@camstack/addon-post-analysis 1.2.64 → 1.2.65

package/dist/{dist-CSTtfEOC.mjs → dist-4dhFDogy.mjs}

@@ -7390,8 +7390,31 @@ var AdoptionJobSchema = object({
 	error: string().nullable()
 });
 /**
-* Per-camera FUNCTION SWITCHES — the one coherent on/off surface over the
-* pipeline functions an operator thinks in terms of.
+* Per-camera FUNCTION SWITCHES.
+*
+* ## The aggregate group is being withdrawn — the BADGE is not (D113)
+*
+* This file shipped as "the one coherent on/off surface over the pipeline
+* functions an operator thinks in terms of". The operator's verdict on
+* 2026-08-12 was that the coherent surface bought complexity and no clarity:
+* every function already had a settings page of its own, and a second place to
+* turn it off is a second place to look. Each switch is going back to its own
+* component's original options — detection to the detection-pipeline wrapper
+* binding, audio analysis to its own, recording to `RecordingConfig.enabled`
+* (which was always first-class; the switch was a veneer over
+* `recording.setDeviceConfig`), notifications to a notification-center
+* per-device setting, the two camera planes to their own components.
+*
+* What survives is {@link composeSwitchedOff}: `CameraStatus.switchedOff`, the
+* thing that lets a status surface say DISABLED instead of BROKEN, recomposed
+* straight from the authorities with no group in the middle. That rule was
+* never about a control panel.
+*
+* Everything else here — {@link CAMERA_SWITCH_CATALOG}, {@link CameraSwitch},
+* {@link deriveCameraSwitches}, the `pipelineOrchestrator.getCameraSwitches` /
+* `setCameraSwitch` pair — is a COMPATIBILITY surface for as long as deployed
+* viewers (v1.0.305) and the admin UI still call it. It is deleted when they
+* stop; nothing new may be built on it.
 *
 * ## This file adds no state
 *
@@ -7753,6 +7776,22 @@ var RecordingConfigSchema = object({
 	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
 }).strict();
 /**
+* Derive the {@link RecordingStorageModeSchema} summary from the authoritative
+* bands: `continuous` when any band records continuously, `events` when a band
+* exists at all, else `off`. Pure.
+*
+* THE one definition: the recorder stamps `config.mode` with it on save and
+* reports it as the cap's `activeMode`, and the settings UI reads it back to
+* decide which authoring tab a config opens in. Two copies would drift, and the
+* symptom (a status dot disagreeing with what is being recorded) is exactly the
+* bug this field was added to fix.
+*/
+function deriveRecordingMode(config) {
+	if (!config.enabled || config.bands.length === 0) return "off";
+	if (config.bands.some((band) => band.mode === "continuous")) return "continuous";
+	return "events";
+}
+/**
 * Entity-relocation job state (storage entity-routing spec, Phase 4).
 *
 * One shape shared by the recorder and pipeline-analytics internal movers.
@@ -18882,9 +18921,16 @@ var CameraStatusSchema = object({
 	audio: CameraAudioStatusSchema.nullable(),
 	recording: CameraRecordingStatusSchema.nullable(),
 	/**
-	* Per-camera function switches an OPERATOR has turned off
+	* Per-camera functions an OPERATOR has turned off
 	* ([D61](../../../../docs/decisions/adr-0067.md)).
 	*
+	* Composed from the AUTHORITIES themselves — the wrapper bindings,
+	* `RecordingConfig.enabled`, the notification mute, the broker's audio
+	* policy, the camera's own microphone — via `composeSwitchedOff`, not from
+	* the deprecated `getCameraSwitches` group ([D113](../../../../docs/decisions/adr-0113.md)).
+	* The badge outlives the control panel: the panel was a convenience, this is
+	* the difference between a camera being off and a camera being dead.
+	*
 	* This is the difference between DISABLED and BROKEN. A camera whose
 	* `detection` block reports zero fps and whose `switchedOff` contains
 	* `'object-detection'` was switched off by a person; the same camera with an
@@ -25937,10 +25983,42 @@ method(object({
 */
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = number().min(.25).max(32);
+/**
+* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+*
+* Relative and not absolute epoch on purpose: the renderer's frame-select
+* expression sees ffmpeg's `t`, which starts at 0 for the export's source
+* playlist. Handing it absolute epochs would make every call site responsible
+* for the same subtraction, and the one that forgot would emit a filter that
+* selects nothing — silently, as a uniform timelapse.
