@camstack/addon-provider-reolink 1.2.160 → 1.2.162

package/dist/addon.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "./chunk-CNf5ZN-e.mjs";
-import { A as splitAnnexBToNalPayloads, C as extractSpsFromAnnexB, D as md5StrModern, E as isH265Irap, M as talkTraceLog, N as traceLog, O as normalizeDebugOptions, S as extractPpsFromAnnexB, T as getH265NalType, _ as convertToAnnexB, a as BC_MAGIC, b as deriveAesKey, c as BaichuanVideoStream, d as __require$1, f as aesDecrypt, g as bcHeaderHasPayloadOffset, h as bcEncrypt, i as BC_CLASS_MODERN_24, j as splitAnnexBToNalPayloads2, k as recordingsTraceLog, l as BcMediaAnnexBDecoder, m as bcDecrypt, n as BC_CLASS_LEGACY, o as BC_MAGIC_REV, p as aesEncrypt, r as BC_CLASS_MODERN_20, t as BC_CLASS_FILE_DOWNLOAD, v as convertToAnnexB2, w as extractVpsFromAnnexB, x as eventTraceLog, y as debugLog } from "./chunk-ZBACPERX-cDJK1KXE.mjs";
+import { A as recordingsTraceLog, C as extractPpsFromAnnexB, D as isH265Irap, E as getH265NalType, M as splitAnnexBToNalPayloads2, N as talkTraceLog, O as md5StrModern, P as traceLog, S as eventTraceLog, T as extractVpsFromAnnexB, _ as bcHeaderHasPayloadOffset, a as BC_MAGIC, b as debugLog, c as BaichuanVideoStream, f as __require$1, g as bcEncrypt, h as bcDecrypt, i as BC_CLASS_MODERN_24, j as splitAnnexBToNalPayloads, k as normalizeDebugOptions, l as BcMediaAnnexBDecoder, m as aesEncrypt, n as BC_CLASS_LEGACY, o as BC_MAGIC_REV, p as aesDecrypt, r as BC_CLASS_MODERN_20, t as BC_CLASS_FILE_DOWNLOAD, v as convertToAnnexB, w as extractSpsFromAnnexB, x as deriveAesKey, y as convertToAnnexB2 } from "./chunk-OSVYEFMM-Bl0F4OJc.mjs";
 import { createHash, randomBytes } from "node:crypto";
 import { EventEmitter } from "events";
 import * as fs2 from "fs";
@@ -5386,7 +5386,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-De1BvmWo.mjs
+//#region ../types/dist/sleep-i3eUVc-d.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -14149,6 +14149,210 @@ method(object({ integrationId: string() }), object({ filters: array(AdoptionFilt
 	auth: "admin"
 });
 /**
+* device-admin-link — "this device has a management page of its own, and here
+* is its address".
+*
+* ## Why this is not a `deviceConfig` cap
+*
+* There is nothing to edit. A `deviceConfig` cap (D14) exists so the framework
+* can DERIVE a settings form from `getOptions` + `getStatus` and route a flat
+* patch back through a setter; it costs a `builderId` reducer in
+* `device-config-contribution.ts` and a `*-config-schema.ts` beside it, and it
+* renders a form section. This cap answers ONE question with ONE read and
+* renders a button. Nothing about it is a form, so it carries no `deviceConfig`
+* block, no `settings`, no `runtimeState` and no reducer — exactly like
+* `reboot`, the other pure-RPC device-native cap.
+*
+* ## Absent, and the difference between "no page" and "we cannot say"
+*
+* The two are answered at DIFFERENT layers, on purpose:
+*
+*  - **"We cannot say"** → the provider never registers the cap for that
+*    device. A VeSync humidifier, a Petkit feeder, a Dreame vacuum and a Dreo
+*    fan are reached only through a vendor cloud; there is no address to hand
+*    out and no page to open. A Tuya plug, a Wyze camera and a Gree air
+*    conditioner DO have a LAN IP, and still have no HTTP management page
+*    behind it. None of them register, so `deviceManager.getBindings` never
+*    lists the cap and no surface asks.
+*  - **"This device has no page, and I know that"** → the provider registers
+*    and `getAdminLink` returns `null`. This is the answer for a device whose
+*    sibling DOES have a page: a Reolink battery camera reached over UDP by
+*    `uid` with a blank `host`, an Ecowitt gateway configured in `listener`
+*    transport, a Home Assistant broker authenticated by supervisor token
+*    (which carries no `baseUrl` at all).
+*
+* Both draw NOTHING. A button that opens a browser error is worse than no
+* button, and D62 is the same rule from the other side: an off switch is
+* reported off, never made to look broken. There is no third state where the
+* UI renders a disabled button "because the device might have a page".
+*
+* ## The URL never carries credentials
+*
+* Not in userinfo, not in a query string. Every provider builds through
+* `buildDeviceAdminUrl` (`device-admin-link-url.ts`), which takes host, port,
+* scheme and path as separate arguments — there is no parameter a secret could
+* arrive in — and re-checks its own output for the `scheme://user:pass@` shape
+* that `scripts/check-no-credential-urls-in-fixtures.ts` bans from recorded
+* output. `scripts/check-admin-link-builder-is-the-only-url-source.ts` is what
+* keeps providers from hand-rolling one anyway.
+*
+* This matters here more than anywhere else in the repo, because every provider
+* that knows a device's host knows its PASSWORD too: `{ host, port, username,
+* password }` sit in one object on Hikvision, Amcrest, Reolink and ONVIF alike,
+* and `http://admin:hunter2@192.168.50.139/` is a URL a browser accepts. The
+* camera's own page will ask for its own login. That is correct, and pre-
+* filling it is the operator's business, not ours.
+*
+* ## It is a LAN fact
+*
+* The URL addresses the device where the NODE can see it. It is not proxied,
+* not made reachable from outside, and not sent anywhere. A surface renders it
+* as a link the operator's own browser follows, on the operator's own network,
+* or renders nothing.
+*/
+/**
+* Whose page is it. The distinction is for the OPERATOR, who needs to know
+* before clicking whether he is about to land on a camera's own web server or
+* inside Home Assistant.
+*/
+var AdminLinkTargetEnum = _enum(["device", "integration"]);
+var DeviceAdminLinkSchema = object({
+	/**
+	* Absolute `http(s)://` URL. Built by `buildDeviceAdminUrl` and therefore
+	* free of userinfo and of any credential-shaped query key.
+	*/
+	url: string(),
+	/**
+	* What the surface calls it — "Web UI", "Home Assistant", "UniFi controller".
+	* The PROVIDER names it, because only the provider knows what the page is;
+	* a UI that invented the label from the addon id would call the Home
+	* Assistant device page "Provider Homeassistant".
+	*/
+	label: string(),
+	target: AdminLinkTargetEnum,
+	/**
+	* Host the URL points at, without scheme, port or path — for the tooltip, so
+	* an operator can see WHERE the button goes before he follows it. Redundant
+	* with `url` by construction; carried separately so no surface has to parse
+	* a URL to show it.
+	*/
+	host: string()
+});
+var deviceAdminLinkCapability = {
+	name: "device-admin-link",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	methods: { 
+	/**
+	* The device's management page, or `null` when this device has none.
+	*
+	* `auth: 'admin'` deliberately. This is administration, not actuation —
+	* the same bucket as `reboot` and `camera-credentials`, and explicitly NOT
+	* the actuation set `scripts/check-actuation-not-admin.ts` protects (D403).
+	* The URL is also a statement about the LAN, which a household member with
+	* a `view` grant on a light has no reason to be handed.
+	*
+	* The surfaces gate on the QUERY, never on a role they guessed: a caller
+	* without the right loses the query and draws nothing, which is the same
+	* thing a device with no page draws. There is no path on which a button
+	* appears and then fails — the D403 failure mode, from the other end.
+	*/
+getAdminLink: method(object({ deviceId: number().int().nonnegative() }), DeviceAdminLinkSchema.nullable(), { auth: "admin" }) }
+};
+/**
+* Query keys that may never appear on an admin link. A credential smuggled as
+* `?password=` is the same leak as userinfo, in a form the userinfo check
+* cannot see: it survives copy-paste, referrer headers and proxy logs
+* identically.
+*/
+var CREDENTIAL_QUERY_KEYS = [
+	"password",
+	"passwd",
+	"pwd",
+	"pass",
+	"user",
+	"username",
+	"usr",
+	"login",
+	"token",
+	"access_token",
+	"auth",
+	"authorization",
+	"apikey",
+	"api_key",
+	"secret",
+	"credential",
+	"credentials",
+	"session",
+	"sessionid",
+	"key"
+];
+/**
+* The same userinfo shape `scripts/check-no-credential-urls-in-fixtures.ts`
+* scans recorded fixtures for, applied to what we are about to EMIT. Kept
+* structurally identical on purpose: a URL this function returns is a URL that
+* guard would pass.
+*/
+var CREDENTIAL_URL = /[a-z][a-z0-9+.-]*:\/\/[^/\s:@'"]+:[^/\s:@'"]+@/i;
+/** A host that is safe to place in an authority component verbatim. */
+var PLAIN_HOST = /^[a-zA-Z0-9._-]+$/;
+/** A bracketed IPv6 literal, the only other authority form we emit. */
+var IPV6_HOST = /^\[[0-9a-fA-F:.]+\]$/;
+function defaultPortFor(scheme) {
+	return scheme === "https" ? 443 : 80;
+}
+/**
+* Build the admin-page URL, or refuse by name.
+*
+* The refusal is never thrown: a provider answering "no page for this device"
+* is an ordinary answer (`getAdminLink` → `null`), and a throw here would turn
+* a missing host on one device into a failed query for the whole surface.
+*/
+function buildDeviceAdminUrl(parts) {
+	const host = parts.host.trim();
+	if (host.length === 0) return {
+		ok: false,
+		reason: "empty-host"
+	};
+	if (host.includes("@")) return {
+		ok: false,
+		reason: "host-carries-userinfo"
+	};
+	if (!PLAIN_HOST.test(host) && !IPV6_HOST.test(host)) return {
+		ok: false,
+		reason: "host-not-plain"
+	};
+	if (parts.port !== null) {
+		if (!Number.isInteger(parts.port) || parts.port < 1 || parts.port > 65535) return {
+			ok: false,
+			reason: "port-out-of-range"
+		};
+	}
+	if (!parts.path.startsWith("/")) return {
+		ok: false,
+		reason: "path-not-absolute"
+	};
+	const query = parts.query ?? {};
+	for (const key of Object.keys(query)) if (CREDENTIAL_QUERY_KEYS.includes(key.toLowerCase())) return {
+		ok: false,
+		reason: "credential-query-key"
+	};
+	const authority = parts.port === null || parts.port === defaultPortFor(parts.scheme) ? host : `${host}:${String(parts.port)}`;
+	const search = new URLSearchParams();
+	for (const [key, value] of Object.entries(query)) search.append(key, value);
+	const suffix = search.size > 0 ? `?${search.toString()}` : "";
+	const url = `${parts.scheme}://${authority}${parts.path}${suffix}`;
+	if (CREDENTIAL_URL.test(url)) return {
+		ok: false,
+		reason: "userinfo-in-result"
+	};
+	return {
+		ok: true,
+		url
+	};
+}
+/**
 * `device-export` — collection cap for addons that export camstack
 * devices to external ecosystems (HomeAssistant via MQTT discovery,
 * HomeKit/HAP, Alexa Smart Home, …).
@@ -25151,6 +25355,39 @@ _enum([
 _enum(["deferred", "final"]);
 /** The camera's / provider's own words. Kept verbatim, never parsed. */
 var CLIP_STILL_REASON_HEADER = "x-camstack-reason";
+/**
+* Make a refusal sentence safe to put in an HTTP header.
+*
+* **An HTTP header value is Latin-1.** Node throws `Invalid character in
+* header content` on anything above U+00FF, the handler dies mid-response,
+* and the client gets a socket hang up — no status, no reason, nothing. The
+* mechanism that exists to EXPLAIN a refusal is then the thing that silences
+* it, and the surface shows "nothing happened".
+*
+* That is not hypothetical: measured 2026-09-23 on 1436, a Hikvision replay
+* refusal read `SETUP of the video track answered 500 — the camera refused
+* this replay`, and the EM DASH in it threw on every clip the operator
+* opened. This repository writes its refusals in prose, and its prose uses
+* `—`, `’` and `…` everywhere, so every reason string is a candidate.
+*
+* Substitutes rather than strips: an operator reading a log or a response
+* should get a readable sentence, not one with holes in it. The typographic
+* characters this repo actually writes have exact ASCII equivalents; anything
+* else non-Latin-1 becomes `?`, which is visible rather than silent. Control
+* characters go too — a newline in a header value is a response-splitting
+* bug, not a formatting one.
+*/
+function clipReasonHeaderValue(reason) {
+	const folded = reason.replace(/[\u2013\u2014\u2212]/g, "-").replace(/[\u2018\u2019\u201b]/g, "'").replace(/[\u201c\u201d]/g, "\"").replace(/\u2026/g, "...").replace(/[\u00a0\u2007\u202f]/g, " ");
+	let out = "";
+	for (const ch of folded) {
+		const code = ch.codePointAt(0) ?? 0;
+		if (code < 32 || code === 127) out += " ";
+		else if (code > 255) out += "?";
+		else out += ch;
+	}
+	return out.slice(0, 500).trim();
+}
 /** One {@link ClipStillRefusalCodeSchema} token, alone. */
 var CLIP_STILL_REASON_CODE_HEADER = "x-camstack-reason-code";
 /** One {@link ClipStillDispositionSchema} token, alone. */
@@ -27977,6 +28214,511 @@ var dayNightCapability = {
 	volatileStateFields: ["lastFetchedAt"]
 };
 /**
+* Vendor-neutral **onboard** recording + storage cap — what the CAMERA
+* writes to the CAMERA's own card, on the camera's own schedule.
+*
+* This is NOT `recording.cap.ts`. That one is CamStack's recorder: our
+* footage ledger, our storage locations, our retention. This one has a
+* different authority — the camera's firmware — and per D62 it stores
+* nothing of its own. Every value here is read from the camera and every
+* write goes back to the camera; there is no CamStack-side mirror that
+* could disagree with the device.
+*
+* ## One shape, two firmwares
+*
+* Measured 2026-09-22 against the live fleet:
+*
+* | fact | Hikvision (ISAPI) | Reolink (Baichuan) |
+* | --- | --- | --- |
+* | storage | `ContentMgmt/Storage` `<hdd>` rows: status, capacity, freeSpace (MB) | `getHddInfoList` (cmd 102): `mount`, `format`, `capacity` GB + `capacityM` MB remainder |
+* | tracks | several (101 **and** 103 on both 1436 and 3833), each with its own schedule | one per channel |
+* | schedule | per track, 7 `ScheduleAction` blocks: DayOfWeek + TimeOfDay range + ONE `ActionRecordingMode` | per trigger type, a 168-char weekly HOUR mask |
+* | triggers | `CMR`, `MOTION` | `Normal`, `MD`, `people`, `vehicle`, `dog_cat`, `crossline`, `intrude`, `loitering` |
+* | pre-record | `PreRecordTimeSeconds` | `preRecordTime` |
+* | post-record | `PostRecordTimeSeconds` | `recordDelayTime` |
+* | overwrite | per track `LoopEnable` | `cycle`, with `cycleList` enumerating the accepted values |
+* | segment length | not exposed on V5.7.1 | `packageTime` (minutes) |
+*
+* The two schedule models look different and are the same thing in
+* different coordinates: both answer "for this trigger, during which
+* weekly windows does the camera record". {@link RecordWindow} is that
+* question in one shape — Hikvision's ranges map straight onto it,
+* Reolink's mask expands into hour-aligned windows.
+*
+* ## Union, not intersection
+*
+* **The same fields exist on every camera.** What differs per device is
+* which VALUES that device accepts, and that is what {@link
+* RecordingOnboardOptions} reports — a `{ readable, writable, reason }`
+* per field plus the schedule's own limits. A control a camera cannot
+* honour is rendered DISABLED WITH ITS REASON, never missing and never
+* dead: disabled must not look like broken.
+*
+* ## Refusal by name
+*
+* A write a camera cannot honour is refused with a sentence the operator
+* can read — never accepted and dropped. Both providers refuse through
+* {@link describeOnboardRefusal}, so the vocabulary is one function and
+* one test, not two hand-written vendor opinions.
+*
+* Follows the D14 `deviceConfig` archetype (see `stream-params.cap.ts`):
+* `getOptions` advertises per-camera availability, `getStatus` (auto-
+* injected from `status`) reports the live values, and a single
+* `setSettings` mutation applies a partial change. No hand-written
+* settings-contribution methods.
+*/
+/**
+* What makes the camera start recording during a window.
+*
+* The union of both vendors' vocabularies. `continuous` is Hikvision's
+* `CMR` and Reolink's `Normal`; `motion` is `MOTION` / `MD`. The
+* object-class triggers are Reolink-only today and the smart-event ones
+* (`lineCrossing`, `intrusion`, `loitering`) are Reolink-only on the
+* firmwares measured — a camera that cannot record on a trigger simply
+* does not list it in `options.schedule.triggers`, and a window naming
+* it is REFUSED, not dropped.
+*/
+var RecordTriggerSchema = _enum([
+	"continuous",
+	"motion",
+	"person",
+	"vehicle",
+	"animal",
+	"lineCrossing",
+	"intrusion",
+	"loitering",
+	"alarmInput"
+]);
+/**
+* One weekly recording window: "on `day`, from `startMinute` to
+* `endMinute`, record on `trigger`".
+*
+* `day` is 0 = Monday … 6 = Sunday (ISO order, which is also the order
+* both firmwares enumerate). Minutes are local camera time since
+* midnight; `endMinute` may be 1440, meaning end of day — that is
+* Hikvision's literal `24:00` and Reolink's 24th mask slot, and
+* collapsing it to 0 would turn a whole-day window into an empty one.
