@camstack/addon-pipeline 1.2.131 → 1.2.133

package/dist/recorder/index.js

@@ -1,7 +1,7 @@
-const require_dist = require("../dist-CqoMNE1e.js");
+const require_dist = require("../dist-DsnZUYTs.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
-const require_addon_utils = require("../addon-utils-DCQ5AP_v.js");
+const require_addon_utils = require("../addon-utils-FV2O25id.js");
 const require_retire_root_keys = require("../retire-root-keys-KE6D6Xh_.js");
 let node_crypto = require("node:crypto");
 let node_child_process = require("node:child_process");
@@ -33,6 +33,185 @@ function subscribeEventCapture(deps) {
 	});
 }
 //#endregion
+//#region src/recorder/object-trigger.ts
+/**
+* Il gate fra `pipeline-analytics.detection-event` e "apri una finestra di
+* registrazione".
+*
+* Fratello di `recorder/event-capture.ts` e per lo stesso motivo: la qualifica
+* ha dei rami, e un ramo che scarta lavoro senza dirlo è indistinguibile da una
+* funzione mai cablata. Ogni verdetto negativo NOMINA il motivo, e il chiamante
+* lo logga.
+*
+* Puro: nessun bus, nessun orologio, nessuna config. La scelta di QUALI classi
+* ascoltare è della banda (`bandTriggerSources`); qui si decide solo se
+* l'evento è una detection utilizzabile e di che macro classe è.
+*/
+/** Type guard, non cast: `event.data` è `unknown` finché non passa di qui. */
+function isDetectionEventData(value) {
+	if (typeof value !== "object" || value === null) return false;
+	if (!("deviceId" in value) || typeof value.deviceId !== "number") return false;
+	if (!("kind" in value) || typeof value.kind !== "string") return false;
+	if (!("timestamp" in value) || typeof value.timestamp !== "number") return false;
+	if (!Number.isFinite(value.timestamp) || value.timestamp <= 0) return false;
+	if (!("className" in value) || typeof value.className !== "string") return false;
+	if ("source" in value && value.source !== void 0 && typeof value.source !== "string") return false;
+	return true;
+}
+function qualifyObjectTrigger(data) {
+	if (!isDetectionEventData(data)) return {
+		qualified: false,
+		reason: "malformed"
+	};
+	if (data.kind !== "object") return {
+		qualified: false,
+		reason: "not-object"
+	};
+	if ((data.source ?? "pipeline") !== "pipeline") return {
+		qualified: false,
+		reason: "not-pipeline"
+	};
+	const className = data.className.trim().toLowerCase();
+	if (!require_dist.isFirstLevelMacroClass(className)) return {
+		qualified: false,
+		reason: "not-a-macro"
+	};
+	return {
+		qualified: true,
+		deviceId: data.deviceId,
+		macroClass: className,
+		atMs: data.timestamp
+	};
+}
+//#endregion
+//#region src/recorder/sensor-trigger.ts
+/**
+* Da `DeviceStateChanged` a "quali camere devono registrare".
+*
+* Due responsabilità, entrambe in RAM e nessuna durevole:
+*  - la MEMORIA del fronte, per `(deviceId, capName)`, che rende `false→true`
+*    distinguibile da una ri-emissione. Il predicato è `evaluateSensorEdge`
+*    (`@camstack/types`) — la stessa tabella `SOURCE_CAP_ACTIVE_FIELD` del
+*    virtual-doorbell, non una copia;
+*  - l'INDICE INVERSO sorgente→camere, uno stato rispecchiato aggiornato FUORI
+*    dal percorso dell'evento (D49): `setBindings` è chiamato al boot dalle
+*    config già lette e a ogni `onConfigChanged`, che è un'RPC. Una lettura
+*    fallibile sul percorso del trigger potrebbe rispondere "nessuno ascolta"
+*    e perdere l'episodio, che è il fallimento contro cui D49 è scritta.
+*
+* L'ordine dei controlli è deliberato: `DeviceStateChanged` viaggia a ritmo di
+* bus su tutta la flotta (batteria, la `motion` nativa di ogni camera, la
+* connettività). L'indice inverso è una `Map.get` senza allocazioni e va per
+* primo; il fronte — che legge due tabelle e la slice — viene dopo. È la stessa
+* scelta che post-analysis scrive per la sua sottoscrizione: *"the
+* EVENT_KIND_BY_CAP gate runs FIRST so non-sensor cap churn exits before any
+* async work"*.
+*
+* Puro rispetto al mondo: nessun bus, nessun logger, nessun orologio proprio.
+* Il chiamante logga il verdetto — un ramo che non accende nulla lo DICE.
+*/
+/**
+* Type GUARD, not a cast: `event.data` is `unknown`, and a version-skewed
+* emitter must leave this router untouched rather than route a `deviceId` of
+* `undefined`. Same discipline as `parseTopologySnapshotNodes`.
+*
+* A missing or non-object `slice` is REFUSED rather than defaulted to `{}`:
+* `evaluateSensorEdge` would read `non-boolean-value` from an empty object and
+* that would look like a sensor reporting nonsense, when what actually
+* happened is that there was nothing to read.
+*/
+function parseSensorStateChanged(data) {
+	if (typeof data !== "object" || data === null) return null;
+	if (!("deviceId" in data) || typeof data.deviceId !== "number") return null;
+	if (!("capName" in data) || typeof data.capName !== "string") return null;
+	if (!("slice" in data) || typeof data.slice !== "object" || data.slice === null) return null;
+	const slice = { ...data.slice };
+	return {
+		deviceId: data.deviceId,
+		capName: data.capName,
+		slice
+	};
+}
+/**
+* sourceDeviceId → cameras whose config names it.
+*
+* From EVERY band, not only the one active now: the index only changes on a
+* config write, while the active band changes with the clock, and an index
+* that followed the clock would lose the first trigger after every band edge.
+* Filtering by band is already the gate's job — `bandTriggerSources` reads the
+* band active at the instant of evaluation.
+*
+* A disabled camera is skipped: it records nothing whatever a sensor does, and
+* it re-enters through `onConfigChanged`, which rebuilds this.
