@camstack/addon-pipeline 1.2.274 → 1.2.276

package/dist/audio-analyzer/index.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-k6Vu-AhZ.js");
-const require_process_memory = require("../process-memory-DN7opum2.js");
+const require_dist = require("../dist-NYjn7hkE.js");
+const require_process_memory = require("../process-memory-DDvuSEMJ.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_path = require("node:path");

package/dist/audio-analyzer/index.mjs

@@ -1,6 +1,6 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
-import { E as PoolMemoryWatchdog, I as audioAnalysisCapability, Jt as BaseAddon, L as audioAnalyzerCapability, Qt as audioChunkBytesPerSample, Vt as errMsg, jt as resolvePoolMemoryPolicy, lt as mapAudioLabelToMacro, n as AUDIO_BACKEND_CHOICES, nn as expandAudioChunkToF32le, rn as hydrateSchema, s as DEFAULT_AUDIO_ANALYZER_CONFIG, sn as nodePin, wn as EventCategory, x as HF_BASE_URL } from "../dist-g5MfpiBh.mjs";
-import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-Gl3EowL-.mjs";
+import { E as PoolMemoryWatchdog, Ft as resolvePoolMemoryPolicy, Gt as errMsg, I as audioAnalysisCapability, L as audioAnalyzerCapability, Qt as BaseAddon, cn as hydrateSchema, fn as nodePin, ft as mapAudioLabelToMacro, kn as EventCategory, n as AUDIO_BACKEND_CHOICES, rn as audioChunkBytesPerSample, s as DEFAULT_AUDIO_ANALYZER_CONFIG, sn as expandAudioChunkToF32le, x as HF_BASE_URL } from "../dist-C1pCVJk7.mjs";
+import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-BQOfL3Ig.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
 import { downloadFile } from "@camstack/system/addon-utils";

package/dist/{default-detection-model-CAWhHQo2.js → default-detection-model-6lCvep7n.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-k6Vu-AhZ.js");
+const require_dist = require("./dist-NYjn7hkE.js");
 let node_crypto = require("node:crypto");
 //#region src/detection-pipeline/pipeline/landmark-precision-gate.ts
 /**

package/dist/{default-detection-model-BXwE-Dvo.mjs → default-detection-model-dQSwHHfx.mjs}

@@ -1,4 +1,4 @@
-import { R as audioKindId, a as COCO_80_LABELS, it as hfModelUrl, o as COCO_TO_MACRO, r as AUDIO_MACRO_LABELS } from "./dist-g5MfpiBh.mjs";
+import { R as audioKindId, a as COCO_80_LABELS, o as COCO_TO_MACRO, r as AUDIO_MACRO_LABELS, st as hfModelUrl } from "./dist-C1pCVJk7.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/detection-pipeline/pipeline/landmark-precision-gate.ts
 /**

package/dist/detection-pipeline/index.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-k6Vu-AhZ.js");
-const require_node = require("../node--u_jUObS.js");
-const require_default_detection_model = require("../default-detection-model-CAWhHQo2.js");
+const require_dist = require("../dist-NYjn7hkE.js");
+const require_node = require("../node-CVYY8a4y.js");
+const require_default_detection_model = require("../default-detection-model-6lCvep7n.js");
 const require_lazy_sharp = require("../lazy-sharp-BuwKlQLR.js");
-const require_process_memory = require("../process-memory-DN7opum2.js");
+const require_process_memory = require("../process-memory-DDvuSEMJ.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/detection-pipeline/index.mjs

@@ -1,9 +1,9 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
-import { $ as evaluateZoneRules, $t as createEvent, Cn as union, E as PoolMemoryWatchdog, J as detectionPipelineCapability, Jt as BaseAddon, Nt as runtimeDevices$1, Ot as resolveClusterStepModelId, P as YAMNET_TO_MACRO, Rt as supportedRuntimes$1, Sn as string, St as pipelineExecutorCapability, Vt as errMsg, W as defaultDeviceFor$1, Z as enumerateInferenceDevices, at as inferModelProvider, c as DEFAULT_CLUSTER_STEP_MODELS, cn as parseJsonUnknown, dn as sleep, gt as overlayClusterStepSettings, jt as resolvePoolMemoryPolicy, l as DEFAULT_CLUSTER_STEP_SETTINGS, m as DEVICE_BACKEND_TO_FORMAT, pn as array, rn as hydrateSchema, sn as nodePin, st as loadContributionCapability, t as APPLE_SA_TO_MACRO, vt as pickClusterStepModels, wn as EventCategory, yn as object, yt as pickClusterStepSettings } from "../dist-g5MfpiBh.mjs";
-import { s as readProcessCost } from "../node-BXsHQH5h.mjs";
-import { a as localFrameRegistry, c as ALL_STEPS, d as getStepDefinition, f as resolveModelForFormat, l as getDefaultModelForFormat, n as resolveDefaultDetectionModel, p as landmarkPrecisionVerdict, r as macroGateVerdict, s as ALL_PIPELINE_STEPS, u as getStep } from "../default-detection-model-BXwE-Dvo.mjs";
