@camstack/addon-post-analysis 1.2.65 → 1.2.67

package/dist/{dist-4dhFDogy.mjs → dist-DJC4JrMD.mjs}

@@ -7576,6 +7576,13 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
+* The wrapper capability each wrapper-backed switch controls. Named constants
+* because the same strings appear in `legacy-migrations.ts`, in
+* `isCapActiveForDevice` call sites and in the fake harness — a typo in any of
+* them is a switch that silently writes a binding nobody reads.
+*/
+var DETECTION_PIPELINE_CAP_NAME = "detection-pipeline";
+/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -7800,7 +7807,15 @@ function deriveRecordingMode(config) {
 * Each completed/failed run also lands one durable ops-log row on its owning
 * addon surface.
 */
+/**
+* `queued` exists because the recorder mover is SINGLE-FLIGHT and an operator
+* rebalance enqueues one job per (camera, profile). Refusing the second job —
+* what the engine did before — turned a fifteen-camera rebalance into fifteen
+* manual retries. Queued jobs run FIFO; a queued job that is cancelled never
+* runs at all.
+*/
 var RelocateJobStateSchema = _enum([
+	"queued",
 	"running",
 	"done",
 	"failed",
@@ -7835,6 +7850,15 @@ var RelocateFootageInputSchema = object({
 	/** Limits relocation to the logical profile class. Omit only for the
 	* pre-orchestration compatibility path. */
 	footageClass: RelocateFootageClassSchema.optional(),
+	/** Scope the move to ONE camera. Absent = every camera on the source, which
+	*  is what a whole-disk drain means. The rebalance path always sets it: its
+	*  unit is a (camera, profile) pile, not a disk. */
+	deviceId: number().int().optional(),
+	/** Scope the move to specific segment profiles (`high` / `mid` / `low`).
+	*  Finer than `footageClass`, which cannot separate high from mid — and the
+	*  placement plan assigns those two independently, so a rebalance that could
+	*  only say "recordings" would move footage the plan never asked to move. */
+	profiles: array(string()).optional(),
 	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
 	*  never allowed to starve live writers. */
 	throttleMbps: number().min(1).max(1e3).optional()
@@ -7970,6 +7994,21 @@ var StorageLocationSchema = object({
 	nodeId: string().optional(),
 	isDefault: boolean().default(false),
 	isSystem: boolean().default(false),
+	/**
+	* Operator opt-in: whether consumers that BALANCE across several locations
+	* of a type may write here. Recordings reads it today; event media and
+	* backups are the next consumers, which is why the flag lives on the
+	* location rather than in any one addon's store — nothing has to be
+	* extended to add the next consumer.
+	*
+	* OPTIONAL, and ABSENT MEANS ACTIVE. Every location persisted before the
+	* flag existed reads back with no flag and keeps working exactly as before;
+	* that is the whole compat story, and it is why no migration ships with it.
+	* A newly CREATED sibling is stamped `false` by the orchestrator (creating a
+	* disk must not silently start writing to it); the default of a type is
+	* always stamped `true`.
+	*/
+	enabled: boolean().optional(),
 	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
 	*  for node-local locations it can reach) — never persisted, absent when the
 	*  volume is remote/unreachable. The single capacity truth every UI reads. */
@@ -12509,7 +12548,8 @@ var embeddingEncoderCapability = {
 };
 /**
 * filesystem-browse — per-node capability for browsing the node's local
-* filesystem, sandboxed to operator-configured allowed roots. Used by the
+* filesystem. Reads are unconfined (whole filesystem, from `/` down); WRITES
+* are sandboxed to operator-configured allowed roots (D115). Used by the
 * admin "Add filesystem location" flow to pick a node + path. `mode:'per-node'`
 * (one provider per node); the hub calls it with `{nodeId}` so the codegen
 * routes to that exact node (default `nodeIdMode:'routing'`).
@@ -14377,6 +14417,13 @@ var MaskGridDimsSchema = object({
 * `package-event` are pure trigger kinds (no urgency dimension). Extending
 * this one field keeps the schema additive — a rule still declares exactly
 * one trigger.
+*
+* AUDIO rules add no member here, for the reason occupancy added none: the
+* enum is mirrored by hand in the viewer (`scripts/check-viewer-condition-
+* mirror.ts` fails the build on a member the app cannot render) and every
+* member costs a release train. A sustained-sound rule is therefore an
+* `immediate` rule carrying {@link NcConditions.audio} — the condition is the
+* trigger discriminator, exactly as `occupancy` is on `device-event`.
 */
 var NcDeliverySchema = _enum([
 	"immediate",
@@ -14391,15 +14438,32 @@ var NcDeliverySchema = _enum([
 * depend on a provider's raw event name or payload shape.
