@camstack/addon-export-alexa 1.2.137 → 1.2.138

package/dist/export-alexa.addon.mjs

@@ -1,5 +1,5 @@
 import * as crypto$1 from "node:crypto";
-import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
+import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import sharp from "sharp";
 //#region ../types/dist/event-category-B_0XEcLF.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
@@ -5372,7 +5372,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BNeXenvr.mjs
+//#region ../types/dist/sleep-B0JG7-_F.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8329,8 +8329,8 @@ function buildAddonRouteProvider(id, routes) {
 			const reply = buildCapturingReply(envelope);
 			const request = {
 				params: {
-					...input.params,
-					...match.params
+					...match.params,
+					...input.params
 				},
 				query: input.query,
 				body: input.body,
@@ -15117,6 +15117,10 @@ var DeviceInfoSchema = object({
 	isCamera: boolean(),
 	/** Current config values — serializable snapshot */
 	config: record(string(), unknown()),
+	/** Paths inside `config` the device's schema declares secret (D783) —
+	*  what the non-admin redaction withholds. Paths, never values. Absent
+	*  when the owning runner has not reported them. */
+	secretConfigPaths: array(string()).optional(),
 	/** Hardware + identity blob (manufacturer / model / firmware / sn /
 	*  uid / mac / …). Populated by drivers; editable via setMetadata. */
 	metadata: record(string(), unknown()).nullable().optional(),
@@ -15322,7 +15326,13 @@ var DeviceRegisterPayloadSchema = object({
 	*  call (workers re-register on init), so probe-driven updates
 	*  (e.g. PTZ flag flipping after the abilities probe) propagate. */
 	features: array(string()).optional(),
-	config: record(string(), unknown())
+	config: record(string(), unknown()),
+	/** Config paths the device's own schema DECLARES secret
+	*  (`.meta({ secret: true })` — dotted, `[]` for array items, e.g.
+	*  `connection.password`). Re-published on every register; the non-admin
+	*  redaction withholds them at any depth (D783). Optional: an older runner
+	*  omits it and the keyword backstop applies. */
+	secretConfigPaths: array(string()).optional()
 });
 var DeviceRemovePayloadSchema = object({ deviceId: number() });
 var DevicePersistConfigPayloadSchema = object({
@@ -16981,7 +16991,14 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		icon: string().optional(),
 		/** Addon-owned HTTP route the button navigates to (GET). */
 		startUrl: string(),
-		stage: LoginStageEnum
+		stage: LoginStageEnum,
+		/**
+		* The provider names an external identity a signed-in user can link to
+		* their own account (D782): `auth.listLinkableProviders` /
+		* `beginExternalLink` offer exactly the redirect methods that set this,
+		* whatever their id. Absent / false — a login button only (magic-link).
+		*/
+		linkable: boolean().optional()
 	}),
 	object({
 		kind: literal("widget"),
@@ -21781,7 +21798,7 @@ var TrainingExportSummarySchema = object({
 	truncated: boolean(),
 	devices: array(TrainingExportDeviceTotalsSchema).readonly()
 });
-var TrackSchema = object({
+var TrackSchema$1 = object({
 	trackId: string(),
 	deviceId: number(),
 	className: string(),
@@ -22394,7 +22411,13 @@ var RetrainFrameSchema = object({
 	sizeBytes: number().int(),
 	width: number().int(),
 	height: number().int(),
-	copiedAt: number()
+	copiedAt: number(),
+	/** When the CAMERA captured the frame. Absent on a copy taken before D785. */
+	capturedAt: number().optional(),
+	/** The operator's "every subject in this frame is boxed". Detector
+	*  evaluation keeps only complete frames: an unboxed subject would count as
+	*  a false positive. */
+	complete: boolean()
 });
 /** Why a copy-on-select could not be honoured — named, never a silent skip. */
 var RetrainCopyRefusalSchema = _enum([
@@ -22415,6 +22438,51 @@ var RetrainFrameListSchema = object({
 	/** What the page pre-selects — the native key frame when one survives. */
 	autoPickMediaId: number().int().optional()
 });
+/**
+* Which frames an annotated export carries. Every field narrows; an empty
+* filter is every annotated copy. A dataset VERSION is a frozen `frameIds`
+* list owned by whoever trains (the training orchestrator), so `frameIds` is
+* the primitive a version export uses; `batchId` re-selects what an earlier
+* export carried (`exportedInBatch`).
+*/
+var RetrainExportFilterSchema = object({
+	deviceIds: array(number()).optional(),
+	frameIds: array(string()).max(2e4).optional(),
+	batchId: string().optional(),
+	/** Only frames the operator marked complete (all subjects boxed). */
+	completeOnly: boolean().optional()
+});
+/**
+* `frames`: the full frame copies, boxes in `annotations.json`.
+* `crops`: additionally one JPEG per subject, cut with the runtime detail-crop
+* convention — the classifier layout.
+*/
+var RetrainExportLayoutSchema = _enum(["frames", "crops"]);
+/**
+* Where `writeRetrainArchive` streams the tar: one HTTP request whose body is
+* the archive, sent chunk by chunk. Covers a presigned PUT and a provider
+* addon's data-plane upload route alike. Headers are sent verbatim and never
+* logged.
+*/
+var RetrainArchiveTargetSchema = object({
+	kind: literal("http"),
+	method: _enum(["PUT", "POST"]),
+	url: string().url(),
+	headers: record(string(), string()).optional()
+});
+var RetrainArchiveResultSchema = object({
+	batchId: string(),
+	frames: number().int(),
+	crops: number().int(),
+	annotations: number().int(),
+	/** Frames planned but not shipped (unreadable copy, path too long). */
+	missing: number().int(),
+	bytes: number().int(),
+	/** sha256 of the exact bytes sent. */
+	sha256: string(),
+	/** The target's HTTP status. */
+	status: number().int()
+});
 /** What the operator asked the assist to look for. */
 var RetrainAssistSubjectSchema = discriminatedUnion("kind", [object({
 	kind: literal("package"),
@@ -22508,7 +22576,7 @@ var RecentTracksQueryInput = object({
 });
 var RecentTracksPageSchema = object({
 	/** Merged page, ordered by (`lastSeen` DESC, `trackId` DESC). */
-	tracks: array(TrackSchema).readonly(),
+	tracks: array(TrackSchema$1).readonly(),
 	/** Cursor for the next page, or null when this page is the last. */
 	nextCursor: string().nullable()
 });
@@ -22982,10 +23050,10 @@ var LtsBucketSchema = object({
 	min: number(),
 	max: number()
 });
-DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).readonly()), method(object({
+DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema$1).readonly()), method(object({
 	deviceId: number(),
 	trackId: string()
-}), TrackSchema.nullable()), method(object({
+}), TrackSchema$1.nullable()), method(object({
 	deviceId: number(),
 	since: number().optional(),
 	until: number().optional(),
@@ -23018,7 +23086,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	classes: array(string()).optional(),
 	/** See {@link ExcludeSourcesDoc}. */
 	excludeSources: array(TrackSourceSchema).optional()
-}), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(object({ deviceId: number() }), _void(), {
+}), array(TrackSchema$1).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number() }), array(EventKindDescriptorSchema).readonly()), method(object({ deviceIds: array(number()).min(1).max(200) }), array(EventKindsForDeviceSchema).readonly()), method(object({
@@ -23209,9 +23277,25 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), RetrainTransitionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
+}), method(RetrainExportFilterSchema.extend({ layout: RetrainExportLayoutSchema.optional() }), object({ url: string() }), {
 	kind: "query",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	frameId: string(),
+	complete: boolean()
+}), RetrainFrameSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	filter: RetrainExportFilterSchema,
+	layout: RetrainExportLayoutSchema,
+	target: RetrainArchiveTargetSchema
+}), RetrainArchiveResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 60 * 6e4
 }), method(object({
 	/** Which of the three event tables owns the row. */
 	ownerType: EventOwnerTypeSchema,
@@ -26327,7 +26411,7 @@ method(SendEmailInputSchema, SendEmailResultSchema, {
 * the device-native provider (onboard capture) or from the stream-broker
 * prebuffer fallback.
 */
-var SnapshotImageSchema$1 = object({
+var SnapshotImageSchema$2 = object({
 	base64: string(),
 	contentType: string()
 });
@@ -26359,7 +26443,7 @@ DeviceType.Camera, method(object({
 	* correct answer: stale but honest beats woken.
 	*/
 	force: boolean().optional()
-}), SnapshotImageSchema$1.nullable()), method(object({ deviceId: number() }), _void(), {
+}), SnapshotImageSchema$2.nullable()), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), systemMethod(object({ deviceIds: array(number()).min(1).max(200) }), array(object({
@@ -26501,7 +26585,19 @@ var SsoBridgeClaimsSchema = object({
 	* editing a descriptor must not retroactively extend or shorten a link the
 	* operator already consented to.
 	*/
-	refreshTtl: union([number().int().positive(), literal("never")]).optional()
+	refreshTtl: union([number().int().positive(), literal("never")]).optional(),
+	/**
+	* Opaque handle of a hub-side LINK intent (D782). Set by an OIDC callback
+	* that was started from a signed-in user's "Link" button: the finish then
+	* links this identity to the intent's user instead of signing anyone in.
+	* The handle carries no user id — the hub resolves it, single-use.
+	*/
+	linkIntent: string().optional(),
+	/**
+	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
+	* subject is unique only per issuer, so a link is bound to it.
+	*/
+	issuer: string().optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
@@ -36521,6 +36617,32 @@ var TotpStatusSchema = object({
 	/** Null when no row exists OR the row is still pending confirmation. */
 	confirmedAt: number().nullable()
 });
+/**
+* user-management — singleton capability for user accounts, API keys,
+* and scoped tokens.
+*
+* v2 model: every method gated by `auth: 'admin'`. Admin-only delegation
+* — the subset check on `setUserScopes` / `createScopedToken` is moot
+* because non-admins never reach these. If/when we open non-admin
+* delegation, structural caller-scope subset check goes inside the
+* provider.
+*/
+var ExternalIdentitySchema = object({
+	/** Login-method id of the provider instance, e.g. `auth-oidc/authentik`. */
+	provider: string(),
+	/** The IdP's stable subject (`sub`) for this account. */
+	subject: string(),
+	/** The verified `iss` of the IdP the identity was linked under — `sub` is unique only per issuer. */
+	issuer: string(),
+	userId: string(),
+	/** What the IdP called the account at link time (username / email) — display only. */
+	label: string().optional(),
+	linkedAt: number()
+});
+var ExternalIdentityKeySchema = object({
+	provider: string().min(1),
+	subject: string().min(1)
+});
 method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserInputSchema, UserSummarySchema, {
 	kind: "mutation",
 	auth: "admin",
@@ -36634,7 +36756,22 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	userId: string(),
 	username: string(),
 	scopes: array(TokenScopeSchema)
-}).nullable(), { access: "view" }), method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }), method(object({ id: string() }), object({ success: boolean() }), {
+}).nullable(), { access: "view" }), method(object({ userId: string() }), array(ExternalIdentitySchema), { auth: "admin" }), method(ExternalIdentityKeySchema, object({
+	userId: string(),
+	issuer: string()
+}).nullable(), { auth: "admin" }), method(ExternalIdentityKeySchema.extend({
+	userId: string(),
+	issuer: string().min(1),
+	label: string().optional()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "create"
+}), method(ExternalIdentityKeySchema.extend({ userId: string() }), object({ success: boolean() }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "delete"
+}), method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }), method(object({ id: string() }), object({ success: boolean() }), {
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
@@ -41440,6 +41577,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.setRetrainFrameComplete": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -41476,6 +41619,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.writeRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineExecutor.cacheFrameInPool": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -43828,18 +43977,36 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userManagement.findUserByExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.getTotpStatus": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.linkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.listExternalIdentities": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.listOauthSessions": {
 		capName: "user-management",
 		capScope: "system",
@@ -43918,6 +44085,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userManagement.unlinkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"userManagement.updateUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -47257,6 +47430,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.setRetrainFrameComplete": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.setTrackFlags": [{
 		name: "deviceId",
 		form: "single",
@@ -49382,38 +49560,63 @@ var MB = 1024 * 1024;
 /**
 * Alexa Smart Home export — customActions catalog.
 *
-* Exposes addon operations the settings form drives via
-* `api.addons.custom.{query,mutate}({ addonId, action, input })`:
+* The settings page drives these through
+* `api.addons.custom.{query,mutate}({ addonId, action, input })`: every action
+* button there is an `addon-action-button`, which shows the result (or the
+* error) under the button, and the external-address picker is an
+* `addon-action-select` over `listExternalAddresses`.
 *
-*   redetectHubUrl — force-refresh the hub's public HTTPS URL from the
-*                    connected `network-access` provider, clobbering any
-*                    manual override. Backs the "Re-detect public hub
-*                    URL" `type: 'button'` field on the settings form;
-*                    the form-builder's button-field dispatch routes
-*                    here through the generic customAction channel.
-*                    Same detection logic as the existing
-*                    `/addon/export-alexa/admin/redetect-hub-url` route.
+* Every action is `auth: 'admin'` (S2). The framework default is `protected` —
+* any authenticated user — and at that level a viewer could rotate the token
+* and read the new one in the response, unlink the Amazon account, or delete
+* endpoints from it.
 */
+/** tRPC/superjson elides empty-object inputs on the wire — accept both `{}`
+*  and `undefined` so the form-builder doesn't have to know. */
+var NoInput = object({}).optional();
 var exportAlexaActions = defineCustomActions({
-	redetectHubUrl: customAction(object({}).optional(), object({ publicHubUrl: string() }), {
-		kind: "mutation",
-		auth: "admin"
-	}),
-	regenerateIngressToken: customAction(object({}).optional(), object({ ingressToken: string() }), {
+	/**
+	* The external addresses the connected `network-access` providers report
+	* now, read live for the "External address" picker, plus the saved choice
+	* when it is not among them (so it is never silently dropped from view).
+	*/
+	listExternalAddresses: customAction(NoInput, object({ addresses: array(object({
+		value: string(),
+		label: string()
+	})).readonly() }), { auth: "admin" }),
+	regenerateIngressToken: customAction(NoInput, object({ ingressToken: string() }), {
 		kind: "mutation",
 		auth: "admin"
 	}),
-	resyncDiscovery: customAction(object({}).optional(), object({
+	/**
+	* Re-sync: re-send every exposed device to every linked account, and delete
+	* from Alexa the devices still tracked but no longer exposed (an unexpose
+	* whose DeleteReport failed). Throws when there is no linked account with a
+	* push grant, so the button says why nothing happened.
+	*/
+	resyncDiscovery: customAction(NoInput, object({
+		deviceCount: number(),
 		endpointCount: number(),
-		accountCount: number()
+		accountCount: number(),
+		removedEndpointCount: number(),
+		retainedEndpointCount: number(),
+		failedCount: number()
 	}), {
 		kind: "mutation",
 		auth: "admin"
 	}),
-	purgeStaleEndpoints: customAction(object({}).optional(), object({
+	/**
+	* Send `Alexa.Discovery/DeleteReport` for endpoint ids the operator types in
+	* the button's prompt — for a device Alexa still shows that this hub no
+	* longer tracks. The ids are an argument, never a saved setting. Throws
+	* unless every linked account accepted the delete; only then does the local
+	* tracking forget those ids.
+	*/
+	removeAlexaEndpoints: customAction(object({ endpointIds: string() }), object({
 		requested: number(),
 		accountCount: number(),
-		attemptedAccounts: number()
+		deliveredAccounts: number(),
+		failedAccounts: number()
 	}), {
 		kind: "mutation",
 		auth: "admin"
@@ -49431,7 +49634,7 @@ var exportAlexaActions = defineCustomActions({
 	* cleared. Revoking alone leaves the gateway pushing motion and doorbell
 	* events at the old Amazon account until Amazon happens to answer 403.
 	*/
-	unlinkAlexaAccounts: customAction(object({}).optional(), object({
+	unlinkAlexaAccounts: customAction(NoInput, object({
 		revokedSessions: number(),
 		removedAccounts: number()
 	}), {
@@ -49439,20 +49642,21 @@ var exportAlexaActions = defineCustomActions({
 		auth: "admin"
 	}),
 	/**
-	* Swap the per-link credential this hub presents to the skill Lambda's
-	* token broker (D753) for a fresh one; the old one dies at once. Rotation
-	* also happens implicitly on every re-link.
-	*/
-	/**
 	* The ingress token, in clear, for an administrator who asked for it. The
 	* one read surface that returns it: `deviceExport.getStatus` and the
 	* settings form carry only a mask.
 	*/
-	revealIngressToken: customAction(object({}).optional(), object({ ingressToken: string() }), {
+	revealIngressToken: customAction(NoInput, object({ ingressToken: string() }), {
 		kind: "mutation",
 		auth: "admin"
 	}),
-	rotateBrokerCredential: customAction(object({}).optional(), object({
+	/**
+	* Swap the per-link credential this hub presents to the skill Lambda's
+	* token broker (D753) for a fresh one; the old one dies at once. Rotation
+	* also happens implicitly on every re-link. Throws when no link is held at
+	* a broker.
