camstack 1.2.10 → 1.2.12

package/dist/{chunk-BRUAXYPT.js → chunk-7EQOMKUT.js}

@@ -14522,7 +14522,7 @@ function date4(params) {
 // ../../node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../types/dist/sleep-C3ceNSsf.mjs
+// ../types/dist/sleep-B_Uaqbai.mjs
 var WELL_KNOWN_TABS = [
   {
     id: "overview",
@@ -15504,18 +15504,6 @@ var ConvertResultSchema = external_exports.object({
 });
 var RecordingWeekdaySchema = external_exports.number().int().min(0).max(6);
 var HHMM = /^([01]\d|2[0-3]):[0-5]\d$/;
-var RecordingScheduleSchema = external_exports.discriminatedUnion("kind", [external_exports.object({ kind: external_exports.literal("always") }), external_exports.object({
-  kind: external_exports.literal("timeOfDay"),
-  start: external_exports.string().regex(HHMM),
-  end: external_exports.string().regex(HHMM),
-  /** Restrict to these weekdays; omit = every day. */
-  days: external_exports.array(RecordingWeekdaySchema).optional()
-})]);
-var RecordingModeSchema = external_exports.enum([
-  "continuous",
-  "onMotion",
-  "onAudioThreshold"
-]);
 var RecordingStorageModeSchema = external_exports.enum([
   "off",
   "events",
@@ -15536,18 +15524,6 @@ var RecordingBandSchema = external_exports.object({
   preBufferSec: external_exports.number().min(0).optional(),
   postBufferSec: external_exports.number().min(0).optional()
 });
-var RecordingRuleSchema = external_exports.object({
-  schedule: RecordingScheduleSchema,
-  mode: RecordingModeSchema,
-  /** Seconds of footage to retain BEFORE a trigger (applied at keep/discard). */
-  preBufferSec: external_exports.number().min(0).default(0),
-  /** Keep recording until this many seconds after the last trigger. */
-  postBufferSec: external_exports.number().min(0).default(0),
-  /** Each new trigger restarts the post-buffer window. */
-  resetTimeoutOnNewEvent: external_exports.boolean().default(true),
-  /** onAudioThreshold only — dBFS level that counts as a trigger. */
-  thresholdDbfs: external_exports.number().optional()
-});
 var RecordingRetentionSchema = external_exports.object({
   maxAgeDays: external_exports.number().min(0).optional(),
   maxSizeGb: external_exports.number().min(0).optional()
@@ -15561,33 +15537,17 @@ var ScrubThumbnailPresetSchema = external_exports.enum([
 ]);
 var RecordingConfigSchema = external_exports.object({
   enabled: external_exports.boolean(),
-  /** Authoritative storage mode. Absent on legacy targets → derived once via
-  *  `migrateRulesToMode`, then persisted. */
+  /** DERIVED summary of `bands`, stamped by the recorder on every save.
+  *  Authoring it has no effect — see {@link RecordingStorageModeSchema}. */
   mode: RecordingStorageModeSchema.optional(),
   profiles: external_exports.array(CamProfileSchema).optional(),
   segmentSeconds: external_exports.number().int().positive().optional(),
-  /** Shared recording time-bands for `events` & `continuous` — record only when
-  *  the wall-clock falls inside one of these windows. Omit or empty = always.
-  *  `continuous` compiles to one rule per band; `events` to band × trigger. */
-  schedules: external_exports.array(RecordingScheduleSchema).optional(),
-  /** Legacy single-band predecessor of `schedules`. Read-compat only — it is
-  *  normalized into `schedules` on read and never written going forward. (Not
-  *  tagged `@deprecated`: the normalization paths must read it cast-free.) */
-  schedule: RecordingScheduleSchema.optional(),
-  /** `events`-mode only — which detectors trigger a recording. */
-  triggers: RecordingTriggersSchema.optional(),
-  /** `events`-mode only — seconds retained before / after a trigger. */
-  preBufferSec: external_exports.number().min(0).optional(),
-  postBufferSec: external_exports.number().min(0).optional(),
-  /** DEPRECATED authoring input; retained for migration/transition. */
-  rules: external_exports.array(RecordingRuleSchema).optional(),
   /**
-  * AUTHORITATIVE mode-per-band recording model (recorder). When present it
-  * is the single source of truth; the legacy `mode`/`schedules`/`schedule`/
-  * `triggers`/`rules` fields above are kept for READ-COMPAT only and are
-  * derived into bands once via `migrateConfigToBands`.
+  * AUTHORITATIVE mode-per-band recording model — the single source of truth
+  * the recorder's band engine consumes. An empty array = record nothing;
+  * "off" is the absence of a covering band, never a band value.
   */
-  bands: external_exports.array(RecordingBandSchema).optional(),
+  bands: external_exports.array(RecordingBandSchema).default([]),
   retention: RecordingRetentionSchema.optional(),
   /**
   * Per-camera scrub-thumbnail fidelity preset (resolution + JPEG quality for
@@ -15595,14 +15555,22 @@ var RecordingConfigSchema = external_exports.object({
   * windows only — existing sheets are immutable, and each window's index
   * carries its own tile dims so mixed-preset history renders correctly.
