@camstack/system 1.2.102 → 1.2.103

package/dist/{dist-3wh5LCad.mjs → dist-DHKXob1m.mjs}

@@ -3703,6 +3703,12 @@ var RecordingConfigSchema = z.object({
 	/** DERIVED summary of `bands`, stamped by the recorder on every save.
 	*  Authoring it has no effect — see {@link RecordingStorageModeSchema}. */
 	mode: RecordingStorageModeSchema.optional(),
+	/**
+	* Which assigned broker slots to record. Absent / empty = {@link
+	* DEFAULT_RECORDING_PROFILES} (`high`+`low`) intersected with the
+	* camera's currently assigned slots — never `mid` unless the operator
+	* picks it, and never a slot the broker has not assigned.
+	*/
 	profiles: z.array(CamProfileSchema).optional(),
 	segmentSeconds: z.number().int().positive().optional(),
 	/**
@@ -3783,7 +3789,11 @@ var RelocateFootageInputSchema = z.object({
 	profiles: z.array(z.string()).optional(),
 	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
 	*  never allowed to starve live writers. */
-	throttleMbps: z.number().min(1).max(1e3).optional()
+	throttleMbps: z.number().min(1).max(1e3).optional(),
+	/** Move only segments whose startMs is >= this. Absent = the whole source
+	*  pile. Used when a full drain is too expensive and the operator only
+	*  wants the recent window on the new disk. */
+	sinceMs: z.number().int().optional()
 });
 /** Internal, lease-scoped participant operation. It is intentionally separate
 * from persistent recording settings: a migration never changes
@@ -15122,6 +15132,12 @@ var TrackCascadeCountsSchema = z.object({
 	/** Per-track CLIP search vectors removed (best-effort). */
 	embeddings: z.number().int()
 });
+/** Disk-wins reconcile: media rows whose blobs are gone, then empty tracks. */
+var DiskReconcileCountsSchema = z.object({
+	mediaDropped: z.number().int(),
+	tracks: z.number().int(),
+	events: z.number().int()
+});
 /** Event-store footprint for one camera. */
 var EventStoreDeviceFootprintSchema = z.object({
 	deviceId: z.number(),
@@ -15407,6 +15423,17 @@ var pipelineAnalyticsCapability = {
 			auth: "admin"
 		}),
 		/**
+		* Disk-wins reconcile for one camera. Drops media index rows whose blobs
+		* are gone, then cascades tracks (including favourited and staging) that
+		* have no remaining files. Enrolled identity/vehicle/scene media is never
+		* probed. Trackless motion/audio events with no remaining file are dropped,
+		* including snapshot-less rows.
+		*/
+		reconcileFromDisk: method(z.object({ deviceId: z.number() }), DiskReconcileCountsSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Delete whole tracks (object events) by id for the given device,
 		* cascading their media in lockstep. Returns the number of tracks
 		* actually deleted plus the ids that could not be removed.
@@ -17564,6 +17591,24 @@ var CameraStatusDegradationSchema = z.object({
 *
 * See spec: `docs/superpowers/specs/2026-06-24-camera-status-aggregator-cap.md`
 */
+var DiskReconcileJobSchema = z.object({
+	state: z.enum([
+		"idle",
+		"running",
+		"done",
+		"error"
+	]),
+	total: z.number().int().nonnegative(),
+	completed: z.number().int().nonnegative(),
+	currentDeviceId: z.number().int().nullable(),
+	failed: z.array(z.number().int()).readonly(),
+	mediaDropped: z.number().int().nonnegative(),
+	tracks: z.number().int().nonnegative(),
+	events: z.number().int().nonnegative(),
+	startedAtMs: z.number().int().nullable(),
+	finishedAtMs: z.number().int().nullable(),
+	error: z.string().nullable()
+});
 var CameraStatusSchema = z.object({
 	deviceId: z.number(),
 	assignment: CameraAssignmentStatusSchema,
@@ -18100,6 +18145,18 @@ var pipelineOrchestratorCapability = {
 		* rail without issuing N parallel browser round-trips.
 		*/
 		getCameraStatuses: method(z.object({ deviceIds: z.array(z.number()).optional() }), z.array(CameraStatusSchema).readonly()),
+		/**
+		* Disk-wins fleet reconcile after a recordings wipe. Starts the walk in
+		* the addon process and returns immediately with the job snapshot — the
+		* work outlives the tRPC/UDS 60s timeout. Poll `getReconcileFromDiskStatus`.
