camstack 1.2.21 → 1.2.23

package/dist/{chunk-MBRFZXSS.js → chunk-GGJX3DXD.js}

@@ -15626,6 +15626,7 @@ var RecordingConfigSchema = external_exports.object({
   scrubThumbnails: ScrubThumbnailPresetSchema.optional()
 }).strict();
 var RelocateJobStateSchema = external_exports.enum([
+  "queued",
   "running",
   "done",
   "failed",
@@ -15658,6 +15659,15 @@ var RelocateFootageInputSchema = external_exports.object({
   /** Limits relocation to the logical profile class. Omit only for the
   * pre-orchestration compatibility path. */
   footageClass: RelocateFootageClassSchema.optional(),
+  /** Scope the move to ONE camera. Absent = every camera on the source, which
+  *  is what a whole-disk drain means. The rebalance path always sets it: its
+  *  unit is a (camera, profile) pile, not a disk. */
+  deviceId: external_exports.number().int().optional(),
+  /** Scope the move to specific segment profiles (`high` / `mid` / `low`).
+  *  Finer than `footageClass`, which cannot separate high from mid — and the
+  *  placement plan assigns those two independently, so a rebalance that could
+  *  only say "recordings" would move footage the plan never asked to move. */
+  profiles: external_exports.array(external_exports.string()).optional(),
   /** Copy throttle in MB/s (default 40) — the drain is a background chore,
   *  never allowed to starve live writers. */
   throttleMbps: external_exports.number().min(1).max(1e3).optional()
@@ -15748,6 +15758,21 @@ var StorageLocationSchema = external_exports.object({
   nodeId: external_exports.string().optional(),
   isDefault: external_exports.boolean().default(false),
   isSystem: external_exports.boolean().default(false),
+  /**
+  * Operator opt-in: whether consumers that BALANCE across several locations
+  * of a type may write here. Recordings reads it today; event media and
+  * backups are the next consumers, which is why the flag lives on the
+  * location rather than in any one addon's store — nothing has to be
+  * extended to add the next consumer.
+  *
+  * OPTIONAL, and ABSENT MEANS ACTIVE. Every location persisted before the
+  * flag existed reads back with no flag and keeps working exactly as before;
+  * that is the whole compat story, and it is why no migration ships with it.
+  * A newly CREATED sibling is stamped `false` by the orchestrator (creating a
+  * disk must not silently start writing to it); the default of a type is
+  * always stamped `true`.
+  */
+  enabled: external_exports.boolean().optional(),
   /** COMPUTED at read time by the orchestrator (statfs of the backing volume
   *  for node-local locations it can reach) — never persisted, absent when the
   *  volume is remote/unreachable. The single capacity truth every UI reads. */
@@ -20642,9 +20667,9 @@ var filesystemBrowseCapability = {
   mode: "singleton",
   internal: true,
   methods: {
-    /** The allowed roots browsing is sandboxed to on this node. */
+    /** The roots `createDir` is sandboxed to on this node. Browsing is not confined to them. */
     listAllowedRoots: method(external_exports.void(), external_exports.array(external_exports.string()).readonly(), { auth: "admin" }),
-    /** Immediate subdirectories of `path` (must be within an allowed root) + free/total bytes. */
+    /** Immediate subdirectories of any absolute `path` + free/total bytes. Read-only. */
     browse: method(external_exports.object({ path: external_exports.string() }), BrowseResultSchema, { auth: "admin" }),
     /** Create a subdirectory (within an allowed root). Returns its absolute path. */
     createDir: method(external_exports.object({ path: external_exports.string() }), external_exports.object({ path: external_exports.string() }), {
@@ -22359,18 +22384,46 @@ var NcDeliverySchema = external_exports.enum([
   "system-event"
 ]);
 var NcSystemEventKindSchema = external_exports.enum([
-  "camera-online",
-  "camera-offline",
+  "device-online",
+  "device-offline",
+  "device-disabled",
+  "device-enabled",
   "stream-online",
   "stream-offline",
   "node-online",
   "node-offline",
   "addon-update-available",
-  "server-update-available"
+  "server-update-available",
+  "alarm-triggered",
+  "alarm-armed",
+  "alarm-disarmed",
+  "camera-online",
+  "camera-offline",
+  "camera-disabled",
+  "camera-enabled"
 ]);
+var NC_LEGACY_SYSTEM_EVENT_KINDS = /* @__PURE__ */ new Set([
+  "camera-online",
+  "camera-offline",
+  "camera-disabled",
+  "camera-enabled"
+]);
+var NC_AUTHORABLE_SYSTEM_EVENT_KINDS = NcSystemEventKindSchema.options.filter((kind) => !NC_LEGACY_SYSTEM_EVENT_KINDS.has(kind));
 var NcSystemEventConditionSchema = external_exports.object({
   kinds: external_exports.array(NcSystemEventKindSchema).min(1),
   deviceIds: external_exports.array(external_exports.number().int()).min(1).optional(),
+  /**
+  * Narrow a `device-*` kind to these device TYPES (`DeviceType` values —
+  * `camera`, `switch`, `sensor`, `container`, …). Absent = every type, which
+  * is what a liveness rule means when nobody said otherwise.
