@camstack/types 1.2.14 → 1.2.16

package/dist/addon.d.ts

@@ -26,6 +26,8 @@ export { DisposerChain } from './disposer-chain.js';
 export { ReadinessRegistry, ReadinessTimeoutError, scopeKey, } from './readiness/readiness-registry.js';
 export { DATAPLANE_SECRET_HEADER } from './interfaces/addon-data-plane.js';
 export { expandCapMethods } from './capabilities/capability-definition.js';
+export { nodePin, readNodePin } from './cap-call-context.js';
+export { COLLECTION_ARRAY_METHODS, isCollectionArrayMethodName, } from './generated/collection-array-methods.js';
 export { deviceOpsCapability } from './capabilities/device-ops.cap.js';
 export { createDeviceProxy } from './generated/device-proxy.js';
 export { BaseAddon, normalizeAddonInitResult } from './addon/base-addon.js';

package/dist/addon.js

@@ -1,8 +1,63 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-BG8hQTA8.js");
+const require_sleep = require("./sleep-DRg9F6JJ.js");
 const require_event_category = require("./event-category-Cdyife4p.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
+//#region src/generated/collection-array-methods.ts
+/**
+* AUTO-GENERATED by scripts/generate-collection-array-methods.ts — DO NOT EDIT.
+*
+* For every COLLECTION-mode capability, the array-returning (non-subscription)
+* method names the hub fans across providers. The addon-runner uses this to
+* reproduce the hub's graceful "provider skips an unimplemented collection
+* method" behaviour (see child-cap-dispatch) WITHOUT importing the schema
+* barrel (`ALL_CAPABILITY_DEFINITIONS`), which would cost ~144MB RSS per
+* forked runner. See docs/decisions/adr-0028.md.
+*
+* Coverage: 16 collection caps, 28 array methods.
+*/
+var COLLECTION_ARRAY_METHODS = Object.freeze({
+	"addon-pages-source": ["listPages"],
+	"addon-routes": ["getRoutes"],
+	"addon-widgets-source": ["listWidgets"],
+	"broker": ["list", "listProviders"],
+	"custom-model-registry": ["listModels"],
+	"device-export": ["listExposedDevices", "listSupportedDeviceKinds"],
+	"device-provider": ["discoverDevices", "getDevices"],
+	"llm": [
+		"getDefaults",
+		"getUsage",
+		"listModelCatalog",
+		"listModels",
+		"listNodeModels",
+		"listProfileKinds",
+		"listProfiles",
+		"listRuntimeNodes"
+	],
+	"log-destination": ["query"],
+	"login-method": ["getLoginMethods"],
+	"mqtt-broker": ["listBrokers"],
+	"network-access": ["listEndpoints"],
+	"notification-output": [
+		"discoverTargets",
+		"listTargetKinds",
+		"listTargets"
+	],
+	"storage-provider": ["list"],
+	"turn-provider": ["getTurnServers"],
+	"user-passkeys": ["listPasskeys"]
+});
+/**
+* True when `method` on cap `capName` is a COLLECTION cap's array-returning
+* (non-subscription) method — the schema-free runner-side equivalent of
+* `isCollectionArrayMethod(capDefsByName.get(capName), method)`.
+*/
+function isCollectionArrayMethodName(capName, method) {
+	const methods = COLLECTION_ARRAY_METHODS[capName];
+	return methods !== void 0 && methods.includes(method);
+}
+//#endregion
 exports.BaseAddon = require_sleep.BaseAddon;
+exports.COLLECTION_ARRAY_METHODS = COLLECTION_ARRAY_METHODS;
 exports.DATAPLANE_SECRET_HEADER = require_sleep.DATAPLANE_SECRET_HEADER;
 exports.DeviceType = require_sleep.DeviceType;
 exports.DisposerChain = require_sleep.DisposerChain;
@@ -17,8 +72,11 @@ exports.deviceOpsCapability = require_sleep.deviceOpsCapability;
 exports.emitReadiness = require_sleep.emitReadiness;
 exports.errMsg = require_err_msg.errMsg;
 exports.expandCapMethods = require_sleep.expandCapMethods;
+exports.isCollectionArrayMethodName = isCollectionArrayMethodName;
+exports.nodePin = require_sleep.nodePin;
 exports.normalizeAddonInitResult = require_sleep.normalizeAddonInitResult;
 exports.parseJsonUnknown = require_sleep.parseJsonUnknown;
+exports.readNodePin = require_sleep.readNodePin;
 exports.scopeKey = require_sleep.scopeKey;
 exports.sleep = require_sleep.sleep;
 exports.viewerUiCapability = require_sleep.viewerUiCapability;

package/dist/addon.mjs

@@ -1,4 +1,58 @@
-import { A as parseJsonUnknown, D as asString, I as scopeKey, M as ReadinessRegistry, N as ReadinessTimeoutError, S as DeviceType, T as asJsonObject, a as viewerUiCapability, bt as DisposerChain, ct as BaseAddon, ft as emitReadiness, i as deviceOpsCapability, j as DATAPLANE_SECRET_HEADER, lt as normalizeAddonInitResult, m as expandCapMethods, o as adminUiCapability, s as createDeviceProxy, t as sleep } from "./sleep-DiOnzenz.mjs";
+import { A as parseJsonUnknown, Ct as DisposerChain, D as asString, F as ReadinessRegistry, I as ReadinessTimeoutError, M as nodePin, N as readNodePin, P as DATAPLANE_SECRET_HEADER, S as DeviceType, T as asJsonObject, a as viewerUiCapability, dt as BaseAddon, ft as normalizeAddonInitResult, ht as emitReadiness, i as deviceOpsCapability, m as expandCapMethods, o as adminUiCapability, s as createDeviceProxy, t as sleep, z as scopeKey } from "./sleep-C3ceNSsf.mjs";
 import { t as EventCategory } from "./event-category-BLcNejAE.mjs";
 import { t as errMsg } from "./err-msg-IQTHeDzc.mjs";
-export { BaseAddon, DATAPLANE_SECRET_HEADER, DeviceType, DisposerChain, EventCategory, ReadinessRegistry, ReadinessTimeoutError, adminUiCapability, asJsonObject, asString, createDeviceProxy, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods, normalizeAddonInitResult, parseJsonUnknown, scopeKey, sleep, viewerUiCapability };
+//#region src/generated/collection-array-methods.ts
+/**
+* AUTO-GENERATED by scripts/generate-collection-array-methods.ts — DO NOT EDIT.
+*
+* For every COLLECTION-mode capability, the array-returning (non-subscription)
+* method names the hub fans across providers. The addon-runner uses this to
+* reproduce the hub's graceful "provider skips an unimplemented collection
+* method" behaviour (see child-cap-dispatch) WITHOUT importing the schema
+* barrel (`ALL_CAPABILITY_DEFINITIONS`), which would cost ~144MB RSS per
+* forked runner. See docs/decisions/adr-0028.md.
+*
+* Coverage: 16 collection caps, 28 array methods.
+*/
+var COLLECTION_ARRAY_METHODS = Object.freeze({
+	"addon-pages-source": ["listPages"],
+	"addon-routes": ["getRoutes"],
+	"addon-widgets-source": ["listWidgets"],
+	"broker": ["list", "listProviders"],
+	"custom-model-registry": ["listModels"],
+	"device-export": ["listExposedDevices", "listSupportedDeviceKinds"],
+	"device-provider": ["discoverDevices", "getDevices"],
+	"llm": [
+		"getDefaults",
+		"getUsage",
+		"listModelCatalog",
+		"listModels",
+		"listNodeModels",
+		"listProfileKinds",
+		"listProfiles",
+		"listRuntimeNodes"
+	],
+	"log-destination": ["query"],
+	"login-method": ["getLoginMethods"],
+	"mqtt-broker": ["listBrokers"],
+	"network-access": ["listEndpoints"],
+	"notification-output": [
+		"discoverTargets",
+		"listTargetKinds",
+		"listTargets"
+	],
+	"storage-provider": ["list"],
+	"turn-provider": ["getTurnServers"],
+	"user-passkeys": ["listPasskeys"]
+});
+/**
+* True when `method` on cap `capName` is a COLLECTION cap's array-returning
+* (non-subscription) method — the schema-free runner-side equivalent of
+* `isCollectionArrayMethod(capDefsByName.get(capName), method)`.
+*/
+function isCollectionArrayMethodName(capName, method) {
+	const methods = COLLECTION_ARRAY_METHODS[capName];
+	return methods !== void 0 && methods.includes(method);
+}
+//#endregion
+export { BaseAddon, COLLECTION_ARRAY_METHODS, DATAPLANE_SECRET_HEADER, DeviceType, DisposerChain, EventCategory, ReadinessRegistry, ReadinessTimeoutError, adminUiCapability, asJsonObject, asString, createDeviceProxy, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods, isCollectionArrayMethodName, nodePin, normalizeAddonInitResult, parseJsonUnknown, readNodePin, scopeKey, sleep, viewerUiCapability };