+import { $ as enumerateInferenceDevices, Dn as string, E as PoolMemoryWatchdog, Ft as resolvePoolMemoryPolicy, Gt as errMsg, Ht as supportedRuntimes$1, K as defaultDeviceFor$1, Lt as runtimeDevices$1, On as union, P as YAMNET_TO_MACRO, Qt as BaseAddon, St as pickClusterStepSettings, Tt as pipelineExecutorCapability, X as detectionPipelineCapability, c as DEFAULT_CLUSTER_STEP_MODELS, cn as hydrateSchema, ct as inferModelProvider, fn as nodePin, gn as sleep, in as createEvent, jt as resolveClusterStepModelId, kn as EventCategory, l as DEFAULT_CLUSTER_STEP_SETTINGS, m as DEVICE_BACKEND_TO_FORMAT, pn as parseJsonUnknown, t as APPLE_SA_TO_MACRO, tt as evaluateZoneRules, ut as loadContributionCapability, vn as array, wn as object, xt as pickClusterStepModels, yt as overlayClusterStepSettings } from "../dist-C1pCVJk7.mjs";
+import { s as readProcessCost } from "../node--UY0iepi.mjs";
+import { a as localFrameRegistry, c as ALL_STEPS, d as getStepDefinition, f as resolveModelForFormat, l as getDefaultModelForFormat, n as resolveDefaultDetectionModel, p as landmarkPrecisionVerdict, r as macroGateVerdict, s as ALL_PIPELINE_STEPS, u as getStep } from "../default-detection-model-dQSwHHfx.mjs";
 import { t as getSharp } from "../lazy-sharp-DXsqwpph.mjs";
-import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-Gl3EowL-.mjs";
+import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-BQOfL3Ig.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/{dist-g5MfpiBh.mjs → dist-C1pCVJk7.mjs}

@@ -5360,7 +5360,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-CaB_hL5g.mjs
+//#region ../types/dist/sleep-BVhJDJka.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7102,6 +7102,18 @@ function systemMethod(input, output, options) {
 		systemOnly: true
 	};
 }
+/**
+* A method a SOURCE of a collection cap may legitimately not serve — OPTIONAL
+* on `InferProvider`. The `providerOptional: true` literal is what
+* `InferProvider` keys on; see {@link CapabilityMethodSchema.providerOptional}
+* for when this is the honest answer and when it is a soft stub.
+*/
+function optionalMethod(input, output, options) {
+	return {
+		...method(input, output, options),
+		providerOptional: true
+	};
+}
 /** Shorthand to define an event schema */
 function event(data) {
 	return { data };
@@ -27418,6 +27430,59 @@ var ClipPlaybackSchema = object({
 * which days it asked for and got nothing — "no clips" would be a lie about a
 * card that is full of them.
 */
+/**
+* The operator's authorisation to WAKE a sleeping camera for one clip read.
+*
+* ONE value, absent by default, and it is a `force`-shaped operator signal in
+* exactly the sense `snapshot-wake-gate.ts` uses the word: *"`snapshot.getSnapshot`'s
+* `force` flag, and nothing else… a background caller must never set it…
+* Stale but honest beats woken"*. A scheduler, a retry, a reconcile and a
+* prefetch never set it; a surface sets it only behind the same confirm the
+* "Wake and refresh" gesture uses, and it is refused below 15 % battery
+* exactly as that gesture is.
+*
+* The gate is decided BEFORE `getApi()`, because on UDP the login IS the wake
+* (D549) — a read that opened a session and then checked would have woken the
+* camera to find out it was not allowed to.
+*
+* **One authorised yes is one wake.** `next-natural` — take the clip the next
+* time the camera is awake for its own reasons — is deliberately not a member:
+* it was proposed, it is free on the battery, and the operator declined it on
+* 2026-09-20 (*"Quando un export viene richiesto si sveglia la camera."*,
+* D558 "Considered and not taken").
+*/
+var ClipWakeSchema = _enum(["authorised"]);
+/**
+* A clip's finished bytes, inline — the twin of `recordingExport.readExportBytes`.
+*
+* `bytes` is the DECODED length, so nobody infers it from the base64 length,
+* and `served` says which twin the caller actually got.
+*/
+var ClipBytesSchema = object({
+	base64: string(),
+	contentType: string(),
+	/** Suggested filename, extension included. */
+	name: string(),
+	bytes: number().int().nonnegative(),
+	/**
+	* Which twin was actually served — the same contract
+	* {@link ClipPlaybackSchema.served} carries, and REQUIRED here because the
+	* export record persists it: a row read a week later must say the same thing
+	* the panel said at the moment of the tap. A missing main twin is never
+	* served silently as if it were the asked-for quality (D549 15).
+	*/
+	served: CamProfileSchema,
+	/**
+	* The DECODED duration of the delivered file, when the fetch measured one.
+	*
+	* A clip fetch verifies its own completion against the catalog row and
+	* retries a materially short pass (D568); this is that measurement, carried
+	* so a consumer can say the same thing rather than re-deriving it. Absent
+	* when the producer did not measure — never zero, which would say the file
+	* is empty.