+	*/
+	rotateBrokerCredential: customAction(NoInput, object({
 		rotated: number(),
 		failed: number()
 	}), {
@@ -49737,7 +49941,10 @@ var DirectiveHeaderSchema = object({
 	name: string(),
 	payloadVersion: string(),
 	messageId: string(),
-	correlationToken: string().optional()
+	correlationToken: string().optional(),
+	/** Instanced interfaces' directives carry it (`Alexa.DataController`, D779);
+	*  the response echoes it. */
+	instance: string().optional()
 });
 /** Scope carries the bearer token Alexa minted via our OAuth provider. */
 var BearerScopeSchema = object({
@@ -50478,6 +50685,60 @@ var MOTION_SENSOR = {
 		retrievable: true
 	}
 };
+/** The only classes `Alexa.SmartVision.ObjectDetectionSensor` knows (Amazon:
+*  `imageNetClass` is `person` or `package`; anything else is dropped). */
+var SMART_VISION_CLASSES$1 = ["person", "package"];
+/** `Alexa.DataController` instance that serves the camera's detection history. */
+var SMART_VISION_DATA_INSTANCE = "Camera.SmartVisionData";
+/**
+* `Alexa.SmartVision.ObjectDetectionSensor` v1.0 on the CAMERA endpoint (R4,
+* D779) — the per-camera event history and the "person detected"
+* announcements in the Alexa app. Amazon lists it for en-US only; it is built
+* here as an experiment to find out what an it-IT account does with it.
+*
+* The shape is Amazon's discovery example to the letter, minus the empty
+* `properties: {}` (the interface defines no reportable property; omission is
+* how this file expresses that — see `DOORBELL_EVENT_SOURCE`). No
+* `isAvailable` / `unavailabilityReason`: both are optional and only describe a
+* subscription-gated class. An earlier declaration that ALSO claimed a
+* retrievable `objectDetectionClasses` property (never answered by ReportState)
+* made Alexa reject the camera and every child — so: no properties at all.
+*
+* `classes` is `person`, plus `package` only on a camera whose pipeline can
+* produce package events (the same answer the detection sensors use).
+*/
+function smartVisionObjectDetectionSensor(classes) {
+	return {
+		type: "AlexaInterface",
+		interface: "Alexa.SmartVision.ObjectDetectionSensor",
+		version: "1.0",
+		configuration: { objectDetectionConfiguration: classes.map((imageNetClass) => ({ imageNetClass })) }
+	};
+}
+/**
+* `Alexa.DataController` v1.0, instance {@link SMART_VISION_DATA_INSTANCE} —
+* how the Alexa app reads the camera's detection history back
+* (`ReportData` / `DeleteData`, `handlers/data-controller.ts`). Amazon's
+* ObjectDetectionSensor example declares it beside the sensor; the instance
+* name is the one that example uses.
+*/
+var SMART_VISION_DATA_CONTROLLER = {
+	type: "AlexaInterface",
+	interface: "Alexa.DataController",
+	instance: SMART_VISION_DATA_INSTANCE,
+	version: "1.0",
+	configuration: {
+		targetCapability: {
+			name: "Alexa.SmartVision.ObjectDetectionSensor",
+			version: "1.0"
+		},
+		dataRetrievalSchema: {
+			type: "JSON",
+			schema: "SmartVisionData"
+		},
+		supportedAccess: ["BY_IDENTIFIER", "BY_TIMESTAMP_RANGE"]
+	}
+};
 /**
 * `Alexa.SmartVision.SnapshotProvider` v1.1 — the camera's still in the Alexa
 * app (R2, D773). Available in it-IT and en-GB, unlike object detection.
@@ -50701,6 +50962,11 @@ function buildParentCameraEndpoint(input) {
 	];
 	if (input.isDoorbell) capabilities.push(DOORBELL_EVENT_SOURCE);
 	if (input.hasMotion) capabilities.push(MOTION_SENSOR);
+	const visionClasses = input.objectDetectionClasses ?? [];
+	if (visionClasses.length > 0) {
+		capabilities.push(smartVisionObjectDetectionSensor(visionClasses));
+		capabilities.push(SMART_VISION_DATA_CONTROLLER);
+	}
 	if (input.snapshotProvider === true) capabilities.push(SMART_VISION_SNAPSHOT_PROVIDER);
 	const presetNames = distinctPresetNames(input.ptzPresetNames);
 	if (presetNames.length >= MIN_MODE_CONTROLLER_MODES) capabilities.push(ptzPresetModeController(presetNames));
@@ -50998,6 +51264,7 @@ async function buildEndpointsForExposedDevice(deviceId, deps) {
 		});
 		return [];
 	});
+	const objectDetectionClasses = deps.objectDetection === void 0 ? [] : await deps.objectDetection(parentInfo.id);
 	const out = [];
 	out.push(buildParentCameraEndpoint({
 		deviceId: parentInfo.id,
@@ -51008,7 +51275,8 @@ async function buildEndpointsForExposedDevice(deviceId, deps) {
 		hasMotion,
 		ptzPresetNames,
 		hasPtz,
-		snapshotProvider: deps.snapshots === true
+		snapshotProvider: deps.snapshots === true,
+		objectDetectionClasses
 	}));
 	if (deps.detectionClasses !== void 0) {
 		const classes = await deps.detectionClasses(parentInfo.id);
@@ -51330,8 +51598,13 @@ var ALLOWED_INTERFACE_VERSIONS = {
 	"Alexa.SecurityPanelController": "3",
 	"Alexa.LockController": "3",
 	"Alexa.SmartVision.SnapshotProvider": "1.1",
-	"Alexa.SmartVision.ObjectDetectionSensor": "1.0"
+	"Alexa.SmartVision.ObjectDetectionSensor": "1.0",
+	"Alexa.DataController": "1.0"
 };
+/** `imageNetClass` values Amazon accepts (alexa-smartvision-objectdetectionsensor). */
+var SMART_VISION_CLASSES = new Set(["person", "package"]);
+/** `supportedAccess` values Amazon documents (alexa-datacontroller). */
+var DATA_CONTROLLER_ACCESS = new Set(["BY_IDENTIFIER", "BY_TIMESTAMP_RANGE"]);
 /** Interfaces that need an `instance`. */
 var INSTANCED = new Set([
 	"Alexa.ModeController",
@@ -51378,7 +51651,37 @@ function capabilityKey$1(c) {
 function friendlyTexts(c) {
 	return (c.capabilityResources?.friendlyNames ?? []).map((n) => n.value.text);
 }
-function validateCapability(endpointId, c, out) {
+function field(c, key) {
+	return c.configuration?.[key];
+}
+function objectField(value, key) {
+	return typeof value === "object" && value !== null ? Reflect.get(value, key) : void 0;
+}
+/** ObjectDetectionSensor (D779): a non-empty, duplicate-free list of the two
+*  classes Amazon knows, and no reportable properties (it defines none). */
+function validateObjectDetection(c, push) {
+	const list = field(c, "objectDetectionConfiguration");
+	if (!Array.isArray(list) || list.length === 0) {
+		push("configuration.objectDetectionConfiguration must list at least one class");
+		return;
+	}
+	const classes = list.map((entry) => objectField(entry, "imageNetClass"));
+	for (const cls of classes) if (typeof cls !== "string" || !SMART_VISION_CLASSES.has(cls)) push(`imageNetClass ${String(cls)} is not person or package`);
+	if (new Set(classes).size !== classes.length) push("imageNetClass listed twice");
+	if (c.properties !== void 0) push("declares properties; the interface defines none");
+}
+/** DataController (D779): an instance, a schema, a documented access mode, and
+*  a target capability the SAME endpoint declares. */
+function validateDataController(c, declared, push) {
+	if (c.instance === void 0 || c.instance.length === 0) push("instance is required");
+	const schema = field(c, "dataRetrievalSchema");
+	if (typeof objectField(schema, "type") !== "string" || typeof objectField(schema, "schema") !== "string") push("configuration.dataRetrievalSchema {type, schema} is required");
+	const target = objectField(field(c, "targetCapability"), "name");
+	if (typeof target !== "string" || !declared.has(target)) push("configuration.targetCapability must name an interface this endpoint declares");
+	const access = field(c, "supportedAccess");
+	if (!Array.isArray(access) || access.length === 0 || access.some((a) => typeof a !== "string" || !DATA_CONTROLLER_ACCESS.has(a))) push("configuration.supportedAccess must list BY_IDENTIFIER and/or BY_TIMESTAMP_RANGE");
+}
+function validateCapability(endpointId, c, out, declared) {
 	const push = (rule) => {
 		out.push({
 			endpointId,
@@ -51407,6 +51710,8 @@ function validateCapability(endpointId, c, out) {
 			if (new Set(values).size !== values.length) push("supportedModes values must be unique");
 		}
 	}
+	if (c.interface === "Alexa.SmartVision.ObjectDetectionSensor") validateObjectDetection(c, push);
+	if (c.interface === "Alexa.DataController") validateDataController(c, declared, push);
 	if (c.interface === "Alexa.SmartVision.SnapshotProvider") {
 		if (typeof c.configuration?.["isAvailable"] !== "boolean") push("configuration.isAvailable is required");
 	}
@@ -51439,7 +51744,7 @@ function validateAlexaEndpoint(endpoint) {
 	const interfaces = new Set(caps.map((c) => c.interface));
 	for (const needs of NEEDS_ENDPOINT_HEALTH) if (interfaces.has(needs) && !interfaces.has("Alexa.EndpointHealth")) push(`${needs} requires Alexa.EndpointHealth`);
 	if (interfaces.has("Alexa.RTCSessionController") && endpoint.displayCategories[0] !== "CAMERA") push("an RTCSessionController endpoint must list CAMERA first");
-	for (const c of caps) validateCapability(id, c, out);
+	for (const c of caps) validateCapability(id, c, out, interfaces);
 	return out;
 }
 /** Split endpoints into the valid ones and the violations of the rest. */
@@ -51737,6 +52042,543 @@ async function handleInitializeCameraStreams(header, endpointRaw, payloadRaw, de
 	} };
 }
 //#endregion
+//#region src/detection-sensors/detection-tracker.ts
+/**
+* Which detection classes are currently present on each camera (R1, D772).
+*
+* Fed by the pipeline's track lifecycle (`PipelineAnalyticsTrackLifecycle`,
+* `data.deviceId` — these events carry no device on their `source`) and by
+* package deliveries. A class is present while at least one of ITS tracks is
+* open: the set is per `(camera, class)` and per `trackId`, so the end of one
+* person's track does not clear "Person" while another person is still in
+* view (the HA export's per-event flip has exactly that bug).
+*
+* Events are telemetry and may be dropped (D8), and the pipeline does not
+* promise an `end` for every `start` (a zero-media false birth or a discarded
+* stale track ends silently). So {@link reconcile} replaces a camera's sets
+* with an authoritative read of its ACTIVE tracks; a sensor can therefore never
+* stay "detected" past one reconcile after its last track closed. A read that
+* fails is not passed in — the sets then stay as they were.
+*
+* Emits a transition per `(camera, class)` only when presence changes; the
+* Alexa-facing hold (≥ 30 s DETECTED before NOT_DETECTED) is the gateway's.
+*/
+/** A package delivery is an instant, not a track: it is present this long. */
+var PACKAGE_PULSE_MS = 1e3;
+/** The detection class a pipeline class name belongs to, or null. Pipeline
+*  classes are already macros; a raw COCO label is mapped the same way the
+*  executor maps it. */
+function detectionClassOf(className) {
+	if (className === void 0) return null;
+	const lower = className.toLowerCase();
+	const isClass = (v) => DETECTION_SENSOR_CLASSES.includes(v);
+	if (isClass(lower)) return lower;
+	const mapped = COCO_TO_MACRO.mapping[lower];
+	return mapped !== void 0 && isClass(mapped) ? mapped : null;
+}
+var DetectionTracker = class {
+	onTransition;
+	/** `${deviceId}|${class}` → open track ids. */
+	open = /* @__PURE__ */ new Map();
+	pulseTimers = /* @__PURE__ */ new Set();
+	constructor(onTransition) {
+		this.onTransition = onTransition;
+	}
+	onTrackLifecycle(event) {
+		const cls = detectionClassOf(event.bestClassName ?? event.classes?.[0]);
+		if (cls === null) return;
+		if (event.phase === "end") {
+			this.remove(event.deviceId, cls, event.trackId);
+			for (const other of DETECTION_SENSOR_CLASSES) if (other !== cls) this.remove(event.deviceId, other, event.trackId);
+			return;
+		}
+		this.add(event.deviceId, cls, event.trackId);
+	}
+	/** A package was delivered: "Package" is detected, as a pulse. */
+	onPackageDelivered(deviceId, entryId) {
+		const id = `package:${entryId}`;
+		this.add(deviceId, "package", id);
+		const timer = setTimeout(() => {
+			this.pulseTimers.delete(timer);
+			this.remove(deviceId, "package", id);
+		}, PACKAGE_PULSE_MS);
+		timer.unref?.();
+		this.pulseTimers.add(timer);
+	}
+	/** Replace a camera's open tracks with what the pipeline says is ACTIVE. */
+	reconcile(deviceId, active) {
+		const truth = /* @__PURE__ */ new Map();
+		for (const track of active) {
+			const cls = detectionClassOf(track.className);
+			if (cls === null) continue;
+			const set = truth.get(cls) ?? /* @__PURE__ */ new Set();
+			set.add(track.trackId);
+			truth.set(cls, set);
+		}
+		for (const cls of DETECTION_SENSOR_CLASSES) {
+			const key = `${deviceId}|${cls}`;
+			const before = this.open.get(key) ?? /* @__PURE__ */ new Set();
+			const after = truth.get(cls) ?? /* @__PURE__ */ new Set();
+			for (const id of before) if (id.startsWith("package:")) after.add(id);
+			this.replace(deviceId, cls, before, after);
+		}
+	}
+	/** Cameras with at least one class present — the ones worth reconciling. */
+	camerasWithPresence() {
+		const out = /* @__PURE__ */ new Set();
+		for (const [key, set] of this.open) if (set.size > 0) out.add(Number(key.split("|")[0]));
+		return [...out];
+	}
+	isPresent(deviceId, cls) {
+		return (this.open.get(`${deviceId}|${cls}`)?.size ?? 0) > 0;
+	}
+	clear() {
+		this.open.clear();
+		for (const t of this.pulseTimers) clearTimeout(t);
+		this.pulseTimers.clear();
+	}
+	add(deviceId, cls, id) {
+		const key = `${deviceId}|${cls}`;
+		const set = this.open.get(key) ?? /* @__PURE__ */ new Set();
+		const was = set.size > 0;
+		set.add(id);
+		this.open.set(key, set);
+		if (!was) this.onTransition(deviceId, cls, true);
+	}
+	remove(deviceId, cls, id) {
+		const set = this.open.get(`${deviceId}|${cls}`);
+		if (set === void 0 || !set.delete(id)) return;
+		if (set.size === 0) this.onTransition(deviceId, cls, false);
+	}
+	replace(deviceId, cls, before, after) {
+		this.open.set(`${deviceId}|${cls}`, after);
+		if (before.size > 0 && after.size === 0) this.onTransition(deviceId, cls, false);
+		else if (before.size === 0 && after.size > 0) this.onTransition(deviceId, cls, true);
+	}
+};
+//#endregion
+//#region src/vision/vision-ids.ts
+/**
+* The identifiers an `ObjectDetection` event and a `DataReport` item carry
+* (R4, D779).
+*
+*  - `objectIdentifier`: "a UUID identifying a specific physical object" — one
+*    per pipeline track. A UUIDv5 of `<deviceId>:<trackId>` under this hub's
+*    namespace, so it is stable for the track's life and across restarts.
+*  - `eventIdentifier`: Amazon requires a version-4 UUID per event in the
+*    history. This skill posts ONE event per track, so the event id is derived
+*    from the track too — a v4-shaped UUID whose 122 "random" bits are a
+*    SHA-256 of the hub namespace and the track. Deriving it (instead of
+*    `randomUUID()`) is what lets the history (`ReportData` by time range)
+*    hand Alexa the SAME id the live event carried, without a lookup table
+*    that would have to outlive the tracks it describes.
+*
+* The hub namespace is a random UUID generated once and stored hidden in the
+* addon settings, so two hubs never mint the same ids for the same track id.
+*/
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function uuidBytes(uuid) {
+	if (!UUID.test(uuid)) throw new Error(`not a UUID: ${uuid}`);
+	return Buffer.from(uuid.replaceAll("-", ""), "hex");
+}
+function formatUuid(bytes) {
+	const hex = bytes.subarray(0, 16).toString("hex");
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+function stamp$1(bytes, version) {
+	const out = Buffer.from(bytes.subarray(0, 16));
+	out[6] = (out[6] ?? 0) & 15 | version << 4;
+	out[8] = (out[8] ?? 0) & 63 | 128;
+	return out;
+}
+/** RFC 4122 UUIDv5 (SHA-1, name-based). */
+function uuidV5(namespace, name) {
+	return formatUuid(stamp$1(createHash("sha1").update(uuidBytes(namespace)).update(Buffer.from(name, "utf8")).digest(), 5));
+}
+/** A version-4-formatted UUID whose bits are a hash — see the file header. */
+function hashedUuidV4(namespace, name) {
+	return formatUuid(stamp$1(createHash("sha256").update(uuidBytes(namespace)).update(name, "utf8").digest(), 4));
+}
+function trackName(deviceId, trackId) {
+	return `${deviceId}:${trackId}`;
+}
+function objectIdentifierFor(namespace, deviceId, trackId) {
+	return uuidV5(namespace, trackName(deviceId, trackId));
+}
+/** One event per track AND class: a track re-classified person → package is a
+*  second event about the same object. */
+function eventIdentifierFor(namespace, deviceId, trackId, imageNetClass) {
+	return hashedUuidV4(namespace, `event|${trackName(deviceId, trackId)}|${imageNetClass}`);
+}
+//#endregion
+//#region src/vision/vision-state.ts
+/**
+* Per-camera object-detection state the Alexa side owns (R4, D779), in this
+* addon's per-device store (`<addonId>:addon-devices`, key
+* {@link VISION_STATE_KEY}):
+*
+*  - `classes` — what the user last chose in the Alexa app
+*    (`SetObjectDetectionClasses`). Absent = never told = every declared class.
