@camstack/addon-export-alexa 1.2.136 → 1.2.137

package/dist/export-alexa.addon.mjs

@@ -1,5 +1,6 @@
 import * as crypto$1 from "node:crypto";
-import { randomUUID } from "node:crypto";
+import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
+import sharp from "sharp";
 //#region ../types/dist/event-category-B_0XEcLF.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
@@ -3763,7 +3764,7 @@ function initializeContext(params) {
 		external: params?.external ?? void 0
 	};
 }
-function process(schema, ctx, _params = {
+function process$1(schema, ctx, _params = {
 	path: [],
 	schemaPath: []
 }) {
@@ -3800,7 +3801,7 @@ function process(schema, ctx, _params = {
 		const parent = schema._zod.parent;
 		if (parent) {
 			if (!result.ref) result.ref = parent;
-			process(parent, ctx, params);
+			process$1(parent, ctx, params);
 			ctx.seen.get(parent).isParent = true;
 		}
 	}
@@ -4020,7 +4021,7 @@ var createToJSONSchemaMethod = (schema, processors = {}) => (params) => {
 		...params,
 		processors
 	});
-	process(schema, ctx);
+	process$1(schema, ctx);
 	extractDefs(ctx, schema);
 	return finalize(ctx, schema);
 };
@@ -4032,7 +4033,7 @@ var createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params) =
 		io,
 		processors
 	});
-	process(schema, ctx);
+	process$1(schema, ctx);
 	extractDefs(ctx, schema);
 	return finalize(ctx, schema);
 };
@@ -4146,7 +4147,7 @@ var arrayProcessor = (schema, ctx, _json, params) => {
 	if (typeof minimum === "number") json.minItems = minimum;
 	if (typeof maximum === "number") json.maxItems = maximum;
 	json.type = "array";
-	json.items = process(def.element, ctx, {
+	json.items = process$1(def.element, ctx, {
 		...params,
 		path: [...params.path, "items"]
 	});
@@ -4157,7 +4158,7 @@ var objectProcessor = (schema, ctx, _json, params) => {
 	json.type = "object";
 	json.properties = {};
 	const shape = def.shape;
-	for (const key in shape) json.properties[key] = process(shape[key], ctx, {
+	for (const key in shape) json.properties[key] = process$1(shape[key], ctx, {
 		...params,
 		path: [
 			...params.path,
@@ -4175,7 +4176,7 @@ var objectProcessor = (schema, ctx, _json, params) => {
 	if (def.catchall?._zod.def.type === "never") json.additionalProperties = false;
 	else if (!def.catchall) {
 		if (ctx.io === "output") json.additionalProperties = false;
-	} else if (def.catchall) json.additionalProperties = process(def.catchall, ctx, {
+	} else if (def.catchall) json.additionalProperties = process$1(def.catchall, ctx, {
 		...params,
 		path: [...params.path, "additionalProperties"]
 	});
@@ -4183,7 +4184,7 @@ var objectProcessor = (schema, ctx, _json, params) => {
 var unionProcessor = (schema, ctx, json, params) => {
 	const def = schema._zod.def;
 	const isExclusive = def.inclusive === false;
-	const options = def.options.map((x, i) => process(x, ctx, {
+	const options = def.options.map((x, i) => process$1(x, ctx, {
 		...params,
 		path: [
 			...params.path,
@@ -4196,7 +4197,7 @@ var unionProcessor = (schema, ctx, json, params) => {
 };
 var intersectionProcessor = (schema, ctx, json, params) => {
 	const def = schema._zod.def;
-	const a = process(def.left, ctx, {
+	const a = process$1(def.left, ctx, {
 		...params,
 		path: [
 			...params.path,
@@ -4204,7 +4205,7 @@ var intersectionProcessor = (schema, ctx, json, params) => {
 			0
 		]
 	});
-	const b = process(def.right, ctx, {
+	const b = process$1(def.right, ctx, {
 		...params,
 		path: [
 			...params.path,
@@ -4221,7 +4222,7 @@ var tupleProcessor = (schema, ctx, _json, params) => {
 	json.type = "array";
 	const prefixPath = ctx.target === "draft-2020-12" ? "prefixItems" : "items";
 	const restPath = ctx.target === "draft-2020-12" ? "items" : ctx.target === "openapi-3.0" ? "items" : "additionalItems";
-	const prefixItems = def.items.map((x, i) => process(x, ctx, {
+	const prefixItems = def.items.map((x, i) => process$1(x, ctx, {
 		...params,
 		path: [
 			...params.path,
@@ -4229,7 +4230,7 @@ var tupleProcessor = (schema, ctx, _json, params) => {
 			i
 		]
 	}));
-	const rest = def.rest ? process(def.rest, ctx, {
+	const rest = def.rest ? process$1(def.rest, ctx, {
 		...params,
 		path: [
 			...params.path,
@@ -4260,7 +4261,7 @@ var recordProcessor = (schema, ctx, _json, params) => {
 	const keyType = def.keyType;
 	const patterns = keyType._zod.bag?.patterns;
 	if (def.mode === "loose" && patterns && patterns.size > 0) {
-		const valueSchema = process(def.valueType, ctx, {
+		const valueSchema = process$1(def.valueType, ctx, {
 			...params,
 			path: [
 				...params.path,
@@ -4271,11 +4272,11 @@ var recordProcessor = (schema, ctx, _json, params) => {
 		json.patternProperties = {};
 		for (const pattern of patterns) json.patternProperties[pattern.source] = valueSchema;
 	} else {
-		if (ctx.target === "draft-07" || ctx.target === "draft-2020-12") json.propertyNames = process(def.keyType, ctx, {
+		if (ctx.target === "draft-07" || ctx.target === "draft-2020-12") json.propertyNames = process$1(def.keyType, ctx, {
 			...params,
 			path: [...params.path, "propertyNames"]
 		});
-		json.additionalProperties = process(def.valueType, ctx, {
+		json.additionalProperties = process$1(def.valueType, ctx, {
 			...params,
 			path: [...params.path, "additionalProperties"]
 		});
@@ -4288,7 +4289,7 @@ var recordProcessor = (schema, ctx, _json, params) => {
 };
 var nullableProcessor = (schema, ctx, json, params) => {
 	const def = schema._zod.def;
-	const inner = process(def.innerType, ctx, params);
+	const inner = process$1(def.innerType, ctx, params);
 	const seen = ctx.seen.get(schema);
 	if (ctx.target === "openapi-3.0") {
 		seen.ref = def.innerType;
@@ -4297,27 +4298,27 @@ var nullableProcessor = (schema, ctx, json, params) => {
 };
 var nonoptionalProcessor = (schema, ctx, _json, params) => {
 	const def = schema._zod.def;
-	process(def.innerType, ctx, params);
+	process$1(def.innerType, ctx, params);
 	const seen = ctx.seen.get(schema);
 	seen.ref = def.innerType;
 };
 var defaultProcessor = (schema, ctx, json, params) => {
 	const def = schema._zod.def;
-	process(def.innerType, ctx, params);
+	process$1(def.innerType, ctx, params);
 	const seen = ctx.seen.get(schema);
 	seen.ref = def.innerType;
 	json.default = JSON.parse(JSON.stringify(def.defaultValue));
 };
 var prefaultProcessor = (schema, ctx, json, params) => {
 	const def = schema._zod.def;
-	process(def.innerType, ctx, params);
+	process$1(def.innerType, ctx, params);
 	const seen = ctx.seen.get(schema);
 	seen.ref = def.innerType;
 	if (ctx.io === "input") json._prefault = JSON.parse(JSON.stringify(def.defaultValue));
 };
 var catchProcessor = (schema, ctx, json, params) => {
 	const def = schema._zod.def;
-	process(def.innerType, ctx, params);
+	process$1(def.innerType, ctx, params);
 	const seen = ctx.seen.get(schema);
 	seen.ref = def.innerType;
 	let catchValue;
@@ -4332,26 +4333,26 @@ var pipeProcessor = (schema, ctx, _json, params) => {
 	const def = schema._zod.def;
 	const inIsTransform = def.in._zod.traits.has("$ZodTransform");
 	const innerType = ctx.io === "input" ? inIsTransform ? def.out : def.in : def.out;
-	process(innerType, ctx, params);
+	process$1(innerType, ctx, params);
 	const seen = ctx.seen.get(schema);
 	seen.ref = innerType;
 };
 var readonlyProcessor = (schema, ctx, json, params) => {
 	const def = schema._zod.def;
-	process(def.innerType, ctx, params);
+	process$1(def.innerType, ctx, params);
 	const seen = ctx.seen.get(schema);
 	seen.ref = def.innerType;
 	json.readOnly = true;
 };
 var optionalProcessor = (schema, ctx, _json, params) => {
 	const def = schema._zod.def;
-	process(def.innerType, ctx, params);
+	process$1(def.innerType, ctx, params);
 	const seen = ctx.seen.get(schema);
 	seen.ref = def.innerType;
 };
 var lazyProcessor = (schema, ctx, _json, params) => {
 	const innerType = schema._zod.innerType;
-	process(innerType, ctx, params);
+	process$1(innerType, ctx, params);
 	const seen = ctx.seen.get(schema);
 	seen.ref = innerType;
 };
@@ -7442,9 +7443,9 @@ function errMsg(err) {
 */
 /** The pinned jellyfin-ffmpeg release. Changing this is the version change. */
 var FFMPEG_RELEASE = "8.1.2-5";
-var BASE = `https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/v${FFMPEG_RELEASE}`;
+var BASE$1 = `https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/v${FFMPEG_RELEASE}`;
 function portable(target) {
-	return `${BASE}/jellyfin-ffmpeg_${FFMPEG_RELEASE}_portable_${target}-gpl.tar.xz`;
+	return `${BASE$1}/jellyfin-ffmpeg_${FFMPEG_RELEASE}_portable_${target}-gpl.tar.xz`;
 }
 portable("linux64"), portable("linuxarm64"), portable("macarm64"), portable("mac64");
 /**
@@ -26326,7 +26327,7 @@ method(SendEmailInputSchema, SendEmailResultSchema, {
 * the device-native provider (onboard capture) or from the stream-broker
 * prebuffer fallback.
 */
-var SnapshotImageSchema = object({
+var SnapshotImageSchema$1 = object({
 	base64: string(),
 	contentType: string()
 });
@@ -26358,7 +26359,7 @@ DeviceType.Camera, method(object({
 	* correct answer: stale but honest beats woken.
 	*/
 	force: boolean().optional()
-}), SnapshotImageSchema.nullable()), method(object({ deviceId: number() }), _void(), {
+}), SnapshotImageSchema$1.nullable()), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), systemMethod(object({ deviceIds: array(number()).min(1).max(200) }), array(object({
@@ -28406,7 +28407,22 @@ DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), ar
 	* field their hints were silently stripped by the schema and the
 	* adaptive ladder started blind on the client's display size.
 	*/
-	hints: webrtcClientHintsSchema.optional()
+	hints: webrtcClientHintsSchema.optional(),
+	/**
+	* Talk-back (D771): relay the PEER's audio to the device's speaker
+	* through the `intercom` cap's push-talk triple. When `true` and the
+	* offer lets the peer send audio, the answer's audio is `sendrecv`
+	* and every inbound frame goes to `intercom.pushTalkAudio` for this
+	* `deviceId`; absent/false answers `sendonly`, as for every viewer.
+	*
+	* TRUSTED-CALLER ONLY. Set by the Alexa export for an Echo on a camera
+	* with `intercom`, when the linked user may control that camera. The
+	* hub STRIPS it from every request-bound call (a browser), exactly as
+	* it overwrites `relayOnly` — a viewer's talk permission is the
+	* intercom cap's own surface (share tokens gate it there), and this
+	* flag must not become a second door to the camera's speaker.
+	*/
+	talkback: boolean().optional()
 }), object({
 	sessionId: string(),
 	sdpAnswer: string()
@@ -29193,7 +29209,19 @@ object({
 	lastChangedAt: number()
 });
 DeviceType.Sensor;
-object({
+/**
+* Dimmable-light brightness control. Co-exists with `switch` on the
+* same device — the switch toggles on/off, this cap sets the level
+* applied when the light is on. Drivers map their per-vendor dim
+* controls to this single-method surface.
+*
+* The cap is intentionally minimal: a single `setBrightness({deviceId,
+* percentage})` mutation plus the auto-injected `getStatus`. Drivers
+* that expose richer controls (color temperature, scenes, schedules)
+* should surface those via the device's `getSettingsUISchema()`
+* instead of bloating this cap.
+*/
+var BrightnessStatusSchema = object({
 	/** Current level as 0..100 inclusive. Firmware-reported. */
 	percentage: number().min(0).max(100),
 	/** Ms epoch of the last operator-driven change. Useful for UI freshness. */
@@ -29818,7 +29846,19 @@ Object.values(DeviceType), method(object({
 	kind: "mutation",
 	auth: "admin"
 }), ConsumablesStatusSchema.extend({ lastFetchedAt: number() });
-object({
+/**
+* Door / window / opening / garage / valve contact sensor. Boolean
+* "is the entry currently open" with the timestamp of the last
+* transition. Drives Home Assistant `binary_sensor` entries whose
+* `device_class` is `door`, `window`, `opening`, `garage`, or
+* `garage_door` — and any future native integration that needs
+* the same semantics.
+*
+* Push-driven: providers update the slice on transition events from
+* the upstream source (HA WebSocket `state_changed`, ZWave
+* `notification` …). Consumers read the slice; no polling.
+*/
+var ContactStatusSchema = object({
 	/** True when the entry is open; false when closed. */
 	entryOpen: boolean(),
 	/** Ms epoch of the last open↔closed transition. 0 if never observed. */
@@ -30640,7 +30680,15 @@ DeviceType.Humidifier, method(object({
 	kind: "mutation",
 	auth: "protected"
 });
-object({
+/**
+* Single-metric humidity reading. Drives Home Assistant `sensor`
+* entries with `device_class: humidity`.
+*
+* Unit normalisation: percent. The canonical display unit (`%`) is a
+* descriptor constant in the UI (ROLE_DESCRIPTOR), not stored in
+* `sourceInfo`.
+*/
+var HumiditySensorStatusSchema = object({
 	/** Current relative humidity, 0..100. */
 	percent: number().min(0).max(100),
 	/** Ms epoch when the slice was last updated. */
@@ -31447,7 +31495,7 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	kind: "mutation",
 	auth: "admin"
 });
-object({
+var LockControlStatusSchema = object({
 	/** Lifecycle state of the lock. `jammed` means the motor reported
 	*  failure to reach the target — operator intervention required. */
 	state: _enum([
@@ -31785,7 +31833,7 @@ authKey: string().optional() }), object({
 	/** Human-readable error when `ok: false`. */
 	error: string().optional()
 }), { kind: "mutation" });
-object({
+var MotionStatusSchema = object({
 	detected: boolean(),
 	/** Ms epoch of the last detected-true observation. Null if never detected. */
 	lastDetectedAt: number().nullable(),
@@ -33330,7 +33378,7 @@ var GpsLocationSchema = object({
 	/** Reported accuracy in meters (lower = better). */
 	accuracyMeters: number().nonnegative()
 });
-object({
+var PresenceStatusSchema = object({
 	/** `home` / `not_home` / any user-defined zone name. */
 	state: string(),
 	/** Optional textual location label (zone name, city, address). Null
@@ -35752,7 +35800,14 @@ DeviceType.Camera, method(object({ deviceId: number() }), StreamParamsOptionsSch
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ deviceId: number() }), unknown().nullable());
-object({
+/**
+* Generic on/off switch cap for accessory children (siren, floodlight,
+* spotlight, PIR toggle, chime silencer, autotrack enable, …). The cap
+* owns ONLY the boolean state — driver-specific settings (brightness,
+* sensitivity, schedule, duration) live on the device's own
+* `getSettingsUISchema()` surface.
+*/
+var SwitchStatusSchema = object({
 	on: boolean(),
 	/** Ms epoch of the last state change. Useful for UI "X minutes ago". */
 	lastChangedAt: number()
@@ -36293,7 +36348,23 @@ object({
 	lastChangedAt: number()
 });
 DeviceType.Sensor;
-object({
+/**
+* Single-metric temperature reading. Drives Home Assistant `sensor`
+* entries with `device_class: temperature` and any future native
+* thermometer.
+*
+* Unit normalisation: providers convert to Celsius before storing.
+* The slice value is always Celsius so cross-cap aggregators
+* (climate-control's `currentTemp`, energy analytics) can compose
+* without per-source unit fixups. The canonical display unit (`°C`) is
+* a descriptor constant in the UI (ROLE_DESCRIPTOR), not stored in
+* `sourceInfo`.
+*
+* Status `lastFetchedAt` lets staleness-aware consumers detect a
+* frozen feed (provider hung) distinct from a "temperature hasn't
+* changed" steady state.
+*/
+var TemperatureSensorStatusSchema = object({
 	/** Current temperature in Celsius. */
 	celsius: number(),
 	/** Ms epoch when the slice was last updated (push or poll). */
@@ -49234,6 +49305,76 @@ DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.sceneBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
+/** Ancestor-walk bound — defence-in-depth against a corrupt parentage cycle. */
+var MAX_ANCESTOR_HOPS$1 = 8;
+/**
+* Does `selector` cover `device` DIRECTLY (no inheritance)? Inheritance is
+* layered on by the resolver/matcher, which tests this against a device's
+* ancestors too.
+*/
+function deviceSelectorMatches(selector, device) {
+	switch (selector.kind) {
+		case "all": return true;
+		case "ids": return selector.ids.includes(device.id);
+		case "types": return selector.types.some((t) => String(t) === device.type);
+		case "locations": return device.location !== null && selector.locations.includes(device.location);
+	}
+}
+/** Whether a `category:device` grant covers `access` (the broad lever). */
+function hasBroadDeviceGrant(scopes, access) {
+	return scopes.some((s) => s.type === "category" && s.target === "device" && s.access.includes(access));
+}
+/** The `device`-typed scopes granting `access`. */
+function deviceScopesFor(scopes, access) {
+	return scopes.filter((s) => s.type === "device" && s.access.includes(access));
+}
+/** Whether inheritance applies for a grant at `access` (view inherits, others
+*  don't, unless the grant overrides via `includeLinked`). */
+function scopeInherits(scope, access) {
+	return scope.includeLinked ?? access === "view";
+}
+/** Ancestors (parent, grandparent, …) of `deviceId` within a fleet map. */
+function ancestorsOf(deviceId, byId) {
+	const out = [];
+	let current = deviceId;
+	for (let hop = 0; hop < MAX_ANCESTOR_HOPS$1; hop++) {
+		const parent = current === null ? null : byId.get(current)?.parentDeviceId ?? null;
+		if (parent === null || parent === current) break;
+		out.push(parent);
+		current = parent;
+	}
+	return out;
+}
+/**
+* Resolve the set of deviceIds the caller may reach at `access`, expanded
+* against the live `fleet`. A `category:device` grant returns the whole
+* fleet. Device selectors are matched per device — directly, or (when the
+* grant inherits) against an ancestor, so a parent grant covers its
+* accessories.
+*/
+function resolveViewableDeviceIds(scopes, fleet, access) {
+	if (hasBroadDeviceGrant(scopes, access)) return new Set(fleet.map((d) => d.id));
+	const byId = /* @__PURE__ */ new Map();
+	for (const d of fleet) byId.set(d.id, d);
+	const grants = deviceScopesFor(scopes, access);
+	const out = /* @__PURE__ */ new Set();
+	for (const d of fleet) for (const grant of grants) {
+		if (deviceSelectorMatches(grant.selector, d)) {
+			out.add(d.id);
+			break;
+		}
+		if (scopeInherits(grant, access)) {
+			if (ancestorsOf(d.id, byId).some((ancestorId) => {
+				const ancestor = byId.get(ancestorId);
+				return ancestor !== void 0 && deviceSelectorMatches(grant.selector, ancestor);
+			})) {
+				out.add(d.id);
+				break;
+			}
+		}
+	}
+	return out;
+}
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
@@ -49254,17 +49395,29 @@ var MB = 1024 * 1024;
 *                    `/addon/export-alexa/admin/redetect-hub-url` route.
 */
 var exportAlexaActions = defineCustomActions({
-	redetectHubUrl: customAction(object({}).optional(), object({ publicHubUrl: string() }), { kind: "mutation" }),
-	regenerateIngressToken: customAction(object({}).optional(), object({ ingressToken: string() }), { kind: "mutation" }),
+	redetectHubUrl: customAction(object({}).optional(), object({ publicHubUrl: string() }), {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	regenerateIngressToken: customAction(object({}).optional(), object({ ingressToken: string() }), {
+		kind: "mutation",
+		auth: "admin"
+	}),
 	resyncDiscovery: customAction(object({}).optional(), object({
 		endpointCount: number(),
 		accountCount: number()
-	}), { kind: "mutation" }),
+	}), {
+		kind: "mutation",
+		auth: "admin"
+	}),
 	purgeStaleEndpoints: customAction(object({}).optional(), object({
 		requested: number(),
 		accountCount: number(),
 		attemptedAccounts: number()
-	}), { kind: "mutation" }),
+	}), {
+		kind: "mutation",
+		auth: "admin"
+	}),
 	/**
 	* Sever the Amazon account link from this side — the only severance path
 	* that exists, because the descriptor sets `refreshTokenTtlSec: 'never'`
@@ -49281,16 +49434,31 @@ var exportAlexaActions = defineCustomActions({
 	unlinkAlexaAccounts: customAction(object({}).optional(), object({
 		revokedSessions: number(),
 		removedAccounts: number()
-	}), { kind: "mutation" }),
+	}), {
+		kind: "mutation",
+		auth: "admin"
+	}),
 	/**
 	* Swap the per-link credential this hub presents to the skill Lambda's
 	* token broker (D753) for a fresh one; the old one dies at once. Rotation
 	* also happens implicitly on every re-link.
 	*/
+	/**
+	* The ingress token, in clear, for an administrator who asked for it. The
+	* one read surface that returns it: `deviceExport.getStatus` and the
+	* settings form carry only a mask.