+	*/
+	durationMs: number().positive().optional()
+});
 var ClipSourceAvailabilitySchema = object({
 	state: _enum([
 		"ok",
@@ -27519,22 +27584,40 @@ var videoclipsCapability = {
 			limit: number().int().positive().optional(),
 			/**
 			* WHICH provider to ask — the `addonId` a {@link ClipSourceSchema} row
-			* carries, never a source id and never a list.
+			* carries, never a source id and never a list. **Required** (D554 amended).
+			*
+			* A provider the device is not bound to is refused by name rather than
+			* answered by another one (D552's `rejectUnresolvedAddonPin` rule).
+			*
+			* It was optional, documented as "absent means the device's BOUND
+			* provider, which is CamStack on every camera". No code implemented
+			* that. Measured on the live hub 2026-09-20 — device 592, bound to
+			* `recorder` AND `provider-reolink` — a bare call with `limit: 3`
+			* answered SIX rows, three from each source, merged newest-first:
+			* `device-collection-dispatch.ts` simply left the fan-out un-narrowed,
+			* so absence bought the union this method exists not to be, and
+			* `limit` meant `limit × sources`.
+			*
+			* There is nothing to restore the default to. `getBindings` answers a
+			* collection cap with a DERIVED, PLURAL set (D554 amended, step 0);
+			* `setWrapperActive` — the singleton authority that could name one —
+			* throws for a collection cap by design. Naming CamStack here instead
+			* would privilege one addon by id inside a surface whose premise is
+			* that sources are peers, and would be wrong on the first camera with
+			* no recorder binding. So absence is REFUSED, in the schema, where the
+			* generated types make it unomittable rather than merely discouraged.
 			*
-			* Absent means the device's BOUND provider, which is CamStack on every
-			* camera today because that is what `deviceManager.getBindings`
-			* answers with. A provider the device is not bound to is refused by
-			* name rather than answered by another one (D552's
-			* `rejectUnresolvedAddonPin` rule).
+			* The default belongs to the SURFACE, which has the `listSources` rows
+			* and can say which one it picked (D569 § 1–3; the viewer already
+			* always sends this).
 			*
 			* It replaced `sources?: string[]`, a VIEW filter over source ids that
 			* assumed the answer was a fan-out over everything a camera has. The
-			* operator settled otherwise on 2026-09-20 — *"il get videoclips
-			* prendere un provider opzionale, di default va su camstack"*,
-			* *"l'utilizzatore è uno solo"* — so the list is asked of one provider
-			* at a time and there is nothing to filter out of it.
+			* operator settled otherwise on 2026-09-20 — *"l'utilizzatore è uno
+			* solo"* — so the list is asked of one provider at a time and there is
+			* nothing to filter out of it.
 			*/
-			provider: string().optional()
+			provider: string().min(1)
 		}), array(ClipSchema).readonly(), {
 			kind: "query",
 			auth: "protected"
@@ -27571,6 +27654,68 @@ var videoclipsCapability = {
 		}), ClipPlaybackSchema, {
 			kind: "query",
 			auth: "protected"
+		}),
+		/**
+		* This clip's BYTES, base64, bounded — the by-handle read a clip EXPORT
+		* pulls once (D558).
+		*
+		* `getClipPlayback` is the right answer for a player: it hands back a URL
+		* on a plane the hub serves `access:'authenticated'`, which a browser and a
+		* viewer session satisfy. It is the wrong answer for another ADDON. There
+		* is no addon→addon byte transport in this framework — `AddonDataPlane`
+		* only lets an addon SERVE, on `127.0.0.1` behind a per-listener secret
+		* only the hub may present — so a recorder that wants a camera's clip
+		* cannot fetch that URL. This method is the one seam that exists for it,
+		* and it is deliberately the same shape (and the same bound) as
+		* `recordingExport.readExportBytes`, which exists for the mirror-image
+		* reason.
+		*
+		* Routing needs no `provider` pin: the id is source-prefixed and
+		* self-contained, so `device-collection-dispatch.ts` rule 3 hands the call
+		* to the source that claims it — and an id nobody claims is REFUSED rather
+		* than answered by another source.
+		*
+		* The producer reuses the fetch path it already has, completion rules
+		* included: a clip is taken by cmd 5 and finished on a short idle window
+		* whose result is PROVED against the catalog row's own span, retried once
+		* when it comes up materially short, and served-and-named when it is still
+		* short (D568). A second fetch with different completion rules is exactly
+		* the second authority D558 refuses to create.
+		*
+		* Every refusal THROWS with its reason and none of them is silent — the
+		* sleep gate (decided before `getApi()`, liftable only by
+		* {@link ClipWakeSchema}), a catalog row nobody claims, a clip with no
+		* bytes behind it, a mux that failed, and the size bound. The caller turns
+		* that reason into an operator-facing one; a truncated file is never an
+		* answer.
+		*/
+		readClipBytes: optionalMethod(object({
+			deviceId: number(),
+			clipId: string().min(1),
+			/**
+			* Which twin to fetch, on the mapping D549 15 already fixed:
+			* `low | mid` → the sub file, `high` → the main twin. `auto` is not
+			* accepted here for the same reason it is not accepted by
+			* `getClipPlayback` — a stored file has no broker session, so the
+			* adaptive tier cannot be resolved for it.
