camstack 1.2.20 → 1.2.22

package/dist/{chunk-INLS2YWL.js → chunk-2OGTDEYC.js}

@@ -14522,7 +14522,7 @@ function date4(params) {
 // ../../node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../types/dist/sleep-CeuvKr4N.mjs
+// ../types/dist/sleep-BxjBLp3L.mjs
 var WELL_KNOWN_TABS = [
   {
     id: "overview",
@@ -15626,6 +15626,7 @@ var RecordingConfigSchema = external_exports.object({
   scrubThumbnails: ScrubThumbnailPresetSchema.optional()
 }).strict();
 var RelocateJobStateSchema = external_exports.enum([
+  "queued",
   "running",
   "done",
   "failed",
@@ -15650,20 +15651,96 @@ var RelocateJobSchema = external_exports.object({
   finishedAt: external_exports.number().nullable(),
   error: external_exports.string().nullable()
 });
+var RelocateFootageClassSchema = external_exports.enum(["recordings", "recordingsLow"]);
 var RelocateFootageInputSchema = external_exports.object({
-  deviceId: external_exports.number().optional(),
   fromLocationId: external_exports.string(),
   toLocationId: external_exports.string(),
   entities: external_exports.array(external_exports.enum(["segments"])).optional(),
+  /** Limits relocation to the logical profile class. Omit only for the
+  * pre-orchestration compatibility path. */
+  footageClass: RelocateFootageClassSchema.optional(),
+  /** Scope the move to ONE camera. Absent = every camera on the source, which
+  *  is what a whole-disk drain means. The rebalance path always sets it: its
+  *  unit is a (camera, profile) pile, not a disk. */
+  deviceId: external_exports.number().int().optional(),
+  /** Scope the move to specific segment profiles (`high` / `mid` / `low`).
+  *  Finer than `footageClass`, which cannot separate high from mid — and the
+  *  placement plan assigns those two independently, so a rebalance that could
+  *  only say "recordings" would move footage the plan never asked to move. */
+  profiles: external_exports.array(external_exports.string()).optional(),
   /** Copy throttle in MB/s (default 40) — the drain is a background chore,
   *  never allowed to starve live writers. */
   throttleMbps: external_exports.number().min(1).max(1e3).optional()
 });
+var StorageMigrationLeaseInputSchema = external_exports.object({ leaseId: external_exports.string().min(1) });
+var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: external_exports.string().min(1) });
 var RelocateMediaInputSchema = external_exports.object({
-  deviceId: external_exports.number().optional(),
   toLocationId: external_exports.string(),
   throttleMbps: external_exports.number().min(1).max(1e3).optional()
 });
+var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: external_exports.string().min(1) });
+var StorageMigrationClassSchema = external_exports.enum([
+  "recordings",
+  "recordingsLow",
+  "eventMedia"
+]);
+var StorageMigrationDestinationsSchema = external_exports.object({
+  recordings: external_exports.string().min(1).optional(),
+  recordingsLow: external_exports.string().min(1).optional(),
+  eventMedia: external_exports.string().min(1).optional()
+}).refine((value) => Object.keys(value).length > 0, { message: "select at least one storage class" });
+var StorageMigrationInputSchema = external_exports.object({
+  destinations: StorageMigrationDestinationsSchema,
+  throttleMbps: external_exports.number().min(1).max(1e3).optional()
+});
+var StorageMigrationPhaseSchema = external_exports.enum([
+  "planning",
+  "pausing",
+  "moving",
+  "verifying",
+  "repointing",
+  "refreshing",
+  "resuming",
+  "done",
+  "failed",
+  "cancelled"
+]);
+var StorageMigrationParticipantSchema = external_exports.enum([
+  "pipeline",
+  "recorder",
+  "analytics"
+]);
+var StorageMigrationMoveSchema = external_exports.object({
+  storageClass: StorageMigrationClassSchema,
+  fromLocationId: external_exports.string(),
+  toLocationId: external_exports.string(),
+  moverJobId: external_exports.string().nullable(),
+  state: RelocateJobStateSchema.nullable(),
+  error: external_exports.string().nullable()
+});
+var StorageMigrationJobSchema = external_exports.object({
+  jobId: external_exports.string(),
+  phase: StorageMigrationPhaseSchema,
+  destinations: StorageMigrationDestinationsSchema,
+  throttleMbps: external_exports.number(),
+  moves: external_exports.array(StorageMigrationMoveSchema),
+  pauseLeaseId: external_exports.string().nullable(),
+  pausedParticipants: external_exports.array(StorageMigrationParticipantSchema),
+  repointed: external_exports.boolean(),
+  cancelRequested: external_exports.boolean(),
+  startedAt: external_exports.number(),
+  updatedAt: external_exports.number(),
+  finishedAt: external_exports.number().nullable(),
+  error: external_exports.string().nullable()
+});
+var StorageMigrationPlanSchema = external_exports.object({
+  destinations: StorageMigrationDestinationsSchema,
+  moves: external_exports.array(external_exports.object({
+    storageClass: StorageMigrationClassSchema,
+    fromLocationId: external_exports.string(),
+    toLocationId: external_exports.string()
+  }))
+});
 var StorageLocationTypeSchema = external_exports.string().regex(/^[a-z][a-zA-Z0-9-]*$/);
 var StorageLocationSchema = external_exports.object({
   id: external_exports.string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/),
@@ -15681,6 +15758,21 @@ var StorageLocationSchema = external_exports.object({
   nodeId: external_exports.string().optional(),
   isDefault: external_exports.boolean().default(false),
   isSystem: external_exports.boolean().default(false),
+  /**
+  * Operator opt-in: whether consumers that BALANCE across several locations
+  * of a type may write here. Recordings reads it today; event media and
+  * backups are the next consumers, which is why the flag lives on the
+  * location rather than in any one addon's store — nothing has to be
+  * extended to add the next consumer.
+  *
+  * OPTIONAL, and ABSENT MEANS ACTIVE. Every location persisted before the
+  * flag existed reads back with no flag and keeps working exactly as before;
+  * that is the whole compat story, and it is why no migration ships with it.
+  * A newly CREATED sibling is stamped `false` by the orchestrator (creating a
+  * disk must not silently start writing to it); the default of a type is
+  * always stamped `true`.