+*/
+var RecordWindowSchema = object({
+	trigger: RecordTriggerSchema,
+	day: number().int().min(0).max(6),
+	startMinute: number().int().min(0).max(1439),
+	endMinute: number().int().min(1).max(1440)
+});
+/** Status of one physical volume, as the camera itself describes it. */
+var OnboardStorageVolumeSchema = object({
+	/** The camera's own id for the volume (`hdd/id`, Reolink `HddInfo/number`). */
+	id: string(),
+	/** The camera's own name for it, when it gives one (`hddName`). */
+	label: string().optional(),
+	status: _enum([
+		"ok",
+		"unformatted",
+		"error",
+		"offline",
+		"unknown"
+	]),
+	/**
+	* Total size in MB, or **null when the camera did not say**.
+	*
+	* Never 0 for an unreadable value: a measurement that failed is not a
+	* measurement (D393), and a card whose size is unknown must not be
+	* rendered as a card of size zero.
+	*/
+	capacityMb: number().nullable(),
+	/**
+	* Free space in MB, or null when unknown.
+	*
+	* **Not a proxy for "has footage".** Measured 2026-09-22: 1436 and
+	* 1439 both report exactly 11776 MB free — the fixed reserve a looping
+	* card converges on once it has wrapped. At loop steady state the
+	* number is identical whether the camera recorded yesterday or stopped
+	* a month ago.
+	*/
+	freeMb: number().nullable(),
+	/** True when the camera reports the volume writable (`property` RW). */
+	writable: boolean().optional()
+});
+/**
+* What the camera is doing with its own storage, right now.
+*
+* Every scalar is nullable and **null means the camera did not answer**,
+* never a default. A form that seeds `0` from an unanswered read invites
+* the operator to save that 0 back onto the camera.
+*/
+var RecordingOnboardStatusSchema = object({
+	storage: discriminatedUnion("kind", [
+		object({
+			kind: literal("present"),
+			volumes: array(OnboardStorageVolumeSchema)
+		}),
+		object({
+			kind: literal("absent"),
+			reason: string()
+		}),
+		object({
+			kind: literal("unknown"),
+			reason: string()
+		})
+	]),
+	tracks: array(object({
+		id: string(),
+		enabled: boolean(),
+		isVideo: boolean(),
+		/** From the camera's own track description. Null when it does not say. */
+		codec: string().nullable(),
+		resolution: string().nullable(),
+		/** Per-track overwrite flag, where the firmware keeps it per track. */
+		overwriteWhenFull: boolean().nullable()
+	})),
+	/**
+	* The track the write path targets — the enabled VIDEO one. Null when
+	* no track could be identified, which is itself a refusal reason.
+	*/
+	primaryTrackId: string().nullable(),
+	/** Master "record to the card at all" switch. */
+	enabled: boolean().nullable(),
+	overwriteWhenFull: boolean().nullable(),
+	preRecordSec: number().nullable(),
+	postRecordSec: number().nullable(),
+	/** Length of one recorded file, in minutes. */
+	segmentMinutes: number().nullable(),
+	/** The primary track's weekly windows, flattened. */
+	windows: array(RecordWindowSchema),
+	/**
+	* How many windows the camera described that CamStack could NOT read —
+	* an unrecognised trigger, an unparseable clock, a weekday it does not
+	* name.
+	*
+	* A dropped window is work the reader threw away, and a schedule that
+	* silently shows fewer rows than the camera holds is how an operator
+	* saves back a schedule shorter than the one they were looking at
+	* (D391). Non-zero means the window list is INCOMPLETE and a write
+	* that replaces it would delete what was not shown — which is why a
+	* provider reporting a non-zero count also reports the schedule as not
+	* writable.
+	*/
+	unreadableWindows: number(),
+	/**
+	* The camera is scheduled to record and has NO usable storage.
+	*
+	* A first-class fact because it is the fleet's most common silent
+	* defect: measured 2026-09-22, 1441 and 3831 are both motion-recording
+	* to a card that is not there. Neither the schedule nor the storage
+	* read says anything wrong on its own; only the pair does.
+	*/
+	recordingToNowhere: boolean(),
+	lastFetchedAt: number()
+});
+/** Numeric range descriptor — `{ min, max, step }` per the getOptions convention. */
+var RangeSchema = object({
+	min: number(),
+	max: number(),
+	step: number()
+});
+/**
+* The values a camera actually takes for a numeric field, when they are a SET
+* rather than a range.
+*
+* `{min,max,step}` cannot say what these two firmwares do. Measured on 1436
+* (I91DN) on 2026-09-22 by writing each value and reading it back:
+*
+* - pre-record: `0, 5, 10, 15, 20, 25, 30` and `2147483647` (INT32_MAX, the
+*   camera's "no limit" — `-1` and `4294967295` both land on it);
+* - post-record: `5, 10, 30, 60, 120, 300, 600`.
+*
+* Neither is expressible as a step: the first has a sentinel two billion away
+* from its neighbours, the second doubles and then jumps. A range that tried
+* would forbid values the camera takes AND permit values it silently replaces
+* with 5 — wrong in both directions at once.
+*
+* `sentinel` names the member that is not a duration, so a surface can render
+* "no limit" instead of `2147483647` seconds.
+*/
+var AllowedValuesSchema = object({
+	values: array(number()).min(1),
+	sentinel: object({
+		value: number(),
+		meaning: _enum(["no-limit", "disabled"])
+	}).optional()
+});
+/**
+* Per-field availability on ONE camera.
+*
+* The field exists on every camera — this says whether this one can be
+* read and whether it can be written, and `reason` says why not when
+* either is false. The UI renders the control DISABLED with the reason
+* rather than hiding it, so a limitation is legible instead of looking
+* like a missing feature.
+*/
+var OnboardFieldSupportSchema = object({
+	readable: boolean(),
+	writable: boolean(),
+	/** Required whenever `readable` or `writable` is false. */
+	reason: string().optional()
+});
+/** What this camera's schedule model can express. */
+var OnboardScheduleSupportSchema = object({
+	support: OnboardFieldSupportSchema,
+	/**
+	* The smallest time step the camera can express, in minutes.
+	*
+	* Hikvision takes arbitrary minutes (`00:05:00`–`23:57:00` observed on
+	* 1436's track 103). Reolink's schedule is a 7×24 HOUR mask, so 60. A
+	* window whose edges are not a multiple of this is REFUSED rather than
+	* quietly rounded — rounding is how an operator's 06:30 becomes 06:00
+	* and nothing says so.
+	*/
+	granularityMinutes: number(),
+	/** Triggers this camera can record on. A window naming another is refused. */
+	triggers: array(RecordTriggerSchema),
+	/**
+	* False when the camera stores ONE trigger per time range, so two
+	* windows overlapping on the same day cannot carry different triggers.
+	* True on Reolink, whose mask is per-trigger and independent.
+	*/
+	supportsOverlappingTriggers: boolean()
+});
+var RecordingOnboardOptionsSchema = object({
+	enabled: OnboardFieldSupportSchema,
+	overwriteWhenFull: OnboardFieldSupportSchema,
+	preRecordSec: OnboardFieldSupportSchema,
+	preRecordSecRange: RangeSchema.optional(),
+	/** Preferred over the range when the camera takes a SET, not a span. */
+	preRecordSecAllowed: AllowedValuesSchema.optional(),
+	postRecordSec: OnboardFieldSupportSchema,
+	postRecordSecRange: RangeSchema.optional(),
+	/** Preferred over the range when the camera takes a SET, not a span. */
+	postRecordSecAllowed: AllowedValuesSchema.optional(),
+	segmentMinutes: OnboardFieldSupportSchema,
+	segmentMinutesRange: RangeSchema.optional(),
+	/** Preferred over the range when the camera takes a SET, not a span. */
+	segmentMinutesAllowed: AllowedValuesSchema.optional(),
+	schedule: OnboardScheduleSupportSchema
+});
+/**
+* A partial change. Every field optional.
+*
+* Unlike the other `deviceConfig` caps, a provider here does **NOT**
+* silently ignore a field it cannot support — it refuses, by name,
+* through {@link describeOnboardRefusal}. Silence on a recording setting
+* is the failure D62 exists to prevent: the operator believes the camera
+* is recording the way the form says, and it is not.
+*/
+var RecordingOnboardPatchSchema = object({
+	enabled: boolean().optional(),
+	overwriteWhenFull: boolean().optional(),
+	preRecordSec: number().optional(),
+	postRecordSec: number().optional(),
+	segmentMinutes: number().optional(),
+	/** The complete new window set for the primary track — not a delta. */
+	windows: array(RecordWindowSchema).optional()
+});
+var recordingOnboardCapability = {
+	name: "recording-onboard",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	deviceConfig: { ui: {
+		kind: "derived-form",
+		builderId: "recording-onboard",
+		tab: "recording"
+	} },
+	methods: {
+		getOptions: method(object({ deviceId: number() }), RecordingOnboardOptionsSchema),
+		setSettings: method(object({
+			deviceId: number(),
+			settings: RecordingOnboardPatchSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: RecordingOnboardStatusSchema,
+		kind: "poll"
+	},
+	runtimeState: RecordingOnboardStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-set camera-side
+	* recording config; mutation-driven, and the storage half is the last
+	* thing the camera said about its own card.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
+};
+/**
+* Day-of-week names in the cap's index order (0 = Monday), for messages
+* an operator reads and for Hikvision's `<DayOfWeek>` element.
+*/
+var DAY_NAMES = [
+	"Monday",
+	"Tuesday",
+	"Wednesday",
+	"Thursday",
+	"Friday",
+	"Saturday",
+	"Sunday"
+];
+/**
+* Does `patch` ask this camera for something it cannot do?
+*
+* Returns the operator-readable reason, or `null` when every field in
+* the patch is within what `options` says this camera accepts. A
+* provider calls this BEFORE touching the camera and throws the string:
+* refusing is the point, and refusing identically on both vendors is why
+* this is one function.
+*
+* The order of checks is the order an operator would read them: the
+* scalar knobs first, then the schedule, because a schedule complaint is
+* longer and a scalar one is usually the real problem.
+*/
+function describeOnboardRefusal(options, patch) {
+	if (patch.enabled !== void 0 && !options.enabled.writable) return unwritable("the master recording switch", options.enabled.reason);
+	if (patch.overwriteWhenFull !== void 0 && !options.overwriteWhenFull.writable) return unwritable("overwrite-when-full", options.overwriteWhenFull.reason);
+	const preRefusal = refuseNumeric("pre-record seconds", patch.preRecordSec, options.preRecordSec, options.preRecordSecRange, options.preRecordSecAllowed);
+	if (preRefusal) return preRefusal;
+	const postRefusal = refuseNumeric("post-record seconds", patch.postRecordSec, options.postRecordSec, options.postRecordSecRange, options.postRecordSecAllowed);
+	if (postRefusal) return postRefusal;
+	const segmentRefusal = refuseNumeric("segment length (minutes)", patch.segmentMinutes, options.segmentMinutes, options.segmentMinutesRange, options.segmentMinutesAllowed);
+	if (segmentRefusal) return segmentRefusal;
+	if (patch.windows !== void 0) {
+		const scheduleRefusal = refuseSchedule(options, patch.windows);
+		if (scheduleRefusal) return scheduleRefusal;
+	}
+	return null;
+}
+function unwritable(what, reason) {
+	return reason ? `this camera cannot change ${what}: ${reason}` : `this camera cannot change ${what}`;
+}
+function refuseNumeric(what, value, support, range, allowed) {
+	if (value === void 0) return null;
+	if (!support.writable) return unwritable(what, support.reason);
+	if (!Number.isFinite(value)) return `${what} must be a number, got ${String(value)}`;
+	if (allowed) {
+		if (allowed.values.includes(value)) return null;
+		const say = (v) => allowed.sentinel !== void 0 && v === allowed.sentinel.value ? allowed.sentinel.meaning === "no-limit" ? "no limit" : "off" : String(v);
+		return `this camera accepts ${what} only as ${allowed.values.map(say).join(", ")}; ${say(value)} is not one of them`;
+	}
+	if (!range) return null;
+	if (value < range.min || value > range.max) return `this camera accepts ${what} between ${String(range.min)} and ${String(range.max)}; ${String(value)} is outside that`;
+	if (range.step > 0 && (value - range.min) % range.step !== 0) return `this camera accepts ${what} in steps of ${String(range.step)} from ${String(range.min)}; ${String(value)} is not one of them`;
+	return null;
+}
+function refuseSchedule(options, windows) {
+	const schedule = options.schedule;
+	if (!schedule.support.writable) return unwritable("the recording schedule", schedule.support.reason);
+	const allowed = new Set(schedule.triggers);
+	for (const window of windows) {
+		if (!allowed.has(window.trigger)) {
+			const offer = schedule.triggers.length > 0 ? schedule.triggers.join(", ") : "none";
+			return `this camera cannot record on "${window.trigger}"; it records on: ${offer}`;
+		}
+		if (window.endMinute <= window.startMinute) return `a window on ${dayName(window.day)} ends at or before it starts (${String(window.startMinute)} → ${String(window.endMinute)})`;
+		const step = schedule.granularityMinutes;
+		if (step > 1 && (window.startMinute % step !== 0 || window.endMinute % step !== 0)) return `this camera's schedule only moves in ${String(step)}-minute steps; the ${dayName(window.day)} window ${formatMinutes(window.startMinute)}–${formatMinutes(window.endMinute)} is not aligned to them`;
+	}
+	if (!schedule.supportsOverlappingTriggers) {
+		const clash = findOverlapWithDifferentTrigger(windows);
+		if (clash) return `this camera stores one trigger per time range, so "${clash.a.trigger}" and "${clash.b.trigger}" cannot both cover ${dayName(clash.a.day)} ${formatMinutes(Math.max(clash.a.startMinute, clash.b.startMinute))}–${formatMinutes(Math.min(clash.a.endMinute, clash.b.endMinute))}`;
+	}
+	return null;
+}
+function findOverlapWithDifferentTrigger(windows) {
+	for (let i = 0; i < windows.length; i += 1) for (let j = i + 1; j < windows.length; j += 1) {
+		const a = windows[i];
+		const b = windows[j];
+		if (!a || !b) continue;
+		if (a.day !== b.day) continue;
+		if (a.trigger === b.trigger) continue;
+		if (a.startMinute < b.endMinute && b.startMinute < a.endMinute) return {
+			a,
+			b
+		};
+	}
+	return null;
+}
+function dayName(day) {
+	return DAY_NAMES[day] ?? `day ${String(day)}`;
+}
+/** `510` → `08:30`. For messages, not for the wire. */
+function formatMinutes(minute) {
+	const hour = Math.floor(minute / 60);
+	const rest = minute % 60;
+	return `${String(hour).padStart(2, "0")}:${String(rest).padStart(2, "0")}`;
+}
+/**
+* Index of the mask character covering `day` at `hour`.
+*
+* **Layout: day-major, Monday first** — `day * 24 + hour`.
+*
+* This is an ASSUMPTION, and it is recorded as one because the fleet
+* cannot currently confirm it: every `valueTable` on every Reolink
+* measured on 2026-09-22 is uniform (all `1` or all `0`), and a uniform
+* mask reads identically under either layout. To settle it, set a single
+* hour on one day from the Reolink app and re-read `getRecordSchedule`.
+* Until then, a NON-uniform mask is reported as windows under this
+* layout and the day labels may be transposed; a uniform one is exact.
+*/
+function weeklyMaskIndex(day, hour) {
+	return day * 24 + hour;
+}
+/**
+* Expand one trigger's weekly hour mask into windows, merging adjacent
+* set hours into one window per run so a full day is ONE window rather
+* than twenty-four.
+*
+* A mask of the wrong length yields no windows: a truncated table is not
+* a schedule of fewer days, it is an answer we did not understand.
+*/
+function weeklyMaskToWindows(mask, trigger) {
+	if (mask.length !== 168) return [];
+	const out = [];
+	for (let day = 0; day < 7; day += 1) {
+		let runStart = null;
+		for (let hour = 0; hour <= 24; hour += 1) {
+			const set = hour < 24 && mask[weeklyMaskIndex(day, hour)] === "1";
+			if (set && runStart === null) runStart = hour;
+			else if (!set && runStart !== null) {
+				out.push({
+					trigger,
+					day,
+					startMinute: runStart * 60,
+					endMinute: hour * 60
+				});
+				runStart = null;
+			}
+		}
+	}
+	return out;
+}
+/**
+* Collapse this trigger's windows back into a weekly hour mask.
+*
+* Windows for other triggers are ignored — the mask is per trigger. A
+* window that is not hour-aligned is REFUSED upstream by
+* {@link describeOnboardRefusal}; this function rounds nothing, it
+* simply sets every hour the window fully or partly covers, so a caller
+* that skipped the refusal cannot silently lose coverage.
+*/
+function windowsToWeeklyMask(windows, trigger) {
+	const slots = new Array(168).fill("0");
+	for (const window of windows) {
+		if (window.trigger !== trigger) continue;
+		if (window.day < 0 || window.day >= 7) continue;
+		const firstHour = Math.floor(window.startMinute / 60);
+		const lastHour = Math.ceil(window.endMinute / 60);
+		for (let hour = firstHour; hour < lastHour && hour < 24; hour += 1) slots[weeklyMaskIndex(window.day, hour)] = "1";
+	}
+	return slots.join("");
+}
+/**
 * Generic device-level status snapshot. Auto-registered by `BaseDevice`
 * for every device, regardless of provider — the kernel needs a uniform
 * cap-keyed slice for the basic device flags every consumer expects to
@@ -36979,6 +37721,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	pressureSensor: pressureSensorCapability,
 	privacyMask: privacyMaskCapability,
 	ptzAutotrack: ptzAutotrackCapability,
+	recordingOnboard: recordingOnboardCapability,
 	recordingSignal: recordingSignalCapability,
 	sceneMonitor: sceneMonitorCapability,
 	scriptRunner: scriptRunnerCapability,
@@ -40929,6 +41672,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceAdminLink.getAdminLink": {
+		capName: "device-admin-link",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"deviceAdoption.adopt": {
 		capName: "device-adoption",
 		capScope: "system",
@@ -44967,6 +45716,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recordingOnboard.getOptions": {
+		capName: "recording-onboard",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"recordingOnboard.getStatus": {
+		capName: "recording-onboard",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"recordingOnboard.setSettings": {
+		capName: "recording-onboard",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"recordingSignal.getStatus": {
 		capName: "recording-signal",
 		capScope: "device",
@@ -46853,6 +47620,11 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"deviceAdminLink.getAdminLink": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceAdoption.release": [{
 		name: "camDeviceId",
 		form: "single",
@@ -48238,6 +49010,16 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"recordingOnboard.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recordingOnboard.setSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"recordingSignal.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -71797,7 +72579,7 @@ var require_yazl = /* @__PURE__ */ __commonJSMin(((exports) => {
 	}
 }));
 //#endregion
-//#region node_modules/@apocaliss92/nodelink-js/dist/chunk-UIQ527B6.js
+//#region node_modules/@apocaliss92/nodelink-js/dist/chunk-E2N7WTCC.js
 var import_undici = require_undici();
 var import_yazl = /* @__PURE__ */ __toESM(require_yazl(), 1);
 var formatterCache = /* @__PURE__ */ new Map();
@@ -78283,7 +79065,7 @@ var require_lz4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	};
 }));
 //#endregion
-//#region node_modules/@apocaliss92/nodelink-js/dist/chunk-GNC5U3YA.js
+//#region node_modules/@apocaliss92/nodelink-js/dist/chunk-IPKY5AWA.js
 var import_fxp = require_fxp();
 var import_lz4 = /* @__PURE__ */ __toESM(require_lz4(), 1);
 function encodeHeader(h) {
@@ -80315,6 +81097,17 @@ var BaichuanClient = class _BaichuanClient extends EventEmitter {
 	* Impact: Snapshots are ~0–50ms slower per camera (negligible for users).