 */
 var NcSystemEventKindSchema = _enum([
-	"camera-online",
-	"camera-offline",
+	"device-online",
+	"device-offline",
+	"device-disabled",
+	"device-enabled",
 	"stream-online",
 	"stream-offline",
 	"node-online",
 	"node-offline",
 	"addon-update-available",
-	"server-update-available"
+	"server-update-available",
+	"alarm-triggered",
+	"alarm-armed",
+	"alarm-disarmed",
+	"camera-online",
+	"camera-offline",
+	"camera-disabled",
+	"camera-enabled"
+]);
+/** The legacy tail of {@link NcSystemEventKindSchema} — see its docblock. */
+var NC_LEGACY_SYSTEM_EVENT_KINDS = new Set([
+	"camera-online",
+	"camera-offline",
+	"camera-disabled",
+	"camera-enabled"
 ]);
+NcSystemEventKindSchema.options.filter((kind) => !NC_LEGACY_SYSTEM_EVENT_KINDS.has(kind));
 /**
 * One coherent system-event condition. `kinds` is the required opt-in safety
 * gate; the remaining lists are optional narrowing filters relevant to the
@@ -14408,6 +14472,18 @@ var NcSystemEventKindSchema = _enum([
 var NcSystemEventConditionSchema = object({
 	kinds: array(NcSystemEventKindSchema).min(1),
 	deviceIds: array(number().int()).min(1).optional(),
+	/**
+	* Narrow a `device-*` kind to these device TYPES (`DeviceType` values —
+	* `camera`, `switch`, `sensor`, `container`, …). Absent = every type, which
+	* is what a liveness rule means when nobody said otherwise.
+	*
+	* This is where "only my cameras" is expressed, and it lives on the rule for
+	* one reason: the intake cannot know which devices this household cares
+	* about, and a producer-side filter is one no operator can change. Fails
+	* CLOSED — a subject whose device type is unknown (an id the device mirror
+	* does not carry) matches no `deviceTypes` list.
+	*/
+	deviceTypes: array(string().min(1)).min(1).optional(),
 	nodeIds: array(string().min(1)).min(1).optional(),
 	packageNames: array(string().min(1)).min(1).optional()
 });
@@ -14458,6 +14534,47 @@ var NcOccupancyConditionSchema = object({
 	sustainSeconds: number().int().min(0).max(3600).default(15)
 });
 /**
+* Audio condition (IMMEDIATE trigger) — a rule on SOUND, not on a picture.
+*
+* Operator-approved vocabulary (2026-08-12, option A — the same one the
+* reference notifier uses, so an operator moving between them re-uses what
+* they already know): a rule matches when, over a sampling window of
+* `samplingSeconds`, at least `hitPercent`% of the audio samples in that
+* window are HITS. A sample is a hit when it satisfies BOTH present filters:
+*
+*  - `dbThreshold` — its level is at or above this many dBFS (see
+*    {@link NC_AUDIO_DBFS_FLOOR}: negative-going, `0` = full scale);
+*  - `labels` — the classifier put at least one of these labels on it.
+*
+* Both are OPTIONAL and independent, which is the point of the shape: a
+* loudness rule ("something loud at 3am") needs no model to be right, and a
+* label rule ("a dog barked") needs no threshold. **Fail-closed when NEITHER
+* is given** — a window in which every sample is trivially a hit would fire on
+* silence, so the engine refuses such a condition rather than notifying on
+* nothing (the schema cannot express "at least one of" without becoming a
+* ZodEffects the cap path would have to special-case).
+*
+* `hitPercent` is over the samples the window actually HOLDS, and the window
+* must be FULL before it can match — a window that has been open for two
+* seconds of its ten is 100% of nothing, and firing on it would make
+* `samplingSeconds` decorative.
+*
+* Labels are the audio macro classes (`AUDIO_MACRO_LABELS` / the NC taxonomy's
+* `audio-*` ids). Both spellings are accepted — the matcher normalizes the
+* `audio-` prefix away on both sides, so a picker that offers taxonomy ids and
+* an operator who typed `dog` mean the same thing.
+*/
+var NcAudioConditionSchema = object({
+	/** Audio macro labels; absent = any sound (level-only rule). */
+	labels: array(string().min(1)).min(1).optional(),
+	/** Level floor in dBFS (negative-going, `0` = full scale); absent = any level. */
+	dbThreshold: number().min(-96).max(0).optional(),
+	/** Percentage of the window's samples that must be hits (1–100). */
+	hitPercent: number().int().min(1).max(100).default(60),
+	/** Length of the sampling window in seconds. */
+	samplingSeconds: number().int().min(1).max(300).default(10)
+});
+/**
 * Which zone-crossing DIRECTION a rule accepts (`ObjectEvent.zoneCrossing`).
 *
 * The values are not symmetric, and deliberately so — the absent value has to
@@ -14730,7 +14847,33 @@ var NcConditionsSchema = object({
 	* threshold and holds for `sustainSeconds`. Fail-closed on missing
 	* substrate (no snapshot / missing zone). See {@link NcOccupancyCondition}.
 	*/
-	occupancy: NcOccupancyConditionSchema.optional()
+	occupancy: NcOccupancyConditionSchema.optional(),
+	/**
+	* IMMEDIATE only. Sustained-sound matcher — `hitPercent` of the samples in a
+	* `samplingSeconds` window clear the optional `dbThreshold` and carry one of
+	* the optional `labels`. Fail-closed on missing substrate (no audio samples,
+	* a window that is not full yet, neither filter given). See
+	* {@link NcAudioCondition}.
