@camstack/system 1.2.21 → 1.2.23

package/dist/{dist-OQ1yU92D.js → dist-CS0pdC8l.js}

@@ -3228,35 +3228,22 @@ var ConvertResultSchema = zod.z.object({
 */
 var RecordingWeekdaySchema = zod.z.number().int().min(0).max(6);
 var HHMM = /^([01]\d|2[0-3]):[0-5]\d$/;
-var RecordingScheduleSchema = zod.z.discriminatedUnion("kind", [zod.z.object({ kind: zod.z.literal("always") }), zod.z.object({
-	kind: zod.z.literal("timeOfDay"),
-	start: zod.z.string().regex(HHMM),
-	end: zod.z.string().regex(HHMM),
-	/** Restrict to these weekdays; omit = every day. */
-	days: zod.z.array(RecordingWeekdaySchema).optional()
-})]);
-var RecordingModeSchema = zod.z.enum([
-	"continuous",
-	"onMotion",
-	"onAudioThreshold"
-]);
 /**
-* First-class, authoritative per-camera storage mode — the explicit choice the
-* UI reads directly (never inferred from `rules`):
-*  - `off`        — not recording.
-*  - `events`     — record only around triggers (motion / audio threshold),
-*                   with pre/post-buffer.
-*  - `continuous` — record 24/7 within the schedule.
+* DERIVED per-camera storage summary — the single field cheap consumers read
+* (the viewer's status dot, the camera list) instead of walking `bands`:
+*  - `off`        — no band covers the camera (or it is disabled).
+*  - `events`     — every band records around triggers only.
+*  - `continuous` — at least one band records continuously.
 *
-* `mode` compiles one-way to the internal `rules[]` consumed by the policy
-* engine (see `compileRules`); `rules[]` is never authored directly anymore.
+* NEVER authored: the recorder stamps it from the authoritative `bands` on
+* every save (`activeModeForConfig`). Writing it has no effect.
 */
 var RecordingStorageModeSchema = zod.z.enum([
 	"off",
 	"events",
 	"continuous"
 ]);
-/** Which detectors trigger an `events`-mode recording. */
+/** Which detectors trigger an `events`-mode band. */
 var RecordingTriggersSchema = zod.z.object({
 	motion: zod.z.boolean().optional(),
 	audioThresholdDbfs: zod.z.number().optional()
@@ -3292,18 +3279,6 @@ var RecordingBandSchema = zod.z.object({
 	preBufferSec: zod.z.number().min(0).optional(),
 	postBufferSec: zod.z.number().min(0).optional()
 });
-var RecordingRuleSchema = zod.z.object({
-	schedule: RecordingScheduleSchema,
-	mode: RecordingModeSchema,
-	/** Seconds of footage to retain BEFORE a trigger (applied at keep/discard). */
-	preBufferSec: zod.z.number().min(0).default(0),
-	/** Keep recording until this many seconds after the last trigger. */
-	postBufferSec: zod.z.number().min(0).default(0),
-	/** Each new trigger restarts the post-buffer window. */
-	resetTimeoutOnNewEvent: zod.z.boolean().default(true),
-	/** onAudioThreshold only — dBFS level that counts as a trigger. */
-	thresholdDbfs: zod.z.number().optional()
-});
 /**
 * Per-device retention overrides. Every field is optional; an unset or `0`
 * value inherits the node-wide recorder default. Only footage-lifetime limits
@@ -3337,40 +3312,28 @@ var ScrubThumbnailPresetSchema = zod.z.enum([
 /**
 * The full per-camera recording intent — the wire shape of a RecordingTarget.
 *
-* `mode` is the authoritative storage choice; `schedule`/`triggers`/`pre`/`post`
-* are its mode-specific parameters. `rules` is a DEPRECATED authoring input kept
-* only for transition + migration (`migrateRulesToMode`); the policy engine
-* consumes the compiled output of `compileRules(config)`, never `rules` directly.
+* `bands` is the ONLY authored recording intent: what to record, when, and on
+* which trigger. `mode` is a derived summary the recorder stamps on save; every
+* other field is a storage knob (profiles, segment length, retention, scrub).
+*
+* STRICT on purpose: the legacy authoring surface (`schedule`/`schedules`/
+* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30.
+* A stale caller must fail loudly — silently stripping its legacy intent would
+* persist a band-less config, i.e. silently stop recording the camera.