+*  - `index` — eventIdentifier → track, for `ReportData` BY_IDENTIFIER. Ids are
+*    derived from the track (`vision-ids.ts`), so the index only has to answer
+*    the reverse direction; bounded to the newest {@link MAX_INDEX} entries.
+*  - `hidden` — events `DeleteData` removed. Hidden from Alexa ONLY: deleting
+*    CamStack footage is not something a voice assistant may do. Bounded.
+*
+* Reads are cached per camera; writes are serialized per camera (one
+* read-modify-write at a time), the same shape as `DetectionClassSource`.
+*/
+var VISION_STATE_KEY = "alexaVision";
+var IndexEntrySchema = object({
+	/** eventIdentifier */
+	e: string(),
+	/** trackId */
+	t: string(),
+	/** imageNetClass */
+	c: _enum(SMART_VISION_CLASSES$1),
+	/** ms epoch of the detection */
+	at: number()
+});
+var VisionStateSchema = object({
+	classes: array(_enum(SMART_VISION_CLASSES$1)).optional(),
+	index: array(IndexEntrySchema).default([]),
+	hidden: array(string()).default([])
+});
+var EMPTY = {
+	index: [],
+	hidden: []
+};
+function parseVisionState(store) {
+	const parsed = VisionStateSchema.safeParse(store[VISION_STATE_KEY]);
+	return parsed.success ? parsed.data : EMPTY;
+}
+var VisionStateStore = class {
+	deps;
+	cache = /* @__PURE__ */ new Map();
+	chains = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	async get(deviceId) {
+		const cached = this.cache.get(deviceId);
+		if (cached !== void 0) return cached;
+		const state = parseVisionState(await this.deps.read(deviceId));
+		this.cache.set(deviceId, state);
+		return state;
+	}
+	/** The user's class choice from the Alexa app. */
+	setClasses(deviceId, classes) {
+		return this.update(deviceId, (s) => ({
+			...s,
+			classes: [...classes]
+		}));
+	}
+	/** Record events Alexa was (or is about to be) told about. Known ids are
+	*  left alone, so re-reading the history costs no write. */
+	async remember(deviceId, entries) {
+		const known = new Set((await this.get(deviceId)).index.map((e) => e.e));
+		const fresh = entries.filter((e) => !known.has(e.e));
+		if (fresh.length === 0) return;
+		await this.update(deviceId, (s) => {
+			const merged = [...s.index.filter((e) => !fresh.some((f) => f.e === e.e)), ...fresh];
+			merged.sort((a, b) => a.at - b.at);
+			return {
+				...s,
+				index: merged.slice(-300)
+			};
+		});
+	}
+	async lookup(deviceId, eventIdentifier) {
+		return (await this.get(deviceId)).index.find((e) => e.e === eventIdentifier) ?? null;
+	}
+	hide(deviceId, eventIdentifiers) {
+		return this.update(deviceId, (s) => {
+			const hidden = [...s.hidden.filter((h) => !eventIdentifiers.includes(h)), ...eventIdentifiers];
+			return {
+				...s,
+				hidden: hidden.slice(-1e3)
+			};
+		});
+	}
+	/** Forget the cached copy (tests; a store written behind our back). */
+	invalidate(deviceId) {
+		this.cache.delete(deviceId);
+	}
+	update(deviceId, fn) {
+		const run = (this.chains.get(deviceId) ?? Promise.resolve()).then(async () => {
+			const next = fn(await this.get(deviceId));
+			await this.deps.write(deviceId, { [VISION_STATE_KEY]: next });
+			this.cache.set(deviceId, next);
+		});
+		this.chains.set(deviceId, run.catch(() => void 0));
+		return run;
+	}
+};
+/**
+* The classes a camera reports to Alexa: the ones it declares (`person`, plus
+* `package` where the pipeline produces it) that the user has not turned off
+* in the Alexa app.
+*/
+function reportableVisionClasses(declared, state) {
+	const chosen = state.classes;
+	return declared.filter((c) => chosen === void 0 || chosen.includes(c));
+}
+/** Rows read per round while filling a page, and rounds per page. */
+var FETCH_ROWS = 50;
+var MAX_ROUNDS = 5;
+/** Rows a time-range DeleteData hides at most. */
+var MAX_DELETE_ROWS = 500;
+var QuerySchema = object({
+	ids: array(string()).max(10).optional(),
+	fromTime: string().optional(),
+	toTime: string().optional()
+});
+var ReportDataPayloadSchema = object({
+	queryType: _enum([
+		"QUERY_BY_IDENTIFIER",
+		"QUERY_BY_TIMESTAMP_RANGE",
+		"QUERY_ALL"
+	]),
+	query: QuerySchema.optional(),
+	maxResults: number().int().optional(),
+	nextToken: string().optional()
+});
+var DeleteDataPayloadSchema = ReportDataPayloadSchema.omit({
+	maxResults: true,
+	nextToken: true
+});
+var SetClassesPayloadSchema = object({ objectDetectionClasses: array(object({ imageNetClass: string() })) });
+var CursorSchema = object({
+	l: number(),
+	t: string()
+});
+function encodeCursor(cursor) {
+	return `v1.${Buffer.from(JSON.stringify(cursor), "utf8").toString("base64url")}`;
+}
+function decodeCursor(token) {
+	if (!token.startsWith("v1.")) return null;
+	try {
+		const parsed = CursorSchema.safeParse(JSON.parse(Buffer.from(token.slice(3), "base64url").toString("utf8")));
+		return parsed.success ? parsed.data : null;
+	} catch {
+		return null;
+	}
+}
+/** Before the cursor in (`lastSeen` DESC, `trackId` DESC) order? */
+function isAfterCursor(row, cursor) {
+	if (cursor === null) return true;
+	return row.lastSeen < cursor.l || row.lastSeen === cursor.l && row.trackId < cursor.t;
+}
+function cameraOf(endpoint) {
+	if (endpoint === void 0) return null;
+	const parsed = parseCameraEndpointId(endpoint.endpointId);
+	return parsed.kind === "camera" ? parsed.deviceId : null;
+}
+function isVisionClass$1(cls) {
+	return SMART_VISION_CLASSES$1.includes(cls);
+}
+async function prepare(ctx, deviceId) {
+	const state = await ctx.vision.get(deviceId);
+	return {
+		deviceId,
+		reportable: reportableVisionClasses(await ctx.declaredClasses(deviceId), state),
+		hidden: new Set(state.hidden)
+	};
+}
+/** A track as a history entry, or null when it is not one this camera shows. */
+function entryOf(ctx, p, track) {
+	const cls = detectionClassOf(track.className);
+	if (!isVisionClass$1(cls) || !p.reportable.includes(cls)) return null;
+	const e = eventIdentifierFor(ctx.namespace(), p.deviceId, track.trackId, cls);
+	if (p.hidden.has(e)) return null;
+	return {
+		e,
+		t: track.trackId,
+		c: cls,
+		at: track.firstSeen
+	};
+}
+function dataItem(ctx, p, entry, userId) {
+	return {
+		eventIdentifier: entry.e,
+		imageNetClass: entry.c,
+		objectIdentifier: objectIdentifierFor(ctx.namespace(), p.deviceId, entry.t),
+		...ctx.imagesFor(userId, p.deviceId, entry.t, entry.at)
+	};
+}
+function rangeOf(payload) {
+	if (payload.queryType === "QUERY_ALL") return {
+		from: 0,
+		to: Date.now()
+	};
+	const from = Date.parse(payload.query?.fromTime ?? "");
+	const to = Date.parse(payload.query?.toTime ?? "");
+	if (!Number.isFinite(from) || !Number.isFinite(to) || from > to) return null;
+	return {
+		from,
+		to
+	};
+}
+function dataControllerEvent(header, endpointId, name, payload) {
+	return { event: {
+		header: {
+			namespace: "Alexa.DataController",
+			name,
+			instance: header.instance ?? "Camera.SmartVisionData",
+			messageId: randomUUID(),
+			...header.correlationToken !== void 0 ? { correlationToken: header.correlationToken } : {},
+			payloadVersion: "1.0"
+		},
+		endpoint: { endpointId },
+		payload
+	} };
+}
+/** One page of the time-range history, starting after `start`. */
+async function rangePage(ctx, p, range, start, max) {
+	const entries = [];
+	let cursor = start;
+	for (let round = 0; round < MAX_ROUNDS; round += 1) {
+		const rows = await ctx.listTracks(p.deviceId, {
+			since: range.from,
+			until: cursor === null ? range.to : Math.min(cursor.l, range.to),
+			limit: FETCH_ROWS
+		});
+		for (const row of rows) {
+			if (!isAfterCursor(row, cursor)) continue;
+			cursor = {
+				l: row.lastSeen,
+				t: row.trackId
+			};
+			const entry = entryOf(ctx, p, row);
+			if (entry === null) continue;
+			entries.push(entry);
+			if (entries.length === max) return {
+				entries,
+				next: cursor
+			};
+		}
+		if (rows.length < FETCH_ROWS) return {
+			entries,
+			next: null
+		};
+	}
+	return {
+		entries,
+		next: cursor
+	};
+}
+async function handleReportData(header, endpoint, payloadRaw, ctx, caller) {
+	const deviceId = cameraOf(endpoint);
+	if (deviceId === null || endpoint === void 0) return errorEnvelope(header, "INVALID_DIRECTIVE", "event history is served for camera endpoints");
+	const parsed = ReportDataPayloadSchema.safeParse(payloadRaw);
+	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", "ReportData payload shape unexpected");
+	const payload = parsed.data;
+	const max = Math.min(Math.max(payload.maxResults ?? 10, 1), 10);
+	const p = await prepare(ctx, deviceId);
+	let entries = [];
+	let next = null;
+	if (payload.queryType === "QUERY_BY_IDENTIFIER") for (const id of (payload.query?.ids ?? []).slice(0, max)) {
+		const known = await ctx.vision.lookup(deviceId, id);
+		if (known === null) continue;
+		const track = await ctx.getTrack(deviceId, known.t);
+		const entry = track === null ? null : entryOf(ctx, p, track);
+		if (entry !== null && entry.e === id) entries.push(entry);
+	}
+	else {
+		const range = rangeOf(payload);
+		if (range === null) return errorEnvelope(header, "INVALID_DIRECTIVE", "fromTime/toTime missing or invalid");
+		const start = payload.nextToken === void 0 ? null : decodeCursor(payload.nextToken);
+		if (payload.nextToken !== void 0 && start === null) return errorEnvelope(header, "INVALID_DIRECTIVE", "nextToken not recognised");
+		const page = await rangePage(ctx, p, range, start, max);
+		entries = page.entries;
+		next = page.next;
+		await ctx.vision.remember(deviceId, entries);
+	}
+	ctx.logger.info("alexa data controller: history served", {
+		tags: { deviceId },
+		meta: {
+			userId: caller.userId,
+			queryType: payload.queryType,
+			items: entries.length,
+			more: next !== null
+		}
+	});
+	return dataControllerEvent(header, endpoint.endpointId, "DataReport", {
+		...next !== null ? { paginationContext: { nextToken: encodeCursor(next) } } : {},
+		dataSchema: {
+			type: "JSON",
+			schema: "SmartVisionData"
+		},
+		data: entries.map((e) => dataItem(ctx, p, e, caller.userId))
+	});
+}
+async function handleDeleteData(header, endpoint, payloadRaw, ctx, caller) {
+	const deviceId = cameraOf(endpoint);
+	if (deviceId === null || endpoint === void 0) return errorEnvelope(header, "INVALID_DIRECTIVE", "event history is served for camera endpoints");
+	const parsed = DeleteDataPayloadSchema.safeParse(payloadRaw);
+	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", "DeleteData payload shape unexpected");
+	const payload = parsed.data;
+	let ids;
+	if (payload.queryType === "QUERY_BY_IDENTIFIER") ids = payload.query?.ids ?? [];
+	else {
+		const range = rangeOf(payload);
+		if (range === null) return errorEnvelope(header, "INVALID_DIRECTIVE", "fromTime/toTime missing or invalid");
+		const p = await prepare(ctx, deviceId);
+		ids = (await ctx.listTracks(deviceId, {
+			since: range.from,
+			until: range.to,
+			limit: MAX_DELETE_ROWS
+		})).map((r) => entryOf(ctx, p, r)?.e).filter((e) => e !== void 0);
+	}
+	await ctx.vision.hide(deviceId, ids);
+	ctx.logger.info("alexa data controller: events hidden from Alexa (CamStack keeps them)", {
+		tags: { deviceId },
+		meta: {
+			userId: caller.userId,
+			queryType: payload.queryType,
+			hidden: ids.length
+		}
+	});
+	return dataControllerEvent(header, endpoint.endpointId, "DataDeleted", {
+		queryType: payload.queryType,
+		...payload.query !== void 0 ? { query: payload.query } : {}
+	});
+}
+async function handleSetObjectDetectionClasses(header, endpoint, payloadRaw, ctx) {
+	const deviceId = cameraOf(endpoint);
+	if (deviceId === null || endpoint === void 0) return errorEnvelope(header, "INVALID_DIRECTIVE", "object detection lives on camera endpoints");
+	const parsed = SetClassesPayloadSchema.safeParse(payloadRaw);
+	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", "SetObjectDetectionClasses payload unexpected");
+	const wanted = new Set(parsed.data.objectDetectionClasses.map((c) => c.imageNetClass));
+	const classes = SMART_VISION_CLASSES$1.filter((c) => wanted.has(c));
+	await ctx.vision.setClasses(deviceId, classes);
+	ctx.logger.info("alexa object detection: classes set from the Alexa app", {
+		tags: { deviceId },
+		meta: { classes }
+	});
+	const connectivity = await readConnectivity(ctx.ctx.api, deviceId, ctx.logger);
+	return {
+		event: {
+			header: {
+				namespace: "Alexa",
+				name: "Response",
+				messageId: randomUUID(),
+				...header.correlationToken !== void 0 ? { correlationToken: header.correlationToken } : {},
+				payloadVersion: "3"
+			},
+			endpoint: { endpointId: endpoint.endpointId },
+			payload: {}
+		},
+		context: { properties: [{
+			namespace: "Alexa.EndpointHealth",
+			name: "connectivity",
+			value: { value: connectivity },
+			timeOfSample: (/* @__PURE__ */ new Date()).toISOString(),
+			uncertaintyInMilliseconds: 0
+		}] }
+	};
+}
+//#endregion
 //#region src/handlers/lock-controller.ts
 /** The `lock-control` state as Alexa's `lockState`. */
 function alexaLockStateFor(state) {
@@ -52105,7 +52947,7 @@ async function toAlexaJpeg(source) {
 //#region src/handlers/snapshot-provider.ts
 /** Leaves the rest of Amazon's 8 s for the re-encode and the Lambda hop. */
 var SNAPSHOT_READ_TIMEOUT_MS = 5e3;
-var SnapshotImageSchema = object({
+var SnapshotImageSchema$1 = object({
 	base64: string().min(1),
 	contentType: string()
 });
@@ -52131,7 +52973,7 @@ async function readFrame(ctx, deviceId) {
 	});
 	try {
 		const raw = await Promise.race([ctx.api.snapshot.getSnapshot.query({ deviceId }), timeout]);
-		const parsed = SnapshotImageSchema.safeParse(raw);
+		const parsed = SnapshotImageSchema$1.safeParse(raw);
 		return parsed.success ? Buffer.from(parsed.data.base64, "base64") : null;
 	} finally {
 		if (timer !== void 0) clearTimeout(timer);
@@ -52890,6 +53732,9 @@ async function dispatchParsedDirective(rawBody, deps, callerIdentity) {
 		"Alexa.SecurityPanelController/Arm": "create",
 		"Alexa.SecurityPanelController/Disarm": "create",
 		"Alexa.SmartVision.SnapshotProvider/GetSnapshot": "view",
+		"Alexa.SmartVision.ObjectDetectionSensor/SetObjectDetectionClasses": "view",
+		"Alexa.DataController/ReportData": "view",
+		"Alexa.DataController/DeleteData": "view",
 		"Alexa.LockController/Lock": "create",
 		"Alexa.LockController/Unlock": "create"
 	};
@@ -53034,6 +53879,18 @@ async function dispatchParsedDirective(rawBody, deps, callerIdentity) {
 			status: 200,
 			body: await handleGetSnapshot(header, endpoint, deps.snapshotProvider, callerIdentity)
 		};
+		if (key === "Alexa.SmartVision.ObjectDetectionSensor/SetObjectDetectionClasses") return {
+			status: 200,
+			body: await handleSetObjectDetectionClasses(header, endpoint, payload, deps.vision)
+		};
+		if (key === "Alexa.DataController/ReportData") return {
+			status: 200,
+			body: await handleReportData(header, endpoint, payload, deps.vision, callerIdentity)
+		};
+		if (key === "Alexa.DataController/DeleteData") return {
+			status: 200,
+			body: await handleDeleteData(header, endpoint, payload, deps.vision, callerIdentity)
+		};
 		if (key === "Alexa/ReportState") return {
 			status: 200,
 			body: await handleReportState(header, endpoint, deps.reportState, callerIdentity)
@@ -53339,8 +54196,17 @@ async function handleSnapshotFetch(req, reply, deps) {
 		refuse(reply, 403, "not allowed");
 		return;
 	}
-	reply.code(200).type(image.contentType).header("cache-control", "private, no-store").header("content-encoding", "identity").header("content-length", String(image.bytes.byteLength));
-	reply.send(image.bytes);
+	const bytes = await deps.store.bytesOf(image);
+	if (bytes === null || bytes.byteLength === 0) {
+		deps.logger.debug("alexa snapshot: no image to serve for this event", {
+			tags: { deviceId: image.deviceId },
+			meta: { imageId }
+		});
+		refuse(reply, 410, "no image is available for this event");
+		return;
+	}
+	reply.code(200).type(image.contentType).header("cache-control", "private, no-store").header("content-encoding", "identity").header("content-length", String(bytes.byteLength));
+	reply.send(bytes);
 }
 //#endregion
 //#region src/http-server.ts
@@ -53780,17 +54646,14 @@ function connectivityDeviceOf(endpointId) {
 var DOORBELL_INTERFACE = "Alexa.DoorbellEventSource";
 /**
 * The interface an endpoint must advertise for an `ObjectDetection` event to
-* survive the Alexa cloud — and which `buildParentCameraEndpoint` does NOT
-* currently declare (the two `capabilities.push(SMART_VISION_*)` lines are
-* commented out there, deliberately).