+	*
+	* Presence of this key is what makes a rule an AUDIO rule: the engine fires
+	* it ONLY on a confirmed audio window, and a rule carrying it never fires on
+	* a detection, a track or a device event (the same fail-closed pairing
+	* `occupancy` has with the `device-event` trigger). That is how audio labels
+	* leave `classes`: an audio rule names its sounds HERE, and the legacy path
+	* (an `immediate` rule naming an `audio-*` class, one notification per
+	* classified sample) stays exactly as it was for rules that already use it.
+	*
+	* NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
+	* rather than an oversight: the viewer mirrors the descriptor enums BY HAND
+	* (`camstack/src/data/notification-center.ts`, guarded by
+	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+	* condition fields it does not know when a rule is saved from the phone.
+	* Publishing an editor for a condition the app cannot round-trip is how an
+	* operator loses a rule's conditions by opening it — so the descriptor, the
+	* admin widget and the viewer mirror land together (P2 + P3), and only then
+	* does an audio rule become authorable.
+	*/
+	audio: NcAudioConditionSchema.optional()
 });
 /** One delivery target: a `notification-output` Target ref + passthrough params. */
 var NcRuleTargetSchema = object({
@@ -14844,6 +14987,73 @@ var NcThrottleSchema = object({
 	*/
 	granularity: NcThrottleGranularitySchema.optional()
 });
+/**
+* How long the confirm gate may hold ONE notification, and how big the picture
+* it judges may be.
+*
+* The clamp is the product decision, not a coincidence of the model: p50 was
+* 4.9 s warm and 15.3 s cold against qwen3-vl-8b, and a notification that
+* arrives after the visitor has gone is not a notification. 448 px was enough
+* to score 16/16 on the operator's parking scenario — bigger costs latency and
+* tokens for pixels the model pools away.
+*/
+var NC_CONFIRM_MIN_TIMEOUT_MS = 1e3;
+var NC_CONFIRM_MAX_TIMEOUT_MS = 2e4;
+var NC_CONFIRM_DEFAULT_TIMEOUT_MS = 8e3;
+/** Comparison the model's COUNT must satisfy for the notification to fire. */
+var NcConfirmExpectSchema = object({
+	op: _enum([
+		">=",
+		">",
+		"<=",
+		"<",
+		"=="
+	]),
+	count: number().int().min(0).max(1e3)
+});
+/**
+* AI CONFIRM — a vision model looks at the picture this notification is about
+* to ship and says whether it agrees with the rule.
+*
+* It runs AFTER the attachments resolve, deliberately: the crop JUDGED is the
+* crop SHIPPED (D52). A verdict about a different pixel rectangle than the one
+* on the operator's phone is not a verdict about this notification.
+*
+* FAIL-OPEN is the only safe default. A gate that cannot reach its model, or
+* whose model is cold, must not silence a camera — so `onTimeout: 'fire'` is
+* the default and every fail-open is COUNTED, because a gate that always fails
+* open looks in the log exactly like a gate that works.
+*
+* Every field is `.optional()` rather than relied on as a Zod default at the
+* runtime seam: a Zod default does NOT run on the addon→addon cap path (three
+* production failures in one day), so the gate reads absent as the constant
+* above rather than trusting a parse it may never have seen.
+*/
+var NcConfirmSchema = object({
+	/** Off unless asked for. An absent `confirm` and `enabled:false` are the
+	*  same thing, and both mean "deliver exactly as before". */
+	enabled: boolean().default(false),
+	/** Explicit vision profile; absent = the `purpose:'vision'` cluster default. */
+	profileId: string().optional(),
+	/**
+	* The operator's question, in his own words. Absent = a question derived
+	* from the rule (its class and its expectation).
+	*
+	* NEVER composed with text READ OUT OF THE FRAME. The model reads OSD
+	* banners, signage and plates as instructions if you let them reach the
+	* prompt — proven live — so the authoritative contract stays in the system
+	* turn and only rule-authored words land here.
+	*/
+	prompt: string().max(1e3).optional(),
+	/** Fire only when the model's count satisfies this. Absent = the model's
+	*  own boolean verdict decides. */
+	expect: NcConfirmExpectSchema.optional(),
+	timeoutMs: number().int().min(NC_CONFIRM_MIN_TIMEOUT_MS).max(NC_CONFIRM_MAX_TIMEOUT_MS).default(NC_CONFIRM_DEFAULT_TIMEOUT_MS),
+	/** What a timeout / unreachable model MEANS. `fire` (default) = fail-open. */
+	onTimeout: _enum(["fire", "suppress"]).default("fire"),
+	/** Longest edge the judged image is downscaled to before it is sent. */
+	maxImagePx: number().int().min(64).max(2048).default(448)
+});
 /** Client-supplied rule fields (server stamps id/createdBy/createdAt/updatedAt). */
 var NcRuleInputSchema = object({
 	name: string().min(1).max(200),
@@ -14904,7 +15114,13 @@ var NcRuleInputSchema = object({
 	* `{ cap: 'alarm-panel', method: 'arm', args: { mode: 'away' } }`, the same
 	* shape as every other actuation.