   */
-  scrubThumbnails: ScrubThumbnailPresetSchema.optional()
-});
+  scrubThumbnails: ScrubThumbnailPresetSchema.optional(),
+  /**
+  * OPT-IN thumbnail-strip generation for this camera: every keyframe of the
+  * low recording saved as a JPEG (the fast-drag scrub depth), a derived
+  * cache that eviction reclaims with the footage. Absent/false = no strips
+  * are written and scrub reads exact keyframes at every velocity.
+  */
+  stripsEnabled: external_exports.boolean().optional()
+}).strict();
 var OpsLogDomainSchema = external_exports.enum(["recording", "events"]);
 var OpsLogOpSchema = external_exports.enum([
   "prune",
   "manual-delete",
   "rescan",
-  "retention-run"
+  "retention-run",
+  "relocate"
 ]);
 var OpsLogReasonSchema = external_exports.enum([
   "retention",
@@ -15637,6 +15605,45 @@ var OpsLogQueryInputSchema = external_exports.object({
   /** Max rows returned, newest-first. */
   limit: external_exports.number().int().min(1).max(1e3).optional()
 });
+var RelocateJobStateSchema = external_exports.enum([
+  "running",
+  "done",
+  "failed",
+  "cancelled"
+]);
+var RelocateJobSchema = external_exports.object({
+  jobId: external_exports.string(),
+  state: RelocateJobStateSchema,
+  /** Source location — for media relocation this is informational ('*': rows
+  *  move from wherever they are to the target). */
+  fromLocationId: external_exports.string(),
+  toLocationId: external_exports.string(),
+  /** Scoped device, or null = every device. */
+  deviceId: external_exports.number().nullable(),
+  /** What the job moves (owner-addon specific: segments/strips or media). */
+  entities: external_exports.array(external_exports.string()),
+  filesMoved: external_exports.number().int(),
+  bytesMoved: external_exports.number().int(),
+  /** Total files discovered up front; null while (or when) unknown. */
+  filesTotal: external_exports.number().int().nullable(),
+  startedAt: external_exports.number(),
+  finishedAt: external_exports.number().nullable(),
+  error: external_exports.string().nullable()
+});
+var RelocateFootageInputSchema = external_exports.object({
+  deviceId: external_exports.number().optional(),
+  fromLocationId: external_exports.string(),
+  toLocationId: external_exports.string(),
+  entities: external_exports.array(external_exports.enum(["segments", "strips"])).optional(),
+  /** Copy throttle in MB/s (default 40) — the drain is a background chore,
+  *  never allowed to starve live writers. */
+  throttleMbps: external_exports.number().min(1).max(1e3).optional()
+});
+var RelocateMediaInputSchema = external_exports.object({
+  deviceId: external_exports.number().optional(),
+  toLocationId: external_exports.string(),
+  throttleMbps: external_exports.number().min(1).max(1e3).optional()
+});
 var StorageLocationTypeSchema = external_exports.string().regex(/^[a-z][a-zA-Z0-9-]*$/);
 var StorageLocationSchema = external_exports.object({
   id: external_exports.string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/),
@@ -15654,6 +15661,13 @@ var StorageLocationSchema = external_exports.object({
   nodeId: external_exports.string().optional(),
   isDefault: external_exports.boolean().default(false),
   isSystem: external_exports.boolean().default(false),
+  /** COMPUTED at read time by the orchestrator (statfs of the backing volume
+  *  for node-local locations it can reach) — never persisted, absent when the
+  *  volume is remote/unreachable. The single capacity truth every UI reads. */
+  capacity: external_exports.object({
+    totalBytes: external_exports.number(),
+    availableBytes: external_exports.number()
+  }).nullable().optional(),
   createdAt: external_exports.number(),
   updatedAt: external_exports.number()
 });
@@ -15687,16 +15701,23 @@ var StorageLocationDeclarationSchema = external_exports.object({
   * Which node root the seeded `<id>:default` instance is placed under on a
   * FRESH install:
   * - `'data'` (default) — the node's data dir (`CAMSTACK_DATA` / boot dir),
-  *   the appData volume. Right for small/durable data (backups, logs, models).
+  *   the appData volume. Right for small/durable data (logs, models).
   * - `'media'` — the dedicated media volume (`CAMSTACK_MEDIA_ROOT`) when that
   *   env is set, else falls back to the data root. Right for bulky, hot media
   *   (recordings, event media) that should stay off the appData disk.
+  * - `'backup'` — the dedicated backup volume (`CAMSTACK_BACKUP_ROOT`, default
+  *   `/backups` in the image) so archives live on their own mount rather than
+  *   filling the appData disk. Falls back to the data root when unset.
   *
   * Only affects the seeded default's `basePath`; operators can repoint any
   * location afterwards, and a `defaultsTo` slot inherits its parent's root
   * regardless of this field. Absent (the common case) is treated as `'data'`.