-*
-* Measured 2026-08-07: 223 `smartvision person posted status=202` in 692 s on
-* endpoint 590 alone, every one of them against an endpoint whose discovered
-* capability list has never contained this string. The Event Gateway answers
-* 202 because the ENVELOPE parsed; the cloud then drops the event because the
-* endpoint cannot host it. This is D76 exactly — an accepted POST is not
-* evidence of delivery — and it is why the operator sees no events in the app
-* while the log reads as though they were delivered.
+* survive the Alexa cloud. Declared on a camera only while object detection is
+* on for it (R4, D779).
+*
+* Measured 2026-08-07, before the declaration existed: 223 `smartvision person
+* posted status=202` in 692 s on endpoint 590 alone, every one of them against
+* an endpoint whose discovered capability list did not contain this string. The
+* Event Gateway answers 202 because the ENVELOPE parsed; the cloud then drops
+* the event. D76: an accepted POST is not evidence of delivery.
 */
 var SMART_VISION_INTERFACE = "Alexa.SmartVision.ObjectDetectionSensor";
 /**
@@ -53972,13 +54835,7 @@ var LwaEventGateway = class {
 			endpointId,
 			detected: data.detected,
 			timestamp: data.timestamp,
-			label: "motion",
-			onRisingPosted: (userId) => this.postObjectDetection({
-				userId,
-				deviceId: data.deviceId,
-				endpointId,
-				timestamp: data.timestamp
-			})
+			label: "motion"
 		});
 	}
 	/**
@@ -54043,7 +54900,6 @@ var LwaEventGateway = class {
 				detected: true,
 				timestamp: opts.timestamp
 			});
-			await opts.onRisingPosted?.(account.userId);
 		}
 	}
 	async postMotionChange(opts) {
@@ -54053,49 +54909,53 @@ var LwaEventGateway = class {
 		}), `motion ${opts.detected ? "DETECTED" : "NOT_DETECTED"}`);
 	}
 	/**
-	* Pair a reported DETECTED with a SmartVision `ObjectDetection` event — the
-	* event that populates the per-camera Events box in the Alexa app
-	* (`Alexa.MotionSensor` alone only feeds the account-wide Activity feed).
+	* Post one `Alexa.SmartVision.ObjectDetectionSensor/ObjectDetection` event
+	* (R4, D779) to every linked account whose hub user may view the camera.
 	*
-	* **Gated on the endpoint actually declaring the interface, and today that
-	* gate is closed.** `buildParentCameraEndpoint` does not push
-	* `SMART_VISION_OBJECT_DETECTION_SENSOR`, so every one of these events was
-	* being accepted by the gateway (202) and discarded by the cloud. Posting
-	* into that is not harmless: it is ~1 POST/s per flapping camera against a
-	* rate-limited gateway, and it makes the log assert a delivery that never
-	* happened. The doorbell path learned the same lesson today and only warns
-	* — it can, because `Alexa.DoorbellEventSource` IS built for a doorbell and
-	* a missing one means stale discovery, i.e. a bet worth taking. Here the
-	* interface is absent by construction, so the bet is a certain loss.
+	* Fed by `ObjectDetectionFeed` from the pipeline's tracks — never by camera
+	* motion. Gated on the endpoint Alexa holds DECLARING the interface (the
+	* exported signature's entry for the camera endpoint): an event for an
+	* endpoint without it is a 2xx the cloud discards (D76), and before D779
+	* that was ~1 POST/s per flapping camera. The drop is logged sparsely.
 	*
-	* Re-opening this gate is a design item, not a toggle: see
-	* `docs/design/2026-08-07-alexa-events-and-hksv-assessment.md`.
+	* Images are minted PER ACCOUNT (`imagesFor`): an image URL is checked
+	* against the account-link token of the user it was minted for.
 	*/
 	async postObjectDetection(opts) {
+		const endpointId = String(opts.deviceId);
 		const signature = this.deps.getExportedSignature(opts.deviceId);
-		if (signature === null || !signature.includes(SMART_VISION_INTERFACE)) {
-			const dropped = (this.smartVisionDropped.get(opts.endpointId) ?? 0) + 1;
-			this.smartVisionDropped.set(opts.endpointId, dropped);
+		if (!(signature !== null && signatureEntries(signature).some((e) => e.endpointId === endpointId && e.interfaces.includes(SMART_VISION_INTERFACE)))) {
+			const dropped = (this.smartVisionDropped.get(endpointId) ?? 0) + 1;
+			this.smartVisionDropped.set(endpointId, dropped);
 			if (dropped === 1 || dropped % SMART_VISION_DROP_LOG_EVERY === 0) this.deps.logger.info(`alexa lwa-gateway: ObjectDetection NOT posted — the endpoint Alexa knows does not declare ${SMART_VISION_INTERFACE}, so the cloud would accept and discard it`, {
 				tags: { deviceId: opts.deviceId },
 				meta: {
-					endpointId: opts.endpointId,
+					endpointId,
 					droppedSoFar: dropped,
 					signature
 				}
 			});
 			return;
 		}
-		await this.postEventBody(opts.userId, opts.endpointId, (accessToken) => buildSmartVisionObjectDetectionEvent({
-			userId: opts.userId,
-			endpointId: opts.endpointId,
-			detections: [{
-				eventIdentifier: `${opts.endpointId}-${opts.timestamp}`,
-				imageNetClass: "person"
-			}],
-			timestamp: opts.timestamp,
-			accessToken
-		}), `smartvision person`);
+		const linked = this.deps.listLinkedAccounts();
+		if (linked.length === 0 || !this.hasProactiveCredentials()) return;
+		const d = opts.detection;
+		for (const account of linked) {
+			if (!this.mayPush(account.userId, opts.deviceId, "object detection")) continue;
+			const images = opts.imagesFor?.(account.userId) ?? {};
+			await this.postEventBody(account.userId, endpointId, (accessToken) => buildSmartVisionObjectDetectionEvent({
+				userId: account.userId,
+				endpointId,
+				detections: [{
+					eventIdentifier: d.eventIdentifier,
+					imageNetClass: d.imageNetClass,
+					objectIdentifier: d.objectIdentifier,
+					...images
+				}],
+				timestamp: d.timestamp,
+				accessToken
+			}), `smartvision ${d.imageNetClass} (track ${d.trackId}, images ${images.frameImageUri === void 0 ? "off" : "on"})`);
+		}
 	}
 	/**
 	* A camera went offline or came back. Amazon requires the `connectivity`
@@ -54219,32 +55079,16 @@ var LwaEventGateway = class {
 	* either side get cleared.
 	*/
 	async purgeEndpoints(endpointIds) {
-		if (endpointIds.length === 0) return {
-			requested: 0,
-			accountCount: 0,
-			attemptedAccounts: 0
-		};
 		const linked = this.deps.listLinkedAccounts();
-		if (linked.length === 0) return {
-			requested: endpointIds.length,
-			accountCount: 0,
-			attemptedAccounts: 0
-		};
-		if (!this.hasProactiveCredentials()) return {
-			requested: endpointIds.length,
-			accountCount: linked.length,
-			attemptedAccounts: 0
-		};
-		let attemptedAccounts = 0;
-		for (const account of linked) {
-			if (!this.findToken(account.userId)) continue;
-			await this.postEventBody(account.userId, "discovery", (accessToken) => buildDeleteReportPayload(account.userId, endpointIds, accessToken), `discovery delete (manual purge, ${endpointIds.length})`);
-			attemptedAccounts += 1;
+		let deliveredAccounts = 0;
+		if (endpointIds.length > 0) {
+			for (const account of linked) if (await this.postEventBody(account.userId, "discovery", (accessToken) => buildDeleteReportPayload(account.userId, endpointIds, accessToken), `discovery delete (manual, ${endpointIds.length})`)) deliveredAccounts += 1;
 		}
 		return {
 			requested: endpointIds.length,
 			accountCount: linked.length,
-			attemptedAccounts
+			deliveredAccounts,
+			failedAccounts: endpointIds.length > 0 ? linked.length - deliveredAccounts : 0
 		};
 	}
 	/** Public delivery used by the SyncEngine. Returns true on gateway 2xx.
@@ -54684,6 +55528,286 @@ function buildDeleteReportPayload(_userId, endpointIds, accessToken) {
 	} };
 }
 //#endregion
+//#region src/remove-endpoints.ts
+/** Comma / whitespace / newline separated ids → unique non-empty ids. */
+function parseEndpointIds(raw) {
+	const ids = raw.split(/[\s,]+/).map((s) => s.trim()).filter((s) => s.length > 0);
+	return [...new Set(ids)];
+}
+/**
+* The tracked map (deviceId → endpoint ids last pushed) without `removed`. A
+* device left with no id is dropped, so no later DeleteReport re-addresses it.
+*/
+function forgetDeliveredEndpointIds(tracked, removed) {
+	const gone = new Set(removed);
+	const next = {};
+	for (const [key, ids] of Object.entries(tracked)) {
+		const remaining = ids.filter((id) => !gone.has(id));
+		if (remaining.length > 0) next[Number(key)] = remaining;
+	}
+	return next;
+}
+/**
+* Delete the typed ids from every linked Alexa account. Throws — so the button
+* shows the reason — unless every account accepted the delete; only then are
+* the ids forgotten locally. A partial delivery keeps them tracked, so a
+* Re-sync or a second press can still reach the account that missed it.
+*/
+async function removeEndpointsFromAlexa(deps) {
+	const ids = parseEndpointIds(deps.raw);
+	if (ids.length === 0) throw new Error("No endpoint id given. Type one or more ids, e.g. 54, 54__privacy.");
+	const result = await deps.purge(ids);
+	if (result.accountCount === 0) throw new Error("No linked Amazon account: there is no Alexa account to remove them from.");
+	if (result.failedAccounts > 0) throw new Error(`The delete did not reach ${result.failedAccounts} of ${result.accountCount} linked account(s); nothing was forgotten. The addon log has the gateway's answer.`);
+	await deps.setTracked(forgetDeliveredEndpointIds(deps.getTracked(), ids));
+	return result;
+}
+//#endregion
+//#region src/settings-schema.ts
+var ADDON_ID = "export-alexa";
+var CONNECTION_DESCRIPTION = [
+	"Public skill (default): enable the \"CamStack\" skill in the Alexa app and link your account. No Amazon developer setup is needed.",
+	"Custom skill: enter your skill id and deploy the skill Lambda from this addon's lambda-template in your own AWS account.",
+	"Either way the skill's Lambda keeps the Amazon credentials (in a custom skill, in your SSM Parameter Store); this hub holds none. It receives short-lived event tokens from the Lambda's token broker with a credential unique to this link.",
+	"This hub must be reachable from the internet over HTTPS (Cloudflare Tunnel, Tailscale Funnel, …). The external address below is the one the skill calls back on."
+].join("\n");
+function connectionSection(input) {
+	const { defaults } = input;
+	return {
+		id: "export-alexa-connection",
+		title: "Connection",
+		description: CONNECTION_DESCRIPTION,
+		columns: 1,
+		fields: [
+			{
+				type: "select",
+				key: "skillMode",
+				label: "Alexa skill",
+				description: "Public: the built-in CamStack skill. Custom: your own skill and your own copy of the skill Lambda.",
+				options: [{
+					value: "public",
+					label: "Public (built-in CamStack skill)"
+				}, {
+					value: "custom",
+					label: "Custom skill"
+				}],
+				default: defaults.skillMode
+			},
+			{
+				type: "select",
+				key: "region",
+				label: "Skill region",
+				description: "The Alexa Event Gateway this hub posts to: doorbell presses, motion, camera online/offline and state changes, and the device-list updates sent when you expose or unexpose a camera. Pick the region your Amazon account is in — events sent to another region are rejected.",
+				options: [
+					{
+						value: "NA",
+						label: "North America"
+					},
+					{
+						value: "EU",
+						label: "Europe"
+					},
+					{
+						value: "FE",
+						label: "Far East"
+					}
+				],
+				default: defaults.region
+			},
+			...input.skillMode === "custom" ? [{
+				type: "text",
+				key: "expectedAudience",
+				label: "Alexa skill id",
+				description: "Your skill's id, format amzn1.ask.skill.xxxx, from the Alexa developer console. Directives for any other skill are refused.",
+				default: defaults.expectedAudience
+			}] : [],
+			{
+				type: "addon-action-select",
+				key: "publicHubUrl",
+				label: "External address",
+				description: "The HTTPS address the skill reaches this hub on, read live from the connected remote-access providers each time this page opens. Defaults to the first one detected; a saved choice that is no longer detected stays selected until you change it.",
+				addonId: ADDON_ID,
+				action: "listExternalAddresses",
+				mapOption: {
+					value: "value",
+					label: "label"
+				},
+				emptyResultsMessage: "No external HTTPS address detected. Set up remote access (Cloudflare Tunnel, Tailscale Funnel, …), then reopen this page.",
+				default: defaults.publicHubUrl
+			}
+		]
+	};
+}
+function featuresSection(input) {
+	const { defaults } = input;
+	return {
+		id: "export-alexa-features",
+		title: "Features",
+		columns: 1,
+		fields: [
+			{
+				type: "boolean",
+				key: "detectionSensors",
+				label: "Detection sensors",
+				description: "Master switch for the detection sensors: Alexa motion sensors named \"<camera> Person\", \"Vehicle\", \"Animal\" or \"Package\", usable as routine triggers (for example: when Front door Package detects motion, announce on the Echo devices). Which classes each camera sends is chosen on the camera's Export tab — none by default, and only the classes its pipeline detects. They report only \"detected\", no images. Off removes every one of them from Alexa.",
+				default: defaults.detectionSensors
+			},
+			{
+				type: "boolean",
+				key: "objectDetection",
+				label: "Object detection (experimental)",
+				description: "Each exposed camera reports person and package detections to Alexa as events, with an event history on the camera in the Alexa app and, where Alexa supports it, \"person detected\" announcements. Amazon documents this for US English only; it is on to find out what other languages do with it. If Alexa stops showing a camera, turn this off: the cameras are sent again without it. Images follow the Snapshots switch. Each camera can also be turned off on its Export tab.",
+				default: defaults.objectDetection
+			},
+			{
+				type: "boolean",
+				key: "snapshots",
+				label: "Snapshots in the Alexa app",
+				description: "Show each exposed camera's latest still on its tile in the Alexa app. While this is on, Amazon fetches still images of your cameras (re-encoded to about 480 px, each link valid ten minutes and only with your account's token). Off removes the feature from Alexa and invalidates every link already handed out. The external address must be set.",
+				default: defaults.snapshots
+			}
+		]
+	};
+}
+function accountLinkSection(input) {
+	return {
+		id: "export-alexa-account",
+		title: "Account link",
+		columns: 1,
+		fields: [{
+			type: "info",
+			key: "__alexa-link-status",
+			label: "Status",
+			variant: "info",
+			content: buildLinkStatusContent({
+				linkedAccounts: input.linkedAccounts,
+				tokens: input.tokens,
+				now: input.now
+			})
+		}, {
+			type: "addon-action-button",
+			addonId: ADDON_ID,
+			key: "__unlink-alexa-accounts",
+			label: "Unlink Amazon account",
+			description: "Revokes every Alexa account-link session on this hub and discards the stored Amazon push grant. Live view, voice control and proactive events stop immediately. The account-linking token never expires on its own, so this is the only way to sever the link. Re-link from the Alexa app afterwards; a new link also picks up widened permissions.",
+			buttonLabel: "Unlink now",
+			action: "unlinkAlexaAccounts",
+			variant: "danger",
+			confirmMessage: "Unlink the Amazon account? Alexa loses access to your cameras immediately and you must re-link from the Alexa app to restore it.",
+			successMessage: "Unlinked: {revokedSessions} session(s) revoked, {removedAccounts} linked account(s) removed. Re-link from the Alexa app to restore."
