@camstack/addon-export-hap 1.2.127 → 1.2.128

package/dist/hap-export.addon.mjs

@@ -1,9 +1,12 @@
 import { createRequire } from "node:module";
+import { spawn } from "node:child_process";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import * as path from "node:path";
-import { readFileSync } from "node:fs";
-import { spawn } from "node:child_process";
+import { join } from "node:path";
+import { createWriteStream, readFileSync } from "node:fs";
 import * as fs from "node:fs/promises";
+import { mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+import { once } from "node:events";
 import { createSocket } from "node:dgram";
 import { networkInterfaces } from "node:os";
 //#region \0rolldown/runtime.js
@@ -35,43 +38,6 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 //#endregion
-//#region src/exposed-entry.ts
-/**
-* Carrying an exposed-device entry across a re-expose.
-*
-* `exposeDevice` rebuilds its entry from scratch — display name, mapper kind,
-* timestamp — and then REPLACES the stored one. Anything the rebuilt object
-* does not mention is therefore destroyed, and two things it never mentioned
-* were the per-camera settings and the capability list.
-*
-* The visible cost: the operator's "Source stream (HomeKit)" selector writes
-* `low`, the addon logs `streamPreference changed — refreshing accessory
-* {from=auto to=low}`, and the accessory that comes back derives its
-* advertisement from DEFAULTS — `streamPreference=auto` — because the settings
-* were dropped between the write and the rebuild. The selector only ever took
-* effect after a full addon restart, when the settings were loaded first. A
-* second write after the re-expose hid this: the store ended up correct, so
-* nothing looked wrong except the stream nobody could explain.
-*/
-/**
-* Fill `base` from `existing` for the given keys, letting `base` win wherever
-* it actually says something.
-*
-* That asymmetry is the point: a caller who passes `capabilities` is stating a
-* new truth and must not be overruled by the stored copy, while a caller who
-* says nothing about `settings` is not asking for them to be erased.
-*/
-function carryForward(base, existing, keys) {
-	if (existing === void 0) return base;
-	const out = { ...base };
-	for (const key of keys) {
-		if (out[key] !== void 0) continue;
-		const carried = existing[key];
-		if (carried !== void 0) out[key] = carried;
-	}
-	return out;
-}
-//#endregion
 //#region ../types/dist/event-category-BVDXG4tB.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
@@ -5433,7 +5399,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-GU_us3DG.mjs
+//#region ../types/dist/sleep-CiR4z7r9.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6575,6 +6541,17 @@ var CamProfileSchema = _enum([
 	"mid",
 	"low"
 ]);
+/**
+* Which rung a per-camera consumer listens on: an explicit profile, or `auto`.
+*
+* `auto` is a REAL value, not an absent one — it means "resolve it by the rule
+* that consumer owns". It lives beside `CamProfile` because a rung is the only
+* operator-facing way to name a stream: a cam-stream id is broker-internal and
+* moves when a slot is reassigned, so a stored id silently stops meaning what
+* the operator picked. Today's one user is the audio analyser, whose rule is
+* "the lowest AVAILABLE native rung" (D537).
+*/
+var AudioStreamPickSchema = union([CamProfileSchema, literal("auto")]);
 var CamStreamKindSchema = _enum([
 	"pull-rtsp",
 	"pull-rtmp",
@@ -7434,7 +7411,7 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 	input: unknown()
 }), unknown(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
 //#endregion
-//#region ../types/dist/canonical-hash-DBkl8q6V.mjs
+//#region ../types/dist/canonical-hash-CPK2Dy60.mjs
 var AUDIO_ENCODER_BY_CODEC = {
 	opus: "libopus",
 	aac: "aac",
@@ -7492,10 +7469,17 @@ function buildInputArgs(input, decodeHwAccel) {
 	const args = [];
 	if (!isSoftwareDecode(decodeHwAccel)) args.push("-hwaccel", String(decodeHwAccel));
 	if (input.extraArgs?.length) args.push(...input.extraArgs);
+	if (input.decodeThreadCount !== void 0 && input.decodeThreadCount > 0) args.push("-threads", String(input.decodeThreadCount));
 	if (input.analyzeDurationUs !== void 0) args.push("-analyzeduration", String(input.analyzeDurationUs));
 	if (input.probeSizeBytes !== void 0) args.push("-probesize", String(input.probeSizeBytes));
+	if (input.lowDelay === true) args.push("-flags", "low_delay");
+	if (input.useWallclockTimestamps === true) args.push("-use_wallclock_as_timestamps", "1");
 	if (input.fflags?.length) for (const flag of input.fflags) args.push("-fflags", flag);
 	if (input.rtspTransport) args.push("-rtsp_transport", input.rtspTransport);
+	if (input.rawVideo !== void 0) {
+		const raw = input.rawVideo;
+		args.push("-f", "rawvideo", "-pix_fmt", raw.pixelFormat, "-video_size", `${String(raw.width)}x${String(raw.height)}`, "-framerate", String(raw.framerate));
+	}
 	args.push("-i", input.url);
 	return args;
 }
@@ -7528,16 +7512,29 @@ function resolveStreamMaps(selection) {
 	};
 }
 /** The `-vf` filter args, or `[]` when a consumer `-vf` already claims the slot. */
-function buildVideoFilterArgs(scale, outputArgs, filterGraph) {
+function buildVideoFilterArgs(scale, outputArgs, filterGraph, hwUpload) {
 	if (filterGraph) {
 		if (scale) throw new Error("FfmpegInvocation: video.scale cannot be combined with a filter graph — scale inside the graph instead (the -vf would feed an output the graph already feeds)");
 		if (outputArgs.some((a) => a === "-vf")) throw new Error("FfmpegInvocation: outputArgs carries a -vf while a filter graph feeds the same output — fold the filter into the graph");
 		return [];
 	}
-	if (!scale) return [];
 	if (outputArgs.some((a) => a === "-vf")) return [];
-	if (scale.mode === "exact") return ["-vf", `scale=${scale.width}:${scale.height}`];
-	return ["-vf", `scale='min(${scale.width},iw)':'min(${scale.height},ih)':force_original_aspect_ratio=decrease:force_divisible_by=2`];
+	if (!scale) return hwUpload.length > 0 ? ["-vf", hwUpload] : [];
+	const suffix = hwUpload.length > 0 ? `,${hwUpload}` : "";
+	if (scale.mode === "exact") return ["-vf", `scale=${scale.width}:${scale.height}${suffix}`];
+	return ["-vf", `scale='min(${scale.width},iw)':'min(${scale.height},ih)':force_original_aspect_ratio=decrease:force_divisible_by=2${suffix}`];
+}
+/**
+* The upload filter a hardware encode needs, or `''`.
+*
+* Nothing is uploaded when the DECODE already left the frames on the GPU
+* (`-hwaccel vaapi`): they are surfaces already, and uploading a surface is an
+* error rather than a no-op.
+*/
+function resolveHwUpload(device, decodeHwAccel) {
+	if (device === void 0) return "";
+	if (!isSoftwareDecode(decodeHwAccel)) return "";
+	return "format=nv12,hwupload";
 }
 /** Rate-control args for an encode plan. */
 function buildRateControlArgs(video) {
@@ -7557,7 +7554,18 @@ function buildRateControlArgs(video) {
 	];
 }
 /** The whole video block (`-vf` … `-c:v` … knobs), after `-i`. */
-function buildVideoArgs(video, outputArgs, filterGraph) {
+function buildVideoArgs(video, outputArgs, filterGraph, hwEncode) {
+	if (video.kind === "raw") {
+		if (filterGraph && video.filter !== void 0) throw new Error("FfmpegInvocation: video.filter cannot be combined with a filter graph — fold the filter into the graph");
+		return [
+			...video.filter !== void 0 ? ["-vf", video.filter] : [],
+			"-c:v",
+			"rawvideo",
+			"-pix_fmt",
+			video.pixelFormat,
+			...video.fps !== void 0 ? ["-r", String(video.fps)] : []
+		];
+	}
 	if (video.kind === "copy") {
 		if (filterGraph) throw new Error("FfmpegInvocation: a filter graph produces a NEW picture, so video.kind must be `encode`");
 		return [
@@ -7566,8 +7574,10 @@ function buildVideoArgs(video, outputArgs, filterGraph) {
 			...video.bitstreamFilter ? ["-bsf:v", video.bitstreamFilter] : []
 		];
 	}
+	const hwUpload = hwEncode === void 0 ? "" : resolveHwUpload(hwEncode.device, hwEncode.decodeHwAccel);
+	if (hwEncode !== void 0 && filterGraph) throw new Error("FfmpegInvocation: a hardware encode fed by a filter graph must upload INSIDE the graph — hwEncodeDevice cannot be combined with filterGraph");
 	const args = [
-		...buildVideoFilterArgs(video.scale, outputArgs, filterGraph),
+		...buildVideoFilterArgs(video.scale, outputArgs, filterGraph, hwUpload),
 		"-c:v",
 		video.encoder
 	];
@@ -7737,15 +7747,23 @@ function buildAudioSidecarArgs(sidecar) {
 * (`0:a:0?`): the sidecar is defined as the SOURCE's microphone on its own RTP
 * output, not as whatever the main output happens to carry.
 */
+/** The hardware-encode context for this invocation, or `undefined`. */
+function hwEncodeFor(inv) {
+	return inv.hwEncodeDevice === void 0 ? void 0 : {
+		device: inv.hwEncodeDevice,
+		decodeHwAccel: inv.decodeHwAccel
+	};
+}
 function buildFfmpegArgs(inv) {
 	const graph = inv.filterGraph ?? null;
 	const head = [
 		...logBannerArgs(inv.logLevel),
+		...inv.hwEncodeDevice !== void 0 ? ["-vaapi_device", inv.hwEncodeDevice.renderNode] : [],
 		...buildInputArgs(inv.input, inv.decodeHwAccel),
 		...(inv.extraInputs ?? []).flatMap((extra) => buildInputArgs(extra, inv.decodeHwAccel)),
 		...graph ? ["-filter_complex", graph.graph] : []
 	];
-	const threadArgs = inv.threadCount > 0 ? ["-threads", String(inv.threadCount)] : [];
+	const threadArgs = [...inv.threadCount > 0 ? ["-threads", String(inv.threadCount)] : [], ...inv.filterThreadCount !== void 0 && inv.filterThreadCount > 0 ? ["-filter_threads", String(inv.filterThreadCount)] : []];
 	const maps = resolveStreamMaps(inv);
 	const videoMapArgs = maps.video ? ["-map", maps.video] : [];
 	const audioMapArgs = maps.audio ? ["-map", maps.audio] : [];
@@ -7754,7 +7772,7 @@ function buildFfmpegArgs(inv) {
 			"-an",
 			"-map",
 			maps.video ?? "0:v:0",
-			...buildVideoArgs(inv.video, inv.outputArgs, graph),
+			...buildVideoArgs(inv.video, inv.outputArgs, graph, hwEncodeFor(inv)),
 			...threadArgs,
 			...inv.outputArgs,
 			...buildRtpOutputArgs(inv.sink.video)
@@ -7777,7 +7795,7 @@ function buildFfmpegArgs(inv) {
 	return [
 		...head,
 		...videoMapArgs,
-		...buildVideoArgs(inv.video, inv.outputArgs, graph),
+		...buildVideoArgs(inv.video, inv.outputArgs, graph, hwEncodeFor(inv)),
 		...threadArgs,
 		...mutedAudio ? [] : audioMapArgs,
 		...audioArgs,
@@ -8456,6 +8474,7 @@ var CameraSwitchIdSchema = _enum([
 	"device-audio",
 	"broker-audio",
 	"audio-analysis",
+	"event-saving",
 	"recording",
 	"notifications"
 ]);
@@ -8930,11 +8949,31 @@ var RecordingBandTriggersSchema = RecordingTriggersSchema;
 * band engine's `applies` rule). `start`/`end` are `HH:MM`; an `end <= start`
 * span wraps past midnight (handled by the band engine).
 */
+/**
+* Whether a band's footage carries sound.
+*
+* The recorder has always attached with `audio: 'aac'`, so every band of every
+* camera recorded sound whether anyone wanted it or not. The broker already
+* serves the other answer — `audio: 'none'` takes the video-only `/muted`
+* restream — so this was a choice the product could always have offered.
+*
+* It belongs on the BAND rather than the camera because one camera can want
+* both: silent across the shop floor during opening hours, sound overnight.
+* And it applies to BOTH modes — an events band firing on motion has the same
+* question to answer as a continuous one.
+*/
+var RecordingBandAudioSchema = _enum(["on", "muted"]);
 var RecordingBandSchema = object({
 	days: array(RecordingWeekdaySchema),
 	start: string().regex(HHMM),
 	end: string().regex(HHMM),
 	mode: RecordingBandModeSchema,
+	/**
+	* Sound, or silence. OPTIONAL and absent-means-`on`: every recording
+	* written before this existed carried sound, and a band whose key is
+	* missing must keep meaning what it meant. See {@link RecordingBandAudioSchema}.
+	*/
+	audio: RecordingBandAudioSchema.optional(),
 	triggers: RecordingBandTriggersSchema.optional(),
 	/**
 	* RETIRED (D381). A band no longer carries a pre-buffer of its own.
@@ -20756,6 +20795,7 @@ var MediaFileKindEnum = _enum([
 	"keyFrameSmall",
 	"thumbnailSmall",
 	"confirmationCrop",
+	"debugCrop",
 	"sceneFrame"
 ]);
 /**
@@ -22420,6 +22460,18 @@ var RunnerCameraConfigSchema = object({
 	motionStreamId: string(),
 	detectionStreamId: string(),
 	/**
+	* Which rung this camera's audio analysis listens on — `auto` (the lowest
+	* AVAILABLE native rung) or an explicit one.
+	*
+	* Not consumed by the runner: carried here so it travels with the camera's
+	* config the way `audioMotionWindowMs` does, and so the orchestrator's
+	* watchdog resolves the same stream the audio subscription did. OPTIONAL
+	* with no default — absent means `auto`, which is what every camera written
+	* before this field had, and an absent optional adds nothing to the
+	* generated cap-input defaults (D537).
+	*/
+	audioStreamPick: AudioStreamPickSchema.optional(),
+	/**
 	* Motion sources that can activate the pipeline. At least one must
 	* be present. Multiple sources OR-ed: any one firing arms the
 	* cooldown timer and transitions watching → active. The same
@@ -23490,10 +23542,9 @@ var ServerBootModeSchema = _enum([
 *  - `idle` / `checking` / `staging` — steady / in-flight registry work.
 *  - `pending-restart` — a version is staged and the node has NOT yet
 *    restarted onto it (still running the OLD version).
-*  - `awaiting-confirmation` — the node HAS restarted onto the staged version
-*    (it is the active probation boot) and is waiting to confirm boot-health.
-*    Apply/rollback are refused in this state and the node must NOT be
-*    manually restarted, or the probation boot auto-rolls-back.
+*  - `awaiting-confirmation` — RETIRED with the probation boot (single-copy
+*    collapse, 2026-07-18). Kept in the enum so an older client still parses;
+*    no provider emits it.
 */
 var ServerUpdateStateSchema = _enum([
 	"idle",
@@ -23582,12 +23633,35 @@ var ServerRollbackInfoSchema = object({
 var ServerPackageStatusSchema = object({
 	/** Root package name (`@camstack/server` on the hub). */
 	packageName: string(),
-	/** Version of the code the running process ACTUALLY loaded. */
+	/**
+	* Version of the code THIS PROCESS loaded — captured once, at boot, from the
+	* package.json of the copy the code was loaded from, and never re-read. A
+	* copy replaced on disk under a live process must not move this number;
+	* that divergence is what `installedVersion` is for. Before 2026-09-20 this
+	* was a lazy disk read that would have followed such a swap silently.
+	*/
 	runningVersion: string().nullable(),
 	/** Node.js runtime version the node's process runs on (`process.versions.node`). */
 	nodeRuntimeVersion: string().nullable(),
 	/** Active data-dir root version; null when booted from seed/workspace. */
 	activeVersion: string().nullable(),
+	/**
+	* Version of the root package in the data-root `current/` copy RIGHT NOW —
+	* what the next boot would load if nothing is staged. Normally equal to
+	* `runningVersion`; differs only when the copy on disk changed under the
+	* live process. `null` when there is no data-root copy (baked seed or
+	* workspace boot). Optional for version skew: an older provider omits it.
+	*/
+	installedVersion: string().nullable().optional(),
+	/**
+	* True when the code that would run after a restart is NOT the code running
+	* now: a version is staged (`pendingVersion`), or `installedVersion` differs
+	* from `runningVersion`. Derived on every read, never stored. This is the
+	* one field that lets an operator or a script say "1.2.353 is installed and
+	* will run after a restart" instead of reading it off a number that means
+	* "installed". Optional for version skew.
+	*/
+	restartRequired: boolean().optional(),
 	/** N-1 version kept for rollback; null when no previous version exists. */
 	previousVersion: string().nullable(),
 	/** Version of the immutable baked seed closure (image fallback). */
@@ -23622,19 +23696,71 @@ var ServerPackageStatusSchema = object({
 });
 var ServerUpdateCheckResultSchema = object({
 	packageName: string(),
+	/** Same meaning as on the status payload: what THIS process loaded. */
 	runningVersion: string().nullable(),
 	latestVersion: string().nullable(),
+	/**
+	* `latestVersion` is newer than `runningVersion` AND is not the version
+	* already staged on this node. A staged-and-waiting version is not "an
+	* update available" — applying it again is refused (`already-staged`), and
+	* a button that announced "updating…" on this boolean then got refused
+	* would be lying. It is reported through `pendingVersion` instead.
+	*/
 	updateAvailable: boolean(),
 	checkedAtMs: number(),
 	/** Non-null when the registry lookup failed (offline, bad registry, …). */
-	error: string().nullable()
+	error: string().nullable(),
+	/**
+	* Version staged on this node and awaiting its restart, when one is. Before
+	* 2026-09-20 a check answered `{runningVersion, updateAvailable:false}` for a
+	* node whose staged closure had never booted, and the caller had no way to
+	* see the difference. Optional for version skew.
+	*/
+	pendingVersion: string().nullable().optional(),
+	/** See the status payload: staged, or installed-on-disk ≠ running. Optional for skew. */
+	restartRequired: boolean().optional()
 });
+/**
+* What an action DID — the discriminant `accepted` cannot carry. Before
+* 2026-09-20 `applyServerUpdate` answered `accepted:false` both for a refusal
+* where nothing was wrong (already current, already staged) and for a staging
+* install that died on `npm error code ECONNRESET`; the only difference was
+* prose in `message`, and an operator restarted a container on the strength of
+* it, booting the previous version.
+*
+*  - `staged`            — the closure is installed and validated; the node
+*                          restarts to apply it (`restarting:true`). NOTHING
+*                          runs the new code until that restart completes.
+*  - `restart-scheduled` — a plain, version-preserving restart was accepted.
+*  - `already-current`   — the target IS the running version; nothing done.
+*  - `refused`           — dropped by a gate; `reason` names which.
+*  - `failed`            — attempted and did not land; `error` says why.
+*/
+var ServerUpdateOutcomeSchema = _enum([
+	"staged",
+	"restart-scheduled",
+	"already-current",
+	"refused",
+	"failed"
+]);
 var ServerUpdateActionResultSchema = object({
 	accepted: boolean(),
 	targetVersion: string().nullable(),
 	/** True when a graceful restart was scheduled to apply the change. */
 	restarting: boolean(),
-	message: string()
+	message: string(),
+	/** See {@link ServerUpdateOutcomeSchema}. Optional for version skew. */
+	outcome: ServerUpdateOutcomeSchema.optional(),
+	/**
+	* Stable, greppable cause for `refused` / `failed` (the engine's
+	* `UpdateRefusalReason`, `staging-failed`, …). `null` on success.
+	*/
+	reason: string().nullable().optional(),
+	/**
+	* The failure itself, verbatim enough to act on (the npm output for a
+	* staging install). Non-null only for `failed`.
+	*/
+	error: string().nullable().optional()
 });
 method(_void(), ServerPackageStatusSchema, { auth: "admin" }), method(_void(), ServerUpdateCheckResultSchema, {
 	kind: "mutation",
@@ -24911,6 +25037,104 @@ var WebrtcStreamChoiceSchema = object({
 	/** Bitrate in kbps (null for adaptive). */
 	bitrateKbps: number().nullable()
 });
+/**
+* The last move the adaptive ladder made on this session, and the numbers it
+* rested on. Mirrors `LadderDecision` in the stream-broker's
+* `adaptive-controller.ts` — the log line's evidence, made readable.
+*
+* Nullability is load-bearing: `lossRatio: null` means the loss tracker had
+* no window to report, which is NOT a link with zero loss.
+*/
+var WebrtcLadderDecisionSchema = object({
+	/** `loss` — RTCP / client-reported packet loss; `stall` — the picture
+	*  stopped moving; `healthy` — a promotion. */
+	cause: _enum([
+		"loss",
+		"stall",
+		"healthy"
+	]),
+	/** The rung the ladder moved TO. Null for a move that changed no rung
+	*  (an MTU reduction, a forced transcode-down at the bottom). */
+	tier: CamProfileSchema.nullable(),
+	/** Whether that move forced the egress transcode-down rung. */
+	forcedTranscodeDown: boolean(),
+	/** Loss ratio over the tracker's window at the moment of the decision. */
+	lossRatio: number().nullable(),
+	/** The client's reported downlink at that moment, in kbps. */
+	clientKbps: number().nullable(),
+	/** How long the stall detector had been seeing nothing arrive. */
+	stalledForMs: number().nullable(),
+	/** Whether the broker WAS sending while that was measured — the half that
+	*  separates "the camera stopped" from "the link stopped". */
+	serverSending: boolean().nullable(),
+	/** Epoch ms. The overlay prints its age; a decision from 40 minutes ago
+	*  must not read like one from this second. */
+	at: number()
+});
+/** Per-tier count of MEASURED downgrades this viewer session has suffered. */
+var WebrtcTierFailureSchema = object({
+	tier: CamProfileSchema,
+	failures: number().int().nonnegative()
+});
+/**
+* What the SERVER decided for one WebRTC session — the half the client cannot
+* measure. See `getSessionDebug`.
+*/
+var WebrtcSessionDebugSchema = object({
+	sessionId: string(),
+	/** Whether the session still exists here. Everything below is null when
+	*  it does not — a dead session has no measurements, not zero ones. */
+	alive: boolean(),
+	/** Epoch ms this snapshot was taken, so the overlay can show its age. */
+	observedAt: number(),
+	/** The broker actually feeding this session (`<deviceId>/<camStreamId>`). */
+	brokerId: string().nullable(),
+	camStreamId: string().nullable(),
+	/** `derived` = this hub BUILT the rung being served (a transcode/scale of
+	*  another stream); `native` = the camera's own encode. */
+	sourceKind: _enum([
+		"native",
+		"derived",
+		"unknown"
+	]),
+	/** Whether the ladder is running at all (an `adaptive` target). */
+	adaptive: boolean(),
+	/** The rung `auto` ACTUALLY resolved to right now. Null when the broker
+	*  is bound to no profile slot (a manually-activated stream). */
+	servedTier: CamProfileSchema.nullable(),
+	/** Which node ingests the source. Null when unresolved. */
+	ingestNodeId: string().nullable(),
+	/** Whether that node is a remote one (the media crosses a node boundary
+	*  before it reaches this session). Null when unresolved. */
+	ingestIsRemote: boolean().nullable(),
+	/** Codec off the source, and the one negotiated with this client. */
+	sourceCodec: string().nullable(),
+	negotiatedCodec: string().nullable(),
+	/** Whether the EGRESS leg re-encodes for this client or forwards the
+	*  source bytes untouched. */
+	egressLeg: _enum([
+		"copy",
+		"transcode",
+		"unknown"
+	]),
+	/** What the broker itself reports about the rung it is serving. */
+	brokerStatus: string().nullable(),
+	brokerCodec: string().nullable(),
+	brokerBitrateKbps: number().nullable(),
+	brokerInputFps: number().nullable(),
+	brokerUptimeMs: number().nullable(),
+	/** RTP packets this session has sent — the server's own "am I sending?". */
+	rtpPacketsSent: number().nullable(),
+	/** D42: the track may be carrying the recorded feeder, not live. The ladder
+	*  is suspended there, so a frozen picture in `recorded` mode means
+	*  something entirely different. */
+	trackMode: _enum(["live", "recorded"]).nullable(),
+	lastDecision: WebrtcLadderDecisionSchema.nullable(),
+	tierFailures: array(WebrtcTierFailureSchema),
+	/** Successful promotions in this viewer session (drives the progressive
+	*  healthy timer). Null when no ladder is running. */
+	upgradeCount: number().nullable()
+});
 DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), array(WebrtcStreamChoiceSchema)), method(object({
 	deviceId: number().int().nonnegative(),
 	target: WebrtcStreamTargetSchema,
@@ -25075,7 +25299,10 @@ DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), ar
 	* the same answer as "it ended": either way nothing is holding it up.