+*/
+function buildSensorTriggerBindings(configs) {
+	const index = /* @__PURE__ */ new Map();
+	for (const [cameraId, config] of configs) {
+		if (config.enabled !== true) continue;
+		for (const band of config.bands ?? []) for (const sourceDeviceId of band.triggers?.sensorDeviceIds ?? []) {
+			const cameras = index.get(sourceDeviceId) ?? /* @__PURE__ */ new Set();
+			cameras.add(cameraId);
+			index.set(sourceDeviceId, cameras);
+		}
+	}
+	return index;
+}
+var SensorTriggerRouter = class {
+	/** sourceDeviceId → camere la cui config lo nomina. */
+	bindings = /* @__PURE__ */ new Map();
+	/** Ultimo booleano osservato, per `${deviceId}:${capName}`. */
+	lastValues = /* @__PURE__ */ new Map();
+	now;
+	startedAtMs;
+	freshnessMs;
+	constructor(options) {
+		this.now = options.now;
+		this.startedAtMs = options.startedAtMs;
+		this.freshnessMs = options.firstSightingFreshnessMs ?? 3e4;
+	}
+	/**
+	* Sostituisce l'indice inverso. NON tocca `lastValues`: un sensore tolto e
+	* rimesso in una banda deve ritrovare il suo livello precedente, altrimenti
+	* la prima slice dopo il rientro sarebbe una "prima osservazione" e un
+	* contatto rimasto aperto tutto il tempo diventerebbe un fronte alto.
+	*/
+	setBindings(bindings) {
+		this.bindings = bindings;
+	}
+	/** Quali sorgenti l'indice contiene ora — per la riga di log al boot. */
+	listenedSourceIds() {
+		return [...this.bindings.keys()];
+	}
+	onStateSlice(deviceId, capName, slice) {
+		const cameras = this.bindings.get(deviceId);
+		if (cameras === void 0 || cameras.size === 0) return {
+			fired: [],
+			skipped: "not-listened"
+		};
+		const key = `${deviceId}:${capName}`;
+		const verdict = require_dist.evaluateSensorEdge({
+			capName,
+			slice,
+			prior: this.lastValues.get(key),
+			startedAtMs: this.startedAtMs,
+			nowMs: this.now(),
+			firstSightingFreshnessMs: this.freshnessMs
+		});
+		if (verdict.edge === "none") {
+			if (verdict.value !== null) this.lastValues.set(key, verdict.value);
+			return {
+				fired: [],
+				skipped: verdict.reason
+			};
+		}
+		this.lastValues.set(key, true);
+		return {
+			fired: [...cameras],
+			skipped: null
+		};
+	}
+};
+//#endregion
 //#region src/recorder/event-map.ts
 var EventMap = class {
 	byDevice = /* @__PURE__ */ new Map();
@@ -350,8 +529,13 @@ function fragmentRangeFor(index, offsetTicks) {
 * "nothing to read" (D49's letter, applied to a byte budget: a fallible
 * computation must never silently look like an unbind).
 */
-function fragmentsWithinBudget(index, offsetTicks, maxBytes) {
-	const { samples, mfraOffset } = index;
+/**
+* The last sync sample at or before `offsetTicks` — the keyframe a decoder
+* must start from. Shared by {@link fragmentsWithinBudget} and
+* {@link fragmentsInWindow}: both walk forward from the same anchor, they
+* only differ in the condition that stops the walk.
+*/
+function findAnchor(samples, offsetTicks) {
 	let lo = 0;
 	let hi = samples.length - 1;
 	let anchor = 0;
@@ -364,6 +548,11 @@ function fragmentsWithinBudget(index, offsetTicks, maxBytes) {
 			lo = mid + 1;
 		} else hi = mid - 1;
 	}
+	return anchor;
+}
+function fragmentsWithinBudget(index, offsetTicks, maxBytes) {
+	const { samples, mfraOffset } = index;
+	const anchor = findAnchor(samples, offsetTicks);
 	const endOf = (i) => samples[i + 1]?.moofOffset ?? mfraOffset;
 	const anchorStart = samples[anchor]?.moofOffset ?? 0;
 	const anchorEnd = endOf(anchor);
@@ -400,6 +589,70 @@ function fragmentsWithinBudget(index, offsetTicks, maxBytes) {
 		oversizeFragment
 	};
 }
+/**
+* Convert a TIME WINDOW `[fromTicks, toTicks)` into the set of consecutive
+* fragments that covers it — the replay's primitive for "give me this many
+* seconds of one segment", as opposed to {@link fragmentsWithinBudget}'s
+* "give me as much as fits in N bytes" (the scrub GOP read's primitive).
+*
+* Stops walking forward the instant the NEXT fragment's own start time
+* already reaches `toTicks`: at that point the fragments already collected
+* cover the whole window, because each fragment's coverage runs up to the
+* next one's start (the same relationship {@link fragmentsWithinBudget}'s
+* `endOf` encodes). `maxBytes` is a SAFETY CEILING, not the primary stop
+* condition — a caller with a well-formed window is expected to hit the time
+* condition first; the byte cap exists so a pathological request cannot pull
+* an unbounded amount of one segment into memory.
+*
+* Same never-empty guarantee as {@link fragmentsWithinBudget}: the anchor
+* fragment is always returned, even when it alone exceeds `maxBytes`.