+  *
+  * This is where "only my cameras" is expressed, and it lives on the rule for
+  * one reason: the intake cannot know which devices this household cares
+  * about, and a producer-side filter is one no operator can change. Fails
+  * CLOSED — a subject whose device type is unknown (an id the device mirror
+  * does not carry) matches no `deviceTypes` list.
+  */
+  deviceTypes: external_exports.array(external_exports.string().min(1)).min(1).optional(),
   nodeIds: external_exports.array(external_exports.string().min(1)).min(1).optional(),
   packageNames: external_exports.array(external_exports.string().min(1)).min(1).optional()
 });
@@ -22406,6 +22459,16 @@ var NcOccupancyConditionSchema = external_exports.object({
   count: external_exports.number().int().min(0).default(1),
   sustainSeconds: external_exports.number().int().min(0).max(3600).default(15)
 });
+var NcAudioConditionSchema = external_exports.object({
+  /** Audio macro labels; absent = any sound (level-only rule). */
+  labels: external_exports.array(external_exports.string().min(1)).min(1).optional(),
+  /** Level floor in dBFS (negative-going, `0` = full scale); absent = any level. */
+  dbThreshold: external_exports.number().min(-96).max(0).optional(),
+  /** Percentage of the window's samples that must be hits (1–100). */
+  hitPercent: external_exports.number().int().min(1).max(100).default(60),
+  /** Length of the sampling window in seconds. */
+  samplingSeconds: external_exports.number().int().min(1).max(300).default(10)
+});
 var NcCrossingSchema = external_exports.enum([
   "enter",
   "exit",
@@ -22604,7 +22667,33 @@ var NcConditionsSchema = external_exports.object({
   * threshold and holds for `sustainSeconds`. Fail-closed on missing
   * substrate (no snapshot / missing zone). See {@link NcOccupancyCondition}.
   */
-  occupancy: NcOccupancyConditionSchema.optional()
+  occupancy: NcOccupancyConditionSchema.optional(),
+  /**
+  * IMMEDIATE only. Sustained-sound matcher — `hitPercent` of the samples in a
+  * `samplingSeconds` window clear the optional `dbThreshold` and carry one of
+  * the optional `labels`. Fail-closed on missing substrate (no audio samples,
+  * a window that is not full yet, neither filter given). See
+  * {@link NcAudioCondition}.
+  *
+  * Presence of this key is what makes a rule an AUDIO rule: the engine fires
+  * it ONLY on a confirmed audio window, and a rule carrying it never fires on
+  * a detection, a track or a device event (the same fail-closed pairing
+  * `occupancy` has with the `device-event` trigger). That is how audio labels
+  * leave `classes`: an audio rule names its sounds HERE, and the legacy path
+  * (an `immediate` rule naming an `audio-*` class, one notification per
+  * classified sample) stays exactly as it was for rules that already use it.
+  *
+  * NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
+  * rather than an oversight: the viewer mirrors the descriptor enums BY HAND
+  * (`camstack/src/data/notification-center.ts`, guarded by
+  * `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+  * condition fields it does not know when a rule is saved from the phone.
+  * Publishing an editor for a condition the app cannot round-trip is how an
+  * operator loses a rule's conditions by opening it — so the descriptor, the
+  * admin widget and the viewer mirror land together (P2 + P3), and only then
+  * does an audio rule become authorable.
+  */
+  audio: NcAudioConditionSchema.optional()
 });
 var NcRuleTargetSchema = external_exports.object({
   /** `notification-output` Target id. */
@@ -22681,6 +22770,44 @@ var NcThrottleSchema = external_exports.object({
   */
   granularity: NcThrottleGranularitySchema.optional()
 });
+var NC_CONFIRM_MIN_TIMEOUT_MS = 1e3;
+var NC_CONFIRM_MAX_TIMEOUT_MS = 2e4;
+var NC_CONFIRM_DEFAULT_TIMEOUT_MS = 8e3;
+var NcConfirmExpectSchema = external_exports.object({
+  op: external_exports.enum([
+    ">=",
+    ">",
+    "<=",
+    "<",
+    "=="
+  ]),
+  count: external_exports.number().int().min(0).max(1e3)
+});
+var NcConfirmSchema = external_exports.object({
+  /** Off unless asked for. An absent `confirm` and `enabled:false` are the
+  *  same thing, and both mean "deliver exactly as before". */
+  enabled: external_exports.boolean().default(false),
+  /** Explicit vision profile; absent = the `purpose:'vision'` cluster default. */
+  profileId: external_exports.string().optional(),
+  /**
+  * The operator's question, in his own words. Absent = a question derived
+  * from the rule (its class and its expectation).
+  *
+  * NEVER composed with text READ OUT OF THE FRAME. The model reads OSD
+  * banners, signage and plates as instructions if you let them reach the
+  * prompt — proven live — so the authoritative contract stays in the system
+  * turn and only rule-authored words land here.