+*/
+var ExportDenseRangeSchema = object({
+	fromSec: number().nonnegative(),
+	toSec: number().nonnegative()
+}).refine((r) => r.toSec > r.fromSec, { message: "dense range must have toSec > fromSec" });
+/**
+* Dense-interval overlay for a timelapse: sample at `dense.everyMs` INSIDE the
+* listed ranges and at the base `everyMs` everywhere else.
+*
+* `everyMs` must be strictly smaller than the base cadence — a dense rate that
+* is not denser renders a uniform timelapse the operator believes is two-rate.
+*/
+var ExportDenseSchema = object({
+	everyMs: number().int().positive(),
+	ranges: array(ExportDenseRangeSchema).min(1).max(200)
+});
 /** Timelapse cadence — sample one source frame per `everyMs`, output at `outputFps`. */
 var ExportTimelapseSchema = object({
 	everyMs: number().int().positive(),
-	outputFps: number().int().min(1).max(60).optional()
+	outputFps: number().int().min(1).max(60).optional(),
+	/** Optional second, FASTER rate over the intervals that matter. */
+	dense: ExportDenseSchema.optional()
+}).superRefine((v, ctx) => {
+	if (v.dense !== void 0 && v.dense.everyMs >= v.everyMs) ctx.addIssue({
+		code: ZodIssueCode.custom,
+		message: "dense.everyMs must be strictly smaller than the base everyMs",
+		path: ["dense", "everyMs"]
+	});
 });
 /**
 * Render options. `speed` and `timelapse` are mutually exclusive. `includeAudio`
@@ -25998,6 +26076,38 @@ var ExportDownloadSchema = object({
 	url: string(),
 	endpoints: array(string())
 });
+/**
+* Hard ceiling on ONE {@link recordingExportCapability} byte read — 50 MiB.
+*
+* Two independent reasons land on the same number, which is why it is this one
+* and not a rounder guess:
+*
+*  - **Nobody would accept more.** The roomiest byte cap any notifier backend
+*    declares is telegram's 50 MiB, and the degrade engine DROPS an over-cap
+*    attachment outright rather than degrading it to a link. Bytes above this
+*    are read, encoded and moved to be thrown away at the last step.
+*  - **The envelope is unary.** A base64 payload is held whole, ~1.33× its
+*    size, in the provider AND in the caller — on a hub this repo has already
+*    OOM'd once (D9/D18). A bounded on-demand read at human speed is the shape
+*    those records permit; an unbounded one is the shape they forbid.
+*
+* Above it the provider REFUSES with a log line rather than truncating: half a
+* video is worse than a notification that says there is no attachment.
+*/
+var RECORDING_EXPORT_MAX_READ_BYTES = 50 * 1024 * 1024;
+/**
+* A finished export's bytes, inline.
+*
+* `bytes` is the DECODED length — the number the caller bounds and logs
+* against, so nobody has to infer it from the base64 length.
+*/
+var ExportBytesSchema = object({
+	base64: string(),
+	contentType: string(),
+	/** Suggested filename, extension included. */
+	name: string(),
+	bytes: number().int().nonnegative()
+});
 method(object({
 	deviceId: number(),
 	profile: string(),
@@ -26022,6 +26132,9 @@ method(object({
 }), method(object({ exportId: string() }), ExportDownloadSchema, {
 	kind: "query",
 	auth: "protected"
+}), method(object({ exportId: string() }), ExportBytesSchema, {
+	kind: "query",
+	auth: "protected"
 });
 /**
 * scene-monitor — device-scoped reference-region state cap. An operator marks
@@ -28488,9 +28601,10 @@ var DeclaredDevices = class {
 		}
 		const integrationId = spec.integrationId ?? await this.ensureIntegration(spec.integrationName);
 		const index = await this.readIndex();
+		const live = await this.readLiveByStableId();
 		const outcomes = [];
 		for (const declaration of spec.devices) {
-			const outcome = await this.applyDeclaration(declaration, integrationId, index);
+			const outcome = await this.applyDeclaration(declaration, integrationId, index, live);
 			if (outcome !== null) outcomes.push(outcome);
 		}
 		return {
@@ -28536,6 +28650,26 @@ var DeclaredDevices = class {
 		return new Map(rows.map((row) => [row.stableId, row]));
 	}
 	/**
+	* Devices this kernel already has CONSTRUCTED, by stableId.