+*/
+function fragmentsInWindow(index, fromTicks, toTicks, maxBytes) {
+	const { samples, mfraOffset } = index;
+	const anchor = findAnchor(samples, fromTicks);
+	const endOf = (i) => samples[i + 1]?.moofOffset ?? mfraOffset;
+	const windowCoveredAt = (i) => {
+		const next = samples[i + 1];
+		return next === void 0 || next.timeTicks >= toTicks;
+	};
+	const anchorStart = samples[anchor]?.moofOffset ?? 0;
+	const anchorEnd = endOf(anchor);
+	const fragments = [{
+		start: anchorStart,
+		end: anchorEnd,
+		sampleIndex: anchor
+	}];
+	let total = anchorEnd - anchorStart;
+	const oversizeFragment = total > maxBytes;
+	let i = anchor;
+	let reachesWindowEnd = windowCoveredAt(i);
+	while (!reachesWindowEnd) {
+		const nextIndex = i + 1;
+		const nextSample = samples[nextIndex];
+		if (nextSample === void 0) break;
+		const nextStart = nextSample.moofOffset;
+		const nextEnd = endOf(nextIndex);
+		const nextSize = nextEnd - nextStart;
+		if (total + nextSize > maxBytes) break;
+		fragments.push({
+			start: nextStart,
+			end: nextEnd,
+			sampleIndex: nextIndex
+		});
+		total += nextSize;
+		i = nextIndex;
+		reachesWindowEnd = windowCoveredAt(i);
+	}
+	const last = fragments[fragments.length - 1];
+	return {
+		fragments,
+		start: fragments[0].start,
+		end: last.end,
+		reachesSegmentEnd: last.end >= mfraOffset,
+		reachesWindowEnd,
+		oversizeFragment
+	};
+}
 //#endregion
 //#region src/recorder/mfra-capture.ts
 /**
@@ -4440,6 +4693,34 @@ var SCRUB_GOP_BUDGET_MAX_BYTES = 15e5;
 function ticksToMs(ticks, timescale) {
 	return Math.round(ticks / timescale * 1e3);
 }
+/** ms → ticks on the video timescale — the inverse of {@link ticksToMs}. */
+function msToTicks(ms, timescale) {
+	return ms / 1e3 * timescale;
+}
+/**
+* Steps 1-2 shared by {@link readGopRange} and {@link readGopWindowRange}:
+* locate the `mfra` (seeded or from the tail), read the `ftyp`+`moov` head,
+* and pick the VIDEO track's sync table (never the audio one, which lists
+* every `moof` and would send a seek to bytes that do not open a GOP).
+* `null` on anything that does not look like a recorded segment.
+*/
+async function resolveSegmentIndex(file, seededIndex, read) {
+	const parsed = seededIndex === void 0 ? await parseTail(file, read) : null;
+	if (seededIndex === void 0 && parsed === null) return null;
+	const index = seededIndex ?? parsed.index;
+	const firstMoof = index.samples[0]?.moofOffset ?? 0;
+	if (firstMoof <= 0 || firstMoof >= file.size) return null;
+	const head = await read(0, firstMoof);
+	const init = parseInitInfo(head);
+	if (init === null) return null;
+	const videoIndex = index.trackId === init.videoTrackId ? index : parsed === null ? null : reparseTail(parsed.tail, file.size, init.videoTrackId);
+	if (videoIndex === null) return null;
+	return {
+		head,
+		init,
+		videoIndex
+	};
+}
 /**
 * Read the single GOP covering `epochMs` from `file`, by byte range.
 *
@@ -4455,17 +4736,10 @@ async function readGopRange(file, args) {
 		bytesRead += chunk.length;
 		return chunk;
 	};
-	const parsed = args.seededIndex === void 0 ? await parseTail(file, read) : null;
-	if (args.seededIndex === void 0 && parsed === null) return null;
-	const index = args.seededIndex ?? parsed.index;
-	const firstMoof = index.samples[0]?.moofOffset ?? 0;
-	if (firstMoof <= 0 || firstMoof >= file.size) return null;
-	const head = await read(0, firstMoof);
-	const init = parseInitInfo(head);
-	if (init === null) return null;
-	const videoIndex = index.trackId === init.videoTrackId ? index : parsed === null ? null : reparseTail(parsed.tail, file.size, init.videoTrackId);
-	if (videoIndex === null) return null;
-	const offsetTicks = Math.max(0, args.epochMs - args.segmentStartMs) / 1e3 * init.videoTimescale;
+	const resolved = await resolveSegmentIndex(file, args.seededIndex, read);
+	if (resolved === null) return null;
+	const { head, init, videoIndex } = resolved;
+	const offsetTicks = msToTicks(Math.max(0, args.epochMs - args.segmentStartMs), init.videoTimescale);
 	let start;
 	let end;
 	let firstSampleIndex;
@@ -4510,6 +4784,49 @@ async function readGopRange(file, args) {
 	};
 }
 /**
+* Read the fragments covering `[fromMs, toMs)` from `file`, by byte range —
+* the WINDOW twin of {@link readGopRange}'s single instant. Same shape, same
+* standalone-demuxable `ftyp`+`moov` head, same `null`-on-unparseable
+* contract; the only difference is the stop condition
+* ({@link fragmentsInWindow} instead of {@link fragmentRangeFor} /
+* {@link fragmentsWithinBudget}).
+*/
+async function readGopWindowRange(file, args) {
+	let bytesRead = 0;
+	const read = async (offset, length) => {
+		const chunk = await file.read(offset, length);
+		bytesRead += chunk.length;
+		return chunk;
+	};
+	const resolved = await resolveSegmentIndex(file, args.seededIndex, read);
+	if (resolved === null) return null;
+	const { head, init, videoIndex } = resolved;
+	const fromOffsetMs = Math.max(0, args.fromMs - args.segmentStartMs);
+	const toOffsetMs = Math.max(fromOffsetMs, args.toMs - args.segmentStartMs);
+	const plan = fragmentsInWindow(videoIndex, msToTicks(fromOffsetMs, init.videoTimescale), msToTicks(toOffsetMs, init.videoTimescale), args.maxBytes);
+	const { start, end } = plan;
+	if (start <= 0 || end <= start || end > file.size) return null;
+	const fragment = await read(start, end - start);
+	const firstSampleIndex = plan.fragments[0].sampleIndex;
+	const lastSampleIndex = plan.fragments[plan.fragments.length - 1].sampleIndex;
+	const startTicks = videoIndex.samples[firstSampleIndex]?.timeTicks ?? 0;
+	const nextTicks = videoIndex.samples[lastSampleIndex + 1]?.timeTicks;
+	const gopStartOffsetMs = ticksToMs(startTicks, init.videoTimescale);
+	const gopDurMs = nextTicks !== void 0 ? ticksToMs(nextTicks - startTicks, init.videoTimescale) : Math.max(1, args.segmentDurMs - gopStartOffsetMs);
+	const data = new Uint8Array(head.length + fragment.length);
+	data.set(head, 0);
+	data.set(fragment, head.length);
+	return {
+		data,
+		gopStartMs: args.segmentStartMs + gopStartOffsetMs,
+		gopDurMs,
+		bytesRead,
+		reachesSegmentEnd: plan.reachesSegmentEnd,
+		reachesWindowEnd: plan.reachesWindowEnd,
+		oversizeFragment: plan.oversizeFragment
+	};
+}
+/**
 * Fetch + parse the `mfra` tail, honouring `MfraParseError.needBytes` with ONE
 * widened retry. Null on anything else — bytes that are not a segment.