 */
 var RecordingConfigSchema = zod.z.object({
 	enabled: zod.z.boolean(),
-	/** Authoritative storage mode. Absent on legacy targets → derived once via
-	*  `migrateRulesToMode`, then persisted. */
+	/** DERIVED summary of `bands`, stamped by the recorder on every save.
+	*  Authoring it has no effect — see {@link RecordingStorageModeSchema}. */
 	mode: RecordingStorageModeSchema.optional(),
 	profiles: zod.z.array(CamProfileSchema).optional(),
 	segmentSeconds: zod.z.number().int().positive().optional(),
-	/** Shared recording time-bands for `events` & `continuous` — record only when
-	*  the wall-clock falls inside one of these windows. Omit or empty = always.
-	*  `continuous` compiles to one rule per band; `events` to band × trigger. */
-	schedules: zod.z.array(RecordingScheduleSchema).optional(),
-	/** Legacy single-band predecessor of `schedules`. Read-compat only — it is
-	*  normalized into `schedules` on read and never written going forward. (Not
-	*  tagged `@deprecated`: the normalization paths must read it cast-free.) */
-	schedule: RecordingScheduleSchema.optional(),
-	/** `events`-mode only — which detectors trigger a recording. */
-	triggers: RecordingTriggersSchema.optional(),
-	/** `events`-mode only — seconds retained before / after a trigger. */
-	preBufferSec: zod.z.number().min(0).optional(),
-	postBufferSec: zod.z.number().min(0).optional(),
-	/** DEPRECATED authoring input; retained for migration/transition. */
-	rules: zod.z.array(RecordingRuleSchema).optional(),
 	/**
-	* AUTHORITATIVE mode-per-band recording model (recorder). When present it
-	* is the single source of truth; the legacy `mode`/`schedules`/`schedule`/
-	* `triggers`/`rules` fields above are kept for READ-COMPAT only and are
-	* derived into bands once via `migrateConfigToBands`.
+	* AUTHORITATIVE mode-per-band recording model — the single source of truth
+	* the recorder's band engine consumes. An empty array = record nothing;
+	* "off" is the absence of a covering band, never a band value.
 	*/
-	bands: zod.z.array(RecordingBandSchema).optional(),
+	bands: zod.z.array(RecordingBandSchema).default([]),
 	retention: RecordingRetentionSchema.optional(),
 	/**
 	* Per-camera scrub-thumbnail fidelity preset (resolution + JPEG quality for
@@ -3378,8 +3341,15 @@ var RecordingConfigSchema = zod.z.object({
 	* windows only — existing sheets are immutable, and each window's index
 	* carries its own tile dims so mixed-preset history renders correctly.
 	*/
-	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
-});
+	scrubThumbnails: ScrubThumbnailPresetSchema.optional(),
+	/**
+	* OPT-IN thumbnail-strip generation for this camera: every keyframe of the
+	* low recording saved as a JPEG (the fast-drag scrub depth), a derived
+	* cache that eviction reclaims with the footage. Absent/false = no strips
+	* are written and scrub reads exact keyframes at every velocity.
+	*/
+	stripsEnabled: zod.z.boolean().optional()
+}).strict();
 /**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
@@ -3398,7 +3368,8 @@ var OpsLogOpSchema = zod.z.enum([
 	"prune",
 	"manual-delete",
 	"rescan",
-	"retention-run"
+	"retention-run",
+	"relocate"
 ]);
 /** Why the operation ran. */
 var OpsLogReasonSchema = zod.z.enum([
@@ -3437,6 +3408,55 @@ var OpsLogQueryInputSchema = zod.z.object({
 	limit: zod.z.number().int().min(1).max(1e3).optional()
 });
 /**
+* Entity-relocation job state (storage entity-routing spec, Phase 4).
+*
+* One shape shared by the recorder's `relocateFootage` (segments + strips) and
+* pipeline-analytics' `relocateMedia` (event media blobs) so the admin Data
+* page renders both movers with one component. Jobs are in-RAM (a restart
+* forgets them — re-running is safe by construction: copy-if-absent, delete
+* after verify) and each completed/failed run also lands one durable ops-log
+* row on the owning addon's surface.