+	*
+	* Distinct from {@link readIndex}, and the distinction is the bug: the index
+	* is persisted rows, this is live objects. A row without an object must be
+	* adopted; an object must be left exactly as it is.
+	*
+	* Failure is non-fatal and deliberately so — an empty map degrades to the
+	* previous behaviour (attempt the adopt) rather than skipping a device that
+	* genuinely needs bringing up.
+	*/
+	async readLiveByStableId() {
+		try {
+			const devices = await this.ports.devices.getAll();
+			return new Map(devices.map((device) => [device.stableId, device]));
+		} catch (err) {
+			this.ports.logger.warn("could not read live devices — falling back to adopt-by-row", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			return /* @__PURE__ */ new Map();
+		}
+	}
+	/**
 	* One declaration: adopt what exists, create what does not.
 	*
 	* The create branch is the destructive one — it seeds `initialMeta`, and
@@ -28544,8 +28678,15 @@ var DeclaredDevices = class {
 	* the declared name over the operator's rename. D49: that branch needs a
 	* second read to agree.
 	*/
-	async applyDeclaration(declaration, integrationId, index) {
+	async applyDeclaration(declaration, integrationId, index, live) {
 		try {
+			const alreadyLive = live.get(declaration.stableId);
+			if (alreadyLive !== void 0) return {
+				stableId: declaration.stableId,
+				deviceId: alreadyLive.id,
+				device: alreadyLive,
+				created: false
+			};
 			let existing = index.get(declaration.stableId);
 			if (existing === void 0) {
 				existing = (await this.readIndex()).get(declaration.stableId);
@@ -32886,6 +33027,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recordingExport.readExportBytes": {
+		capName: "recordingExport",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"sceneMonitor.captureReference": {
 		capName: "scene-monitor",
 		capScope: "device",
@@ -34343,7 +34490,23 @@ var TimelapseRuleInputSchema = object({
 	/** Canonical notification priority ordinal (1..5); per-target overridable. */
 	priority: PriorityField.default(3)
 });
-object({
+/**
+* Partial patch for an update — any subset of the INPUT fields, with NO
+* defaults (an absent key means "leave unchanged", never "reset to default").
+* Provenance and ownership are absent by construction: a patch can rename or
+* retune a rule, never re-own it or forge its generation state.
+*
+* CLEAR SIGNAL: `template` is the one OPTIONAL field an editor can REMOVE, so
+* it is `.nullable()` here and NOWHERE else. Wire representation:
+*  - key absent          → leave the template unchanged
+*  - `"template": null`  → CLEAR it (the persisted rule loses the key)
+*  - `"template": {...}` → replace it
+* `undefined` is deliberately NOT the clear signal: it does not survive
+* `JSON.stringify`, so a viewer editor could not express "remove". The
+* PERSISTED rule never carries `null` — the store drops the key (see
+* `TimelapseStore.update`).
+*/
+var TimelapseRulePatchSchema = object({
 	name: NameField.optional(),
 	enabled: boolean().optional(),
 	deviceIds: DeviceIdsField.optional(),
@@ -34364,15 +34527,50 @@ var TimelapseRuleSchema = TimelapseRuleInputSchema.extend({
 	*/
 	ownerUserId: string().optional(),
 	/**
-	* Epoch-ms of the last successful generation — the 1-hour re-generation
-	* guard's durable state (predecessor parity). Absent = never generated.
+	* Epoch-ms of the NEWEST successful generation across every camera of this
+	* rule. What a UI shows, and the compatibility floor for
+	* {@link readTimelapseGeneratedAt}. Absent = never generated.
 	*/
 	lastGeneratedAt: number().optional(),
+	/**
+	* PER-CAMERA generation state, keyed by `String(deviceId)` — the
+	* re-generation guard's real durable state.