 	*/
 	alive: boolean()
-}));
+})), method(object({
+	deviceId: number().int().nonnegative(),
+	sessionId: string()
+}), WebrtcSessionDebugSchema, { kind: "query" });
 object({
 	/** All accessory children of the parent. */
 	childDeviceIds: array(number()).readonly(),
@@ -28199,16 +28426,37 @@ var GridProfileOfferSchema = object({
 	]),
 	offered: boolean(),
 	/** Sources that cannot serve it. Empty when it is offered, or when there are no cells. */
-	missingSources: array(number().int().positive())
+	missingSources: array(number().int().positive()),
+	/**
+	* The canvas this profile composes onto, `WxH`, or empty when it is not
+	* offered. DERIVED from the cells and the sources' own size at this profile —
+	* it is reported because nothing else in the system would ever say what the
+	* grid came out as, and because it is the number an operator would otherwise
+	* expect to type.
+	*/
+	canvas: string(),
+	/**
+	* Whether this profile is PUBLISHED, of the ones the grid could serve.
+	*
+	* A grid's `high` is composed of its sources' `high`, so on a 4K fleet it is
+	* a 4K canvas built from 4K decodes — something to opt into, not something a
+	* viewer's adaptive should be handed by climbing to the top rung it can see.
+	* Default is `mid` + `low`.
+	*/
+	published: boolean()
 });
 var GridLayoutViewSchema = object({
 	/** The persisted grid row this camera was declared from. */
 	instanceId: string(),
 	deviceId: number().int().nonnegative(),
 	name: string(),
-	/** The canvas the operator laid out — this grid's `high`. mid/low are scaled from it. */
-	width: number().int(),
-	height: number().int(),
+	/**
+	* NO canvas size. A grid's resolution is not authored: each profile derives
+	* its own from the cells and its sources' dimensions. The two numbers that
+	* used to be here were a text field that silently decided both how much the
+	* composite cost and how sharp it was — see `profiles[].canvas` for what it
+	* came out as.
+	*/
 	fps: number().int(),
 	cells: array(GridLayoutCellSchema),
 	/** What the catalog will publish, and what it refuses to. Read-only. */
@@ -28217,9 +28465,13 @@ var GridLayoutViewSchema = object({
 var GridLayoutPatchSchema = object({
 	deviceId: number().int().nonnegative(),
 	name: string().min(1).max(160).optional(),
-	width: number().int().min(160).max(7680).optional(),
-	height: number().int().min(120).max(4320).optional(),
 	fps: number().int().min(1).max(60).optional(),
+	/** Which profiles to publish. See `GridProfileOffer.published`. */
+	publishedProfiles: array(_enum([
+		"high",
+		"mid",
+		"low"
+	])).max(3).optional(),
 	/**
 	* The whole cell list at once. A per-cell patch would need an ordering the
 	* editor does not have, and a half-applied layout is a picture nobody asked
@@ -38799,6 +39051,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"webrtcSession.getSessionDebug": {
+		capName: "webrtc-session",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"webrtcSession.getSessionState": {
 		capName: "webrtc-session",
 		capScope: "device",
@@ -40782,6 +41040,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"webrtcSession.getSessionDebug": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"webrtcSession.getSessionState": [{
 		name: "deviceId",
 		form: "single",
@@ -41400,6 +41663,60 @@ DEFAULT_NATIVE_LEASE_SETTINGS.sceneBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
+//#endregion
+//#region ../types/dist/node.mjs
+/**
+* The ffmpeg build every CamStack node downloads, per platform and arch.
+*
+* ## Why a download, on every node, including the container
+*
+* The version of ffmpeg used to be CODE: baked into the image, changeable only
+* by rebuilding and rolling it. Now it is DATA — this file states the release,
+* and a node that boots with a different one downloads it. Changing ffmpeg is a
+* framework bump, not an image rebuild.
+*
+* It also settles the licence question by removing it. FFmpeg's licence is
+* chosen at compile time: the core is LGPL 2.1+, `--enable-gpl` makes it GPL
+* (for x264/x265), `--enable-version3` makes that v3, and `--enable-nonfree`
+* makes the result undistributable. These are GPL v3 builds, and we do not
+* distribute them: the user's own node fetches the archive from the project
+* that publishes it, so we convey no GPL work and inherit none of the
+* obligations that come with conveying one. That is the whole reason the image
+* no longer installs ffmpeg at all — not a technical preference.
+*
+* ## Why jellyfin-ffmpeg
+*
+* One vendor covering linux-amd64, linux-arm64, darwin-arm64 and darwin-x64
+* from one release, with the widest hardware surface of anything maintained:
+* VAAPI, QSV, NVENC/NVDEC, AMF, Vulkan, OpenCL and DRM on amd64, plus Rockchip
+* MPP on arm64. It reaches the vendor libraries through dlopen trampolines,
+* so the binary is not linked against a driver stack it may not find.
+*
+* **What it still needs from the host, measured 2026-09-19.** On the Unraid
+* HOST, which has no libva, `-vaapi_device` aborts the process outright —
+* `implib-gen: libva-drm.so.2: failed to load library ... Assertion '0 &&
+* "Assertion in generated code"' failed`. Inside our container, which installs
+* libva plus the iHD driver, the same command encodes: verified end to end with
+* `testsrc → format=nv12,hwupload → h264_vaapi`. So the image drops ffmpeg and
+* KEEPS the Intel media stack; the drivers are the part a binary cannot bring.
+*
+* ## Why each artifact carries a checksum and a claim
+*
+* The download is now the only source, so `sha256` is verified before anything
+* is extracted — jellyfin publishes no checksums on its release assets, so
+* these are ours, taken at the version bump. And `expectedHwaccels` is what the
+* build is supposed to be able to do: a binary that probes short of its own
+* claim is a source that changed under us, which is precisely what went
+* unnoticed for months when a static build turned out to carry no VAAPI at all
+* (D536).
+*/
+/** The pinned jellyfin-ffmpeg release. Changing this is the version change. */
+var FFMPEG_RELEASE = "8.1.2-5";
+var BASE = `https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/v${FFMPEG_RELEASE}`;
+function portable(target) {
+	return `${BASE}/jellyfin-ffmpeg_${FFMPEG_RELEASE}_portable_${target}-gpl.tar.xz`;
+}
+portable("linux64"), portable("linuxarm64"), portable("macarm64"), portable("mac64");
 var DEFAULT_FIRST_UNIT_TIMEOUT_MS = 12e3;
 /** Heartbeat cadence — ~2 minutes of 4 s fragments. */
 var FRAGMENT_LOG_EVERY = 30;
@@ -88381,6 +88698,43 @@ var BridgeHost = class {
 	}
 };
 //#endregion
+//#region src/exposed-entry.ts
+/**
+* Carrying an exposed-device entry across a re-expose.
+*
+* `exposeDevice` rebuilds its entry from scratch — display name, mapper kind,
+* timestamp — and then REPLACES the stored one. Anything the rebuilt object
+* does not mention is therefore destroyed, and two things it never mentioned
+* were the per-camera settings and the capability list.
+*
+* The visible cost: the operator's "Source stream (HomeKit)" selector writes
+* `low`, the addon logs `streamPreference changed — refreshing accessory
+* {from=auto to=low}`, and the accessory that comes back derives its
+* advertisement from DEFAULTS — `streamPreference=auto` — because the settings
+* were dropped between the write and the rebuild. The selector only ever took
+* effect after a full addon restart, when the settings were loaded first. A
+* second write after the re-expose hid this: the store ended up correct, so
+* nothing looked wrong except the stream nobody could explain.
+*/
+/**
+* Fill `base` from `existing` for the given keys, letting `base` win wherever
+* it actually says something.
+*
+* That asymmetry is the point: a caller who passes `capabilities` is stating a
+* new truth and must not be overruled by the stored copy, while a caller who
+* says nothing about `settings` is not asking for them to be erased.
+*/
+function carryForward(base, existing, keys) {
+	if (existing === void 0) return base;
+	const out = { ...base };
+	for (const key of keys) {
+		if (out[key] !== void 0) continue;
+		const carried = existing[key];
+		if (carried !== void 0) out[key] = carried;
+	}
+	return out;
+}
+//#endregion
 //#region src/hap-setup-uri.ts
 function errMsg$15(e) {
 	return e instanceof Error ? e.message : String(e);
@@ -88415,47 +88769,610 @@ function firstExposedAccessorySetupUri(exposed, logger) {
 	}
 }
 //#endregion
-//#region src/mappers/builders/accessory-info.ts
+//#region src/hksv/clip-record.ts
+/**
+* What ONE teed HomeKit clip is, on disk.
+*
+* ## Why a sidecar at all
+*
+* HomeKit Secure Video is a SINK. HAP's `dataSend` is `hello/whoami/open/data/
+* ack/close` and `CameraRecordingDelegate` is push-only, so a clip "recorded by
+* HomeKit" can only ever be ours if we kept our own copy of what we SENT.
+* There is no read-back to reconcile against later, and there never will be.
+* Everything a later reader can know about a teed clip therefore has to be
+* written down at the moment it was written — by the only process that ever saw
+* it — or it is lost with the session.
+*
+* ## The two coverage limits, stated on the record rather than discovered
+*
+* - **Only some cameras record at all.** `pickRecordingSource` refuses anything
+*   without an H.264 slot, `MAX_RECORDING_HEIGHT` prefers ≤ 1080p, and
+*   `deriveFragmentLengthMs` refuses a GOP longer than 8 s. A camera the tee
+*   never writes for is not a gap in this store, it is a camera HKSV never
+*   recorded; {@link HksvClipRecord} exists only for the ones it did.
+* - **The duration is whatever iOS PULLED.** `durationMs` is the wall-clock
+*   span of the HDS stream (prebuffer replay plus however long the hub kept it
+*   open), not a window CamStack chose. A short clip is not a truncated one —
+*   {@link HksvClipRecord.truncated} is the only thing that says truncated.
+*
+* ## `thumbnailFile` is VOUCHED
+*
+* It is written only after the JPEG has been stat'd on disk at non-zero size.
+* A minter that reports success and produced nothing leaves
+* {@link HksvClipRecord.thumbnailUnavailable} instead — the whole point of
+* vouching is that the promise and the file are not the same claim.
+*/
+/** The `videoclips` source id a later provider will list these under. */
+var HKSV_CLIP_SOURCE = "hksv";
+/** Why no still could be minted from the saved fMP4. Named, never blank. */
+var HksvThumbnailUnavailableReasonSchema = _enum([
+	"decode-failed",
+	"timed-out",
+	"ffmpeg-missing",
+	"no-init-segment",
+	"not-attempted"
+]);
+/** Why a clip stopped short of the stream that fed it. */
+var HksvClipTruncationSchema = _enum([
+	"size-cap",
+	"slow-consumer",
+	"write-failed"
+]);
+var HksvClipRecordSchema = object({
+	/** Bumped when a field's MEANING changes; a reader refuses what it cannot read. */
+	schemaVersion: literal(1),
+	/** `hksv:<deviceId>:<startedAtMs>-<streamId>` — self-contained, so a later
+	*  provider addresses bytes and stills without re-listing. */
+	clipId: string().min(1),
+	source: literal(HKSV_CLIP_SOURCE),
+	deviceId: number().int(),
+	/** The HDS stream this clip was teed from — the join to the delegate's logs. */
+	streamId: number().int(),
+	startedAtMs: number().int(),
+	endedAtMs: number().int(),
+	/** `endedAtMs - startedAtMs`. What iOS pulled, never a window we chose. */
+	durationMs: number().int().nonnegative(),
+	/** How much of the clip's head came from the prebuffer ring, by ARRIVAL age. */
+	prebufferSpanMs: number().int().nonnegative(),
+	bytes: number().int().nonnegative(),
+	fragments: number().int().nonnegative(),
+	/** Basenames, relative to the clip's own device directory. */
+	file: string().min(1),
+	thumbnailFile: string().min(1).optional(),
+	thumbnailUnavailable: object({ reason: HksvThumbnailUnavailableReasonSchema }).optional(),
+	truncated: HksvClipTruncationSchema.optional(),
+	/** iOS sent `ack` for this stream: HomeKit itself kept the clip. */
+	acknowledgedByHomeKit: boolean(),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	/** The advertised fragment length the source was cutting at. */
+	fragmentMs: number().int().positive()
+});
 /**
-* `Service.AccessoryInformation` — the manufacturer / model / firmware /
-* serial block every HomeKit accessory carries.
-*
-* One implementation for both accessory shapes (camera and generic): the
-* fields come from the device's own metadata either way, and a second copy
-* would be a second answer to "what serial does this device publish".
-* Metadata is best-effort — a device that cannot answer still publishes.
+* One stem per clip, three extensions. Derived from the id and from nothing
+* else, so a pruner deleting a clip never has to guess which JPEG was its.
 */
-async function populateAccessoryInfo(accessory, proxy, displayName, modelFallback) {
-	const info = accessory.getService(import_dist.Service.AccessoryInformation);
-	if (!info) return;
+function clipFileNames(clipId) {
+	const stem = clipStem(clipId);
+	return {
+		clip: `${stem}.mp4`,
+		thumbnail: `${stem}.jpg`,
+		record: `${stem}.json`
+	};
+}
+function clipIdFor(deviceId, startedAtMs, streamId) {
+	return `${HKSV_CLIP_SOURCE}:${deviceId}:${startedAtMs}-${streamId}`;
+}
+/** The filesystem-safe tail of an id. `:` is legal on ext4 and hostile everywhere else. */
+function clipStem(clipId) {
+	return clipId.replace(/[^A-Za-z0-9_-]/g, "_");
+}
+//#endregion
+//#region src/hksv/clip-store.ts
+/**
+* `HksvClipStore` — who owns the teed clips, and for how long.
+*
+* ## The owner
+*
+* The **export-hap addon**, in its OWN data dir, and nothing else. Not the
+* recorder's storage locations and not the `eventMedia` class:
+*
+*  - `export-hap` is hub-only and runs in its own runner. The recorder's
+*    location machinery (D385/D386/D389) is another addon's, in another
+*    process, and reaching it would be a cross-runner write on the frame path
+*    of a live HomeKit session — exactly what D9/D18 forbid.
+*  - A teed clip is a DERIVED artifact of a HomeKit session, with no track, no
+*    detection and no event behind it. Filing it under `eventMedia` would put
+*    it inside the post-analysis retention sweep, where its lifetime would be
+*    decided by a policy written for a different question.
+*  - The precedent is D549 decision 13: Reolink's clip thumbnails live in the
+*    vendor addon's data dir under a per-device LRU, outside `eventMedia` and
+*    outside the sweep, for the same reason.
+*
+* Layout: `<dataDir>/hksv-clips/<deviceId>/<stem>.{mp4,jpg,json}`. One stem per
+* clip, three extensions, so a pruner deleting a clip never has to guess which
+* JPEG was its.
+*
+* ## The retention, and why these numbers
+*
+* HomeKit's own retention is unreadable — HAP has no read-back, so CamStack can
+* never ask "does iOS still have this one?" and reconcile. The store therefore
+* cannot mirror HomeKit's lifetime and does not pretend to: it keeps a bounded
+* recent window and says, per clip, exactly when it started. Four bounds, all
+* enforced on every completion:
+*
+*  - **{@link DEFAULT_CLIP_BOUNDS.maxClipBytes} per clip (256 MB).** A clip's
+*    duration is whatever iOS pulled — there is no window we choose — so this
+*    is the only ceiling on a session that never closes. At the ~64 KB/s a
+*    1080p copy branch produces it is over an hour of video.
+*  - **{@link DEFAULT_CLIP_BOUNDS.maxClipsPerDevice} (200)** and
+*    **{@link DEFAULT_CLIP_BOUNDS.maxBytesPerDevice} (512 MB)**, oldest first.
+*    Measured fragment sizes (D84): ~255 KB per 8 s at 720p, ~500 KB at 1080p,
+*    so a typical 20-40 s HKSV clip is 1.5-3 MB and 200 of them is ~400 MB.
+*    Both bounds exist for the same reason the prebuffer ring has both: at 4K
+*    a fragment is 6.35 MB, a 25x spread, and a count-only bound is a
+*    per-camera disk figure nobody can predict.
+*  - **{@link DEFAULT_CLIP_BOUNDS.maxAgeMs} (14 days)**, so a camera that
+*    stopped recording in March does not hold half a gigabyte forever.
+*  - **{@link DEFAULT_CLIP_BOUNDS.maxStoreBytes} (4 GB)** across every camera,
+*    applied after the per-device pass. Per-device bounds alone multiply by a
+*    camera count the operator changes without thinking about this store.
+*
+* A file nobody prunes is a disk that fills, and the pruner is the only thing
+* standing between a permanent prebuffer and that.
+*
+* ## The thumbnail is VOUCHED, never promised
+*
+* The minter is injected and its verdict is not believed: after it returns the
+* store stats the JPEG, and `thumbnailFile` is written only if a non-empty file
+* is really there. A minter that reports success and produced nothing gets
+* `thumbnailUnavailable.reason: 'decode-failed'` and its zero-byte leftover
+* deleted — this repo has twice shipped a green test because the fake supplied
+* what production forgot, and a promise is not a file.
+*/
+/** The directory under the addon's data dir. Ours, and only ours. */
+var CLIP_DIR_NAME = "hksv-clips";
+/** See the class docblock for what each number is, and where it comes from. */
+var DEFAULT_CLIP_BOUNDS = {
+	maxClipBytes: 256 * 1024 * 1024,
+	maxClipsPerDevice: 200,
+	maxBytesPerDevice: 512 * 1024 * 1024,
+	maxAgeMs: 336 * 60 * 60 * 1e3,
+	maxStoreBytes: 4 * 1024 * 1024 * 1024
+};
+var HksvClipStore = class {
+	input;
+	log;
+	bounds;
+	now;
+	inFlight = /* @__PURE__ */ new Map();
+	constructor(input) {
+		this.input = input;
+		this.log = input.logger;
+		this.bounds = {
+			...DEFAULT_CLIP_BOUNDS,
+			...input.bounds
+		};
+		this.now = input.now ?? Date.now;
+	}
+	/** The per-clip ceiling the tee enforces while writing. */
+	get maxClipBytes() {
+		return this.bounds.maxClipBytes;
+	}
+	/**
+	* Open a file for one HDS stream. `null` when the directory cannot be made —
+	* the caller must then skip the tee entirely and leave HKSV untouched, which
+	* is why this returns rather than throws.
+	*/
+	async open(input) {
+		const clipId = clipIdFor(input.deviceId, input.startedAtMs, input.streamId);
+		const names = clipFileNames(clipId);
+		const dir = this.deviceDir(input.deviceId);
+		const tags = { deviceId: input.deviceId };
+		try {
+			await mkdir(dir, { recursive: true });
+			const sink = await createFileSink(join(dir, names.clip));
+			this.inFlight.set(clipId, {
+				deviceId: input.deviceId,
+				stem: stemOf(names.clip)
+			});
+			return {
+				clipId,
+				sink,
+				complete: (outcome) => this.complete(clipId, input, names, outcome)
+			};
+		} catch (err) {
+			this.inFlight.delete(clipId);
+			this.log.warn("hksv clip store: could NOT open a clip file — nothing is teed for this stream", {
+				tags,
+				meta: {
+					streamId: input.streamId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+			return null;
+		}
+	}
+	/** Every sidecar for a camera, newest first. What a later provider lists. */
+	async listRecords(deviceId) {
+		const dir = this.deviceDir(deviceId);
+		let names;
+		try {
+			names = await readdir(dir);
+		} catch {
+			return [];
+		}
+		const records = [];
+		for (const name of names) {
+			if (!name.endsWith(".json")) continue;
+			const record = await this.readRecord(join(dir, name), deviceId);
+			if (record !== null) records.push(record);
+		}
+		return records.sort((a, b) => b.startedAtMs - a.startedAtMs);
+	}
+	/** iOS sent `ack`: HomeKit itself kept this clip. Recorded on the sidecar. */
+	async acknowledge(deviceId, clipId) {
+		const path = join(this.deviceDir(deviceId), clipFileNames(clipId).record);
+		const record = await this.readRecord(path, deviceId);
+		if (record === null) return;
+		await this.writeRecord(path, {
+			...record,
+			acknowledgedByHomeKit: true
+		});
+	}
+	deviceDir(deviceId) {
+		return join(this.input.rootDir, String(deviceId));
+	}
+	async complete(clipId, input, names, outcome) {
+		this.inFlight.delete(clipId);
+		const dir = this.deviceDir(input.deviceId);
+		const tags = { deviceId: input.deviceId };
+		const clipPath = join(dir, names.clip);
+		if (!outcome.sawInit || outcome.bytes === 0) {
+			await rm(clipPath, { force: true });
+			this.log.warn("hksv clip tee: DROPPED the clip — it carries no init segment, so nothing in it is decodable", {
+				tags,
+				meta: {
+					clipId,
+					streamId: input.streamId,
+					bytes: outcome.bytes,
+					fragments: outcome.fragments
+				}
+			});
+			return null;
+		}
+		const thumbnail = await this.mintAndVouch({
+			deviceId: input.deviceId,
+			clipPath,
+			jpegPath: join(dir, names.thumbnail),
+			triggerOffsetSec: input.prebufferSpanMs / 1e3
+		});
+		const record = {
+			schemaVersion: 1,
+			clipId,
+			source: HKSV_CLIP_SOURCE,
+			deviceId: input.deviceId,
+			streamId: input.streamId,
+			startedAtMs: outcome.startedAtMs,
+			endedAtMs: outcome.endedAtMs,
+			durationMs: Math.max(0, outcome.endedAtMs - outcome.startedAtMs),
+			prebufferSpanMs: input.prebufferSpanMs,
+			bytes: outcome.bytes,
+			fragments: outcome.fragments,
+			file: names.clip,
+			...thumbnail.ok ? { thumbnailFile: names.thumbnail } : { thumbnailUnavailable: { reason: thumbnail.reason } },
+			...outcome.truncated === null ? {} : { truncated: outcome.truncated },
+			acknowledgedByHomeKit: false,
+			width: input.width,
+			height: input.height,
+			fragmentMs: input.fragmentMs
+		};
+		await this.writeRecord(join(dir, names.record), record);
+		this.log.info("hksv clip tee: a HomeKit clip was KEPT", {
+			tags,
+			meta: {
+				clipId,
+				streamId: input.streamId,
+				bytes: record.bytes,
+				fragments: record.fragments,
+				durationMs: record.durationMs,
+				prebufferSpanMs: record.prebufferSpanMs,
+				truncated: record.truncated ?? null,
+				thumbnail: record.thumbnailFile ?? null,
+				thumbnailUnavailable: record.thumbnailUnavailable?.reason ?? null
+			}
+		});
+		await this.prune(input.deviceId);
+		return record;
+	}
+	/**
+	* Mint, then CHECK. The minter's own verdict decides nothing on its own: a
+	* JPEG is vouched by `stat`, never by a return value.
+	*/
+	async mintAndVouch(mint) {
+		const { deviceId, jpegPath } = mint;
+		const minter = this.input.mintThumbnail;
+		if (minter === void 0) return {
+			ok: false,
+			reason: "not-attempted"
+		};
+		let declared;
+		try {
+			declared = await minter(mint);
+		} catch (err) {
+			this.log.warn("hksv clip tee: the thumbnail minter threw — the clip is kept WITHOUT a still", {
+				tags: { deviceId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+			declared = {
+				ok: false,
+				reason: "decode-failed"
+			};
+		}
+		if (await fileSize(jpegPath) > 0) return { ok: true };
+		await rm(jpegPath, { force: true });
+		const reason = declared.ok ? "decode-failed" : declared.reason;
+		this.log.warn("hksv clip tee: no thumbnail for this clip", {
+			tags: { deviceId },
+			meta: {
+				reason,
+				declaredOk: declared.ok
+			}
+		});
+		return {
+			ok: false,
+			reason
+		};
+	}
+	/**
+	* Enforce every bound, oldest first. Enumerated from the MP4s rather than the
+	* sidecars, so a stem whose sidecar never landed — a crash mid-write — is
+	* seen and removed instead of occupying the disk invisibly forever.