 	*/
 	snapshotQueueTail = Promise.resolve();
+	/**
+	* Live cmd 5 replay transfers on this socket.
+	*
+	* Opening a replay SUPERSEDES every earlier one: nothing on the wire ends a
+	* cmd 5 transfer, so an abandoned one keeps delivering (measured: 8 126
+	* further frames over 3 475 ms after the consumer let go) and its successor
+	* used to adopt them. A superseded session now refuses every frame and
+	* counts it.
+	*/
+	replaySessions = /* @__PURE__ */ new Set();
+	replaySessionSeq = 0;
 	opts;
 	debugCfg;
 	logger;
@@ -81772,6 +82565,85 @@ var BaichuanClient = class _BaichuanClient extends EventEmitter {
 		this.alarmEventState.set(fallbackChannel, curr);
 		return out;
 	}
+	/**
+	* Register a cmd 5 replay transfer and supersede every earlier one on this
+	* socket.
+	*/
+	openReplaySession(discriminator) {
+		for (const prev of this.replaySessions) {
+			if (prev.superseded) continue;
+			prev.superseded = true;
+			this.logger?.warn?.(`[BaichuanClient] cmd 5 replay session #${prev.id} (channelId=${prev.discriminator.channelId}, ${prev.discriminator.kind}) superseded by #${this.replaySessionSeq + 1} after ${prev.acceptedFrames} accepted frame(s). Frames still in flight for #${prev.id} will be dropped, not handed to its successor.`);
+		}
+		const session = {
+			id: ++this.replaySessionSeq,
+			discriminator,
+			superseded: false,
+			acceptedFrames: 0,
+			droppedFrames: 0,
+			droppedChannelIds: /* @__PURE__ */ new Set(),
+			reportedDrop: false
+		};
+		this.replaySessions.add(session);
+		return session;
+	}
+	closeReplaySession(session) {
+		this.replaySessions.delete(session);
+		if (session.droppedFrames > 0) this.logger?.debug?.(`[BaichuanClient] cmd 5 replay session #${session.id} (channelId=${session.discriminator.channelId}) ended: ${session.acceptedFrames} frame(s) accepted, ${session.droppedFrames} dropped from channelId ${[...session.droppedChannelIds].join(",")}.`);
+	}
+	/**
+	* Count a cmd 5 frame this transfer refused, and say so the first time.
+	*
+	* Silence here is what made the original defect invisible: the successor
+	* transfer simply returned a few extra access units and a short duration,
+	* with nothing anywhere saying a frame had changed hands.
+	*/
+	countReplayDrop(session, frame, reason) {
+		session.droppedFrames++;
+		session.droppedChannelIds.add(frame.header.channelId);
+		if (!session.reportedDrop) {
+			session.reportedDrop = true;
+			this.logger?.warn?.(`[BaichuanClient] cmd 5 replay session #${session.id} dropping frames (${reason}): frame channelId=${frame.header.channelId} streamType=${frame.header.streamType} msgNum=${frame.header.msgNum} vs session channelId=${session.discriminator.channelId} (${session.discriminator.kind}). Further drops for this session are counted, not logged.`);
+		}
+	}
+	/**
+	* Wait until the socket has gone quiet of cmd 5 frames.
+	*
+	* A cmd 7 stop is acknowledged `rc=200` before the camera has finished
+	* sending: four of eleven stopped sessions in the Reolink app's own capture
+	* were still delivering when the ack came back (26–91 further frames). A
+	* caller that opens the next replay the instant the ack lands is racing that
+	* tail; this is how it waits for it instead.
+	*
+	* @returns how many cmd 5 frames arrived during the drain.
+	*/
+	async drainReplayFrames(options) {
+		const quietMs = options?.quietMs ?? 300;
+		const maxMs = options?.maxMs ?? 4e3;
+		let drained = 0;
+		await new Promise((resolve) => {
+			let quiet;
+			const hard = setTimeout(() => settle(), maxMs);
+			const onFrame = (frame) => {
+				if (frame.header.cmdId !== 5) return;
+				drained++;
+				if (quiet) clearTimeout(quiet);
+				quiet = setTimeout(() => settle(), quietMs);
+			};
+			let settled = false;
+			const settle = () => {
+				if (settled) return;
+				settled = true;
+				clearTimeout(hard);
+				if (quiet) clearTimeout(quiet);
+				this.off("frame", onFrame);
+				resolve();
+			};
+			this.on("frame", onFrame);
+			quiet = setTimeout(() => settle(), quietMs);
+		});
+		return drained;
+	}
 	nextMsgNum() {
 		this.msgNum = this.msgNum + 1 & 65535;
 		return this.msgNum;
@@ -82325,6 +83197,13 @@ var BaichuanClient = class _BaichuanClient extends EventEmitter {
 		params.channel ?? this.opts.channel;
 		const sessionCounter = this.nextMsgNum();
 		const channelId = params.channelIdOverride ?? sessionCounter;
+		const discriminator = params.channelIdOverride == null ? {
+			kind: "minted",
+			channelId
+		} : {
+			kind: "pinned",
+			channelId
+		};
 		const msgNum = params.msgNumOverride ?? 0;
 		const cmdId = params.cmdId;
 		const extXml = params.extensionXml ?? "";
@@ -82350,9 +83229,10 @@ var BaichuanClient = class _BaichuanClient extends EventEmitter {
 		const idleTimeoutMs = params.idleTimeoutMs ?? 2e3;
 		const chunks = [];
 		let streamMsgNum;
-		let lockedChannelId;
+		let lockedChannelId = discriminator.kind === "minted" ? discriminator.channelId : void 0;
 		let lockedStreamType;
 		let idleTimer;
+		const session = this.openReplaySession(discriminator);
 		const looksLikeXml = (buf) => {
 			let i = 0;
 			while (i < buf.length && (buf[i] === 0 || buf[i] === 9 || buf[i] === 10 || buf[i] === 13 || buf[i] === 32)) i++;
@@ -82402,6 +83282,7 @@ var BaichuanClient = class _BaichuanClient extends EventEmitter {
 				this.off("frame", onFrame);
 				if (timeout) clearTimeout(timeout);
 				if (idleTimer) clearTimeout(idleTimer);
+				this.closeReplaySession(session);
 			};
 			const finish = (buf) => {
 				if (done) return;
@@ -82423,8 +83304,15 @@ var BaichuanClient = class _BaichuanClient extends EventEmitter {
 			};
 			const onFrame = (frame) => {
 				if (frame.header.cmdId !== cmdId) return;
+				if (session.superseded) {
+					this.countReplayDrop(session, frame, "superseded");
+					return;
+				}
 				if (lockedStreamType !== void 0 && frame.header.streamType !== lockedStreamType) return;
-				if (lockedChannelId !== void 0 && frame.header.channelId !== lockedChannelId) return;
+				if (lockedChannelId !== void 0 && frame.header.channelId !== lockedChannelId) {
+					this.countReplayDrop(session, frame, "foreign-channel");
+					return;
+				}
 				if (streamMsgNum !== void 0 && frame.header.msgNum !== streamMsgNum) return;
 				const rc = frame.header.responseCode;
 				if (rc >= 400 && rc < 6e4 && frame.header.msgNum === msgNum) {
@@ -82448,6 +83336,7 @@ var BaichuanClient = class _BaichuanClient extends EventEmitter {
 						lockedChannelId = frame.header.channelId;
 						lockedStreamType = frame.header.streamType;
 					}
+					session.acceptedFrames++;
 					params.onChunk?.(decrypted);
 					chunks.push(decrypted);
 					armIdleFinish();
@@ -82461,7 +83350,8 @@ var BaichuanClient = class _BaichuanClient extends EventEmitter {
 					finish(Buffer.concat(chunks));
 					return;
 				}
-				fail(/* @__PURE__ */ new Error(`Baichuan timeout waiting FileInfoList replay binary chunks cmdId=${cmdId} channelId=${channelId} streamType=${expectedStreamType}`));
+				const seen = session.droppedFrames > 0 ? ` (rejected ${session.droppedFrames} cmd ${cmdId} frame(s) on channelId ${[...session.droppedChannelIds].join(",")})` : "";
+				fail(/* @__PURE__ */ new Error(`Baichuan timeout waiting FileInfoList replay binary chunks cmdId=${cmdId} channelId=${channelId} streamType=${expectedStreamType}${seen}`));
 			}, timeoutMs);
 			this.on("frame", onFrame);
 			try {
@@ -85897,6 +86787,433 @@ var MpegTsMuxer = class {
 		this.tablesSent = false;
 	}
 };
+var buildDetectionClasses = (parsed, recordType) => {
+	const classes = [];
+	const flags = parsed?.flags;
+	if (flags) {
+		if (flags.aiPerson) classes.push("person");
+		if (flags.aiVehicle) classes.push("vehicle");
+		if (flags.aiAnimal) classes.push("animal");
+		if (flags.aiFace) classes.push("face");
+		if (flags.motion) classes.push("motion");
+		if (flags.schedule) classes.push("schedule");
+		if (flags.doorbell) classes.push("doorbell");
+		if (flags.package) classes.push("package");
+		if (flags.rf) classes.push("rf");
+		if (flags.aiOther) classes.push("other");
+	}
+	if (classes.length === 0 && recordType) {
+		const rt = recordType.toLowerCase();
+		if (rt.includes("people") || rt.includes("person")) classes.push("person");
+		if (rt.includes("vehicle")) classes.push("vehicle");
+		if (rt.includes("dog_cat") || rt.includes("animal")) classes.push("animal");
+		if (rt.includes("face")) classes.push("face");
+		if (rt.includes("md") || rt.includes("motion")) classes.push("motion");
+		if (rt.includes("sched")) classes.push("schedule");
+		if (rt.includes("visitor") || rt.includes("doorbell")) classes.push("doorbell");
+		if (rt.includes("package")) classes.push("package");
+		if (rt.includes("rf")) classes.push("rf");
+	}
+	if (classes.length === 0) classes.push("motion");
+	return classes;
+};
+var getXmlTexts = (xml, tags) => {
+	const out = {};
+	for (const tag2 of tags) {
+		const v = getXmlText(xml, tag2);
+		if (v !== void 0) out[tag2] = v;
+	}
+	return out;
+};
+var getXmlBlocks = (xml, tagName) => {
+	const re = new RegExp(`<${tagName}\\b[^>]*>([\\s\\S]*?)<\\/${tagName}>`, "g");
+	const out = [];
+	let match;
+	while (match = re.exec(xml)) out.push(match[1] ?? "");
+	return out;
+};
+var parseXmlDateTimeBlock = (block, timeZone) => {
+	const year = Number.parseInt(getXmlText(block, "year") ?? "", 10);
+	const month = Number.parseInt(getXmlText(block, "month") ?? "", 10);
+	const day = Number.parseInt(getXmlText(block, "day") ?? "", 10);
+	const hour = Number.parseInt(getXmlText(block, "hour") ?? "", 10);
+	const minute = Number.parseInt(getXmlText(block, "minute") ?? "", 10);
+	const second = Number.parseInt(getXmlText(block, "second") ?? "", 10);
+	if ([
+		year,
+		month,
+		day,
+		hour,
+		minute,
+		second
+	].every(Number.isFinite)) return dateFromWallClock({
+		year,
+		month,
+		day,
+		hour,
+		minute,
+		second
+	}, timeZone);
+	const m = block.replace(/<[^>]*>/g, "").trim().match(/(\d{4})[-/](\d{1,2})[-/](\d{1,2})(?:[ T](\d{1,2}):(\d{1,2})(?::(\d{1,2}))?)?/);
+	if (!m) return void 0;
+	const y = Number.parseInt(m[1] ?? "", 10);
+	const mo = Number.parseInt(m[2] ?? "", 10);
+	const da = Number.parseInt(m[3] ?? "", 10);
+	const ho = Number.parseInt(m[4] ?? "0", 10);
+	const mi = Number.parseInt(m[5] ?? "0", 10);
+	const se = Number.parseInt(m[6] ?? "0", 10);
+	if (![
+		y,
+		mo,
+		da,
+		ho,
+		mi,
+		se
+	].every(Number.isFinite)) return void 0;
+	return dateFromWallClock({
+		year: y,
+		month: mo,
+		day: da,
+		hour: ho,
+		minute: mi,
+		second: se
+	}, timeZone);
+};
+var parseRecordingFilesFromXml = (xml, options) => {
+	const timeZone = options?.timeZone;
+	const fileNameOptions = timeZone !== void 0 ? { timeZone } : void 0;
+	const out = [];
+	const fileInfoBlocks = getXmlBlocks(xml, "FileInfo");
+	for (const b of fileInfoBlocks) {
+		const id = getXmlText(b, "Id") ?? getXmlText(b, "ID") ?? getXmlText(b, "id");
+		const name = getXmlText(b, "name") ?? getXmlText(b, "fileName");
+		const chosen = (id ?? name)?.trim();
+		if (!chosen) continue;
+		const item = { fileName: chosen };
+		if (name != null && name.trim()) item.name = name.trim();
+		if (id != null && id.trim()) item.id = id.trim();
+		const recordType = getXmlText(b, "type") ?? getXmlText(b, "recordType") ?? getXmlText(b, "alarmType");
+		if (recordType != null) item.recordType = recordType;
+		const sizeText = getXmlText(b, "size") ?? getXmlText(b, "fileSize");
+		const sizeBytes = sizeText ? Number.parseInt(sizeText, 10) : void 0;
+		if (sizeBytes != null && Number.isFinite(sizeBytes)) item.sizeBytes = sizeBytes;
+		const start = getXmlBlocks(b, "startTime")[0];
+		const end = getXmlBlocks(b, "endTime")[0];
+		const startDt = start ? parseXmlDateTimeBlock(start, timeZone) : void 0;
+		const endDt = end ? parseXmlDateTimeBlock(end, timeZone) : void 0;
+		if (startDt) item.startTime = startDt;
+		if (endDt) item.endTime = endDt;
+		const parsed = parseRecordingFileName(item.name ?? item.fileName, fileNameOptions);
+		const parsedFromPath = item.fileName !== item.name ? parseRecordingFileName(item.fileName, fileNameOptions) : void 0;
+		const bestParsed = parsedFromPath?.sizeBytes != null ? parsedFromPath : parsed;
+		if (bestParsed) {
+			item.parsedFileName = bestParsed;
+			if (!item.startTime) item.startTime = bestParsed.start;
+			if (!item.endTime) item.endTime = bestParsed.end;
+			if (item.sizeBytes == null && bestParsed.sizeBytes != null) item.sizeBytes = bestParsed.sizeBytes;
+		}
+		item.detectionClasses = buildDetectionClasses(parsed, item.recordType);
+		out.push(item);
+	}
+	const fileBlocks = getXmlBlocks(xml, "File");
+	for (const b of fileBlocks) {
+		const fileName = (getXmlText(b, "fileName") ?? getXmlText(b, "name"))?.trim();
+		if (!fileName) continue;
+		const sizeText = getXmlText(b, "size") ?? getXmlText(b, "fileSize");
+		const sizeBytes = sizeText ? Number.parseInt(sizeText, 10) : void 0;
+		const recordType = getXmlText(b, "type") ?? getXmlText(b, "recordType") ?? getXmlText(b, "alarmType");
+		const start = getXmlBlocks(b, "startTime")[0];
+		const end = getXmlBlocks(b, "endTime")[0];
+		const item = { fileName };
+		if (sizeBytes != null && Number.isFinite(sizeBytes)) item.sizeBytes = sizeBytes;
+		if (recordType != null) item.recordType = recordType;
+		const startDt = start ? parseXmlDateTimeBlock(start, timeZone) : void 0;
+		const endDt = end ? parseXmlDateTimeBlock(end, timeZone) : void 0;
+		if (startDt) item.startTime = startDt;
+		if (endDt) item.endTime = endDt;
+		const parsed = parseRecordingFileName(item.fileName, fileNameOptions);
+		if (parsed) {
+			item.parsedFileName = parsed;
+			if (!item.startTime) item.startTime = parsed.start;
+			if (!item.endTime) item.endTime = parsed.end;
+			if (item.sizeBytes == null && parsed.sizeBytes != null) item.sizeBytes = parsed.sizeBytes;
+		}
+		item.detectionClasses = buildDetectionClasses(parsed, item.recordType);
+		out.push(item);
+	}
+	if (out.length === 0) {
+		const re = /<fileName>([\s\S]*?)<\/fileName>/g;
+		const seenNames = /* @__PURE__ */ new Set();
+		let match;
+		while (match = re.exec(xml)) {
+			const fileName = (match[1] ?? "").trim();
+			if (!fileName) continue;
+			if (seenNames.has(fileName)) continue;
+			seenNames.add(fileName);
+			const item = { fileName };
+			const parsed = parseRecordingFileName(fileName, fileNameOptions);
+			if (parsed) {
+				item.parsedFileName = parsed;
+				item.startTime = parsed.start;
+				item.endTime = parsed.end;
+			}
+			item.detectionClasses = buildDetectionClasses(parsed, void 0);
+			out.push(item);
+		}
+	}
+	const alarmBlocks = getXmlBlocks(xml, "alarmVideo");
+	if (alarmBlocks.length > 0) {
+		const byName = /* @__PURE__ */ new Map();
+		for (const existing of out) {
+			const key = existing.fileName.trim();
+			if (!key) continue;
+			if (!byName.has(key)) byName.set(key, existing);
+		}
+		for (const b of alarmBlocks) {