package/dist/capabilities/backup.cap.d.ts

@@ -111,6 +111,32 @@ declare const LocationStatSchema: z.ZodObject<{
     fileCount: z.ZodNumber;
     present: z.ZodBoolean;
 }, z.core.$strip>;
+/**
+ * A backup schedule — the N:M "entry" that binds one cron cadence to a
+ * SET of destination locations. Supersedes the per-location cron on
+ * `BackupDestinationPolicy`: an operator creates a schedule, picks the
+ * `backups` locations it should write to, and the orchestrator fans a
+ * single archive out to all of them when the cron fires.
+ *
+ * `retentionCount` is per-schedule (D-decision 2026-07-28): every
+ * location targeted by this schedule keeps this many archives from
+ * this schedule's runs.
+ *
+ * `dataSources` optionally narrows which top-level state locations
+ * (db, addons, tls, …) are archived; omitted = the orchestrator's
+ * default full set.
+ */
+declare const BackupScheduleSchema: z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    cron: z.ZodString;
+    enabled: z.ZodBoolean;
+    locationIds: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    retentionCount: z.ZodNumber;
+    dataSources: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    lastRunAt: z.ZodOptional<z.ZodNumber>;
+    nextRunAt: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
 /**
  * backup — singleton capability for backup management.
  *
@@ -155,6 +181,7 @@ export declare const backupCapability: {
             destinations: z.ZodOptional<z.ZodArray<z.ZodString>>;
             locations: z.ZodOptional<z.ZodArray<z.ZodString>>;
             label: z.ZodOptional<z.ZodString>;
+            retentionCount: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strip>>, z.ZodReadonly<z.ZodArray<z.ZodObject<{
             id: z.ZodString;
             destinationId: z.ZodOptional<z.ZodString>;
@@ -262,7 +289,52 @@ export declare const backupCapability: {
             error: z.ZodOptional<z.ZodString>;
             nextRuns: z.ZodReadonly<z.ZodArray<z.ZodNumber>>;
         }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
+        /**
+         * List every backup schedule (the N:M entries), each with its
+         * computed `nextRunAt`. Powers the Schedules section of the
+         * admin-UI Backups page.
+         */
+        readonly listSchedules: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            label: z.ZodString;
+            cron: z.ZodString;
+            enabled: z.ZodBoolean;
+            locationIds: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+            retentionCount: z.ZodNumber;
+            dataSources: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+            lastRunAt: z.ZodOptional<z.ZodNumber>;
+            nextRunAt: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>>, import("./capability-definition.js").CapabilityMethodKind>;
+        /**
+         * Create or replace a schedule. An empty / absent `id` mints a new
+         * one; a present `id` replaces in place. `cron` is validated
+         * server-side; `locationIds` must reference existing `backups`
+         * locations (unknown ids are dropped with a warning).
+         */
+        readonly upsertSchedule: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            id: z.ZodOptional<z.ZodString>;
+            label: z.ZodString;
+            cron: z.ZodString;
+            enabled: z.ZodBoolean;
+            locationIds: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+            retentionCount: z.ZodNumber;
+            dataSources: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+        }, z.core.$strip>, z.ZodObject<{
+            id: z.ZodString;
+            label: z.ZodString;
+            cron: z.ZodString;
+            enabled: z.ZodBoolean;
+            locationIds: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+            retentionCount: z.ZodNumber;
+            dataSources: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+            lastRunAt: z.ZodOptional<z.ZodNumber>;
+            nextRunAt: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>, "mutation">;
+        /** Delete a schedule by id. Does not touch the target locations. */
+        readonly deleteSchedule: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            id: z.ZodString;
+        }, z.core.$strip>, z.ZodVoid, "mutation">;
     };
 };
 export type IBackupProvider = InferProvider<typeof backupCapability>;
-export { BackupEntrySchema, BackupSubDestinationInfoSchema, BackupDestinationInfoSchema, BackupArchiveEntrySchema, ArchiveEntrySchema, ArchiveManifestSchema, LocationStatSchema, };
+export { ArchiveEntrySchema, ArchiveManifestSchema, BackupArchiveEntrySchema, BackupDestinationInfoSchema, BackupEntrySchema, BackupScheduleSchema, BackupSubDestinationInfoSchema, LocationStatSchema, };

package/dist/capabilities/storage.cap.d.ts

@@ -125,6 +125,7 @@ export declare const storageCapability: {
             defaultRoot: z.ZodOptional<z.ZodEnum<{
                 data: "data";
                 media: "media";
+                backup: "backup";
             }>>;
         }, z.core.$strip>>>, import("./capability-definition.js").CapabilityMethodKind>;
         readonly upsertLocation: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{

