@camstack/addon-export-alexa 1.2.133 → 1.2.135

package/dist/export-alexa.addon.js

@@ -26,7 +26,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 //#endregion
 let node_crypto = require("node:crypto");
 node_crypto = __toESM(node_crypto, 1);
-//#region ../types/dist/event-category-BGmz_oxW.mjs
+//#region ../types/dist/event-category-B_0XEcLF.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -527,15 +527,6 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["AgentWsDisconnected"] = "agent.ws.disconnected";
 	EventCategory["AgentBackupActivated"] = "agent.backup.activated";
 	EventCategory["OrchestrationSettingsUpdated"] = "orchestration.settings-updated";
-	/**
-	* Per-agent hwaccel preference changed (user override set, cleared, or
-	* re-probed). Observability event — decoders pull the current pref at
-	* `createSession`, so running sessions keep their current backend until
-	* they rotate naturally (camera add/remove, stream restart). Future
-	* work can wire a listener in stream-broker that force-rotates live
-	* sessions; for now this event powers logs + admin-UI toast feedback.
-	*/
-	EventCategory["PipelineAgentHwaccelChanged"] = "pipeline.agent-hwaccel-changed";
 	EventCategory["MotionAnalysis"] = "detection.motion-analysis";
 	/** All raw motion zones from CCL before minArea filter — for UI debug overlay. */
 	EventCategory["MotionZonesRaw"] = "detection.motion-zones-raw";
@@ -5406,7 +5397,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DAJ9Er57.mjs
+//#region ../types/dist/sleep-BNeXenvr.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6772,32 +6763,12 @@ object({
 	audioCodec: string().optional(),
 	metadata: record(string(), unknown()).readonly().optional()
 });
-var EncodedPacketSchema = object({
-	type: _enum(["video", "audio"]),
-	data: _instanceof(Uint8Array),
-	pts: number(),
-	dts: number(),
-	keyframe: boolean(),
-	codec: string()
-});
-var DecodedFrameSchema = object({
-	data: _instanceof(Uint8Array),
-	width: number(),
-	height: number(),
-	format: _enum([
-		"jpeg",
-		"rgb",
-		"bgr",
-		"yuv420",
-		"gray"
-	]),
-	timestamp: number()
-});
 /**
 * Wire schema for `FrameHandle` — a zero-pixel, serialisable reference to a
 * frame in a shared-memory ring (Phase 5 / D9). Mirrors the `FrameHandle` TS
-* interface in `interfaces/frame-handle.ts` field-for-field so a decoder cap
-* method (`pullHandles`) can carry handles over tRPC / Moleculer.
+* interface in `interfaces/frame-handle.ts` field-for-field so a cap method
+* (the runner's native-crop and pipeline-executor inputs) can carry handles
+* over tRPC / Moleculer.
 *
 * The `satisfies` assertion below pins this schema to the interface: if a
 * field is added to / removed from `FrameHandle` without a matching schema
@@ -6823,50 +6794,6 @@ var FrameHandleSchema = object({
 	slotCount: number().int().positive()
 });
 /**
-* Pixel format a frame-handle subscriber can request from the broker
-* (Phase 5 / D9). The packed, raster subset of `FrameFormat` — the formats a
-* `frameSink: 'shm'` decoder session can write into a `FrameRing` slot.
-* `jpeg` is excluded: a variable-length stream is not a fixed-stride ring
-* payload, and no decoded-frame consumer requests it over the shm plane.
-*/
-var FrameHandleFormatSchema = _enum([
-	"rgb",
-	"bgr",
-	"yuv420",
-	"gray"
-]);
-/**
-* Input for `stream-broker.subscribeFrames` (Phase 5 / D9). A consumer asks the
-* broker for a `FrameHandle` stream of one `format`; the broker maintains one
-* shared-memory ring per `(brokerId, format)` actually requested, so a `gray`
-* subscriber (motion) and an `rgb` subscriber (detection) each read the format
-* they asked for with no broker-side conversion.
-*/
-var SubscribeFramesInputSchema = object({
-	brokerId: string(),
-	format: FrameHandleFormatSchema,
-	/**
-	* Optional reader-side cadence hint in frames per second. The broker does
-	* NOT throttle — latest-wins ring reads drop frames implicitly for a slow
-	* consumer. The value is echoed back in `SubscribeFramesResult.maxFps` so
-	* the consumer can pace its own `pullFrameHandles` polling.
-	*/
-	maxFps: number().positive().optional(),
-	/** Short caller-identity tag (`motion`, `detection`, …) for diagnostics. */
-	tag: string().optional()
-});
-/**
-* Result of `stream-broker.subscribeFrames`. The consumer then polls
-* `pullFrameHandles({ subscriptionId, maxCount })` and feeds each returned
-* `FrameHandle` to a `FrameRingReader`.
-*/
-var SubscribeFramesResultSchema = object({
-	/** Opaque id the consumer passes to `pullFrameHandles` / `unsubscribeFrames`. */
-	subscriptionId: string(),
-	/** Reader-side cadence hint (frames/s) — echoes `SubscribeFramesInput.maxFps`. */
-	maxFps: number().nonnegative()
-});
-/**
 * Wire schema for a decoded audio chunk (Phase 5 / D9). Mirrors the
 * `DecodedAudioChunk` TS interface in `interfaces/stream-broker.ts`: PCM
 * sample bytes plus the track parameters a consumer needs to interpret them.
@@ -6874,8 +6801,8 @@ var SubscribeFramesResultSchema = object({
 * Audio chunks are tiny (a ~500ms AudioCodecSession window is a few KB of
 * Float32 PCM), so unlike video frames they ship their bytes INLINE over
 * tRPC / Moleculer — no shared-memory plane. `data` is typed `Uint8Array`
-* (the wire-serialisable supertype of `Buffer`) to match `DecodedFrameSchema`
-* / `EncodedPacketSchema`'s precedent; a `Buffer` is assignable to it.
