@camstack/types 1.2.124 → 1.2.127

package/dist/addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_event_category = require("./event-category-BaEgqJNv.js");
-const require_sleep = require("./sleep-CJrvRDlD.js");
+const require_sleep = require("./sleep-CWWLTM6W.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
 //#region src/generated/cap-input-defaults.ts
 /**
@@ -16,7 +16,7 @@ const require_err_msg = require("./err-msg-COpsHMw2.js");
 * Plain data, zero Zod: a forked runner must not import the schema barrel
 * (~144MB RSS per runner — D28).
 *
-* Coverage: 24 caps, 53 methods with defaults.
+* Coverage: 24 caps, 54 methods with defaults.
 */
 var CAP_INPUT_DEFAULTS = Object.freeze({
 	"addons": { "getLogs": { "limit": 100 } },
@@ -236,7 +236,10 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 		"createApiKey": { "isAdmin": false },
 		"createUser": { "isAdmin": false }
 	},
-	"vector-store": { "declareIndex": { "metric": "cosine" } },
+	"vector-store": {
+		"declareIndex": { "metric": "cosine" },
+		"scan": { "cursor": 0 }
+	},
 	"zones": {
 		"addZone": { "zone": { "__nested__": {
 			"kind": "polygon",

package/dist/addon.mjs

@@ -1,5 +1,5 @@
 import { t as EventCategory } from "./event-category-BZL-fdNj.mjs";
-import { B as ReadinessRegistry, E as adminUiCapability, L as nodePin, R as readNodePin, St as emitReadiness, T as DeviceType, V as ReadinessTimeoutError, W as scopeKey, _t as DisposerChain, a as asJsonObject, b as deviceOpsCapability, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, gt as DATAPLANE_SECRET_HEADER, h as createEventBusSliceSource, j as expandCapMethods, m as createDeviceProxy, p as isDeviceScopedCap, s as asString, t as sleep, u as parseJsonUnknown, vt as BaseAddon, x as viewerUiCapability, yt as normalizeAddonInitResult } from "./sleep-L5-bG_a_.mjs";
+import { B as ReadinessRegistry, E as adminUiCapability, L as nodePin, R as readNodePin, St as emitReadiness, T as DeviceType, V as ReadinessTimeoutError, W as scopeKey, _t as DisposerChain, a as asJsonObject, b as deviceOpsCapability, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, gt as DATAPLANE_SECRET_HEADER, h as createEventBusSliceSource, j as expandCapMethods, m as createDeviceProxy, p as isDeviceScopedCap, s as asString, t as sleep, u as parseJsonUnknown, vt as BaseAddon, x as viewerUiCapability, yt as normalizeAddonInitResult } from "./sleep-bm0x6zZF.mjs";
 import { t as errMsg } from "./err-msg-IQTHeDzc.mjs";
 //#region src/generated/cap-input-defaults.ts
 /**
@@ -15,7 +15,7 @@ import { t as errMsg } from "./err-msg-IQTHeDzc.mjs";
 * Plain data, zero Zod: a forked runner must not import the schema barrel
 * (~144MB RSS per runner — D28).
 *
-* Coverage: 24 caps, 53 methods with defaults.
+* Coverage: 24 caps, 54 methods with defaults.
 */
 var CAP_INPUT_DEFAULTS = Object.freeze({
 	"addons": { "getLogs": { "limit": 100 } },
@@ -235,7 +235,10 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 		"createApiKey": { "isAdmin": false },
 		"createUser": { "isAdmin": false }
 	},
-	"vector-store": { "declareIndex": { "metric": "cosine" } },
+	"vector-store": {
+		"declareIndex": { "metric": "cosine" },
+		"scan": { "cursor": 0 }
+	},
 	"zones": {
 		"addZone": { "zone": { "__nested__": {
 			"kind": "polygon",

package/dist/capabilities/device-manager.cap.d.ts

@@ -982,6 +982,15 @@ export declare const deviceManagerCapability: {
          * calls are sync. Bindings change rarely (only on wrapper toggle or
          * device add/remove) — clients invalidate via the
          * `capability.binding-changed` event.
+         *
+         * "A single round-trip" describes the CLIENT's side and used not to
+         * describe the server's: until 2026-08-30 the resolver read the persisted
+         * wrapper activations once per device, so answering this cost one
+         * settings-door RPC per device — 1 020 on the live 1 019-device hub, and
+         * it did not return in 240 s against `SystemMirror.init`'s 15 s budget.
+         * The server side is now two reads for the whole fleet. Anything PERIODIC
+         * still belongs on `getBindings` / `getBindingsBatch` (D12); this remains
+         * a warm seed.
          */
         readonly getAllBindings: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodArray<z.ZodObject<{
             deviceId: z.ZodNumber;