package/dist/generated/addon-api.d.ts

@@ -2296,6 +2296,7 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
                 destinations?: string[] | undefined;
                 locations?: string[] | undefined;
                 label?: string | undefined;
+                retentionCount?: number | undefined;
             } | undefined;
             output: readonly {
                 id: string;
@@ -2414,6 +2415,55 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             };
             meta: object;
         }>;
+        listSchedules: import("@trpc/server").TRPCQueryProcedure<{
+            input: {
+                nodeId?: string | undefined;
+            } | undefined;
+            output: readonly {
+                id: string;
+                label: string;
+                cron: string;
+                enabled: boolean;
+                locationIds: readonly string[];
+                retentionCount: number;
+                dataSources?: readonly string[] | undefined;
+                lastRunAt?: number | undefined;
+                nextRunAt?: number | undefined;
+            }[];
+            meta: object;
+        }>;
+        upsertSchedule: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+                label: string;
+                cron: string;
+                enabled: boolean;
+                locationIds: readonly string[];
+                retentionCount: number;
+                id?: string | undefined;
+                dataSources?: readonly string[] | undefined;
+            };
+            output: {
+                id: string;
+                label: string;
+                cron: string;
+                enabled: boolean;
+                locationIds: readonly string[];
+                retentionCount: number;
+                dataSources?: readonly string[] | undefined;
+                lastRunAt?: number | undefined;
+                nextRunAt?: number | undefined;
+            };
+            meta: object;
+        }>;
+        deleteSchedule: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+                id: string;
+            };
+            output: void;
+            meta: object;
+        }>;
     }>>;
     battery: import("@trpc/server").TRPCBuiltRouter<{
         ctx: TrpcContext;
@@ -14761,7 +14811,7 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
                 cardinality: "single" | "multi";
                 description?: string | undefined;
                 defaultsTo?: string | undefined;
-                defaultRoot?: "data" | "media" | undefined;
+                defaultRoot?: "backup" | "data" | "media" | undefined;
             }[];
             meta: object;
         }>;
@@ -19721,6 +19771,7 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
                 destinations?: string[] | undefined;
                 locations?: string[] | undefined;
                 label?: string | undefined;
+                retentionCount?: number | undefined;
             } | undefined;
             output: readonly {
                 id: string;
@@ -19839,6 +19890,55 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
             };
             meta: object;
         }>;
+        listSchedules: import("@trpc/server").TRPCQueryProcedure<{
+            input: {
+                nodeId?: string | undefined;
+            } | undefined;
+            output: readonly {
+                id: string;
+                label: string;
+                cron: string;
+                enabled: boolean;
+                locationIds: readonly string[];
+                retentionCount: number;
+                dataSources?: readonly string[] | undefined;
+                lastRunAt?: number | undefined;
+                nextRunAt?: number | undefined;
+            }[];
+            meta: object;
+        }>;
+        upsertSchedule: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+                label: string;
+                cron: string;
+                enabled: boolean;
+                locationIds: readonly string[];
+                retentionCount: number;
+                id?: string | undefined;
+                dataSources?: readonly string[] | undefined;
+            };
+            output: {
+                id: string;
+                label: string;
+                cron: string;
+                enabled: boolean;
+                locationIds: readonly string[];
+                retentionCount: number;
+                dataSources?: readonly string[] | undefined;
+                lastRunAt?: number | undefined;
+                nextRunAt?: number | undefined;
+            };
+            meta: object;
+        }>;
+        deleteSchedule: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+                id: string;
+            };
+            output: void;
+            meta: object;
+        }>;
     }>>;
     battery: import("@trpc/server").TRPCBuiltRouter<{
         ctx: TrpcContext;
@@ -32186,7 +32286,7 @@ export type AppRouter = import("@trpc/server/unstable-core-do-not-import").Route
                 cardinality: "single" | "multi";
                 description?: string | undefined;
                 defaultsTo?: string | undefined;
-                defaultRoot?: "data" | "media" | undefined;
+                defaultRoot?: "backup" | "data" | "media" | undefined;
             }[];
             meta: object;
         }>;

package/dist/generated/collection-array-methods.d.ts

@@ -0,0 +1,19 @@
+/**
+ * AUTO-GENERATED by scripts/generate-collection-array-methods.ts — DO NOT EDIT.
+ *
+ * For every COLLECTION-mode capability, the array-returning (non-subscription)
+ * method names the hub fans across providers. The addon-runner uses this to
+ * reproduce the hub's graceful "provider skips an unimplemented collection
+ * method" behaviour (see child-cap-dispatch) WITHOUT importing the schema
+ * barrel (`ALL_CAPABILITY_DEFINITIONS`), which would cost ~144MB RSS per
+ * forked runner. See docs/decisions/adr-0028.md.
+ *
+ * Coverage: 16 collection caps, 28 array methods.
+ */
+export declare const COLLECTION_ARRAY_METHODS: Readonly<Record<string, readonly string[]>>;
+/**
+ * True when `method` on cap `capName` is a COLLECTION cap's array-returning
+ * (non-subscription) method — the schema-free runner-side equivalent of
+ * `isCollectionArrayMethod(capDefsByName.get(capName), method)`.
+ */
+export declare function isCollectionArrayMethodName(capName: string, method: string): boolean;

package/dist/generated/method-access-map.d.ts

@@ -6,7 +6,7 @@
  * scope+access check inside `protectedProcedure` (see
  * `server/backend/src/api/trpc/trpc.middleware.ts`).
  *
- * Coverage: 811 method paths across 117 capabilities.
+ * Coverage: 814 method paths across 117 capabilities.
  */
 import type { CapabilityMethodAccess } from '../capabilities/capability-definition.js';
 export interface MethodAccessRecord {

package/dist/generated/system-proxy.d.ts

@@ -58,7 +58,7 @@ export interface SystemProxy {
     readonly alerts: Pick<InferProvider<typeof alertsCapability>, 'emit' | 'update' | 'list' | 'getUnreadCount' | 'markRead' | 'markAllRead' | 'dismiss'>;
     readonly audioAnalyzer: Pick<InferProvider<typeof audioAnalyzerCapability>, 'analyseChunk' | 'classify' | 'isReady' | 'dispose' | 'reprobeAudioEngine'>;
     readonly audioCodec: Pick<InferProvider<typeof audioCodecCapability>, 'listSupportedCodecs' | 'canHandle' | 'createDecodeSession' | 'createEncodeSession' | 'closeSession' | 'pushEncodedFrame' | 'pullPcm' | 'pushPcm' | 'pullEncoded' | 'flushEncode' | 'listActiveSessions'>;
-    readonly backup: Pick<InferProvider<typeof backupCapability>, 'listDestinations' | 'trigger' | 'list' | 'listLocations' | 'getEntries' | 'restore' | 'delete' | 'listArchives' | 'upsertDestinationPolicy' | 'previewSchedule'>;
+    readonly backup: Pick<InferProvider<typeof backupCapability>, 'listDestinations' | 'trigger' | 'list' | 'listLocations' | 'getEntries' | 'restore' | 'delete' | 'listArchives' | 'upsertDestinationPolicy' | 'previewSchedule' | 'listSchedules' | 'upsertSchedule' | 'deleteSchedule'>;
     readonly broker: Pick<InferProvider<typeof brokerCapability>, 'list' | 'get' | 'listProviders' | 'add' | 'remove' | 'testConnection' | 'getSettings' | 'setSettings' | 'getBrokerConfig' | 'getSettingsSchema' | 'testSettings' | 'publish' | 'subscribe' | 'unsubscribe' | 'getState' | 'getStatus'>;
     readonly decoder: Pick<InferProvider<typeof decoderCapability>, 'supportsCodec' | 'getInfo' | 'createSession' | 'destroySession' | 'pushPacket' | 'openStream' | 'pullFrames' | 'pullHandles' | 'getFrame' | 'getShmStats' | 'updateConfig' | 'getStats' | 'listActiveSessions' | 'reprobeHwaccel'>;
     readonly deviceAdoption: Pick<InferProvider<typeof deviceAdoptionCapability>, 'listCandidateFilters' | 'listCandidates' | 'getCandidate' | 'refresh' | 'adopt' | 'release' | 'resync'>;