+  */
+  enabled: external_exports.boolean().optional(),
   /** COMPUTED at read time by the orchestrator (statfs of the backing volume
   *  for node-local locations it can reach) — never persisted, absent when the
   *  volume is remote/unreachable. The single capacity truth every UI reads. */
@@ -20575,9 +20667,9 @@ var filesystemBrowseCapability = {
   mode: "singleton",
   internal: true,
   methods: {
-    /** The allowed roots browsing is sandboxed to on this node. */
+    /** The roots `createDir` is sandboxed to on this node. Browsing is not confined to them. */
     listAllowedRoots: method(external_exports.void(), external_exports.array(external_exports.string()).readonly(), { auth: "admin" }),
-    /** Immediate subdirectories of `path` (must be within an allowed root) + free/total bytes. */
+    /** Immediate subdirectories of any absolute `path` + free/total bytes. Read-only. */
     browse: method(external_exports.object({ path: external_exports.string() }), BrowseResultSchema, { auth: "admin" }),
     /** Create a subdirectory (within an allowed root). Returns its absolute path. */
     createDir: method(external_exports.object({ path: external_exports.string() }), external_exports.object({ path: external_exports.string() }), {
@@ -22292,18 +22384,46 @@ var NcDeliverySchema = external_exports.enum([
   "system-event"
 ]);
 var NcSystemEventKindSchema = external_exports.enum([
-  "camera-online",
-  "camera-offline",
+  "device-online",
+  "device-offline",
+  "device-disabled",
+  "device-enabled",
   "stream-online",
   "stream-offline",
   "node-online",
   "node-offline",
   "addon-update-available",
-  "server-update-available"
+  "server-update-available",
+  "alarm-triggered",
+  "alarm-armed",
+  "alarm-disarmed",
+  "camera-online",
+  "camera-offline",
+  "camera-disabled",
+  "camera-enabled"
+]);
+var NC_LEGACY_SYSTEM_EVENT_KINDS = /* @__PURE__ */ new Set([
+  "camera-online",
+  "camera-offline",
+  "camera-disabled",
+  "camera-enabled"
 ]);
+var NC_AUTHORABLE_SYSTEM_EVENT_KINDS = NcSystemEventKindSchema.options.filter((kind) => !NC_LEGACY_SYSTEM_EVENT_KINDS.has(kind));
 var NcSystemEventConditionSchema = external_exports.object({
   kinds: external_exports.array(NcSystemEventKindSchema).min(1),
   deviceIds: external_exports.array(external_exports.number().int()).min(1).optional(),
+  /**
+  * Narrow a `device-*` kind to these device TYPES (`DeviceType` values —
+  * `camera`, `switch`, `sensor`, `container`, …). Absent = every type, which
+  * is what a liveness rule means when nobody said otherwise.
+  *
+  * This is where "only my cameras" is expressed, and it lives on the rule for
+  * one reason: the intake cannot know which devices this household cares
+  * about, and a producer-side filter is one no operator can change. Fails
+  * CLOSED — a subject whose device type is unknown (an id the device mirror
+  * does not carry) matches no `deviceTypes` list.
+  */
+  deviceTypes: external_exports.array(external_exports.string().min(1)).min(1).optional(),
   nodeIds: external_exports.array(external_exports.string().min(1)).min(1).optional(),
   packageNames: external_exports.array(external_exports.string().min(1)).min(1).optional()
 });
@@ -22339,6 +22459,16 @@ var NcOccupancyConditionSchema = external_exports.object({
   count: external_exports.number().int().min(0).default(1),
   sustainSeconds: external_exports.number().int().min(0).max(3600).default(15)
 });
+var NcAudioConditionSchema = external_exports.object({
+  /** Audio macro labels; absent = any sound (level-only rule). */
+  labels: external_exports.array(external_exports.string().min(1)).min(1).optional(),
+  /** Level floor in dBFS (negative-going, `0` = full scale); absent = any level. */
+  dbThreshold: external_exports.number().min(-96).max(0).optional(),
+  /** Percentage of the window's samples that must be hits (1–100). */
+  hitPercent: external_exports.number().int().min(1).max(100).default(60),
+  /** Length of the sampling window in seconds. */
+  samplingSeconds: external_exports.number().int().min(1).max(300).default(10)
+});
 var NcCrossingSchema = external_exports.enum([
   "enter",
   "exit",
@@ -22537,7 +22667,33 @@ var NcConditionsSchema = external_exports.object({
   * threshold and holds for `sustainSeconds`. Fail-closed on missing
   * substrate (no snapshot / missing zone). See {@link NcOccupancyCondition}.
   */
-  occupancy: NcOccupancyConditionSchema.optional()
+  occupancy: NcOccupancyConditionSchema.optional(),
+  /**
+  * IMMEDIATE only. Sustained-sound matcher — `hitPercent` of the samples in a
+  * `samplingSeconds` window clear the optional `dbThreshold` and carry one of
+  * the optional `labels`. Fail-closed on missing substrate (no audio samples,
+  * a window that is not full yet, neither filter given). See
+  * {@link NcAudioCondition}.
+  *
+  * Presence of this key is what makes a rule an AUDIO rule: the engine fires
+  * it ONLY on a confirmed audio window, and a rule carrying it never fires on
+  * a detection, a track or a device event (the same fail-closed pairing
+  * `occupancy` has with the `device-event` trigger). That is how audio labels
+  * leave `classes`: an audio rule names its sounds HERE, and the legacy path
+  * (an `immediate` rule naming an `audio-*` class, one notification per
+  * classified sample) stays exactly as it was for rules that already use it.
+  *
+  * NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
+  * rather than an oversight: the viewer mirrors the descriptor enums BY HAND
+  * (`camstack/src/data/notification-center.ts`, guarded by
+  * `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+  * condition fields it does not know when a rule is saved from the phone.
+  * Publishing an editor for a condition the app cannot round-trip is how an
+  * operator loses a rule's conditions by opening it — so the descriptor, the
+  * admin widget and the viewer mirror land together (P2 + P3), and only then
+  * does an audio rule become authorable.
+  */
+  audio: NcAudioConditionSchema.optional()
 });
 var NcRuleTargetSchema = external_exports.object({
   /** `notification-output` Target id. */
@@ -22614,6 +22770,44 @@ var NcThrottleSchema = external_exports.object({
   */
   granularity: NcThrottleGranularitySchema.optional()
 });
+var NC_CONFIRM_MIN_TIMEOUT_MS = 1e3;
+var NC_CONFIRM_MAX_TIMEOUT_MS = 2e4;
+var NC_CONFIRM_DEFAULT_TIMEOUT_MS = 8e3;
+var NcConfirmExpectSchema = external_exports.object({
+  op: external_exports.enum([
+    ">=",
+    ">",
+    "<=",
+    "<",
+    "=="
+  ]),
+  count: external_exports.number().int().min(0).max(1e3)
+});
+var NcConfirmSchema = external_exports.object({
+  /** Off unless asked for. An absent `confirm` and `enabled:false` are the
+  *  same thing, and both mean "deliver exactly as before". */
+  enabled: external_exports.boolean().default(false),
+  /** Explicit vision profile; absent = the `purpose:'vision'` cluster default. */
+  profileId: external_exports.string().optional(),
+  /**
+  * The operator's question, in his own words. Absent = a question derived
+  * from the rule (its class and its expectation).
+  *
+  * NEVER composed with text READ OUT OF THE FRAME. The model reads OSD
+  * banners, signage and plates as instructions if you let them reach the
+  * prompt — proven live — so the authoritative contract stays in the system
+  * turn and only rule-authored words land here.