package/dist/capabilities/pipeline-analytics.cap.d.ts

@@ -2421,6 +2421,7 @@ export declare const pipelineAnalyticsCapability: {
             filesMoved: z.ZodNumber;
             bytesMoved: z.ZodNumber;
             filesTotal: z.ZodNullable<z.ZodNumber>;
+            rowsReconciled: z.ZodOptional<z.ZodNumber>;
             startedAt: z.ZodNumber;
             finishedAt: z.ZodNullable<z.ZodNumber>;
             error: z.ZodNullable<z.ZodString>;
@@ -2458,12 +2459,51 @@ export declare const pipelineAnalyticsCapability: {
          * happens to stamp it. This count is what the migration planner's
          * non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
          * it to zero.
+         *
+         * TWO indexed statements per collection, not a walk. It used to page the
+         * whole collection at 200 rows per RPC ordered by an unindexed column, so
+         * on the live hub — 1 254 576 rows — it hit the 60 s RPC deadline every
+         * time it was called, and the migration it gates could never start. The
+         * cheap question (`present`: is there at least one) is asked first and
+         * separately from the expensive one (`rows`), because only the first has
+         * to be answerable for the gate to do its job.
+         *
+         * **`null` is "not measurable", never zero** — at either level. An
+         * unreadable collection must not read as a sealed one.
          */
-        readonly countUnstampedEventMedia: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodObject<{
-            media: z.ZodNumber;
-            retrainFrames: z.ZodNumber;
-            total: z.ZodNumber;
-        }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
+        readonly countUnstampedEventMedia: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodNullable<z.ZodObject<{
+            media: z.ZodObject<{
+                present: z.ZodBoolean;
+                rows: z.ZodNullable<z.ZodNumber>;
+            }, z.core.$strip>;
+            retrainFrames: z.ZodObject<{
+                present: z.ZodBoolean;
+                rows: z.ZodNullable<z.ZodNumber>;
+            }, z.core.$strip>;
+            anyPresent: z.ZodBoolean;
+            total: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
+        /**
+         * How many rows a pass would STILL act on against `toLocationId`.
+         *
+         * One derivation, two consumers: it is the media lane's denominator (the
+         * **M** the footage lane gets from the ledger census — D295) and it is the
+         * residue behind "drain remaining". Deriving them separately is how "N of M"
+         * ends up comparing two different populations.
+         *
+         * `null` means the count could not be taken; it is never zero-filled,
+         * because a zero here reads as "nothing left to move".
+         */
+        readonly countRelocatableMedia: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            toLocationId: z.ZodString;
+            mode: z.ZodOptional<z.ZodEnum<{
+                move: "move";
+                seal: "seal";
+                gallery: "gallery";
+            }>>;
+        }, z.core.$strip>, z.ZodNullable<z.ZodObject<{
+            rows: z.ZodNumber;
+        }, z.core.$strip>>, "query">;
         /** Every relocate job this addon knows about, newest first (in RAM: the
          *  move is resumable, so a lost list costs nothing but the display). */
         readonly listRelocateMediaJobs: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodReadonly<z.ZodArray<z.ZodObject<{
@@ -2482,6 +2522,7 @@ export declare const pipelineAnalyticsCapability: {
             filesMoved: z.ZodNumber;
             bytesMoved: z.ZodNumber;
             filesTotal: z.ZodNullable<z.ZodNumber>;
+            rowsReconciled: z.ZodOptional<z.ZodNumber>;
             startedAt: z.ZodNumber;
             finishedAt: z.ZodNullable<z.ZodNumber>;
             error: z.ZodNullable<z.ZodString>;