+* (the wire-serialisable supertype of `Buffer`); a `Buffer` is assignable to
+* it.
 */
 var AudioChunkFormatSchema = _enum(AUDIO_CHUNK_FORMATS);
 var DecodedAudioChunkSchema = object({
@@ -6893,11 +6820,10 @@ var DecodedAudioChunkSchema = object({
 	format: AudioChunkFormatSchema.optional()
 });
 /**
-* Input for `stream-broker.subscribeAudioChunks` (Phase 5 / D9). The
-* handle-free, ship-bytes-inline analogue of `subscribeFrames`: a consumer
-* asks the broker for the decoded audio-chunk stream of one broker; the
-* broker keeps a per-subscription bounded FIFO queue the consumer drains via
-* `pullAudioChunks`.
+* Input for `stream-broker.subscribeAudioChunks` (Phase 5 / D9). Audio ships
+* its bytes inline: a consumer asks the broker for the decoded audio-chunk
+* stream of one broker; the broker keeps a per-subscription bounded FIFO queue
+* the consumer drains via `pullAudioChunks`.
 */
 var SubscribeAudioChunksInputSchema = object({
 	brokerId: string(),
@@ -6928,9 +6854,7 @@ var BrokerStatsSchema = object({
 		"stopped"
 	]),
 	inputFps: number(),
-	decodeFps: number(),
 	encodedSubscribers: number(),
-	decodedSubscribers: number(),
 	uptimeMs: number(),
 	bitrateKbps: number(),
 	idrIntervalMs: number(),
@@ -6943,14 +6867,6 @@ var BrokerStatsSchema = object({
 	preBufferMs: number(),
 	preBufferPackets: number(),
 	/**
-	* Moleculer node id of the decoder provider currently servicing this
-	* stream's decoded subscribers. `null` until the deferred decoder is
-	* created (no decoded clients yet, or codec not detected). Surfaces the
-	* runtime decoder placement so the UI can show "Decoder: <agent>" without
-	* a separate cap call per broker.
-	*/
-	decoderNodeId: string().nullable(),
-	/**
 	* Detected audio track parameters from the RTSP DESCRIBE / SDP. `null`
 	* when the stream has no audio track or the broker is in cold start.
 	* `supported = false` means the codec was detected but the local
@@ -10473,70 +10389,6 @@ var StorageLocationDeclarationSchema = object({
 		"backup"
 	]).optional()
 });
-var DecoderStatsSchema = object({
-	inputFps: number(),
-	outputFps: number(),
-	avgDecodeTimeMs: number(),
-	droppedFrames: number(),
-	/**
-	* Pull-mode adaptive-fps telemetry (optional — only pull sessions run the
-	* lag-driven controller; push sessions omit these). `lagMs` is the EWMA of
-	* the decoder's real-time drift (rising = falling behind live); `adaptiveFps`
-	* is the current lag-throttled emit rate (≤ `effectiveFps` ceiling).
-	*/
-	lagMs: number().optional(),
-	effectiveFps: number().optional(),
-	adaptiveFps: number().optional()
-});
-var DecoderSessionConfigSchema = object({
-	codec: string(),
-	maxFps: number().default(0),
-	outputFormat: _enum([
-		"jpeg",
-		"rgb",
-		"bgr",
-		"yuv420",
-		"gray"
-	]).default("jpeg"),
-	scale: number().default(1),
-	width: number().optional(),
-	height: number().optional(),
-	/**
-	* Identifier of the camera this decoder session serves. Optional
-	* because the cap is generic (any caller could request decode), but
-	* stream-broker passes it so decoder logs include `deviceId` for
-	* per-camera filtering when diagnosing failures (e.g. node-av
-	* sendPacket errors on a single hung camera).
-	*/
-	deviceId: number().int().nonnegative().optional(),
-	/**
-	* Free-form tag for log scoping. Stream-broker uses
-	* `broker:<deviceId>/<profile>`. Decoder session logger surfaces it
-	* on every line so `grep tag=broker:5/high` filters one camera
-	* profile cleanly.
-	*/
-	tag: string().optional(),
-	/**
-	* Where the session delivers decoded frames (Phase 5 / D9):
-	*
-	* - `'callback'` (default) — the legacy pixel path: decoded frames are
-	*   buffered as `DecodedFrame`s and drained via `pullFrames`.
-	* - `'shm'` — the shared-memory frame plane: decoded frames are written
-	*   into an OS shared-memory ring and drained as zero-pixel
-	*   `FrameHandle`s via `pullHandles`. A session is one mode or the
-	*   other — `pullFrames` returns nothing for an `'shm'` session and
-	*   `pullHandles` returns nothing for a `'callback'` session.
-	*/
-	frameSink: _enum(["callback", "shm"]).default("callback"),
-	/**
-	* Per-camera decoder DEBUG facility. When `true`, a pull-mode session emits
-	* a throttled (~1Hz) structured `decoder debug` line (effective/adaptive fps,
-	* real-time lag, dropped-frame delta, avg decode time, hwaccel). Mirrors the
-	* stream-broker's `streamingDebug` gate — off by default so production logs
-	* stay quiet and the emit path pays zero per-frame cost when disabled.
-	*/
-	debug: boolean().optional()
-});
 /**
 * Per-component log CHANNELS — the gate a hot path consults, and the registry
 * an addon declares its channels in.
