@camstack/addon-provider-amcrest 0.2.118 → 0.2.119

package/dist/addon.mjs

@@ -2,6 +2,12 @@ import { createRequire } from "node:module";
 import { createHash, randomBytes } from "node:crypto";
 import { request } from "node:http";
 import { request as request$1 } from "node:https";
+import { mkdir, readFile, readdir, rename, rm, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { createReadStream, createWriteStream } from "node:fs";
+import { spawn } from "node:child_process";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
 import { networkInterfaces } from "node:os";
 //#region \0rolldown/runtime.js
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
@@ -5368,7 +5374,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-i3eUVc-d.mjs
+//#region ../types/dist/sleep-COWaSCAi.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7526,6 +7532,24 @@ object({
 		unreachable: number()
 	})
 });
+/** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
+var PeerBytesTicketSchema = object({
+	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
+	url: string().min(1),
+	/**
+	* The HOST node this URL means something on — the hub or a named agent,
+	* never a runner. {@link AddonPeerBytes.open} compares it to its own and
+	* refuses `cross-node` by name when they differ, without dialling.
+	*/
+	hostNodeId: string().min(1),
+	expiresAtMs: number().int().nonnegative(),
+	/**
+	* What the producer DECLARED the body to be, when it knows — `null` when it
+	* does not. Never `0` for unknown (D393): a consumer sizing a bound off this
+	* must be able to tell "the producer did not say" from "the body is empty".
+	*/
+	declaredBytes: number().int().nonnegative().nullable()
+});
 /**
 * Adoption job — the background form of `device-adoption.adopt`.
 *
@@ -24699,6 +24723,7 @@ _enum([
 	"sleeping",
 	"camera-refused",
 	"no-keyframe",
+	"decode-failed",
 	"no-catalog-row",
 	"unsupported",
 	"unknown-device",
@@ -24942,6 +24967,49 @@ var ClipPlaybackSchema = object({
 */
 var ClipWakeSchema = _enum(["authorised"]);
 /**
+* Hard ceiling on ONE {@link videoclipsCapability.methods.readClipBytes} — the
+* same 50 MiB `RECORDING_EXPORT_MAX_READ_BYTES` uses, and for the same second
+* reason: the envelope is unary, so a base64 payload is held whole (~1.33× its
+* size) in the provider AND in the caller, on a hub this repo has already
+* OOM'd once (D9/D18).
+*
+* Measured clips sit far below it — 92 KB–2.29 MB for a sub twin, 455 KB for a
+* 16 s main clip — so the bound bites rarely. "Rarely" is not "never": a long
+* 4K main twin can exceed it, and above the bound the provider REFUSES with
+* the size in the message, never truncates. Half a video is worse than an
+* honest refusal.
+*
+* **Superseded as the way a clip export gets its bytes** (D613). The bound is
+* a property of the ENVELOPE, not of clips, so the cure was a transport with
+* no envelope: {@link videoclipsCapability.methods.offerClipBytes} hands back
+* a one-shot `peerBytes` ticket and the consumer streams it straight to disk,
+* holding nothing. This method stays for a consumer that genuinely wants the
+* bytes in hand, and for a provider not yet redeployed — with this bound,
+* which for an inline read is not going to move.
+*/
+var VIDEOCLIPS_MAX_READ_BYTES = 50 * 1024 * 1024;
+/**
+* Hard ceiling on ONE {@link videoclipsCapability.methods.offerClipBytes}
+* transfer — ten times {@link VIDEOCLIPS_MAX_READ_BYTES}, and the reasoning is
+* not "ten times more comfortable".
+*
+* The inline bound is set by what is HELD: a base64 envelope is the payload at
+* ~1.33× in the provider AND the same again in the caller, so 50 MiB of clip
+* is ~133 MiB of heap across two processes. Over `peerBytes` the consumer
+* holds one socket chunk at a time and writes straight through to the export
+* file, so its contribution is flat whatever the clip weighs. What is left is
+* the PRODUCER's own copy, and that is a property of how each provider makes a
+* clip rather than of this transport: Hikvision's fetch writes to a scratch
+* FILE and offers it (nothing is held), Reolink's cmd-5 transfer is collected
+* in memory and offered from there (one copy, the one it already had).
+*
+* So this number bounds the worst provider, not the transport, and it is named
+* separately so that lifting it is a statement about a provider rather than
+* about clips. Above it the provider REFUSES with the size in the message and
+* never truncates: half a video is worse than an honest refusal.
+*/
+var VIDEOCLIPS_MAX_OFFER_BYTES = 500 * 1024 * 1024;
+/**
 * A clip's finished bytes, inline — the twin of `recordingExport.readExportBytes`.
 *
 * `bytes` is the DECODED length, so nobody infers it from the base64 length,
@@ -24973,6 +25041,32 @@ var ClipBytesSchema = object({
 	durationMs: number().positive().optional()
 });
 /**
+* Where a clip's finished bytes can be TAKEN (D613) — the answer to
+* {@link videoclipsCapability.methods.offerClipBytes}.
+*
+* Everything {@link ClipBytesSchema} carries except the bytes themselves, plus
+* the one-shot ticket that leads to them. The metadata is answered BEFORE the
+* transfer on purpose: a consumer learns which twin it got, what to call the
+* file and how long the clip runs without having to read a byte, so a decision
+* it would make on that metadata (a wrong twin, an implausible duration) costs
+* no transfer at all.
+*/
+var ClipBytesOfferSchema = object({
+	/**
+	* One shot, seconds-long, loopback, on the PROVIDER's own host. Open it with
+	* `ctx.peerBytes.open(...)`, which refuses a ticket from another node by
+	* name rather than dialling a port that means something else here.
+	*/
+	ticket: PeerBytesTicketSchema,
+	contentType: string(),
+	/** Suggested filename, extension included. */
+	name: string(),
+	/** Which twin was actually served — see {@link ClipBytesSchema.served}. */
+	served: CamProfileSchema,
+	/** See {@link ClipBytesSchema.durationMs}. Absent when nothing measured it. */
+	durationMs: number().positive().optional()
+});
+/**
 * Where a clip's STREAM can be dialled (D597) — the answer to
 * {@link videoclipsCapability.methods.dialClipStream}.
 *
@@ -25048,6 +25142,105 @@ var ClipStreamDialSchema = object({
 	/** Why `servedAudio` is `none` although sound was asked for. */
 	audioReason: ClipStreamAudioReasonSchema.optional()
 });
+/**
+* The playback rates a clip can be DELIVERED at, ascending, always with `1`.
+*
+* These are the BROKER's: it re-paces frames it has already demuxed — the
+* `MonotonicClock` divides source elapsed time by the factor and the pacer
+* pushes that much faster — so the domain is the recorded one, {0} ∪ [0.25, 4],
+* and this is the discrete ladder drawn from it. `1.5` is in it because a
+* re-pacer has no reason to refuse it.
+*
+* `8` and `16` are deliberately NOT here. They are the CAMERA's own
+* `<playSpeed>` (Reolink cmd-5 replay), a different mechanism, still unwired
+* (D597, D600) — a rate change there costs a new dial and a new stream, and
+* the camera's 8x would need a resample the clip audio path has no decoder
+* for. Offering them today accepts a rate and delivers 1x, which is the whole
+* defect this list exists to end (D612). When `playSpeed` IS wired its rates
+* join THIS array — a second list elsewhere is the second authority D62
+* forbids.
+*
+* Every entry must survive the broker's `clampPlaybackRate` unchanged: a set
+* that offers what the clamp then moves is the same lie one step later.
+*/
+var CLIP_BROKER_PACED_RATES = [
+	.25,
+	.5,
+	1,
+	1.5,
+	2,
+	4
+];
+/**
+* The rates a REALTIME-BOUND stream can be delivered at.
+*
+* **Measured, and it is the whole reason this second ladder exists.** A
+* Hikvision RTSP replay is not a fast fetch: it delivers the recording at the
+* speed it was recorded. On 1436, 2026-09-23, one stream carried 176 access
+* units in 14 274 ms of wall clock at a measured 12.5 fps — 14.08 s of media
+* in 14.27 s, **1.01× realtime** — and a whole 18 s clip took 22.3 s to fetch
+* end to end. Reolink's cmd-5 transfer, which {@link CLIP_BROKER_PACED_RATES}
+* was written for, lands the same bytes at 49–62× and therefore has the entire
+* clip in hand within the first second.
+*
+* The broker's pacer consumes `rate` seconds of media per second of wall
+* clock while the socket supplies one. So at any rate above 1 the buffer
+* drains at `(rate − 1)×` and a stream that is only seconds old runs dry
+* almost at once — the viewer stops, the queue empties, and the provider's
+* own drain gate eventually reports `peer-stalled`. Nothing about that is a
+* bug to be fixed with a bigger buffer: there is no buffer, because the bytes
+* do not exist yet.
+*
+* So the honest answer is the DECLARATION (D612's own rule, applied to the
+* case it did not yet have): a rate this transport cannot deliver is never
+* offered. Below 1 is free — a slower pacer only lets the buffer grow.
+*
+* When a clip is served from a FILE the constraint is gone with the transport,
+* which is why `file` keeps the full ladder.
+*/
+var CLIP_REALTIME_SOURCE_RATES = [
+	.25,
+	.5,
+	1
+];
+/**
+* What a surface may DRAW for this provider's clips — the answer to
+* {@link videoclipsCapability.methods.getPlaybackOptions} (D612).
+*
+* The envelope is a PROVIDER fact, not a clip fact, and that is measured, not
+* assumed: the broker's `chooseClipPath` reads exactly two inputs — whether
+* `dialClipStream` and `readClipBytes` are wired — and both are constants of
+* the broker's own closure over the provider's methods. The `profile` it is
+* handed is explicitly not read. So every clip of a provider is served the
+* same way, and a per-clip channel carried a value that could not vary. The
+* per-clip `clipTransport` server message was removed for exactly that reason.
+*
+* Queried per camera, before a clip is picked, so a control is rendered or
+* DISABLED rather than offered and refused at play time (D62: a disabled
+* control reads as unavailable, one that undoes the gesture reads as broken).
+*/
+var ClipPlaybackOptionsSchema = object({
+	/**
+	* How this provider's clips reach the player. `stream` is the provider's
+	* forward-only fMP4 (D597); `file` is one bounded by-handle fetch of the
+	* whole clip, `stbl` indexed (D575).
+	*/
+	transport: _enum(["stream", "file"]),
+	/** `forward` = only ahead of the playhead. `free` = anywhere. */
+	seek: _enum(["forward", "free"]),
+	/** Frame-step BACKWARD is meaningful. Forward always is. */
+	stepBack: boolean(),
+	/** Whether the scrub gesture is served, as opposed to refused by name. */
+	scrub: boolean(),
+	/**
+	* The rates that can be delivered, ascending, always containing `1`. The
+	* viewer draws its picker from this and from nothing else — a constant it
+	* keeps instead is the second authority that produced the defect: `8` and
+	* `16` were offered, the broker clamped them to `4`, and no line anywhere
+	* said so. `0` is not a member: pause is the absence of a rate.
+	*/
+	rates: array(number().positive()).min(1).readonly()
+});
 var ClipSourceAvailabilitySchema = object({
 	state: _enum([
 		"ok",
@@ -25097,138 +25290,389 @@ var ClipSourceSchema = object({
 	addonId: string().optional(),
 	availability: ClipSourceAvailabilitySchema
 });
-DeviceType.Camera, method(object({
-	deviceId: number(),
-	since: number(),
-	until: number(),
-	limit: number().int().positive().optional(),
-	/**
-	* WHICH provider to ask — the `addonId` a {@link ClipSourceSchema} row
-	* carries, never a source id and never a list. **Required** (D554 amended).
-	*
-	* A provider the device is not bound to is refused by name rather than
-	* answered by another one (D552's `rejectUnresolvedAddonPin` rule).
-	*
-	* It was optional, documented as "absent means the device's BOUND
-	* provider, which is CamStack on every camera". No code implemented
-	* that. Measured on the live hub 2026-09-20 — device 592, bound to
-	* `recorder` AND `provider-reolink` — a bare call with `limit: 3`
-	* answered SIX rows, three from each source, merged newest-first:
-	* `device-collection-dispatch.ts` simply left the fan-out un-narrowed,
-	* so absence bought the union this method exists not to be, and
-	* `limit` meant `limit × sources`.
-	*
-	* There is nothing to restore the default to. `getBindings` answers a
-	* collection cap with a DERIVED, PLURAL set (D554 amended, step 0);
-	* `setWrapperActive` — the singleton authority that could name one —
-	* throws for a collection cap by design. Naming CamStack here instead
-	* would privilege one addon by id inside a surface whose premise is
-	* that sources are peers, and would be wrong on the first camera with
-	* no recorder binding. So absence is REFUSED, in the schema, where the
-	* generated types make it unomittable rather than merely discouraged.
-	*
-	* The default belongs to the SURFACE, which has the `listSources` rows
-	* and can say which one it picked (D569 § 1–3; the viewer already
-	* always sends this).
-	*
-	* It replaced `sources?: string[]`, a VIEW filter over source ids that
-	* assumed the answer was a fan-out over everything a camera has. The
-	* operator settled otherwise on 2026-09-20 — *"l'utilizzatore è uno
-	* solo"* — so the list is asked of one provider at a time and there is
-	* nothing to filter out of it.
-	*/
-	provider: string().min(1)
-}), array(ClipSchema).readonly(), {
-	kind: "query",
-	auth: "protected"
-}), method(object({ deviceId: number() }), array(ClipSourceSchema).readonly(), {
-	kind: "query",
-	auth: "protected"
-}), method(object({
-	deviceId: number(),
-	clipId: string(),
-	/**
-	* Which twin to serve, on the ONE quality scale the system already has
-	* (`CamProfileSchema`). `low | mid` → the sub file, `high` → the main
-	* twin; both ids are already on the row so this never re-searches the
-	* camera. Absent means the provider's own default (the sub file, which
-	* every source is measured to hold).
-	*
-	* `auto` is deliberately NOT accepted here: a stored file has no
-	* broker session, so the adaptive tier cannot be resolved for it. The
-	* viewer resolves `auto` to a profile the same way live does, before
-	* it calls (D549 15).
-	*/
-	profile: CamProfileSchema.optional()
-}), ClipPlaybackSchema, {
-	kind: "query",
-	auth: "protected"
-}), optionalMethod(object({
-	deviceId: number(),
-	clipId: string().min(1),
-	/**
-	* WHICH provider holds the bytes — the `addonId` a
-	* {@link ClipSourceSchema} row carries. **Required**, for the reason
-	* `listClips` states one method above and for a second one this method
-	* learned the hard way.
-	*
-	* The caller is the stream broker, and the broker lives in
-	* `addon-pipeline` — the same addon that registers the RECORDER's
-	* videoclips provider. With no provider named, the in-process
-	* resolution handed it its own sibling, which implements this method
-	* solely to explain that an analytics visit has no file behind it. So
-	* every onboard clip answered with that sentence, a flash of video and
-	* nothing more, while the SAME call from outside the addon reached the
-	* right provider and returned the bytes (measured on 3628,
-	* 2026-09-21).
-	*/
-	provider: string().min(1),
-	/**
-	* Which twin to fetch, on the mapping D549 15 already fixed:
-	* `low | mid` → the sub file, `high` → the main twin. `auto` is not
-	* accepted here for the same reason it is not accepted by
-	* `getClipPlayback` — a stored file has no broker session, so the
-	* adaptive tier cannot be resolved for it.
-	*/
-	profile: CamProfileSchema.optional(),
-	/**
-	* The CALLER's byte bound, so an over-size clip is refused before it is
-	* read and encoded rather than after. Capped by
-	* {@link VIDEOCLIPS_MAX_READ_BYTES} whatever is passed; absent means
-	* that ceiling.
-	*/
-	maxBytes: number().int().positive().optional(),
+var videoclipsCapability = {
+	name: "videoclips",
+	scope: "device",
+	mode: "collection",
+	kind: "wrapper",
+	defaultActive: true,
+	/** A clip is a window over a camera's footage — the cap is meaningless on a
+	*  sensor, a button or an event emitter, and the `defaultActive` auto-bind
+	*  reads this to decide which devices it may claim. */
+	deviceTypes: [DeviceType.Camera],
 	/**
-	* The operator's authorisation to wake a sleeping camera for this
-	* read. Absent — the default — means a sleeping standalone battery
-	* camera is REFUSED by name, before any session is opened.
+	* The Clips section of a camera's device details is FRAMEWORK-DERIVED (D14):
+	* the aggregator turns this declaration into the `type:'widget'` section and
+	* `DeviceDetail.tsx` is never edited. `videoclips` is the first WRAPPER cap
+	* to declare one — every previous `host/` widget cap is `deviceNative` — so
+	* `device-config-widget-wrapped-binding.spec.ts` pins that a `kind:'wrapped'`
+	* binding entry derives the same section a native one does.
+	*
+	* **It is a SECTION of the Recording tab, at the end of it — not a tab of
+	* its own.** It shipped as a `clips` top-tab and the operator rejected the
+	* placement: *"utilizzerei la stessa tab recordings, lì abbiamo già tutto il
+	* necessario, una nuova sezione alla fine per le clips"*. The Recording tab
+	* already holds the recorder's panel, the schedule bands and the unified
+	* retention policy; footage the camera itself holds is the same question,
+	* asked of a different store. `order: 100` puts it after all of them with
+	* room left in front. The `clips` entry in `WELL_KNOWN_TABS` went with it —
+	* a well-known id nobody declares is an invitation to mint the tab again.
+	*
+	* `topTab` stays: the browser owns a pane (a day's tiles, a source list and
+	* a player) and the Config tab's inner bar has no room for one. The widget
+	* itself is `host/clips-browser` in ui-library's `HOST_WIDGETS`, and because
+	* the admin Recordings page renders every `location:'top-tab'` +
+	* `tab:'recording'` section behind its camera picker
+	* (`CameraRecordingSettingsSection`), this declaration lands the section on
+	* BOTH surfaces with no second wiring.
 	*/
-	wake: ClipWakeSchema.optional()
-}), ClipBytesSchema, {
-	kind: "query",
-	auth: "protected"
-}), optionalMethod(object({
-	deviceId: number(),
-	clipId: string().min(1),
-	/** WHICH provider holds the camera — see `readClipBytes.provider`. */
-	provider: string().min(1),
-	/** Which twin — `high` → the main file, everything else the sub (D599). */
-	profile: CamProfileSchema.optional(),
+	deviceConfig: { ui: {
+		kind: "widget",
+		widgetId: "host/clips-browser",
+		tab: "recording",
+		topTab: true,
+		label: "Clips",
+		order: 100
+	} },
+	methods: {
+		listClips: method(object({
+			deviceId: number(),
+			since: number(),
+			until: number(),
+			limit: number().int().positive().optional(),
+			/**
+			* WHICH provider to ask — the `addonId` a {@link ClipSourceSchema} row
+			* carries, never a source id and never a list. **Required** (D554 amended).
+			*
+			* A provider the device is not bound to is refused by name rather than
+			* answered by another one (D552's `rejectUnresolvedAddonPin` rule).
+			*
+			* It was optional, documented as "absent means the device's BOUND
+			* provider, which is CamStack on every camera". No code implemented
+			* that. Measured on the live hub 2026-09-20 — device 592, bound to
+			* `recorder` AND `provider-reolink` — a bare call with `limit: 3`
+			* answered SIX rows, three from each source, merged newest-first:
+			* `device-collection-dispatch.ts` simply left the fan-out un-narrowed,
+			* so absence bought the union this method exists not to be, and
+			* `limit` meant `limit × sources`.
+			*
+			* There is nothing to restore the default to. `getBindings` answers a
+			* collection cap with a DERIVED, PLURAL set (D554 amended, step 0);
+			* `setWrapperActive` — the singleton authority that could name one —
+			* throws for a collection cap by design. Naming CamStack here instead
+			* would privilege one addon by id inside a surface whose premise is
+			* that sources are peers, and would be wrong on the first camera with
+			* no recorder binding. So absence is REFUSED, in the schema, where the
+			* generated types make it unomittable rather than merely discouraged.
+			*
+			* The default belongs to the SURFACE, which has the `listSources` rows
+			* and can say which one it picked (D569 § 1–3; the viewer already
+			* always sends this).
+			*
+			* It replaced `sources?: string[]`, a VIEW filter over source ids that
+			* assumed the answer was a fan-out over everything a camera has. The
+			* operator settled otherwise on 2026-09-20 — *"l'utilizzatore è uno
+			* solo"* — so the list is asked of one provider at a time and there is
+			* nothing to filter out of it.