package/dist/capabilities/recording.cap.d.ts

@@ -665,6 +665,7 @@ export declare const recordingCapability: {
             filesMoved: z.ZodNumber;
             bytesMoved: z.ZodNumber;
             filesTotal: z.ZodNullable<z.ZodNumber>;
+            rowsReconciled: z.ZodOptional<z.ZodNumber>;
             startedAt: z.ZodNumber;
             finishedAt: z.ZodNullable<z.ZodNumber>;
             error: z.ZodNullable<z.ZodString>;
@@ -714,10 +715,31 @@ export declare const recordingCapability: {
             filesMoved: z.ZodNumber;
             bytesMoved: z.ZodNumber;
             filesTotal: z.ZodNullable<z.ZodNumber>;
+            rowsReconciled: z.ZodOptional<z.ZodNumber>;
             startedAt: z.ZodNumber;
             finishedAt: z.ZodNullable<z.ZodNumber>;
             error: z.ZodNullable<z.ZodString>;
         }, z.core.$strip>>>, "query">;
+        /**
+         * What a location STILL holds, asked of the durable hour ledger.
+         *
+         * The number behind "drain remaining": segments and bytes that would still
+         * have to move off `fromLocationId`. It is a ledger aggregate — the archive
+         * — because the resident index is not the archive (D295), and a drain sized
+         * off the index is exactly what reported `done` over 80.3 GB on 2026-08-29.
+         * `null` means the archive could not be asked (no ledger on this node, or
+         * the aggregate failed) and is never conflated with an empty source.
+         */
+        readonly getRelocateResidue: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            fromLocationId: z.ZodString;
+            footageClass: z.ZodOptional<z.ZodEnum<{
+                recordings: "recordings";
+                recordingsLow: "recordingsLow";
+            }>>;
+        }, z.core.$strip>, z.ZodNullable<z.ZodObject<{
+            segments: z.ZodNumber;
+            bytes: z.ZodNumber;
+        }, z.core.$strip>>, "query">;
         /** Cancel a running or queued relocate job. A queued job never runs. */
         readonly cancelRelocateJob: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             jobId: z.ZodString;

package/dist/capabilities/storage-migration.cap.d.ts

@@ -129,6 +129,14 @@ export declare const storageMigrationCapability: {
                     cancelled: "cancelled";
                 }>>;
                 error: z.ZodNullable<z.ZodString>;
+                progress: z.ZodNullable<z.ZodObject<{
+                    filesMoved: z.ZodNumber;
+                    filesTotal: z.ZodNullable<z.ZodNumber>;
+                    bytesMoved: z.ZodNumber;
+                    rowsReconciled: z.ZodOptional<z.ZodNumber>;
+                    startedAt: z.ZodNumber;
+                    observedAt: z.ZodNumber;
+                }, z.core.$strip>>;
             }, z.core.$strip>>;
             pauseLeaseId: z.ZodNullable<z.ZodString>;
             pausedParticipants: z.ZodArray<z.ZodEnum<{
@@ -148,6 +156,83 @@ export declare const storageMigrationCapability: {
         }, z.core.$strip>, z.ZodObject<{
             cancelled: z.ZodBoolean;
         }, z.core.$strip>, "mutation">;
+        /**
+         * Every mover running RIGHT NOW, in both lanes, with its counters.
+         *
+         * `status` covers a migration's own moves — the coordinator folds their
+         * progress onto the durable job record it is already polling. This covers
+         * the other case, and it is not hypothetical: a drain armed straight against
+         * `recording.relocateFootage` (the only path that existed before
+         * {@link drain}) has no job to fold into and would otherwise be invisible.
+         */
+        readonly movers: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            lane: z.ZodEnum<{
+                media: "media";
+                footage: "footage";
+            }>;
+            job: z.ZodObject<{
+                jobId: z.ZodString;
+                state: z.ZodEnum<{
+                    failed: "failed";
+                    running: "running";
+                    queued: "queued";
+                    done: "done";
+                    cancelled: "cancelled";
+                }>;
+                fromLocationId: z.ZodString;
+                toLocationId: z.ZodString;
+                deviceId: z.ZodNullable<z.ZodNumber>;
+                entities: z.ZodArray<z.ZodString>;
+                filesMoved: z.ZodNumber;
+                bytesMoved: z.ZodNumber;
+                filesTotal: z.ZodNullable<z.ZodNumber>;
+                rowsReconciled: z.ZodOptional<z.ZodNumber>;
+                startedAt: z.ZodNumber;
+                finishedAt: z.ZodNullable<z.ZodNumber>;
+                error: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>;
+            migrationJobId: z.ZodNullable<z.ZodString>;
+            observedAt: z.ZodNumber;
+        }, z.core.$strip>>>, import("./capability-definition.js").CapabilityMethodKind>;
+        /**
+         * What each class's SOURCE still holds, from the archive — never from the
+         * resident index (D295). Only classes with something left (or something
+         * unknown) are listed, so an empty list means there is nothing to drain and
+         * the UI has no honest button to offer.
+         */
+        readonly residue: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            storageClass: z.ZodEnum<{
+                recordings: "recordings";
+                recordingsLow: "recordingsLow";
+                eventMedia: "eventMedia";
+                backups: "backups";
+                galleryMedia: "galleryMedia";
+            }>;
+            fromLocationId: z.ZodString;
+            toLocationId: z.ZodString;
+            items: z.ZodNullable<z.ZodNumber>;
+            bytes: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strip>>>, import("./capability-definition.js").CapabilityMethodKind>;
+        /**
+         * Run the drain half alone, on a class whose default has ALREADY moved.
+         *
+         * It never repoints anything, which is what lets `start` keep refusing a
+         * destination that is already the default: the two verbs cannot be confused
+         * for one another, and no operator can re-repoint a migrated class through
+         * this door.
+         */
+        readonly drain: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            classes: z.ZodArray<z.ZodEnum<{
+                recordings: "recordings";
+                recordingsLow: "recordingsLow";
+                eventMedia: "eventMedia";
+                backups: "backups";
+                galleryMedia: "galleryMedia";
+            }>>;
+            throttleMbps: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>, z.ZodObject<{
+            jobId: z.ZodString;
+        }, z.core.$strip>, "mutation">;
     };
 };
 export type IStorageMigrationProvider = InferProvider<typeof storageMigrationCapability>;