+	*/
+	async prune(deviceId) {
+		const cutoff = this.now() - this.bounds.maxAgeMs;
+		const perDevice = await this.scanDevice(deviceId);
+		await this.enforce(perDevice, cutoff, this.bounds.maxClipsPerDevice, this.bounds.maxBytesPerDevice);
+		let deviceIds;
+		try {
+			deviceIds = (await readdir(this.input.rootDir, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => Number.parseInt(e.name, 10)).filter((id) => Number.isFinite(id));
+		} catch {
+			return;
+		}
+		const all = [];
+		for (const id of deviceIds) all.push(...await this.scanDevice(id));
+		await this.enforce(all, cutoff, Number.POSITIVE_INFINITY, this.bounds.maxStoreBytes);
+	}
+	async enforce(clips, ageCutoff, maxCount, maxBytes) {
+		const ordered = [...clips].sort((a, b) => b.startedAtMs - a.startedAtMs);
+		let kept = 0;
+		let bytes = 0;
+		for (const clip of ordered) {
+			const tooOld = clip.startedAtMs < ageCutoff;
+			const overCount = kept >= maxCount;
+			const overBytes = bytes + clip.bytes > maxBytes;
+			if (!tooOld && !overCount && !overBytes) {
+				kept += 1;
+				bytes += clip.bytes;
+				continue;
+			}
+			await this.deleteClip(clip, tooOld ? "age" : overCount ? "count" : "bytes");
+		}
+	}
+	async deleteClip(clip, reason) {
+		for (const name of [
+			`${clip.stem}.mp4`,
+			`${clip.stem}.jpg`,
+			`${clip.stem}.json`
+		]) await rm(join(clip.dir, name), { force: true });
+		this.log.info("hksv clip store: pruned a clip", {
+			tags: { deviceId: clip.deviceId },
+			meta: {
+				stem: clip.stem,
+				bytes: clip.bytes,
+				reason,
+				startedAtMs: clip.startedAtMs
+			}
+		});
+	}
+	async scanDevice(deviceId) {
+		const dir = this.deviceDir(deviceId);
+		let names;
+		try {
+			names = await readdir(dir);
+		} catch {
+			return [];
+		}
+		const clips = [];
+		for (const name of names) {
+			if (!name.endsWith(".mp4")) continue;
+			const stem = stemOf(name);
+			if (this.isInFlight(deviceId, stem)) continue;
+			const bytes = await fileSize(join(dir, name));
+			const record = await this.readRecord(join(dir, `${stem}.json`), deviceId);
+			if (record === null) {
+				await rm(join(dir, name), { force: true });
+				this.log.warn("hksv clip store: removed an orphaned clip file (no sidecar, not being written)", {
+					tags: { deviceId },
+					meta: {
+						stem,
+						bytes
+					}
+				});
+				continue;
+			}
+			clips.push({
+				deviceId,
+				dir,
+				stem,
+				bytes,
+				startedAtMs: record.startedAtMs
+			});
+		}
+		return clips;
+	}
+	isInFlight(deviceId, stem) {
+		for (const entry of this.inFlight.values()) if (entry.deviceId === deviceId && entry.stem === stem) return true;
+		return false;
+	}
+	async readRecord(path, deviceId) {
+		let raw;
+		try {
+			raw = await readFile(path, "utf8");
+		} catch {
+			return null;
+		}
+		const parsed = HksvClipRecordSchema.safeParse(JSON.parse(raw));
+		if (parsed.success) return parsed.data;
+		this.log.warn("hksv clip store: a sidecar could not be read — the clip is not listed", {
+			tags: { deviceId },
+			meta: {
+				path,
+				error: parsed.error.message
+			}
+		});
+		return null;
+	}
+	async writeRecord(path, record) {
+		await writeFile(path, JSON.stringify(record, null, 2), "utf8");
+	}
+};
+function stemOf(fileName) {
+	return fileName.replace(/\.[^.]+$/, "");
+}
+async function fileSize(path) {
 	try {
-		const device = await proxy.deviceManager?.getDevice({});
-		const metadata = readMetadata(device);
-		info.setCharacteristic(import_dist.Characteristic.Name, device?.name ?? displayName);
-		info.setCharacteristic(import_dist.Characteristic.Manufacturer, stringOr(metadata?.manufacturer, "CamStack"));
-		info.setCharacteristic(import_dist.Characteristic.Model, stringOr(metadata?.model, modelFallback));
-		info.setCharacteristic(import_dist.Characteristic.FirmwareRevision, stringOr(metadata?.firmware, "0.0.0"));
-		info.setCharacteristic(import_dist.Characteristic.SerialNumber, stringOr(metadata?.sn, `camstack-${proxy.deviceId}`));
-	} catch {}
+		return (await stat(path)).size;
+	} catch {
+		return 0;
+	}
 }
-/** The four fields this module reads, or `null` — the device record's
-*  `metadata` is an open bag and nothing else here depends on its shape. */
-function readMetadata(device) {
-	const metadata = device?.metadata;
-	if (metadata === null || typeof metadata !== "object") return {};
-	const entries = new Map(Object.entries(metadata));
+/**
+* A sink over a real file that HONOURS backpressure: `write()` returning false
+* means the kernel has not taken the bytes, and ignoring it is how a stream
+* grows a queue nobody bounded (D447).
+*/
+async function createFileSink(path) {
+	const stream = createWriteStream(path);
+	await once(stream, "open");
 	return {
-		model: stringOrNull(entries.get("model")),
-		manufacturer: stringOrNull(entries.get("manufacturer")),
-		firmware: stringOrNull(entries.get("firmware")),
-		sn: stringOrNull(entries.get("sn"))
+		async write(chunk) {
+			if (!stream.write(chunk)) await once(stream, "drain");
+		},
+		async close() {
+			await new Promise((resolve, reject) => {
+				stream.end((err) => err ? reject(err) : resolve());
+			});
+		}
 	};
 }
-function stringOrNull(value) {
-	return typeof value === "string" ? value : null;
+function buildClipThumbnailArgs(input) {
+	return [
+		"-hide_banner",
+		"-loglevel",
+		"error",
+		"-nostdin",
+		"-y",
+		"-ss",
+		String(Math.max(0, Math.floor(input.seekSec))),
+		"-i",
+		input.clipPath,
+		"-frames:v",
+		"1",
+		"-vf",
+		`scale='min(${input.maxWidth},iw)':-2`,
+		"-f",
+		"image2",
+		"-vcodec",
+		"mjpeg",
+		input.jpegPath
+	];
 }
-function stringOr(value, fallback) {
-	return typeof value === "string" && value.length > 0 ? value : fallback;
+function createClipThumbnailMinter(input) {
+	return async ({ clipPath, jpegPath, triggerOffsetSec }) => {
+		const args = buildClipThumbnailArgs({
+			clipPath,
+			jpegPath,
+			seekSec: triggerOffsetSec,
+			maxWidth: input.maxWidth ?? 640
+		});
+		let run;
+		try {
+			run = await input.runner(args);
+		} catch {
+			return {
+				ok: false,
+				reason: "decode-failed"
+			};
+		}
+		if (run.spawnFailed) return {
+			ok: false,
+			reason: "ffmpeg-missing"
+		};
+		if (run.timedOut) return {
+			ok: false,
+			reason: "timed-out"
+		};
+		if (run.code !== 0) return {
+			ok: false,
+			reason: "decode-failed"
+		};
+		return { ok: true };
+	};
+}
+/**
+* The production runner: one bounded ffmpeg, killed at the deadline.
+*
+* Bounded and killed, not merely awaited — an ffmpeg that never exits on a
+* clip it cannot parse would otherwise hold a process per clip on a hub that
+* already runs a permanent prebuffer per recorded camera.
+*/
+function createFfmpegClipThumbnailRunner(input) {
+	const timeoutMs = input.timeoutMs ?? 1e4;
+	return (args) => new Promise((resolve) => {
+		let settled = false;
+		const finish = (run) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			resolve(run);
+		};
+		const child = input.spawnFn(input.ffmpegBinaryPath, [...args], { stdio: [
+			"ignore",
+			"ignore",
+			"pipe"
+		] });
+		let stderr = "";
+		child.stderr?.on("data", (chunk) => {
+			if (stderr.length < 2e3) stderr += chunk.toString("utf8");
+		});
+		const timer = setTimeout(() => {
+			child.kill("SIGKILL");
+			finish({
+				code: null,
+				timedOut: true,
+				spawnFailed: false,
+				stderr
+			});
+		}, timeoutMs);
+		timer.unref?.();
+		child.on("error", (err) => {
+			finish({
+				code: null,
+				timedOut: false,
+				spawnFailed: true,
+				stderr: err.message
+			});
+		});
+		child.on("close", (code) => {
+			finish({
+				code,
+				timedOut: false,
+				spawnFailed: false,
+				stderr
+			});
+		});
+	});
 }
 //#endregion
 //#region src/mappers/builders/generic/characteristic-update.ts
@@ -88785,6 +89702,910 @@ function errMsg$14(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
+//#region src/mappers/builders/child-switch.ts
+/**
+* Child-switch builder — turns a camstack accessory child device (siren,
+* floodlight, spotlight, …) into a HomeKit Service ON THE PARENT
+* camera Accessory.
+*
+* The orchestrator (`child-accessory.ts → buildChildServicesFor`)
+* hands this builder the PARENT accessory + the CHILD's proxy + a
+* unique subtype so each service round-trips deterministically through
+* HAP serialisation. The builder:
+*  - Maps `switch` cap → `Service.Switch`.
+*  - Maps `switch` + `brightness` cap → `Service.Lightbulb` with
+*    Brightness characteristic (lighting devices only — see below).
+*  - Hydrates initial state from `getStatus({})`.
+*  - Wires `Characteristic.On` / `Characteristic.Brightness` through
+*    the typed DeviceProxy.
+*  - Subscribes to runtime-state slice updates so iOS Home reflects
+*    external state changes (e.g. another integration toggling the
+*    light).
+*
+* Service-kind selection: most cameras expose `brightness` on a siren
+* because it controls the alarm VOLUME, not luminosity. Mapping a
+* siren onto `Service.Lightbulb` makes it appear as a regular light in
+* iOS Home (wrong icon, wrong scenes, wrong Siri intents). We therefore
+* gate `Service.Lightbulb` on the child's `DeviceType` — only Light /
+* Generic devices keep the Lightbulb shape; Siren, Switch, and others
+* fall back to `Service.Switch`. Volume control for sirens is exposed
+* through the camstack admin UI; iOS Home only needs the on/off toggle.
+*
+* Child devices without `switch` / `brightness` cap (status sensors,
+* IR LED, etc.) return a no-op handle.
+*/
+async function buildChildSwitch(bctx, subtype, deviceType) {
+	const { ctx, accessory, proxy, numericDeviceId, displayName } = bctx;
+	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
+	const hasSwitch = !!proxy.switch;
+	const hasBrightness = !!proxy.brightness;
+	if (!hasSwitch && !hasBrightness) {
+		log.debug("export-hap: child has no switch/brightness cap — skipping");
+		return { async dispose() {} };
+	}
+	const isLightingDevice = deviceType === DeviceType.Light || deviceType === DeviceType.Generic;
+	const useLightbulb = hasBrightness && isLightingDevice;
+	const service = useLightbulb ? accessory.addService(import_dist.Service.Lightbulb, displayName, subtype) : accessory.addService(import_dist.Service.Switch, displayName, subtype);
+	applyServiceLabel(service, displayName);
+	try {
+		const switchStatus = await proxy.switch?.getStatus({});
+		if (switchStatus && typeof switchStatus.on === "boolean") service.updateCharacteristic(import_dist.Characteristic.On, switchStatus.on);
+	} catch (err) {
+		log.debug("export-hap: child switch.getStatus failed (non-fatal)", { meta: { error: errMsg$13(err) } });
+	}
+	if (useLightbulb) try {
+		const status = await proxy.brightness?.getStatus({});
+		if (status && typeof status.percentage === "number") service.updateCharacteristic(import_dist.Characteristic.Brightness, status.percentage);
+	} catch (err) {
+		log.debug("export-hap: child brightness.getStatus failed (non-fatal)", { meta: { error: errMsg$13(err) } });
+	}
+	if (hasSwitch) service.getCharacteristic(import_dist.Characteristic.On).onSet(async (value) => {
+		const on = value === true;
+		try {
+			await proxy.switch?.setState({ on });
+		} catch (err) {
+			log.warn("export-hap: child switch.setState failed", { meta: {
+				on,
+				error: errMsg$13(err)
+			} });
+		}
+	});
+	if (useLightbulb) service.getCharacteristic(import_dist.Characteristic.Brightness).onSet(async (value) => {
+		const percentage = typeof value === "number" ? value : Number(value);
+		if (!Number.isFinite(percentage)) return;
+		try {
+			await proxy.brightness?.setBrightness({ percentage });
+		} catch (err) {
+			log.warn("export-hap: child brightness.setBrightness failed", { meta: {
+				percentage,
+				error: errMsg$13(err)
+			} });
+		}
+	});
+	const unsubscribes = [];
+	if (proxy.state.switch) {
+		const unsubSwitch = proxy.state.switch.subscribe((value) => {
+			if (value && typeof value.on === "boolean") service.updateCharacteristic(import_dist.Characteristic.On, value.on);
+		});
+		unsubscribes.push(unsubSwitch);
+	}
+	if (useLightbulb && proxy.state.brightness) {
+		const unsubBrightness = proxy.state.brightness.subscribe((value) => {
+			if (value && typeof value.percentage === "number") service.updateCharacteristic(import_dist.Characteristic.Brightness, value.percentage);
+		});
+		unsubscribes.push(unsubBrightness);
+	}
+	return { async dispose() {
+		for (const u of unsubscribes) try {
+			u();
+		} catch {}
+	} };
+}
+function errMsg$13(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
+//#region src/mappers/builders/generic/lock.ts
+/**
+* `lock-control` → `Service.LockMechanism`.
+*
+* Not a sensor row: HomeKit models a lock as two characteristics, a CURRENT
+* state the accessory owns and a TARGET state the controller writes, and the
+* cap's five states do not map onto either one alone.
+*
+* ```
+*  cap state    LockCurrentState   LockTargetState
+*  locked       SECURED            SECURED
+*  unlocked     UNSECURED          UNSECURED
+*  locking      UNKNOWN            SECURED      (in flight — do not claim SECURED)
+*  unlocking    UNKNOWN            UNSECURED
+*  jammed       JAMMED             unchanged    (the controller's intent stands)
+* ```
+*
+* Reporting SECURED while the bolt is still moving is the failure worth naming:
+* iOS renders the lock as closed, the operator walks away, and the motor stalls
+* behind them. `UNKNOWN` is the honest answer for an in-flight transition.
+*
+* `open` (the cap's third method, for locks with a latch/buzzer) has no HomeKit
+* counterpart on this service and is deliberately not wired — a Switch that
+* silently buzzes a door open would be a second knob nobody asked for.
+*/
+var SUBTYPE$1 = "lock-control";
+var readLock = reader(LockControlStatusSchema.pick({ state: true }), (status) => {
+	const current = status.state === "locked" ? import_dist.Characteristic.LockCurrentState.SECURED : status.state === "unlocked" ? import_dist.Characteristic.LockCurrentState.UNSECURED : status.state === "jammed" ? import_dist.Characteristic.LockCurrentState.JAMMED : import_dist.Characteristic.LockCurrentState.UNKNOWN;
+	const target = status.state === "locked" || status.state === "locking" ? import_dist.Characteristic.LockTargetState.SECURED : status.state === "unlocked" || status.state === "unlocking" ? import_dist.Characteristic.LockTargetState.UNSECURED : null;
+	return [{
+		characteristic: import_dist.Characteristic.LockCurrentState,
+		value: current
+	}, ...target === null ? [] : [{
+		characteristic: import_dist.Characteristic.LockTargetState,
+		value: target
+	}]];
+});
+async function buildLockMechanism(bctx) {
+	const { ctx, accessory, proxy, numericDeviceId, displayName } = bctx;
+	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
+	const label = hapServiceName([displayName], `Lock ${numericDeviceId}`);
+	const service = accessory.addService(import_dist.Service.LockMechanism, label, SUBTYPE$1);
+	applyServiceLabel(service, label);
+	const apply = (status, source) => {
+		const updates = readLock(status);
+		if (updates.length === 0) {
+			log.debug("export-hap: lock status did not match the cap schema — no update", { meta: { source } });
+			return;
+		}
+		applyUpdates(service, updates);
+	};
+	try {
+		const status = await proxy.lockControl?.getStatus({});
+		if (status !== void 0 && status !== null) apply(status, "getStatus");
+	} catch (err) {
+		log.debug("export-hap: lock getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$12(err) } });
+	}
+	service.getCharacteristic(import_dist.Characteristic.LockTargetState).onSet(async (value) => {
+		const secure = value === import_dist.Characteristic.LockTargetState.SECURED;
+		try {
+			if (secure) await proxy.lockControl?.lock({});
+			else await proxy.lockControl?.unlock({});
+		} catch (err) {
+			log.warn("export-hap: lock command failed", { meta: {
+				secure,
+				error: errMsg$12(err)
+			} });
+		}
+	});
+	const unsubscribe = proxy.state.lockControl?.subscribe((value) => {
+		if (value === void 0 || value === null) return;
+		apply(value, "slice");
+	}) ?? null;
+	return { async dispose() {
+		try {
+			unsubscribe?.();
+		} catch {}
+	} };
+}
+function errMsg$12(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
+//#region src/mappers/builders/generic/security-state.ts
+/** Is this a settled arm state worth remembering? */
+function armedMemoOf(state) {
+	return state === "armed_home" || state === "armed_away" || state === "armed_night" || state === "armed_vacation" || state === "armed_custom_bypass" ? state : null;
+}
+function currentForArmed(state) {
+	switch (state) {
+		case "armed_home":
+		case "armed_custom_bypass": return import_dist.Characteristic.SecuritySystemCurrentState.STAY_ARM;
+		case "armed_night": return import_dist.Characteristic.SecuritySystemCurrentState.NIGHT_ARM;
+		default: return import_dist.Characteristic.SecuritySystemCurrentState.AWAY_ARM;
+	}
+}
+function targetForArmed(state) {
+	switch (state) {
+		case "armed_home":
+		case "armed_custom_bypass": return import_dist.Characteristic.SecuritySystemTargetState.STAY_ARM;
+		case "armed_night": return import_dist.Characteristic.SecuritySystemTargetState.NIGHT_ARM;
+		default: return import_dist.Characteristic.SecuritySystemTargetState.AWAY_ARM;
+	}
+}
+function securityStateFor(state, memo) {
+	const settled = armedMemoOf(state);
+	if (settled !== null) return {
+		current: currentForArmed(settled),
+		target: targetForArmed(settled)
+	};
+	switch (state) {
+		case "disarmed": return {
+			current: import_dist.Characteristic.SecuritySystemCurrentState.DISARMED,
+			target: import_dist.Characteristic.SecuritySystemTargetState.DISARM
+		};
+		case "arming": return {
+			current: import_dist.Characteristic.SecuritySystemCurrentState.DISARMED,
+			target: memo === null ? null : targetForArmed(memo)
+		};
+		case "disarming": return {
+			current: memo === null ? import_dist.Characteristic.SecuritySystemCurrentState.DISARMED : currentForArmed(memo),
+			target: import_dist.Characteristic.SecuritySystemTargetState.DISARM
+		};
+		case "pending": return {
+			current: memo === null ? import_dist.Characteristic.SecuritySystemCurrentState.DISARMED : currentForArmed(memo),
+			target: memo === null ? null : targetForArmed(memo)
+		};
+		default: return {
+			current: import_dist.Characteristic.SecuritySystemCurrentState.ALARM_TRIGGERED,
+			target: memo === null ? null : targetForArmed(memo)
+		};
+	}
+}
+/**
+* The arm mode behind a HomeKit target, or `null` for DISARM and for anything
+* outside the four values HomeKit defines.
+*
+* `null` is not an error the caller can ignore: DISARM is a different COMMAND,
+* and a value HomeKit never sends is a write this builder refuses to translate.
+*/
+function alarmArmModeFor(target) {
+	switch (target) {
+		case import_dist.Characteristic.SecuritySystemTargetState.STAY_ARM: return "home";
+		case import_dist.Characteristic.SecuritySystemTargetState.AWAY_ARM: return "away";
+		case import_dist.Characteristic.SecuritySystemTargetState.NIGHT_ARM: return "night";
+		default: return null;
+	}
+}
+//#endregion
+//#region src/mappers/builders/generic/security-target.ts
+/**
+* The panel modes behind each HomeKit target, PRIMARY first.
+*
+* The primary is the mode `alarmArmModeFor` names; the secondary is the other
+* mode `security-state.ts` reports through the same HomeKit value, so the two
+* modules agree in both directions by construction.
+*/
+var MODES_BY_TARGET = new Map([
+	[import_dist.Characteristic.SecuritySystemTargetState.STAY_ARM, ["home", "custom_bypass"]],
+	[import_dist.Characteristic.SecuritySystemTargetState.AWAY_ARM, ["away", "vacation"]],
+	[import_dist.Characteristic.SecuritySystemTargetState.NIGHT_ARM, ["night"]]
+]);
+/** Arm targets in the order HomeKit numbers them; DISARM is appended last. */
+var ARM_TARGETS = [
+	import_dist.Characteristic.SecuritySystemTargetState.STAY_ARM,
+	import_dist.Characteristic.SecuritySystemTargetState.AWAY_ARM,
+	import_dist.Characteristic.SecuritySystemTargetState.NIGHT_ARM
+];
+/**
+* The `validValues` for `SecuritySystemTargetState`, or `null` to leave
+* HomeKit's own four values in place.
+*
+* DISARM is always present: disarming is not one of the panel's arm modes and
+* a panel that cannot be disarmed is not a thing this cap can express.
+*/
+function targetValidValuesFor(availableModes) {
+	if (availableModes.length === 0) return null;
+	return [...ARM_TARGETS.filter((target) => (MODES_BY_TARGET.get(target) ?? []).some((mode) => availableModes.includes(mode))), import_dist.Characteristic.SecuritySystemTargetState.DISARM];
+}
+/**
+* The arm mode to send for a HomeKit target, or `null` when there is none.
+*
+* `null` is not a shrug the caller may swallow: DISARM is a different command,
+* and an arm target the panel accepts no mode for is a write this module
+* refuses to translate rather than guess at.
+*/
+function armModeForTarget(target, availableModes) {
+	const primary = alarmArmModeFor(target);
+	if (primary === null) return null;
+	if (availableModes.length === 0) return primary;
+	return (MODES_BY_TARGET.get(target) ?? [primary]).find((mode) => availableModes.includes(mode)) ?? null;
+}
+//#endregion
+//#region src/mappers/builders/generic/security-system.ts
+/**
+* `alarm-panel` → `Service.SecuritySystem`.
+*
+* The lock builder's shape (a current/target pair, a hydrate, an `onSet`, a
+* slice subscription, a dispose) applied to the one device on the fleet where
+* reporting a state that is not true has a consequence worse than a stalled
+* motor. The mapping itself is NOT here: `security-state.ts` owns what the
+* panel's state looks like to HomeKit and `security-target.ts` owns what
+* HomeKit may ask for, both pure and both tested on their own. This file is
+* the service around them.
+*
+* ## The memo
+*
+* `pending`, `disarming` and `triggered` do not carry the mode the panel was
+* armed to — only the last settled state knows it. This builder is the caller
+* `security-state.ts` describes: it remembers the last settled arm and forgets
+* it on `disarmed`, because a memo that outlives a disarm makes the next
+* `arming` claim a target nobody asked for.
+*
+* The memo is deliberately NOT seeded from the controller's own write. HomeKit
+* already holds the target the operator just set; not writing it back is
+* exactly right. The cost is a panel armed from its own keypad during an exit
+* delay, where the target stays at whatever HomeKit last knew — a stale target
+* for the length of the delay, against inventing an intent, and the invention
+* is worse.
+*
+* ## `requiresCode`: the arm is REFUSED, not attempted
+*
+* HomeKit's SecuritySystem has no PIN prompt — there is no characteristic for
+* it and no way to ask the operator mid-write. So a panel that requires a code
+* cannot be armed or disarmed from the Home app, and this builder says so
+* twice: the write fails with `INSUFFICIENT_AUTHORIZATION` (iOS renders the
+* tile's failure) and a WARN names the device, the command and the mode.
+*
+* Sending the command code-less and letting the panel reject it was the
+* alternative. It is worse: the refusal costs a round trip, it is
+* indistinguishable from a broken panel in the log, and repeated code-less
+* attempts are what locks a real alarm panel out.
+*/
+var SUBTYPE = "alarm-panel";
+/** The subset of the status this builder reads. */
+var PanelReadSchema = AlarmPanelStatusSchema.pick({
+	state: true,
+	availableModes: true,
+	requiresCode: true
+});
+/**
+* Turn a panel status into characteristic writes, folding the memo.
+*
+* A payload that does not match the cap's own schema yields NO updates and
+* leaves the memo alone — it is a status we could not read, not a panel that
+* changed. The caller logs the drop; a frozen characteristic is otherwise
+* indistinguishable from a quiet panel.