   */
-  defaultRoot: external_exports.enum(["data", "media"]).optional()
+  defaultRoot: external_exports.enum([
+    "data",
+    "media",
+    "backup"
+  ]).optional()
 });
 var DecoderStatsSchema = external_exports.object({
   inputFps: external_exports.number(),
@@ -16914,6 +16935,8 @@ var BATTERY_DEVICE_PROFILE = {
     "streamBroker.preBufferEnabled": false
   }
 };
+var NC_BASE_CONDITION_KEYS = ["devices", "classes"];
+var BASE_CONDITION_SET = new Set(NC_BASE_CONDITION_KEYS);
 var MaskPointSchema = external_exports.object({
   x: external_exports.number(),
   y: external_exports.number()
@@ -16997,6 +17020,11 @@ var NcOccupancyConditionSchema = external_exports.object({
   count: external_exports.number().int().min(0).default(1),
   sustainSeconds: external_exports.number().int().min(0).max(3600).default(15)
 });
+var NcCrossingSchema = external_exports.enum([
+  "enter",
+  "exit",
+  "any"
+]);
 var NcZoneConditionSchema = external_exports.object({
   ids: external_exports.array(external_exports.string().min(1)).min(1),
   /** Quantifier over `ids` — at least one / every one visited. */
@@ -17016,6 +17044,13 @@ var NcConditionsSchema = external_exports.object({
   /** Veto zones — any hit fails the rule. */
   zonesExclude: external_exports.array(external_exports.string().min(1)).optional(),
   /**
+  * Zone-crossing direction. IMMEDIATE only — a crossing is a per-event fact
+  * and a closed track carries none, so a `track-end` rule asking for one
+  * fails closed (use `zones`, which tests `zonesVisited`). ABSENT = `enter`,
+  * which is exactly today's behaviour. See {@link NcCrossingSchema}.
+  */
+  crossing: NcCrossingSchema.optional(),
+  /**
   * Exact (case-insensitive) match on the record's collapsed `label`
   * (identity name / plate text / subclass).
   */
@@ -17136,16 +17171,62 @@ var NcRuleTargetSchema = external_exports.object({
   */
   params: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
 });
-var NcMediaPolicySchema = external_exports.object({ attach: external_exports.enum([
-  "best",
-  "best-matching",
-  "keyFrame",
-  "none"
-]).default("best") });
+var NcMediaFrameSchema = external_exports.enum([
+  "cropped",
+  "full",
+  "boxed"
+]);
+var NcMediaPolicySchema = external_exports.object({
+  attach: external_exports.enum([
+    "best",
+    "best-matching",
+    "keyFrame",
+    "none"
+  ]).default("best"),
+  /** What the still shows. Absent = `cropped` (the historical `best` shape). */
+  frame: NcMediaFrameSchema.optional(),
+  /** Crop the attached still to the rule's condition-zone bbox (padded) —
+  *  "show me the ZONE", not the whole scene or the subject crop. */
+  zoneCrop: external_exports.boolean().optional(),
+  /**
+  * Also attach a short GIF cut from the stream broker's clip ring around the
+  * event — NOT from the recording, so the camera does not have to be
+  * recording, and the window sits AROUND the moment instead of a segment
+  * behind it. Fail-closed: a window the ring does not cover contributes no
+  * gif, never a failed notification.
+  */
+  gif: external_exports.boolean().optional(),
+  /**
+  * Also attach a short MP4 CLIP of the same cut. Same source and the same
+  * fail-closed rule as `gif`. Prefer it where the backend takes video
+  * (telegram, discord, zentik, webhook); backends that do not are handled by
+  * the degrade engine, which drops the video and keeps the still.
+  */
+  clip: external_exports.boolean().optional(),
+  /** Seconds of footage BEFORE / AFTER the event instant. Defaults 3 / 7. */
+  clipPreRollSec: external_exports.number().int().min(0).max(30).optional(),
+  clipPostRollSec: external_exports.number().int().min(0).max(30).optional(),
+  /**
+  * Which stream profile the footage is cut from. Absent = the CHEAPEST
+  * assigned profile: a notification is watched on a phone, so the 4K
+  * rendition would burn CPU to produce a file the client downscales anyway.
+  * A profile that is not assigned falls back to the cheapest, and the render
+  * reports which one actually ran.
+  */
+  profile: CamProfileSchema.optional()
+});
+var NcThrottleGranularitySchema = external_exports.enum(["shared", "per-class"]);
 var NcThrottleSchema = external_exports.object({
   cooldownSec: external_exports.number().int().min(0).max(86400).default(60),
   /** `rule` = one shared cooldown; `rule-device` = per-camera cooldown. */
-  scope: external_exports.enum(["rule", "rule-device"]).default("rule-device")
+  scope: external_exports.enum(["rule", "rule-device"]).default("rule-device"),
+  /**
+  * Class granularity of the cooldown key. Optional rather than defaulted:
+  * a Zod default does NOT run on the addon→addon cap path, so a persisted
+  * rule authored before this field simply carries none — and the engine
+  * reads absent as `shared`, the pre-existing behaviour.