package/dist/capabilities/storage.cap.d.ts

@@ -131,6 +131,10 @@ export declare const storageCapability: {
                 single: "single";
                 multi: "multi";
             }>;
+            access: z.ZodOptional<z.ZodEnum<{
+                "local-path": "local-path";
+                "cap-mediated": "cap-mediated";
+            }>>;
             defaultsTo: z.ZodOptional<z.ZodString>;
             defaultRoot: z.ZodOptional<z.ZodEnum<{
                 data: "data";

package/dist/capabilities/vector-store.cap.d.ts

@@ -5,12 +5,38 @@ import { type InferProvider } from './capability-definition.js';
  *
  * ## Why this is a capability and not a helper
  *
- * Six stores in `addon-post-analysis` already hold vectors — object CLIP, face,
- * plate, vehicle, identity, and the event store's derivatives — and every one of
- * them keeps its vectors in a `JSON` settings-store column and ranks them by
- * brute-force cosine in JS. Measured on the live hub that costs ~11.7 KB per row
- * (512 floats as TEXT, `JSON.parse`d on every search) and made semantic search
- * load 5,000 rows before ranking anything.
+ * This capability was introduced with the claim that SIX stores in
+ * `addon-post-analysis` held vectors in a `JSON` settings-store column — object
+ * CLIP, face, plate, vehicle, identity, and the event store's derivatives. That
+ * claim was never true, and leaving it here made five stores look like pending
+ * work when three of them have no vector at all. Counted column by column on
+ * 2026-08-30, exactly THREE ever held one:
+ *
+ *  - `object-clip`      — 512-dim CLIP image embedding, migrated 2026-08-06.
+ *  - `faces.embedding`  — 512-dim ArcFace face embedding, migrated 2026-08-30.
+ *  - `identity-samples.embedding` — the same ArcFace vector for an ENROLLED
+ *    face, migrated 2026-08-30 into its OWN index (see below).
+ *
+ * `plates` and `vehicle-samples` store a plate STRING and a score; `vehicles`
+ * and `identities` store a name; the event store stores no derivative vector.
+ * They are not migration candidates and never were.
+ *
+ * Measured on the live hub the JSON encoding cost ~11.7 KB per row (512 floats
+ * as TEXT, `JSON.parse`d on every search) and made semantic search load 5,000
+ * rows before ranking anything.
+ *
+ * ## One index per COMPARISON, never per encoder
+ *
+ * `faces` and `identity-samples` hold the same 512 ArcFace dims from the same
+ * model, and they still get two indexes. An index is a set of things that are
+ * ranked against each other and that live and die together, and these two are
+ * neither: a `faces` row is TRACK-OWNED and cascades away with its track under
+ * a per-camera capacity cap, an `identity-samples` row is retention-EXEMPT
+ * forever and is the gallery every recognition ranks against. One index would
+ * mean every gallery load and every reconcile carried a filter whose failure
+ * mode is either ranking a candidate against itself or reclaiming an enrolled
+ * person's only sample. The dimension they share is not a reason to share an
+ * index; the question they answer is, and it differs.
  *
  * The fix is not a faster loop, it is a different backend — and the backend
  * should be replaceable without touching six callers. So: a singleton
@@ -114,6 +140,7 @@ export declare const VectorQueryResultSchema: z.ZodObject<{
     }, z.core.$strip>>;
     scanned: z.ZodNumber;
     truncated: z.ZodBoolean;
+    effectiveTopK: z.ZodNumber;
 }, z.core.$strip>;
 export declare const VectorDeleteInputSchema: z.ZodObject<{
     index: z.ZodString;
@@ -149,6 +176,62 @@ export declare const VectorGetResultSchema: z.ZodObject<{
         metadata: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
+/**
+ * Ids to read back WITH their vectors.
+ *
+ * The sibling of {@link VectorGetResultSchema}, and deliberately a separate
+ * method rather than a flag on it: `getByIds` promises no vectors and its one
+ * caller depends on that promise. This one promises the opposite.
+ *
+ * It exists because a store cannot put its vectors here otherwise. An ArcFace
+ * gallery is ranked IN PROCESS, per detection, against every enrolled sample —