 */
@@ -4801,6 +5118,16 @@ var RANGE_MERGE_GAP_MS = 5e3;
 * hour but covers the requested epoch is hydrated too. Recorder segments are
 * currently much shorter; the margin keeps this boundary future-safe. */
 var LOCATE_HYDRATE_MARGIN_MS = 6e4;
+/**
+* Safety ceiling for one `readWindowBytes` answer — NOT the primary stop
+* condition (the requested `toMs` is; see `fragmentsInWindow` in
+* `mfra-index.ts`). Sized off `high`'s own bandwidth hint above
+* (`PROFILE_BANDWIDTH.high` = 4 Mbps = 500 000 B/s): a 30 s replay window at
+* that rate is ~15 MB, so 20 MB covers it with headroom while still bounding
+* a pathological request. A window this call actually truncates is reported
+* (`reachesRequestedEnd: false`) rather than silently shortened.
+*/
+var WINDOW_READ_MAX_BYTES = 2e7;
 /** Empty "no playback" manifest. */
 function noPlayback(deviceId) {
 	return {
@@ -5318,6 +5645,76 @@ function buildRecordingProvider(deps) {
 				gopDurMs: seg.durMs
 			};
 		},
+		readWindowBytes: async ({ deviceId, profile, startMs, fromMs, toMs }) => {
+			const { abs, seg } = resolveSegmentFile(deps, deviceId, profile, startMs);
+			const segmentEndMs = seg.startMs + seg.durMs;
+			if (toMs > segmentEndMs) {
+				deps.logger.warn("recording: readWindowBytes refused — window runs past this segment, not silently clipped", {
+					tags: { deviceId },
+					meta: {
+						profile,
+						startMs,
+						fromMs,
+						toMs,
+						segmentEndMs
+					}
+				});
+				return {
+					kind: "spans-multiple-segments",
+					segmentEndMs
+				};
+			}
+			const file = await (deps.openRangeReadable ?? openRangeFromDisk)(abs, seg.bytes);
+			try {
+				const gop = await readGopWindowRange(file, {
+					segmentStartMs: seg.startMs,
+					segmentDurMs: seg.durMs,
+					fromMs,
+					toMs,
+					seededIndex: deps.mfraFor?.(deviceId, profile, startMs),
+					maxBytes: WINDOW_READ_MAX_BYTES
+				});
+				if (gop !== null) {
+					if (gop.reachesWindowEnd !== true) deps.logger.warn("recording: readWindowBytes truncated by its safety byte cap before covering the requested window", {
+						tags: { deviceId },
+						meta: {
+							profile,
+							startMs,
+							fromMs,
+							toMs,
+							bytes: gop.data.length,
+							WINDOW_READ_MAX_BYTES
+						}
+					});
+					return {
+						kind: "ok",
+						data: gop.data,
+						gopStartMs: gop.gopStartMs,
+						gopDurMs: gop.gopDurMs,
+						reachesRequestedEnd: gop.reachesWindowEnd === true
+					};
+				}
+			} finally {
+				await file.close();
+			}
+			deps.logger.warn("recording: readWindowBytes fell back to the WHOLE segment (mfra/moov unparseable)", {
+				tags: { deviceId },
+				meta: {
+					profile,
+					startMs,
+					fromMs,
+					toMs
+				}
+			});
+			const data = await readFile(abs);
+			return {
+				kind: "ok",
+				data: Uint8Array.from(data),
+				gopStartMs: seg.startMs,
+				gopDurMs: seg.durMs,
+				reachesRequestedEnd: true
+			};
+		},
 		setDeviceConfig: async ({ deviceId, config }) => {
 			const saved = await saveDeviceConfig(deps.configStore, deviceId, config);
 			if (deps.onConfigChanged) try {
@@ -7525,17 +7922,47 @@ function eventsBandCanEverDemand(band) {
 	return bandTriggerSources(band).length > 0 && resolveBandBufferMs(band).postMs > 0;
 }
 /**
+* La chiave sotto cui una sorgente conserva le sue finestre. È anche la stringa
+* che compare nei log — quattro sorgenti che aprono la stessa finestra senza
+* dire chi è stato rendono impossibile rispondere a "perché questa camera
+* registra tanto" — quindi è leggibile per progetto.
+*/
+function triggerKey(source) {
+	switch (source.kind) {
+		case "motion": return "motion";
+		case "audio": return "audio";
+		case "object": return `object:${source.macroClass}`;
+		case "sensor": return `sensor:${source.sourceDeviceId}`;
+	}
+}
+/**
 * LE sorgenti che questa banda ascolta — l'unico posto dove i `triggers` di
-* una banda diventano `TriggerSource[]`. `eventsBandCanEverDemand` e
-* `RecordingController.reportUnrecordable` lo leggono invece di ripetere
-* l'if-ladder motion/audio a mano.
+* una banda diventano `TriggerSource[]`.
+*
+* Prima erano CINQUE copie dello stesso if-ladder motion/audio
+* (`eventsBandCanEverDemand`, `eventsBandDemanded`, `segmentRetainedForEvents`,
+* `segmentMissedByMs`, `eventsWindowCloseMs`), che con quattro sorgenti
+* sarebbero diventate cinque scale a quattro rami. `RecordingController`
+* (`reportUnrecordable`, la riconciliazione durevole) legge la stessa lista.
+*
+* Una chiave in {@link UNFED_TRIGGER_KEYS} non produce sorgenti: la banda che
+* ascolta solo quella "non può mai chiedere", ed è così che il recorder la
+* denuncia invece di restare zitto.