+  */
+  prompt: external_exports.string().max(1e3).optional(),
+  /** Fire only when the model's count satisfies this. Absent = the model's
+  *  own boolean verdict decides. */
+  expect: NcConfirmExpectSchema.optional(),
+  timeoutMs: external_exports.number().int().min(NC_CONFIRM_MIN_TIMEOUT_MS).max(NC_CONFIRM_MAX_TIMEOUT_MS).default(NC_CONFIRM_DEFAULT_TIMEOUT_MS),
+  /** What a timeout / unreachable model MEANS. `fire` (default) = fail-open. */
+  onTimeout: external_exports.enum(["fire", "suppress"]).default("fire"),
+  /** Longest edge the judged image is downscaled to before it is sent. */
+  maxImagePx: external_exports.number().int().min(64).max(2048).default(448)
+});
 var NcRuleInputSchema = external_exports.object({
   name: external_exports.string().min(1).max(200),
   enabled: external_exports.boolean().default(true),
@@ -22673,9 +22867,45 @@ var NcRuleInputSchema = external_exports.object({
   * `{ cap: 'alarm-panel', method: 'arm', args: { mode: 'away' } }`, the same
   * shape as every other actuation.
   */
-  actions: NcRuleActionsSchema.optional()
+  actions: NcRuleActionsSchema.optional(),
+  /**
+  * AI CONFIRM — see {@link NcConfirmSchema}. `.optional()`, never defaulted:
+  * a rule that predates the gate must keep delivering byte-for-byte as it
+  * did, and absent is the only way to say that without a migration.
+  */
+  confirm: NcConfirmSchema.optional()
+});
+var NcRulePatchSchema = NcRuleInputSchema.partial().extend({
+  disabledTargetIds: external_exports.array(external_exports.string()).optional(),
+  /**
+  * `.partial()` DOES NOT REMOVE A FIELD'S `.default()`.
+  *
+  * It makes the key optional to SUPPLY; the parse still materialises the
+  * default when the key is absent. And `NcRuleStore.update` merges with
+  * `{ ...existing, ...patch }`, so a materialised key OVERWRITES the stored
+  * one — which made every partial edit destructive:
+  *
+  *   nc.updateRule({ throttle })         → conditions reset to `{}`
+  *   nc.setRuleTargetEnabled(...)        → conditions reset to `{}`
+  *   setEnabled(ruleId, false)           → conditions reset to `{}`
+  *
+  * A rule scoped to one camera and one zone silently became a rule that
+  * matches EVERY event on EVERY camera, and lost its `media` policy
+  * (zoneCrop / gif / clip / frame) and its `priority` at the same time. Seen
+  * live on 2026-08-12: a rule scoped to device 617 fired on 590 and 615
+  * within a minute of a two-field patch.
+  *
+  * So every defaulted field is re-declared here WITHOUT its default. The
+  * inner defaults still apply when the caller DOES send the key — `{}` for
+  * conditions remains a real instruction ("clear them") — and only the
+  * absent key is now genuinely absent.
+  */
+  enabled: external_exports.boolean().optional(),
+  conditions: NcConditionsSchema.optional(),
+  media: NcMediaPolicySchema.optional(),
+  throttle: NcThrottleSchema.optional(),
+  priority: external_exports.number().int().min(1).max(5).optional()
 });
-var NcRulePatchSchema = NcRuleInputSchema.partial().extend({ disabledTargetIds: external_exports.array(external_exports.string()).optional() });
 var NcRuleSchema = NcRuleInputSchema.extend({
   id: external_exports.string(),
   /** userId of the admin who created the rule (server-stamped caller). */
@@ -22918,6 +23148,15 @@ var NcAlarmSettingsSchema = external_exports.object({
   announceTargets: external_exports.array(external_exports.string().min(1)).max(16)
 });
 var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.partial();
+var NcAlarmSkipReasonSchema = external_exports.enum([
+  "muted",
+  "detection-off",
+  "offline"
+]);
+var NcAlarmSkippedDeviceSchema = external_exports.object({
+  deviceId: external_exports.number().int(),
+  reason: NcAlarmSkipReasonSchema
+});
 var NcAlarmModeCoverageSchema = external_exports.object({
   mode: AlarmArmModeSchema,
   /** Enabled rules gated on `armed_<mode>`. Zero means the mode does nothing. */
@@ -22925,7 +23164,18 @@ var NcAlarmModeCoverageSchema = external_exports.object({
   /** At least one covering rule has no device scope, so the mode covers all. */
   allDevices: external_exports.boolean(),
   /** Ids named by the covering rules. A SUBSET when `allDevices` is true. */
-  deviceIds: external_exports.array(external_exports.number().int())
+  deviceIds: external_exports.array(external_exports.number().int()),
+  /**
+  * Devices this mode NAMES but cannot actually arm, each with the switch that
+  * excludes it.
+  *
+  * "Away armed — 12 cameras" is a promise, and a muted camera among those
+  * twelve makes it false in exactly the way nobody notices until an incident.
+  * Defaulted to `[]` so a coverage answer computed before this field existed
+  * still parses as "nothing known to be skipped" rather than failing the whole
+  * alarm tab.
+  */
+  skippedDevices: external_exports.array(NcAlarmSkippedDeviceSchema).default([])
 });
 var NcAlarmConfigSchema = external_exports.object({
   /**
@@ -24185,20 +24435,28 @@ var pipelineAnalyticsCapability = {
     }),
     /** The events ops-log rows (newest-first), optionally scoped to one camera.
     *  Backed by a declared pipeline-analytics SQLite collection. */
-    /**
-    * Move event-media blobs onto `toLocationId` (entity-routing spec Phase
-    * 4): per-row copy → stamp row.locationId → delete old blob. Rows already
-    * at the target are skipped, so a re-run resumes. Single-flight.
-    */
-    relocateMedia: method(RelocateMediaInputSchema, external_exports.object({ jobId: external_exports.string() }), {
+    /** Internal migration-participant lease. It drains active MediaStore
+    * writes and refuses new ones without changing analytics bindings. */
+    pauseForStorageMigration: method(StorageMigrationLeaseInputSchema, external_exports.object({ paused: external_exports.literal(true) }), {
       kind: "mutation",
       auth: "admin"
     }),
-    getMediaRelocateStatus: method(external_exports.object({}), external_exports.array(RelocateJobSchema).readonly(), {
-      kind: "query",
+    resumeForStorageMigration: method(StorageMigrationLeaseInputSchema, external_exports.object({ resumed: external_exports.literal(true) }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** Drops cached location roots after the storage coordinator repoints a
+    * default so future event-media writes use the new root. */
+    refreshStorageLocationsForMigration: method(StorageMigrationLeaseInputSchema, external_exports.object({ refreshed: external_exports.literal(true) }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    startStorageMigrationMove: method(StorageMigrationMediaMoveInputSchema, external_exports.object({ jobId: external_exports.string() }), {
+      kind: "mutation",
       auth: "admin"
     }),
-    cancelMediaRelocate: method(external_exports.object({ jobId: external_exports.string() }), external_exports.object({ cancelled: external_exports.boolean() }), {
+    getStorageMigrationMoveStatus: method(external_exports.object({ jobId: external_exports.string() }), RelocateJobSchema.nullable(), { auth: "admin" }),
+    cancelStorageMigrationMove: method(external_exports.object({ jobId: external_exports.string() }), external_exports.object({ cancelled: external_exports.boolean() }), {
       kind: "mutation",
       auth: "admin"
     }),
@@ -26035,9 +26293,16 @@ var CameraStatusSchema = external_exports.object({
   audio: CameraAudioStatusSchema.nullable(),
   recording: CameraRecordingStatusSchema.nullable(),
   /**
-  * Per-camera function switches an OPERATOR has turned off
+  * Per-camera functions an OPERATOR has turned off
   * ([D61](../../../../docs/decisions/adr-0067.md)).