+	*
+	* One rule covers several cameras and each renders its own video, so a rule
+	* -wide stamp is wrong in the direction that DESTROYS work: camera A
+	* succeeding at 06:05 tells camera B, whose render failed, that it is
+	* already done — and B's night is gone for good, because the window will not
+	* come back.
+	*
+	* ADDITIVE, so the migration is free: a row written before this field simply
+	* has no map, and {@link readTimelapseGeneratedAt} falls back to
+	* {@link TimelapseRuleSchema.shape.lastGeneratedAt}. Reading an old row as
+	* "never generated" would re-render and re-notify every camera of every rule
+	* once, on the deploy that shipped the map.
+	*/
+	generatedByDevice: record(string(), number()).optional(),
 	/** userId of the caller who created the rule (server-stamped). */
 	createdBy: string(),
 	createdAt: number(),
 	updatedAt: number()
 });
+/**
+* The last successful generation for ONE camera of a rule, epoch-ms.
+*
+* The per-device map wins; a rule with no map falls back to the rule-wide
+* `lastGeneratedAt` (the compatible-migration path — see
+* {@link TimelapseRuleSchema}); a rule with neither returns 0, which every
+* guard reads as "never generated".
+*
+* Read through this helper and never off the field directly: the fallback is
+* the whole migration, and a call site that forgot it would re-render an
+* entire rule set once.
+*/
+function readTimelapseGeneratedAt(rule, deviceId) {
+	const map = rule.generatedByDevice;
+	if (map !== void 0) return map[String(deviceId)] ?? 0;
+	return rule.lastGeneratedAt ?? 0;
+}
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -34525,4 +34723,4 @@ function vectorDimFromBase64(encoded) {
 	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
 }
 //#endregion
-export { array as $, embeddingEncoderCapability as A, subKindsOf as B, addonWidgetsSourceCapability as C, cosineSimilarity as D, buildEventKindDescriptor as E, kebabToCamel as F, BaseAddon as G, videoclipsCapability as H, notificationRulesCapability as I, hydrateSchema as J, DeviceType as K, pipelineAnalyticsCapability as L, faceGalleryCapability as M, hfModelUrl as N, customAction as O, isScheduleActive as P, _enum as Q, plateGalleryCapability as R, TrackSourceSchema as S, audioMetricsCapability as T, zoneAnalyticsCapability as U, vectorDimFromBase64 as V, errMsg as W, nodePin as X, isDeviceScopedCap as Y, sleep as Z, NcTaxonomySchema as _, EVENT_PAD_MS as a, string as at, TimelapseRuleInputSchema as b, NC_CONDITION_CATALOG as c, NcRuleInputSchema as d, boolean as et, NcRulePatchSchema as f, NcSnoozeSuppressedSchema as g, NcSnoozeSchema as h, EVENT_KIND_BY_CAP as i, record as it, encodeVectorBase64 as j, defineCustomActions as k, NC_TAXONOMY as l, NcSnoozeInputSchema as m, DEFAULT_EVENT_COLOR as n, number as nt, LabelAttributionSchema as o, unknown as ot, NcRuleSchema as p, createEvent as q, DeclaredDevices as r, object as rt, MACRO_LABELS as s, EventCategory as st, BaseDevice as t, literal as tt, NcConditionDescriptorSchema as u, OpsLogEntrySchema as v, alarmPanelCapability as w, TimelapseRuleSchema as x, RetrainStatusSchema as y, readDeviceStateFrom as z };
+export { isDeviceScopedCap as $, customAction as A, pipelineAnalyticsCapability as B, TimelapseRuleSchema as C, audioMetricsCapability as D, alarmPanelCapability as E, faceGalleryCapability as F, vectorDimFromBase64 as G, readDeviceStateFrom as H, hfModelUrl as I, errMsg as J, videoclipsCapability as K, isScheduleActive as L, deriveRecordingMode as M, embeddingEncoderCapability as N, buildEventKindDescriptor as O, encodeVectorBase64 as P, hydrateSchema as Q, kebabToCamel as R, TimelapseRulePatchSchema as S, addonWidgetsSourceCapability as T, readTimelapseGeneratedAt as U, plateGalleryCapability as V, subKindsOf as W, DeviceType as X, BaseAddon as Y, createEvent as Z, NcTaxonomySchema as _, EVENT_PAD_MS as a, literal as at, RetrainStatusSchema as b, NC_CONDITION_CATALOG