 */
 function bandTriggerSources(band) {
 	const t = band.triggers;
 	if (t === void 0) return [];
 	const sources = [];
-	if (t.motion === true) sources.push("motion");
-	if (t.audioThresholdDbfs !== void 0) sources.push("audio");
+	if (t.motion === true) sources.push({ kind: "motion" });
+	if (t.audioThresholdDbfs !== void 0) sources.push({ kind: "audio" });
+	for (const macroClass of t.objectClasses ?? []) sources.push({
+		kind: "object",
+		macroClass
+	});
+	for (const sourceDeviceId of t.sensorDeviceIds ?? []) sources.push({
+		kind: "sensor",
+		sourceDeviceId
+	});
 	return sources;
 }
 /**
@@ -7564,10 +7991,7 @@ function audioLevelQualifies(band, dbfs) {
 	return threshold !== void 0 && dbfs >= threshold;
 }
 /** No trigger has been seen for this device yet. */
-var EMPTY_TRIGGER_STATE = {
-	motion: [],
-	audio: []
-};
+var EMPTY_TRIGGER_STATE = { windows: /* @__PURE__ */ new Map() };
 /**
 * How long a window is retained PAST the end of its own keep span
 * (`lastMs + postBufferSec`).
@@ -7579,18 +8003,21 @@ var EMPTY_TRIGGER_STATE = {
 * room to spare, while bounding a busy camera to a handful of windows.
 */
 var TRIGGER_HISTORY_MARGIN_MS = 12e4;
-/** The windows for a source, in the order they opened. */
-function windowsFor(state, source) {
-	return source === "motion" ? state.motion : state.audio;
-}
+/** The windows for a source, in the order they opened. Empty when the source
+*  has never fired — an absent key and a source with no history are the same
+*  fact, and only one of them is ever stored. */
+function triggerWindowsFor(state, source) {
+	return state.windows.get(triggerKey(source)) ?? [];
+}
+/** Replace one source's windows. An EMPTY list deletes the key rather than
+*  storing a zero-length array: that is what bounds the map when an operator
+*  removes a sensor from a band. */
 function withWindows(state, source, windows) {
-	return source === "motion" ? {
-		...state,
-		motion: windows
-	} : {
-		...state,
-		audio: windows
-	};
+	const next = new Map(state.windows);
+	const key = triggerKey(source);
+	if (windows.length === 0) next.delete(key);
+	else next.set(key, windows);
+	return { windows: next };
 }
 /**
 * Fold one qualifying trigger into the history, immutably. It EXTENDS the newest
@@ -7602,7 +8029,7 @@ function withWindows(state, source, windows) {
 * predates the episode, so the keep span can only ever grow.
 */
 function recordTrigger(state, source, atMs, mergeGapMs) {
-	const windows = windowsFor(state, source);
+	const windows = triggerWindowsFor(state, source);
 	const newest = windows[windows.length - 1];
 	const merged = newest !== void 0 && atMs - newest.lastMs <= mergeGapMs && atMs >= newest.firstMs - mergeGapMs ? [...windows.slice(0, -1), {
 		firstMs: Math.min(newest.firstMs, atMs),
@@ -7625,18 +8052,18 @@ function recordTrigger(state, source, atMs, mergeGapMs) {
 */
 function pruneTriggerHistory(state, postMs, nowMs) {
 	const cutoffMs = nowMs - postMs - TRIGGER_HISTORY_MARGIN_MS;
-	const live = (w) => w.lastMs >= cutoffMs;
-	const motion = state.motion.filter(live);
-	const audio = state.audio.filter(live);
-	if (motion.length === state.motion.length && audio.length === state.audio.length) return state;
-	return {
-		motion,
-		audio
-	};
+	const next = /* @__PURE__ */ new Map();
+	let changed = false;
+	for (const [key, windows] of state.windows) {
+		const live = windows.filter((w) => w.lastMs >= cutoffMs);
+		if (live.length !== windows.length) changed = true;
+		if (live.length > 0) next.set(key, live);
+	}
+	return changed ? { windows: next } : state;
 }
 /** Most recent trigger for a source, or null when none is retained. */
 function latestTriggerMs(state, source) {
-	const windows = windowsFor(state, source);
+	const windows = triggerWindowsFor(state, source);
 	return windows[windows.length - 1]?.lastMs ?? null;
 }
 /**
@@ -7646,10 +8073,10 @@ function latestTriggerMs(state, source) {
 */
 function eventsBandDemanded(band, triggers, atMs) {
 	const { postMs } = resolveBandBufferMs(band);
-	const fresh = (lastMs) => lastMs != null && atMs - lastMs <= postMs;
-	if (band.triggers?.motion && fresh(latestTriggerMs(triggers, "motion"))) return true;
-	if (band.triggers?.audioThresholdDbfs != null && fresh(latestTriggerMs(triggers, "audio"))) return true;
-	return false;
+	return bandTriggerSources(band).some((source) => {
+		const lastMs = latestTriggerMs(triggers, source);
+		return lastMs !== null && atMs - lastMs <= postMs;
+	});
 }
 /**
 * Should recording (any mode) be active for this device at `at`? The live
@@ -7720,9 +8147,7 @@ function segmentRetainedForEvents(segStartMs, segEndMs, band, triggers, attach)
 		if (segStartMs <= window.lastMs + postMs) return true;
 		return attach.attachedAtMs <= window.lastMs + postMs && segStartMs <= deadlineMs;
 	};
-	if (band.triggers?.motion && triggers.motion.some(overlaps)) return true;
-	if (band.triggers?.audioThresholdDbfs != null && triggers.audio.some(overlaps)) return true;
-	return false;
+	return bandTriggerSources(band).some((source) => triggerWindowsFor(triggers, source).some(overlaps));
 }
 /**
 * By how many ms a discarded segment missed being kept — its start past the
@@ -7744,7 +8169,7 @@ function segmentMissedByMs(segStartMs, band, triggers, attach) {
 		const windowEndMs = window.lastMs + postMs;
 		return attach.attachedAtMs <= windowEndMs ? Math.max(windowEndMs, deadlineMs) : windowEndMs;
 	};
-	const considered = [...band.triggers?.motion === true ? triggers.motion : [], ...band.triggers?.audioThresholdDbfs != null ? triggers.audio : []];
+	const considered = bandTriggerSources(band).flatMap((source) => [...triggerWindowsFor(triggers, source)]);
 	if (considered.length === 0) return null;
 	return segStartMs - Math.max(...considered.map(latestKeptStart));
 }
@@ -7778,10 +8203,10 @@ function foldDurableTriggers(state, source, timestamps, mergeGapMs) {
 	let recovered = 0;
 	let evicted = 0;
 	for (const atMs of rows) {
-		const before = windowsFor(next, source);
+		const before = triggerWindowsFor(next, source);
 		const folded = recordTrigger(next, source, atMs, mergeGapMs);
 		evicted += folded.evicted;
-		const after = windowsFor(folded.state, source);
+		const after = triggerWindowsFor(folded.state, source);
 		if (folded.evicted > 0 || after.length !== before.length || after.some((w, i) => w.firstMs !== before[i]?.firstMs || w.lastMs !== before[i]?.lastMs)) recovered++;
 		next = folded.state;
 	}
@@ -7928,12 +8353,7 @@ function nextBandEdgeMs(config, nowMs) {
 function eventsWindowCloseMs(band, triggers, nowMs) {
 	if (band.mode !== "events") return null;
 	const { postMs } = resolveBandBufferMs(band);
-	const ends = [];
-	const motionMs = latestTriggerMs(triggers, "motion");
-	const audioMs = latestTriggerMs(triggers, "audio");
-	if (band.triggers?.motion === true && motionMs != null) ends.push(motionMs + postMs);
-	if (band.triggers?.audioThresholdDbfs != null && audioMs != null) ends.push(audioMs + postMs);
-	const open = ends.filter((ms) => ms >= nowMs);
+	const open = bandTriggerSources(band).map((source) => latestTriggerMs(triggers, source)).filter((ms) => ms !== null).map((ms) => ms + postMs).filter((ms) => ms >= nowMs);
 	if (open.length === 0) return null;
 	return Math.max(...open) + 1;
 }
@@ -9199,44 +9619,78 @@ var RecordingController = class {
 	* of it is discarded and the footage is gone for ever — durable state resting
 	* on telemetry, which D8/D11 forbid.