+			const fileName = (getXmlText(b, "fileName") ?? getXmlText(b, "name"))?.trim();
+			if (!fileName) continue;
+			const alarmId = (getXmlText(b, "fileId") ?? getXmlText(b, "recFileId") ?? getXmlText(b, "recFileName") ?? getXmlText(b, "recFile") ?? getXmlText(b, "recordFile") ?? getXmlText(b, "Id") ?? getXmlText(b, "ID") ?? getXmlText(b, "id") ?? "").trim();
+			const alarmType = getXmlText(b, "alarmType")?.trim();
+			const start = getXmlBlocks(b, "startTime")[0];
+			const end = getXmlBlocks(b, "endTime")[0];
+			const startDt = start ? parseXmlDateTimeBlock(start, timeZone) : void 0;
+			const endDt = end ? parseXmlDateTimeBlock(end, timeZone) : void 0;
+			const target = byName.get(fileName) ?? { fileName };
+			if (alarmId && !target.id) target.id = alarmId;
+			if (alarmType) target.recordType = alarmType;
+			if (startDt) target.startTime = startDt;
+			if (endDt) target.endTime = endDt;
+			if (!target.parsedFileName) {
+				const parsed = parseRecordingFileName(target.fileName, fileNameOptions);
+				if (parsed) {
+					target.parsedFileName = parsed;
+					if (!target.startTime) target.startTime = parsed.start;
+					if (!target.endTime) target.endTime = parsed.end;
+				}
+			}
+			if (!byName.has(fileName)) {
+				out.push(target);
+				byName.set(fileName, target);
+			}
+		}
+	}
+	const seen = /* @__PURE__ */ new Set();
+	return out.filter((f) => {
+		const key = f.fileName.trim();
+		if (seen.has(key)) return false;
+		seen.add(key);
+		return true;
+	});
+};
+function parseTalkAudioConfig(block) {
+	const audioType = getXmlText(block, "audioType");
+	const sampleRate = Number.parseInt(getXmlText(block, "sampleRate") ?? "", 10);
+	const samplePrecision = Number.parseInt(getXmlText(block, "samplePrecision") ?? "", 10);
+	const lengthPerEncoder = Number.parseInt(getXmlText(block, "lengthPerEncoder") ?? "", 10);
+	const soundTrack = getXmlText(block, "soundTrack");
+	const priorityText = getXmlText(block, "priority");
+	if (!audioType || !Number.isFinite(sampleRate) || !Number.isFinite(samplePrecision) || !Number.isFinite(lengthPerEncoder) || !soundTrack) return null;
+	const config = {
+		audioType,
+		sampleRate,
+		samplePrecision,
+		lengthPerEncoder,
+		soundTrack
+	};
+	if (priorityText !== void 0) {
+		const pr = Number.parseInt(priorityText, 10);
+		if (Number.isFinite(pr)) config.priority = pr;
+	}
+	return config;
+}
+var parseTalkAbilityXml = (xml) => {
+	const talkAbilityBlock = getXmlBlocks(xml, "TalkAbility")[0];
+	if (!talkAbilityBlock) throw new Error("TalkAbility XML not found in response");
+	return {
+		duplexList: getXmlBlocks(talkAbilityBlock, "duplexList").map((b) => getXmlText(b, "duplex")).filter((v) => Boolean(v)),
+		audioStreamModeList: getXmlBlocks(talkAbilityBlock, "audioStreamModeList").map((b) => getXmlText(b, "audioStreamMode")).filter((v) => Boolean(v)),
+		audioConfigList: getXmlBlocks(talkAbilityBlock, "audioConfig").map(parseTalkAudioConfig).filter((v) => Boolean(v))
+	};
+};
+function parseNumber(v) {
+	if (v == null) return void 0;
+	const n = Number(v);
+	return Number.isFinite(n) ? n : void 0;
+}
+function parseBoolean01(v) {
+	if (v == null) return void 0;
+	const s = v.trim();
+	if (s === "1" || s.toLowerCase() === "true") return true;
+	if (s === "0" || s.toLowerCase() === "false") return false;
+}
+var BYTES_PER_MB = 1024 * 1024;
+var num = (xml, tag2) => {
+	const value = parseNumber(getXmlText(xml, tag2));
+	return value === void 0 ? null : value;
+};
+var megabytes$1 = (bytes, whole, remainder) => {
+	if (bytes !== null) return bytes / BYTES_PER_MB;
+	if (whole === null && remainder === null) return null;
+	return (whole ?? 0) * 1024 + (remainder ?? 0);
+};
+var parseHddInfoListXml = (xml) => {
+	const list = getXmlBlocks(xml, "HddInfoList")[0];
+	if (list === void 0) return [];
+	return getXmlBlocks(list, "HddInfo").map((block) => {
+		const capacity = num(block, "capacity");
+		const capacityM = num(block, "capacityM");
+		const capacityBytes = num(block, "capacityV2");
+		const remainSize = num(block, "remainSize");
+		const remainSizeM = num(block, "remainSizeM");
+		const remainSizeBytes = num(block, "remainSizeV2");
+		return {
+			number: num(block, "number"),
+			capacity,
+			capacityM,
+			capacityBytes,
+			remainSize,
+			remainSizeM,
+			remainSizeBytes,
+			format: num(block, "format"),
+			mount: num(block, "mount"),
+			type: num(block, "type"),
+			index: num(block, "index"),
+			capacityMb: megabytes$1(capacityBytes, capacity, capacityM),
+			remainMb: megabytes$1(remainSizeBytes, remainSize, remainSizeM)
+		};
+	});
+};
+var DEFAULT_PRE_RECORD_SECONDS = 10;
+var parseRecordCfgLimits = (xml) => {
+	const block = getXmlBlocks(xml, "RecordCfg")[0] ?? "";
+	const numbersIn = (container, tag2) => {
+		const outer = getXmlBlocks(block, container)[0];
+		if (outer === void 0) return [];
+		return getXmlBlocks(outer, tag2).map((t) => parseNumber(t.trim())).filter((n) => n !== void 0);
+	};
+	const pre = parseNumber(getXmlText(block, "preRecordTime"));
+	return {
+		cycleList: numbersIn("cyclelist", "item"),
+		recordDelayTimeChoices: numbersIn("timeList", "time"),
+		preRecordSupported: pre !== void 0,
+		preRecordSeconds: pre === void 0 || pre === 0 ? null : pre
+	};
+};
+var parseRecordScheduleRows = (xml) => {
+	const block = getXmlBlocks(xml, "Record")[0];
+	const list = block === void 0 ? void 0 : getXmlBlocks(block, "typeScheduleList")[0];
+	if (list === void 0) return [];
+	const rows = [];
+	for (const item of getXmlBlocks(list, "item")) {
+		const type = (getXmlText(item, "type") ?? "").trim();
+		if (type === "") continue;
+		const index = parseNumber(getXmlText(item, "index"));
+		rows.push({
+			type,
+			index: index === void 0 ? null : index,
+			valueTable: (getXmlText(item, "valueTable") ?? "").trim()
+		});
+	}
+	return rows;
+};
+var BaichuanRecordConfigError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "BaichuanRecordConfigError";
+	}
+};
+var requireInteger = (field, value) => {
+	if (!Number.isInteger(value)) throw new BaichuanRecordConfigError(`${field} must be a whole number, got ${String(value)}`);
+};
+var validateRecordCfgPatch = (patch, limits) => {
+	if (patch.cycle !== void 0) {
+		requireInteger("cycle", patch.cycle);
+		if (limits.cycleList.length > 0 && !limits.cycleList.includes(patch.cycle)) throw new BaichuanRecordConfigError(`cycle ${patch.cycle} is not one of the values this camera accepts (${limits.cycleList.join(", ")}); it would answer 200 and keep the old value`);
+	}
+	if (patch.recordDelayTime !== void 0) {
+		requireInteger("recordDelayTime", patch.recordDelayTime);
+		if (patch.recordDelayTime < 0) throw new BaichuanRecordConfigError(`recordDelayTime must not be negative, got ${patch.recordDelayTime}`);
+	}
+	if (patch.packageTime !== void 0) {
+		requireInteger("packageTime", patch.packageTime);
+		if (patch.packageTime < 1) throw new BaichuanRecordConfigError(`packageTime is a length in minutes and must be at least 1, got ${patch.packageTime}`);
+	}
+	if (patch.preRecordEnabled !== void 0 && !limits.preRecordSupported) throw new BaichuanRecordConfigError("this camera does not report a pre-record setting, so writing one would do nothing");
+};
+var isWeeklyMask = (mask) => mask.length === 168 && /^[01]+$/.test(mask);
+var validateRecordSchedulePatch = (patch, rows) => {
+	for (const entry of patch.entries ?? []) {
+		if (!isWeeklyMask(entry.valueTable)) throw new BaichuanRecordConfigError(`the weekly mask for ${describeEntry(entry)} must be exactly 168 characters of 0 or 1, got ${entry.valueTable.length}; the camera would answer 200 and keep the old mask`);
+		if (!rows.some((row) => row.type === entry.type && (entry.index === void 0 || row.index === entry.index))) throw new BaichuanRecordConfigError(`this camera has no recording schedule for ${describeEntry(entry)}; it lists ${rows.map(describeRow).join(", ") || "nothing"}`);
+	}
+};
+var describeEntry = (entry) => entry.index === void 0 ? entry.type : `${entry.type}[${entry.index}]`;
+var describeRow = (row) => row.index === null ? row.type : `${row.type}[${row.index}]`;
+var replaceTag = (xml, tag2, value) => xml.replace(new RegExp(`<${tag2}>[^<]*</${tag2}>`), `<${tag2}>${value}</${tag2}>`);
+var buildRecordCfgSetXml = (currentXml, patch, limits) => {
+	let xml = currentXml;
+	if (patch.cycle !== void 0) xml = replaceTag(xml, "cycle", String(patch.cycle));
+	if (patch.recordDelayTime !== void 0) xml = replaceTag(xml, "recordDelayTime", String(patch.recordDelayTime));
+	if (patch.packageTime !== void 0) xml = replaceTag(xml, "packageTime", String(patch.packageTime));
+	if (patch.preRecordEnabled !== void 0) {
+		const seconds = patch.preRecordEnabled ? limits.preRecordSeconds ?? DEFAULT_PRE_RECORD_SECONDS : 0;
+		xml = replaceTag(xml, "preRecordTime", String(seconds));
+	}
+	return xml;
+};
+var buildRecordScheduleSetXml = (currentXml, patch) => {
+	let xml = currentXml;
+	if (patch.enable !== void 0) xml = replaceTag(xml, "enable", patch.enable ? "1" : "0");
+	for (const entry of patch.entries ?? []) xml = replaceItemValueTable(xml, entry);
+	return xml;
+};
+var ITEM_RE = /<item>([\s\S]*?)<\/item>/g;
+var replaceItemValueTable = (xml, entry) => xml.replace(ITEM_RE, (whole, inner) => {
+	if ((getXmlText(inner, "type") ?? "").trim() !== entry.type) return whole;
+	if (entry.index !== void 0) {
+		if (parseNumber(getXmlText(inner, "index")) !== entry.index) return whole;
+	}
+	if (getXmlText(inner, "valueTable") === void 0) return whole;
+	return `<item>${replaceTag(inner, "valueTable", entry.valueTable)}</item>`;
+});
+var verdict = (outcomes) => ({
+	outcomes,
+	allApplied: outcomes.every((o) => o.status === "applied")
+});
+var compare = (field, requested, actual) => actual === requested ? {
+	field,
+	status: "applied",
+	value: requested
+} : {
+	field,
+	status: "ignored",
+	requested,
+	actual: actual ?? "(absent)"
+};
+var diffRecordCfg = (patch, afterXml) => {
+	const block = getXmlBlocks(afterXml, "RecordCfg")[0] ?? "";
+	const outcomes = [];
+	if (patch.cycle !== void 0) outcomes.push(compare("cycle", String(patch.cycle), getXmlText(block, "cycle")));
+	if (patch.recordDelayTime !== void 0) outcomes.push(compare("recordDelayTime", String(patch.recordDelayTime), getXmlText(block, "recordDelayTime")));
+	if (patch.packageTime !== void 0) outcomes.push(compare("packageTime", String(patch.packageTime), getXmlText(block, "packageTime")));
+	if (patch.preRecordEnabled !== void 0) {
+		const seconds = parseNumber(getXmlText(block, "preRecordTime"));
+		const on = seconds !== void 0 && seconds !== 0;
+		outcomes.push(compare("preRecordEnabled", String(patch.preRecordEnabled), seconds === void 0 ? void 0 : String(on)));
+	}
+	return verdict(outcomes);
+};
+var diffRecordSchedule = (patch, afterXml) => {
+	const outcomes = [];
+	const block = getXmlBlocks(afterXml, "Record")[0] ?? "";
+	if (patch.enable !== void 0) outcomes.push(compare("enable", patch.enable ? "1" : "0", getXmlText(block, "enable")));
+	const rows = parseRecordScheduleRows(afterXml);
+	for (const entry of patch.entries ?? []) {
+		const row = rows.find((r) => r.type === entry.type && (entry.index === void 0 || r.index === entry.index));
+		outcomes.push(compare(`schedule.${describeEntry(entry)}`, entry.valueTable, row === void 0 ? void 0 : row.valueTable));
+	}
+	return verdict(outcomes);
+};
 function toNumberOrUndefined(value) {
 	if (value == null) return void 0;
 	const n = Number(value);
@@ -86510,254 +87827,6 @@ var estimateVideoTiming = (params) => {
 		fpsSource: "unknown"
 	};
 };
-var buildDetectionClasses = (parsed, recordType) => {
-	const classes = [];
-	const flags = parsed?.flags;
-	if (flags) {
-		if (flags.aiPerson) classes.push("person");
-		if (flags.aiVehicle) classes.push("vehicle");
-		if (flags.aiAnimal) classes.push("animal");
-		if (flags.aiFace) classes.push("face");
-		if (flags.motion) classes.push("motion");
-		if (flags.schedule) classes.push("schedule");
-		if (flags.doorbell) classes.push("doorbell");
-		if (flags.package) classes.push("package");
-		if (flags.rf) classes.push("rf");
-		if (flags.aiOther) classes.push("other");
-	}
-	if (classes.length === 0 && recordType) {
-		const rt = recordType.toLowerCase();
-		if (rt.includes("people") || rt.includes("person")) classes.push("person");
-		if (rt.includes("vehicle")) classes.push("vehicle");
-		if (rt.includes("dog_cat") || rt.includes("animal")) classes.push("animal");
-		if (rt.includes("face")) classes.push("face");
-		if (rt.includes("md") || rt.includes("motion")) classes.push("motion");
-		if (rt.includes("sched")) classes.push("schedule");
-		if (rt.includes("visitor") || rt.includes("doorbell")) classes.push("doorbell");
-		if (rt.includes("package")) classes.push("package");
-		if (rt.includes("rf")) classes.push("rf");
-	}
-	if (classes.length === 0) classes.push("motion");
-	return classes;
-};
-var getXmlTexts = (xml, tags) => {
-	const out = {};
-	for (const tag2 of tags) {
-		const v = getXmlText(xml, tag2);
-		if (v !== void 0) out[tag2] = v;
-	}
-	return out;
-};
-var getXmlBlocks = (xml, tagName) => {
-	const re = new RegExp(`<${tagName}\\b[^>]*>([\\s\\S]*?)<\\/${tagName}>`, "g");
-	const out = [];
-	let match;
-	while (match = re.exec(xml)) out.push(match[1] ?? "");
-	return out;
-};
-var parseXmlDateTimeBlock = (block, timeZone) => {
-	const year = Number.parseInt(getXmlText(block, "year") ?? "", 10);
-	const month = Number.parseInt(getXmlText(block, "month") ?? "", 10);
-	const day = Number.parseInt(getXmlText(block, "day") ?? "", 10);
-	const hour = Number.parseInt(getXmlText(block, "hour") ?? "", 10);
-	const minute = Number.parseInt(getXmlText(block, "minute") ?? "", 10);
-	const second = Number.parseInt(getXmlText(block, "second") ?? "", 10);
-	if ([
-		year,
-		month,
-		day,
-		hour,
-		minute,
-		second
-	].every(Number.isFinite)) return dateFromWallClock({
-		year,
-		month,
-		day,
-		hour,
-		minute,
-		second
-	}, timeZone);
-	const m = block.replace(/<[^>]*>/g, "").trim().match(/(\d{4})[-/](\d{1,2})[-/](\d{1,2})(?:[ T](\d{1,2}):(\d{1,2})(?::(\d{1,2}))?)?/);
-	if (!m) return void 0;
-	const y = Number.parseInt(m[1] ?? "", 10);
-	const mo = Number.parseInt(m[2] ?? "", 10);
-	const da = Number.parseInt(m[3] ?? "", 10);
-	const ho = Number.parseInt(m[4] ?? "0", 10);
-	const mi = Number.parseInt(m[5] ?? "0", 10);
-	const se = Number.parseInt(m[6] ?? "0", 10);
-	if (![
-		y,
-		mo,
-		da,
-		ho,
-		mi,
-		se
-	].every(Number.isFinite)) return void 0;
-	return dateFromWallClock({
-		year: y,
-		month: mo,
-		day: da,
-		hour: ho,
-		minute: mi,
-		second: se
-	}, timeZone);
-};
-var parseRecordingFilesFromXml = (xml, options) => {
-	const timeZone = options?.timeZone;
-	const fileNameOptions = timeZone !== void 0 ? { timeZone } : void 0;
-	const out = [];
-	const fileInfoBlocks = getXmlBlocks(xml, "FileInfo");
-	for (const b of fileInfoBlocks) {
-		const id = getXmlText(b, "Id") ?? getXmlText(b, "ID") ?? getXmlText(b, "id");