 	*/
-	actions: NcRuleActionsSchema.optional()
+	actions: NcRuleActionsSchema.optional(),
+	/**
+	* AI CONFIRM — see {@link NcConfirmSchema}. `.optional()`, never defaulted:
+	* a rule that predates the gate must keep delivering byte-for-byte as it
+	* did, and absent is the only way to say that without a migration.
+	*/
+	confirm: NcConfirmSchema.optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -14915,7 +15131,37 @@ var NcRuleInputSchema = object({
 * still flow through `nc.setRuleTargetEnabled` (owner-checked), never a raw
 * `updateRule` patch.
 */
-var NcRulePatchSchema = NcRuleInputSchema.partial().extend({ disabledTargetIds: array(string()).optional() });
+var NcRulePatchSchema = NcRuleInputSchema.partial().extend({
+	disabledTargetIds: array(string()).optional(),
+	/**
+	* `.partial()` DOES NOT REMOVE A FIELD'S `.default()`.
+	*
+	* It makes the key optional to SUPPLY; the parse still materialises the
+	* default when the key is absent. And `NcRuleStore.update` merges with
+	* `{ ...existing, ...patch }`, so a materialised key OVERWRITES the stored
+	* one — which made every partial edit destructive:
+	*
+	*   nc.updateRule({ throttle })         → conditions reset to `{}`
+	*   nc.setRuleTargetEnabled(...)        → conditions reset to `{}`
+	*   setEnabled(ruleId, false)           → conditions reset to `{}`
+	*
+	* A rule scoped to one camera and one zone silently became a rule that
+	* matches EVERY event on EVERY camera, and lost its `media` policy
+	* (zoneCrop / gif / clip / frame) and its `priority` at the same time. Seen
+	* live on 2026-08-12: a rule scoped to device 617 fired on 590 and 615
+	* within a minute of a two-field patch.
+	*
+	* So every defaulted field is re-declared here WITHOUT its default. The
+	* inner defaults still apply when the caller DOES send the key — `{}` for
+	* conditions remains a real instruction ("clear them") — and only the
+	* absent key is now genuinely absent.
+	*/
+	enabled: boolean().optional(),
+	conditions: NcConditionsSchema.optional(),
+	media: NcMediaPolicySchema.optional(),
+	throttle: NcThrottleSchema.optional(),
+	priority: number().int().min(1).max(5).optional()
+});
 /** A persisted rule. */
 var NcRuleSchema = NcRuleInputSchema.extend({
 	id: string(),
@@ -15028,12 +15274,20 @@ var NC_CONDITION_CATALOG = [
 		valueType: "systemEvent",
 		options: [
 			{
-				value: "camera-online",
-				label: "Camera online"
+				value: "device-online",
+				label: "Device online"
+			},
+			{
+				value: "device-offline",
+				label: "Device offline"
+			},
+			{
+				value: "device-disabled",
+				label: "Device switched off"
 			},
 			{
-				value: "camera-offline",
-				label: "Camera offline"
+				value: "device-enabled",
+				label: "Device switched on"
 			},
 			{
 				value: "stream-online",
@@ -15058,12 +15312,24 @@ var NC_CONDITION_CATALOG = [
 			{
 				value: "server-update-available",
 				label: "Server update available"
+			},
+			{
+				value: "alarm-triggered",
+				label: "Alarm triggered"
+			},
+			{
+				value: "alarm-armed",
+				label: "Alarm armed"
+			},
+			{
+				value: "alarm-disarmed",
+				label: "Alarm disarmed"
 			}
 		],
 		operator: "in",
 		appliesTo: ["system-event"],
 		phase: "P1",
-		description: "Infrastructure and update events. Optionally narrow camera/stream events by device, node events by node id, and addon updates by package name."
+		description: "Infrastructure and update events. Device liveness covers EVERY device type — narrow it by device type (cameras only, say) and/or by device, node events by node id, and addon updates by package name."
 	},
 	{
 		id: "devices",
@@ -15587,6 +15853,25 @@ var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.partial();
 * Never authored, never stored — see `alarm-mode-coverage.ts` for why a stored
 * copy would lie the first time a rule is disabled.
 */
+/**
+* Why a device a mode NAMES is nonetheless not armed by it.
+*
+* Each value is an existing authority, never a new flag (D62): `muted` is the
+* per-camera notification switch the Notification Center already owns,
+* `detection-off` is the device's own detection binding being inactive, and
+* `offline` is the device manager's liveness. A fourth reason would mean a
+* fourth authority, and inventing one here is how a panel starts disagreeing
+* with the switches the operator actually used.