+			*/
+			profile: CamProfileSchema.optional(),
+			/**
+			* The CALLER's byte bound, so an over-size clip is refused before it is
+			* read and encoded rather than after. Capped by
+			* {@link VIDEOCLIPS_MAX_READ_BYTES} whatever is passed; absent means
+			* that ceiling.
+			*/
+			maxBytes: number().int().positive().optional(),
+			/**
+			* The operator's authorisation to wake a sleeping camera for this
+			* read. Absent — the default — means a sleeping standalone battery
+			* camera is REFUSED by name, before any session is opened.
+			*/
+			wake: ClipWakeSchema.optional()
+		}), ClipBytesSchema, {
+			kind: "query",
+			auth: "protected"
 		})
 	}
 };
@@ -33864,13 +34009,101 @@ var ExportStateSchema = _enum([
 	"expired",
 	"deleted"
 ]);
-/** One export job / history row. */
+/**
+* WHAT an export is — the authority, as opposed to the four top-level fields
+* the Library sorts and labels on (D558 § 2.2).
+*
+* Read it through {@link exportSubjectOf}, never off the record directly: the
+* field is optional for the history rows written before it existed, and that
+* absence has exactly one interpreter.
+*/
+var ExportSubjectSchema = discriminatedUnion("kind", [object({
+	kind: literal("footage"),
+	deviceId: number(),
+	profiles: array(string()).min(1),
+	fromMs: number(),
+	toMs: number()
+}), object({
+	kind: literal("clip"),
+	deviceId: number(),
+	provider: string().min(1),
+	source: string().min(1),
+	sourceLabel: string().min(1),
+	clipId: string().min(1),
+	/**
+	* WHERE IN THE CATALOG to confirm this clip — the day window the surface was
+	* already listing when the operator picked the segment.
+	*
+	* It is **not** a time range control and it never becomes one: the record's
+	* `fromMs`/`toMs` come from the catalog ROW and from nothing a caller
+	* supplied (D558 § 5.4.3), and a window that does not contain the clip is a
+	* `catalog-miss`, not a silently wider search. It exists because
+	* `videoclips.listClips` takes `since`/`until` and has no by-handle twin:
+	* the catalog check D558 asks for is literally that call, and a call needs a
+	* window. The surface has one — `ClipsBrowser`'s `dayWindow`, one local
+	* wall-clock day, which is also the only width measured to be cheap (one
+	* day on 592 lists 171 clips in 712 ms, a busy day 546 in 2.0 s; twenty days
+	* of one child's events took 3.6–5.4 s).
+	*/
+	catalogWindow: object({
+		sinceMs: number(),
+		untilMs: number()
+	}),
+	profile: _enum([
+		"high",
+		"mid",
+		"low"
+	]),
+	/**
+	* The operator's authorisation to wake a sleeping camera for this export.
+	* ONE definition, in the cap that owns the clip read ({@link ClipWakeSchema}),
+	* because the gate that honours it is the clip provider's sleep gate — a
+	* second enum here would be a second contract. Absent by default; never
+	* settable by a scheduler or a retry.
+	*
+	* **One authorised yes is ONE wake.** A failed clip export is retried only by
+	* an operator act that asks again; a queued job that outlived its wake fails
+	* with a reason rather than waking on its turn; and this subject carries
+	* exactly one profile precisely so one tap is never two fetches (D558 § 5.2).
+	*/
+	wake: ClipWakeSchema.optional()
+})]);
+/**
+* One export job / history row.
+*
+* **`subject` is the AUTHORITY on what was exported. `deviceId`, `profile`,
+* `fromMs` and `toMs` are its PROJECTION** — kept top-level because the whole
+* Library sorts and labels on them (`library-items.ts` orders an export by
+* `fromMs`; `export-format.ts` draws `rangeLabel` from the pair), and a row
+* that did not fill them would sort under the epoch and render a blank range.
+* Write to the subject and read from the projection and the two will disagree;
+* the projection is derived at creation and never edited afterwards.
+*
+* And they mean DIFFERENT FACTS for the two kinds, which is the part a reader
+* who knows only the recording export will get wrong:
+*
+* | field | `kind:'footage'` | `kind:'clip'` |
+* | --- | --- | --- |
+* | `fromMs`/`toMs` | the stretch the operator ASKED for | the camera's own boundaries, always `clip.timeRange`, never anything a caller supplied |
+* | `profile` | the stream rendered | the twin actually SERVED (`subject.profile` is the one asked for) |
+*
+* Same type, different fact — the shape this repo keeps getting wrong (D385's
+* two authorities, D224's second copy).
+*/
 var ExportRecordSchema = object({
 	id: string(),
 	deviceId: number(),
 	profile: string(),
 	fromMs: number(),
 	toMs: number(),
+	/**
+	* What this export IS. Optional ONLY for the rows written before D558: the
+	* store parses every row through this schema on every read, so a required
+	* field would make the export AUDIT — which is the whole reason rows survive
+	* file deletion — unreadable in one release. Absence means `footage`, and
+	* {@link exportSubjectOf} is the one place that says so.