-		const name = getXmlText(b, "name") ?? getXmlText(b, "fileName");
-		const chosen = (id ?? name)?.trim();
-		if (!chosen) continue;
-		const item = { fileName: chosen };
-		if (name != null && name.trim()) item.name = name.trim();
-		if (id != null && id.trim()) item.id = id.trim();
-		const recordType = getXmlText(b, "type") ?? getXmlText(b, "recordType") ?? getXmlText(b, "alarmType");
-		if (recordType != null) item.recordType = recordType;
-		const sizeText = getXmlText(b, "size") ?? getXmlText(b, "fileSize");
-		const sizeBytes = sizeText ? Number.parseInt(sizeText, 10) : void 0;
-		if (sizeBytes != null && Number.isFinite(sizeBytes)) item.sizeBytes = sizeBytes;
-		const start = getXmlBlocks(b, "startTime")[0];
-		const end = getXmlBlocks(b, "endTime")[0];
-		const startDt = start ? parseXmlDateTimeBlock(start, timeZone) : void 0;
-		const endDt = end ? parseXmlDateTimeBlock(end, timeZone) : void 0;
-		if (startDt) item.startTime = startDt;
-		if (endDt) item.endTime = endDt;
-		const parsed = parseRecordingFileName(item.name ?? item.fileName, fileNameOptions);
-		const parsedFromPath = item.fileName !== item.name ? parseRecordingFileName(item.fileName, fileNameOptions) : void 0;
-		const bestParsed = parsedFromPath?.sizeBytes != null ? parsedFromPath : parsed;
-		if (bestParsed) {
-			item.parsedFileName = bestParsed;
-			if (!item.startTime) item.startTime = bestParsed.start;
-			if (!item.endTime) item.endTime = bestParsed.end;
-			if (item.sizeBytes == null && bestParsed.sizeBytes != null) item.sizeBytes = bestParsed.sizeBytes;
-		}
-		item.detectionClasses = buildDetectionClasses(parsed, item.recordType);
-		out.push(item);
-	}
-	const fileBlocks = getXmlBlocks(xml, "File");
-	for (const b of fileBlocks) {
-		const fileName = (getXmlText(b, "fileName") ?? getXmlText(b, "name"))?.trim();
-		if (!fileName) continue;
-		const sizeText = getXmlText(b, "size") ?? getXmlText(b, "fileSize");
-		const sizeBytes = sizeText ? Number.parseInt(sizeText, 10) : void 0;
-		const recordType = getXmlText(b, "type") ?? getXmlText(b, "recordType") ?? getXmlText(b, "alarmType");
-		const start = getXmlBlocks(b, "startTime")[0];
-		const end = getXmlBlocks(b, "endTime")[0];
-		const item = { fileName };
-		if (sizeBytes != null && Number.isFinite(sizeBytes)) item.sizeBytes = sizeBytes;
-		if (recordType != null) item.recordType = recordType;
-		const startDt = start ? parseXmlDateTimeBlock(start, timeZone) : void 0;
-		const endDt = end ? parseXmlDateTimeBlock(end, timeZone) : void 0;
-		if (startDt) item.startTime = startDt;
-		if (endDt) item.endTime = endDt;
-		const parsed = parseRecordingFileName(item.fileName, fileNameOptions);
-		if (parsed) {
-			item.parsedFileName = parsed;
-			if (!item.startTime) item.startTime = parsed.start;
-			if (!item.endTime) item.endTime = parsed.end;
-			if (item.sizeBytes == null && parsed.sizeBytes != null) item.sizeBytes = parsed.sizeBytes;
-		}
-		item.detectionClasses = buildDetectionClasses(parsed, item.recordType);
-		out.push(item);
-	}
-	if (out.length === 0) {
-		const re = /<fileName>([\s\S]*?)<\/fileName>/g;
-		const seenNames = /* @__PURE__ */ new Set();
-		let match;
-		while (match = re.exec(xml)) {
-			const fileName = (match[1] ?? "").trim();
-			if (!fileName) continue;
-			if (seenNames.has(fileName)) continue;
-			seenNames.add(fileName);
-			const item = { fileName };
-			const parsed = parseRecordingFileName(fileName, fileNameOptions);
-			if (parsed) {
-				item.parsedFileName = parsed;
-				item.startTime = parsed.start;
-				item.endTime = parsed.end;
-			}
-			item.detectionClasses = buildDetectionClasses(parsed, void 0);
-			out.push(item);
-		}
-	}
-	const alarmBlocks = getXmlBlocks(xml, "alarmVideo");
-	if (alarmBlocks.length > 0) {
-		const byName = /* @__PURE__ */ new Map();
-		for (const existing of out) {
-			const key = existing.fileName.trim();
-			if (!key) continue;
-			if (!byName.has(key)) byName.set(key, existing);
-		}
-		for (const b of alarmBlocks) {
-			const fileName = (getXmlText(b, "fileName") ?? getXmlText(b, "name"))?.trim();
-			if (!fileName) continue;
-			const alarmId = (getXmlText(b, "fileId") ?? getXmlText(b, "recFileId") ?? getXmlText(b, "recFileName") ?? getXmlText(b, "recFile") ?? getXmlText(b, "recordFile") ?? getXmlText(b, "Id") ?? getXmlText(b, "ID") ?? getXmlText(b, "id") ?? "").trim();
-			const alarmType = getXmlText(b, "alarmType")?.trim();
-			const start = getXmlBlocks(b, "startTime")[0];
-			const end = getXmlBlocks(b, "endTime")[0];
-			const startDt = start ? parseXmlDateTimeBlock(start, timeZone) : void 0;
-			const endDt = end ? parseXmlDateTimeBlock(end, timeZone) : void 0;
-			const target = byName.get(fileName) ?? { fileName };
-			if (alarmId && !target.id) target.id = alarmId;
-			if (alarmType) target.recordType = alarmType;
-			if (startDt) target.startTime = startDt;
-			if (endDt) target.endTime = endDt;
-			if (!target.parsedFileName) {
-				const parsed = parseRecordingFileName(target.fileName, fileNameOptions);
-				if (parsed) {
-					target.parsedFileName = parsed;
-					if (!target.startTime) target.startTime = parsed.start;
-					if (!target.endTime) target.endTime = parsed.end;
-				}
-			}
-			if (!byName.has(fileName)) {
-				out.push(target);
-				byName.set(fileName, target);
-			}
-		}
-	}
-	const seen = /* @__PURE__ */ new Set();
-	return out.filter((f) => {
-		const key = f.fileName.trim();
-		if (seen.has(key)) return false;
-		seen.add(key);
-		return true;
-	});
-};
-function parseTalkAudioConfig(block) {
-	const audioType = getXmlText(block, "audioType");
-	const sampleRate = Number.parseInt(getXmlText(block, "sampleRate") ?? "", 10);
-	const samplePrecision = Number.parseInt(getXmlText(block, "samplePrecision") ?? "", 10);
-	const lengthPerEncoder = Number.parseInt(getXmlText(block, "lengthPerEncoder") ?? "", 10);
-	const soundTrack = getXmlText(block, "soundTrack");
-	const priorityText = getXmlText(block, "priority");
-	if (!audioType || !Number.isFinite(sampleRate) || !Number.isFinite(samplePrecision) || !Number.isFinite(lengthPerEncoder) || !soundTrack) return null;
-	const config = {
-		audioType,
-		sampleRate,
-		samplePrecision,
-		lengthPerEncoder,
-		soundTrack
-	};
-	if (priorityText !== void 0) {
-		const pr = Number.parseInt(priorityText, 10);
-		if (Number.isFinite(pr)) config.priority = pr;
-	}
-	return config;
-}
-var parseTalkAbilityXml = (xml) => {
-	const talkAbilityBlock = getXmlBlocks(xml, "TalkAbility")[0];
-	if (!talkAbilityBlock) throw new Error("TalkAbility XML not found in response");
-	return {
-		duplexList: getXmlBlocks(talkAbilityBlock, "duplexList").map((b) => getXmlText(b, "duplex")).filter((v) => Boolean(v)),
-		audioStreamModeList: getXmlBlocks(talkAbilityBlock, "audioStreamModeList").map((b) => getXmlText(b, "audioStreamMode")).filter((v) => Boolean(v)),
-		audioConfigList: getXmlBlocks(talkAbilityBlock, "audioConfig").map(parseTalkAudioConfig).filter((v) => Boolean(v))
-	};
-};
 function daysInMonth(year, month) {
 	return new Date(Date.UTC(year, month, 0)).getUTCDate();
 }
@@ -87366,17 +88435,6 @@ var TtlCache = class {
 		this.entries.clear();
 	}
 };
-function parseNumber(v) {
-	if (v == null) return void 0;
-	const n = Number(v);
-	return Number.isFinite(n) ? n : void 0;
-}
-function parseBoolean01(v) {
-	if (v == null) return void 0;
-	const s = v.trim();
-	if (s === "1" || s.toLowerCase() === "true") return true;
-	if (s === "0" || s.toLowerCase() === "false") return false;
-}
 function parseOsdDatetimeXml(rawXml) {
 	const osdBlock = getXmlBlocks(rawXml, "OsdDatetime")[0];
 	const nameBlock = getXmlBlocks(rawXml, "OsdChannelName")[0];
@@ -88719,12 +89777,12 @@ var parseRecStartParamIfPresent = (fileName) => {
 	if (!m) return void 0;
 	return `${m[2]}${m[3]}`;
 };
-var buildReplayStopNameFromFileName = (fileName) => {
+var buildReplayStopNameFromFileName = (fileName, channel = 0) => {
 	const trimmed = (fileName ?? "").trim();
-	if (/^01\d{14}$/.test(trimmed)) return trimmed;
+	if (/^\d{2}\d{14}$/.test(trimmed)) return trimmed;
 	const start = parseRecStartParamIfPresent(fileName);
 	if (!start) return void 0;
-	return `01${start}`;
+	return `${String(channel + 1).padStart(2, "0")}${start}`;
 };
 var buildFileInfoListReplayByIdXml = (params) => {
 	const st = params.streamType ?? "mainStream";
@@ -91424,7 +92482,7 @@ var ReolinkBaichuanApi = class _ReolinkBaichuanApi {
 			return;
 		}
 		entry.startInFlight = (async () => {
-			const { BaichuanVideoStream: BaichuanVideoStream2 } = await import("./BaichuanVideoStream-FOE2DBVZ-94yIU75L.mjs");
+			const { BaichuanVideoStream: BaichuanVideoStream2 } = await import("./BaichuanVideoStream-UG3DIMIE-BRbIHCdL.mjs");
 			const sessionKey = `live:object-detections:ch${entry.channel}:${entry.profile}`;
 			const dedicated = await this.createDedicatedSession(sessionKey);
 			const stream = new BaichuanVideoStream2({
@@ -93384,7 +94442,7 @@ var ReolinkBaichuanApi = class _ReolinkBaichuanApi {
 		const stop = async () => {
 			if (tornDown) return;
 			tornDown = true;
-			const stopName = buildReplayStopNameFromFileName(params.fileName);
+			const stopName = buildReplayStopNameFromFileName(params.fileName, channel);
 			if (started && stopName) try {
 				const stopXml = buildFileInfoListStopXml({
 					channel,
@@ -93493,7 +94551,7 @@ var ReolinkBaichuanApi = class _ReolinkBaichuanApi {
 		const stop = async () => {
 			if (tornDown) return;
 			tornDown = true;
-			const stopName = buildReplayStopNameFromFileName(params.fileName);
+			const stopName = buildReplayStopNameFromFileName(params.fileName, channel);
 			if (started && stopName) try {
 				const stopXml = buildFileInfoListStopXml({
 					channel,
@@ -94445,11 +95503,13 @@ ${stderr}`));
 		});
 		const timeoutMs = params.timeoutMs ?? 12e4;
 		trace(`download: channel=${channel} uid=${uid || "(missing)"} ident=${ident} streamType=${streamType} isNvr=${isNvr} timeoutMs=${timeoutMs}`);
+		const pinnedHeaderChannelId = params.headerChannelIdOverride;
+		let abandoned = false;
 		try {
 			return await this.client.sendBinary({
 				cmdId: 5,
 				channel,
-				...isNvr ? { channelIdOverride: headerChannelIdOverride ?? 82 } : {},
+				...pinnedHeaderChannelId != null ? { channelIdOverride: pinnedHeaderChannelId } : {},
 				msgNumOverride: 0,
 				messageClass: BC_CLASS_MODERN_24,
 				payloadXml,
@@ -94460,8 +95520,53 @@ ${stderr}`));
 			});
 		} catch (e) {
 			trace(`download failed: ${e instanceof Error ? e.message : String(e)}`);
+			abandoned = true;
 			throw e;
+		} finally {
+			await this.stopFileInfoListReplay({
+				channel,
+				fileName: ident,
+				streamType,
+				drain: abandoned
+			});
+		}
+	}
+	/**
+	* Close a cmd 5 replay session at the camera (cmd 7) and wait for the wire to
+	* go quiet.
+	*
+	* Best-effort by design: a session that has already ended answers with an
+	* error on some firmwares and there is nothing to do about it. The DRAIN is
+	* not best-effort — the ack comes back before the camera has finished
+	* sending (the Reolink app's own capture shows 26–91 further frames after
+	* four of eleven stops), and the next replay must not be opened into that
+	* tail.
+	*/
+	async stopFileInfoListReplay(params) {
+		const stopName = buildReplayStopNameFromFileName(params.fileName, params.channel);
+		if (!stopName) {
+			this.logger?.debug?.(`[stopFileInfoListReplay] no stop name derivable from ${params.fileName}; the session is left to time out at the camera`);
+			return;
+		}
+		try {
+			await this.client.sendXml({
+				cmdId: 7,
+				channel: params.channel,
+				payloadXml: buildFileInfoListStopXml({
+					channel: params.channel,
+					name: stopName,
+					streamType: params.streamType
+				}),
+				messageClass: BC_CLASS_MODERN_24,
+				timeoutMs: 4e3,
+				internal: true
+			});
+		} catch (e) {
+			this.logger?.debug?.(`[stopFileInfoListReplay] stop <name>${stopName}</name> failed: ${e instanceof Error ? e.message : String(e)}`);
 		}
+		if (!params.drain) return;
+		const drained = await this.client.drainReplayFrames();
+		if (drained > 0) this.logger?.debug?.(`[stopFileInfoListReplay] ${drained} cmd 5 frame(s) still arrived after the stop (<name>${stopName}</name>); drained before releasing the socket`);
 	}
 	async downloadRecording(params) {
 		this.logger?.debug?.(`[downloadRecording] Queuing download for: ${params.fileName}, channel=${params.channel}`);
@@ -97581,7 +98686,7 @@ ${xml}`);
 	* @returns Test results for all stream types and profiles
 	*/
 	async testChannelStreams(channel, logger) {
-		const { testChannelStreams } = await import("./DiagnosticsTools-ZC7I7QM6-9NV95vRN.mjs");
+		const { testChannelStreams } = await import("./DiagnosticsTools-YIWXO7IJ-9NV95vRN.mjs");
 		return await testChannelStreams({
 			api: this,
 			channel: this.normalizeChannel(channel),
@@ -97597,7 +98702,7 @@ ${xml}`);
 	* @returns Complete diagnostics for all channels and streams
 	*/
 	async collectMultifocalDiagnostics(logger) {
-		const { collectMultifocalDiagnostics } = await import("./DiagnosticsTools-ZC7I7QM6-9NV95vRN.mjs");
+		const { collectMultifocalDiagnostics } = await import("./DiagnosticsTools-YIWXO7IJ-9NV95vRN.mjs");
 		return await collectMultifocalDiagnostics({
 			api: this,
 			logger
@@ -98419,6 +99524,115 @@ ${xml}`);
 			};
 		})() : {};
 	}
+	/**
+	* The limits THIS camera states for `<RecordCfg>` (cmd 54), read from its
+	* own reply — `<cyclelist>`, `<timeList>`, whether pre-record exists at all.
+	*
+	* Read this before offering a control: a firmware that stops accepting a
+	* value stops listing it, and {@link setRecordCfg} refuses against the same
+	* facts.
+	*/
+	async getRecordCfgLimits(channel, options) {
+		return parseRecordCfgLimits(await this.sendPcapDerivedSettingsGetXml({
+			cmdId: 54,
+			channel,
+			...options?.timeoutMs != null ? { timeoutMs: options.timeoutMs } : {}
+		}));
+	}
+	/**
+	* SetRecCfg (cmd 55) — write the onboard recording configuration.
+	*
+	* Read-modify-write over the camera's own cmd 54 document, then a re-read to
+	* find out what it actually kept. Both halves are load-bearing, because this
+	* command **never reports a bad value**: measured on 2026-09-22, a
+	* `preRecordTime` of 9999 and a `cycle` outside the camera's own
+	* `<cyclelist>` were each answered `200` and discarded. The returned
+	* {@link BaichuanRecordWriteResult} is the only honest answer to "did that
+	* work", so callers should look at `allApplied` rather than at the absence
+	* of a thrown error.
+	*
+	* Values the camera would certainly drop are refused BEFORE the wire with a
+	* {@link BaichuanRecordConfigError}.
+	*
+	* `preRecordEnabled` is a boolean on purpose — see `utils/recordConfig.ts`.
+	*
+	* Verified live: `packageTime` 5 → 10 and `recordDelayTime` 15 → 30 on E1
+	* Outdoor PoE v3.1.0.5223, `recordDelayTime` 15 → 30 → 20 on a Home Hub
+	* v3.3.0.456 channel 0, each read back and restored.