+  */
+  prompt: external_exports.string().max(1e3).optional(),
+  /** Fire only when the model's count satisfies this. Absent = the model's
+  *  own boolean verdict decides. */
+  expect: NcConfirmExpectSchema.optional(),
+  timeoutMs: external_exports.number().int().min(NC_CONFIRM_MIN_TIMEOUT_MS).max(NC_CONFIRM_MAX_TIMEOUT_MS).default(NC_CONFIRM_DEFAULT_TIMEOUT_MS),
+  /** What a timeout / unreachable model MEANS. `fire` (default) = fail-open. */
+  onTimeout: external_exports.enum(["fire", "suppress"]).default("fire"),
+  /** Longest edge the judged image is downscaled to before it is sent. */
+  maxImagePx: external_exports.number().int().min(64).max(2048).default(448)
+});
 var NcRuleInputSchema = external_exports.object({
   name: external_exports.string().min(1).max(200),
   enabled: external_exports.boolean().default(true),
@@ -22740,9 +22867,45 @@ var NcRuleInputSchema = external_exports.object({
   * `{ cap: 'alarm-panel', method: 'arm', args: { mode: 'away' } }`, the same
   * shape as every other actuation.
   */
-  actions: NcRuleActionsSchema.optional()
+  actions: NcRuleActionsSchema.optional(),
+  /**
+  * AI CONFIRM — see {@link NcConfirmSchema}. `.optional()`, never defaulted:
+  * a rule that predates the gate must keep delivering byte-for-byte as it
+  * did, and absent is the only way to say that without a migration.
+  */
+  confirm: NcConfirmSchema.optional()
+});
+var NcRulePatchSchema = NcRuleInputSchema.partial().extend({
+  disabledTargetIds: external_exports.array(external_exports.string()).optional(),
+  /**
+  * `.partial()` DOES NOT REMOVE A FIELD'S `.default()`.
+  *
+  * It makes the key optional to SUPPLY; the parse still materialises the
+  * default when the key is absent. And `NcRuleStore.update` merges with
+  * `{ ...existing, ...patch }`, so a materialised key OVERWRITES the stored
+  * one — which made every partial edit destructive:
+  *
+  *   nc.updateRule({ throttle })         → conditions reset to `{}`
+  *   nc.setRuleTargetEnabled(...)        → conditions reset to `{}`
+  *   setEnabled(ruleId, false)           → conditions reset to `{}`
+  *
+  * A rule scoped to one camera and one zone silently became a rule that
+  * matches EVERY event on EVERY camera, and lost its `media` policy
+  * (zoneCrop / gif / clip / frame) and its `priority` at the same time. Seen
+  * live on 2026-08-12: a rule scoped to device 617 fired on 590 and 615
+  * within a minute of a two-field patch.
+  *
+  * So every defaulted field is re-declared here WITHOUT its default. The
+  * inner defaults still apply when the caller DOES send the key — `{}` for
+  * conditions remains a real instruction ("clear them") — and only the
+  * absent key is now genuinely absent.
+  */
+  enabled: external_exports.boolean().optional(),
+  conditions: NcConditionsSchema.optional(),
+  media: NcMediaPolicySchema.optional(),
+  throttle: NcThrottleSchema.optional(),
+  priority: external_exports.number().int().min(1).max(5).optional()
 });
-var NcRulePatchSchema = NcRuleInputSchema.partial().extend({ disabledTargetIds: external_exports.array(external_exports.string()).optional() });
 var NcRuleSchema = NcRuleInputSchema.extend({
   id: external_exports.string(),
   /** userId of the admin who created the rule (server-stamped caller). */
@@ -22985,6 +23148,15 @@ var NcAlarmSettingsSchema = external_exports.object({
   announceTargets: external_exports.array(external_exports.string().min(1)).max(16)
 });
 var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.partial();
+var NcAlarmSkipReasonSchema = external_exports.enum([
+  "muted",
+  "detection-off",
+  "offline"
+]);
+var NcAlarmSkippedDeviceSchema = external_exports.object({
+  deviceId: external_exports.number().int(),
+  reason: NcAlarmSkipReasonSchema
+});
 var NcAlarmModeCoverageSchema = external_exports.object({
   mode: AlarmArmModeSchema,
   /** Enabled rules gated on `armed_<mode>`. Zero means the mode does nothing. */
@@ -22992,7 +23164,18 @@ var NcAlarmModeCoverageSchema = external_exports.object({
   /** At least one covering rule has no device scope, so the mode covers all. */
   allDevices: external_exports.boolean(),
   /** Ids named by the covering rules. A SUBSET when `allDevices` is true. */
-  deviceIds: external_exports.array(external_exports.number().int())
+  deviceIds: external_exports.array(external_exports.number().int()),
+  /**
+  * Devices this mode NAMES but cannot actually arm, each with the switch that
+  * excludes it.
+  *
+  * "Away armed — 12 cameras" is a promise, and a muted camera among those
+  * twelve makes it false in exactly the way nobody notices until an incident.
+  * Defaulted to `[]` so a coverage answer computed before this field existed
+  * still parses as "nothing known to be skipped" rather than failing the whole
+  * alarm tab.