+	*/
+	subject: ExportSubjectSchema.optional(),
 	options: ExportOptionsSchema,
 	state: ExportStateSchema,
 	/** 0–100 while rendering; null otherwise. */
@@ -33887,6 +34120,49 @@ var ExportRecordSchema = object({
 	/** Failure reason when state is 'failed'; null otherwise. */
 	error: string().nullable()
 });
+/**
+* Every way a clip export can fail, as a TOKEN — never prose.
+*
+* A branch that accepts work and produces nothing is the branch this repo
+* keeps losing work in (D391), and a clip export has five places to lose it
+* that a recording export does not have. The token is what a surface may key
+* a table on; the PROSE — the camera's own words, the source's verbatim
+* refusal — travels with it, in the same `ExportRecord.error` string, after a
+* `: `. Two separate things in one field because the field is one field:
+* `ClipStillRefusalCodeSchema` split them across two HTTP headers for the same
+* reason, and the surface that keyed on the whole header rendered every
+* refusal on this fleet as `Refused: <prose>`.
+*
+* Compose with {@link clipExportFailure}, read back with
+* {@link clipExportFailureOf}. Never hand-spell the separator.
+*/
+var ClipExportFailureSchema = _enum([
+	"catalog-miss",
+	"catalog-unreachable",
+	"no-file-for-window",
+	"clip-in-progress",
+	"unsupported-option",
+	"sleeping",
+	"camera-refused",
+	"fetch-failed",
+	"too-large-to-transfer",
+	"wake-expired"
+]);
+/** `<token>: <prose>` — the ONE composition of a clip export's failure string. */
+function clipExportFailure(code, detail) {
+	return detail.length > 0 ? `${code}: ${detail}` : code;
+}
+/**
+* The token out of an {@link ExportRecord.error}, or null when the string did
+* not come from {@link clipExportFailure} (every footage failure, and every
+* error thrown by something that never heard of this vocabulary).
+*/
+function clipExportFailureOf(error) {
+	if (error === null) return null;
+	const head = error.split(":", 1)[0] ?? "";
+	const parsed = ClipExportFailureSchema.safeParse(head.trim());
+	return parsed.success ? parsed.data : null;
+}
 /** Candidate download URLs (LAN first, then operator extra hosts). */
 var ExportDownloadSchema = object({
 	url: string(),
@@ -33924,29 +34200,150 @@ var ExportBytesSchema = object({
 	name: string(),
 	bytes: number().int().nonnegative()
 });
+/** Canonical `profiles[]`, falling back to the legacy singular `profile`. */
+function resolveExportProfiles(input) {
+	if (input.profiles !== void 0 && input.profiles.length > 0) return [...input.profiles];
+	if (typeof input.profile === "string" && input.profile.length > 0) return [input.profile];
+	return [];
+}
+/**
+* `createExport` input — ONE object carrying an optional {@link ExportSubject},
+* never a union of two inputs.
+*
+* It has to be a ZodObject: generated routers call `.input.loose()` so the
+* out-of-band `nodeId` selector survives the wire parse, and `.loose()` is a
+* ZodObject method a `z.discriminatedUnion` does not have. That is why the
+* discriminant sits one level down, in `subject`, and why
+* {@link resolveCreateExportSubject} — not a `z.preprocess` wrapper, which
+* would have produced a schema with no `.loose()` — is the one reading of a
+* legacy flat input as a subject.
+*
+* **`deviceId` stays REQUIRED at the top level**, for both kinds, and a clip
+* subject naming a different one is REFUSED. Not symmetry: `METHOD_DEVICE_SELECTORS`
+* (generated) maps top-level fields and one-level object arrays, so per-device
+* scope enforcement in `scope-access.ts` reads THIS field and cannot see
+* `subject.deviceId`. A deviceId that lived only in the subject would let a
+* principal scoped to one camera create an export — and, on the clip path, a
+* WAKE — for another.
+*
+* **A clip carries no time range**, and one supplied alongside a clip subject
+* is refused rather than ignored: there is no drag on this path and nothing to
+* normalise (D558 § 5.4.3). The record's `fromMs`/`toMs` come from the clip's
+* own `timeRange` and from nowhere else.