 	*
-	* Motion only. Audio triggers have no durable counterpart the recorder can
-	* ask for at the same granularity, and a reconcile that silently covered one
-	* source and not the other would read as covering both.
+	* ## Which sources it covers, and which it does NOT
+	*
+	* MOTION and OBJECT-DETECTION. Both have a durable counterpart at the same
+	* granularity the bus carries — `pipelineAnalytics.getMotionEvents` and
+	* `getObjectEvents` — so a dropped event is recoverable from rows.
+	*
+	* AUDIO and SENSOR are NOT covered, and that is a stated gap, not an
+	* oversight:
+	*  - audio has no per-window durable row the recorder can ask for;
+	*  - `SensorEvent` rows exist but are LEVEL, not EDGE (a contact closing
+	*    writes a row exactly like one opening), and they carry the taxonomy
+	*    `kind`, not the `capName` that `SOURCE_CAP_ACTIVE_FIELD` is indexed by.
+	*    The inversion was MEASURED on 2026-08-27 rather than eyeballed:
+	*    `CAP_TO_KIND` (`types/capabilities/sensor-event-kinds.ts`) has no two
+	*    caps sharing a kind, so `kind → capName` is invertible — but `binary`,
+	*    a source cap, has NO entry in it at all, so a `binary` sensor's edges
+	*    never reach the `SensorEvent` table and could never be recovered. A
+	*    reconcile covering nine source caps out of ten reads as covering all
+	*    ten, which is the failure this whole comment exists to avoid.
+	*
+	* A reconcile that silently covered some sources and not others would read as
+	* covering all of them, so it is named here and the un-covered sources are
+	* simply skipped — never faked.
 	*
 	* Never throws: this runs at the head of the reconcile beat and an escape
 	* here would cancel the evaluate for the whole device.
 	*/
 	async reconcileTriggerHistory(deviceId) {
-		const load = this.deps.loadMotionEvents;
-		if (load === void 0 || this.stopped) return;
+		const loadMotion = this.deps.loadMotionEvents;
+		const loadObject = this.deps.loadObjectEvents;
+		if (loadMotion === void 0 && loadObject === void 0 || this.stopped) return;
 		try {
 			const config = await this.deps.loadConfig(deviceId);
 			if (config.enabled !== true) return;
 			const nowMs = this.now();
 			const band = activeBandAt({ bands: config.bands ?? [] }, new Date(nowMs));
-			if (!band || band.mode !== "events" || band.triggers?.motion !== true) return;
+			if (!band || band.mode !== "events") return;
 			const { postMs } = resolveBandBufferMs(band);
 			const sinceMs = nowMs - postMs - TRIGGER_HISTORY_MARGIN_MS;
-			const rows = await load(deviceId, sinceMs, nowMs);
-			if (this.stopped || rows.length === 0) return;
-			const folded = foldDurableTriggers(pruneTriggerHistory(this.triggersFor(deviceId), postMs, this.now()), "motion", rows, postMs);
-			this.triggers.set(deviceId, folded.state);
-			if (folded.recovered > 0) this.deps.logger.info("recorder: trigger windows recovered from the durable rows — the bus had not delivered them", {
-				tags: { deviceId },
-				meta: {
-					rows: rows.length,
-					recovered: folded.recovered,
-					sinceMs,
-					postMs
-				}
-			});
-			if (folded.evicted > 0) this.deps.logger.warn("recorder: trigger history full during reconcile — oldest window(s) evicted", {
-				tags: { deviceId },
-				meta: {
-					evicted: folded.evicted,
-					maxWindows: 32
-				}
-			});
+			/** Durable rows for one source, or null when that source has no durable
+			*  half (audio, sensor) or its loader was not injected. */
+			const durableRowsFor = async (source) => {
+				if (source.kind === "motion") return loadMotion === void 0 ? null : await loadMotion(deviceId, sinceMs, nowMs);
+				if (source.kind === "object") return loadObject === void 0 ? null : await loadObject(deviceId, source.macroClass, sinceMs, nowMs);
+				return null;
+			};
+			for (const source of bandTriggerSources(band)) {
+				if (this.stopped) return;
+				const rows = await durableRowsFor(source);
+				if (rows === null || rows.length === 0) continue;
+				if (this.stopped) return;
+				const folded = foldDurableTriggers(pruneTriggerHistory(this.triggersFor(deviceId), postMs, this.now()), source, rows, postMs);
+				this.triggers.set(deviceId, folded.state);
+				if (folded.recovered > 0) this.deps.logger.info("recorder: trigger windows recovered from the durable rows — the bus had not delivered them", {
+					tags: { deviceId },
+					meta: {
+						source: triggerKey(source),
+						rows: rows.length,
+						recovered: folded.recovered,
+						sinceMs,
+						postMs
+					}