package/dist/index.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-BG8hQTA8.js");
+const require_sleep = require("./sleep-DRg9F6JJ.js");
 const require_event_category = require("./event-category-Cdyife4p.js");
 const require_enums = require("./enums.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
@@ -1260,16 +1260,23 @@ var StorageLocationDeclarationSchema = zod.z.object({
 	* Which node root the seeded `<id>:default` instance is placed under on a
 	* FRESH install:
 	* - `'data'` (default) — the node's data dir (`CAMSTACK_DATA` / boot dir),
-	*   the appData volume. Right for small/durable data (backups, logs, models).
+	*   the appData volume. Right for small/durable data (logs, models).
 	* - `'media'` — the dedicated media volume (`CAMSTACK_MEDIA_ROOT`) when that
 	*   env is set, else falls back to the data root. Right for bulky, hot media
 	*   (recordings, event media) that should stay off the appData disk.
+	* - `'backup'` — the dedicated backup volume (`CAMSTACK_BACKUP_ROOT`, default
+	*   `/backups` in the image) so archives live on their own mount rather than
+	*   filling the appData disk. Falls back to the data root when unset.
 	*
 	* Only affects the seeded default's `basePath`; operators can repoint any
 	* location afterwards, and a `defaultsTo` slot inherits its parent's root
 	* regardless of this field. Absent (the common case) is treated as `'data'`.
 	*/
-	defaultRoot: zod.z.enum(["data", "media"]).optional()
+	defaultRoot: zod.z.enum([
+		"data",
+		"media",
+		"backup"
+	]).optional()
 });
 //#endregion
 //#region src/interfaces/device-capabilities/camera.ts
@@ -1704,47 +1711,6 @@ var RUNTIME_DEFAULTS = {
 	"auth.tokenExpiry": "7d"
 };
 //#endregion
-//#region src/cap-call-context.ts
-/**
-* Per-call node pinning for `ctx.api` capability calls.
-*
-* A capability call normally resolves to its DEFAULT provider — a `singleton`
-* cap resolves to the hub, a device-scoped cap to the device's owning node. To
-* query a SPECIFIC node's provider instead (e.g. a remote agent's own
-* in-process `platform-probe` hardware, which the hub cannot probe), pin the
-* call to that node.
-*
-* The nodeId rides OUT-OF-BAND in the tRPC call context (NOT in the validated
-* method args), so capability method signatures stay `nodeId`-free — node
-* targeting is a property of the CALL, not of the method. The transport lifts
-* it from `op.context` onto the `CapCallInput.nodeId` field (`ipcParentLink`),
-* and the hub parent's `onUnownedCall` passes it to the `CapRouteResolver`,
-* which classifies a pinned agent node as `agent-child-forward`
-* (`$agent-cap-fwd.forward` → the agent's in-process provider).
-*
-* Usage at a call site:
-*
-*   await api.platformProbe.getCapabilities.query(undefined, nodePin(nodeId))
-*/
-/** tRPC `op.context` key carrying a per-call node pin. */
-var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
-/**
-* Build the tRPC request options that pin a single capability call to `nodeId`.
-* Pass as the second argument to `.query(input, …)` / `.mutate(input, …)`.
-*/
-function nodePin(nodeId) {
-	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: nodeId } };
-}
-/**
-* Read a per-call node pin out of a tRPC `op.context` (transport side).
-* Returns the pinned nodeId, or `undefined` when no pin is present.
-*/
-function readNodePin(context) {
-	if (context === null || typeof context !== "object") return void 0;
-	const value = Reflect.get(context, CAP_NODE_PIN_CONTEXT_KEY);
-	return typeof value === "string" ? value : void 0;
-}
-//#endregion
 //#region src/utils/hf-url.ts
 function hfModelUrl(repo, path) {
 	return `https://huggingface.co/${repo}/resolve/main/${path}`;
@@ -14310,7 +14276,10 @@ function createSystemProxy(api) {
 			delete: (input) => dispatch("backup", "delete", "mutation", input),
 			listArchives: (input) => dispatch("backup", "listArchives", "query", input),
 			upsertDestinationPolicy: (input) => dispatch("backup", "upsertDestinationPolicy", "mutation", input),
-			previewSchedule: (input) => dispatch("backup", "previewSchedule", "query", input)
+			previewSchedule: (input) => dispatch("backup", "previewSchedule", "query", input),
+			listSchedules: (input) => dispatch("backup", "listSchedules", "query", input),
+			upsertSchedule: (input) => dispatch("backup", "upsertSchedule", "mutation", input),
+			deleteSchedule: (input) => dispatch("backup", "deleteSchedule", "mutation", input)
 		},
 		broker: {
 			list: (input) => dispatch("broker", "list", "query", input),
@@ -16342,6 +16311,41 @@ var LocationStatSchema = zod.z.object({
 	present: zod.z.boolean()
 });
 /**
+* A backup schedule — the N:M "entry" that binds one cron cadence to a
+* SET of destination locations. Supersedes the per-location cron on
+* `BackupDestinationPolicy`: an operator creates a schedule, picks the
+* `backups` locations it should write to, and the orchestrator fans a
+* single archive out to all of them when the cron fires.
+*
+* `retentionCount` is per-schedule (D-decision 2026-07-28): every
+* location targeted by this schedule keeps this many archives from
+* this schedule's runs.
+*
+* `dataSources` optionally narrows which top-level state locations
+* (db, addons, tls, …) are archived; omitted = the orchestrator's
+* default full set.