as c, record as ct, NcRuleInputSchema as d, EventCategory as dt, nodePin as et, NcRulePatchSchema as f, NcSnoozeSuppressedSchema as g, NcSnoozeSchema as h, EVENT_KIND_BY_CAP as i, boolean as it, defineCustomActions as j, cosineSimilarity as k, NC_TAXONOMY as l, string as lt, NcSnoozeInputSchema as m, DEFAULT_EVENT_COLOR as n, _enum as nt, LabelAttributionSchema as o, number as ot, NcRuleSchema as p, zoneAnalyticsCapability as q, DeclaredDevices as r, array as rt, MACRO_LABELS as s, object as st, BaseDevice as t, sleep as tt, NcConditionDescriptorSchema as u, unknown as ut, OpsLogEntrySchema as v, TrackSourceSchema as w, TimelapseRuleInputSchema as x, RECORDING_EXPORT_MAX_READ_BYTES as y, notificationRulesCapability as z };

package/dist/{dist-BQ-M7jn9.js → dist-DTClXZLm.js}

@@ -7421,8 +7421,31 @@ var AdoptionJobSchema = object({
 	error: string().nullable()
 });
 /**
-* Per-camera FUNCTION SWITCHES — the one coherent on/off surface over the
-* pipeline functions an operator thinks in terms of.
+* Per-camera FUNCTION SWITCHES.
+*
+* ## The aggregate group is being withdrawn — the BADGE is not (D113)
+*
+* This file shipped as "the one coherent on/off surface over the pipeline
+* functions an operator thinks in terms of". The operator's verdict on
+* 2026-08-12 was that the coherent surface bought complexity and no clarity:
+* every function already had a settings page of its own, and a second place to
+* turn it off is a second place to look. Each switch is going back to its own
+* component's original options — detection to the detection-pipeline wrapper
+* binding, audio analysis to its own, recording to `RecordingConfig.enabled`
+* (which was always first-class; the switch was a veneer over
+* `recording.setDeviceConfig`), notifications to a notification-center
+* per-device setting, the two camera planes to their own components.
+*
+* What survives is {@link composeSwitchedOff}: `CameraStatus.switchedOff`, the
+* thing that lets a status surface say DISABLED instead of BROKEN, recomposed
+* straight from the authorities with no group in the middle. That rule was
+* never about a control panel.
+*
+* Everything else here — {@link CAMERA_SWITCH_CATALOG}, {@link CameraSwitch},
+* {@link deriveCameraSwitches}, the `pipelineOrchestrator.getCameraSwitches` /
+* `setCameraSwitch` pair — is a COMPATIBILITY surface for as long as deployed
+* viewers (v1.0.305) and the admin UI still call it. It is deleted when they
+* stop; nothing new may be built on it.
 *
 * ## This file adds no state
 *
@@ -7784,6 +7807,22 @@ var RecordingConfigSchema = object({
 	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
 }).strict();
 /**
+* Derive the {@link RecordingStorageModeSchema} summary from the authoritative
+* bands: `continuous` when any band records continuously, `events` when a band
+* exists at all, else `off`. Pure.
+*
+* THE one definition: the recorder stamps `config.mode` with it on save and
+* reports it as the cap's `activeMode`, and the settings UI reads it back to
+* decide which authoring tab a config opens in. Two copies would drift, and the
+* symptom (a status dot disagreeing with what is being recorded) is exactly the
+* bug this field was added to fix.
+*/
+function deriveRecordingMode(config) {
+	if (!config.enabled || config.bands.length === 0) return "off";
+	if (config.bands.some((band) => band.mode === "continuous")) return "continuous";
+	return "events";
+}
+/**
 * Entity-relocation job state (storage entity-routing spec, Phase 4).
 *
 * One shape shared by the recorder and pipeline-analytics internal movers.
@@ -18913,9 +18952,16 @@ var CameraStatusSchema = object({
 	audio: CameraAudioStatusSchema.nullable(),
 	recording: CameraRecordingStatusSchema.nullable(),
 	/**
-	* Per-camera function switches an OPERATOR has turned off
+	* Per-camera functions an OPERATOR has turned off
 	* ([D61](../../../../docs/decisions/adr-0067.md)).