+ * a per-face cross-process KNN would be a network round trip inside the
+ * recognition loop. So the gallery is loaded once and held in RAM, and loading
+ * it requires the index to hand the floats back. Without this method the only
+ * way to keep a readable vector is a JSON column, which is the thing this
+ * capability exists to delete.
+ *
+ * BOUNDED BY THE CALLER: ids are named, never "everything". Enumerating an
+ * index is {@link VectorScanInputSchema}'s job, and it returns no vectors.
+ */
+export declare const VectorFetchInputSchema: z.ZodObject<{
+    index: z.ZodString;
+    ids: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export declare const VectorFetchResultSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        vector: z.ZodString;
+        metadata: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * ENUMERATE an index: one page of rows in a stable order, no ranking.
+ *
+ * A reconcile does not want the nearest rows, it wants ALL of them, and asking
+ * a KNN for "all" is the wrong question twice over. It hits the backend's `k`
+ * ceiling — 4,096 on sqlite-vec against a 22,128-row index — and it needs a
+ * probe vector it does not have, so the audit passed a ZERO vector whose cosine
+ * distance to every row is degenerate. `examined: 4096` then read as "we
+ * looked" for as long as anyone cared to read it.
+ *
+ * This is the primitive that question actually needs: a bounded page, ordered
+ * by the backend's own row order, costing no distance computation at all.
+ * Vectors are NOT returned — an enumeration that shipped 2 KB per row would be
+ * the full-table read this capability was built to stop.
+ */
+export declare const VectorScanInputSchema: z.ZodObject<{
+    index: z.ZodString;
+    cursor: z.ZodDefault<z.ZodNumber>;
+    limit: z.ZodNumber;
+}, z.core.$strip>;
+export declare const VectorScanResultSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        metadata: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strip>>;
+    nextCursor: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strip>;
 export declare const VectorStatsInputSchema: z.ZodObject<{
     index: z.ZodString;
 }, z.core.$strip>;
@@ -216,6 +299,7 @@ export declare const vectorStoreCapability: {
             }, z.core.$strip>>;
             scanned: z.ZodNumber;
             truncated: z.ZodBoolean;
+            effectiveTopK: z.ZodNumber;
         }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
         /** Metadata by id, no vectors — see {@link VectorGetResultSchema}. */
         readonly getByIds: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
@@ -227,6 +311,29 @@ export declare const vectorStoreCapability: {
                 metadata: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
             }, z.core.$strip>>;
         }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
+        /** Metadata AND vectors, by named id — see {@link VectorFetchInputSchema}. */
+        readonly fetchByIds: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            index: z.ZodString;
+            ids: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>, z.ZodObject<{
+            items: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                vector: z.ZodString;
+                metadata: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
+        /** One page of the whole index, unranked — see {@link VectorScanInputSchema}. */
+        readonly scan: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            index: z.ZodString;
+            cursor: z.ZodDefault<z.ZodNumber>;
+            limit: z.ZodNumber;
+        }, z.core.$strip>, z.ZodObject<{
+            items: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                metadata: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+            }, z.core.$strip>>;
+            nextCursor: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
         readonly deleteByIds: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             index: z.ZodString;
             ids: z.ZodArray<z.ZodString>;