+	*/
+	async setRecordCfg(channel, patch, options) {
+		const ch = this.normalizeChannel(channel);
+		const timeoutOpts = options?.timeoutMs != null ? { timeoutMs: options.timeoutMs } : {};
+		const currentXml = await this.sendXml({
+			cmdId: 54,
+			channel: ch,
+			...timeoutOpts
+		});
+		const limits = parseRecordCfgLimits(currentXml);
+		validateRecordCfgPatch(patch, limits);
+		await this.sendXml({
+			cmdId: 55,
+			channel: ch,
+			payloadXml: ensureXmlHeader(buildRecordCfgSetXml(currentXml, patch, limits)),
+			...timeoutOpts
+		});
+		return diffRecordCfg(patch, await this.sendXml({
+			cmdId: 54,
+			channel: ch,
+			...timeoutOpts
+		}));
+	}
+	/**
+	* The schedule rows THIS camera lists (cmd 81), `(type, index)` and the
+	* current mask for each.
+	*
+	* `<index>` matters: an E1 Outdoor Pro lists `crossline`, `intrude` and
+	* `loitering` three times each, one row per configured rule, and a write
+	* addressed by `type` alone would overwrite all three.
+	*/
+	async getRecordScheduleRows(channel, options) {
+		return parseRecordScheduleRows(await this.sendPcapDerivedSettingsGetXml({
+			cmdId: 81,
+			channel,
+			...options?.timeoutMs != null ? { timeoutMs: options.timeoutMs } : {}
+		}));
+	}
+	/**
+	* SetRec (cmd 82) — write the weekly recording schedule.
+	*
+	* Same contract as {@link setRecordCfg}: refuse what is certainly bad before
+	* the wire, then verify by re-reading. A 167-character mask and a `<type>`
+	* the camera does not have were each answered `200` and dropped, and the
+	* drop is **per item** — one document carrying a bad `Normal` mask and a
+	* good `MD` mask applied the `MD` one and discarded the other. So a caller
+	* cannot treat this write as atomic, and the per-field
+	* {@link BaichuanRecordWriteResult} says which rows landed.
+	*
+	* Verified live on E1 Outdoor PoE v3.1.0.5223: `Normal` hour 0 flipped on
+	* and restored, via both a full document and a one-item document (the camera
+	* merges per row and leaves the other rows alone).
+	*/
+	async setRecordSchedule(channel, patch, options) {
+		const ch = this.normalizeChannel(channel);
+		const timeoutOpts = options?.timeoutMs != null ? { timeoutMs: options.timeoutMs } : {};
+		const currentXml = await this.sendXml({
+			cmdId: 81,
+			channel: ch,
+			...timeoutOpts
+		});
+		validateRecordSchedulePatch(patch, parseRecordScheduleRows(currentXml));
+		await this.sendXml({
+			cmdId: 82,
+			channel: ch,
+			payloadXml: ensureXmlHeader(buildRecordScheduleSetXml(currentXml, patch)),
+			...timeoutOpts
+		});
+		return diffRecordSchedule(patch, await this.sendXml({
+			cmdId: 81,
+			channel: ch,
+			...timeoutOpts
+		}));
+	}
 	async getWifiSignal(channel, options) {
 		const signal = parseNumber(getXmlText(await this.sendPcapDerivedSettingsGetXml({
 			cmdId: 115,
@@ -98617,6 +99831,22 @@ ${xml}`);
 		}));
 	}
 	/**
+	* cmd 102 `<HddInfoList>`, typed — one record per volume with the size
+	* arithmetic already done.
+	*
+	* Prefer this over {@link getHddInfoList}. The raw reply splits size across
+	* `capacity` (whole GB) and `capacityM` (MB remainder), and newer firmwares
+	* add exact byte counts in `capacityV2` / `remainSizeV2`; `capacityMb` and
+	* `remainMb` fold whichever pair the camera sent, and are **null when it
+	* sent neither** rather than 0.
+	*/
+	async getHddInfo(options) {
+		return parseHddInfoListXml(await this.sendXml({
+			cmdId: 102,
+			...options?.timeoutMs != null ? { timeoutMs: options.timeoutMs } : {}
+		}));
+	}
+	/**
 	* cmd 142 `<DayRecords>` — which days of a month have footage, for one
 	* channel. The calendar the official app draws.
 	*
@@ -150399,7 +151629,7 @@ function writeRefusal(res, refusal, deviceId, logger, clipKey) {
 	else logger.debug(line, extras);
 	const retryAfterMs = refusal.disposition === "deferred" ? refusal.retryAfterMs : void 0;
 	res.writeHead(204, {
-		[CLIP_STILL_REASON_HEADER]: refusal.reason.slice(0, 500),
+		[CLIP_STILL_REASON_HEADER]: clipReasonHeaderValue(refusal.reason),
 		[CLIP_STILL_REASON_CODE_HEADER]: refusal.code,
 		[CLIP_STILL_DISPOSITION_HEADER]: refusal.disposition,
 		...retryAfterMs === void 0 ? {} : { "retry-after": String(Math.max(1, Math.ceil(retryAfterMs / 1e3))) }
@@ -150596,7 +151826,7 @@ function createClipStreamHandler(deps) {
 				status: resolved.status
 			} });
 			res.writeHead(resolved.status, {
-				[CLIP_STILL_REASON_HEADER]: resolved.detail.slice(0, 500),
+				[CLIP_STILL_REASON_HEADER]: clipReasonHeaderValue(resolved.detail),
 				[CLIP_STILL_REASON_CODE_HEADER]: resolved.code
 			});
 			res.end();
@@ -150669,7 +151899,7 @@ function createClipStreamHandler(deps) {
 			}
 		});
 		res.writeHead(streamRefusalStatus(outcome.code), {
-			[CLIP_STILL_REASON_HEADER]: outcome.detail.slice(0, 500),
+			[CLIP_STILL_REASON_HEADER]: clipReasonHeaderValue(outcome.detail),
 			[CLIP_STILL_REASON_CODE_HEADER]: outcome.code
 		});
 		res.end();
@@ -150943,6 +152173,14 @@ function buildClipStreamMuxArgs(input) {
 * not push the deadline out. `drain` — the hop's own word that it took what
 * it held — disarms it. Stall fires at most once, and a disposed gate is
 * silent for ever.
+*
+* **A gate must be DISPOSED when its hop stops taking bytes for good** — when
+* the input is ended, and when the run is over. Node emits no `drain` after
+* `end()` (`afterWrite` guards it with `!state.ending`), so a gate armed at
+* EOF can never be disarmed: it fires `timeoutMs` later and severs a stream
+* that was already served. Measured on real bytes: a 42 s clip delivered at
+* 18× leaves the audio pipe armed at EOF every time, with zero `drain`
+* events after `end()`. (D604)
 */
 function createDrainGate(deps) {
 	let handle = null;
@@ -151103,7 +152341,33 @@ function createClipStreamProducer(deps) {
 				}
 			});
 			activeByHost.set(hostKey, ahead + 1);
-			const run = (lanes.get(hostKey) ?? Promise.resolve()).then(() => runAttempts(input)).finally(() => {
+			let abandonedAt = null;
+			input.sink.onceClose(() => {
+				abandonedAt ??= Date.now();
+			});
+			const queuedAt = Date.now();
+			const run = (lanes.get(hostKey) ?? Promise.resolve()).then(async () => {
+				if (abandonedAt !== null) {
+					const waitedMs = abandonedAt - queuedAt;
+					deps.logger.info("videoclips: a queued clip stream was dropped, its peer had gone", {
+						tags: { deviceId },
+						meta: {
+							clipKey: input.row.clipKey,
+							twin: input.twin,
+							branch: "queued-peer-gone",
+							waitedMs,
+							aheadWhenQueued: ahead
+						}
+					});
+					return {
+						kind: "refused",
+						code: "fetch-failed",
+						detail: `the peer left after ${String(waitedMs)} ms in the queue, so this clip was never fetched`,
+						attempts: 0
+					};
+				}
+				return await runAttempts(input);
+			}).finally(() => {
 				const left = (activeByHost.get(hostKey) ?? 1) - 1;
 				if (left <= 0) activeByHost.delete(hostKey);
 				else activeByHost.set(hostKey, left);
@@ -151147,8 +152411,18 @@ var ClipStreamRun = class {
 		accessUnits: 0
 	};
 	videoType = null;
+	/** The last access unit's timestamp, to catch a transfer that went BACK. */
+	lastUs = null;
+	/** Units of a PREVIOUS transfer, dropped before the mux existed (D604). */
+	residueUnits = 0;
+	residueAudioFrames = 0;
+	/** A backwards timestamp that arrived too late to drop: the duration of
+	*  this pass cannot be measured, and is never guessed (D393). */
+	timestampsBroken = false;
 	begun = false;
 	ended = false;
+	/** The run is over. Every late callback is silent from here (D604). */
+	done = false;
 	bytesOut = 0;
 	cut = null;
 	stdinGate;
@@ -151205,17 +152479,28 @@ var ClipStreamRun = class {
 			};
 		}
 		try {
-			await api.fileInfoListReplayBinaryDownload({
-				channel: device.channel,
-				...device.uid !== void 0 ? { uid: device.uid } : {},
-				fileName,
-				idleTimeoutMs: 300,
-				onChunk: (chunk) => this.onChunk(decoder, chunk)
-			});
-		} catch (err) {
-			return this.onTransferFailed(err);
+			try {
+				await api.fileInfoListReplayBinaryDownload({
+					channel: device.channel,
+					...device.uid !== void 0 ? { uid: device.uid } : {},
+					fileName,
+					idleTimeoutMs: 300,
+					onChunk: (chunk) => this.onChunk(decoder, chunk)
+				});
+			} catch (err) {
+				return this.onTransferFailed(err);
+			}
+			return await this.onTransferEnded();
+		} finally {
+			this.done = true;
+			this.disposeGates();
 		}
-		return this.onTransferEnded();
+	}
+	/** Every hop's drain gate, silenced. Idempotent. */
+	disposeGates() {
+		this.stdinGate.dispose();
+		this.audioStdinGate.dispose();
+		this.peerGate.dispose();
 	}
 	/** The camera's bytes, as they arrive. A cut run THROWS here: the only stop. */
 	onChunk(decoder, chunk) {
@@ -151229,14 +152514,81 @@ var ClipStreamRun = class {
 	}
 	onAccessUnit(unit) {
 		if (this.cut !== null) return;
+		const previousUs = this.lastUs;
+		this.lastUs = unit.microseconds;
+		if (previousUs !== null && unit.microseconds < previousUs) this.onTimestampsWentBack(previousUs, unit.microseconds);
 		this.accessUnits += 1;
 		this.timestampsUs.push(unit.microseconds);
-		if (this.mux === null) {
-			this.probe = [...this.probe, unit];
-			if (this.probe.length >= 16) this.startMux();
+		if (this.mux !== null) {
+			this.feed(unit.annexB);
 			return;
 		}
-		this.feed(unit.annexB);
+		this.probe = [...this.probe, unit];
+		if (this.probe.length < 16) return;
+		if (probeClipStreamRate(this.timestampsUs).fpsSource === "timestamps" || this.probe.length >= 128) this.startMux();
+	}
+	/**
+	* A timestamp that went BACKWARD: this is a second transfer's first frame.
+	*
+	* The library's replay listener cannot tell one transfer from the next —
+	* every cmd 5 replay carries `msgNum: 0` and, on a hub child, the same
+	* header channel id — and a CUT transfer is never stopped at the camera
+	* (nothing on the wire aborts one; the producer's only lever is to throw
+	* from the next chunk). So the frames still in flight for the previous,
+	* aborted stream are handed to THIS one, ahead of its own first frame.
+	*
+	* Measured on 3628, 2026-09-22 16:41: a stream cut at 55 access units was
+	* followed 1 ms later by another, which decoded 640 units instead of 635
+	* and 666 audio frames instead of 661 — the same five extra of each — and
+	* spanned 38.52 s instead of 42.21 s, exactly the 3.69 s the cut stream had
+	* already delivered. Its rate probe therefore measured a NEGATIVE span and
+	* refused to name a rate, which is the only way `estimateVideoTiming` can
+	* answer anything but `timestamps` here.
+	*
+	* Before the mux exists the answer is to DROP what was held and probe
+	* again: nothing has reached the peer, so the residue can simply not be
+	* part of this stream. After it exists there is nothing to drop — the bytes
+	* are out — so it is named, counted, and this pass's duration becomes
+	* unmeasurable rather than a number measured across two transfers.
+	*/
+	onTimestampsWentBack(previousUs, currentUs) {
+		const { row, twin } = this.input;
+		const meta = {
+			clipKey: row.clipKey,
+			twin,
+			previousUs,
+			currentUs
+		};
+		if (this.mux !== null) {
+			if (this.timestampsBroken) return;
+			this.timestampsBroken = true;
+			this.deps.logger.warn("videoclips: a clip stream’s timestamps went backwards mid-mux", {
+				tags: this.tags,
+				meta: {
+					...meta,
+					branch: "stream-timestamp-jump",
+					accessUnits: this.accessUnits
+				}
+			});
+			return;
+		}
+		this.residueUnits += this.probe.length;
+		this.residueAudioFrames += this.audioProbe.length;
+		this.audioFramesDropped += this.audioProbe.length;
+		this.probe = [];
+		this.audioProbe = [];
+		this.audioProbeBytes = 0;
+		this.timestampsUs.length = 0;
+		this.accessUnits = 0;
+		this.deps.logger.warn("videoclips: a clip stream dropped the previous transfer’s frames", {
+			tags: this.tags,
+			meta: {
+				...meta,
+				branch: "stream-transfer-residue",
+				residueAccessUnits: this.residueUnits,
+				residueAudioFrames: this.residueAudioFrames
+			}
+		});
 	}
 	/**
 	* One audio frame from the decoder.
@@ -151301,15 +152653,20 @@ var ClipStreamRun = class {
 		this.rate = probeClipStreamRate(this.timestampsUs);
 		this.decideAudio();
 		const { row, twin } = this.input;
-		if (this.rate.fpsSource !== "timestamps") this.deps.logger.warn("videoclips: no measured frame rate for this clip stream", {
-			tags: this.tags,
-			meta: {
-				clipKey: row.clipKey,
-				twin,
-				branch: "fps-unmeasured",
-				probeAccessUnits: this.rate.accessUnits
-			}
-		});
+		if (this.rate.fps === null || this.rate.fpsSource !== "timestamps") {
+			this.deps.logger.warn("videoclips: no measured frame rate for this clip stream", {
+				tags: this.tags,
+				meta: {
+					clipKey: row.clipKey,
+					twin,
+					branch: "fps-unmeasured",
+					probeAccessUnits: this.rate.accessUnits,
+					residueAccessUnits: this.residueUnits
+				}
+			});
+			this.sever("rate-unmeasured", `no frame rate could be measured over ${String(this.rate.accessUnits)} access units`);
+			return;
+		}
 		let mux;
 		try {
 			mux = this.deps.spawnMux(buildClipStreamMuxArgs({
@@ -151414,14 +152771,12 @@ var ClipStreamRun = class {
 	}
 	/** Sever every hop, once, and say why. */
 	sever(reason, detail) {
-		if (this.cut !== null) return;
+		if (this.cut !== null || this.done) return;
 		this.cut = {
 			reason,
 			detail
 		};
-		this.stdinGate.dispose();
-		this.audioStdinGate.dispose();
-		this.peerGate.dispose();
+		this.disposeGates();
 		this.mux?.kill("SIGKILL");
 		this.deps.logger.warn("videoclips: a clip stream was cut", {
 			tags: this.tags,
@@ -151482,6 +152837,8 @@ var ClipStreamRun = class {
 		});
 		mux.stdin?.end();
 		this.audioIn?.end();
+		this.stdinGate.dispose();
+		this.audioStdinGate.dispose();
 		const flush = setTimeout(() => this.sever("mux-hung", `ffmpeg did not exit ${this.deps.flushTimeoutMs} ms after its input ended`), this.deps.flushTimeoutMs);
 		const code = await this.muxClosed;
 		clearTimeout(flush);
@@ -151501,7 +152858,7 @@ var ClipStreamRun = class {
 	served() {
 		const { row, twin } = this.input;
 		const timing = estimateVideoTiming({ timestampsUs: this.timestampsUs });
-		const durationSeconds = timing.fpsSource === "timestamps" ? timing.durationSeconds : null;
+		const durationSeconds = this.timestampsBroken || timing.fpsSource !== "timestamps" ? null : timing.durationSeconds;
 		const verdict = judgeClipDuration({
 			expectedMs: row.endMs - row.startMs,
 			decodedSeconds: durationSeconds,
@@ -151519,7 +152876,9 @@ var ClipStreamRun = class {
 			expectedMs: row.endMs - row.startMs,
 			fps: this.rate.fps,
 			fpsSource: this.rate.fpsSource,
-			videoType: this.videoType
+			videoType: this.videoType,
+			residueAccessUnits: this.residueUnits,
+			timestampsBroken: this.timestampsBroken
 		};
 		if (verdict.kind === "short") this.deps.logger.warn("videoclips: a clip stream came up short against its row", {
 			tags: this.tags,
@@ -152501,11 +153860,11 @@ function enumerateWallClockDays(sinceMs, untilMs, timeZone) {
 * nowhere). Searching for the KEY rather than the path survives both, and
 * survives the next firmware that nests it differently.
 */
-function findRecordWithKey$1(node, key) {
+function findRecordWithKey$2(node, key) {
 	if (node === null || typeof node !== "object") return null;
 	if (Array.isArray(node)) {
 		for (const child of node) {
-			const found = findRecordWithKey$1(child, key);
+			const found = findRecordWithKey$2(child, key);
 			if (found !== null) return found;
 		}
 		return null;
@@ -152513,7 +153872,7 @@ function findRecordWithKey$1(node, key) {
 	const record = { ...node };
 	if (key in record) return record;
 	for (const value of Object.values(record)) {
-		const found = findRecordWithKey$1(value, key);
+		const found = findRecordWithKey$2(value, key);
 		if (found !== null) return found;
 	}
 	return null;
@@ -152533,7 +153892,7 @@ async function readStorageState(api) {
 			reason: err instanceof Error ? err.message : String(err)
 		};
 	}
-	const record = findRecordWithKey$1(raw, "mount");
+	const record = findRecordWithKey$2(raw, "mount");
 	if (record === null) return { state: "unknown" };
 	const mount = asNumber(record["mount"]);
 	if (mount === null) return { state: "unknown" };
@@ -155122,6 +156481,313 @@ var reolinkDebugActions = defineCustomActions({ debugRawRead: customAction(RawRe
 	auth: "admin"
 }) });
 //#endregion
+//#region src/recording-onboard-mapping.ts
+/**
+* Reolink's schedule `type` → the cap's trigger vocabulary.