+*/
+var RelocateJobStateSchema = zod.z.enum([
+	"running",
+	"done",
+	"failed",
+	"cancelled"
+]);
+var RelocateJobSchema = zod.z.object({
+	jobId: zod.z.string(),
+	state: RelocateJobStateSchema,
+	/** Source location — for media relocation this is informational ('*': rows
+	*  move from wherever they are to the target). */
+	fromLocationId: zod.z.string(),
+	toLocationId: zod.z.string(),
+	/** Scoped device, or null = every device. */
+	deviceId: zod.z.number().nullable(),
+	/** What the job moves (owner-addon specific: segments/strips or media). */
+	entities: zod.z.array(zod.z.string()),
+	filesMoved: zod.z.number().int(),
+	bytesMoved: zod.z.number().int(),
+	/** Total files discovered up front; null while (or when) unknown. */
+	filesTotal: zod.z.number().int().nullable(),
+	startedAt: zod.z.number(),
+	finishedAt: zod.z.number().nullable(),
+	error: zod.z.string().nullable()
+});
+var RelocateFootageInputSchema = zod.z.object({
+	deviceId: zod.z.number().optional(),
+	fromLocationId: zod.z.string(),
+	toLocationId: zod.z.string(),
+	entities: zod.z.array(zod.z.enum(["segments", "strips"])).optional(),
+	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
+	*  never allowed to starve live writers. */
+	throttleMbps: zod.z.number().min(1).max(1e3).optional()
+});
+var RelocateMediaInputSchema = zod.z.object({
+	deviceId: zod.z.number().optional(),
+	toLocationId: zod.z.string(),
+	throttleMbps: zod.z.number().min(1).max(1e3).optional()
+});
+/**
 * Severity ordering. Declared once here because it had already been re-declared
 * three times independently (`kernel/transport/uds-logger.ts`,
 * `builtins/loki-logging/loki-destination.ts`, and the log buffer) — four copies
@@ -3506,6 +3526,13 @@ var StorageLocationSchema = zod.z.object({
 	nodeId: zod.z.string().optional(),
 	isDefault: zod.z.boolean().default(false),
 	isSystem: zod.z.boolean().default(false),
+	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
+	*  for node-local locations it can reach) — never persisted, absent when the
+	*  volume is remote/unreachable. The single capacity truth every UI reads. */
+	capacity: zod.z.object({
+		totalBytes: zod.z.number(),
+		availableBytes: zod.z.number()
+	}).nullable().optional(),
 	createdAt: zod.z.number(),
 	updatedAt: zod.z.number()
 });
@@ -3567,16 +3594,23 @@ var StorageLocationDeclarationSchema = zod.z.object({
 	* Which node root the seeded `<id>:default` instance is placed under on a
 	* FRESH install:
 	* - `'data'` (default) — the node's data dir (`CAMSTACK_DATA` / boot dir),
-	*   the appData volume. Right for small/durable data (backups, logs, models).
+	*   the appData volume. Right for small/durable data (logs, models).
 	* - `'media'` — the dedicated media volume (`CAMSTACK_MEDIA_ROOT`) when that
 	*   env is set, else falls back to the data root. Right for bulky, hot media
 	*   (recordings, event media) that should stay off the appData disk.
+	* - `'backup'` — the dedicated backup volume (`CAMSTACK_BACKUP_ROOT`, default
+	*   `/backups` in the image) so archives live on their own mount rather than
+	*   filling the appData disk. Falls back to the data root when unset.
 	*
 	* Only affects the seeded default's `basePath`; operators can repoint any
 	* location afterwards, and a `defaultsTo` slot inherits its parent's root
 	* regardless of this field. Absent (the common case) is treated as `'data'`.
 	*/
-	defaultRoot: zod.z.enum(["data", "media"]).optional()
+	defaultRoot: zod.z.enum([
+		"data",
+		"media",
+		"backup"
+	]).optional()
 });
 /** Friendly display labels for stream quality IDs. */
 var STREAM_QUALITY_LABELS = {
@@ -4327,7 +4361,8 @@ var NcTaxonomyEntrySchema = zod.z.object({
 	/** Macro/category parent for grouping ('car' → 'vehicle'); null for a top. */
 	parentKind: zod.z.string().nullable()
 });
-zod.z.object({
+/** The complete NC picker taxonomy — three grouped buckets. */
+var NcTaxonomySchema = zod.z.object({
 	videoClasses: zod.z.array(NcTaxonomyEntrySchema),
 	audioKinds: zod.z.array(NcTaxonomyEntrySchema),
 	labels: zod.z.array(NcTaxonomyEntrySchema)
@@ -5128,6 +5163,7 @@ var AccessoryKind = {
 };
 AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
 DeviceFeature.BatteryOperated;
+new Set(["devices", "classes"]);
 /**
 * Shared geometry vocabulary for on-frame shape caps — privacy-mask,
 * motion-zones, and the detection zones/lines editor all speak this one
@@ -5448,12 +5484,60 @@ var NcRuleTargetSchema = zod.z.object({
 *  - `keyFrame` — the clean scene frame (no subject box).