+*/
+function securityUpdatesFor(status, memo) {
+	const parsed = PanelReadSchema.safeParse(status);
+	if (!parsed.success) return {
+		updates: [],
+		memo,
+		panel: null
+	};
+	const nextMemo = parsed.data.state === "disarmed" ? null : armedMemoOf(parsed.data.state) ?? memo;
+	const { current, target } = securityStateFor(parsed.data.state, nextMemo);
+	return {
+		updates: [{
+			characteristic: import_dist.Characteristic.SecuritySystemCurrentState,
+			value: current
+		}, ...target === null ? [] : [{
+			characteristic: import_dist.Characteristic.SecuritySystemTargetState,
+			value: target
+		}]],
+		memo: nextMemo,
+		panel: {
+			availableModes: parsed.data.availableModes,
+			requiresCode: parsed.data.requiresCode
+		}
+	};
+}
+async function buildSecuritySystem(bctx) {
+	const { ctx, accessory, proxy, numericDeviceId, displayName } = bctx;
+	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
+	const label = hapServiceName([displayName], `Alarm ${numericDeviceId}`);
+	const service = accessory.addService(import_dist.Service.SecuritySystem, label, SUBTYPE);
+	applyServiceLabel(service, label);
+	let memo = null;
+	let availableModes = [];
+	let requiresCode = false;
+	/** Only log the `validValues` narrowing when it actually changes. */
+	let lastValidValues = "";
+	const applyValidValues = () => {
+		const validValues = targetValidValuesFor(availableModes);
+		if (validValues === null) {
+			if (lastValidValues !== "unconstrained") {
+				lastValidValues = "unconstrained";
+				log.info("export-hap: alarm panel named no arm modes — leaving HomeKit’s targets unconstrained", { meta: { subtype: SUBTYPE } });
+			}
+			return;
+		}
+		const key = validValues.join(",");
+		if (key === lastValidValues) return;
+		lastValidValues = key;
+		service.getCharacteristic(import_dist.Characteristic.SecuritySystemTargetState).setProps({ validValues: [...validValues] });
+		log.info("export-hap: alarm panel target constrained to the modes it accepts", { meta: {
+			subtype: SUBTYPE,
+			availableModes: [...availableModes],
+			validValues
+		} });
+	};
+	const apply = (status, source) => {
+		const next = securityUpdatesFor(status, memo);
+		if (next.updates.length === 0) {
+			log.debug("export-hap: alarm panel status did not match the cap schema — no update", { meta: {
+				subtype: SUBTYPE,
+				source
+			} });
+			return;
+		}
+		memo = next.memo;
+		if (next.panel !== null) {
+			availableModes = next.panel.availableModes;
+			requiresCode = next.panel.requiresCode;
+			applyValidValues();
+		}
+		applyUpdates(service, next.updates);
+	};
+	try {
+		const status = await proxy.alarmPanel?.getStatus({});
+		if (status !== void 0 && status !== null) apply(status, "getStatus");
+	} catch (err) {
+		log.debug("export-hap: alarm panel getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$11(err) } });
+	}
+	service.getCharacteristic(import_dist.Characteristic.SecuritySystemTargetState).onSet(async (value) => {
+		const target = typeof value === "number" ? value : Number(value);
+		const disarm = target === import_dist.Characteristic.SecuritySystemTargetState.DISARM;
+		const mode = disarm ? null : armModeForTarget(target, availableModes);
+		if (requiresCode) {
+			log.warn("export-hap: alarm panel requires a PIN — HomeKit cannot supply one, command REFUSED", { meta: {
+				subtype: SUBTYPE,
+				command: disarm ? "disarm" : "arm",
+				mode,
+				target
+			} });
+			throw new import_dist.HapStatusError(import_dist.HAPStatus.INSUFFICIENT_AUTHORIZATION);
+		}
+		if (!disarm && mode === null) {
+			log.warn("export-hap: alarm panel cannot honour this HomeKit arm target — REFUSED", { meta: {
+				subtype: SUBTYPE,
+				target,
+				availableModes: [...availableModes]
+			} });
+			throw new import_dist.HapStatusError(import_dist.HAPStatus.INVALID_VALUE_IN_REQUEST);
+		}
+		try {
+			if (mode === null) await proxy.alarmPanel?.disarm({});
+			else await proxy.alarmPanel?.arm({ mode });
+		} catch (err) {
+			log.warn("export-hap: alarm panel command failed", { meta: {
+				subtype: SUBTYPE,
+				command: mode === null ? "disarm" : "arm",
+				mode,
+				error: errMsg$11(err)
+			} });
+			throw new import_dist.HapStatusError(import_dist.HAPStatus.SERVICE_COMMUNICATION_FAILURE);
+		}
+	});
+	const unsubscribe = proxy.state.alarmPanel?.subscribe((value) => {
+		if (value === void 0 || value === null) return;
+		apply(value, "slice");
+	}) ?? null;
+	return { async dispose() {
+		try {
+			unsubscribe?.();
+		} catch {}
+	} };
+}
+function errMsg$11(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
+//#region src/mappers/builders/generic/sensor-service.ts
+async function buildSensorService(input) {
+	const { bctx, spec, name, subtype } = input;
+	const { ctx, accessory, proxy, numericDeviceId } = bctx;
+	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
+	const label = hapServiceName([name], spec.label);
+	const service = spec.addService(accessory, label, subtype);
+	applyServiceLabel(service, label);
+	const apply = (status, source) => {
+		const updates = spec.read(status);
+		if (updates.length === 0) {
+			log.debug("export-hap: sensor status did not match the cap schema — no update", { meta: {
+				subtype,
+				source
+			} });
+			return;
+		}
+		applyUpdates(service, updates);
+	};
+	try {
+		const status = await spec.getStatus(proxy);
+		if (status !== void 0 && status !== null) apply(status, "getStatus");
+	} catch (err) {
+		log.debug("export-hap: sensor getStatus hydrate failed (non-fatal)", { meta: {
+			subtype,
+			error: errMsg$10(err)
+		} });
+	}
+	const unsubscribe = spec.subscribe(proxy, (value) => {
+		if (value === void 0 || value === null) return;
+		apply(value, "slice");
+	});
+	return { async dispose() {
+		try {
+			unsubscribe?.();
+		} catch {}
+	} };
+}
+function errMsg$10(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
+//#region src/mappers/builders/generic/cap-service-table.ts
+/**
+* The capability→HomeKit-service TABLE for non-camera devices.
+*
+* This is the whole coverage decision for the generic export path, and it is
+* deliberately a table rather than a `switch` on `DeviceType`. The doctrine is
+* the one the Home Assistant exporter already writes down: *coverage is decided
+* by a device's capabilities, not its type — restricting the picker by type is
+* what confined the previous exporter to cameras.* A `DeviceType` here is only
+* ever a UI filter (`HAP_EXPORTABLE_DEVICE_TYPES`) or an icon
+* (`ACCESSORY_CATEGORY_BY_TYPE`); it never decides whether something exports.
+*
+* The shape mirrors `CAP_ENTITY_MAP` in
+* `packages/addon-provider-homeassistant/src/ha-export/entity-catalog.ts` so
+* the two can be unified later — one row per capability, keyed by the cap name
+* exactly as it appears in `proxy.binding.entries[].capName`.
+*
+* ## Reading a status
+*
+* Every row parses the cap's OWN Zod status schema rather than duck-typing the
+* payload, and it `.pick()`s only the fields it reads: a provider that omits a
+* timestamp must not silence a sensor, and a provider that sends the wrong
+* shape must not write a garbage characteristic. A parse that fails yields no
+* updates, and the builder that owns the service logs the drop — silence reads
+* as "the sensor never changed".
+*
+* ## Tier
+*
+* Tier A, plus `alarm-panel`: the caps whose HomeKit service exists today and
+* needs no feature-dependent shape. `cover` still needs `cover-positionable`
+* and `climate-control` the dual-setpoint split; those are a separate task,
+* and adding a row here must never mean adding a service whose semantics this
+* file cannot fully honour.
+*
+* `alarm-panel` earned its row by answering the two questions that kept it
+* out: a target the panel would refuse is never offered (`availableModes` →
+* `validValues`, `security-target.ts`) and an arm a PIN-gated panel cannot
+* accept is refused out loud rather than attempted (`security-system.ts`).
+*/
+/** HomeKit's floor for `CurrentAmbientLightLevel`; 0 lux is out of range. */
+var MIN_LUX = 1e-4;
+var SENSOR_SPECS = {
+	contact: {
+		label: "Contact",
+		addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.ContactSensor, name, subtype),
+		getStatus: (proxy) => proxy.contact?.getStatus({}),
+		subscribe: (proxy, onValue) => proxy.state.contact?.subscribe(onValue) ?? null,
+		read: reader(ContactStatusSchema.pick({ entryOpen: true }), (status) => [{
+			characteristic: import_dist.Characteristic.ContactSensorState,
+			value: status.entryOpen ? import_dist.Characteristic.ContactSensorState.CONTACT_NOT_DETECTED : import_dist.Characteristic.ContactSensorState.CONTACT_DETECTED
+		}])
+	},
+	motion: {
+		label: "Motion",
+		addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.MotionSensor, name, subtype),
+		getStatus: (proxy) => proxy.motion?.getStatus({}),
+		subscribe: (proxy, onValue) => proxy.state.motion?.subscribe(onValue) ?? null,
+		read: reader(MotionStatusSchema.pick({ detected: true }), (status) => [{
+			characteristic: import_dist.Characteristic.MotionDetected,
+			value: status.detected
+		}])
+	},
+	presence: {
+		label: "Presence",
+		addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.OccupancySensor, name, subtype),
+		getStatus: (proxy) => proxy.presence?.getStatus({}),
+		subscribe: (proxy, onValue) => proxy.state.presence?.subscribe(onValue) ?? null,
+		read: reader(PresenceStatusSchema.pick({ state: true }), (status) => [{
+			characteristic: import_dist.Characteristic.OccupancyDetected,
+			value: status.state === "home" ? import_dist.Characteristic.OccupancyDetected.OCCUPANCY_DETECTED : import_dist.Characteristic.OccupancyDetected.OCCUPANCY_NOT_DETECTED
+		}])
+	},
+	smoke: {
+		label: "Smoke",
+		addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.SmokeSensor, name, subtype),
+		getStatus: (proxy) => proxy.smoke?.getStatus({}),
+		subscribe: (proxy, onValue) => proxy.state.smoke?.subscribe(onValue) ?? null,
+		read: reader(SmokeStatusSchema.pick({ detected: true }), (status) => [{
+			characteristic: import_dist.Characteristic.SmokeDetected,
+			value: status.detected ? import_dist.Characteristic.SmokeDetected.SMOKE_DETECTED : import_dist.Characteristic.SmokeDetected.SMOKE_NOT_DETECTED
+		}])
+	},
+	"carbon-monoxide": {
+		label: "Carbon monoxide",
+		addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.CarbonMonoxideSensor, name, subtype),
+		getStatus: (proxy) => proxy.carbonMonoxide?.getStatus({}),
+		subscribe: (proxy, onValue) => proxy.state.carbonMonoxide?.subscribe(onValue) ?? null,
+		read: reader(CarbonMonoxideStatusSchema.pick({ detected: true }), (status) => [{
+			characteristic: import_dist.Characteristic.CarbonMonoxideDetected,
+			value: status.detected ? import_dist.Characteristic.CarbonMonoxideDetected.CO_LEVELS_ABNORMAL : import_dist.Characteristic.CarbonMonoxideDetected.CO_LEVELS_NORMAL
+		}])
+	},
+	flood: {
+		label: "Leak",
+		addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.LeakSensor, name, subtype),
+		getStatus: (proxy) => proxy.flood?.getStatus({}),
+		subscribe: (proxy, onValue) => proxy.state.flood?.subscribe(onValue) ?? null,
+		read: reader(FloodStatusSchema.pick({ flooded: true }), (status) => [{
+			characteristic: import_dist.Characteristic.LeakDetected,
+			value: status.flooded ? import_dist.Characteristic.LeakDetected.LEAK_DETECTED : import_dist.Characteristic.LeakDetected.LEAK_NOT_DETECTED
+		}])
+	},
+	"temperature-sensor": {
+		label: "Temperature",
+		addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.TemperatureSensor, name, subtype),
+		getStatus: (proxy) => proxy.temperatureSensor?.getStatus({}),
+		subscribe: (proxy, onValue) => proxy.state.temperatureSensor?.subscribe(onValue) ?? null,
+		read: reader(TemperatureSensorStatusSchema.pick({ celsius: true }), (status) => [{
+			characteristic: import_dist.Characteristic.CurrentTemperature,
+			value: status.celsius
+		}])
+	},
+	"humidity-sensor": {
+		label: "Humidity",
+		addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.HumiditySensor, name, subtype),
+		getStatus: (proxy) => proxy.humiditySensor?.getStatus({}),
+		subscribe: (proxy, onValue) => proxy.state.humiditySensor?.subscribe(onValue) ?? null,
+		read: reader(HumiditySensorStatusSchema.pick({ percent: true }), (status) => [{
+			characteristic: import_dist.Characteristic.CurrentRelativeHumidity,
+			value: status.percent
+		}])
+	},
+	"ambient-light-sensor": {
+		label: "Light level",
+		addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.LightSensor, name, subtype),
+		getStatus: (proxy) => proxy.ambientLightSensor?.getStatus({}),
+		subscribe: (proxy, onValue) => proxy.state.ambientLightSensor?.subscribe(onValue) ?? null,
+		read: reader(AmbientLightSensorStatusSchema.pick({ lux: true }), (status) => [{
+			characteristic: import_dist.Characteristic.CurrentAmbientLightLevel,
+			value: Math.max(MIN_LUX, status.lux)
+		}])
+	}
+};
+/**
+* The `battery` row reads like a sensor but writes three characteristics from
+* one status, and the camera path publishes the SAME service from the same cap.
+* The derivation therefore lives once, in `battery.ts`, and both callers read
+* it from there.
+*/
+var BATTERY_SPEC = {
+	label: "Battery",
+	addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.Battery, name, subtype),
+	getStatus: (proxy) => proxy.battery?.getStatus({}),
+	subscribe: (proxy, onValue) => proxy.state.battery?.subscribe(onValue) ?? null,
+	read: batteryCharacteristicUpdates
+};
+function sensorRow(capName, spec) {
+	return {
+		caps: [capName],
+		label: spec.label,
+		build: ({ bctx, name }) => buildSensorService({
+			bctx,
+			spec,
+			name,
+			subtype: capName
+		})
+	};
+}
+/**
+* THE table. Order matters only for one thing: the first row that matches a
+* device decides the accessory's category when the device's own type does not.
+*/
+var HAP_CAP_SERVICES = [
+	{
+		caps: ["switch", "brightness"],
+		label: "Power",
+		build: ({ bctx, name, deviceType }) => buildChildSwitch({
+			...bctx,
+			displayName: name
+		}, "switch", deviceType)
+	},
+	{
+		caps: ["lock-control"],
+		label: "Lock",
+		build: ({ bctx, name }) => buildLockMechanism({
+			...bctx,
+			displayName: name
+		})
+	},
+	{
+		caps: ["alarm-panel"],
+		label: "Alarm",
+		build: ({ bctx, name }) => buildSecuritySystem({
+			...bctx,
+			displayName: name
+		})
+	},
+	{
+		caps: ["battery"],
+		label: BATTERY_SPEC.label,
+		build: ({ bctx, name }) => buildSensorService({
+			bctx,
+			spec: BATTERY_SPEC,
+			name,
+			subtype: "battery"
+		})
+	},
+	...Object.entries(SENSOR_SPECS).map(([capName, spec]) => sensorRow(capName, spec))
+];
+/**
+* The rows a device's bound capabilities select, in table order.
+*
+* A row matches when ANY of its caps is bound: a lamp with `switch` but no
+* `brightness` is still a Lightbulb-shaped row, and the builder degrades on its
+* own.
+*/
+function rowsForCaps(capNames) {
+	return HAP_CAP_SERVICES.filter((row) => row.caps.some((cap) => capNames.has(cap)));
+}
+/**
+* The HomeKit accessory category per camstack device type — the icon iOS Home
+* draws and nothing else. Absent = `OTHER`, which is a valid accessory that
+* simply gets the generic tile.
+*
+* This is NOT a coverage decision. `HAP_EXPORTABLE_DEVICE_TYPES` (in
+* `mappers/index.ts`) filters the picker; whether a device exports anything is
+* decided by `rowsForCaps`.
+*/
+var ACCESSORY_CATEGORY_BY_TYPE = {
+	[DeviceType.Switch]: import_dist.Categories.SWITCH,
+	[DeviceType.Light]: import_dist.Categories.LIGHTBULB,
+	[DeviceType.Siren]: import_dist.Categories.SWITCH,
+	[DeviceType.Lock]: import_dist.Categories.DOOR_LOCK,
+	[DeviceType.Sensor]: import_dist.Categories.SENSOR,
+	[DeviceType.Presence]: import_dist.Categories.SENSOR,
+	[DeviceType.AlarmPanel]: import_dist.Categories.SECURITY_SYSTEM
+};
+function accessoryCategoryFor(deviceType) {
+	return ACCESSORY_CATEGORY_BY_TYPE[deviceType] ?? import_dist.Categories.OTHER;
+}
+//#endregion
+//#region src/mappers/builders/stream-hwaccel-memo.ts
+/**
+* The two bounded memos HomeKit's decode path owns.
+*
+* ## Why they exist
+*
+* Everything D67 was actually about — one argv builder, one set of constants,
+* one hwaccel authority — HomeKit already had. What it did NOT have were the
+* two things the broker gained alongside them:
+*
+*  1. **A memo.** `probeDecoderHwaccel` issued a cross-process
+*     `decoder.getInfo` per SESSION. iOS starts sessions in bursts — one on
+*     record was started three times in 16 s — and every one of those paid a
+*     cap call on a hub whose main thread is the scarce resource.
+*  2. **Failure feedback.** When HomeKit's hardware child died at init and
+*     `shouldRetryInSoftware` saved the session, HomeKit told nobody. The next
+*     session re-picked the same corpse and paid the same two-second death.
+*     `EgressTranscodeManager` fixed exactly this for its own children
+*     (26a522cd5) by reporting the dead backend into the broker's 60 s memo.
+*
+* ## Both ride `HwAccelCache`, deliberately
+*
+* `createHwAccelCache` from `@camstack/types` is the primitive the broker's own
+* `egressHwAccelCache` is built from, and the discipline it encodes is the
+* point: **caller-owned, never a module global** — a module global would
+* outlive an addon respawn and survive an operator changing the decoder
+* backend. Same TTL as the broker's, so "has hardware come back yet" cannot
+* answer differently depending on which consumer asked.
+*
+* ## The cross-process gap, stated honestly
+*
+* These memos are scoped to the `export-hap` PROCESS. When HomeKit's vaapi
+* child dies, the broker's next child still pays its own two-second death, and
+* vice versa — because addons may never import each other and there is no
+* capability for "this backend is dead on this node right now". Closing that
+* would need a new cap surface, which Phase 0 explicitly does not take. What is
+* closed here is HomeKit's own repetition of the cost, across cameras and
+* across sessions.
+*/
+/**
+* The window both memos answer for.
+*
+* 60 s, the same as `stream-broker-manager`'s `egressHwAccelCache`. Long enough
+* that a burst of session restarts pays one read; short enough that an operator
+* who changes the decoder backend, or a host whose accelerator recovers, is
+* obeyed on the next session rather than after an addon respawn.
+*/
+var HAP_DECODE_MEMO_TTL_MS = 6e4;
+/**
+* Separator inside the encoded reading. A control character, because a backend
+* name is `[a-z0-9]+` and the decoder's non-backend choices are `auto` /
+* `none` / `''`, none of which can contain one — so the split is total.
+*/
+var READING_SEPARATOR = "
";
+/**
+* Marks a `null` FIELD, distinct from an EMPTY one.
+*
+* `probedBestHwaccel: ''` means the decoder answered and has never probed
+* (=> `not-probed`); `null` means the field was absent altogether. Encoding
+* both as `''` would lose a distinction `selectHwDecode` acts on.
+*/
+var NULL_FIELD = "\0";
+function encodeField(value) {
+	return value === null ? NULL_FIELD : value;
+}
+function decodeField(value) {
+	return value === NULL_FIELD ? null : value;
+}
+/**
+* A reading as ONE `string | null`, which is what {@link HwAccelCache} stores.
+*
+* The cache's three states are exactly the three a memoised reading needs:
+* `undefined` (never asked, or expired), `null` (asked, and the decoder could
+* not be reached), and a value. Encoding into the one cache rather than
+* splitting across two is what keeps those three from skewing — two caches
+* written together can still be READ across an expiry boundary.
+*/
+function encodeDecoderReading(reading) {
+	if (reading === null) return null;
+	return `${encodeField(reading.hwaccel)}${READING_SEPARATOR}${encodeField(reading.probedBestHwaccel)}`;
+}
+function decodeDecoderReading(value) {
+	if (value === null) return null;
+	const [hwaccel = NULL_FIELD, probed = NULL_FIELD] = value.split(READING_SEPARATOR);
+	return {
+		hwaccel: decodeField(hwaccel),
+		probedBestHwaccel: decodeField(probed)
+	};
+}
+function createDecoderReadingMemo(options) {
+	const cache = createHwAccelCache(options);
+	return {
+		read() {
+			const cached = cache.read();
+			return cached === void 0 ? void 0 : decodeDecoderReading(cached);
+		},
+		write(reading) {
+			cache.write(encodeDecoderReading(reading));
+		}
+	};
+}
+function createHapDecodeMemos(now) {
+	const options = {
+		ttlMs: HAP_DECODE_MEMO_TTL_MS,
+		...now ? { now } : {}
+	};
+	return {
+		reading: createDecoderReadingMemo(options),
+		failedBackend: createHwAccelCache(options)
+	};
+}
+//#endregion
+//#region src/mappers/builders/accessory-info.ts
+/**
+* `Service.AccessoryInformation` — the manufacturer / model / firmware /
+* serial block every HomeKit accessory carries.
+*
+* One implementation for both accessory shapes (camera and generic): the
+* fields come from the device's own metadata either way, and a second copy
+* would be a second answer to "what serial does this device publish".
+* Metadata is best-effort — a device that cannot answer still publishes.
+*/
+async function populateAccessoryInfo(accessory, proxy, displayName, modelFallback) {
+	const info = accessory.getService(import_dist.Service.AccessoryInformation);
+	if (!info) return;
+	try {
+		const device = await proxy.deviceManager?.getDevice({});
+		const metadata = readMetadata(device);
+		info.setCharacteristic(import_dist.Characteristic.Name, device?.name ?? displayName);
+		info.setCharacteristic(import_dist.Characteristic.Manufacturer, stringOr(metadata?.manufacturer, "CamStack"));
+		info.setCharacteristic(import_dist.Characteristic.Model, stringOr(metadata?.model, modelFallback));
+		info.setCharacteristic(import_dist.Characteristic.FirmwareRevision, stringOr(metadata?.firmware, "0.0.0"));
+		info.setCharacteristic(import_dist.Characteristic.SerialNumber, stringOr(metadata?.sn, `camstack-${proxy.deviceId}`));
+	} catch {}
+}
+/** The four fields this module reads, or `null` — the device record's
+*  `metadata` is an open bag and nothing else here depends on its shape. */
+function readMetadata(device) {
+	const metadata = device?.metadata;
+	if (metadata === null || typeof metadata !== "object") return {};
+	const entries = new Map(Object.entries(metadata));
+	return {
+		model: stringOrNull(entries.get("model")),
+		manufacturer: stringOrNull(entries.get("manufacturer")),
+		firmware: stringOrNull(entries.get("firmware")),
+		sn: stringOrNull(entries.get("sn"))
+	};
+}
+function stringOrNull(value) {
+	return typeof value === "string" ? value : null;
+}
+function stringOr(value, fallback) {
+	return typeof value === "string" && value.length > 0 ? value : fallback;
+}
+//#endregion
 //#region ../../node_modules/werift-rtp/lib/rtp/src/srtp/const.js
 var require_const = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
@@ -100101,7 +101922,7 @@ var VIDEO_LOOPBACK_RCVBUF_BYTES = 8 * 1024 * 1024;
 * not burst size.