+			*/
+			provider: string().min(1)
+		}), array(ClipSchema).readonly(), {
+			kind: "query",
+			auth: "protected"
+		}),
+		/**
+		* The sources this camera has, WITH the reason any of them cannot answer.
+		*
+		* Asked separately from `listClips` because an empty clip list is
+		* ambiguous and this is the only place the ambiguity is resolved: every
+		* bound provider contributes its own rows, and a provider that could not
+		* be reached at all still produces one row saying so. A surface that draws
+		* "no clips" without reading this is drawing a guess.
+		*/
+		listSources: method(object({ deviceId: number() }), array(ClipSourceSchema).readonly(), {
+			kind: "query",
+			auth: "protected"
+		}),
+		getClipPlayback: method(object({
+			deviceId: number(),
+			clipId: string(),
+			/**
+			* Which twin to serve, on the ONE quality scale the system already has
+			* (`CamProfileSchema`). `low | mid` → the sub file, `high` → the main
+			* twin; both ids are already on the row so this never re-searches the
+			* camera. Absent means the provider's own default (the sub file, which
+			* every source is measured to hold).
+			*
+			* `auto` is deliberately NOT accepted here: a stored file has no
+			* broker session, so the adaptive tier cannot be resolved for it. The
+			* viewer resolves `auto` to a profile the same way live does, before
+			* it calls (D549 15).
+			*/
+			profile: CamProfileSchema.optional()
+		}), ClipPlaybackSchema, {
+			kind: "query",
+			auth: "protected"
+		}),
+		/**
+		* This clip's BYTES, base64, bounded — the by-handle read a clip EXPORT
+		* pulls once (D558).
+		*
+		* `getClipPlayback` is the right answer for a player: it hands back a URL
+		* on a plane the hub serves `access:'authenticated'`, which a browser and a
+		* viewer session satisfy. It is the wrong answer for another ADDON: the
+		* hub's proxy in front of that plane takes only a user credential, which
+		* an addon does not hold, so a recorder that wants a camera's clip cannot
+		* fetch that URL. This method is the shape that answer forced — the same
+		* one (and the same bound) as `recordingExport.readExportBytes`.
+		*
+		* **It is no longer the only seam.** Until D613 there was no addon→addon
+		* byte transport at all; there is now
+		* ({@link offerClipBytes}, over `ctx.peerBytes`), it holds nothing on
+		* either side, and it is what a clip EXPORT uses. This method remains for
+		* a consumer that genuinely wants the bytes in hand, and as the named
+		* fallback for a provider not yet redeployed.
+		*
+		* Routing needs no `provider` pin: the id is source-prefixed and
+		* self-contained, so `device-collection-dispatch.ts` rule 3 hands the call
+		* to the source that claims it — and an id nobody claims is REFUSED rather
+		* than answered by another source.
+		*
+		* The producer reuses the fetch path it already has, completion rules
+		* included: a clip is taken by cmd 5 and finished on a short idle window
+		* whose result is PROVED against the catalog row's own span, retried once
+		* when it comes up materially short, and served-and-named when it is still
+		* short (D568). A second fetch with different completion rules is exactly
+		* the second authority D558 refuses to create.
+		*
+		* Every refusal THROWS with its reason and none of them is silent — the
+		* sleep gate (decided before `getApi()`, liftable only by
+		* {@link ClipWakeSchema}), a catalog row nobody claims, a clip with no
+		* bytes behind it, a mux that failed, and the size bound. The caller turns
+		* that reason into an operator-facing one; a truncated file is never an
+		* answer.
+		*/
+		readClipBytes: optionalMethod(object({
+			deviceId: number(),
+			clipId: string().min(1),
+			/**
+			* WHICH provider holds the bytes — the `addonId` a
+			* {@link ClipSourceSchema} row carries. **Required**, for the reason
+			* `listClips` states one method above and for a second one this method
+			* learned the hard way.
+			*
+			* The caller is the stream broker, and the broker lives in
+			* `addon-pipeline` — the same addon that registers the RECORDER's
+			* videoclips provider. With no provider named, the in-process
+			* resolution handed it its own sibling, which implements this method
+			* solely to explain that an analytics visit has no file behind it. So
+			* every onboard clip answered with that sentence, a flash of video and
+			* nothing more, while the SAME call from outside the addon reached the
+			* right provider and returned the bytes (measured on 3628,
+			* 2026-09-21).
+			*/
+			provider: string().min(1),
+			/**
+			* Which twin to fetch, on the mapping D549 15 already fixed:
+			* `low | mid` → the sub file, `high` → the main twin. `auto` is not
+			* accepted here for the same reason it is not accepted by
+			* `getClipPlayback` — a stored file has no broker session, so the
+			* adaptive tier cannot be resolved for it.
+			*/
+			profile: CamProfileSchema.optional(),
+			/**
+			* The CALLER's byte bound, so an over-size clip is refused before it is
+			* read and encoded rather than after. Capped by
+			* {@link VIDEOCLIPS_MAX_READ_BYTES} whatever is passed; absent means
+			* that ceiling.
+			*/
+			maxBytes: number().int().positive().optional(),
+			/**
+			* The operator's authorisation to wake a sleeping camera for this
+			* read. Absent — the default — means a sleeping standalone battery
+			* camera is REFUSED by name, before any session is opened.
+			*/
+			wake: ClipWakeSchema.optional()
+		}), ClipBytesSchema, {
+			kind: "query",
+			auth: "protected"
+		}),
+		/**
+		* Where this clip's finished bytes can be TAKEN — the by-handle read a
+		* clip EXPORT pulls, over the addon→addon byte transport (D613).
+		*
+		* This is {@link readClipBytes} with the envelope removed. Same gates,
+		* same vocabulary, same completion rules, same `served` contract — the
+		* only difference is that the bytes travel over a one-shot loopback
+		* socket instead of inside a base64 field, so neither side holds the
+		* payload whole and the 50 MiB refusal on a long `high` twin stops
+		* existing. The bound that remains is
+		* {@link VIDEOCLIPS_MAX_OFFER_BYTES}, and it bounds the PRODUCER's own
+		* copy rather than the transport.
+		*
+		* **The ticket is loopback and same-host.** A provider on an agent mints a
+		* URL that means nothing on the hub, and `ctx.peerBytes.open` refuses it
+		* `cross-node` by name rather than dialling whatever else holds that port
+		* here. A consumer that can be on the other side of a node boundary from
+		* its provider must be able to read that refusal and say so; it must not
+		* treat it as "no bytes".
+		*
+		* **A ticket is a one-shot bearer credential with a seconds-long life.**
+		* Take it immediately, never persist it, never log its `url`. An untaken
+		* ticket costs the provider one map entry until its TTL, and outstanding
+		* tickets are bounded — which is also what makes a per-frame misuse of
+		* this method refuse by name rather than work slowly (D9/D18: this is a
+		* by-handle fetch of finished media, not a frame pipe).
+		*
+		* Optional on the provider for the same reason `readClipBytes` is: a
+		* source with no camera socket behind it has no bytes. A provider that
+		* predates this method answers `NOT_IMPLEMENTED`, and a consumer may fall
+		* back to `readClipBytes` — but it says so in the log, with the deploy
+		* hint, because that fallback re-imposes the 50 MiB refusal and an
+		* operator who sees `too-large-to-transfer` after this shipped is looking
+		* at a stale addon, not at a clip that cannot be exported.
+		*/
+		offerClipBytes: optionalMethod(object({
+			deviceId: number(),
+			clipId: string().min(1),
+			/** WHICH provider holds the bytes — see `readClipBytes.provider`. */
+			provider: string().min(1),
+			/** Which twin — `low | mid` → the sub file, `high` → the main twin. */
+			profile: CamProfileSchema.optional(),
+			/**
+			* The CALLER's byte bound, so an over-size clip is refused before the
+			* camera is touched rather than after. Capped by
+			* {@link VIDEOCLIPS_MAX_OFFER_BYTES} whatever is passed; absent means
+			* that ceiling.
+			*/
+			maxBytes: number().int().positive().optional(),
+			/**
+			* The operator's authorisation to wake a sleeping camera for this
+			* read. Absent — the default — means a sleeping standalone battery
+			* camera is REFUSED by name, before any session is opened.
+			*/
+			wake: ClipWakeSchema.optional()
+		}), ClipBytesOfferSchema, {
+			kind: "query",
+			auth: "protected"
+		}),
+		/**
+		* Where this clip's STREAM can be dialled (D597) — the forward-only
+		* fMP4 the provider writes from the first muxed byte, for the broker to
+		* play through the same WebRTC session as recorded footage, with the
+		* first frame at the first fragment instead of after the last byte.
+		*
+		* Nothing is fetched here: the answer is a one-shot URL on the
+		* provider's own listener, and the camera is touched when it is dialled.
+		* The gates the file path runs (`readClipBytes`) run on the dial too —
+		* the id, the row, a clip still being written — and refuse in the same
+		* vocabulary, THROWN with `clipExportFailure(<token>, <prose>)`. Every
+		* profile is served (D599) and the answer states which twin it carries;
+		* `high` is not refused. Optional on the provider for the same reason
+		* `readClipBytes` is: a source with no camera socket behind it (the
+		* recorder's analytics window, a HomeKit tee) has no stream.
+		*/
+		dialClipStream: optionalMethod(object({
+			deviceId: number(),
+			clipId: string().min(1),
+			/** WHICH provider holds the camera — see `readClipBytes.provider`. */
+			provider: string().min(1),
+			/** Which twin — `high` → the main file, everything else the sub (D599). */
+			profile: CamProfileSchema.optional(),
+			/**
+			* Which audio codec the caller's session negotiated, so the provider
+			* can mux it (D600). The ask travels on the DIAL because the mux is
+			* spawned once, before the first byte, and cannot gain a track later.
+			*
+			* ABSENT IS `none`, never a guess: a caller that does not state an
+			* ask is served the video-only stream that shipped first, so a broker
+			* older than this field keeps working unchanged (D382 — an unstated
+			* ask is zero).
+			*/
+			audio: ClipStreamAudioSchema.optional()
+		}), ClipStreamDialSchema, {
+			kind: "query",
+			auth: "protected"
+		}),
+		/**
+		* What a surface may DRAW for this provider's clips: the rates it can be
+		* played at, whether scrub is served, how far a position may be moved,
+		* and whether a backward frame-step means anything (D612).
+		*
+		* **The only authority.** The per-clip `clipTransport` server message
+		* that used to carry the same answer was removed: the broker's transport
+		* choice reads nothing that varies per clip, so the clip level had no
+		* information the provider does not already have, and two channels that
+		* can disagree are worse than one (D62).
+		*
+		* Asked per camera and per provider, so it must stay CHEAP — it is a
+		* statement about wiring, answered from a constant, never a call to the
+		* camera. A provider answers with one of {@link CLIP_PLAYBACK_OPTIONS}
+		* and never composes an envelope of its own.
+		*
+		* Optional, and absence is load-bearing: a provider that has not answered
+		* has not restricted anything, and a viewer reads it as the freedom it
+		* always had. See D612 on the rollout order that absence implies.
+		*/
+		getPlaybackOptions: optionalMethod(object({
+			deviceId: number(),
+			/** WHICH provider to ask — the `addonId` a {@link ClipSourceSchema}
+			*  row carries. Required for the same reason `listClips` requires it:
+			*  a collection cap has no "the bound one" to resolve to (D554). */
+			provider: string().min(1)
+		}), ClipPlaybackOptionsSchema, {
+			kind: "query",
+			auth: "protected"
+		})
+	}
+};
+/**
+* NOTE ON PLACEMENT: this block lives AFTER the capability definition on
+* purpose. `scripts/lib/parse-cap.ts` finds a cap by the FIRST
+* `export const <X> = {` in the file, so an object literal declared above
+* `videoclipsCapability` is silently taken for the capability itself and
+* codegen emits a `DeviceProxy` entry that does not type-check. Found the
+* hard way, 2026-09-23.
+*/
+/**
+* The two envelopes, spelled ONCE.
+*
+* A provider answers with the entry for the transport its own wiring buys —
+* `stream` if it implements `dialClipStream`, `file` if it implements only
+* `readClipBytes` — and never composes one of its own. One table is what
+* makes "the provider may not promise what no clip can be given" structural
+* instead of a discipline: there is nothing else to promise.
+*/
+var CLIP_PLAYBACK_OPTIONS = {
+	stream: {
+		transport: "stream",
+		seek: "forward",
+		stepBack: false,
+		scrub: false,
+		rates: CLIP_BROKER_PACED_RATES
+	},
 	/**
-	* Which audio codec the caller's session negotiated, so the provider
-	* can mux it (D600). The ask travels on the DIAL because the mux is
-	* spawned once, before the first byte, and cannot gain a track later.
+	* A `stream` whose SOURCE runs at realtime — a Hikvision RTSP replay.
 	*
-	* ABSENT IS `none`, never a guess: a caller that does not state an
-	* ask is served the video-only stream that shipped first, so a broker
-	* older than this field keeps working unchanged (D382 — an unstated
-	* ask is zero).
+	* Same verbs as `stream`, a shorter rate ladder, and the difference is a
+	* measurement rather than a preference: see
+	* {@link CLIP_REALTIME_SOURCE_RATES}. A third entry rather than a parameter,
+	* because a provider must still be able to do nothing but NAME one of these.
 	*/
-	audio: ClipStreamAudioSchema.optional()
-}), ClipStreamDialSchema, {
-	kind: "query",
-	auth: "protected"
-});
+	realtimeStream: {
+		transport: "stream",
+		seek: "forward",
+		stepBack: false,
+		scrub: false,
+		rates: CLIP_REALTIME_SOURCE_RATES
+	},
+	file: {
+		transport: "file",
+		seek: "free",
+		stepBack: true,
+		scrub: true,
+		rates: CLIP_BROKER_PACED_RATES
+	}
+};
 /**
 * Optional client-side hints sent at session creation to help the provider
 * pick the best native source. All fields optional — a viewer that knows
@@ -27729,6 +28173,108 @@ var recordingOnboardCapability = {
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
 };
+/** Minutes in a day. `endMinute === 1440` means "to end of day". */
+var MINUTES_PER_DAY = 1440;
+/**
+* Day-of-week names in the cap's index order (0 = Monday), for messages
+* an operator reads and for Hikvision's `<DayOfWeek>` element.
+*/
+var DAY_NAMES = [
+	"Monday",
+	"Tuesday",
+	"Wednesday",
+	"Thursday",
+	"Friday",
+	"Saturday",
+	"Sunday"
+];
+/**
+* Does `patch` ask this camera for something it cannot do?
+*
+* Returns the operator-readable reason, or `null` when every field in
+* the patch is within what `options` says this camera accepts. A
+* provider calls this BEFORE touching the camera and throws the string:
+* refusing is the point, and refusing identically on both vendors is why
+* this is one function.
+*
+* The order of checks is the order an operator would read them: the
+* scalar knobs first, then the schedule, because a schedule complaint is
+* longer and a scalar one is usually the real problem.
+*/
+function describeOnboardRefusal(options, patch) {
+	if (patch.enabled !== void 0 && !options.enabled.writable) return unwritable("the master recording switch", options.enabled.reason);
+	if (patch.overwriteWhenFull !== void 0 && !options.overwriteWhenFull.writable) return unwritable("overwrite-when-full", options.overwriteWhenFull.reason);
+	const preRefusal = refuseNumeric("pre-record seconds", patch.preRecordSec, options.preRecordSec, options.preRecordSecRange, options.preRecordSecAllowed);
+	if (preRefusal) return preRefusal;
+	const postRefusal = refuseNumeric("post-record seconds", patch.postRecordSec, options.postRecordSec, options.postRecordSecRange, options.postRecordSecAllowed);
+	if (postRefusal) return postRefusal;
+	const segmentRefusal = refuseNumeric("segment length (minutes)", patch.segmentMinutes, options.segmentMinutes, options.segmentMinutesRange, options.segmentMinutesAllowed);
+	if (segmentRefusal) return segmentRefusal;
+	if (patch.windows !== void 0) {
+		const scheduleRefusal = refuseSchedule(options, patch.windows);
+		if (scheduleRefusal) return scheduleRefusal;
+	}
+	return null;
+}
+function unwritable(what, reason) {
+	return reason ? `this camera cannot change ${what}: ${reason}` : `this camera cannot change ${what}`;
+}
+function refuseNumeric(what, value, support, range, allowed) {
+	if (value === void 0) return null;
+	if (!support.writable) return unwritable(what, support.reason);
+	if (!Number.isFinite(value)) return `${what} must be a number, got ${String(value)}`;
+	if (allowed) {
+		if (allowed.values.includes(value)) return null;
+		const say = (v) => allowed.sentinel !== void 0 && v === allowed.sentinel.value ? allowed.sentinel.meaning === "no-limit" ? "no limit" : "off" : String(v);
+		return `this camera accepts ${what} only as ${allowed.values.map(say).join(", ")}; ${say(value)} is not one of them`;
+	}
+	if (!range) return null;
+	if (value < range.min || value > range.max) return `this camera accepts ${what} between ${String(range.min)} and ${String(range.max)}; ${String(value)} is outside that`;
+	if (range.step > 0 && (value - range.min) % range.step !== 0) return `this camera accepts ${what} in steps of ${String(range.step)} from ${String(range.min)}; ${String(value)} is not one of them`;
+	return null;
+}
+function refuseSchedule(options, windows) {
+	const schedule = options.schedule;
+	if (!schedule.support.writable) return unwritable("the recording schedule", schedule.support.reason);
+	const allowed = new Set(schedule.triggers);
+	for (const window of windows) {
+		if (!allowed.has(window.trigger)) {
+			const offer = schedule.triggers.length > 0 ? schedule.triggers.join(", ") : "none";
+			return `this camera cannot record on "${window.trigger}"; it records on: ${offer}`;
+		}
+		if (window.endMinute <= window.startMinute) return `a window on ${dayName(window.day)} ends at or before it starts (${String(window.startMinute)} → ${String(window.endMinute)})`;
+		const step = schedule.granularityMinutes;
+		if (step > 1 && (window.startMinute % step !== 0 || window.endMinute % step !== 0)) return `this camera's schedule only moves in ${String(step)}-minute steps; the ${dayName(window.day)} window ${formatMinutes(window.startMinute)}–${formatMinutes(window.endMinute)} is not aligned to them`;
+	}
+	if (!schedule.supportsOverlappingTriggers) {
+		const clash = findOverlapWithDifferentTrigger(windows);
+		if (clash) return `this camera stores one trigger per time range, so "${clash.a.trigger}" and "${clash.b.trigger}" cannot both cover ${dayName(clash.a.day)} ${formatMinutes(Math.max(clash.a.startMinute, clash.b.startMinute))}–${formatMinutes(Math.min(clash.a.endMinute, clash.b.endMinute))}`;
+	}
+	return null;
+}
+function findOverlapWithDifferentTrigger(windows) {
+	for (let i = 0; i < windows.length; i += 1) for (let j = i + 1; j < windows.length; j += 1) {
+		const a = windows[i];
+		const b = windows[j];
+		if (!a || !b) continue;
+		if (a.day !== b.day) continue;
+		if (a.trigger === b.trigger) continue;
+		if (a.startMinute < b.endMinute && b.startMinute < a.endMinute) return {
+			a,
+			b
+		};
+	}
+	return null;
+}
+function dayName(day) {
+	return DAY_NAMES[day] ?? `day ${String(day)}`;
+}
+/** `510` → `08:30`. For messages, not for the wire. */
+function formatMinutes(minute) {
+	const hour = Math.floor(minute / 60);
+	const rest = minute % 60;
+	return `${String(hour).padStart(2, "0")}:${String(rest).padStart(2, "0")}`;
+}
 /**
 * Generic device-level status snapshot. Auto-registered by `BaseDevice`
 * for every device, regardless of provider — the kernel needs a uniform
@@ -33668,6 +34214,10 @@ _enum([
 	"too-large-to-transfer",
 	"wake-expired"
 ]);
+/** `<token>: <prose>` — the ONE composition of a clip export's failure string. */
+function clipExportFailure(code, detail) {
+	return detail.length > 0 ? `${code}: ${detail}` : code;
+}
 /** Candidate download URLs (LAN first, then operator extra hosts). */
 var ExportDownloadSchema = object({
 	url: string(),
@@ -46259,6 +46809,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"videoclips.getPlaybackOptions": {
+		capName: "videoclips",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"videoclips.listClips": {
 		capName: "videoclips",
 		capScope: "device",
@@ -46271,6 +46827,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"videoclips.offerClipBytes": {
+		capName: "videoclips",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"videoclips.readClipBytes": {
 		capName: "videoclips",
 		capScope: "device",
@@ -48317,6 +48879,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"videoclips.getPlaybackOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"videoclips.listClips": [{
 		name: "deviceId",
 		form: "single",
@@ -48327,6 +48894,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"videoclips.offerClipBytes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"videoclips.readClipBytes": [{
 		name: "deviceId",
 		form: "single",
@@ -49237,6 +49809,14 @@ var AmcrestCgiClient = class AmcrestCgiClient {
 	* Write config values. Keys are raw Dahua paths (e.g.
