
 			kind: "query",
 			auth: "admin"
@@ -34443,6 +34862,10 @@ var recordingCapability = {
 		* value (D315, D393, D590). It carries schedules and retention, no secret,
 		* and the per-device gate in `scope-access.ts` still applies; `setDeviceConfig`
 		* stays `admin`.
+		*
+		* It is a SINGLETON method and stays one (D625 §16.2): it is the D62
+		* recording authority, and an authority that several providers could answer
+		* is the "two knobs over one decision" D62 forbids.
 		*/
 		getDeviceConfig: method(object({ deviceId: number() }), RecordingConfigSchema, {
 			kind: "query",
@@ -34450,7 +34873,13 @@ var recordingCapability = {
 		}),
 		/** Locate footage at a wall-clock instant: the covering segment's window,
 		*  or a gap with the forward nearest covered edge. Used by a feeder running
-		*  in another addon process to seek recorded footage over tRPC. */
+		*  in another addon process to seek recorded footage over tRPC.
+		*
+		*  BYTE PLANE: defined by `mfra` byte ranges over OUR own MP4 segment tree.
+		*  There is no vendor-neutral statement of it, its only callers are feeders
+		*  in other addon processes (the stream broker, the replay-clip source),
+		*  and an onboard source that ever needs bytes delegates to the
+		*  `videoclips` transport its vendor already has (D625 §9.3, §10.5). */
 		locateSegment: method(object({
 			deviceId: number(),
 			profile: string(),
@@ -35183,6 +35612,307 @@ var recordingExportCapability = {
 	}
 };
 /**
+* Vendor-neutral **onboard** recording + storage cap — what the CAMERA
+* writes to the CAMERA's own card, on the camera's own schedule.
+*
+* This is NOT `recording.cap.ts`. That one is CamStack's recorder: our
+* footage ledger, our storage locations, our retention. This one has a
+* different authority — the camera's firmware — and per D62 it stores
+* nothing of its own. Every value here is read from the camera and every
+* write goes back to the camera; there is no CamStack-side mirror that
+* could disagree with the device.
+*
+* ## One shape, two firmwares
+*
+* Measured 2026-09-22 against the live fleet:
+*
+* | fact | Hikvision (ISAPI) | Reolink (Baichuan) |
+* | --- | --- | --- |
+* | storage | `ContentMgmt/Storage` `<hdd>` rows: status, capacity, freeSpace (MB) | `getHddInfoList` (cmd 102): `mount`, `format`, `capacity` GB + `capacityM` MB remainder |
+* | tracks | several (101 **and** 103 on both 1436 and 3833), each with its own schedule | one per channel |
+* | schedule | per track, 7 `ScheduleAction` blocks: DayOfWeek + TimeOfDay range + ONE `ActionRecordingMode` | per trigger type, a 168-char weekly HOUR mask |
+* | triggers | `CMR`, `MOTION` | `Normal`, `MD`, `people`, `vehicle`, `dog_cat`, `crossline`, `intrude`, `loitering` |
+* | pre-record | `PreRecordTimeSeconds` | `preRecordTime` |
+* | post-record | `PostRecordTimeSeconds` | `recordDelayTime` |
+* | overwrite | per track `LoopEnable` | `cycle`, with `cycleList` enumerating the accepted values |
+* | segment length | not exposed on V5.7.1 | `packageTime` (minutes) |
+*
+* The two schedule models look different and are the same thing in
+* different coordinates: both answer "for this trigger, during which
+* weekly windows does the camera record". {@link RecordWindow} is that
+* question in one shape — Hikvision's ranges map straight onto it,
+* Reolink's mask expands into hour-aligned windows.
+*
+* ## Union, not intersection
+*
+* **The same fields exist on every camera.** What differs per device is
+* which VALUES that device accepts, and that is what {@link
+* RecordingOnboardOptions} reports — a `{ readable, writable, reason }`
+* per field plus the schedule's own limits. A control a camera cannot
+* honour is rendered DISABLED WITH ITS REASON, never missing and never
+* dead: disabled must not look like broken.
+*
+* ## Refusal by name
+*
+* A write a camera cannot honour is refused with a sentence the operator
+* can read — never accepted and dropped. Both providers refuse through
+* {@link describeOnboardRefusal}, so the vocabulary is one function and
+* one test, not two hand-written vendor opinions.