+*/
+var NcAlarmSkipReasonSchema = _enum([
+	"muted",
+	"detection-off",
+	"offline"
+]);
+var NcAlarmSkippedDeviceSchema = object({
+	deviceId: number().int(),
+	reason: NcAlarmSkipReasonSchema
+});
 var NcAlarmModeCoverageSchema = object({
 	mode: AlarmArmModeSchema,
 	/** Enabled rules gated on `armed_<mode>`. Zero means the mode does nothing. */
@@ -15594,7 +15879,18 @@ var NcAlarmModeCoverageSchema = object({
 	/** At least one covering rule has no device scope, so the mode covers all. */
 	allDevices: boolean(),
 	/** Ids named by the covering rules. A SUBSET when `allDevices` is true. */
-	deviceIds: array(number().int())
+	deviceIds: array(number().int()),
+	/**
+	* Devices this mode NAMES but cannot actually arm, each with the switch that
+	* excludes it.
+	*
+	* "Away armed — 12 cameras" is a promise, and a muted camera among those
+	* twelve makes it false in exactly the way nobody notices until an incident.
+	* Defaulted to `[]` so a coverage answer computed before this field existed
+	* still parses as "nothing known to be skipped" rather than failing the whole
+	* alarm tab.
+	*/
+	skippedDevices: array(NcAlarmSkippedDeviceSchema).default([])
 });
 var NcAlarmConfigSchema = object({
 	/**
@@ -25776,7 +26072,19 @@ var RecordingManifestSchema = object({
 *  profiles/subtrees/locations on this node). */
 var RecordingDeviceUsageSchema = object({
 	deviceId: number(),
-	usedBytes: number()
+	usedBytes: number(),
+	/**
+	* Start of this camera's OLDEST indexed segment, across every profile and
+	* location — the "Oldest footage" column in Recordings → Storage, and the
+	* only honest answer to "is retention actually holding?" per camera.
+	*
+	* `null` = the camera has no footage. OPTIONAL because a recorder that
+	* predates this field omits it entirely, and a hub whose types carry the
+	* field must keep validating that older provider's payload: the framework
+	* (types) and the addon ship on different trains, and the addon is usually
+	* the later of the two.
+	*/
+	oldestMs: number().nullable().optional()
 });
 /** Recording storage usage + capacity for one storage location. */
 var RecordingLocationUsageSchema = object({
@@ -25804,6 +26112,57 @@ var RecordingStorageUsageSchema = object({
 	locations: array(RecordingLocationUsageSchema)
 });
 /**
+* The OPERATOR-ARMED half of multi-location recordings (D116).
+*
+* The placement plan decides where NEW writes go and moves nothing. A rebalance
+* is the operator asking for the EXISTING archive to be brought into line with
+* that plan: one relocate job per (camera, profile) pile that sits on the wrong
+* location, run FIFO behind the single-flight mover.
+*
+* `plan…` and `start…` return the SAME shape deliberately — what the operator
+* confirms is exactly what gets enqueued, and `jobIds` is the only difference
+* (empty on the plan).
+*/
+var RecordingRebalanceMoveSchema = object({
+	deviceId: number(),
+	profile: string(),
+	fromLocationId: string(),
+	toLocationId: string(),
+	bytes: number(),
+	files: number().int()
+});
+/** Why a pile that is out of place is staying there. Every refusal is
+*  reported: a rebalance that silently drops a camera reads exactly like one
+*  that had nothing to do. */
+var RecordingRebalanceSkipReasonSchema = _enum([
+	"unassigned",
+	"target-not-writable",
+	"below-threshold",
+	"no-headroom"
+]);
+var RecordingRebalanceSkipSchema = object({
+	deviceId: number(),
+	profile: string(),
+	fromLocationId: string(),
+	/** The location the plan wants; null when the camera has no assignment. */
+	toLocationId: string().nullable(),
+	bytes: number(),
+	reason: RecordingRebalanceSkipReasonSchema
+});
+var RecordingRebalancePlanSchema = object({
+	moves: array(RecordingRebalanceMoveSchema),
+	skipped: array(RecordingRebalanceSkipSchema),
+	bytesToMove: number(),
+	/** Relocate job ids enqueued. Always empty for the plan (dry-run) call. */
+	jobIds: array(string())
+});
+var RecordingRebalanceInputSchema = object({
+	/** Copy throttle in MB/s (default 40) — a rebalance is a background chore. */
+	throttleMbps: number().min(1).max(1e3).optional(),
+	/** Ignore piles smaller than this (default 1 GB). */
+	minMoveGb: number().min(0).optional()
+});
+/**
 * Result of locating footage at a wall-clock instant for one device/profile.
 * `segment` carries the covering segment's window; `gap` reports the forward
 * nearest covered edge (`null` past the end of footage / when none exists)
@@ -25966,9 +26325,24 @@ method(object({
 }), method(object({ jobId: string() }), RelocateJobSchema.nullable(), { auth: "admin" }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(RelocateFootageInputSchema, object({ jobId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(RelocateJobSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(RecordingRebalanceInputSchema, RecordingRebalancePlanSchema, {
+	kind: "query",
+	auth: "admin"
+}), method(RecordingRebalanceInputSchema, RecordingRebalancePlanSchema, {
+	kind: "mutation",
+	auth: "admin"
 });
 /**
-* `recordingExport` cap — render a footage time range into a single downloadable
+* `recording-export` cap — render a footage time range into a single downloadable
 * MP4 (regular / accelerated / decelerated / timelapse, ± audio), kept for a
 * bounded lifetime with a durable history, auto-expiry, and optional
 * delete-after-download.