 	* `VideoColor[0][0].Brightness`); brackets are passed through unescaped
 	* (Dahua requires them literal) and only values are URL-encoded.
+	*
+	* **Every key must belong to the SAME config table.** Measured on an
+	* IP4M-1041B (2026-09-23): `MediaGlobal.PacketLength=6&Record[0].PreRecord=4`
+	* answered `200 OK` and applied only `MediaGlobal`; with the operands
+	* swapped, only `Record` changed. Within one table the write IS atomic —
+	* two keys both land, and one bad key rejects the pair with a body of
+	* `Error` under HTTP 200, which is why success is decided on the body
+	* and never on the status code.
 	*/
 	async setConfig(params) {
 		const query = Object.entries(params).map(([k, v]) => `${k}=${encodeURIComponent(String(v))}`).join("&");
@@ -49244,6 +49824,78 @@ var AmcrestCgiClient = class AmcrestCgiClient {
 		if (!/\bOK\b/i.test(body)) throw new Error(`setConfig rejected: ${body.trim().slice(0, 200)}`);
 	}
 	/**
+	* Read the camera's own storage inventory.
+	*
+	* `storageDevice.cgi?action=getDeviceAllInfo` — verified 200 on an
+	* IP4M-1041B, serving the same rows RPC2's `storage.getDeviceAllInfo`
+	* returns, so this cap needs no RPC2 session. (`action=getCaps` on the
+	* same CGI is 501 on this firmware; the record caps come from
+	* {@link getRecordManagerCaps} instead.)
+	*/
+	async getStorageDeviceAllInfo() {
+		return AmcrestCgiClient.parseTable(await this.getText("/cgi-bin/storageDevice.cgi?action=getDeviceAllInfo"));
+	}
+	/**
+	* Open a recorded FILE for reading — `GET /cgi-bin/RPC_Loadfile<FilePath>`.
+	*
+	* Measured on device 3836 (2026-09-23): **200**, a `content-length` that is
+	* byte-exact against the catalog row's `Length`, TTFB 142–211 ms, 2.87–3.5
+	* MB/s, and a genuine self-contained ISO MP4 with an AAC track. Three
+	* simultaneous pulls of three files all completed byte-exact and nothing
+	* wedged afterwards — the opposite of the Reolink behaviour D611 records.
+	*
+	* Two hazards a caller MUST handle, both measured:
+	*
+	* - **`Range` is ignored.** 200 with the whole body and no `content-range`,
+	*   on every form tried. There is no partial read of a recorded file.
+	* - **A path that does not exist closes the TCP socket with zero bytes and
+	*   NO HTTP status.** A real path answers 200 on the same endpoint, so the
+	*   bare close specifically means "not found" — and it reaches the caller as
+	*   a thrown transport error, which must become a NAMED refusal and never an
+	*   absence (D611).
+	*
+	* `content-type` is `application/http` — not a media type. It is deliberately
+	* not returned: a consumer that trusted it would mislabel an MP4.
+	*/
+	async openRecordedFile(filePath, timeoutMs) {
+		const encoded = filePath.split("/").map((segment) => encodeURIComponent(segment)).join("/");
+		const res = await this.send(`/cgi-bin/RPC_Loadfile${encoded}`, timeoutMs);
+		const declared = res.headers.get("content-length");
+		const contentLength = declared === null ? null : Number(declared);
+		return {
+			status: res.status,
+			contentLength: contentLength !== null && Number.isFinite(contentLength) && contentLength > 0 ? contentLength : null,
+			body: res.body
+		};
+	}
+	/**
+	* What time the camera thinks it is, VERBATIM — `result=2026-09-23 11:29:27`.
+	*
+	* Its own LOCAL wall clock, with no zone on it, and the only thing that can
+	* say what that clock is: measured 2026-09-23 answering `11:29:27` against a
+	* host UTC of `09:29:27`. Everything the clip catalog sends or reads is in
+	* this clock, so `clip-clock.ts` turns this string into the one offset the
+	* whole clip path uses. Parsed there, never here: a read that failed must
+	* reach the caller as a failure, not as a zero offset that looks like UTC.
+	*/
+	async getCurrentTime() {
+		return await this.getText("/cgi-bin/global.cgi?action=getCurrentTime");
+	}
+	/**
+	* The camera's own statement of what it accepts for recording —
+	* `MaxPreRecordTime`, `PacketLengthRange[0..1]`, `SupportHoliday`.
+	*/
+	async getRecordManagerCaps() {
+		return AmcrestCgiClient.parseTable(await this.getText("/cgi-bin/recordManager.cgi?action=getCaps"));
+	}
+	/**
+	* The camera's own statement of what an event handler accepts —
+	* `RecordLatch[0..1]` is the post-record bound.
+	*/
+	async getEventManagerCaps() {
+		return AmcrestCgiClient.parseTable(await this.getText("/cgi-bin/eventManager.cgi?action=getCaps"));
+	}
+	/**
 	* Open the Dahua CGI event-manager attach stream — a long-lived
 	* `multipart/x-mixed-replace` GET that pushes camera events
 	* (`VideoMotion` Start/Stop, heartbeats, …) until the connection drops
@@ -49628,6 +50280,689 @@ function capExposureModeToAmcrest(mode) {
 	return mode === "manual" ? 4 : 0;
 }
 //#endregion
+//#region src/clips/clip-availability.ts
+/**
+* What the storage read means for this SOURCE.
+*
+* `null` means "nothing to report" — the card is there and readable, so the
+* next question may be asked. Every other answer is terminal and the camera is
+* not searched.
+*/
+function availabilityFromStorage(storage) {
+	switch (storage.kind) {
+		case "absent": return {
+			state: "no-storage",
+			reason: storage.reason
+		};
+		case "unknown": return {
+			state: "unreachable",
+			reason: storage.reason
+		};
+		case "present": return null;
+	}
+}
+/**
+* The second gate, and it is not optional.
+*
+* Every time this provider sends the camera travels as the camera's LOCAL wall
+* clock. Without a measured offset there is no window to ask for — and the
+* failure mode of guessing is not an error, it is footage from two hours away
+* presented as the footage that was asked for. So a clock that could not be
+* read is `unreachable` by name, before a search is built.
+*/
+function availabilityFromClock(clock) {
+	if (clock !== null) return null;
+	return {
+		state: "unreachable",
+		reason: "The camera did not answer what time it thinks it is, and its recordings are stamped in its own local clock — a window asked for without that offset would return the wrong footage."
+	};
+}
+//#endregion
+//#region src/recording-onboard-mapping.ts
+/**
+* Bit position → the cap's trigger vocabulary.
+*
+* Every `TimeSection` entry is `"<mask> HH:MM:SS-HH:MM:SS"`, and `<mask>`
+* is the SET of triggers that time range records on. 3836 carries
+* `393222` = `0x60006` on all seven weekday rows: bits 1, 2, 17 and 18.
+*
+* Only these three bits are NAMED here, because only these three are
+* defensible from the Dahua CGI specification. Bits 17 and 18 are real
+* on this firmware and this repo cannot say what they mean — most likely
+* two IVS/smart kinds, and "most likely" is exactly the guess D608
+* forbids. An unnamed bit is therefore COUNTED as an unreadable window
+* and the schedule is reported unwritable (D391), which on 3836 it is.
+*
+* To lift that: identify bits 17 and 18 — set one of them alone on a
+* slot, observe which event actually starts a recording — and add them
+* here. Nothing else in this module changes.
+*/
+var TRIGGER_BY_BIT = {
+	0: "continuous",
+	1: "motion",
+	2: "alarmInput"
+};
+/** Triggers an Amcrest schedule can be written with. */
+var AMCREST_TRIGGERS = [
+	"continuous",
+	"motion",
+	"alarmInput"
+];
+/** The cap's trigger vocabulary → its bit position. */
+var BIT_BY_TRIGGER = {
+	continuous: 0,
+	motion: 1,
+	alarmInput: 2
+};
+/**
+* Dahua row index → the cap's day index.
+*
+* **Layout: row 0 is SUNDAY**, which the Dahua CGI specification states
+* and every Dahua/Amcrest UI renders Sunday-first; the cap's day 0 is
+* Monday (ISO). This is an ASSUMPTION in exactly the sense D608 records
+* for Reolink's mask: all seven weekday rows on 3836 are identical, and a
+* uniform schedule reads the same under either layout, so the reads
+* shipped here are exact and the assumption is unfalsifiable from this
+* camera. {@link weekdayRowsAreUniform} names the case. To settle it: set
+* one weekday only from the Amcrest app and re-read `Record`.
+*/
+function rowToCapDay(row) {
+	return (row + 6) % 7;
+}
+/** The cap's day index → the Dahua row index. Inverse of {@link rowToCapDay}. */
+function capDayToRow(day) {
+	return (day + 1) % 7;
+}
+/** The Dahua key for one schedule slot. */
+function timeSectionKey(channel, row, slot) {
+	return `Record[${String(channel)}].TimeSection[${String(row)}][${String(slot)}]`;
+}
+/**
+* A number the camera stated, or null when it did not state one.
+*
+* Never 0 for a missing or unparseable value: a measurement that failed
+* is not a measurement (D393). `TotalBytes` arrives as
+* `134202327040.000000` over CGI, so this parses a float and does not
+* demand an integer spelling.
+*/
+function numberAt(table, key) {
+	const raw = table.get(key);
+	if (raw === void 0 || raw.trim() === "") return null;
+	const value = Number(raw);
+	return Number.isFinite(value) ? value : null;
+}
+/** A boolean the camera stated, or null when it did not state one. */
+function booleanAt(table, key) {
+	const raw = table.get(key);
+	if (raw === void 0) return null;
+	if (raw === "true") return true;
+	if (raw === "false") return false;
+	return null;
+}
+var BYTES_PER_MB = 1024 * 1024;
+/** Bytes → whole MB, or null when the byte count was never stated (D393). */
+function toMegabytes(bytes) {
+	if (bytes === null) return null;
+	return Math.round(bytes / BYTES_PER_MB);
+}
+var VOLUME_STATUS_BY_STATE = {
+	Success: "ok",
+	Running: "ok",
+	Error: "error",
+	Unformatted: "unformatted",
+	NoExist: "offline",
+	Offline: "offline",
+	Sleeping: "ok"
+};
+/**
+* Read `storageDevice.cgi?action=getDeviceAllInfo`.
+*
+* Verbatim from 3836 with the card fitted:
+*
+* ```
+* list.info[0].Name=/dev/mmc0
+* list.info[0].State=Success
+* list.info[0].Detail[0].Path=/mnt/sd
+* list.info[0].Detail[0].TotalBytes=134202327040.000000
+* list.info[0].Detail[0].UsedBytes=345309184.000000
+* list.info[0].Detail[0].Type=ReadWrite
+* list.info[0].Detail[0].IsError=false
+* ```
+*
+* EVERY detail row is returned, not the first usable one — an operator
+* asking what is in this camera is owed the camera's whole answer. A
+* table with no `info` row at all is `absent`: that is what a camera with
+* no card answers, and it is the read that turns
+* {@link RecordingOnboardStatus.recordingToNowhere} back on. An
+* unreadable answer is `unknown`, never folded into `absent` (D393).
+*/
+function parseOnboardStorage(table) {
+	const deviceIndices = /* @__PURE__ */ new Set();
+	for (const key of table.keys()) {
+		const match = /^list\.info\[(\d+)\]\./.exec(key);
+		if (match?.[1] !== void 0) deviceIndices.add(Number(match[1]));
+	}
+	if (deviceIndices.size === 0) return {
+		kind: "absent",
+		reason: "The camera reports no storage device — there is no card in it."
+	};
+	const volumes = [];
+	for (const device of [...deviceIndices].toSorted((a, b) => a - b)) {
+		const prefix = `list.info[${String(device)}]`;
+		const name = table.get(`${prefix}.Name`) ?? `device ${String(device)}`;
+		const state = table.get(`${prefix}.State`);
+		const detailIndices = /* @__PURE__ */ new Set();
+		for (const key of table.keys()) {
+			const match = new RegExp(`^list\\.info\\[${String(device)}\\]\\.Detail\\[(\\d+)\\]\\.`).exec(key);
+			if (match?.[1] !== void 0) detailIndices.add(Number(match[1]));
+		}
+		if (detailIndices.size === 0) {
+			volumes.push({
+				id: name,
+				label: name,
+				status: statusOf(state, null),
+				capacityMb: null,
+				freeMb: null
+			});
+			continue;
+		}
+		for (const detail of [...detailIndices].toSorted((a, b) => a - b)) {
+			const dPrefix = `${prefix}.Detail[${String(detail)}]`;
+			const path = table.get(`${dPrefix}.Path`);
+			const total = numberAt(table, `${dPrefix}.TotalBytes`);
+			const used = numberAt(table, `${dPrefix}.UsedBytes`);
+			const type = table.get(`${dPrefix}.Type`);
+			const isError = booleanAt(table, `${dPrefix}.IsError`);
+			const volume = {
+				id: path === void 0 ? `${name}#${String(detail)}` : `${name}:${path}`,
+				...path === void 0 ? {} : { label: path },
+				status: statusOf(state, isError),
+				capacityMb: toMegabytes(total),
+				freeMb: total === null || used === null ? null : toMegabytes(total - used),
+				...type === void 0 ? {} : { writable: type === "ReadWrite" }
+			};
+			volumes.push(volume);
+		}
+	}
+	if (!volumes.some((volume) => volume.status === "ok")) return {
+		kind: "absent",
+		reason: "The camera lists storage, but no volume it can write to — the card is missing, unformatted or failed."
+	};
+	return {
+		kind: "present",
+		volumes
+	};
+}
+function statusOf(state, isError) {
+	if (isError === true) return "error";
+	if (state === void 0) return "unknown";
+	return VOLUME_STATUS_BY_STATE[state] ?? "unknown";
+}
+/**
+* `"393222 00:00:00-23:59:59"` → its three parts, or null when the slot
+* is not something this reader understands.
+*
+* `23:59:59` is the firmware's spelling of end-of-day and becomes 1440,
+* exactly as Hikvision's `24:00` does — collapsing it to 1439 would shave
+* a minute off every whole-day window, and to 0 would empty it. Any OTHER
+* non-zero seconds value is refused rather than rounded: the cap's
+* resolution is minutes and rounding is how an operator's 06:30:30
+* becomes 06:30 with nothing saying so.
+*/
+function parseTimeSectionSlot(raw) {
+	const match = /^\s*(-?\d+)\s+(\d{2}):(\d{2}):(\d{2})-(\d{2}):(\d{2}):(\d{2})\s*$/.exec(raw);
+	if (!match) return null;
+	const mask = Number(match[1]);
+	if (!Number.isInteger(mask) || mask < 0) return null;
+	const start = clockToMinutes(match[2], match[3], match[4]);
+	const end = clockToMinutes(match[5], match[6], match[7]);
+	if (start === null || end === null) return null;
+	return {
+		mask,
+		startMinute: start,
+		endMinute: end
+	};
+}
+function clockToMinutes(hour, minute, second) {
+	if (hour === void 0 || minute === void 0 || second === void 0) return null;
+	const h = Number(hour);
+	const m = Number(minute);
+	const s = Number(second);
+	if (h > 23 || m > 59 || s > 59) return null;
+	if (h === 23 && m === 59 && s === 59) return MINUTES_PER_DAY;
+	if (s !== 0) return null;
+	return h * 60 + m;
+}
+/** Every bit set in `mask`, low to high. */
+function setBits(mask) {
+	const out = [];
+	for (let bit = 0; bit < 32; bit += 1) if ((mask & 1 << bit) !== 0) out.push(bit);
+	return out;
+}
+/**
+* Expand the `Record[ch].TimeSection[row][slot]` grid into windows.
+*
+* One slot can name SEVERAL triggers at once — that is what the bitfield
+* is — so one slot becomes one window per NAMED bit. An unnamed bit, a
+* slot that will not parse, and every bit of the holiday row are counted
+* as unreadable: each is coverage the camera holds and the operator is
+* not being shown, and a schedule that silently shows fewer rows than the
+* camera holds is how a shorter one gets saved back (D391).
+*/
+function parseSchedule(table, channel) {
+	const windows = [];
+	let unreadable = 0;
+	let anyCoverage = false;
+	for (let row = 0; row <= 7; row += 1) for (let slot = 0; slot < 6; slot += 1) {
+		const raw = table.get(timeSectionKey(channel, row, slot));
+		if (raw === void 0) continue;
+		const parsed = parseTimeSectionSlot(raw);
+		if (parsed === null) {
+			unreadable += 1;
+			anyCoverage = true;
+			continue;
+		}
+		if (parsed.mask === 0) continue;
+		anyCoverage = true;
+		const bits = setBits(parsed.mask);
+		if (row === 7) {
+			unreadable += bits.length;
+			continue;
+		}
+		if (parsed.endMinute <= parsed.startMinute) {
+			unreadable += bits.length;
+			continue;
+		}
+		for (const bit of bits) {
+			const trigger = TRIGGER_BY_BIT[bit];
+			if (trigger === void 0) {
+				unreadable += 1;
+				continue;
+			}
+			windows.push({
+				trigger,
+				day: rowToCapDay(row),
+				startMinute: parsed.startMinute,
+				endMinute: parsed.endMinute
+			});
+		}
+	}
+	return {
+		windows,
+		unreadable,
+		anyCoverage
+	};
+}
+/** Read both caps tables into {@link AmcrestRecordLimits}. */
+function parseRecordLimits(input) {
+	const record = input.recordCaps;
+	const event = input.eventCaps;
+	const pair = (table, key) => {
+		if (table === null) return null;
+		const min = numberAt(table, `${key}[0]`);
+		const max = numberAt(table, `${key}[1]`);
+		if (min === null || max === null || max < min) return null;
+		return {
+			min,
+			max
+		};
+	};
+	return {
+		maxPreRecordSec: record === null ? null : numberAt(record, "MaxPreRecordTime"),
+		packetLengthMinutes: pair(record, "PacketLengthRange"),
+		recordLatchSec: pair(event, "RecordLatch")
+	};
+}
+/** Index of the local storage group, or null when the camera named none. */
+function findLocalStorageGroup(table) {
+	for (const [key, value] of table) {
+		const match = /^StorageGroup\[(\d+)\]\.Name$/.exec(key);
+		if (match?.[1] !== void 0 && value === "ReadWrite") return Number(match[1]);
+	}
+	return null;
+}
+/**
+* Overwrite-when-full, from BOTH places this firmware keeps it.
+*
+* Measured: `MediaGlobal.OverWrite` and `StorageGroup[0].OverWrite` are
+* INDEPENDENT — setting the first to `false` left the second `true` — and
+* nothing on the camera says which one the recorder honours. The card is
+* 134 GB and settling it by filling it is not an experiment this repo is
+* going to run.
+*
+* So the read is the two authorities' AGREEMENT: equal → that value;
+* different → null, which the status renders as "the camera did not say"
+* rather than picking a winner. The WRITE sets both (one request per
+* table), so a value CamStack wrote can never be the disagreeing case.
+*/
+function readOverwriteWhenFull(input) {
+	const global = input.mediaGlobal === null ? null : booleanAt(input.mediaGlobal, "MediaGlobal.OverWrite");
+	const groupIndex = input.storageGroup === null ? null : findLocalStorageGroup(input.storageGroup);
+	const group = input.storageGroup === null || groupIndex === null ? null : booleanAt(input.storageGroup, `StorageGroup[${String(groupIndex)}].OverWrite`);
+	if (global === null) return group;
+	if (group === null) return global;
+	return global === group ? global : null;
+}
+/**
+* Post-record seconds, from every event handler that records.
+*
+* Dahua keeps post-record per EVENT HANDLER (`…EventHandler.RecordLatch`),
+* not once per channel. 3836 exposes exactly one — `MotionDetect[0]`;
+* `SmartMotionDetect`, `AlarmLocal`, `VideoBlind` and `VideoLoss` all
+* answer HTTP 400 on this firmware, and its single `VideoAnalyseRule`
+* (`LeTrack`, disabled) carries no `EventHandler`.