   *
+  * Composed from the AUTHORITIES themselves — the wrapper bindings,
+  * `RecordingConfig.enabled`, the notification mute, the broker's audio
+  * policy, the camera's own microphone — via `composeSwitchedOff`, not from
+  * the deprecated `getCameraSwitches` group ([D113](../../../../docs/decisions/adr-0113.md)).
+  * The badge outlives the control panel: the panel was a convenience, this is
+  * the difference between a camera being off and a camera being dead.
+  *
   * This is the difference between DISABLED and BROKEN. A camera whose
   * `detection` block reports zero fps and whose `switchedOff` contains
   * `'object-detection'` was switched off by a person; the same camera with an
@@ -26115,6 +26380,16 @@ var pipelineOrchestratorCapability = {
   nodeIdMode: "data",
   exposesDeviceSettings: true,
   methods: {
+    /** Internal storage-migration participant lease. While held, dispatch
+    * requests are accepted as pending but no new runner attachment starts. */
+    pauseForStorageMigration: method(StorageMigrationLeaseInputSchema, external_exports.object({ paused: external_exports.literal(true) }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    resumeForStorageMigration: method(StorageMigrationLeaseInputSchema, external_exports.object({ resumed: external_exports.literal(true) }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
     /**
     * Pin a camera's pipeline to a specific agent (L1 affinity).
     * The orchestrator re-evaluates the assignment immediately and persists
@@ -26454,6 +26729,10 @@ var pipelineOrchestratorCapability = {
       agentNodeId: external_exports.string().optional()
     }), CameraPipelineConfigSchema),
     /**
+    * @deprecated The aggregate switch group is being withdrawn
+    * ([D113](../../../../docs/decisions/adr-0113.md)). Build nothing new on
+    * this pair; read the authority directly.
+    *
     * The whole per-camera function switch group, DERIVED — never a stored
     * list ([D61](../../../../docs/decisions/adr-0067.md)).
     *
@@ -26467,9 +26746,23 @@ var pipelineOrchestratorCapability = {
     * `auth: 'view'` deliberately — a NON-admin must be able to see that a
     * camera is quiet because somebody switched it off. Only the mutation is
     * admin-gated.
+    *
+    * **Removal plan.** It stays and it KEEPS WORKING while shipped viewers
+    * (v1.0.305) and the admin UI still call it — removing it now is a broken
+    * app on a device nobody can redeploy from here. It is served by a thin
+    * shim over the same authorities (`camera-switch-service.ts`), so the
+    * behaviour of the pair is the behaviour of the authorities by
+    * construction. It is deleted once every surface reaches its own
+    * component's options and the last caller is gone. Nothing on this server
+    * reads it: `CameraStatus.switchedOff` is composed from the authorities
+    * directly via `composeSwitchedOff`.
     */
     getCameraSwitches: method(external_exports.object({ deviceId: external_exports.number() }), CameraSwitchGroupSchema),
     /**
+    * @deprecated See {@link getCameraSwitches}. Write the authority — the
+    * wrapper binding, `RecordingConfig.enabled`, the notification mute — not
+    * this ([D113](../../../../docs/decisions/adr-0113.md)).
+    *
     * Flip ONE switch, routed to its existing authority.
     *
     * Never writes a parallel map: `recording` patches `RecordingConfig.enabled`
@@ -26847,24 +27140,28 @@ var snapshotCapability = {
     *
     * `getSnapshotOverview` is cache-only by contract: it answers from whatever
     * the wrapper happens to hold and never captures. Under D93 the client
-    * versions its image URL on that answer, and an image REQUEST is what enrols
-    * a camera in the keep-warm loop. Both of those are satisfiable by the
-    * client's own image cache — `expo-image` is URL-keyed and never revalidates
-    * — so a URL painted in a previous session comes off disk with no network,
-    * no enrolment, and nothing warming. Measured on the live hub: reopening
-    * after two minutes idle painted 15 of 16 tiles at **168 s old** with zero
-    * HTTP requests, and the fleet only recovered because a later poll happened
-    * to observe a different identity.
+    * versions its image URL on that answer, and an image REQUEST was the only
+    * demand signal. Both of those are satisfiable by the client's own image
+    * cache — `expo-image` is URL-keyed and never revalidates — so a URL painted
+    * in a previous session comes off disk with no network, no demand, and no
+    * capture. Measured on the live hub: reopening after two minutes idle
+    * painted 15 of 16 tiles at **168 s old** with zero HTTP requests, and the
+    * fleet only recovered because a later poll happened to observe a different
+    * identity.
     *
     * ## The two properties that fix it
     *
     * **It is an RPC, so no client cache can answer it.** The demand signal
-    * always reaches the wrapper. This method therefore MAY create keep-warm
-    * subscriptions, where `getSnapshotOverview` must never (D93) — the
-    * distinction is not "one is newer" but that the overview poll is app-wide
-    * (a creating overview would warm every camera on the install) while this is
-    * called by a rendered surface naming the tiles it is actually painting, at
-    * the width it is painting them.
+    * always reaches the wrapper. This method therefore CAPTURES, where
+    * `getSnapshotOverview` must never (D93) — the distinction is not "one is
+    * newer" but that the overview poll is app-wide (a capturing overview would
+    * dial every camera on the install) while this is called by a rendered
+    * surface naming the tiles it is actually painting, at the width it is
+    * painting them.
+    *
+    * Since 2026-08-11 this is the ONLY thing that refreshes a snapshot: the
+    * server-side keep-warm loop was removed (operator directive — on-demand,
+    * always), so a camera nobody is looking at costs nothing at all.
