@camstack/addon-provider-reolink 1.2.219 → 1.2.220

package/dist/addon.mjs

@@ -22,10 +22,8 @@ import { setInterval as setInterval$1 } from "timers";
 import * as net2 from "net";
 import netImpl from "net";
 import { mkdir as mkdir$1 } from "fs/promises";
-import http from "http";
-import { URL as URL$1 } from "url";
 import { spawn as spawn$1 } from "node:child_process";
-import os, { tmpdir } from "node:os";
+import { tmpdir } from "node:os";
 import { createReadStream } from "node:fs";
 //#region ../../node_modules/undici/lib/core/symbols.js
 var require_symbols = /* @__PURE__ */ __commonJSMin(((exports, module) => {
@@ -7769,7 +7767,7 @@ var require_client_h2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 var require_client = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var assert$21 = __require("node:assert");
 	var net$5 = __require("node:net");
-	var http$2 = __require("node:http");
+	var http$1 = __require("node:http");
 	var util = require_util$9();
 	var { ClientStats } = require_stats();
 	var { channels } = require_diagnostics();
@@ -7781,7 +7779,7 @@ var require_client = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var connectH1 = require_client_h1();
 	var connectH2 = require_client_h2();
 	var kClosedResolve = Symbol("kClosedResolve");
-	var getDefaultNodeMaxHeaderSize = http$2 && http$2.maxHeaderSize && Number.isInteger(http$2.maxHeaderSize) && http$2.maxHeaderSize > 0 ? () => http$2.maxHeaderSize : () => {
+	var getDefaultNodeMaxHeaderSize = http$1 && http$1.maxHeaderSize && Number.isInteger(http$1.maxHeaderSize) && http$1.maxHeaderSize > 0 ? () => http$1.maxHeaderSize : () => {
 		throw new InvalidArgumentError("http module not available or http.maxHeaderSize invalid");
 	};
 	var noop = () => {};
@@ -9180,7 +9178,7 @@ var require_socks5_client = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 //#endregion
 //#region ../../node_modules/undici/lib/dispatcher/socks5-proxy-agent.js
 var require_socks5_proxy_agent = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var { URL: URL$2 } = __require("node:url");
+	var { URL: URL$1 } = __require("node:url");
 	var tls;
 	var DispatcherBase = require_dispatcher_base();
 	var { InvalidArgumentError } = require_errors$1();
@@ -9209,7 +9207,7 @@ var require_socks5_proxy_agent = /* @__PURE__ */ __commonJSMin(((exports, module
 				experimentalWarningEmitted = true;
 			}
 			if (!proxyUrl) throw new InvalidArgumentError("Proxy URL is mandatory");
-			const url = typeof proxyUrl === "string" ? new URL$2(proxyUrl) : proxyUrl;
+			const url = typeof proxyUrl === "string" ? new URL$1(proxyUrl) : proxyUrl;
 			if (url.protocol !== "socks5:" && url.protocol !== "socks:") throw new InvalidArgumentError("Proxy URL must use socks5:// or socks:// protocol");
 			this[kProxyUrl] = url;
 			this[kProxyHeaders] = options.headers || {};
@@ -9307,7 +9305,7 @@ var require_socks5_proxy_agent = /* @__PURE__ */ __commonJSMin(((exports, module
 						connections: opts.connections,
 						connect: async (connectOpts, callback) => {
 							try {
-								const url = new URL$2(origin);
+								const url = new URL$1(origin);
 								const targetHost = url.hostname;
 								const targetPort = parseInt(url.port) || (url.protocol === "https:" ? 443 : 80);
 								debug("establishing SOCKS5 connection to", targetHost, targetPort);
@@ -39077,19 +39075,10 @@ function mapBaichuanWebhookAlarmXmlToSimpleEvents(xml) {
 	return [...out];
 }
 var emitter2 = new EventEmitter();
-var lastEventByCamera2 = /* @__PURE__ */ new Map();
-var MAX_GLOBAL_EVENTS2 = 300;
-var globalRecentEvents2 = [];
 function onBaichuanWebhookEvent(handler) {
 	emitter2.on("event", handler);
 	return () => emitter2.off("event", handler);
 }
-function emitBaichuanWebhookEvent(event) {
-	lastEventByCamera2.set(event.cameraId, event);
-	globalRecentEvents2.unshift(event);
-	if (globalRecentEvents2.length > MAX_GLOBAL_EVENTS2) globalRecentEvents2.length = MAX_GLOBAL_EVENTS2;
-	emitter2.emit("event", event);
-}
 function mapBaichuanWebhookToSimpleEvents(event) {
 	const name = (event.event ?? "").toLowerCase();
 	if (name === "sleep") return ["sleeping"];
@@ -54964,7 +54953,7 @@ var require_smtp_connection = /* @__PURE__ */ __commonJSMin(((exports, module) =
 	var ipv6normalize = require_ipv6_normalize();
 	var sasl = require_sasl();
 	var crypto$5 = __require("crypto");
-	var os$2 = __require("os");
+	var os$1 = __require("os");
 	var punycode = (init_punycode_es6(), __toCommonJS(punycode_es6_exports));
 	var EventEmitter$2 = __require("events");
 	var SOCKET_TIMEOUT = 60 * 1e3;
@@ -55063,7 +55052,7 @@ var require_smtp_connection = /* @__PURE__ */ __commonJSMin(((exports, module) =
 			this._unauthenticatedCommands = 0;
 			this._maxAllowedUnauthenticatedCommands = this._server.options.maxAllowedUnauthenticatedCommands || 10;
 			this._unrecognizedCommands = 0;
-			this.name = this._server.options.name || os$2.hostname();
+			this.name = this._server.options.name || os$1.hostname();
 			this.clientHostname = false;
 			this.openingCommand = false;
 			this.hostNameAppearsAs = false;
@@ -56884,7 +56873,7 @@ var require_errors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/nodemailer/lib/fetch/index.js
 var require_fetch = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var http$1 = __require("http");
+	var http = __require("http");
 	var https = __require("https");
 	var urllib = require_url();
 	var zlib = __require("zlib");
@@ -56916,7 +56905,7 @@ var require_fetch = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		let finished = false;
 		let cookies;
 		let body;
-		const handler = parsed.protocol === "https:" ? https : http$1;
+		const handler = parsed.protocol === "https:" ? https : http;
 		const headers = {
 			"accept-encoding": "gzip,deflate",
 			"user-agent": "nodemailer/" + packageData.version
@@ -57103,7 +57092,7 @@ var require_shared = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var errors = require_errors();
 	var dns$1 = __require("dns");
 	var net$1 = __require("net");
-	var os$1 = __require("os");
+	var os = __require("os");
 	var DNS_TTL = 300 * 1e3;
 	var CACHE_CLEANUP_INTERVAL = 30 * 1e3;
 	var MAX_CACHE_SIZE = 1e3;
@@ -57114,7 +57103,7 @@ var require_shared = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	};
 	var networkInterfaces;
 	try {
-		networkInterfaces = os$1.networkInterfaces();
+		networkInterfaces = os.networkInterfaces();
 	} catch (_err) {}
 	module.exports.networkInterfaces = networkInterfaces;
 	var isFamilySupported = (family, allowInternal) => {
@@ -100697,180 +100686,6 @@ function parseBaichuanWebhookObject(mess) {
 	if (typeof dataRaw.reason === "string") parsed.reason = dataRaw.reason;
 	return parsed;
 }
-function normalizePrefix(prefix) {
-	const raw = (prefix ?? "/webhook").trim() || "/webhook";
-	return (raw.startsWith("/") ? raw : `/${raw}`).replace(/\/+$/, "") || "/webhook";
-}
-function getCameraWebhookPath(cameraId, pathPrefix = "/webhook") {
-	return `${normalizePrefix(pathPrefix)}/${encodeURIComponent(cameraId)}`;
-}
-function createBaichuanWebhookServer(params) {
-	const log = {
-		debug: params.logger?.debug ?? (() => {}),
-		info: params.logger?.info ?? (() => {}),
-		warn: params.logger?.warn ?? (() => {}),
-		error: params.logger?.error ?? (() => {})
-	};
-	let config = params.config;
-	let enabled = params.enabled !== false;
-	let server;
-	let status = buildInitialStatus2(config, enabled);
-	const resolve = params.cameraResolver ?? ((id) => id ? id : void 0);
-	function pathPrefix() {
-		return normalizePrefix(config.pathPrefix);
-	}
-	function maxBody() {
-		return config.maxBodyBytes && config.maxBodyBytes > 0 ? config.maxBodyBytes : 64 * 1024;
-	}
-	async function handle(req, res) {
-		try {
-			if (req.method !== "POST" && req.method !== "PUT") {
-				res.writeHead(405, { "Content-Type": "text/plain" });
-				res.end("Method Not Allowed");
-				status.messagesRejected += 1;
-				return;
-			}
-			const host = req.headers.host ?? "localhost";
-			const url = new URL$1(req.url ?? "/", `http://${host}`);
-			const prefix = pathPrefix();
-			if (!url.pathname.startsWith(prefix + "/") && url.pathname !== prefix) {
-				res.writeHead(404, { "Content-Type": "text/plain" });
-				res.end("Not Found");
-				status.messagesRejected += 1;
-				return;
-			}
-			const rest = url.pathname.slice(prefix.length).replace(/^\/+/, "");
-			const cameraId = resolve(decodeURIComponent(rest.split("/")[0] ?? ""));
-			if (!cameraId) {
-				res.writeHead(404, { "Content-Type": "text/plain" });
-				res.end("Unknown camera");
-				status.messagesRejected += 1;
-				return;
-			}
-			const chunks = [];
-			let total = 0;
-			const limit = maxBody();
-			for await (const chunk of req) {
-				const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-				total += buf.length;
-				if (total > limit) {
-					res.writeHead(413, { "Content-Type": "text/plain" });
-					res.end("Payload Too Large");
-					status.messagesRejected += 1;
-					return;
-				}
-				chunks.push(buf);
-			}
-			const body = Buffer.concat(chunks);
-			const parsed = parseBaichuanWebhookBody(body);
-			if (!parsed) {
-				log.warn(`Baichuan webhook: unparseable body for camera=${cameraId} (${body.length}B)`);
-				res.writeHead(400, { "Content-Type": "text/plain" });
-				res.end("Bad Request");
-				status.messagesRejected += 1;
-				return;
-			}
-			const event = {
-				cameraId,
-				event: parsed.kind === "event" ? parsed.event : `cmd_${parsed.cmdId}`,
-				...parsed.kind === "event" && parsed.reason ? { reason: parsed.reason } : {},
-				receivedAtMs: Date.now(),
-				raw: parsed
-			};
-			emitBaichuanWebhookEvent(event);
-			status.messagesAccepted += 1;
-			log.debug(`Baichuan webhook camera=${cameraId} event=${event.event}` + (event.reason ? ` reason=${event.reason}` : ""));
-			res.writeHead(200, { "Content-Type": "text/plain" });
-			res.end("OK");
-		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
-			status.lastErrorMessage = msg;
-			status.messagesRejected += 1;
-			log.error(`Baichuan webhook handler error: ${msg}`);
-			if (!res.headersSent) {
-				res.writeHead(500, { "Content-Type": "text/plain" });
-				res.end("Error");
-			}
-		}
-	}
-	async function start() {
-		if (server) {
-			log.debug("startBaichuanWebhookServer called but server already running");
-			return;
-		}
-		enabled = true;
-		server = http.createServer((req, res) => {
-			handle(req, res);
-		});
-		await new Promise((resolveListen, reject) => {
-			server.once("error", (err) => {
-				status.lastErrorMessage = err.message;
-				status.running = false;
-				reject(err);
-			});
-			server.listen(config.port, config.bindHost, () => {
-				const addr = server.address();
-				if (addr && typeof addr === "object") status.port = addr.port;
-				status.running = true;
-				status.enabled = true;
-				status.startedAtMs = Date.now();
-				status.lastErrorMessage = void 0;
-				log.info(`Baichuan webhook listening on ${config.bindHost}:${status.port} (prefix=${pathPrefix()})`);
-				resolveListen();
-			});
-		});
-	}
-	async function stop() {
-		const srv = server;
-		server = void 0;
-		if (!srv) {
-			status.running = false;
-			return;
-		}
-		await new Promise((resolveStop) => {
-			srv.close(() => resolveStop());
-		});
-		status.running = false;
-		log.info("Baichuan webhook server stopped");
-	}
-	return {
-		start,
-		stop,
-		async restart() {
-			await stop();
-			await start();
-		},
-		getStatus() {
-			return {
-				...status,
-				enabled,
-				pathPrefix: pathPrefix()
-			};
-		},
-		updateConfig(next) {
-			config = next;
-			status.port = next.port;
-			status.bindHost = next.bindHost;
-			status.pathPrefix = normalizePrefix(next.pathPrefix);
-		},
-		getCameraWebhookPath(cameraId) {
-			return getCameraWebhookPath(cameraId, pathPrefix());
-		}
-	};
-}
-function buildInitialStatus2(config, enabled) {
-	return {
-		enabled,
-		running: false,
-		port: config.port,
-		bindHost: config.bindHost,
-		pathPrefix: normalizePrefix(config.pathPrefix),
-		messagesAccepted: 0,
-		messagesRejected: 0,
-		startedAtMs: void 0,