+		}]
+	};
+}
+function troubleshootingSection() {
+	return {
+		id: "export-alexa-troubleshooting",
+		title: "Troubleshooting",
+		style: "accordion",
+		defaultCollapsed: true,
+		columns: 1,
+		fields: [
+			{
+				type: "addon-action-button",
+				addonId: ADDON_ID,
+				key: "__resync-discovery",
+				label: "Re-sync devices",
+				description: "Sends every exposed device to Alexa again, and removes from Alexa the devices you stopped exposing whose removal did not get through. Devices normally sync on their own; use this when the Alexa app disagrees with the exposed list. Needs a linked account. Safe to repeat.",
+				buttonLabel: "Re-sync now",
+				action: "resyncDiscovery",
+				variant: "default",
+				successMessage: "Sent {endpointCount} endpoint(s) of {deviceCount} device(s) to {accountCount} account(s). Removed {removedEndpointCount} endpoint(s) of unexposed devices; {retainedEndpointCount} still pending. Failed deliveries: {failedCount} (see the addon log)."
+			},
+			{
+				type: "addon-action-button",
+				addonId: ADDON_ID,
+				key: "__remove-alexa-endpoints",
+				label: "Remove ids from Alexa",
+				description: "For a device the Alexa app still shows that this hub no longer knows about (left over from an earlier link or addon version). You type the Alexa endpoint ids when you press the button: a camera is its device id (\"54\"), its parts add a suffix (\"54__privacy\", \"54__98\"). Removing an endpoint also removes it from any Alexa routine that uses it.",
+				buttonLabel: "Remove ids…",
+				action: "removeAlexaEndpoints",
+				variant: "danger",
+				prompt: {
+					param: "endpointIds",
+					title: "Remove ids from Alexa",
+					message: "Endpoint ids separated by commas or spaces. Each linked Alexa account is sent a delete for them.",
+					placeholder: "54, 54__privacy"
+				},
+				successMessage: "Removed {requested} id(s) from {deliveredAccounts} linked account(s)."
+			},
+			{
+				type: "addon-action-button",
+				addonId: ADDON_ID,
+				key: "__rotate-broker-credential",
+				label: "Rotate broker credential",
+				description: "Replaces the credential this hub uses at the skill's token broker with a fresh one; the old one stops working immediately. Use it if a backup of this hub's settings may have leaked. Re-linking also issues a fresh one.",
+				buttonLabel: "Rotate credential",
+				action: "rotateBrokerCredential",
+				variant: "default",
+				successMessage: "Rotated {rotated} credential(s); {failed} failed (see the addon log)."
+			}
+		]
+	};
+}
+/** Custom skill only: the public skill's shared Lambda sends one ingress token
+*  for every hub (`HUB_INGRESS_TOKEN`), so a per-hub token cannot apply to it. */
+function customSkillSecuritySection(input) {
+	return {
+		id: "export-alexa-custom-security",
+		title: "Custom-skill security",
+		style: "accordion",
+		defaultCollapsed: true,
+		columns: 1,
+		fields: [
+			{
+				type: "info",
+				key: "__ingress-token-info",
+				label: "Ingress token",
+				variant: "info",
+				content: "An optional shared secret your skill Lambda sends on every call to this hub. Show it, put it in the Lambda's HUB_INGRESS_TOKEN environment variable, then turn on \"Require ingress token\". After a rotation, update the Lambda."
+			},
+			{
+				type: "addon-action-button",
+				addonId: ADDON_ID,
+				key: "__reveal-ingress-token",
+				label: "Show ingress token",
+				description: "Administrators only. Shows the current token once, here.",
+				buttonLabel: "Show ingress token",
+				action: "revealIngressToken",
+				variant: "default",
+				successMessage: "Ingress token: {ingressToken}"
+			},
+			{
+				type: "addon-action-button",
+				addonId: ADDON_ID,
+				key: "__regenerate-ingress-token",
+				label: "Rotate ingress token",
+				description: "Generates a new ingress token; the old one stops working. Update your Lambda's HUB_INGRESS_TOKEN afterwards.",
+				buttonLabel: "Regenerate token",
+				action: "regenerateIngressToken",
+				variant: "default",
+				successMessage: "New ingress token: {ingressToken} — put it in HUB_INGRESS_TOKEN now.",
+				confirmMessage: "Rotate the ingress token? With \"Require ingress token\" on, the Lambda is refused until you update HUB_INGRESS_TOKEN."
+			},
+			{
+				type: "boolean",
+				key: "enforceIngressToken",
+				label: "Require ingress token",
+				description: "When on, this hub refuses skill calls without the matching token. Turn it on only after HUB_INGRESS_TOKEN is set in your Lambda.",
+				default: input.defaults.enforceIngressToken
+			}
+		]
+	};
+}
+function buildAlexaSettingsSections(input) {
+	return [
+		connectionSection(input),
+		featuresSection(input),
+		accountLinkSection(input),
+		troubleshootingSection(),
+		...input.skillMode === "custom" ? [customSkillSecuritySection(input)] : []
+	];
+}
+//#endregion
 //#region src/access/account-visibility.ts
 /** Event-path gate. Unknown account ⇒ refused (fail closed). */
 function visibilityAllows(entry, deviceId) {
@@ -54837,121 +55961,6 @@ async function applyVisibilityChanges(changes, target, logger) {
 		}
 	}
 }
-//#endregion
-//#region src/detection-sensors/detection-tracker.ts
-/**
-* Which detection classes are currently present on each camera (R1, D772).
-*
-* Fed by the pipeline's track lifecycle (`PipelineAnalyticsTrackLifecycle`,
-* `data.deviceId` — these events carry no device on their `source`) and by
-* package deliveries. A class is present while at least one of ITS tracks is
-* open: the set is per `(camera, class)` and per `trackId`, so the end of one
-* person's track does not clear "Person" while another person is still in
-* view (the HA export's per-event flip has exactly that bug).
-*
-* Events are telemetry and may be dropped (D8), and the pipeline does not
-* promise an `end` for every `start` (a zero-media false birth or a discarded
-* stale track ends silently). So {@link reconcile} replaces a camera's sets
-* with an authoritative read of its ACTIVE tracks; a sensor can therefore never
-* stay "detected" past one reconcile after its last track closed. A read that
-* fails is not passed in — the sets then stay as they were.
-*
-* Emits a transition per `(camera, class)` only when presence changes; the
-* Alexa-facing hold (≥ 30 s DETECTED before NOT_DETECTED) is the gateway's.
-*/
-/** A package delivery is an instant, not a track: it is present this long. */
-var PACKAGE_PULSE_MS = 1e3;
-/** The detection class a pipeline class name belongs to, or null. Pipeline
-*  classes are already macros; a raw COCO label is mapped the same way the
-*  executor maps it. */
-function detectionClassOf(className) {
-	if (className === void 0) return null;
-	const lower = className.toLowerCase();
-	const isClass = (v) => DETECTION_SENSOR_CLASSES.includes(v);
-	if (isClass(lower)) return lower;
-	const mapped = COCO_TO_MACRO.mapping[lower];
-	return mapped !== void 0 && isClass(mapped) ? mapped : null;
-}
-var DetectionTracker = class {
-	onTransition;
-	/** `${deviceId}|${class}` → open track ids. */
-	open = /* @__PURE__ */ new Map();
-	pulseTimers = /* @__PURE__ */ new Set();
-	constructor(onTransition) {
-		this.onTransition = onTransition;
-	}
-	onTrackLifecycle(event) {
-		const cls = detectionClassOf(event.bestClassName ?? event.classes?.[0]);
-		if (cls === null) return;
-		if (event.phase === "end") {
-			this.remove(event.deviceId, cls, event.trackId);
-			for (const other of DETECTION_SENSOR_CLASSES) if (other !== cls) this.remove(event.deviceId, other, event.trackId);
-			return;
-		}
-		this.add(event.deviceId, cls, event.trackId);
-	}
-	/** A package was delivered: "Package" is detected, as a pulse. */
-	onPackageDelivered(deviceId, entryId) {
-		const id = `package:${entryId}`;
-		this.add(deviceId, "package", id);
-		const timer = setTimeout(() => {
-			this.pulseTimers.delete(timer);
-			this.remove(deviceId, "package", id);
-		}, PACKAGE_PULSE_MS);
-		timer.unref?.();
-		this.pulseTimers.add(timer);
-	}
-	/** Replace a camera's open tracks with what the pipeline says is ACTIVE. */
-	reconcile(deviceId, active) {
-		const truth = /* @__PURE__ */ new Map();
-		for (const track of active) {
-			const cls = detectionClassOf(track.className);
-			if (cls === null) continue;
-			const set = truth.get(cls) ?? /* @__PURE__ */ new Set();
-			set.add(track.trackId);
-			truth.set(cls, set);
-		}
-		for (const cls of DETECTION_SENSOR_CLASSES) {
-			const key = `${deviceId}|${cls}`;
-			const before = this.open.get(key) ?? /* @__PURE__ */ new Set();
-			const after = truth.get(cls) ?? /* @__PURE__ */ new Set();
-			for (const id of before) if (id.startsWith("package:")) after.add(id);
-			this.replace(deviceId, cls, before, after);
-		}
-	}
-	/** Cameras with at least one class present — the ones worth reconciling. */
-	camerasWithPresence() {
-		const out = /* @__PURE__ */ new Set();
-		for (const [key, set] of this.open) if (set.size > 0) out.add(Number(key.split("|")[0]));
-		return [...out];
-	}
-	isPresent(deviceId, cls) {
-		return (this.open.get(`${deviceId}|${cls}`)?.size ?? 0) > 0;
-	}
-	clear() {
-		this.open.clear();
-		for (const t of this.pulseTimers) clearTimeout(t);
-		this.pulseTimers.clear();
-	}
-	add(deviceId, cls, id) {
-		const key = `${deviceId}|${cls}`;
-		const set = this.open.get(key) ?? /* @__PURE__ */ new Set();
-		const was = set.size > 0;
-		set.add(id);
-		this.open.set(key, set);
-		if (!was) this.onTransition(deviceId, cls, true);
-	}
-	remove(deviceId, cls, id) {
-		const set = this.open.get(`${deviceId}|${cls}`);
-		if (set === void 0 || !set.delete(id)) return;
-		if (set.size === 0) this.onTransition(deviceId, cls, false);
-	}
-	replace(deviceId, cls, before, after) {
-		this.open.set(`${deviceId}|${cls}`, after);
-		if (before.size > 0 && after.size === 0) this.onTransition(deviceId, cls, false);
-		else if (before.size === 0 && after.size > 0) this.onTransition(deviceId, cls, true);
-	}
-};
 /** The detection classes an event-kind answer offers. */
 function detectionClassesOfKinds(kinds) {
 	const out = /* @__PURE__ */ new Set();
@@ -55030,7 +56039,7 @@ var DetectionClassSource = class {
 //#endregion
 //#region src/detection-sensors/detection-feed.ts
 var DETECTION_RECONCILE_INTERVAL_MS = 6e4;
-var TrackLifecycleSchema = object({
+var TrackLifecycleSchema$1 = object({
 	deviceId: number(),
 	trackId: string(),
 	phase: _enum([
@@ -55058,7 +56067,7 @@ var DetectionSensorFeed = class {
 	}
 	start() {
 		this.offs.push(this.deps.eventBus.subscribe({ category: EventCategory.PipelineAnalyticsTrackLifecycle }, (event) => {
-			const parsed = TrackLifecycleSchema.safeParse(event.data);
+			const parsed = TrackLifecycleSchema$1.safeParse(event.data);
 			if (parsed.success) this.tracker.onTrackLifecycle(parsed.data);
 		}), this.deps.eventBus.subscribe({ category: EventCategory.PipelineAnalyticsPackageDelivered }, (event) => {
 			const parsed = PackageDeliveredSchema.safeParse(event.data);
@@ -55103,6 +56112,388 @@ var DetectionSensorFeed = class {
 	}
 };
 //#endregion
+//#region src/detection-sensors/sensor-selection.ts
+/** Per-device store key of the saved selection. */
+var SENSOR_SELECTION_KEY = "alexaDetectionSensorClasses";
+var LABELS = {
+	person: "Person",
+	vehicle: "Vehicle",
+	animal: "Animal",
+	package: "Package"
+};
+function isClass(value) {
+	return typeof value === "string" && DETECTION_SENSOR_CLASSES.includes(value);
+}
+/** The saved selection in a per-device store blob; `null` = never saved. */
+function parseSensorSelection(store) {
+	const raw = store[SENSOR_SELECTION_KEY];
+	if (!Array.isArray(raw)) return null;
+	return DETECTION_SENSOR_CLASSES.filter((c) => raw.includes(c));
+}
+/** A patch value from the multiselect, cleaned to known classes. */
+function sensorSelectionFromPatch(value) {
+	if (!Array.isArray(value)) return [];
+	const picked = new Set(value.filter(isClass));
+	return DETECTION_SENSOR_CLASSES.filter((c) => picked.has(c));
+}
+/** The classes a camera publishes a sensor for: offered ∩ saved, in the
+*  canonical order. Never saved ⇒ none. */
+function effectiveSensorClasses(available, saved) {
+	if (saved === null) return [];
+	return DETECTION_SENSOR_CLASSES.filter((c) => available.includes(c) && saved.includes(c));
+}
+/** The device-settings field key — namespaced per exporter (see the addon). */
+function sensorSelectionKey(deviceId) {
+	return `alexa:${deviceId}:detectionSensorClasses`;
+}
+/** The camera's "Detection sensors in Alexa" field: a multiselect over the
+*  classes the camera produces, or an info line saying why there is none. */
+function sensorSelectionField(input) {
+	const key = sensorSelectionKey(input.deviceId);
+	const showWhen = {
+		field: input.enabledKey,
+		equals: true
+	};
+	if (!input.masterOn) return {
+		type: "info",
+		key: `${key}:off`,
+		label: "Detection sensors in Alexa",
+		content: "Detection sensors are switched off for the whole Alexa integration (Alexa settings → Detection sensors).",
+		variant: "info",
+		showWhen
+	};
+	if (input.available.length === 0) return {
+		type: "info",
+		key: `${key}:none`,
+		label: "Detection sensors in Alexa",
+		content: "This camera's detection pipeline produces no person, vehicle, animal or package events, so there is nothing to send to Alexa as a sensor.",
+		variant: "info",
+		showWhen
+	};
+	return {
+		type: "multiselect",
+		key,
+		label: "Detection sensors in Alexa",
+		description: "Each class picked here becomes an Alexa motion sensor named \"<camera> <class>\", usable as a routine trigger. Only the classes this camera's pipeline detects are offered (Package needs a package zone). Removing a class deletes its sensor, and the routines built on it, from Alexa.",
+		options: input.available.map((c) => ({
+			value: c,
+			label: LABELS[c]
+		})),
+		value: input.available.filter((c) => (input.saved ?? []).includes(c)),
+		showWhen,
+		immediate: true
+	};
+}
+/** Bound on the per-track bookkeeping should `end` events be lost (D8). */
+var MAX_TRACKED = 5e3;
+var TrackLifecycleSchema = object({
+	deviceId: number(),
+	trackId: string(),
+	phase: _enum([
+		"start",
+		"update",
+		"end"
+	]),
+	bestClassName: string().optional(),
+	classes: array(string()).optional()
+});
+function isVisionClass(cls) {
+	return cls === "person" || cls === "package";
+}
+var ObjectDetectionFeed = class {
+	deps;
+	/** `${deviceId}|${trackId}|${class}` already handled → insertion time. */
+	handled = /* @__PURE__ */ new Map();
+	/** objectIdentifier → last event time. */
+	lastPosted = /* @__PURE__ */ new Map();
+	off = null;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	start() {
+		this.off = this.deps.eventBus.subscribe({ category: EventCategory.PipelineAnalyticsTrackLifecycle }, (event) => {
+			const parsed = TrackLifecycleSchema.safeParse(event.data);
+			if (!parsed.success) return;
+			this.onTrackLifecycle(parsed.data).catch((err) => {
+				this.deps.logger.warn("alexa object detection: event failed", {
+					tags: { deviceId: parsed.data.deviceId },
+					meta: {
+						trackId: parsed.data.trackId,
+						error: errMsg(err)
+					}
+				});
+			});
+		});
+	}
+	stop() {
+		this.off?.();
+		this.off = null;
+		this.handled.clear();
+		this.lastPosted.clear();
+	}
+	/** Per-track entries currently held (tests, diagnostics). */
+	trackedCount() {
+		return this.handled.size;
+	}
+	async onTrackLifecycle(event) {