+*/
+var CreateExportInputSchema = object({
+	deviceId: number(),
+	/** @deprecated Prefer `profiles`. Kept so timelapse/notifiers keep working. */
+	profile: string().optional(),
+	profiles: array(string()).min(1).optional(),
+	/** Footage only — a clip's boundaries are the camera's. */
+	fromMs: number().optional(),
+	toMs: number().optional(),
+	/** What to export. Absent means the legacy flat footage request. */
+	subject: ExportSubjectSchema.optional(),
+	options: ExportOptionsSchema
+}).superRefine((v, ctx) => {
+	if (v.subject?.kind === "clip") {
+		if (v.subject.deviceId !== v.deviceId) ctx.addIssue({
+			code: ZodIssueCode.custom,
+			message: `subject.deviceId (${v.subject.deviceId}) must equal deviceId (${v.deviceId}) — the top-level field is what per-device scope enforcement reads`,
+			path: ["subject", "deviceId"]
+		});
+		if (v.fromMs !== void 0 || v.toMs !== void 0) ctx.addIssue({
+			code: ZodIssueCode.custom,
+			message: "a clip export asks for no time range: the camera chose the boundaries and they are read from the catalog row",
+			path: ["fromMs"]
+		});
+		return;
+	}
+	if (v.subject?.kind === "footage" && v.subject.deviceId !== v.deviceId) ctx.addIssue({
+		code: ZodIssueCode.custom,
+		message: `subject.deviceId (${v.subject.deviceId}) must equal deviceId (${v.deviceId})`,
+		path: ["subject", "deviceId"]
+	});
+	const fromMs = v.subject?.kind === "footage" ? v.subject.fromMs : v.fromMs;
+	const toMs = v.subject?.kind === "footage" ? v.subject.toMs : v.toMs;
+	if (typeof fromMs !== "number" || typeof toMs !== "number") ctx.addIssue({
+		code: ZodIssueCode.custom,
+		message: "a footage export needs fromMs and toMs",
+		path: ["fromMs"]
+	});
+	if ((v.subject?.kind === "footage" ? [...v.subject.profiles] : resolveExportProfiles(v)).length < 1) ctx.addIssue({
+		code: ZodIssueCode.custom,
+		message: "pass profiles[] (min 1) or legacy profile",
+		path: ["profiles"]
+	});
+});
+/**
+* The ONE reading of a `createExport` input as a {@link ExportSubject}.
+*
+* Every consumer goes through this: a provider that branched on
+* `input.subject !== undefined` in one place and on `input.fromMs` in another
+* would be two authorities on what was asked for, which is how the flat fields
+* and the subject drift apart.
+*
+* Throws on a footage input with no range — an input that parsed cannot reach
+* that, and a caller that skipped the parse gets a named refusal rather than
+* `NaN` boundaries on a durable row.
+*/
+function resolveCreateExportSubject(input) {
+	if (input.subject !== void 0) return input.subject;
+	const profiles = resolveExportProfiles(input);
+	if (typeof input.fromMs !== "number" || typeof input.toMs !== "number") throw new Error("recording-export: a footage export needs fromMs and toMs");
+	return {
+		kind: "footage",
+		deviceId: input.deviceId,
+		profiles,
+		fromMs: input.fromMs,
+		toMs: input.toMs
+	};
+}
+/**
+* The ONE interpreter of a stored row's subject.
+*
+* `ExportRecord.subject` is optional for exactly one reason — the history rows
+* written before D558 — and "absent means footage, built from the projection"
+* is a statement that must live in one place. Anything that reads
+* `rec.subject` directly and falls back inline is the second authority.
+*/
+function exportSubjectOf(rec) {
+	if (rec.subject !== void 0) return rec.subject;
+	return {
+		kind: "footage",
+		deviceId: rec.deviceId,
+		profiles: [rec.profile],
+		fromMs: rec.fromMs,
+		toMs: rec.toMs
+	};
+}
 var recordingExportCapability = {
 	name: "recording-export",
 	scope: "system",
 	mode: "singleton",
 	methods: {
-		/** Queue a render of `[fromMs,toMs)` for `deviceId`/`profiles` (legacy
-		*  singular `profile` still accepted). Fails fast when no footage covers
-		*  the range. One job per profile; returns the first queued record. */
-		createExport: method(object({
-			deviceId: number(),
-			/** @deprecated Prefer `profiles`. Kept so timelapse/notifiers keep working. */
-			profile: string().optional(),
-			profiles: array(string()).min(1).optional(),
-			fromMs: number(),
-			toMs: number(),
-			options: ExportOptionsSchema
-		}).superRefine((v, ctx) => {
-			if ((v.profiles !== void 0 && v.profiles.length > 0 ? v.profiles : v.profile !== void 0 ? [v.profile] : []).length < 1) ctx.addIssue({
-				code: ZodIssueCode.custom,
-				message: "pass profiles[] (min 1) or legacy profile",
-				path: ["profiles"]
-			});
-		}), ExportRecordSchema, {
+		/**
+		* Queue an export of {@link ExportSubjectSchema}.
+		*
+		* `kind:'footage'` — a render of `[fromMs,toMs)` for `deviceId`/`profiles`
+		* (legacy flat input, singular `profile` included, still accepted and
+		* rewritten). Fails fast when no footage covers the range. One job per
+		* profile; **returns the first queued record and the others are reachable
+		* only through `listExports`** — a defect named in D558 § 6.3 and the
+		* reason a clip subject carries exactly ONE profile.
+		*
+		* `kind:'clip'` — a finished file the camera holds, validated against the
+		* device's clip CATALOG (`videoclips.listClips`, at the subject's
+		* `provider`) instead of the recording index, and fetched once by handle
+		* under a bound. Its `fromMs`/`toMs` come from the catalog row and from
+		* nowhere else; a caller supplying a range is refused.