@@ -32865,6 +33239,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.cancelRelocateJob": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.cancelStorageMigrationMove": {
 		capName: "recording",
 		capScope: "system",
@@ -32919,6 +33299,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.listRelocateJobs": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.locateSegment": {
 		capName: "recording",
 		capScope: "system",
@@ -32931,6 +33317,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.planStorageRebalance": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.pruneFootage": {
 		capName: "recording",
 		capScope: "system",
@@ -32955,6 +33347,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.relocateFootage": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.renderClip": {
 		capName: "recording",
 		capScope: "system",
@@ -32991,44 +33389,50 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.startStorageRebalance": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recordingExport.cancelExport": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
 	"recordingExport.createExport": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
 	"recordingExport.deleteExport": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
 	"recordingExport.getDownloadUrl": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
 	"recordingExport.getExport": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
 	"recordingExport.listExports": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
 	"recordingExport.readExportBytes": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "view"
@@ -34465,6 +34869,111 @@ var FramerateField = number().int().min(1).max(60);
 var TargetsField = array(NcRuleTargetSchema).min(1);
 var PriorityField = number().int().min(1).max(5);
 /**
+* Floor on any dense cadence, seconds — the recording's own frame interval.
+*
+* Declared here because it bounds BOTH the rule field and the renderer's
+* derivation, and two copies of a floor are two floors that can drift.
+*/
+var TIMELAPSE_DENSE_FLOOR_SEC = .1;
+/**
+* Explicit override of the DENSE sampling cadence, seconds.
+*
+* Absent ⇒ derived as `max(1s, cadenceSec / 30)` — a 30 s base samples every
+* 1 s inside a detection range. (It was `base / 10` until 2026-08-12, which
+* made that same base 3 s and rendered a person pass as two frames.)
+*
+* THE ARITHMETIC. A detection range of `rangeSec` seconds sampled every
+* `denseCadenceSec` and played at `framerate` occupies
+*
+*     outputSeconds = (rangeSec / denseCadenceSec) / framerate
+*
+* so a 7 s pass at 1 s / 12 fps is 0.58 s of video, and at 0.5 s it is 1.17 s.
+* Halving this field doubles the frames INSIDE ranges only — the base cadence,
+* and therefore the length of a quiet night, does not move.
+*
+* Floored at {@link TIMELAPSE_DENSE_FLOOR_SEC}: asking for frames faster than
+* the recording has them returns the same frames, requested twice. Must be
+* STRICTLY smaller than `cadenceSec` — a dense rate that is not denser renders
+* a uniform video the operator believes is two-rate — and upsert refuses it
+* rather than letting the export cap reject the render hours after the window.
+*/
+var DenseCadenceSecField = number().min(TIMELAPSE_DENSE_FLOOR_SEC).max(3600);
+/**
+* Minimum seconds of OUTPUT video each detection range must occupy.
+*
+* The operator-facing form of the arithmetic above: instead of solving for a
+* cadence, state the dwell and let the renderer solve. `minDwellSec: 1` on a
+* 30 s base at 12 fps turns a 7 s pass into a full second of video by sampling
+* that range every ~583 ms.
+*
+* ONE CADENCE SERVES EVERY RANGE. `ExportDenseSchema.everyMs` is global — the
+* ranges are terms of a single ffmpeg `select` expression that cannot vary rate
+* per term — so the MOST DEMANDING (shortest) range sets the rate and longer
+* ranges are sampled denser than they need. Per-range cadences require a cap
+* schema change and are the tracked follow-up.
+*
+* A range too short to reach the dwell even at {@link TIMELAPSE_DENSE_FLOOR_SEC}
+* is rendered with every frame that EXISTS and no more: the guarantee is capped
+* by real footage, never met by duplicating frames into motion that never
+* happened.
+*/
+var MinDwellSecField = number().min(0).max(60);
+/**
+* Caption burned into the notification's preview frame.
+*
+* Same `{{var}}` vocabulary as {@link TimelapseTemplateSchema} (`camera`,
+* `rule`, `from`, `to`) and rendered by the SAME renderer — a second
+* templating dialect for one field would be a second thing to explain.
+*
+* Absent ⇒ {@link DEFAULT_TIMELAPSE_PREVIEW_TEXT}. An EMPTY STRING is the
+* operator saying "the frame, no caption" — a distinct, reachable answer, and
+* the reason this is not `.min(1)`.
+*/
+var PreviewTextField = string().max(200);
+/**
+* Whether the notification's preview is a STILL or a short animation.
+*
+* The operator's ask, verbatim: *"inviato come gif o video (come per le altre
+* rule)"* — his Scrypted advanced-notifier has a `gifRule`, and a ten-hour
+* night reads better as three seconds of motion than as one frame of it. Both
+* modes get the SAME treatment (blurred frame, large centred title); `'gif'`
+* simply applies it to a dozen frames sampled across the render and assembles
+* them.
+*
+* `'image'` is the default and stays the default: a GIF costs a dozen ffmpeg
+* seeks and a palette pass, and no rule that never asked for one should start
+* paying that on the deploy that shipped it.