+*/
+var BackupScheduleSchema = zod.z.object({
+	/** Stable id. Generated by the orchestrator on first upsert if absent. */
+	id: zod.z.string(),
+	/** Operator-facing display name. */
+	label: zod.z.string(),
+	/** 5-field POSIX cron. Empty = disabled cadence (kept for editing). */
+	cron: zod.z.string(),
+	/** Master on/off toggle for the whole schedule. */
+	enabled: zod.z.boolean(),
+	/** `backups`-location ids this schedule writes to (fan-out set). */
+	locationIds: zod.z.array(zod.z.string()).readonly(),
+	/** Archives kept per targeted location for this schedule. */
+	retentionCount: zod.z.number().int().min(1).max(1e3),
+	/** Optional subset of source locations to include; omitted = all. */
+	dataSources: zod.z.array(zod.z.string()).readonly().optional(),
+	/** ms-epoch of last successful run. */
+	lastRunAt: zod.z.number().optional(),
+	/** ms-epoch of next computed firing (read-only, filled on list). */
+	nextRunAt: zod.z.number().optional()
+});
+/**
 * backup — singleton capability for backup management.
 *
 * Implemented by `local-backup` addon. Future providers (S3, rsync)
@@ -16368,7 +16372,14 @@ var backupCapability = {
 			/** Subset of registered `backup-destination` addon ids to write to. */
 			destinations: zod.z.array(zod.z.string()).optional(),
 			locations: zod.z.array(zod.z.string()).optional(),
-			label: zod.z.string().optional()
+			label: zod.z.string().optional(),
+			/**
+			* Per-run retention override applied to every targeted
+			* destination. Used by schedule-driven runs (per-entry
+			* retention). Omitted = each destination's own policy
+			* retention (manual runs).
+			*/
+			retentionCount: zod.z.number().int().min(1).max(1e3).optional()
 		}).optional(), zod.z.array(BackupEntrySchema).readonly(), {
 			kind: "mutation",
 			auth: "admin"
@@ -16455,7 +16466,36 @@ var backupCapability = {
 			ok: zod.z.boolean(),
 			error: zod.z.string().optional(),
 			nextRuns: zod.z.array(zod.z.number()).readonly()
-		}))
+		})),
+		/**
+		* List every backup schedule (the N:M entries), each with its
+		* computed `nextRunAt`. Powers the Schedules section of the
+		* admin-UI Backups page.
+		*/
+		listSchedules: require_sleep.method(zod.z.void(), zod.z.array(BackupScheduleSchema).readonly(), { auth: "admin" }),
+		/**
+		* Create or replace a schedule. An empty / absent `id` mints a new
+		* one; a present `id` replaces in place. `cron` is validated
+		* server-side; `locationIds` must reference existing `backups`
+		* locations (unknown ids are dropped with a warning).
+		*/
+		upsertSchedule: require_sleep.method(zod.z.object({
+			id: zod.z.string().optional(),
+			label: zod.z.string(),
+			cron: zod.z.string(),
+			enabled: zod.z.boolean(),
+			locationIds: zod.z.array(zod.z.string()).readonly(),
+			retentionCount: zod.z.number().int().min(1).max(1e3),
+			dataSources: zod.z.array(zod.z.string()).readonly().optional()
+		}), BackupScheduleSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Delete a schedule by id. Does not touch the target locations. */
+		deleteSchedule: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 //#endregion
@@ -27698,6 +27738,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"backup.deleteSchedule": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"backup.getEntries": {
 		capName: "backup",
 		capScope: "system",
@@ -27728,6 +27774,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"backup.listSchedules": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"backup.previewSchedule": {
 		capName: "backup",
 		capScope: "system",
@@ -27752,6 +27804,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"backup.upsertSchedule": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"battery.wakeForStream": {
 		capName: "battery",
 		capScope: "device",
@@ -33001,7 +33059,7 @@ exports.CAM_PROFILE_ORDER = require_sleep.CAM_PROFILE_ORDER;
 exports.CAPABILITY_NAMES = CAPABILITY_NAMES;
 exports.CAPABILITY_ROUTER_KEYS = CAPABILITY_ROUTER_KEYS;
 exports.CAP_NAMES_WITH_STATUS = CAP_NAMES_WITH_STATUS;
-exports.CAP_NODE_PIN_CONTEXT_KEY = CAP_NODE_PIN_CONTEXT_KEY;
+exports.CAP_NODE_PIN_CONTEXT_KEY = require_sleep.CAP_NODE_PIN_CONTEXT_KEY;
 exports.CAP_PROVIDER_KIND_MAP = CAP_PROVIDER_KIND_MAP;
 exports.COCO_80_LABELS = COCO_80_LABELS;
 exports.COCO_TO_MACRO = COCO_TO_MACRO;
@@ -33738,7 +33796,7 @@ exports.mqttBrokerCapability = mqttBrokerCapability;
 exports.nativeObjectDetectionCapability = nativeObjectDetectionCapability;
 exports.networkAccessCapability = networkAccessCapability;
 exports.networkQualityCapability = networkQualityCapability;
-exports.nodePin = nodePin;
+exports.nodePin = require_sleep.nodePin;
 exports.nodesCapability = nodesCapability;
 exports.normalizeAddonInitResult = require_sleep.normalizeAddonInitResult;
 exports.normalizeUnit = normalizeUnit;
@@ -33774,7 +33832,7 @@ exports.procedureAuthKey = procedureAuthKey;
 exports.ptzAutotrackCapability = ptzAutotrackCapability;
 exports.ptzCapability = ptzCapability;
 exports.pythonScriptForBackend = pythonScriptForBackend;
-exports.readNodePin = readNodePin;
+exports.readNodePin = require_sleep.readNodePin;
 exports.readinessKey = require_sleep.readinessKey;
 exports.rebootCapability = rebootCapability;
 exports.recordingCapability = recordingCapability;