 	*
+	* Composed from the AUTHORITIES themselves — the wrapper bindings,
+	* `RecordingConfig.enabled`, the notification mute, the broker's audio
+	* policy, the camera's own microphone — via `composeSwitchedOff`, not from
+	* the deprecated `getCameraSwitches` group ([D113](../../../../docs/decisions/adr-0113.md)).
+	* The badge outlives the control panel: the panel was a convenience, this is
+	* the difference between a camera being off and a camera being dead.
+	*
 	* This is the difference between DISABLED and BROKEN. A camera whose
 	* `detection` block reports zero fps and whose `switchedOff` contains
 	* `'object-detection'` was switched off by a person; the same camera with an
@@ -25968,10 +26014,42 @@ method(object({
 */
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = number().min(.25).max(32);
+/**
+* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+*
+* Relative and not absolute epoch on purpose: the renderer's frame-select
+* expression sees ffmpeg's `t`, which starts at 0 for the export's source
+* playlist. Handing it absolute epochs would make every call site responsible
+* for the same subtraction, and the one that forgot would emit a filter that
+* selects nothing — silently, as a uniform timelapse.
+*/
+var ExportDenseRangeSchema = object({
+	fromSec: number().nonnegative(),
+	toSec: number().nonnegative()
+}).refine((r) => r.toSec > r.fromSec, { message: "dense range must have toSec > fromSec" });
+/**
+* Dense-interval overlay for a timelapse: sample at `dense.everyMs` INSIDE the
+* listed ranges and at the base `everyMs` everywhere else.
+*
+* `everyMs` must be strictly smaller than the base cadence — a dense rate that
+* is not denser renders a uniform timelapse the operator believes is two-rate.
+*/
+var ExportDenseSchema = object({
+	everyMs: number().int().positive(),
+	ranges: array(ExportDenseRangeSchema).min(1).max(200)
+});
 /** Timelapse cadence — sample one source frame per `everyMs`, output at `outputFps`. */
 var ExportTimelapseSchema = object({
 	everyMs: number().int().positive(),
-	outputFps: number().int().min(1).max(60).optional()
+	outputFps: number().int().min(1).max(60).optional(),
+	/** Optional second, FASTER rate over the intervals that matter. */
+	dense: ExportDenseSchema.optional()
+}).superRefine((v, ctx) => {
+	if (v.dense !== void 0 && v.dense.everyMs >= v.everyMs) ctx.addIssue({
+		code: ZodIssueCode.custom,
+		message: "dense.everyMs must be strictly smaller than the base everyMs",
+		path: ["dense", "everyMs"]
+	});
 });
 /**
 * Render options. `speed` and `timelapse` are mutually exclusive. `includeAudio`
@@ -26029,6 +26107,38 @@ var ExportDownloadSchema = object({
 	url: string(),
 	endpoints: array(string())
 });
+/**
+* Hard ceiling on ONE {@link recordingExportCapability} byte read — 50 MiB.
+*
+* Two independent reasons land on the same number, which is why it is this one
+* and not a rounder guess:
+*
+*  - **Nobody would accept more.** The roomiest byte cap any notifier backend
+*    declares is telegram's 50 MiB, and the degrade engine DROPS an over-cap
+*    attachment outright rather than degrading it to a link. Bytes above this
+*    are read, encoded and moved to be thrown away at the last step.
+*  - **The envelope is unary.** A base64 payload is held whole, ~1.33× its
+*    size, in the provider AND in the caller — on a hub this repo has already
+*    OOM'd once (D9/D18). A bounded on-demand read at human speed is the shape
+*    those records permit; an unbounded one is the shape they forbid.
+*
+* Above it the provider REFUSES with a log line rather than truncating: half a
+* video is worse than a notification that says there is no attachment.
+*/
+var RECORDING_EXPORT_MAX_READ_BYTES = 50 * 1024 * 1024;
+/**
+* A finished export's bytes, inline.
+*
+* `bytes` is the DECODED length — the number the caller bounds and logs
+* against, so nobody has to infer it from the base64 length.