     *
     * **It waits, briefly and boundedly, for the capture it triggered.** The
     * returned `capturedAt` is the frame the link will serve, not the frame the
@@ -27108,6 +27405,23 @@ var storageEvictableCapability = {
     }), EvictResultSchema, { kind: "mutation" })
   }
 };
+var storageMigrationCapability = {
+  name: "storage-migration",
+  scope: "system",
+  mode: "singleton",
+  methods: {
+    plan: method(StorageMigrationInputSchema, StorageMigrationPlanSchema, { auth: "admin" }),
+    start: method(StorageMigrationInputSchema, external_exports.object({ jobId: external_exports.string() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    status: method(external_exports.object({ jobId: external_exports.string().optional() }), StorageMigrationJobSchema.nullable(), { auth: "admin" }),
+    cancel: method(external_exports.object({ jobId: external_exports.string() }), external_exports.object({ cancelled: external_exports.boolean() }), {
+      kind: "mutation",
+      auth: "admin"
+    })
+  }
+};
 var ProviderInfoSchema = external_exports.discriminatedUnion("shouldSaveDiskSpace", [external_exports.object({
   providerId: external_exports.string().min(1),
   displayName: external_exports.string().min(1),
@@ -27222,6 +27536,24 @@ var TerminalProfileInfoSchema = external_exports.object({
   label: external_exports.string(),
   description: external_exports.string().optional()
 });
+var TerminalInstanceInfoSchema = external_exports.object({
+  instanceId: external_exports.string(),
+  cameraStableId: external_exports.string(),
+  nodeId: external_exports.string(),
+  profileId: external_exports.string(),
+  profileLabel: external_exports.string(),
+  name: external_exports.string(),
+  enabled: external_exports.boolean()
+});
+var TerminalLegacyCameraSchema = external_exports.object({
+  stableId: external_exports.string(),
+  nodeId: external_exports.string(),
+  profileId: external_exports.string(),
+  profileLabel: external_exports.string(),
+  name: external_exports.string(),
+  /** Only legacy monitor cameras can retain their historic stable identity. */
+  adoptable: external_exports.boolean()
+});
 var TerminalOutputEventSchema = external_exports.discriminatedUnion("kind", [external_exports.object({
   seq: external_exports.number().int().positive(),
   kind: external_exports.literal("data"),
@@ -27245,6 +27577,37 @@ var terminalSessionCapability = {
   methods: {
     /** Pre-declared profiles the operator may open. */
     listProfiles: method(external_exports.void(), external_exports.array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }),
+    /** Explicit durable Terminal instances, managed centrally on the hub. */
+    listInstances: method(external_exports.void(), external_exports.array(TerminalInstanceInfoSchema).readonly(), { auth: "admin" }),
+    createInstance: method(external_exports.object({
+      targetNodeId: external_exports.string().min(1),
+      profileId: external_exports.string().min(1),
+      name: external_exports.string().trim().min(1).max(160).optional()
+    }), TerminalInstanceInfoSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    deleteInstance: method(external_exports.object({ instanceId: external_exports.string().min(1) }), external_exports.void(), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    setInstanceEnabled: method(external_exports.object({
+      instanceId: external_exports.string().min(1),
+      enabled: external_exports.boolean()
+    }), TerminalInstanceInfoSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** Existing automatic cameras are shown for explicit migration only. */
+    listLegacyCameras: method(external_exports.void(), external_exports.array(TerminalLegacyCameraSchema).readonly(), { auth: "admin" }),
+    /** Explicitly adopt one legacy monitor camera, retaining its stable id. */
+    adoptLegacyMonitor: method(external_exports.object({
+      stableId: external_exports.string().min(1),
+      name: external_exports.string().trim().min(1).max(160).optional()
+    }), TerminalInstanceInfoSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
     /** Live sessions currently hosted by the provider. */
     listSessions: method(external_exports.void(), external_exports.array(TerminalSessionInfoSchema).readonly(), { auth: "admin" }),
     /**
@@ -27276,7 +27639,13 @@ var terminalSessionCapability = {
     pullOutput: method(external_exports.object({
       sessionId: external_exports.string(),
       afterSeq: external_exports.number().int().nonnegative(),
-      waitMs: external_exports.number().int().min(0).max(2e3).default(0)
+      waitMs: external_exports.number().int().min(0).max(2e3).default(0),
+      /**
+      * Wait when a just-opened session has no output yet. Kept opt-in so a
+      * browser's initial repaint remains immediate; the camera snapshot
+      * relay uses it to avoid encoding a blank startup frame.
+      */
+      waitForOutput: external_exports.boolean().optional()
     }), TerminalOutputBatchSchema, {
       kind: "mutation",
       auth: "admin",
@@ -29656,6 +30025,7 @@ var FaceInfoSchema = external_exports.object({
 var FaceFilterEnum = external_exports.enum([
   "unassigned",
   "recognized",
+  "identified",
   "all"
 ]);
 var MediaFileLiteSchema$1 = external_exports.object({
@@ -29695,6 +30065,8 @@ var faceGalleryCapability = {
       auth: "admin"
     }),
     listRecentFaces: method(external_exports.object({
+      /** Restrict to one camera. Absent keeps the cluster-wide gallery view. */
+      deviceId: external_exports.number().int().optional(),
       limit: external_exports.number().int().positive().optional(),
       filter: FaceFilterEnum.optional(),
       /**
@@ -31771,6 +32143,10 @@ var OsdSourceSchema = external_exports.discriminatedUnion("kind", [
     capName: external_exports.string().min(1).max(64),
     /** Dot path inside the slice, e.g. `detected`, `value`, `mode`. */
     valuePath: external_exports.string().min(1).max(64)
+  }),
+  external_exports.object({
+    kind: external_exports.literal("latest-recognition"),
+    recognition: external_exports.enum(["person", "plate"])
   })
 ]);
 var OsdSlotBindingSchema = external_exports.object({
@@ -31897,6 +32273,21 @@ var osdManagerCapability = {
       auth: "admin"
     }),
     /**
+    * Replace one camera's binding configuration from another. Writable source
+    * slots are mapped by ordinal onto writable target slots so different
+    * provider slot ids do not make the copied configuration disappear.
+    */
+    copyDeviceConfiguration: method(external_exports.object({
+      sourceDeviceId: external_exports.number().int(),
+      targetDeviceId: external_exports.number().int()
+    }), external_exports.object({
+      copied: external_exports.number().int().nonnegative(),
+      skipped: external_exports.number().int().nonnegative()
+    }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /**
     * Render without writing. `binding` overrides the stored one so an
     * editor can preview an unsaved change. Mutation kind only to carry
     * the binding object safely; no side effects.
@@ -32808,7 +33199,19 @@ var RecordingManifestSchema = external_exports.object({
 });
 var RecordingDeviceUsageSchema = external_exports.object({
   deviceId: external_exports.number(),
-  usedBytes: external_exports.number()
+  usedBytes: external_exports.number(),
+  /**
+  * Start of this camera's OLDEST indexed segment, across every profile and
+  * location — the "Oldest footage" column in Recordings → Storage, and the
+  * only honest answer to "is retention actually holding?" per camera.
+  *
+  * `null` = the camera has no footage. OPTIONAL because a recorder that
+  * predates this field omits it entirely, and a hub whose types carry the
+  * field must keep validating that older provider's payload: the framework
+  * (types) and the addon ship on different trains, and the addon is usually
+  * the later of the two.