+		* Admin-only. Idempotent while a job is already running.
+		*/
+		reconcileFromDisk: method(z.void(), DiskReconcileJobSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Snapshot of the in-flight or last disk-wins fleet reconcile. */
+		getReconcileFromDiskStatus: method(z.void(), DiskReconcileJobSchema, { auth: "admin" }),
 		/** List every template the operator has saved. */
 		listTemplates: method(z.void(), z.array(PipelineTemplateSchema).readonly()),
 		/** Create a new named preset from a given CameraPipelineConfig. */
@@ -19572,20 +19629,6 @@ var vectorStoreCapability = {
 		stats: method(VectorStatsInputSchema, VectorStatsResultSchema)
 	}
 };
-/**
-* `videoclips` — the unified, navigable-clip surface for a camera.
-*
-* A device-scoped WRAPPER cap (like `pipeline-analytics`): exactly one active
-* provider per device, substitutable. The DEFAULT provider (registered by
-* `addon-post-analysis`, `defaultActive: true`) composes the analytics event
-* log (markers + thumbnails) with the recorder's `getPlaybackManifest` — a clip
-* is a time-WINDOW over existing footage, never a separate file. A camera that
-* exposes NATIVE onboard clips (Reolink/Hikvision NVR) can later substitute the
-* wrapper provider for its device and serve its own clip catalog + URLs.
-*
-* A `Clip` is purely time-based (subtree-blind): playback resolves segments by
-* temporal overlap, so the API never decides `continuous` vs `events`.
-*/
 var ClipSchema = z.object({
 	/** Opaque, provider-namespaced id. The default provider encodes the time
 	*  window so `getClipPlayback` is self-contained (no event re-query). */
@@ -19611,12 +19654,41 @@ var ClipSchema = z.object({
 	* of the event that owns `kind` (object > motion > audio). Do not extract
 	* a keyframe from the recorded segments. Other providers (onboard, HKSV)
 	* mint their own stills.
+	*
+	* **VOUCHED, never fabricated.** A provider emits this only for an event it
+	* has CONFIRMED owns at least one media row (its own, or its owning track's).
+	* Absent is meaningful — "this visit has no event still" — never "we did not
+	* look". Stamping it from a URL template made 35% of one camera's clips point
+	* at a 404 (device 3836, 2026-08-17: 64 of 179 clips dead, 63 of them motion).
+	* A read that FAILS drops the claim; it never invents it.
 	*/
 	thumbnail: z.string().optional(),
-	/** Analytics event ids that overlap this visit. Empty on footage-only clips.
-	*  The default provider's visit grain puts many motion heartbeats on one clip
-	*  instead of minting one clip per marker. */
+	/**
+	* An instant INSIDE this visit's footage, hole-safe, where a recorded still
+	* can be decoded. Present whenever the visit came from recorded availability;
+	* absent on a per-event padded window (there is no footage to promise).
+	*
+	* This is not a thumbnail and not a second byte path: it is the argument to
+	* the recorder's existing still route. The surface — never the provider —
+	* decides whether to use it. It is the midpoint of the visit's LONGEST
+	* contiguous range, not of the visit: a visit spans its holes by
+	* construction, so a naive midpoint lands in dead air.
+	*/
+	stillAtMs: z.number().optional(),
+	/**
+	* Analytics event ids that overlap this visit — a BOUNDED sample, newest
+	* first within kind (object → motion → audio), capped at
+	* {@link MAX_CLIP_EVENT_IDS}. Empty on footage-only clips.
+	*
+	* Bounded because it is not a payload the surface pages through: one visit on
+	* device 615 carried 2 345 ids, and `eventIds` was 99% of a 153 KB
+	* camera-day. Read {@link eventCount} for the true total.