+	*/
+	revealIngressToken: customAction(object({}).optional(), object({ ingressToken: string() }), {
+		kind: "mutation",
+		auth: "admin"
+	}),
 	rotateBrokerCredential: customAction(object({}).optional(), object({
 		rotated: number(),
 		failed: number()
-	}), { kind: "mutation" })
+	}), {
+		kind: "mutation",
+		auth: "admin"
+	})
 });
 //#endregion
 //#region src/egress/alexa-rtc-egress.ts
@@ -49430,6 +49598,21 @@ async function profileForCamStream(input) {
 }
 //#endregion
 //#region src/handlers/endpoint-id.ts
+/** The classes a camera publishes a detection sensor for (R1). */
+var DETECTION_SENSOR_CLASSES = [
+	"person",
+	"vehicle",
+	"animal",
+	"package"
+];
+var DETECTION_PREFIX = "det_";
+function isDetectionSensorClass(value) {
+	return DETECTION_SENSOR_CLASSES.includes(value);
+}
+/** The endpoint id of a camera's detection sensor for one class. */
+function detectionSensorEndpointId(deviceId, cls) {
+	return `${deviceId}${SEPARATOR}${DETECTION_PREFIX}${cls}`;
+}
 var SEPARATOR = "__";
 function parseCameraEndpointId(raw) {
 	if (!raw.includes(SEPARATOR)) {
@@ -49465,6 +49648,22 @@ function parseCameraEndpointId(raw) {
 		kind: "alarm-panel",
 		deviceId: parent
 	};
+	if (tail === "dev") return {
+		kind: "generic",
+		deviceId: parent
+	};
+	if (tail.startsWith(DETECTION_PREFIX)) {
+		const cls = tail.slice(4);
+		if (isDetectionSensorClass(cls)) return {
+			kind: "detection",
+			deviceId: parent,
+			detectionClass: cls
+		};
+		return {
+			kind: "invalid",
+			reason: `unknown detection class in endpointId: ${raw}`
+		};
+	}
 	const child = parseNonNegativeInt(tail);
 	if (child === null) return {
 		kind: "invalid",
@@ -49646,7 +49845,12 @@ function resolveWebrtcTarget(pref) {
 		camStreamId: pref
 	};
 }
-async function handleInitiateSessionWithOffer(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
+/** The cap whose push-talk triple receives the Echo's microphone. */
+var CAP_INTERCOM$1 = "intercom";
+async function deviceHasIntercom(api, deviceId) {
+	return (await api.deviceManager.getBindings.query({ deviceId })).entries.some((e) => e.capName === CAP_INTERCOM$1);
+}
+async function handleInitiateSessionWithOffer(header, endpointRaw, payloadRaw, deps, _callerIdentity, grant = { mayTalk: false }) {
 	const parsed = InitiateSessionWithOfferDirectiveSchema.safeParse({
 		endpoint: endpointRaw,
 		payload: payloadRaw ?? {}
@@ -49755,12 +49959,21 @@ async function handleInitiateSessionWithOffer(header, endpointRaw, payloadRaw, d
 		log.warn("alexa rtc-session: egress acquire failed, falling back to streamPreference target", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		derivedTarget = resolveWebrtcTarget(exposedEntry?.settings?.streamPreference ?? "auto");
 	}
+	const talkback = grant.mayTalk && await deviceHasIntercom(api, deviceId).catch((err) => {
+		log.warn("alexa rtc-session: intercom lookup failed — this session is one-way audio", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		return false;
+	});
+	log.info("alexa rtc-session: talk-back decision", { meta: {
+		talkback,
+		mayTalk: grant.mayTalk
+	} });
 	try {
 		const result = await api.webrtcSession.handleOffer.mutate({
 			deviceId,
 			sdpOffer,
 			sessionId,
 			target: derivedTarget,
+			talkback,
 			relayOnly: false,
 			nonTrickle: true,
 			disableTurn: true,
@@ -50015,6 +50228,111 @@ async function rotateBrokerCredential(fetchImpl, brokerUrl, credential) {
 async function revokeBrokerCredential(fetchImpl, brokerUrl, credential) {
 	await call(fetchImpl, brokerUrl, "/broker/revoke", { bearer: credential }, unknown());
 }
+/** Device types this export may publish as a generic endpoint. */
+var GENERIC_DEVICE_TYPES = [
+	"light",
+	"switch",
+	"siren",
+	"sensor",
+	"lock",
+	"presence",
+	"thermostat",
+	"generic"
+];
+function iface(name, property) {
+	return {
+		type: "AlexaInterface",
+		interface: name,
+		version: "3",
+		properties: {
+			supported: [{ name: property }],
+			proactivelyReported: true,
+			retrievable: true
+		}
+	};
+}
+var BASE = {
+	type: "AlexaInterface",
+	interface: "Alexa",
+	version: "3"
+};
+var HEALTH = {
+	type: "AlexaInterface",
+	interface: "Alexa.EndpointHealth",
+	version: "3.1",
+	properties: {
+		supported: [{ name: "connectivity" }],
+		proactivelyReported: true,
+		retrievable: true
+	}
+};
+var ROWS = [
+	{
+		cap: "lock-control",
+		capability: iface("Alexa.LockController", "lockState"),
+		category: "SMARTLOCK"
+	},
+	{
+		cap: "contact",
+		capability: iface("Alexa.ContactSensor", "detectionState"),
+		category: "CONTACT_SENSOR"
+	},
+	{
+		cap: "motion",
+		capability: iface("Alexa.MotionSensor", "detectionState"),
+		category: "MOTION_SENSOR"
+	},
+	{
+		cap: "presence",
+		capability: iface("Alexa.MotionSensor", "detectionState"),
+		category: "MOTION_SENSOR"
+	},
+	{
+		cap: "temperature-sensor",
+		capability: iface("Alexa.TemperatureSensor", "temperature"),
+		category: "TEMPERATURE_SENSOR"
+	},
+	{
+		cap: "humidity-sensor",
+		capability: iface("Alexa.HumiditySensor", "relativeHumidity"),
+		category: "TEMPERATURE_SENSOR"
+	},
+	{
+		cap: "switch",
+		capability: iface("Alexa.PowerController", "powerState"),
+		category: "SWITCH"
+	}
+];
+var BRIGHTNESS = iface("Alexa.BrightnessController", "brightness");
+/** The endpoint for a non-camera device, or null when none of its caps has an
+*  Alexa interface. */
+function buildGenericDeviceEndpoint(input) {
+	const capabilities = [BASE];
+	const seen = /* @__PURE__ */ new Set();
+	let category = null;
+	for (const row of ROWS) {
+		if (!input.capNames.includes(row.cap)) continue;
+		if (seen.has(row.capability.interface)) continue;
+		seen.add(row.capability.interface);
+		capabilities.push(row.capability);
+		category ??= row.category;
+	}
+	if (category === null) return null;
+	const dimmable = input.capNames.includes("switch") && input.capNames.includes("brightness");
+	if (dimmable) capabilities.push(BRIGHTNESS);
+	if (category === "SWITCH" && (dimmable || input.type === "light")) category = "LIGHT";
+	capabilities.push(HEALTH);
+	const name = input.name.trim();
+	return {
+		endpointId: `${input.deviceId}__dev`,
+		manufacturerName: "camstack",
+		description: `CamStack ${input.type || "device"}`,
+		friendlyName: name.length > 0 ? name : `Device ${input.deviceId}`,
+		displayCategories: [category],
+		capabilities,
+		cookie: { stableId: input.stableId }
+	};
+}
 //#endregion
 //#region src/handlers/security-panel-arm-state.ts
 /**
@@ -50116,6 +50434,34 @@ var CAMERA_STREAM_CONTROLLER = {
 		audioCodecs: ["AAC"]
 	}]
 };
+/**
+* `Alexa.EndpointHealth` v3.1 — `connectivity`, retrievable and proactive.
+*
+* Required by Amazon on every sensor endpoint (a camera with MotionSensor is
+* one) and for live view it is load-bearing: the first time it was declared,
+* the hub only ever reported a TRANSITION and ReportState never answered it,
+* so Alexa held no value — and the phone app refused live view on an endpoint
+* of unknown health while an Echo Show kept streaming. It is declared ONLY
+* together with what keeps a value in Alexa's hands (D770):
+*
+*   - `handlers/report-state.ts` answers `connectivity` for every endpoint
+*     that declares it (`OK` when the status read itself fails);
+*   - `LwaEventGateway.scheduleInitialConnectivity` reports it after every
+*     AddOrUpdateReport and every Discover;
+*   - the gateway's online/offline ChangeReports keep it current.
+*
+* `endpoint-health.spec.ts` pins all three.
+*/
+var ENDPOINT_HEALTH = {
+	type: "AlexaInterface",
+	interface: "Alexa.EndpointHealth",
+	version: "3.1",
+	properties: {
+		supported: [{ name: "connectivity" }],
+		proactivelyReported: true,
+		retrievable: true
+	}
+};
 var DOORBELL_EVENT_SOURCE = {
 	type: "AlexaInterface",
 	interface: "Alexa.DoorbellEventSource",
@@ -50132,6 +50478,26 @@ var MOTION_SENSOR = {
 		retrievable: true
 	}
 };
+/**
+* `Alexa.SmartVision.SnapshotProvider` v1.1 — the camera's still in the Alexa
+* app (R2, D773). Available in it-IT and en-GB, unlike object detection.
+* Declared on every camera while the integration's "Snapshots" switch is on;
+* `GetSnapshot` answers with a signed, ten-minute, account-token-checked image
+* on the hub's public address (`handlers/snapshot-provider.ts`).
+*
+* `minRefreshIntervalInSeconds` bounds how often Alexa may ask per camera:
+* every ask is a snapshot read and a re-encode on the hub, and a picture of the
+* home handed to Amazon, so the tile refreshes at most every few minutes.
+*/
+var SMART_VISION_SNAPSHOT_PROVIDER = {
+	type: "AlexaInterface",
+	interface: "Alexa.SmartVision.SnapshotProvider",
+	version: "1.1",
+	configuration: {
+		isAvailable: true,
+		minRefreshIntervalInSeconds: 180
+	}
+};
 function rtcSessionController(fullDuplexAudio) {
 	return {
 		type: "AlexaInterface",
@@ -50140,13 +50506,15 @@ function rtcSessionController(fullDuplexAudio) {
 		configuration: { isFullDuplexAudioSupported: fullDuplexAudio }
 	};
 }
+/** Proactively reported (R3, D776): `StateChangeReporter` pushes every
+*  `switch` / `privacy-mask` / `ptz-autotrack` / `brightness` change. */
 var POWER_CONTROLLER = {
 	type: "AlexaInterface",
 	interface: "Alexa.PowerController",
 	version: "3",
 	properties: {
 		supported: [{ name: "powerState" }],
-		proactivelyReported: false,
+		proactivelyReported: true,
 		retrievable: true
 	}
 };
@@ -50156,16 +50524,6 @@ var BRIGHTNESS_CONTROLLER = {
 	version: "3",
 	properties: {
 		supported: [{ name: "brightness" }],
-		proactivelyReported: false,
-		retrievable: true
-	}
-};
-var BATTERY_LEVEL_SENSOR = {
-	type: "AlexaInterface",
-	interface: "Alexa.BatteryLevelSensor",
-	version: "3",
-	properties: {
-		supported: [{ name: "batteryLevel" }],
 		proactivelyReported: true,
 		retrievable: true
 	}
@@ -50338,11 +50696,12 @@ function buildParentCameraEndpoint(input) {
 	const capabilities = [
 		ALEXA_BASE_CAPABILITY,
 		CAMERA_STREAM_CONTROLLER,
-		rtcSessionController(input.hasIntercom)
+		rtcSessionController(input.hasIntercom),
+		ENDPOINT_HEALTH
 	];
 	if (input.isDoorbell) capabilities.push(DOORBELL_EVENT_SOURCE);
 	if (input.hasMotion) capabilities.push(MOTION_SENSOR);
-	if (input.hasBattery) capabilities.push(BATTERY_LEVEL_SENSOR);
+	if (input.snapshotProvider === true) capabilities.push(SMART_VISION_SNAPSHOT_PROVIDER);
 	const presetNames = distinctPresetNames(input.ptzPresetNames);
 	if (presetNames.length >= MIN_MODE_CONTROLLER_MODES) capabilities.push(ptzPresetModeController(presetNames));
 	if (input.hasPtz) {
@@ -50449,10 +50808,10 @@ function buildPrivacyEndpoint(input) {
 *    declared: `alarm-panel` has no field saying WHICH alarm is sounding, and
 *    declaring a property we would always answer `OK` on is a claim with no
 *    basis behind it. The reasoning is in `security-panel-arm-state.ts`.
-*  - `proactivelyReported: false`. This addon's Event Gateway pushes
-*    ChangeReports for camera motion only; a panel state change is not wired
-*    to it, and promising a report nothing sends is how an endpoint ends up
-*    looking broken. `retrievable: true` — `Alexa/ReportState` answers.
+*  - `proactivelyReported: true` (R3, D776). Amazon asks for alarms to be
+*    reported proactively; `StateChangeReporter` pushes every `alarm-panel`
+*    slice change (arm state and the burglary alarm). `retrievable: true` —
+*    `Alexa/ReportState` answers too.
 *  - `supportedAuthorizationTypes` appears only for a panel that requires a
 *    code. Alexa's Disarm directive can carry a PIN; its **Arm directive
 *    cannot**, which is why a PIN-gated arm is refused by the handler with
@@ -50467,7 +50826,7 @@ function buildAlarmPanelEndpoint(input) {
 		version: "3",
 		properties: {
 			supported: [{ name: "armState" }, { name: "burglaryAlarm" }],
-			proactivelyReported: false,
+			proactivelyReported: true,
 			retrievable: true
 		},
 		configuration
@@ -50482,6 +50841,42 @@ function buildAlarmPanelEndpoint(input) {
 		cookie: { stableId: input.stableId }
 	};
 }
+/** How a detection sensor is named after its camera. English, like every
+*  other name this skill publishes; the operator can rename it in the app. */
+var DETECTION_SENSOR_LABELS = {
+	person: "Person",
+	vehicle: "Vehicle",
+	animal: "Animal",
+	package: "Package"
+};
+/**
+* One class of a camera's detections as an `Alexa.MotionSensor` endpoint —
+* "Front door Person" (R1, D772). It is what an it-IT / en-GB account can use
+* as a routine trigger ("when Front door Person detects motion → announce…"):
+* Amazon's object-detection interface is en-US only, MotionSensor is not.
+* Driven by the pipeline's tracks, not by the camera's own motion. Sensors
+* need `Alexa.EndpointHealth` (Amazon), reported like the camera's (D770).
+*/
+function buildDetectionSensorEndpoint(input) {
+	const label = DETECTION_SENSOR_LABELS[input.detectionClass];
+	const camera = input.cameraName.trim().length > 0 ? input.cameraName.trim() : `Camera ${input.deviceId}`;
+	return {
+		endpointId: detectionSensorEndpointId(input.deviceId, input.detectionClass),
+		manufacturerName: "camstack",
+		description: `CamStack ${input.detectionClass} detection`,
+		friendlyName: `${camera} ${label}`,
+		displayCategories: ["MOTION_SENSOR"],
+		capabilities: [
+			ALEXA_BASE_CAPABILITY,
+			MOTION_SENSOR,
+			ENDPOINT_HEALTH
+		],
+		cookie: {
+			stableId: input.stableId,
+			detectionClass: input.detectionClass
+		}
+	};
+}
 //#endregion
 //#region src/handlers/ptz-preset-recallable.ts
 var RECALLABLE_FUNCTIONS = new Set(["home"]);
@@ -50501,12 +50896,13 @@ var CAP_PTZ = "ptz";
 var CAP_PTZ_AUTOTRACK = "ptz-autotrack";
 var CAP_SWITCH = "switch";
 var CAP_BRIGHTNESS = "brightness";
-var CAP_BATTERY = "battery";
 var CAP_PRIVACY_MASK = "privacy-mask";
 var CAP_ALARM_PANEL = "alarm-panel";
-async function handleDiscovery(header, payloadRaw, deps, callerIdentity) {
+async function handleDiscovery(header, payloadRaw, deps, callerIdentity, visibility) {
 	if (!discoveryPayloadSchema.safeParse(payloadRaw).success) return errorEnvelope(header, "INVALID_DIRECTIVE", "Discovery payload shape unexpected");
-	const exposed = await deps.listExposed();
+	const allExposed = await deps.listExposed();
+	const exposed = [];
+	for (const entry of allExposed) if (await visibility.deviceVisible(entry.deviceId)) exposed.push(entry);
 	const built = new Array(exposed.length).fill(null);
 	const queue = exposed.map((entry, index) => ({
 		entry,
@@ -50517,7 +50913,7 @@ async function handleDiscovery(header, payloadRaw, deps, callerIdentity) {
 			const item = queue.shift();
 			if (item === void 0) return;
 			try {
-				built[item.index] = await buildEndpointsForExposedDevice(item.entry.deviceId, deps);
+				built[item.index] = await deps.buildEndpoints(item.entry.deviceId);
 			} catch (err) {
 				deps.logger.warn("alexa discovery (on-demand): skipping device — build failed", {
 					tags: { deviceId: item.entry.deviceId },
@@ -50528,10 +50924,12 @@ async function handleDiscovery(header, payloadRaw, deps, callerIdentity) {
 	};
 	const lanes = Math.min(DISCOVERY_BUILD_CONCURRENCY, Math.max(1, queue.length));
 	await Promise.all(Array.from({ length: lanes }, lane));
-	const endpoints = built.flatMap((b) => b ?? []);
+	const endpoints = await visibility.filterEndpoints(built.flatMap((b) => b ?? []));
 	deps.logger.info("alexa discovery returned endpoints", { meta: {
 		count: endpoints.length,
-		userId: callerIdentity.userId
+		userId: callerIdentity.userId,
+		exposedDevices: allExposed.length,
+		visibleDevices: exposed.length
 	} });
 	return discoveryResponse(header, endpoints);
 }
@@ -50543,6 +50941,26 @@ async function buildEndpointsForExposedDevice(deviceId, deps) {
 		return [];
 	}
 	const parentInfo = await loadBoundDeviceInfo(device, api);
+	if (GENERIC_DEVICE_TYPES.includes(String(device.type)) && !parentInfo.capNames.includes(CAP_ALARM_PANEL)) {
+		const generic = buildGenericDeviceEndpoint({
+			deviceId: parentInfo.id,
+			stableId: parentInfo.stableId,
+			name: parentInfo.name,
+			type: String(device.type),
+			capNames: parentInfo.capNames
+		});
+		if (generic === null) {
+			deps.logger.warn("alexa discovery: device has no cap Alexa has an interface for — not published", {
+				tags: { deviceId },
+				meta: {
+					type: device.type,
+					capNames: parentInfo.capNames
+				}
+			});
+			return [];
+		}
+		return [generic];
+	}
 	if (parentInfo.capNames.includes(CAP_ALARM_PANEL)) return [await buildAlarmPanelEndpointFor(parentInfo, api, deps)];
 	const children = await api.deviceManager.getChildren.query({ parentDeviceId: deviceId }).catch((err) => {
 		deps.logger.warn("alexa discovery: getChildren failed", {
@@ -50558,7 +50976,6 @@ async function buildEndpointsForExposedDevice(deviceId, deps) {
 	const hasMotion = parentInfo.capNames.includes(CAP_MOTION);
 	const hasAutotrack = parentInfo.capNames.includes(CAP_PTZ_AUTOTRACK);
 	const hasPtz = parentInfo.capNames.includes(CAP_PTZ);
-	const hasBattery = parentInfo.capNames.includes(CAP_BATTERY);
 	const hasPrivacy = parentInfo.capNames.includes(CAP_PRIVACY_MASK);
 	deps.logger.info("alexa discovery: built feature flags", {
 		tags: { deviceId: parentInfo.id },
@@ -50566,7 +50983,6 @@ async function buildEndpointsForExposedDevice(deviceId, deps) {
 			name: parentInfo.name,
 			capNames: parentInfo.capNames,
 			hasMotion,
-			hasBattery,
 			hasPtz,
 			hasAutotrack,
 			hasPrivacy,
@@ -50591,9 +51007,18 @@ async function buildEndpointsForExposedDevice(deviceId, deps) {
 		hasIntercom,
 		hasMotion,
 		ptzPresetNames,
-		hasBattery,
-		hasPtz
+		hasPtz,
+		snapshotProvider: deps.snapshots === true
 	}));
+	if (deps.detectionClasses !== void 0) {
+		const classes = await deps.detectionClasses(parentInfo.id);
+		for (const detectionClass of classes) out.push(buildDetectionSensorEndpoint({
+			deviceId: parentInfo.id,
+			stableId: parentInfo.stableId,
+			cameraName: parentInfo.name,
+			detectionClass
+		}));
+	}
 	if (hasAutotrack) out.push(buildAutotrackEndpoint({
 		parentDeviceId: parentInfo.id,
 		parentStableId: parentInfo.stableId,
@@ -50696,6 +51121,476 @@ function discoveryResponse(header, endpoints) {
 		payload: { endpoints }
 	} };
 }
+/** Ancestor-walk bound — defence against a corrupt parentage cycle. */
+var MAX_ANCESTOR_HOPS = 8;
+function principalFromGrant(grant) {
+	return grant.isAdmin ? {
+		kind: "admin",
+		userId: grant.userId
+	} : {
+		kind: "scoped",
+		userId: grant.userId,
+		scopes: grant.scopes
+	};
+}
+/**
+* Does `principal` reach `chain[0]` at `access`? `chain` is the device followed
+* by its ancestors (parent first), each with the metadata a selector needs.
+* Pure — the one derivation shared by directives, discovery and the event mirror.
+*/
+function principalAllowsDevice(principal, chain, access) {
+	if (principal.kind === "admin") return true;
+	const target = chain[0];
+	if (target === void 0) return false;
+	return resolveViewableDeviceIds(principal.scopes, chain, access).has(target.id);
+}
+function endpointAccessTarget(parsed) {
+	switch (parsed.kind) {
+		case "camera": return {
+			exposedDeviceId: parsed.deviceId,
+			deviceId: parsed.deviceId,
+			requiresParent: null,
+			ownAccess: "view"
+		};
+		case "privacy":
+		case "autotrack": return {
+			exposedDeviceId: parsed.parentDeviceId,
+			deviceId: parsed.parentDeviceId,
+			requiresParent: null,
+			ownAccess: "create"
+		};
+		case "child": return {
+			exposedDeviceId: parsed.parentDeviceId,
+			deviceId: parsed.childDeviceId,
+			requiresParent: parsed.parentDeviceId,
+			ownAccess: "create"
+		};
+		case "alarm-panel":
+		case "detection":
+		case "generic": return {
+			exposedDeviceId: parsed.deviceId,
+			deviceId: parsed.deviceId,
+			requiresParent: null,
+			ownAccess: "view"
+		};
+		case "invalid": return null;
+	}
+}
+var AlexaAccessGate = class {
+	deps;
+	grants = null;
+	grantsFlight = null;
+	meta = /* @__PURE__ */ new Map();
+	warnedStale = false;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	now() {
+		return this.deps.now?.() ?? Date.now();
+	}
+	/** Resolve the principal a link with this `userId` acts for. */
+	async principal(userId) {
+		const snapshot = await this.readGrants();
+		if (snapshot === null) return {
+			kind: "unavailable",
+			error: "the hub user store could not be read"
+		};
+		const grant = snapshot.byUserId.get(userId);
+		if (grant === void 0) return { kind: "unknown-user" };
+		return {
+			kind: "found",
+			principal: principalFromGrant(grant)
+		};
+	}
+	/** Does `principal` reach `deviceId` at `access`? */
+	async allows(principal, deviceId, access) {
+		if (principal.kind === "admin") return "allowed";
+		const chain = await this.chainOf(deviceId);
+		if (chain === null) return "unknown";
+		return principalAllowsDevice(principal, chain, access) ? "allowed" : "denied";
+	}
+	/** The device's parent per the registry; `undefined` when unknown. */
+	async parentOf(deviceId) {
+		const meta = await this.metaOf(deviceId);
+		return meta === null ? void 0 : meta.parentDeviceId;
+	}
+	/** Forget everything cached — for tests and an operator-driven re-sync. */
+	invalidate() {
+		this.grants = null;
+		this.meta.clear();
+	}
+	async readGrants() {
+		const cached = this.grants;
+		if (cached !== null && this.now() - cached.at < 3e4) return cached;
+		if (this.grantsFlight === null) this.grantsFlight = this.deps.listUserGrants().then((list) => {
+			const byUserId = /* @__PURE__ */ new Map();
+			for (const g of list) byUserId.set(g.userId, g);
+			const snapshot = {
+				at: this.now(),
+				byUserId
+			};
+			this.grants = snapshot;
+			this.warnedStale = false;
+			return snapshot;
+		}).finally(() => {
+			this.grantsFlight = null;
+		});
+		try {
+			return await this.grantsFlight;
+		} catch (err) {
+			if (cached !== null) {
+				if (!this.warnedStale) {
+					this.warnedStale = true;
+					this.deps.logger.warn("alexa access: the hub user store could not be re-read — keeping the last good grants", { meta: {
+						error: errMsg(err),
+						ageMs: this.now() - cached.at
+					} });
+				}
+				return cached;
+			}
+			this.deps.logger.warn("alexa access: the hub user store could not be read — refusing Alexa access until it can", { meta: { error: errMsg(err) } });
+			return null;
+		}
+	}
+	async metaOf(deviceId) {
+		const cached = this.meta.get(deviceId);
+		if (cached !== void 0 && this.now() - cached.at < 6e4) return cached.meta;
+		try {
+			const meta = await this.deps.getDeviceMeta(deviceId);
+			this.meta.set(deviceId, {
+				at: this.now(),
+				meta
+			});
+			return meta;
+		} catch (err) {
+			this.deps.logger.debug("alexa access: device metadata read failed", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
+			return cached?.meta ?? null;
+		}
+	}
+	/** The device followed by its ancestors, or `null` if the device is unknown.