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { $ as StreamSourceSchema, A as parseJsonUnknown, B as CamProfileSchema, C as asBoolean, D as asString, E as asNumber, F as readinessKey, G as DecodedFrameSchema, H as CamStreamResolutionSchema, I as scopeKey, J as FrameHandleSchema, K as EncodedPacketSchema, L as BrokerStatsSchema, M as ReadinessRegistry, N as ReadinessTimeoutError, O as parseJsonArray, P as emitDownForOwnedCaps, Q as StreamSourceEntrySchema, R as BrokerStatusSchema, S as DeviceType, T as asJsonObject, U as CameraStreamSchema, V as CamStreamKindSchema, W as DecodedAudioChunkSchema, X as ProfileSlotSchema, Y as ProfileRtspEntrySchema, Z as ProfileSlotStatusSchema, _ as resolveCapMount, _t as collectHydratedFieldValues, a as viewerUiCapability, at as makeSourceBrokerId, b as DeviceFeature, bt as DisposerChain, c as createLazyTrpcSource, ct as BaseAddon, d as DEVICE_SETTINGS_CONTRIBUTION_METHODS, dt as createEvent, et as SubscribeAudioChunksInputSchema, f as DEVICE_STATUS_METHOD, ft as emitReadiness, g as method, gt as collectHydratedFieldEntries, h as isDeviceConfigCap, ht as WELL_KNOWN_TAB_MAP, i as deviceOpsCapability, it as makeProfileBrokerId, j as DATAPLANE_SECRET_HEADER, k as parseJsonObject, l as createMirrorSource, lt as normalizeAddonInitResult, m as expandCapMethods, mt as WELL_KNOWN_TABS, n as sleepCancellable, nt as SubscribeFramesInputSchema, o as adminUiCapability, ot as parseProfileBrokerId, p as event, pt as isEvent, q as FrameHandleFormatSchema, r as RawStateResultSchema, rt as SubscribeFramesResultSchema, s as createDeviceProxy, st as selectAssignedProfileSlots, t as sleep, tt as SubscribeAudioChunksResultSchema, u as createSliceHandle, ut as createDurableState, v as systemMethod, vt as hydrateSchema, w as asJsonArray, x as DeviceRole, y as ChargingStatus, yt as resolveHydratedFieldValue, z as CAM_PROFILE_ORDER } from "./sleep-DiOnzenz.mjs";
+import { $ as ProfileSlotSchema, A as parseJsonUnknown, B as BrokerStatsSchema, C as asBoolean, Ct as DisposerChain, D as asString, E as asNumber, F as ReadinessRegistry, G as CamStreamResolutionSchema, H as CAM_PROFILE_ORDER, I as ReadinessTimeoutError, J as DecodedFrameSchema, K as CameraStreamSchema, L as emitDownForOwnedCaps, M as nodePin, N as readNodePin, O as parseJsonArray, P as DATAPLANE_SECRET_HEADER, Q as ProfileRtspEntrySchema, R as readinessKey, S as DeviceType, St as resolveHydratedFieldValue, T as asJsonObject, U as CamProfileSchema, V as BrokerStatusSchema, W as CamStreamKindSchema, X as FrameHandleFormatSchema, Y as EncodedPacketSchema, Z as FrameHandleSchema, _ as resolveCapMount, _t as WELL_KNOWN_TABS, a as viewerUiCapability, at as SubscribeFramesInputSchema, b as DeviceFeature, bt as collectHydratedFieldValues, c as createLazyTrpcSource, ct as makeSourceBrokerId, d as DEVICE_SETTINGS_CONTRIBUTION_METHODS, dt as BaseAddon, et as ProfileSlotStatusSchema, f as DEVICE_STATUS_METHOD, ft as normalizeAddonInitResult, g as method, gt as isEvent, h as isDeviceConfigCap, ht as emitReadiness, i as deviceOpsCapability, it as SubscribeAudioChunksResultSchema, j as CAP_NODE_PIN_CONTEXT_KEY, k as parseJsonObject, l as createMirrorSource, lt as parseProfileBrokerId, m as expandCapMethods, mt as createEvent, n as sleepCancellable, nt as StreamSourceSchema, o as adminUiCapability, ot as SubscribeFramesResultSchema, p as event, pt as createDurableState, q as DecodedAudioChunkSchema, r as RawStateResultSchema, rt as SubscribeAudioChunksInputSchema, s as createDeviceProxy, st as makeProfileBrokerId, t as sleep, tt as StreamSourceEntrySchema, u as createSliceHandle, ut as selectAssignedProfileSlots, v as systemMethod, vt as WELL_KNOWN_TAB_MAP, w as asJsonArray, x as DeviceRole, xt as hydrateSchema, y as ChargingStatus, yt as collectHydratedFieldEntries, z as scopeKey } from "./sleep-C3ceNSsf.mjs";
 import { t as EventCategory } from "./event-category-BLcNejAE.mjs";
 import { EventSourceType } from "./enums.mjs";
 import { t as errMsg } from "./err-msg-IQTHeDzc.mjs";
@@ -1259,16 +1259,23 @@ var StorageLocationDeclarationSchema = z.object({
 	* Which node root the seeded `<id>:default` instance is placed under on a
 	* FRESH install:
 	* - `'data'` (default) — the node's data dir (`CAMSTACK_DATA` / boot dir),
-	*   the appData volume. Right for small/durable data (backups, logs, models).
+	*   the appData volume. Right for small/durable data (logs, models).
 	* - `'media'` — the dedicated media volume (`CAMSTACK_MEDIA_ROOT`) when that
 	*   env is set, else falls back to the data root. Right for bulky, hot media
 	*   (recordings, event media) that should stay off the appData disk.
+	* - `'backup'` — the dedicated backup volume (`CAMSTACK_BACKUP_ROOT`, default
+	*   `/backups` in the image) so archives live on their own mount rather than
+	*   filling the appData disk. Falls back to the data root when unset.
 	*
 	* Only affects the seeded default's `basePath`; operators can repoint any
 	* location afterwards, and a `defaultsTo` slot inherits its parent's root
 	* regardless of this field. Absent (the common case) is treated as `'data'`.
 	*/
-	defaultRoot: z.enum(["data", "media"]).optional()
+	defaultRoot: z.enum([
+		"data",
+		"media",
+		"backup"
+	]).optional()
 });
 //#endregion
 //#region src/interfaces/device-capabilities/camera.ts
@@ -1703,47 +1710,6 @@ var RUNTIME_DEFAULTS = {
 	"auth.tokenExpiry": "7d"
 };
 //#endregion
-//#region src/cap-call-context.ts
-/**
-* Per-call node pinning for `ctx.api` capability calls.
-*
-* A capability call normally resolves to its DEFAULT provider — a `singleton`
-* cap resolves to the hub, a device-scoped cap to the device's owning node. To
-* query a SPECIFIC node's provider instead (e.g. a remote agent's own
-* in-process `platform-probe` hardware, which the hub cannot probe), pin the
-* call to that node.
-*
-* The nodeId rides OUT-OF-BAND in the tRPC call context (NOT in the validated
-* method args), so capability method signatures stay `nodeId`-free — node
-* targeting is a property of the CALL, not of the method. The transport lifts
-* it from `op.context` onto the `CapCallInput.nodeId` field (`ipcParentLink`),
-* and the hub parent's `onUnownedCall` passes it to the `CapRouteResolver`,
-* which classifies a pinned agent node as `agent-child-forward`