-		lastErrorMessage: void 0
-	};
-}
 //#endregion
 //#region ../types/dist/event-category-BmPm98n0.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
@@ -106715,7 +106530,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-QsoHs66J.mjs
+//#region ../types/dist/sleep-hmSP-eJt.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -110367,6 +110182,7 @@ var CAP_NAMES = Object.freeze([
 	"backup",
 	"battery",
 	"binary",
+	"board-key-source",
 	"brightness",
 	"broker",
 	"button",
@@ -110488,6 +110304,7 @@ var CAP_NAMES = Object.freeze([
 	"privacy-mask",
 	"ptz",
 	"ptz-autotrack",
+	"pump-cycle",
 	"reboot",
 	"record-entries",
 	"recording",
@@ -111780,18 +111597,6 @@ Object.freeze({
 			"path": "pumpRunning",
 			"valueType": "boolean"
 		},
-		{
-			"path": "pumpIntervalEnabled",
-			"valueType": "boolean"
-		},
-		{
-			"path": "pumpOnTime",
-			"valueType": "number"
-		},
-		{
-			"path": "pumpOffTime",
-			"valueType": "number"
-		},
 		{
 			"path": "lastDrink",
 			"valueType": "number"
@@ -111915,6 +111720,20 @@ Object.freeze({
 			"valueType": "number"
 		}
 	],
+	"pump-cycle": [
+		{
+			"path": "enabled",
+			"valueType": "boolean"
+		},
+		{
+			"path": "onTime",
+			"valueType": "number"
+		},
+		{
+			"path": "offTime",
+			"valueType": "number"
+		}
+	],
 	"recording-archive": [
 		{
 			"path": "deviceId",
@@ -114818,6 +114637,16 @@ var MigrationPlanSchema = object({ edits: array(discriminatedUnion("op", [
 		precondition: PreconditionSchema
 	})
 ])) });
+/** `JSON.stringify` with object keys sorted, so equal values spell the same. */
+function canonicalJson(value) {
+	if (Array.isArray(value)) return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
+	if (typeof value === "object" && value !== null) return `{${Object.entries(value).filter(([, item]) => item !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`).join(",")}}`;
+	return JSON.stringify(value) ?? "null";
+}
+/** The precondition string for a value a plan read (`null` when it read nothing). */
+function preconditionOf(value) {
+	return canonicalJson(value ?? null);
+}
 /**
 * What a `procedure` body reports. `already-done` means the rerun observed the
 * work finished (a crash between the work and the ledger row, or a manual fix)
@@ -120548,24 +120377,52 @@ var APPLIANCE_CAP_VOCABULARY = {
 				args: { on: false }
 			},
 			{
-				id: "petFountain.intervalOn",
-				method: "setPumpInterval",
+				id: "petFountain.resetDailyConsumption",
+				method: "resetDailyConsumption",
+				label: t("Clear daily consumption", "Azzera il consumo giornaliero"),
+				phrase: t("Clear the daily water consumption of {device}", "Azzera il consumo giornaliero di acqua di {device}"),
+				icon: "rotate-ccw"
+			}
+		],
+		state: [{
+			kind: "boolean",
+			field: "empty",
+			label: t("Tank empty", "Serbatoio vuoto"),
+			whenTrue: t("When the tank of {device} is empty", "Quando il serbatoio di {device} è vuoto"),
+			whenFalse: t("When the tank of {device} is refilled", "Quando il serbatoio di {device} viene riempito"),
+			icon: "droplet"
+		}, {
+			kind: "numeric",
+			field: "waterLevel",
+			quantity: t("the water level", "il livello dell’acqua"),
+			label: t("Water level", "Livello dell’acqua"),
+			unit: "%",
+			icon: "droplets"
+		}]
+	},
+	"pump-cycle": {
+		scope: "device",
+		noun: t("Pump cycle", "Ciclo della pompa"),
+		actions: [
+			{
+				id: "pumpCycle.on",
+				method: "setEnabled",
 				label: t("Pump cycle on", "Ciclo pompa attivo"),
 				phrase: t("Run the pump of {device} on its on/off cycle", "Fai lavorare la pompa di {device} a ciclo acceso/spento"),
 				icon: "timer",
 				args: { on: true }
 			},
 			{
-				id: "petFountain.intervalOff",
-				method: "setPumpInterval",
+				id: "pumpCycle.off",
+				method: "setEnabled",
 				label: t("Pump cycle off", "Ciclo pompa spento"),
 				phrase: t("Run the pump of {device} continuously", "Fai lavorare la pompa di {device} in continuo"),
 				icon: "timer-off",
 				args: { on: false }
 			},
 			{
-				id: "petFountain.pumpOnMinutes",
-				method: "setPumpOnMinutes",
+				id: "pumpCycle.onMinutes",
+				method: "setOnMinutes",
 				label: t("Set pump run time", "Imposta il tempo di lavoro della pompa"),
 				phrase: t("Set the pump of {device} to run {minutes} minutes per cycle", "Imposta la pompa di {device} a lavorare {minutes} minuti per ciclo"),
 				icon: "timer",
@@ -120581,8 +120438,8 @@ var APPLIANCE_CAP_VOCABULARY = {
 				}]
 			},
 			{
-				id: "petFountain.pumpOffMinutes",
-				method: "setPumpOffMinutes",
+				id: "pumpCycle.offMinutes",
+				method: "setOffMinutes",
 				label: t("Set pump rest time", "Imposta il tempo di riposo della pompa"),
 				phrase: t("Set the pump of {device} to rest {minutes} minutes per cycle", "Imposta la pompa di {device} a riposare {minutes} minuti per ciclo"),
 				icon: "timer-off",
@@ -120596,29 +120453,15 @@ var APPLIANCE_CAP_VOCABULARY = {
 						unit: "min"
 					}
 				}]
-			},
-			{
-				id: "petFountain.resetDailyConsumption",
-				method: "resetDailyConsumption",
-				label: t("Clear daily consumption", "Azzera il consumo giornaliero"),
-				phrase: t("Clear the daily water consumption of {device}", "Azzera il consumo giornaliero di acqua di {device}"),
-				icon: "rotate-ccw"
 			}
 		],
 		state: [{
 			kind: "boolean",
-			field: "empty",
-			label: t("Tank empty", "Serbatoio vuoto"),
-			whenTrue: t("When the tank of {device} is empty", "Quando il serbatoio di {device} è vuoto"),
-			whenFalse: t("When the tank of {device} is refilled", "Quando il serbatoio di {device} viene riempito"),
-			icon: "droplet"
-		}, {
-			kind: "numeric",
-			field: "waterLevel",
-			quantity: t("the water level", "il livello dell’acqua"),
-			label: t("Water level", "Livello dell’acqua"),
-			unit: "%",
-			icon: "droplets"
+			field: "enabled",
+			label: t("Pump cycle", "Ciclo pompa"),
+			whenTrue: t("When {device} starts running its pump on a cycle", "Quando {device} inizia a far lavorare la pompa a ciclo"),
+			whenFalse: t("When {device} runs its pump continuously", "Quando {device} fa lavorare la pompa in continuo"),
+			icon: "timer"
 		}]
 	},
 	"media-player": {
@@ -122511,6 +122354,7 @@ var SYSTEM_CAP_VOCABULARY = {
 	"audio-analyzer": system(PIPELINE),
 	"audio-codec": system(INTERNAL),
 	"auth-provider": system(IDENTITY),
+	"board-key-source": system(INTERNAL),
 	backup: system("system backups — run and restored from the Backups page"),
 	broker: system("message-broker connections — configured, not actuated"),
 	"calendar-source": system(INTERNAL),
@@ -147420,6 +147264,49 @@ var binaryCapability = {
 	volatileStateFields: ["lastChangedAt"]
 };
 /**
+* Why a board key could not be read. Typed so a caller reports the cause and
+* never treats "could not read" as "has no key" (D49).
+*/
+var BoardKeyFailureReasonSchema = _enum([
+	"unknown-source",
+	"not-admin",
+	"no-builder",
+	"no-ingress-url",
+	"unreachable",
+	"unknown-board",
+	"no-encryption-key",
+	"unreadable-config"
+]);
+var BoardKeySourceSchema = object({
+	sourceId: string(),
+	name: string()
+});
+var BoardKeyBoardSchema = object({
+	/** The builder's file name, e.g. `kitchen.yaml`: the handle `getBoardKey` takes. */
+	configuration: string(),
+	/** The node name the builder gives the board. */
+	name: string(),
+	/** The address the builder knows the board by, when it has one. */
+	address: string().nullable()
+});
+var BoardKeyFailureSchema = object({
+	ok: literal(false),
+	reason: BoardKeyFailureReasonSchema,
+	detail: string().optional()
+});
+var ListBoardsResultSchema = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	boards: array(BoardKeyBoardSchema).readonly()
+}), BoardKeyFailureSchema]);
+var GetBoardKeyResultSchema = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	key: string()
+}), BoardKeyFailureSchema]);
+method(_void(), array(BoardKeySourceSchema).readonly(), { auth: "admin" }), method(object({ sourceId: string().min(1) }), ListBoardsResultSchema, { auth: "admin" }), method(object({
+	sourceId: string().min(1),
+	configuration: string().min(1)
+}), GetBoardKeyResultSchema, { auth: "admin" });
+/**
 * Dimmable-light brightness control. Co-exists with `switch` on the
 * same device — the switch toggles on/off, this cap sets the level
 * applied when the light is on. Drivers map their per-vendor dim
@@ -154057,7 +153944,7 @@ var DishwasherStatusSchema = object({
 	/** Ms epoch of the last value received from the appliance; 0 = never. */
 	lastFetchedAt: number()
 });
-var DeviceIdSchema$1 = number().int().nonnegative();
+var DeviceIdSchema$2 = number().int().nonnegative();
 /** A value a program option or setting can take. */
 var DishwasherValueSchema = union([
 	boolean(),
@@ -154132,77 +154019,77 @@ var dishwasherCapability = {
 		* option feature keys; each is checked against the program's constraints.
 		*/
 		start: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			program: string().min(1).optional(),
 			options: record(string(), DishwasherValueSchema).optional()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
-		pause: method(object({ deviceId: DeviceIdSchema$1 }), _void(), {
+		pause: method(object({ deviceId: DeviceIdSchema$2 }), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
-		resume: method(object({ deviceId: DeviceIdSchema$1 }), _void(), {
+		resume: method(object({ deviceId: DeviceIdSchema$2 }), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
-		stop: method(object({ deviceId: DeviceIdSchema$1 }), _void(), {
+		stop: method(object({ deviceId: DeviceIdSchema$2 }), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		/** Select (not start) a program; refused when the appliance does not offer it. */
 		setProgram: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			program: string().min(1)
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setPower: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setHalfLoad: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setHygienePlus: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setExtraDry: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setIntensiveZone: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setVarioSpeedPlus: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setChildLock: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
@@ -154214,7 +154101,7 @@ var dishwasherCapability = {
 		* its declared range / members.
 		*/
 		setOption: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			key: string().min(1),
 			value: DishwasherValueSchema
 		}), _void(), {
@@ -154222,7 +154109,7 @@ var dishwasherCapability = {
 			auth: "protected"
 		}),
 		/** What this appliance can do, from its own description — the UI is derived from it. */
-		getOptions: method(object({ deviceId: DeviceIdSchema$1 }), DishwasherOptionsSchema, { auth: "protected" })
+		getOptions: method(object({ deviceId: DeviceIdSchema$2 }), DishwasherOptionsSchema, { auth: "protected" })
 	},
 	status: {
 		schema: DishwasherStatusSchema,
@@ -169651,7 +169538,7 @@ var petFeederCapability = {
 /**
 * Pet water-fountain cap. Models the telemetry and the control surface of a
 * circulating drinking fountain: how much water is in the tank, how much the
-* pet drank, whether the pump runs and on what duty cycle.
+* pet drank, whether the pump runs.
 *
 * It has no native vendor provider of its own: a fountain reaches CamStack as
 * a container of loose entities (a pump switch, two number boxes, a "filter
@@ -169667,8 +169554,10 @@ var petFeederCapability = {
 * never here. Every reading may be `null`: a source that is offline or does
 * not report is unknown, never zero.
 *
-* The filter is not a field of this cap: it is an item of the `consumables`
-* cap on the same device (kind `wear`), reset by the same forward mechanism.
+* The pump's on/off duty cycle is model-specific and lives in the optional
+* `pump-cycle` cap. The filter, the cleaning and the water change are not
+* fields of this cap: they are items of the `consumables` cap on the same
+* device (kind `wear`), reset by the same forward mechanism.