+*
+* `legacy` is deliberately absent: it appears on 618 and names nothing
+* an operator would recognise, so a window carrying it is COUNTED as
+* unread rather than mapped onto a guess.
+*/
+var TRIGGER_BY_TYPE = {
+	MD: "motion",
+	Normal: "continuous",
+	people: "person",
+	vehicle: "vehicle",
+	dog_cat: "animal",
+	crossline: "lineCrossing",
+	intrude: "intrusion",
+	loitering: "loitering"
+};
+/** Triggers a Reolink camera's schedule can name. */
+var REOLINK_TRIGGERS = [
+	"continuous",
+	"motion",
+	"person",
+	"vehicle",
+	"animal",
+	"lineCrossing",
+	"intrusion",
+	"loitering"
+];
+/**
+* Find the first record anywhere in the reply that carries `key`.
+*
+* Structural, not path-based, because the library's declared shape for
+* this reply is wrong and a path written against it finds nothing.
+*/
+function findRecordWithKey$1(node, key) {
+	if (typeof node !== "object" || node === null) return null;
+	if (Array.isArray(node)) {
+		for (const item of node) {
+			const found = findRecordWithKey$1(item, key);
+			if (found) return found;
+		}
+		return null;
+	}
+	const record = { ...node };
+	if (key in record) return record;
+	for (const value of Object.values(record)) {
+		const found = findRecordWithKey$1(value, key);
+		if (found) return found;
+	}
+	return null;
+}
+function finiteNumber(value) {
+	if (typeof value !== "number") return null;
+	return Number.isFinite(value) ? value : null;
+}
+/**
+* Total size in MB from Reolink's split pair.
+*
+* Null when the camera stated NEITHER half — a size we did not read is
+* not a size of zero (D393). A stated 0 GB with a stated MB remainder is
+* a real, small number, and survives as one.
+*/
+function megabytes(whole, remainder) {
+	const gb = finiteNumber(whole);
+	const mb = finiteNumber(remainder);
+	if (gb === null && mb === null) return null;
+	return (gb ?? 0) * 1024 + (mb ?? 0);
+}
+/**
+* Read `getHddInfoList`.
+*
+* `mount === 0` is a camera with no card — the same signal
+* `clips/clip-catalog.ts` keys off. `format === 0` is a card present but
+* not usable, which is `absent` with a reason that says so rather than
+* `present` with a card nothing can be written to.
+*/
+function parseOnboardStorage(reply) {
+	const record = findRecordWithKey$1(reply, "mount");
+	if (!record) return {
+		kind: "unknown",
+		reason: "The camera answered, but with nothing this reader recognised as storage info."
+	};
+	if (finiteNumber(record.mount) === 0) return {
+		kind: "absent",
+		reason: "The camera reports no mounted storage (HddInfo mount 0)."
+	};
+	const formatted = finiteNumber(record.format);
+	const id = finiteNumber(record.number);
+	const volume = {
+		id: id === null ? "0" : String(id),
+		status: formatted === 0 ? "unformatted" : "ok",
+		capacityMb: megabytes(record.capacity, record.capacityM),
+		freeMb: megabytes(record.remainSize, record.remainSizeM)
+	};
+	if (formatted === 0) return {
+		kind: "absent",
+		reason: "The camera reports a card that is not formatted, so it cannot record to it."
+	};
+	return {
+		kind: "present",
+		volumes: [volume]
+	};
+}
+/**
+* Expand every `typeScheduleList` entry into windows.
+*
+* Entries sharing a trigger are merged slot-wise before expansion, so
+* three `crossline` rules produce one set of line-crossing windows
+* rather than three overlapping copies.
+*
+* An entry whose `type` is unknown, or whose table is not 168 characters,
+* is counted as unread. A table of the wrong length is not a schedule of
+* fewer days.
+*/
+function parseSchedule(schedule) {
+	const entries = schedule?.typeScheduleList ?? [];
+	const merged = /* @__PURE__ */ new Map();
+	let unreadable = 0;
+	for (const entry of entries) {
+		const trigger = TRIGGER_BY_TYPE[entry.type];
+		if (trigger === void 0 || entry.valueTable.length !== 168) {
+			if (entry.valueTable.includes("1")) unreadable += 1;
+			continue;
+		}
+		const existing = merged.get(trigger);
+		if (!existing) {
+			merged.set(trigger, [...entry.valueTable]);
+			continue;
+		}
+		for (let i = 0; i < existing.length; i += 1) if (entry.valueTable[i] === "1") existing[i] = "1";
+	}
+	const windows = [];
+	for (const [trigger, slots] of merged) windows.push(...weeklyMaskToWindows(slots.join(""), trigger));
+	return {
+		windows,
+		unreadable
+	};
+}
+/**
+* Fold the three reads into the cap's status.
+*
+* `tracks` is empty and `primaryTrackId` null on purpose: a Reolink
+* channel exposes no track list, and inventing one synthetic row would
+* put a fact in the UI that the camera never stated. The form renders
+* "the camera reports no recording track", which is true.
+*/
+function buildOnboardStatus(input) {
+	const { windows, unreadable } = parseSchedule(input.schedule);
+	const masterOn = input.schedule?.enable ?? null;
+	const scheduled = masterOn === true && windows.length > 0;
+	const cycle = input.cfg?.cycle;
+	return {
+		storage: input.storage,
+		tracks: [],
+		primaryTrackId: null,
+		enabled: masterOn,
+		overwriteWhenFull: cycle === void 0 ? null : cycle !== 0,
+		preRecordSec: input.cfg?.preRecordTime ?? null,
+		postRecordSec: input.cfg?.recordDelayTime ?? null,
+		segmentMinutes: input.cfg?.packageTime ?? null,
+		windows: [...windows],
+		unreadableWindows: unreadable,
+		recordingToNowhere: scheduled && input.storage.kind === "absent",
+		lastFetchedAt: input.now
+	};
+}
+/** Why a Reolink camera cannot be written until CamStack has read it. */
+var REOLINK_NOT_READ_REASON = "CamStack has not read this camera yet";
+/**
+* Why the schedule is unwritable when one trigger occupies several rows.
+*
+* An E1 Outdoor Pro lists `crossline`, `intrude` and `loitering` three times
+* each — one row per configured rule. The status READ merges them, because
+* the cap's question is "does this camera record on line-crossing". A write
+* cannot un-merge them: addressed by type alone it rewrites all three rules
+* with one mask (measured — `replaceItemValueTable` matches every row of a
+* type when no index is given), and the cap's patch carries no room to say
+* which rule an operator meant. So the schedule is REPORTED unwritable on
+* such a camera rather than writable and destructive.
+*/
+var REOLINK_MERGED_ROWS_REASON = "this camera stores several rules of the same kind (one row per configured rule) and CamStack cannot tell them apart, so writing the schedule would overwrite all of them with one mask";
+/** How many rows each trigger occupies, from the camera's own list. */
+function rowsPerTrigger(schedule) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const entry of schedule?.typeScheduleList ?? []) {
+		const trigger = TRIGGER_BY_TYPE[entry.type];
+		if (trigger === void 0) continue;
+		counts.set(trigger, (counts.get(trigger) ?? 0) + 1);
+	}
+	return counts;
+}
+/**
+* What THIS Reolink accepts.
+*
+* Writability is decided per field from the camera's OWN statement, never
+* from a vendor default:
+*
+*   - `overwriteWhenFull` needs `<cyclelist>` to offer both 0 and 1; the
+*     cap's field is a boolean and a camera offering one value cannot be
+*     set both ways. `<cyclelist>` IS enforced by the firmware (writing 7
+*     was answered 200 and dropped), so it is a real refusal.
+*   - `preRecordSec` is a two-member SET, not a span. The wire field is
+*     seconds and the firmware honours exactly two states: 0 is off, and
+*     5, 15 and 30 all read back as 10 — identically on two firmwares. A
+*     slider here would move and change nothing.
+*   - `postRecordSec` carries NO allowed set although the camera states
+*     `<timeList>`: that list is advisory, and a Home Hub offering
+*     `8,15,30` accepted and applied 20. Refusing against it would block a
+*     value the firmware honours, so the write goes through unconstrained
+*     and the read-back diff is what reports a value the camera dropped.
+*   - `segmentMinutes` likewise carries no bound, because no camera states
+*     one and an invented maximum refuses values the firmware may take.
+*/
+function buildOnboardOptions(input) {
+	const reached = input.status !== null;
+	const notRead = {
+		readable: false,
+		writable: false,
+		reason: REOLINK_NOT_READ_REASON
+	};
+	const writable = {
+		readable: true,
+		writable: true
+	};
+	const refuse = (reason) => ({
+		readable: true,
+		writable: false,
+		reason
+	});
+	if (!reached || input.limits === null) return {
+		enabled: notRead,
+		overwriteWhenFull: notRead,
+		preRecordSec: notRead,
+		postRecordSec: notRead,
+		segmentMinutes: notRead,
+		schedule: {
+			support: notRead,
+			granularityMinutes: 60,
+			triggers: [...REOLINK_TRIGGERS],
+			supportsOverlappingTriggers: true
+		}
+	};
+	const limits = input.limits;
+	const cycleChoices = limits.cycleList;
+	const overwrite = cycleChoices.includes(0) && cycleChoices.includes(1) ? writable : refuse(cycleChoices.length === 0 ? "this camera did not say which overwrite settings it accepts" : `this camera accepts only ${cycleChoices.join(", ")} for overwrite, so it cannot be switched both ways`);
+	const preRecord = limits.preRecordSupported ? writable : refuse("this camera reports no pre-record setting, so writing one would do nothing");
+	const merged = [...rowsPerTrigger(input.schedule).entries()].filter(([, count]) => count > 1);
+	const unreadable = input.status?.unreadableWindows ?? 0;
+	const scheduleSupport = unreadable > 0 ? refuse(`CamStack could not read ${String(unreadable)} of this camera's schedule rows, and a write would replace what it could not show`) : merged.length > 0 ? refuse(REOLINK_MERGED_ROWS_REASON) : writable;
+	return {
+		enabled: writable,
+		overwriteWhenFull: overwrite,
+		preRecordSec: preRecord,
+		...limits.preRecordSupported ? { preRecordSecAllowed: { values: [0, limits.preRecordSeconds ?? 10] } } : {},
+		postRecordSec: writable,
+		segmentMinutes: writable,
+		schedule: {
+			support: scheduleSupport,
+			granularityMinutes: 60,
+			triggers: [...REOLINK_TRIGGERS],
+			supportsOverlappingTriggers: true
+		}
+	};
+}
+/** The cap's trigger vocabulary → Reolink's schedule `type`. */
+var TYPE_BY_TRIGGER = Object.fromEntries(Object.entries(TRIGGER_BY_TYPE).filter((pair) => pair[1] !== void 0).map(([type, trigger]) => [trigger, type]));
+/**
+* Turn a cap patch into the two Baichuan writes.
+*
+* `windows` is the COMPLETE new set, so every trigger the camera lists gets
+* a row — including one the new set does not mention, which must be written
+* as an all-zero mask or the camera keeps recording on a trigger the
+* operator just removed. A trigger the camera does NOT list is skipped: a
+* row the camera never had is answered 200 and discarded, so sending it
+* would report success for nothing.
+*
+* `preRecordSec` collapses to the boolean the firmware really has: any
+* non-zero ask is "on", because 5, 15 and 30 all store as 10.
+*/
+function buildOnboardWrites(patch, schedule) {
+	const cfg = {};
+	if (patch.overwriteWhenFull !== void 0) cfg.cycle = patch.overwriteWhenFull ? 1 : 0;
+	if (patch.postRecordSec !== void 0) cfg.recordDelayTime = patch.postRecordSec;
+	if (patch.preRecordSec !== void 0) cfg.preRecordEnabled = patch.preRecordSec !== 0;
+	if (patch.segmentMinutes !== void 0) cfg.packageTime = patch.segmentMinutes;
+	const scheduleOut = {};
+	if (patch.enabled !== void 0) scheduleOut.enable = patch.enabled;
+	if (patch.windows !== void 0) {
+		const present = new Set((schedule?.typeScheduleList ?? []).map((e) => e.type));
+		const entries = [];
+		for (const trigger of REOLINK_TRIGGERS) {
+			const type = TYPE_BY_TRIGGER[trigger];
+			if (type === void 0 || !present.has(type)) continue;
+			entries.push({
+				type,
+				valueTable: windowsToWeeklyMask(patch.windows, trigger)
+			});
+		}
+		scheduleOut.entries = entries;
+	}
+	return {
+		cfg: Object.keys(cfg).length > 0 ? cfg : null,
+		schedule: Object.keys(scheduleOut).length > 0 ? scheduleOut : null
+	};
+}
+//#endregion
 //#region src/battery-charging.ts
 /**
 * Da `adapterStatus` + `chargeStatus` alla sorgente di alimentazione.
@@ -155618,6 +157284,82 @@ function decideSnapshotCameraAccess(input) {
 	};
 }
 //#endregion
+//#region src/sleep-state-decision.ts
+/**
+* Hysteresis is ASYMMETRIC, because the two directions have very different
+* costs when we get them wrong.
+*
+* `→ awake` (`WAKE_HYSTERESIS_MS`): expensive if wrong. Believing an asleep
+* camera is awake un-gates every background probe and makes `wakeForStream`
+* early-out without actually waking. Keep the window >= the library's UDP
+* inference cycle (~12 s on battery cams with idle-disconnect) and >= its
+* `getIdleDisconnectTimeoutMs` (30 s default).
+*
+* `→ sleeping` (`SLEEP_HYSTERESIS_MS`): cheap if wrong. Believing an awake
+* camera is asleep only means we skip background probes and serve cached
+* values; the demand paths still drive a real wake. The old symmetric 30 s
+* window was LONGER than the camera's own awake window (~14 s), so a natural
+* wake→sleep cycle had its `sleeping` transition dropped and the slice stayed
+* stuck on "awake" while the camera slept.
+*/
+var WAKE_HYSTERESIS_MS = 3e4;
+/** See {@link WAKE_HYSTERESIS_MS}. */
+var SLEEP_HYSTERESIS_MS = 5e3;
+/**
+* How long a freshly committed FIRST-HAND state is protected from a lagging
+* summary's awake→sleeping flip. The summary lags real pushes by over a
+* minute (measured >75 s on 2026-08-16); 3 min covers two full
+* discovery-refresh cycles of lag without letting a genuinely stuck "awake"
+* slice stand forever — the reconcile still wins after the grace, which is
+* exactly its recovery role.
+*/
+var HUB_SUMMARY_SLEEP_GRACE_MS = 18e4;
+/** A source whose verdict comes from the parent NVR's channel summary. */
+function isSummarySourced(source) {
+	return source === "hub-summary" || source === "hub-reconcile";
+}
+/**
+* Decide one commit. Pure: the caller owns the slice, the clock and the log.
+*
+* Order of the gates, and why:
+*  1. No-op first — re-asserting the current value is never a transition.
+*  2. A summary-sourced verdict is firmware state, not socket inference, so
+*     the anti-flap window does not apply to it at all.
+*  3. A `confirmed-wake` in the `→ awake` direction is first-hand evidence
+*     this process produced: gating it with the anti-flap window is what
+*     stranded 3825's mirror on "asleep" while `wakeForStream` answered
+*     `awoke: true`.
+*  4. Everything else is subject to the asymmetric hysteresis.
+*  5. A summary flip toward `sleeping` is refused while a first-hand
+*     observation inside the grace says otherwise.
+*/
+function decideSleepCommit(input) {
+	const { current, next, source, lastFirstHandCommitAt, nowMs } = input;
+	if (current === next) return { kind: "unchanged" };
+	const summarySourced = isSummarySourced(source);
+	const firstHandWake = source === "confirmed-wake" && next === false;
+	const sinceLastChangeMs = nowMs - lastFirstHandCommitAt;
+	if (!summarySourced && !firstHandWake) {
+		const windowMs = next ? SLEEP_HYSTERESIS_MS : WAKE_HYSTERESIS_MS;
+		if (lastFirstHandCommitAt > 0 && sinceLastChangeMs < windowMs) return {
+			kind: "refused",
+			reason: "hysteresis",
+			windowMs,
+			sinceLastChangeMs
+		};
+	}
+	if (summarySourced && next === true && lastFirstHandCommitAt > 0 && sinceLastChangeMs < 18e4) return {
+		kind: "refused",
+		reason: "summary-grace",
+		windowMs: HUB_SUMMARY_SLEEP_GRACE_MS,
+		sinceLastChangeMs
+	};
+	return {
+		kind: "commit",
+		stampFirstHand: source !== "hub-reconcile"
+	};
+}
+//#endregion
 //#region src/raw-state.ts
 /**
 * Source tag for every raw-state blob this provider emits.
@@ -158864,53 +160606,20 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 		return this.state.battery.sleeping ?? false;
 	}
 	/**
-	* Wall-clock ms when `this.sleeping` last flipped. Drives a
-	* hysteresis window that filters out the lib's UDP sleep-inference
-	* flapping. The lib runs an internal `getSleepStatus` every 2s on
-	* UDP/battery cameras and emits awake/sleeping events from socket
-	* I/O patterns alone — those events do NOT reflect real firmware
-	* state, especially on battery cams with idle-disconnect where
-	* socket activity drops periodically. Without this window every
-	* inferred flip would close active streams + emit a cap event.
+	* Wall-clock ms when a FIRST-HAND observation last moved `this.sleeping`.
+	*
+	* It drives two windows — the anti-flap hysteresis that filters the lib's
+	* UDP sleep inference, and the grace that stops the parent's LAGGING
+	* summary from clobbering a fresher verdict. Both want the same thing:
+	* "when did something that was actually looking at the camera last speak".