+	*/
 	eventIds: z.array(z.string()).optional(),
+	/** How many analytics events actually overlap this visit. Differs from
+	*  `eventIds.length` exactly when the sample was capped — so a truncated
+	*  list is never mistaken for a quiet visit. */
+	eventCount: z.number().int().nonnegative().optional(),
 	/** Intra-visit footage holes (GOP rolls, discarded segments) still shorter
 	*  than `VISIT_MERGE_GAP_MS`. Playback concatenates around them; the timeline
 	*  bar keeps showing them via `recording.getAvailability`. */
@@ -20253,7 +20325,14 @@ var SearchResultSchema = z.object({
 });
 var AutoUpdateSettingsSchema = z.object({
 	channel: ChannelSchema,
-	intervalSeconds: z.number()
+	intervalSeconds: z.number(),
+	/**
+	* Cadence of the "an update exists" POLLER, in seconds. Independent of
+	* `channel`: the poller runs while auto-apply is `off`, because being told
+	* about a publish and installing it are different decisions. Clamped
+	* server-side to 900 s … 604800 s; defaults to 21600 s (6 h).
+	*/
+	updateCheckIntervalSeconds: z.number()
 });
 var AddonAutoUpdateSchema = ChannelWithInheritSchema;
 var RestartAddonResultSchema = z.unknown();
@@ -20522,7 +20601,9 @@ var addonsCapability = {
 		getAutoUpdateSettings: method(z.void(), AutoUpdateSettingsSchema, { auth: "admin" }),
 		setAutoUpdateSettings: method(z.object({
 			channel: ChannelSchema,
-			intervalSeconds: z.number().min(300).max(86400).optional()
+			intervalSeconds: z.number().min(300).max(86400).optional(),
+			/** Availability-poll cadence; see AutoUpdateSettingsSchema. */
+			updateCheckIntervalSeconds: z.number().min(900).max(604800).optional()
 		}), z.unknown(), {
 			kind: "mutation",
 			auth: "admin"
@@ -33237,6 +33318,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.reconcileFromDisk": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.refreshStorageLocationsForMigration": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -33639,6 +33726,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getReconcileFromDiskStatus": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.listAgentSettings": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -33663,6 +33756,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.reconcileFromDisk": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.removeAgentSettings": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -36654,6 +36753,11 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"pipelineAnalytics.reconcileFromDisk": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.restageRetrainTrack": [{
 		name: "deviceId",
 		form: "single",

package/dist/{dist-9sC0wZw6.js → dist-qnwy_iWM.js}

@@ -3703,6 +3703,12 @@ var RecordingConfigSchema = zod.z.object({
 	/** DERIVED summary of `bands`, stamped by the recorder on every save.
 	*  Authoring it has no effect — see {@link RecordingStorageModeSchema}. */
 	mode: RecordingStorageModeSchema.optional(),
+	/**
+	* Which assigned broker slots to record. Absent / empty = {@link
+	* DEFAULT_RECORDING_PROFILES} (`high`+`low`) intersected with the
+	* camera's currently assigned slots — never `mid` unless the operator
+	* picks it, and never a slot the broker has not assigned.
+	*/
 	profiles: zod.z.array(CamProfileSchema).optional(),
 	segmentSeconds: zod.z.number().int().positive().optional(),
 	/**
@@ -3783,7 +3789,11 @@ var RelocateFootageInputSchema = zod.z.object({
 	profiles: zod.z.array(zod.z.string()).optional(),
 	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
 	*  never allowed to starve live writers. */
-	throttleMbps: zod.z.number().min(1).max(1e3).optional()
+	throttleMbps: zod.z.number().min(1).max(1e3).optional(),
+	/** Move only segments whose startMs is >= this. Absent = the whole source
+	*  pile. Used when a full drain is too expensive and the operator only
+	*  wants the recent window on the new disk. */
+	sinceMs: zod.z.number().int().optional()
 });
 /** Internal, lease-scoped participant operation. It is intentionally separate
 * from persistent recording settings: a migration never changes
@@ -15122,6 +15132,12 @@ var TrackCascadeCountsSchema = zod.z.object({
 	/** Per-track CLIP search vectors removed (best-effort). */
 	embeddings: zod.z.number().int()
 });
+/** Disk-wins reconcile: media rows whose blobs are gone, then empty tracks. */
+var DiskReconcileCountsSchema = zod.z.object({
+	mediaDropped: zod.z.number().int(),
+	tracks: zod.z.number().int(),
+	events: zod.z.number().int()
+});
 /** Event-store footprint for one camera. */
 var EventStoreDeviceFootprintSchema = zod.z.object({
 	deviceId: zod.z.number(),
@@ -15407,6 +15423,17 @@ var pipelineAnalyticsCapability = {
 			auth: "admin"
 		}),
 		/**
+		* Disk-wins reconcile for one camera. Drops media index rows whose blobs
+		* are gone, then cascades tracks (including favourited and staging) that
+		* have no remaining files. Enrolled identity/vehicle/scene media is never
+		* probed. Trackless motion/audio events with no remaining file are dropped,
+		* including snapshot-less rows.