package/dist/device/system-mirror.d.ts

@@ -57,6 +57,13 @@ export interface SystemMirrorApi extends SliceHandleApi {
         /**
          * Whole-fleet binding dump. WARM BOOT ONLY — 903 ms and 373 KB on a
          * 524-device hub. Anything on the event path uses `getBindings`.
+         *
+         * `init` gives this 15 s, and on 2026-08-30 it took longer than 240 s on a
+         * 1 019-device hub: the server-side resolver read the wrapper-activation
+         * blob once PER DEVICE, so answering cost 1 020 settings-door RPCs. Fixed
+         * in `device-bindings-store.ts` (two reads for the whole fleet). Worth
+         * knowing here because the symptom is always this timeout, and the cause
+         * is never in this file.
          */
         readonly getAllBindings: {
             query(input: Record<string, never>): Promise<ReadonlyArray<DeviceBinding>>;

package/dist/generated/addon-api.d.ts

@@ -5128,6 +5128,13 @@ export type AppRouter = TrpcCoreRouter<{
             output: z.infer<typeof pipelineAnalyticsCapability.methods.countUnstampedEventMedia.output>;
             meta: object;
         }>;
+        countRelocatableMedia: TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof pipelineAnalyticsCapability.methods.countRelocatableMedia.input>;
+            output: z.infer<typeof pipelineAnalyticsCapability.methods.countRelocatableMedia.output>;
+            meta: object;
+        }>;
         listRelocateMediaJobs: TRPCQueryProcedure<{
             input: {
                 [x: string]: unknown;
@@ -6578,6 +6585,13 @@ export type AppRouter = TrpcCoreRouter<{
             output: z.infer<typeof recordingCapability.methods.listRelocateJobs.output>;
             meta: object;
         }>;
+        getRelocateResidue: TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof recordingCapability.methods.getRelocateResidue.input>;
+            output: z.infer<typeof recordingCapability.methods.getRelocateResidue.output>;
+            meta: object;
+        }>;
         cancelRelocateJob: TRPCMutationProcedure<{
             input: {
                 [x: string]: unknown;
@@ -7252,6 +7266,27 @@ export type AppRouter = TrpcCoreRouter<{
             output: z.infer<typeof storageMigrationCapability.methods.cancel.output>;
             meta: object;
         }>;
+        movers: TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof storageMigrationCapability.methods.movers.input>;
+            output: z.infer<typeof storageMigrationCapability.methods.movers.output>;
+            meta: object;
+        }>;
+        residue: TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof storageMigrationCapability.methods.residue.input>;
+            output: z.infer<typeof storageMigrationCapability.methods.residue.output>;
+            meta: object;
+        }>;
+        drain: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof storageMigrationCapability.methods.drain.input>;
+            output: z.infer<typeof storageMigrationCapability.methods.drain.output>;
+            meta: object;
+        }>;
     }>>;
     storageProvider: TRPCBuiltRouter<{
         ctx: TrpcContext;
@@ -8403,6 +8438,20 @@ export type AppRouter = TrpcCoreRouter<{
             output: z.infer<typeof vectorStoreCapability.methods.getByIds.output>;
             meta: object;
         }>;
+        fetchByIds: TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof vectorStoreCapability.methods.fetchByIds.input>;
+            output: z.infer<typeof vectorStoreCapability.methods.fetchByIds.output>;
+            meta: object;
+        }>;
+        scan: TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof vectorStoreCapability.methods.scan.input>;
+            output: z.infer<typeof vectorStoreCapability.methods.scan.output>;
+            meta: object;
+        }>;
         deleteByIds: TRPCMutationProcedure<{
             input: {
                 [x: string]: unknown;

package/dist/generated/cap-input-defaults.d.ts

@@ -11,7 +11,7 @@
  * Plain data, zero Zod: a forked runner must not import the schema barrel
  * (~144MB RSS per runner — D28).
  *
- * Coverage: 24 caps, 53 methods with defaults.
+ * Coverage: 24 caps, 54 methods with defaults.
  */
 export declare const CAP_INPUT_DEFAULTS: Readonly<Record<string, Readonly<Record<string, Readonly<Record<string, unknown>>>>>>;
 /**