+  */
+  granularity: NcThrottleGranularitySchema.optional()
 });
 var NcRuleInputSchema = external_exports.object({
   name: external_exports.string().min(1).max(200),
@@ -17153,7 +17234,19 @@ var NcRuleInputSchema = external_exports.object({
   delivery: NcDeliverySchema,
   conditions: NcConditionsSchema.default({}),
   schedule: NcScheduleSchema.optional(),
-  targets: external_exports.array(NcRuleTargetSchema).min(1),
+  /** May be empty when `targetUsers` addresses at least one user — the
+  *  "at least one addressee" invariant is enforced by the provider, because
+  *  a cross-field refine here would break `NcRulePatchSchema.partial()`. */
+  targets: external_exports.array(NcRuleTargetSchema),
+  /**
+  * USERS this rule addresses in addition to `targets` (Phase 4). At fire
+  * time each user fans out to the personal targets they own
+  * (`config.ownerUserId`), filtered by that user's `allowedDevices` for the
+  * firing camera — a user is never notified about a device they cannot open.
+  * Per-user opt-outs (`disabledTargetIds`) still apply to the fanned-out
+  * targets.
+  */
+  targetUsers: external_exports.array(external_exports.string()).optional(),
   media: NcMediaPolicySchema.default({ attach: "best" }),
   throttle: NcThrottleSchema.default({
     cooldownSec: 60,
@@ -17230,6 +17323,7 @@ var NcConditionDescriptorSchema = external_exports.object({
     "schedule",
     "plateMatcher",
     "packagePhase",
+    "crossingSelect",
     "polygonDraw",
     "occupancy"
   ]),
@@ -17342,7 +17436,20 @@ var notificationRulesCapability = {
       kind: "mutation",
       auth: "admin"
     }),
-    getConditionCatalog: method(external_exports.object({}), external_exports.object({ catalog: external_exports.array(NcConditionDescriptorSchema) })),
+    /**
+    * The machine-readable condition surface a rule editor renders from, plus
+    * the picker VOCABULARY those conditions draw on.
+    *
+    * `taxonomy` is optional so an older provider that only returns `catalog`
+    * still validates; a client that receives none keeps free-text inputs.
+    * It was previously served ONLY on the `nc.getConditionCatalog` bridge
+    * action, which is why the viewer had grouped pickers and the admin UI —
+    * which reaches this cap — was stuck typing `person` from memory.
+    */
+    getConditionCatalog: method(external_exports.object({}), external_exports.object({
+      catalog: external_exports.array(NcConditionDescriptorSchema),
+      taxonomy: NcTaxonomySchema.optional()
+    })),
     /**
     * Queryable delivery history — a read-only view over the durable outbox
     * (fired rule, subject summary, target, status, timestamps, error on a
@@ -18212,6 +18319,48 @@ var streamBrokerCapability = {
       kind: "mutation",
       auth: "admin"
     }),
+    /**
+    * Render a short GIF or MP4 from the broker's PRE-BUFFER around an instant.
+    *
+    * The pre-buffer is the only source that already holds the seconds BEFORE
+    * an event (it is what it exists for — "when an addon needs the last N
+    * seconds of video for clip creation"). Cutting from recorded segments
+    * cannot: only finalized segments are addressable and the one covering the
+    * moment is still being written, so a segment-sourced clip is either
+    * delayed or shows the approach instead of the event (operator,
+    * 2026-07-30). It also means a camera does not have to be RECORDING to
+    * produce a notification clip.
+    *
+    * Returns muxed BYTES, never packets: the frame plane never crosses a
+    * process boundary at frame rate (D9/D18) — this is one compressed,
+    * on-demand payload per notification.
+    *
+    * Waits up to `postRollSec` for the tail to accumulate, so the window is
+    * CENTRED on `aroundMs`.