 */
 var PetFountainStatusSchema = object({
 	/** Water in the tank, 0..100 (%). Null while the source has not reported. */
@@ -169679,27 +169568,20 @@ var PetFountainStatusSchema = object({
 	empty: boolean().nullable(),
 	/** True while the pump is running. Null while unknown. */
 	pumpRunning: boolean().nullable(),
-	/** True when the pump works on an on/off duty cycle rather than continuously. */
-	pumpIntervalEnabled: boolean().nullable(),
-	/** How long the pump runs per cycle, in seconds. */
-	pumpOnTime: number().min(0).nullable().meta(readingMeta("duration")),
-	/** How long the pump rests per cycle, in seconds. */
-	pumpOffTime: number().min(0).nullable().meta(readingMeta("duration")),
 	/** Water drunk in the last drink, in litres. */
 	lastDrink: number().min(0).nullable().meta(readingMeta("volume")),
 	/** Water drunk in the current hour, in litres. */
 	currentHourDrink: number().min(0).nullable().meta(readingMeta("volume")),
 	/** Water drunk over the last 24 hours (rolling), in litres. */
 	last24hDrink: number().min(0).nullable().meta(readingMeta("volume")),
-	/** Water drunk since local midnight, in litres. */
+	/** Water drunk since local midnight, in litres. Null when the fountain has no such sensor. */
 	todayDrink: number().min(0).nullable().meta(readingMeta("volume")),
 	/** Decoded fault message. Null means healthy; a non-null string is an active fault. */
 	error: string().nullable(),
 	/** Ms epoch when the slice was last refreshed. */
 	lastFetchedAt: number()
 });
-var DeviceIdSchema = number().int().nonnegative();
-var MinutesSchema = number().int().min(0);
+var DeviceIdSchema$1 = number().int().nonnegative();
 var petFountainCapability = {
 	name: "pet-fountain",
 	scope: "device",
@@ -169709,38 +169591,14 @@ var petFountainCapability = {
 	methods: {
 		/** Start or stop the pump. */
 		setPump: method(object({
-			deviceId: DeviceIdSchema,
-			on: boolean()
-		}), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
-		/** Switch the on/off duty cycle on or off (off = the pump runs continuously). */
-		setPumpInterval: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
-		/** Set how many minutes the pump runs per cycle. */
-		setPumpOnMinutes: method(object({
-			deviceId: DeviceIdSchema,
-			minutes: MinutesSchema
-		}), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
-		/** Set how many minutes the pump rests per cycle. */
-		setPumpOffMinutes: method(object({
-			deviceId: DeviceIdSchema,
-			minutes: MinutesSchema
-		}), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
 		/** Clear the rolling daily consumption counters on the device. */
-		resetDailyConsumption: method(object({ deviceId: DeviceIdSchema }), _void(), {
+		resetDailyConsumption: method(object({ deviceId: DeviceIdSchema$1 }), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		})
@@ -172186,6 +172044,79 @@ var ptzAutotrackCapability = {
 	history: "none"
 };
 /**
+* The on/off duty cycle of a pet fountain's pump. Some models run the pump
+* continuously and have nothing to configure; others can alternate a run time
+* and a rest time. That is model-specific, so it is its own optional cap on the
+* fountain device: a fountain without cycle entities simply never composes it
+* (planning#366), and the `pet-fountain` cap stays the model-independent core.
+*
+* Like `pet-fountain` it has no native vendor provider: an operator BUILDS the
+* cycle from loose entities (a cycle switch and two number boxes) and every
+* method is a forward to one source entity (D659, D967). Durations are stored
+* in SECONDS (D944); a number box that cannot be read back leaves them `null`
+* — unknown, never zero (D393).
+*/
+var PumpCycleStatusSchema = object({
+	/** True when the pump works on the on/off cycle, false when it runs continuously. Null while unknown. */
+	enabled: boolean().nullable(),
+	/** How long the pump runs per cycle, in seconds. Null while unknown. */
+	onTime: number().min(0).nullable().meta(readingMeta("duration")),
+	/** How long the pump rests per cycle, in seconds. Null while unknown. */
+	offTime: number().min(0).nullable().meta(readingMeta("duration")),
+	/** Ms epoch when the slice was last refreshed. */
+	lastFetchedAt: number()
+});
+var DeviceIdSchema = number().int().nonnegative();
+var MinutesSchema = number().int().min(0);
+var pumpCycleCapability = {
+	name: "pump-cycle",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.PetFountain],
+	methods: {
+		/** Switch the on/off duty cycle on or off (off = the pump runs continuously). */
+		setEnabled: method(object({
+			deviceId: DeviceIdSchema,
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/** Set how many minutes the pump runs per cycle. */
+		setOnMinutes: method(object({
+			deviceId: DeviceIdSchema,
+			minutes: MinutesSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/** Set how many minutes the pump rests per cycle. */
+		setOffMinutes: method(object({
+			deviceId: DeviceIdSchema,
+			minutes: MinutesSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		})
+	},
+	status: {
+		schema: PumpCycleStatusSchema,
+		kind: "push"
+	},
+	/** Runtime-state slice — mirrored by the kernel; the hero card reads it whole. */
+	runtimeState: PumpCycleStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live appliance state re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
+	/** History (D850): a duty-cycle setting is not a series worth recording. */
+	history: "none"
+};
+/**
 * reboot — device-scoped capability for "soft" device reboots (firmware
 * reboot via vendor protocol; cameras, NVRs, doorbells). Surfaces a
 * single mutation so the UI can offer a confirm-and-reboot button for
@@ -182465,6 +182396,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	pressureSensor: pressureSensorCapability,
 	privacyMask: privacyMaskCapability,
 	ptzAutotrack: ptzAutotrackCapability,
+	pumpCycle: pumpCycleCapability,
 	recordingOnboard: recordingOnboardCapability,
 	recordingSignal: recordingSignalCapability,
 	runningState: runningStateCapability,
@@ -184649,6 +184581,27 @@ Object.freeze({
 		access: "view",
 		role: "viewer"
 	},
+	"boardKeySource.getBoardKey": {
+		capName: "board-key-source",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"boardKeySource.listBoards": {
+		capName: "board-key-source",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"boardKeySource.listSources": {
+		capName: "board-key-source",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"brightness.getStatus": {
 		capName: "brightness",
 		capScope: "device",
@@ -189472,27 +189425,6 @@ Object.freeze({
 		access: "create",
 		role: "viewer"
 	},
-	"petFountain.setPumpInterval": {
-		capName: "pet-fountain",
-		capScope: "device",
-		addonId: null,
-		access: "create",
-		role: "viewer"
-	},
-	"petFountain.setPumpOffMinutes": {
-		capName: "pet-fountain",
-		capScope: "device",
-		addonId: null,
-		access: "create",
-		role: "viewer"
-	},
-	"petFountain.setPumpOnMinutes": {
-		capName: "pet-fountain",
-		capScope: "device",
-		addonId: null,
-		access: "create",
-		role: "viewer"
-	},
 	"pipelineAnalytics.addRetrainFrameFromRecording": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -191271,6 +191203,34 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"pumpCycle.getStatus": {
+		capName: "pump-cycle",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
+	"pumpCycle.setEnabled": {
+		capName: "pump-cycle",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"pumpCycle.setOffMinutes": {
+		capName: "pump-cycle",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"pumpCycle.setOnMinutes": {
+		capName: "pump-cycle",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
 	"reboot.reboot": {
 		capName: "reboot",
 		capScope: "device",
@@ -195967,21 +195927,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"petFountain.setPumpInterval": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
-	"petFountain.setPumpOffMinutes": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
-	"petFountain.setPumpOnMinutes": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
 	"pipelineAnalytics.addRetrainFrameFromRecording": [{
 		name: "deviceId",
 		form: "single",
@@ -196617,6 +196562,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pumpCycle.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pumpCycle.setEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pumpCycle.setOffMinutes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pumpCycle.setOnMinutes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"reboot.reboot": [{
 		name: "deviceId",
 		form: "single",
@@ -199228,7 +199193,7 @@ async function resolvePinnedFfmpegSpawner(seam, resolveFfmpeg, options) {
 * provider's `addonId` field manually — both must match for the device-
 * manager + alert center to correlate events back to the provider.
 */
-var REOLINK_ADDON_ID = "provider-reolink";
+var REOLINK_ADDON_ID$1 = "provider-reolink";
 /**
 * Map nodelink ReolinkSimpleEvent.type values to the loose
 * CameraNativeDetection class strings the rest of camstack consumes.
@@ -199729,6 +199694,12 @@ var reolinkCameraSchema = object({
 		"email"
 	]).optional(),
 	/**
+	* The URL generation this battery camera's HaCfg webhook points at (absent = the retired private
+	* :9081 listener). Written once the camera has been moved to the addon's data-plane URL, so the
+	* move happens on the first Baichuan contact after the upgrade and never again.
+	*/
+	webhookUrlGeneration: number().int().optional(),
+	/**
 	* On-camera motion detection master switch + sensitivity.
 	* Pushed via `setMotionAlarm` (cmdId=47). The Reolink mobile
 	* app + camera web UI use 1..50 (1 = least sensitive,
@@ -203371,7 +203342,7 @@ function createReolinkVideoclipsProvider(deps) {
 			if (device === null) return [];
 			return [{
 				source: CLIP_SOURCE_ONBOARD,
-				addonId: REOLINK_ADDON_ID,
+				addonId: REOLINK_ADDON_ID$1,
 				label: "Camera storage",
 				availability: await resolveAvailability(device)
 			}];
@@ -204538,10 +204509,10 @@ function createClipService(deps) {
 		cache,
 		resolveDevice: deps.resolveDevice,
 		hasVouchedThumbnail: (deviceId, clipKey) => thumbs.has(deviceId, clipKey),
-		thumbnailUrl: (deviceId, clipKey) => `/addon/${REOLINK_ADDON_ID}/${CLIP_THUMB_PREFIX}/${deviceId}/${clipKey}`,
-		thumbnailMintUrl: (deviceId, clipKey) => `/addon/${REOLINK_ADDON_ID}/${CLIP_THUMB_PREFIX}/${deviceId}/${clipKey}`,
+		thumbnailUrl: (deviceId, clipKey) => `/addon/${REOLINK_ADDON_ID$1}/${CLIP_THUMB_PREFIX}/${deviceId}/${clipKey}`,
+		thumbnailMintUrl: (deviceId, clipKey) => `/addon/${REOLINK_ADDON_ID$1}/${CLIP_THUMB_PREFIX}/${deviceId}/${clipKey}`,
 		preparePlayback: async ({ device, clipKey, profile }) => ({
-			playbackUrl: `/addon/${REOLINK_ADDON_ID}/${CLIP_MEDIA_PREFIX}/${device.deviceId}/${clipKey}.mp4`,
+			playbackUrl: `/addon/${REOLINK_ADDON_ID$1}/${CLIP_MEDIA_PREFIX}/${device.deviceId}/${clipKey}.mp4`,
 			served: profile === "high" ? "high" : "low"
 		}),
 		prepareBytes,
@@ -204587,7 +204558,7 @@ function createClipService(deps) {
 				deviceId,
 				since: until - CLIP_CATALOG_REFRESH_WINDOW_MS,
 				until,
-				provider: REOLINK_ADDON_ID
+				provider: REOLINK_ADDON_ID$1
 			});
 		},
 		hostBusy: (hostKey) => queue.busy(hostKey),
@@ -205334,6 +205305,52 @@ var IntercomFailureReport = class {
 /** The process-wide instance every camera in this addon notes into. */
 var intercomFailureReport = new IntercomFailureReport();
 //#endregion
+//#region src/baichuan-webhook-shared.ts
+/** The data-plane prefix this addon serves the camera push on: `/addon/<addonId>/webhook/<stableId>`. */
+var BAICHUAN_WEBHOOK_PREFIX = "webhook";
+/** The addon id the hub's reverse proxy mounts the plane under. */
+var BAICHUAN_WEBHOOK_ADDON_ID = "provider-reolink";
+/** The hub's plain-HTTP LAN listener, when the address book does not say (a hub older than its `listenerOrigins`). */
+var DEFAULT_LAN_HTTP_PORT = 4480;
+/**
+* Absolute URL a camera should POST HaCfg events to: the addon's data plane on the hub's plain-HTTP
+* LAN listener. HTTP, not HTTPS: the firmware refuses the hub's self-signed certificate.
+*/
+function buildBaichuanWebhookUrl(params) {
+	const id = encodeURIComponent(params.stableId);
+	return `http://${params.host}:${String(params.port)}/addon/${BAICHUAN_WEBHOOK_ADDON_ID}/${BAICHUAN_WEBHOOK_PREFIX}/${id}`;
+}
+function hostOf(url) {
+	if (url === null || url.trim().length === 0) return null;
+	try {
+		const host = new URL(url).hostname;
+		return host.length > 0 ? host : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* The host is the `internal` role of the palette (D729) and the port is the plain-HTTP origin the
+* hub lists for that host. Throws the reason, in the operator's words, when there is none: there is
+* no fallback host and never an HTTPS one.