 */
 var AUDIO_LOOPBACK_RCVBUF_BYTES = 1024 * 1024;
-function errMsg$13(err) {
+function errMsg$9(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 /**
@@ -100116,13 +101937,13 @@ function applyReceiveBuffer(socket, requestedBytes) {
 	try {
 		socket.setRecvBufferSize(requestedBytes);
 	} catch (err) {
-		error = errMsg$13(err);
+		error = errMsg$9(err);
 	}
 	let effectiveBytes = null;
 	try {
 		effectiveBytes = socket.getRecvBufferSize();
 	} catch (err) {
-		if (error === null) error = errMsg$13(err);
+		if (error === null) error = errMsg$9(err);
 	}
 	return {
 		requestedBytes,
@@ -100393,20 +102214,20 @@ function buildCameraStreamingDelegate(bctx, advertised) {
 		delegate: {
 			handleSnapshotRequest(request, callback) {
 				handleSnapshot(bctx, request).then((buf) => callback(void 0, buf)).catch((err) => {
-					log.warn("export-hap: snapshot failed", { meta: { error: errMsg$12(err) } });
-					callback(err instanceof Error ? err : new Error(errMsg$12(err)));
+					log.warn("export-hap: snapshot failed", { meta: { error: errMsg$8(err) } });
+					callback(err instanceof Error ? err : new Error(errMsg$8(err)));
 				});
 			},
 			prepareStream(request, callback) {
 				prepareStream(request, sessions, bctx, "classic").then((resp) => callback(void 0, resp)).catch((err) => {
-					log.warn("export-hap: prepareStream failed", { meta: { error: errMsg$12(err) } });
-					callback(err instanceof Error ? err : new Error(errMsg$12(err)));
+					log.warn("export-hap: prepareStream failed", { meta: { error: errMsg$8(err) } });
+					callback(err instanceof Error ? err : new Error(errMsg$8(err)));
 				});
 			},
 			handleStreamRequest(request, callback) {
 				handleStreamRequest(request, sessions, bctx, advertised).then(() => callback()).catch((err) => {
-					log.warn("export-hap: handleStreamRequest failed", { meta: { error: errMsg$12(err) } });
-					callback(err instanceof Error ? err : new Error(errMsg$12(err)));
+					log.warn("export-hap: handleStreamRequest failed", { meta: { error: errMsg$8(err) } });
+					callback(err instanceof Error ? err : new Error(errMsg$8(err)));
 				});
 			}
 		},
@@ -100545,7 +102366,7 @@ async function prepareStream(request, sessions, bctx, negotiatedVia) {
 		closeSocket(audioUdp);
 		closeSocket(videoLoopUdp);
 		closeSocket(audioLoopUdp);
-		throw new Error(`export-hap: outbound SrtpSession init failed: ${errMsg$12(err)}`, { cause: err });
+		throw new Error(`export-hap: outbound SrtpSession init failed: ${errMsg$8(err)}`, { cause: err });
 	}
 	let upstreamAudioSrtp = null;
 	try {
@@ -100559,7 +102380,7 @@ async function prepareStream(request, sessions, bctx, negotiatedVia) {
 			profile: import_src.ProtectionProfileAes128CmHmacSha1_80
 		});
 	} catch (err) {
-		bctx.ctx.logger.withTags({ deviceId: bctx.numericDeviceId }).warn("export-hap: SrtpSession init failed (upstream audio decrypt disabled)", { meta: { error: errMsg$12(err) } });
+		bctx.ctx.logger.withTags({ deviceId: bctx.numericDeviceId }).warn("export-hap: SrtpSession init failed (upstream audio decrypt disabled)", { meta: { error: errMsg$8(err) } });
 	}
 	const videoSsrc = randomSsrc();
 	const audioSsrc = randomSsrc();
@@ -100679,7 +102500,7 @@ async function prepareStream(request, sessions, bctx, negotiatedVia) {
 	});
 	audioUdp.on("message", (packet, rinfo) => {
 		handleIncomingAudioRtp(session, packet, rinfo.address, bctx).catch((err) => {
-			bctx.ctx.logger.withTags({ deviceId: bctx.numericDeviceId }).debug("export-hap: incoming-audio handler error (dropped)", { meta: { error: errMsg$12(err) } });
+			bctx.ctx.logger.withTags({ deviceId: bctx.numericDeviceId }).debug("export-hap: incoming-audio handler error (dropped)", { meta: { error: errMsg$8(err) } });
 		});
 	});
 	logLoopbackBuffer(tagLog, request.sessionID, "video", videoLoop.buffer);
@@ -100875,7 +102696,7 @@ function readControllerRtcp(session, leg, packet, log) {
 	} catch (err) {
 		drop(session, "inbound-rtcp-decrypt-failed");
 		storeReceiverReports(session, leg, recordUnreadableRtcp(tally));
-		logUnreadableRtcp(session, leg, `decrypt: ${errMsg$12(err)}`, log);
+		logUnreadableRtcp(session, leg, `decrypt: ${errMsg$8(err)}`, log);
 		return;
 	}
 	const outcome = ingestDecryptedRtcp(plaintext, tally);
@@ -101693,7 +103514,7 @@ async function handleIncomingAudioRtp(session, packet, sourceAddress, bctx) {
 		session.upstreamRtpDecryptFailures += 1;
 		if (session.upstreamRtpDecryptFailures % 100 === 1) log.debug("export-hap: SRTP decrypt failed (rate-limited)", { meta: {
 			failures: session.upstreamRtpDecryptFailures,
-			error: errMsg$12(err)
+			error: errMsg$8(err)
 		} });
 		return;
 	}
@@ -101707,7 +103528,7 @@ async function handleIncomingAudioRtp(session, packet, sourceAddress, bctx) {
 		rtpPayloadType = parsedRtp.header.payloadType;
 	} catch (err) {
 		drop(session, "upstream-parse-failed");
-		log.debug("export-hap: RTP parse failed after decrypt", { meta: { error: errMsg$12(err) } });
+		log.debug("export-hap: RTP parse failed after decrypt", { meta: { error: errMsg$8(err) } });
 		return;
 	}
 	const negotiatedAudioPt = session.lastStartParams?.audioPt;
@@ -101731,7 +103552,7 @@ async function handleIncomingAudioRtp(session, packet, sourceAddress, bctx) {
 	if (session.intercomTalkSessionId === null) {
 		session.intercomTalkSessionId = "";
 		const opened = await openIntercomTalkSession(bctx).catch((err) => {
-			log.warn("export-hap: intercom.startTalkSession failed", { meta: { error: errMsg$12(err) } });
+			log.warn("export-hap: intercom.startTalkSession failed", { meta: { error: errMsg$8(err) } });
 			return null;
 		});
 		if (opened) {
@@ -101758,7 +103579,7 @@ async function handleIncomingAudioRtp(session, packet, sourceAddress, bctx) {
 		drop(session, "upstream-push-failed");
 		log.debug("export-hap: intercom.pushTalkAudio failed (will re-open on next frame)", { meta: {
 			sequenceNumber: session.intercomPcmSequence,
-			error: errMsg$12(err)
+			error: errMsg$8(err)
 		} });
 		session.intercomTalkSessionId = null;
 	}
@@ -101790,7 +103611,7 @@ async function closeIntercomTalkSession(session, bctx) {
 	} catch (err) {
 		log.debug("export-hap: intercom.endTalkSession failed (continuing)", { meta: {
 			sessionId,
-			error: errMsg$12(err)
+			error: errMsg$8(err)
 		} });
 	}
 }
@@ -101815,7 +103636,7 @@ function closeSocket(udp) {
 function randomSsrc() {
 	return Math.floor(Math.random() * 2147483646) + 1 | 0;
 }
-function errMsg$12(err) {
+function errMsg$8(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -101899,14 +103720,14 @@ async function buildDoorbell(input) {
 			}
 			log.info("export-hap: doorbell SINGLE_PRESS pushed to HomeKit", { meta: { ...delivery } });
 		} catch (err) {
-			log.warn("export-hap: ringDoorbell() failed", { meta: { error: errMsg$11(err) } });
+			log.warn("export-hap: ringDoorbell() failed", { meta: { error: errMsg$7(err) } });
 		}
 	});
 	return { async dispose() {
 		unsubscribe();
 	} };
 }
-function errMsg$11(err) {
+function errMsg$7(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -101954,7 +103775,7 @@ async function buildMotionSensor(bctx, existing = null) {
 		const detected = await proxy.motion?.isDetected({});
 		if (typeof detected === "boolean") motionService.updateCharacteristic(import_dist.Characteristic.MotionDetected, detected);
 	} catch (err) {
-		ctx.logger.withTags({ deviceId: numericDeviceId }).debug("export-hap: initial motion hydrate failed (non-fatal)", { meta: { error: errMsg$10(err) } });
+		ctx.logger.withTags({ deviceId: numericDeviceId }).debug("export-hap: initial motion hydrate failed (non-fatal)", { meta: { error: errMsg$6(err) } });
 	}
 	let resetTimer = null;
 	const armReset = () => {
@@ -101988,7 +103809,7 @@ async function buildMotionSensor(bctx, existing = null) {
 		}
 	} };
 }
-function errMsg$10(err) {
+function errMsg$6(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -102019,7 +103840,7 @@ async function buildPrivacySwitch(bctx) {
 		const status = await proxy.privacyMask?.getStatus({});
 		if (status && typeof status.enabled === "boolean") service.updateCharacteristic(import_dist.Characteristic.On, status.enabled);
 	} catch (err) {
-		log.debug("export-hap: privacy-mask getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$9(err) } });
+		log.debug("export-hap: privacy-mask getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$5(err) } });
 	}
 	service.getCharacteristic(import_dist.Characteristic.On).onSet(async (value) => {
 		const enabled = value === true;
@@ -102028,7 +103849,7 @@ async function buildPrivacySwitch(bctx) {
 		} catch (err) {
 			log.warn("export-hap: privacy-mask setMask failed", { meta: {
 				enabled,
-				error: errMsg$9(err)
+				error: errMsg$5(err)
 			} });
 		}
 	});
@@ -102046,7 +103867,7 @@ async function buildPrivacySwitch(bctx) {
 		} catch {}
 	} };
 }
-function errMsg$9(err) {
+function errMsg$5(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -102137,7 +103958,7 @@ async function buildPtz(bctx) {
 			} catch (err) {
 				log.warn("export-hap: ptz.goToPreset failed", { meta: {
 					presetId: preset.id,
-					error: errMsg$8(err)
+					error: errMsg$4(err)
 				} });
 			}
 			armReset(() => service.updateCharacteristic(import_dist.Characteristic.On, false), MOMENTARY_RESET_MS);
@@ -102155,14 +103976,14 @@ async function buildPtz(bctx) {
 					try {
 						await proxy.ptz?.stop({});
 					} catch (err) {
-						log.debug("export-hap: ptz.stop failed (non-fatal)", { meta: { error: errMsg$8(err) } });
+						log.debug("export-hap: ptz.stop failed (non-fatal)", { meta: { error: errMsg$4(err) } });
 					}
 					service.updateCharacteristic(import_dist.Characteristic.On, false);
 				}, options.ptzPulseMs);
 			} catch (err) {
 				log.warn("export-hap: ptz.continuousMove failed", { meta: {
 					dir: dir.label,
-					error: errMsg$8(err)
+					error: errMsg$4(err)
 				} });
 				service.updateCharacteristic(import_dist.Characteristic.On, false);
 			}
@@ -102194,7 +104015,7 @@ async function readPresets(bctx) {
 		}
 		return entries;
 	} catch (err) {
-		ctx.logger.withTags({ deviceId: numericDeviceId }).debug("export-hap: ptz.getPresets failed (non-fatal)", { meta: { error: errMsg$8(err) } });
+		ctx.logger.withTags({ deviceId: numericDeviceId }).debug("export-hap: ptz.getPresets failed (non-fatal)", { meta: { error: errMsg$4(err) } });
 		return [];
 	}
 }
@@ -102209,7 +104030,7 @@ async function tryBuildAutotrack(bctx) {
 		const status = await proxy.ptzAutotrack.getStatus({});
 		if (status && typeof status.enabled === "boolean") service.updateCharacteristic(import_dist.Characteristic.On, status.enabled);
 	} catch (err) {
-		log.debug("export-hap: ptzAutotrack.getStatus failed (non-fatal)", { meta: { error: errMsg$8(err) } });
+		log.debug("export-hap: ptzAutotrack.getStatus failed (non-fatal)", { meta: { error: errMsg$4(err) } });
 	}
 	service.getCharacteristic(import_dist.Characteristic.On).onSet(async (value) => {
 		const enabled = value === true;
@@ -102218,16 +104039,218 @@ async function tryBuildAutotrack(bctx) {
 		} catch (err) {
 			log.warn("export-hap: ptzAutotrack.setEnabled failed", { meta: {
 				enabled,
-				error: errMsg$8(err)
+				error: errMsg$4(err)
 			} });
 		}
 	});
 	return { async dispose() {} };
 }
-function errMsg$8(err) {
+function errMsg$4(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
+//#region src/hksv/clip-writer.ts
+var HksvClipWriter = class {
+	input;
+	log;
+	started = false;
+	settle = null;
+	outcome;
+	bytes = 0;
+	fragments = 0;
+	sawInit = false;
+	truncated = null;
+	startedAtMs;
+	constructor(input) {
+		this.input = input;
+		this.log = input.logger;
+		this.startedAtMs = input.now();
+		this.outcome = new Promise((resolve) => {
+			this.settle = resolve;
+		});
+	}
+	/** Resolves once the file is closed. NEVER rejects — every failure is named. */
+	get done() {
+		return this.outcome;
+	}
+	/** Launch the loop. Returns immediately: the delegate awaits nothing here. */
+	start() {
+		if (this.started) return;
+		this.started = true;
+		this.run();
+	}
+	/**
+	* The HDS stream ended. Releases the subscription, which drains whatever is
+	* already queued and then completes the loop. Idempotent, synchronous, and
+	* safe to call from the delegate's `finally`.
+	*/
+	finish() {
+		this.input.subscription.release();
+	}
+	async run() {
+		const { subscription, sink } = this.input;
+		const tags = { deviceId: this.input.deviceId };
+		try {
+			for await (const packet of subscription.packets()) {
+				if (packet.data.length === 0) continue;
+				if (this.bytes + packet.data.length > this.input.maxBytes) {
+					this.truncated = "size-cap";
+					this.log.warn("hksv clip tee: the per-clip size ceiling was reached — TRUNCATING", {
+						tags,
+						meta: {
+							streamId: this.input.streamId,
+							bytes: this.bytes,
+							maxBytes: this.input.maxBytes,
+							fragments: this.fragments
+						}
+					});
+					break;
+				}
+				await sink.write(packet.data);
+				this.bytes += packet.data.length;
+				if (packet.kind === "init") this.sawInit = true;
+				else this.fragments += 1;
+			}
+			if (this.truncated === null && subscription.closedReason === "slow-consumer") {
+				this.truncated = "slow-consumer";
+				this.log.warn("hksv clip tee: the plane closed the tee for falling behind — the clip is TRUNCATED (HomeKit recording unaffected)", {
+					tags,
+					meta: {
+						streamId: this.input.streamId,
+						bytes: this.bytes,
+						fragments: this.fragments
+					}
+				});
+			}
+		} catch (err) {
+			this.truncated = "write-failed";
+			this.log.warn("hksv clip tee: writing the clip FAILED — the HomeKit recording is unaffected", {
+				tags,
+				meta: {
+					streamId: this.input.streamId,
+					bytes: this.bytes,
+					fragments: this.fragments,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		} finally {
+			subscription.release();
+			try {
+				await sink.close();
+			} catch (err) {
+				if (this.truncated === null) this.truncated = "write-failed";
+				this.log.warn("hksv clip tee: closing the clip file failed", {
+					tags,
+					meta: {
+						streamId: this.input.streamId,
+						error: err instanceof Error ? err.message : String(err)
+					}
+				});
+			}
+			this.resolve();
+		}
+	}
+	resolve() {
+		const settle = this.settle;
+		this.settle = null;
+		settle?.({
+			bytes: this.bytes,
+			fragments: this.fragments,
+			sawInit: this.sawInit,
+			truncated: this.truncated,
+			startedAtMs: this.startedAtMs,
+			endedAtMs: this.input.now()
+		});
+	}
+};
+//#endregion
+//#region src/hksv/clip-tee.ts
+function createClipTeeFactory(input) {
+	return (request) => new ClipTeeRunner(input, request);
+}
+var ClipTeeRunner = class {
+	input;
+	request;
+	writer = null;
+	/** `finish()` arriving before the file is open — the short stream case. */
+	finishPending = false;
+	acknowledgePending = false;
+	clipId = null;
+	completed;
+	constructor(input, request) {
+		this.input = input;
+		this.request = request;
+		this.completed = this.run();
+	}
+	finish() {
+		this.finishPending = true;
+		this.writer?.finish();
+	}
+	acknowledge() {
+		this.acknowledgePending = true;
+		this.completed.then(() => this.persistAcknowledgement());
+	}
+	async run() {
+		const { store, deviceId } = this.input;
+		const now = this.input.now ?? Date.now;
+		const tags = { deviceId };
+		const open = await store.open({
+			deviceId,
+			streamId: this.request.streamId,
+			startedAtMs: now(),
+			prebufferSpanMs: this.request.prebufferSpanMs,
+			width: this.input.width,
+			height: this.input.height,
+			fragmentMs: this.input.fragmentMs
+		});
+		if (open === null) {
+			this.request.subscription.release();
+			return;
+		}
+		this.clipId = open.clipId;
+		const writer = new HksvClipWriter({
+			logger: this.input.logger,
+			deviceId,
+			streamId: this.request.streamId,
+			subscription: this.request.subscription,
+			sink: open.sink,
+			maxBytes: store.maxClipBytes,
+			now
+		});
+		this.writer = writer;
+		writer.start();
+		if (this.finishPending) writer.finish();
+		const outcome = await writer.done;
+		try {
+			await open.complete(outcome);
+		} catch (err) {
+			this.input.logger.warn("hksv clip tee: the clip could not be completed", {
+				tags,
+				meta: {
+					streamId: this.request.streamId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
+	}
+	async persistAcknowledgement() {
+		const clipId = this.clipId;
+		if (clipId === null || !this.acknowledgePending) return;
+		this.acknowledgePending = false;
+		try {
+			await this.input.store.acknowledge(this.input.deviceId, clipId);
+		} catch (err) {
+			this.input.logger.warn("hksv clip tee: recording the acknowledgement failed", {
+				tags: { deviceId: this.input.deviceId },
+				meta: {
+					clipId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
+	}
+};
+//#endregion
 //#region src/hksv/controller-census.ts
 var EMPTY_CENSUS = {
 	serverPublished: false,
@@ -102549,8 +104572,13 @@ var HksvFragmentSource = class {
 	* Returns `null` when there is no plane — the caller MUST treat that as
 	* "cannot serve this recording" rather than opening an HDS stream it cannot
 	* feed, which is the D50 failure exactly.
+	*
+	* Called ONCE PER CONSUMER, never shared: the delegate takes one for HomeKit
+	* and the clip tee takes a second. `queueCapacity` is how much slack this
+	* subscriber gets before the plane closes it (D80 closes, never gaps) — the
+	* tee asks for less than HomeKit's stream on purpose.
 	*/
-	subscribe(tag) {
+	subscribe(tag, queueCapacity) {
 		const plane = this.plane;
 		if (plane === null || plane.isEnded) return null;
 		const stats = plane.prebufferStats();
@@ -102565,7 +104593,8 @@ var HksvFragmentSource = class {
 		});
 		return plane.subscribe({
 			tag,
-			withPrebuffer: true
+			withPrebuffer: true,
+			...queueCapacity === void 0 ? {} : { queueCapacity }
 		});
 	}
 	/** What the ring holds — surfaced so the delegate can log what it served. */
@@ -102689,6 +104718,12 @@ var HksvFragmentSource = class {
 //#endregion
 //#region src/hksv/recording-delegate.ts
 /**
+* How many finished clips may wait for an acknowledgement iOS may never send.
+* Eight is more concurrent HKSV streams than one camera ever has; the number
+* exists so the map cannot grow, not to be tuned.
+*/
+var MAX_TEES_AWAITING_ACK = 8;
+/**
 * `HDSProtocolSpecificErrorReason` is a `const enum`, so there is no reverse
 * map to index — and a bare number in the log is the difference between "iOS
 * closed it normally" and "iOS rejected our data", which is the whole reason
@@ -102717,6 +104752,12 @@ var HksvRecordingDelegate = class {
 	log;
 	/** The stream currently being yielded, so `closeRecordingStream` can end it. */
 	open = null;
+	/**
+	* Tees whose stream has ended, still waiting for iOS's `ack`. BOUNDED: the
+	* ack may never come (a dropped connection looks identical), and a map that
+	* only ever grows is the unbounded buffer D9/D18 names in its smallest form.
+	*/
+	tees = /* @__PURE__ */ new Map();
 	constructor(input) {
 		this.input = input;
 		this.log = input.logger;
@@ -102797,6 +104838,7 @@ var HksvRecordingDelegate = class {
 		};
 		const startedAt = this.input.now();
 		const prebufferSpanMs = source.prebufferSpanMs();
+		const tee = this.openTee(streamId, source, prebufferSpanMs);
 		let packets = 0;
 		let bytes = 0;
 		let markedLast = false;
@@ -102848,6 +104890,7 @@ var HksvRecordingDelegate = class {
 			}
 		} finally {
 			subscription.release();
+			this.finishTee(streamId, tee);
 			if (this.open?.streamId === streamId) this.open = null;
 			const fragmentOverrun = longestFragmentGapMs > this.input.advertisedFragmentMs * 1.5;
 			this.log.info("hksv: recording stream finished", {
@@ -102878,6 +104921,20 @@ var HksvRecordingDelegate = class {
 			tags: { deviceId: this.input.deviceId },
 			meta: { streamId }
 		});
+		const tee = this.tees.get(streamId);
+		this.tees.delete(streamId);
+		if (tee === void 0) return;
+		try {
+			tee.acknowledge();
+		} catch (err) {
+			this.log.warn("hksv clip tee: recording the acknowledgement failed", {
+				tags: { deviceId: this.input.deviceId },
+				meta: {
+					streamId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
 	}
 	closeRecordingStream(streamId, reason) {
 		this.log.info("hksv: the recording stream was closed by the controller", {
@@ -102897,11 +104954,82 @@ var HksvRecordingDelegate = class {
 	async dispose() {
 		this.open?.subscription.release();
 		this.open = null;
+		this.tees.clear();
 		const source = this.source;
 		this.source = null;
 		if (source) await source.stop("accessory disposed");
 	}
 	/**
+	* A second subscription on the same plane, handed to the tee.
+	*
+	* Every failure here returns `null`: no tee, a warn naming the camera, and a
+	* HomeKit recording that proceeds exactly as it would have. The one thing
+	* this must never do is let a clip problem reach the generator above.
+	*/
+	openTee(streamId, source, prebufferSpanMs) {
+		const factory = this.input.openClipTee;
+		if (factory === void 0) return null;
+		let subscription = null;
+		try {
+			subscription = source.subscribe(`clip/${this.input.deviceId}#${streamId}`, 2);
+			if (subscription === null) {
+				this.log.warn("hksv clip tee: the plane refused a second subscription — this clip is NOT kept", {
+					tags: { deviceId: this.input.deviceId },
+					meta: { streamId }
+				});
+				return null;
+			}
+			const tee = factory({
+				streamId,
+				subscription,
+				prebufferSpanMs
+			});
+			if (tee === null) {
+				subscription.release();
+				return null;
+			}
+			this.rememberTee(streamId, tee);
+			return tee;
+		} catch (err) {
+			subscription?.release();
+			this.log.warn("hksv clip tee: could NOT be opened — the HomeKit recording continues untouched", {
+				tags: { deviceId: this.input.deviceId },
+				meta: {
+					streamId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+			return null;
+		}
+	}
+	finishTee(streamId, tee) {
+		if (tee === null) return;
+		try {
+			tee.finish();
+		} catch (err) {
+			this.log.warn("hksv clip tee: closing the clip failed", {
+				tags: { deviceId: this.input.deviceId },
+				meta: {
+					streamId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
+	}
+	/**
+	* Hold the tee until iOS acknowledges, dropping the oldest once the map is
+	* full. An ack that never arrives is the normal case for a dropped
+	* connection, so this map's size is the only thing bounding it.
+	*/
+	rememberTee(streamId, tee) {
+		this.tees.set(streamId, tee);
+		while (this.tees.size > MAX_TEES_AWAITING_ACK) {
+			const oldest = this.tees.keys().next();
+			if (oldest.done === true) break;
+			this.tees.delete(oldest.value);
+		}
+	}
+	/**
 	* Start the prebuffer when iOS wants recording AND has chosen how, stop it
 	* otherwise. Called from every state edge rather than each edge deciding for
 	* itself: the two characteristics arrive in an order hap-nodejs explicitly
@@ -103071,10 +105199,20 @@ async function buildHksvRecording(input) {
 		fps,
 		fragmentLengthMs
 	});
+	const clipStore = bctx.options.hksvClipStore;
+	const openClipTee = clipStore === null ? void 0 : createClipTeeFactory({
+		logger: log,
+		deviceId: numericDeviceId,
+		store: clipStore,
+		width: source.width,
+		height: source.height,
+		fragmentMs: fragmentLengthMs
+	});
 	const delegate = new HksvRecordingDelegate({
 		logger: log,
 		deviceId: numericDeviceId,
 		isAudioActive: input.isAudioActive,
+		...openClipTee === void 0 ? {} : { openClipTee },
 		advertisedFragmentMs: fragmentLengthMs,
 		now: () => Date.now(),
 		describeControllers: () => describeHapControllers(bctx.accessory),
@@ -103096,7 +105234,8 @@ async function buildHksvRecording(input) {
 		measuredFps: fps,
 		advertisedFps: advertisedResolution?.[2] ?? null,
 		fragmentLengthMs,
-		sourceGopMs: gopMs ?? "unknown"
+		sourceGopMs: gopMs ?? "unknown",
+		clipsKept: openClipTee !== void 0
 	} });
 	return {
 		options,
@@ -103121,133 +105260,30 @@ async function readProfileEntries(bctx) {
 * on 615 `ext` is the 1280×720 slot the broker calls `mid` — a name-based match
 * would silently read the 4K slot's GOP for a 720p recording.
 *
-* `undefined` when the cap is not bound, which is most non-Hikvision providers.
-*/
-async function readSourceGopMs(bctx, width, height) {
-	try {
-		const status = await bctx.proxy.streamParams?.getStatus({});
-		if (!status) return void 0;
-		for (const profile of [
-			status.main,
-			status.sub,
-			status.ext
-		]) {
-			if (!profile) continue;
-			if (profile.width !== width || profile.height !== height) continue;
-			const { gop, framerate } = profile;
-			if (gop === void 0 || gop <= 0 || framerate <= 0) return void 0;
-			return Math.round(gop / framerate * 1e3);
-		}
-		return;
-	} catch {
-		return;
-	}
-}
-function resolveFps(fpsByProfile, profile) {
-	return fpsByProfile.get(profile)?.fps ?? ASSUMED_RECORDING_FPS;
-}
-//#endregion
-//#region src/mappers/builders/child-switch.ts
-/**
-* Child-switch builder — turns a camstack accessory child device (siren,
-* floodlight, spotlight, …) into a HomeKit Service ON THE PARENT
-* camera Accessory.
-*
-* The orchestrator (`child-accessory.ts → buildChildServicesFor`)
-* hands this builder the PARENT accessory + the CHILD's proxy + a
-* unique subtype so each service round-trips deterministically through
-* HAP serialisation. The builder:
-*  - Maps `switch` cap → `Service.Switch`.
-*  - Maps `switch` + `brightness` cap → `Service.Lightbulb` with
-*    Brightness characteristic (lighting devices only — see below).
-*  - Hydrates initial state from `getStatus({})`.
-*  - Wires `Characteristic.On` / `Characteristic.Brightness` through
-*    the typed DeviceProxy.
-*  - Subscribes to runtime-state slice updates so iOS Home reflects
-*    external state changes (e.g. another integration toggling the
-*    light).