+		*/
+		reconcileFromDisk: method(zod.z.object({ deviceId: zod.z.number() }), DiskReconcileCountsSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Delete whole tracks (object events) by id for the given device,
 		* cascading their media in lockstep. Returns the number of tracks
 		* actually deleted plus the ids that could not be removed.
@@ -17564,6 +17591,24 @@ var CameraStatusDegradationSchema = zod.z.object({
 *
 * See spec: `docs/superpowers/specs/2026-06-24-camera-status-aggregator-cap.md`
 */
+var DiskReconcileJobSchema = zod.z.object({
+	state: zod.z.enum([
+		"idle",
+		"running",
+		"done",
+		"error"
+	]),
+	total: zod.z.number().int().nonnegative(),
+	completed: zod.z.number().int().nonnegative(),
+	currentDeviceId: zod.z.number().int().nullable(),
+	failed: zod.z.array(zod.z.number().int()).readonly(),
+	mediaDropped: zod.z.number().int().nonnegative(),
+	tracks: zod.z.number().int().nonnegative(),
+	events: zod.z.number().int().nonnegative(),
+	startedAtMs: zod.z.number().int().nullable(),
+	finishedAtMs: zod.z.number().int().nullable(),
+	error: zod.z.string().nullable()
+});
 var CameraStatusSchema = zod.z.object({
 	deviceId: zod.z.number(),
 	assignment: CameraAssignmentStatusSchema,
@@ -18100,6 +18145,18 @@ var pipelineOrchestratorCapability = {
 		* rail without issuing N parallel browser round-trips.
 		*/
 		getCameraStatuses: method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), zod.z.array(CameraStatusSchema).readonly()),
+		/**
+		* Disk-wins fleet reconcile after a recordings wipe. Starts the walk in
+		* the addon process and returns immediately with the job snapshot — the
+		* work outlives the tRPC/UDS 60s timeout. Poll `getReconcileFromDiskStatus`.
+		* Admin-only. Idempotent while a job is already running.
+		*/
+		reconcileFromDisk: method(zod.z.void(), DiskReconcileJobSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Snapshot of the in-flight or last disk-wins fleet reconcile. */
+		getReconcileFromDiskStatus: method(zod.z.void(), DiskReconcileJobSchema, { auth: "admin" }),
 		/** List every template the operator has saved. */
 		listTemplates: method(zod.z.void(), zod.z.array(PipelineTemplateSchema).readonly()),
 		/** Create a new named preset from a given CameraPipelineConfig. */
@@ -19572,20 +19629,6 @@ var vectorStoreCapability = {
 		stats: method(VectorStatsInputSchema, VectorStatsResultSchema)
 	}
 };
-/**
-* `videoclips` — the unified, navigable-clip surface for a camera.
-*
-* A device-scoped WRAPPER cap (like `pipeline-analytics`): exactly one active
-* provider per device, substitutable. The DEFAULT provider (registered by
-* `addon-post-analysis`, `defaultActive: true`) composes the analytics event
-* log (markers + thumbnails) with the recorder's `getPlaybackManifest` — a clip
-* is a time-WINDOW over existing footage, never a separate file. A camera that
-* exposes NATIVE onboard clips (Reolink/Hikvision NVR) can later substitute the
-* wrapper provider for its device and serve its own clip catalog + URLs.
-*
-* A `Clip` is purely time-based (subtree-blind): playback resolves segments by
-* temporal overlap, so the API never decides `continuous` vs `events`.
-*/
 var ClipSchema = zod.z.object({
 	/** Opaque, provider-namespaced id. The default provider encodes the time
 	*  window so `getClipPlayback` is self-contained (no event re-query). */
@@ -19611,12 +19654,41 @@ var ClipSchema = zod.z.object({
 	* of the event that owns `kind` (object > motion > audio). Do not extract
 	* a keyframe from the recorded segments. Other providers (onboard, HKSV)
 	* mint their own stills.