+*
+* Where several DO exist and disagree, there is no single number to
+* report: this returns null and the field says why, rather than picking
+* one handler's value and calling it the camera's.
+*/
+function readPostRecordSec(motionDetect) {
+	if (motionDetect === null) return {
+		value: null,
+		handlers: 0,
+		disagree: false
+	};
+	const values = [];
+	for (const [key, raw] of motionDetect) {
+		if (!key.endsWith(".EventHandler.RecordLatch")) continue;
+		const value = Number(raw);
+		if (Number.isFinite(value)) values.push(value);
+	}
+	if (values.length === 0) return {
+		value: null,
+		handlers: 0,
+		disagree: false
+	};
+	const first = values[0] ?? null;
+	const disagree = values.some((value) => value !== first);
+	return {
+		value: disagree ? null : first,
+		handlers: values.length,
+		disagree
+	};
+}
+/**
+* Fold the reads into the cap's status.
+*
+* `tracks` is empty and `primaryTrackId` null, as on Reolink: a Dahua
+* channel exposes no track list, and inventing one synthetic row would
+* put a fact in the UI the camera never stated.
+*
+* `enabled` is the CONJUNCTION of the two switches that both have to be
+* on for the camera to record on its schedule — `RecordMode[ch].Mode`
+* (0 auto / 1 manual / 2 off) and `Record[ch].Enable`. Either one off
+* means nothing is recorded, so reporting only one of them would call a
+* silent camera enabled.
+*/
+function buildOnboardStatus(input) {
+	const { reads } = input;
+	const channel = reads.channel;
+	const schedule = reads.record === null ? {
+		windows: [],
+		unreadable: 0,
+		anyCoverage: false
+	} : parseSchedule(reads.record, channel);
+	const mode = reads.recordMode === null ? null : numberAt(reads.recordMode, `RecordMode[${String(channel)}].Mode`);
+	const recordEnable = reads.record === null ? null : booleanAt(reads.record, `Record[${String(channel)}].Enable`);
+	const enabled = mode === null || recordEnable === null ? null : mode !== 2 && recordEnable;
+	const post = readPostRecordSec(reads.motionDetect);
+	return {
+		storage: reads.storage,
+		tracks: [],
+		primaryTrackId: null,
+		enabled,
+		overwriteWhenFull: readOverwriteWhenFull({
+			mediaGlobal: reads.mediaGlobal,
+			storageGroup: reads.storageGroup
+		}),
+		preRecordSec: reads.record === null ? null : numberAt(reads.record, `Record[${String(channel)}].PreRecord`),
+		postRecordSec: post.value,
+		segmentMinutes: reads.mediaGlobal === null ? null : numberAt(reads.mediaGlobal, "MediaGlobal.PacketLength"),
+		windows: [...schedule.windows],
+		unreadableWindows: schedule.unreadable,
+		recordingToNowhere: enabled === true && schedule.anyCoverage && reads.storage.kind === "absent",
+		lastFetchedAt: input.now
+	};
+}
+/** Why nothing can be written before CamStack has read the camera. */
+var AMCREST_NOT_READ_REASON = "CamStack has not read this camera yet";
+/** Why a field is closed when the camera never stated its limits. */
+var AMCREST_NO_LIMITS_REASON = "this camera did not state the values it accepts for this setting, and it was measured storing values outside its own limits without complaint";
+/** Why the schedule is closed when part of it could not be read. */
+var AMCREST_PARTIAL_SCHEDULE_REASON = "CamStack could not read every recording window this camera holds — it records on triggers this version cannot name — so replacing them would delete the ones it could not show";
+/** Why post-record is closed when the handlers disagree. */
+var AMCREST_POST_RECORD_SPLIT_REASON = "this camera keeps post-record separately per event type and they do not agree, so there is no single value to show or write";
+/**
+* What THIS Amcrest accepts.
+*
+* Writability comes from the camera's OWN statement, never a vendor
+* default: `recordManager.cgi?action=getCaps` bounds pre-record and
+* segment length, `eventManager.cgi?action=getCaps` bounds post-record.
+* A caps read that failed closes its field, because this firmware was
+* measured answering `200 OK` to `PacketLength=99` and `RecordLatch=999`
+* — values its own caps forbid. Nothing but the refusal before the wire
+* stops those.
+*/
+function buildOnboardOptions(input) {
+	const reached = input.status !== null;
+	const closed = (reason) => ({
+		readable: reached,
+		writable: false,
+		reason: reached ? reason : AMCREST_NOT_READ_REASON
+	});
+	const open = {
+		readable: true,
+		writable: true
+	};
+	const gate = (allowed, reason) => reached && allowed ? open : closed(reason);
+	const limits = input.limits;
+	const preOk = limits.maxPreRecordSec !== null;
+	const segmentOk = limits.packetLengthMinutes !== null;
+	const postOk = limits.recordLatchSec !== null && input.postRecord.handlers > 0 && !input.postRecord.disagree;
+	const scheduleReadable = (input.status?.unreadableWindows ?? 0) === 0;
+	return {
+		enabled: gate(true, AMCREST_NOT_READ_REASON),
+		overwriteWhenFull: gate(true, AMCREST_NOT_READ_REASON),
+		preRecordSec: gate(preOk, AMCREST_NO_LIMITS_REASON),
+		...limits.maxPreRecordSec === null ? {} : { preRecordSecRange: {
+			min: 0,
+			max: limits.maxPreRecordSec,
+			step: 1
+		} },
+		postRecordSec: gate(postOk, input.postRecord.disagree ? AMCREST_POST_RECORD_SPLIT_REASON : AMCREST_NO_LIMITS_REASON),
+		...limits.recordLatchSec === null ? {} : { postRecordSecRange: {
+			min: limits.recordLatchSec.min,
+			max: limits.recordLatchSec.max,
+			step: 1
+		} },
+		segmentMinutes: gate(segmentOk, AMCREST_NO_LIMITS_REASON),
+		...limits.packetLengthMinutes === null ? {} : { segmentMinutesRange: {
+			min: limits.packetLengthMinutes.min,
+			max: limits.packetLengthMinutes.max,
+			step: 1
+		} },
+		schedule: {
+			support: gate(scheduleReadable, AMCREST_PARTIAL_SCHEDULE_REASON),
+			granularityMinutes: 1,
+			triggers: [...AMCREST_TRIGGERS],
+			supportsOverlappingTriggers: true
+		}
+	};
+}
+/**
+* Turn a cap patch into one request per config table.
+*
+* `windows` is the COMPLETE new set, so every weekday row is rewritten —
+* including a day the new set does not mention, whose slots must be
+* written back as `0 00:00:00-23:59:59` or the camera keeps recording on
+* a day the operator just cleared. Slots beyond the new windows are
+* cleared the same way. The HOLIDAY row is never touched: the cap cannot
+* express it, so rewriting it would delete coverage nobody was shown.
+*
+* `enabled` is read-modify-write on `RecordMode`: turning recording back
+* ON restores `auto` only when the camera was `off`, so a camera the
+* operator had put in `manual` stays in `manual`.
+*/
+function buildOnboardWrites(patch, current) {
+	const ch = String(current.channel);
+	const writes = [];
+	const recordParams = {};
+	const recordVerify = {};
+	if (patch.enabled !== void 0) {
+		recordParams[`Record[${ch}].Enable`] = patch.enabled;
+		recordVerify["enabled"] = {
+			key: `Record[${ch}].Enable`,
+			expect: patch.enabled ? "true" : "false"
+		};
+	}
+	if (patch.preRecordSec !== void 0) {
+		recordParams[`Record[${ch}].PreRecord`] = patch.preRecordSec;
+		recordVerify["preRecordSec"] = {
+			key: `Record[${ch}].PreRecord`,
+			expect: String(patch.preRecordSec)
+		};
+	}
+	if (patch.windows !== void 0) {
+		const slots = windowsToTimeSections(patch.windows);
+		for (let row = 0; row < 7; row += 1) for (let slot = 0; slot < 6; slot += 1) {
+			const value = slots[row]?.[slot] ?? "0 00:00:00-23:59:59";
+			const key = timeSectionKey(current.channel, row, slot);
+			recordParams[key] = value;
+			recordVerify[`windows[${String(row)}][${String(slot)}]`] = {
+				key,
+				expect: value
+			};
+		}
+	}
+	if (Object.keys(recordParams).length > 0) writes.push({
+		table: "Record",
+		params: recordParams,
+		verify: recordVerify
+	});
+	if (patch.enabled !== void 0) {
+		const mode = patch.enabled ? current.recordMode === 2 || current.recordMode === null ? 0 : current.recordMode : 2;
+		writes.push({
+			table: "RecordMode",
+			params: { [`RecordMode[${ch}].Mode`]: mode },
+			verify: { enabledMode: {
+				key: `RecordMode[${ch}].Mode`,
+				expect: String(mode)
+			} }
+		});
+	}
+	const mediaParams = {};
+	const mediaVerify = {};
+	if (patch.overwriteWhenFull !== void 0) {
+		mediaParams["MediaGlobal.OverWrite"] = patch.overwriteWhenFull;
+		mediaVerify["overwriteWhenFull"] = {
+			key: "MediaGlobal.OverWrite",
+			expect: patch.overwriteWhenFull ? "true" : "false"
+		};
+	}
+	if (patch.segmentMinutes !== void 0) {
+		mediaParams["MediaGlobal.PacketLength"] = patch.segmentMinutes;
+		mediaVerify["segmentMinutes"] = {
+			key: "MediaGlobal.PacketLength",
+			expect: String(patch.segmentMinutes)
+		};
+	}
+	if (Object.keys(mediaParams).length > 0) writes.push({
+		table: "MediaGlobal",
+		params: mediaParams,
+		verify: mediaVerify
+	});
+	if (patch.overwriteWhenFull !== void 0 && current.storageGroupIndex !== null) {
+		const key = `StorageGroup[${String(current.storageGroupIndex)}].OverWrite`;
+		writes.push({
+			table: "StorageGroup",
+			params: { [key]: patch.overwriteWhenFull },
+			verify: { overwriteWhenFullGroup: {
+				key,
+				expect: patch.overwriteWhenFull ? "true" : "false"
+			} }
+		});
+	}
+	if (patch.postRecordSec !== void 0) {
+		const key = `MotionDetect[${ch}].EventHandler.RecordLatch`;
+		writes.push({
+			table: "MotionDetect",
+			params: { [key]: patch.postRecordSec },
+			verify: { postRecordSec: {
+				key,
+				expect: String(patch.postRecordSec)
+			} }
+		});
+	}
+	return writes;
+}
+/**
+* Windows → the weekday rows' slots.
+*
+* Windows sharing a day and a time range are MERGED into one slot whose
+* mask carries every trigger — that is what the bitfield is, and emitting
+* one slot per trigger would burn through the six the camera has.
+*
+* A day needing more than {@link SLOTS_PER_ROW} distinct ranges yields
+* only the first six; the caller refuses that case before the wire rather
+* than letting the extra ones fall off here. A trigger with no bit is
+* skipped for the same reason — `describeOnboardRefusal` has already
+* refused it against `options.schedule.triggers`.
+*/
+function windowsToTimeSections(windows) {
+	const rows = Array.from({ length: 7 }, () => []);
+	for (let day = 0; day < 7; day += 1) {
+		const byRange = /* @__PURE__ */ new Map();
+		for (const window of windows) {
+			if (window.day !== day) continue;
+			const bit = BIT_BY_TRIGGER[window.trigger];
+			if (bit === void 0) continue;
+			const range = `${minutesToClock(window.startMinute)}-${minutesToClock(window.endMinute)}`;
+			byRange.set(range, (byRange.get(range) ?? 0) | 1 << bit);
+		}
+		const row = capDayToRow(day);
+		rows[row] = [...byRange.entries()].toSorted((a, b) => a[0].localeCompare(b[0])).map(([range, mask]) => `${String(mask)} ${range}`);
+	}
+	return rows;
+}
+/**
+* The one refusal `describeOnboardRefusal` cannot make for this vendor.
+*
+* A Dahua weekday row holds {@link SLOTS_PER_ROW} time ranges and no
+* more. A day asking for more would be written as its first six and the
+* rest would vanish into a `200 OK` — the silent drop this whole cap
+* exists to prevent — so it is refused by name, before the wire, with the
+* same voice the shared vocabulary uses.
+*
+* Returns null when the set fits.
+*/
+function describeAmcrestScheduleRefusal(windows) {
+	for (const [day, needed] of slotsNeededPerDay(windows)) if (needed > 6) return `this camera holds ${String(6)} recording periods per day and ${DAY_NAMES[day] ?? `day ${String(day)}`} asks for ${String(needed)}`;
+	return null;
+}
+/** How many distinct time ranges a day would need. For the refusal. */
+function slotsNeededPerDay(windows) {
+	const out = /* @__PURE__ */ new Map();
+	for (let day = 0; day < 7; day += 1) {
+		const ranges = /* @__PURE__ */ new Set();
+		for (const window of windows) {
+			if (window.day !== day) continue;
+			ranges.add(`${String(window.startMinute)}-${String(window.endMinute)}`);
+		}
+		out.set(day, ranges.size);
+	}
+	return out;
+}
+/**
+* `1440` → `23:59:59`, the firmware's own end-of-day; everything else
+* `HH:MM:00`.
+*/
+function minutesToClock(minute) {
+	if (minute >= 1440) return "23:59:59";
+	const hour = Math.floor(minute / 60);
+	const rest = minute % 60;
+	return `${String(hour).padStart(2, "0")}:${String(rest).padStart(2, "0")}:00`;
+}
+//#endregion
 //#region src/extra-settings.ts
 /**
 * Driver-authored device-settings sections for the camera facts that no
@@ -50107,6 +51442,7 @@ var AmcrestCamera = class AmcrestCamera extends BaseDevice {
 		this.registerOsdCap();
 		this.registerDayNightCap();
 		this.registerImageSettingsCap();
+		this.registerRecordingOnboardCap();
 	}
 	/** Dahua CGI `eventManager` attach codes — VideoMotion is the base
 	*  onboard-motion signal (Start/Stop). Smart sub-codes
@@ -50146,6 +51482,8 @@ var AmcrestCamera = class AmcrestCamera extends BaseDevice {
 	dayNightRefreshInFlight = null;
 	/** Single-flight guard for the `image-settings` camera refresh. */
 	imageSettingsRefreshInFlight = null;
+	/** Single-flight guard for the `recording-onboard` camera refresh. */
+	recordingOnboardRefreshInFlight = null;
 	/** Channel is 1-based; defaults to the schema's configured value. */
 	get channel() {
 		return this.config.get("channel") ?? 1;
@@ -50168,6 +51506,47 @@ var AmcrestCamera = class AmcrestCamera extends BaseDevice {
 			source: "operator"
 		};
 	}
+	/**
+	* What the clip service needs to reach this camera's own recordings.
+	*
+	* The CGI client is the DEVICE's, not a second one: it carries a warm
+	* digest state whose nonce-count is monotonic, and a second client for the
+	* clip path would advance a second one against the same camera.
+	*
+	* `readStorage` is the SAME read and the SAME parser the `recording-onboard`
+	* cap uses (D614) — `storageDevice.cgi?action=getDeviceAllInfo` through
+	* `parseOnboardStorage` — mapped into the clip cap's own three states. There
+	* is one storage reader in this addon and this is a caller of it, not a
+	* second one. It is read live rather than taken off the cap's runtime slice
+	* because that slice is `unknown` until the cap's first refresh, and
+	* "CamStack has not read this camera yet" must not reach an operator as
+	* "this camera cannot be reached".
+	*/
+	getClipCamera() {
+		const https = this.config.get("https") ?? false;
+		return {
+			deviceId: this.id,
+			host: this.config.get("host"),
+			port: this.config.get("port") ?? (https ? 443 : 80),
+			https,
+			username: this.config.get("username") ?? "admin",
+			password: this.config.get("password"),
+			channel: this.channel,
+			client: this.ensureClient(),
+			readStorage: async () => {
+				let table;
+				try {
+					table = await this.ensureClient().getStorageDeviceAllInfo();
+				} catch (err) {
+					return {
+						state: "unreachable",
+						reason: `The camera did not answer the storage read: ${err instanceof Error ? err.message : String(err)}`
+					};
+				}
+				return availabilityFromStorage(parseOnboardStorage(table));
+			}
+		};
+	}
 	ensureClient() {
 		if (this.client) return this.client;
 		this.client = this.buildClient();
@@ -51674,6 +53053,238 @@ var AmcrestCamera = class AmcrestCamera extends BaseDevice {
 		this.ctx.registerNativeCap(imageSettingsCapability, provider);
 		this.ctx.logger.info("amcrest: image-settings cap registered", { tags: { deviceId: this.id } });
 	}
+	/**
+	* Register the vendor-neutral `recording-onboard` cap.
+	*
+	* The camera's own card and the camera's own schedule — not CamStack's
+	* recorder. The whole surface rides the existing digest CGI client:
+	* `storageDevice.cgi?action=getDeviceAllInfo` serves the card,
+	* `configManager.cgi` serves `Record` / `RecordMode` / `MediaGlobal` /
+	* `StorageGroup` / `MotionDetect`, and `recordManager.cgi` +
+	* `eventManager.cgi` serve the limits. No RPC2 session is needed.
+	*
+	* Writes follow D610 whole, and this firmware earns every word of it:
+	*
+	*   - **Refused before the wire**, against what the camera STATED —
+	*     because `PacketLength=99` and `RecordLatch=999` were both stored
+	*     although the camera's own caps forbid them.
+	*   - **One request per config TABLE**, because a `setConfig` naming
+	*     two answers `200 OK` and applies only the first.
+	*   - **Verified after it by re-reading**, per field. Success is the
+	*     read-back agreeing, never the absence of a thrown error — the
+	*     body reads `Error` under HTTP 200 when a key is refused.
+	*/
+	registerRecordingOnboardCap() {
+		const CAP_NAME = "recording-onboard";
+		const configChannel = Math.max(0, this.channel - 1);
+		const emptyStatus = () => ({
+			storage: {
+				kind: "unknown",
+				reason: "CamStack has not read this camera yet."
+			},
+			tracks: [],
+			primaryTrackId: null,
+			enabled: null,
+			overwriteWhenFull: null,
+			preRecordSec: null,
+			postRecordSec: null,
+			segmentMinutes: null,
+			windows: [],
+			unreadableWindows: 0,
+			recordingToNowhere: false,
+			lastFetchedAt: 0
+		});
+		/** The camera's own statement of what it accepts. */
+		let lastLimits = {
+			maxPreRecordSec: null,
+			packetLengthMinutes: null,
+			recordLatchSec: null
+		};
+		/** How many event handlers hold a post-record, and whether they agree. */
+		let lastPostRecord = {
+			handlers: 0,
+			disagree: false
+		};
+		/** `RecordMode[ch].Mode`, so turning recording back ON can preserve `manual`. */
+		let lastRecordMode = null;
+		/** Which `StorageGroup` row is the local card. */
+		let lastStorageGroupIndex = null;
+		/** Read every table this cap needs. A table that failed is null, never empty. */
+		const readAll = async () => {
+			const client = this.ensureClient();
+			const [storageTable, record, recordMode, mediaGlobal, storageGroup, motionDetect] = await Promise.all([
+				client.getStorageDeviceAllInfo().catch(() => null),
+				client.getConfig("Record").catch(() => null),
+				client.getConfig("RecordMode").catch(() => null),
+				client.getConfig("MediaGlobal").catch(() => null),
+				client.getConfig("StorageGroup").catch(() => null),
+				client.getConfig("MotionDetect").catch(() => null)
+			]);
+			return {
+				storage: storageTable === null ? {
+					kind: "unknown",
+					reason: "The camera did not answer the storage read."