+		const prefix = `${event.deviceId}|${event.trackId}|`;
+		if (event.phase === "end") {
+			for (const key of [...this.handled.keys()]) if (key.startsWith(prefix)) this.handled.delete(key);
+			return;
+		}
+		const cls = detectionClassOf(event.bestClassName ?? event.classes?.[0]);
+		if (!isVisionClass(cls)) return;
+		const key = `${prefix}${cls}`;
+		if (this.handled.has(key)) return;
+		const now = this.deps.now?.() ?? Date.now();
+		const namespace = this.deps.namespace();
+		const objectIdentifier = objectIdentifierFor(namespace, event.deviceId, event.trackId);
+		const last = this.lastPosted.get(objectIdentifier);
+		if (last !== void 0 && now - last < 3e4) return;
+		this.mark(key, now);
+		if (!(await this.deps.reportableClasses(event.deviceId)).includes(cls)) return;
+		const detection = {
+			trackId: event.trackId,
+			imageNetClass: cls,
+			eventIdentifier: eventIdentifierFor(namespace, event.deviceId, event.trackId, cls),
+			objectIdentifier,
+			timestamp: now
+		};
+		this.lastPosted.set(objectIdentifier, now);
+		this.pruneLastPosted(now);
+		await this.deps.remember(event.deviceId, {
+			e: detection.eventIdentifier,
+			t: event.trackId,
+			c: cls,
+			at: now
+		});
+		await this.deps.post(event.deviceId, detection);
+	}
+	mark(key, now) {
+		this.handled.set(key, now);
+		if (this.handled.size <= MAX_TRACKED) return;
+		const oldest = this.handled.keys().next().value;
+		if (oldest !== void 0) this.handled.delete(oldest);
+	}
+	pruneLastPosted(now) {
+		for (const [id, at] of this.lastPosted) if (now - at >= 3e4) this.lastPosted.delete(id);
+	}
+};
+//#endregion
+//#region src/vision/vision-runtime.ts
+/** Per-device store key of the camera's object-detection toggle. */
+var OBJECT_DETECTION_KEY = "alexaObjectDetection";
+/** Clean scene first; the boxed frames never (they are annotated). */
+var FRAME_KINDS = [
+	"keyFrameSmall",
+	"sceneFrame",
+	"keyFrame",
+	"fullFrame"
+];
+var CROP_KINDS = [
+	"thumbnailSmall",
+	"thumbnail",
+	"crop"
+];
+/** A live event whose track has no stored frame yet may show the camera's
+*  current snapshot — but only this soon after the detection. Older history
+*  never does: it would show a different moment. */
+var LIVE_FALLBACK_MS = 6e4;
+var MediaRowSchema = object({
+	kind: string(),
+	base64: string()
+});
+var SnapshotImageSchema = object({ base64: string().min(1) });
+var RecentTracksSchema = object({ tracks: array(object({
+	trackId: string(),
+	className: string(),
+	firstSeen: number(),
+	lastSeen: number()
+})) });
+var TrackSchema = object({
+	trackId: string(),
+	className: string(),
+	firstSeen: number(),
+	lastSeen: number()
+}).nullable();
+/** The classes a camera declares, from what its pipeline produces. */
+function declaredVisionClasses(available) {
+	return available.includes("package") ? ["person", "package"] : ["person"];
+}
+/** The camera's toggle in a per-device store blob (absent = on). */
+function cameraObjectDetectionOn(store) {
+	return store[OBJECT_DETECTION_KEY] !== false;
+}
+function objectDetectionKey(deviceId) {
+	return `alexa:${deviceId}:objectDetection`;
+}
+/** The camera's "Object detection in Alexa" field. */
+function objectDetectionField(input) {
+	const showWhen = {
+		field: input.enabledKey,
+		equals: true
+	};
+	if (!input.integrationOn) return {
+		type: "info",
+		key: `${objectDetectionKey(input.deviceId)}:off`,
+		label: "Object detection in Alexa (experimental)",
+		content: "Object detection is switched off for the whole Alexa integration (Alexa settings → Object detection).",
+		variant: "info",
+		showWhen
+	};
+	return {
+		type: "boolean",
+		key: objectDetectionKey(input.deviceId),
+		label: "Object detection in Alexa (experimental)",
+		description: "Send this camera's person (and, with a package zone, package) detections to Alexa as events, with their history on the camera in the Alexa app. Amazon documents this for US English only. If Alexa stops showing the camera after this is on, switch it off: the camera returns after the next re-sync.",
+		style: "switch",
+		value: cameraObjectDetectionOn(input.store),
+		showWhen,
+		immediate: true
+	};
+}
+var AlexaVisionRuntime = class {
+	deps;
+	state;
+	feed;
+	constructor(deps) {
+		this.deps = deps;
+		this.state = new VisionStateStore({
+			read: (deviceId) => this.readPrefs(deviceId),
+			write: (deviceId, patch) => this.writePrefs(deviceId, patch)
+		});
+		this.feed = new ObjectDetectionFeed({
+			eventBus: deps.ctx.eventBus,
+			reportableClasses: (deviceId) => this.reportable(deviceId),
+			namespace: deps.namespace,
+			remember: (deviceId, entry) => this.state.remember(deviceId, [entry]),
+			post: (deviceId, detection) => deps.post({
+				deviceId,
+				detection,
+				imagesFor: (userId) => this.imagesFor(userId, deviceId, detection.trackId, detection.timestamp)
+			}),
+			logger: deps.logger
+		});
+	}
+	start() {
+		this.feed.start();
+	}
+	stop() {
+		this.feed.stop();
+	}
+	/** This addon's per-device store for a camera; `{}` when unreadable. */
+	async readPrefs(deviceId) {
+		try {
+			return await this.deps.ctx.settings?.readDeviceStore(deviceId) ?? {};
+		} catch (err) {
+			this.deps.logger.debug("alexa: per-device settings unreadable — using defaults", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
+			return {};
+		}
+	}
+	async writePrefs(deviceId, patch) {
+		const settings = this.deps.ctx.settings;
+		if (settings === void 0) throw new Error("export-alexa: no per-device settings store");
+		await settings.writeDeviceStore(deviceId, patch);
+		this.state.invalidate(deviceId);
+	}
+	/** What the endpoint build declares for a camera, from a FRESH class read. */
+	async buildClasses(deviceId, available) {
+		if (!this.deps.integrationOn()) return [];
+		if (!cameraObjectDetectionOn(await this.readPrefs(deviceId))) return [];
+		return declaredVisionClasses(available);
+	}
+	/** What a camera declares right now, without reading its pipeline. */
+	async declared(deviceId) {
+		if (!this.deps.integrationOn() || !this.deps.isExposed(deviceId)) return [];
+		if (!cameraObjectDetectionOn(await this.readPrefs(deviceId))) return [];
+		return declaredVisionClasses(this.deps.knownClasses(deviceId));
+	}
+	async reportable(deviceId) {
+		const declared = await this.declared(deviceId);
+		if (declared.length === 0) return [];
+		return reportableVisionClasses(declared, await this.state.get(deviceId));
+	}
+	/** Fresh, per-user, ten-minute image URIs for one event — or none. */
+	imagesFor(userId, deviceId, trackId, at) {
+		if (!this.deps.snapshotsOn()) return {};
+		const base = this.deps.publicHubUrl().replace(/\/+$/, "");
+		if (!base.startsWith("https://")) return {};
+		const frame = this.deps.store.mintLazy({
+			deviceId,
+			userId,
+			capturedAt: at,
+			load: () => this.loadImage(deviceId, trackId, FRAME_KINDS, at)
+		});
+		const crop = this.deps.store.mintLazy({
+			deviceId,
+			userId,
+			capturedAt: at,
+			load: () => this.loadImage(deviceId, trackId, CROP_KINDS, null)
+		});
+		return {
+			frameImageUri: `${base}${frame.path}`,
+			croppedImageUri: `${base}${crop.path}`
+		};
+	}
+	/** The directive handlers' view (`handlers/data-controller.ts`). */
+	context() {
+		const api = this.deps.ctx.api;
+		return {
+			ctx: this.deps.ctx,
+			logger: this.deps.logger,
+			vision: this.state,
+			declaredClasses: (deviceId) => this.declared(deviceId),
+			namespace: this.deps.namespace,
+			listTracks: async (deviceId, q) => {
+				return RecentTracksSchema.parse(await api.pipelineAnalytics.listRecentTracks.query({
+					deviceIds: [deviceId],
+					since: q.since,
+					until: q.until,
+					limit: q.limit,
+					projection: "slim"
+				})).tracks;
+			},
+			getTrack: async (deviceId, trackId) => TrackSchema.parse(await api.pipelineAnalytics.getTrack.query({
+				deviceId,
+				trackId
+			})),
+			imagesFor: (userId, deviceId, trackId, at) => this.imagesFor(userId, deviceId, trackId, at)
+		};
+	}
+	async loadImage(deviceId, trackId, kinds, liveFallbackAt) {
+		const encode = this.deps.encode ?? toAlexaJpeg;
+		try {
+			const rows = array(MediaRowSchema).parse(await this.deps.ctx.api.pipelineAnalytics.getTrackMedia.query({
+				trackId,
+				deviceId,
+				kinds: [...kinds]
+			}));
+			for (const kind of kinds) {
+				const row = rows.find((r) => r.kind === kind);
+				if (row !== void 0) return (await encode(Buffer.from(row.base64, "base64"))).bytes;
+			}
+			const now = this.deps.now?.() ?? Date.now();
+			if (liveFallbackAt !== null && now - liveFallbackAt < LIVE_FALLBACK_MS) {
+				const snap = SnapshotImageSchema.safeParse(await this.deps.ctx.api.snapshot.getSnapshot.query({ deviceId }));
+				if (snap.success) return (await encode(Buffer.from(snap.data.base64, "base64"))).bytes;
+			}
+			return null;
+		} catch (err) {
+			this.deps.logger.warn("alexa object detection: image read failed", {
+				tags: { deviceId },
+				meta: {
+					trackId,
+					error: errMsg(err)
+				}
+			});
+			return null;
+		}
+	}
+};
+//#endregion
 //#region src/oauth-integration.ts
 /**
 * The `export-alexa` OAuth client — the descriptor behind
@@ -55204,20 +56595,13 @@ function buildAlexaOauthIntegration(publicHubUrl) {
 function buildAlexaSetupBlock(input) {
 	const base = input.publicHubUrl.replace(/\/+$/, "");
 	return {
-		fields: [
-			...base ? [{
-				label: "Directive endpoint",
-				value: `${base}/addon/export-alexa/directive`
-			}] : [],
-			...input.ingressToken ? [{
-				label: "Ingress token (Lambda HUB_INGRESS_TOKEN) — use \"Show ingress token\" in settings",
-				value: maskSecretTail(input.ingressToken)
-			}] : [],
-			{
-				label: "Linked Alexa accounts",
-				value: String(input.linkedAccountCount)
-			}
-		],
+		fields: [...base ? [{
+			label: "Directive endpoint",
+			value: `${base}/addon/export-alexa/directive`
+		}] : [], ...input.ingressToken && input.skillMode === "custom" ? [{
+			label: "Ingress token (Lambda HUB_INGRESS_TOKEN) — use \"Show ingress token\" in settings",
+			value: maskSecretTail(input.ingressToken)
+		}] : []],
 		note: base ? "Account linking is handled by the core OAuth server. Use the hub's /api/oauth2/authorize endpoint with integration=export-alexa." : "Set the public hub URL on the settings form first — the directive endpoint URL is derived from it."
 	};
 }
@@ -55301,6 +56685,7 @@ var SnapshotStore = class {
 	secret;
 	now;
 	images = /* @__PURE__ */ new Map();
+	loading = /* @__PURE__ */ new Map();
 	totalBytes = 0;
 	constructor(secret, now = Date.now) {
 		this.secret = secret;
@@ -55329,6 +56714,59 @@ var SnapshotStore = class {
 			path: `/addon/export-alexa/snapshot/${imageId}.jpg?exp=${expiresAt}&sig=${signExpiringUrl(this.secret(), imageId, expiresAt)}`
 		};
 	}
+	/**
+	* Mint a URL whose pixels are read on the first authorised fetch (R4,
+	* D779). Costs nothing until then, so a history page can carry twenty image
+	* URIs without reading twenty images inside Alexa's response budget. Bounded
+	* by count like every entry; by bytes once loaded.
+	*/
+	mintLazy(input) {
+		this.prune();
+		const imageId = randomUUID();
+		const expiresAt = this.now() + SNAPSHOT_URL_TTL_MS;
+		this.images.set(imageId, {
+			imageId,
+			deviceId: input.deviceId,
+			userId: input.userId,
+			bytes: Buffer.alloc(0),
+			load: input.load,
+			contentType: "image/jpeg",
+			capturedAt: input.capturedAt,
+			expiresAt
+		});
+		this.evictOverBounds();
+		return {
+			imageId,
+			expiresAt,
+			path: `/addon/export-alexa/snapshot/${imageId}.jpg?exp=${expiresAt}&sig=${signExpiringUrl(this.secret(), imageId, expiresAt)}`
+		};
+	}
+	/**
+	* The bytes of a found image — loading a lazy one once (concurrent fetches
+	* share the read). `null` when a lazy image has nothing to show.
+	*/
+	async bytesOf(image) {
+		if (image.load === void 0) return image.bytes;
+		let pending = this.loading.get(image.imageId);
+		if (pending === void 0) {
+			pending = image.load().catch(() => null);
+			this.loading.set(image.imageId, pending);
+		}
+		const bytes = await pending;
+		this.loading.delete(image.imageId);
+		if (bytes === null) return null;
+		const held = this.images.get(image.imageId);
+		if (held !== void 0 && held.load !== void 0) {
+			this.images.set(image.imageId, {
+				...held,
+				bytes,
+				load: void 0
+			});
+			this.totalBytes += bytes.length;
+			this.evictOverBounds();
+		}
+		return bytes;
+	}
 	/** Resolve a fetch of a minted URL. */
 	lookup(imageId, exp, sig) {
 		const now = this.now();
@@ -55360,6 +56798,7 @@ var SnapshotStore = class {
 	/** Drop everything — the integration switch was turned off. */
 	clear() {
 		this.images.clear();
+		this.loading.clear();
 		this.totalBytes = 0;
 	}
 	get size() {
@@ -55631,6 +57070,9 @@ var StateChangeReporter = class {
 var PUBLIC_SKILL_ID = "amzn1.ask.skill.aa85d6df-1600-4f13-bda9-babcfdc849e6";
 //#endregion
 //#region src/sync-engine.ts
+function declaresObjectDetection(endpoint) {
+	return endpoint.capabilities.some((c) => c.interface === "Alexa.SmartVision.ObjectDetectionSensor");
+}
 /**
 * Devices reconciled at once in {@link SyncEngine.reconcileAllExposed}. Each
 * lane's device build is a handful of cross-process tRPC calls — latency, not
@@ -55770,9 +57212,25 @@ var SyncEngine = class {
 			});
 		});
 		if (visible.length === 0) return true;
-		const ok = await this.deps.postAddOrUpdate(userId, visible);
-		if (ok) this.deps.afterPush(userId, visible);
-		return ok;
+		const isolated = visible.filter(declaresObjectDetection);
+		const rest = visible.filter((e) => !declaresObjectDetection(e));
+		let allOk = true;
+		for (const batch of [...isolated.map((e) => [e]), ...rest.length > 0 ? [rest] : []]) {
+			const ok = await this.deps.postAddOrUpdate(userId, batch);
+			for (const endpoint of batch) this.deps.logger.info("alexa sync: AddOrUpdateReport endpoint result", {
+				tags: { deviceId },
+				meta: {
+					userId,
+					endpointId: endpoint.endpointId,
+					gatewayAccepted: ok,
+					isolated: batch.length === 1 && isolated.includes(endpoint),
+					interfaces: endpoint.capabilities.map((c) => c.instance === void 0 ? c.interface : `${c.interface}#${c.instance}`)
+				}
+			});
+			if (ok) this.deps.afterPush(userId, batch);
+			else allOk = false;
+		}
+		return allOk;
 	}
 	/** A device the account's user just gained (visibility mirror). */
 	async pushDeviceToAccount(userId, deviceId) {
@@ -55800,7 +57258,7 @@ var SyncEngine = class {
 		const accounts = this.deps.listLinkedAccounts();
 		const failures = [];
 		for (const account of accounts) if (!await this.deps.postDelete(account.userId, ids)) failures.push(`${account.userId}:${deviceId}`);
-		await this.recordEndpoints(deviceId, [], null);
+		if (failures.length === 0) await this.recordEndpoints(deviceId, [], null);
 		return {
 			deviceId,
 			endpointCount: ids.length,
@@ -55809,6 +57267,51 @@ var SyncEngine = class {
 		};
 	}
 	/**
+	* The operator's Re-sync: re-send every exposed device (whatever the
+	* signatures say), then delete from Alexa every device we still track but no
+	* longer expose — an unexpose whose DeleteReport failed.
+	*
+	* Only devices ABSENT from the exposed list are deleted. That list is the
+	* operator's persisted choice, not a read that can fail transiently; what an
+	* exposed device happens not to build this time is never deleted here
+	* (D49 / D767).