+    */
+    renderPreBufferClip: method(external_exports.object({
+      deviceId: external_exports.number(),
+      /** Absent = the LOWEST assigned profile — a notification attachment is
+      *  watched on a phone, and the cheap rendition is the right default. */
+      profile: CamProfileSchema.optional(),
+      aroundMs: external_exports.number(),
+      preRollSec: external_exports.number().min(0).max(20).default(3),
+      postRollSec: external_exports.number().min(0).max(20).default(5),
+      format: external_exports.enum(["gif", "mp4"]).default("gif"),
+      maxWidth: external_exports.number().int().min(120).max(1920).default(480),
+      /** GIF only — MP4 keeps the source cadence. */
+      fps: external_exports.number().int().min(1).max(15).default(5)
+    }), external_exports.object({
+      base64: external_exports.string(),
+      mime: external_exports.string(),
+      bytes: external_exports.number().int(),
+      /** The profile actually rendered (what the default resolved to). */
+      profile: CamProfileSchema,
+      durationMs: external_exports.number()
+    }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
     listAllCameraStreams: method(external_exports.void(), external_exports.array(CameraStreamSchema).readonly()),
     listAllProfileSlots: method(external_exports.void(), external_exports.array(ProfileSlotSchema).readonly()),
     getBrokerStats: method(external_exports.object({ brokerId: external_exports.string() }), BrokerStatsSchema),
@@ -23868,6 +24017,26 @@ var LocationStatSchema = external_exports.object({
   fileCount: external_exports.number(),
   present: external_exports.boolean()
 });
+var BackupScheduleSchema = external_exports.object({
+  /** Stable id. Generated by the orchestrator on first upsert if absent. */
+  id: external_exports.string(),
+  /** Operator-facing display name. */
+  label: external_exports.string(),
+  /** 5-field POSIX cron. Empty = disabled cadence (kept for editing). */
+  cron: external_exports.string(),
+  /** Master on/off toggle for the whole schedule. */
+  enabled: external_exports.boolean(),
+  /** `backups`-location ids this schedule writes to (fan-out set). */
+  locationIds: external_exports.array(external_exports.string()).readonly(),
+  /** Archives kept per targeted location for this schedule. */
+  retentionCount: external_exports.number().int().min(1).max(1e3),
+  /** Optional subset of source locations to include; omitted = all. */
+  dataSources: external_exports.array(external_exports.string()).readonly().optional(),
+  /** ms-epoch of last successful run. */
+  lastRunAt: external_exports.number().optional(),
+  /** ms-epoch of next computed firing (read-only, filled on list). */
+  nextRunAt: external_exports.number().optional()
+});
 var backupCapability = {
   name: "backup",
   scope: "system",
@@ -23889,7 +24058,14 @@ var backupCapability = {
       /** Subset of registered `backup-destination` addon ids to write to. */
       destinations: external_exports.array(external_exports.string()).optional(),
       locations: external_exports.array(external_exports.string()).optional(),
-      label: external_exports.string().optional()
+      label: external_exports.string().optional(),
+      /**
+      * Per-run retention override applied to every targeted
+      * destination. Used by schedule-driven runs (per-entry
+      * retention). Omitted = each destination's own policy
+      * retention (manual runs).
+      */
+      retentionCount: external_exports.number().int().min(1).max(1e3).optional()
     }).optional(), external_exports.array(BackupEntrySchema).readonly(), {
       kind: "mutation",
       auth: "admin"
@@ -23976,7 +24152,36 @@ var backupCapability = {
       ok: external_exports.boolean(),
       error: external_exports.string().optional(),
       nextRuns: external_exports.array(external_exports.number()).readonly()
-    }))
+    })),
+    /**
+    * List every backup schedule (the N:M entries), each with its
+    * computed `nextRunAt`. Powers the Schedules section of the
+    * admin-UI Backups page.
+    */
+    listSchedules: method(external_exports.void(), external_exports.array(BackupScheduleSchema).readonly(), { auth: "admin" }),
+    /**
+    * Create or replace a schedule. An empty / absent `id` mints a new
+    * one; a present `id` replaces in place. `cron` is validated
+    * server-side; `locationIds` must reference existing `backups`
+    * locations (unknown ids are dropped with a warning).
+    */
+    upsertSchedule: method(external_exports.object({
+      id: external_exports.string().optional(),
+      label: external_exports.string(),
+      cron: external_exports.string(),
+      enabled: external_exports.boolean(),
+      locationIds: external_exports.array(external_exports.string()).readonly(),
+      retentionCount: external_exports.number().int().min(1).max(1e3),
+      dataSources: external_exports.array(external_exports.string()).readonly().optional()
+    }), BackupScheduleSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** Delete a schedule by id. Does not touch the target locations. */
+    deleteSchedule: method(external_exports.object({ id: external_exports.string() }), external_exports.void(), {
+      kind: "mutation",
+      auth: "admin"
+    })
   }
 };
 var BrokerStatusEnum = external_exports.enum([
@@ -25367,7 +25572,29 @@ var deviceManagerCapability = {
     getDeviceStatusAggregate: method(external_exports.object({
       deviceId: external_exports.number(),
       caps: external_exports.array(external_exports.string()).readonly().optional()
-    }), external_exports.record(external_exports.string(), external_exports.unknown().nullable()))
+    }), external_exports.record(external_exports.string(), external_exports.unknown().nullable())),
+    /**
+    * The same aggregate, for a LIST of devices in one round-trip.
+    *
+    * The viewer's camera list is the caller this exists for. Each card asked
+    * for its own badges — battery here, recording mode there — so a ten-camera
+    * install issued N separate procedures per reconcile, each its own message
+    * on the one WebSocket that also carries the WebRTC signalling (the client
+    * has no `httpBatchLink`, so there is no transport-level batching to lean
+    * on: collapsing has to happen at the procedure level, which is here).
+    *
+    * Keyed by device id as a STRING — a JSON object cannot key by number, and
+    * pretending otherwise is how a record survives the wire only in tests.
+    * The per-device value is exactly what `getDeviceStatusAggregate` returns,
+    * so a caller can move between the two without reshaping anything.
+    *
+    * `caps` matters more here than in the single call: a client that needs two
+    * caps should not pay for every status-carrying cap × every device.