+*/
+function resolveWebhookEndpoint(book) {
+	const host = hostOf(book.roles.internal.resolved);
+	if (host === null) throw new Error("The hub has no internal address (System → Network)");
+	if (book.listenerOrigins === void 0) return {
+		host,
+		port: DEFAULT_LAN_HTTP_PORT
+	};
+	for (const origin of book.listenerOrigins) try {
+		const url = new URL(origin);
+		if (url.protocol === "http:" && url.hostname === host) return {
+			host,
+			port: url.port.length > 0 ? Number(url.port) : 80
+		};
+	} catch {}
+	throw new Error("The hub has no plain-HTTP LAN listener: the camera webhook cannot use HTTPS. Turn on LAN HTTP in System → Network");
+}
+//#endregion
 //#region src/battery-charging.ts
 /**
 * From `adapterStatus` + `chargeStatus` to the power source.
@@ -205587,912 +205604,6 @@ var BatteryHourlyRefresh = class {
 	}
 };
 //#endregion
-//#region src/hub-connection.ts
-/** Baichuan control port a Reolink NVR / Home Hub listens on. */
-var REOLINK_HUB_DEFAULT_PORT = 9e3;
-/** Settings key that names the section holding the hub connection form. */
-var HUB_CONNECTION_SECTION_ID = "connection";
-var HUB_DEBUG_SECTION_ID = "hub-debug";
-/** A blank form field is "not provided", never an invalid port. */
-function blankToUndefined(value) {
-	return value === "" || value === null ? void 0 : value;
-}
-/**
-* The connection of ONE Reolink NVR / Home Hub: the settings of an INTEGRATION (D985). The
-* password is a schema `password` field kept in the keychain — never in env, argv or logs.
-*/
-var reolinkHubConnectionSchema = object({
-	host: string().trim().min(1).describe("NVR / Home Hub IP or hostname"),
-	port: preprocess(blankToUndefined, number().int().min(1).max(65535).default(REOLINK_HUB_DEFAULT_PORT)),
-	/** The RTSP relay port the cameras dial for their streams (not the Baichuan `port`). */
-	rtspPort: preprocess(blankToUndefined, number().int().min(1).max(65535).default(554)),
-	username: preprocess(blankToUndefined, string().trim().min(1).default("admin")),
-	password: string().min(1).describe("NVR / Home Hub password").meta({ secret: true }),
-	/** Hubs are TCP-only on supported firmwares — kept for symmetry with a camera. */
-	transport: _enum(["tcp", "udp"]).default("tcp"),
-	/** UID of a hub that was paired by it; unused for a plain TCP login. */
-	uid: string().optional(),
-	debugGeneral: boolean().default(false),
-	debugSocketLogs: array(ReolinkSocketDebugFlagSchema).default([])
-});
-function stringValue(value) {
-	return typeof value === "string" ? value.trim() : "";
-}
-function readHubConnection(settings) {
-	if (stringValue(settings["host"]).length === 0) return { kind: "no-host" };
-	const password = settings["password"];
-	if (isSecretMarkerLike(password)) return { kind: "password-locked" };
-	if (typeof password !== "string" || password.length === 0) return { kind: "no-password" };
-	const parsed = reolinkHubConnectionSchema.safeParse(settings);
-	if (!parsed.success) return { kind: "no-host" };
-	return {
-		kind: "ok",
-		connection: parsed.data
-	};
-}
-/** Two reads that would dial the same way. */
-function sameHubConnection(a, b) {
-	return a.host === b.host && a.port === b.port && a.rtspPort === b.rtspPort && a.username === b.username && a.password === b.password && a.transport === b.transport && a.uid === b.uid;
-}
-/**
-* The connection + debug sections of the integration form. Fields are NOT `required` here:
-* the same schema is the addon's own settings page, where a required host would block saving
-* an unrelated email-push change on the default integration. A hub integration missing its
-* host or password is named by the session at reconcile time instead.
-*/
-function buildHubConnectionSections() {
-	return { sections: [{
-		id: HUB_CONNECTION_SECTION_ID,
-		title: "NVR / Home Hub connection",
-		titleKey: "provider-reolink:connection.s_connection.title",
-		description: "Only for an integration that is one NVR or Home Hub. Its channels are adopted as cameras that share this connection.",
-		descriptionKey: "provider-reolink:connection.s_connection.description",
-		columns: 2,
-		fields: [
-			{
-				type: "text",
-				key: "host",
-				label: "Hub IP",
-				labelKey: "provider-reolink:connection.s_connection.host.label",
-				placeholder: "192.168.10.100"
-			},
-			{
-				type: "number",
-				key: "port",
-				label: "Port",
-				labelKey: "provider-reolink:connection.s_connection.port.label",
-				default: REOLINK_HUB_DEFAULT_PORT,
-				min: 1,
-				max: 65535,
-				step: 1
-			},
-			{
-				type: "number",
-				key: "rtspPort",
-				label: "RTSP port",
-				labelKey: "provider-reolink:connection.s_connection.rtspPort.label",
-				default: 554,
-				min: 1,
-				max: 65535,
-				step: 1
-			},
-			{
-				type: "text",
-				key: "username",
-				label: "Username",
-				labelKey: "provider-reolink:connection.s_connection.username.label",
-				default: "admin"
-			},
-			{
-				type: "password",
-				key: "password",
-				label: "Password",
-				labelKey: "provider-reolink:connection.s_connection.password.label",
-				showToggle: true
-			}
-		]
-	}, {
-		id: HUB_DEBUG_SECTION_ID,
-		title: "NVR / Home Hub debug",
-		titleKey: "provider-reolink:connection.s_hub-debug.title",
-		description: "Debug logging adds log volume; use it temporarily.",
-		descriptionKey: "provider-reolink:connection.s_hub-debug.description",
-		columns: 1,
-		fields: [{
-			type: "boolean",
-			key: "debugGeneral",
-			label: "General debug logs",
-			labelKey: "provider-reolink:connection.s_hub-debug.debugGeneral.label",
-			default: false,
-			style: "switch"
-		}, {
-			type: "multiselect",
-			key: "debugSocketLogs",
-			label: "Socket trace categories",
-			labelKey: "provider-reolink:connection.s_hub-debug.debugSocketLogs.label",
-			description: "Each area adds log volume.",
-			descriptionKey: "provider-reolink:connection.s_hub-debug.debugSocketLogs.description",
-			default: [],
-			options: [{
-				value: "traceEvents",
-				label: "Events (cmd 33 — AlarmEventList push)",
-				labelKey: "provider-reolink:connection.s_hub-debug.debugSocketLogs.o_traceEvents.label"
-			}]
-		}]
-	}] };
-}
-/**
-* `true` for an integration that IS one NVR / Home Hub: it was set up from a hub candidate, was
-* migrated from a Hub device, or carries a host. The default integration (standalone cameras,
-* email push, webhook, clips) has none of the three.
-*/
-function isHubIntegration(evidence) {
-	if (evidence.originStableId?.startsWith("reolink-hub-") === true) return true;
-	if (evidence.info["migratedFromHubDeviceId"] !== void 0) return true;
-	return stringValue(evidence.settings["host"]).length > 0;
-}
-/** The form of a hub integration: its connection and debug sections, nothing of the addon's own. */
-function buildHubInstanceSchema() {
-	return buildHubConnectionSections();
-}
-//#endregion
-//#region src/hub-battery-fields.ts
-/**
-* The hub boundary for the per-channel battery power fields.
-*
-* The Reolink hub/NVR reports `chargeStatus` and `adapterStatus` as NUMBERS
-* (0/1/2); the standalone camera path reports the same facts as strings, and
-* `deriveChargingSource` (`battery-charging.ts`) speaks only the string
-* vocabulary. This module is the translation, and — the part that was
-* missing — it NAMES a code it cannot translate instead of dropping the field
-* silently. A dropped field reads as "the push said nothing about power", so
-* a new firmware value would have kept the previous belief forever, with not
-* one log line. The ledger lets the hub warn once per (device, field, code).
-*/
-var CHARGE_STATUS_BY_CODE = {
-	0: "none",
-	1: "charging",
-	2: "chargeComplete"
-};
-var ADAPTER_STATUS_BY_CODE = {
-	0: "none",
-	1: "dc",
-	2: "solarPanel"
-};
-function mapOne(field, value, byCode) {
-	if (value === void 0 || value === null) return {};
-	if (typeof value === "string") return { mapped: value };
-	if (typeof value === "number") {
-		const mapped = byCode[value];
-		if (mapped !== void 0) return { mapped };
-	}
-	return { unmapped: {
-		field,
-		value
-	} };
-}
-/** Translate one channel's raw CGI power fields; never throws. */
-function mapHubBatteryPower(cgi) {
-	const charge = mapOne("chargeStatus", cgi?.["chargeStatus"], CHARGE_STATUS_BY_CODE);
-	const adapter = mapOne("adapterStatus", cgi?.["adapterStatus"], ADAPTER_STATUS_BY_CODE);
-	return {
-		fields: {
-			...charge.mapped !== void 0 ? { chargeStatus: charge.mapped } : {},
-			...adapter.mapped !== void 0 ? { adapterStatus: adapter.mapped } : {}
-		},
-		unmapped: [...charge.unmapped !== void 0 ? [charge.unmapped] : [], ...adapter.unmapped !== void 0 ? [adapter.unmapped] : []]
-	};
-}
-/**
-* Remembers which (device, field, code) triples were already reported, so a
-* polled read warns once per finding and not once per tick. Unbounded only in
-* theory: the key space is a few cameras times two fields times the handful of
-* codes a firmware can invent.
-*/
-var UnmappedCodeLedger = class {
-	seen = /* @__PURE__ */ new Set();
-	firstSeen(deviceId, field, value) {
-		const key = `${deviceId}:${field}:${String(value)}`;
-		if (this.seen.has(key)) return false;
-		this.seen.add(key);
-		return true;
-	}
-};
-//#endregion
-//#region src/hub-channel-reconcile.ts
-/**
-* Match adopted children to the hub's own channel list by IDENTITY, then report the
-* ones whose persisted `channel` is missing or wrong.
-*
-* A child's stableId ENDS with `-${childNativeId}` (the prefix is the integration it was
-* adopted into, or the retired Hub's stableId for a migrated child), and `childNativeId` is built
-* from the camera's UID — so identity survives a channel move, while `channel` does not.
-* The hub is the authority on which slot a UID currently occupies.
-*
-* Why this exists: `loadAdoptedChildrenByChannel` keys the adopted set on the persisted
-* `channel` alone. A child that lost it is absent from that map, so the discovery panel
-* renders it `alreadyAdopted: false` — one click away from being adopted a SECOND time —
-* and `routeSimpleEvent` silently drops every push for its slot. Observed live on
-* 2026-09-04 with an Argus MagiCam that was actually on channel 3.
-*
-* Pure: no I/O. A discovered entry with no channel, or with no adopted child, is skipped —
-* this repairs what exists, it never adopts.
-*/
-function planChannelReconciliation(discovered, children) {
-	const repairs = [];
-	for (const entry of discovered) {
-		if (typeof entry.rtspChannel !== "number") continue;
-		const child = children.find((c) => c.stableId.endsWith(`-${entry.childNativeId}`));
-		if (child === void 0) continue;
-		if (child.channel === entry.rtspChannel) continue;
-		repairs.push({
-			deviceId: child.deviceId,
-			stableId: child.stableId,
-			from: child.channel ?? null,
-			to: entry.rtspChannel
-		});
-	}
-	return repairs;
-}
-function createMotionSensorTracker(now = Date.now) {
-	const latest = /* @__PURE__ */ new Map();
-	return {
-		observe(event) {
-			if (event.type !== "motion") return;
-			const sensor = event.motion.source;
-			if (sensor === void 0) return;
-			latest.set(event.channel, {
-				sensor,
-				at: now()
-			});
-		},
-		take(channel) {
-			const entry = latest.get(channel);
-			if (!entry) return null;
-			latest.delete(channel);
-			return now() - entry.at <= 2e3 ? entry.sensor : null;
-		}
-	};
-}
-var isMotionSensor = (value) => value === "md" || value === "pir" || value === "unknown";
-/**
-* The sensor a simple event states itself, for a library version that forwards
-* `motion.source` on the simple event; `null` for the versions that do not.
-*/
-function motionSensorOnSimpleEvent(event) {
-	if (!("motion" in event)) return null;
-	const motion = event.motion;
-	if (typeof motion !== "object" || motion === null || !("source" in motion)) return null;
-	return isMotionSensor(motion.source) ? motion.source : null;
-}
-//#endregion
-//#region src/simple-event-dispatch-trace.ts
-/**
-* Gate for hub-side simpleEvent traces.