@@ -12797,13 +12649,6 @@ var BrokerRtspClientSchema = object({
 	lastRtpAt: number(),
 	bytesSent: number()
 });
-var BrokerDecodedClientSchema = object({
-	tag: string(),
-	subscribedAt: number(),
-	maxFps: number(),
-	framesDelivered: number(),
-	framesDropped: number()
-});
 var BrokerAudioClientSchema = object({
 	tag: string(),
 	subscribedAt: number(),
@@ -12895,7 +12740,6 @@ var BrokerEncodedClientSchema = object({
 });
 var BrokerClientsSchema = object({
 	rtsp: array(BrokerRtspClientSchema).readonly(),
-	decoded: array(BrokerDecodedClientSchema).readonly(),
 	audio: array(BrokerAudioClientSchema).readonly(),
 	encoded: array(BrokerEncodedClientSchema).readonly(),
 	pipeClients: number(),
@@ -13264,11 +13108,7 @@ method(object({
 	auth: "admin"
 }), method(object({ brokerId: string() }), BrokerClientsSchema), method(object({
 	brokerId: string(),
-	channel: _enum([
-		"rtsp",
-		"decoded",
-		"audio"
-	]),
+	channel: _enum(["rtsp", "audio"]),
 	handle: string()
 }), object({ killed: boolean() }), {
 	kind: "mutation",
@@ -13303,10 +13143,7 @@ method(object({
 }), method(SubscribeAudioChunksInputSchema, SubscribeAudioChunksResultSchema, { kind: "mutation" }), method(object({
 	subscriptionId: string(),
 	maxCount: number().int().positive().default(8)
-}), array(DecodedAudioChunkSchema).readonly()), method(object({ subscriptionId: string() }), object({ released: boolean() }), { kind: "mutation" }), method(SubscribeFramesInputSchema, SubscribeFramesResultSchema, { kind: "mutation" }), method(object({
-	subscriptionId: string(),
-	maxCount: number().int().positive().default(4)
-}), array(FrameHandleSchema).readonly()), method(object({ subscriptionId: string() }), object({ released: boolean() }), { kind: "mutation" }), method(object({
+}), array(DecodedAudioChunkSchema).readonly()), method(object({ subscriptionId: string() }), object({ released: boolean() }), { kind: "mutation" }), method(object({
 	brokerId: string(),
 	seconds: number().min(0).max(30)
 }), _void(), {
@@ -14463,54 +14300,12 @@ id: union([string(), number()]) }), {
 	kind: "mutation",
 	auth: "admin"
 });
-/**
-* shm ring usage stats for a `frameSink: 'shm'` decoder session —
-* exposed via `decoder.getShmStats` so downstream consumers can
-* observe ring pressure (slot count, byte budget, hit/miss ratio).
-*/
-var ShmRingStatsSchema = object({
-	sessionId: string(),
-	slotCount: number().int(),
-	slotByteLength: number().int(),
-	segmentBytes: number().int(),
-	budgetMb: number().int(),
-	framesWritten: number().int(),
-	getFrameHits: number().int(),
-	getFrameMisses: number().int()
-});
-method(object({ codec: string() }), boolean()), method(_void(), object({
+method(_void(), object({
 	id: string(),
 	name: string(),
-	isPullMode: boolean().optional(),
-	priority: number().optional(),
 	hwaccel: string().optional(),
 	probedBestHwaccel: string().optional()
-})), method(DecoderSessionConfigSchema, object({
-	sessionId: string(),
-	nodeId: string()
-})), method(object({ sessionId: string() }), _void()), method(object({
-	sessionId: string(),
-	packet: EncodedPacketSchema
-}), _void()), method(object({
-	sessionId: string(),
-	url: string()
-}), _void()), method(object({
-	sessionId: string(),
-	maxCount: number().default(1),
-	waitMs: number().optional()
-}), array(DecodedFrameSchema)), method(object({
-	sessionId: string(),
-	maxCount: number().default(1),
-	waitMs: number().optional()
-}), array(FrameHandleSchema)), method(object({ handle: FrameHandleSchema }), DecodedFrameSchema.nullable()), method(object({ sessionId: string() }), ShmRingStatsSchema.nullable()), method(object({
-	sessionId: string(),
-	config: DecoderSessionConfigSchema.partial()
-}), _void()), method(object({ sessionId: string() }), DecoderStatsSchema), method(_void(), array(object({
-	sessionId: string(),
-	codec: string(),
-	outputFormat: string(),
-	createdAtMs: number()
-})).readonly()), method(_void(), object({ backend: string() }), {
+})), method(_void(), object({ backend: string() }), {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -21571,8 +21366,8 @@ Object.freeze(Object.fromEntries([{
 var CLUSTER_STEP_SETTING_FIELDS = [{
 	stepId: "face-embedding",
 	key: "minLandmarkFaceSize",
-	label: "Min face size for recognition (detection px)",
-	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	label: "Min face size to embed (detection-frame px)",
+	description: "Faces smaller than this in the small frame the detector sees are not embedded, so they can never be recognised. Below it the face cannot be aligned reliably and a bad embedding matches everyone. Same value on every node. 0 = no limit.",
 	type: "slider",
 	min: 0,
 	max: 64,
@@ -23624,21 +23419,6 @@ var PipelineDefaultStepSchema = lazy(() => object({
 	group: string().optional(),
 	settings: record(string(), unknown()).optional()
 }));
-var PipelineTemplateStepSchema = lazy(() => object({
-	addonId: string(),
-	enabled: boolean(),
-	modelId: string(),
-	children: array(PipelineTemplateStepSchema).readonly(),
-	settings: record(string(), unknown()).optional()
-}));
-var PipelineTemplateSchema$1 = object({
-	id: string(),
-	name: string(),
-	createdAt: string(),
-	updatedAt: string(),
-	engine: PipelineEngineChoiceSchema,
-	steps: array(PipelineTemplateStepSchema).readonly()
-});
 var PipelineModelOptionSchema = object({
 	id: string(),
 	name: string(),
@@ -23850,15 +23630,7 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 }), method(_void(), PipelineSchemaSchema), method(_void(), array(PipelineDefaultStepSchema).readonly().nullable()), method(_void(), PipelineConfigBridge), method(_void(), ConfigUISchemaBridge), method(object({
 	steps: array(PipelineStepInputSchema),
 	deviceKey: string().optional()
-}), PipelineValidationResultSchema), method(_void(), array(PipelineTemplateSchema$1).readonly()), method(object({
-	name: string(),
-	steps: array(PipelineTemplateStepSchema).readonly(),
-	engine: PipelineEngineChoiceSchema
-}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({
-	id: string(),
-	name: string().optional(),
-	steps: array(PipelineTemplateStepSchema).readonly().optional()
-}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({ id: string() }), _void(), { kind: "mutation" }), method(_void(), InferenceCapabilitiesBridge), method(object({ addonId: string() }), ModelAvailabilityListBridge), method(object({
+}), PipelineValidationResultSchema), method(_void(), InferenceCapabilitiesBridge), method(object({ addonId: string() }), ModelAvailabilityListBridge), method(object({
 	addonId: string(),
 	modelId: string(),
 	format: ModelFormatSchema$2
@@ -25268,14 +25040,15 @@ var RunnerLocalLoadSchema = object({
 	* Per-inference-device live load (multi-device C4). One entry per deviceKey
 	* this runner currently has attached cameras on, so the orchestrator's second
 	* `balance()` pass (over a node's devices) weights on real per-pool session
-	* counts. Empty on single-device / pre-multi-device runners. `queueDepthTotal`
-	* per device is 0 until the pool backlog gets a public accessor (follow-up).