+	*
+	* The parent's periodic summary sweep (`hub-reconcile`) therefore never
+	* stamps this. It is firmware truth, but it is minutes old, and stamping
+	* it armed the 30 s wake window against the camera's own wake push — see
+	* `sleep-state-decision.ts` for the measurement (D603).
 	*/
 	sleepStateChangedAt = 0;
 	/**
-	* Hysteresis is ASYMMETRIC, because the two directions have very
-	* different costs when we get them wrong.
-	*
-	* `→ awake` (`WAKE_HYSTERESIS_MS`): expensive if wrong. Believing an
-	* asleep camera is awake un-gates every background probe
-	* (`refreshParentSettingsSnapshot`, the device-config cap refreshes,
-	* aux align) and makes `wakeForStream` early-out without actually
-	* waking. Keep the full window >= the lib's UDP inference cycle
-	* (~12s on battery cams with idle-disconnect) and >= the lib's
-	* `getIdleDisconnectTimeoutMs` (30s default), so neither an
-	* inference flap nor a transient socket close→reopen can walk us
-	* into a false "awake".
-	*
-	* `→ sleeping` (`SLEEP_HYSTERESIS_MS`): cheap if wrong. Believing an
-	* awake camera is asleep only means we skip background probes and
-	* serve cached values; the demand paths (`wakeForStream`,
-	* `wakeIfSleeping`) still drive a real wake. The old symmetric 30s
-	* window was LONGER than the camera's own awake window (~14s — see
-	* `onWakeTransition`), so a natural wake→sleep cycle had its
-	* `sleeping` transition dropped and the slice stayed stuck on
-	* "awake" while the camera slept: the exact "at rest we lose the
-	* sleeping state" symptom. 5s still absorbs a single 2s inference
-	* tick while tracking the real cycle.
-	*/
-	static WAKE_HYSTERESIS_MS = 3e4;
-	static SLEEP_HYSTERESIS_MS = 5e3;
-	/**
-	* How long a freshly committed state is protected from a hub-summary
-	* awake→sleeping flip. The summary's per-channel sleep flag lags real
-	* pushes by over a minute (measured >75 s on 2026-08-16); 3 min covers
-	* two full discovery-refresh cycles of lag without letting a genuinely
-	* stuck "awake" slice stand forever — the reconcile still wins after
-	* the grace, which is exactly its recovery role.
-	*/
-	static HUB_SUMMARY_SLEEP_GRACE_MS = 18e4;
-	/**
 	* Wall-clock ms of the last PROACTIVE wake — one we issued on our own
 	* initiative (background snapshot refresh), not because the operator
 	* or a stream consumer asked for the camera. Drives
@@ -159825,6 +161534,32 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 			await (await this.ensureApi()).reboot(this.getChannel());
 			return { success: true };
 		} });
+		this.ctx.registerNativeCap(deviceAdminLinkCapability, { getAdminLink: async ({ deviceId }) => {
+			if (deviceId !== this.id) throw new Error(`ReolinkCamera: deviceId mismatch, expected ${this.id}, got ${deviceId}`);
+			const host = this.config.get("host") ?? "";
+			const built = buildDeviceAdminUrl({
+				host,
+				port: null,
+				scheme: "http",
+				path: "/"
+			});
+			if (!built.ok) {
+				this.ctx.logger.debug("reolink admin link unavailable", {
+					tags: { deviceId: this.id },
+					meta: {
+						reason: built.reason,
+						transport: this.config.get("transport") ?? "tcp"
+					}
+				});
+				return null;
+			}
+			return {
+				url: built.url,
+				label: "Web UI",
+				target: "device",
+				host
+			};
+		} });
 		this.registerNetworkLink();
 		this.ctx.registerNativeCap(motionCapability, { isDetected: async ({ deviceId }) => {
 			if (deviceId !== this.id) throw new Error(`ReolinkCamera: deviceId mismatch, expected ${this.id}, got ${deviceId}`);
@@ -159871,6 +161606,7 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 		this.registerPrivacyMaskCap();
 		this.registerDayNightCap();
 		this.registerImageSettingsCap();
+		this.registerRecordingOnboardCap();
 		this.registerStreamCatalogProvider();
 		this.registerNativeObjectDetectionCap();
 		const cache = this.config.get("deviceCache");
@@ -159914,6 +161650,8 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	dayNightRefreshInFlight = null;
 	/** Single-flight guard for the `image-settings` cap refresh. */
 	imageSettingsRefreshInFlight = null;
+	/** Single-flight guard for the `recording-onboard` cap refresh. */
+	recordingOnboardRefreshInFlight = null;
 	/**
 	* Single-flight guard for snapshot fetches (Slice 10). When two
 	* consumers hit `getSnapshot` concurrently we issue ONE Baichuan
@@ -160115,35 +161853,6 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 		}
 	}
 	/**
-	* Decide whether to honour a sleep-state transition. Returns
-	* `false` when the lib's UDP inference is still inside the
-	* hysteresis window so we don't flap. The window is asymmetric —
-	* see `WAKE_HYSTERESIS_MS` / `SLEEP_HYSTERESIS_MS`. The first
-	* transition AFTER an api login / restart is always honoured —
-	* no prior-flip timestamp gating it.
-	*
-	* @param next - the desired next value of `this.sleeping`
-	* @returns `true` if the caller should commit the new state
-	*/
-	acceptSleepingTransition(next) {
-		if (this.sleeping === next) return false;
-		const now = Date.now();
-		const windowMs = next ? ReolinkCamera.SLEEP_HYSTERESIS_MS : ReolinkCamera.WAKE_HYSTERESIS_MS;
-		if (this.sleepStateChangedAt > 0 && now - this.sleepStateChangedAt < windowMs) {
-			this.ctx.logger.debug("ignoring sleep inference flap within hysteresis window", {
-				tags: { deviceId: this.id },
-				meta: {
-					next,
-					windowMs,
-					sinceLastChangeMs: now - this.sleepStateChangedAt
-				}
-			});
-			return false;
-		}
-		this.sleepStateChangedAt = now;
-		return true;
-	}
-	/**
 	* THE single writer of the `battery.sleeping` slice.
 	*
 	* Before this existed the state had three independent writers with
@@ -160154,38 +161863,38 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	* ancient timestamp). Funnelling every writer through here keeps one
 	* rule set and one timestamp.
 	*
-	* @param source - `'hub-summary'` is AUTHORITATIVE (the NVR reports
-	*   per-channel sleep state from its own firmware, not from socket
-	*   I/O inference) and therefore bypasses the hysteresis — with ONE
-	*   exception: the summary LAGS real push state (measured >75 s behind
-	*   an `awake` push, 2026-08-16), so an awake→sleeping flip from the
-	*   summary is refused while a fresher committed state is still inside
-	*   `HUB_SUMMARY_SLEEP_GRACE_MS`. Without the guard the 60 s reconcile
-	*   clobbered the fresh awake right back to sleeping for a full cycle —
-	*   the viewer flashed the live frame, then the sleeping overlay, then
-	*   live again. Sleeping→awake from the summary is always honoured
-	*   (it strands nothing; the camera wakes regardless).
+	* The rule itself lives in `sleep-state-decision.ts`, pure, so it can be
+	* driven by a test instead of asserted from this file's source text. Read
+	* that module for why `hub-reconcile` — the parent's periodic summary
+	* sweep — stamps nothing: it lags real state by more than a minute, and
+	* arming the anti-flap window from it threw away the camera's real wake
+	* for up to 2 min 26 s on the live hub (D603).
+	*
 	* @returns `true` when the slice actually changed.
 	*/
 	commitSleepState(next, source) {
 		if (!this.isBattery) return false;
-		if (this.sleeping === next) return false;
-		if (source === "confirmed-wake" && next === false) this.sleepStateChangedAt = Date.now();
-		else if (source !== "hub-summary" && !this.acceptSleepingTransition(next)) return false;
-		if (source === "hub-summary") {
-			const sinceCommitMs = Date.now() - this.sleepStateChangedAt;
-			if (next === true && this.sleepStateChangedAt > 0 && sinceCommitMs < ReolinkCamera.HUB_SUMMARY_SLEEP_GRACE_MS) {
-				this.ctx.logger.debug("hub-summary sleep flip refused — fresher state inside grace", {
-					tags: { deviceId: this.id },
-					meta: {
-						sinceCommitMs,
-						graceMs: ReolinkCamera.HUB_SUMMARY_SLEEP_GRACE_MS
-					}
-				});
-				return false;
-			}
-			this.sleepStateChangedAt = Date.now();
+		const decision = decideSleepCommit({
+			current: this.sleeping,
+			next,
+			source,
+			lastFirstHandCommitAt: this.sleepStateChangedAt,
+			nowMs: Date.now()
+		});
+		if (decision.kind === "unchanged") return false;
+		if (decision.kind === "refused") {
+			this.ctx.logger.debug(decision.reason === "hysteresis" ? "ignoring sleep inference flap within hysteresis window" : "hub-summary sleep flip refused — fresher first-hand state inside grace", {
+				tags: { deviceId: this.id },
+				meta: {
+					next,
+					source,
+					windowMs: decision.windowMs,
+					sinceLastChangeMs: decision.sinceLastChangeMs
+				}
+			});
+			return false;
 		}
+		if (decision.stampFirstHand) this.sleepStateChangedAt = Date.now();
 		this.state.battery.sleeping = next;
 		this.ctx.logger.info("battery sleep state committed", {
 			tags: { deviceId: this.id },
@@ -160212,7 +161921,7 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	*/
 	applyHubSleepState(sleeping) {
 		if (!this.isBattery) return;
-		if (this.commitSleepState(sleeping, "hub-summary") && !sleeping) this.onWakeTransition("hub-summary").catch(() => {});
+		if (this.commitSleepState(sleeping, "hub-reconcile") && !sleeping) this.onWakeTransition("hub-reconcile").catch(() => {});
 	}
 	/**
 	* Rate-limit for wakes we issue on our OWN initiative. Returns
@@ -161909,6 +163618,173 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	*   denormalized against the camera's OWN probed threshold range
 	*   (never a hardcoded 0..255 guess).
 	*/
+	/**
+	* Register the vendor-neutral `recording-onboard` cap.
+	*
+	* READ-ONLY on Reolink, and it says so per field. `@apocaliss92/
+	* nodelink-js` exposes a reader for the record config and the record
+	* schedule and no writer; the Baichuan SET command ids exist but
+	* nothing in this repo has ever sent them, and the only route is
+	* hand-built XML through the generic passthrough. So `getOptions`
+	* reports every field `writable: false` with
+	* {@link REOLINK_NO_WRITE_REASON}, the UI renders each control
+	* disabled WITH that sentence — disabled must not look like broken —
+	* and `setSettings` refuses by name instead of accepting a write and
+	* dropping it.
+	*
+	* The cap's FIELD SET is identical to Hikvision's. Only the answers
+	* differ.
+	*/
+	registerRecordingOnboardCap() {
+		const channel = this.getChannel();
+		const CAP_NAME = "recording-onboard";
+		const emptyStatus = () => ({
+			storage: {
+				kind: "unknown",
+				reason: "CamStack has not read this camera yet."
+			},
+			tracks: [],
+			primaryTrackId: null,
+			enabled: null,
+			overwriteWhenFull: null,
+			preRecordSec: null,
+			postRecordSec: null,
+			segmentMinutes: null,
+			windows: [],
+			unreadableWindows: 0,
+			recordingToNowhere: false,
+			lastFetchedAt: 0
+		});
+		/** Last `getRecordCfg` reply. */
+		let lastCfg = null;
+		/** Last `getRecordCfgLimits` — what the camera says it accepts. */
+		let lastLimits = null;
+		/** Last schedule read — which trigger rows this camera actually has. */
+		let lastSchedule = null;
+		const refreshFromCamera = async () => {
+			if (this.recordingOnboardRefreshInFlight) return this.recordingOnboardRefreshInFlight;
+			const promise = (async () => {
+				try {
+					const api = await this.ensureApi();
+					const [cfg, limits, schedule, hdd] = await Promise.all([
+						api.getRecordCfg(channel).catch(() => null),
+						api.getRecordCfgLimits(channel).catch(() => null),
+						api.getRecordSchedule(channel).catch(() => null),
+						this.isHubChild() ? Promise.resolve(null) : api.getHddInfoList().catch(() => null)
+					]);
+					lastCfg = cfg;
+					lastLimits = limits;
+					lastSchedule = schedule;
+					const next = buildOnboardStatus({
+						storage: this.isHubChild() ? {
+							kind: "unknown",
+							reason: "This camera hangs off a Reolink Hub, so its footage lives on the Hub’s disk, not on a card of its own."
+						} : hdd === null ? {
+							kind: "unknown",
+							reason: "The camera did not answer the storage read."
+						} : parseOnboardStorage(hdd),
+						cfg,
+						schedule,
+						now: Date.now()
+					});
+					this.runtimeState.setCapState(CAP_NAME, next);
+					if (next.recordingToNowhere) this.ctx.logger.warn("reolink onboard recording: camera is scheduled to record and has no usable storage", {
+						tags: { deviceId: this.id },
+						meta: { windows: next.windows.length }
+					});
+					if (next.unreadableWindows > 0) this.ctx.logger.warn("reolink onboard recording: some schedule tables could not be read — the schedule shown is incomplete", {
+						tags: { deviceId: this.id },
+						meta: {
+							unreadableWindows: next.unreadableWindows,
+							readWindows: next.windows.length
+						}
+					});
+				} catch (err) {
+					this.ctx.logger.debug("reolink onboard recording refresh failed — keeping last slice", {
+						tags: { deviceId: this.id },
+						meta: { error: err instanceof Error ? err.message : String(err) }
+					});
+				}
+			})();
+			this.recordingOnboardRefreshInFlight = promise;
+			try {
+				await promise;
+			} finally {
+				this.recordingOnboardRefreshInFlight = null;
+			}
+		};
+		const bridge = createRuntimeStateBridge({
+			runtimeState: this.runtimeState,
+			cap: recordingOnboardCapability,
+			ownDeviceId: this.id,
+			refresh: this.sleepGatedRefresh(CAP_NAME, refreshFromCamera),
+			staleMs: OPERATOR_WRITTEN_STALE_MS,
+			staleRead: "serve-and-revalidate",
+			empty: emptyStatus
+		});
+		const readOptions = () => buildOnboardOptions({
+			status: this.runtimeState.getCapState(CAP_NAME) ?? null,
+			cfg: lastCfg,
+			limits: lastLimits,
+			schedule: lastSchedule
+		});
+		const provider = {
+			getStatus: bridge.getStatus,
+			getOptions: async ({ deviceId }) => {
+				if (deviceId !== this.id) throw new Error(`ReolinkCamera: deviceId mismatch, expected ${this.id}, got ${deviceId}`);
+				await bridge.ensureFresh();
+				return readOptions();
+			},
+			setSettings: async ({ deviceId, settings }) => {
+				if (deviceId !== this.id) return;
+				if (Object.keys(settings).length === 0) return;
+				await bridge.ensureFresh();
+				const refusal = describeOnboardRefusal(readOptions(), settings);
+				if (refusal !== null) {
+					this.ctx.logger.warn("reolink onboard recording: refusing a write this camera cannot take", {
+						tags: { deviceId: this.id },
+						meta: {
+							refusal,
+							fields: Object.keys(settings)
+						}
+					});
+					throw new Error(`device ${String(this.id)}: ${refusal}`);
+				}
+				const writes = buildOnboardWrites(settings, lastSchedule);
+				const api = await this.ensureApi();
+				const ignored = [];
+				if (writes.cfg !== null) {
+					const result = await api.setRecordCfg(channel, writes.cfg);
+					for (const outcome of result.outcomes) if (outcome.status === "ignored") ignored.push(`${outcome.field}: asked ${outcome.requested}, camera kept ${outcome.actual}`);
+				}
+				if (writes.schedule !== null) {
+					const result = await api.setRecordSchedule(channel, writes.schedule);
+					for (const outcome of result.outcomes) if (outcome.status === "ignored") ignored.push(`schedule ${outcome.field}: the camera kept its own value`);
+				}
+				await refreshFromCamera();
+				if (ignored.length > 0) {
+					this.ctx.logger.warn("reolink onboard recording: the camera answered 200 and discarded part of the write", {
+						tags: { deviceId: this.id },
+						meta: {
+							ignored,
+							fields: Object.keys(settings)
+						}
+					});
+					throw new Error(`device ${String(this.id)}: the camera accepted the request and kept its own values — ${ignored.join("; ")}`);
+				}
+				this.ctx.logger.info("reolink onboard recording: write applied", {
+					tags: { deviceId: this.id },
+					meta: { fields: Object.keys(settings) }
+				});
+			}
+		};
+		this.registerCapWarmer(CAP_NAME, async () => {
+			await provider.getOptions({ deviceId: this.id });
+			await refreshFromCamera();
+		});
+		this.ctx.registerNativeCap(recordingOnboardCapability, provider);
+		this.ctx.logger.info("Reolink recording-onboard cap registered", { tags: { deviceId: this.id } });
+	}
 	registerDayNightCap() {
 		const channel = this.getChannel();
 		const CAP_NAME = "day-night";
@@ -166338,6 +168214,29 @@ var ReolinkHub = class ReolinkHub extends BaseDevice {
 			await (await this.ensureApi()).reboot();
 			return { success: true };
 		} });
+		this.ctx.registerNativeCap(deviceAdminLinkCapability, { getAdminLink: async ({ deviceId }) => {
+			if (deviceId !== this.id) throw new Error(`ReolinkHub: deviceId mismatch, expected ${this.id}, got ${deviceId}`);
+			const host = this.config.get("host") ?? "";
+			const built = buildDeviceAdminUrl({
+				host,
+				port: null,
+				scheme: "http",
+				path: "/"
+			});
+			if (!built.ok) {
+				this.ctx.logger.debug("reolink hub admin link unavailable", {
+					tags: { deviceId: this.id },
+					meta: { reason: built.reason }
+				});
+				return null;
+			}
+			return {
+				url: built.url,
+				label: "Web UI",
+				target: "device",
+				host
+			};
+		} });
 	}
 	async onActivate() {
 		this.ensureApi().catch((err) => {