-*
-* Service-kind selection: most cameras expose `brightness` on a siren
-* because it controls the alarm VOLUME, not luminosity. Mapping a
-* siren onto `Service.Lightbulb` makes it appear as a regular light in
-* iOS Home (wrong icon, wrong scenes, wrong Siri intents). We therefore
-* gate `Service.Lightbulb` on the child's `DeviceType` — only Light /
-* Generic devices keep the Lightbulb shape; Siren, Switch, and others
-* fall back to `Service.Switch`. Volume control for sirens is exposed
-* through the camstack admin UI; iOS Home only needs the on/off toggle.
-*
-* Child devices without `switch` / `brightness` cap (status sensors,
-* IR LED, etc.) return a no-op handle.
+* `undefined` when the cap is not bound, which is most non-Hikvision providers.
 */
-async function buildChildSwitch(bctx, subtype, deviceType) {
-	const { ctx, accessory, proxy, numericDeviceId, displayName } = bctx;
-	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
-	const hasSwitch = !!proxy.switch;
-	const hasBrightness = !!proxy.brightness;
-	if (!hasSwitch && !hasBrightness) {
-		log.debug("export-hap: child has no switch/brightness cap — skipping");
-		return { async dispose() {} };
-	}
-	const isLightingDevice = deviceType === DeviceType.Light || deviceType === DeviceType.Generic;
-	const useLightbulb = hasBrightness && isLightingDevice;
-	const service = useLightbulb ? accessory.addService(import_dist.Service.Lightbulb, displayName, subtype) : accessory.addService(import_dist.Service.Switch, displayName, subtype);
-	applyServiceLabel(service, displayName);
+async function readSourceGopMs(bctx, width, height) {
 	try {
-		const switchStatus = await proxy.switch?.getStatus({});
-		if (switchStatus && typeof switchStatus.on === "boolean") service.updateCharacteristic(import_dist.Characteristic.On, switchStatus.on);
-	} catch (err) {
-		log.debug("export-hap: child switch.getStatus failed (non-fatal)", { meta: { error: errMsg$7(err) } });
-	}
-	if (useLightbulb) try {
-		const status = await proxy.brightness?.getStatus({});
-		if (status && typeof status.percentage === "number") service.updateCharacteristic(import_dist.Characteristic.Brightness, status.percentage);
-	} catch (err) {
-		log.debug("export-hap: child brightness.getStatus failed (non-fatal)", { meta: { error: errMsg$7(err) } });
-	}
-	if (hasSwitch) service.getCharacteristic(import_dist.Characteristic.On).onSet(async (value) => {
-		const on = value === true;
-		try {
-			await proxy.switch?.setState({ on });
-		} catch (err) {
-			log.warn("export-hap: child switch.setState failed", { meta: {
-				on,
-				error: errMsg$7(err)
-			} });
-		}
-	});
-	if (useLightbulb) service.getCharacteristic(import_dist.Characteristic.Brightness).onSet(async (value) => {
-		const percentage = typeof value === "number" ? value : Number(value);
-		if (!Number.isFinite(percentage)) return;
-		try {
-			await proxy.brightness?.setBrightness({ percentage });
-		} catch (err) {
-			log.warn("export-hap: child brightness.setBrightness failed", { meta: {
-				percentage,
-				error: errMsg$7(err)
-			} });
+		const status = await bctx.proxy.streamParams?.getStatus({});
+		if (!status) return void 0;
+		for (const profile of [
+			status.main,
+			status.sub,
+			status.ext
+		]) {
+			if (!profile) continue;
+			if (profile.width !== width || profile.height !== height) continue;
+			const { gop, framerate } = profile;
+			if (gop === void 0 || gop <= 0 || framerate <= 0) return void 0;
+			return Math.round(gop / framerate * 1e3);
 		}
-	});
-	const unsubscribes = [];
-	if (proxy.state.switch) {
-		const unsubSwitch = proxy.state.switch.subscribe((value) => {
-			if (value && typeof value.on === "boolean") service.updateCharacteristic(import_dist.Characteristic.On, value.on);
-		});
-		unsubscribes.push(unsubSwitch);
-	}
-	if (useLightbulb && proxy.state.brightness) {
-		const unsubBrightness = proxy.state.brightness.subscribe((value) => {
-			if (value && typeof value.percentage === "number") service.updateCharacteristic(import_dist.Characteristic.Brightness, value.percentage);
-		});
-		unsubscribes.push(unsubBrightness);
+		return;
+	} catch {
+		return;
 	}
-	return { async dispose() {
-		for (const u of unsubscribes) try {
-			u();
-		} catch {}
-	} };
 }
-function errMsg$7(err) {
-	return err instanceof Error ? err.message : String(err);
+function resolveFps(fpsByProfile, profile) {
+	return fpsByProfile.get(profile)?.fps ?? ASSUMED_RECORDING_FPS;
 }
 //#endregion
 //#region src/mappers/child-accessory.ts
@@ -103273,7 +105309,7 @@ async function buildChildServicesFor(input) {
 		for (const h of handles) try {
 			await h.dispose();
 		} catch (err) {
-			ctx.logger.withTags({ deviceId: parentNumericId }).debug("export-hap: child service dispose failed (continuing)", { meta: { error: errMsg$6(err) } });
+			ctx.logger.withTags({ deviceId: parentNumericId }).debug("export-hap: child service dispose failed (continuing)", { meta: { error: errMsg$3(err) } });
 		}
 	} };
 }
@@ -103289,7 +105325,7 @@ async function listChildren(ctx, parentNumericId) {
 			features: Array.isArray(c.features) ? c.features.filter((f) => typeof f === "string") : []
 		}));
 	} catch (err) {
-		ctx.logger.withTags({ deviceId: parentNumericId }).debug("export-hap: deviceManager.getChildren failed (non-fatal)", { meta: { error: errMsg$6(err) } });
+		ctx.logger.withTags({ deviceId: parentNumericId }).debug("export-hap: deviceManager.getChildren failed (non-fatal)", { meta: { error: errMsg$3(err) } });
 		return [];
 	}
 }
@@ -103305,7 +105341,7 @@ function asDeviceType(raw) {
 	for (const value of Object.values(DeviceType)) if (value === lower) return value;
 	return DeviceType.Generic;
 }
-function errMsg$6(err) {
+function errMsg$3(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -103902,1035 +105938,389 @@ function buildMultiTierServices(input) {
 			logger.info("hap multi-tier: refused a setup-endpoints write", {
 				tags: { deviceId },
 				meta: { reason: input.negotiation === void 0 ? "no-negotiator" : "not-a-string" }
-			});
-			return;
-		}
-		await input.negotiation.handleSetupEndpointsWrite(value);
-	});
-	streamManagement.addCharacteristic(setupEndpoints);
-	const streamingControl = new import_dist.Characteristic("RTP Streaming Control", CHAR_RTP_STREAMING_CONTROL, {
-		format: import_dist.Formats.TLV8,
-		perms: [import_dist.Perms.PAIRED_READ, import_dist.Perms.PAIRED_WRITE]
-	});
-	streamingControl.onGet(() => {
-		note("rtp-streaming-control");
-		return input.negotiation?.readStreamingControl() ?? encodeRtpStreamingControlStatus(null, RtpStreamingStatus.ERROR);
-	});
-	streamingControl.onSet(async (value) => {
-		if (input.negotiation === void 0 || typeof value !== "string") {
-			logger.info("hap multi-tier: refused an rtp streaming control write", {
-				tags: { deviceId },
-				meta: { reason: input.negotiation === void 0 ? "no-negotiator" : "not-a-string" }
-			});
-			return;
-		}
-		await input.negotiation.handleStreamingControlWrite(value);
-	});
-	streamManagement.addCharacteristic(streamingControl);
-	const sensor = new import_dist.Characteristic("Sensor UUID", CHAR_SENSOR_UUID, {
-		format: import_dist.Formats.DATA,
-		perms: [import_dist.Perms.PAIRED_READ]
-	});
-	const sensorValue = sensorUuid.toString("base64");
-	sensor.onGet(() => {
-		note("sensor-uuid");
-		return sensorValue;
-	});
-	streamManagement.addCharacteristic(sensor);
-	return {
-		capabilities,
-		globalOperatingMode,
-		streamManagement
-	};
-}
-//#endregion
-//#region src/multi-tier/negotiation.ts
-/**
-* The adapter between Apple's new characteristics and the streaming engine this
-* addon already has.
-*
-* ## Why an adapter and not a second engine
-*
-* The multi-tier RTP service owns its OWN `Setup Endpoints` and `RTP Streaming
-* Control`, so hap-nodejs's `CameraController` never negotiates for it — and
-* the library's own handlers are all `private`, so its engine cannot be
-* borrowed either. But the sockets, the SRTP contexts, the ffmpeg pipeline and
-* the teardown are the same ones the classic service uses. A second copy would
-* be two engines to keep in agreement, and this repo has paid for that shape
-* before. So: new characteristics, one engine, through `StreamNegotiator`.
-*
-* ## What is different about the new flow
-*
-* The classic `Selected RTP Stream Configuration` carries the whole selected
-* configuration in its start — codec, profile, level, resolution, bitrate.
-* `RTP Streaming Control` carries a **tier identifier**, because the
-* configuration was agreed when we published `Supported Video Stream Tiers`.
-* So this maps an identifier back to the tier WE published, and a tier we never
-* published is `No Such Stream` — improvising a geometry there would serve a
-* stream the controller did not ask for and it would look like it worked.
-*
-* ## Every path answers
-*
-* A read of either characteristic always produces a valid TLV8. The Home app
-* reads a camera's characteristics in one batch, and one member that answers
-* nothing took the kitchen camera's whole read down and left it on "loading".
-* So an engine failure, a malformed write and "nothing has happened yet" are
-* all statuses, never silence.
-*/
-/** RTP payload types. 96 is the first dynamic one (RFC 3551); 110 is what our
-*  own Opus offers use. Both are echoed in the tier declaration. */
-var VIDEO_PAYLOAD_TYPE = 96;
-var AUDIO_PAYLOAD_TYPE = 110;
-/** RTCP interval in SECONDS, which is the unit the engine reads. */
-var RTCP_INTERVAL_SECONDS = 5;
-/** The MTU the classic path uses for an Ethernet-sized path. */
-var DEFAULT_MTU = 1378;
-function errorMessage(error) {
-	return error instanceof Error ? error.message : String(error);
-}
-function buildMultiTierNegotiation(input) {
-	const { deviceId, logger, negotiator } = input;
-	const log = logger.withTags({ deviceId });
-	let setupResponse = encodeSetupEndpointsRefusal(SetupEndpointsStatus.ERROR);
-	let controlResponse = encodeRtpStreamingControlStatus(null, RtpStreamingStatus.ERROR);
-	/** Sessions we have STARTED, so an End can tell "not started" from "unknown". */
-	const started = /* @__PURE__ */ new Set();
-	async function handleSetupEndpointsWrite(base64) {
-		let sessionId = null;
-		try {
-			const request = decodeSetupEndpointsRequest(base64);
-			sessionId = request.sessionId;
-			const prepareRequest = {
-				sessionID: request.sessionId,
-				sourceAddress: request.controllerAddress,
-				targetAddress: request.controllerAddress,
-				addressVersion: request.addressVersion,
-				video: {
-					port: request.videoPort,
-					srtpCryptoSuite: import_dist.SRTPCryptoSuites.AES_CM_128_HMAC_SHA1_80,
-					srtp_key: request.videoSrtp.key,
-					srtp_salt: request.videoSrtp.salt
-				},
-				audio: {
-					port: request.audioPort,
-					srtpCryptoSuite: import_dist.SRTPCryptoSuites.AES_CM_128_HMAC_SHA1_80,
-					srtp_key: request.audioSrtp.key,
-					srtp_salt: request.audioSrtp.salt
-				}
-			};
-			const prepared = await negotiator.prepare(prepareRequest);
-			setupResponse = encodeSetupEndpointsResponse({
-				sessionId: request.sessionId,
-				addressVersion: request.addressVersion,
-				accessoryAddress: prepared.localAddress,
-				videoPort: prepared.videoPort,
-				audioPort: prepared.audioPort,
-				videoSrtp: {
-					key: request.videoSrtp.key,
-					salt: request.videoSrtp.salt
-				},
-				audioSrtp: {
-					key: request.audioSrtp.key,
-					salt: request.audioSrtp.salt
-				},
-				videoSsrc: prepared.videoSsrc,
-				audioSsrc: prepared.audioSsrc
-			});
-			log.info("hap multi-tier: endpoints prepared", { meta: {
-				sessionId: request.sessionId,
-				controller: `${request.controllerAddress}:${request.videoPort}/${request.audioPort}`,
-				accessory: `${prepared.localAddress}:${prepared.videoPort}/${prepared.audioPort}`,
-				videoSsrc: prepared.videoSsrc,
-				audioSsrc: prepared.audioSsrc
-			} });
-		} catch (error) {
-			setupResponse = encodeSetupEndpointsRefusal(SetupEndpointsStatus.ERROR);
-			log.warn("hap multi-tier: setup endpoints refused", { meta: {
-				sessionId,
-				error: errorMessage(error)
-			} });
-		}
-	}
-	async function handleStreamingControlWrite(base64) {
-		let sessionId = null;
-		try {
-			const command = decodeRtpStreamingControl(base64);
-			sessionId = command.sessionId;
-			if (!negotiator.has(command.sessionId)) {
-				controlResponse = encodeRtpStreamingControlStatus(command.sessionId, RtpStreamingStatus.UNKNOWN_SESSION_IDENTIFIER);
-				log.warn("hap multi-tier: control write for a session that was never prepared", { meta: {
-					sessionId: command.sessionId,
-					command: command.command
-				} });
-				return;
-			}
-			if (command.command === RtpStreamingCommand.END) {
-				if (!started.has(command.sessionId)) {
-					controlResponse = encodeRtpStreamingControlStatus(command.sessionId, RtpStreamingStatus.NO_SUCH_STREAM);
-					return;
-				}
-				const stop = {
-					sessionID: command.sessionId,
-					type: import_dist.StreamRequestTypes.STOP
-				};
-				await negotiator.control(stop);
-				started.delete(command.sessionId);
-				controlResponse = encodeRtpStreamingControlStatus(command.sessionId, RtpStreamingStatus.SUCCESS);
-				log.info("hap multi-tier: stream ended", { meta: { sessionId: command.sessionId } });
-				return;
-			}
-			const tier = input.tiers.find((t) => t.identifier === command.videoTier);
-			if (tier === void 0) {
-				controlResponse = encodeRtpStreamingControlStatus(command.sessionId, RtpStreamingStatus.NO_SUCH_STREAM);
-				log.warn("hap multi-tier: start named a tier we never published", { meta: {
-					sessionId: command.sessionId,
-					requested: command.videoTier,
-					published: input.tiers.map((t) => t.identifier)
-				} });
-				return;
-			}
-			log.info("hap multi-tier: start ssrc comparison", { meta: {
-				sessionId: command.sessionId,
-				controllerVideoSsrc: command.videoSsrc ?? null,
-				controllerAudioSsrc: command.audioSsrc ?? null,
-				note: "accessory keeps the ssrcs it advertised at setup"
-			} });
-			const start = {
-				sessionID: command.sessionId,
-				type: import_dist.StreamRequestTypes.START,
-				video: {
-					codec: import_dist.VideoCodecType.H264,
-					profile: import_dist.H264Profile.HIGH,
-					level: import_dist.H264Level.LEVEL4_0,
-					packetizationMode: import_dist.VideoCodecPacketizationMode.NON_INTERLEAVED,
-					width: tier.width,
-					height: tier.height,
-					fps: tier.frameRate,
-					pt: VIDEO_PAYLOAD_TYPE,
-					ssrc: command.videoSsrc ?? 0,
-					max_bit_rate: tier.targetAverageBitrateKbps,
-					rtcp_interval: RTCP_INTERVAL_SECONDS,
-					mtu: DEFAULT_MTU
-				},
-				audio: {
-					codec: import_dist.AudioStreamingCodecType.OPUS,
-					channel: 1,
-					bit_rate: 24,
-					sample_rate: import_dist.AudioStreamingSamplerate.KHZ_24,
-					packet_time: 20,
-					pt: AUDIO_PAYLOAD_TYPE,
-					ssrc: command.audioSsrc ?? 0,
-					max_bit_rate: 24,
-					rtcp_interval: RTCP_INTERVAL_SECONDS,
-					comfort_pt: 13,
-					comfortNoiseEnabled: false
-				}
-			};
-			await negotiator.control(start);
-			started.add(command.sessionId);
-			controlResponse = encodeRtpStreamingControlStatus(command.sessionId, RtpStreamingStatus.SUCCESS);
-			log.info("hap multi-tier: stream started", { meta: {
-				sessionId: command.sessionId,
-				tier: tier.identifier,
-				geometry: `${tier.width}x${tier.height}@${tier.frameRate}`,
-				targetKbps: tier.targetAverageBitrateKbps,
-				codec: input.codec
-			} });
-		} catch (error) {
-			controlResponse = encodeRtpStreamingControlStatus(sessionId, RtpStreamingStatus.ERROR);
-			log.warn("hap multi-tier: control write refused", { meta: {
-				sessionId,
-				error: errorMessage(error)
-			} });
-		}
-	}
-	return {
-		handleSetupEndpointsWrite,
-		readSetupEndpoints: () => setupResponse,
-		handleStreamingControlWrite,
-		readStreamingControl: () => controlResponse
-	};
-}
-//#endregion
-//#region src/mappers/camera-accessory.ts
-/**
-* Camera accessory orchestrator — given a camstack deviceId, builds one
-* HomeKit Accessory representing the camera (or doorbell) plus a
-* separate Accessory per child device (siren, floodlight, …).
-*
-* Flow:
-*  1. Resolve a typed `DeviceProxy` via `ctx.fetchDevice(deviceId)`.
-*  2. Inspect `proxy.binding.entries` (or fall back to `getDevice`
-*     features) to decide whether the device is a doorbell vs a
-*     regular camera. Doorbells get `Categories.VIDEO_DOORBELL` +
-*     `DoorbellController`; otherwise `Categories.IP_CAMERA` +
-*     `CameraController`.
-*  3. Build the streaming delegate via the `camera-streams` builder.
-*  4. `configureController(controller)` to attach the streaming
-*     services to the Accessory.
-*  5. Run each feature builder gated on cap presence (motion sensor,
-*     intercom, PTZ, doorbell).
-*  6. Enumerate children via `proxy.deviceManager.getChildren({...})`
-*     and build one Accessory per child (see `child-accessory.ts`).
-*  7. Return a `Mapper` whose `accessories[]` lists every accessory
-*     this device produced so the bridge can register them all and
-*     remove them all on unexpose.
-*/
-async function buildCameraAccessory(input) {
-	const { ctx, deviceId, displayName, options } = input;
-	const numericId = Number.parseInt(deviceId, 10);
-	if (!Number.isFinite(numericId)) throw new Error(`export-hap: cannot map device '${deviceId}' — id is not numeric`);
-	const proxy = await ctx.fetchDevice(numericId);
-	const capNames = new Set(proxy.binding?.entries.map((e) => e.capName) ?? []);
-	const isDoorbell = capNames.has("doorbell");
-	const category = isDoorbell ? import_dist.Categories.VIDEO_DOORBELL : import_dist.Categories.IP_CAMERA;
-	const accessory = new import_dist.Accessory(displayName, accessoryUuidFor("camera", numericId));
-	accessory.category = category;
-	await populateAccessoryInfo(accessory, proxy, displayName, "Camera");
-	const bctx = {
-		ctx,
-		accessory,
-		proxy,
-		numericDeviceId: numericId,
-		displayName,
-		options
-	};
-	const advertisedVideo = await probeAdvertisedVideoProfile(bctx);
-	const streams = buildCameraStreamingDelegate(bctx, advertisedVideo);
-	const handles = [];
-	if (capNames.has("intercom")) handles.push(await buildIntercom({
-		bctx,
-		streamingOptions: streams.streamingOptions
-	}));
-	const recordingEnabled = options.hapDeviceSettings.hksvRecording === true;
-	let recordingAudioActive = true;
-	const recording = recordingEnabled ? await buildHksvRecording({
-		bctx,
-		fpsByProfile: advertisedVideo.fpsByProfile,
-		isAudioActive: () => recordingAudioActive
-	}) : null;
-	const controller = new (isDoorbell ? import_dist.DoorbellController : import_dist.CameraController)({
-		delegate: streams.delegate,
-		streamingOptions: streams.streamingOptions,
-		cameraStreamCount: 2,
-		...recording === null ? {} : { recording },
-		...recording === null || !capNames.has("motion-detection") ? {} : { sensors: { motion: true } }
-	});
-	accessory.configureController(controller);
-	if (options.hapDeviceSettings.multiTierService !== false) {
-		const sensor = advertisedVideo.sensor;
-		const services = buildMultiTierServices({
-			deviceId: numericId,
-			logger: ctx.logger,
-			width: sensor.width,
-			height: sensor.height,
-			codec: sensor.codec,
-			audioCaptureRateHz: 16e3,
-			negotiation: buildMultiTierNegotiation({
-				deviceId: numericId,
-				logger: ctx.logger,
-				negotiator: streams.negotiator,
-				tiers: tiersForSensor(sensor.width, sensor.height),
-				codec: sensor.codec
-			})
-		});
-		accessory.addService(services.capabilities);
-		accessory.addService(services.globalOperatingMode);
-		accessory.addService(services.streamManagement);
-		ctx.logger.info("hap multi-tier: services declared on this accessory", {
-			tags: { deviceId: numericId },
-			meta: {
-				serviceUuid: MULTI_TIER_RTP_SERVICE_UUID,
-				codec: sensor.codec === TierVideoCodec.H265 ? "h265" : "h264",
-				sensor: `${sensor.width}x${sensor.height}`
-			}
-		});
-	}
-	if (recording !== null) {
-		handles.push({ dispose: () => recording.dispose() });
-		const audioCharacteristic = (controller.recordingManagement?.operatingModeService)?.getCharacteristic(import_dist.Characteristic.RecordingAudioActive);
-		if (audioCharacteristic) {
-			recordingAudioActive = audioCharacteristic.value !== 0 && audioCharacteristic.value !== false;
-			audioCharacteristic.on("change", ({ newValue }) => {
-				recordingAudioActive = newValue !== 0 && newValue !== false;
-			});
-		}
-	}
-	if (capNames.has("motion-detection")) handles.push(await buildMotionSensor(bctx, recording === null ? null : controller.motionService ?? null));
-	if (isDoorbell && controller instanceof import_dist.DoorbellController) handles.push(await buildDoorbell({
-		bctx,
-		controller
-	}));
-	if (capNames.has("ptz") || capNames.has("ptz-autotrack")) handles.push(await buildPtz(bctx));
-	if (capNames.has("battery")) handles.push(await buildBattery(bctx));
-	if (capNames.has("privacy-mask")) handles.push(await buildPrivacySwitch(bctx));
-	handles.push(await buildChildServicesFor({ parentCtx: bctx }));
-	return {
-		accessory,
-		accessories: [accessory],
-		async dispose() {
-			const log = ctx.logger.withTags({ deviceId: numericId });
-			for (const h of handles) try {
-				await h.dispose();
-			} catch (err) {
-				log.debug("export-hap: builder dispose failed (continuing)", { meta: { error: errMsg$5(err) } });
-			}
-			try {
-				await streams.dispose();
-			} catch (err) {
-				log.debug("export-hap: streams dispose failed", { meta: { error: errMsg$5(err) } });
-			}
-		}
-	};
-}
-function errMsg$5(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-//#endregion
-//#region src/mappers/builders/generic/lock.ts
-/**
-* `lock-control` → `Service.LockMechanism`.
-*
-* Not a sensor row: HomeKit models a lock as two characteristics, a CURRENT
-* state the accessory owns and a TARGET state the controller writes, and the
-* cap's five states do not map onto either one alone.
-*
-* ```
-*  cap state    LockCurrentState   LockTargetState
-*  locked       SECURED            SECURED
-*  unlocked     UNSECURED          UNSECURED
-*  locking      UNKNOWN            SECURED      (in flight — do not claim SECURED)
-*  unlocking    UNKNOWN            UNSECURED
-*  jammed       JAMMED             unchanged    (the controller's intent stands)
-* ```
-*
-* Reporting SECURED while the bolt is still moving is the failure worth naming:
-* iOS renders the lock as closed, the operator walks away, and the motor stalls
-* behind them. `UNKNOWN` is the honest answer for an in-flight transition.
-*
-* `open` (the cap's third method, for locks with a latch/buzzer) has no HomeKit
-* counterpart on this service and is deliberately not wired — a Switch that
-* silently buzzes a door open would be a second knob nobody asked for.