+	*/
+	async resync() {
+		const push = await this.pushAllExposed();
+		const exposed = new Set(this.deps.listExposed().map((e) => e.deviceId));
+		const unexposed = Object.entries(this.deps.getExportedEndpoints()).map(([key, ids]) => ({
+			deviceId: Number(key),
+			ids
+		})).filter((entry) => !exposed.has(entry.deviceId) && entry.ids.length > 0);
+		const canDelete = push.accountCount > 0 && this.deps.hasProactiveCredentials();
+		let removedEndpointCount = 0;
+		let retainedEndpointCount = 0;
+		let failedCount = push.failures.length;
+		for (const { deviceId, ids } of unexposed) {
+			if (!canDelete) {
+				retainedEndpointCount += ids.length;
+				continue;
+			}
+			const r = await this.removeDevice(deviceId);
+			failedCount += r.failures.length;
+			if (r.failures.length === 0) removedEndpointCount += ids.length;
+			else retainedEndpointCount += ids.length;
+		}
+		if (unexposed.length > 0) this.deps.logger.info("alexa sync: re-sync cleaned up devices that are no longer exposed", { meta: {
+			deviceIds: unexposed.map((u) => u.deviceId),
+			removedEndpointCount,
+			retainedEndpointCount
+		} });
+		return {
+			deviceCount: push.deviceCount,
+			endpointCount: push.endpointCount,
+			accountCount: push.accountCount,
+			removedEndpointCount,
+			retainedEndpointCount,
+			failedCount
+		};
+	}
+	/**
 	* Re-push ONE exposed device if the endpoint shape it builds today differs
 	* from the shape Alexa was last told about.
 	*
@@ -55993,19 +57496,35 @@ var DEFAULT_CONFIG = {
 	exportedEndpoints: {},
 	exportedSignatures: {},
 	publicHubUrl: "",
-	availableEndpoints: [],
 	ingressToken: "",
 	enforceIngressToken: false,
-	staleEndpointPurgeInput: "",
 	accountVisibility: {},
 	detectionSensors: true,
 	detectionClasses: {},
 	snapshots: true,
-	snapshotSigningKey: ""
+	snapshotSigningKey: "",
+	objectDetection: true,
+	visionNamespace: ""
 };
 /** The one field of `oauthVerifyAccessToken`'s answer the snapshot route
 *  reads. */
 var VerifiedTokenSchema = object({ userId: string() }).nullable();
+/**
+* Settings as the runtime reads them. In `skillMode: 'public'` the skill id is
+* the built-in skill's, and the ingress token is never required: the public
+* skill's Lambda is shared by every hub and sends one `HUB_INGRESS_TOKEN` for
+* all of them, so enforcing a per-hub token would refuse every directive. The
+* persisted values stay untouched, so switching back to `custom` restores
+* them. There is no credential to overlay any more (D753).
+*/
+function effectiveAlexaSettings(config) {
+	if (config.skillMode !== "public") return config;
+	return {
+		...config,
+		expectedAudience: PUBLIC_SKILL_ID,
+		enforceIngressToken: false
+	};
+}
 /** UI filter for the Export picker. `alarm-panel` publishes an
 *  `Alexa.SecurityPanelController` endpoint (`endpoints/builder.ts`). */
 var SUPPORTED_KINDS = [
@@ -56033,6 +57552,8 @@ var ExportAlexaAddon = class extends BaseAddon {
 	*  restart answers 410 and Alexa asks again. */
 	snapshotStore = new SnapshotStore(() => this.config.snapshotSigningKey);
 	detectionFeed = null;
+	/** R4 (D779): object detection + event history. */
+	visionRef = null;
 	stateReporter = null;
 	/** The switches whose change re-shapes every exposed endpoint, as last
 	*  applied — `onConfigChanged` runs on EVERY settings write. */
@@ -56045,6 +57566,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 	async onInitialize() {
 		if (!this.config.ingressToken) await this.updateGlobalSettings({ ingressToken: generateIngressToken() });
 		if (!this.config.snapshotSigningKey) await this.updateGlobalSettings({ snapshotSigningKey: generateIngressToken() });
+		if (!this.config.visionNamespace) await this.updateGlobalSettings({ visionNamespace: randomUUID() });
 		if (this.config.lwaClientSecret) {
 			await this.updateGlobalSettings({ lwaClientSecret: "" });
 			this.ctx.logger.warn("export-alexa: removed a stored LWA client secret — the hub no longer uses one; your skill Lambda holds it (D753)");
@@ -56068,6 +57590,18 @@ var ExportAlexaAddon = class extends BaseAddon {
 			setStored: (next) => this.updateGlobalSettings({ accountVisibility: next }),
 			logger: this.ctx.logger
 		});
+		this.visionRef = new AlexaVisionRuntime({
+			ctx: this.ctx,
+			logger: this.ctx.logger,
+			integrationOn: () => this.config.objectDetection,
+			snapshotsOn: () => this.config.snapshots,
+			isExposed: (deviceId) => this.config.exposed.some((e) => e.deviceId === deviceId),
+			knownClasses: (deviceId) => this.config.detectionClasses[deviceId]?.classes ?? [],
+			namespace: () => this.config.visionNamespace,
+			publicHubUrl: () => this.config.publicHubUrl,
+			store: this.snapshotStore,
+			post: (opts) => this.requireGateway().postObjectDetection(opts)
+		});
 		const deviceExportProvider = {
 			getStatus: async () => ({
 				linkState: this.config.linkedAccounts.length > 0 ? "linked" : "unlinked",
@@ -56140,6 +57674,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 					enabled: () => this.config.snapshots,
 					publicHubUrl: () => this.config.publicHubUrl
 				},
+				vision: this.vision.context(),
 				access: this.endpointAccess,
 				afterDiscovery: (userId, endpoints) => this.requireGateway().scheduleInitialConnectivity(userId, endpoints)
 			},
@@ -56199,6 +57734,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 			logger: this.ctx.logger
 		});
 		this.detectionFeed.start();
+		this.vision.start();
 		this.appliedShapeSwitches = this.shapeSwitches();
 		this.stateReporter = new StateChangeReporter({
 			eventBus: this.ctx.eventBus,
@@ -56278,14 +57814,25 @@ var ExportAlexaAddon = class extends BaseAddon {
 			],
 			customActions: exportAlexaActions,
 			actionHandlers: {
-				redetectHubUrl: async () => this.redetectPublicHubUrl(),
+				listExternalAddresses: async () => this.listExternalAddresses(),
 				regenerateIngressToken: async () => this.regenerateIngressToken(),
 				revealIngressToken: async () => {
 					this.ctx.logger.info("export-alexa: an administrator revealed the ingress token");
 					return { ingressToken: this.config.ingressToken };
 				},
 				resyncDiscovery: async () => this.resyncDiscovery(),
-				purgeStaleEndpoints: async () => this.purgeStaleEndpoints(),
+				removeAlexaEndpoints: async ({ endpointIds }) => removeEndpointsFromAlexa({
+					raw: endpointIds,
+					purge: (ids) => this.requireGateway().purgeEndpoints(ids),
+					getTracked: () => this.config.exportedEndpoints,
+					setTracked: (next) => this.updateGlobalSettings({ exportedEndpoints: next })
+				}).then((r) => {
+					this.ctx.logger.info("export-alexa: operator removed endpoint ids from Alexa", { meta: {
+						...r,
+						endpointIds
+					} });
+					return r;
+				}),
 				unlinkAlexaAccounts: async () => this.unlinkAlexaAccounts(),
 				rotateBrokerCredential: async () => this.rotateBrokerCredentials()
 			}
@@ -56294,6 +57841,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 	async onShutdown() {
 		this.detectionFeed?.stop();
 		this.detectionFeed = null;
+		this.visionRef?.stop();
 		this.stateReporter?.stop();
 		this.stateReporter = null;
 		if (this.lwaGateway) {
@@ -56347,18 +57895,26 @@ var ExportAlexaAddon = class extends BaseAddon {
 	*/
 	async buildEndpointsForOneDevice(deviceId) {
 		const classSource = this.detectionClassSource;
+		const vision = this.vision;
+		let available = null;
+		const classesOf = (id) => {
+			available ??= classSource === null ? Promise.resolve([]) : classSource.classesFor(id);
+			return available;
+		};
 		return buildEndpointsForExposedDevice(deviceId, {
 			ctx: this.ctx,
 			logger: this.ctx.logger,
 			snapshots: this.config.snapshots,
-			...this.config.detectionSensors && classSource !== null ? { detectionClasses: (id) => classSource.classesFor(id) } : {}
+			...this.config.detectionSensors ? { detectionClasses: async (id) => effectiveSensorClasses(await classesOf(id), parseSensorSelection(await vision.readPrefs(id))) } : {},
+			...this.config.objectDetection ? { objectDetection: async (id) => vision.buildClasses(id, await classesOf(id)) } : {}
 		});
 	}
 	/** The settings that change every exposed endpoint's shape, as one key. */
 	shapeSwitches() {
 		return JSON.stringify({
 			detectionSensors: this.config.detectionSensors,
-			snapshots: this.config.snapshots
+			snapshots: this.config.snapshots,
+			objectDetection: this.config.objectDetection
 		});
 	}
 	/**
@@ -56380,7 +57936,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 	}
 	scheduleDetectionClassRefresh() {
 		const timer = setInterval(() => {
-			if (!this.config.detectionSensors) return;
+			if (!this.config.detectionSensors && !this.config.objectDetection) return;
 			this.requireSyncEngine().reconcileAllExposed().catch((err) => {
 				this.ctx.logger.warn("export-alexa: detection-class refresh failed", { meta: { error: errMsg(err) } });
 			});
@@ -56388,6 +57944,10 @@ var ExportAlexaAddon = class extends BaseAddon {
 		timer.unref?.();
 		this.ctx.addDisposer(async () => clearInterval(timer));
 	}
+	get vision() {
+		if (!this.visionRef) throw new Error("export-alexa: vision runtime not initialized");
+		return this.visionRef;
+	}
 	get visibility() {
 		if (!this.visibilityRef) throw new Error("export-alexa: visibility mirror not initialized");
 		return this.visibilityRef;
@@ -56512,49 +58072,17 @@ var ExportAlexaAddon = class extends BaseAddon {
 			});
 		}
 	}
-	async resyncDiscovery() {
-		const r = await this.requireSyncEngine().pushAllExposed();
-		this.ctx.logger.info("export-alexa: manual discovery re-sync", { meta: { ...r } });
-		return {
-			endpointCount: r.endpointCount,
-			accountCount: r.accountCount
-		};
-	}
 	/**
-	* Manual "Purge stale Alexa endpoints" button. Reads the comma/newline/
-	* whitespace-separated id list the operator pasted into
-	* `staleEndpointPurgeInput`, POSTs a `DeleteReport` per linked account,
-	* then clears the input field so a re-click is idempotent. Also drops
-	* any `exportedEndpoints` device whose endpoint ids were all purged so a
-	* later DeleteReport doesn't try to re-delete them.
+	* The Re-sync button: every exposed device re-sent, and the devices still
+	* tracked but no longer exposed deleted from Alexa (`SyncEngine.resync`).
+	* Throws when nothing can be sent, so the button says why.
 	*/
-	async purgeStaleEndpoints() {
-		const ids = this.config.staleEndpointPurgeInput.split(/[\s,]+/).map((s) => s.trim()).filter((s) => s.length > 0);
-		if (ids.length === 0) return {
-			requested: 0,
-			accountCount: 0,
-			attemptedAccounts: 0
-		};
-		const result = await this.lwaGateway?.purgeEndpoints(ids) ?? {
-			requested: ids.length,
-			accountCount: 0,
-			attemptedAccounts: 0
-		};
-		const purgedSet = new Set(ids);
-		const nextEndpoints = {};
-		for (const [deviceIdKey, endpointIds] of Object.entries(this.config.exportedEndpoints)) {
-			const remaining = endpointIds.filter((id) => !purgedSet.has(id));
-			if (remaining.length > 0) nextEndpoints[Number(deviceIdKey)] = remaining;
-		}
-		await this.updateGlobalSettings({
-			staleEndpointPurgeInput: "",
-			exportedEndpoints: nextEndpoints
-		});
-		this.ctx.logger.info("export-alexa: manual stale-endpoint purge", { meta: {
-			...result,
-			endpointIds: ids
-		} });
-		return result;
+	async resyncDiscovery() {
+		if (this.config.linkedAccounts.length === 0) throw new Error("No linked Amazon account. Link the skill from the Alexa app first.");
+		if (this.config.tokens.length === 0) throw new Error("No Amazon push grant is stored for the linked account, so nothing can be sent. Re-link the skill from the Alexa app.");
+		const r = await this.requireSyncEngine().resync();
+		this.ctx.logger.info("export-alexa: manual discovery re-sync", { meta: { ...r } });
+		return r;
 	}
 	/**
 	* Sever the Amazon account link. Backs the "Unlink Amazon account" button.
@@ -56584,7 +58112,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 	* Deliberately does NOT send a `DeleteReport` first. Amazon drops the
 	* endpoints itself when the account is unlinked, and a purge needs the very
 	* token we are about to discard — a best-effort push here would make the
-	* result claim work it cannot verify. Use "Purge stale Alexa endpoints" if
+	* result claim work it cannot verify. Use "Remove ids from Alexa" if
 	* ghosts survive.
 	*/
 	async unlinkAlexaAccounts() {
@@ -56674,19 +58202,9 @@ var ExportAlexaAddon = class extends BaseAddon {
 		});
 		if (missing.length > 0) this.ctx.logger.info("export-alexa: backfilled linked accounts from stored LWA tokens", { meta: { count: missing.length } });
 	}
-	/**
-	* Settings as the runtime should read them. In `skillMode: 'public'` the
-	* skill id is swapped for the built-in CamStack skill's; the operator's own
-	* `expectedAudience` stays untouched in the persisted config so switching
-	* back to `custom` restores it. Everything else passes through. There is no
-	* credential to overlay any more (D753).
-	*/
+	/** Settings as the runtime reads them (`effectiveAlexaSettings`). */
 	effectiveSettings() {
-		if (this.config.skillMode !== "public") return this.config;
-		return {
-			...this.config,
-			expectedAudience: PUBLIC_SKILL_ID
-		};
+		return effectiveAlexaSettings(this.config);
 	}
 	/** Persist the broker origin the Lambda advertised on a verified directive. */
 	rememberAdvertisedBroker(raw) {
@@ -56719,6 +58237,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 	* broker no longer recognises is reported, not retried — re-link instead.
 	*/
 	async rotateBrokerCredentials() {
+		if (!this.config.tokens.some(isBrokerGrant)) throw new Error("No link is held at the skill's token broker, so there is no credential to rotate. Link the skill from the Alexa app first.");
 		let rotated = 0;
 		let failed = 0;
 		for (const t of this.config.tokens) {
@@ -56775,7 +58294,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 		if (fromList.length > 0) return fromList;
 		const single = await this.detectFromGetStatus();
 		if (single.length > 0) return [single];
-		this.ctx.logger.warn("export-alexa: no connected HTTPS remote-access endpoint — Alexa Lambda has no hub URL to route to. Set up Cloudflare Tunnel / Tailscale Funnel and press \"Refresh external addresses\" on the Alexa addon page.");
+		this.ctx.logger.warn("export-alexa: no connected HTTPS remote-access endpoint — Alexa Lambda has no hub URL to route to. Set up Cloudflare Tunnel / Tailscale Funnel; the External address picker on the Alexa page lists it once connected.");
 		return [];
 	}
 	/** Aggregate `listEndpoints` → every HTTPS entry's url, de-duplicated. */
@@ -56803,33 +58322,29 @@ var ExportAlexaAddon = class extends BaseAddon {
 		}
 	}
 	/**
-	* Boot-time best-effort: refresh the cached endpoint list that backs the
-	* "External address" picker, and default the selection to the first
-	* endpoint only when the operator hasn't already chosen one.
+	* Boot-time best-effort: default the external address to the first
+	* detected endpoint when the operator hasn't chosen one. The picker reads
+	* its options live, so nothing is cached here.
 	*/
 	async autoDetectPublicHubUrl() {
-		const endpoints = await this.resolveEndpoints();
-		const first = endpoints[0];
-		const defaulted = !this.config.publicHubUrl && first ? first : void 0;
-		await this.updateGlobalSettings(defaulted ? {
-			availableEndpoints: endpoints,
-			publicHubUrl: defaulted
-		} : { availableEndpoints: endpoints });
-		if (defaulted) this.ctx.logger.info("export-alexa: defaulted public hub URL to first external address", { meta: { url: defaulted } });
+		if (this.config.publicHubUrl) return;
+		const defaulted = (await this.resolveEndpoints())[0];
+		if (defaulted) {
+			await this.updateGlobalSettings({ publicHubUrl: defaulted });
+			this.ctx.logger.info("export-alexa: defaulted public hub URL to first external address", { meta: { url: defaulted } });
+		}
 	}
 	/**
-	* Re-scan the connected `network-access` providers, refresh the cached
-	* endpoint list for the picker, and keep the operator's current selection
-	* when it's still present (otherwise default to the first). Returns the URL
-	* we landed on (empty string when nothing is connected).