+	* counts. Empty on single-device / pre-multi-device runners. There is no
+	* per-device queue depth: the inference pool's backlog has no accessor, and
+	* a field that always read 0 was removed rather than shown as a measurement
+	* (D762).
 	*/
 	devices: array(object({
 		deviceKey: string(),
 		backend: string(),
-		attachedCameras: number(),
-		queueDepthTotal: number()
+		attachedCameras: number()
 	})).default([]),
 	/** Hardware capability flags reported by this node. */
 	hardware: object({
@@ -25489,14 +25262,6 @@ var CameraPipelineConfigSchema = object({
 		settings: record(string(), unknown()).readonly().optional()
 	}).nullable().optional()
 });
-var PipelineTemplateSchema = object({
-	id: string(),
-	name: string(),
-	description: string().optional(),
-	config: CameraPipelineConfigSchema,
-	createdAt: string(),
-	updatedAt: string()
-});
 var DeviceStepConfigSchema = object({
 	modelId: string().optional(),
 	settings: record(string(), unknown()).optional(),
@@ -25606,7 +25371,10 @@ var PipelineAssignmentSchema = object({
 });
 /**
 * Per-agent load summary surfaced to the load balancer + dashboards.
-* Aggregated from each runner's `getLocalLoad` cap call.
+* Aggregated from each runner's `getLocalLoad` cap call. In the
+* `getAgentLoad` report, a single-device node's default-pool sessions (no
+* `deviceKey`) are credited to its one eligible device in `load.devices` —
+* the default pool IS that device (D745); the balancer's census stays raw.
 */
 var AgentLoadSummarySchema = object({
 	nodeId: string(),
@@ -25695,26 +25463,27 @@ var CameraBrokerStatusSchema = object({
 		width: number(),
 		height: number(),
 		subscribers: number(),
-		inFps: number(),
-		outFps: number()
+		/**
+		* Encoded packets/s the broker receives from the camera. null when the
+		* broker's stats read failed — unknown, never 0 (a 0 here reads as a stall).
+		* There is no output rate: decoding runs in the session decode workers, not
+		* in the broker, so the broker's own decoded-frame rate is 0 on every live
+		* camera and is not served (D758).
+		*/
+		inFps: number().nullable()
 	})).readonly(),
 	webrtcSessions: number(),
 	rtspRestream: boolean()
 });
-/** Shared-memory ring statistics within the decoder block. */
-var CameraDecoderShmSchema = object({
-	framesWritten: number(),
-	getFrameHits: number(),
-	getFrameMisses: number(),
-	budgetMb: number()
-});
-/** Decoder block — null when the decoder stage is unreachable or inactive. */
-var CameraDecoderStatusSchema = object({
-	nodeId: string(),
-	formats: array(string()).readonly(),
-	sessionCount: number(),
-	shm: CameraDecoderShmSchema
-});
+/**
+* Decoder block — WHERE decode runs (co-located with the detection node by
+* construction); null when the camera has no detection node. It carries no
+* frame counter: the shared-memory plane whose counters it used to serve is
+* gone, and those fields read 0 forever. Whether frames actually flow is read
+* from `detection.actualFps` (frames delivered to and processed by the
+* detector), never from a counter nothing feeds.