+*/
+var ExportBytesSchema = object({
+	base64: string(),
+	contentType: string(),
+	/** Suggested filename, extension included. */
+	name: string(),
+	bytes: number().int().nonnegative()
+});
 method(object({
 	deviceId: number(),
 	profile: string(),
@@ -26053,6 +26163,9 @@ method(object({
 }), method(object({ exportId: string() }), ExportDownloadSchema, {
 	kind: "query",
 	auth: "protected"
+}), method(object({ exportId: string() }), ExportBytesSchema, {
+	kind: "query",
+	auth: "protected"
 });
 /**
 * scene-monitor — device-scoped reference-region state cap. An operator marks
@@ -28519,9 +28632,10 @@ var DeclaredDevices = class {
 		}
 		const integrationId = spec.integrationId ?? await this.ensureIntegration(spec.integrationName);
 		const index = await this.readIndex();
+		const live = await this.readLiveByStableId();
 		const outcomes = [];
 		for (const declaration of spec.devices) {
-			const outcome = await this.applyDeclaration(declaration, integrationId, index);
+			const outcome = await this.applyDeclaration(declaration, integrationId, index, live);
 			if (outcome !== null) outcomes.push(outcome);
 		}
 		return {
@@ -28567,6 +28681,26 @@ var DeclaredDevices = class {
 		return new Map(rows.map((row) => [row.stableId, row]));
 	}
 	/**
+	* Devices this kernel already has CONSTRUCTED, by stableId.
+	*
+	* Distinct from {@link readIndex}, and the distinction is the bug: the index
+	* is persisted rows, this is live objects. A row without an object must be
+	* adopted; an object must be left exactly as it is.
+	*
+	* Failure is non-fatal and deliberately so — an empty map degrades to the
+	* previous behaviour (attempt the adopt) rather than skipping a device that
+	* genuinely needs bringing up.
+	*/
+	async readLiveByStableId() {
+		try {
+			const devices = await this.ports.devices.getAll();
+			return new Map(devices.map((device) => [device.stableId, device]));
+		} catch (err) {
+			this.ports.logger.warn("could not read live devices — falling back to adopt-by-row", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			return /* @__PURE__ */ new Map();
+		}
+	}
+	/**
 	* One declaration: adopt what exists, create what does not.
 	*
 	* The create branch is the destructive one — it seeds `initialMeta`, and
@@ -28575,8 +28709,15 @@ var DeclaredDevices = class {
 	* the declared name over the operator's rename. D49: that branch needs a
 	* second read to agree.
 	*/
-	async applyDeclaration(declaration, integrationId, index) {
+	async applyDeclaration(declaration, integrationId, index, live) {
 		try {
+			const alreadyLive = live.get(declaration.stableId);
+			if (alreadyLive !== void 0) return {
+				stableId: declaration.stableId,
+				deviceId: alreadyLive.id,
+				device: alreadyLive,
+				created: false
+			};
 			let existing = index.get(declaration.stableId);
 			if (existing === void 0) {
 				existing = (await this.readIndex()).get(declaration.stableId);
@@ -32917,6 +33058,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recordingExport.readExportBytes": {
+		capName: "recordingExport",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"sceneMonitor.captureReference": {
 		capName: "scene-monitor",
 		capScope: "device",
@@ -34374,7 +34521,23 @@ var TimelapseRuleInputSchema = object({
 	/** Canonical notification priority ordinal (1..5); per-target overridable. */
 	priority: PriorityField.default(3)
 });
-object({
+/**
+* Partial patch for an update — any subset of the INPUT fields, with NO
+* defaults (an absent key means "leave unchanged", never "reset to default").
+* Provenance and ownership are absent by construction: a patch can rename or
+* retune a rule, never re-own it or forge its generation state.
+*
+* CLEAR SIGNAL: `template` is the one OPTIONAL field an editor can REMOVE, so
+* it is `.nullable()` here and NOWHERE else. Wire representation:
+*  - key absent          → leave the template unchanged
+*  - `"template": null`  → CLEAR it (the persisted rule loses the key)
+*  - `"template": {...}` → replace it
+* `undefined` is deliberately NOT the clear signal: it does not survive
+* `JSON.stringify`, so a viewer editor could not express "remove". The
+* PERSISTED rule never carries `null` — the store drops the key (see
+* `TimelapseStore.update`).