+				} : parseOnboardStorage(storageTable),
+				record,
+				recordMode,
+				mediaGlobal,
+				storageGroup,
+				motionDetect,
+				channel: configChannel
+			};
+		};
+		const applyReads = (reads) => {
+			lastRecordMode = reads.recordMode === null ? null : Number(reads.recordMode.get(`RecordMode[${String(configChannel)}].Mode`) ?? NaN);
+			if (lastRecordMode !== null && !Number.isFinite(lastRecordMode)) lastRecordMode = null;
+			lastStorageGroupIndex = reads.storageGroup === null ? null : findLocalStorageGroup(reads.storageGroup);
+			const post = readPostRecordSec(reads.motionDetect);
+			lastPostRecord = {
+				handlers: post.handlers,
+				disagree: post.disagree
+			};
+			return buildOnboardStatus({
+				reads,
+				now: Date.now()
+			});
+		};
+		const refreshFromCamera = async () => {
+			if (this.recordingOnboardRefreshInFlight) return this.recordingOnboardRefreshInFlight;
+			const promise = (async () => {
+				try {
+					const client = this.ensureClient();
+					const [reads, recordCaps, eventCaps] = await Promise.all([
+						readAll(),
+						client.getRecordManagerCaps().catch(() => null),
+						client.getEventManagerCaps().catch(() => null)
+					]);
+					lastLimits = parseRecordLimits({
+						recordCaps,
+						eventCaps
+					});
+					const next = applyReads(reads);
+					this.runtimeState.setCapState(CAP_NAME, next);
+					if (next.recordingToNowhere) this.ctx.logger.warn("amcrest onboard recording: camera is scheduled to record and has no usable storage", {
+						tags: { deviceId: this.id },
+						meta: {
+							windows: next.windows.length,
+							unreadable: next.unreadableWindows
+						}
+					});
+					if (next.unreadableWindows > 0) this.ctx.logger.warn("amcrest onboard recording: some schedule slots could not be read — the schedule shown is incomplete and cannot be written", {
+						tags: { deviceId: this.id },
+						meta: {
+							unreadableWindows: next.unreadableWindows,
+							readWindows: next.windows.length
+						}
+					});
+				} catch (err) {
+					this.ctx.logger.debug("amcrest onboard recording refresh failed — keeping last slice", {
+						tags: { deviceId: this.id },
+						meta: { error: err instanceof Error ? err.message : String(err) }
+					});
+				}
+			})();
+			this.recordingOnboardRefreshInFlight = promise;
+			try {
+				await promise;
+			} finally {
+				this.recordingOnboardRefreshInFlight = null;
+			}
+		};
+		const bridge = createRuntimeStateBridge({
+			runtimeState: this.runtimeState,
+			cap: recordingOnboardCapability,
+			ownDeviceId: this.id,
+			refresh: refreshFromCamera,
+			staleMs: OPERATOR_WRITTEN_STALE_MS,
+			staleRead: "serve-and-revalidate",
+			logger: this.ctx.logger,
+			empty: emptyStatus
+		});
+		const readOptions = () => buildOnboardOptions({
+			status: this.runtimeState.getCapState(CAP_NAME) ?? null,
+			limits: lastLimits,
+			postRecord: lastPostRecord
+		});
+		const provider = {
+			getStatus: bridge.getStatus,
+			getOptions: async ({ deviceId }) => {
+				if (deviceId !== this.id) throw new Error(`AmcrestCamera: deviceId mismatch, expected ${this.id}, got ${deviceId}`);
+				await bridge.ensureFresh();
+				return readOptions();
+			},
+			setSettings: async ({ deviceId, settings }) => {
+				if (deviceId !== this.id) return;
+				if (Object.keys(settings).length === 0) return;
+				await bridge.ensureFresh();
+				const refusal = describeOnboardRefusal(readOptions(), settings) ?? (settings.windows === void 0 ? null : describeAmcrestScheduleRefusal(settings.windows));
+				if (refusal !== null) {
+					this.ctx.logger.warn("amcrest onboard recording: refusing a write this camera cannot take", {
+						tags: { deviceId: this.id },
+						meta: {
+							refusal,
+							fields: Object.keys(settings)
+						}
+					});
+					throw new Error(`device ${String(this.id)}: ${refusal}`);
+				}
+				const writes = buildOnboardWrites(settings, {
+					channel: configChannel,
+					recordMode: lastRecordMode,
+					storageGroupIndex: lastStorageGroupIndex
+				});
+				const client = this.ensureClient();
+				const rejected = [];
+				for (const write of writes) try {
+					await client.setConfig(write.params);
+				} catch (err) {
+					rejected.push(`${write.table}: ${err instanceof Error ? err.message : String(err)}`);
+				}
+				const after = await readAll();
+				this.runtimeState.setCapState(CAP_NAME, applyReads(after));
+				const byTable = {
+					Record: after.record,
+					RecordMode: after.recordMode,
+					MediaGlobal: after.mediaGlobal,
+					StorageGroup: after.storageGroup,
+					MotionDetect: after.motionDetect
+				};
+				const discarded = [];
+				for (const write of writes) {
+					const table = byTable[write.table] ?? null;
+					if (table === null) {
+						discarded.push(`${write.table}: the camera would not say what it stored`);
+						continue;
+					}
+					for (const [field, check] of Object.entries(write.verify)) {
+						const stored = table.get(check.key);
+						if (stored === check.expect) continue;
+						discarded.push(`${field}: asked ${check.expect}, camera holds ${stored ?? "(nothing)"}`);
+					}
+				}
+				if (rejected.length > 0 || discarded.length > 0) {
+					this.ctx.logger.warn("amcrest onboard recording: the camera did not keep part of the write", {
+						tags: { deviceId: this.id },
+						meta: {
+							rejected,
+							discarded,
+							fields: Object.keys(settings)
+						}
+					});
+					throw new Error(`device ${String(this.id)}: the camera kept its own values — ${[...rejected, ...discarded].join("; ")}`);
+				}
+				this.ctx.logger.info("amcrest onboard recording: write applied and verified", {
+					tags: { deviceId: this.id },
+					meta: {
+						fields: Object.keys(settings),
+						requests: writes.length
+					}
+				});
+			}
+		};
+		this.ctx.registerNativeCap(recordingOnboardCapability, provider);
+		this.ctx.logger.info("amcrest: recording-onboard cap registered", { tags: { deviceId: this.id } });
+	}
 };
 /** Normalize Dahua's `Video.Compression` string (`'H.264'`, `'H.265'`,
 *  `'MJPG'`, …) into the cap's `'h264' | 'h265'` enum. Returns
@@ -51706,6 +53317,1987 @@ function collectAudioEnableKeys(table) {
 	for (const key of table.keys()) if (/^Encode\[0\]\.(?:MainFormat|ExtraFormat)\[\d+\]\.AudioEnable$/.test(key)) out.push(key);
 	return out.toSorted();
 }
+var EMPTY_PARAMS = Object.freeze({});
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Error codes that mean "your session is gone", so one silent re-login is the
+* right answer rather than a refusal the operator reads.
+*
+* Deliberately a SHORT list. An unknown code is a refusal — guessing that any
+* failure is a stale session turns one camera refusal into two round-trips and
+* the same refusal, and `findFile`'s 285409284 (which means "nothing matched,
+* or your condition was malformed") would then be retried on every empty day.
+*/
+var RPC2_SESSION_LOST_CODES = new Set([268632064, 268632081]);
+function md5Upper(input) {
+	return createHash("md5").update(input, "utf8").digest("hex").toUpperCase();
+}
+/**
+* A minimal Dahua RPC2 client. One per camera.
+*
+* It exposes exactly what the clip catalog needs — `call`, plus the login
+* `call` performs for itself. There is no generic "raw request" escape hatch:
+* a second way into this protocol is a second place to get the session
+* discipline wrong.
+*/
+var AmcrestRpc2Client = class {
+	base;
+	username;
+	password;
+	timeoutMs;
+	fetchImpl;
+	now;
+	session = null;
+	nextId = 0;
+	loginInFlight = null;
+	constructor(opts) {
+		this.base = `${opts.https ? "https" : "http"}://${opts.host}:${String(opts.port)}`;
+		this.username = opts.username;
+		this.password = opts.password;
+		this.timeoutMs = opts.defaultTimeoutMs ?? 15e3;
+		this.fetchImpl = opts.fetchImpl ?? fetch;
+		this.now = opts.now ?? (() => Date.now());
+	}
+	/**
+	* One RPC2 call, logging in first when there is no live session.
+	*
+	* `object` is the find-object handle for the `mediaFileFind.*` methods that
+	* take one; absent for the factory and for `global.*`.
+	*/
+	async call(method, params, object) {
+		const session = await this.ensureSession();
+		if (session.kind === "unreachable") return {
+			kind: "unreachable",
+			detail: session.detail
+		};
+		if (session.kind === "refused") return {
+			kind: "refused",
+			error: session.error,
+			params: EMPTY_PARAMS,
+			session: null
+		};
+		const first = await this.post("/RPC2", method, params, object, session.session);
+		if (first.kind === "refused" && first.error.code !== null && RPC2_SESSION_LOST_CODES.has(first.error.code)) {
+			this.session = null;
+			const fresh = await this.ensureSession();
+			if (fresh.kind !== "ok") return first;
+			return await this.post("/RPC2", method, params, object, fresh.session);
+		}
+		return first;
+	}
+	/** Drop the session and tell the camera, best-effort. For a client whose
+	*  device is going away. */
+	async logout() {
+		const session = this.session;
+		this.session = null;
+		if (session === null) return;
+		await this.post("/RPC2", "global.logout", null, void 0, session.id);
+	}
+	/** Forget the cached session WITHOUT telling the camera — for a client whose
+	*  host or credentials just changed under it, where the old session id means
+	*  nothing at the new address. */
+	reset() {
+		this.session = null;
+	}
+	async ensureSession() {
+		const live = this.session;
+		if (live !== null && this.now() - live.mintedAtMs < 3e4) return {
+			kind: "ok",
+			session: live.id
+		};
+		this.session = null;
+		const inFlight = this.loginInFlight;
+		if (inFlight !== null) return await inFlight;
+		const promise = this.login();
+		this.loginInFlight = promise;
+		try {
+			return await promise;
+		} finally {
+			this.loginInFlight = null;
+		}
+	}
+	async login() {
+		const challenge = await this.post("/RPC2_Login", "global.login", {
+			userName: this.username,
+			password: "",
+			clientType: "Web3.0"
+		}, void 0, null);
+		if (challenge.kind === "unreachable") return {
+			kind: "unreachable",
+			detail: challenge.detail
+		};
+		const sessionId = challenge.session;
+		const realm = challenge.params["realm"];
+		const random = challenge.params["random"];
+		if (sessionId === null || typeof realm !== "string" || typeof random !== "string" || realm === "" || random === "") return {
+			kind: "refused",
+			error: challenge.kind === "refused" ? challenge.error : {
+				code: null,
+				message: "the login challenge carried no realm/random"
+			}
+		};
+		const inner = md5Upper(`${this.username}:${realm}:${this.password}`);
+		const hashed = md5Upper(`${this.username}:${random}:${inner}`);
+		const confirmed = await this.post("/RPC2_Login", "global.login", {
+			userName: this.username,
+			password: hashed,
+			clientType: "Web3.0",
+			loginType: "Direct",
+			authorityType: "Default",
+			passwordType: "Default"
+		}, void 0, sessionId);
+		if (confirmed.kind === "unreachable") return {
+			kind: "unreachable",
+			detail: confirmed.detail
+		};
+		if (confirmed.kind === "refused") return {
+			kind: "refused",
+			error: confirmed.error
+		};
+		this.session = {
+			id: sessionId,
+			mintedAtMs: this.now()
+		};
+		return {
+			kind: "ok",
+			session: sessionId
+		};
+	}
+	async post(path, method, params, object, session) {
+		this.nextId += 1;
+		const body = {
+			method,
+			params,
+			id: this.nextId
+		};
+		if (object !== void 0) body["object"] = object;
+		if (session !== null) body["session"] = session;
+		const controller = new AbortController();
+		const timer = setTimeout(() => {
+			controller.abort();
+		}, this.timeoutMs);
+		try {
+			const res = await this.fetchImpl(`${this.base}${path}`, {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify(body),
+				signal: controller.signal
+			});
+			const text = await res.text();
+			let parsed;
+			try {
+				parsed = JSON.parse(text);
+			} catch {
+				return {
+					kind: "unreachable",
+					detail: `RPC2 ${method} answered HTTP ${String(res.status)} with a body that is not JSON`
+				};
+			}
+			if (!isRecord$1(parsed)) return {
+				kind: "unreachable",
+				detail: `RPC2 ${method} answered a non-object body`
+			};
+			const answeredParams = isRecord$1(parsed["params"]) ? parsed["params"] : EMPTY_PARAMS;
+			const answeredSession = readSessionId(parsed["session"]);
+			const answeredResult = parsed["result"];
+			if (answeredResult !== false && answeredResult !== void 0 && answeredResult !== null) return {
+				kind: "ok",
+				params: answeredParams,
+				session: answeredSession,
+				result: answeredResult
+			};
+			return {
+				kind: "refused",
+				error: readError(parsed["error"]),
+				params: answeredParams,
+				session: answeredSession
+			};
+		} catch (err) {
+			return {
+				kind: "unreachable",
+				detail: err instanceof Error ? err.message : String(err)
+			};
+		} finally {
+			clearTimeout(timer);
+		}
+	}
+};
+function readSessionId(raw) {
+	if (typeof raw === "string" && raw !== "") return raw;
+	if (typeof raw === "number") return String(raw);
+	return null;
+}
+function readError(raw) {
+	if (!isRecord$1(raw)) return {
+		code: null,
+		message: ""
+	};
+	return {
+		code: typeof raw["code"] === "number" ? raw["code"] : null,
+		message: typeof raw["message"] === "string" ? raw["message"] : ""
+	};
+}
+/**
+* A clip key is `<startSec>-<endSec>` (`clip-identity.ts`). Anything else is
+* REFUSED rather than joined: a key reaches this from a URL path segment, and
+* a `..` in it is a write outside the scratch.
+*/
+var SAFE_KEY = /^[0-9]{1,20}-[0-9]{1,20}$/;
+var KIND = "clip-media";
+var EXTENSION = ".mp4";
+var ClipArtifactStore = class {
+	options;
+	maxFiles;
+	maxBytes;
+	constructor(options) {
+		this.options = options;
+		this.maxFiles = options.maxFilesPerDevice ?? 8;
+		this.maxBytes = options.maxBytesPerDevice ?? 419430400;
+	}
+	/** Is this a key this store will touch at all? Exposed so a ROUTE can refuse
+	*  a bad segment by name before it reaches the filesystem. */
+	static isSafeKey(clipKey) {
+		return SAFE_KEY.test(clipKey);
+	}
+	dirFor(deviceId) {
+		return join(this.options.root, KIND, String(deviceId));
+	}
+	pathFor(deviceId, clipKey) {
+		return join(this.dirFor(deviceId), `${clipKey}${EXTENSION}`);
+	}
+	/** A scratch path to write INTO, with its directory made. */
+	async reserve(deviceId, clipKey) {
+		if (!SAFE_KEY.test(clipKey)) throw new Error(`clip artifact store: refused key "${clipKey}" — not a safe artifact key`);
+		await mkdir(this.dirFor(deviceId), { recursive: true });
+		return `${this.pathFor(deviceId, clipKey)}.${String(process.pid)}.part`;
+	}
+	/** Present AND carrying bytes — never a memory of having written one. */
+	async pathIfPresent(deviceId, clipKey) {
+		if (!SAFE_KEY.test(clipKey)) return null;
+		const path = this.pathFor(deviceId, clipKey);
+		try {
+			const info = await stat(path);
+			return info.isFile() && info.size > 0 ? path : null;
+		} catch {
+			return null;
+		}
+	}
+	/**
+	* Publish a reserved path under its key and enforce the bounds.
+	*
+	* A key already present wins: artifacts are immutable, and the temp file is
+	* removed rather than renamed over it.
+	*/
+	async publish(deviceId, clipKey, tempPath) {
+		const existing = await this.pathIfPresent(deviceId, clipKey);
+		if (existing !== null) {
+			await rm(tempPath, { force: true });
+			return existing;
+		}
+		const path = this.pathFor(deviceId, clipKey);
+		await rename(tempPath, path);
+		await this.enforceBounds(deviceId);
+		return path;
+	}
+	async forgetDevice(deviceId) {
+		await rm(this.dirFor(deviceId), {
+			recursive: true,
+			force: true
+		});
+	}
+	async listEntries(deviceId) {
+		let names;
+		try {
+			names = await readdir(this.dirFor(deviceId));
+		} catch {
+			return [];
+		}
+		const out = [];
+		for (const name of names) {
+			if (!name.endsWith(EXTENSION)) continue;
+			const path = join(this.dirFor(deviceId), name);
+			try {
+				const info = await stat(path);
+				if (info.isFile()) out.push({
+					path,
+					bytes: info.size,
+					mtimeMs: info.mtimeMs
+				});
+			} catch {}
+		}
+		return out;
+	}
+	/** Oldest-first eviction until BOTH bounds hold. */
+	async enforceBounds(deviceId) {
+		const entries = [...await this.listEntries(deviceId)].toSorted((a, b) => a.mtimeMs - b.mtimeMs);
+		let files = entries.length;
+		let bytes = entries.reduce((sum, entry) => sum + entry.bytes, 0);
+		for (const entry of entries) {
+			if (files <= this.maxFiles && bytes <= this.maxBytes) break;
+			try {
+				await rm(entry.path, { force: true });
+				files -= 1;
+				bytes -= entry.bytes;
+			} catch {}
+		}
+	}
+};
+//#endregion
+//#region src/clips/clip-clock.ts
+/**
+* The camera's clock, and the ONE place a time crosses between it and ours.
+*
+* **This is the trap that would put every clip two hours away.** Hikvision
+* stamps its catalog in UTC with a `Z`. Dahua does not: `mediaFileFind`'s
+* `StartTime`/`EndTime`, and the `starttime`/`endtime` that `/cam/playback`
+* accepts, are the camera's own LOCAL wall clock with no zone on them.
+* Measured 2026-09-23 on device 3836: `global.cgi?action=getCurrentTime`
+* answered `2026-09-23 11:29:27` while the host's UTC was `09:29:27.711`.
+*
+* ## Why the offset is READ and never inferred
+*
+* Two shortcuts both fail:
+*
+* - **The node's own timezone.** The addon runs wherever the runner runs; a
+*   hub in a UTC container would read the camera's strings two hours early
+*   and ask `/cam/playback` for footage that does not exist yet.
+* - **The camera's configured `NTP.TimeZone`.** It is a Dahua zone INDEX, it
+*   says nothing about DST on the day in question, and this addon already
+*   knows one Dahua index table is not a fact about the wire.
+*
+* So the offset is MEASURED: `getCurrentTime` against our own `Date.now()`.
+*
+* ## The offset is RAW, not rounded to a timezone
+*
+* It is tempting to round the measured difference to the nearest 15 minutes
+* and call it a UTC offset. That is wrong for this purpose. What the catalog
+* needs is a map between *the camera's clock* and *ours* — and a camera whose
+* clock has drifted ten minutes stamps its files ten minutes off. Carrying the
+* drift is what makes "the window the operator is looking at" and "the window
+* the camera will serve" the same window. Rounding it away would reintroduce
+* exactly the error it was meant to remove.
+*
+* A LARGE disagreement is still worth saying out loud, because it is an
+* operator-visible fault on the camera and not a fact about clips — see
+* {@link CAMERA_CLOCK_DISAGREEMENT_WARN_MS}. It is not a refusal: the map is
+* self-consistent at any offset, and refusing would break a working camera
+* over a cosmetic complaint.
+*
+* Pure. No I/O — the caller does the read and hands the two numbers in.
+*/
+/**
+* How long one clock read is trusted.
+*
+* Long enough that a listing does not pay for it every time, short enough that
+* a DST rollover — which moves the offset by a whole hour — is corrected
+* within one refresh rather than sending every subsequent search an hour
+* astray.
+*/
+var CAMERA_CLOCK_STALE_MS = 10 * 6e4;
+/**
+* Past this, the camera's clock and ours disagree by more than any timezone
+* plus a plausible drift, so the difference is a camera fault worth a line.
+* 15 hours: the widest real UTC offset is +14, and this leaves room for it.
+*/
+var CAMERA_CLOCK_DISAGREEMENT_WARN_MS = 900 * 6e4;
+/**
+* The raw body of `global.cgi?action=getCurrentTime`, which answers
+* `result=2026-09-23 11:29:27`. `null` when there is no timestamp in it — a
+* read that failed is not a reading (D393), and the caller must refuse rather
+* than fall back to its own clock.
+*/
+function parseCurrentTimeBody(body) {
+	return /result\s*=\s*(\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}:\d{2})/.exec(body)?.[1]?.replace("T", " ") ?? null;
+}
+/**
+* A Dahua wall-clock string read AS IF it were UTC — the intermediate every
+* conversion goes through. `null` on anything that is not the exact shape,
+* including the empty string and a date the calendar does not hold.