 *  - `none` — no attachment.
 */
-var NcMediaPolicySchema = zod.z.object({ attach: zod.z.enum([
-	"best",
-	"best-matching",
-	"keyFrame",
-	"none"
-]).default("best") });
+/**
+* WHAT THE PICTURE SHOWS — chosen explicitly, because the implicit ladders
+* conflate it with the selection strategy and betray the request: asking for
+* the clean scene frame on an object-event owner used to start at
+* `fullFrameBoxed`, i.e. the annotated frame (2026-07-30).
+*  - `cropped` — the subject, tight. What "who is at the door" wants.
+*  - `full`    — the clean scene, no annotation. What "what is going on" wants.
+*  - `boxed`   — the scene WITH the detection boxes drawn, for verifying what
+*                the pipeline actually saw.
+*/
+var NcMediaFrameSchema = zod.z.enum([
+	"cropped",
+	"full",
+	"boxed"
+]);
+var NcMediaPolicySchema = zod.z.object({
+	attach: zod.z.enum([
+		"best",
+		"best-matching",
+		"keyFrame",
+		"none"
+	]).default("best"),
+	/** What the still shows. Absent = `cropped` (the historical `best` shape). */
+	frame: NcMediaFrameSchema.optional(),
+	/** Crop the attached still to the rule's condition-zone bbox (padded) —
+	*  "show me the ZONE", not the whole scene or the subject crop. */
+	zoneCrop: zod.z.boolean().optional(),
+	/**
+	* Also attach a short GIF cut from the stream broker's clip ring around the
+	* event — NOT from the recording, so the camera does not have to be
+	* recording, and the window sits AROUND the moment instead of a segment
+	* behind it. Fail-closed: a window the ring does not cover contributes no
+	* gif, never a failed notification.
+	*/
+	gif: zod.z.boolean().optional(),
+	/**
+	* Also attach a short MP4 CLIP of the same cut. Same source and the same
+	* fail-closed rule as `gif`. Prefer it where the backend takes video
+	* (telegram, discord, zentik, webhook); backends that do not are handled by
+	* the degrade engine, which drops the video and keeps the still.
+	*/
+	clip: zod.z.boolean().optional(),
+	/** Seconds of footage BEFORE / AFTER the event instant. Defaults 3 / 7. */
+	clipPreRollSec: zod.z.number().int().min(0).max(30).optional(),
+	clipPostRollSec: zod.z.number().int().min(0).max(30).optional(),
+	/**
+	* Which stream profile the footage is cut from. Absent = the CHEAPEST
+	* assigned profile: a notification is watched on a phone, so the 4K
+	* rendition would burn CPU to produce a file the client downscales anyway.
+	* A profile that is not assigned falls back to the cheapest, and the render
+	* reports which one actually ran.
+	*/
+	profile: CamProfileSchema.optional()
+});
 /** Throttle — cooldown survives restarts (rebuilt from the outbox on boot). */
 var NcThrottleSchema = zod.z.object({
 	cooldownSec: zod.z.number().int().min(0).max(86400).default(60),
@@ -5467,7 +5551,19 @@ var NcRuleInputSchema = zod.z.object({
 	delivery: NcDeliverySchema,
 	conditions: NcConditionsSchema.default({}),
 	schedule: NcScheduleSchema.optional(),
-	targets: zod.z.array(NcRuleTargetSchema).min(1),
+	/** May be empty when `targetUsers` addresses at least one user — the
+	*  "at least one addressee" invariant is enforced by the provider, because
+	*  a cross-field refine here would break `NcRulePatchSchema.partial()`. */
+	targets: zod.z.array(NcRuleTargetSchema),
+	/**
+	* USERS this rule addresses in addition to `targets` (Phase 4). At fire
+	* time each user fans out to the personal targets they own
+	* (`config.ownerUserId`), filtered by that user's `allowedDevices` for the
+	* firing camera — a user is never notified about a device they cannot open.