+	*  An unknown ANCESTOR ends the walk — inheritance through it is simply not
+	*  granted (fail closed). */
+	async chainOf(deviceId) {
+		const self = await this.metaOf(deviceId);
+		if (self === null) return null;
+		const chain = [self];
+		let parent = self.parentDeviceId;
+		for (let hop = 0; hop < MAX_ANCESTOR_HOPS && parent !== null; hop++) {
+			if (chain.some((d) => d.id === parent)) break;
+			const meta = await this.metaOf(parent);
+			if (meta === null) break;
+			chain.push(meta);
+			parent = meta.parentDeviceId;
+		}
+		return chain;
+	}
+};
+//#endregion
+//#region src/connectivity.ts
+/** The one field read off the `device-status` slice (its wire output is
+*  untyped here). */
+var OnlineSchema$1 = object({ online: boolean() });
+async function readConnectivity(api, deviceId, logger) {
+	try {
+		const parsed = OnlineSchema$1.safeParse(await api.deviceStatus.getStatus.query({ deviceId }));
+		return parsed.success && !parsed.data.online ? "UNREACHABLE" : "OK";
+	} catch (err) {
+		logger.debug("alexa: device-status unreadable — reporting connectivity OK", {
+			tags: { deviceId },
+			meta: { error: errMsg(err) }
+		});
+		return "OK";
+	}
+}
+//#endregion
+//#region src/endpoints/validate-endpoint.ts
+/**
+* Interfaces this skill may declare, with the version Amazon documents. An
+* interface missing here is either not in Amazon's list (`BatteryLevelSensor`
+* never was) or deprecated (`MediaMetadata`, `EventDetectionSensor`).
+*/
+var ALLOWED_INTERFACE_VERSIONS = {
+	Alexa: "3",
+	"Alexa.CameraStreamController": "3",
+	"Alexa.RTCSessionController": "3",
+	"Alexa.DoorbellEventSource": "3",
+	"Alexa.MotionSensor": "3",
+	"Alexa.ContactSensor": "3",
+	"Alexa.TemperatureSensor": "3",
+	"Alexa.HumiditySensor": "3",
+	"Alexa.EndpointHealth": "3.1",
+	"Alexa.PowerController": "3",
+	"Alexa.BrightnessController": "3",
+	"Alexa.ModeController": "3",
+	"Alexa.ToggleController": "3",
+	"Alexa.RangeController": "3",
+	"Alexa.SecurityPanelController": "3",
+	"Alexa.LockController": "3",
+	"Alexa.SmartVision.SnapshotProvider": "1.1",
+	"Alexa.SmartVision.ObjectDetectionSensor": "1.0"
+};
+/** Interfaces that need an `instance`. */
+var INSTANCED = new Set([
+	"Alexa.ModeController",
+	"Alexa.ToggleController",
+	"Alexa.RangeController"
+]);
+/** Sensor interfaces Amazon requires to be paired with `Alexa.EndpointHealth`. */
+var NEEDS_ENDPOINT_HEALTH = new Set([
+	"Alexa.MotionSensor",
+	"Alexa.ContactSensor",
+	"Alexa.TemperatureSensor",
+	"Alexa.HumiditySensor",
+	"Alexa.LockController",
+	"Alexa.SmartVision.ObjectDetectionSensor"
+]);
+/** `displayCategories` values from alexa-discovery (the subset a camstack
+*  device can be). */
+var DISPLAY_CATEGORIES = new Set([
+	"CAMERA",
+	"DOORBELL",
+	"LIGHT",
+	"SWITCH",
+	"SMARTPLUG",
+	"SECURITY_PANEL",
+	"SECURITY_SYSTEM",
+	"MOTION_SENSOR",
+	"CONTACT_SENSOR",
+	"TEMPERATURE_SENSOR",
+	"SMARTLOCK",
+	"DOOR",
+	"GARAGE_DOOR",
+	"OTHER"
+]);
+var ENDPOINT_ID_PATTERN = /^[A-Za-z0-9 _\-=#;:?@&]{1,256}$/;
+var MAX_FRIENDLY_NAME = 256;
+var MAX_DESCRIPTION = 128;
+var MAX_MANUFACTURER = 128;
+var MAX_COOKIE_BYTES = 5e3;
+var MAX_CAPABILITIES = 100;
+var MIN_MODES = 2;
+function capabilityKey$1(c) {
+	return c.instance === void 0 ? c.interface : `${c.interface}#${c.instance}`;
+}
+function friendlyTexts(c) {
+	return (c.capabilityResources?.friendlyNames ?? []).map((n) => n.value.text);
+}
+function validateCapability(endpointId, c, out) {
+	const push = (rule) => {
+		out.push({
+			endpointId,
+			rule: `${capabilityKey$1(c)}: ${rule}`
+		});
+	};
+	if (c.type !== "AlexaInterface") push("type must be AlexaInterface");
+	const version = ALLOWED_INTERFACE_VERSIONS[c.interface];
+	if (version === void 0) {
+		push("interface is not in Amazon's interface list (or is deprecated)");
+		return;
+	}
+	if (c.version !== version) push(`version must be ${version}`);
+	if (INSTANCED.has(c.interface)) {
+		if (c.instance === void 0 || c.instance.length === 0) push("instance is required");
+		if (friendlyTexts(c).length === 0) push("capabilityResources.friendlyNames is required");
+	}
+	if (c.properties !== void 0) {
+		if (c.properties.supported.length === 0) push("properties.supported must not be empty");
+	}
+	if (c.interface === "Alexa.ModeController") {
+		const modes = c.configuration?.["supportedModes"];
+		if (!Array.isArray(modes) || modes.length < MIN_MODES) push(`at least ${MIN_MODES} supportedModes`);
+		else {
+			const values = modes.map((m) => typeof m === "object" && m !== null ? String(Reflect.get(m, "value")) : "");
+			if (new Set(values).size !== values.length) push("supportedModes values must be unique");
+		}
+	}
+	if (c.interface === "Alexa.SmartVision.SnapshotProvider") {
+		if (typeof c.configuration?.["isAvailable"] !== "boolean") push("configuration.isAvailable is required");
+	}
+}
+/** Every rule an endpoint breaks. Empty = Amazon should accept it. */
+function validateAlexaEndpoint(endpoint) {
+	const out = [];
+	const id = endpoint.endpointId;
+	const push = (rule) => {
+		out.push({
+			endpointId: id,
+			rule
+		});
+	};
+	if (!ENDPOINT_ID_PATTERN.test(id)) push("endpointId: 1-256 of [A-Za-z0-9 _-=#;:?@&]");
+	if (endpoint.friendlyName.trim().length === 0) push("friendlyName must not be empty");
+	if (endpoint.friendlyName.length > MAX_FRIENDLY_NAME) push("friendlyName longer than 256");
+	if (endpoint.description.length === 0 || endpoint.description.length > MAX_DESCRIPTION) push("description must be 1-128 characters");
+	if (endpoint.manufacturerName.length === 0 || endpoint.manufacturerName.length > MAX_MANUFACTURER) push("manufacturerName must be 1-128 characters");
+	if (endpoint.displayCategories.length === 0) push("displayCategories must not be empty");
+	for (const cat of endpoint.displayCategories) if (!DISPLAY_CATEGORIES.has(cat)) push(`displayCategory ${cat} is not an Amazon value`);
+	if (endpoint.cookie !== void 0) {
+		if (new TextEncoder().encode(JSON.stringify(endpoint.cookie)).length > MAX_COOKIE_BYTES) push("cookie larger than 5000 bytes");
+	}
+	const caps = endpoint.capabilities;
+	if (caps.length > MAX_CAPABILITIES) push("more than 100 capabilities");
+	if (!caps.some((c) => c.interface === "Alexa" && c.version === "3")) push("the base Alexa interface (version 3) is required");
+	const keys = caps.map(capabilityKey$1);
+	if (new Set(keys).size !== keys.length) push("a capability (interface + instance) is declared twice");
+	const interfaces = new Set(caps.map((c) => c.interface));
+	for (const needs of NEEDS_ENDPOINT_HEALTH) if (interfaces.has(needs) && !interfaces.has("Alexa.EndpointHealth")) push(`${needs} requires Alexa.EndpointHealth`);
+	if (interfaces.has("Alexa.RTCSessionController") && endpoint.displayCategories[0] !== "CAMERA") push("an RTCSessionController endpoint must list CAMERA first");
+	for (const c of caps) validateCapability(id, c, out);
+	return out;
+}
+/** Split endpoints into the valid ones and the violations of the rest. */
+function partitionValidEndpoints(endpoints) {
+	const valid = [];
+	const violations = [];
+	for (const e of endpoints) {
+		const found = validateAlexaEndpoint(e);
+		if (found.length === 0) valid.push(e);
+		else violations.push(...found);
+	}
+	return {
+		valid,
+		violations
+	};
+}
+/**
+* The runtime gate: keep the valid endpoints, and say out loud which ones were
+* withheld and why. Sending an invalid one risks Alexa rejecting the report —
+* and with it every valid endpoint beside it.
+*/
+function withholdInvalidEndpoints(endpoints, warn) {
+	const { valid, violations } = partitionValidEndpoints(endpoints);
+	if (violations.length > 0) warn("alexa: endpoints WITHHELD — they break an Amazon discovery rule and could make Alexa reject the whole report", violations);
+	return valid;
+}
+//#endregion
+//#region src/access/endpoint-access.ts
+/**
+* May `principal` reach `endpointId` at `access`? `access` defaults to the
+* endpoint's own discovery access (`view` for a camera, `create` for an
+* actuator-only endpoint).
+*/
+async function authorizeEndpoint(endpointId, principal, deps, access) {
+	const target = endpointAccessTarget(parseCameraEndpointId(endpointId));
+	if (target === null) return {
+		allowed: false,
+		refusal: { kind: "invalid-endpoint" }
+	};
+	if (!deps.isExposed(target.exposedDeviceId)) return {
+		allowed: false,
+		refusal: {
+			kind: "not-exposed",
+			deviceId: target.exposedDeviceId
+		}
+	};
+	if (target.requiresParent !== null) {
+		const parent = await deps.gate.parentOf(target.deviceId);
+		if (parent === void 0) return {
+			allowed: false,
+			refusal: {
+				kind: "device-unknown",
+				deviceId: target.deviceId
+			}
+		};
+		if (parent !== target.requiresParent) return {
+			allowed: false,
+			refusal: {
+				kind: "not-a-child",
+				deviceId: target.deviceId,
+				parentDeviceId: target.requiresParent
+			}
+		};
+	}
+	const needed = access ?? target.ownAccess;
+	const verdict = await deps.gate.allows(principal, target.deviceId, needed);
+	if (verdict === "allowed") return { allowed: true };
+	if (verdict === "unknown") return {
+		allowed: false,
+		refusal: {
+			kind: "device-unknown",
+			deviceId: target.deviceId
+		}
+	};
+	return {
+		allowed: false,
+		refusal: {
+			kind: "not-granted",
+			deviceId: target.deviceId,
+			access: needed
+		}
+	};
+}
+/**
+* Interfaces on a VIEWABLE endpoint that only actuate. A user who may see a
+* camera but not control it is shown the camera without them, so the Alexa app
+* never offers a PTZ dropdown whose every use would be refused.
+*/
+var CONTROL_ONLY_INTERFACES = new Set(["Alexa.ModeController", "Alexa.ToggleController"]);
+/** Strip what a view-only principal may not drive. Two-way audio is driving
+*  the camera's speaker, so it goes too. Returns a NEW endpoint. */
+function viewOnlyShape(endpoint) {
+	return {
+		...endpoint,
+		capabilities: endpoint.capabilities.filter((c) => !CONTROL_ONLY_INTERFACES.has(c.interface)).map((c) => c.interface === "Alexa.RTCSessionController" ? {
+			...c,
+			configuration: {
+				...c.configuration,
+				isFullDuplexAudioSupported: false
+			}
+		} : c)
+	};
+}
+/** Keep the endpoints `principal` may be shown, shaped to what it may drive.
+*  Order is preserved. */
+async function filterEndpointsForPrincipal(endpoints, principal, deps) {
+	const kept = [];
+	const refused = [];
+	for (const endpoint of endpoints) {
+		const verdict = await authorizeEndpoint(endpoint.endpointId, principal, deps);
+		if (!verdict.allowed) {
+			refused.push({
+				endpointId: endpoint.endpointId,
+				refusal: verdict.refusal
+			});
+			continue;
+		}
+		const target = endpointAccessTarget(parseCameraEndpointId(endpoint.endpointId));
+		if (principal.kind === "scoped" && target !== null && target.ownAccess === "view") {
+			const control = await deps.gate.allows(principal, target.deviceId, "create");
+			kept.push(control === "allowed" ? endpoint : viewOnlyShape(endpoint));
+			continue;
+		}
+		kept.push(endpoint);
+	}
+	return {
+		kept,
+		refused
+	};
+}
+/** The Alexa error type a refusal maps to. A device the user may not see does
+*  not exist for that user; one it may see but not control is a permission
+*  failure; a device the registry cannot read right now is unreachable. */
+function alexaErrorTypeFor(refusal) {
+	switch (refusal.kind) {
+		case "device-unknown": return "ENDPOINT_UNREACHABLE";
+		case "not-granted": return refusal.access === "view" ? "NO_SUCH_ENDPOINT" : "INVALID_DIRECTIVE";
+		case "invalid-endpoint":
+		case "not-exposed":
+		case "not-a-child": return "NO_SUCH_ENDPOINT";
+	}
+}
+function describeRefusal(refusal) {
+	switch (refusal.kind) {
+		case "invalid-endpoint": return "the endpoint id is not one this skill publishes";
+		case "not-exposed": return `device ${refusal.deviceId} is not exposed to Alexa`;
+		case "not-a-child": return `device ${refusal.deviceId} is not an accessory of ${refusal.parentDeviceId}`;
+		case "not-granted": return `the linked hub user has no ${refusal.access} grant on device ${refusal.deviceId}`;
+		case "device-unknown": return `device ${refusal.deviceId} could not be resolved in the registry`;
+	}
+}
 //#endregion
 //#region src/handlers/brightness-controller.ts
 var SetBrightnessDirectiveSchema = object({
@@ -50718,20 +51613,21 @@ async function handleSetBrightness(header, endpointRaw, payloadRaw, deps, _calle
 	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
 	const endpointId = parsed.data.endpoint.endpointId;
 	const parsedId = parseCameraEndpointId(endpointId);
-	if (parsedId.kind === "autotrack" || parsedId.kind === "privacy" || parsedId.kind === "alarm-panel") return errorEnvelope(header, "INVALID_DIRECTIVE", `BrightnessController is not exposed on the ${parsedId.kind} endpoint`);
+	if (parsedId.kind === "autotrack" || parsedId.kind === "privacy" || parsedId.kind === "alarm-panel" || parsedId.kind === "detection") return errorEnvelope(header, "INVALID_DIRECTIVE", `BrightnessController is not exposed on the ${parsedId.kind} endpoint`);
 	if (parsedId.kind === "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", "BrightnessController is not exposed on camera endpoints — direct the directive at the dimmable child accessory");
 	if (parsedId.kind === "invalid") return errorEnvelope(header, "INVALID_DIRECTIVE", parsedId.reason);
 	const percentage = parsed.data.payload.brightness;
 	const api = deps.ctx.api;
+	const targetDeviceId = parsedId.kind === "child" ? parsedId.childDeviceId : parsedId.deviceId;
 	try {
 		await api.brightness.setBrightness.mutate({
-			deviceId: parsedId.childDeviceId,
+			deviceId: targetDeviceId,
 			percentage
 		});
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
 		deps.logger.warn("alexa brightness-controller: setBrightness failed", { meta: {
-			deviceId: parsedId.childDeviceId,
+			deviceId: targetDeviceId,
 			percentage,
 			error: message
 		} });
@@ -50841,6 +51737,66 @@ async function handleInitializeCameraStreams(header, endpointRaw, payloadRaw, de
 	} };
 }
 //#endregion
+//#region src/handlers/lock-controller.ts
+/** The `lock-control` state as Alexa's `lockState`. */
+function alexaLockStateFor(state) {
+	switch (state) {
+		case "locked":
+		case "locking": return "LOCKED";
+		case "unlocked":
+		case "unlocking": return "UNLOCKED";
+		case "jammed": return "JAMMED";
+	}
+}
+async function readLockState(api, deviceId) {
+	const raw = await api.lockControl.getStatus.query({ deviceId });
+	const parsed = LockControlStatusSchema.pick({ state: true }).safeParse(raw);
+	return parsed.success ? alexaLockStateFor(parsed.data.state) : null;
+}
+async function handleLock(header, endpoint, deps) {
+	if (endpoint === void 0) return errorEnvelope(header, "INVALID_DIRECTIVE", "missing endpoint");
+	const parsed = parseCameraEndpointId(endpoint.endpointId);
+	if (parsed.kind !== "generic") return errorEnvelope(header, "INVALID_DIRECTIVE", "LockController is only on a lock endpoint");
+	const lock = header.name === "Lock";
+	const api = deps.ctx.api;
+	try {
+		if (lock) await api.lockControl.lock.mutate({ deviceId: parsed.deviceId });
+		else await api.lockControl.unlock.mutate({ deviceId: parsed.deviceId });
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		deps.logger.warn(`alexa lock-controller: ${header.name} failed`, {
+			tags: { deviceId: parsed.deviceId },
+			meta: { error: message }
+		});
+		return errorEnvelope(header, "ENDPOINT_UNREACHABLE", `${header.name} failed: ${message}`);
+	}
+	const state = await readLockState(api, parsed.deviceId).catch(() => null) ?? (lock ? "LOCKED" : "UNLOCKED");
+	deps.logger.info(`alexa lock-controller: ${header.name}`, {
+		tags: { deviceId: parsed.deviceId },
+		meta: { lockState: state }
+	});
+	return {
+		event: {
+			header: {
+				namespace: "Alexa",
+				name: "Response",
+				messageId: header.messageId,
+				...header.correlationToken !== void 0 ? { correlationToken: header.correlationToken } : {},
+				payloadVersion: "3"
+			},
+			endpoint: { endpointId: endpoint.endpointId },
+			payload: {}
+		},
+		context: { properties: [{
+			namespace: "Alexa.LockController",
+			name: "lockState",
+			value: state,
+			timeOfSample: (/* @__PURE__ */ new Date()).toISOString(),
+			uncertaintyInMilliseconds: 500
+		}] }
+	};
+}
+//#endregion
 //#region src/handlers/power-controller.ts
 var PowerDirectiveSchema = object({
 	header: object({
@@ -50876,6 +51832,11 @@ async function handlePower(header, endpointRaw, deps, _callerIdentity) {
 	});
 	else if (parsedId.kind === "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", "PowerController is not exposed on camera endpoints — direct the directive at the child accessory");
 	else if (parsedId.kind === "alarm-panel") return errorEnvelope(header, "INVALID_DIRECTIVE", "PowerController is not exposed on alarm-panel endpoints — use Alexa.SecurityPanelController");
+	else if (parsedId.kind === "generic") await api.switch.setState.mutate({
+		deviceId: parsedId.deviceId,
+		on
+	});
+	else if (parsedId.kind === "detection") return errorEnvelope(header, "INVALID_DIRECTIVE", "PowerController is not exposed on a detection sensor — it only reports");
 	else return errorEnvelope(header, "INVALID_DIRECTIVE", parsedId.reason);
 	return {
 		event: {
@@ -51107,6 +52068,236 @@ function modeSuccessResponse(header, endpointId, instance, mode) {
 		}] }
 	};
 }
+var JPEG_QUALITY = 72;
+var RESIZE_TIMEOUT_MS = 4e3;
+/** Re-encode a camera frame for Alexa. Rejects (never falls back to the
+*  original) on failure or timeout. */
+async function toAlexaJpeg(source) {
+	const work = (async () => {
+		const meta = await sharp(source).metadata();
+		const width = meta.width;
+		const height = meta.height;
+		if (width === void 0 || height === void 0 || width === 0 || height === 0) throw new Error("snapshot has no readable dimensions");
+		const short = Math.min(width, height);
+		const targetShort = short < 360 ? 360 : Math.min(short, 480);
+		const resize = width <= height ? { width: targetShort } : { height: targetShort };
+		const { data, info } = await sharp(source).rotate().resize(resize).jpeg({
+			quality: JPEG_QUALITY,
+			mozjpeg: false
+		}).toBuffer({ resolveWithObject: true });
+		return {
+			bytes: data,
+			width: info.width,
+			height: info.height
+		};
+	})();
+	let timer;
+	const timeout = new Promise((_, reject) => {
+		timer = setTimeout(() => reject(/* @__PURE__ */ new Error("snapshot re-encode timed out")), RESIZE_TIMEOUT_MS);
+	});
+	try {
+		return await Promise.race([work, timeout]);
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
+	}
+}
+//#endregion
+//#region src/handlers/snapshot-provider.ts
+/** Leaves the rest of Amazon's 8 s for the re-encode and the Lambda hop. */
+var SNAPSHOT_READ_TIMEOUT_MS = 5e3;
+var SnapshotImageSchema = object({
+	base64: string().min(1),
+	contentType: string()
+});
+function snapshotError(header, type, message) {
+	return { event: {
+		header: {
+			namespace: "Alexa.SmartVision.SnapshotProvider",
+			name: "ErrorResponse",
+			messageId: header.messageId,
+			...header.correlationToken !== void 0 ? { correlationToken: header.correlationToken } : {},
+			payloadVersion: "1.1"
+		},
+		payload: {
+			type,
+			message
+		}
+	} };
+}
+async function readFrame(ctx, deviceId) {
+	let timer;
+	const timeout = new Promise((resolve) => {
+		timer = setTimeout(() => resolve(null), SNAPSHOT_READ_TIMEOUT_MS);
+	});
+	try {
+		const raw = await Promise.race([ctx.api.snapshot.getSnapshot.query({ deviceId }), timeout]);
+		const parsed = SnapshotImageSchema.safeParse(raw);
+		return parsed.success ? Buffer.from(parsed.data.base64, "base64") : null;
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
+	}
+}
+async function handleGetSnapshot(header, endpoint, deps, caller) {
+	if (endpoint === void 0) return errorEnvelope(header, "INVALID_DIRECTIVE", "missing endpoint");
+	if (!deps.enabled()) return snapshotError(header, "DISABLED_BY_USER", "snapshots are switched off on this hub");
+	const parsed = parseCameraEndpointId(endpoint.endpointId);
+	if (parsed.kind !== "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", "snapshots are served for camera endpoints");
+	const deviceId = parsed.deviceId;
+	const base = deps.publicHubUrl().replace(/\/+$/, "");
+	if (!base.startsWith("https://")) {
+		deps.logger.warn("alexa snapshot: no public HTTPS address — Alexa cannot fetch an image", { tags: { deviceId } });
+		return errorEnvelope(header, "INTERNAL_ERROR", "the hub has no public HTTPS address");
+	}
+	const started = deps.now?.() ?? Date.now();
+	const frame = await readFrame(deps.ctx, deviceId).catch((err) => {
+		deps.logger.warn("alexa snapshot: snapshot read failed", {
+			tags: { deviceId },
+			meta: { error: err instanceof Error ? err.message : String(err) }
+		});
+		return null;
+	});
+	if (frame === null) return errorEnvelope(header, "ENDPOINT_UNREACHABLE", `no snapshot from device ${deviceId}`);
+	let jpeg;
+	try {
+		jpeg = await (deps.encode ?? toAlexaJpeg)(frame);
+	} catch (err) {
+		deps.logger.warn("alexa snapshot: re-encode failed — not sending the original frame", {
+			tags: { deviceId },
+			meta: { error: err instanceof Error ? err.message : String(err) }
+		});
+		return errorEnvelope(header, "INTERNAL_ERROR", "snapshot could not be prepared");
+	}
+	const now = deps.now?.() ?? Date.now();
+	const minted = deps.store.mint({
+		deviceId,
+		userId: caller.userId,
+		bytes: jpeg.bytes,
+		capturedAt: now
+	});
+	deps.logger.info("alexa snapshot: served", {
+		tags: { deviceId },
+		meta: {
+			userId: caller.userId,
+			bytes: jpeg.bytes.length,
+			width: jpeg.width,
+			height: jpeg.height,
+			tookMs: now - started
+		}
+	});
+	return { event: {
+		header: {
+			namespace: "Alexa.SmartVision.SnapshotProvider",
+			name: "Snapshot",
+			messageId: header.messageId,
+			...header.correlationToken !== void 0 ? { correlationToken: header.correlationToken } : {},
+			payloadVersion: "1.1"
+		},
+		endpoint: { endpointId: endpoint.endpointId },
+		payload: {
+			value: {
+				uri: `${base}${minted.path}`,
+				uriExpirationTime: new Date(minted.expiresAt).toISOString(),
+				authenticationType: "ACCESS_TOKEN"
+			},
+			timeOfSample: new Date(now).toISOString(),
+			uncertaintyInMilliseconds: 1e4
+		}
+	} };
+}
+//#endregion
+//#region src/handlers/generic-state.ts
+/**
+* A generic device's Alexa properties from its cap slices (R5, D775) — ONE
+* mapping shared by `Alexa/ReportState` (reading each cap's status) and the
+* proactive reports (`DeviceStateChanged` slices), so the two can never answer
+* differently for the same state.