+*/
+var CameraDecoderStatusSchema = object({ nodeId: string() });
 /** Motion block — null when motion detection is not active for this device. */
 var CameraMotionStatusSchema = object({
 	enabled: boolean(),
@@ -26167,25 +25936,7 @@ method(object({
 }), method(_void(), DiskReconcileJobSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), DiskReconcileJobSchema, { auth: "admin" }), method(_void(), array(PipelineTemplateSchema).readonly()), method(object({
-	name: string(),
-	description: string().optional(),
-	config: CameraPipelineConfigSchema
-}), PipelineTemplateSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	id: string(),
-	name: string().optional(),
-	description: string().optional(),
-	config: CameraPipelineConfigSchema.optional()
-}), PipelineTemplateSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ id: string() }), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-});
+}), method(_void(), DiskReconcileJobSchema, { auth: "admin" });
 /**
 * Cap → event-kind mapping for the SENSOR / CONTROL cap families — the table
 * `pipeline-analytics.listEventKinds` uses to turn a linked device's bound
@@ -28405,8 +28156,6 @@ var WebrtcStreamChoiceSchema = object({
 	]).nullable(),
 	/** Input FPS from the camera (null for adaptive). */
 	inputFps: number().nullable(),
-	/** Decoded FPS (null for adaptive). */
-	decodeFps: number().nullable(),
 	/** Bitrate in kbps (null for adaptive). */
 	bitrateKbps: number().nullable()
 });
@@ -38541,90 +38290,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"decoder.createSession": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.destroySession": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
-	"decoder.getFrame": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"decoder.getInfo": {
 		capName: "decoder",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"decoder.getShmStats": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.getStats": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.listActiveSessions": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.openStream": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.pullFrames": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.pullHandles": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.pushPacket": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"decoder.reprobeHwaccel": {
 		capName: "decoder",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"decoder.supportsCodec": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.updateConfig": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"detectionPipeline.applyDeviceSettingsPatch": {
 		capName: "detection-pipeline",
 		capScope: "device",
@@ -41715,12 +41392,6 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
-	"pipelineExecutor.deleteTemplate": {
-		capName: "pipeline-executor",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
 	"pipelineExecutor.downloadModel": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -41859,12 +41530,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"pipelineExecutor.listTemplates": {
-		capName: "pipeline-executor",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"pipelineExecutor.rearmInferenceDevice": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -41889,12 +41554,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineExecutor.saveTemplate": {
-		capName: "pipeline-executor",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineExecutor.setVideoPipelineSteps": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -41913,12 +41572,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineExecutor.updateTemplate": {
-		capName: "pipeline-executor",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineExecutor.validatePipeline": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -41949,12 +41602,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.deleteTemplate": {
-		capName: "pipeline-orchestrator",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
 	"pipelineOrchestrator.getAgentLoad": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -42105,12 +41752,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"pipelineOrchestrator.listTemplates": {
-		capName: "pipeline-orchestrator",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"pipelineOrchestrator.pauseForStorageMigration": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -42165,12 +41806,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.saveTemplate": {
-		capName: "pipeline-orchestrator",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineOrchestrator.setAgentCapabilities": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -42279,12 +41914,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.updateTemplate": {
-		capName: "pipeline-orchestrator",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineRunner.attachCamera": {
 		capName: "pipeline-runner",
 		capScope: "system",
@@ -43719,12 +43348,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"streamBroker.pullFrameHandles": {
-		capName: "stream-broker",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"streamBroker.regenerateRtspToken": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -43791,12 +43414,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"streamBroker.subscribeFrames": {
-		capName: "stream-broker",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"streamBroker.unassignProfile": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -43809,12 +43426,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"streamBroker.unsubscribeFrames": {
-		capName: "stream-broker",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"streamCatalog.getCatalog": {
 		capName: "stream-catalog",
 		capScope: "device",
@@ -46328,11 +45939,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"decoder.createSession": [{
-		name: "deviceId",
-		form: "single",
-		optional: true
-	}],
 	"detectionPipeline.applyDeviceSettingsPatch": [{
 		name: "deviceId",
 		form: "single",
@@ -49844,6 +49450,9 @@ function parseNonNegativeInt(s) {
 /**
 * Shared Alexa `Alexa/ErrorResponse` envelope builder.
 *
+* Certification checks the shape: `correlationToken` (set here) and
+* `endpoint` (set by `withErrorEndpoint` in the router) are both required.
+*
 * Lives in its own module so every handler (and the directive router)
 * can emit its own namespace-appropriate error without circular imports.
 */
@@ -49852,8 +49461,10 @@ object({ event: object({
 		namespace: literal("Alexa"),
 		name: literal("ErrorResponse"),
 		messageId: string(),
+		correlationToken: string().optional(),
 		payloadVersion: literal("3")
 	}),
+	endpoint: object({ endpointId: string() }).optional(),
 	payload: object({
 		type: string(),
 		message: string()
@@ -49865,6 +49476,7 @@ function errorEnvelope(header, type, message) {
 			namespace: "Alexa",
 			name: "ErrorResponse",
 			messageId: header.messageId,
+			...header.correlationToken !== void 0 ? { correlationToken: header.correlationToken } : {},
 			payloadVersion: "3"
 		},
 		payload: {
@@ -50225,18 +49837,43 @@ async function handleSessionDisconnected(header, endpointRaw, payloadRaw, deps,
 		},
 		meta: { endpointId: endpoint.endpointId }
 	});
+	return sessionEvent("SessionDisconnected", header, endpoint.endpointId, parsed.data.payload.sessionId);
+}
+/**
+* The response to `SessionConnected` / `SessionDisconnected` is the event of
+* the same name with the session id (alexa-rtcsessioncontroller) — not a
+* generic `Alexa.Response`.
+*/
+function sessionEvent(name, header, endpointId, sessionId) {
 	return { event: {
 		header: {
-			namespace: "Alexa",
-			name: "Response",
+			namespace: "Alexa.RTCSessionController",
+			name,
 			messageId: header.messageId,
 			correlationToken: header.correlationToken,
 			payloadVersion: "3"
 		},
-		endpoint: { endpointId: endpoint.endpointId },
-		payload: {}
+		endpoint: { endpointId },
+		payload: { sessionId }
 	} };
 }
+/**
+* `SessionConnected` — Alexa reports the media path is up. Nothing to do
+* hub-side (the session already exists from the offer); acknowledge it. Amazon
+* notes it is not always sent, so nothing may depend on it.
+*/
+function handleSessionConnected(header, endpointRaw, payloadRaw, deps) {
+	const parsed = SessionDisconnectedDirectiveSchema.safeParse({
+		endpoint: endpointRaw,
+		payload: payloadRaw ?? {}
+	});
+	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
+	deps.logger.info("alexa rtc-session: SessionConnected", {
+		tags: { sessionId: parsed.data.payload.sessionId },
+		meta: { endpointId: parsed.data.endpoint.endpointId }
+	});
+	return sessionEvent("SessionConnected", header, parsed.data.endpoint.endpointId, parsed.data.payload.sessionId);
+}
 //#endregion
 //#region src/broker-client.ts
 /**
@@ -50604,6 +50241,27 @@ var PTZ_TILT_MODE_CONTROLLER = ptzDirectionalModeController("ptz.tilt", "Tilt",
 		label: "Down"
 	}
 ]);
+/** Amazon (alexa-modecontroller): "You must include a minimum of two mode
+*  objects." One preset made the camera's whole AddOrUpdateReport fail
+*  schema validation, and Discover dropped the camera. */
+var MIN_MODE_CONTROLLER_MODES = 2;
+/**
+* Preset names as distinct mode values. Two presets with the same name (the
+* camera allows it: `Stanza`, `Stanza`; `CamStack Home` ×3) produced two
+* identical modes, and Alexa rejected the capability — "Invalid capability
+* received." — and with it every endpoint of the camera. First wins,
+* case-insensitively: the SetMode handler resolves a value to the first
+* preset of that name, which is the one kept.