+  */
+  oldestMs: external_exports.number().nullable().optional()
 });
 var RecordingLocationUsageSchema = external_exports.object({
   /** StorageLocation id; null for the legacy/degraded single-root fallback. */
@@ -32831,6 +33234,42 @@ var RecordingStorageUsageSchema = external_exports.object({
   devices: external_exports.array(RecordingDeviceUsageSchema),
   locations: external_exports.array(RecordingLocationUsageSchema)
 });
+var RecordingRebalanceMoveSchema = external_exports.object({
+  deviceId: external_exports.number(),
+  profile: external_exports.string(),
+  fromLocationId: external_exports.string(),
+  toLocationId: external_exports.string(),
+  bytes: external_exports.number(),
+  files: external_exports.number().int()
+});
+var RecordingRebalanceSkipReasonSchema = external_exports.enum([
+  "unassigned",
+  "target-not-writable",
+  "below-threshold",
+  "no-headroom"
+]);
+var RecordingRebalanceSkipSchema = external_exports.object({
+  deviceId: external_exports.number(),
+  profile: external_exports.string(),
+  fromLocationId: external_exports.string(),
+  /** The location the plan wants; null when the camera has no assignment. */
+  toLocationId: external_exports.string().nullable(),
+  bytes: external_exports.number(),
+  reason: RecordingRebalanceSkipReasonSchema
+});
+var RecordingRebalancePlanSchema = external_exports.object({
+  moves: external_exports.array(RecordingRebalanceMoveSchema),
+  skipped: external_exports.array(RecordingRebalanceSkipSchema),
+  bytesToMove: external_exports.number(),
+  /** Relocate job ids enqueued. Always empty for the plan (dry-run) call. */
+  jobIds: external_exports.array(external_exports.string())
+});
+var RecordingRebalanceInputSchema = external_exports.object({
+  /** Copy throttle in MB/s (default 40) — a rebalance is a background chore. */
+  throttleMbps: external_exports.number().min(1).max(1e3).optional(),
+  /** Ignore piles smaller than this (default 1 GB). */
+  minMoveGb: external_exports.number().min(0).optional()
+});
 var LocateSegmentResultSchema = external_exports.discriminatedUnion("kind", [external_exports.object({
   kind: external_exports.literal("segment"),
   startMs: external_exports.number(),
@@ -32981,12 +33420,6 @@ var recordingCapability = {
       auth: "admin"
     }),
     /**
-    * Move footage (recorded segments) from one recordings location to
-    * another — the drain workflow's mover (entity-routing spec Phase 4).
-    * Throttled copy → size-verify → delete source → index refresh; resumable
-    * by construction (copy-if-absent). Single-flight: one job at a time.
-    */
-    /**
     * Render a short GIF from recorded footage around `aroundMs` (low profile,
     * palette-free ffmpeg gif). Synchronous — the window is a few seconds of
     * `low`, rendering in ~1-2s. Built for notification attachments: the
@@ -33038,25 +33471,83 @@ var recordingCapability = {
       kind: "mutation",
       auth: "admin"
     }),
+    /** Internal migration-participant lease. Blocks new recorder attaches and
+    * waits for writers to exit while their watchers index final segments. */
+    pauseForStorageMigration: method(StorageMigrationLeaseInputSchema, external_exports.object({ paused: external_exports.literal(true) }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    resumeForStorageMigration: method(StorageMigrationLeaseInputSchema, external_exports.object({ resumed: external_exports.literal(true) }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** Re-resolve location roots after the coordinator changes defaults. */
+    refreshStorageLocationsForMigration: method(StorageMigrationLeaseInputSchema, external_exports.object({ refreshed: external_exports.literal(true) }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** Internal mover, callable only by the storage-migration coordinator. */
+    startStorageMigrationMove: method(StorageMigrationFootageMoveInputSchema, external_exports.object({ jobId: external_exports.string() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    getStorageMigrationMoveStatus: method(external_exports.object({ jobId: external_exports.string() }), RelocateJobSchema.nullable(), { auth: "admin" }),
+    cancelStorageMigrationMove: method(external_exports.object({ jobId: external_exports.string() }), external_exports.object({ cancelled: external_exports.boolean() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /**
+    * Move footage between locations — the OPERATOR's mover, scoped to one
+    * camera (and optionally to specific profiles) rather than a whole disk.
+    * Queued FIFO behind the single-flight engine, so arming several is safe.
+    */
     relocateFootage: method(RelocateFootageInputSchema, external_exports.object({ jobId: external_exports.string() }), {
       kind: "mutation",
       auth: "admin"
     }),
-    /** Every known relocate job (in-RAM, newest-first). */
-    getRelocateStatus: method(external_exports.object({}), external_exports.array(RelocateJobSchema).readonly(), {
+    /** Every relocate job this recorder knows about, newest first (in RAM: the
+    *  move is resumable, so a lost list costs nothing but the display). */
+    listRelocateJobs: method(external_exports.object({}), external_exports.array(RelocateJobSchema).readonly(), {
+      kind: "query",
+      auth: "admin"
+    }),
+    /** Cancel a running or queued relocate job. A queued job never runs. */
+    cancelRelocateJob: method(external_exports.object({ jobId: external_exports.string() }), external_exports.object({ cancelled: external_exports.boolean() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** What a rebalance WOULD move, and what it would refuse. Moves nothing. */
+    planStorageRebalance: method(RecordingRebalanceInputSchema, RecordingRebalancePlanSchema, {
       kind: "query",
       auth: "admin"
     }),
-    cancelRelocate: method(external_exports.object({ jobId: external_exports.string() }), external_exports.object({ cancelled: external_exports.boolean() }), {
+    /** Arm the rebalance: enqueue one relocate job per planned move. */
+    startStorageRebalance: method(RecordingRebalanceInputSchema, RecordingRebalancePlanSchema, {
       kind: "mutation",
       auth: "admin"
     })
   }
 };
 var ExportSpeedSchema = external_exports.number().min(0.25).max(32);
+var ExportDenseRangeSchema = external_exports.object({
+  fromSec: external_exports.number().nonnegative(),
+  toSec: external_exports.number().nonnegative()
+}).refine((r) => r.toSec > r.fromSec, { message: "dense range must have toSec > fromSec" });
+var ExportDenseSchema = external_exports.object({
+  everyMs: external_exports.number().int().positive(),
+  ranges: external_exports.array(ExportDenseRangeSchema).min(1).max(200)
+});
 var ExportTimelapseSchema = external_exports.object({
   everyMs: external_exports.number().int().positive(),
-  outputFps: external_exports.number().int().min(1).max(60).optional()
+  outputFps: external_exports.number().int().min(1).max(60).optional(),
+  /** Optional second, FASTER rate over the intervals that matter. */
+  dense: ExportDenseSchema.optional()
+}).superRefine((v, ctx) => {
+  if (v.dense !== void 0 && v.dense.everyMs >= v.everyMs) ctx.addIssue({
+    code: external_exports.ZodIssueCode.custom,
+    message: "dense.everyMs must be strictly smaller than the base everyMs",
+    path: ["dense", "everyMs"]
+  });
 });
 var ExportOptionsSchema = external_exports.object({
   speed: ExportSpeedSchema.optional(),
@@ -33106,8 +33597,16 @@ var ExportDownloadSchema = external_exports.object({
   url: external_exports.string(),
   endpoints: external_exports.array(external_exports.string())
 });
+var RECORDING_EXPORT_MAX_READ_BYTES = 50 * 1024 * 1024;
+var ExportBytesSchema = external_exports.object({
+  base64: external_exports.string(),
+  contentType: external_exports.string(),
+  /** Suggested filename, extension included. */
+  name: external_exports.string(),
+  bytes: external_exports.number().int().nonnegative()
+});
 var recordingExportCapability = {
-  name: "recordingExport",
+  name: "recording-export",
   scope: "system",
   mode: "singleton",
   methods: {
@@ -33145,6 +33644,27 @@ var recordingExportCapability = {
     getDownloadUrl: method(external_exports.object({ exportId: external_exports.string() }), ExportDownloadSchema, {
       kind: "query",
       auth: "protected"
+    }),
+    /**
+    * The finished file's BYTES, base64, for a caller that must republish them
+    * somewhere a session-less fetcher can reach.