+	* Per-user opt-outs (`disabledTargetIds`) still apply to the fanned-out
+	* targets.
+	*/
+	targetUsers: zod.z.array(zod.z.string()).optional(),
 	media: NcMediaPolicySchema.default({ attach: "best" }),
 	throttle: NcThrottleSchema.default({
 		cooldownSec: 60,
@@ -5697,7 +5793,20 @@ var notificationRulesCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		getConditionCatalog: method(zod.z.object({}), zod.z.object({ catalog: zod.z.array(NcConditionDescriptorSchema) })),
+		/**
+		* The machine-readable condition surface a rule editor renders from, plus
+		* the picker VOCABULARY those conditions draw on.
+		*
+		* `taxonomy` is optional so an older provider that only returns `catalog`
+		* still validates; a client that receives none keeps free-text inputs.
+		* It was previously served ONLY on the `nc.getConditionCatalog` bridge
+		* action, which is why the viewer had grouped pickers and the admin UI —
+		* which reaches this cap — was stuck typing `person` from memory.
+		*/
+		getConditionCatalog: method(zod.z.object({}), zod.z.object({
+			catalog: zod.z.array(NcConditionDescriptorSchema),
+			taxonomy: NcTaxonomySchema.optional()
+		})),
 		/**
 		* Queryable delivery history — a read-only view over the durable outbox
 		* (fired rule, subject summary, target, status, timestamps, error on a
@@ -6745,6 +6854,48 @@ var streamBrokerCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* Render a short GIF or MP4 from the broker's PRE-BUFFER around an instant.
+		*
+		* The pre-buffer is the only source that already holds the seconds BEFORE
+		* an event (it is what it exists for — "when an addon needs the last N
+		* seconds of video for clip creation"). Cutting from recorded segments
+		* cannot: only finalized segments are addressable and the one covering the
+		* moment is still being written, so a segment-sourced clip is either
+		* delayed or shows the approach instead of the event (operator,
+		* 2026-07-30). It also means a camera does not have to be RECORDING to
+		* produce a notification clip.
+		*
+		* Returns muxed BYTES, never packets: the frame plane never crosses a
+		* process boundary at frame rate (D9/D18) — this is one compressed,
+		* on-demand payload per notification.
+		*
+		* Waits up to `postRollSec` for the tail to accumulate, so the window is
+		* CENTRED on `aroundMs`.
+		*/
+		renderPreBufferClip: method(zod.z.object({
+			deviceId: zod.z.number(),
+			/** Absent = the LOWEST assigned profile — a notification attachment is
+			*  watched on a phone, and the cheap rendition is the right default. */
+			profile: CamProfileSchema.optional(),
+			aroundMs: zod.z.number(),
+			preRollSec: zod.z.number().min(0).max(20).default(3),
+			postRollSec: zod.z.number().min(0).max(20).default(5),
+			format: zod.z.enum(["gif", "mp4"]).default("gif"),
+			maxWidth: zod.z.number().int().min(120).max(1920).default(480),
+			/** GIF only — MP4 keeps the source cadence. */
+			fps: zod.z.number().int().min(1).max(15).default(5)
+		}), zod.z.object({
+			base64: zod.z.string(),
+			mime: zod.z.string(),
+			bytes: zod.z.number().int(),
+			/** The profile actually rendered (what the default resolved to). */
+			profile: CamProfileSchema,
+			durationMs: zod.z.number()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		listAllCameraStreams: method(zod.z.void(), zod.z.array(CameraStreamSchema).readonly()),
 		listAllProfileSlots: method(zod.z.void(), zod.z.array(ProfileSlotSchema).readonly()),
 		getBrokerStats: method(zod.z.object({ brokerId: zod.z.string() }), BrokerStatsSchema),
@@ -13573,6 +13724,41 @@ var LocationStatSchema = zod.z.object({
 	present: zod.z.boolean()
 });
 /**
+* A backup schedule — the N:M "entry" that binds one cron cadence to a
+* SET of destination locations. Supersedes the per-location cron on
+* `BackupDestinationPolicy`: an operator creates a schedule, picks the
+* `backups` locations it should write to, and the orchestrator fans a
+* single archive out to all of them when the cron fires.