+*
+* Follows the D14 `deviceConfig` archetype (see `stream-params.cap.ts`):
+* `getOptions` advertises per-camera availability, `getStatus` (auto-
+* injected from `status`) reports the live values, and a single
+* `setSettings` mutation applies a partial change. No hand-written
+* settings-contribution methods.
+*/
+/**
+* What makes the camera start recording during a window.
+*
+* The union of both vendors' vocabularies. `continuous` is Hikvision's
+* `CMR` and Reolink's `Normal`; `motion` is `MOTION` / `MD`. The
+* object-class triggers are Reolink-only today and the smart-event ones
+* (`lineCrossing`, `intrusion`, `loitering`) are Reolink-only on the
+* firmwares measured — a camera that cannot record on a trigger simply
+* does not list it in `options.schedule.triggers`, and a window naming
+* it is REFUSED, not dropped.
+*/
+var RecordTriggerSchema = _enum([
+	"continuous",
+	"motion",
+	"person",
+	"vehicle",
+	"animal",
+	"lineCrossing",
+	"intrusion",
+	"loitering",
+	"alarmInput"
+]);
+/**
+* One weekly recording window: "on `day`, from `startMinute` to
+* `endMinute`, record on `trigger`".
+*
+* `day` is 0 = Monday … 6 = Sunday (ISO order, which is also the order
+* both firmwares enumerate). Minutes are local camera time since
+* midnight; `endMinute` may be 1440, meaning end of day — that is
+* Hikvision's literal `24:00` and Reolink's 24th mask slot, and
+* collapsing it to 0 would turn a whole-day window into an empty one.
+*/
+var RecordWindowSchema = object({
+	trigger: RecordTriggerSchema,
+	day: number().int().min(0).max(6),
+	startMinute: number().int().min(0).max(1439),
+	endMinute: number().int().min(1).max(1440)
+});
+/** Status of one physical volume, as the camera itself describes it. */
+var OnboardStorageVolumeSchema = object({
+	/** The camera's own id for the volume (`hdd/id`, Reolink `HddInfo/number`). */
+	id: string(),
+	/** The camera's own name for it, when it gives one (`hddName`). */
+	label: string().optional(),
+	status: _enum([
+		"ok",
+		"unformatted",
+		"error",
+		"offline",
+		"unknown"
+	]),
+	/**
+	* Total size in MB, or **null when the camera did not say**.
+	*
+	* Never 0 for an unreadable value: a measurement that failed is not a
+	* measurement (D393), and a card whose size is unknown must not be
+	* rendered as a card of size zero.
+	*/
+	capacityMb: number().nullable(),
+	/**
+	* Free space in MB, or null when unknown.
+	*
+	* **Not a proxy for "has footage".** Measured 2026-09-22: 1436 and
+	* 1439 both report exactly 11776 MB free — the fixed reserve a looping
+	* card converges on once it has wrapped. At loop steady state the
+	* number is identical whether the camera recorded yesterday or stopped
+	* a month ago.
+	*/
+	freeMb: number().nullable(),
+	/** True when the camera reports the volume writable (`property` RW). */
+	writable: boolean().optional()
+});
+object({
+	storage: discriminatedUnion("kind", [
+		object({
+			kind: literal("present"),
+			volumes: array(OnboardStorageVolumeSchema)
+		}),
+		object({
+			kind: literal("absent"),
+			reason: string()
+		}),
+		object({
+			kind: literal("unknown"),
+			reason: string()
+		})
+	]),
+	tracks: array(object({
+		id: string(),
+		enabled: boolean(),
+		isVideo: boolean(),
+		/** From the camera's own track description. Null when it does not say. */
+		codec: string().nullable(),
+		resolution: string().nullable(),
+		/** Per-track overwrite flag, where the firmware keeps it per track. */
+		overwriteWhenFull: boolean().nullable()
+	})),
+	/**
+	* The track the write path targets — the enabled VIDEO one. Null when
+	* no track could be identified, which is itself a refusal reason.
+	*/
+	primaryTrackId: string().nullable(),
+	/** Master "record to the card at all" switch. */
+	enabled: boolean().nullable(),
+	overwriteWhenFull: boolean().nullable(),
+	preRecordSec: number().nullable(),
+	postRecordSec: number().nullable(),
+	/** Length of one recorded file, in minutes. */
+	segmentMinutes: number().nullable(),
+	/** The primary track's weekly windows, flattened. */
+	windows: array(RecordWindowSchema),
+	/**
+	* How many windows the camera described that CamStack could NOT read —
+	* an unrecognised trigger, an unparseable clock, a weekday it does not
+	* name.