+*/
+/** The caps a generic endpoint reads, in the order ReportState asks them. */
+var GENERIC_STATE_CAPS = [
+	"lock-control",
+	"contact",
+	"motion",
+	"presence",
+	"temperature-sensor",
+	"humidity-sensor",
+	"switch",
+	"brightness"
+];
+var detection = (detected) => ({
+	namespace: "",
+	name: "detectionState",
+	value: detected ? "DETECTED" : "NOT_DETECTED"
+});
+/** The Alexa property one cap slice sets, or null (unknown cap, bad slice). */
+function genericPropertyFor(capName, slice) {
+	switch (capName) {
+		case "lock-control": {
+			const p = LockControlStatusSchema.pick({ state: true }).safeParse(slice);
+			return p.success ? {
+				namespace: "Alexa.LockController",
+				name: "lockState",
+				value: alexaLockStateFor(p.data.state)
+			} : null;
+		}
+		case "contact": {
+			const p = ContactStatusSchema.pick({ entryOpen: true }).safeParse(slice);
+			return p.success ? {
+				...detection(p.data.entryOpen),
+				namespace: "Alexa.ContactSensor"
+			} : null;
+		}
+		case "motion": {
+			const p = MotionStatusSchema.pick({ detected: true }).safeParse(slice);
+			return p.success ? {
+				...detection(p.data.detected),
+				namespace: "Alexa.MotionSensor"
+			} : null;
+		}
+		case "presence": {
+			const p = PresenceStatusSchema.pick({ state: true }).safeParse(slice);
+			return p.success ? {
+				...detection(p.data.state === "home"),
+				namespace: "Alexa.MotionSensor"
+			} : null;
+		}
+		case "temperature-sensor": {
+			const p = TemperatureSensorStatusSchema.pick({ celsius: true }).safeParse(slice);
+			return p.success ? {
+				namespace: "Alexa.TemperatureSensor",
+				name: "temperature",
+				value: {
+					value: Math.round(p.data.celsius * 10) / 10,
+					scale: "CELSIUS"
+				}
+			} : null;
+		}
+		case "humidity-sensor": {
+			const p = HumiditySensorStatusSchema.pick({ percent: true }).safeParse(slice);
+			return p.success ? {
+				namespace: "Alexa.HumiditySensor",
+				name: "relativeHumidity",
+				value: { value: Math.max(0, Math.min(100, p.data.percent)) }
+			} : null;
+		}
+		case "switch": {
+			const p = SwitchStatusSchema.pick({ on: true }).safeParse(slice);
+			return p.success ? {
+				namespace: "Alexa.PowerController",
+				name: "powerState",
+				value: p.data.on ? "ON" : "OFF"
+			} : null;
+		}
+		case "brightness": {
+			const p = BrightnessStatusSchema.pick({ percentage: true }).safeParse(slice);
+			return p.success ? {
+				namespace: "Alexa.BrightnessController",
+				name: "brightness",
+				value: Math.max(0, Math.min(100, Math.round(p.data.percentage)))
+			} : null;
+		}
+		default: return null;
+	}
+}
 //#endregion
 //#region src/handlers/report-state.ts
 async function handleReportState(header, endpointRaw, deps, _callerIdentity) {
@@ -51123,6 +52314,23 @@ async function handleReportState(header, endpointRaw, deps, _callerIdentity) {
 		else if (parsed.kind === "autotrack") await collectAutotrackProperties(api, parsed.parentDeviceId, properties, nowIso, deps.logger);
 		else if (parsed.kind === "child") await collectChildProperties(api, parsed.childDeviceId, properties, nowIso, deps.logger);
 		else if (parsed.kind === "alarm-panel") await collectAlarmPanelProperties(api, parsed.deviceId, properties, nowIso, deps.logger);
+		else if (parsed.kind === "generic") await collectGenericProperties(api, parsed.deviceId, properties, nowIso, deps.logger);
+		else if (parsed.kind === "detection") {
+			properties.push({
+				namespace: "Alexa.MotionSensor",
+				name: "detectionState",
+				value: deps.detectionPresent?.(parsed.deviceId, parsed.detectionClass) ? "DETECTED" : "NOT_DETECTED",
+				timeOfSample: nowIso,
+				uncertaintyInMilliseconds: 0
+			});
+			properties.push({
+				namespace: "Alexa.EndpointHealth",
+				name: "connectivity",
+				value: { value: await readConnectivity(api, parsed.deviceId, deps.logger) },
+				timeOfSample: nowIso,
+				uncertaintyInMilliseconds: 0
+			});
+		}
 	} catch (err) {
 		deps.logger.warn("alexa report-state: collection failed", { meta: {
 			endpointId,
@@ -51144,6 +52352,39 @@ async function handleReportState(header, endpointRaw, deps, _callerIdentity) {
 		context: { properties }
 	};
 }
+/**
+* A generic device (R5): every cap it has, read through its status, mapped by
+* the same function the proactive reports use. A cap the device does not have
+* fails its read and contributes nothing; connectivity is always answered.
+*/
+async function collectGenericProperties(api, deviceId, properties, timeOfSample, logger) {
+	const reads = await Promise.all(GENERIC_STATE_CAPS.map(async (capName) => {
+		const status = await api.deviceState.getCapSlice.query({
+			deviceId,
+			capName
+		}).catch(() => null);
+		return status === null ? null : genericPropertyFor(capName, status);
+	}));
+	const seen = /* @__PURE__ */ new Set();
+	for (const p of reads) {
+		if (p === null) continue;
+		const key = `${p.namespace}.${p.name}`;
+		if (seen.has(key)) continue;
+		seen.add(key);
+		properties.push({
+			...p,
+			timeOfSample,
+			uncertaintyInMilliseconds: 0
+		});
+	}
+	properties.push({
+		namespace: "Alexa.EndpointHealth",
+		name: "connectivity",
+		value: { value: await readConnectivity(api, deviceId, logger) },
+		timeOfSample,
+		uncertaintyInMilliseconds: 0
+	});
+}
 function numberField(value, key) {
 	if (typeof value !== "object" || value === null) return null;
 	const raw = value[key];
@@ -51155,17 +52396,10 @@ function boolField(value, key) {
 	return typeof raw === "boolean" ? raw : null;
 }
 async function collectCameraProperties(api, deviceId, properties, timeOfSample, logger) {
-	const percentage = numberField(await api.battery.getStatus.query({ deviceId }).catch((err) => {
-		logger.info("alexa report-state: battery.getStatus skipped", { meta: {
-			deviceId,
-			error: err instanceof Error ? err.message : String(err)
-		} });
-		return null;
-	}), "percentage");
-	if (percentage !== null) properties.push({
-		namespace: "Alexa.BatteryLevelSensor",
-		name: "batteryLevel",
-		value: Math.max(0, Math.min(100, Math.round(percentage))),
+	properties.push({
+		namespace: "Alexa.EndpointHealth",
+		name: "connectivity",
+		value: { value: await readConnectivity(api, deviceId, logger) },
 		timeOfSample,
 		uncertaintyInMilliseconds: 0
 	});
@@ -51552,6 +52786,35 @@ function requireDeviceScope(scopes, access) {
 	if (!scopesAllowDeviceCap(scopes, access)) throw new Error(`directive token not authorized for device ${access}`);
 }
 /**
+* Directives that are never refused by the access gate. `SessionDisconnected`
+* only tears down a session that already exists (and releases its transcode);
+* refusing it because the user lost access in the meantime would leak the
+* egress the reaper then has to find.
+*/
+var ACCESS_EXEMPT = new Set(["Alexa.RTCSessionController/SessionDisconnected"]);
+/**
+* Directives that need the device itself to answer. On a device the registry
+* reports OFFLINE they are refused with `ENDPOINT_UNREACHABLE` at once, rather
+* than spending Alexa's few-second budget on a transcode or a command that
+* cannot land (runbook C.2-b). `Alexa/ReportState` is NOT here: an offline
+* endpoint still answers, with `connectivity: UNREACHABLE` and the last known
+* values (alexa-endpointhealth). A status read that fails does not refuse.
+*/
+var NEEDS_REACHABLE_DEVICE = new Set([
+	"Alexa.CameraStreamController/InitializeCameraStreams",
+	"Alexa.RTCSessionController/InitiateSessionWithOffer",
+	"Alexa.PowerController/TurnOn",
+	"Alexa.PowerController/TurnOff",
+	"Alexa.BrightnessController/SetBrightness",
+	"Alexa.ModeController/SetMode",
+	"Alexa.ToggleController/TurnOn",
+	"Alexa.ToggleController/TurnOff",
+	"Alexa.SecurityPanelController/Arm",
+	"Alexa.SecurityPanelController/Disarm",
+	"Alexa.LockController/Lock",
+	"Alexa.LockController/Unlock"
+]);
+/**
 * Give an `Alexa.ErrorResponse` the directive's endpoint when it lacks one.
 * Amazon requires `endpoint` on every ErrorResponse to an endpoint directive
 * (alexa-errorresponse); the handlers build their errors from the header
@@ -51573,6 +52836,18 @@ function withErrorEndpoint(body, endpoint) {
 		}
 	};
 }
+/** The device whose online state decides whether an endpoint is reachable:
+*  the device the directive actuates (an accessory for a child endpoint). */
+function reachabilityDeviceOf(endpointId) {
+	const target = endpointAccessTarget(parseCameraEndpointId(endpointId));
+	return target === null ? null : target.deviceId;
+}
+/** Whether the principal may CONTROL the device an endpoint addresses — the
+*  talk-back gate (D771). */
+async function mayControlEndpoint(endpointId, principal, access) {
+	if (endpointId === void 0 || principal === null) return false;
+	return (await authorizeEndpoint(endpointId, principal, access, "create")).allowed;
+}
 async function dispatchDirective(rawBody, deps, callerIdentity) {
 	const result = await dispatchParsedDirective(rawBody, deps, callerIdentity);
 	const endpoint = rawBody?.directive?.endpoint;
@@ -51613,7 +52888,10 @@ async function dispatchParsedDirective(rawBody, deps, callerIdentity) {
 		"Alexa.ToggleController/TurnOff": "create",
 		"Alexa/ReportState": "view",
 		"Alexa.SecurityPanelController/Arm": "create",
-		"Alexa.SecurityPanelController/Disarm": "create"
+		"Alexa.SecurityPanelController/Disarm": "create",
+		"Alexa.SmartVision.SnapshotProvider/GetSnapshot": "view",
+		"Alexa.LockController/Lock": "create",
+		"Alexa.LockController/Unlock": "create"
 	};
 	try {
 		const key = `${header.namespace}/${header.name}`;
@@ -51626,17 +52904,95 @@ async function dispatchParsedDirective(rawBody, deps, callerIdentity) {
 				body: errorEnvelope(header, "INVALID_AUTHORIZATION_CREDENTIAL", scopeErr instanceof Error ? scopeErr.message : String(scopeErr))
 			};
 		}
-		if (key === "Alexa.Discovery/Discover") return {
-			status: 200,
-			body: await handleDiscovery(header, payload, deps.discovery, callerIdentity)
-		};
+		let principal = null;
+		if (!ACCESS_EXEMPT.has(key)) {
+			const lookup = await deps.access.gate.principal(callerIdentity.userId);
+			if (lookup.kind === "unknown-user") {
+				deps.discovery.logger.warn("alexa directive: refused — the hub user who linked this Alexa account no longer exists", { meta: {
+					userId: callerIdentity.userId,
+					directive: key
+				} });
+				return {
+					status: 200,
+					body: errorEnvelope(header, "INVALID_AUTHORIZATION_CREDENTIAL", "the hub user behind this account link no longer exists")
+				};
+			}
+			if (lookup.kind === "unavailable") return {
+				status: 200,
+				body: errorEnvelope(header, "INTERNAL_ERROR", lookup.error)
+			};
+			principal = lookup.principal;
+			if (key !== "Alexa.Discovery/Discover") {
+				if (endpoint === void 0) return {
+					status: 200,
+					body: errorEnvelope(header, "INVALID_DIRECTIVE", "missing directive.endpoint")
+				};
+				const verdict = await authorizeEndpoint(endpoint.endpointId, principal, deps.access, requiredAccess);
+				if (!verdict.allowed) {
+					deps.discovery.logger.info("alexa directive: refused by the user access gate", { meta: {
+						userId: callerIdentity.userId,
+						directive: key,
+						endpointId: endpoint.endpointId,
+						reason: describeRefusal(verdict.refusal)
+					} });
+					return {
+						status: 200,
+						body: errorEnvelope(header, alexaErrorTypeFor(verdict.refusal), describeRefusal(verdict.refusal))
+					};
+				}
+				if (NEEDS_REACHABLE_DEVICE.has(key)) {
+					const deviceId = reachabilityDeviceOf(endpoint.endpointId);
+					if (deviceId !== null && await readConnectivity(deps.reportState.ctx.api, deviceId, deps.reportState.logger) === "UNREACHABLE") {
+						deps.reportState.logger.info("alexa directive: refused — the device is offline", {
+							tags: { deviceId },
+							meta: {
+								directive: key,
+								endpointId: endpoint.endpointId
+							}
+						});
+						return {
+							status: 200,
+							body: errorEnvelope(header, "ENDPOINT_UNREACHABLE", `device ${deviceId} is offline`)
+						};
+					}
+				}
+			}
+		}
+		if (key === "Alexa.Discovery/Discover") {
+			if (principal === null) throw new Error("discovery reached without a principal");
+			const who = principal;
+			return {
+				status: 200,
+				body: await handleDiscovery(header, payload, deps.discovery, callerIdentity, {
+					deviceVisible: async (deviceId) => deps.access.isExposed(deviceId) && await deps.access.gate.allows(who, deviceId, "view") === "allowed",
+					filterEndpoints: async (endpoints) => {
+						const filtered = await filterEndpointsForPrincipal(endpoints, who, deps.access);
+						if (filtered.refused.length > 0) deps.discovery.logger.info("alexa discovery: endpoints withheld from this link", { meta: {
+							userId: callerIdentity.userId,
+							withheld: filtered.refused.map((r) => ({
+								endpointId: r.endpointId,
+								reason: describeRefusal(r.refusal)
+							}))
+						} });
+						const valid = withholdInvalidEndpoints(filtered.kept, (message, violations) => {
+							deps.discovery.logger.warn(message, { meta: {
+								userId: callerIdentity.userId,
+								violations
+							} });
+						});
+						deps.afterDiscovery(callerIdentity.userId, valid);
+						return valid;
+					}
+				})
+			};
+		}
 		if (key === "Alexa.CameraStreamController/InitializeCameraStreams") return {
 			status: 200,
 			body: await handleInitializeCameraStreams(header, endpoint, payload, deps.cameraStream, callerIdentity)
 		};
 		if (key === "Alexa.RTCSessionController/InitiateSessionWithOffer") return {
 			status: 200,
-			body: await handleInitiateSessionWithOffer(header, endpoint, payload, deps.rtcSession, callerIdentity)
+			body: await handleInitiateSessionWithOffer(header, endpoint, payload, deps.rtcSession, callerIdentity, { mayTalk: await mayControlEndpoint(endpoint?.endpointId, principal, deps.access) })
 		};
 		if (key === "Alexa.RTCSessionController/SessionConnected") return {
 			status: 200,
@@ -51670,6 +53026,14 @@ async function dispatchParsedDirective(rawBody, deps, callerIdentity) {
 			status: 200,
 			body: await handleDisarm(header, endpoint, payload, deps.securityPanel, callerIdentity)
 		};
+		if (key === "Alexa.LockController/Lock" || key === "Alexa.LockController/Unlock") return {
+			status: 200,
+			body: await handleLock(header, endpoint, deps.lockController)
+		};
+		if (key === "Alexa.SmartVision.SnapshotProvider/GetSnapshot") return {
+			status: 200,
+			body: await handleGetSnapshot(header, endpoint, deps.snapshotProvider, callerIdentity)
+		};
 		if (key === "Alexa/ReportState") return {
 			status: 200,
 			body: await handleReportState(header, endpoint, deps.reportState, callerIdentity)
@@ -51903,6 +53267,81 @@ function verifyIngressToken(expected, provided) {
 function readIngressHeader(headers) {
 	for (const [key, value] of Object.entries(headers)) if (key.toLowerCase() === "x-camstack-ingress") return value;
 }
+/** Characters of a secret a mask may keep, so an operator can tell two apart. */
+var MASK_TAIL = 4;
+/**
+* A secret as a READ surface may show it: a fixed run of dots and, for a value
+* long enough that four characters do not meaningfully shorten a guess, its
+* last four. Every read of this addon's status goes through this (S2) — the
+* value itself is handed out only by the admin-only `revealIngressToken`.
+*/
+function maskSecretTail(secret) {
+	if (secret.length === 0) return "";
+	if (secret.length <= MASK_TAIL * 4) return "••••";
+	return `••••••••${secret.slice(-4)}`;
+}
+//#endregion
+//#region src/snapshots/snapshot-route.ts
+var IMAGE_FILE = /^([0-9a-f-]{36})\.jpg$/;
+function bearerOf(headers) {
+	for (const [key, value] of Object.entries(headers)) {
+		if (key.toLowerCase() !== "authorization") continue;
+		return /^Bearer\s+(.+)$/i.exec(value.trim())?.[1] ?? null;
+	}
+	return null;
+}
+function refuse(reply, status, error) {
+	reply.code(status).type("application/json").header("cache-control", "no-store").header("content-encoding", "identity");
+	reply.send({ error });
+}
+async function handleSnapshotFetch(req, reply, deps) {
+	if (!deps.enabled()) {
+		refuse(reply, 410, "snapshots are switched off");
+		return;
+	}
+	const imageId = IMAGE_FILE.exec(req.params["file"] ?? "")?.[1];
+	if (imageId === void 0) {
+		refuse(reply, 410, "not a snapshot address");
+		return;
+	}
+	const found = deps.store.lookup(imageId, req.query["exp"], req.query["sig"]);
+	if (found.kind === "gone") {
+		deps.logger.debug("alexa snapshot: fetch of a gone image", { meta: {
+			imageId,
+			reason: found.reason
+		} });
+		refuse(reply, 410, found.reason);
+		return;
+	}
+	const image = found.image;
+	const token = bearerOf(req.headers);
+	const verified = token === null ? null : await deps.verifyToken(token).catch(() => null);
+	if (verified === null) {
+		deps.logger.warn("alexa snapshot: refused a fetch without a valid account-link token", {
+			tags: { deviceId: image.deviceId },
+			meta: {
+				imageId,
+				hadToken: token !== null
+			}
+		});
+		refuse(reply, 401, "a valid Alexa account-link token is required");
+		return;
+	}
+	if (verified.userId !== image.userId || !await deps.mayView(verified.userId, image.deviceId)) {
+		deps.logger.warn("alexa snapshot: refused — the token does not belong to the user this image was made for, or that user lost the camera", {
+			tags: { deviceId: image.deviceId },
+			meta: {
+				imageId,
+				tokenUser: verified.userId,
+				imageUser: image.userId
+			}
+		});
+		refuse(reply, 403, "not allowed");
+		return;
+	}
+	reply.code(200).type(image.contentType).header("cache-control", "private, no-store").header("content-encoding", "identity").header("content-length", String(image.bytes.byteLength));
+	reply.send(image.bytes);
+}
 //#endregion
 //#region src/http-server.ts
 /**
@@ -51955,6 +53394,13 @@ function buildRoutes(deps) {
 				await handleLwaTokensCallback(req, reply, deps.lwaTokensCallbackDeps);
 			}
 		},
+		{
+			method: "GET",
+			path: "/snapshot/:file",
+			access: "public",
+			description: "Alexa SnapshotProvider image (signed, 10 min, account-link token required)",
+			handler: (req, reply) => handleSnapshotFetch(req, reply, deps.snapshotRoute)
+		},
 		{
 			method: "POST",
 			path: "/admin/redetect-hub-url",
@@ -52137,6 +53583,46 @@ function describeGrant(acc, input) {
 	return `Amazon push grant: held via the skill's token broker, valid for another ${minutes(token.expiresAt - input.now)} min (last renewed ${renewedAgo} min ago).`;
 }
 //#endregion
+//#region src/endpoint-signature.ts
+/**
+* One capability's identity as Alexa distinguishes it. A capability whose
+* properties are proactively reported carries a `!p` mark: Alexa's copy must
+* know the hub reports them, or the ChangeReports are worth nothing (R3) —
+* so flipping the flag is a shape change the reconcile re-pushes.