-*/
-var SUBTYPE$1 = "lock-control";
-var readLock = reader(LockControlStatusSchema.pick({ state: true }), (status) => {
-	const current = status.state === "locked" ? import_dist.Characteristic.LockCurrentState.SECURED : status.state === "unlocked" ? import_dist.Characteristic.LockCurrentState.UNSECURED : status.state === "jammed" ? import_dist.Characteristic.LockCurrentState.JAMMED : import_dist.Characteristic.LockCurrentState.UNKNOWN;
-	const target = status.state === "locked" || status.state === "locking" ? import_dist.Characteristic.LockTargetState.SECURED : status.state === "unlocked" || status.state === "unlocking" ? import_dist.Characteristic.LockTargetState.UNSECURED : null;
-	return [{
-		characteristic: import_dist.Characteristic.LockCurrentState,
-		value: current
-	}, ...target === null ? [] : [{
-		characteristic: import_dist.Characteristic.LockTargetState,
-		value: target
-	}]];
-});
-async function buildLockMechanism(bctx) {
-	const { ctx, accessory, proxy, numericDeviceId, displayName } = bctx;
-	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
-	const label = hapServiceName([displayName], `Lock ${numericDeviceId}`);
-	const service = accessory.addService(import_dist.Service.LockMechanism, label, SUBTYPE$1);
-	applyServiceLabel(service, label);
-	const apply = (status, source) => {
-		const updates = readLock(status);
-		if (updates.length === 0) {
-			log.debug("export-hap: lock status did not match the cap schema — no update", { meta: { source } });
+			});
 			return;
 		}
-		applyUpdates(service, updates);
-	};
-	try {
-		const status = await proxy.lockControl?.getStatus({});
-		if (status !== void 0 && status !== null) apply(status, "getStatus");
-	} catch (err) {
-		log.debug("export-hap: lock getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$4(err) } });
-	}
-	service.getCharacteristic(import_dist.Characteristic.LockTargetState).onSet(async (value) => {
-		const secure = value === import_dist.Characteristic.LockTargetState.SECURED;
-		try {
-			if (secure) await proxy.lockControl?.lock({});
-			else await proxy.lockControl?.unlock({});
-		} catch (err) {
-			log.warn("export-hap: lock command failed", { meta: {
-				secure,
-				error: errMsg$4(err)
-			} });
+		await input.negotiation.handleSetupEndpointsWrite(value);
+	});
+	streamManagement.addCharacteristic(setupEndpoints);
+	const streamingControl = new import_dist.Characteristic("RTP Streaming Control", CHAR_RTP_STREAMING_CONTROL, {
+		format: import_dist.Formats.TLV8,
+		perms: [import_dist.Perms.PAIRED_READ, import_dist.Perms.PAIRED_WRITE]
+	});
+	streamingControl.onGet(() => {
+		note("rtp-streaming-control");
+		return input.negotiation?.readStreamingControl() ?? encodeRtpStreamingControlStatus(null, RtpStreamingStatus.ERROR);
+	});
+	streamingControl.onSet(async (value) => {
+		if (input.negotiation === void 0 || typeof value !== "string") {
+			logger.info("hap multi-tier: refused an rtp streaming control write", {
+				tags: { deviceId },
+				meta: { reason: input.negotiation === void 0 ? "no-negotiator" : "not-a-string" }
+			});
+			return;
 		}
+		await input.negotiation.handleStreamingControlWrite(value);
 	});
-	const unsubscribe = proxy.state.lockControl?.subscribe((value) => {
-		if (value === void 0 || value === null) return;
-		apply(value, "slice");
-	}) ?? null;
-	return { async dispose() {
-		try {
-			unsubscribe?.();
-		} catch {}
-	} };
-}
-function errMsg$4(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-//#endregion
-//#region src/mappers/builders/generic/security-state.ts
-/** Is this a settled arm state worth remembering? */
-function armedMemoOf(state) {
-	return state === "armed_home" || state === "armed_away" || state === "armed_night" || state === "armed_vacation" || state === "armed_custom_bypass" ? state : null;
-}
-function currentForArmed(state) {
-	switch (state) {
-		case "armed_home":
-		case "armed_custom_bypass": return import_dist.Characteristic.SecuritySystemCurrentState.STAY_ARM;
-		case "armed_night": return import_dist.Characteristic.SecuritySystemCurrentState.NIGHT_ARM;
-		default: return import_dist.Characteristic.SecuritySystemCurrentState.AWAY_ARM;
-	}
-}
-function targetForArmed(state) {
-	switch (state) {
-		case "armed_home":
-		case "armed_custom_bypass": return import_dist.Characteristic.SecuritySystemTargetState.STAY_ARM;
-		case "armed_night": return import_dist.Characteristic.SecuritySystemTargetState.NIGHT_ARM;
-		default: return import_dist.Characteristic.SecuritySystemTargetState.AWAY_ARM;
-	}
-}
-function securityStateFor(state, memo) {
-	const settled = armedMemoOf(state);
-	if (settled !== null) return {
-		current: currentForArmed(settled),
-		target: targetForArmed(settled)
+	streamManagement.addCharacteristic(streamingControl);
+	const sensor = new import_dist.Characteristic("Sensor UUID", CHAR_SENSOR_UUID, {
+		format: import_dist.Formats.DATA,
+		perms: [import_dist.Perms.PAIRED_READ]
+	});
+	const sensorValue = sensorUuid.toString("base64");
+	sensor.onGet(() => {
+		note("sensor-uuid");
+		return sensorValue;
+	});
+	streamManagement.addCharacteristic(sensor);
+	return {
+		capabilities,
+		globalOperatingMode,
+		streamManagement
 	};
-	switch (state) {
-		case "disarmed": return {
-			current: import_dist.Characteristic.SecuritySystemCurrentState.DISARMED,
-			target: import_dist.Characteristic.SecuritySystemTargetState.DISARM
-		};
-		case "arming": return {
-			current: import_dist.Characteristic.SecuritySystemCurrentState.DISARMED,
-			target: memo === null ? null : targetForArmed(memo)
-		};
-		case "disarming": return {
-			current: memo === null ? import_dist.Characteristic.SecuritySystemCurrentState.DISARMED : currentForArmed(memo),
-			target: import_dist.Characteristic.SecuritySystemTargetState.DISARM
-		};
-		case "pending": return {
-			current: memo === null ? import_dist.Characteristic.SecuritySystemCurrentState.DISARMED : currentForArmed(memo),
-			target: memo === null ? null : targetForArmed(memo)
-		};
-		default: return {
-			current: import_dist.Characteristic.SecuritySystemCurrentState.ALARM_TRIGGERED,
-			target: memo === null ? null : targetForArmed(memo)
-		};
-	}
-}
-/**
-* The arm mode behind a HomeKit target, or `null` for DISARM and for anything
-* outside the four values HomeKit defines.
-*
-* `null` is not an error the caller can ignore: DISARM is a different COMMAND,
-* and a value HomeKit never sends is a write this builder refuses to translate.
-*/
-function alarmArmModeFor(target) {
-	switch (target) {
-		case import_dist.Characteristic.SecuritySystemTargetState.STAY_ARM: return "home";
-		case import_dist.Characteristic.SecuritySystemTargetState.AWAY_ARM: return "away";
-		case import_dist.Characteristic.SecuritySystemTargetState.NIGHT_ARM: return "night";
-		default: return null;
-	}
-}
-//#endregion
-//#region src/mappers/builders/generic/security-target.ts
-/**
-* The panel modes behind each HomeKit target, PRIMARY first.
-*
-* The primary is the mode `alarmArmModeFor` names; the secondary is the other
-* mode `security-state.ts` reports through the same HomeKit value, so the two
-* modules agree in both directions by construction.
-*/
-var MODES_BY_TARGET = new Map([
-	[import_dist.Characteristic.SecuritySystemTargetState.STAY_ARM, ["home", "custom_bypass"]],
-	[import_dist.Characteristic.SecuritySystemTargetState.AWAY_ARM, ["away", "vacation"]],
-	[import_dist.Characteristic.SecuritySystemTargetState.NIGHT_ARM, ["night"]]
-]);
-/** Arm targets in the order HomeKit numbers them; DISARM is appended last. */
-var ARM_TARGETS = [
-	import_dist.Characteristic.SecuritySystemTargetState.STAY_ARM,
-	import_dist.Characteristic.SecuritySystemTargetState.AWAY_ARM,
-	import_dist.Characteristic.SecuritySystemTargetState.NIGHT_ARM
-];
-/**
-* The `validValues` for `SecuritySystemTargetState`, or `null` to leave
-* HomeKit's own four values in place.
-*
-* DISARM is always present: disarming is not one of the panel's arm modes and
-* a panel that cannot be disarmed is not a thing this cap can express.
-*/
-function targetValidValuesFor(availableModes) {
-	if (availableModes.length === 0) return null;
-	return [...ARM_TARGETS.filter((target) => (MODES_BY_TARGET.get(target) ?? []).some((mode) => availableModes.includes(mode))), import_dist.Characteristic.SecuritySystemTargetState.DISARM];
-}
-/**
-* The arm mode to send for a HomeKit target, or `null` when there is none.
-*
-* `null` is not a shrug the caller may swallow: DISARM is a different command,
-* and an arm target the panel accepts no mode for is a write this module
-* refuses to translate rather than guess at.
-*/
-function armModeForTarget(target, availableModes) {
-	const primary = alarmArmModeFor(target);
-	if (primary === null) return null;
-	if (availableModes.length === 0) return primary;
-	return (MODES_BY_TARGET.get(target) ?? [primary]).find((mode) => availableModes.includes(mode)) ?? null;
 }
 //#endregion
-//#region src/mappers/builders/generic/security-system.ts
+//#region src/multi-tier/negotiation.ts
 /**
-* `alarm-panel` → `Service.SecuritySystem`.
-*
-* The lock builder's shape (a current/target pair, a hydrate, an `onSet`, a
-* slice subscription, a dispose) applied to the one device on the fleet where
-* reporting a state that is not true has a consequence worse than a stalled
-* motor. The mapping itself is NOT here: `security-state.ts` owns what the
-* panel's state looks like to HomeKit and `security-target.ts` owns what
-* HomeKit may ask for, both pure and both tested on their own. This file is
-* the service around them.
-*
-* ## The memo
+* The adapter between Apple's new characteristics and the streaming engine this
+* addon already has.
 *
-* `pending`, `disarming` and `triggered` do not carry the mode the panel was
-* armed to — only the last settled state knows it. This builder is the caller
-* `security-state.ts` describes: it remembers the last settled arm and forgets
-* it on `disarmed`, because a memo that outlives a disarm makes the next
-* `arming` claim a target nobody asked for.
+* ## Why an adapter and not a second engine
 *
-* The memo is deliberately NOT seeded from the controller's own write. HomeKit
-* already holds the target the operator just set; not writing it back is
-* exactly right. The cost is a panel armed from its own keypad during an exit
-* delay, where the target stays at whatever HomeKit last knew — a stale target
-* for the length of the delay, against inventing an intent, and the invention
-* is worse.
+* The multi-tier RTP service owns its OWN `Setup Endpoints` and `RTP Streaming
+* Control`, so hap-nodejs's `CameraController` never negotiates for it — and
+* the library's own handlers are all `private`, so its engine cannot be
+* borrowed either. But the sockets, the SRTP contexts, the ffmpeg pipeline and
+* the teardown are the same ones the classic service uses. A second copy would
+* be two engines to keep in agreement, and this repo has paid for that shape
+* before. So: new characteristics, one engine, through `StreamNegotiator`.
 *
-* ## `requiresCode`: the arm is REFUSED, not attempted
+* ## What is different about the new flow
 *
-* HomeKit's SecuritySystem has no PIN prompt — there is no characteristic for
-* it and no way to ask the operator mid-write. So a panel that requires a code
-* cannot be armed or disarmed from the Home app, and this builder says so
-* twice: the write fails with `INSUFFICIENT_AUTHORIZATION` (iOS renders the
-* tile's failure) and a WARN names the device, the command and the mode.
+* The classic `Selected RTP Stream Configuration` carries the whole selected
+* configuration in its start — codec, profile, level, resolution, bitrate.
+* `RTP Streaming Control` carries a **tier identifier**, because the
+* configuration was agreed when we published `Supported Video Stream Tiers`.
+* So this maps an identifier back to the tier WE published, and a tier we never
+* published is `No Such Stream` — improvising a geometry there would serve a
+* stream the controller did not ask for and it would look like it worked.
 *
-* Sending the command code-less and letting the panel reject it was the
-* alternative. It is worse: the refusal costs a round trip, it is
-* indistinguishable from a broken panel in the log, and repeated code-less
-* attempts are what locks a real alarm panel out.
-*/
-var SUBTYPE = "alarm-panel";
-/** The subset of the status this builder reads. */
-var PanelReadSchema = AlarmPanelStatusSchema.pick({
-	state: true,
-	availableModes: true,
-	requiresCode: true
-});
-/**
-* Turn a panel status into characteristic writes, folding the memo.
+* ## Every path answers
 *
-* A payload that does not match the cap's own schema yields NO updates and
-* leaves the memo alone — it is a status we could not read, not a panel that
-* changed. The caller logs the drop; a frozen characteristic is otherwise
-* indistinguishable from a quiet panel.
+* A read of either characteristic always produces a valid TLV8. The Home app
+* reads a camera's characteristics in one batch, and one member that answers
+* nothing took the kitchen camera's whole read down and left it on "loading".
+* So an engine failure, a malformed write and "nothing has happened yet" are
+* all statuses, never silence.
 */
-function securityUpdatesFor(status, memo) {
-	const parsed = PanelReadSchema.safeParse(status);
-	if (!parsed.success) return {
-		updates: [],
-		memo,
-		panel: null
-	};
-	const nextMemo = parsed.data.state === "disarmed" ? null : armedMemoOf(parsed.data.state) ?? memo;
-	const { current, target } = securityStateFor(parsed.data.state, nextMemo);
-	return {
-		updates: [{
-			characteristic: import_dist.Characteristic.SecuritySystemCurrentState,
-			value: current
-		}, ...target === null ? [] : [{
-			characteristic: import_dist.Characteristic.SecuritySystemTargetState,
-			value: target
-		}]],
-		memo: nextMemo,
-		panel: {
-			availableModes: parsed.data.availableModes,
-			requiresCode: parsed.data.requiresCode
-		}
-	};
+/** RTP payload types. 96 is the first dynamic one (RFC 3551); 110 is what our
+*  own Opus offers use. Both are echoed in the tier declaration. */
+var VIDEO_PAYLOAD_TYPE = 96;
+var AUDIO_PAYLOAD_TYPE = 110;
+/** RTCP interval in SECONDS, which is the unit the engine reads. */
+var RTCP_INTERVAL_SECONDS = 5;
+/** The MTU the classic path uses for an Ethernet-sized path. */
+var DEFAULT_MTU = 1378;
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
 }
-async function buildSecuritySystem(bctx) {
-	const { ctx, accessory, proxy, numericDeviceId, displayName } = bctx;
-	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
-	const label = hapServiceName([displayName], `Alarm ${numericDeviceId}`);
-	const service = accessory.addService(import_dist.Service.SecuritySystem, label, SUBTYPE);
-	applyServiceLabel(service, label);
-	let memo = null;
-	let availableModes = [];
-	let requiresCode = false;
-	/** Only log the `validValues` narrowing when it actually changes. */
-	let lastValidValues = "";
-	const applyValidValues = () => {
-		const validValues = targetValidValuesFor(availableModes);
-		if (validValues === null) {
-			if (lastValidValues !== "unconstrained") {
-				lastValidValues = "unconstrained";
-				log.info("export-hap: alarm panel named no arm modes — leaving HomeKit’s targets unconstrained", { meta: { subtype: SUBTYPE } });
-			}
-			return;
-		}
-		const key = validValues.join(",");
-		if (key === lastValidValues) return;
-		lastValidValues = key;
-		service.getCharacteristic(import_dist.Characteristic.SecuritySystemTargetState).setProps({ validValues: [...validValues] });
-		log.info("export-hap: alarm panel target constrained to the modes it accepts", { meta: {
-			subtype: SUBTYPE,
-			availableModes: [...availableModes],
-			validValues
-		} });
-	};
-	const apply = (status, source) => {
-		const next = securityUpdatesFor(status, memo);
-		if (next.updates.length === 0) {
-			log.debug("export-hap: alarm panel status did not match the cap schema — no update", { meta: {
-				subtype: SUBTYPE,
-				source
-			} });
-			return;
-		}
-		memo = next.memo;
-		if (next.panel !== null) {
-			availableModes = next.panel.availableModes;
-			requiresCode = next.panel.requiresCode;
-			applyValidValues();
-		}
-		applyUpdates(service, next.updates);
-	};
-	try {
-		const status = await proxy.alarmPanel?.getStatus({});
-		if (status !== void 0 && status !== null) apply(status, "getStatus");
-	} catch (err) {
-		log.debug("export-hap: alarm panel getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$3(err) } });
-	}
-	service.getCharacteristic(import_dist.Characteristic.SecuritySystemTargetState).onSet(async (value) => {
-		const target = typeof value === "number" ? value : Number(value);
-		const disarm = target === import_dist.Characteristic.SecuritySystemTargetState.DISARM;
-		const mode = disarm ? null : armModeForTarget(target, availableModes);
-		if (requiresCode) {
-			log.warn("export-hap: alarm panel requires a PIN — HomeKit cannot supply one, command REFUSED", { meta: {
-				subtype: SUBTYPE,
-				command: disarm ? "disarm" : "arm",
-				mode,
-				target
+function buildMultiTierNegotiation(input) {
+	const { deviceId, logger, negotiator } = input;
+	const log = logger.withTags({ deviceId });
+	let setupResponse = encodeSetupEndpointsRefusal(SetupEndpointsStatus.ERROR);
+	let controlResponse = encodeRtpStreamingControlStatus(null, RtpStreamingStatus.ERROR);
+	/** Sessions we have STARTED, so an End can tell "not started" from "unknown". */
+	const started = /* @__PURE__ */ new Set();
+	async function handleSetupEndpointsWrite(base64) {
+		let sessionId = null;
+		try {
+			const request = decodeSetupEndpointsRequest(base64);
+			sessionId = request.sessionId;
+			const prepareRequest = {
+				sessionID: request.sessionId,
+				sourceAddress: request.controllerAddress,
+				targetAddress: request.controllerAddress,
+				addressVersion: request.addressVersion,
+				video: {
+					port: request.videoPort,
+					srtpCryptoSuite: import_dist.SRTPCryptoSuites.AES_CM_128_HMAC_SHA1_80,
+					srtp_key: request.videoSrtp.key,
+					srtp_salt: request.videoSrtp.salt
+				},
+				audio: {
+					port: request.audioPort,
+					srtpCryptoSuite: import_dist.SRTPCryptoSuites.AES_CM_128_HMAC_SHA1_80,
+					srtp_key: request.audioSrtp.key,
+					srtp_salt: request.audioSrtp.salt
+				}
+			};
+			const prepared = await negotiator.prepare(prepareRequest);
+			setupResponse = encodeSetupEndpointsResponse({
+				sessionId: request.sessionId,
+				addressVersion: request.addressVersion,
+				accessoryAddress: prepared.localAddress,
+				videoPort: prepared.videoPort,
+				audioPort: prepared.audioPort,
+				videoSrtp: {
+					key: request.videoSrtp.key,
+					salt: request.videoSrtp.salt
+				},
+				audioSrtp: {
+					key: request.audioSrtp.key,
+					salt: request.audioSrtp.salt
+				},
+				videoSsrc: prepared.videoSsrc,
+				audioSsrc: prepared.audioSsrc
+			});
+			log.info("hap multi-tier: endpoints prepared", { meta: {
+				sessionId: request.sessionId,
+				controller: `${request.controllerAddress}:${request.videoPort}/${request.audioPort}`,
+				accessory: `${prepared.localAddress}:${prepared.videoPort}/${prepared.audioPort}`,
+				videoSsrc: prepared.videoSsrc,
+				audioSsrc: prepared.audioSsrc
 			} });
-			throw new import_dist.HapStatusError(import_dist.HAPStatus.INSUFFICIENT_AUTHORIZATION);
-		}
-		if (!disarm && mode === null) {
-			log.warn("export-hap: alarm panel cannot honour this HomeKit arm target — REFUSED", { meta: {
-				subtype: SUBTYPE,
-				target,
-				availableModes: [...availableModes]
+		} catch (error) {
+			setupResponse = encodeSetupEndpointsRefusal(SetupEndpointsStatus.ERROR);
+			log.warn("hap multi-tier: setup endpoints refused", { meta: {
+				sessionId,
+				error: errorMessage(error)
 			} });
-			throw new import_dist.HapStatusError(import_dist.HAPStatus.INVALID_VALUE_IN_REQUEST);
 		}
+	}
+	async function handleStreamingControlWrite(base64) {
+		let sessionId = null;
 		try {
-			if (mode === null) await proxy.alarmPanel?.disarm({});
-			else await proxy.alarmPanel?.arm({ mode });
-		} catch (err) {
-			log.warn("export-hap: alarm panel command failed", { meta: {
-				subtype: SUBTYPE,
-				command: mode === null ? "disarm" : "arm",
-				mode,
-				error: errMsg$3(err)
+			const command = decodeRtpStreamingControl(base64);
+			sessionId = command.sessionId;
+			if (!negotiator.has(command.sessionId)) {
+				controlResponse = encodeRtpStreamingControlStatus(command.sessionId, RtpStreamingStatus.UNKNOWN_SESSION_IDENTIFIER);
+				log.warn("hap multi-tier: control write for a session that was never prepared", { meta: {
+					sessionId: command.sessionId,
+					command: command.command
+				} });
+				return;
+			}
+			if (command.command === RtpStreamingCommand.END) {
+				if (!started.has(command.sessionId)) {
+					controlResponse = encodeRtpStreamingControlStatus(command.sessionId, RtpStreamingStatus.NO_SUCH_STREAM);
+					return;
+				}
+				const stop = {
+					sessionID: command.sessionId,
+					type: import_dist.StreamRequestTypes.STOP
+				};
+				await negotiator.control(stop);
+				started.delete(command.sessionId);
+				controlResponse = encodeRtpStreamingControlStatus(command.sessionId, RtpStreamingStatus.SUCCESS);
+				log.info("hap multi-tier: stream ended", { meta: { sessionId: command.sessionId } });
+				return;
+			}
+			const tier = input.tiers.find((t) => t.identifier === command.videoTier);
+			if (tier === void 0) {
+				controlResponse = encodeRtpStreamingControlStatus(command.sessionId, RtpStreamingStatus.NO_SUCH_STREAM);
+				log.warn("hap multi-tier: start named a tier we never published", { meta: {
+					sessionId: command.sessionId,
+					requested: command.videoTier,
+					published: input.tiers.map((t) => t.identifier)
+				} });
+				return;
+			}
+			log.info("hap multi-tier: start ssrc comparison", { meta: {
+				sessionId: command.sessionId,
+				controllerVideoSsrc: command.videoSsrc ?? null,
+				controllerAudioSsrc: command.audioSsrc ?? null,
+				note: "accessory keeps the ssrcs it advertised at setup"
 			} });
-			throw new import_dist.HapStatusError(import_dist.HAPStatus.SERVICE_COMMUNICATION_FAILURE);
-		}
-	});
-	const unsubscribe = proxy.state.alarmPanel?.subscribe((value) => {
-		if (value === void 0 || value === null) return;
-		apply(value, "slice");
-	}) ?? null;
-	return { async dispose() {
-		try {
-			unsubscribe?.();
-		} catch {}
-	} };
-}
-function errMsg$3(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-//#endregion
-//#region src/mappers/builders/generic/sensor-service.ts
-async function buildSensorService(input) {
-	const { bctx, spec, name, subtype } = input;
-	const { ctx, accessory, proxy, numericDeviceId } = bctx;
-	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
-	const label = hapServiceName([name], spec.label);
-	const service = spec.addService(accessory, label, subtype);
-	applyServiceLabel(service, label);
-	const apply = (status, source) => {
-		const updates = spec.read(status);
-		if (updates.length === 0) {
-			log.debug("export-hap: sensor status did not match the cap schema — no update", { meta: {
-				subtype,
-				source
+			const start = {
+				sessionID: command.sessionId,
+				type: import_dist.StreamRequestTypes.START,
+				video: {
+					codec: import_dist.VideoCodecType.H264,
+					profile: import_dist.H264Profile.HIGH,
+					level: import_dist.H264Level.LEVEL4_0,
+					packetizationMode: import_dist.VideoCodecPacketizationMode.NON_INTERLEAVED,
+					width: tier.width,
+					height: tier.height,
+					fps: tier.frameRate,
+					pt: VIDEO_PAYLOAD_TYPE,
+					ssrc: command.videoSsrc ?? 0,
+					max_bit_rate: tier.targetAverageBitrateKbps,
+					rtcp_interval: RTCP_INTERVAL_SECONDS,
+					mtu: DEFAULT_MTU
+				},
+				audio: {
+					codec: import_dist.AudioStreamingCodecType.OPUS,
+					channel: 1,
+					bit_rate: 24,
+					sample_rate: import_dist.AudioStreamingSamplerate.KHZ_24,
+					packet_time: 20,
+					pt: AUDIO_PAYLOAD_TYPE,
+					ssrc: command.audioSsrc ?? 0,
+					max_bit_rate: 24,
+					rtcp_interval: RTCP_INTERVAL_SECONDS,
+					comfort_pt: 13,
+					comfortNoiseEnabled: false
+				}
+			};
+			await negotiator.control(start);
+			started.add(command.sessionId);
+			controlResponse = encodeRtpStreamingControlStatus(command.sessionId, RtpStreamingStatus.SUCCESS);
+			log.info("hap multi-tier: stream started", { meta: {
+				sessionId: command.sessionId,
+				tier: tier.identifier,
+				geometry: `${tier.width}x${tier.height}@${tier.frameRate}`,
+				targetKbps: tier.targetAverageBitrateKbps,
+				codec: input.codec
+			} });
+		} catch (error) {
+			controlResponse = encodeRtpStreamingControlStatus(sessionId, RtpStreamingStatus.ERROR);
+			log.warn("hap multi-tier: control write refused", { meta: {
+				sessionId,
+				error: errorMessage(error)
 			} });
-			return;
 		}
-		applyUpdates(service, updates);
-	};
-	try {
-		const status = await spec.getStatus(proxy);
-		if (status !== void 0 && status !== null) apply(status, "getStatus");
-	} catch (err) {
-		log.debug("export-hap: sensor getStatus hydrate failed (non-fatal)", { meta: {
-			subtype,
-			error: errMsg$2(err)
-		} });
 	}
-	const unsubscribe = spec.subscribe(proxy, (value) => {
-		if (value === void 0 || value === null) return;
-		apply(value, "slice");
-	});
-	return { async dispose() {
-		try {
-			unsubscribe?.();
-		} catch {}
-	} };
-}
-function errMsg$2(err) {
-	return err instanceof Error ? err.message : String(err);
+	return {
+		handleSetupEndpointsWrite,
+		readSetupEndpoints: () => setupResponse,
+		handleStreamingControlWrite,
+		readStreamingControl: () => controlResponse
+	};
 }
 //#endregion
-//#region src/mappers/builders/generic/cap-service-table.ts
+//#region src/mappers/camera-accessory.ts
 /**
-* The capability→HomeKit-service TABLE for non-camera devices.