+  */
+  skippedDevices: external_exports.array(NcAlarmSkippedDeviceSchema).default([])
 });
 var NcAlarmConfigSchema = external_exports.object({
   /**
@@ -26110,9 +26293,16 @@ var CameraStatusSchema = external_exports.object({
   audio: CameraAudioStatusSchema.nullable(),
   recording: CameraRecordingStatusSchema.nullable(),
   /**
-  * Per-camera function switches an OPERATOR has turned off
+  * Per-camera functions an OPERATOR has turned off
   * ([D61](../../../../docs/decisions/adr-0067.md)).
   *
+  * Composed from the AUTHORITIES themselves — the wrapper bindings,
+  * `RecordingConfig.enabled`, the notification mute, the broker's audio
+  * policy, the camera's own microphone — via `composeSwitchedOff`, not from
+  * the deprecated `getCameraSwitches` group ([D113](../../../../docs/decisions/adr-0113.md)).
+  * The badge outlives the control panel: the panel was a convenience, this is
+  * the difference between a camera being off and a camera being dead.
+  *
   * This is the difference between DISABLED and BROKEN. A camera whose
   * `detection` block reports zero fps and whose `switchedOff` contains
   * `'object-detection'` was switched off by a person; the same camera with an
@@ -26539,6 +26729,10 @@ var pipelineOrchestratorCapability = {
       agentNodeId: external_exports.string().optional()
     }), CameraPipelineConfigSchema),
     /**
+    * @deprecated The aggregate switch group is being withdrawn
+    * ([D113](../../../../docs/decisions/adr-0113.md)). Build nothing new on
+    * this pair; read the authority directly.
+    *
     * The whole per-camera function switch group, DERIVED — never a stored
     * list ([D61](../../../../docs/decisions/adr-0067.md)).
     *
@@ -26552,9 +26746,23 @@ var pipelineOrchestratorCapability = {
     * `auth: 'view'` deliberately — a NON-admin must be able to see that a
     * camera is quiet because somebody switched it off. Only the mutation is
     * admin-gated.
+    *
+    * **Removal plan.** It stays and it KEEPS WORKING while shipped viewers
+    * (v1.0.305) and the admin UI still call it — removing it now is a broken
+    * app on a device nobody can redeploy from here. It is served by a thin
+    * shim over the same authorities (`camera-switch-service.ts`), so the
+    * behaviour of the pair is the behaviour of the authorities by
+    * construction. It is deleted once every surface reaches its own
+    * component's options and the last caller is gone. Nothing on this server
+    * reads it: `CameraStatus.switchedOff` is composed from the authorities
+    * directly via `composeSwitchedOff`.
     */
     getCameraSwitches: method(external_exports.object({ deviceId: external_exports.number() }), CameraSwitchGroupSchema),
     /**
+    * @deprecated See {@link getCameraSwitches}. Write the authority — the
+    * wrapper binding, `RecordingConfig.enabled`, the notification mute — not
+    * this ([D113](../../../../docs/decisions/adr-0113.md)).
+    *
     * Flip ONE switch, routed to its existing authority.
     *
     * Never writes a parallel map: `recording` patches `RecordingConfig.enabled`
@@ -26932,24 +27140,28 @@ var snapshotCapability = {
     *
     * `getSnapshotOverview` is cache-only by contract: it answers from whatever
     * the wrapper happens to hold and never captures. Under D93 the client
-    * versions its image URL on that answer, and an image REQUEST is what enrols
-    * a camera in the keep-warm loop. Both of those are satisfiable by the
-    * client's own image cache — `expo-image` is URL-keyed and never revalidates
-    * — so a URL painted in a previous session comes off disk with no network,
-    * no enrolment, and nothing warming. Measured on the live hub: reopening
-    * after two minutes idle painted 15 of 16 tiles at **168 s old** with zero
-    * HTTP requests, and the fleet only recovered because a later poll happened
-    * to observe a different identity.
+    * versions its image URL on that answer, and an image REQUEST was the only
+    * demand signal. Both of those are satisfiable by the client's own image
+    * cache — `expo-image` is URL-keyed and never revalidates — so a URL painted
+    * in a previous session comes off disk with no network, no demand, and no
+    * capture. Measured on the live hub: reopening after two minutes idle
+    * painted 15 of 16 tiles at **168 s old** with zero HTTP requests, and the
+    * fleet only recovered because a later poll happened to observe a different
+    * identity.
     *
     * ## The two properties that fix it
     *
     * **It is an RPC, so no client cache can answer it.** The demand signal
-    * always reaches the wrapper. This method therefore MAY create keep-warm
-    * subscriptions, where `getSnapshotOverview` must never (D93) — the
-    * distinction is not "one is newer" but that the overview poll is app-wide
-    * (a creating overview would warm every camera on the install) while this is
-    * called by a rendered surface naming the tiles it is actually painting, at
-    * the width it is painting them.
+    * always reaches the wrapper. This method therefore CAPTURES, where
+    * `getSnapshotOverview` must never (D93) — the distinction is not "one is
+    * newer" but that the overview poll is app-wide (a capturing overview would
+    * dial every camera on the install) while this is called by a rendered
+    * surface naming the tiles it is actually painting, at the width it is
+    * painting them.