+*/
+function capabilityKey(capability) {
+	const instance = typeof capability.instance === "string" ? capability.instance : "";
+	const base = instance.length > 0 ? `${capability.interface}#${instance}` : capability.interface;
+	return capability.properties?.proactivelyReported === true ? `${base}!p` : base;
+}
+/** Read back the endpoints (and their interfaces) a signature records — what
+*  Alexa was last told about a device. */
+function signatureEntries(signature) {
+	if (signature.length === 0) return [];
+	return signature.split(";").map((entry) => {
+		const [endpointId = "", , interfaces = ""] = entry.split("|");
+		return {
+			endpointId,
+			interfaces: interfaces.split(",").filter((i) => i.length > 0).map((i) => i.replace(/!p$/, "").replace(/#.*$/, ""))
+		};
+	});
+}
+/** Stable, order-independent signature of ONE endpoint's advertised shape. */
+function endpointKey(endpoint) {
+	const interfaces = endpoint.capabilities.map(capabilityKey).sort().join(",");
+	const categories = [...endpoint.displayCategories].sort().join(",");
+	return `${endpoint.endpointId}|${categories}|${interfaces}`;
+}
+/**
+* Stable signature of the endpoint set built for ONE device. Two builds that
+* would land identically in Alexa's registry produce the same string; any
+* added, removed or renamed interface — or a changed display category —
+* produces a different one.
+*/
+function endpointsSignature(endpoints) {
+	return endpoints.map(endpointKey).sort().join(";");
+}
+//#endregion
 //#region src/motion-clear-hold.ts
 /**
 * Default hold. Matches `RESET_DEBOUNCE_MS` in
@@ -52271,6 +53757,24 @@ var MIGRATION_RETRY_MS = 300 * 1e3;
 /** The interface a camera endpoint must declare for a connectivity
 *  ChangeReport to mean anything to the Alexa cloud. */
 var ENDPOINT_HEALTH_INTERFACE = "Alexa.EndpointHealth";
+/** Whether an exported signature (`endpoint-signature.ts`) names this
+*  endpoint id. */
+function signatureNamesEndpoint(signature, endpointId) {
+	return signature.split(";").some((entry) => entry.startsWith(`${endpointId}|`));
+}
+/** How long after a push the initial connectivity reports go out — the
+*  AddOrUpdateReport is accepted asynchronously, and a ChangeReport for an
+*  endpoint the cloud has not created yet is dropped. */
+var INITIAL_CONNECTIVITY_DELAY_MS = 5e3;
+/**
+* The device whose online state an endpoint's connectivity reports: the
+* exposed device the endpoint is published under (a camera's own id, a
+* detection sensor's camera, a generic device's id).
+*/
+function connectivityDeviceOf(endpointId) {
+	const target = endpointAccessTarget(parseCameraEndpointId(endpointId));
+	return target === null ? null : target.exposedDeviceId;
+}
 /** The interface an endpoint must advertise for a `DoorbellPress` to survive
 *  the Alexa cloud. */
 var DOORBELL_INTERFACE = "Alexa.DoorbellEventSource";
@@ -52301,11 +53805,12 @@ var LwaEventGateway = class {
 	deps;
 	unsubscribe = null;
 	unsubscribeMotion = null;
-	unsubscribeBattery = null;
 	unsubscribeConnectivity = [];
 	/** Last connectivity reported per `userId|endpointId` — a camera that
 	*  re-announces the same state must not become a ChangeReport stream. */
 	lastConnectivity = /* @__PURE__ */ new Map();
+	/** Initial-connectivity reports waiting for the cloud to create endpoints. */
+	pendingInitialReports = /* @__PURE__ */ new Set();
 	refreshTimer = null;
 	lastSentAt = /* @__PURE__ */ new Map();
 	/**
@@ -52319,11 +53824,6 @@ var LwaEventGateway = class {
 	/** Per-endpoint count of `ObjectDetection` events dropped because the
 	*  endpoint does not declare {@link SMART_VISION_INTERFACE}. */
 	smartVisionDropped = /* @__PURE__ */ new Map();
-	/** Last reported integer battery percentage per `userId|endpointId` —
-	*  battery providers may push the same level every poll cycle and
-	*  Alexa Smart Home rate-limits ChangeReports per property; dedupe
-	*  so only level *changes* (or step-grain ones) hit the gateway. */
-	lastBatteryLevel = /* @__PURE__ */ new Map();
 	/** Latches the "no grant at all" warning so it's logged ONCE, not on every
 	*  doorbell/motion event while no account has a push grant. */
 	warnedNoGrant = false;
@@ -52349,11 +53849,6 @@ var LwaEventGateway = class {
 				this.deps.logger.warn("alexa lwa-gateway: motion handler crashed", { meta: { error: err instanceof Error ? err.message : String(err) } });
 			});
 		});
-		this.unsubscribeBattery = this.deps.ctx.eventBus.subscribe({ category: EventCategory.BatteryOnStatusChanged }, (event) => {
-			this.onBatteryStatusChanged(event.data).catch((err) => {
-				this.deps.logger.warn("alexa lwa-gateway: battery handler crashed", { meta: { error: err instanceof Error ? err.message : String(err) } });
-			});
-		});
 		this.unsubscribeConnectivity = [[EventCategory.DeviceOnline, "OK"], [EventCategory.DeviceOffline, "UNREACHABLE"]].map(([category, connectivity]) => this.deps.ctx.eventBus.subscribe({ category }, (event) => {
 			this.onConnectivityChanged(event.data, connectivity).catch((err) => {
 				this.deps.logger.warn("alexa lwa-gateway: connectivity handler crashed", { meta: { error: err instanceof Error ? err.message : String(err) } });
@@ -52371,17 +53866,16 @@ var LwaEventGateway = class {
 		this.unsubscribe = null;
 		if (this.unsubscribeMotion) this.unsubscribeMotion();
 		this.unsubscribeMotion = null;
-		if (this.unsubscribeBattery) this.unsubscribeBattery();
-		this.unsubscribeBattery = null;
 		for (const off of this.unsubscribeConnectivity) off();
 		this.unsubscribeConnectivity = [];
 		this.lastConnectivity.clear();
+		for (const timer of this.pendingInitialReports) clearTimeout(timer);
+		this.pendingInitialReports.clear();
 		if (this.refreshTimer) clearInterval(this.refreshTimer);
 		this.refreshTimer = null;
 		this.lastSentAt.clear();
 		this.motionHold.clear();
 		this.smartVisionDropped.clear();
-		this.lastBatteryLevel.clear();
 		this.warnedNoToken.clear();
 		this.warnedLegacyWaiting.clear();
 		this.migrationRetryAt.clear();
@@ -52413,6 +53907,7 @@ var LwaEventGateway = class {
 		}
 		if (!this.hasProactiveCredentials()) return;
 		for (const account of linked) {
+			if (!this.mayPush(account.userId, parentDeviceId, "doorbell press")) continue;
 			if (!this.findToken(account.userId)) {
 				this.deps.logger.info("alexa lwa-gateway: no LWA token for user — skipped", {
 					tags: { deviceId: parentDeviceId },
@@ -52437,6 +53932,19 @@ var LwaEventGateway = class {
 			});
 		}
 	}
+	/**
+	* S1: the account's hub user may view `deviceId`. A refusal is logged at
+	* debug — for a scoped user it is the EXPECTED outcome for every camera
+	* outside the grant, many times a minute.
+	*/
+	mayPush(userId, deviceId, label) {
+		if (this.deps.accountMaySee(userId, deviceId)) return true;
+		this.deps.logger.debug(`alexa lwa-gateway: ${label} not sent to this account — its hub user may not view the device`, {
+			tags: { deviceId },
+			meta: { userId }
+		});
+		return false;
+	}
 	isThrottled(key) {
 		const composite = `${key.userId}|${key.endpointId}`;
 		const last = this.lastSentAt.get(composite) ?? 0;
@@ -52459,13 +53967,57 @@ var LwaEventGateway = class {
 	async onMotionChanged(data) {
 		if (!this.deps.listExposed().some((e) => e.deviceId === data.deviceId)) return;
 		const endpointId = String(data.deviceId);
+		await this.pushMotionState({
+			deviceId: data.deviceId,
+			endpointId,
+			detected: data.detected,
+			timestamp: data.timestamp,
+			label: "motion",
+			onRisingPosted: (userId) => this.postObjectDetection({
+				userId,
+				deviceId: data.deviceId,
+				endpointId,
+				timestamp: data.timestamp
+			})
+		});
+	}
+	/**
+	* A camera's detection class appeared or cleared (R1, D772): report it on
+	* that class's detection-sensor endpoint, with the same hold as camera
+	* motion (instant rising edge; NOT_DETECTED only after the source went
+	* quiet and at least 30 s after DETECTED, Amazon's MotionSensor rule).
+	*
+	* Posted only to an endpoint Alexa KNOWS: a ChangeReport for an endpoint the
+	* last AddOrUpdateReport did not contain is a 202 the cloud discards (D76),
+	* so the exported signature must name it.
+	*/
+	async pushDetectionSensor(opts) {
+		if (!this.deps.listExposed().some((e) => e.deviceId === opts.deviceId)) return;
+		const signature = this.deps.getExportedSignature(opts.deviceId);
+		if (signature === null || !signatureNamesEndpoint(signature, opts.endpointId)) {
+			this.deps.logger.debug("alexa lwa-gateway: detection change not sent — Alexa has not been told about this sensor endpoint", {
+				tags: { deviceId: opts.deviceId },
+				meta: { endpointId: opts.endpointId }
+			});
+			return;
+		}
+		await this.pushMotionState({
+			...opts,
+			label: "detection"
+		});
+	}
+	/** The per-account MotionSensor ChangeReport loop shared by camera motion
+	*  and the detection sensors. The hold is keyed per account AND endpoint. */
+	async pushMotionState(opts) {
+		const { deviceId, endpointId } = opts;
 		const linked = this.deps.listLinkedAccounts();
 		if (linked.length === 0) return;
 		if (!this.hasProactiveCredentials()) return;
 		for (const account of linked) {
+			if (!this.mayPush(account.userId, deviceId, opts.label)) continue;
 			if (!this.findToken(account.userId)) continue;
 			const key = `${account.userId}|${endpointId}`;
-			if (!data.detected) {
+			if (!opts.detected) {
 				this.motionHold.onCleared(key, () => {
 					this.postMotionChange({
 						userId: account.userId,
@@ -52473,8 +54025,8 @@ var LwaEventGateway = class {
 						detected: false,
 						timestamp: Date.now()
 					}).catch((err) => {
-						this.deps.logger.warn("alexa lwa-gateway: held motion clear failed to post", {
-							tags: { deviceId: data.deviceId },
+						this.deps.logger.warn(`alexa lwa-gateway: held ${opts.label} clear failed to post`, {
+							tags: { deviceId },
 							meta: {
 								endpointId,
 								error: err instanceof Error ? err.message : String(err)
@@ -52489,14 +54041,9 @@ var LwaEventGateway = class {
 				userId: account.userId,
 				endpointId,
 				detected: true,
-				timestamp: data.timestamp
-			});
-			await this.postObjectDetection({
-				userId: account.userId,
-				deviceId: data.deviceId,
-				endpointId,
-				timestamp: data.timestamp
+				timestamp: opts.timestamp
 			});
+			await opts.onRisingPosted?.(account.userId);
 		}
 	}
 	async postMotionChange(opts) {
@@ -52551,59 +54098,113 @@ var LwaEventGateway = class {
 		}), `smartvision person`);
 	}
 	/**
-	* Battery slice changed. Push an `Alexa.BatteryLevelSensor`
-	* ChangeReport with the integer percentage. Dedupe so a provider that
-	* re-emits the same level on every poll doesn't flood the gateway —
-	* only round-percentage TRANSITIONS make it out (a typical battery
-	* cam reports every few minutes, and Alexa Smart Home rate-limits
-	* ChangeReports anyway).
+	* A camera went offline or came back. Amazon requires the `connectivity`
+	* ChangeReport within 3 s of the change (alexa-endpointhealth). Deduped per
+	* account and endpoint, and skipped for an endpoint Alexa is known to hold
+	* WITHOUT `Alexa.EndpointHealth` — the cloud would drop it (D76).
 	*/
-	async onBatteryStatusChanged(data) {
-		if (!this.deps.listExposed().some((e) => e.deviceId === data.deviceId)) return;
-		const endpointId = String(data.deviceId);
+	async onConnectivityChanged(data, connectivity) {
+		if (typeof data?.deviceId !== "number") return;
+		await this.reportConnectivity(data.deviceId, connectivity);
+	}
+	/**
+	* A device went offline or came back: report `connectivity` on EVERY
+	* endpoint of it that Alexa knows with `Alexa.EndpointHealth` — the camera
+	* and its detection sensors (D770). Fed by the generic `device-status`
+	* slice (R3) and by the providers that also emit DeviceOnline/Offline;
+	* deduplicated per account and endpoint, so the two sources never double-post.
+	*/
+	async reportConnectivity(deviceId, connectivity) {
+		if (!this.deps.listExposed().some((e) => e.deviceId === deviceId)) return;
+		const signature = this.deps.getExportedSignature(deviceId);
+		const endpointIds = signature === null ? [String(deviceId)] : signatureEntries(signature).filter((e) => e.interfaces.includes(ENDPOINT_HEALTH_INTERFACE)).map((e) => e.endpointId);
+		if (endpointIds.length === 0) return;
 		const linked = this.deps.listLinkedAccounts();
 		if (linked.length === 0) return;
 		if (!this.hasProactiveCredentials()) return;
-		const level = Math.max(0, Math.min(100, Math.round(data.status.percentage)));
 		for (const account of linked) {
-			if (!this.findToken(account.userId)) continue;
-			const key = `${account.userId}|${endpointId}`;
-			if (this.lastBatteryLevel.get(key) === level) continue;
-			this.lastBatteryLevel.set(key, level);
-			await this.postEventBody(account.userId, endpointId, (accessToken) => buildBatteryChangeReportPayload({
-				userId: account.userId,
-				endpointId,
-				batteryLevel: level,
-				timestamp: Date.now(),
-				accessToken
-			}), `battery ${level}%`);
+			if (!this.mayPush(account.userId, deviceId, "connectivity")) continue;
+			for (const endpointId of endpointIds) {
+				const key = `${account.userId}|${endpointId}`;
+				if (this.lastConnectivity.get(key) === connectivity) continue;
+				this.lastConnectivity.set(key, connectivity);
+				await this.postEventBody(account.userId, endpointId, (accessToken) => buildConnectivityChangeReportPayload({
+					endpointId,
+					connectivity,
+					timestamp: Date.now(),
+					accessToken
+				}), `connectivity ${connectivity}`);
+			}
 		}
 	}
 	/**
-	* A camera went offline or came back. Amazon requires the `connectivity`
-	* ChangeReport within 3 s of the change (alexa-endpointhealth). Deduped per
-	* account and endpoint, and skipped for an endpoint Alexa is known to hold
-	* WITHOUT `Alexa.EndpointHealth` — the cloud would drop it (D76).
+	* A device state change Alexa should hear about (R3, D776): the alarm
+	* panel, a privacy/autotrack switch, an accessory. Posted only to an
+	* endpoint Alexa knows WITH the interface the properties belong to (D76).
 	*/
-	async onConnectivityChanged(data, connectivity) {
-		if (typeof data?.deviceId !== "number") return;
-		if (!this.deps.listExposed().some((e) => e.deviceId === data.deviceId)) return;
-		const signature = this.deps.getExportedSignature(data.deviceId);
-		if (signature !== null && !signature.includes(ENDPOINT_HEALTH_INTERFACE)) return;
+	async postStateChange(report) {
+		if (!this.deps.listExposed().some((e) => e.deviceId === report.exposedDeviceId)) return;
+		const signature = this.deps.getExportedSignature(report.exposedDeviceId);
+		const entry = signature === null ? void 0 : signatureEntries(signature).find((e) => e.endpointId === report.endpointId);
+		if (entry === void 0 || !entry.interfaces.includes(report.interfaceName)) {
+			this.deps.logger.debug("alexa lwa-gateway: state change not sent — Alexa has not been told about this endpoint/interface", {
+				tags: { deviceId: report.exposedDeviceId },
+				meta: {
+					endpointId: report.endpointId,
+					interfaceName: report.interfaceName
+				}
+			});
+			return;
+		}
 		const linked = this.deps.listLinkedAccounts();
 		if (linked.length === 0) return;
 		if (!this.hasProactiveCredentials()) return;
-		const endpointId = String(data.deviceId);
 		for (const account of linked) {
-			const key = `${account.userId}|${endpointId}`;
-			if (this.lastConnectivity.get(key) === connectivity) continue;
-			this.lastConnectivity.set(key, connectivity);
-			await this.postEventBody(account.userId, endpointId, (accessToken) => buildConnectivityChangeReportPayload({
-				endpointId,
+			if (!this.mayPush(account.userId, report.exposedDeviceId, "state change")) continue;
+			if (!this.findToken(account.userId)) continue;
+			await this.postEventBody(account.userId, report.endpointId, (accessToken) => buildStateChangeReportPayload({
+				endpointId: report.endpointId,
+				properties: report.properties,
+				timestamp: Date.now(),
+				accessToken
+			}), `state ${report.interfaceName}`);
+		}
+	}
+	/**
+	* After endpoints reach an account (AddOrUpdateReport or a Discover answer),
+	* tell Alexa each one's connectivity, so it never holds an endpoint of
+	* unknown health — the state in which the phone app refused live view
+	* (D770). Delayed so the cloud has created the endpoints the report names.
+	* Only endpoints that DECLARE `Alexa.EndpointHealth` are reported.
+	*/
+	scheduleInitialConnectivity(userId, endpoints) {
+		const targets = endpoints.filter((e) => e.capabilities.some((c) => c.interface === ENDPOINT_HEALTH_INTERFACE));
+		if (targets.length === 0) return;
+		const timer = setTimeout(() => {
+			this.reportInitialConnectivity(userId, targets).catch((err) => {
+				this.deps.logger.warn("alexa lwa-gateway: initial connectivity report failed", { meta: {
+					userId,
+					error: err instanceof Error ? err.message : String(err)
+				} });
+			});
+		}, INITIAL_CONNECTIVITY_DELAY_MS);
+		timer.unref?.();
+		this.pendingInitialReports.add(timer);
+	}
+	async reportInitialConnectivity(userId, endpoints) {
+		if (!this.hasProactiveCredentials()) return;
+		for (const endpoint of endpoints) {
+			const deviceId = connectivityDeviceOf(endpoint.endpointId);
+			if (deviceId === null) continue;
+			if (!this.mayPush(userId, deviceId, "initial connectivity")) continue;
+			const connectivity = await readConnectivity(this.deps.ctx.api, deviceId, this.deps.logger);
+			this.lastConnectivity.set(`${userId}|${endpoint.endpointId}`, connectivity);
+			await this.postEventBody(userId, endpoint.endpointId, (accessToken) => buildConnectivityChangeReportPayload({
+				endpointId: endpoint.endpointId,
 				connectivity,
 				timestamp: Date.now(),
 				accessToken
-			}), `connectivity ${connectivity}`);
+			}), `initial connectivity ${connectivity}`);
 		}
 	}
 	/**
@@ -52662,14 +54263,25 @@ var LwaEventGateway = class {
 	*  with a fresh header would ship a token Amazon has already rejected. */
 	async postEventBody(userId, endpointId, buildBody, label) {
 		const url = EVENT_GATEWAY_URLS[this.deps.getRegion()];
-		const send = async (accessToken) => fetch(url, {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				Authorization: `Bearer ${accessToken}`
-			},
-			body: JSON.stringify(buildBody(accessToken))
-		});
+		const send = async (accessToken) => {
+			const body = JSON.stringify(buildBody(accessToken));
+			return sendWithGatewayRetry(() => fetch(url, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Authorization: `Bearer ${accessToken}`
+				},
+				body
+			}), (attempt, reason, delayMs) => {
+				this.deps.logger.info(`alexa lwa-gateway: ${label} retrying`, { meta: {
+					userId,
+					endpointId,
+					attempt,
+					reason,
+					delayMs
+				} });
+			});
+		};
 		const initial = this.findToken(userId);
 		if (!initial) {
 			if (!this.warnedNoToken.has(userId)) {
@@ -52844,12 +54456,65 @@ var LwaEventGateway = class {
 		return false;
 	}
 };
+/**
+* Statuses Amazon tells a sender to retry (smarthome/send-events: 429
+* THROTTLING, 500 INTERNAL_SERVICE, 503 SERVICE_UNAVAILABLE — "resend the
+* message up to three times, with at least a one-second interval").
+*/
+var RETRYABLE_GATEWAY_STATUSES = new Set([
+	429,
+	500,
+	503
+]);
+/** Delays before retry 1, 2, 3 — bounded, at least one second each. */
+var GATEWAY_RETRY_DELAYS_MS = [
+	1e3,
+	2e3,
+	4e3
+];
+/** A `Retry-After` the gateway sends is honoured up to this much. */
+var MAX_RETRY_AFTER_MS = 1e4;
+function retryAfterMs(response) {
+	const raw = response.headers?.get?.("retry-after");
+	if (raw === null || raw === void 0) return 0;
+	const seconds = Number(raw);
+	return Number.isFinite(seconds) && seconds > 0 ? Math.min(seconds * 1e3, MAX_RETRY_AFTER_MS) : 0;
+}
+/**
+* POST with Amazon's retry rule: a retryable status or a network failure is
+* re-sent up to three times, waiting 1 s / 2 s / 4 s (or the gateway's
+* `Retry-After`, capped). Anything else — 2xx, 401 (renewal is the caller's),
+* 403, 400 — is returned at once. The last answer (or the last network error)
+* is what the caller sees.