-*
-* This is the whole coverage decision for the generic export path, and it is
-* deliberately a table rather than a `switch` on `DeviceType`. The doctrine is
-* the one the Home Assistant exporter already writes down: *coverage is decided
-* by a device's capabilities, not its type — restricting the picker by type is
-* what confined the previous exporter to cameras.* A `DeviceType` here is only
-* ever a UI filter (`HAP_EXPORTABLE_DEVICE_TYPES`) or an icon
-* (`ACCESSORY_CATEGORY_BY_TYPE`); it never decides whether something exports.
-*
-* The shape mirrors `CAP_ENTITY_MAP` in
-* `packages/addon-provider-homeassistant/src/ha-export/entity-catalog.ts` so
-* the two can be unified later — one row per capability, keyed by the cap name
-* exactly as it appears in `proxy.binding.entries[].capName`.
-*
-* ## Reading a status
-*
-* Every row parses the cap's OWN Zod status schema rather than duck-typing the
-* payload, and it `.pick()`s only the fields it reads: a provider that omits a
-* timestamp must not silence a sensor, and a provider that sends the wrong
-* shape must not write a garbage characteristic. A parse that fails yields no
-* updates, and the builder that owns the service logs the drop — silence reads
-* as "the sensor never changed".
-*
-* ## Tier
-*
-* Tier A, plus `alarm-panel`: the caps whose HomeKit service exists today and
-* needs no feature-dependent shape. `cover` still needs `cover-positionable`
-* and `climate-control` the dual-setpoint split; those are a separate task,
-* and adding a row here must never mean adding a service whose semantics this
-* file cannot fully honour.
+* Camera accessory orchestrator — given a camstack deviceId, builds one
+* HomeKit Accessory representing the camera (or doorbell) plus a
+* separate Accessory per child device (siren, floodlight, …).
 *
-* `alarm-panel` earned its row by answering the two questions that kept it
-* out: a target the panel would refuse is never offered (`availableModes` →
-* `validValues`, `security-target.ts`) and an arm a PIN-gated panel cannot
-* accept is refused out loud rather than attempted (`security-system.ts`).
+* Flow:
+*  1. Resolve a typed `DeviceProxy` via `ctx.fetchDevice(deviceId)`.
+*  2. Inspect `proxy.binding.entries` (or fall back to `getDevice`
+*     features) to decide whether the device is a doorbell vs a
+*     regular camera. Doorbells get `Categories.VIDEO_DOORBELL` +
+*     `DoorbellController`; otherwise `Categories.IP_CAMERA` +
+*     `CameraController`.
+*  3. Build the streaming delegate via the `camera-streams` builder.
+*  4. `configureController(controller)` to attach the streaming
+*     services to the Accessory.
+*  5. Run each feature builder gated on cap presence (motion sensor,
+*     intercom, PTZ, doorbell).
+*  6. Enumerate children via `proxy.deviceManager.getChildren({...})`
+*     and build one Accessory per child (see `child-accessory.ts`).
+*  7. Return a `Mapper` whose `accessories[]` lists every accessory
+*     this device produced so the bridge can register them all and
+*     remove them all on unexpose.
 */
-/** HomeKit's floor for `CurrentAmbientLightLevel`; 0 lux is out of range. */
-var MIN_LUX = 1e-4;
-var SENSOR_SPECS = {
-	contact: {
-		label: "Contact",
-		addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.ContactSensor, name, subtype),
-		getStatus: (proxy) => proxy.contact?.getStatus({}),
-		subscribe: (proxy, onValue) => proxy.state.contact?.subscribe(onValue) ?? null,
-		read: reader(ContactStatusSchema.pick({ entryOpen: true }), (status) => [{
-			characteristic: import_dist.Characteristic.ContactSensorState,
-			value: status.entryOpen ? import_dist.Characteristic.ContactSensorState.CONTACT_NOT_DETECTED : import_dist.Characteristic.ContactSensorState.CONTACT_DETECTED
-		}])
-	},
-	motion: {
-		label: "Motion",
-		addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.MotionSensor, name, subtype),
-		getStatus: (proxy) => proxy.motion?.getStatus({}),
-		subscribe: (proxy, onValue) => proxy.state.motion?.subscribe(onValue) ?? null,
-		read: reader(MotionStatusSchema.pick({ detected: true }), (status) => [{
-			characteristic: import_dist.Characteristic.MotionDetected,
-			value: status.detected
-		}])
-	},
-	presence: {
-		label: "Presence",
-		addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.OccupancySensor, name, subtype),
-		getStatus: (proxy) => proxy.presence?.getStatus({}),
-		subscribe: (proxy, onValue) => proxy.state.presence?.subscribe(onValue) ?? null,
-		read: reader(PresenceStatusSchema.pick({ state: true }), (status) => [{
-			characteristic: import_dist.Characteristic.OccupancyDetected,
-			value: status.state === "home" ? import_dist.Characteristic.OccupancyDetected.OCCUPANCY_DETECTED : import_dist.Characteristic.OccupancyDetected.OCCUPANCY_NOT_DETECTED
-		}])
-	},
-	smoke: {
-		label: "Smoke",
-		addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.SmokeSensor, name, subtype),
-		getStatus: (proxy) => proxy.smoke?.getStatus({}),
-		subscribe: (proxy, onValue) => proxy.state.smoke?.subscribe(onValue) ?? null,
-		read: reader(SmokeStatusSchema.pick({ detected: true }), (status) => [{
-			characteristic: import_dist.Characteristic.SmokeDetected,
-			value: status.detected ? import_dist.Characteristic.SmokeDetected.SMOKE_DETECTED : import_dist.Characteristic.SmokeDetected.SMOKE_NOT_DETECTED
-		}])
-	},
-	"carbon-monoxide": {
-		label: "Carbon monoxide",
-		addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.CarbonMonoxideSensor, name, subtype),
-		getStatus: (proxy) => proxy.carbonMonoxide?.getStatus({}),
-		subscribe: (proxy, onValue) => proxy.state.carbonMonoxide?.subscribe(onValue) ?? null,
-		read: reader(CarbonMonoxideStatusSchema.pick({ detected: true }), (status) => [{
-			characteristic: import_dist.Characteristic.CarbonMonoxideDetected,
-			value: status.detected ? import_dist.Characteristic.CarbonMonoxideDetected.CO_LEVELS_ABNORMAL : import_dist.Characteristic.CarbonMonoxideDetected.CO_LEVELS_NORMAL
-		}])
-	},
-	flood: {
-		label: "Leak",
-		addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.LeakSensor, name, subtype),
-		getStatus: (proxy) => proxy.flood?.getStatus({}),
-		subscribe: (proxy, onValue) => proxy.state.flood?.subscribe(onValue) ?? null,
-		read: reader(FloodStatusSchema.pick({ flooded: true }), (status) => [{
-			characteristic: import_dist.Characteristic.LeakDetected,
-			value: status.flooded ? import_dist.Characteristic.LeakDetected.LEAK_DETECTED : import_dist.Characteristic.LeakDetected.LEAK_NOT_DETECTED
-		}])
-	},
-	"temperature-sensor": {
-		label: "Temperature",
-		addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.TemperatureSensor, name, subtype),
-		getStatus: (proxy) => proxy.temperatureSensor?.getStatus({}),
-		subscribe: (proxy, onValue) => proxy.state.temperatureSensor?.subscribe(onValue) ?? null,
-		read: reader(TemperatureSensorStatusSchema.pick({ celsius: true }), (status) => [{
-			characteristic: import_dist.Characteristic.CurrentTemperature,
-			value: status.celsius
-		}])
-	},
-	"humidity-sensor": {
-		label: "Humidity",
-		addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.HumiditySensor, name, subtype),
-		getStatus: (proxy) => proxy.humiditySensor?.getStatus({}),
-		subscribe: (proxy, onValue) => proxy.state.humiditySensor?.subscribe(onValue) ?? null,
-		read: reader(HumiditySensorStatusSchema.pick({ percent: true }), (status) => [{
-			characteristic: import_dist.Characteristic.CurrentRelativeHumidity,
-			value: status.percent
-		}])
-	},
-	"ambient-light-sensor": {
-		label: "Light level",
-		addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.LightSensor, name, subtype),
-		getStatus: (proxy) => proxy.ambientLightSensor?.getStatus({}),
-		subscribe: (proxy, onValue) => proxy.state.ambientLightSensor?.subscribe(onValue) ?? null,
-		read: reader(AmbientLightSensorStatusSchema.pick({ lux: true }), (status) => [{
-			characteristic: import_dist.Characteristic.CurrentAmbientLightLevel,
-			value: Math.max(MIN_LUX, status.lux)
-		}])
+async function buildCameraAccessory(input) {
+	const { ctx, deviceId, displayName, options } = input;
+	const numericId = Number.parseInt(deviceId, 10);
+	if (!Number.isFinite(numericId)) throw new Error(`export-hap: cannot map device '${deviceId}' — id is not numeric`);
+	const proxy = await ctx.fetchDevice(numericId);
+	const capNames = new Set(proxy.binding?.entries.map((e) => e.capName) ?? []);
+	const isDoorbell = capNames.has("doorbell");
+	const category = isDoorbell ? import_dist.Categories.VIDEO_DOORBELL : import_dist.Categories.IP_CAMERA;
+	const accessory = new import_dist.Accessory(displayName, accessoryUuidFor("camera", numericId));
+	accessory.category = category;
+	await populateAccessoryInfo(accessory, proxy, displayName, "Camera");
+	const bctx = {
+		ctx,
+		accessory,
+		proxy,
+		numericDeviceId: numericId,
+		displayName,
+		options
+	};
+	const advertisedVideo = await probeAdvertisedVideoProfile(bctx);
+	const streams = buildCameraStreamingDelegate(bctx, advertisedVideo);
+	const handles = [];
+	if (capNames.has("intercom")) handles.push(await buildIntercom({
+		bctx,
+		streamingOptions: streams.streamingOptions
+	}));
+	const recordingEnabled = options.hapDeviceSettings.hksvRecording === true;
+	let recordingAudioActive = true;
+	const recording = recordingEnabled ? await buildHksvRecording({
+		bctx,
+		fpsByProfile: advertisedVideo.fpsByProfile,
+		isAudioActive: () => recordingAudioActive
+	}) : null;
+	const controller = new (isDoorbell ? import_dist.DoorbellController : import_dist.CameraController)({
+		delegate: streams.delegate,
+		streamingOptions: streams.streamingOptions,
+		cameraStreamCount: 2,
+		...recording === null ? {} : { recording },
+		...recording === null || !capNames.has("motion-detection") ? {} : { sensors: { motion: true } }
+	});
+	accessory.configureController(controller);
+	if (options.hapDeviceSettings.multiTierService !== false) {
+		const sensor = advertisedVideo.sensor;
+		const services = buildMultiTierServices({
+			deviceId: numericId,
+			logger: ctx.logger,
+			width: sensor.width,
+			height: sensor.height,
+			codec: sensor.codec,
+			audioCaptureRateHz: 16e3,
+			negotiation: buildMultiTierNegotiation({
+				deviceId: numericId,
+				logger: ctx.logger,
+				negotiator: streams.negotiator,
+				tiers: tiersForSensor(sensor.width, sensor.height),
+				codec: sensor.codec
+			})
+		});
+		accessory.addService(services.capabilities);
+		accessory.addService(services.globalOperatingMode);
+		accessory.addService(services.streamManagement);
+		ctx.logger.info("hap multi-tier: services declared on this accessory", {
+			tags: { deviceId: numericId },
+			meta: {
+				serviceUuid: MULTI_TIER_RTP_SERVICE_UUID,
+				codec: sensor.codec === TierVideoCodec.H265 ? "h265" : "h264",
+				sensor: `${sensor.width}x${sensor.height}`
+			}
+		});
 	}
-};
-/**
-* The `battery` row reads like a sensor but writes three characteristics from
-* one status, and the camera path publishes the SAME service from the same cap.
-* The derivation therefore lives once, in `battery.ts`, and both callers read
-* it from there.
-*/
-var BATTERY_SPEC = {
-	label: "Battery",
-	addService: (accessory, name, subtype) => accessory.addService(import_dist.Service.Battery, name, subtype),
-	getStatus: (proxy) => proxy.battery?.getStatus({}),
-	subscribe: (proxy, onValue) => proxy.state.battery?.subscribe(onValue) ?? null,
-	read: batteryCharacteristicUpdates
-};
-function sensorRow(capName, spec) {
+	if (recording !== null) {
+		handles.push({ dispose: () => recording.dispose() });
+		const audioCharacteristic = (controller.recordingManagement?.operatingModeService)?.getCharacteristic(import_dist.Characteristic.RecordingAudioActive);
+		if (audioCharacteristic) {
+			recordingAudioActive = audioCharacteristic.value !== 0 && audioCharacteristic.value !== false;
+			audioCharacteristic.on("change", ({ newValue }) => {
+				recordingAudioActive = newValue !== 0 && newValue !== false;
+			});
+		}
+	}
+	if (capNames.has("motion-detection")) handles.push(await buildMotionSensor(bctx, recording === null ? null : controller.motionService ?? null));
+	if (isDoorbell && controller instanceof import_dist.DoorbellController) handles.push(await buildDoorbell({
+		bctx,
+		controller
+	}));
+	if (capNames.has("ptz") || capNames.has("ptz-autotrack")) handles.push(await buildPtz(bctx));
+	if (capNames.has("battery")) handles.push(await buildBattery(bctx));
+	if (capNames.has("privacy-mask")) handles.push(await buildPrivacySwitch(bctx));
+	handles.push(await buildChildServicesFor({ parentCtx: bctx }));
 	return {
-		caps: [capName],
-		label: spec.label,
-		build: ({ bctx, name }) => buildSensorService({
-			bctx,
-			spec,
-			name,
-			subtype: capName
-		})
+		accessory,
+		accessories: [accessory],
+		async dispose() {
+			const log = ctx.logger.withTags({ deviceId: numericId });
+			for (const h of handles) try {
+				await h.dispose();
+			} catch (err) {
+				log.debug("export-hap: builder dispose failed (continuing)", { meta: { error: errMsg$2(err) } });
+			}
+			try {
+				await streams.dispose();
+			} catch (err) {
+				log.debug("export-hap: streams dispose failed", { meta: { error: errMsg$2(err) } });
+			}
+		}
 	};
 }
-/**
-* THE table. Order matters only for one thing: the first row that matches a
-* device decides the accessory's category when the device's own type does not.
-*/
-var HAP_CAP_SERVICES = [
-	{
-		caps: ["switch", "brightness"],
-		label: "Power",
-		build: ({ bctx, name, deviceType }) => buildChildSwitch({
-			...bctx,
-			displayName: name
-		}, "switch", deviceType)
-	},
-	{
-		caps: ["lock-control"],
-		label: "Lock",
-		build: ({ bctx, name }) => buildLockMechanism({
-			...bctx,
-			displayName: name
-		})
-	},
-	{
-		caps: ["alarm-panel"],
-		label: "Alarm",
-		build: ({ bctx, name }) => buildSecuritySystem({
-			...bctx,
-			displayName: name
-		})
-	},
-	{
-		caps: ["battery"],
-		label: BATTERY_SPEC.label,
-		build: ({ bctx, name }) => buildSensorService({
-			bctx,
-			spec: BATTERY_SPEC,
-			name,
-			subtype: "battery"
-		})
-	},
-	...Object.entries(SENSOR_SPECS).map(([capName, spec]) => sensorRow(capName, spec))
-];
-/**
-* The rows a device's bound capabilities select, in table order.
-*
-* A row matches when ANY of its caps is bound: a lamp with `switch` but no
-* `brightness` is still a Lightbulb-shaped row, and the builder degrades on its
-* own.
-*/
-function rowsForCaps(capNames) {
-	return HAP_CAP_SERVICES.filter((row) => row.caps.some((cap) => capNames.has(cap)));
-}
-/**
-* The HomeKit accessory category per camstack device type — the icon iOS Home
-* draws and nothing else. Absent = `OTHER`, which is a valid accessory that
-* simply gets the generic tile.
-*
-* This is NOT a coverage decision. `HAP_EXPORTABLE_DEVICE_TYPES` (in
-* `mappers/index.ts`) filters the picker; whether a device exports anything is
-* decided by `rowsForCaps`.
-*/
-var ACCESSORY_CATEGORY_BY_TYPE = {
-	[DeviceType.Switch]: import_dist.Categories.SWITCH,
-	[DeviceType.Light]: import_dist.Categories.LIGHTBULB,
-	[DeviceType.Siren]: import_dist.Categories.SWITCH,
-	[DeviceType.Lock]: import_dist.Categories.DOOR_LOCK,
-	[DeviceType.Sensor]: import_dist.Categories.SENSOR,
-	[DeviceType.Presence]: import_dist.Categories.SENSOR,
-	[DeviceType.AlarmPanel]: import_dist.Categories.SECURITY_SYSTEM
-};
-function accessoryCategoryFor(deviceType) {
-	return ACCESSORY_CATEGORY_BY_TYPE[deviceType] ?? import_dist.Categories.OTHER;
+function errMsg$2(err) {
+	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
 //#region src/mappers/generic-accessory.ts
@@ -105034,118 +106424,6 @@ function getMapperFactory(kind) {
 	return factory;
 }
 //#endregion
-//#region src/mappers/builders/stream-hwaccel-memo.ts
-/**
-* The two bounded memos HomeKit's decode path owns.
-*
-* ## Why they exist
-*
-* Everything D67 was actually about — one argv builder, one set of constants,
-* one hwaccel authority — HomeKit already had. What it did NOT have were the
-* two things the broker gained alongside them:
-*
-*  1. **A memo.** `probeDecoderHwaccel` issued a cross-process
-*     `decoder.getInfo` per SESSION. iOS starts sessions in bursts — one on
-*     record was started three times in 16 s — and every one of those paid a
-*     cap call on a hub whose main thread is the scarce resource.
-*  2. **Failure feedback.** When HomeKit's hardware child died at init and
-*     `shouldRetryInSoftware` saved the session, HomeKit told nobody. The next
-*     session re-picked the same corpse and paid the same two-second death.
-*     `EgressTranscodeManager` fixed exactly this for its own children
-*     (26a522cd5) by reporting the dead backend into the broker's 60 s memo.
-*
-* ## Both ride `HwAccelCache`, deliberately
-*
-* `createHwAccelCache` from `@camstack/types` is the primitive the broker's own
-* `egressHwAccelCache` is built from, and the discipline it encodes is the
-* point: **caller-owned, never a module global** — a module global would
-* outlive an addon respawn and survive an operator changing the decoder
-* backend. Same TTL as the broker's, so "has hardware come back yet" cannot
-* answer differently depending on which consumer asked.
-*
-* ## The cross-process gap, stated honestly
-*
-* These memos are scoped to the `export-hap` PROCESS. When HomeKit's vaapi
-* child dies, the broker's next child still pays its own two-second death, and
-* vice versa — because addons may never import each other and there is no
-* capability for "this backend is dead on this node right now". Closing that
-* would need a new cap surface, which Phase 0 explicitly does not take. What is
-* closed here is HomeKit's own repetition of the cost, across cameras and
-* across sessions.
-*/
-/**
-* The window both memos answer for.
-*
-* 60 s, the same as `stream-broker-manager`'s `egressHwAccelCache`. Long enough
-* that a burst of session restarts pays one read; short enough that an operator
-* who changes the decoder backend, or a host whose accelerator recovers, is
-* obeyed on the next session rather than after an addon respawn.
-*/
-var HAP_DECODE_MEMO_TTL_MS = 6e4;
-/**
-* Separator inside the encoded reading. A control character, because a backend
-* name is `[a-z0-9]+` and the decoder's non-backend choices are `auto` /
-* `none` / `''`, none of which can contain one — so the split is total.
-*/
-var READING_SEPARATOR = "
";
-/**
-* Marks a `null` FIELD, distinct from an EMPTY one.
-*
-* `probedBestHwaccel: ''` means the decoder answered and has never probed
-* (=> `not-probed`); `null` means the field was absent altogether. Encoding
-* both as `''` would lose a distinction `selectHwDecode` acts on.
-*/
-var NULL_FIELD = "\0";
-function encodeField(value) {
-	return value === null ? NULL_FIELD : value;
-}
-function decodeField(value) {
-	return value === NULL_FIELD ? null : value;
-}
-/**
-* A reading as ONE `string | null`, which is what {@link HwAccelCache} stores.
-*
-* The cache's three states are exactly the three a memoised reading needs:
-* `undefined` (never asked, or expired), `null` (asked, and the decoder could
-* not be reached), and a value. Encoding into the one cache rather than
-* splitting across two is what keeps those three from skewing — two caches
-* written together can still be READ across an expiry boundary.
-*/
-function encodeDecoderReading(reading) {
-	if (reading === null) return null;
-	return `${encodeField(reading.hwaccel)}${READING_SEPARATOR}${encodeField(reading.probedBestHwaccel)}`;
-}
-function decodeDecoderReading(value) {
-	if (value === null) return null;
-	const [hwaccel = NULL_FIELD, probed = NULL_FIELD] = value.split(READING_SEPARATOR);
-	return {
-		hwaccel: decodeField(hwaccel),
-		probedBestHwaccel: decodeField(probed)
-	};
-}
-function createDecoderReadingMemo(options) {
-	const cache = createHwAccelCache(options);
-	return {
-		read() {
-			const cached = cache.read();
-			return cached === void 0 ? void 0 : decodeDecoderReading(cached);
-		},
-		write(reading) {
-			cache.write(encodeDecoderReading(reading));
-		}
-	};
-}
-function createHapDecodeMemos(now) {
-	const options = {
-		ttlMs: HAP_DECODE_MEMO_TTL_MS,
-		...now ? { now } : {}
-	};
-	return {
-		reading: createDecoderReadingMemo(options),
-		failedBackend: createHwAccelCache(options)
-	};
-}
-//#endregion
 //#region src/reconcile/sync-state.ts
 function syncStateFromJson(json) {
 	const map = /* @__PURE__ */ new Map();
@@ -105331,6 +106609,16 @@ var ExportHapAddon = class extends BaseAddon {
 	*/
 	decodeMemos = createHapDecodeMemos();
 	/**
+	* Where HomeKit's own clips are kept.
+	*
+	* ONE per addon: HomeKit Secure Video is a SINK — HAP has no read-back, so a
+	* clip is ours only if we kept a copy of what we SENT — and the copy has to
+	* be pruned against bounds that span every camera, which a per-camera store
+	* could not see. Created at boot rather than lazily so the directory's
+	* failure to exist is one line at boot and not a surprise mid-recording.
+	*/
+	hksvClipStore = null;
+	/**
 	* THE bridge. Lazily created and published the first time a non-camera
 	* accessory needs it; never torn down while the addon runs, because an
 	* unpublish would drop a pairing the operator already entered a code for.
@@ -105356,6 +106644,14 @@ var ExportHapAddon = class extends BaseAddon {
 			this.lastError = errMsg(err);
 			this.ctx.logger.error("export-hap: HAP storage init failed", { meta: { error: this.lastError } });
 		}
+		this.hksvClipStore = new HksvClipStore({
+			logger: this.ctx.logger.child("hksv-clips"),
+			rootDir: path.join(this.ctx.dataDir, CLIP_DIR_NAME),
+			mintThumbnail: createClipThumbnailMinter({ runner: createFfmpegClipThumbnailRunner({
+				ffmpegBinaryPath: "ffmpeg",
+				spawnFn: spawn
+			}) })
+		});
 		const validKinds = new Set(SUPPORTED_MAPPER_KINDS);
 		const cleaned = this.config.exposed.filter((entry) => {
 			if (validKinds.has(entry.mapperKind)) return true;
@@ -105548,6 +106844,7 @@ var ExportHapAddon = class extends BaseAddon {
 			options: {
 				ptzPulseMs: this.config.ptzPulseMs,
 				decodeMemos: this.decodeMemos,
+				hksvClipStore: this.hksvClipStore,
 				hapDeviceSettings: {
 					streamPreference: entrySettings.streamPreference ?? "auto",
 					hksvRecording: resolveHksvRecording(entrySettings),