+				});
+				if (folded.evicted > 0) this.deps.logger.warn("recorder: trigger history full during reconcile — oldest window(s) evicted", {
+					tags: { deviceId },
+					meta: {
+						source: triggerKey(source),
+						evicted: folded.evicted,
+						maxWindows: 32
+					}
+				});
+			}
 		} catch (err) {
 			this.deps.logger.warn("recorder: trigger reconcile failed — retries on the next beat", {
 				tags: { deviceId },
@@ -9403,7 +9857,7 @@ var RecordingController = class {
 		if (receivedLagMs > TRIGGER_LAG_WARN_MS) this.deps.logger.warn("recorder: trigger arrived late — part of its window is already spent", {
 			tags: { deviceId },
 			meta: {
-				source,
+				source: triggerKey(source),
 				atMs,
 				receivedLagMs
 			}
@@ -9416,7 +9870,7 @@ var RecordingController = class {
 			this.deps.logger.warn("recorder: trigger attach deferred — stream not available yet (retries on next broker ready/reconcile)", {
 				tags: { deviceId },
 				meta: {
-					source,
+					source: triggerKey(source),
 					atMs,
 					error: require_dist.errMsg(err)
 				}
@@ -9458,7 +9912,7 @@ var RecordingController = class {
 			return;
 		}
 		if (!audioLevelQualifies(band, dbfs)) return;
-		await this.onTrigger(deviceId, "audio", atMs);
+		await this.onTrigger(deviceId, { kind: "audio" }, atMs);
 	}
 	/**
 	* The post-buffer that governs this device's trigger history right now: it is
@@ -9494,7 +9948,7 @@ var RecordingController = class {
 		if (evicted > 0) this.deps.logger.warn("recorder: trigger history full — oldest window(s) evicted, their footage may be discarded", {
 			tags: { deviceId },
 			meta: {
-				source,
+				source: triggerKey(source),
 				atMs,
 				postMs,
 				evicted,
@@ -9939,14 +10393,10 @@ var RecordingController = class {
 			profile,
 			startMs,
 			durMs,
-			motionWindows: triggers.motion.map((w) => ({
+			triggerWindows: Object.fromEntries(bandTriggerSources(band).map((source) => [triggerKey(source), triggerWindowsFor(triggers, source).map((w) => ({
 				firstMs: w.firstMs,
 				lastMs: w.lastMs
-			})),
-			audioWindows: triggers.audio.map((w) => ({
-				firstMs: w.firstMs,
-				lastMs: w.lastMs
-			})),
+			}))])),
 			postMs,
 			preMs,
 			attachedAtMs: attach.attachedAtMs,
@@ -11637,6 +12087,28 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	* down the same way, idempotent re-entry included.
 	*/
 	audioTriggerUnsub = null;
+	/**
+	* Unsubscribe handle for the `PipelineAnalyticsDetectionEvent` subscription —
+	* the feed behind `RecordingTriggers.objectClasses` (Traccia A of the same
+	* plan). Same guard/teardown discipline as the two above.
+	*/
+	detectionTriggerUnsub = null;
+	/**
+	* Unsubscribe handle for the `DeviceStateChanged` subscription — the feed
+	* behind `RecordingTriggers.sensorDeviceIds` (Traccia B).
+	*/
+	sensorTriggerUnsub = null;
+	/**
+	* Edge memory + reverse index (source device → cameras) for the sensor
+	* trigger. Constructed once per addon instance: `startedAtMs` is the floor a
+	* first-sighting rise must beat, and a fresh instance per boot is exactly
+	* what makes a runner respawn err towards silence rather than record 30 s
+	* per camera on every hydrated contact.
+	*/
+	sensorRouter = new SensorTriggerRouter({
+		now: () => Date.now(),
+		startedAtMs: Date.now()
+	});
 	/** Resolved recordings locations (id + root). Refreshed on boot + rescan.
 	*  Already ALIAS-GUARDED: a writable same-type duplicate of another
 	*  location's physical root arrives here demoted to read-only. */
@@ -11852,6 +12324,29 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 					projection: "slim"
 				})).map((event) => event.timestamp);
 			},
+			/**
+			* The DURABLE half of the OBJECT source. Same shape as `loadMotionEvents`
+			* — SQLite rows instead of a broadcast, one call per macro class because
+			* `TriggerState` keys per class and the store filters server-side.
+			*
+			* `projection: 'full'` and NOT `'slim'`, deliberately: `SLIM_OBJECT_COLUMNS`
+			* (`addon-post-analysis/.../store/event-store.ts`) does not carry `source`,
+			* and the filter below reads an absent `source` as `pipeline` — so a slim
+			* read would fold ONBOARD rows, re-opening from SQL exactly the windows
+			* `qualifyObjectTrigger` refuses on the live path. Two truths about one
+			* detection, which is what this whole track exists to avoid. The extra
+			* cost is bounded: only bands that actually list `objectClasses` reach
+			* here, `classFilter` narrows to one class, and `limit` caps the rows.