+*/
+async function sendWithGatewayRetry(attemptOnce, onRetry) {
+	for (let attempt = 0;; attempt++) {
+		let response = null;
+		let failure = null;
+		try {
+			response = await attemptOnce();
+		} catch (err) {
+			failure = err;
+		}
+		const retryable = response === null || RETRYABLE_GATEWAY_STATUSES.has(response.status);
+		const delay = GATEWAY_RETRY_DELAYS_MS[attempt];
+		if (!retryable || delay === void 0) {
+			if (response !== null) return response;
+			throw failure;
+		}
+		const wait = response === null ? delay : Math.max(delay, retryAfterMs(response));
+		onRetry(attempt + 1, response === null ? `network: ${failure instanceof Error ? failure.message : String(failure)}` : `status ${response.status}`, wait);
+		await new Promise((resolve) => {
+			setTimeout(resolve, wait).unref?.();
+		});
+	}
+}
 function buildDoorbellPressPayload(opts) {
 	return { event: {
 		header: {
 			namespace: "Alexa.DoorbellEventSource",
 			name: "DoorbellPress",
-			messageId: `doorbell-${opts.userId}-${opts.timestamp}`,
+			messageId: randomUUID(),
 			payloadVersion: "3"
 		},
 		endpoint: {
@@ -52872,7 +54537,7 @@ function buildMotionChangeReportPayload(opts) {
 			header: {
 				namespace: "Alexa",
 				name: "ChangeReport",
-				messageId: `motion-${opts.userId}-${opts.timestamp}`,
+				messageId: randomUUID(),
 				payloadVersion: "3"
 			},
 			endpoint: {
@@ -52896,14 +54561,14 @@ function buildMotionChangeReportPayload(opts) {
 		context: { properties: [] }
 	};
 }
-function buildBatteryChangeReportPayload(opts) {
+function buildStateChangeReportPayload(opts) {
 	const timeOfSample = new Date(opts.timestamp).toISOString();
 	return {
 		event: {
 			header: {
 				namespace: "Alexa",
 				name: "ChangeReport",
-				messageId: `battery-${opts.userId}-${opts.timestamp}`,
+				messageId: randomUUID(),
 				payloadVersion: "3"
 			},
 			endpoint: {
@@ -52914,14 +54579,14 @@ function buildBatteryChangeReportPayload(opts) {
 				endpointId: opts.endpointId
 			},
 			payload: { change: {
-				cause: { type: "PERIODIC_POLL" },
-				properties: [{
-					namespace: "Alexa.BatteryLevelSensor",
-					name: "batteryLevel",
-					value: opts.batteryLevel,
+				cause: { type: "PHYSICAL_INTERACTION" },
+				properties: opts.properties.map((p) => ({
+					namespace: p.namespace,
+					name: p.name,
+					value: p.value,
 					timeOfSample,
 					uncertaintyInMilliseconds: 0
-				}]
+				}))
 			} }
 		},
 		context: { properties: [] }
@@ -52963,7 +54628,7 @@ function buildSmartVisionObjectDetectionEvent(opts) {
 		header: {
 			namespace: "Alexa.SmartVision.ObjectDetectionSensor",
 			name: "ObjectDetection",
-			messageId: `smartvision-${opts.userId}-${opts.timestamp}`,
+			messageId: randomUUID(),
 			payloadVersion: "1.0"
 		},
 		endpoint: {
@@ -52984,12 +54649,12 @@ function buildSmartVisionObjectDetectionEvent(opts) {
 		})) }
 	} };
 }
-function buildAddOrUpdateReportPayload(userId, endpoints, accessToken) {
+function buildAddOrUpdateReportPayload(_userId, endpoints, accessToken) {
 	return { event: {
 		header: {
 			namespace: "Alexa.Discovery",
 			name: "AddOrUpdateReport",
-			messageId: `discovery-addupdate-${userId}-${Date.now()}`,
+			messageId: randomUUID(),
 			payloadVersion: "3"
 		},
 		payload: {
@@ -53001,12 +54666,12 @@ function buildAddOrUpdateReportPayload(userId, endpoints, accessToken) {
 		}
 	} };
 }
-function buildDeleteReportPayload(userId, endpointIds, accessToken) {
+function buildDeleteReportPayload(_userId, endpointIds, accessToken) {
 	return { event: {
 		header: {
 			namespace: "Alexa.Discovery",
 			name: "DeleteReport",
-			messageId: `discovery-delete-${userId}-${Date.now()}`,
+			messageId: randomUUID(),
 			payloadVersion: "3"
 		},
 		payload: {
@@ -53019,6 +54684,425 @@ function buildDeleteReportPayload(userId, endpointIds, accessToken) {
 	} };
 }
 //#endregion
+//#region src/access/account-visibility.ts
+/** Event-path gate. Unknown account ⇒ refused (fail closed). */
+function visibilityAllows(entry, deviceId) {
+	if (entry === void 0) return false;
+	if (entry.all === true) return true;
+	return entry.view.includes(deviceId);
+}
+function visibleSet(entry, exposed) {
+	if (entry === void 0 || entry.all === true) return new Set(exposed);
+	return new Set(entry.view);
+}
+var AccountVisibilityMirror = class {
+	deps;
+	flight = null;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** Synchronous event-path read. */
+	allows(userId, deviceId) {
+		return visibilityAllows(this.deps.getStored()[userId], deviceId);
+	}
+	/** Recompute every linked account. One pass at a time; a caller joins the
+	*  pass in flight. Returns the changes the caller must apply to Alexa. */
+	async refresh() {
+		if (this.flight === null) this.flight = this.refreshNow().finally(() => {
+			this.flight = null;
+		});
+		return this.flight;
+	}
+	async refreshNow() {
+		const exposed = this.deps.listExposedDeviceIds();
+		const stored = this.deps.getStored();
+		const next = {};
+		const changes = [];
+		for (const userId of this.deps.listLinkedUserIds()) {
+			const prev = stored[userId];
+			const computed = await this.compute(userId, prev, exposed);
+			if (computed === null) {
+				if (prev !== void 0) next[userId] = prev;
+				continue;
+			}
+			next[userId] = computed.entry;
+			if (computed.change.added.length > 0 || computed.change.removed.length > 0) changes.push(computed.change);
+		}
+		await this.deps.setStored(next);
+		return changes;
+	}
+	async compute(userId, prev, exposed) {
+		const lookup = await this.deps.gate.principal(userId);
+		if (lookup.kind === "unavailable") return null;
+		const before = visibleSet(prev, exposed);
+		const prevPending = new Set(prev !== void 0 && prev.all !== true ? prev.pendingRemoval ?? [] : []);
+		if (lookup.kind === "found" && lookup.principal.kind === "admin") return {
+			entry: { all: true },
+			change: {
+				userId,
+				added: prev === void 0 ? [] : exposed.filter((id) => !before.has(id)),
+				removed: []
+			}
+		};
+		const view = [];
+		for (const deviceId of exposed) {
+			if (lookup.kind === "unknown-user") continue;
+			const verdict = await this.deps.gate.allows(lookup.principal, deviceId, "view");
+			if (verdict === "allowed" || verdict === "unknown" && before.has(deviceId)) view.push(deviceId);
+		}
+		const viewSet = new Set(view);
+		const added = prev === void 0 ? [] : view.filter((id) => !before.has(id));
+		const lostNow = exposed.filter((id) => before.has(id) && !viewSet.has(id));
+		const removed = [...prevPending].filter((id) => !viewSet.has(id));
+		const pendingRemoval = lostNow.filter((id) => !prevPending.has(id));
+		if (lookup.kind === "unknown-user" && prev === void 0) this.deps.logger.warn("alexa access: a linked Alexa account belongs to a hub user that no longer exists — it will be shown nothing", { meta: { userId } });
+		return {
+			entry: pendingRemoval.length > 0 ? {
+				view,
+				pendingRemoval
+			} : { view },
+			change: {
+				userId,
+				added,
+				removed
+			}
+		};
+	}
+};
+//#endregion
+//#region src/access/hub-access-source.ts
+function createHubAccessGate(ctx) {
+	return new AlexaAccessGate({
+		logger: ctx.logger,
+		listUserGrants: async () => {
+			return (await ctx.api.userManagement.listUsers.query()).map((u) => ({
+				userId: u.id,
+				isAdmin: u.isAdmin,
+				scopes: u.scopes
+			}));
+		},
+		getDeviceMeta: async (deviceId) => {
+			const device = await ctx.api.deviceManager.getDevice.query({ deviceId });
+			if (device === null) return null;
+			return {
+				id: device.id,
+				type: String(device.type),
+				location: device.location,
+				parentDeviceId: device.parentDeviceId
+			};
+		}
+	});
+}
+//#endregion
+//#region src/access/visibility-sync.ts
+async function applyVisibilityChanges(changes, target, logger) {
+	for (const change of changes) {
+		for (const deviceId of change.added) {
+			const ok = await target.pushDeviceToAccount(change.userId, deviceId).catch((err) => {
+				logger.warn("alexa access: pushing a newly granted device failed", {
+					tags: { deviceId },
+					meta: {
+						userId: change.userId,
+						error: errMsg(err)
+					}
+				});
+				return false;
+			});
+			logger.info("alexa access: the linked user gained this device — pushed to their Alexa account", {
+				tags: { deviceId },
+				meta: {
+					userId: change.userId,
+					delivered: ok
+				}
+			});
+		}
+		for (const deviceId of change.removed) {
+			const ok = await target.removeDeviceFromAccount(change.userId, deviceId).catch((err) => {
+				logger.warn("alexa access: deleting a revoked device failed", {
+					tags: { deviceId },
+					meta: {
+						userId: change.userId,
+						error: errMsg(err)
+					}
+				});
+				return false;
+			});
+			logger.warn("alexa access: the linked user lost this device (confirmed twice) — deleted from their Alexa account", {
+				tags: { deviceId },
+				meta: {
+					userId: change.userId,
+					delivered: ok
+				}
+			});
+		}
+	}
+}
+//#endregion
+//#region src/detection-sensors/detection-tracker.ts
+/**
+* Which detection classes are currently present on each camera (R1, D772).
+*
+* Fed by the pipeline's track lifecycle (`PipelineAnalyticsTrackLifecycle`,
+* `data.deviceId` — these events carry no device on their `source`) and by
+* package deliveries. A class is present while at least one of ITS tracks is
+* open: the set is per `(camera, class)` and per `trackId`, so the end of one
+* person's track does not clear "Person" while another person is still in
+* view (the HA export's per-event flip has exactly that bug).
+*
+* Events are telemetry and may be dropped (D8), and the pipeline does not
+* promise an `end` for every `start` (a zero-media false birth or a discarded
+* stale track ends silently). So {@link reconcile} replaces a camera's sets
+* with an authoritative read of its ACTIVE tracks; a sensor can therefore never
+* stay "detected" past one reconcile after its last track closed. A read that
+* fails is not passed in — the sets then stay as they were.
+*
+* Emits a transition per `(camera, class)` only when presence changes; the
+* Alexa-facing hold (≥ 30 s DETECTED before NOT_DETECTED) is the gateway's.
+*/
+/** A package delivery is an instant, not a track: it is present this long. */
+var PACKAGE_PULSE_MS = 1e3;
+/** The detection class a pipeline class name belongs to, or null. Pipeline
+*  classes are already macros; a raw COCO label is mapped the same way the
+*  executor maps it. */
+function detectionClassOf(className) {
+	if (className === void 0) return null;
+	const lower = className.toLowerCase();
+	const isClass = (v) => DETECTION_SENSOR_CLASSES.includes(v);
+	if (isClass(lower)) return lower;
+	const mapped = COCO_TO_MACRO.mapping[lower];
+	return mapped !== void 0 && isClass(mapped) ? mapped : null;
+}
+var DetectionTracker = class {
+	onTransition;
+	/** `${deviceId}|${class}` → open track ids. */
+	open = /* @__PURE__ */ new Map();
+	pulseTimers = /* @__PURE__ */ new Set();
+	constructor(onTransition) {
+		this.onTransition = onTransition;
+	}
+	onTrackLifecycle(event) {
+		const cls = detectionClassOf(event.bestClassName ?? event.classes?.[0]);
+		if (cls === null) return;
+		if (event.phase === "end") {
+			this.remove(event.deviceId, cls, event.trackId);
+			for (const other of DETECTION_SENSOR_CLASSES) if (other !== cls) this.remove(event.deviceId, other, event.trackId);
+			return;
+		}
+		this.add(event.deviceId, cls, event.trackId);
+	}
+	/** A package was delivered: "Package" is detected, as a pulse. */
+	onPackageDelivered(deviceId, entryId) {
+		const id = `package:${entryId}`;
+		this.add(deviceId, "package", id);
+		const timer = setTimeout(() => {
+			this.pulseTimers.delete(timer);
+			this.remove(deviceId, "package", id);
+		}, PACKAGE_PULSE_MS);
+		timer.unref?.();
+		this.pulseTimers.add(timer);
+	}
+	/** Replace a camera's open tracks with what the pipeline says is ACTIVE. */
+	reconcile(deviceId, active) {
+		const truth = /* @__PURE__ */ new Map();
+		for (const track of active) {
+			const cls = detectionClassOf(track.className);
+			if (cls === null) continue;
+			const set = truth.get(cls) ?? /* @__PURE__ */ new Set();
+			set.add(track.trackId);
+			truth.set(cls, set);
+		}
+		for (const cls of DETECTION_SENSOR_CLASSES) {
+			const key = `${deviceId}|${cls}`;
+			const before = this.open.get(key) ?? /* @__PURE__ */ new Set();
+			const after = truth.get(cls) ?? /* @__PURE__ */ new Set();
+			for (const id of before) if (id.startsWith("package:")) after.add(id);
+			this.replace(deviceId, cls, before, after);
+		}
+	}
+	/** Cameras with at least one class present — the ones worth reconciling. */
+	camerasWithPresence() {
+		const out = /* @__PURE__ */ new Set();
+		for (const [key, set] of this.open) if (set.size > 0) out.add(Number(key.split("|")[0]));
+		return [...out];
+	}
+	isPresent(deviceId, cls) {
+		return (this.open.get(`${deviceId}|${cls}`)?.size ?? 0) > 0;
+	}
+	clear() {
+		this.open.clear();
+		for (const t of this.pulseTimers) clearTimeout(t);
+		this.pulseTimers.clear();
+	}
+	add(deviceId, cls, id) {
+		const key = `${deviceId}|${cls}`;
+		const set = this.open.get(key) ?? /* @__PURE__ */ new Set();
+		const was = set.size > 0;
+		set.add(id);
+		this.open.set(key, set);
+		if (!was) this.onTransition(deviceId, cls, true);
+	}
+	remove(deviceId, cls, id) {
+		const set = this.open.get(`${deviceId}|${cls}`);
+		if (set === void 0 || !set.delete(id)) return;
+		if (set.size === 0) this.onTransition(deviceId, cls, false);
+	}
+	replace(deviceId, cls, before, after) {
+		this.open.set(`${deviceId}|${cls}`, after);
+		if (before.size > 0 && after.size === 0) this.onTransition(deviceId, cls, false);
+		else if (before.size === 0 && after.size > 0) this.onTransition(deviceId, cls, true);
+	}
+};
+/** The detection classes an event-kind answer offers. */
+function detectionClassesOfKinds(kinds) {
+	const out = /* @__PURE__ */ new Set();
+	for (const k of kinds) {
+		if (k.level !== "macro") continue;
+		if (k.category !== "detection" && k.category !== "package") continue;
+		const cls = detectionClassOf(k.kind);
+		if (cls !== null) out.add(cls);
+	}
+	return DETECTION_SENSOR_CLASSES.filter((c) => out.has(c));
+}
+function sameClasses(a, b) {
+	return JSON.stringify(a ?? null) === JSON.stringify(b);
+}
+var DetectionClassSource = class {
+	deps;
+	/** Serializes the persisted map's read-modify-write: builds run four
+	*  cameras at once, and two writes computed off one snapshot would erase
+	*  each other's camera. */
+	writeChain = Promise.resolve();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	persist(deviceId, next) {
+		const write = this.writeChain.then(() => this.deps.setStored({
+			...this.deps.getStored(),
+			[deviceId]: next
+		}));
+		this.writeChain = write.catch(() => void 0);
+		return write;
+	}
+	async classesFor(deviceId) {
+		const prev = this.deps.getStored()[deviceId];
+		let read;
+		try {
+			read = detectionClassesOfKinds(await this.deps.readEventKinds(deviceId));
+		} catch (err) {
+			this.deps.logger.debug("alexa detection sensors: class read failed — keeping the last answer", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
+			return prev?.classes ?? [];
+		}
+		const now = this.deps.now?.() ?? Date.now();
+		const missingSince = {};
+		const keep = new Set(read);
+		const removed = [];
+		for (const cls of prev?.classes ?? []) {
+			if (keep.has(cls)) continue;
+			const since = prev?.missingSince?.[cls] ?? now;
+			if (now - since >= 9e5) {
+				removed.push(cls);
+				continue;
+			}
+			keep.add(cls);
+			missingSince[cls] = since;
+		}
+		const classes = DETECTION_SENSOR_CLASSES.filter((c) => keep.has(c));
+		const next = Object.keys(missingSince).length > 0 ? {
+			classes,
+			missingSince
+		} : { classes };
+		if (!sameClasses(prev, next)) {
+			await this.persist(deviceId, next);
+			if (removed.length > 0 || classes.some((c) => !(prev?.classes ?? []).includes(c))) this.deps.logger.info("alexa detection sensors: the camera's detection classes changed", {
+				tags: { deviceId },
+				meta: {
+					classes,
+					removed
+				}
+			});
+		}
+		return classes;
+	}
+};
+//#endregion
+//#region src/detection-sensors/detection-feed.ts
+var DETECTION_RECONCILE_INTERVAL_MS = 6e4;
+var TrackLifecycleSchema = object({
+	deviceId: number(),
+	trackId: string(),
+	phase: _enum([
+		"start",
+		"update",
+		"end"
+	]),
+	bestClassName: string().optional(),
+	classes: array(string()).optional()
+});
+var PackageDeliveredSchema = object({
+	deviceId: number(),
+	entryId: string()
+});
+var DetectionSensorFeed = class {
+	deps;
+	tracker;
+	offs = [];
+	timer = null;
+	constructor(deps) {
+		this.deps = deps;
+		this.tracker = new DetectionTracker((deviceId, cls, present) => {
+			this.onTransition(deviceId, cls, present);
+		});
+	}
+	start() {
+		this.offs.push(this.deps.eventBus.subscribe({ category: EventCategory.PipelineAnalyticsTrackLifecycle }, (event) => {
+			const parsed = TrackLifecycleSchema.safeParse(event.data);
+			if (parsed.success) this.tracker.onTrackLifecycle(parsed.data);
+		}), this.deps.eventBus.subscribe({ category: EventCategory.PipelineAnalyticsPackageDelivered }, (event) => {
+			const parsed = PackageDeliveredSchema.safeParse(event.data);
+			if (parsed.success) this.tracker.onPackageDelivered(parsed.data.deviceId, parsed.data.entryId);
+		}));
+		this.timer = setInterval(() => void this.reconcile(), DETECTION_RECONCILE_INTERVAL_MS);
+		this.timer.unref?.();
+	}
+	stop() {
+		for (const off of this.offs.splice(0)) off();
+		if (this.timer !== null) clearInterval(this.timer);
+		this.timer = null;
+		this.tracker.clear();
+	}
+	isPresent(deviceId, cls) {
+		return this.deps.enabled() && this.tracker.isPresent(deviceId, cls);
+	}
+	/** One reconcile pass over every camera that shows a class present. A read
+	*  that fails changes nothing for that camera. */
+	async reconcile() {
+		for (const deviceId of this.tracker.camerasWithPresence()) try {
+			this.tracker.reconcile(deviceId, await this.deps.readActiveTracks(deviceId));
+		} catch (err) {
+			this.deps.logger.debug("alexa detection sensors: active-track read failed — kept as is", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
+		}
+	}
+	onTransition(deviceId, cls, present) {
+		if (!this.deps.enabled() || !this.deps.isExposed(deviceId)) return;
+		this.deps.push(deviceId, cls, present, Date.now()).catch((err) => {
+			this.deps.logger.warn("alexa detection sensors: change report failed", {
+				tags: { deviceId },
+				meta: {
+					detectionClass: cls,
+					present,
+					error: errMsg(err)
+				}
+			});
+		});
+	}
+};
+//#endregion
 //#region src/oauth-integration.ts
 /**
 * The `export-alexa` OAuth client — the descriptor behind
@@ -53116,6 +55200,418 @@ function buildAlexaOauthIntegration(publicHubUrl) {
 	};
 }
 //#endregion
+//#region src/setup-block.ts
+function buildAlexaSetupBlock(input) {
+	const base = input.publicHubUrl.replace(/\/+$/, "");
+	return {
+		fields: [
+			...base ? [{
+				label: "Directive endpoint",
+				value: `${base}/addon/export-alexa/directive`
+			}] : [],
+			...input.ingressToken ? [{
+				label: "Ingress token (Lambda HUB_INGRESS_TOKEN) — use \"Show ingress token\" in settings",
+				value: maskSecretTail(input.ingressToken)
+			}] : [],
+			{
+				label: "Linked Alexa accounts",
+				value: String(input.linkedAccountCount)
+			}
+		],
+		note: base ? "Account linking is handled by the core OAuth server. Use the hub's /api/oauth2/authorize endpoint with integration=export-alexa." : "Set the public hub URL on the settings form first — the directive endpoint URL is derived from it."
+	};
+}
+/**
+* The ONE derivation of "a signed, expiring URL".
+*
+* This repo mints unguessable, self-expiring links in three places now — the
+* notification artifact plane, the Home Assistant media plane, and the snapshot
+* link plane. The first two grew independently and are byte-identical logic
+* (`hmac(secret, "<id>:<exp>")`, expiry checked before a constant-time compare),
+* each restating the crypto locally because **addons never import each other**.
+*
+* That reason is real, and the conclusion drawn from it was wrong. Two copies of
+* a signing scheme is how one of them quietly ends up with a different TTL, a
+* different compare, or a missing expiry check, and nothing fails until a link
+* that should have died keeps working. The fix is the same one D52 applies to
+* crop geometry: one derivation, in a place every addon may depend on. A
+* framework package is exactly that place — `@camstack/types/node`, off the root
+* entry because `node:crypto` must never be traversed by a browser bundler.
+*
+* What this module deliberately does NOT decide: the TTL, the base URL, the
+* shape of `id`, and the access level of the route. Those are per-plane policy
+* and each caller states them where a reader can see them.
+*/
+/**
+* The signature over `(id, expMs)`.
+*
+* `id` is whatever the plane uses to name the thing being served — an artifact
+* id, a track id, a `<deviceId>:<width>` pair. It is joined with `:` so a caller
+* must not put a `:` inside a field whose boundary matters; where a plane has
+* more than one field, it composes them itself and owns that ambiguity.
+*/
+function signExpiringUrl(secret, id, expMs) {
+	return createHmac("sha256", secret).update(`${id}:${String(expMs)}`).digest("hex");
+}
+/**
+* Verify a request's `(id, exp, sig)`.
+*
+* **Expiry is checked BEFORE the compare**, so an expired link is refused
+* whether or not its signature is valid — a leaked URL stops working on its own
+* and cannot be kept alive by holding a correct signature. The compare itself is
+* constant-time so a public route cannot be probed for the signature byte by
+* byte.
+*/
+function verifyExpiringUrl(input) {
+	const { secret, id, exp, sig, nowMs } = input;
+	if (exp === void 0 || sig === void 0) return false;
+	const expMs = typeof exp === "number" ? exp : Number(exp);
+	if (!Number.isFinite(expMs)) return false;
+	if (expMs <= nowMs) return false;
+	const expected = signExpiringUrl(secret, id, expMs);
+	const a = Buffer.from(expected, "utf8");
+	const b = Buffer.from(sig, "utf8");
+	if (a.length !== b.length) return false;
+	return timingSafeEqual(a, b);
+}
+//#endregion
+//#region src/snapshots/snapshot-store.ts
+/**
+* The images this hub has handed to Alexa (R2, D773), each behind a signed,
+* short-lived URL.
+*
+* Amazon's rules for a SnapshotProvider image URI (device-apis/
+* alexa-smartvision-snapshotprovider): HTTPS, NOT public — Alexa presents the
+* user's access token — valid about ten minutes, HTTP 410 once expired, no
+* redirects. So every image is minted for ONE linked user and ONE device, kept
+* in memory until it expires, and addressed by a random id whose URL carries an
+* HMAC over `(imageId, exp)`. A hub restart forgets them all; Alexa then gets a
+* 410 and asks for a new snapshot, which is the documented recovery.
+*
+* Bounded by count and by bytes: Alexa refreshes a tile at most every
+* `minRefreshIntervalInSeconds` per camera, so a few hundred kilobytes per
+* camera is the steady state; the bound is what keeps a misbehaving client from
+* turning this into a memory leak.