+*/
+function parseWallClockAsUtcMs(wallClock) {
+	const match = /^(\d{4})-(\d{2})-(\d{2})[ T](\d{2}):(\d{2}):(\d{2})$/.exec(wallClock.trim());
+	if (match === null) return null;
+	const [, y, mo, d, h, mi, s] = match;
+	if (y === void 0 || mo === void 0 || d === void 0) return null;
+	if (h === void 0 || mi === void 0 || s === void 0) return null;
+	const year = Number(y);
+	const month = Number(mo);
+	const day = Number(d);
+	const hour = Number(h);
+	const minute = Number(mi);
+	const second = Number(s);
+	if (month < 1 || month > 12 || day < 1 || day > 31) return null;
+	if (hour > 23 || minute > 59 || second > 59) return null;
+	const ms = Date.UTC(year, month - 1, day, hour, minute, second);
+	const back = new Date(ms);
+	if (back.getUTCFullYear() !== year || back.getUTCMonth() !== month - 1) return null;
+	if (back.getUTCDate() !== day) return null;
+	return ms;
+}
+/**
+* The measured map. `null` when the camera's answer could not be parsed —
+* never a zero offset, which is the same shape as "the camera is on UTC" and
+* would silently move an archive by the timezone it really has.
+*/
+function deriveCameraClock(input) {
+	const wall = parseCurrentTimeBody(input.currentTimeBody);
+	if (wall === null) return null;
+	const asUtc = parseWallClockAsUtcMs(wall);
+	if (asUtc === null) return null;
+	const hostAt = ((input.hostUtcBeforeMs ?? input.hostUtcAfterMs) + input.hostUtcAfterMs) / 2;
+	return {
+		offsetMs: Math.round((asUtc + 500 - hostAt) / 1e3) * 1e3,
+		readAtMs: input.hostUtcAfterMs
+	};
+}
+/** Is this measurement still worth using? */
+function cameraClockIsFresh(clock, nowMs) {
+	return nowMs - clock.readAtMs < CAMERA_CLOCK_STALE_MS;
+}
+/** Does the difference deserve an operator-facing line? */
+function cameraClockDisagrees(clock) {
+	return Math.abs(clock.offsetMs) > CAMERA_CLOCK_DISAGREEMENT_WARN_MS;
+}
+/** An epoch instant as the camera's own wall clock — what a search condition
+*  and a `/cam/playback` query string both take. */
+function toCameraWallClock(epochMs, clock) {
+	const shifted = new Date(epochMs + clock.offsetMs);
+	const pad = (value, width) => String(value).padStart(width, "0");
+	return `${pad(shifted.getUTCFullYear(), 4)}-${pad(shifted.getUTCMonth() + 1, 2)}-${pad(shifted.getUTCDate(), 2)} ${pad(shifted.getUTCHours(), 2)}:${pad(shifted.getUTCMinutes(), 2)}:${pad(shifted.getUTCSeconds(), 2)}`;
+}
+/** The camera's own wall clock as an epoch instant. `null` on a string this
+*  provider could not read — a row with an unreadable time is dropped BY NAME
+*  rather than placed at the epoch. */
+function fromCameraWallClock(wallClock, clock) {
+	const asUtc = parseWallClockAsUtcMs(wallClock);
+	if (asUtc === null) return null;
+	return asUtc - clock.offsetMs;
+}
+//#endregion
+//#region src/clips/clip-identity.ts
+/**
+* An Amcrest clip's IDENTITY — and it is a TIME WINDOW, which is the one thing
+* that makes this provider different from its two siblings.
+*
+* `native:amcrest:onboard:<startSec>:<endSec>`, epoch seconds, OUR clock.
+*
+* ## Why the window and not the file name
+*
+* Because the camera accepts two different handles for the same recording and
+* they are not interchangeable (measured 2026-09-23, device 3836):
+*
+* - **`/cam/playback?channel=1&starttime=…&endtime=…`** — RTSP playback. The
+*   ONLY form that serves: `?filename=<FilePath>` answers 404 and so does the
+*   bare path form `rtsp://…/mnt/sd/…mp4`.
+* - **`/cgi-bin/RPC_Loadfile<FilePath>`** — the bytes. Takes the file path and
+*   nothing else.
+*
+* So the window is the identity and the path is a property of the row. A
+* provider that conflated them would address playback by a handle playback
+* refuses.
+*
+* ## The id is self-contained and the row is still required
+*
+* The window in the id is enough to build a playback URI, which makes a
+* deep-link readable and a log line diagnosable. It deliberately does NOT make
+* the id sufficient: every method still resolves the catalog ROW, and an id
+* whose row this node has not listed is `catalog-miss` — the truth ("I have
+* never heard of it"), not a failure. Otherwise a caller could mint an id for
+* a window nobody checked exists, and the camera would answer a `DESCRIBE`
+* 404 that this firmware ALSO uses for "all three playback slots are busy".
+*
+* Pure. No I/O, no clock.
+*/
+/** The camera's own recordings — the one Amcrest source. */
+var CLIP_SOURCE_ONBOARD = "native:amcrest:onboard";
+/** Every source this provider can name. Order is the picker's order. */
+var AMCREST_CLIP_SOURCES = [CLIP_SOURCE_ONBOARD];
+/**
+* The key a row is filed under, and the segment a data-plane URL carries.
+*
+* `<startSec>-<endSec>` rather than a hash: it is already short, already
+* unique (two files cannot own the same window on one channel), URL-safe
+* without encoding, and readable in a log line — which a sha1 is not, on a
+* provider whose whole identity question is "which window".
+*/
+function clipKeyFor(startMs, endMs) {
+	return `${String(Math.floor(startMs / 1e3))}-${String(Math.floor(endMs / 1e3))}`;
+}
+function mintClipId(parts) {
+	return `${parts.source}:${clipKeyFor(parts.startMs, parts.endMs)}`;
+}
+/**
+* Parse an id this provider minted. `null` for anything else — including an id
+* from the analytics, Reolink or Hikvision source, which is how the collection
+* dispatcher's "nobody claimed this id" branch stays honest.
+*/
+function parseClipId(clipId) {
+	const source = AMCREST_CLIP_SOURCES.find((candidate) => clipId.startsWith(`${candidate}:`));
+	if (source === void 0) return null;
+	const rest = clipId.slice(source.length + 1);
+	const match = /^(\d+)-(\d+)$/.exec(rest);
+	if (match === null) return null;
+	const startSec = Number(match[1]);
+	const endSec = Number(match[2]);
+	if (!Number.isSafeInteger(startSec) || !Number.isSafeInteger(endSec)) return null;
+	if (endSec <= startSec) return null;
+	return {
+		source,
+		startMs: startSec * 1e3,
+		endMs: endSec * 1e3
+	};
+}
+/** The key a clip id names, without re-deriving the arithmetic. */
+function clipKeyOf(parts) {
+	return clipKeyFor(parts.startMs, parts.endMs);
+}
+//#endregion
+//#region src/clips/clip-search.ts
+/**
+* One `mediaFileFind` row, read. Pure: no RPC, no clock read, no logger.
+*
+* ## `Summary` is never read, and that is a hard rule
+*
+* Every row this camera returns carries, on a plain `VideoMotion` recording in
+* a living room, on a camera with no ANPR licence:
+*
+* ```json
+* "Summary": { "TrafficCar": { "PlateNumber": " ", "PlateColor": "Yellow",
+*                              "PlateType": "Yellow", "Speed": 60,
+*                              "VehicleColor": "White" } }
+* ```
+*
+* `PlateNumber` is a single space and `Speed` is a constant 60 on all 60 rows
+* measured. It is an uninitialised struct serialised as data. A provider that
+* surfaced it would invent a licence-plate read and a 60 km/h vehicle on every
+* motion clip. {@link parseClipRow} reads `Events` and `Flags` and nothing
+* else about what happened.
+*
+* ## `Type` is an ECHO of the filter, not a fact about the file
+*
+* Measured 2026-09-23: the SAME recording comes back as `Type: "dav"` when the
+* search asked `Types: ["dav"]` and as `Type: "mp4"` when it asked
+* `Types: ["mp4"]` — identical `FilePath` in both, which really ends `.mp4`
+* and really is an ISO MP4. So the field is not carried onto the row at all.
+* The filter still matters enormously — see {@link buildFindCondition}.
+*
+* ## `Length` is the file, `Duration` is the WINDOW
+*
+* `Duration` is the wall-clock span between `StartTime` and `EndTime`. The
+* container inside runs about 7.5 % shorter (74 s row → 68.433 s media,
+* measured with `ffprobe`). Both are carried, separately, and a completion
+* check that compares the delivered media against the ROW naively would fire
+* on every clip this camera makes.
+*/
+/**
+* The file kinds a CLIP may be.
+*
+* **This filter is not cosmetic.** An unfiltered `Flags: ["Event"]` search
+* over the same window returned 60 rows of which **45 were single JPEG
+* snapshots** — `Duration: 0`, `StartTime === EndTime`, ~250 KB each. Listing
+* them would hand the operator three quarters of a catalog that cannot be
+* played, with a zero-length window that `/cam/playback` has nothing to serve.
+* `Types: ["dav"]` returned exactly the 15 recordings.
+*/
+var CLIP_FIND_TYPES = ["dav"];
+/**
+* The record reasons a clip may carry.
+*
+* All three, and not just `Event`, because the filter is what the camera
+* matches on: a camera scheduled for CONTINUOUS recording writes `Timing`
+* rows, and an `Event`-only search on such a camera would report an empty card
+* as confidently as a real one. Measured: a three-flag condition returns the
+* same 15 rows an `Event`-only one does on this camera, so the wider filter
+* costs nothing where it is not needed.
+*/
+var CLIP_FIND_FLAGS = [
+	"Timing",
+	"Event",
+	"Manual"
+];
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readStrings(value) {
+	if (!Array.isArray(value)) return [];
+	const out = [];
+	for (const entry of value) if (typeof entry === "string" && entry !== "") out.push(entry);
+	return out;
+}
+/**
+* A positive finite number, or `null`.
+*
+* `0` becomes `null` on purpose for `Length`: a zero-byte recording is not a
+* measurement, and a bound check that reads it as "comfortably under the
+* ceiling" would let an unmeasurable file through the one gate that exists to
+* stop it.
+*/
+function readPositiveNumber(value) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return null;
+	return value;
+}
+function parseClipRow(raw, clock) {
+	if (!isRecord(raw)) return {
+		kind: "rejected",
+		reason: "no-file-path"
+	};
+	const filePath = raw["FilePath"];
+	if (typeof filePath !== "string" || filePath === "") return {
+		kind: "rejected",
+		reason: "no-file-path"
+	};
+	const startRaw = raw["StartTime"];
+	const endRaw = raw["EndTime"];
+	const startMs = typeof startRaw === "string" ? fromCameraWallClock(startRaw, clock) : null;
+	if (startMs === null) return {
+		kind: "rejected",
+		reason: "unreadable-start"
+	};
+	const endMs = typeof endRaw === "string" ? fromCameraWallClock(endRaw, clock) : null;
+	if (endMs === null) return {
+		kind: "rejected",
+		reason: "unreadable-end"
+	};
+	if (endMs <= startMs) return {
+		kind: "rejected",
+		reason: "not-a-window"
+	};
+	const declaredDuration = readPositiveNumber(raw["Duration"]);
+	const channelRaw = raw["Channel"];
+	return {
+		kind: "ok",
+		row: {
+			clipKey: clipKeyFor(startMs, endMs),
+			startMs,
+			endMs,
+			windowMs: declaredDuration !== null ? declaredDuration * 1e3 : endMs - startMs,
+			sizeBytes: readPositiveNumber(raw["Length"]),
+			filePath,
+			events: readStrings(raw["Events"]),
+			flags: readStrings(raw["Flags"]),
+			channel: typeof channelRaw === "number" && Number.isInteger(channelRaw) ? channelRaw : 0
+		}
+	};
+}
+function buildFindCondition(input) {
+	return {
+		Channel: input.channel,
+		StartTime: input.startWallClock,
+		EndTime: input.endWallClock,
+		Flags: CLIP_FIND_FLAGS,
+		Types: CLIP_FIND_TYPES
+	};
+}
+/**
+* Has the walk reached the end?
+*
+* `found < count` and nothing else. **`mediaFileFind.getCount` must never be
+* called**: over CGI it is `501 Not Implemented`, and over RPC2 it is worse —
+* measured answering `{"params":{"count":0},"result":true}` on a find object
+* whose `findFile` had just succeeded and from which rows were then
+* enumerated. That is an authoritative-looking zero from a method that
+* answered successfully, which is the exact shape D393 forbids, produced by
+* the camera itself.
+*/
+function findWalkIsComplete(found, asked) {
+	return found < asked;
+}
+//#endregion
+//#region src/clips/clip-catalog.ts
+/**
+* The control window — the camera's own wall clock, wide enough that no card
+* can fall outside it. Measured accepted on this firmware (`findFile` true in
+* 361 ms).
+*/
+var CLIP_CONTROL_WINDOW = {
+	start: "1970-01-01 00:00:00",
+	end: "2100-01-01 00:00:00"
+};
+function describeError(error) {
+	const code = error.code === null ? "no code" : `code ${String(error.code)}`;
+	return error.message === "" ? `${code}, no message` : `${code}: ${error.message}`;
+}
+async function runSearch(deps, input) {
+	const tags = { deviceId: deps.deviceId };
+	const created = await deps.rpc.call("mediaFileFind.factory.create", null);
+	if (created.kind === "unreachable") return {
+		kind: "unreachable",
+		detail: created.detail
+	};
+	if (created.kind === "refused") return {
+		kind: "unreachable",
+		detail: `the camera refused a find object (${describeError(created.error)})`
+	};
+	const handle = created.result;
+	if (typeof handle !== "number" || !Number.isFinite(handle)) return {
+		kind: "unreachable",
+		detail: "the camera answered a find-object handle this provider could not read"
+	};
+	try {
+		const condition = buildFindCondition({
+			channel: input.channel,
+			startWallClock: input.startWallClock,
+			endWallClock: input.endWallClock
+		});
+		const started = await deps.rpc.call("mediaFileFind.findFile", { condition }, handle);
+		if (started.kind === "unreachable") return {
+			kind: "unreachable",
+			detail: started.detail
+		};
+		if (started.kind === "refused") return {
+			kind: "refused",
+			detail: describeError(started.error)
+		};
+		if (!input.enumerate) return {
+			kind: "ok",
+			rows: [],
+			pages: 0,
+			rejected: {},
+			rejectedCount: 0
+		};
+		const rows = [];
+		const rejected = {};
+		let rejectedCount = 0;
+		let pages = 0;
+		for (; pages < 64;) {
+			const page = await deps.rpc.call("mediaFileFind.findNextFile", { count: 64 }, handle);
+			pages += 1;
+			if (page.kind === "unreachable") return {
+				kind: "unreachable",
+				detail: page.detail
+			};
+			if (page.kind === "refused") return {
+				kind: "unreachable",
+				detail: `page ${String(pages)} of the search refused (${describeError(page.error)})`
+			};
+			const foundRaw = page.params["found"];
+			const found = typeof foundRaw === "number" && Number.isFinite(foundRaw) ? foundRaw : 0;
+			const infos = page.params["infos"];
+			const list = Array.isArray(infos) ? infos : [];
+			for (const raw of list) {
+				const parsed = parseClipRow(raw, input.clock);
+				if (parsed.kind === "ok") {
+					rows.push(parsed.row);
+					continue;
+				}
+				rejected[parsed.reason] = (rejected[parsed.reason] ?? 0) + 1;
+				rejectedCount += 1;
+			}
+			if (findWalkIsComplete(found, 64)) break;
+			if (list.length === 0) {
+				deps.logger.warn("videoclips: a search page claimed more rows and carried none", {
+					tags,
+					meta: {
+						branch: "find-empty-page",
+						page: pages,
+						found
+					}
+				});
+				break;
+			}
+		}
+		if (pages >= 64) deps.logger.warn("videoclips: a search never terminated — stopping at the page bound", {
+			tags,
+			meta: {
+				branch: "find-page-bound",
+				pages,
+				rows: rows.length
+			}
+		});
+		return {
+			kind: "ok",
+			rows,
+			pages,
+			rejected,
+			rejectedCount
+		};
+	} finally {
+		await releaseFindObject(deps, handle);
+	}
+}
+async function releaseFindObject(deps, handle) {
+	for (const method of ["mediaFileFind.close", "mediaFileFind.destroy"]) {
+		const released = await deps.rpc.call(method, null, handle);
+		if (released.kind === "ok") continue;
+		deps.logger.warn("videoclips: a find object was not released", {
+			tags: { deviceId: deps.deviceId },
+			meta: {
+				branch: "find-object-leak",
+				method,
+				detail: released.kind === "refused" ? describeError(released.error) : released.detail
+			}
+		});
+	}
+}
+/**
+* Every row the camera holds in a window.
+*
+* The window travels as the CAMERA's wall clock, converted through the
+* measured offset. A UTC window would be two hours off in summer and one in
+* winter, and would silently return the wrong footage rather than an error.
+*/
+async function readClipRows(deps, input) {
+	const tags = { deviceId: deps.deviceId };
+	const startWallClock = toCameraWallClock(input.sinceMs, input.clock);
+	const endWallClock = toCameraWallClock(input.untilMs, input.clock);
+	const asked = await runSearch(deps, {
+		startWallClock,
+		endWallClock,
+		channel: input.channel,
+		clock: input.clock,
+		enumerate: true
+	});
+	if (asked.kind === "ok") {
+		if (asked.rejectedCount > 0) deps.logger.warn("videoclips: the camera sent rows this provider could not read", {
+			tags,
+			meta: {
+				branch: "rows-rejected",
+				rejected: asked.rejected,
+				rejectedCount: asked.rejectedCount,
+				kept: asked.rows.length
+			}
+		});
+		return asked;
+	}
+	if (asked.kind === "unreachable") return {
+		kind: "unreachable",
+		detail: asked.detail
+	};
+	const control = await runSearch(deps, {
+		startWallClock: CLIP_CONTROL_WINDOW.start,
+		endWallClock: CLIP_CONTROL_WINDOW.end,
+		channel: input.channel,
+		clock: input.clock,
+		enumerate: false
+	});
+	if (control.kind === "unreachable") return {
+		kind: "unreachable",
+		detail: `the camera refused the search for ${startWallClock} … ${endWallClock} (${asked.detail}) and did not answer the control search (${control.detail})`
+	};
+	if (control.kind === "ok") {
+		deps.logger.info("videoclips: the window holds nothing, proved against a control search", {
+			tags,
+			meta: {
+				branch: "empty-window",
+				startWallClock,
+				endWallClock,
+				refusal: asked.detail
+			}
+		});
+		return { kind: "empty-window" };
+	}
+	return {
+		kind: "index-empty",
+		detail: `the camera refused both the asked window (${startWallClock} … ${endWallClock}: ${asked.detail}) and an unbounded control search (${CLIP_CONTROL_WINDOW.start} … ${CLIP_CONTROL_WINDOW.end}: ${control.detail}) — its index answers nothing anywhere`
+	};
+}
+//#endregion
+//#region src/clips/clip-data-plane.ts
+/**
+* The addon's clip FILE route.
+*
+* Hosted by `ctx.dataPlane.serve({ access: 'authenticated' })`, so the hub
+* authenticates and reverse-proxies and the addon produces the bytes. **No
+* token in the URL**: the hub's `/addon/<id>/<prefix>` proxy reads the
+* credential from `authorization` or the session cookie, so a clip URL may sit
+* in history, in a `Referer` or in a shared log and open nothing (D549 22).
+*
+* It serves the re-indexed MP4 — `moov` first — with `Range`, which is what a
+* `<video>` element needs to show a duration and to seek. The camera's own
+* copy has the `moov` LAST and ignores `Range` outright, so the seekability
+* this route offers is bought by `clip-file.ts`'s one `-c copy` pass and is
+* not a property of the wire.
+*
+* There is deliberately **no STREAM route here**. The camera's forward-only
+* `/cam/playback` replay is real and is not wired — see the ADR: it is a
+* separate slice, it needs a provider-owned slot gate because the camera's own
+* exhaustion signal is a 404 that means "gone", and it cannot honestly answer
+* the broker's rate ladder.
+*
+* `HEAD` answers headers and touches no camera.
+*/
+/** URL namespace under `/addon/provider-amcrest/`. */
+var CLIP_MEDIA_PREFIX = "clip";
+/**
+* A clip key is `<startSec>-<endSec>` and nothing else may reach the
+* filesystem. The store refuses the same shape a second time — two walls,
+* because this one is reachable from a URL.
+*/
+var MEDIA_PATH = /^\/(\d+)\/(\d{1,20}-\d{1,20})\.mp4$/;
+function pathnameOf(req) {
+	const raw = req.url ?? "/";
+	const query = raw.indexOf("?");
+	return query === -1 ? raw : raw.slice(0, query);
+}
+/**
+* `bytes=a-b` / `bytes=a-` / `bytes=-n`.