+    *
+    * Since 2026-08-11 this is the ONLY thing that refreshes a snapshot: the
+    * server-side keep-warm loop was removed (operator directive — on-demand,
+    * always), so a camera nobody is looking at costs nothing at all.
     *
     * **It waits, briefly and boundedly, for the capture it triggered.** The
     * returned `capturedAt` is the frame the link will serve, not the frame the
@@ -32987,7 +33199,19 @@ var RecordingManifestSchema = external_exports.object({
 });
 var RecordingDeviceUsageSchema = external_exports.object({
   deviceId: external_exports.number(),
-  usedBytes: external_exports.number()
+  usedBytes: external_exports.number(),
+  /**
+  * Start of this camera's OLDEST indexed segment, across every profile and
+  * location — the "Oldest footage" column in Recordings → Storage, and the
+  * only honest answer to "is retention actually holding?" per camera.
+  *
+  * `null` = the camera has no footage. OPTIONAL because a recorder that
+  * predates this field omits it entirely, and a hub whose types carry the
+  * field must keep validating that older provider's payload: the framework
+  * (types) and the addon ship on different trains, and the addon is usually
+  * the later of the two.
+  */
+  oldestMs: external_exports.number().nullable().optional()
 });
 var RecordingLocationUsageSchema = external_exports.object({
   /** StorageLocation id; null for the legacy/degraded single-root fallback. */
@@ -33010,6 +33234,42 @@ var RecordingStorageUsageSchema = external_exports.object({
   devices: external_exports.array(RecordingDeviceUsageSchema),
   locations: external_exports.array(RecordingLocationUsageSchema)
 });
+var RecordingRebalanceMoveSchema = external_exports.object({
+  deviceId: external_exports.number(),
+  profile: external_exports.string(),
+  fromLocationId: external_exports.string(),
+  toLocationId: external_exports.string(),
+  bytes: external_exports.number(),
+  files: external_exports.number().int()
+});
+var RecordingRebalanceSkipReasonSchema = external_exports.enum([
+  "unassigned",
+  "target-not-writable",
+  "below-threshold",
+  "no-headroom"
+]);
+var RecordingRebalanceSkipSchema = external_exports.object({
+  deviceId: external_exports.number(),
+  profile: external_exports.string(),
+  fromLocationId: external_exports.string(),
+  /** The location the plan wants; null when the camera has no assignment. */
+  toLocationId: external_exports.string().nullable(),
+  bytes: external_exports.number(),
+  reason: RecordingRebalanceSkipReasonSchema
+});
+var RecordingRebalancePlanSchema = external_exports.object({
+  moves: external_exports.array(RecordingRebalanceMoveSchema),
+  skipped: external_exports.array(RecordingRebalanceSkipSchema),
+  bytesToMove: external_exports.number(),
+  /** Relocate job ids enqueued. Always empty for the plan (dry-run) call. */
+  jobIds: external_exports.array(external_exports.string())
+});
+var RecordingRebalanceInputSchema = external_exports.object({
+  /** Copy throttle in MB/s (default 40) — a rebalance is a background chore. */
+  throttleMbps: external_exports.number().min(1).max(1e3).optional(),
+  /** Ignore piles smaller than this (default 1 GB). */
+  minMoveGb: external_exports.number().min(0).optional()
+});
 var LocateSegmentResultSchema = external_exports.discriminatedUnion("kind", [external_exports.object({
   kind: external_exports.literal("segment"),
   startMs: external_exports.number(),
@@ -33235,13 +33495,59 @@ var recordingCapability = {
     cancelStorageMigrationMove: method(external_exports.object({ jobId: external_exports.string() }), external_exports.object({ cancelled: external_exports.boolean() }), {
       kind: "mutation",
       auth: "admin"
+    }),
+    /**
+    * Move footage between locations — the OPERATOR's mover, scoped to one
+    * camera (and optionally to specific profiles) rather than a whole disk.
+    * Queued FIFO behind the single-flight engine, so arming several is safe.