+*
+* A GIF that cannot be assembled DEGRADES to the still — never to nothing.
+*/
+var PreviewModeField = _enum(["image", "gif"]);
+/**
+* Which detection classes the notification reports counts for.
+*
+* The counts come from the tracks the render ALREADY fetched for its dense-range
+* plan — no second query — aggregated per class. Absent or empty means "every
+* class the window actually contained", which is what an operator who never
+* opened the field wants; a list narrows it (`['person']` on a driveway that
+* counts cars all night).
+*
+* Class names are the tracker's own (`person`, `vehicle`, `animal`, `package`,
+* …). An unknown name simply never matches and reports nothing — it is not an
+* error, because a rule may legitimately name a class this camera's model does
+* not emit.
+*
+* The counts are exposed to {@link TimelapseTemplateSchema} as:
+*  - `{{detections}}` — total over the reported classes
+*  - `{{detectionSummary}}` — `2 persone, 1 veicolo`
+*  - `{{count_person}}` / `{{count_vehicle}}` / `{{count_animal}}` / … —
+*    one per class, `count_` + the class name
+*
+* With NO custom body template the summary is appended to the derived body, and
+* only when the total is non-zero: a nightly `0 rilevamenti` is a line nobody
+* reads. With a custom template the operator owns every word — nothing is
+* appended, so `{{detectionSummary}}` is how he asks for it.
+*/
+var ReportClassesField = array(string().min(1).max(40)).max(20);
+/**
 * Client-supplied timelapse-rule fields. The server stamps id / createdBy /
 * createdAt / updatedAt / ownerUserId / lastGeneratedAt — none of them appear
 * here (see the ownership note above).
@@ -34484,13 +34993,42 @@ var TimelapseRuleInputSchema = object({
 	cadenceSec: CadenceSecField.default(15),
 	/** Output frames per second of the assembled mp4 (predecessor parity). */
 	framerate: FramerateField.default(10),
+	/**
+	* Explicit dense cadence — see {@link DenseCadenceSecField}. Absent ⇒ derived
+	* as `max(1s, cadenceSec / 30)`, which is what every rule written before this
+	* field gets.
+	*/
+	denseCadenceSec: DenseCadenceSecField.optional(),
+	/** Output-seconds guarantee per detection range — see {@link MinDwellSecField}. */
+	minDwellSec: MinDwellSecField.optional(),
 	/** `notification-output` targets the finished video/thumbnail is sent to. */
 	targets: TargetsField,
 	template: TimelapseTemplateSchema.optional(),
+	/**
+	* Caption on the notification's PREVIEW FRAME — see {@link PreviewTextField}
+	* and {@link DEFAULT_TIMELAPSE_PREVIEW_TEXT}.
+	*
+	* Deliberately NOT part of {@link TimelapseTemplateSchema}: that object is
+	* the notification's title/body, and clearing it (`template: null`) must not
+	* silently clear the caption too.
+	*/
+	previewText: PreviewTextField.optional(),
+	/** Still or animation — see {@link PreviewModeField}. */
+	previewMode: PreviewModeField.default("image"),
+	/** Classes the notification counts — see {@link ReportClassesField}. */
+	reportClasses: ReportClassesField.optional(),
 	/** Canonical notification priority ordinal (1..5); per-target overridable. */
 	priority: PriorityField.default(3)
 });
 /**
+* The caption a rule that never set one gets.
+*
+* Rendered through the ordinary `{{var}}` pass at delivery, so a rule created
+* before this field existed still reads "Timelapse Videocamera ingresso" and
+* not the literal braces.
+*/
+var DEFAULT_TIMELAPSE_PREVIEW_TEXT = "Timelapse {{camera}}";
+/**
 * Partial patch for an update — any subset of the INPUT fields, with NO
 * defaults (an absent key means "leave unchanged", never "reset to default").
 * Provenance and ownership are absent by construction: a patch can rename or
@@ -34513,8 +35051,13 @@ var TimelapseRulePatchSchema = object({
 	schedule: NcScheduleSchema.optional(),
 	cadenceSec: CadenceSecField.optional(),
 	framerate: FramerateField.optional(),
+	denseCadenceSec: DenseCadenceSecField.optional(),
+	minDwellSec: MinDwellSecField.optional(),
 	targets: TargetsField.optional(),
 	template: TimelapseTemplateSchema.nullable().optional(),
+	previewText: PreviewTextField.optional(),
+	previewMode: PreviewModeField.optional(),
+	reportClasses: ReportClassesField.optional(),
 	priority: PriorityField.optional()
 });
 /** A persisted timelapse rule. */
@@ -34555,6 +35098,26 @@ var TimelapseRuleSchema = TimelapseRuleInputSchema.extend({
 	updatedAt: number()
 });
 /**
+* Refuse a dense cadence that is not denser than the base.
+*
+* Called at UPSERT, on the MERGED rule — a patch that lowers `cadenceSec`
+* alone can invalidate a `denseCadenceSec` set months earlier, so checking the
+* patch in isolation would let the bad pair through.