+*
+* `retentionCount` is per-schedule (D-decision 2026-07-28): every
+* location targeted by this schedule keeps this many archives from
+* this schedule's runs.
+*
+* `dataSources` optionally narrows which top-level state locations
+* (db, addons, tls, …) are archived; omitted = the orchestrator's
+* default full set.
+*/
+var BackupScheduleSchema = zod.z.object({
+	/** Stable id. Generated by the orchestrator on first upsert if absent. */
+	id: zod.z.string(),
+	/** Operator-facing display name. */
+	label: zod.z.string(),
+	/** 5-field POSIX cron. Empty = disabled cadence (kept for editing). */
+	cron: zod.z.string(),
+	/** Master on/off toggle for the whole schedule. */
+	enabled: zod.z.boolean(),
+	/** `backups`-location ids this schedule writes to (fan-out set). */
+	locationIds: zod.z.array(zod.z.string()).readonly(),
+	/** Archives kept per targeted location for this schedule. */
+	retentionCount: zod.z.number().int().min(1).max(1e3),
+	/** Optional subset of source locations to include; omitted = all. */
+	dataSources: zod.z.array(zod.z.string()).readonly().optional(),
+	/** ms-epoch of last successful run. */
+	lastRunAt: zod.z.number().optional(),
+	/** ms-epoch of next computed firing (read-only, filled on list). */
+	nextRunAt: zod.z.number().optional()
+});
+/**
 * backup — singleton capability for backup management.
 *
 * Implemented by `local-backup` addon. Future providers (S3, rsync)
@@ -13599,7 +13785,14 @@ var backupCapability = {
 			/** Subset of registered `backup-destination` addon ids to write to. */
 			destinations: zod.z.array(zod.z.string()).optional(),
 			locations: zod.z.array(zod.z.string()).optional(),
-			label: zod.z.string().optional()
+			label: zod.z.string().optional(),
+			/**
+			* Per-run retention override applied to every targeted
+			* destination. Used by schedule-driven runs (per-entry
+			* retention). Omitted = each destination's own policy
+			* retention (manual runs).
+			*/
+			retentionCount: zod.z.number().int().min(1).max(1e3).optional()
 		}).optional(), zod.z.array(BackupEntrySchema).readonly(), {
 			kind: "mutation",
 			auth: "admin"
@@ -13686,7 +13879,36 @@ var backupCapability = {
 			ok: zod.z.boolean(),
 			error: zod.z.string().optional(),
 			nextRuns: zod.z.array(zod.z.number()).readonly()
-		}))
+		})),
+		/**
+		* List every backup schedule (the N:M entries), each with its
+		* computed `nextRunAt`. Powers the Schedules section of the
+		* admin-UI Backups page.
+		*/
+		listSchedules: method(zod.z.void(), zod.z.array(BackupScheduleSchema).readonly(), { auth: "admin" }),
+		/**
+		* Create or replace a schedule. An empty / absent `id` mints a new
+		* one; a present `id` replaces in place. `cron` is validated
+		* server-side; `locationIds` must reference existing `backups`
+		* locations (unknown ids are dropped with a warning).
+		*/
+		upsertSchedule: method(zod.z.object({
+			id: zod.z.string().optional(),
+			label: zod.z.string(),
+			cron: zod.z.string(),
+			enabled: zod.z.boolean(),
+			locationIds: zod.z.array(zod.z.string()).readonly(),
+			retentionCount: zod.z.number().int().min(1).max(1e3),
+			dataSources: zod.z.array(zod.z.string()).readonly().optional()
+		}), BackupScheduleSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Delete a schedule by id. Does not touch the target locations. */
+		deleteSchedule: method(zod.z.object({ id: zod.z.string() }), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 /**
@@ -16680,6 +16902,36 @@ var TargetKindSchema = zod.z.object({
 	icon: zod.z.string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: zod.z.string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: zod.z.string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: zod.z.string().optional(),
 	configSchema: ConfigSchemaPassthrough,
 	supportsDiscovery: zod.z.boolean(),
 	caps: TargetKindCapsSchema
@@ -17552,6 +17804,23 @@ var pipelineAnalyticsCapability = {
 		}),
 		/** The events ops-log rows (newest-first), optionally scoped to one camera.