+*
+* `'unsatisfiable'` is a 416 rather than a silently empty 206: a player that
+* asked past the end must learn it did, not receive zero bytes that look like
+* the end of the file.
+*/
+function parseRange(header, size) {
+	if (header === void 0) return null;
+	const match = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
+	if (match === null) return null;
+	const [, rawStart, rawEnd] = match;
+	if (rawStart === "" && rawEnd === "") return "unsatisfiable";
+	if (rawStart === "") {
+		const length = Number(rawEnd);
+		if (length <= 0) return "unsatisfiable";
+		return {
+			start: Math.max(0, size - length),
+			end: size - 1
+		};
+	}
+	const start = Number(rawStart);
+	if (start >= size) return "unsatisfiable";
+	const end = rawEnd === "" ? size - 1 : Math.min(Number(rawEnd), size - 1);
+	if (end < start) return "unsatisfiable";
+	return {
+		start,
+		end
+	};
+}
+function createClipPlaybackHandler(deps) {
+	return async (req, res) => {
+		if (req.method !== "GET" && req.method !== "HEAD") {
+			res.writeHead(405, { allow: "GET, HEAD" });
+			res.end();
+			return;
+		}
+		const match = MEDIA_PATH.exec(pathnameOf(req));
+		if (match === null) {
+			res.writeHead(400);
+			res.end();
+			return;
+		}
+		const deviceId = Number(match[1]);
+		const clipKey = match[2] ?? "";
+		let path;
+		try {
+			path = await deps.resolvePath(deviceId, clipKey);
+		} catch (err) {
+			deps.logger.warn("videoclips: could not prepare a clip for playback", {
+				tags: { deviceId },
+				meta: {
+					clipKey,
+					branch: "prepare-threw",
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+			res.writeHead(500);
+			res.end();
+			return;
+		}
+		if (path === null) {
+			res.writeHead(404);
+			res.end();
+			return;
+		}
+		const size = (await stat(path)).size;
+		const base = {
+			"content-type": "video/mp4",
+			"accept-ranges": "bytes",
+			"cache-control": "private, max-age=0, must-revalidate"
+		};
+		const range = parseRange(req.headers.range, size);
+		if (range === "unsatisfiable") {
+			res.writeHead(416, {
+				...base,
+				"content-range": `bytes */${String(size)}`
+			});
+			res.end();
+			return;
+		}
+		if (range === null) {
+			res.writeHead(200, {
+				...base,
+				"content-length": String(size)
+			});
+			if (req.method === "HEAD") {
+				res.end();
+				return;
+			}
+			createReadStream(path).pipe(res);
+			return;
+		}
+		res.writeHead(206, {
+			...base,
+			"content-range": `bytes ${String(range.start)}-${String(range.end)}/${String(size)}`,
+			"content-length": String(range.end - range.start + 1)
+		});
+		if (req.method === "HEAD") {
+			res.end();
+			return;
+		}
+		createReadStream(path, {
+			start: range.start,
+			end: range.end
+		}).pipe(res);
+	};
+}
+/** How long one remux may run before it is killed. A `-c copy` pass over
+*  56 MB is seconds; a minute is a bound on a hang, not a budget. */
+var CLIP_FILE_REMUX_TIMEOUT_MS = 6e4;
+/**
+* ffmpeg's own line for the container it opened —
+* `Duration: 00:01:08.43, start: …`. MEASURED, off the file we are about to
+* serve, which is the only thing that can say how long it really runs.
+*/
+function parseFfmpegDurationMs(stderr) {
+	const match = /Duration:\s*(\d+):(\d{2}):(\d{2})\.(\d{1,3})/.exec(stderr);
+	if (match === null) return null;
+	const [, h, m, s, frac] = match;
+	if (h === void 0 || m === void 0 || s === void 0 || frac === void 0) return null;
+	const ms = Number(frac.padEnd(3, "0"));
+	const total = ((Number(h) * 60 + Number(m)) * 60 + Number(s)) * 1e3 + ms;
+	return total > 0 ? total : null;
+}
+/** The `-c copy -movflags +faststart` pass, spelled once. */
+function buildClipFaststartArgs(source, target) {
+	return [
+		"-hide_banner",
+		"-loglevel",
+		"info",
+		"-y",
+		"-i",
+		source,
+		"-c",
+		"copy",
+		"-movflags",
+		"+faststart",
+		"-f",
+		"mp4",
+		target
+	];
+}
+async function fetchRecording(input, deps, target, maxFetchBytes) {
+	let download;
+	try {
+		download = await deps.client.openRecordedFile(input.row.filePath);
+	} catch (err) {
+		return {
+			kind: "refused",
+			bytes: 0,
+			code: "camera-refused",
+			detail: `the camera closed the connection for "${input.row.filePath}" without answering (${err instanceof Error ? err.message : String(err)}) — on this firmware that is how a recording it no longer holds is refused`
+		};
+	}
+	if (download.status !== 200) return {
+		kind: "refused",
+		bytes: 0,
+		code: "camera-refused",
+		detail: `the camera answered HTTP ${String(download.status)} for "${input.row.filePath}"`
+	};
+	if (download.contentLength !== null && download.contentLength > maxFetchBytes) return {
+		kind: "refused",
+		bytes: 0,
+		code: "too-large-to-transfer",
+		detail: `the camera declares "${input.row.filePath}" as ${String(download.contentLength)} bytes, over the ${String(maxFetchBytes)}-byte fetch ceiling`
+	};
+	const body = download.body;
+	if (body === null) return {
+		kind: "refused",
+		bytes: 0,
+		code: "fetch-failed",
+		detail: `the camera answered 200 for "${input.row.filePath}" and sent no body`
+	};
+	let bytes = 0;
+	let overflowed = false;
+	const source = Readable.fromWeb(body);
+	source.on("data", (chunk) => {
+		bytes += chunk.byteLength;
+		if (bytes > maxFetchBytes && !overflowed) {
+			overflowed = true;
+			source.destroy(/* @__PURE__ */ new Error(`fetch ceiling of ${String(maxFetchBytes)} bytes passed`));
+		}
+	});
+	try {
+		await pipeline(source, createWriteStream(target));
+	} catch (err) {
+		if (overflowed) return {
+			kind: "refused",
+			bytes,
+			code: "too-large-to-transfer",
+			detail: `"${input.row.filePath}" passed the ${String(maxFetchBytes)}-byte fetch ceiling before the camera finished it`
+		};
+		return {
+			kind: "refused",
+			bytes,
+			code: "fetch-failed",
+			detail: `the transfer of "${input.row.filePath}" ended after ${String(bytes)} bytes: ${err instanceof Error ? err.message : String(err)}`
+		};
+	}
+	if (bytes === 0) return {
+		kind: "refused",
+		bytes: 0,
+		code: "fetch-failed",
+		detail: `the camera answered 200 for "${input.row.filePath}" and delivered no bytes`
+	};
+	if (download.contentLength !== null && bytes !== download.contentLength) return {
+		kind: "refused",
+		bytes,
+		code: "fetch-failed",
+		detail: `the camera declared ${String(download.contentLength)} bytes for "${input.row.filePath}" and delivered ${String(bytes)}`
+	};
+	return {
+		kind: "ok",
+		bytes
+	};
+}
+/**
+* Fetch a whole recording and re-index it, or answer the cached file.
+*
+* Never throws for a gated branch: a refusal carries its code and its prose so
+* the caller can turn it into the cap's own vocabulary.
+*/
+async function prepareClipFile(input, deps) {
+	const tags = { deviceId: input.deviceId };
+	const meta = { clipKey: input.row.clipKey };
+	const cached = await deps.store.pathIfPresent(input.deviceId, input.row.clipKey);
+	if (cached !== null) {
+		const info = await stat(cached);
+		deps.logger.debug("videoclips: served a clip file from the scratch", {
+			tags,
+			meta: {
+				...meta,
+				bytes: info.size
+			}
+		});
+		return {
+			kind: "ok",
+			path: cached,
+			bytes: info.size,
+			durationMs: null
+		};
+	}
+	const maxFetchBytes = deps.maxFetchBytes ?? 536870912;
+	const startedAt = Date.now();
+	const raw = `${await deps.store.reserve(input.deviceId, input.row.clipKey)}.raw`;
+	const temp = await deps.store.reserve(input.deviceId, input.row.clipKey);
+	try {
+		const fetched = await fetchRecording(input, deps, raw, maxFetchBytes);
+		if (fetched.kind === "refused") {
+			deps.logger.warn("videoclips: a clip fetch was refused", {
+				tags,
+				meta: {
+					...meta,
+					branch: fetched.code ?? "fetch-failed",
+					bytes: fetched.bytes
+				}
+			});
+			return {
+				kind: "refused",
+				code: fetched.code ?? "fetch-failed",
+				detail: fetched.detail ?? "the fetch failed"
+			};
+		}
+		const fetchedAt = Date.now();
+		const args = buildClipFaststartArgs(raw, temp);
+		const child = deps.spawnMux?.([...args]) ?? spawn(deps.ffmpegBinaryPath ?? "ffmpeg", [...args], { stdio: [
+			"ignore",
+			"ignore",
+			"pipe"
+		] });
+		let stderr = "";
+		child.stderr?.on("data", (chunk) => {
+			stderr = `${stderr}${chunk.toString()}`.slice(-4e3);
+		});
+		const killer = setTimeout(() => {
+			child.kill("SIGKILL");
+		}, CLIP_FILE_REMUX_TIMEOUT_MS);
+		const exit = await new Promise((resolve) => {
+			child.on("close", (code) => {
+				resolve(code);
+			});
+			child.on("error", () => {
+				resolve(-1);
+			});
+		});
+		clearTimeout(killer);
+		if (exit !== 0) {
+			deps.logger.warn("videoclips: a clip re-index failed", {
+				tags,
+				meta: {
+					...meta,
+					branch: "fetch-failed",
+					exit,
+					stderr: stderr.trim().slice(-300)
+				}
+			});
+			return {
+				kind: "refused",
+				code: "fetch-failed",
+				detail: `ffmpeg exited ${String(exit)}: ${stderr.trim().slice(-300)}`
+			};
+		}
+		const durationMs = parseFfmpegDurationMs(stderr);
+		const path = await deps.store.publish(input.deviceId, input.row.clipKey, temp);
+		const info = await stat(path);
+		deps.logger.info("videoclips: prepared an Amcrest clip file", {
+			tags,
+			meta: {
+				...meta,
+				fetchedBytes: fetched.bytes,
+				listedBytes: input.row.sizeBytes,
+				bytes: info.size,
+				durationMs,
+				rowWindowMs: input.row.windowMs,
+				fetchMs: fetchedAt - startedAt,
+				remuxMs: Date.now() - fetchedAt
+			}
+		});
+		return {
+			kind: "ok",
+			path,
+			bytes: info.size,
+			durationMs
+		};
+	} finally {
+		await rm(raw, { force: true });
+		await rm(temp, { force: true });
+	}
+}
+//#endregion
+//#region src/clips/clip-twins.ts
+/**
+* The one mapping. An ABSENT profile is not an upgrade: a caller that stated
+* no preference stated no ask, and D382's rule is that an unstated ask is
+* zero — there is nothing for a line to be about.
+*/
+function chooseClipQuality(profile) {
+	return {
+		twin: "main",
+		served: "high",
+		upgraded: profile !== void 0 && profile !== "high"
+	};
+}
+/**
+* One-per-(camera, asked profile) bookkeeping for the upgrade line.
+*
+* Deliberately a plain object rather than a module-level map: a second runner
+* of this addon must not inherit another's "already said that".
+*/
+var ClipUpgradeNotes = class {
+	said = /* @__PURE__ */ new Map();
+	/** Note one upgraded ask and say whether it is worth a line. */
+	note(deviceId, asked) {
+		const key = `${String(deviceId)}|${asked}`;
+		const seen = this.said.get(key);
+		if (seen === void 0) {
+			this.said.set(key, 0);
+			return {
+				kind: "say",
+				asked,
+				suppressedSince: 0
+			};
+		}
+		this.said.set(key, seen + 1);
+		return { kind: "silent" };
+	}
+	/** How many asks this camera/profile pair has made since its one line. Read
+	*  by the listing log, so the quiet carries its own denominator. */
+	suppressed(deviceId, asked) {
+		return this.said.get(`${String(deviceId)}|${asked}`) ?? 0;
+	}
+};
+//#endregion
+//#region src/clips/clip-window.ts
+/**
+* A row whose `endMs` is not after its `startMs` is treated as an INSTANT at
+* `startMs` — judging it by a bad end would drop a recording rather than
+* misplace it, and one of those is recoverable.
+*/
+function clipOverlapsWindow(row, window) {
+	const end = row.endMs > row.startMs ? row.endMs : row.startMs;
+	return row.startMs < window.until && end > window.since;
+}
+function narrowClipsToWindow(rows, window) {
+	const kept = rows.filter((row) => clipOverlapsWindow(row, window));
+	return {
+		kept,
+		outOfWindow: rows.length - kept.length
+	};
+}
+//#endregion
+//#region src/clips/amcrest-videoclips-provider.ts
+/**
+* The name an export carries away.
+*
+* The camera's own file name is `10.23.27-10.24.41[M][0@0][0].mp4` — square
+* brackets, an `@`, and a clock with no date. Every one of those is a hazard in
+* a downloads folder and none of them says WHEN. So the name is minted from the
+* window, in ISO, and the extension is re-stated because what we hand over is
+* an MP4 whatever the camera called it.
+*/
+function clipFileLabel(row) {
+	return `amcrest_${new Date(row.startMs).toISOString().replace(/[:.]/g, "-").slice(0, 19)}.mp4`;
+}
+/**
+* What the camera's own event strings mean in the cap's vocabulary.
+*
+* `VideoMotion` is the only value 60 of 60 measured rows carried, so this is a
+* mapping written against ONE observed string and it says so. Everything else
+* is `native` — the camera's words survive verbatim on `nativeTypes`, which is
+* the lossless copy D549 20 requires precisely because this table is lossy.
+*/
+function clipKindFor(row) {
+	if (row.events.some((event) => event.toLowerCase().includes("motion"))) return "motion";
+	return "native";
+}
+function createAmcrestVideoclipsProvider(deps) {
+	/** Last known availability per device, written by every read. */
+	const health = /* @__PURE__ */ new Map();
+	/** Every row this provider has listed, by `deviceId|clipKey`, so a byte
+	*  offer resolves without re-searching the camera. */
+	const rowsByKey = /* @__PURE__ */ new Map();
+	const upgrades = new ClipUpgradeNotes();
+	const rowKey = (deviceId, clipKey) => `${String(deviceId)}|${clipKey}`;
+	const remember = (deviceId, rows) => {
+		for (const row of rows) rowsByKey.set(rowKey(deviceId, row.clipKey), row);
+	};
+	const toClip = (row, catalogAsOf) => {
+		const id = mintClipId({
+			source: CLIP_SOURCE_ONBOARD,
+			startMs: row.startMs,
+			endMs: row.endMs
+		});
+		return {
+			id,
+			source: CLIP_SOURCE_ONBOARD,
+			kind: clipKindFor(row),
+			timeRange: {
+				startMs: row.startMs,
+				endMs: row.endMs
+			},
+			...row.events.length > 0 ? { nativeTypes: [...row.events] } : {},
+			thumbnailUnavailable: { reason: "unsupported" },
+			catalogAsOf,
+			streams: { main: {
+				id,
+				...row.sizeBytes !== null ? { bytes: row.sizeBytes } : {}
+			} },
+			supportSub: false
+		};
+	};
+	const noteUpgrade = (deviceId, profile) => {
+		if (profile === void 0) return;
+		if (upgrades.note(deviceId, profile).kind !== "say") return;
+		deps.logger.warn("videoclips: this camera archives only the main copy — every ask is served it", {
+			tags: { deviceId },
+			meta: {
+				branch: "quality-upgraded",
+				asked: profile,
+				served: "high",
+				note: "further upgraded asks for this camera and profile are not logged"
+			}
+		});
+	};
+	return {
+		listSources: async ({ deviceId }) => {
+			const device = await deps.resolveDevice(deviceId);
+			if (device === null) return [];
+			const availability = await deps.probeAvailability(device);
+			health.set(deviceId, availability);
+			return [{
+				source: CLIP_SOURCE_ONBOARD,
+				addonId: AMCREST_ADDON_ID,
+				label: "Camera storage",
+				availability
+			}];
+		},
+		listClips: async ({ deviceId, since, until, limit }) => {
+			const device = await deps.resolveDevice(deviceId);
+			if (device === null) return [];
+			const tags = { deviceId };
+			const outcome = await deps.readCatalog({
+				device,
+				sinceMs: since,
+				untilMs: until
+			});
+			if (outcome.kind === "refused") {
+				health.set(deviceId, outcome.availability);
+				deps.logger.warn("videoclips: nothing to list, and the source cannot answer", {
+					tags,
+					meta: {
+						branch: "refused-empty",
+						state: outcome.availability.state,
+						reason: outcome.availability.reason ?? null
+					}
+				});
+				throw new Error(`videoclips: device ${String(deviceId)} listed no clips, and that is not an empty window — the source is "${outcome.availability.state}"` + (outcome.availability.reason !== void 0 ? `: ${outcome.availability.reason}` : "."));
+			}
+			const catalogAsOf = deps.now();
+			health.set(deviceId, {
+				state: "ok",
+				catalogAsOf
+			});
+			if (outcome.kind === "empty") {
+				deps.logger.info("videoclips: the window holds no clips", {
+					tags,
+					meta: {
+						branch: "empty-window",
+						source: CLIP_SOURCE_ONBOARD,
+						since,
+						until
+					}
+				});
+				return [];
+			}
+			remember(deviceId, outcome.rows);
+			const narrowed = narrowClipsToWindow(outcome.rows, {
+				since,
+				until
+			});
+			if (narrowed.outOfWindow > 0) deps.logger.info("videoclips: narrowed a listing to the window it was asked for", {
+				tags,
+				meta: {
+					branch: "listing-narrowed",
+					listed: outcome.rows.length,
+					kept: narrowed.kept.length,
+					outOfWindow: narrowed.outOfWindow,
+					since,
+					until
+				}
+			});
+			const ordered = narrowed.kept.toSorted((a, b) => b.startMs - a.startMs);
+			const capped = limit !== void 0 ? ordered.slice(0, limit) : ordered;
+			deps.logger.info("videoclips: listed an Amcrest catalog", {
+				tags,
+				meta: {
+					source: CLIP_SOURCE_ONBOARD,
+					clips: capped.length,
+					truncated: limit !== void 0 && ordered.length > limit,
+					findChannel: device.findChannel
+				}
+			});
+			return capped.map((row) => toClip(row, catalogAsOf));
+		},
+		/**
+		* The player's URL — a finished, `moov`-first MP4 on this addon's own
+		* media plane, with `Range`, because the surface hands it to a `<video>`
+		* element that has to show a duration and seek.
+		*/
+		getClipPlayback: async ({ deviceId, clipId, profile }) => {
+			const parsed = parseClipId(clipId);
+			if (parsed === null) throw new Error(`videoclips: clip id "${clipId}" was not minted by the Amcrest provider`);
+			if (await deps.resolveDevice(deviceId) === null) throw new Error(`videoclips: device ${String(deviceId)} is not an Amcrest camera`);
+			const clipKey = clipKeyOf(parsed);
+			if (!rowsByKey.has(rowKey(deviceId, clipKey))) throw new Error(clipExportFailure("catalog-miss", `clip "${clipId}" is not in this node's catalog for device ${String(deviceId)} — list the window that holds it first`));
+			const quality = chooseClipQuality(profile);
+			if (quality.upgraded) noteUpgrade(deviceId, profile);
+			return {
+				playbackUrl: deps.playbackUrl(deviceId, clipKey),
+				format: "mp4",
+				served: quality.served
+			};
+		},
+		/**
+		* This clip's BYTES, base64, bounded — the broker's file feeder (D575).
+		*
+		* **It is wired, and it will refuse about a fifth of this camera's
+		* catalog, by name.** Ten measured clips ran 33.4–72.9 MiB and 2 of them
+		* exceed `VIDEOCLIPS_MAX_READ_BYTES` (50 MiB); the worst the camera can
+		* structurally produce — one motion episode cut at the 5-minute
+		* `PacketLength` cap, at the peak achieved 6.64 Mbit/s — is 238 MiB. The
+		* envelope is unary, so that payload is held at ~1.33× in the provider AND
+		* in the caller, on a hub this repo has already OOM'd (D9/D18), and the
+		* bound is not going to move for an inline read.