+*/
+/** How long a minted image URL is valid — Amazon recommends ten minutes. */
+var SNAPSHOT_URL_TTL_MS = 10 * 6e4;
+var MAX_IMAGES = 128;
+var MAX_TOTAL_BYTES = 24 * 1024 * 1024;
+var SnapshotStore = class {
+	secret;
+	now;
+	images = /* @__PURE__ */ new Map();
+	totalBytes = 0;
+	constructor(secret, now = Date.now) {
+		this.secret = secret;
+		this.now = now;
+	}
+	/** Keep `bytes` for `userId`/`deviceId` and return the signed path to it. */
+	mint(input) {
+		this.prune();
+		const imageId = randomUUID();
+		const expiresAt = this.now() + SNAPSHOT_URL_TTL_MS;
+		const image = {
+			imageId,
+			deviceId: input.deviceId,
+			userId: input.userId,
+			bytes: input.bytes,
+			contentType: "image/jpeg",
+			capturedAt: input.capturedAt,
+			expiresAt
+		};
+		this.images.set(imageId, image);
+		this.totalBytes += image.bytes.length;
+		this.evictOverBounds();
+		return {
+			imageId,
+			expiresAt,
+			path: `/addon/export-alexa/snapshot/${imageId}.jpg?exp=${expiresAt}&sig=${signExpiringUrl(this.secret(), imageId, expiresAt)}`
+		};
+	}
+	/** Resolve a fetch of a minted URL. */
+	lookup(imageId, exp, sig) {
+		const now = this.now();
+		const expMs = Number(exp);
+		if (Number.isFinite(expMs) && expMs <= now) return {
+			kind: "gone",
+			reason: "expired"
+		};
+		if (!verifyExpiringUrl({
+			secret: this.secret(),
+			id: imageId,
+			exp,
+			sig,
+			nowMs: now
+		})) return {
+			kind: "gone",
+			reason: "bad-signature"
+		};
+		const image = this.images.get(imageId);
+		if (image === void 0 || image.expiresAt <= now) return {
+			kind: "gone",
+			reason: "unknown-image"
+		};
+		return {
+			kind: "found",
+			image
+		};
+	}
+	/** Drop everything — the integration switch was turned off. */
+	clear() {
+		this.images.clear();
+		this.totalBytes = 0;
+	}
+	get size() {
+		return this.images.size;
+	}
+	prune() {
+		const now = this.now();
+		for (const [id, image] of this.images) if (image.expiresAt <= now) this.drop(id, image);
+	}
+	evictOverBounds() {
+		for (const [id, image] of this.images) {
+			if (this.images.size <= MAX_IMAGES && this.totalBytes <= MAX_TOTAL_BYTES) return;
+			this.drop(id, image);
+		}
+	}
+	drop(id, image) {
+		this.images.delete(id);
+		this.totalBytes -= image.bytes.length;
+	}
+};
+//#endregion
+//#region src/state-reports/state-change-map.ts
+/**
+* What a device's state change means for Alexa (R3, D776).
+*
+* Every cap state change on the hub arrives as ONE event —
+* `DeviceStateChanged {deviceId, capName, slice}` (the device-state mirror;
+* the per-cap `on…Changed` events the cap files declare are never emitted).
+* This maps one such change to the Alexa properties it changes, on the
+* endpoints this addon last published (`exportedEndpoints`): the alarm panel's
+* `armState` / `burglaryAlarm`, a privacy or autotrack switch's `powerState`,
+* an accessory's `powerState` / `brightness`, and — for `device-status` — the
+* device's connectivity.
+*
+* Pure: no I/O, so the mapping is pinned by a spec without an event bus.
+*/
+/** Every published endpoint, keyed by the device whose state drives it. */
+function indexByDrivingDevice(exported) {
+	const out = /* @__PURE__ */ new Map();
+	const add = (deviceId, entry) => {
+		const list = out.get(deviceId) ?? [];
+		list.push(entry);
+		out.set(deviceId, list);
+	};
+	for (const [key, ids] of Object.entries(exported)) {
+		const exposedDeviceId = Number(key);
+		for (const endpointId of ids) {
+			const parsed = parseCameraEndpointId(endpointId);
+			switch (parsed.kind) {
+				case "camera":
+					add(parsed.deviceId, {
+						exposedDeviceId,
+						endpointId,
+						kind: "camera"
+					});
+					break;
+				case "privacy":
+				case "autotrack":
+					add(parsed.parentDeviceId, {
+						exposedDeviceId,
+						endpointId,
+						kind: parsed.kind
+					});
+					break;
+				case "child":
+					add(parsed.childDeviceId, {
+						exposedDeviceId,
+						endpointId,
+						kind: "child"
+					});
+					break;
+				case "alarm-panel":
+					add(parsed.deviceId, {
+						exposedDeviceId,
+						endpointId,
+						kind: "alarm-panel"
+					});
+					break;
+				case "detection":
+					add(parsed.deviceId, {
+						exposedDeviceId,
+						endpointId,
+						kind: "detection"
+					});
+					break;
+				case "generic":
+					add(parsed.deviceId, {
+						exposedDeviceId,
+						endpointId,
+						kind: "generic"
+					});
+					break;
+				case "invalid": break;
+			}
+		}
+	}
+	return out;
+}
+var EnabledSchema = object({ enabled: boolean() });
+var OnSchema = object({ on: boolean() });
+var PercentageSchema = object({ percentage: number() });
+var OnlineSchema = object({ online: boolean() });
+function power(on) {
+	return {
+		namespace: "Alexa.PowerController",
+		name: "powerState",
+		value: on ? "ON" : "OFF"
+	};
+}
+function stateReportsFor(change, exported) {
+	if (change.capName === "device-status") {
+		const parsed = OnlineSchema.safeParse(change.slice);
+		return parsed.success ? {
+			kind: "connectivity",
+			deviceId: change.deviceId,
+			online: parsed.data.online
+		} : null;
+	}
+	const endpoints = indexByDrivingDevice(exported).get(change.deviceId) ?? [];
+	const reports = [];
+	const of = (kind) => endpoints.filter((e) => e.kind === kind).map((e) => ({
+		exposedDeviceId: e.exposedDeviceId,
+		endpointId: e.endpointId
+	}));
+	const generic = genericPropertyFor(change.capName, change.slice);
+	if (generic !== null) for (const e of of("generic")) reports.push({
+		...e,
+		interfaceName: generic.namespace,
+		properties: [generic]
+	});
+	switch (change.capName) {
+		case "alarm-panel": {
+			const parsed = AlarmPanelStatusSchema.pick({
+				state: true,
+				targetMode: true
+			}).safeParse(change.slice);
+			if (!parsed.success) return null;
+			for (const e of of("alarm-panel")) reports.push({
+				...e,
+				interfaceName: "Alexa.SecurityPanelController",
+				properties: [{
+					namespace: "Alexa.SecurityPanelController",
+					name: "armState",
+					value: alexaArmStateFor(parsed.data.state, parsed.data.targetMode ?? null)
+				}, {
+					namespace: "Alexa.SecurityPanelController",
+					name: "burglaryAlarm",
+					value: burglaryAlarmFor(parsed.data.state)
+				}]
+			});
+			break;
+		}
+		case "privacy-mask":
+		case "ptz-autotrack": {
+			const parsed = EnabledSchema.safeParse(change.slice);
+			if (!parsed.success) return null;
+			const kind = change.capName === "privacy-mask" ? "privacy" : "autotrack";
+			for (const e of of(kind)) reports.push({
+				...e,
+				interfaceName: "Alexa.PowerController",
+				properties: [power(parsed.data.enabled)]
+			});
+			break;
+		}
+		case "switch": {
+			const parsed = OnSchema.safeParse(change.slice);
+			if (!parsed.success) break;
+			for (const e of of("child")) reports.push({
+				...e,
+				interfaceName: "Alexa.PowerController",
+				properties: [power(parsed.data.on)]
+			});
+			break;
+		}
+		case "brightness": {
+			const parsed = PercentageSchema.safeParse(change.slice);
+			if (!parsed.success) break;
+			const value = Math.max(0, Math.min(100, Math.round(parsed.data.percentage)));
+			for (const e of of("child")) reports.push({
+				...e,
+				interfaceName: "Alexa.BrightnessController",
+				properties: [{
+					namespace: "Alexa.BrightnessController",
+					name: "brightness",
+					value
+				}]
+			});
+			break;
+		}
+		default: break;
+	}
+	return reports.length > 0 ? {
+		kind: "reports",
+		reports
+	} : null;
+}
+//#endregion
+//#region src/state-reports/state-change-reporter.ts
+var DeviceStateChangedSchema = object({
+	deviceId: number(),
+	capName: string(),
+	slice: record(string(), unknown())
+});
+var StateChangeReporter = class {
+	deps;
+	off = null;
+	lastReported = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	start() {
+		this.off = this.deps.eventBus.subscribe({ category: EventCategory.DeviceStateChanged }, (event) => {
+			const parsed = DeviceStateChangedSchema.safeParse(event.data);
+			if (parsed.success) this.onChange(parsed.data);
+		});
+	}
+	stop() {
+		this.off?.();
+		this.off = null;
+		this.lastReported.clear();
+	}
+	async onChange(change) {
+		const outcome = stateReportsFor(change, this.deps.getExportedEndpoints());
+		if (outcome === null) return;
+		try {
+			if (outcome.kind === "connectivity") {
+				await this.deps.reportConnectivity(outcome.deviceId, outcome.online ? "OK" : "UNREACHABLE");
+				return;
+			}
+			for (const report of outcome.reports) {
+				const key = `${report.endpointId}|${report.interfaceName}`;
+				const value = JSON.stringify(report.properties);
+				if (this.lastReported.get(key) === value) continue;
+				this.lastReported.set(key, value);
+				if (report.interfaceName === "Alexa.MotionSensor") {
+					await this.deps.postHeldMotion(report, report.properties[0]?.value === "DETECTED");
+					continue;
+				}
+				await this.deps.postStateChange(report);
+			}
+		} catch (err) {
+			this.deps.logger.warn("alexa state reports: posting a state change failed", {
+				tags: { deviceId: change.deviceId },
+				meta: {
+					capName: change.capName,
+					error: errMsg(err)
+				}
+			});
+		}
+	}
+};
+//#endregion
 //#region src/public-skill.ts
 /**
 * The built-in "public" CamStack Alexa skill.
@@ -53134,28 +55630,6 @@ function buildAlexaOauthIntegration(publicHubUrl) {
 */
 var PUBLIC_SKILL_ID = "amzn1.ask.skill.aa85d6df-1600-4f13-bda9-babcfdc849e6";
 //#endregion
-//#region src/endpoint-signature.ts
-/** One capability's identity as Alexa distinguishes it. */
-function capabilityKey(capability) {
-	const instance = typeof capability.instance === "string" ? capability.instance : "";
-	return instance.length > 0 ? `${capability.interface}#${instance}` : capability.interface;
-}
-/** Stable, order-independent signature of ONE endpoint's advertised shape. */
-function endpointKey(endpoint) {
-	const interfaces = endpoint.capabilities.map(capabilityKey).sort().join(",");
-	const categories = [...endpoint.displayCategories].sort().join(",");
-	return `${endpoint.endpointId}|${categories}|${interfaces}`;
-}
-/**
-* Stable signature of the endpoint set built for ONE device. Two builds that
-* would land identically in Alexa's registry produce the same string; any
-* added, removed or renamed interface — or a changed display category —
-* produces a different one.
-*/
-function endpointsSignature(endpoints) {
-	return endpoints.map(endpointKey).sort().join(";");
-}
-//#endregion
 //#region src/sync-engine.ts
 /**
 * Devices reconciled at once in {@link SyncEngine.reconcileAllExposed}. Each
@@ -53203,8 +55677,18 @@ var SyncEngine = class {
 			};
 		}
 		const endpointIds = endpoints.map((e) => e.endpointId);
+		const retired = (this.deps.getExportedEndpoints()[deviceId] ?? []).filter((id) => !endpointIds.includes(id) && this.deps.mayRetire(id));
 		const failures = [];
-		for (const account of accounts) if (!await this.deps.postAddOrUpdate(account.userId, endpoints)) failures.push(`${account.userId}:${deviceId}`);
+		for (const account of accounts) {
+			if (!await this.postFiltered(account.userId, deviceId, endpoints)) failures.push(`${account.userId}:${deviceId}`);
+			if (retired.length > 0) {
+				if (!await this.deps.postDelete(account.userId, retired)) failures.push(`${account.userId}:${deviceId}:delete`);
+			}
+		}
+		if (retired.length > 0) this.deps.logger.info("alexa sync: retired endpoints the device no longer builds", {
+			tags: { deviceId },
+			meta: { retired }
+		});
 		await this.recordEndpoints(deviceId, endpointIds, endpointsSignature(endpoints));
 		return {
 			deviceCount: 1,
@@ -53250,7 +55734,7 @@ var SyncEngine = class {
 		for (const { deviceId } of this.deps.listExposed()) {
 			const endpoints = await this.deps.buildEndpoints(deviceId);
 			if (endpoints.length === 0) continue;
-			if (!await this.deps.postAddOrUpdate(userId, endpoints)) failures.push(`${userId}:${deviceId}`);
+			if (!await this.postFiltered(userId, deviceId, endpoints)) failures.push(`${userId}:${deviceId}`);
 			await this.recordEndpoints(deviceId, endpoints.map((e) => e.endpointId), endpointsSignature(endpoints));
 			deviceCount += 1;
 			endpointCount += endpoints.length;
@@ -53262,6 +55746,49 @@ var SyncEngine = class {
 			failures
 		};
 	}
+	/**
+	* Post `endpoints` to one account, cut to what that account's user may see.
+	* Nothing visible is a success with nothing to send: an empty
+	* AddOrUpdateReport is an Alexa protocol error.
+	*/
+	async postFiltered(userId, deviceId, endpoints) {
+		const filtered = await this.deps.filterForAccount(userId, endpoints);
+		if (filtered === null) {
+			this.deps.logger.warn("alexa sync: the linked user's grants could not be read — this account was NOT sent the device", {
+				tags: { deviceId },
+				meta: { userId }
+			});
+			return false;
+		}
+		const visible = withholdInvalidEndpoints(filtered, (message, violations) => {
+			this.deps.logger.warn(message, {
+				tags: { deviceId },
+				meta: {
+					userId,
+					violations
+				}
+			});
+		});
+		if (visible.length === 0) return true;
+		const ok = await this.deps.postAddOrUpdate(userId, visible);
+		if (ok) this.deps.afterPush(userId, visible);
+		return ok;
+	}
+	/** A device the account's user just gained (visibility mirror). */
+	async pushDeviceToAccount(userId, deviceId) {
+		if (!this.deps.hasProactiveCredentials()) return false;
+		if (!this.deps.listExposed().some((e) => e.deviceId === deviceId)) return true;
+		const endpoints = await this.deps.buildEndpoints(deviceId);
+		if (endpoints.length === 0) return false;
+		return this.postFiltered(userId, deviceId, endpoints);
+	}
+	/** A device the account's user lost (confirmed by two reads): delete every
+	*  endpoint we ever published for it from THAT account only. */
+	async removeDeviceFromAccount(userId, deviceId) {
+		if (!this.deps.hasProactiveCredentials()) return false;
+		const ids = this.deps.getExportedEndpoints()[deviceId] ?? [String(deviceId)];
+		return this.deps.postDelete(userId, ids);
+	}
 	async removeDevice(deviceId) {
 		const ids = this.deps.getExportedEndpoints()[deviceId] ?? [];
 		if (ids.length === 0) return {
@@ -53420,6 +55947,17 @@ var SyncEngine = class {
 *  provider respawn emits one `DeviceBindingsChanged` per cap; reconciling in
 *  the middle of that burst would read a half-registered binding set. */
 var BINDINGS_RECONCILE_DEBOUNCE_MS = 5e3;
+/** How often each linked account's visibility is recomputed from the live
+*  user grants (S1). Also the bound on how long an event keeps reaching a user
+*  whose grant was just revoked. */
+var VISIBILITY_REFRESH_INTERVAL_MS = 6e4;
+/** First visibility pass after boot — soon, because until an account has an
+*  entry its events are refused (fail closed). */
+var BOOT_VISIBILITY_DELAY_MS = 5e3;
+/** How often every exposed camera's endpoint shape is re-checked while the
+*  detection sensors are on — a camera whose pipeline gained or (confirmed)
+*  lost a class gets its sensors added or removed. */
+var DETECTION_CLASS_REFRESH_MS = 15 * 6e4;
 /** Delay before the boot-time reconcile pass. Long enough for device providers
 *  to have registered their caps — a device whose bindings have not landed
 *  builds a shape we must never push to Alexa. */
@@ -53458,18 +55996,47 @@ var DEFAULT_CONFIG = {
 	availableEndpoints: [],
 	ingressToken: "",
 	enforceIngressToken: false,
-	staleEndpointPurgeInput: ""
+	staleEndpointPurgeInput: "",
+	accountVisibility: {},
+	detectionSensors: true,
+	detectionClasses: {},
+	snapshots: true,
+	snapshotSigningKey: ""
 };
+/** The one field of `oauthVerifyAccessToken`'s answer the snapshot route
+*  reads. */
+var VerifiedTokenSchema = object({ userId: string() }).nullable();
 /** UI filter for the Export picker. `alarm-panel` publishes an
 *  `Alexa.SecurityPanelController` endpoint (`endpoints/builder.ts`). */
 var SUPPORTED_KINDS = [
 	"camera",
 	"doorbell",
-	DeviceType.AlarmPanel
+	DeviceType.AlarmPanel,
+	DeviceType.Light,
+	DeviceType.Switch,
+	DeviceType.Siren,
+	DeviceType.Sensor,
+	DeviceType.Lock,
+	DeviceType.Presence,
+	DeviceType.Thermostat,
+	DeviceType.Generic
 ];
 var ExportAlexaAddon = class extends BaseAddon {
 	lwaGateway = null;
 	syncEngine = null;
+	/** S1 (D767): the linking user's live grants. Built in `onInitialize`, the
+	*  first point `ctx` exists. */
+	accessGateRef = null;
+	visibilityRef = null;
+	detectionClassSource = null;
+	/** The images handed to Alexa, behind signed URLs (R2). In memory only: a
+	*  restart answers 410 and Alexa asks again. */
+	snapshotStore = new SnapshotStore(() => this.config.snapshotSigningKey);
+	detectionFeed = null;
+	stateReporter = null;
+	/** The switches whose change re-shapes every exposed endpoint, as last
+	*  applied — `onConfigChanged` runs on EVERY settings write. */
+	appliedShapeSwitches = null;
 	/** Per-device debounce timers for the bindings-change discovery reconcile. */
 	pendingReconcileTimers = /* @__PURE__ */ new Map();
 	constructor() {
@@ -53477,6 +56044,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 	}
 	async onInitialize() {
 		if (!this.config.ingressToken) await this.updateGlobalSettings({ ingressToken: generateIngressToken() });
+		if (!this.config.snapshotSigningKey) await this.updateGlobalSettings({ snapshotSigningKey: generateIngressToken() });
 		if (this.config.lwaClientSecret) {
 			await this.updateGlobalSettings({ lwaClientSecret: "" });
 			this.ctx.logger.warn("export-alexa: removed a stored LWA client secret — the hub no longer uses one; your skill Lambda holds it (D753)");
@@ -53485,6 +56053,21 @@ var ExportAlexaAddon = class extends BaseAddon {
 		this.autoDetectPublicHubUrl().catch((err) => {
 			this.ctx.logger.warn("export-alexa: public hub URL auto-detect failed", { meta: { error: errMsg(err) } });
 		});
+		this.accessGateRef = createHubAccessGate(this.ctx);
+		this.detectionClassSource = new DetectionClassSource({
+			readEventKinds: (deviceId) => this.ctx.api.pipelineAnalytics.listEventKinds.query({ deviceId }),
+			getStored: () => this.config.detectionClasses,
+			setStored: (next) => this.updateGlobalSettings({ detectionClasses: next }),
+			logger: this.ctx.logger
+		});
+		this.visibilityRef = new AccountVisibilityMirror({
+			gate: this.accessGateRef,
+			listLinkedUserIds: () => this.config.linkedAccounts.map((a) => a.userId),
+			listExposedDeviceIds: () => this.config.exposed.map((e) => e.deviceId),
+			getStored: () => this.config.accountVisibility,
+			setStored: (next) => this.updateGlobalSettings({ accountVisibility: next }),
+			logger: this.ctx.logger
+		});
 		const deviceExportProvider = {
 			getStatus: async () => ({
 				linkState: this.config.linkedAccounts.length > 0 ? "linked" : "unlinked",
@@ -53507,7 +56090,8 @@ var ExportAlexaAddon = class extends BaseAddon {
 				discovery: {
 					ctx: this.ctx,
 					logger: this.ctx.logger,
-					listExposed: async () => this.config.exposed
+					listExposed: async () => this.config.exposed,
+					buildEndpoints: (deviceId) => this.buildEndpointsForOneDevice(deviceId)
 				},
 				cameraStream: {
 					ctx: this.ctx,
@@ -53538,12 +56122,26 @@ var ExportAlexaAddon = class extends BaseAddon {
 				},
 				reportState: {
 					ctx: this.ctx,
-					logger: this.ctx.logger
+					logger: this.ctx.logger,
+					detectionPresent: (deviceId, cls) => this.detectionFeed?.isPresent(deviceId, cls) ?? false
 				},
 				securityPanel: {
 					ctx: this.ctx,
 					logger: this.ctx.logger
-				}
+				},
+				lockController: {
+					ctx: this.ctx,
+					logger: this.ctx.logger
+				},
+				snapshotProvider: {
+					ctx: this.ctx,
+					logger: this.ctx.logger,
+					store: this.snapshotStore,
+					enabled: () => this.config.snapshots,
+					publicHubUrl: () => this.config.publicHubUrl
+				},
+				access: this.endpointAccess,
+				afterDiscovery: (userId, endpoints) => this.requireGateway().scheduleInitialConnectivity(userId, endpoints)
 			},
 			lwaTokensCallbackDeps: {
 				ctx: this.ctx,
@@ -53552,7 +56150,18 @@ var ExportAlexaAddon = class extends BaseAddon {
 				recordLinkedAccount: (input) => this.recordLinkedAccount(input)
 			},
 			redetectPublicHubUrl: () => this.redetectPublicHubUrl(),
-			onBrokerAdvertised: (raw) => this.rememberAdvertisedBroker(raw)
+			onBrokerAdvertised: (raw) => this.rememberAdvertisedBroker(raw),
+			snapshotRoute: {
+				store: this.snapshotStore,
+				enabled: () => this.config.snapshots,
+				verifyToken: (token) => this.verifyAccountLinkToken(token),
+				mayView: async (userId, deviceId) => {
+					const lookup = await this.accessGate.principal(userId);
+					if (lookup.kind !== "found") return false;
+					return await this.accessGate.allows(lookup.principal, deviceId, "view") === "allowed";
+				},
+				logger: this.ctx.logger
+			}
 		}));
 		const oauthIntegrationProvider = { getDescriptor: async () => buildAlexaOauthIntegration(this.config.publicHubUrl) };
 		this.lwaGateway = new LwaEventGateway({
@@ -53566,15 +56175,54 @@ var ExportAlexaAddon = class extends BaseAddon {
 			getAdvertisedBrokerUrl: () => this.config.advertisedBrokerUrl || null,
 			getPublicHubUrl: () => this.config.publicHubUrl,
 			getRegion: () => this.config.region,
-			getExportedSignature: (deviceId) => this.config.exportedSignatures[deviceId] ?? null
+			getExportedSignature: (deviceId) => this.config.exportedSignatures[deviceId] ?? null,
+			accountMaySee: (userId, deviceId) => this.visibility.allows(userId, deviceId)
 		});
 		this.lwaGateway.start();
+		const gatewayForFeed = this.lwaGateway;
+		this.detectionFeed = new DetectionSensorFeed({
+			eventBus: this.ctx.eventBus,
+			enabled: () => this.config.detectionSensors,
+			isExposed: (deviceId) => this.config.exposed.some((e) => e.deviceId === deviceId),
+			readActiveTracks: async (deviceId) => {
+				return (await this.ctx.api.pipelineAnalytics.getActiveTracks.query({ deviceId })).map((t) => ({
+					trackId: t.trackId,
+					className: t.className
+				}));
+			},
+			push: (deviceId, cls, detected, timestamp) => gatewayForFeed.pushDetectionSensor({
+				deviceId,
+				endpointId: detectionSensorEndpointId(deviceId, cls),
+				detected,
+				timestamp
+			}),
+			logger: this.ctx.logger
+		});
+		this.detectionFeed.start();
+		this.appliedShapeSwitches = this.shapeSwitches();
+		this.stateReporter = new StateChangeReporter({
+			eventBus: this.ctx.eventBus,
+			getExportedEndpoints: () => this.config.exportedEndpoints,
+			reportConnectivity: (deviceId, connectivity) => gatewayForFeed.reportConnectivity(deviceId, connectivity),
+			postStateChange: (report) => gatewayForFeed.postStateChange(report),
+			postHeldMotion: (report, detected) => gatewayForFeed.pushDetectionSensor({
+				deviceId: report.exposedDeviceId,
+				endpointId: report.endpointId,
+				detected,
+				timestamp: Date.now()
+			}),
+			logger: this.ctx.logger
+		});
+		this.stateReporter.start();
 		this.syncEngine = new SyncEngine({
 			logger: this.ctx.logger,
 			listExposed: () => this.config.exposed,
 			listLinkedAccounts: () => this.config.linkedAccounts,
 			hasProactiveCredentials: () => this.config.tokens.length > 0,
 			buildEndpoints: (deviceId) => this.buildEndpointsForOneDevice(deviceId),
+			filterForAccount: (userId, endpoints) => this.filterForAccount(userId, endpoints),
+			afterPush: (userId, endpoints) => this.requireGateway().scheduleInitialConnectivity(userId, endpoints),
+			mayRetire: (endpointId) => parseCameraEndpointId(endpointId).kind === "detection",
 			postAddOrUpdate: (userId, endpoints) => this.requireGateway().postReport(userId, (accessToken) => buildAddOrUpdateReportPayload(userId, endpoints, accessToken), `add/update (${endpoints.length})`),
 			postDelete: (userId, ids) => this.requireGateway().postReport(userId, (accessToken) => buildDeleteReportPayload(userId, ids, accessToken), `delete (${ids.length})`),
 			getExportedEndpoints: () => this.config.exportedEndpoints,
@@ -53584,6 +56232,8 @@ var ExportAlexaAddon = class extends BaseAddon {
 		});
 		this.subscribeBindingsChangedForReconcile();
 		this.scheduleBootDiscoveryReconcile();
+		this.scheduleVisibilityRefresh();
+		this.scheduleDetectionClassRefresh();
 		const offRemoved = this.ctx.eventBus.subscribe({ category: EventCategory.DeviceUnregistered }, (event) => {
 			const id = event.data?.deviceId;
 			if (typeof id !== "number") return;
@@ -53630,6 +56280,10 @@ var ExportAlexaAddon = class extends BaseAddon {
 			actionHandlers: {
 				redetectHubUrl: async () => this.redetectPublicHubUrl(),
 				regenerateIngressToken: async () => this.regenerateIngressToken(),
+				revealIngressToken: async () => {
+					this.ctx.logger.info("export-alexa: an administrator revealed the ingress token");
+					return { ingressToken: this.config.ingressToken };
+				},
 				resyncDiscovery: async () => this.resyncDiscovery(),
 				purgeStaleEndpoints: async () => this.purgeStaleEndpoints(),
 				unlinkAlexaAccounts: async () => this.unlinkAlexaAccounts(),
@@ -53638,6 +56292,10 @@ var ExportAlexaAddon = class extends BaseAddon {
 		};
 	}
 	async onShutdown() {
+		this.detectionFeed?.stop();
+		this.detectionFeed = null;
+		this.stateReporter?.stop();
+		this.stateReporter = null;
 		if (this.lwaGateway) {
 			this.lwaGateway.stop();
 			this.lwaGateway = null;
@@ -53658,7 +56316,10 @@ var ExportAlexaAddon = class extends BaseAddon {
 		});
 		await this.updateGlobalSettings({ exposed: next });
 		this.ctx.logger.info("export-alexa: exposed device", { meta: { deviceId } });
-		this.requireSyncEngine().pushDevice(deviceId).then((r) => this.ctx.logger.info("export-alexa: synced exposed device", { meta: { ...r } })).catch((err) => {
+		this.requireSyncEngine().pushDevice(deviceId).then((r) => {
+			this.ctx.logger.info("export-alexa: synced exposed device", { meta: { ...r } });
+			return this.refreshVisibility();
+		}).catch((err) => {
 			this.ctx.logger.warn("export-alexa: expose sync failed", { meta: {
 				deviceId,
 				error: errMsg(err)
@@ -53685,12 +56346,96 @@ var ExportAlexaAddon = class extends BaseAddon {
 	* `Discover` handler uses.