+	*
+	* A dropped window is work the reader threw away, and a schedule that
+	* silently shows fewer rows than the camera holds is how an operator
+	* saves back a schedule shorter than the one they were looking at
+	* (D391). Non-zero means the window list is INCOMPLETE and a write
+	* that replaces it would delete what was not shown — which is why a
+	* provider reporting a non-zero count also reports the schedule as not
+	* writable.
+	*/
+	unreadableWindows: number(),
+	/**
+	* The camera is scheduled to record and has NO usable storage.
+	*
+	* A first-class fact because it is the fleet's most common silent
+	* defect: measured 2026-09-22, 1441 and 3831 are both motion-recording
+	* to a card that is not there. Neither the schedule nor the storage
+	* read says anything wrong on its own; only the pair does.
+	*/
+	recordingToNowhere: boolean(),
+	lastFetchedAt: number()
+});
+/** Numeric range descriptor — `{ min, max, step }` per the getOptions convention. */
+var RangeSchema = object({
+	min: number(),
+	max: number(),
+	step: number()
+});
+/**
+* The values a camera actually takes for a numeric field, when they are a SET
+* rather than a range.
+*
+* `{min,max,step}` cannot say what these two firmwares do. Measured on 1436
+* (I91DN) on 2026-09-22 by writing each value and reading it back:
+*
+* - pre-record: `0, 5, 10, 15, 20, 25, 30` and `2147483647` (INT32_MAX, the
+*   camera's "no limit" — `-1` and `4294967295` both land on it);
+* - post-record: `5, 10, 30, 60, 120, 300, 600`.
+*
+* Neither is expressible as a step: the first has a sentinel two billion away
+* from its neighbours, the second doubles and then jumps. A range that tried
+* would forbid values the camera takes AND permit values it silently replaces
+* with 5 — wrong in both directions at once.
+*
+* `sentinel` names the member that is not a duration, so a surface can render
+* "no limit" instead of `2147483647` seconds.
+*/
+var AllowedValuesSchema = object({
+	values: array(number()).min(1),
+	sentinel: object({
+		value: number(),
+		meaning: _enum(["no-limit", "disabled"])
+	}).optional()
+});
+/**
+* Per-field availability on ONE camera.
+*
+* The field exists on every camera — this says whether this one can be
+* read and whether it can be written, and `reason` says why not when
+* either is false. The UI renders the control DISABLED with the reason
+* rather than hiding it, so a limitation is legible instead of looking
+* like a missing feature.
+*/
+var OnboardFieldSupportSchema = object({
+	readable: boolean(),
+	writable: boolean(),
+	/** Required whenever `readable` or `writable` is false. */
+	reason: string().optional()
+});
+/** What this camera's schedule model can express. */
+var OnboardScheduleSupportSchema = object({
+	support: OnboardFieldSupportSchema,
+	/**
+	* The smallest time step the camera can express, in minutes.
+	*
+	* Hikvision takes arbitrary minutes (`00:05:00`–`23:57:00` observed on
+	* 1436's track 103). Reolink's schedule is a 7×24 HOUR mask, so 60. A
+	* window whose edges are not a multiple of this is REFUSED rather than
+	* quietly rounded — rounding is how an operator's 06:30 becomes 06:00
+	* and nothing says so.
+	*/
+	granularityMinutes: number(),
+	/** Triggers this camera can record on. A window naming another is refused. */
+	triggers: array(RecordTriggerSchema),
+	/**
+	* False when the camera stores ONE trigger per time range, so two
+	* windows overlapping on the same day cannot carry different triggers.
+	* True on Reolink, whose mask is per-trigger and independent.