package/dist/generated/method-access-map.d.ts

@@ -6,7 +6,7 @@
  * scope+access check inside `protectedProcedure` (see
  * `server/backend/src/api/trpc/trpc.middleware.ts`).
  *
- * Coverage: 979 method paths across 126 capabilities.
+ * Coverage: 986 method paths across 126 capabilities.
  */
 import type { CapabilityMethodAccess } from '../capabilities/capability-definition.js';
 export interface MethodAccessRecord {

package/dist/generated/system-proxy.d.ts

@@ -87,12 +87,12 @@ export interface SystemProxy {
     readonly pipelineOrchestrator: Pick<InferProvider<typeof pipelineOrchestratorCapability>, 'pauseForStorageMigration' | 'resumeForStorageMigration' | 'rebalance' | 'getPipelineAssignments' | 'getAgentLoad' | 'getGlobalMetrics' | 'getCapabilityBindings' | 'setCapabilityBinding' | 'getIngestOwner' | 'getAudioNodeLoad' | 'getAgentSettings' | 'listAgentSettings' | 'removeAgentSettings' | 'setAgentMaxCameras' | 'setAgentDetectWeight' | 'setAgentCapabilities' | 'setAgentReachableHost' | 'setAgentInferenceDevices' | 'getNodeInferenceDevices' | 'resetNodePipelineDefaults' | 'getCameraStatuses' | 'reconcileFromDisk' | 'getReconcileFromDiskStatus' | 'listTemplates' | 'saveTemplate' | 'updateTemplate' | 'deleteTemplate'>;
     readonly pipelineRunner: Pick<InferProvider<typeof pipelineRunnerCapability>, 'attachCamera' | 'reportMotion' | 'getLocalLoad' | 'getLocalMetrics' | 'getAllCameraMetrics' | 'getLocalCameras' | 'getNativeCrop' | 'runStatelessStep'>;
     readonly plateGallery: Pick<InferProvider<typeof plateGalleryCapability>, 'getPlateMedia' | 'searchPlates' | 'suggestPlateClusters' | 'correctPlateText' | 'deletePlate' | 'listVehicles' | 'createVehicle' | 'renameVehicle' | 'deleteVehicle' | 'listVehicleSamples' | 'removeVehicleSample' | 'assignPlate' | 'unassignPlate' | 'assignPlates' | 'unassignPlates'>;
-    readonly recording: Pick<InferProvider<typeof recordingCapability>, 'getStorageUsage' | 'listOpsLog' | 'pauseForStorageMigration' | 'resumeForStorageMigration' | 'refreshStorageLocationsForMigration' | 'startStorageMigrationMove' | 'getStorageMigrationMoveStatus' | 'cancelStorageMigrationMove' | 'relocateFootage' | 'listRelocateJobs' | 'cancelRelocateJob' | 'planStorageRebalance' | 'startStorageRebalance'>;
+    readonly recording: Pick<InferProvider<typeof recordingCapability>, 'getStorageUsage' | 'listOpsLog' | 'pauseForStorageMigration' | 'resumeForStorageMigration' | 'refreshStorageLocationsForMigration' | 'startStorageMigrationMove' | 'getStorageMigrationMoveStatus' | 'cancelStorageMigrationMove' | 'relocateFootage' | 'listRelocateJobs' | 'getRelocateResidue' | 'cancelRelocateJob' | 'planStorageRebalance' | 'startStorageRebalance'>;
     readonly recordingExport: Pick<InferProvider<typeof recordingExportCapability>, 'createExport' | 'getExport' | 'cancelExport' | 'deleteExport' | 'getDownloadUrl' | 'readExportBytes'>;
     readonly serverManagement: Pick<InferProvider<typeof serverManagementCapability>, 'getServerPackageStatus' | 'checkServerUpdate' | 'applyServerUpdate' | 'rollbackServerUpdate' | 'restartServer'>;
     readonly settingsStore: Pick<InferProvider<typeof settingsStoreCapability>, 'get' | 'set' | 'query' | 'insert' | 'insertMany' | 'update' | 'delete' | 'deleteWhere' | 'updateWhere' | 'count' | 'aggregate' | 'histogram' | 'isEmpty' | 'declareCollection'>;
     readonly storage: Pick<InferProvider<typeof storageCapability>, 'resolve' | 'write' | 'read' | 'exists' | 'list' | 'delete' | 'getAvailableSpace' | 'beginUpload' | 'writeChunk' | 'finalizeUpload' | 'abortUpload' | 'beginDownload' | 'readChunk' | 'endDownload' | 'listLocations' | 'getDefaultLocation' | 'listLocationDeclarations' | 'upsertLocation' | 'deleteLocation' | 'testLocation' | 'listProviders' | 'testConfig'>;
-    readonly storageMigration: Pick<InferProvider<typeof storageMigrationCapability>, 'plan' | 'start' | 'status' | 'cancel'>;
+    readonly storageMigration: Pick<InferProvider<typeof storageMigrationCapability>, 'plan' | 'start' | 'status' | 'cancel' | 'movers' | 'residue' | 'drain'>;
     readonly streamBroker: Pick<InferProvider<typeof streamBrokerCapability>, 'fetchEventMedia' | 'listAllCameraStreams' | 'listAllProfileSlots' | 'getBrokerStats' | 'probeStream' | 'listClients' | 'killClient' | 'getStreamUrl' | 'getStreamWithCodec' | 'releaseStreamWithCodec' | 'acquireEgressTranscode' | 'releaseEgressTranscode' | 'subscribeAudioChunks' | 'pullAudioChunks' | 'unsubscribeAudioChunks' | 'subscribeFrames' | 'pullFrameHandles' | 'unsubscribeFrames' | 'setPreBufferDuration' | 'getPreBufferInfo' | 'getRtspPort' | 'getAllRtspEntries' | 'getRtspEntry' | 'regenerateRtspToken' | 'setRtspEnabled' | 'isRtspEnabled'>;
     readonly system: Pick<InferProvider<typeof systemCapability>, 'info' | 'health' | 'featureFlags' | 'networkAddresses' | 'getRetentionConfig' | 'setRetentionConfig' | 'forceRetentionCleanup' | 'getSiteLocation' | 'setSiteLocation' | 'detectSiteLocation' | 'getRequestCensus' | 'getLoadContributions' | 'getFailureContributions' | 'getLoggingSettings' | 'setLoggingSettings'>;
     readonly terminalSession: Pick<InferProvider<typeof terminalSessionCapability>, 'listProfiles' | 'listInstances' | 'createInstance' | 'updateInstance' | 'deleteInstance' | 'setInstanceEnabled' | 'listLegacyCameras' | 'adoptLegacyMonitor' | 'listSessions' | 'openSession' | 'resize' | 'pullOutput' | 'writeInput' | 'close'>;