 		*  Backed by a declared pipeline-analytics SQLite collection. */
+		/**
+		* Move event-media blobs onto `toLocationId` (entity-routing spec Phase
+		* 4): per-row copy → stamp row.locationId → delete old blob. Rows already
+		* at the target are skipped, so a re-run resumes. Single-flight.
+		*/
+		relocateMedia: method(RelocateMediaInputSchema, zod.z.object({ jobId: zod.z.string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getMediaRelocateStatus: method(zod.z.object({}), zod.z.array(RelocateJobSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		cancelMediaRelocate: method(zod.z.object({ jobId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		listOpsLog: method(OpsLogQueryInputSchema, zod.z.array(OpsLogEntrySchema).readonly(), {
 			kind: "query",
 			auth: "admin"
@@ -21109,6 +21378,17 @@ var ConnectionEndpointSchema = zod.z.object({
 	priority: zod.z.number()
 });
 var GetConnectionEndpointsResultSchema = zod.z.object({ endpoints: zod.z.array(ConnectionEndpointSchema).readonly() });
+/**
+* The chosen outbound endpoint for notification artifacts. `baseUrl: null` =
+* AUTO (resolved from the candidate ranking at send time); `resolved` reports
+* what AUTO currently picks, so the UI can show the effective value either way.
+*/
+var NotificationEndpointSchema = zod.z.object({
+	/** The operator's explicit choice, or null for AUTO. */
+	baseUrl: zod.z.string().nullable(),
+	/** What the ranking currently resolves to (null when nothing is reachable). */
+	resolved: zod.z.string().nullable()
+});
 var AllowedAddressesSchema = zod.z.object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -21160,6 +21440,26 @@ var localNetworkCapability = {
 			scheme: zod.z.enum(["http", "https"]).optional()
 		}), GetConnectionEndpointsResultSchema),
 		/**
+		* The endpoint OUTBOUND artifacts must be addressed by — notification
+		* attachment links and deep links. `baseUrl: null` means AUTO: the first
+		* public candidate (a configured origin, then a connected tunnel, then the
+		* LAN), never loopback.
+		*
+		* Why an explicit marker: the automatic ranking cannot know which of
+		* several reachable addresses the RECIPIENT can actually open. A link is
+		* consumed on someone's phone, off the LAN, possibly hours later — and a
+		* link nobody can open is worse than no link, because the notification
+		* arrives advertising media that 404s.
+		*/
+		getNotificationEndpoint: method(zod.z.void(), NotificationEndpointSchema),
+		/**
+		* Mark which endpoint notification artifacts use. `baseUrl: null` restores
+		* AUTO. The value is stored verbatim (not an index into the candidate
+		* list): interfaces come and go, and an index would silently re-point at a
+		* different address after a reboot.
+		*/
+		setNotificationEndpoint: method(zod.z.object({ baseUrl: zod.z.string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }),
+		/**
 		* Read the operator's allowlist. Empty = "auto" (no filter). Used
 		* by the admin UI's address selector to seed its checkbox state.
 		*/
@@ -22253,7 +22553,12 @@ var RecordingDeviceUsageSchema = zod.z.object({
 var RecordingLocationUsageSchema = zod.z.object({
 	/** StorageLocation id; null for the legacy/degraded single-root fallback. */
 	locationId: zod.z.string().nullable(),
-	/** Bytes of recordings stored on this location. */
+	/** Every location id sharing this row's PHYSICAL volume (aliases). One row
+	*  is emitted per physical disk (2026-07-29): two locations on one root
+	*  previously rendered as two identical "disks" with a nonsensical used
+	*  split — hydrate attribution across aliases is arbitrary by nature. */
+	locationIds: zod.z.array(zod.z.string()).optional(),
+	/** Bytes of recordings stored on this PHYSICAL volume (all aliases). */
 	usedBytes: zod.z.number(),
 	/** Free bytes on the location's volume; null when capacity is unknown (remote). */
 	availableBytes: zod.z.number().nullable(),
@@ -22409,6 +22714,77 @@ var recordingCapability = {
 		listOpsLog: method(OpsLogQueryInputSchema, zod.z.array(OpsLogEntrySchema).readonly(), {
 			kind: "query",
 			auth: "admin"
+		}),
+		/**
+		* Move footage (segments and/or strips) from one recordings location to
+		* another — the drain workflow's mover (entity-routing spec Phase 4).