+	*/
+	supportsOverlappingTriggers: boolean()
+});
+var RecordingOnboardOptionsSchema = object({
+	enabled: OnboardFieldSupportSchema,
+	overwriteWhenFull: OnboardFieldSupportSchema,
+	preRecordSec: OnboardFieldSupportSchema,
+	preRecordSecRange: RangeSchema.optional(),
+	/** Preferred over the range when the camera takes a SET, not a span. */
+	preRecordSecAllowed: AllowedValuesSchema.optional(),
+	postRecordSec: OnboardFieldSupportSchema,
+	postRecordSecRange: RangeSchema.optional(),
+	/** Preferred over the range when the camera takes a SET, not a span. */
+	postRecordSecAllowed: AllowedValuesSchema.optional(),
+	segmentMinutes: OnboardFieldSupportSchema,
+	segmentMinutesRange: RangeSchema.optional(),
+	/** Preferred over the range when the camera takes a SET, not a span. */
+	segmentMinutesAllowed: AllowedValuesSchema.optional(),
+	schedule: OnboardScheduleSupportSchema
+});
+/**
+* A partial change. Every field optional.
+*
+* Unlike the other `deviceConfig` caps, a provider here does **NOT**
+* silently ignore a field it cannot support — it refuses, by name,
+* through {@link describeOnboardRefusal}. Silence on a recording setting
+* is the failure D62 exists to prevent: the operator believes the camera
+* is recording the way the form says, and it is not.
+*/
+var RecordingOnboardPatchSchema = object({
+	enabled: boolean().optional(),
+	overwriteWhenFull: boolean().optional(),
+	preRecordSec: number().optional(),
+	postRecordSec: number().optional(),
+	segmentMinutes: number().optional(),
+	/** The complete new window set for the primary track — not a delta. */
+	windows: array(RecordWindowSchema).optional()
+});
+DeviceType.Camera, method(object({ deviceId: number() }), RecordingOnboardOptionsSchema), method(object({
+	deviceId: number(),
+	settings: RecordingOnboardPatchSchema
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * A camera's own "record me NOW" LEVEL — a signal the device raises while
 * something it knows about is happening (a robot vacuum cleaning, a machine
 * running, a gate open) and lowers when it stops.
@@ -40179,6 +40909,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.listDeviceIdsByCaps": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.listLocationDescriptions": {
 		capName: "device-manager",
 		capScope: "system",
@@ -40665,24 +41401,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"events.getEventClipUrl": {
-		capName: "events",
-		capScope: "device",
-		addonId: null,
-		access: "view"
-	},
-	"events.getEvents": {
-		capName: "events",
-		capScope: "device",
-		addonId: null,
-		access: "view"
-	},
-	"events.getEventThumbnail": {
-		capName: "events",
-		capScope: "device",
-		addonId: null,
-		access: "view"
-	},
 	"faceGallery.assignFace": {
 		capName: "face-gallery",
 		capScope: "system",
@@ -42003,6 +42721,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.getTemplateCatalog": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.listDeviceMutes": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -42021,6 +42745,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.previewTemplate": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.resolveArtifactUrl": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -43557,224 +44287,236 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"recording.applyDeviceSettingsPatch": {
+	"recording.getAvailability": {
 		capName: "recording",
-		capScope: "system",
+		capScope: "device",
 		addonId: null,
-		access: "create"
+		access: "view"
 	},
-	"recording.cancelRelocateJob": {
+	"recording.getDaysWithRecordings": {
 		capName: "recording",
-		capScope: "system",
+		capScope: "device",
 		addonId: null,
-		access: "create"
+		access: "view"
 	},
-	"recording.cancelStorageMigrationMove": {
+	"recording.getPlayback": {
 		capName: "recording",
-		capScope: "system",
+		capScope: "device",
 		addonId: null,
-		access: "create"
+		access: "view"
 	},
-	"recording.deleteFootprint": {
+	"recording.getPlaybackOptions": {
 		capName: "recording",
-		capScope: "system",
+		capScope: "device",
 		addonId: null,
-		access: "delete"
+		access: "view"
 	},
-	"recording.getAvailability": {
+	"recording.listSources": {
 		capName: "recording",
-		capScope: "system",
+		capScope: "device",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getAvailabilityBatch": {
-		capName: "recording",
+	"recordingArchive.applyDeviceSettingsPatch": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "create"
 	},
-	"recording.getDaysWithRecordings": {
-		capName: "recording",
+	"recordingArchive.cancelRelocateJob": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "create"
 	},
-	"recording.getDaysWithRecordingsBatch": {
-		capName: "recording",
+	"recordingArchive.cancelStorageMigrationMove": {
+		capName: "recording-archive",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"recordingArchive.deleteFootprint": {