+    */
+    getDeviceStatusAggregateBatch: method(external_exports.object({
+      deviceIds: external_exports.array(external_exports.number()).readonly(),
+      caps: external_exports.array(external_exports.string()).readonly().optional()
+    }), external_exports.record(external_exports.string(), external_exports.record(external_exports.string(), external_exports.unknown().nullable())))
   }
 };
 var deviceStateCapability = {
@@ -26357,6 +26584,36 @@ var TargetKindSchema = external_exports.object({
   icon: external_exports.string(),
   /** Stamped by each provider so the concat-fanned catalog stays routable. */
   addonId: external_exports.string(),
+  /**
+  * URL of the kind's bundled BRAND icon, served by the providing addon over
+  * its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+  * when the addon bundles no icon for that kind — the client then falls back
+  * to a neutral glyph rather than rendering the raw `icon` NAME as text.
+  *
+  * Root-relative on purpose: it resolves against whatever origin serves a web
+  * client, and a native client joins it onto its own hub base.
+  *
+  * DECLARED here deliberately. It used to travel as an undeclared passthrough
+  * field that survived only because the runtime cap-router forwards provider
+  * output verbatim — so every consumer had to re-declare it by hand to stop
+  * its own Zod parse from stripping it, and the whole arrangement would have
+  * broken silently the moment output validation was tightened anywhere.
+  */
+  iconUrl: external_exports.string().optional(),
+  /**
+  * Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+  *
+  * The server knows this and therefore says it, because the client cannot
+  * safely guess: a React-Native client renders SVG and raster through two
+  * DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+  * not decode SVG on iOS/Android), so without this it silently fell back to a
+  * placeholder glyph for every vector icon while the web build looked fine.
+  *
+  * Absent when {@link iconUrl} is absent, or for a legacy provider that has
+  * not been updated — a client that cannot determine the type should prefer
+  * its raster path, which is the safe default for an unknown image.
+  */
+  iconMediaType: external_exports.string().optional(),
   configSchema: ConfigSchemaPassthrough,
   supportsDiscovery: external_exports.boolean(),
   caps: TargetKindCapsSchema
@@ -26691,6 +26948,14 @@ var MotionEventSchema = external_exports.object({
   mediaUrl: external_exports.string().optional()
 });
 var DetectionSourceSchema = external_exports.enum(["pipeline", "onboard"]);
+var ZoneCrossingDirectionSchema = external_exports.enum(["enter", "exit"]);
+var ZoneCrossingSchema = external_exports.object({
+  direction: ZoneCrossingDirectionSchema,
+  /** Admin zone id crossed. */
+  zoneId: external_exports.string(),
+  /** Zone display name at crossing time (falls back to the id). */
+  zoneName: external_exports.string().optional()
+});
 var ObjectEventSchema = external_exports.object({
   ...BaseEventFields,
   kind: external_exports.literal("object"),
@@ -26717,6 +26982,12 @@ var ObjectEventSchema = external_exports.object({
   zones: external_exports.array(external_exports.string()).readonly().optional(),
   /** Omitted in slim projection. */
   state: TrackStateSchema.optional(),
+  /**
+  * The zone crossing this event IS, when it is one. Absent on every other
+  * event kind (movement state, appearance, package) — see
+  * {@link ZoneCrossingSchema}. Omitted in slim projection.
+  */
+  zoneCrossing: ZoneCrossingSchema.optional(),
   /** Detection-frame dimensions in pixels — let consumers normalize the
   *  pixel-space `bbox` onto a displayed image. Omitted in slim projection. */
   frameWidth: external_exports.number().optional(),
@@ -27093,6 +27364,23 @@ var pipelineAnalyticsCapability = {
     }),
     /** The events ops-log rows (newest-first), optionally scoped to one camera.
     *  Backed by a declared pipeline-analytics SQLite collection. */
+    /**
+    * Move event-media blobs onto `toLocationId` (entity-routing spec Phase
+    * 4): per-row copy → stamp row.locationId → delete old blob. Rows already
+    * at the target are skipped, so a re-run resumes. Single-flight.
+    */
+    relocateMedia: method(RelocateMediaInputSchema, external_exports.object({ jobId: external_exports.string() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    getMediaRelocateStatus: method(external_exports.object({}), external_exports.array(RelocateJobSchema).readonly(), {
+      kind: "query",
+      auth: "admin"
+    }),
+    cancelMediaRelocate: method(external_exports.object({ jobId: external_exports.string() }), external_exports.object({ cancelled: external_exports.boolean() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
     listOpsLog: method(OpsLogQueryInputSchema, external_exports.array(OpsLogEntrySchema).readonly(), {
       kind: "query",
       auth: "admin"
@@ -30079,6 +30367,12 @@ var ConnectionEndpointSchema = external_exports.object({
   priority: external_exports.number()
 });
 var GetConnectionEndpointsResultSchema = external_exports.object({ endpoints: external_exports.array(ConnectionEndpointSchema).readonly() });
+var NotificationEndpointSchema = external_exports.object({
+  /** The operator's explicit choice, or null for AUTO. */
+  baseUrl: external_exports.string().nullable(),
+  /** What the ranking currently resolves to (null when nothing is reachable). */
+  resolved: external_exports.string().nullable()
+});
 var AllowedAddressesSchema = external_exports.object({
   /**
   * Allowlist of interface addresses operators have explicitly opted
@@ -30131,6 +30425,26 @@ var localNetworkCapability = {
       scheme: external_exports.enum(["http", "https"]).optional()
     }), GetConnectionEndpointsResultSchema),
     /**
+    * The endpoint OUTBOUND artifacts must be addressed by — notification
+    * attachment links and deep links. `baseUrl: null` means AUTO: the first
+    * public candidate (a configured origin, then a connected tunnel, then the
+    * LAN), never loopback.