-*
-* Hub-child events arrive on the parent's Baichuan socket. Logging them on
-* the child logger only is invisible when the operator filters Logs to the
-* Hub; logging every channel unconditionally floods the Hub (battery ticks).
-* Trace when the target camera — or the hub itself — is under debug.
-*/
-function shouldTraceSimpleEventDispatch(input) {
-	return wantsEventTrace(input.hubDebugGeneral, input.hubSocketFlags) || wantsEventTrace(input.childDebugGeneral, input.childSocketFlags);
-}
-function wantsEventTrace(debugGeneral, socketFlags) {
-	return debugGeneral || socketFlags.includes("traceEvents");
-}
-//#endregion
-//#region src/reolink-hub-session.ts
-var HUB_DISCOVERY_REFRESH_TIMEOUT_MS = 8e3;
-/**
-* How often the session re-reads its own channels summary to reconcile the adopted children's
-* sleep slices. 60 s: a naturally-waking camera (PIR, schedule) is caught within a minute, and
-* the play path has its own faster confirm + post-dial watch, so this only ever carries
-* background drift. Never wakes a child — the summary is answered by the hub itself.
-*/
-var HUB_CHILD_SLEEP_RECONCILE_MS = 6e4;
-var HUB_RECONNECT_BASE_MS = 2e3;
-var HUB_RECONNECT_MAX_MS = 3e4;
-var UNROUTED_LOG_THROTTLE_MS = 6e4;
-/**
-* ONE Reolink NVR / Home Hub: a single Baichuan control + event socket fronting N channels,
-* owned per integration (D985). It was the `ReolinkHub` device; the device is gone, the
-* mechanism is unchanged:
-*
-*  - one persistent socket (no per-channel login), reconnected with a bounded backoff;
-*  - every `simpleEvent` from any channel is dispatched into the matching child;
-*  - every 60 s the hub's own channels summary reconciles the children's sleep, online and
-*    battery slices — read from the hub's mains-powered socket, never from a battery camera.
-*/
-var ReolinkHubSession = class {
-	integrationId;
-	#deps;
-	#logger;
-	#now;
-	#connection;
-	#api = null;
-	#connectInFlight = null;
-	#reconnectAttempts = 0;
-	#reconnectTimer = null;
-	#reconcileTimer = null;
-	#shutdown = false;
-	#online = false;
-	#snapshot = {
-		channels: [],
-		lastRefreshAt: null,
-		lastError: null
-	};
-	#refreshInFlight = null;
-	/** Wall-clock ms of the last refresh that listed each child (by device id). */
-	#childLastSeenAt = /* @__PURE__ */ new Map();
-	/** Channels the last good refresh listed but nobody adopted: their pushes are expected drops. */
-	#knownUnadoptedChannels = /* @__PURE__ */ new Set();
-	#unroutedLoggedAt = /* @__PURE__ */ new Map();
-	#batteryShapeLogged = false;
-	#unmappedBatteryCodes = new UnmappedCodeLedger();
-	#motionSensors = createMotionSensorTracker();
-	#simpleEventBound = (event) => {
-		this.routeSimpleEvent(event);
-	};
-	#rawEventBound = (event) => {
-		this.#motionSensors.observe(event);
-	};
-	constructor(deps) {
-		this.integrationId = deps.integrationId;
-		this.#deps = deps;
-		this.#logger = deps.logger;
-		this.#connection = deps.connection;
-		this.#now = deps.now ?? Date.now;
-	}
-	get connection() {
-		return this.#connection;
-	}
-	get isOnline() {
-		return this.#online;
-	}
-	/** The integration's display name. */
-	get name() {
-		return this.#deps.name;
-	}
-	/** Restart the hub itself (not a camera behind it). */
-	async reboot() {
-		await (await this.getApi()).reboot();
-	}
-	/** The last channel list, for the adoption surface. */
-	channelSnapshot() {
-		return this.#snapshot;
-	}
-	/**
-	* What a child dials for the hub's RTSP relay. The port is the connection's RTSP port
-	* (default 554) — never the Baichuan port.
-	*/
-	relayEndpoint() {
-		const c = this.#connection;
-		return {
-			host: c.host,
-			username: c.username,
-			password: c.password,
-			port: c.rtspPort
-		};
-	}
-	/** Arm the periodic reconcile and make the first dial. Idempotent. */
-	start() {
-		if (this.#reconcileTimer === null) {
-			this.#reconcileTimer = setInterval(() => {
-				this.refresh().catch(() => {});
-			}, HUB_CHILD_SLEEP_RECONCILE_MS);
-			if (typeof this.#reconcileTimer.unref === "function") this.#reconcileTimer.unref();
-		}
-		this.getApi().catch((err) => {
-			this.#logger.warn("Reolink hub initial connect failed — will retry", {
-				tags: { integrationId: this.integrationId },
-				meta: { error: errMsg$3(err) }
-			});
-		});
-	}
-	/**
-	* Apply a new connection. A session already dialled the same way keeps its socket; any real
-	* change tears the socket down and re-dials with the new credentials.
-	*/
-	async reconfigure(connection) {
-		if (sameHubConnection(this.#connection, connection)) {
-			this.#connection = connection;
-			return;
-		}
-		this.#connection = connection;
-		await this.dropApi("settings-changed");
-		this.#setOnline(false);
-		this.getApi().catch((err) => {
-			this.#logger.warn("Reolink hub re-dial after settings change failed", {
-				tags: { integrationId: this.integrationId },
-				meta: { error: errMsg$3(err) }
-			});
-		});
-	}
-	async close() {
-		this.#shutdown = true;
-		if (this.#reconnectTimer !== null) {
-			clearTimeout(this.#reconnectTimer);
-			this.#reconnectTimer = null;
-		}
-		if (this.#reconcileTimer !== null) {
-			clearInterval(this.#reconcileTimer);
-			this.#reconcileTimer = null;
-		}
-		await this.dropApi("hub-shutdown");
-	}
-	/**
-	* The logged-in api (single round-trip on first call). Mid-disconnect, callers wait for the
-	* reconnect that is already in flight.
-	*/
-	async getApi() {
-		const live = this.#api;
-		if (live !== null && live.client.isSocketConnected() && live.client.loggedIn) return live;
-		if (this.#connectInFlight !== null) return this.#connectInFlight;
-		this.#connectInFlight = this.#connect().finally(() => {
-			this.#connectInFlight = null;
-		});
-		return this.#connectInFlight;
-	}
-	async dropApi(reason) {
-		const api = this.#api;
-		this.#api = null;
-		if (api === null) return;
-		try {
-			await api.close({ reason });
-		} catch {}
-	}
-	async #connect() {
-		await this.dropApi("hub-reconnect");
-		const connection = this.#connection;
-		if (connection.host.length === 0) throw userError("reolink.hub-host-missing", void 0, "Reolink Hub: host not configured");
-		if (connection.password.length === 0) throw userError("reolink.hub-password-missing", void 0, "Reolink Hub: password not configured");
-		this.#logger.info("Reolink hub connecting", {
-			tags: { integrationId: this.integrationId },
-			meta: {
-				host: connection.host,
-				port: connection.port,
-				transport: connection.transport
-			}
-		});
-		const api = await this.#deps.connect(connection);
-		try {
-			await api.offSimpleEvent(this.#simpleEventBound);
-		} catch {}
-		api.client.off("event", this.#rawEventBound);
-		api.client.prependListener("event", this.#rawEventBound);
-		await api.onSimpleEvent(this.#simpleEventBound);
-		api.client.on("close", () => this.#scheduleReconnect("socket-close"));
-		api.client.on("error", (err) => {
-			this.#logger.warn("Reolink hub socket error — scheduling reconnect", {
-				tags: { integrationId: this.integrationId },
-				meta: { error: errMsg$3(err) }
-			});
-			this.#scheduleReconnect("socket-error");
-		});
-		this.#api = api;
-		this.#reconnectAttempts = 0;
-		this.#setOnline(true);
-		this.refresh().catch(() => {});
-		return api;
-	}
-	#setOnline(online) {
-		if (this.#online === online) return;
-		this.#online = online;
-		this.#deps.onConnectionChange?.(online);
-	}
-	#scheduleReconnect(reason) {
-		if (this.#shutdown) return;
-		this.#api = null;
-		this.#setOnline(false);
-		if (this.#reconnectTimer !== null) return;
-		const backoff = Math.min(HUB_RECONNECT_BASE_MS * 2 ** this.#reconnectAttempts, HUB_RECONNECT_MAX_MS);
-		this.#reconnectAttempts += 1;
-		this.#logger.info("Reolink hub reconnect scheduled", {
-			tags: { integrationId: this.integrationId },
-			meta: {
-				reason,
-				attempt: this.#reconnectAttempts,
-				backoffMs: backoff
-			}
-		});
-		this.#reconnectTimer = setTimeout(() => {
-			this.#reconnectTimer = null;
-			this.getApi().catch(() => {});
-		}, backoff);
-	}
-	/**
-	* Pull the channel list from the hub via `getNvrChannelsSummary({ source: 'cgi' })` — CGI,
-	* because `GetChannelstatus` answers synchronously (no race against the cmd_id 145 push
-	* cache that is empty right after login). Single-flight.
-	*/
-	refresh() {
-		if (this.#refreshInFlight !== null) return this.#refreshInFlight;
-		const run = this.#refresh().finally(() => {
-			this.#refreshInFlight = null;
-		});
-		this.#refreshInFlight = run;
-		return run;
-	}
-	async #refresh() {
-		const startedAt = this.#now();
-		let lastError = null;
-		let channels = [];
-		try {
-			channels = (await (await this.getApi()).getNvrChannelsSummary({
-				source: "cgi",
-				timeoutMs: HUB_DISCOVERY_REFRESH_TIMEOUT_MS
-			})).devices.map((d) => ({
-				childNativeId: computeChildNativeId(d.channel, d.uid),
-				channel: d.channel,
-				name: d.name ?? `Channel ${d.channel}`,
-				status: discoveredStatusFor(d),
-				...d.uid ? { uid: d.uid } : {},
-				...d.model ? { model: d.model } : {},
-				...d.serialNumber ? { serialNumber: d.serialNumber } : {},
-				isBattery: d.isBattery === true,
-				isDoorbell: d.isDoorbell === true,
-				isMultifocal: d.isMultifocal === true
-			}));
-		} catch (err) {
-			lastError = errMsg$3(err);
-			this.#logger.warn("Reolink hub channel refresh failed", {
-				tags: { integrationId: this.integrationId },
-				meta: { error: lastError }
-			});
-		}
-		this.#snapshot = lastError === null ? {
-			channels,
-			lastRefreshAt: this.#now(),
-			lastError: null
-		} : {
-			...this.#snapshot,
-			lastError
-		};
-		if (lastError !== null) return;
-		await this.reconcileChildChannels(channels);
-		const adoptedChannels = /* @__PURE__ */ new Set();
-		for (const child of this.#deps.children()) if (child.channel !== void 0) adoptedChannels.add(child.channel);
-		this.#knownUnadoptedChannels.clear();
-		for (const c of channels) if (!adoptedChannels.has(c.channel)) this.#knownUnadoptedChannels.add(c.channel);
-		this.#logger.info("Reolink hub: channel refresh complete", {
-			tags: { integrationId: this.integrationId },
-			meta: {
-				durationMs: this.#now() - startedAt,
-				total: channels.length,
-				adopted: channels.filter((c) => adoptedChannels.has(c.channel)).length,
-				online: channels.filter((c) => c.status === "online").length,
-				sleeping: channels.filter((c) => c.status === "sleeping").length
-			}
-		});
-		this.reconcileChildOnline(channels);
-		this.reconcileChildSleepState(channels);
-		await this.reconcileChildBattery();
-	}
-	/**
-	* Re-derive each adopted child's `channel` from the hub's own list, matching by IDENTITY
-	* (the stableId carries the camera UID) rather than by the channel itself — a child that lost
-	* its channel is invisible to the routing, and a channel move produces the same damage under
-	* a wrong number. A child that is not live is skipped: it is repaired on its next restore.
-	*/
-	async reconcileChildChannels(channels) {
-		const children = this.#deps.children();
-		const repairs = planChannelReconciliation(channels.map((c) => ({
-			childNativeId: c.childNativeId,
-			rtspChannel: c.channel
-		})), children.map((child) => ({
-			deviceId: child.id,
-			stableId: child.stableId,
-			...child.channel !== void 0 ? { channel: child.channel } : {}
-		})));
-		for (const repair of repairs) {
-			const child = children.find((c) => c.id === repair.deviceId);
-			if (child === void 0) continue;
-			try {
-				await child.repairChannel(repair.to);
-				this.#logger.warn("Reolink hub: repaired a child channel from the hub channel list", {
-					tags: {
-						deviceId: repair.deviceId,
-						stableId: repair.stableId
-					},
-					meta: {
-						from: repair.from,
-						to: repair.to
-					}
-				});
-			} catch (err) {
-				this.#logger.warn("Reolink hub: child channel repair failed", {
-					tags: {
-						deviceId: repair.deviceId,
-						stableId: repair.stableId
-					},
-					meta: {
-						from: repair.from,
-						to: repair.to,
-						error: errMsg$3(err)
-					}
-				});
-			}
-		}
-	}
-	/**
-	* Mark every child still listed `online`, and any child missing for more than
-	* `HUB_MISSING_OFFLINE_MS` `offline` — "if the hub firmware doesn't list it, the device isn't
-	* reachable through the hub". Battery cams that briefly drop out of the summary during deep
-	* sleep are not false-flagged: the threshold gives 3+ cycles of grace.