+		*
+		* A clip export reuses the six {@link ExportStateSchema} members and adds
+		* none: the viewer maps an unknown state string to `failed`, so a seventh
+		* member renders every live export — of both kinds — as FAILED on every
+		* installed app (D558 § 6.1, pinned by `export-state-members.spec.ts`).
+		* `subject.kind` is what tells a surface what `rendering` means.
+		*/
+		createExport: method(CreateExportInputSchema, ExportRecordSchema, {
 			kind: "mutation",
 			auth: "protected"
 		}),
@@ -42158,6 +42555,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"videoclips.readClipBytes": {
+		capName: "videoclips",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"viewerUi.getStaticDir": {
 		capName: "viewer-ui",
 		capScope: "system",
@@ -44176,6 +44579,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"videoclips.readClipBytes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"waterHeater.setAway": [{
 		name: "deviceId",
 		form: "single",
@@ -45935,4 +46343,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { evaluateZoneRules as $, createEvent as $t, RecordingConfigSchema as A, resolveLocationMode as At, cameraStreamsCapability as B, webrtcSessionCapability as Bt, NativeLeaseAdmissionSchema as C, union as Cn, pipelineRunnerCapability as Ct, RATE_CONTROL_RELAXED as D, recordingSignalCapability as Dt, PoolMemoryWatchdog as E, recordingExportCapability as Et, addonWidgetsSourceCapability as F, storageOccupancyCapability as Ft, deriveBatteryPresence as G, invocationFromEncodeProfile as Gt, createLogChannelsProvider as H, AUDIO_PRESETS as Ht, audioAnalysisCapability as I, streamBrokerCapability as It, detectionPipelineCapability as J, BaseAddon as Jt, deriveDetailCropRect as K, isSoftwareDecode as Kt, audioAnalyzerCapability as L, stripRetiredBandPreBufferSec as Lt, RingBuffer as M, resolveRecordingProfiles as Mt, VISIT_MERGE_GAP_MS as N, runtimeDevices as Nt, RATE_CONTROL_TIGHT as O, resolveClusterStepModelId as Ot, YAMNET_TO_MACRO as P, storageEvictableCapability as Pt, evaluateSensorEdge as Q, audioChunkBytesPerSample as Qt, audioKindId as R, supportedRuntimes as Rt, MOTION_CLOSE_AFTER_MS as S, string as Sn, pipelineExecutorCapability as St, OpsLogEntrySchema as T, recordingCapability as Tt, declareLogChannel as U, Fmp4BoxSplitter as Ut, createHwAccelCache as V, errMsg as Vt, defaultDeviceFor as W, buildFfmpegArgs as Wt, egressTransportFromRequest as X, DeviceFeature as Xt, egressTranscodeSharingKey as Y, CAM_PROFILE_ORDER as Yt, enumerateInferenceDevices as Z, DeviceType as Zt, EncodeProfileSchema as _, literal as _n, parseProcStatus as _t, COCO_80_LABELS as a, makeProfileBrokerId as an, inferModelProvider as at, G711_SCALE_CORRECTION_DB as b, preprocess as bn, pickDetailCropConvention as bt, DEFAULT_CLUSTER_STEP_MODELS as c, parseJsonUnknown as cn, logChannelsCapability as ct, DEFAULT_EVENTS_BAND_BUFFER_SEC as d, sleep as dn, mayReadLocation as dt, customAction as en, evictionPolicyForMode as et, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as f, _enum as fn, mayWriteToLocation as ft, EVENT_PAD_MS as g, lazy as gn, overlayClusterStepSettings as gt, EVENT_OWNER_TYPES as h, discriminatedUnion as hn, motionDetectionCapability as ht, BatteryStatusSchema as i, isEvent as in, hfModelUrl as it, RecordingSignalStatusSchema as j, resolvePoolMemoryPolicy as jt, RECORDING_EXPORT_MAX_READ_BYTES as k, resolveEgressDecodeHwAccel as kt, DEFAULT_CLUSTER_STEP_SETTINGS as l, parseProfileBrokerId as ln, mapAudioLabelToMacro as lt, DEVICE_BACKEND_TO_FORMAT as m, boolean as mn, modeMayWrite as mt, AUDIO_BACKEND_CHOICES as n, expandAudioChunkToF32le as nn, failureContributionCapability as nt, COCO_TO_MACRO as o, makeSourceBrokerId as on, isFirstLevelMacroClass as ot, DEFAULT_NATIVE_LEASE_SETTINGS as p, array as pn, migrateLegacyDeviceSignalConfig as pt, deriveRecordingMode as q, BOOT_RECOVERY_BACKOFF_MS as qt, AUDIO_MACRO_LABELS as r, hydrateSchema as rn, gbToBytes as rt, DEFAULT_AUDIO_ANALYZER_CONFIG as s, nodePin as sn, loadContributionCapability as st, APPLE_SA_TO_MACRO as t, defineCustomActions as tn, evictionPolicyOfLocation as tt, DEFAULT_DETAIL_CROP_CONVENTION as u, selectAssignedProfileSlots as un, maskUrlCredentials as ut, ExportRecordSchema as v, number as vn, pickClusterStepModels as vt, NativeLeaseSettingsSchema as w, EventCategory as wn, rankStreams as wt, HF_BASE_URL as x, record as xn, pickNativeLeaseOverride as xt, FailureCounters as y, object as yn, pickClusterStepSettings as yt, batteryCapability as z, videoclipsCapability as zt };