 	*/
 	async buildEndpointsForOneDevice(deviceId) {
+		const classSource = this.detectionClassSource;
 		return buildEndpointsForExposedDevice(deviceId, {
 			ctx: this.ctx,
 			logger: this.ctx.logger,
-			listExposed: async () => this.config.exposed
+			snapshots: this.config.snapshots,
+			...this.config.detectionSensors && classSource !== null ? { detectionClasses: (id) => classSource.classesFor(id) } : {}
+		});
+	}
+	/** The settings that change every exposed endpoint's shape, as one key. */
+	shapeSwitches() {
+		return JSON.stringify({
+			detectionSensors: this.config.detectionSensors,
+			snapshots: this.config.snapshots
+		});
+	}
+	/**
+	* A shape switch was flipped: re-push every exposed device. The signature
+	* reconcile pushes only what changed, and the push retires the endpoints a
+	* device no longer builds (the detection sensors, when switched off).
+	*/
+	async onConfigChanged() {
+		const now = this.shapeSwitches();
+		if (this.appliedShapeSwitches === null || now === this.appliedShapeSwitches) return;
+		this.appliedShapeSwitches = now;
+		if (!this.config.snapshots) this.snapshotStore.clear();
+		this.ctx.logger.info("export-alexa: an endpoint-shape switch changed — re-syncing every device", { meta: { switches: now } });
+		const engine = this.syncEngine;
+		if (engine === null) return;
+		engine.reconcileAllExposed().catch((err) => {
+			this.ctx.logger.warn("export-alexa: re-sync after a switch change failed", { meta: { error: errMsg(err) } });
+		});
+	}
+	scheduleDetectionClassRefresh() {
+		const timer = setInterval(() => {
+			if (!this.config.detectionSensors) return;
+			this.requireSyncEngine().reconcileAllExposed().catch((err) => {
+				this.ctx.logger.warn("export-alexa: detection-class refresh failed", { meta: { error: errMsg(err) } });
+			});
+		}, DETECTION_CLASS_REFRESH_MS);
+		timer.unref?.();
+		this.ctx.addDisposer(async () => clearInterval(timer));
+	}
+	get visibility() {
+		if (!this.visibilityRef) throw new Error("export-alexa: visibility mirror not initialized");
+		return this.visibilityRef;
+	}
+	/** The endpoints one linked account may be sent (S1). `null` = its user's
+	*  grants are unreadable right now; a deleted user is sent nothing. */
+	async filterForAccount(userId, endpoints) {
+		const lookup = await this.accessGate.principal(userId);
+		if (lookup.kind === "unavailable") return null;
+		if (lookup.kind === "unknown-user") return [];
+		return (await filterEndpointsForPrincipal(endpoints, lookup.principal, this.endpointAccess)).kept;
+	}
+	/** One visibility pass, applied to Alexa. Never throws. */
+	async refreshVisibility() {
+		try {
+			await applyVisibilityChanges(await this.visibility.refresh(), this.requireSyncEngine(), this.ctx.logger);
+		} catch (err) {
+			this.ctx.logger.warn("export-alexa: visibility refresh failed", { meta: { error: errMsg(err) } });
+		}
+	}
+	scheduleVisibilityRefresh() {
+		const first = setTimeout(() => void this.refreshVisibility(), BOOT_VISIBILITY_DELAY_MS);
+		first.unref?.();
+		const every = setInterval(() => void this.refreshVisibility(), VISIBILITY_REFRESH_INTERVAL_MS);
+		every.unref?.();
+		this.ctx.addDisposer(async () => {
+			clearTimeout(first);
+			clearInterval(every);
 		});
 	}
+	/** An account-link token's hub user, or null — the snapshot route's
+	*  credential check (the same verification `/directive` runs). */
+	async verifyAccountLinkToken(token) {
+		const raw = await this.ctx.api.userManagement.oauthVerifyAccessToken.query({ token });
+		const parsed = VerifiedTokenSchema.safeParse(raw);
+		return parsed.success && parsed.data !== null ? { userId: parsed.data.userId } : null;
+	}
+	get accessGate() {
+		if (!this.accessGateRef) throw new Error("export-alexa: access gate not initialized");
+		return this.accessGateRef;
+	}
+	/** The exposed set + the user gate, as every enforcement point reads them. */
+	get endpointAccess() {
+		return {
+			gate: this.accessGate,
+			isExposed: (deviceId) => this.config.exposed.some((e) => e.deviceId === deviceId)
+		};
+	}
 	/** Narrow the nullable `lwaGateway` for the SyncEngine post closures. It is
 	*  constructed + started in `onInitialize` before the SyncEngine, so its
 	*  `postReport` is always reachable when the engine pushes. */
@@ -53861,7 +56606,8 @@ var ExportAlexaAddon = class extends BaseAddon {
 			linkedAccounts: [],
 			tokens: [],
 			exportedEndpoints: {},
-			exportedSignatures: {}
+			exportedSignatures: {},
+			accountVisibility: {}
 		});
 		this.ctx.logger.warn("export-alexa: operator unlinked the Amazon account(s)", { meta: {
 			revokedSessions,
@@ -53904,7 +56650,10 @@ var ExportAlexaAddon = class extends BaseAddon {
 		await this.updateGlobalSettings({ linkedAccounts: next });
 		const engine = this.syncEngine;
 		if (!engine) return;
-		engine.pushAllToAccount(input.userId).then((r) => this.ctx.logger.info("export-alexa: pushed to newly linked account", { meta: { ...r } })).catch((err) => {
+		engine.pushAllToAccount(input.userId).then((r) => {
+			this.ctx.logger.info("export-alexa: pushed to newly linked account", { meta: { ...r } });
+			return this.refreshVisibility();
+		}).catch((err) => {
 			this.ctx.logger.warn("export-alexa: new-account push failed", { meta: {
 				userId: input.userId,
 				error: errMsg(err)
@@ -54105,26 +56854,11 @@ var ExportAlexaAddon = class extends BaseAddon {
 	* gets a copy button in the panel; the secret rows are masked.
 	*/
 	buildSetupBlock() {
-		const base = this.config.publicHubUrl.replace(/\/+$/, "");
-		const linkedCount = this.config.linkedAccounts.length;
-		return {
-			fields: [
-				...base ? [{
-					label: "Directive endpoint",
-					value: `${base}/addon/export-alexa/directive`
-				}] : [],
-				...this.config.ingressToken ? [{
-					label: "Ingress token (Lambda HUB_INGRESS_TOKEN)",
-					value: this.config.ingressToken,
-					secret: true
-				}] : [],
-				{
-					label: "Linked Alexa accounts",
-					value: String(linkedCount)
-				}
-			],
-			note: base ? "Account linking is handled by the core OAuth server. Use the hub's /api/oauth2/authorize endpoint with integration=export-alexa." : "Set the public hub URL on the settings form first — the directive endpoint URL is derived from it."
-		};
+		return buildAlexaSetupBlock({
+			publicHubUrl: this.config.publicHubUrl,
+			ingressToken: this.config.ingressToken,
+			linkedAccountCount: this.config.linkedAccounts.length
+		});
 	}
 	/** Options for the "External address" picker: the cached HTTPS endpoints
 	*  plus the current selection (so a stale/custom value is never dropped). */
@@ -54195,7 +56929,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 					type: "select",
 					key: "region",
 					label: "Skill region",
-					description: "The Alexa Event Gateway this hub posts to: doorbell presses, motion, battery level, and the device-list updates sent when you expose or unexpose a camera. Pick the region your Amazon account is in — events sent to another region are rejected.",
+					description: "The Alexa Event Gateway this hub posts to: doorbell presses, motion, camera online/offline and state changes, and the device-list updates sent when you expose or unexpose a camera. Pick the region your Amazon account is in — events sent to another region are rejected.",
 					options: [
 						{
 							value: "NA",
@@ -54212,6 +56946,20 @@ var ExportAlexaAddon = class extends BaseAddon {
 					],
 					default: DEFAULT_CONFIG.region
 				}),
+				this.field({
+					type: "boolean",
+					key: "detectionSensors",
+					label: "Detection sensors",
+					description: "Give every exposed camera one Alexa motion sensor per class its detection pipeline finds: \"<camera> Person\", \"Vehicle\", \"Animal\", \"Package\". Use them as routine triggers in the Alexa app (for example: when Front door Person detects motion, announce on the Echo devices). They report only \"detected\" — no images. Off removes them from Alexa.",
+					default: DEFAULT_CONFIG.detectionSensors
+				}),
+				this.field({
+					type: "boolean",
+					key: "snapshots",
+					label: "Snapshots in the Alexa app",
+					description: "Show each exposed camera's latest still on its tile in the Alexa app. While this is on, Amazon fetches still images of your cameras (re-encoded to about 480 px, each link valid ten minutes and only with your account's token). Off removes the feature from Alexa and invalidates every link already handed out. The hub's public HTTPS address must be set.",
+					default: DEFAULT_CONFIG.snapshots
+				}),
 				...this.config.skillMode === "custom" ? [this.field({
 					type: "text",
 					key: "expectedAudience",
@@ -54223,7 +56971,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 					key: "__custom-skill-info",
 					label: "Your skill Lambda",
 					variant: "info",
-					content: "Proactive events (doorbell, motion, battery, device-list updates) are authorised by YOUR skill Lambda: it keeps the \"Send Alexa Events\" LWA client id/secret in SSM Parameter Store and hands this hub short-lived tokens. Nothing to paste here — see the custom-skill setup guide."
+					content: "Proactive events (doorbell, motion, online/offline, device-list updates) are authorised by YOUR skill Lambda: it keeps the \"Send Alexa Events\" LWA client id/secret in SSM Parameter Store and hands this hub short-lived tokens. Nothing to paste here — see the custom-skill setup guide."
 				}] : [{
 					type: "info",
 					key: "__public-skill-info",
@@ -54293,16 +57041,30 @@ var ExportAlexaAddon = class extends BaseAddon {
 					key: "__ingress-token-info",
 					label: "Ingress token",
 					variant: "info",
-					content: "Defense-in-depth shared secret. Copy it from the \"Ingress token\" row in the Exported devices panel (reveal + copy) into your Alexa Lambda's HUB_INGRESS_TOKEN env, then enable \"Require ingress token\" below. Use \"Regenerate token\" to rotate (update the Lambda afterwards)."
+					content: "Defense-in-depth shared secret. Press \"Show ingress token\" to read it (it is never part of a status or settings read), paste it into your Alexa Lambda's HUB_INGRESS_TOKEN env, then enable \"Require ingress token\" below. Use \"Regenerate token\" to rotate (update the Lambda afterwards)."
 				},
 				{
-					type: "button",
+					type: "addon-action-button",
+					addonId: "export-alexa",
+					key: "__reveal-ingress-token",
+					label: "Show ingress token",
+					description: "Administrators only. Shows the current token once, here.",
+					buttonLabel: "Show ingress token",
+					action: "revealIngressToken",
+					variant: "default",
+					successMessage: "Ingress token: {ingressToken}"
+				},
+				{
+					type: "addon-action-button",
+					addonId: "export-alexa",
 					key: "__regenerate-ingress-token",
 					label: "Rotate ingress token",
 					description: "Generate a new ingress token, invalidating the old one. Update your Lambda's HUB_INGRESS_TOKEN afterwards.",
 					buttonLabel: "Regenerate token",
 					action: "regenerateIngressToken",
-					variant: "default"
+					variant: "default",
+					successMessage: "New ingress token: {ingressToken} — paste it into HUB_INGRESS_TOKEN now.",
+					confirmMessage: "Rotate the ingress token? With \"Require ingress token\" on, the Lambda is refused until you update HUB_INGRESS_TOKEN."
 				},
 				this.field({
 					type: "boolean",
@@ -54346,14 +57108,14 @@ var ExportAlexaAddon = class extends BaseAddon {
 		}
 	}
 	async buildDeviceSettingsContribution(deviceId) {
-		if (!await this.isCameraDevice(deviceId)) return null;
+		const kind = await this.exportKindOf(deviceId);
+		if (kind === null) return null;
 		const entry = this.findEntry(deviceId);
 		const settings = entry?.settings ?? DEFAULT_DEVICE_SETTINGS;
 		const enabled = entry !== null;
 		const enabledKey = `alexa:${deviceId}:enabled`;
-		const streamPreferenceKey = `alexa:${deviceId}:streamPreference`;
-		const allowTranscodeKey = `alexa:${deviceId}:allowTranscode`;
 		const linkedCount = this.config.linkedAccounts.length;
+		const statusLabel = enabled ? `Exposed${linkedCount > 0 ? `, ${linkedCount} linked Alexa account(s)` : " (no linked Alexa account yet)"}` : linkedCount > 0 ? `${linkedCount} linked Alexa account(s) — device not exposed` : "Not exposed";
 		return {
 			tabs: [{
 				id: "export",
@@ -54364,7 +57126,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 			sections: [{
 				id: "export-alexa",
 				title: "Alexa Export",
-				description: "Surface this camera to the linked Alexa Smart Home skill.",
+				description: kind === "camera" ? "Surface this camera to the linked Alexa Smart Home skill." : "Surface this device to the linked Alexa Smart Home skill (locks, sensors, switches and lights each become one Alexa device).",
 				tab: "export",
 				columns: 1,
 				order: 20,
@@ -54373,49 +57135,54 @@ var ExportAlexaAddon = class extends BaseAddon {
 						type: "info",
 						key: "__alexa-status",
 						label: "Status",
-						content: enabled ? `Exposed${linkedCount > 0 ? `, ${linkedCount} linked Alexa account(s)` : " (no linked Alexa account yet)"}` : linkedCount > 0 ? `${linkedCount} linked Alexa account(s) — device not exposed` : "Not exposed",
+						content: statusLabel,
 						variant: "info"
 					},
 					{
 						type: "boolean",
 						key: enabledKey,
 						label: "Expose to Alexa",
-						description: "Toggle to mirror this camera onto the Alexa Smart Home skill.",
+						description: "Toggle to mirror this device onto the Alexa Smart Home skill.",
 						style: "switch",
 						value: enabled,
 						immediate: true
 					},
-					{
-						type: "select",
-						key: streamPreferenceKey,
-						label: "Source stream (Alexa / Echo)",
-						description: "Which camstack profile slot the Echo pulls. Auto = the broker picks the slot closest to 720p at session start (the Echo doesn’t adapt mid-session, so pin a specific profile if Auto picks badly on your hardware).",
-						options: STREAM_PREFERENCE_OPTIONS,
-						required: true,
-						value: settings.streamPreference,
-						showWhen: {
-							field: enabledKey,
-							equals: true
-						},
-						immediate: true
-					},
-					{
-						type: "boolean",
-						key: allowTranscodeKey,
-						label: "Allow transcoding for Alexa",
-						description: "Let the hub re-encode this camera for the Echo when no stream is directly usable. Off means only a stream Alexa can take as-is (H.264, 480p-1080p) is offered — cheaper, but a camera that publishes only H.265, or only a small sub-stream, will not be streamable to Alexa at all.",
-						style: "switch",
-						value: settings.allowTranscode !== false,
-						showWhen: {
-							field: enabledKey,
-							equals: true
-						},
-						immediate: true
-					}
+					...kind === "camera" ? this.cameraOnlyExportFields(deviceId, settings, enabledKey) : []
 				]
 			}]
 		};
 	}
+	/** The stream fields of the Export section — a camera's only. */
+	cameraOnlyExportFields(deviceId, settings, enabledKey) {
+		const streamPreferenceKey = `alexa:${deviceId}:streamPreference`;
+		const allowTranscodeKey = `alexa:${deviceId}:allowTranscode`;
+		return [{
+			type: "select",
+			key: streamPreferenceKey,
+			label: "Source stream (Alexa / Echo)",
+			description: "Which camstack profile slot the Echo pulls. Auto = the broker picks the slot closest to 720p at session start (the Echo doesn’t adapt mid-session, so pin a specific profile if Auto picks badly on your hardware).",
+			options: STREAM_PREFERENCE_OPTIONS,
+			required: true,
+			value: settings.streamPreference,
+			showWhen: {
+				field: enabledKey,
+				equals: true
+			},
+			immediate: true
+		}, {
+			type: "boolean",
+			key: allowTranscodeKey,
+			label: "Allow transcoding for Alexa",
+			description: "Let the hub re-encode this camera for the Echo when no stream is directly usable. Off means only a stream Alexa can take as-is (H.264, 480p-1080p) is offered — cheaper, but a camera that publishes only H.265, or only a small sub-stream, will not be streamable to Alexa at all.",
+			style: "switch",
+			value: settings.allowTranscode !== false,
+			showWhen: {
+				field: enabledKey,
+				equals: true
+			},
+			immediate: true
+		}];
+	}
 	/**
 	* Apply a patch produced by the device-details "Export" panel. Flips
 	* the expose/unexpose lifecycle on `enabled` transitions and persists
@@ -54481,13 +57248,20 @@ var ExportAlexaAddon = class extends BaseAddon {
 		}
 		return { success: true };
 	}
-	async isCameraDevice(deviceId) {
+	/**
+	* Which Export section a device gets: the camera one (with stream
+	* settings), the generic one (on/off only — R5, D775), or none. An
+	* unreadable device reads as a camera, as before.
+	*/
+	async exportKindOf(deviceId) {
 		try {
 			const dev = await this.ctx.api.deviceManager.getDevice.query({ deviceId });
-			if (!dev) return true;
-			return dev.type === DeviceType.Camera;
+			if (!dev) return "camera";
+			const type = String(dev.type);
+			if (type === DeviceType.Camera) return "camera";
+			return GENERIC_DEVICE_TYPES.includes(type) ? "generic" : null;
 		} catch {
-			return true;
+			return "camera";
 		}
 	}
 	findEntry(deviceId) {