+    */
+    relocateFootage: method(RelocateFootageInputSchema, external_exports.object({ jobId: external_exports.string() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** Every relocate job this recorder knows about, newest first (in RAM: the
+    *  move is resumable, so a lost list costs nothing but the display). */
+    listRelocateJobs: method(external_exports.object({}), external_exports.array(RelocateJobSchema).readonly(), {
+      kind: "query",
+      auth: "admin"
+    }),
+    /** Cancel a running or queued relocate job. A queued job never runs. */
+    cancelRelocateJob: method(external_exports.object({ jobId: external_exports.string() }), external_exports.object({ cancelled: external_exports.boolean() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** What a rebalance WOULD move, and what it would refuse. Moves nothing. */
+    planStorageRebalance: method(RecordingRebalanceInputSchema, RecordingRebalancePlanSchema, {
+      kind: "query",
+      auth: "admin"
+    }),
+    /** Arm the rebalance: enqueue one relocate job per planned move. */
+    startStorageRebalance: method(RecordingRebalanceInputSchema, RecordingRebalancePlanSchema, {
+      kind: "mutation",
+      auth: "admin"
     })
   }
 };
 var ExportSpeedSchema = external_exports.number().min(0.25).max(32);
+var ExportDenseRangeSchema = external_exports.object({
+  fromSec: external_exports.number().nonnegative(),
+  toSec: external_exports.number().nonnegative()
+}).refine((r) => r.toSec > r.fromSec, { message: "dense range must have toSec > fromSec" });
+var ExportDenseSchema = external_exports.object({
+  everyMs: external_exports.number().int().positive(),
+  ranges: external_exports.array(ExportDenseRangeSchema).min(1).max(200)
+});
 var ExportTimelapseSchema = external_exports.object({
   everyMs: external_exports.number().int().positive(),
-  outputFps: external_exports.number().int().min(1).max(60).optional()
+  outputFps: external_exports.number().int().min(1).max(60).optional(),
+  /** Optional second, FASTER rate over the intervals that matter. */
+  dense: ExportDenseSchema.optional()
+}).superRefine((v, ctx) => {
+  if (v.dense !== void 0 && v.dense.everyMs >= v.everyMs) ctx.addIssue({
+    code: external_exports.ZodIssueCode.custom,
+    message: "dense.everyMs must be strictly smaller than the base everyMs",
+    path: ["dense", "everyMs"]
+  });
 });
 var ExportOptionsSchema = external_exports.object({
   speed: ExportSpeedSchema.optional(),
@@ -33291,8 +33597,16 @@ var ExportDownloadSchema = external_exports.object({
   url: external_exports.string(),
   endpoints: external_exports.array(external_exports.string())
 });
+var RECORDING_EXPORT_MAX_READ_BYTES = 50 * 1024 * 1024;
+var ExportBytesSchema = external_exports.object({
+  base64: external_exports.string(),
+  contentType: external_exports.string(),
+  /** Suggested filename, extension included. */
+  name: external_exports.string(),
+  bytes: external_exports.number().int().nonnegative()
+});
 var recordingExportCapability = {
-  name: "recordingExport",
+  name: "recording-export",
   scope: "system",
   mode: "singleton",
   methods: {
@@ -33330,6 +33644,27 @@ var recordingExportCapability = {
     getDownloadUrl: method(external_exports.object({ exportId: external_exports.string() }), ExportDownloadSchema, {
       kind: "query",
       auth: "protected"
+    }),
+    /**
+    * The finished file's BYTES, base64, for a caller that must republish them
+    * somewhere a session-less fetcher can reach.
+    *
+    * `getDownloadUrl` is the right answer for a human: the download route is
+    * served `access: 'authenticated'`, which a browser satisfies and a
+    * notifier BACKEND does not. It answers a RELATIVE path, so it is not even
+    * a URL an outside fetcher could try. This method exists for the one case
+    * that needs the other thing — a scheduled timelapse whose video has to
+    * become a public attachment on the notification artifact plane.
+    *
+    * Deliberately narrow: `ready` only (a queued, rendering, failed, expired
+    * or deleted export has no file, and answering "0 bytes" for one is how a
+    * caller ships an empty attachment), still inside its lifetime, and under
+    * {@link RECORDING_EXPORT_MAX_READ_BYTES}. Every refusal throws with the
+    * reason — none of them is silent.
+    */
+    readExportBytes: method(external_exports.object({ exportId: external_exports.string() }), ExportBytesSchema, {
+      kind: "query",
+      auth: "protected"
     })
   }
 };
@@ -38757,6 +39092,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "recording.cancelRelocateJob": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "recording.cancelStorageMigrationMove": {
     capName: "recording",
     capScope: "system",
@@ -38811,6 +39152,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "recording.listRelocateJobs": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "recording.locateSegment": {
     capName: "recording",
     capScope: "system",
@@ -38823,6 +39170,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "recording.planStorageRebalance": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "recording.pruneFootage": {
     capName: "recording",
     capScope: "system",
@@ -38847,6 +39200,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "recording.relocateFootage": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "recording.renderClip": {
     capName: "recording",
     capScope: "system",
@@ -38883,38 +39242,50 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "recording.startStorageRebalance": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "recordingExport.cancelExport": {