+export { enumerateInferenceDevices as $, CAM_PROFILE_ORDER as $t, RecordingConfigSchema as A, recordingSignalCapability as At, cameraStreamsCapability as B, streamBrokerCapability as Bt, NativeLeaseAdmissionSchema as C, number as Cn, pickDetailCropConvention as Ct, RATE_CONTROL_RELAXED as D, string as Dn, rankStreams as Dt, PoolMemoryWatchdog as E, record as En, pipelineRunnerCapability as Et, addonWidgetsSourceCapability as F, resolvePoolMemoryPolicy as Ft, declareLogChannel as G, errMsg as Gt, clipExportFailureOf as H, supportedRuntimes as Ht, audioAnalysisCapability as I, resolveRecordingProfiles as It, deriveDetailCropRect as J, buildFfmpegArgs as Jt, defaultDeviceFor as K, AUDIO_PRESETS as Kt, audioAnalyzerCapability as L, runtimeDevices as Lt, RingBuffer as M, resolveCreateExportSubject as Mt, VISIT_MERGE_GAP_MS as N, resolveEgressDecodeHwAccel as Nt, RATE_CONTROL_TIGHT as O, union as On, recordingCapability as Ot, YAMNET_TO_MACRO as P, resolveLocationMode as Pt, egressTransportFromRequest as Q, BaseAddon as Qt, audioKindId as R, storageEvictableCapability as Rt, MOTION_CLOSE_AFTER_MS as S, literal as Sn, pickClusterStepSettings as St, OpsLogEntrySchema as T, preprocess as Tn, pipelineExecutorCapability as Tt, createHwAccelCache as U, videoclipsCapability as Ut, clipExportFailure as V, stripRetiredBandPreBufferSec as Vt, createLogChannelsProvider as W, webrtcSessionCapability as Wt, detectionPipelineCapability as X, isSoftwareDecode as Xt, deriveRecordingMode as Y, invocationFromEncodeProfile as Yt, egressTranscodeSharingKey as Z, BOOT_RECOVERY_BACKOFF_MS as Zt, EncodeProfileSchema as _, _enum as _n, modeMayWrite as _t, COCO_80_LABELS as a, customAction as an, failureContributionCapability as at, G711_SCALE_CORRECTION_DB as b, discriminatedUnion as bn, parseProcStatus as bt, DEFAULT_CLUSTER_STEP_MODELS as c, hydrateSchema as cn, inferModelProvider as ct, DEFAULT_EVENTS_BAND_BUFFER_SEC as d, makeSourceBrokerId as dn, logChannelsCapability as dt, CamProfileSchema as en, evaluateSensorEdge as et, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as f, nodePin as fn, mapAudioLabelToMacro as ft, EVENT_PAD_MS as g, sleep as gn, migrateLegacyDeviceSignalConfig as gt, EVENT_OWNER_TYPES as h, selectAssignedProfileSlots as hn, mayWriteToLocation as ht, BatteryStatusSchema as i, createEvent as in, exportSubjectOf as it, RecordingSignalStatusSchema as j, resolveClusterStepModelId as jt, RECORDING_EXPORT_MAX_READ_BYTES as k, EventCategory as kn, recordingExportCapability as kt, DEFAULT_CLUSTER_STEP_SETTINGS as l, isEvent as ln, isFirstLevelMacroClass as lt, DEVICE_BACKEND_TO_FORMAT as m, parseProfileBrokerId as mn, mayReadLocation as mt, AUDIO_BACKEND_CHOICES as n, DeviceType as nn, evictionPolicyForMode as nt, COCO_TO_MACRO as o, defineCustomActions as on, gbToBytes as ot, DEFAULT_NATIVE_LEASE_SETTINGS as p, parseJsonUnknown as pn, maskUrlCredentials as pt, deriveBatteryPresence as q, Fmp4BoxSplitter as qt, AUDIO_MACRO_LABELS as r, audioChunkBytesPerSample as rn, evictionPolicyOfLocation as rt, DEFAULT_AUDIO_ANALYZER_CONFIG as s, expandAudioChunkToF32le as sn, hfModelUrl as st, APPLE_SA_TO_MACRO as t, DeviceFeature as tn, evaluateZoneRules as tt, DEFAULT_DETAIL_CROP_CONVENTION as u, makeProfileBrokerId as un, loadContributionCapability as ut, ExportRecordSchema as v, array as vn, motionDetectionCapability as vt, NativeLeaseSettingsSchema as w, object as wn, pickNativeLeaseOverride as wt, HF_BASE_URL as x, lazy as xn, pickClusterStepModels as xt, FailureCounters as y, boolean as yn, overlayClusterStepSettings as yt, batteryCapability as z, storageOccupancyCapability as zt };