+    *
+    * Why an explicit marker: the automatic ranking cannot know which of
+    * several reachable addresses the RECIPIENT can actually open. A link is
+    * consumed on someone's phone, off the LAN, possibly hours later — and a
+    * link nobody can open is worse than no link, because the notification
+    * arrives advertising media that 404s.
+    */
+    getNotificationEndpoint: method(external_exports.void(), NotificationEndpointSchema),
+    /**
+    * Mark which endpoint notification artifacts use. `baseUrl: null` restores
+    * AUTO. The value is stored verbatim (not an index into the candidate
+    * list): interfaces come and go, and an index would silently re-point at a
+    * different address after a reboot.
+    */
+    setNotificationEndpoint: method(external_exports.object({ baseUrl: external_exports.string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }),
+    /**
     * Read the operator's allowlist. Empty = "auto" (no filter). Used
     * by the admin UI's address selector to seed its checkbox state.
     */
@@ -31109,7 +31423,12 @@ var RecordingDeviceUsageSchema = external_exports.object({
 var RecordingLocationUsageSchema = external_exports.object({
   /** StorageLocation id; null for the legacy/degraded single-root fallback. */
   locationId: external_exports.string().nullable(),
-  /** Bytes of recordings stored on this location. */
+  /** Every location id sharing this row's PHYSICAL volume (aliases). One row
+  *  is emitted per physical disk (2026-07-29): two locations on one root
+  *  previously rendered as two identical "disks" with a nonsensical used
+  *  split — hydrate attribution across aliases is arbitrary by nature. */
+  locationIds: external_exports.array(external_exports.string()).optional(),
+  /** Bytes of recordings stored on this PHYSICAL volume (all aliases). */
   usedBytes: external_exports.number(),
   /** Free bytes on the location's volume; null when capacity is unknown (remote). */
   availableBytes: external_exports.number().nullable(),
@@ -31251,6 +31570,77 @@ var recordingCapability = {
     listOpsLog: method(OpsLogQueryInputSchema, external_exports.array(OpsLogEntrySchema).readonly(), {
       kind: "query",
       auth: "admin"
+    }),
+    /**
+    * Move footage (segments and/or strips) from one recordings location to
+    * another — the drain workflow's mover (entity-routing spec Phase 4).
+    * Throttled copy → size-verify → delete source → index refresh; resumable
+    * by construction (copy-if-absent). Single-flight: one job at a time.
+    */
+    /**
+    * Render a short GIF from recorded footage around `aroundMs` (low profile,
+    * palette-free ffmpeg gif). Synchronous — the window is a few seconds of
+    * `low`, rendering in ~1-2s. Built for notification attachments: the
+    * caller gets bytes, nothing persists. Fails when no footage covers the
+    * window (camera not recording → caller skips the attachment).
+    */
+    renderGif: method(external_exports.object({
+      deviceId: external_exports.number(),
+      aroundMs: external_exports.number(),
+      preRollSec: external_exports.number().min(0).max(30).default(2),
+      postRollSec: external_exports.number().min(0).max(30).default(5),
+      maxWidth: external_exports.number().int().min(120).max(1280).default(480),
+      fps: external_exports.number().int().min(1).max(15).default(5)
+    }), external_exports.object({
+      gifBase64: external_exports.string(),
+      fromMs: external_exports.number(),
+      toMs: external_exports.number()
+    }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /**
+    * Render a short MP4 clip from recorded footage around `aroundMs` — the
+    * "send a clip, not a gif" notification attachment. Same window, source
+    * and fail-closed contract as {@link renderGif}: no footage covering the
+    * window ⇒ it throws and the caller ships no attachment. Re-encoded (never
+    * stream-copied) so a concat across segments with different encoder
+    * parameters still plays. Silent by contract.
+    *
+    * The returned window is SEGMENT-GRANULAR: the source playlist is built
+    * from whole segments, so the clip starts at or before `fromMs` and ends
+    * at or after `toMs` — overshoot bounded by one segment per side (an 8 s
+    * ask over 4 s segments measured 12 s). `fromMs`/`toMs` report the window
+    * ASKED for, not the encoded duration.