-    capName: "recordingExport",
+    capName: "recording-export",
     capScope: "system",
     addonId: null,
     access: "create"
   },
   "recordingExport.createExport": {
-    capName: "recordingExport",
+    capName: "recording-export",
     capScope: "system",
     addonId: null,
     access: "create"
   },
   "recordingExport.deleteExport": {
-    capName: "recordingExport",
+    capName: "recording-export",
     capScope: "system",
     addonId: null,
     access: "delete"
   },
   "recordingExport.getDownloadUrl": {
-    capName: "recordingExport",
+    capName: "recording-export",
     capScope: "system",
     addonId: null,
     access: "view"
   },
   "recordingExport.getExport": {
-    capName: "recordingExport",
+    capName: "recording-export",
     capScope: "system",
     addonId: null,
     access: "view"
   },
   "recordingExport.listExports": {
-    capName: "recordingExport",
+    capName: "recording-export",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "recordingExport.readExportBytes": {
+    capName: "recording-export",
     capScope: "system",
     addonId: null,
     access: "view"
@@ -40267,6 +40638,12 @@ var CadenceSecField = external_exports.number().int().min(2).max(3600);
 var FramerateField = external_exports.number().int().min(1).max(60);
 var TargetsField = external_exports.array(NcRuleTargetSchema).min(1);
 var PriorityField = external_exports.number().int().min(1).max(5);
+var TIMELAPSE_DENSE_FLOOR_SEC = 0.1;
+var DenseCadenceSecField = external_exports.number().min(TIMELAPSE_DENSE_FLOOR_SEC).max(3600);
+var MinDwellSecField = external_exports.number().min(0).max(60);
+var PreviewTextField = external_exports.string().max(200);
+var PreviewModeField = external_exports.enum(["image", "gif"]);
+var ReportClassesField = external_exports.array(external_exports.string().min(1).max(40)).max(20);
 var TimelapseRuleInputSchema = external_exports.object({
   name: NameField,
   enabled: external_exports.boolean().default(true),
@@ -40282,9 +40659,30 @@ var TimelapseRuleInputSchema = external_exports.object({
   cadenceSec: CadenceSecField.default(15),
   /** Output frames per second of the assembled mp4 (predecessor parity). */
   framerate: FramerateField.default(10),
+  /**
+  * Explicit dense cadence — see {@link DenseCadenceSecField}. Absent ⇒ derived
+  * as `max(1s, cadenceSec / 30)`, which is what every rule written before this
+  * field gets.
+  */
+  denseCadenceSec: DenseCadenceSecField.optional(),
+  /** Output-seconds guarantee per detection range — see {@link MinDwellSecField}. */
+  minDwellSec: MinDwellSecField.optional(),
   /** `notification-output` targets the finished video/thumbnail is sent to. */
   targets: TargetsField,
   template: TimelapseTemplateSchema.optional(),
+  /**
+  * Caption on the notification's PREVIEW FRAME — see {@link PreviewTextField}
+  * and {@link DEFAULT_TIMELAPSE_PREVIEW_TEXT}.
+  *
+  * Deliberately NOT part of {@link TimelapseTemplateSchema}: that object is
+  * the notification's title/body, and clearing it (`template: null`) must not
+  * silently clear the caption too.
+  */
+  previewText: PreviewTextField.optional(),
+  /** Still or animation — see {@link PreviewModeField}. */
+  previewMode: PreviewModeField.default("image"),
+  /** Classes the notification counts — see {@link ReportClassesField}. */
+  reportClasses: ReportClassesField.optional(),
   /** Canonical notification priority ordinal (1..5); per-target overridable. */
   priority: PriorityField.default(3)
 });
@@ -40295,8 +40693,13 @@ var TimelapseRulePatchSchema = external_exports.object({
   schedule: NcScheduleSchema.optional(),
   cadenceSec: CadenceSecField.optional(),
   framerate: FramerateField.optional(),
+  denseCadenceSec: DenseCadenceSecField.optional(),
+  minDwellSec: MinDwellSecField.optional(),
   targets: TargetsField.optional(),
   template: TimelapseTemplateSchema.nullable().optional(),
+  previewText: PreviewTextField.optional(),
+  previewMode: PreviewModeField.optional(),
+  reportClasses: ReportClassesField.optional(),
   priority: PriorityField.optional()
 });
 var TimelapseRuleSchema = TimelapseRuleInputSchema.extend({
@@ -40308,10 +40711,28 @@ var TimelapseRuleSchema = TimelapseRuleInputSchema.extend({
   */
   ownerUserId: external_exports.string().optional(),
   /**
-  * Epoch-ms of the last successful generation — the 1-hour re-generation
-  * guard's durable state (predecessor parity). Absent = never generated.
+  * Epoch-ms of the NEWEST successful generation across every camera of this
+  * rule. What a UI shows, and the compatibility floor for
+  * {@link readTimelapseGeneratedAt}. Absent = never generated.
   */
   lastGeneratedAt: external_exports.number().optional(),
+  /**
+  * PER-CAMERA generation state, keyed by `String(deviceId)` — the
+  * re-generation guard's real durable state.
+  *
+  * One rule covers several cameras and each renders its own video, so a rule
+  * -wide stamp is wrong in the direction that DESTROYS work: camera A
+  * succeeding at 06:05 tells camera B, whose render failed, that it is
+  * already done — and B's night is gone for good, because the window will not
+  * come back.
+  *
+  * ADDITIVE, so the migration is free: a row written before this field simply
+  * has no map, and {@link readTimelapseGeneratedAt} falls back to
+  * {@link TimelapseRuleSchema.shape.lastGeneratedAt}. Reading an old row as
+  * "never generated" would re-render and re-notify every camera of every rule
+  * once, on the deploy that shipped the map.