+		*
+		* It is wired anyway, and the alternative was measured rather than
+		* assumed: the broker's `chooseClipPath` reads whether *the broker* has a
+		* file read wired, not whether this provider implements one. Leaving the
+		* method off would make the broker choose the file path and then call a
+		* method that answers `NOT_IMPLEMENTED` — an unnamed failure in place of
+		* the named refusal this returns. A named `too-large-to-transfer` that an
+		* operator can read is strictly better than an error nobody can, and it is
+		* also the honest measurement that argues for the camera's own
+		* forward-only replay as the next slice.
+		*
+		* {@link offerClipBytes} is the path an EXPORT takes, holds nothing on
+		* either side, and reaches 500 MiB — every clip this camera can make.
+		*
+		* The cheap questions come first and none of them touches the camera: the
+		* id, the row, and the SIZE the catalog already declared (D54).
+		*/
+		readClipBytes: async ({ deviceId, clipId, profile, maxBytes }) => {
+			const tags = { deviceId };
+			const refuse = (code, detail, meta) => {
+				deps.logger.warn("videoclips: refusing a clip byte read", {
+					tags,
+					meta: {
+						clipId,
+						branch: code,
+						...meta
+					}
+				});
+				throw new Error(clipExportFailure(code, detail));
+			};
+			const device = await deps.resolveDevice(deviceId);
+			if (device === null) return refuse("catalog-miss", `device ${String(deviceId)} is not an Amcrest camera`, {});
+			const parsed = parseClipId(clipId);
+			if (parsed === null) return refuse("catalog-miss", `clip id "${clipId}" was not minted by the Amcrest provider`, {});
+			const clipKey = clipKeyOf(parsed);
+			const row = rowsByKey.get(rowKey(deviceId, clipKey));
+			if (row === void 0) return refuse("catalog-miss", `clip "${clipId}" is not in this node's catalog for device ${String(deviceId)} — list the window that holds it first`, { clipKey });
+			const quality = chooseClipQuality(profile);
+			if (quality.upgraded) noteUpgrade(deviceId, profile);
+			const bound = Math.min(maxBytes ?? 52428800, VIDEOCLIPS_MAX_READ_BYTES);
+			if (row.sizeBytes !== null && row.sizeBytes > bound) return refuse("too-large-to-transfer", `the camera lists clip "${clipId}" as ${String(row.sizeBytes)} bytes, over the ${String(bound)}-byte bound for an inline read — play it from its playback URL instead`, {
+				clipKey,
+				listedBytes: row.sizeBytes,
+				bound
+			});
+			const outcome = await deps.prepareBytes({
+				device,
+				row,
+				maxBytes: bound
+			});
+			if (outcome.kind === "refused") throw new Error(clipExportFailure(outcome.code, outcome.detail));
+			if (outcome.bytes.byteLength > bound) return refuse("too-large-to-transfer", `clip "${clipId}" re-indexed to ${String(outcome.bytes.byteLength)} bytes, over the ${String(bound)}-byte bound for an inline read`, {
+				clipKey,
+				bytes: outcome.bytes.byteLength,
+				bound
+			});
+			deps.logger.info("videoclips: served an Amcrest clip inline", {
+				tags,
+				meta: {
+					clipId,
+					clipKey,
+					served: quality.served,
+					asked: profile ?? null,
+					bytes: outcome.bytes.byteLength,
+					durationMs: outcome.durationMs
+				}
+			});
+			return {
+				base64: outcome.bytes.toString("base64"),
+				contentType: "video/mp4",
+				name: clipFileLabel(row),
+				bytes: outcome.bytes.byteLength,
+				served: quality.served,
+				...outcome.durationMs !== null ? { durationMs: outcome.durationMs } : {}
+			};
+		},
+		/**
+		* Where this clip's finished bytes can be TAKEN (D613) — the by-handle
+		* read a clip EXPORT pulls.
+		*
+		* {@link readClipBytes} with the envelope removed, and on this camera that
+		* is the difference between exporting a fifth of the catalog and all of
+		* it: the bound here is `VIDEOCLIPS_MAX_OFFER_BYTES` (500 MiB), which
+		* every measured clip (33.4–72.9 MiB) and the worst structurally possible
+		* one (238 MiB) fit with room. Nothing is held on either side — the bytes
+		* leave over a one-shot loopback socket, straight off the scratch file.
+		*
+		* The cheap questions come first and none of them touches the camera: the
+		* id, the row, and the SIZE the catalog already declared (D54).
+		*/
+		offerClipBytes: async ({ deviceId, clipId, profile, maxBytes }) => {
+			const tags = { deviceId };
+			const refuse = (code, detail, meta) => {
+				deps.logger.warn("videoclips: refusing a clip byte offer", {
+					tags,
+					meta: {
+						clipId,
+						branch: code,
+						...meta
+					}
+				});
+				throw new Error(clipExportFailure(code, detail));
+			};
+			const device = await deps.resolveDevice(deviceId);
+			if (device === null) return refuse("catalog-miss", `device ${String(deviceId)} is not an Amcrest camera`, {});
+			const parsed = parseClipId(clipId);
+			if (parsed === null) return refuse("catalog-miss", `clip id "${clipId}" was not minted by the Amcrest provider`, {});
+			const clipKey = clipKeyOf(parsed);
+			const row = rowsByKey.get(rowKey(deviceId, clipKey));
+			if (row === void 0) return refuse("catalog-miss", `clip "${clipId}" is not in this node's catalog for device ${String(deviceId)} — list the window that holds it first`, { clipKey });
+			const quality = chooseClipQuality(profile);
+			if (quality.upgraded) noteUpgrade(deviceId, profile);
+			const bound = Math.min(maxBytes ?? 524288e3, VIDEOCLIPS_MAX_OFFER_BYTES);
+			if (row.sizeBytes !== null && row.sizeBytes > bound) return refuse("too-large-to-transfer", `the camera lists clip "${clipId}" as ${String(row.sizeBytes)} bytes, over the ${String(bound)}-byte bound for one transfer`, {
+				clipKey,
+				listedBytes: row.sizeBytes,
+				bound
+			});
+			const outcome = await deps.prepareOffer({
+				device,
+				row,
+				maxBytes: bound
+			});
+			if (outcome.kind === "refused") throw new Error(clipExportFailure(outcome.code, outcome.detail));
+			deps.logger.info("videoclips: offered an Amcrest clip by handle", {
+				tags,
+				meta: {
+					clipId,
+					clipKey,
+					served: quality.served,
+					asked: profile ?? null,
+					bytes: outcome.bytes,
+					durationMs: outcome.durationMs,
+					expiresInMs: outcome.ticket.expiresAtMs - deps.now()
+				}
+			});
+			return {
+				ticket: outcome.ticket,
+				contentType: "video/mp4",
+				name: clipFileLabel(row),
+				served: quality.served,
+				...outcome.durationMs !== null ? { durationMs: outcome.durationMs } : {}
+			};
+		},
+		/**
+		* What a surface may DRAW for this camera's clips (D612).
+		*
+		* A CONSTANT, and one of the two the contract spells — a provider never
+		* composes an envelope of its own. `file`, because this provider reaches
+		* the player through one bounded by-handle fetch of a whole, `stbl`-indexed
+		* MP4: the camera hands over a self-contained ISO MP4 with the `moov` at
+		* the end and no ranged read, so the clip is pulled once, made seekable
+		* once, and then everything the `file` envelope promises — free seek,
+		* backward frame-step, scrub, the broker's whole rate ladder — is true of
+		* it.
+		*
+		* The camera's OWN forward-only replay (`/cam/playback` over RTSP) is real
+		* and is deliberately NOT what this answers, because it is not wired: it
+		* would need `dialClipStream`, and the one rate it could honestly offer is
+		* `[1]` — `Scale` is accepted, never echoed, and a cold `Scale: 4.0` drain
+		* delivered 10 % of the packets in 42 % of the time with the audio dropped
+		* entirely. Answering `stream` before that path exists would promise a
+		* transport with no producer behind it.
+		*/
+		getPlaybackOptions: async () => CLIP_PLAYBACK_OPTIONS.file
+	};
+}
+//#endregion
+//#region src/clips/clip-service.ts
+function createClipService(deps) {
+	const now = deps.now ?? (() => Date.now());
+	const logger = deps.logger;
+	const store = new ClipArtifactStore({ root: deps.dataDir });
+	/** One RPC2 client per camera. Minted lazily: a camera nobody asks for clips
+	*  about never logs in. */
+	const rpcByDevice = /* @__PURE__ */ new Map();
+	/** The measured camera-clock offset, per device. */
+	const clockByDevice = /* @__PURE__ */ new Map();
+	/** Every row the provider has listed, mirrored here so the media ROUTE —
+	*  which is reached without a cap call — resolves a key without the camera. */
+	const rowsByKey = /* @__PURE__ */ new Map();
+	const rowKey = (deviceId, clipKey) => `${String(deviceId)}|${clipKey}`;
+	const rpcFor = (camera) => {
+		const existing = rpcByDevice.get(camera.deviceId);
+		if (existing !== void 0) return existing;
+		const client = new AmcrestRpc2Client({
+			host: camera.host,
+			port: camera.port,
+			https: camera.https,
+			username: camera.username,
+			password: camera.password,
+			now
+		});
+		rpcByDevice.set(camera.deviceId, client);
+		return client;
+	};
+	/**
+	* The camera's clock, measured and cached.
+	*
+	* `null` when the read failed — never a zero offset, which is the same shape
+	* as "this camera runs on UTC" and would move its whole archive by the
+	* timezone it really has.
+	*/
+	const clockFor = async (camera) => {
+		const cached = clockByDevice.get(camera.deviceId);
+		if (cached !== void 0 && cameraClockIsFresh(cached, now())) return cached;
+		let body;
+		const sentAt = now();
+		try {
+			body = await camera.client.getCurrentTime();
+		} catch (err) {
+			logger.warn("videoclips: the camera did not say what time it thinks it is", {
+				tags: { deviceId: camera.deviceId },
+				meta: {
+					branch: "clock-unread",
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+			return null;
+		}
+		const clock = deriveCameraClock({
+			currentTimeBody: body,
+			hostUtcBeforeMs: sentAt,
+			hostUtcAfterMs: now()
+		});
+		if (clock === null) {
+			logger.warn("videoclips: the camera answered a time this provider could not read", {
+				tags: { deviceId: camera.deviceId },
+				meta: { branch: "clock-unparsed" }
+			});
+			return null;
+		}
+		clockByDevice.set(camera.deviceId, clock);
+		if (cameraClockDisagrees(clock)) logger.warn("videoclips: the camera's clock disagrees with the hub by more than any timezone", {
+			tags: { deviceId: camera.deviceId },
+			meta: {
+				branch: "clock-disagrees",
+				offsetMs: clock.offsetMs
+			}
+		});
+		else logger.debug("videoclips: measured this camera’s clock offset", {
+			tags: { deviceId: camera.deviceId },
+			meta: { offsetMs: clock.offsetMs }
+		});
+		return clock;
+	};
+	const resolveDevice = async (deviceId) => {
+		const camera = await deps.resolveCamera(deviceId);
+		if (camera === null) return null;
+		return {
+			deviceId,
+			findChannel: Math.max(0, camera.channel - 1)
+		};
+	};
+	const fileFor = async (deviceId, clipKey) => {
+		const camera = await deps.resolveCamera(deviceId);
+		if (camera === null) return {
+			kind: "refused",
+			code: "fetch-failed",
+			detail: `device ${String(deviceId)} is not an Amcrest camera`
+		};
+		const row = rowsByKey.get(rowKey(deviceId, clipKey));
+		if (row === void 0) return {
+			kind: "refused",
+			code: "fetch-failed",
+			detail: "no-catalog-row: list the window that holds this clip first"
+		};
+		return await prepareClipFile({
+			deviceId,
+			row
+		}, {
+			logger,
+			store,
+			client: camera.client,
+			...deps.ffmpegBinaryPath !== void 0 ? { ffmpegBinaryPath: deps.ffmpegBinaryPath } : {}
+		});
+	};
+	return {
+		provider: createAmcrestVideoclipsProvider({
+			now,
+			logger,
+			resolveDevice,
+			probeAvailability: async (device) => {
+				const camera = await deps.resolveCamera(device.deviceId);
+				if (camera === null) return {
+					state: "unreachable",
+					reason: "this device is not an Amcrest camera"
+				};
+				const tags = { deviceId: device.deviceId };
+				const storage = await camera.readStorage();
+				if (storage !== null) {
+					logger.info("videoclips: the storage read settled this source", {
+						tags,
+						meta: {
+							branch: storage.state,
+							reason: storage.reason ?? null
+						}
+					});
+					return storage;
+				}
+				const clockRefusal = availabilityFromClock(await clockFor(camera));
+				if (clockRefusal !== null) return clockRefusal;
+				return {
+					state: "ok",
+					catalogAsOf: now()
+				};
+			},
+			readCatalog: async ({ device, sinceMs, untilMs }) => {
+				const camera = await deps.resolveCamera(device.deviceId);
+				if (camera === null) return {
+					kind: "refused",
+					availability: {
+						state: "unreachable",
+						reason: "this device is not an Amcrest camera"
+					}
+				};
+				const storage = await camera.readStorage();
+				if (storage !== null) return {
+					kind: "refused",
+					availability: storage
+				};
+				const clock = await clockFor(camera);
+				const clockRefusal = availabilityFromClock(clock);
+				if (clockRefusal !== null || clock === null) return {
+					kind: "refused",
+					availability: clockRefusal ?? {
+						state: "unreachable",
+						reason: "no camera clock"
+					}
+				};
+				const outcome = await readClipRows({
+					rpc: rpcFor(camera),
+					logger,
+					deviceId: device.deviceId
+				}, {
+					channel: device.findChannel,
+					sinceMs,
+					untilMs,
+					clock
+				});
+				switch (outcome.kind) {
+					case "unreachable":
+						logger.warn("videoclips: the catalog search did not complete", {
+							tags: { deviceId: device.deviceId },
+							meta: {
+								branch: "camera-refused",
+								error: outcome.detail
+							}
+						});
+						return {
+							kind: "refused",
+							availability: {
+								state: "unreachable",
+								reason: outcome.detail
+							}
+						};
+					case "index-empty":
+						logger.warn("videoclips: the camera’s index answers nothing anywhere", {
+							tags: { deviceId: device.deviceId },
+							meta: {
+								branch: "index-empty",
+								error: outcome.detail
+							}
+						});
+						return {
+							kind: "refused",
+							availability: {
+								state: "index-empty",
+								reason: outcome.detail
+							}
+						};
+					case "empty-window": return { kind: "empty" };
+					case "ok":
+						for (const row of outcome.rows) rowsByKey.set(rowKey(device.deviceId, row.clipKey), row);
+						logger.info("videoclips: the camera answered a catalog search", {
+							tags: { deviceId: device.deviceId },
+							meta: {
+								rows: outcome.rows.length,
+								pages: outcome.pages,
+								rejected: outcome.rejectedCount,
+								findChannel: device.findChannel,
+								oldestStartMs: outcome.rows[0]?.startMs ?? null,
+								newestStartMs: outcome.rows[outcome.rows.length - 1]?.startMs ?? null
+							}
+						});
+						return {
+							kind: "ok",
+							rows: outcome.rows
+						};
+				}
+			},
+			playbackUrl: (deviceId, clipKey) => `/addon/${AMCREST_ADDON_ID}/${CLIP_MEDIA_PREFIX}/${String(deviceId)}/${clipKey}.mp4`,
+			prepareBytes: async ({ device, row, maxBytes }) => {
+				rowsByKey.set(rowKey(device.deviceId, row.clipKey), row);
+				const file = await fileFor(device.deviceId, row.clipKey);
+				if (file.kind === "refused") return {
+					kind: "refused",
+					code: file.code,
+					detail: file.detail
+				};
+				if (file.bytes > maxBytes) return {
+					kind: "refused",
+					code: "too-large-to-transfer",
+					detail: `clip "${row.clipKey}" is ${String(file.bytes)} bytes, over the ${String(maxBytes)}-byte bound for an inline read — play it from its playback URL`
+				};
+				return {
+					kind: "ok",
+					bytes: await readFile(file.path),
+					durationMs: file.durationMs
+				};
+			},
+			prepareOffer: async ({ device, row, maxBytes }) => {
+				const peerBytes = deps.peerBytes;
+				if (peerBytes === void 0) {
+					logger.warn("videoclips: no peer-bytes transport on this node", {
+						tags: { deviceId: device.deviceId },
+						meta: {
+							clipKey: row.clipKey,
+							branch: "no-peer-bytes"
+						}
+					});
+					return {
+						kind: "refused",
+						code: "fetch-failed",
+						detail: "this node has no addon-to-addon byte transport wired"
+					};
+				}
+				rowsByKey.set(rowKey(device.deviceId, row.clipKey), row);
+				const file = await fileFor(device.deviceId, row.clipKey);
+				if (file.kind === "refused") return {
+					kind: "refused",
+					code: file.code,
+					detail: file.detail
+				};
+				if (file.bytes > maxBytes) return {
+					kind: "refused",
+					code: "too-large-to-transfer",
+					detail: `clip "${row.clipKey}" is ${String(file.bytes)} bytes, over the ${String(maxBytes)}-byte bound for one transfer`
+				};
+				const offered = await peerBytes.offerFile({
+					path: file.path,
+					contentType: "video/mp4",
+					label: "amcrest-clip",
+					deviceId: device.deviceId
+				});
+				if (offered.kind === "refused") {
+					logger.warn("videoclips: the clip byte offer could not be minted", {
+						tags: { deviceId: device.deviceId },
+						meta: {
+							clipKey: row.clipKey,
+							branch: offered.code,
+							detail: offered.detail
+						}
+					});
+					return {
+						kind: "refused",
+						code: "fetch-failed",
+						detail: `${offered.code}: ${offered.detail}`
+					};
+				}
+				return {
+					kind: "ok",
+					ticket: offered.ticket,
+					durationMs: file.durationMs,
+					bytes: file.bytes
+				};
+			}
+		}),
+		mediaPrefix: CLIP_MEDIA_PREFIX,
+		mediaHandler: createClipPlaybackHandler({
+			logger,
+			resolvePath: async (deviceId, clipKey) => {
+				const file = await fileFor(deviceId, clipKey);
+				if (file.kind === "ok") return file.path;
+				logger.warn("videoclips: a clip file was refused", {
+					tags: { deviceId },
+					meta: {
+						clipKey,
+						branch: file.code,
+						reason: file.detail
+					}
+				});
+				return null;
+			}
+		}),
+		forgetDevice: (deviceId) => {
+			rpcByDevice.get(deviceId)?.reset();
+			rpcByDevice.delete(deviceId);
+			clockByDevice.delete(deviceId);
+		}
+	};
+}
 //#endregion
 //#region ../../node_modules/xml2js/lib/defaults.js
 var require_defaults = /* @__PURE__ */ __commonJSMin(((exports) => {
@@ -60771,7 +64363,39 @@ var AmcrestProviderAddon = class extends BaseDeviceProvider {
 		throw new Error(`Amcrest: probe on ${host || "(unknown host)"} resolved neither mac nor host address — cannot persist a stable row key. Verify network reachability + credentials, then retry.`);
 	}
 	async onInitialize() {
-		return await super.onInitialize();
+		const regs = await super.onInitialize();
+		this.clipService = createClipService({
+			dataDir: this.ctx.dataDir,
+			logger: this.ctx.logger,
+			...this.ctx.peerBytes !== void 0 ? { peerBytes: this.ctx.peerBytes } : {},
+			resolveCamera: async (deviceId) => {
+				const device = this.ctx.kernel.deviceRegistry?.getById(deviceId);
+				return device instanceof AmcrestCamera ? device.getClipCamera() : null;
+			}
+		});
+		regs.push({
+			capability: videoclipsCapability,
+			provider: this.clipService.provider
+		});
+		await this.serveClipPlane(this.clipService);
+		return regs;
+	}
+	/** The clip service: catalog, the player's file route, the export's bytes. */
+	clipService = null;
+	async serveClipPlane(service) {
+		try {
+			const media = await this.ctx.dataPlane?.serve({
+				prefix: service.mediaPrefix,
+				access: "authenticated",
+				handler: service.mediaHandler
+			});
+			this.ctx.logger.info("Amcrest clip data plane served", { meta: {
+				mediaPath: `/addon/${AMCREST_ADDON_ID}/${service.mediaPrefix}`,
+				mediaServed: media !== void 0
+			} });
+		} catch (err) {
+			this.ctx.logger.warn("Amcrest clip data plane failed to serve — clips will not play", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
 	}
 	async supportsDiscovery() {
 		return true;