-	*/
-	reconcileChildOnline(channels) {
-		const now = this.#now();
-		const listed = new Set(channels.map((c) => c.channel));
-		for (const child of this.#deps.children()) {
-			const ch = child.channel;
-			if (ch === void 0) continue;
-			if (child.type !== DeviceType.Camera) continue;
-			if (listed.has(ch)) {
-				this.#childLastSeenAt.set(child.id, now);
-				if (!child.online) {
-					child.markOnline(true);
-					this.#logger.info("Reolink hub: adopted child back online", {
-						tags: {
-							deviceId: child.id,
-							deviceName: child.name
-						},
-						meta: { channel: ch }
-					});
-				}
-				continue;
-			}
-			const lastSeen = this.#childLastSeenAt.get(child.id) ?? 0;
-			const missingMs = lastSeen > 0 ? now - lastSeen : Number.POSITIVE_INFINITY;
-			if (missingMs >= 6e5 && child.online) {
-				child.markOnline(false);
-				this.#logger.warn("Reolink hub: adopted child marked offline (missing from the hub list)", {
-					tags: {
-						deviceId: child.id,
-						deviceName: child.name
-					},
-					meta: {
-						channel: ch,
-						missingMs
-					}
-				});
-			}
-		}
-	}
-	/**
-	* Push the hub's per-channel sleep state into each adopted battery child's `battery.sleeping`
-	* slice. The summary carries a `sleeping` flag straight from the firmware over the hub's own
-	* mains-powered socket: it costs the battery channel nothing, and it is real firmware state
-	* rather than socket-I/O inference. Only `online` / `sleeping` are acted on: `offline` and
-	* `unknown` carry no sleep information, so the last known value stands.
-	*/
-	reconcileChildSleepState(channels) {
-		const byChannel = new Map(channels.map((c) => [c.channel, c]));
-		for (const child of this.#deps.children()) {
-			if (child.channel === void 0) continue;
-			const entry = byChannel.get(child.channel);
-			if (entry === void 0) continue;
-			if (entry.status !== "sleeping" && entry.status !== "online") continue;
-			child.applyHubSleepState(entry.status === "sleeping");
-		}
-	}
-	/**
-	* Push the hub's per-channel battery read into each adopted battery child.
-	* `getAllChannelsBatteryInfo` is one CGI on the hub's own socket — it never touches a battery
-	* camera — and it is the ONLY way a sleeping child's percentage/charging ever moves.
-	* Independent of the refresh's success path: a battery-read failure must not fail the refresh.
-	*/
-	async reconcileChildBattery() {
-		const children = this.#deps.children();
-		if (children.length === 0) return;
-		try {
-			const data = await (await this.getApi()).getAllChannelsBatteryInfo();
-			const entries = Object.entries(data.batteryInfoData);
-			if (entries.length === 0) return;
-			if (!this.#batteryShapeLogged) {
-				this.#batteryShapeLogged = true;
-				this.#logger.info("Reolink hub: per-channel battery payload (first read)", {
-					tags: { integrationId: this.integrationId },
-					meta: { raw: entries.map(([ch, v]) => ({
-						channel: Number(ch),
-						...v
-					})) }
-				});
-			}
-			for (const [chKey, info] of entries) {
-				const child = children.find((c) => c.channel === Number(chKey));
-				if (child === void 0) continue;
-				const power = mapHubBatteryPower(info.entries[0]);
-				for (const { field, value } of power.unmapped) {
-					if (!this.#unmappedBatteryCodes.firstSeen(child.id, field, value)) continue;
-					this.#logger.warn("Reolink hub: unmapped battery power code — field dropped", {
-						tags: { deviceId: child.id },
-						meta: {
-							channel: Number(chKey),
-							field,
-							value
-						}
-					});
-				}
-				child.applyHubBatteryInfo({
-					batteryPercent: info.batteryLevel,
-					...power.fields
-				});
-			}
-		} catch (err) {
-			this.#logger.debug("Reolink hub: per-channel battery refresh failed", {
-				tags: { integrationId: this.integrationId },
-				meta: { error: errMsg$3(err) }
-			});
-		}
-	}
-	/** Dispatch a hub-received simpleEvent to the matching child's `handleSimpleEvent`. */
-	routeSimpleEvent(event) {
-		const channel = event?.channel;
-		if (typeof channel !== "number") return;
-		const motionSensor = event.type === "motion" ? this.#motionSensors.take(channel) : null;
-		const child = this.#deps.children().find((c) => c.channel === channel);
-		if (child === void 0) {
-			const last = this.#unroutedLoggedAt.get(channel) ?? 0;
-			const now = this.#now();
-			if (now - last > UNROUTED_LOG_THROTTLE_MS) {
-				this.#unroutedLoggedAt.set(channel, now);
-				const knownUnadopted = this.#knownUnadoptedChannels.has(channel);
-				this.#logger[knownUnadopted ? "debug" : "warn"]("Reolink hub: simpleEvent for an unmapped channel dropped", {
-					tags: { integrationId: this.integrationId },
-					meta: {
-						channel,
-						type: event?.type ?? "unknown",
-						knownUnadopted
-					}
-				});
-			}
-			return;
-		}
-		try {
-			if (shouldTraceSimpleEventDispatch({
-				hubDebugGeneral: this.#connection.debugGeneral,
-				hubSocketFlags: this.#connection.debugSocketLogs,
-				childDebugGeneral: child.debugGeneral,
-				childSocketFlags: child.debugSocketFlags
-			})) this.#logger.info("Reolink hub: simpleEvent dispatch", {
-				tags: { deviceId: child.id },
-				meta: {
-					type: event?.type ?? "unknown",
-					channel,
-					timestamp: event?.timestamp,
-					name: child.name
-				}
-			});
-			child.handleSimpleEvent(event, motionSensor);
-		} catch (err) {
-			this.#logger.debug("Reolink hub simpleEvent dispatch failed", {
-				tags: { deviceId: child.id },
-				meta: {
-					channel,
-					error: errMsg$3(err)
-				}
-			});
-		}
-	}
-};
-/**
-* A stable per-child identifier. UID is preferred when available (it identifies a paired camera
-* across re-pairings); otherwise `channel-N`, which is stable for a fixed channel assignment.
-*/
-function computeChildNativeId(channel, uid) {
-	if (uid && uid.length > 0) return `cam-${uid}`;
-	return `channel-${channel}`;
-}
-/**
-* Map the lib's per-channel summary booleans to our `DiscoveredChildStatus`. Precedence:
-* `online === false` → offline; `sleeping === true` → sleeping; `online === true` → online;
-* any non-empty state → online; unknown otherwise (the cmd_id 145 push has not landed yet).
-*/
-function discoveredStatusFor(d) {
-	if (d.online === false) return "offline";
-	if (d.sleeping === true) return "sleeping";
-	if (d.online === true) return "online";
-	if (typeof d.state === "string" && d.state.length > 0) return "online";
-	return "unknown";
-}
-/** The wire-shaped channel the adoption surface lists. */
-function toDiscoveredChild(channel, adoptedDeviceId) {
-	return {
-		childNativeId: channel.childNativeId,
-		name: channel.name,
-		type: DeviceType.Camera,
-		status: channel.status,
-		metadata: {
-			...channel.model ? { model: channel.model } : {},
-			...channel.serialNumber ? { serialNumber: channel.serialNumber } : {},
-			...channel.uid ? { uid: channel.uid } : {},
-			rtspChannel: channel.channel,
-			isBattery: channel.isBattery,
-			isDoorbell: channel.isDoorbell,
-			isMultifocal: channel.isMultifocal
-		},
-		alreadyAdopted: adoptedDeviceId !== null,
-		adoptedDeviceId
-	};
-}
-var GATEWAY_SUFFIX = ":gateway";
-/** The `childNativeId` of the hub box itself, one per integration. */
-function hubGatewayNativeId(integrationId) {
-	return `${integrationId}${GATEWAY_SUFFIX}`;
-}
-/**
-* The hub (NVR / Home Hub) as an adoption candidate: a {@link DeviceType.Gateway} that is a
-* sibling of its channel cameras, never their parent. Only what the library really exposes:
-* `reboot` (Baichuan `Reboot`) and the unit's web page.
-*/
-function toDiscoveredGateway(input) {
-	return {
-		childNativeId: hubGatewayNativeId(input.integrationId),
-		name: input.name,
-		type: DeviceType.Gateway,
-		status: input.online ? "online" : "offline",
-		metadata: { manufacturer: "Reolink" },
-		alreadyAdopted: input.adoptedDeviceId !== null,
-		adoptedDeviceId: input.adoptedDeviceId,
-		capabilities: [rebootCapability.name, deviceAdminLinkCapability.name]
-	};
-}
-/**
-* The per-integration registry the cameras reach their session through (the shape of
-* `veluxGateways` / `enpalConnections`). It also holds the children, so a child that activates
-* before its session exists (boot order) is already routable the moment the session starts.
-*/
-var ReolinkHubSessions = class {
-	#sessions = /* @__PURE__ */ new Map();
-	#children = /* @__PURE__ */ new Map();
-	set(integrationId, session) {
-		if (session === null) {
-			this.#sessions.delete(integrationId);
-			return;
-		}
-		this.#sessions.set(integrationId, session);
-	}
-	get(integrationId) {
-		return this.#sessions.get(integrationId) ?? null;
-	}
-	attach(integrationId, child) {
-		let set = this.#children.get(integrationId);
-		if (set === void 0) {
-			set = /* @__PURE__ */ new Map();
-			this.#children.set(integrationId, set);
-		}
-		set.set(child.id, child);
-	}
-	/** Detach only if `child` is still the attached handle — a rebuilt device keeps its slot. */
-	detach(integrationId, child) {
-		const set = this.#children.get(integrationId);
-		if (set?.get(child.id) === child) set.delete(child.id);
-	}
-	childrenOf(integrationId) {
-		return [...this.#children.get(integrationId)?.values() ?? []];
-	}
-	clear() {
-		this.#sessions.clear();
-		this.#children.clear();
-	}
-};
-/** The module-level registry (one per addon process). */
-var reolinkHubSessions = new ReolinkHubSessions();
-/** Dial a real hub. The default `connect` dependency of a session. */
-async function connectReolinkHub(connection) {
-	const api = new ReolinkBaichuanApi({
-		host: connection.host,
-		port: connection.port,
-		username: connection.username,
-		password: connection.password,
-		transport: connection.transport,
-		...connection.uid ? { uid: connection.uid } : {}
-	});
-	await api.login();
-	return api;
-}
-//#endregion
 //#region src/battery-refresh-settings.ts
 var BATTERY_REFRESH_SECTION_ID = "battery-refresh";
 var BATTERY_REFRESH_MINUTES_DESCRIPTION = "A camera that slept the whole window is woken once to refresh. 0 turns the scheduled refresh off.";
@@ -207419,6 +206530,912 @@ function buildOnboardWrites(patch, schedule) {
 	};
 }
 //#endregion
+//#region src/hub-connection.ts
+/** Baichuan control port a Reolink NVR / Home Hub listens on. */
+var REOLINK_HUB_DEFAULT_PORT = 9e3;
+/** Settings key that names the section holding the hub connection form. */
+var HUB_CONNECTION_SECTION_ID = "connection";
+var HUB_DEBUG_SECTION_ID = "hub-debug";
+/** A blank form field is "not provided", never an invalid port. */
+function blankToUndefined(value) {
+	return value === "" || value === null ? void 0 : value;
+}
+/**
+* The connection of ONE Reolink NVR / Home Hub: the settings of an INTEGRATION (D985). The
+* password is a schema `password` field kept in the keychain — never in env, argv or logs.