+  */
+  generatedByDevice: external_exports.record(external_exports.string(), external_exports.number()).optional(),
   /** userId of the caller who created the rule (server-stamped). */
   createdBy: external_exports.string(),
   createdAt: external_exports.number(),
@@ -40350,25 +40771,32 @@ var DETAIL_CROP_PADDING_FIELD = {
 var NativeLeaseAdmissionSchema = external_exports.enum(["all", "inferred"]);
 var NativeLeaseSettingsSchema = external_exports.object({
   /**
-  * How long a retained native frame is served before it counts as a miss.
+  * How many delivered frames the worker HOLDS at once, waiting for each one's
+  * detection result.
+  *
+  * This replaced a TTL on 2026-08-13, and the replacement is the whole point:
+  * a time window was never related to the event the pixels were waiting for.
+  * A held frame now lives from delivery until the runner has its `FrameResult`
+  * — at which moment the runner cuts the subject tiles it actually wanted and
+  * releases the frame. The bound exists only so a runner that stops answering
+  * cannot pin RAM: above it the OLDEST held frame is dropped and counted.
   *
-  * Must cover the FULL late-crop horizon: detection inference + the
-  * cross-process inference-result hop to hub post-analysis + tracking + the
-  * tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-  * outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-  * RAM per busy camera grows linearly with no measured hit-rate gain.
+  * Sizing: the steady state is `inferenceLatency × deliveredFps`, measured at
+  * 40-160 ms × ≤25 fps = 1-4 frames. The default leaves headroom for a hiccup
+  * without ever approaching the old resident set (43 frames × 24.9 MB at 4K).
+  * Raising it does not buy hit rate — it buys tolerance for a slow runner, and
+  * `holdOverflow` on the metrics line is what says you need it.
   */
-  ttlMs: external_exports.number().int().min(250).max(1e4),
+  holdFrames: external_exports.number().int().min(1).max(64),
   /**
   * Hard per-decode-worker RAM ceiling for retained native frames, in MB.
   *
-  * Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-  * which one is actually binding before reasoning from that. At the shipped
-  * 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-  * at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-  * `leaseFrames` on the metrics line say which. When the ceiling binds, a
-  * change that admits fewer frames buys retention WINDOW at constant RAM
-  * rather than giving RAM back — lower this knob if RAM is what you wanted.
+  * Since 2026-08-13 this is a SAFETY ceiling and nothing else: `holdFrames`
+  * is what decides how much is held, and the ceiling is the number above which
+  * something is wrong. Before that it was the effective cap — at 1024 MB with
+  * a 2 800 ms TTL a 4K camera sat pinned at `leaseMb:1020, leaseFrames:43`
+  * with the TTL expiring nothing, which is exactly the confusion the hold
+  * removes. `leaseMb` / `leaseFrames` still say what is resident.
   * `0` DISABLES the lease entirely and falls the worker back to the tiny
   * leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
   * to replace).
@@ -40394,19 +40822,37 @@ var NativeLeaseSettingsSchema = external_exports.object({
   * there is the signal that some caller names frames outside the inference set
   * and that this must go back to `all`.
   */
-  admission: NativeLeaseAdmissionSchema
+  admission: NativeLeaseAdmissionSchema,
+  /**
+  * RAM ceiling per decode worker, in MB, for the SUBJECT TILES — the
+  * compressed native crops the worker cuts at the moment a frame's detection
+  * result arrives, and keeps long after the frame itself is freed.
+  *
+  * This is the knob that replaced the old retention window, and it buys about
+  * three orders of magnitude more of it: a tile is one subject at native
+  * resolution, JPEG-encoded (~60-120 KB on a 4K person), against ~24.9 MB for
+  * the frame it was cut from. A frame on which nothing was detected costs
+  * nothing at all, which is the real change — the old lease paid per FRAME and
+  * was interrogated per SUBJECT.
+  *
+  * `0` DISABLES tiles, leaving only the hold window and the ≤640 RAM
+  * fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
+  * reproduce that.
+  */
+  tileBudgetMb: external_exports.number().int().min(0).max(1024)
 });
 var DEFAULT_NATIVE_LEASE_SETTINGS = {
-  ttlMs: 1200,
+  holdFrames: 8,
   budgetMb: 1024,
   activityMs: 15e3,
+  tileBudgetMb: 64,
   admission: "inferred"
 };
-var NATIVE_LEASE_TTL_FIELD = {
-  min: 250,
-  max: 1e4,
-  step: 50,
-  default: DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs
+var NATIVE_LEASE_HOLD_FIELD = {
+  min: 1,
+  max: 64,
+  step: 1,
+  default: DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames
 };
 var NATIVE_LEASE_BUDGET_FIELD = {
   min: 0,
@@ -40420,6 +40866,12 @@ var NATIVE_LEASE_ACTIVITY_FIELD = {
   step: 1e3,
   default: DEFAULT_NATIVE_LEASE_SETTINGS.activityMs
 };
+var NATIVE_LEASE_TILE_BUDGET_FIELD = {
+  min: 0,
+  max: 1024,
+  step: 16,
+  default: DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb
+};
 var NATIVE_LEASE_ADMISSION_FIELD = {
   options: [{
     value: "all",