+*
+* Refusing here and not at render time is the whole point: `ExportTimelapseSchema`
+* also rejects the pair, but it does so when the window has already closed and
+* the footage is being cut — the operator learns at 06:05 that last night was
+* never going to render, and a closed window does not come back. This turns
+* that into a failed edit he can see and correct.
+*
+* @throws Error naming both numbers, so the message is actionable in a toast.
+*/
+function assertTimelapseCadences(pair) {
+	const dense = pair.denseCadenceSec;
+	if (dense === void 0) return;
+	if (dense >= pair.cadenceSec) throw new Error(`denseCadenceSec (${dense}s) must be strictly smaller than cadenceSec (${pair.cadenceSec}s) — a dense cadence that is not denser renders a uniform timelapse`);
+}
+/**
 * The last successful generation for ONE camera of a rule, epoch-ms.
 *
 * The per-device map wins; a rule with no map falls back to the rule-wide
@@ -34723,4 +35286,4 @@ function vectorDimFromBase64(encoded) {
 	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
 }
 //#endregion
-export { isDeviceScopedCap as $, customAction as A, pipelineAnalyticsCapability as B, TimelapseRuleSchema as C, audioMetricsCapability as D, alarmPanelCapability as E, faceGalleryCapability as F, vectorDimFromBase64 as G, readDeviceStateFrom as H, hfModelUrl as I, errMsg as J, videoclipsCapability as K, isScheduleActive as L, deriveRecordingMode as M, embeddingEncoderCapability as N, buildEventKindDescriptor as O, encodeVectorBase64 as P, hydrateSchema as Q, kebabToCamel as R, TimelapseRulePatchSchema as S, addonWidgetsSourceCapability as T, readTimelapseGeneratedAt as U, plateGalleryCapability as V, subKindsOf as W, DeviceType as X, BaseAddon as Y, createEvent as Z, NcTaxonomySchema as _, EVENT_PAD_MS as a, literal as at, RetrainStatusSchema as b, NC_CONDITION_CATALOG as c, record as ct, NcRuleInputSchema as d, EventCategory as dt, nodePin as et, NcRulePatchSchema as f, NcSnoozeSuppressedSchema as g, NcSnoozeSchema as h, EVENT_KIND_BY_CAP as i, boolean as it, defineCustomActions as j, cosineSimilarity as k, NC_TAXONOMY as l, string as lt, NcSnoozeInputSchema as m, DEFAULT_EVENT_COLOR as n, _enum as nt, LabelAttributionSchema as o, number as ot, NcRuleSchema as p, zoneAnalyticsCapability as q, DeclaredDevices as r, array as rt, MACRO_LABELS as s, object as st, BaseDevice as t, sleep as tt, NcConditionDescriptorSchema as u, unknown as ut, OpsLogEntrySchema as v, TrackSourceSchema as w, TimelapseRuleInputSchema as x, RECORDING_EXPORT_MAX_READ_BYTES as y, notificationRulesCapability as z };
+export { BaseAddon as $, assertTimelapseCadences as A, hfModelUrl as B, TIMELAPSE_DENSE_FLOOR_SEC as C, TrackSourceSchema as D, TimelapseRuleSchema as E, defineCustomActions as F, plateGalleryCapability as G, kebabToCamel as H, deriveRecordingMode as I, subKindsOf as J, readDeviceStateFrom as K, embeddingEncoderCapability as L, buildEventKindDescriptor as M, cosineSimilarity as N, addonWidgetsSourceCapability as O, customAction as P, errMsg as Q, encodeVectorBase64 as R, RetrainStatusSchema as S, TimelapseRulePatchSchema as T, notificationRulesCapability as U, isScheduleActive as V, pipelineAnalyticsCapability as W, videoclipsCapability as X, vectorDimFromBase64 as Y, zoneAnalyticsCapability as Z, NcSnoozeSchema as _, DeclaredDevices as a, sleep as at, OpsLogEntrySchema as b, LabelAttributionSchema as c, boolean as ct, NC_TAXONOMY as d, object as dt, DeviceType as et, NcConditionDescriptorSchema as f, partialRecord as ft, NcSnoozeInputSchema as g, EventCategory as gt, NcRuleSchema as h, unknown as ht, DETECTION_PIPELINE_CAP_NAME as i, nodePin as it, audioMetricsCapability as j, alarmPanelCapability as k, MACRO_LABELS as l, literal as lt, NcRulePatchSchema as m, string as mt, DEFAULT_EVENT_COLOR as n, hydrateSchema as nt, EVENT_KIND_BY_CAP as o, _enum as ot, NcRuleInputSchema as p, record as pt, readTimelapseGeneratedAt as q, DEFAULT_TIMELAPSE_PREVIEW_TEXT as r, isDeviceScopedCap as rt, EVENT_PAD_MS as s, array as st, BaseDevice as t, createEvent as tt, NC_CONDITION_CATALOG as u, number as ut, NcSnoozeSuppressedSchema as v, TimelapseRuleInputSchema as w, RECORDING_EXPORT_MAX_READ_BYTES as x, NcTaxonomySchema as y, faceGalleryCapability as z };