+		capName: "recording-archive",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"recordingArchive.getAvailabilityBatch": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getDeviceConfig": {
-		capName: "recording",
+	"recordingArchive.getDaysWithRecordingsBatch": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getDeviceLiveContribution": {
-		capName: "recording",
+	"recordingArchive.getDeviceConfig": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getDeviceSettingsContribution": {
-		capName: "recording",
+	"recordingArchive.getDeviceLiveContribution": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getPlacement": {
-		capName: "recording",
+	"recordingArchive.getDeviceSettingsContribution": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getPlaybackManifest": {
-		capName: "recording",
+	"recordingArchive.getPlacement": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getRelocateResidue": {
-		capName: "recording",
+	"recordingArchive.getRelocateResidue": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getStatus": {
-		capName: "recording",
+	"recordingArchive.getStatus": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getStorageMigrationMoveStatus": {
-		capName: "recording",
+	"recordingArchive.getStorageMigrationMoveStatus": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getStorageUsage": {
-		capName: "recording",
+	"recordingArchive.getStorageUsage": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.listOpsLog": {
-		capName: "recording",
+	"recordingArchive.listOpsLog": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.listRelocateJobs": {
-		capName: "recording",
+	"recordingArchive.listRelocateJobs": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.locateSegment": {
-		capName: "recording",
+	"recordingArchive.locateSegment": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.pauseForStorageMigration": {
-		capName: "recording",
+	"recordingArchive.pauseForStorageMigration": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.planStorageRebalance": {
-		capName: "recording",
+	"recordingArchive.planStorageRebalance": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.pruneFootage": {
-		capName: "recording",
+	"recordingArchive.pruneFootage": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.readGopBytes": {
-		capName: "recording",
+	"recordingArchive.readGopBytes": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.readSegmentBytes": {
-		capName: "recording",
+	"recordingArchive.readSegmentBytes": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.readWindowBytes": {
-		capName: "recording",
+	"recordingArchive.readWindowBytes": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.reconcileLedgerAgainstDisk": {
-		capName: "recording",
+	"recordingArchive.reconcileLedgerAgainstDisk": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.refreshStorageLocationsForMigration": {
-		capName: "recording",
+	"recordingArchive.refreshStorageLocationsForMigration": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.relocateFootage": {
-		capName: "recording",
+	"recordingArchive.relocateFootage": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.renderClip": {
-		capName: "recording",
+	"recordingArchive.renderClip": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.renderGif": {
-		capName: "recording",
+	"recordingArchive.renderGif": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.rescanStorage": {
-		capName: "recording",
+	"recordingArchive.rescanStorage": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.resumeForStorageMigration": {
-		capName: "recording",
+	"recordingArchive.resumeForStorageMigration": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.setDeviceConfig": {
-		capName: "recording",
+	"recordingArchive.setDeviceConfig": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.setDevicePlacement": {
-		capName: "recording",
+	"recordingArchive.setDevicePlacement": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.startStorageMigrationMove": {
-		capName: "recording",
+	"recordingArchive.startStorageMigrationMove": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.startStorageRebalance": {
-		capName: "recording",
+	"recordingArchive.startStorageRebalance": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
@@ -46079,21 +46821,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"events.getEventClipUrl": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
-	"events.getEvents": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
-	"events.getEventThumbnail": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
 	"faceGallery.getFaceByTrack": [{
 		name: "deviceId",
 		form: "single",
@@ -47012,107 +47739,117 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"recording.deleteFootprint": [{
+	"recording.getAvailability": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.getAvailability": [{