+*/
+var reolinkHubConnectionSchema = object({
+	host: string().trim().min(1).describe("NVR / Home Hub IP or hostname"),
+	port: preprocess(blankToUndefined, number().int().min(1).max(65535).default(REOLINK_HUB_DEFAULT_PORT)),
+	/** The RTSP relay port the cameras dial for their streams (not the Baichuan `port`). */
+	rtspPort: preprocess(blankToUndefined, number().int().min(1).max(65535).default(554)),
+	username: preprocess(blankToUndefined, string().trim().min(1).default("admin")),
+	password: string().min(1).describe("NVR / Home Hub password").meta({ secret: true }),
+	/** Hubs are TCP-only on supported firmwares — kept for symmetry with a camera. */
+	transport: _enum(["tcp", "udp"]).default("tcp"),
+	/** UID of a hub that was paired by it; unused for a plain TCP login. */
+	uid: string().optional(),
+	debugGeneral: boolean().default(false),
+	debugSocketLogs: array(ReolinkSocketDebugFlagSchema).default([])
+});
+function stringValue(value) {
+	return typeof value === "string" ? value.trim() : "";
+}
+function readHubConnection(settings) {
+	if (stringValue(settings["host"]).length === 0) return { kind: "no-host" };
+	const password = settings["password"];
+	if (isSecretMarkerLike(password)) return { kind: "password-locked" };
+	if (typeof password !== "string" || password.length === 0) return { kind: "no-password" };
+	const parsed = reolinkHubConnectionSchema.safeParse(settings);
+	if (!parsed.success) return { kind: "no-host" };
+	return {
+		kind: "ok",
+		connection: parsed.data
+	};
+}
+/** Two reads that would dial the same way. */
+function sameHubConnection(a, b) {
+	return a.host === b.host && a.port === b.port && a.rtspPort === b.rtspPort && a.username === b.username && a.password === b.password && a.transport === b.transport && a.uid === b.uid;
+}
+/**
+* The connection + debug sections of the integration form. Fields are NOT `required` here:
+* the same schema is the addon's own settings page, where a required host would block saving
+* an unrelated email-push change on the default integration. A hub integration missing its
+* host or password is named by the session at reconcile time instead.
+*/
+function buildHubConnectionSections() {
+	return { sections: [{
+		id: HUB_CONNECTION_SECTION_ID,
+		title: "NVR / Home Hub connection",
+		titleKey: "provider-reolink:connection.s_connection.title",
+		description: "Only for an integration that is one NVR or Home Hub. Its channels are adopted as cameras that share this connection.",
+		descriptionKey: "provider-reolink:connection.s_connection.description",
+		columns: 2,
+		fields: [
+			{
+				type: "text",
+				key: "host",
+				label: "Hub IP",
+				labelKey: "provider-reolink:connection.s_connection.host.label",
+				placeholder: "192.168.10.100"
+			},
+			{
+				type: "number",
+				key: "port",
+				label: "Port",
+				labelKey: "provider-reolink:connection.s_connection.port.label",
+				default: REOLINK_HUB_DEFAULT_PORT,
+				min: 1,
+				max: 65535,
+				step: 1
+			},
+			{
+				type: "number",
+				key: "rtspPort",
+				label: "RTSP port",
+				labelKey: "provider-reolink:connection.s_connection.rtspPort.label",
+				default: 554,
+				min: 1,
+				max: 65535,
+				step: 1
+			},
+			{
+				type: "text",
+				key: "username",
+				label: "Username",
+				labelKey: "provider-reolink:connection.s_connection.username.label",
+				default: "admin"
+			},
+			{
+				type: "password",
+				key: "password",
+				label: "Password",
+				labelKey: "provider-reolink:connection.s_connection.password.label",
+				showToggle: true
+			}
+		]
+	}, {
+		id: HUB_DEBUG_SECTION_ID,
+		title: "NVR / Home Hub debug",
+		titleKey: "provider-reolink:connection.s_hub-debug.title",
+		description: "Debug logging adds log volume; use it temporarily.",
+		descriptionKey: "provider-reolink:connection.s_hub-debug.description",
+		columns: 1,
+		fields: [{
+			type: "boolean",
+			key: "debugGeneral",
+			label: "General debug logs",
+			labelKey: "provider-reolink:connection.s_hub-debug.debugGeneral.label",
+			default: false,
+			style: "switch"
+		}, {
+			type: "multiselect",
+			key: "debugSocketLogs",
+			label: "Socket trace categories",
+			labelKey: "provider-reolink:connection.s_hub-debug.debugSocketLogs.label",
+			description: "Each area adds log volume.",
+			descriptionKey: "provider-reolink:connection.s_hub-debug.debugSocketLogs.description",
+			default: [],
+			options: [{
+				value: "traceEvents",
+				label: "Events (cmd 33 — AlarmEventList push)",
+				labelKey: "provider-reolink:connection.s_hub-debug.debugSocketLogs.o_traceEvents.label"
+			}]
+		}]
+	}] };
+}
+/**
+* `true` for an integration that IS one NVR / Home Hub: it was set up from a hub candidate, was
+* migrated from a Hub device, or carries a host. The default integration (standalone cameras,
+* email push, webhook, clips) has none of the three.
+*/
+function isHubIntegration(evidence) {
+	if (evidence.originStableId?.startsWith("reolink-hub-") === true) return true;
+	if (evidence.info["migratedFromHubDeviceId"] !== void 0) return true;
+	return stringValue(evidence.settings["host"]).length > 0;
+}
+/** The form of a hub integration: its connection and debug sections, nothing of the addon's own. */
+function buildHubInstanceSchema() {
+	return buildHubConnectionSections();
+}
+//#endregion
+//#region src/hub-battery-fields.ts
+/**
+* The hub boundary for the per-channel battery power fields.
+*
+* The Reolink hub/NVR reports `chargeStatus` and `adapterStatus` as NUMBERS
+* (0/1/2); the standalone camera path reports the same facts as strings, and
+* `deriveChargingSource` (`battery-charging.ts`) speaks only the string
+* vocabulary. This module is the translation, and — the part that was
+* missing — it NAMES a code it cannot translate instead of dropping the field
+* silently. A dropped field reads as "the push said nothing about power", so
+* a new firmware value would have kept the previous belief forever, with not
+* one log line. The ledger lets the hub warn once per (device, field, code).
+*/
+var CHARGE_STATUS_BY_CODE = {
+	0: "none",
+	1: "charging",
+	2: "chargeComplete"
+};
+var ADAPTER_STATUS_BY_CODE = {
+	0: "none",
+	1: "dc",
+	2: "solarPanel"
+};
+function mapOne(field, value, byCode) {
+	if (value === void 0 || value === null) return {};
+	if (typeof value === "string") return { mapped: value };
+	if (typeof value === "number") {
+		const mapped = byCode[value];
+		if (mapped !== void 0) return { mapped };
+	}
+	return { unmapped: {
+		field,
+		value
+	} };
+}
+/** Translate one channel's raw CGI power fields; never throws. */
+function mapHubBatteryPower(cgi) {
+	const charge = mapOne("chargeStatus", cgi?.["chargeStatus"], CHARGE_STATUS_BY_CODE);
+	const adapter = mapOne("adapterStatus", cgi?.["adapterStatus"], ADAPTER_STATUS_BY_CODE);
+	return {
+		fields: {
+			...charge.mapped !== void 0 ? { chargeStatus: charge.mapped } : {},
+			...adapter.mapped !== void 0 ? { adapterStatus: adapter.mapped } : {}
+		},
+		unmapped: [...charge.unmapped !== void 0 ? [charge.unmapped] : [], ...adapter.unmapped !== void 0 ? [adapter.unmapped] : []]
+	};
+}
+/**
+* Remembers which (device, field, code) triples were already reported, so a
+* polled read warns once per finding and not once per tick. Unbounded only in
+* theory: the key space is a few cameras times two fields times the handful of
+* codes a firmware can invent.
+*/
+var UnmappedCodeLedger = class {
+	seen = /* @__PURE__ */ new Set();
+	firstSeen(deviceId, field, value) {
+		const key = `${deviceId}:${field}:${String(value)}`;
+		if (this.seen.has(key)) return false;
+		this.seen.add(key);
+		return true;
+	}
+};
+//#endregion
+//#region src/hub-channel-reconcile.ts
+/**
+* Match adopted children to the hub's own channel list by IDENTITY, then report the
+* ones whose persisted `channel` is missing or wrong.
+*
+* A child's stableId ENDS with `-${childNativeId}` (the prefix is the integration it was
+* adopted into, or the retired Hub's stableId for a migrated child), and `childNativeId` is built
+* from the camera's UID — so identity survives a channel move, while `channel` does not.
+* The hub is the authority on which slot a UID currently occupies.
+*
+* Why this exists: `loadAdoptedChildrenByChannel` keys the adopted set on the persisted
+* `channel` alone. A child that lost it is absent from that map, so the discovery panel
+* renders it `alreadyAdopted: false` — one click away from being adopted a SECOND time —
+* and `routeSimpleEvent` silently drops every push for its slot. Observed live on
+* 2026-09-04 with an Argus MagiCam that was actually on channel 3.
+*
+* Pure: no I/O. A discovered entry with no channel, or with no adopted child, is skipped —
+* this repairs what exists, it never adopts.
+*/
+function planChannelReconciliation(discovered, children) {
+	const repairs = [];
+	for (const entry of discovered) {
+		if (typeof entry.rtspChannel !== "number") continue;
+		const child = children.find((c) => c.stableId.endsWith(`-${entry.childNativeId}`));
+		if (child === void 0) continue;
+		if (child.channel === entry.rtspChannel) continue;
+		repairs.push({
+			deviceId: child.deviceId,
+			stableId: child.stableId,
+			from: child.channel ?? null,
+			to: entry.rtspChannel
+		});
+	}
+	return repairs;
+}
+function createMotionSensorTracker(now = Date.now) {
+	const latest = /* @__PURE__ */ new Map();
+	return {
+		observe(event) {
+			if (event.type !== "motion") return;
+			const sensor = event.motion.source;
+			if (sensor === void 0) return;
+			latest.set(event.channel, {
+				sensor,
+				at: now()
+			});
+		},
+		take(channel) {
+			const entry = latest.get(channel);
+			if (!entry) return null;
+			latest.delete(channel);
+			return now() - entry.at <= 2e3 ? entry.sensor : null;
+		}
+	};
+}
+var isMotionSensor = (value) => value === "md" || value === "pir" || value === "unknown";
+/**
+* The sensor a simple event states itself, for a library version that forwards
+* `motion.source` on the simple event; `null` for the versions that do not.
+*/
+function motionSensorOnSimpleEvent(event) {
+	if (!("motion" in event)) return null;
+	const motion = event.motion;
+	if (typeof motion !== "object" || motion === null || !("source" in motion)) return null;
+	return isMotionSensor(motion.source) ? motion.source : null;
+}
+//#endregion
+//#region src/simple-event-dispatch-trace.ts
+/**
+* Gate for hub-side simpleEvent traces.
+*
+* Hub-child events arrive on the parent's Baichuan socket. Logging them on
+* the child logger only is invisible when the operator filters Logs to the
+* Hub; logging every channel unconditionally floods the Hub (battery ticks).
+* Trace when the target camera — or the hub itself — is under debug.
+*/
+function shouldTraceSimpleEventDispatch(input) {
+	return wantsEventTrace(input.hubDebugGeneral, input.hubSocketFlags) || wantsEventTrace(input.childDebugGeneral, input.childSocketFlags);
+}
+function wantsEventTrace(debugGeneral, socketFlags) {
+	return debugGeneral || socketFlags.includes("traceEvents");
+}
+//#endregion
+//#region src/reolink-hub-session.ts
+var HUB_DISCOVERY_REFRESH_TIMEOUT_MS = 8e3;
+/**
+* How often the session re-reads its own channels summary to reconcile the adopted children's
+* sleep slices. 60 s: a naturally-waking camera (PIR, schedule) is caught within a minute, and
+* the play path has its own faster confirm + post-dial watch, so this only ever carries
+* background drift. Never wakes a child — the summary is answered by the hub itself.
+*/
+var HUB_CHILD_SLEEP_RECONCILE_MS = 6e4;
+var HUB_RECONNECT_BASE_MS = 2e3;
+var HUB_RECONNECT_MAX_MS = 3e4;
+var UNROUTED_LOG_THROTTLE_MS = 6e4;
+/**
+* ONE Reolink NVR / Home Hub: a single Baichuan control + event socket fronting N channels,
+* owned per integration (D985). It was the `ReolinkHub` device; the device is gone, the
+* mechanism is unchanged:
+*
+*  - one persistent socket (no per-channel login), reconnected with a bounded backoff;
+*  - every `simpleEvent` from any channel is dispatched into the matching child;
+*  - every 60 s the hub's own channels summary reconciles the children's sleep, online and
+*    battery slices — read from the hub's mains-powered socket, never from a battery camera.