+    */
+    renderClip: method(external_exports.object({
+      deviceId: external_exports.number(),
+      aroundMs: external_exports.number(),
+      preRollSec: external_exports.number().min(0).max(30).default(3),
+      postRollSec: external_exports.number().min(0).max(30).default(7),
+      maxWidth: external_exports.number().int().min(160).max(1920).default(640)
+    }), external_exports.object({
+      clipBase64: external_exports.string(),
+      mime: external_exports.string(),
+      fromMs: external_exports.number(),
+      toMs: external_exports.number(),
+      bytes: external_exports.number().int()
+    }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    relocateFootage: method(RelocateFootageInputSchema, external_exports.object({ jobId: external_exports.string() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** Every known relocate job (in-RAM, newest-first). */
+    getRelocateStatus: method(external_exports.object({}), external_exports.array(RelocateJobSchema).readonly(), {
+      kind: "query",
+      auth: "admin"
+    }),
+    cancelRelocate: method(external_exports.object({ jobId: external_exports.string() }), external_exports.object({ cancelled: external_exports.boolean() }), {
+      kind: "mutation",
+      auth: "admin"
     })
   }
 };
@@ -32181,6 +32571,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "delete"
   },
+  "backup.deleteSchedule": {
+    capName: "backup",
+    capScope: "system",
+    addonId: null,
+    access: "delete"
+  },
   "backup.getEntries": {
     capName: "backup",
     capScope: "system",
@@ -32211,6 +32607,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "backup.listSchedules": {
+    capName: "backup",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "backup.previewSchedule": {
     capName: "backup",
     capScope: "system",
@@ -32235,6 +32637,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "backup.upsertSchedule": {
+    capName: "backup",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "battery.wakeForStream": {
     capName: "battery",
     capScope: "device",
@@ -32841,6 +33249,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "deviceManager.getDeviceStatusAggregateBatch": {
+    capName: "device-manager",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "deviceManager.getLinkedDevices": {
     capName: "device-manager",
     capScope: "system",
@@ -33735,6 +34149,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "localNetwork.getNotificationEndpoint": {
+    capName: "local-network",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "localNetwork.getPreferred": {
     capName: "local-network",
     capScope: "system",
@@ -33759,6 +34179,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "localNetwork.setNotificationEndpoint": {
+    capName: "local-network",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "lockControl.lock": {
     capName: "lock-control",
     capScope: "device",
@@ -34401,6 +34827,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "pipelineAnalytics.cancelMediaRelocate": {
+    capName: "pipeline-analytics",
+    capScope: "device",
+    addonId: null,
+    access: "create"
+  },
   "pipelineAnalytics.clearTracks": {
     capName: "pipeline-analytics",
     capScope: "device",
@@ -34455,6 +34887,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "pipelineAnalytics.getMediaRelocateStatus": {
+    capName: "pipeline-analytics",
+    capScope: "device",
+    addonId: null,
+    access: "view"
+  },
   "pipelineAnalytics.getMotionEvents": {
     capName: "pipeline-analytics",
     capScope: "device",
@@ -34527,6 +34965,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "pipelineAnalytics.relocateMedia": {
+    capName: "pipeline-analytics",
+    capScope: "device",
+    addonId: null,
+    access: "create"
+  },
   "pipelineAnalytics.searchObjectEvents": {
     capName: "pipeline-analytics",
     capScope: "device",
@@ -35289,6 +35733,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "recording.cancelRelocate": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "recording.deleteFootprint": {
     capName: "recording",
     capScope: "system",
@@ -35319,6 +35769,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "recording.getRelocateStatus": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "recording.getStorageUsage": {
     capName: "recording",
     capScope: "system",
@@ -35349,6 +35805,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "recording.relocateFootage": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "recording.renderClip": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "recording.renderGif": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "recording.rescanStorage": {
     capName: "recording",
     capScope: "system",
@@ -35943,6 +36417,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "streamBroker.renderPreBufferClip": {
+    capName: "stream-broker",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "streamBroker.restartProfile": {
     capName: "stream-broker",
     capScope: "system",

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runDiscover
-} from "./chunk-BRUAXYPT.js";
+} from "./chunk-7EQOMKUT.js";
 import "./chunk-K3NQKI34.js";
 
 // src/cli.ts
@@ -1079,7 +1079,7 @@ function isUnknown(_value) {
   return true;
 }
 async function resolveServerInteractive(presetNamespace) {
-  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-7CHGPGXE.js");
+  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-JDVFZ6NG.js");
   if (presetNamespace) {
     const spinner4 = clack.spinner();
     spinner4.start(`Discovering hub on LAN (namespace "${presetNamespace}")`);

package/dist/{discover-7CHGPGXE.js → discover-JDVFZ6NG.js}

@@ -5,7 +5,7 @@ import {
   filterHubNodes,
   resolveHubFromDiscovered,
   runDiscover
-} from "./chunk-BRUAXYPT.js";
+} from "./chunk-7EQOMKUT.js";
 import "./chunk-K3NQKI34.js";
 export {
   DEFAULT_HUB_HTTPS_PORT,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "camstack",
-  "version": "1.2.10",
+  "version": "1.2.12",
   "description": "CLI tool for managing and running CamStack server",
   "keywords": [
     "camstack",