+*/
+function distinctPresetNames(names) {
+	const seen = /* @__PURE__ */ new Set();
+	return names.filter((name) => {
+		const key = name.toLowerCase();
+		if (seen.has(key)) return false;
+		seen.add(key);
+		return true;
+	});
+}
 function ptzPresetModeController(presetNames) {
 	return {
 		type: "AlexaInterface",
@@ -50648,7 +50306,8 @@ function buildParentCameraEndpoint(input) {
 	if (input.isDoorbell) capabilities.push(DOORBELL_EVENT_SOURCE);
 	if (input.hasMotion) capabilities.push(MOTION_SENSOR);
 	if (input.hasBattery) capabilities.push(BATTERY_LEVEL_SENSOR);
-	if (input.ptzPresetNames.length > 0) capabilities.push(ptzPresetModeController(input.ptzPresetNames));
+	const presetNames = distinctPresetNames(input.ptzPresetNames);
+	if (presetNames.length >= MIN_MODE_CONTROLLER_MODES) capabilities.push(ptzPresetModeController(presetNames));
 	if (input.hasPtz) {
 		capabilities.push(PTZ_PAN_MODE_CONTROLLER);
 		capabilities.push(PTZ_TILT_MODE_CONTROLLER);
@@ -50787,6 +50446,12 @@ function buildAlarmPanelEndpoint(input) {
 	};
 }
 //#endregion
+//#region src/handlers/ptz-preset-recallable.ts
+var RECALLABLE_FUNCTIONS = new Set(["home"]);
+function isAlexaRecallablePreset(preset) {
+	return preset.fn === null || RECALLABLE_FUNCTIONS.has(preset.fn);
+}
+//#endregion
 //#region src/handlers/discovery.ts
 var discoveryPayloadSchema = DiscoveryDirectiveSchema.shape.payload;
 /** Devices built at once in `handleDiscovery` — latency-bound tRPC reads, so
@@ -50974,7 +50639,7 @@ async function loadBoundDeviceInfo(device, api) {
 	};
 }
 async function fetchPtzPresetNames(deviceId, api) {
-	return (await api.ptz.getPresets.query({ deviceId })).map((p) => p.name).filter((n) => n.length > 0);
+	return (await api.ptz.getPresets.query({ deviceId })).filter(isAlexaRecallablePreset).map((p) => p.name).filter((n) => n.length > 0);
 }
 function classifyChildKind(deviceType, role) {
 	if (role === "floodlight" || role === "spotlight" || role === "nightvision") return "light";
@@ -51374,8 +51039,8 @@ async function handleSetMode(header, endpointRaw, payloadRaw, deps, _callerIdent
 	if (!mode.startsWith(PTZ_PRESET_MODE_PREFIX)) return errorEnvelope(header, "INVALID_DIRECTIVE", `mode '${mode}' is not a ptz.preset mode`);
 	const presetName = mode.slice(11);
 	if (presetName.length === 0) return errorEnvelope(header, "INVALID_DIRECTIVE", "preset name missing after prefix");
-	const preset = (await api.ptz.getPresets.query({ deviceId: parsedId.deviceId })).find((p) => p.name === presetName);
-	if (!preset) return errorEnvelope(header, "INVALID_DIRECTIVE", `preset '${presetName}' not found on device ${parsedId.deviceId}`);
+	const preset = (await api.ptz.getPresets.query({ deviceId: parsedId.deviceId })).find((p) => p.name === presetName && isAlexaRecallablePreset(p));
+	if (!preset) return errorEnvelope(header, "INVALID_DIRECTIVE", `preset '${presetName}' is not a recallable preset on device ${parsedId.deviceId}`);
 	await api.ptz.goToPreset.mutate({
 		deviceId: parsedId.deviceId,
 		presetId: preset.id
@@ -51849,7 +51514,37 @@ function assertDeviceScope(scopes) {
 function requireDeviceScope(scopes, access) {
 	if (!scopesAllowDeviceCap(scopes, access)) throw new Error(`directive token not authorized for device ${access}`);
 }
+/**
+* Give an `Alexa.ErrorResponse` the directive's endpoint when it lacks one.
+* Amazon requires `endpoint` on every ErrorResponse to an endpoint directive
+* (alexa-errorresponse); the handlers build their errors from the header
+* alone, so the router — which holds the endpoint for every path — adds it.