+	* Re-scan the connected `network-access` providers and keep the
+	* operator's current selection when it's still present (otherwise default
+	* to the first). Runs when a tunnel connects and behind the
+	* `/admin/redetect-hub-url` route. Returns the URL we landed on (empty
+	* string when nothing is connected).
 	*/
 	async redetectPublicHubUrl() {
 		const endpoints = await this.resolveEndpoints();
 		const publicHubUrl = this.config.publicHubUrl.length > 0 && endpoints.includes(this.config.publicHubUrl) ? this.config.publicHubUrl : endpoints[0] ?? "";
-		await this.updateGlobalSettings({
-			availableEndpoints: endpoints,
-			publicHubUrl
-		});
+		if (publicHubUrl !== this.config.publicHubUrl) await this.updateGlobalSettings({ publicHubUrl });
 		return { publicHubUrl };
 	}
 	/**
@@ -56857,224 +58372,36 @@ var ExportAlexaAddon = class extends BaseAddon {
 		return buildAlexaSetupBlock({
 			publicHubUrl: this.config.publicHubUrl,
 			ingressToken: this.config.ingressToken,
-			linkedAccountCount: this.config.linkedAccounts.length
+			skillMode: this.config.skillMode
 		});
 	}
-	/** Options for the "External address" picker: the cached HTTPS endpoints
-	*  plus the current selection (so a stale/custom value is never dropped). */
-	buildEndpointOptions() {
-		const urls = /* @__PURE__ */ new Set();
-		for (const u of this.config.availableEndpoints) if (u.length > 0) urls.add(u);
-		if (this.config.publicHubUrl.length > 0) urls.add(this.config.publicHubUrl);
-		const opts = [...urls].map((u) => ({
-			value: u,
-			label: u
+	/**
+	* The "External address" picker's options, read live: every HTTPS endpoint
+	* the connected remote-access providers report now, plus the saved choice
+	* when it is not among them, so a manual pick is never dropped from view.
+	*/
+	async listExternalAddresses() {
+		const detected = await this.resolveEndpoints();
+		const current = this.config.publicHubUrl;
+		const addresses = detected.map((url) => ({
+			value: url,
+			label: url
 		}));
-		return opts.length > 0 ? opts : [{
-			value: "",
-			label: "(no external address detected — set up remote-access, then Refresh)"
-		}];
+		return { addresses: current.length > 0 && !detected.includes(current) ? [...addresses, {
+			value: current,
+			label: `${current} (not detected now)`
+		}] : addresses };
 	}
+	/** The settings page: see `settings-schema.ts` for its layout. The account-
+	*  linking rows live in the `device-export` setup block instead. */
 	globalSettingsSchema() {
-		return this.schema({ sections: [{
-			id: "export-alexa",
-			title: "Alexa Smart Home export",
-			description: "Hub-side OAuth provider + Smart Home directive endpoint. Pairs with a user-owned AWS Lambda that forwards Alexa directives to this addon.",
-			columns: 1,
-			fields: [
-				{
-					type: "info",
-					key: "__setup-banner",
-					label: "Setup overview",
-					variant: "info",
-					content: [
-						"Public skill (default): enable the \"CamStack\" skill in the Alexa app and link your account — no Amazon developer setup is needed. A single published skill + hosted Lambda route to this hub using its public HTTPS URL (baked into every JWT).",
-						"The skill's Lambda keeps the Amazon credentials: this hub never holds an LWA client secret. It receives short-lived event tokens from the Lambda's token broker with a credential that is unique to this link.",
-						"Custom skill: switch \"Alexa skill\" below to Custom, enter your skill id, and deploy the skill Lambda from this addon's lambda-template in your own AWS account (your LWA credentials go into SSM Parameter Store there, not here).",
-						"Either way this hub must be reachable from the public internet (Cloudflare Tunnel, Tailscale Funnel, …). The \"External address\" picker selects which detected endpoint the Lambda calls back on — press \"Refresh external addresses\" after setting up a new tunnel."
-					].join("\n")
-				},
-				this.field({
-					type: "select",
-					key: "publicHubUrl",
-					label: "External address",
-					description: "Which connected external-access endpoint the Alexa Lambda reaches the hub on. Defaults to the first detected. Press \"Refresh external addresses\" after setting up a new tunnel.",
-					options: this.buildEndpointOptions(),
-					default: DEFAULT_CONFIG.publicHubUrl
-				}),
-				{
-					type: "button",
-					key: "__redetect-hub-url",
-					label: "External addresses",
-					description: "Re-scan the connected external-access providers and refresh the picker above. Keeps your current selection if it is still available, otherwise defaults to the first.",
-					buttonLabel: "Refresh external addresses",
-					action: "redetectHubUrl",
-					variant: "default"
-				},
-				this.field({
-					type: "select",
-					key: "skillMode",
-					label: "Alexa skill",
-					description: "Public: use the built-in CamStack skill — zero Amazon developer setup. Custom: bring your own skill and your own copy of the skill Lambda.",
-					options: [{
-						value: "public",
-						label: "Public (built-in CamStack skill)"
-					}, {
-						value: "custom",
-						label: "Custom skill"
-					}],
-					default: DEFAULT_CONFIG.skillMode
-				}),
-				this.field({
-					type: "select",
-					key: "region",
-					label: "Skill region",
-					description: "The Alexa Event Gateway this hub posts to: doorbell presses, motion, camera online/offline and state changes, and the device-list updates sent when you expose or unexpose a camera. Pick the region your Amazon account is in — events sent to another region are rejected.",
-					options: [
-						{
-							value: "NA",
-							label: "North America"
-						},
-						{
-							value: "EU",
-							label: "Europe"
-						},
-						{
-							value: "FE",
-							label: "Far East"
-						}
-					],
-					default: DEFAULT_CONFIG.region
-				}),
-				this.field({
-					type: "boolean",
-					key: "detectionSensors",
-					label: "Detection sensors",
-					description: "Give every exposed camera one Alexa motion sensor per class its detection pipeline finds: \"<camera> Person\", \"Vehicle\", \"Animal\", \"Package\". Use them as routine triggers in the Alexa app (for example: when Front door Person detects motion, announce on the Echo devices). They report only \"detected\" — no images. Off removes them from Alexa.",
-					default: DEFAULT_CONFIG.detectionSensors
-				}),
-				this.field({
-					type: "boolean",
-					key: "snapshots",
-					label: "Snapshots in the Alexa app",
-					description: "Show each exposed camera's latest still on its tile in the Alexa app. While this is on, Amazon fetches still images of your cameras (re-encoded to about 480 px, each link valid ten minutes and only with your account's token). Off removes the feature from Alexa and invalidates every link already handed out. The hub's public HTTPS address must be set.",
-					default: DEFAULT_CONFIG.snapshots
-				}),
-				...this.config.skillMode === "custom" ? [this.field({
-					type: "text",
-					key: "expectedAudience",
-					label: "Alexa skill id",
-					description: "Your skill's id, format amzn1.ask.skill.xxxx. Found on the Alexa developer console; used to gate directives the next dispatch will start signing.",
-					default: DEFAULT_CONFIG.expectedAudience
-				}), {
-					type: "info",
-					key: "__custom-skill-info",
-					label: "Your skill Lambda",
-					variant: "info",
-					content: "Proactive events (doorbell, motion, online/offline, device-list updates) are authorised by YOUR skill Lambda: it keeps the \"Send Alexa Events\" LWA client id/secret in SSM Parameter Store and hands this hub short-lived tokens. Nothing to paste here — see the custom-skill setup guide."
-				}] : [{
-					type: "info",
-					key: "__public-skill-info",
-					label: "Built-in skill",
-					variant: "info",
-					content: "Using the built-in CamStack public skill — its Amazon credentials stay in the skill's Lambda, never on this hub. Pick your region above, then just enable \"CamStack\" in the Alexa app and link your account. Switch to \"Custom skill\" above to use your own."
-				}],
-				{
-					type: "info",
-					key: "__alexa-link-status",
-					label: "Account link",
-					variant: "info",
-					content: buildLinkStatusContent({
-						linkedAccounts: this.config.linkedAccounts,
-						tokens: this.config.tokens,
-						now: Date.now()
-					})
-				},
-				{
-					type: "button",
-					key: "__unlink-alexa-accounts",
-					label: "Unlink Amazon account",
-					description: "Revokes every active Alexa account-link session on this hub and discards the stored Amazon push grant. Live view, voice control and proactive events stop immediately. This is the ONLY way to sever the link — the account-linking token never expires on its own. Re-link afterwards from the Alexa app; the new link also picks up any widened permissions, because scopes are frozen at consent.",
-					buttonLabel: "Unlink now",
-					action: "unlinkAlexaAccounts",
-					variant: "danger",
-					confirmMessage: "Unlink the Amazon account? Alexa loses access to your cameras immediately and you must re-link from the Alexa app to restore it."
-				},
-				{
-					type: "button",
-					key: "__rotate-broker-credential",
-					label: "Skill broker credential",
-					description: "Replace the credential this hub uses at the skill's token broker with a fresh one. The old one stops working immediately. Use it if a backup of this hub's settings may have leaked. Re-linking from the Alexa app also issues a fresh one.",
-					buttonLabel: "Rotate credential",
-					action: "rotateBrokerCredential",
-					variant: "default"
-				},
-				{
-					type: "button",
-					key: "__resync-discovery",
-					label: "Sync devices to Alexa",
-					description: "Re-send the exposed device list to Alexa now (AddOrUpdateReport). Devices normally sync automatically when you expose/unexpose them — use this if a camera has not appeared in the Alexa app yet. Requires a linked account.",
-					buttonLabel: "Re-sync devices now",
-					action: "resyncDiscovery",
-					variant: "default"
-				},
-				this.field({
-					type: "textarea",
-					key: "staleEndpointPurgeInput",
-					label: "Purge stale Alexa endpoints",
-					description: "Comma / newline / whitespace separated Alexa endpoint ids to force-delete (Alexa.Discovery/DeleteReport). Use when an old camera still shows in the Alexa app even though it is not in your exposed list (left over from a previous link / addon version). Endpoint id is typically the camstack deviceId — e.g. \"54\" for the camera, \"54__privacy\" for its privacy toggle, \"54__98\" for a child accessory. Save this field first, then press the button below — the input is cleared after a successful purge.",
-					rows: 3,
-					default: DEFAULT_CONFIG.staleEndpointPurgeInput
-				}),
-				{
-					type: "button",
-					key: "__purge-stale-endpoints",
-					label: "Purge endpoints",
-					description: "Sends DeleteReport for every endpoint id listed above. Requires a linked account with proactive credentials. Check the addon log for per-account delivery outcomes.",
-					buttonLabel: "Purge now",
-					action: "purgeStaleEndpoints",
-					variant: "danger",
-					confirmMessage: "Send DeleteReport for these endpoint ids to all linked Alexa accounts? The action clears the input on success."
-				},
-				{
-					type: "info",
-					key: "__ingress-token-info",
-					label: "Ingress token",
-					variant: "info",
-					content: "Defense-in-depth shared secret. Press \"Show ingress token\" to read it (it is never part of a status or settings read), paste it into your Alexa Lambda's HUB_INGRESS_TOKEN env, then enable \"Require ingress token\" below. Use \"Regenerate token\" to rotate (update the Lambda afterwards)."
-				},
-				{
-					type: "addon-action-button",
-					addonId: "export-alexa",
-					key: "__reveal-ingress-token",
-					label: "Show ingress token",
-					description: "Administrators only. Shows the current token once, here.",
-					buttonLabel: "Show ingress token",
-					action: "revealIngressToken",
-					variant: "default",
-					successMessage: "Ingress token: {ingressToken}"
-				},
-				{
-					type: "addon-action-button",
-					addonId: "export-alexa",
-					key: "__regenerate-ingress-token",
-					label: "Rotate ingress token",
-					description: "Generate a new ingress token, invalidating the old one. Update your Lambda's HUB_INGRESS_TOKEN afterwards.",
-					buttonLabel: "Regenerate token",
-					action: "regenerateIngressToken",
-					variant: "default",
-					successMessage: "New ingress token: {ingressToken} — paste it into HUB_INGRESS_TOKEN now.",
-					confirmMessage: "Rotate the ingress token? With \"Require ingress token\" on, the Lambda is refused until you update HUB_INGRESS_TOKEN."
-				},
-				this.field({
-					type: "boolean",
-					key: "enforceIngressToken",
-					label: "Require ingress token",
-					description: "When on, /directive and the LWA callback reject calls without a matching ingress token. Turn on AFTER you have set HUB_INGRESS_TOKEN in your Lambda.",
-					default: DEFAULT_CONFIG.enforceIngressToken
-				})
-			]
-		}] });
+		return { sections: buildAlexaSettingsSections({
+			skillMode: this.config.skillMode,
+			linkedAccounts: this.config.linkedAccounts,
+			tokens: this.config.tokens,
+			now: Date.now(),
+			defaults: DEFAULT_CONFIG
+		}) };
 	}
 	/**
 	* One sweep: ask the broker which held sessions are still alive, and release
@@ -57147,11 +58474,51 @@ var ExportAlexaAddon = class extends BaseAddon {
 						value: enabled,
 						immediate: true
 					},
-					...kind === "camera" ? this.cameraOnlyExportFields(deviceId, settings, enabledKey) : []
+					...kind === "camera" ? this.cameraOnlyExportFields(deviceId, settings, enabledKey) : [],
+					...kind === "camera" ? await this.cameraDetectionFields(deviceId, enabledKey) : []
 				]
 			}]
 		};
 	}
+	/**
+	* The camera's detection fields: which classes become Alexa sensors (D778;
+	* only the classes its pipeline produces are offered) and its object
+	* detection toggle (D779).
+	*/
+	async cameraDetectionFields(deviceId, enabledKey) {
+		const store = await this.vision.readPrefs(deviceId);
+		return [sensorSelectionField({
+			deviceId,
+			available: this.detectionClassSource === null ? [] : await this.detectionClassSource.classesFor(deviceId).catch(() => []),
+			saved: parseSensorSelection(store),
+			enabledKey,
+			masterOn: this.config.detectionSensors
+		}), objectDetectionField({
+			deviceId,
+			store,
+			enabledKey,
+			integrationOn: this.config.objectDetection
+		})];
+	}
+	/**
+	* Persist the camera's detection preferences from a device-settings patch
+	* into this addon's per-device store. True when anything changed — the
+	* camera's Alexa shape then needs a reconcile.
+	*/
+	async applyDetectionPrefsPatch(deviceId, patch) {
+		const selectionKey = sensorSelectionKey(deviceId);
+		const odKey = objectDetectionKey(deviceId);
+		const write = {};
+		if (selectionKey in patch) write[SENSOR_SELECTION_KEY] = sensorSelectionFromPatch(patch[selectionKey]);
+		if (odKey in patch) write[OBJECT_DETECTION_KEY] = Boolean(patch[odKey]);
+		if (Object.keys(write).length === 0) return false;
+		await this.vision.writePrefs(deviceId, write);
+		this.ctx.logger.info("export-alexa: camera detection preferences saved", {
+			tags: { deviceId },
+			meta: { ...write }
+		});
+		return true;
+	}
 	/** The stream fields of the Export section — a camera's only. */
 	cameraOnlyExportFields(deviceId, settings, enabledKey) {
 		const streamPreferenceKey = `alexa:${deviceId}:streamPreference`;
@@ -57197,6 +58564,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 		const idStr = String(deviceId);
 		const current = this.findEntry(deviceId);
 		const wasEnabled = current !== null;
+		const prefsChanged = await this.applyDetectionPrefsPatch(deviceId, patch);
 		const enabledKey = `alexa:${deviceId}:enabled`;
 		const streamPreferenceKey = `alexa:${deviceId}:streamPreference`;
 		const allowTranscodeKey = `alexa:${deviceId}:allowTranscode`;
@@ -57221,7 +58589,14 @@ var ExportAlexaAddon = class extends BaseAddon {
 		const currentPref = current?.settings?.streamPreference ?? "auto";
 		const currentAllow = current?.settings?.allowTranscode !== false;
 		await this.patchEntrySettings(deviceId, nextSettings);
-		if (currentPref !== streamPreference || currentAllow !== allowTranscode) {
+		const sourceChanged = currentPref !== streamPreference || currentAllow !== allowTranscode;
+		if (prefsChanged && !sourceChanged) this.requireSyncEngine().reconcileDevice(deviceId).catch((err) => {
+			this.ctx.logger.warn("export-alexa: re-sync after a detection preference change failed", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
+		});
+		if (sourceChanged) {
 			this.ctx.logger.info("export-alexa: source settings changed — refreshing exposure", {
 				tags: { deviceId },
 				meta: {
@@ -57276,4 +58651,4 @@ var ExportAlexaAddon = class extends BaseAddon {
 	}
 };
 //#endregion
-export { ExportAlexaAddon, ExportAlexaAddon as default, ALEXA_EGRESS_PROFILE as i, releaseAlexaEgress as n, exportAlexaActions as r, acquireAlexaEgress as t };
+export { ExportAlexaAddon, ExportAlexaAddon as default, effectiveAlexaSettings, ALEXA_EGRESS_PROFILE as i, releaseAlexaEgress as n, exportAlexaActions as r, acquireAlexaEgress as t };