-* (`$agent-cap-fwd.forward` → the agent's in-process provider).
-*
-* Usage at a call site:
-*
-*   await api.platformProbe.getCapabilities.query(undefined, nodePin(nodeId))
-*/
-/** tRPC `op.context` key carrying a per-call node pin. */
-var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
-/**
-* Build the tRPC request options that pin a single capability call to `nodeId`.
-* Pass as the second argument to `.query(input, …)` / `.mutate(input, …)`.
-*/
-function nodePin(nodeId) {
-	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: nodeId } };
-}
-/**
-* Read a per-call node pin out of a tRPC `op.context` (transport side).
-* Returns the pinned nodeId, or `undefined` when no pin is present.
-*/
-function readNodePin(context) {
-	if (context === null || typeof context !== "object") return void 0;
-	const value = Reflect.get(context, CAP_NODE_PIN_CONTEXT_KEY);
-	return typeof value === "string" ? value : void 0;
-}
-//#endregion
 //#region src/utils/hf-url.ts
 function hfModelUrl(repo, path) {
 	return `https://huggingface.co/${repo}/resolve/main/${path}`;
@@ -14309,7 +14275,10 @@ function createSystemProxy(api) {
 			delete: (input) => dispatch("backup", "delete", "mutation", input),
 			listArchives: (input) => dispatch("backup", "listArchives", "query", input),
 			upsertDestinationPolicy: (input) => dispatch("backup", "upsertDestinationPolicy", "mutation", input),
-			previewSchedule: (input) => dispatch("backup", "previewSchedule", "query", input)
+			previewSchedule: (input) => dispatch("backup", "previewSchedule", "query", input),
+			listSchedules: (input) => dispatch("backup", "listSchedules", "query", input),
+			upsertSchedule: (input) => dispatch("backup", "upsertSchedule", "mutation", input),
+			deleteSchedule: (input) => dispatch("backup", "deleteSchedule", "mutation", input)
 		},
 		broker: {
 			list: (input) => dispatch("broker", "list", "query", input),
@@ -16341,6 +16310,41 @@ var LocationStatSchema = z.object({
 	present: z.boolean()
 });
 /**
+* A backup schedule — the N:M "entry" that binds one cron cadence to a
+* SET of destination locations. Supersedes the per-location cron on
+* `BackupDestinationPolicy`: an operator creates a schedule, picks the
+* `backups` locations it should write to, and the orchestrator fans a
+* single archive out to all of them when the cron fires.
+*
+* `retentionCount` is per-schedule (D-decision 2026-07-28): every
+* location targeted by this schedule keeps this many archives from
+* this schedule's runs.
+*
+* `dataSources` optionally narrows which top-level state locations
+* (db, addons, tls, …) are archived; omitted = the orchestrator's
+* default full set.
+*/
+var BackupScheduleSchema = z.object({
+	/** Stable id. Generated by the orchestrator on first upsert if absent. */
+	id: z.string(),
+	/** Operator-facing display name. */
+	label: z.string(),
+	/** 5-field POSIX cron. Empty = disabled cadence (kept for editing). */
+	cron: z.string(),
+	/** Master on/off toggle for the whole schedule. */
+	enabled: z.boolean(),
+	/** `backups`-location ids this schedule writes to (fan-out set). */
+	locationIds: z.array(z.string()).readonly(),
+	/** Archives kept per targeted location for this schedule. */
+	retentionCount: z.number().int().min(1).max(1e3),
+	/** Optional subset of source locations to include; omitted = all. */
+	dataSources: z.array(z.string()).readonly().optional(),
+	/** ms-epoch of last successful run. */
+	lastRunAt: z.number().optional(),
+	/** ms-epoch of next computed firing (read-only, filled on list). */
+	nextRunAt: z.number().optional()
+});
+/**
 * backup — singleton capability for backup management.
 *
 * Implemented by `local-backup` addon. Future providers (S3, rsync)
@@ -16367,7 +16371,14 @@ var backupCapability = {
 			/** Subset of registered `backup-destination` addon ids to write to. */
 			destinations: z.array(z.string()).optional(),
 			locations: z.array(z.string()).optional(),
-			label: z.string().optional()
+			label: z.string().optional(),
+			/**
+			* Per-run retention override applied to every targeted
+			* destination. Used by schedule-driven runs (per-entry
+			* retention). Omitted = each destination's own policy
+			* retention (manual runs).
+			*/
+			retentionCount: z.number().int().min(1).max(1e3).optional()
 		}).optional(), z.array(BackupEntrySchema).readonly(), {
 			kind: "mutation",
 			auth: "admin"
@@ -16454,7 +16465,36 @@ var backupCapability = {
 			ok: z.boolean(),
 			error: z.string().optional(),
 			nextRuns: z.array(z.number()).readonly()
-		}))
+		})),
+		/**
+		* List every backup schedule (the N:M entries), each with its
+		* computed `nextRunAt`. Powers the Schedules section of the
+		* admin-UI Backups page.
+		*/
+		listSchedules: method(z.void(), z.array(BackupScheduleSchema).readonly(), { auth: "admin" }),
+		/**
+		* Create or replace a schedule. An empty / absent `id` mints a new
+		* one; a present `id` replaces in place. `cron` is validated
+		* server-side; `locationIds` must reference existing `backups`
+		* locations (unknown ids are dropped with a warning).
+		*/
+		upsertSchedule: method(z.object({
+			id: z.string().optional(),
+			label: z.string(),
+			cron: z.string(),
+			enabled: z.boolean(),
+			locationIds: z.array(z.string()).readonly(),
+			retentionCount: z.number().int().min(1).max(1e3),
+			dataSources: z.array(z.string()).readonly().optional()
+		}), BackupScheduleSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Delete a schedule by id. Does not touch the target locations. */
+		deleteSchedule: method(z.object({ id: z.string() }), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 //#endregion
@@ -27697,6 +27737,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"backup.deleteSchedule": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"backup.getEntries": {
 		capName: "backup",
 		capScope: "system",
@@ -27727,6 +27773,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"backup.listSchedules": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"backup.previewSchedule": {
 		capName: "backup",
 		capScope: "system",
@@ -27751,6 +27803,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"backup.upsertSchedule": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"battery.wakeForStream": {
 		capName: "battery",
 		capScope: "device",