+	"recording.getDaysWithRecordings": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.getAvailabilityBatch": [{
-		name: "deviceIds",
-		form: "array",
+	"recording.getPlayback": [{
+		name: "deviceId",
+		form: "single",
 		optional: false
 	}],
-	"recording.getDaysWithRecordings": [{
+	"recording.getPlaybackOptions": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.getDaysWithRecordingsBatch": [{
-		name: "deviceIds",
-		form: "array",
+	"recording.listSources": [{
+		name: "deviceId",
+		form: "single",
 		optional: false
 	}],
-	"recording.getDeviceConfig": [{
+	"recordingArchive.deleteFootprint": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.getPlaybackManifest": [{
+	"recordingArchive.getAvailabilityBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
+	"recordingArchive.getDaysWithRecordingsBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
+	"recordingArchive.getDeviceConfig": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.listOpsLog": [{
+	"recordingArchive.listOpsLog": [{
 		name: "deviceId",
 		form: "single",
 		optional: true
 	}],
-	"recording.locateSegment": [{
+	"recordingArchive.locateSegment": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.pruneFootage": [{
+	"recordingArchive.pruneFootage": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.readGopBytes": [{
+	"recordingArchive.readGopBytes": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.readSegmentBytes": [{
+	"recordingArchive.readSegmentBytes": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.readWindowBytes": [{
+	"recordingArchive.readWindowBytes": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.reconcileLedgerAgainstDisk": [{
+	"recordingArchive.reconcileLedgerAgainstDisk": [{
 		name: "deviceId",
 		form: "single",
 		optional: true
 	}],
-	"recording.relocateFootage": [{
+	"recordingArchive.relocateFootage": [{
 		name: "deviceId",
 		form: "single",
 		optional: true
 	}],
-	"recording.renderClip": [{
+	"recordingArchive.renderClip": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.renderGif": [{
+	"recordingArchive.renderGif": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.rescanStorage": [{
+	"recordingArchive.rescanStorage": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.setDeviceConfig": [{
+	"recordingArchive.setDeviceConfig": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.setDevicePlacement": [{
+	"recordingArchive.setDevicePlacement": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.startStorageMigrationMove": [{
+	"recordingArchive.startStorageMigrationMove": [{
 		name: "deviceId",
 		form: "single",
 		optional: true
@@ -47631,6 +48368,41 @@ var NC_AUDIO_DEFAULTS = {
 };
 new Set(["devices", "classes"]);
 NC_AUDIO_DEFAULTS.hitPercent, NC_AUDIO_DEFAULTS.samplingSeconds;
+var RULE_BODY_ONLY = ["body"];
+var RULE_TEXT = ["title", "body"];
+var BATTERY = ["device-battery-low", "device-battery-normal"];
+var CONSUMABLE = ["device-consumable-low", "device-consumable-normal"];
+var UPDATES = [
+	"addon-update-available",
+	"server-update-available",
+	"wrapper-update-available"
+];
+var PACKAGE_UPDATES = ["addon-update-available", "server-update-available"];
+var ALARM = [
+	"alarm-triggered",
+	"alarm-armed",
+	"alarm-disarmed",
+	"alarm-arming",
+	"alarm-arm-refused",
+	"alarm-pending",
+	"alarm-rearmed",
+	"alarm-sensor-bypass",
+	"alarm-check-failed"
+];
+var COMBINED_ALARM = ["alarm-triggered"];
+var DEVICE_EVENTS = [
+	"device-online",
+	"device-offline",
+	"device-disabled",
+	"device-enabled",
+	...BATTERY,
+	...CONSUMABLE,
+	"stream-online",
+	"stream-offline",
+	"detection-blind",
+	...ALARM
+];
+[...DEVICE_EVENTS], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_BODY_ONLY], [...RULE_TEXT], [...RULE_TEXT], [...DEVICE_EVENTS], [...RULE_TEXT], [...DEVICE_EVENTS], [...RULE_TEXT], [...BATTERY, ...CONSUMABLE], [...RULE_TEXT], [...CONSUMABLE], [...RULE_TEXT], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT];
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -49409,6 +50181,18 @@ Object.defineProperty(exports, "RECORDING_EXPORT_MAX_READ_BYTES", {
 		return RECORDING_EXPORT_MAX_READ_BYTES;
 	}
 });
+Object.defineProperty(exports, "RECORDING_SOURCE_CAMSTACK", {
+	enumerable: true,
+	get: function() {
+		return RECORDING_SOURCE_CAMSTACK;
+	}
+});
+Object.defineProperty(exports, "RECORDING_SOURCE_CAMSTACK_ADDON", {
+	enumerable: true,
+	get: function() {
+		return RECORDING_SOURCE_CAMSTACK_ADDON;
+	}
+});
 Object.defineProperty(exports, "RecordingConfigSchema", {
 	enumerable: true,
 	get: function() {
@@ -49883,6 +50667,12 @@ Object.defineProperty(exports, "record", {
 		return record;
 	}
 });
+Object.defineProperty(exports, "recordingArchiveCapability", {
+	enumerable: true,
+	get: function() {
+		return recordingArchiveCapability;
+	}
+});
 Object.defineProperty(exports, "recordingCapability", {
 	enumerable: true,
 	get: function() {