+    *
+    * `getDownloadUrl` is the right answer for a human: the download route is
+    * served `access: 'authenticated'`, which a browser satisfies and a
+    * notifier BACKEND does not. It answers a RELATIVE path, so it is not even
+    * a URL an outside fetcher could try. This method exists for the one case
+    * that needs the other thing — a scheduled timelapse whose video has to
+    * become a public attachment on the notification artifact plane.
+    *
+    * Deliberately narrow: `ready` only (a queued, rendering, failed, expired
+    * or deleted export has no file, and answering "0 bytes" for one is how a
+    * caller ships an empty attachment), still inside its lifetime, and under
+    * {@link RECORDING_EXPORT_MAX_READ_BYTES}. Every refusal throws with the
+    * reason — none of them is silent.
+    */
+    readExportBytes: method(external_exports.object({ exportId: external_exports.string() }), ExportBytesSchema, {
+      kind: "query",
+      auth: "protected"
     })
   }
 };
@@ -37396,6 +37916,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "delete"
   },
+  "osdManager.copyDeviceConfiguration": {
+    capName: "osd-manager",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "osdManager.getConditionSupport": {
     capName: "osd-manager",
     capScope: "system",
@@ -37492,7 +38018,7 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
-  "pipelineAnalytics.cancelMediaRelocate": {
+  "pipelineAnalytics.cancelStorageMigrationMove": {
     capName: "pipeline-analytics",
     capScope: "device",
     addonId: null,
@@ -37564,12 +38090,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
-  "pipelineAnalytics.getMediaRelocateStatus": {
-    capName: "pipeline-analytics",
-    capScope: "device",
-    addonId: null,
-    access: "view"
-  },
   "pipelineAnalytics.getMotionEvents": {
     capName: "pipeline-analytics",
     capScope: "device",
@@ -37606,6 +38126,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "pipelineAnalytics.getStorageMigrationMoveStatus": {
+    capName: "pipeline-analytics",
+    capScope: "device",
+    addonId: null,
+    access: "view"
+  },
   "pipelineAnalytics.getTrack": {
     capName: "pipeline-analytics",
     capScope: "device",
@@ -37684,6 +38210,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "pipelineAnalytics.pauseForStorageMigration": {
+    capName: "pipeline-analytics",
+    capScope: "device",
+    addonId: null,
+    access: "create"
+  },
   "pipelineAnalytics.proposeRetrainAnnotations": {
     capName: "pipeline-analytics",
     capScope: "device",
@@ -37714,7 +38246,7 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
-  "pipelineAnalytics.relocateMedia": {
+  "pipelineAnalytics.refreshStorageLocationsForMigration": {
     capName: "pipeline-analytics",
     capScope: "device",
     addonId: null,
@@ -37726,6 +38258,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "pipelineAnalytics.resumeForStorageMigration": {
+    capName: "pipeline-analytics",
+    capScope: "device",
+    addonId: null,
+    access: "create"
+  },
   "pipelineAnalytics.saveRetrainAnnotations": {
     capName: "pipeline-analytics",
     capScope: "device",
@@ -37750,6 +38288,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "pipelineAnalytics.startStorageMigrationMove": {
+    capName: "pipeline-analytics",
+    capScope: "device",
+    addonId: null,
+    access: "create"
+  },
   "pipelineAnalytics.wipeAllAnalytics": {
     capName: "pipeline-analytics",
     capScope: "device",
@@ -38116,6 +38660,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "pipelineOrchestrator.pauseForStorageMigration": {
+    capName: "pipeline-orchestrator",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "pipelineOrchestrator.rebalance": {
     capName: "pipeline-orchestrator",
     capScope: "system",
@@ -38140,6 +38690,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "pipelineOrchestrator.resumeForStorageMigration": {
+    capName: "pipeline-orchestrator",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "pipelineOrchestrator.saveTemplate": {
     capName: "pipeline-orchestrator",
     capScope: "system",
@@ -38536,7 +39092,13 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
-  "recording.cancelRelocate": {
+  "recording.cancelRelocateJob": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "recording.cancelStorageMigrationMove": {
     capName: "recording",
     capScope: "system",
     addonId: null,
@@ -38572,7 +39134,7 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
-  "recording.getRelocateStatus": {
+  "recording.getStorageMigrationMoveStatus": {
     capName: "recording",
     capScope: "system",
     addonId: null,
@@ -38590,12 +39152,30 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "recording.listRelocateJobs": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "recording.locateSegment": {
     capName: "recording",
     capScope: "system",
     addonId: null,
     access: "view"
   },
+  "recording.pauseForStorageMigration": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "recording.planStorageRebalance": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "recording.pruneFootage": {
     capName: "recording",
     capScope: "system",
@@ -38614,6 +39194,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "recording.refreshStorageLocationsForMigration": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "recording.relocateFootage": {
     capName: "recording",
     capScope: "system",
@@ -38638,44 +39224,68 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "recording.resumeForStorageMigration": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "recording.setDeviceConfig": {
     capName: "recording",
     capScope: "system",
     addonId: null,
     access: "create"
   },
+  "recording.startStorageMigrationMove": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "recording.startStorageRebalance": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "recordingExport.cancelExport": {
-    capName: "recordingExport",
+    capName: "recording-export",
     capScope: "system",
     addonId: null,
     access: "create"
   },
   "recordingExport.createExport": {
-    capName: "recordingExport",
+    capName: "recording-export",
     capScope: "system",
     addonId: null,
     access: "create"
   },
   "recordingExport.deleteExport": {
-    capName: "recordingExport",
+    capName: "recording-export",
     capScope: "system",
     addonId: null,
     access: "delete"
   },
   "recordingExport.getDownloadUrl": {
-    capName: "recordingExport",
+    capName: "recording-export",
     capScope: "system",
     addonId: null,
     access: "view"
   },
   "recordingExport.getExport": {
-    capName: "recordingExport",
+    capName: "recording-export",
     capScope: "system",
     addonId: null,
     access: "view"
   },