+*/
+function withErrorEndpoint(body, endpoint) {
+	const endpointId = typeof endpoint === "object" && endpoint !== null && typeof endpoint.endpointId === "string" ? endpoint.endpointId : null;
+	if (endpointId === null || typeof body !== "object" || body === null) return body;
+	const event = body.event;
+	if (typeof event !== "object" || event === null) return body;
+	const ev = event;
+	if (ev.header?.namespace !== "Alexa" || ev.header?.name !== "ErrorResponse") return body;
+	if (ev.endpoint !== void 0) return body;
+	return {
+		...body,
+		event: {
+			...ev,
+			endpoint: { endpointId }
+		}
+	};
+}
 async function dispatchDirective(rawBody, deps, callerIdentity) {
+	const result = await dispatchParsedDirective(rawBody, deps, callerIdentity);
+	const endpoint = rawBody?.directive?.endpoint;
+	return {
+		status: result.status,
+		body: withErrorEndpoint(result.body, endpoint)
+	};
+}
+async function dispatchParsedDirective(rawBody, deps, callerIdentity) {
 	const parsed = DirectiveRequestSchema.safeParse(rawBody);
 	if (!parsed.success) return {
 		status: 400,
@@ -51871,6 +51566,7 @@ async function dispatchDirective(rawBody, deps, callerIdentity) {
 		"Alexa.Discovery/Discover": "view",
 		"Alexa.CameraStreamController/InitializeCameraStreams": "view",
 		"Alexa.RTCSessionController/InitiateSessionWithOffer": "view",
+		"Alexa.RTCSessionController/SessionConnected": "view",
 		"Alexa.RTCSessionController/SessionDisconnected": "view",
 		"Alexa.PowerController/TurnOn": "create",
 		"Alexa.PowerController/TurnOff": "create",
@@ -51905,6 +51601,10 @@ async function dispatchDirective(rawBody, deps, callerIdentity) {
 			status: 200,
 			body: await handleInitiateSessionWithOffer(header, endpoint, payload, deps.rtcSession, callerIdentity)
 		};
+		if (key === "Alexa.RTCSessionController/SessionConnected") return {
+			status: 200,
+			body: handleSessionConnected(header, endpoint, payload, deps.rtcSession)
+		};
 		if (key === "Alexa.RTCSessionController/SessionDisconnected") return {
 			status: 200,
 			body: await handleSessionDisconnected(header, endpoint, payload, deps.rtcSession, callerIdentity)
@@ -52411,10 +52111,12 @@ var DEFAULT_MOTION_CLEAR_HOLD_MS = 5e3;
 var MotionClearHold = class {
 	entries = /* @__PURE__ */ new Map();
 	holdMs;
+	minDetectedMs;
 	setTimer;
 	clearTimer;
 	constructor(options) {
 		this.holdMs = options.holdMs;
+		this.minDetectedMs = options.minDetectedMs ?? 3e4;
 		this.setTimer = options.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
 		this.clearTimer = options.clearTimer ?? ((handle) => clearTimeout(handle));
 	}
@@ -52432,13 +52134,15 @@ var MotionClearHold = class {
 			if (entry.timer !== null) this.clearTimer(entry.timer);
 			this.entries.set(key, {
 				state: "detected",
-				timer: null
+				timer: null,
+				detectedAt: entry.detectedAt
 			});
 			return false;
 		}
 		this.entries.set(key, {
 			state: "detected",
-			timer: null
+			timer: null,
+			detectedAt: Date.now()
 		});
 		return true;
 	}
@@ -52459,16 +52163,21 @@ var MotionClearHold = class {
 	onCleared(key, release) {
 		const entry = this.entries.get(key);
 		if (entry !== void 0 && entry.state !== "detected") return;
+		const detectedAt = entry?.detectedAt ?? null;
+		const sinceDetected = detectedAt === null ? 0 : Date.now() - detectedAt;
+		const delay = Math.max(this.holdMs, this.minDetectedMs - sinceDetected);
 		const timer = this.setTimer(() => {
 			this.entries.set(key, {
 				state: "idle",
-				timer: null
+				timer: null,
+				detectedAt: null
 			});
 			release();
-		}, this.holdMs);
+		}, delay);
 		this.entries.set(key, {
 			state: "holding",
-			timer
+			timer,
+			detectedAt
 		});
 	}
 	/** What Alexa currently believes for this key — for logs and assertions. */
@@ -52522,6 +52231,9 @@ var REFRESH_PROACTIVE_WINDOW_MS = 300 * 1e3;
 var REFRESH_SCAN_INTERVAL_MS = 60 * 1e3;
 /** After a failed legacy-grant migration, wait this long before trying again. */
 var MIGRATION_RETRY_MS = 300 * 1e3;
+/** The interface a camera endpoint must declare for a connectivity
+*  ChangeReport to mean anything to the Alexa cloud. */
+var ENDPOINT_HEALTH_INTERFACE = "Alexa.EndpointHealth";
 /** The interface an endpoint must advertise for a `DoorbellPress` to survive
 *  the Alexa cloud. */
 var DOORBELL_INTERFACE = "Alexa.DoorbellEventSource";
@@ -52553,6 +52265,10 @@ var LwaEventGateway = class {
 	unsubscribe = null;
 	unsubscribeMotion = null;
 	unsubscribeBattery = null;
+	unsubscribeConnectivity = [];
+	/** Last connectivity reported per `userId|endpointId` — a camera that
+	*  re-announces the same state must not become a ChangeReport stream. */
+	lastConnectivity = /* @__PURE__ */ new Map();
 	refreshTimer = null;
 	lastSentAt = /* @__PURE__ */ new Map();
 	/**
@@ -52601,6 +52317,11 @@ var LwaEventGateway = class {
 				this.deps.logger.warn("alexa lwa-gateway: battery handler crashed", { meta: { error: err instanceof Error ? err.message : String(err) } });
 			});
 		});
+		this.unsubscribeConnectivity = [[EventCategory.DeviceOnline, "OK"], [EventCategory.DeviceOffline, "UNREACHABLE"]].map(([category, connectivity]) => this.deps.ctx.eventBus.subscribe({ category }, (event) => {
+			this.onConnectivityChanged(event.data, connectivity).catch((err) => {
+				this.deps.logger.warn("alexa lwa-gateway: connectivity handler crashed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			});
+		}));
 		this.refreshTimer = setInterval(() => {
 			this.refreshExpiringTokens().catch((err) => {
 				this.deps.logger.warn("alexa lwa-gateway: token refresh scan crashed", { meta: { error: err instanceof Error ? err.message : String(err) } });
@@ -52615,6 +52336,9 @@ var LwaEventGateway = class {
 		this.unsubscribeMotion = null;
 		if (this.unsubscribeBattery) this.unsubscribeBattery();
 		this.unsubscribeBattery = null;
+		for (const off of this.unsubscribeConnectivity) off();
+		this.unsubscribeConnectivity = [];
+		this.lastConnectivity.clear();
 		if (this.refreshTimer) clearInterval(this.refreshTimer);
 		this.refreshTimer = null;
 		this.lastSentAt.clear();
@@ -52819,6 +52543,33 @@ var LwaEventGateway = class {
 		}
 	}
 	/**
+	* A camera went offline or came back. Amazon requires the `connectivity`
+	* ChangeReport within 3 s of the change (alexa-endpointhealth). Deduped per
+	* account and endpoint, and skipped for an endpoint Alexa is known to hold
+	* WITHOUT `Alexa.EndpointHealth` — the cloud would drop it (D76).