+	*
+	* **VOUCHED, never fabricated.** A provider emits this only for an event it
+	* has CONFIRMED owns at least one media row (its own, or its owning track's).
+	* Absent is meaningful — "this visit has no event still" — never "we did not
+	* look". Stamping it from a URL template made 35% of one camera's clips point
+	* at a 404 (device 3836, 2026-08-17: 64 of 179 clips dead, 63 of them motion).
+	* A read that FAILS drops the claim; it never invents it.
 	*/
 	thumbnail: zod.z.string().optional(),
-	/** Analytics event ids that overlap this visit. Empty on footage-only clips.
-	*  The default provider's visit grain puts many motion heartbeats on one clip
-	*  instead of minting one clip per marker. */
+	/**
+	* An instant INSIDE this visit's footage, hole-safe, where a recorded still
+	* can be decoded. Present whenever the visit came from recorded availability;
+	* absent on a per-event padded window (there is no footage to promise).
+	*
+	* This is not a thumbnail and not a second byte path: it is the argument to
+	* the recorder's existing still route. The surface — never the provider —
+	* decides whether to use it. It is the midpoint of the visit's LONGEST
+	* contiguous range, not of the visit: a visit spans its holes by
+	* construction, so a naive midpoint lands in dead air.
+	*/
+	stillAtMs: zod.z.number().optional(),
+	/**
+	* Analytics event ids that overlap this visit — a BOUNDED sample, newest
+	* first within kind (object → motion → audio), capped at
+	* {@link MAX_CLIP_EVENT_IDS}. Empty on footage-only clips.
+	*
+	* Bounded because it is not a payload the surface pages through: one visit on
+	* device 615 carried 2 345 ids, and `eventIds` was 99% of a 153 KB
+	* camera-day. Read {@link eventCount} for the true total.
+	*/
 	eventIds: zod.z.array(zod.z.string()).optional(),
+	/** How many analytics events actually overlap this visit. Differs from
+	*  `eventIds.length` exactly when the sample was capped — so a truncated
+	*  list is never mistaken for a quiet visit. */
+	eventCount: zod.z.number().int().nonnegative().optional(),
 	/** Intra-visit footage holes (GOP rolls, discarded segments) still shorter
 	*  than `VISIT_MERGE_GAP_MS`. Playback concatenates around them; the timeline
 	*  bar keeps showing them via `recording.getAvailability`. */
@@ -20253,7 +20325,14 @@ var SearchResultSchema = zod.z.object({
 });
 var AutoUpdateSettingsSchema = zod.z.object({
 	channel: ChannelSchema,
-	intervalSeconds: zod.z.number()
+	intervalSeconds: zod.z.number(),
+	/**
+	* Cadence of the "an update exists" POLLER, in seconds. Independent of
+	* `channel`: the poller runs while auto-apply is `off`, because being told
+	* about a publish and installing it are different decisions. Clamped
+	* server-side to 900 s … 604800 s; defaults to 21600 s (6 h).
+	*/
+	updateCheckIntervalSeconds: zod.z.number()
 });
 var AddonAutoUpdateSchema = ChannelWithInheritSchema;
 var RestartAddonResultSchema = zod.z.unknown();
@@ -20522,7 +20601,9 @@ var addonsCapability = {
 		getAutoUpdateSettings: method(zod.z.void(), AutoUpdateSettingsSchema, { auth: "admin" }),
 		setAutoUpdateSettings: method(zod.z.object({
 			channel: ChannelSchema,
-			intervalSeconds: zod.z.number().min(300).max(86400).optional()
+			intervalSeconds: zod.z.number().min(300).max(86400).optional(),
+			/** Availability-poll cadence; see AutoUpdateSettingsSchema. */
+			updateCheckIntervalSeconds: zod.z.number().min(900).max(604800).optional()
 		}), zod.z.unknown(), {
 			kind: "mutation",
 			auth: "admin"
@@ -33237,6 +33318,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.reconcileFromDisk": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.refreshStorageLocationsForMigration": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -33639,6 +33726,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getReconcileFromDiskStatus": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.listAgentSettings": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -33663,6 +33756,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.reconcileFromDisk": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.removeAgentSettings": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -36654,6 +36753,11 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"pipelineAnalytics.reconcileFromDisk": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.restageRetrainTrack": [{
 		name: "deviceId",
 		form: "single",