+*/
+var TimelapseRulePatchSchema = object({
 	name: NameField.optional(),
 	enabled: boolean().optional(),
 	deviceIds: DeviceIdsField.optional(),
@@ -34395,15 +34558,50 @@ var TimelapseRuleSchema = TimelapseRuleInputSchema.extend({
 	*/
 	ownerUserId: string().optional(),
 	/**
-	* Epoch-ms of the last successful generation — the 1-hour re-generation
-	* guard's durable state (predecessor parity). Absent = never generated.
+	* Epoch-ms of the NEWEST successful generation across every camera of this
+	* rule. What a UI shows, and the compatibility floor for
+	* {@link readTimelapseGeneratedAt}. Absent = never generated.
 	*/
 	lastGeneratedAt: number().optional(),
+	/**
+	* PER-CAMERA generation state, keyed by `String(deviceId)` — the
+	* re-generation guard's real durable state.
+	*
+	* One rule covers several cameras and each renders its own video, so a rule
+	* -wide stamp is wrong in the direction that DESTROYS work: camera A
+	* succeeding at 06:05 tells camera B, whose render failed, that it is
+	* already done — and B's night is gone for good, because the window will not
+	* come back.
+	*
+	* ADDITIVE, so the migration is free: a row written before this field simply
+	* has no map, and {@link readTimelapseGeneratedAt} falls back to
+	* {@link TimelapseRuleSchema.shape.lastGeneratedAt}. Reading an old row as
+	* "never generated" would re-render and re-notify every camera of every rule
+	* once, on the deploy that shipped the map.
+	*/
+	generatedByDevice: record(string(), number()).optional(),
 	/** userId of the caller who created the rule (server-stamped). */
 	createdBy: string(),
 	createdAt: number(),
 	updatedAt: number()
 });
+/**
+* The last successful generation for ONE camera of a rule, epoch-ms.
+*
+* The per-device map wins; a rule with no map falls back to the rule-wide
+* `lastGeneratedAt` (the compatible-migration path — see
+* {@link TimelapseRuleSchema}); a rule with neither returns 0, which every
+* guard reads as "never generated".
+*
+* Read through this helper and never off the field directly: the fallback is
+* the whole migration, and a call site that forgot it would re-render an
+* entire rule set once.
+*/
+function readTimelapseGeneratedAt(rule, deviceId) {
+	const map = rule.generatedByDevice;
+	if (map !== void 0) return map[String(deviceId)] ?? 0;
+	return rule.lastGeneratedAt ?? 0;
+}
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -34682,6 +34880,12 @@ Object.defineProperty(exports, "OpsLogEntrySchema", {
 		return OpsLogEntrySchema;
 	}
 });
+Object.defineProperty(exports, "RECORDING_EXPORT_MAX_READ_BYTES", {
+	enumerable: true,
+	get: function() {
+		return RECORDING_EXPORT_MAX_READ_BYTES;
+	}
+});
 Object.defineProperty(exports, "RetrainStatusSchema", {
 	enumerable: true,
 	get: function() {
@@ -34694,6 +34898,12 @@ Object.defineProperty(exports, "TimelapseRuleInputSchema", {
 		return TimelapseRuleInputSchema;
 	}
 });
+Object.defineProperty(exports, "TimelapseRulePatchSchema", {
+	enumerable: true,
+	get: function() {
+		return TimelapseRulePatchSchema;
+	}
+});
 Object.defineProperty(exports, "TimelapseRuleSchema", {
 	enumerable: true,
 	get: function() {
@@ -34784,6 +34994,12 @@ Object.defineProperty(exports, "defineCustomActions", {
 		return defineCustomActions;
 	}
 });
+Object.defineProperty(exports, "deriveRecordingMode", {
+	enumerable: true,
+	get: function() {
+		return deriveRecordingMode;
+	}
+});
 Object.defineProperty(exports, "embeddingEncoderCapability", {
 	enumerable: true,
 	get: function() {
@@ -34886,6 +35102,12 @@ Object.defineProperty(exports, "readDeviceStateFrom", {
 		return readDeviceStateFrom;
 	}
 });
+Object.defineProperty(exports, "readTimelapseGeneratedAt", {
+	enumerable: true,
+	get: function() {
+		return readTimelapseGeneratedAt;
+	}
+});
 Object.defineProperty(exports, "record", {
 	enumerable: true,
 	get: function() {