+	*/
+	async onConnectivityChanged(data, connectivity) {
+		if (typeof data?.deviceId !== "number") return;
+		if (!this.deps.listExposed().some((e) => e.deviceId === data.deviceId)) return;
+		const signature = this.deps.getExportedSignature(data.deviceId);
+		if (signature !== null && !signature.includes(ENDPOINT_HEALTH_INTERFACE)) return;
+		const linked = this.deps.listLinkedAccounts();
+		if (linked.length === 0) return;
+		if (!this.hasProactiveCredentials()) return;
+		const endpointId = String(data.deviceId);
+		for (const account of linked) {
+			const key = `${account.userId}|${endpointId}`;
+			if (this.lastConnectivity.get(key) === connectivity) continue;
+			this.lastConnectivity.set(key, connectivity);
+			await this.postEventBody(account.userId, endpointId, (accessToken) => buildConnectivityChangeReportPayload({
+				endpointId,
+				connectivity,
+				timestamp: Date.now(),
+				accessToken
+			}), `connectivity ${connectivity}`);
+		}
+	}
+	/**
 	* Send a one-shot `DeleteReport` for arbitrary endpoint ids per linked
 	* account. Used to clean up stale entries Alexa still shows from prior
 	* syncs (different addon version, different account, or an aborted
@@ -53139,6 +52890,36 @@ function buildBatteryChangeReportPayload(opts) {
 		context: { properties: [] }
 	};
 }
+function buildConnectivityChangeReportPayload(opts) {
+	return {
+		event: {
+			header: {
+				namespace: "Alexa",
+				name: "ChangeReport",
+				messageId: (0, node_crypto.randomUUID)(),
+				payloadVersion: "3"
+			},
+			endpoint: {
+				scope: {
+					type: "BearerToken",
+					token: opts.accessToken
+				},
+				endpointId: opts.endpointId
+			},
+			payload: { change: {
+				cause: { type: "PERIODIC_POLL" },
+				properties: [{
+					namespace: "Alexa.EndpointHealth",
+					name: "connectivity",
+					value: { value: opts.connectivity },
+					timeOfSample: new Date(opts.timestamp).toISOString(),
+					uncertaintyInMilliseconds: 0
+				}]
+			} }
+		},
+		context: { properties: [] }
+	};
+}
 function buildSmartVisionObjectDetectionEvent(opts) {
 	const timeOfSample = new Date(opts.timestamp).toISOString();
 	return { event: {
@@ -53307,7 +53088,7 @@ function buildAlexaOauthIntegration(publicHubUrl) {
 * client id and SECRET, on the theory that a per-account refresh token was the
 * real gate. The package is public on npm, so that secret was published with
 * every version and has to be rotated. Since D753 the secret lives only in the
-* skill's Lambda (AWS Secrets Manager); the hub gets short-lived Event Gateway
+* skill's Lambda (SSM Parameter Store SecureString, D761); the hub gets short-lived Event Gateway
 * tokens from the Lambda's broker (`broker-client.ts`) with a per-link
 * credential. `scripts/check-no-client-secrets.ts` keeps it that way.
 *
@@ -54338,7 +54119,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 					content: [
 						"Public skill (default): enable the \"CamStack\" skill in the Alexa app and link your account — no Amazon developer setup is needed. A single published skill + hosted Lambda route to this hub using its public HTTPS URL (baked into every JWT).",
 						"The skill's Lambda keeps the Amazon credentials: this hub never holds an LWA client secret. It receives short-lived event tokens from the Lambda's token broker with a credential that is unique to this link.",
-						"Custom skill: switch \"Alexa skill\" below to Custom, enter your skill id, and deploy the skill Lambda from this addon's lambda-template in your own AWS account (your LWA credentials go into AWS Secrets Manager there, not here).",
+						"Custom skill: switch \"Alexa skill\" below to Custom, enter your skill id, and deploy the skill Lambda from this addon's lambda-template in your own AWS account (your LWA credentials go into SSM Parameter Store there, not here).",
 						"Either way this hub must be reachable from the public internet (Cloudflare Tunnel, Tailscale Funnel, …). The \"External address\" picker selects which detected endpoint the Lambda calls back on — press \"Refresh external addresses\" after setting up a new tunnel."
 					].join("\n")
 				},
@@ -54405,7 +54186,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 					key: "__custom-skill-info",
 					label: "Your skill Lambda",
 					variant: "info",
-					content: "Proactive events (doorbell, motion, battery, device-list updates) are authorised by YOUR skill Lambda: it keeps the \"Send Alexa Events\" LWA client id/secret in AWS Secrets Manager and hands this hub short-lived tokens. Nothing to paste here — see the custom-skill setup guide."
+					content: "Proactive events (doorbell, motion, battery, device-list updates) are authorised by YOUR skill Lambda: it keeps the \"Send Alexa Events\" LWA client id/secret in SSM Parameter Store and hands this hub short-lived tokens. Nothing to paste here — see the custom-skill setup guide."
 				}] : [{
 					type: "info",
 					key: "__public-skill-info",