package/dist/interfaces/storage-location-declaration.d.ts

@@ -31,6 +31,7 @@ export declare const StorageLocationDeclarationSchema: z.ZodObject<{
     defaultRoot: z.ZodOptional<z.ZodEnum<{
         data: "data";
         media: "media";
+        backup: "backup";
     }>>;
 }, z.core.$strip>;
 /** Inferred TypeScript type for `StorageLocationDeclarationSchema`. */

package/dist/{sleep-DiOnzenz.mjs → sleep-C3ceNSsf.mjs}

@@ -1880,6 +1880,47 @@ function emitDownForOwnedCaps(registry, owned) {
 */
 var DATAPLANE_SECRET_HEADER = "x-camstack-dataplane-secret";
 //#endregion
+//#region src/cap-call-context.ts
+/**
+* Per-call node pinning for `ctx.api` capability calls.
+*
+* A capability call normally resolves to its DEFAULT provider — a `singleton`
+* cap resolves to the hub, a device-scoped cap to the device's owning node. To
+* query a SPECIFIC node's provider instead (e.g. a remote agent's own
+* in-process `platform-probe` hardware, which the hub cannot probe), pin the
+* call to that node.
+*
+* The nodeId rides OUT-OF-BAND in the tRPC call context (NOT in the validated
+* method args), so capability method signatures stay `nodeId`-free — node
+* targeting is a property of the CALL, not of the method. The transport lifts
+* it from `op.context` onto the `CapCallInput.nodeId` field (`ipcParentLink`),
+* and the hub parent's `onUnownedCall` passes it to the `CapRouteResolver`,
+* which classifies a pinned agent node as `agent-child-forward`
+* (`$agent-cap-fwd.forward` → the agent's in-process provider).
+*
+* Usage at a call site:
+*
+*   await api.platformProbe.getCapabilities.query(undefined, nodePin(nodeId))
+*/
+/** tRPC `op.context` key carrying a per-call node pin. */
+var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
+/**
+* Build the tRPC request options that pin a single capability call to `nodeId`.
+* Pass as the second argument to `.query(input, …)` / `.mutate(input, …)`.
+*/
+function nodePin(nodeId) {
+	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: nodeId } };
+}
+/**
+* Read a per-call node pin out of a tRPC `op.context` (transport side).
+* Returns the pinned nodeId, or `undefined` when no pin is present.
+*/
+function readNodePin(context) {
+	if (context === null || typeof context !== "object") return void 0;
+	const value = Reflect.get(context, CAP_NODE_PIN_CONTEXT_KEY);
+	return typeof value === "string" ? value : void 0;
+}
+//#endregion
 //#region src/utils/json-safe.ts
 /**
 * Type-safe JSON parsing helpers.
@@ -3456,4 +3497,4 @@ function sleepCancellable(ms, signal) {
 	});
 }
 //#endregion
-export { StreamSourceSchema as $, parseJsonUnknown as A, CamProfileSchema as B, asBoolean as C, asString as D, asNumber as E, readinessKey as F, DecodedFrameSchema as G, CamStreamResolutionSchema as H, scopeKey as I, FrameHandleSchema as J, EncodedPacketSchema as K, BrokerStatsSchema as L, ReadinessRegistry as M, ReadinessTimeoutError as N, parseJsonArray as O, emitDownForOwnedCaps as P, StreamSourceEntrySchema$1 as Q, BrokerStatusSchema as R, DeviceType as S, asJsonObject as T, CameraStreamSchema as U, CamStreamKindSchema as V, DecodedAudioChunkSchema as W, ProfileSlotSchema as X, ProfileRtspEntrySchema as Y, ProfileSlotStatusSchema as Z, resolveCapMount as _, collectHydratedFieldValues as _t, viewerUiCapability as a, makeSourceBrokerId as at, DeviceFeature as b, DisposerChain as bt, createLazyTrpcSource as c, BaseAddon as ct, DEVICE_SETTINGS_CONTRIBUTION_METHODS as d, createEvent as dt, SubscribeAudioChunksInputSchema as et, DEVICE_STATUS_METHOD as f, emitReadiness as ft, method as g, collectHydratedFieldEntries as gt, isDeviceConfigCap as h, WELL_KNOWN_TAB_MAP as ht, deviceOpsCapability as i, makeProfileBrokerId as it, DATAPLANE_SECRET_HEADER as j, parseJsonObject as k, createMirrorSource as l, normalizeAddonInitResult as lt, expandCapMethods as m, WELL_KNOWN_TABS as mt, sleepCancellable as n, SubscribeFramesInputSchema as nt, adminUiCapability as o, parseProfileBrokerId as ot, event as p, isEvent as pt, FrameHandleFormatSchema as q, RawStateResultSchema as r, SubscribeFramesResultSchema as rt, createDeviceProxy as s, selectAssignedProfileSlots as st, sleep as t, SubscribeAudioChunksResultSchema as tt, createSliceHandle as u, createDurableState as ut, systemMethod as v, hydrateSchema as vt, asJsonArray as w, DeviceRole as x, ChargingStatus as y, resolveHydratedFieldValue as yt, CAM_PROFILE_ORDER as z };
+export { ProfileSlotSchema as $, parseJsonUnknown as A, BrokerStatsSchema as B, asBoolean as C, DisposerChain as Ct, asString as D, asNumber as E, ReadinessRegistry as F, CamStreamResolutionSchema as G, CAM_PROFILE_ORDER as H, ReadinessTimeoutError as I, DecodedFrameSchema as J, CameraStreamSchema as K, emitDownForOwnedCaps as L, nodePin as M, readNodePin as N, parseJsonArray as O, DATAPLANE_SECRET_HEADER as P, ProfileRtspEntrySchema as Q, readinessKey as R, DeviceType as S, resolveHydratedFieldValue as St, asJsonObject as T, CamProfileSchema as U, BrokerStatusSchema as V, CamStreamKindSchema as W, FrameHandleFormatSchema as X, EncodedPacketSchema as Y, FrameHandleSchema as Z, resolveCapMount as _, WELL_KNOWN_TABS as _t, viewerUiCapability as a, SubscribeFramesInputSchema as at, DeviceFeature as b, collectHydratedFieldValues as bt, createLazyTrpcSource as c, makeSourceBrokerId as ct, DEVICE_SETTINGS_CONTRIBUTION_METHODS as d, BaseAddon as dt, ProfileSlotStatusSchema as et, DEVICE_STATUS_METHOD as f, normalizeAddonInitResult as ft, method as g, isEvent as gt, isDeviceConfigCap as h, emitReadiness as ht, deviceOpsCapability as i, SubscribeAudioChunksResultSchema as it, CAP_NODE_PIN_CONTEXT_KEY as j, parseJsonObject as k, createMirrorSource as l, parseProfileBrokerId as lt, expandCapMethods as m, createEvent as mt, sleepCancellable as n, StreamSourceSchema as nt, adminUiCapability as o, SubscribeFramesResultSchema as ot, event as p, createDurableState as pt, DecodedAudioChunkSchema as q, RawStateResultSchema as r, SubscribeAudioChunksInputSchema as rt, createDeviceProxy as s, makeProfileBrokerId as st, sleep as t, StreamSourceEntrySchema$1 as tt, createSliceHandle as u, selectAssignedProfileSlots as ut, systemMethod as v, WELL_KNOWN_TAB_MAP as vt, asJsonArray as w, DeviceRole as x, hydrateSchema as xt, ChargingStatus as y, collectHydratedFieldEntries as yt, scopeKey as z };

package/dist/{sleep-BG8hQTA8.js → sleep-DRg9F6JJ.js}

@@ -1880,6 +1880,47 @@ function emitDownForOwnedCaps(registry, owned) {
 */
 var DATAPLANE_SECRET_HEADER = "x-camstack-dataplane-secret";
 //#endregion
+//#region src/cap-call-context.ts
+/**
+* Per-call node pinning for `ctx.api` capability calls.
+*
+* A capability call normally resolves to its DEFAULT provider — a `singleton`
+* cap resolves to the hub, a device-scoped cap to the device's owning node. To
+* query a SPECIFIC node's provider instead (e.g. a remote agent's own
+* in-process `platform-probe` hardware, which the hub cannot probe), pin the
+* call to that node.
+*
+* The nodeId rides OUT-OF-BAND in the tRPC call context (NOT in the validated
+* method args), so capability method signatures stay `nodeId`-free — node
+* targeting is a property of the CALL, not of the method. The transport lifts
+* it from `op.context` onto the `CapCallInput.nodeId` field (`ipcParentLink`),
+* and the hub parent's `onUnownedCall` passes it to the `CapRouteResolver`,
+* which classifies a pinned agent node as `agent-child-forward`
+* (`$agent-cap-fwd.forward` → the agent's in-process provider).
+*
+* Usage at a call site:
+*
+*   await api.platformProbe.getCapabilities.query(undefined, nodePin(nodeId))
+*/
+/** tRPC `op.context` key carrying a per-call node pin. */
+var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
+/**
+* Build the tRPC request options that pin a single capability call to `nodeId`.
+* Pass as the second argument to `.query(input, …)` / `.mutate(input, …)`.
+*/
+function nodePin(nodeId) {
+	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: nodeId } };
+}
+/**
+* Read a per-call node pin out of a tRPC `op.context` (transport side).
+* Returns the pinned nodeId, or `undefined` when no pin is present.
+*/
+function readNodePin(context) {
+	if (context === null || typeof context !== "object") return void 0;
+	const value = Reflect.get(context, CAP_NODE_PIN_CONTEXT_KEY);
+	return typeof value === "string" ? value : void 0;
+}
+//#endregion
 //#region src/utils/json-safe.ts
 /**
 * Type-safe JSON parsing helpers.
@@ -3480,6 +3521,12 @@ Object.defineProperty(exports, "CAM_PROFILE_ORDER", {
 		return CAM_PROFILE_ORDER;
 	}
 });
+Object.defineProperty(exports, "CAP_NODE_PIN_CONTEXT_KEY", {
+	enumerable: true,
+	get: function() {
+		return CAP_NODE_PIN_CONTEXT_KEY;
+	}
+});
 Object.defineProperty(exports, "CamProfileSchema", {
 	enumerable: true,
 	get: function() {
@@ -3816,6 +3863,12 @@ Object.defineProperty(exports, "method", {
 		return method;
 	}
 });
+Object.defineProperty(exports, "nodePin", {
+	enumerable: true,
+	get: function() {
+		return nodePin;
+	}
+});
 Object.defineProperty(exports, "normalizeAddonInitResult", {
 	enumerable: true,
 	get: function() {
@@ -3846,6 +3899,12 @@ Object.defineProperty(exports, "parseProfileBrokerId", {
 		return parseProfileBrokerId;
 	}
 });
+Object.defineProperty(exports, "readNodePin", {
+	enumerable: true,
+	get: function() {
+		return readNodePin;
+	}
+});
 Object.defineProperty(exports, "readinessKey", {
 	enumerable: true,
 	get: function() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/types",
-  "version": "1.2.14",
+  "version": "1.2.16",
   "description": "Shared types, interfaces, and model catalogs for the CamStack detection ecosystem",
   "keywords": [
     "camstack",