+		* Throttled copy → size-verify → delete source → index refresh; resumable
+		* by construction (copy-if-absent). Single-flight: one job at a time.
+		*/
+		/**
+		* Render a short GIF from recorded footage around `aroundMs` (low profile,
+		* palette-free ffmpeg gif). Synchronous — the window is a few seconds of
+		* `low`, rendering in ~1-2s. Built for notification attachments: the
+		* caller gets bytes, nothing persists. Fails when no footage covers the
+		* window (camera not recording → caller skips the attachment).
+		*/
+		renderGif: method(zod.z.object({
+			deviceId: zod.z.number(),
+			aroundMs: zod.z.number(),
+			preRollSec: zod.z.number().min(0).max(30).default(2),
+			postRollSec: zod.z.number().min(0).max(30).default(5),
+			maxWidth: zod.z.number().int().min(120).max(1280).default(480),
+			fps: zod.z.number().int().min(1).max(15).default(5)
+		}), zod.z.object({
+			gifBase64: zod.z.string(),
+			fromMs: zod.z.number(),
+			toMs: zod.z.number()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Render a short MP4 clip from recorded footage around `aroundMs` — the
+		* "send a clip, not a gif" notification attachment. Same window, source
+		* and fail-closed contract as {@link renderGif}: no footage covering the
+		* window ⇒ it throws and the caller ships no attachment. Re-encoded (never
+		* stream-copied) so a concat across segments with different encoder
+		* parameters still plays. Silent by contract.
+		*
+		* The returned window is SEGMENT-GRANULAR: the source playlist is built
+		* from whole segments, so the clip starts at or before `fromMs` and ends
+		* at or after `toMs` — overshoot bounded by one segment per side (an 8 s
+		* ask over 4 s segments measured 12 s). `fromMs`/`toMs` report the window
+		* ASKED for, not the encoded duration.
+		*/
+		renderClip: method(zod.z.object({
+			deviceId: zod.z.number(),
+			aroundMs: zod.z.number(),
+			preRollSec: zod.z.number().min(0).max(30).default(3),
+			postRollSec: zod.z.number().min(0).max(30).default(7),
+			maxWidth: zod.z.number().int().min(160).max(1920).default(640)
+		}), zod.z.object({
+			clipBase64: zod.z.string(),
+			mime: zod.z.string(),
+			fromMs: zod.z.number(),
+			toMs: zod.z.number(),
+			bytes: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		relocateFootage: method(RelocateFootageInputSchema, zod.z.object({ jobId: zod.z.string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Every known relocate job (in-RAM, newest-first). */
+		getRelocateStatus: method(zod.z.object({}), zod.z.array(RelocateJobSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		cancelRelocate: method(zod.z.object({ jobId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
 		})
 	}
 };
@@ -23904,6 +24280,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"backup.deleteSchedule": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"backup.getEntries": {
 		capName: "backup",
 		capScope: "system",
@@ -23934,6 +24316,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"backup.listSchedules": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"backup.previewSchedule": {
 		capName: "backup",
 		capScope: "system",
@@ -23958,6 +24346,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"backup.upsertSchedule": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"battery.wakeForStream": {
 		capName: "battery",
 		capScope: "device",
@@ -25458,6 +25852,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getNotificationEndpoint": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getPreferred": {
 		capName: "local-network",
 		capScope: "system",
@@ -25482,6 +25882,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.setNotificationEndpoint": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -26124,6 +26530,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.cancelMediaRelocate": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.clearTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -26178,6 +26590,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getMediaRelocateStatus": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getMotionEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -26250,6 +26668,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.relocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.searchObjectEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -27012,6 +27436,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.cancelRelocate": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.deleteFootprint": {
 		capName: "recording",
 		capScope: "system",
@@ -27042,6 +27472,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.getRelocateStatus": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.getStorageUsage": {
 		capName: "recording",
 		capScope: "system",
@@ -27072,6 +27508,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.relocateFootage": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"recording.renderClip": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"recording.renderGif": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.rescanStorage": {
 		capName: "recording",
 		capScope: "system",
@@ -27666,6 +28120,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.renderPreBufferClip": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.restartProfile": {
 		capName: "stream-broker",
 		capScope: "system",