+			*/
+			loadObjectEvents: async (deviceId, macroClass, sinceMs, untilMs) => {
+				return (await this.ctx.api.pipelineAnalytics.getObjectEvents.query({
+					deviceId,
+					since: sinceMs,
+					until: untilMs,
+					classFilter: macroClass,
+					limit: TRIGGER_RECONCILE_ROW_LIMIT
+				})).filter((event) => (event.source ?? "pipeline") === "pipeline").map((event) => event.timestamp);
+			},
 			locations: () => this.resolvedLocations,
 			placeProfile: (deviceId, profile) => this.placeProfile(deviceId, profile),
 			onPlacementTick: (deviceIds) => this.recomputePlacement(deviceIds),
@@ -11919,7 +12414,10 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			calendar: this.calendar,
 			mfraFor: (deviceId, profile, startMs) => this.mfraTables.get(deviceId, profile, startMs),
 			hydrateWindow: (deviceId, fromMs, toMs) => hydrateWindowFromStorage(this.index, deviceId, fromMs, toMs, this.resolvedLocations, this.ctx.logger),
-			onConfigChanged: (deviceId) => this.controller?.onConfigChanged(deviceId) ?? Promise.resolve(),
+			onConfigChanged: async (deviceId) => {
+				await this.refreshSensorTriggerBindings();
+				await (this.controller?.onConfigChanged(deviceId) ?? Promise.resolve());
+			},
 			pauseForStorageMigration: (leaseId) => this.pauseForStorageMigration(leaseId),
 			resumeForStorageMigration: (leaseId) => this.resumeForStorageMigration(leaseId),
 			refreshStorageLocationsForMigration: (leaseId) => this.refreshStorageLocationsForMigration(leaseId),
@@ -12110,6 +12608,10 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		this.eventUnsub = null;
 		this.audioTriggerUnsub?.();
 		this.audioTriggerUnsub = null;
+		this.detectionTriggerUnsub?.();
+		this.detectionTriggerUnsub = null;
+		this.sensorTriggerUnsub?.();
+		this.sensorTriggerUnsub = null;
 		await this.controller?.stop();
 		this.controller = null;
 		this.segmentStore = null;
@@ -12181,7 +12683,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			padPreMs: MARKER_PAD_PRE_MS,
 			padPostMs: MARKER_PAD_POST_MS,
 			onMotion: (deviceId, atMs) => {
-				this.controller?.onTrigger(deviceId, "motion", atMs);
+				this.controller?.onTrigger(deviceId, { kind: "motion" }, atMs);
 			}
 		});
 		if (this.audioTriggerUnsub === null) this.audioTriggerUnsub = this.ctx.eventBus.subscribe({ category: require_dist.EventCategory.PipelineAudioInferenceResult }, (event) => {
@@ -12189,6 +12691,48 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			if (dbfs === void 0) return;
 			this.controller?.onAudioLevel(event.data.deviceId, dbfs, event.data.frame.timestamp);
 		});
+		if (this.detectionTriggerUnsub === null) this.detectionTriggerUnsub = this.ctx.eventBus.subscribe({ category: require_dist.EventCategory.PipelineAnalyticsDetectionEvent }, (event) => {
+			const verdict = qualifyObjectTrigger(event.data);
+			if (!verdict.qualified) {
+				this.ctx.logger.debug("recorder: detection event did not qualify as a trigger", { meta: { reason: verdict.reason } });
+				return;
+			}
+			this.controller?.onTrigger(verdict.deviceId, {
+				kind: "object",
+				macroClass: verdict.macroClass
+			}, verdict.atMs);
+		});
+		if (this.sensorTriggerUnsub === null) {
+			await this.refreshSensorTriggerBindings();
+			this.sensorTriggerUnsub = this.ctx.eventBus.subscribe({ category: require_dist.EventCategory.DeviceStateChanged }, (event) => {
+				const parsed = parseSensorStateChanged(event.data);
+				if (parsed === null) return;
+				const atMs = event.timestamp instanceof Date ? event.timestamp.getTime() : Date.now();
+				const result = this.sensorRouter.onStateSlice(parsed.deviceId, parsed.capName, parsed.slice);
+				for (const cameraId of result.fired) {
+					this.ctx.logger.info("recorder: sensor rising edge opened a recording window", {
+						tags: { deviceId: cameraId },
+						meta: {
+							sourceDeviceId: parsed.deviceId,
+							capName: parsed.capName
+						}
+					});
+					this.controller?.onTrigger(cameraId, {
+						kind: "sensor",
+						sourceDeviceId: parsed.deviceId
+					}, atMs);
+				}
+				if (result.skipped === null || result.skipped === "not-listened") return;
+				const level = result.skipped === "baseline-seeded-stale-active" ? "warn" : "debug";
+				this.ctx.logger[level]("recorder: sensor state change opened no window", {
+					tags: { deviceId: parsed.deviceId },
+					meta: {
+						capName: parsed.capName,
+						reason: result.skipped
+					}
+				});
+			});
+		}
 		try {
 			await this.segmentHours?.load();
 			this.segmentHours?.hydrateIndex(this.index);
@@ -12202,6 +12746,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			this.ctx.logger.warn("recorder: reading persisted device configs failed — skipping hydrate", { meta: { error: require_dist.errMsg(err) } });
 			return;
 		}
+		this.applySensorTriggerBindings(configs);
 		this.warmToday([...configs.keys()]);
 		this.ctx.logger.info("recorder: full-archive index walk skipped", { meta: {
 			reason: "on-demand-windows",
@@ -12220,6 +12765,39 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		this.retentionSweeper?.start();
 	}
 	/**
+	* Rebuild the sensor trigger's reverse index from the persisted configs.
+	*
+	* D49: this is a MIRROR refreshed off the event path — at boot and on every
+	* config write (an RPC that cannot be dropped), never from a fallible read
+	* while a `DeviceStateChanged` is being routed.
+	*
+	* A failed read leaves the PREVIOUS index standing and says so. An index that
+	* emptied itself on a transient store failure would answer "nobody listens"
+	* to every sensor edge until the next config write — silently, and that is
+	* precisely the "a read that fails changes nothing" half of D49.
+	*/
+	async refreshSensorTriggerBindings() {
+		try {
+			this.applySensorTriggerBindings(await readDeviceConfigs(this.configStore()));
+		} catch (err) {
+			this.ctx.logger.warn("recorder: sensor trigger index NOT refreshed — config read failed, the previous index stands", { meta: { error: require_dist.errMsg(err) } });
+		}
+	}
+	/** Apply an already-read config map to the sensor index. Logs only when the
+	*  set of listened sources CHANGED — a config write that touches something
+	*  else must not print a line that reads as a rewiring. */
+	applySensorTriggerBindings(configs) {
+		const before = [...this.sensorRouter.listenedSourceIds()].toSorted((a, b) => a - b);
+		const bindings = buildSensorTriggerBindings(configs);
+		this.sensorRouter.setBindings(bindings);
+		const after = [...bindings.keys()].toSorted((a, b) => a - b);
+		if (before.length === after.length && before.every((id, i) => id === after[i])) return;
+		this.ctx.logger.info("recorder: sensor trigger index rebuilt", { meta: {
+			sourceDeviceIds: after,
+			cameras: configs.size
+		} });
+	}
+	/**
 	* Resume interrupted exports and arm the expiry sweep.
 	*
 	* The resume itself lives in `export-reconcile.ts` — pure, tested, and loud