package/dist/index.d.ts

@@ -38,6 +38,7 @@ export type * from './interfaces/config-port.js';
 export type * from './interfaces/config-ui.js';
 export type { HydratedFieldEntry } from './interfaces/config-ui.js';
 export { collectHydratedFieldEntries, collectHydratedFieldValues, hydrateSchema, resolveHydratedFieldValue, WELL_KNOWN_TAB_MAP, WELL_KNOWN_TABS, } from './interfaces/config-ui.js';
+export { collectSecretConfigKeys, isSecretConfigField, REDACTED_SECRET, schemaDeclaresAnyField, } from './interfaces/config-ui-secrets.js';
 export type * from './interfaces/context.js';
 export type * from './interfaces/decoder.js';
 export type * from './interfaces/detection-addon.js';
@@ -92,8 +93,8 @@ export type * from './interfaces/server-network.js';
 export type * from './interfaces/storage.js';
 export type { StorageLocation, StorageLocationRef, } from './interfaces/storage-location.js';
 export { StorageLocationRefSchema, StorageLocationSchema, StorageLocationTypeSchema, } from './interfaces/storage-location.js';
-export type { StorageLocationDeclaration } from './interfaces/storage-location-declaration.js';
-export { StorageLocationDeclarationSchema } from './interfaces/storage-location-declaration.js';
+export type { StorageAccess, StorageLocationDeclaration, } from './interfaces/storage-location-declaration.js';
+export { STORAGE_ACCESS_FALLBACK, StorageAccessSchema, StorageLocationDeclarationSchema, } from './interfaces/storage-location-declaration.js';
 export * from './interfaces/stream-broker.js';
 export type * from './interfaces/task-handler.js';
 export type { Timezone, TimezoneDstRule, Weekday } from './interfaces/timezones.js';