   "recordingExport.listExports": {
-    capName: "recordingExport",
+    capName: "recording-export",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "recordingExport.readExportBytes": {
+    capName: "recording-export",
     capScope: "system",
     addonId: null,
     access: "view"
@@ -39034,6 +39644,30 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "storageMigration.cancel": {
+    capName: "storage-migration",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "storageMigration.plan": {
+    capName: "storage-migration",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "storageMigration.start": {
+    capName: "storage-migration",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "storageMigration.status": {
+    capName: "storage-migration",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "storageProvider.abortUpload": {
     capName: "storage-provider",
     capScope: "system",
@@ -39412,12 +40046,42 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "terminalSession.adoptLegacyMonitor": {
+    capName: "terminal-session",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "terminalSession.close": {
     capName: "terminal-session",
     capScope: "system",
     addonId: null,
     access: "create"
   },
+  "terminalSession.createInstance": {
+    capName: "terminal-session",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "terminalSession.deleteInstance": {
+    capName: "terminal-session",
+    capScope: "system",
+    addonId: null,
+    access: "delete"
+  },
+  "terminalSession.listInstances": {
+    capName: "terminal-session",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "terminalSession.listLegacyCameras": {
+    capName: "terminal-session",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "terminalSession.listProfiles": {
     capName: "terminal-session",
     capScope: "system",
@@ -39448,6 +40112,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "terminalSession.setInstanceEnabled": {
+    capName: "terminal-session",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "terminalSession.writeInput": {
     capName: "terminal-session",
     capScope: "system",
@@ -39968,6 +40638,12 @@ var CadenceSecField = external_exports.number().int().min(2).max(3600);
 var FramerateField = external_exports.number().int().min(1).max(60);
 var TargetsField = external_exports.array(NcRuleTargetSchema).min(1);
 var PriorityField = external_exports.number().int().min(1).max(5);
+var TIMELAPSE_DENSE_FLOOR_SEC = 0.1;
+var DenseCadenceSecField = external_exports.number().min(TIMELAPSE_DENSE_FLOOR_SEC).max(3600);
+var MinDwellSecField = external_exports.number().min(0).max(60);
+var PreviewTextField = external_exports.string().max(200);
+var PreviewModeField = external_exports.enum(["image", "gif"]);
+var ReportClassesField = external_exports.array(external_exports.string().min(1).max(40)).max(20);
 var TimelapseRuleInputSchema = external_exports.object({
   name: NameField,
   enabled: external_exports.boolean().default(true),
@@ -39983,9 +40659,30 @@ var TimelapseRuleInputSchema = external_exports.object({
   cadenceSec: CadenceSecField.default(15),
   /** Output frames per second of the assembled mp4 (predecessor parity). */
   framerate: FramerateField.default(10),
+  /**
+  * Explicit dense cadence — see {@link DenseCadenceSecField}. Absent ⇒ derived
+  * as `max(1s, cadenceSec / 30)`, which is what every rule written before this
+  * field gets.
+  */
+  denseCadenceSec: DenseCadenceSecField.optional(),
+  /** Output-seconds guarantee per detection range — see {@link MinDwellSecField}. */
+  minDwellSec: MinDwellSecField.optional(),
   /** `notification-output` targets the finished video/thumbnail is sent to. */
   targets: TargetsField,
   template: TimelapseTemplateSchema.optional(),
+  /**
+  * Caption on the notification's PREVIEW FRAME — see {@link PreviewTextField}
+  * and {@link DEFAULT_TIMELAPSE_PREVIEW_TEXT}.
+  *
+  * Deliberately NOT part of {@link TimelapseTemplateSchema}: that object is
+  * the notification's title/body, and clearing it (`template: null`) must not
+  * silently clear the caption too.
+  */
+  previewText: PreviewTextField.optional(),
+  /** Still or animation — see {@link PreviewModeField}. */
+  previewMode: PreviewModeField.default("image"),
+  /** Classes the notification counts — see {@link ReportClassesField}. */
+  reportClasses: ReportClassesField.optional(),
   /** Canonical notification priority ordinal (1..5); per-target overridable. */
   priority: PriorityField.default(3)
 });
@@ -39996,8 +40693,13 @@ var TimelapseRulePatchSchema = external_exports.object({
   schedule: NcScheduleSchema.optional(),
   cadenceSec: CadenceSecField.optional(),
   framerate: FramerateField.optional(),
+  denseCadenceSec: DenseCadenceSecField.optional(),
+  minDwellSec: MinDwellSecField.optional(),
   targets: TargetsField.optional(),
   template: TimelapseTemplateSchema.nullable().optional(),
+  previewText: PreviewTextField.optional(),
+  previewMode: PreviewModeField.optional(),
+  reportClasses: ReportClassesField.optional(),
   priority: PriorityField.optional()
 });
 var TimelapseRuleSchema = TimelapseRuleInputSchema.extend({
@@ -40009,10 +40711,28 @@ var TimelapseRuleSchema = TimelapseRuleInputSchema.extend({
   */
   ownerUserId: external_exports.string().optional(),
   /**
-  * Epoch-ms of the last successful generation — the 1-hour re-generation
-  * guard's durable state (predecessor parity). Absent = never generated.
+  * Epoch-ms of the NEWEST successful generation across every camera of this
+  * rule. What a UI shows, and the compatibility floor for
+  * {@link readTimelapseGeneratedAt}. Absent = never generated.
   */
   lastGeneratedAt: external_exports.number().optional(),
+  /**
+  * PER-CAMERA generation state, keyed by `String(deviceId)` — the
+  * re-generation guard's real durable state.
+  *
+  * One rule covers several cameras and each renders its own video, so a rule
+  * -wide stamp is wrong in the direction that DESTROYS work: camera A
+  * succeeding at 06:05 tells camera B, whose render failed, that it is
+  * already done — and B's night is gone for good, because the window will not
+  * come back.
+  *
+  * ADDITIVE, so the migration is free: a row written before this field simply
+  * has no map, and {@link readTimelapseGeneratedAt} falls back to
+  * {@link TimelapseRuleSchema.shape.lastGeneratedAt}. Reading an old row as
+  * "never generated" would re-render and re-notify every camera of every rule
+  * once, on the deploy that shipped the map.
+  */
+  generatedByDevice: external_exports.record(external_exports.string(), external_exports.number()).optional(),
   /** userId of the caller who created the rule (server-stamped). */
   createdBy: external_exports.string(),
   createdAt: external_exports.number(),