+*/
+var ReolinkHubSession = class {
+	integrationId;
+	#deps;
+	#logger;
+	#now;
+	#connection;
+	#api = null;
+	#connectInFlight = null;
+	#reconnectAttempts = 0;
+	#reconnectTimer = null;
+	#reconcileTimer = null;
+	#shutdown = false;
+	#online = false;
+	#snapshot = {
+		channels: [],
+		lastRefreshAt: null,
+		lastError: null
+	};
+	#refreshInFlight = null;
+	/** Wall-clock ms of the last refresh that listed each child (by device id). */
+	#childLastSeenAt = /* @__PURE__ */ new Map();
+	/** Channels the last good refresh listed but nobody adopted: their pushes are expected drops. */
+	#knownUnadoptedChannels = /* @__PURE__ */ new Set();
+	#unroutedLoggedAt = /* @__PURE__ */ new Map();
+	#batteryShapeLogged = false;
+	#unmappedBatteryCodes = new UnmappedCodeLedger();
+	#motionSensors = createMotionSensorTracker();
+	#simpleEventBound = (event) => {
+		this.routeSimpleEvent(event);
+	};
+	#rawEventBound = (event) => {
+		this.#motionSensors.observe(event);
+	};
+	constructor(deps) {
+		this.integrationId = deps.integrationId;
+		this.#deps = deps;
+		this.#logger = deps.logger;
+		this.#connection = deps.connection;
+		this.#now = deps.now ?? Date.now;
+	}
+	get connection() {
+		return this.#connection;
+	}
+	get isOnline() {
+		return this.#online;
+	}
+	/** The integration's display name. */
+	get name() {
+		return this.#deps.name;
+	}
+	/** Restart the hub itself (not a camera behind it). */
+	async reboot() {
+		await (await this.getApi()).reboot();
+	}
+	/** The last channel list, for the adoption surface. */
+	channelSnapshot() {
+		return this.#snapshot;
+	}
+	/**
+	* What a child dials for the hub's RTSP relay. The port is the connection's RTSP port
+	* (default 554) — never the Baichuan port.
+	*/
+	relayEndpoint() {
+		const c = this.#connection;
+		return {
+			host: c.host,
+			username: c.username,
+			password: c.password,
+			port: c.rtspPort
+		};
+	}
+	/** Arm the periodic reconcile and make the first dial. Idempotent. */
+	start() {
+		if (this.#reconcileTimer === null) {
+			this.#reconcileTimer = setInterval(() => {
+				this.refresh().catch(() => {});
+			}, HUB_CHILD_SLEEP_RECONCILE_MS);
+			if (typeof this.#reconcileTimer.unref === "function") this.#reconcileTimer.unref();
+		}
+		this.getApi().catch((err) => {
+			this.#logger.warn("Reolink hub initial connect failed — will retry", {
+				tags: { integrationId: this.integrationId },
+				meta: { error: errMsg$3(err) }
+			});
+		});
+	}
+	/**
+	* Apply a new connection. A session already dialled the same way keeps its socket; any real
+	* change tears the socket down and re-dials with the new credentials.
+	*/
+	async reconfigure(connection) {
+		if (sameHubConnection(this.#connection, connection)) {
+			this.#connection = connection;
+			return;
+		}
+		this.#connection = connection;
+		await this.dropApi("settings-changed");
+		this.#setOnline(false);
+		this.getApi().catch((err) => {
+			this.#logger.warn("Reolink hub re-dial after settings change failed", {
+				tags: { integrationId: this.integrationId },
+				meta: { error: errMsg$3(err) }
+			});
+		});
+	}
+	async close() {
+		this.#shutdown = true;
+		if (this.#reconnectTimer !== null) {
+			clearTimeout(this.#reconnectTimer);
+			this.#reconnectTimer = null;
+		}
+		if (this.#reconcileTimer !== null) {
+			clearInterval(this.#reconcileTimer);
+			this.#reconcileTimer = null;
+		}
+		await this.dropApi("hub-shutdown");
+	}
+	/**
+	* The logged-in api (single round-trip on first call). Mid-disconnect, callers wait for the
+	* reconnect that is already in flight.
+	*/
+	async getApi() {
+		const live = this.#api;
+		if (live !== null && live.client.isSocketConnected() && live.client.loggedIn) return live;
+		if (this.#connectInFlight !== null) return this.#connectInFlight;
+		this.#connectInFlight = this.#connect().finally(() => {
+			this.#connectInFlight = null;
+		});
+		return this.#connectInFlight;
+	}
+	async dropApi(reason) {
+		const api = this.#api;
+		this.#api = null;
+		if (api === null) return;
+		try {
+			await api.close({ reason });
+		} catch {}
+	}
+	async #connect() {
+		await this.dropApi("hub-reconnect");
+		const connection = this.#connection;
+		if (connection.host.length === 0) throw userError("reolink.hub-host-missing", void 0, "Reolink Hub: host not configured");
+		if (connection.password.length === 0) throw userError("reolink.hub-password-missing", void 0, "Reolink Hub: password not configured");
+		this.#logger.info("Reolink hub connecting", {
+			tags: { integrationId: this.integrationId },
+			meta: {
+				host: connection.host,
+				port: connection.port,
+				transport: connection.transport
+			}
+		});
+		const api = await this.#deps.connect(connection);
+		try {
+			await api.offSimpleEvent(this.#simpleEventBound);
+		} catch {}
+		api.client.off("event", this.#rawEventBound);
+		api.client.prependListener("event", this.#rawEventBound);
+		await api.onSimpleEvent(this.#simpleEventBound);
+		api.client.on("close", () => this.#scheduleReconnect("socket-close"));
+		api.client.on("error", (err) => {
+			this.#logger.warn("Reolink hub socket error — scheduling reconnect", {
+				tags: { integrationId: this.integrationId },
+				meta: { error: errMsg$3(err) }
+			});
+			this.#scheduleReconnect("socket-error");
+		});
+		this.#api = api;
+		this.#reconnectAttempts = 0;
+		this.#setOnline(true);
+		this.refresh().catch(() => {});
+		return api;
+	}
+	#setOnline(online) {
+		if (this.#online === online) return;
+		this.#online = online;
+		this.#deps.onConnectionChange?.(online);
+	}
+	#scheduleReconnect(reason) {
+		if (this.#shutdown) return;
+		this.#api = null;
+		this.#setOnline(false);
+		if (this.#reconnectTimer !== null) return;
+		const backoff = Math.min(HUB_RECONNECT_BASE_MS * 2 ** this.#reconnectAttempts, HUB_RECONNECT_MAX_MS);
+		this.#reconnectAttempts += 1;
+		this.#logger.info("Reolink hub reconnect scheduled", {
+			tags: { integrationId: this.integrationId },
+			meta: {
+				reason,
+				attempt: this.#reconnectAttempts,
+				backoffMs: backoff
+			}
+		});
+		this.#reconnectTimer = setTimeout(() => {
+			this.#reconnectTimer = null;
+			this.getApi().catch(() => {});
+		}, backoff);
+	}
+	/**
+	* Pull the channel list from the hub via `getNvrChannelsSummary({ source: 'cgi' })` — CGI,
+	* because `GetChannelstatus` answers synchronously (no race against the cmd_id 145 push
+	* cache that is empty right after login). Single-flight.
+	*/
+	refresh() {
+		if (this.#refreshInFlight !== null) return this.#refreshInFlight;
+		const run = this.#refresh().finally(() => {
+			this.#refreshInFlight = null;
+		});
+		this.#refreshInFlight = run;
+		return run;
+	}
+	async #refresh() {
+		const startedAt = this.#now();
+		let lastError = null;
+		let channels = [];
+		try {
+			channels = (await (await this.getApi()).getNvrChannelsSummary({
+				source: "cgi",
+				timeoutMs: HUB_DISCOVERY_REFRESH_TIMEOUT_MS
+			})).devices.map((d) => ({
+				childNativeId: computeChildNativeId(d.channel, d.uid),
+				channel: d.channel,
+				name: d.name ?? `Channel ${d.channel}`,
+				status: discoveredStatusFor(d),
+				...d.uid ? { uid: d.uid } : {},
+				...d.model ? { model: d.model } : {},
+				...d.serialNumber ? { serialNumber: d.serialNumber } : {},
+				isBattery: d.isBattery === true,
+				isDoorbell: d.isDoorbell === true,
+				isMultifocal: d.isMultifocal === true
+			}));
+		} catch (err) {
+			lastError = errMsg$3(err);
+			this.#logger.warn("Reolink hub channel refresh failed", {
+				tags: { integrationId: this.integrationId },
+				meta: { error: lastError }
+			});
+		}
+		this.#snapshot = lastError === null ? {
+			channels,
+			lastRefreshAt: this.#now(),
+			lastError: null
+		} : {
+			...this.#snapshot,
+			lastError
+		};
+		if (lastError !== null) return;
+		await this.reconcileChildChannels(channels);
+		const adoptedChannels = /* @__PURE__ */ new Set();
+		for (const child of this.#deps.children()) if (child.channel !== void 0) adoptedChannels.add(child.channel);
+		this.#knownUnadoptedChannels.clear();
+		for (const c of channels) if (!adoptedChannels.has(c.channel)) this.#knownUnadoptedChannels.add(c.channel);
+		this.#logger.info("Reolink hub: channel refresh complete", {
+			tags: { integrationId: this.integrationId },
+			meta: {
+				durationMs: this.#now() - startedAt,
+				total: channels.length,
+				adopted: channels.filter((c) => adoptedChannels.has(c.channel)).length,
+				online: channels.filter((c) => c.status === "online").length,
+				sleeping: channels.filter((c) => c.status === "sleeping").length
+			}
+		});
+		this.reconcileChildOnline(channels);
+		this.reconcileChildSleepState(channels);
+		await this.reconcileChildBattery();
+	}
+	/**
+	* Re-derive each adopted child's `channel` from the hub's own list, matching by IDENTITY
+	* (the stableId carries the camera UID) rather than by the channel itself — a child that lost
+	* its channel is invisible to the routing, and a channel move produces the same damage under
+	* a wrong number. A child that is not live is skipped: it is repaired on its next restore.
+	*/
+	async reconcileChildChannels(channels) {
+		const children = this.#deps.children();
+		const repairs = planChannelReconciliation(channels.map((c) => ({
+			childNativeId: c.childNativeId,
+			rtspChannel: c.channel
+		})), children.map((child) => ({
+			deviceId: child.id,
+			stableId: child.stableId,
+			...child.channel !== void 0 ? { channel: child.channel } : {}
+		})));
+		for (const repair of repairs) {
+			const child = children.find((c) => c.id === repair.deviceId);
+			if (child === void 0) continue;
+			try {
+				await child.repairChannel(repair.to);
+				this.#logger.warn("Reolink hub: repaired a child channel from the hub channel list", {
+					tags: {
+						deviceId: repair.deviceId,
+						stableId: repair.stableId
+					},
+					meta: {
+						from: repair.from,
+						to: repair.to
+					}
+				});
+			} catch (err) {
+				this.#logger.warn("Reolink hub: child channel repair failed", {
+					tags: {
+						deviceId: repair.deviceId,
+						stableId: repair.stableId
+					},
+					meta: {
+						from: repair.from,
+						to: repair.to,
+						error: errMsg$3(err)
+					}
+				});
+			}
+		}
+	}
+	/**
+	* Mark every child still listed `online`, and any child missing for more than
+	* `HUB_MISSING_OFFLINE_MS` `offline` — "if the hub firmware doesn't list it, the device isn't
+	* reachable through the hub". Battery cams that briefly drop out of the summary during deep
+	* sleep are not false-flagged: the threshold gives 3+ cycles of grace.
+	*/
+	reconcileChildOnline(channels) {
+		const now = this.#now();
+		const listed = new Set(channels.map((c) => c.channel));
+		for (const child of this.#deps.children()) {
+			const ch = child.channel;
+			if (ch === void 0) continue;
+			if (child.type !== DeviceType.Camera) continue;
+			if (listed.has(ch)) {
+				this.#childLastSeenAt.set(child.id, now);
+				if (!child.online) {
+					child.markOnline(true);
+					this.#logger.info("Reolink hub: adopted child back online", {
+						tags: {
+							deviceId: child.id,
+							deviceName: child.name
+						},
+						meta: { channel: ch }
+					});
+				}
+				continue;
+			}
+			const lastSeen = this.#childLastSeenAt.get(child.id) ?? 0;
+			const missingMs = lastSeen > 0 ? now - lastSeen : Number.POSITIVE_INFINITY;
+			if (missingMs >= 6e5 && child.online) {
+				child.markOnline(false);
+				this.#logger.warn("Reolink hub: adopted child marked offline (missing from the hub list)", {
+					tags: {
+						deviceId: child.id,
+						deviceName: child.name
+					},
+					meta: {
+						channel: ch,
+						missingMs
+					}
+				});
+			}
+		}
+	}
+	/**
+	* Push the hub's per-channel sleep state into each adopted battery child's `battery.sleeping`
+	* slice. The summary carries a `sleeping` flag straight from the firmware over the hub's own
+	* mains-powered socket: it costs the battery channel nothing, and it is real firmware state
+	* rather than socket-I/O inference. Only `online` / `sleeping` are acted on: `offline` and
+	* `unknown` carry no sleep information, so the last known value stands.
+	*/
+	reconcileChildSleepState(channels) {
+		const byChannel = new Map(channels.map((c) => [c.channel, c]));
+		for (const child of this.#deps.children()) {
+			if (child.channel === void 0) continue;
+			const entry = byChannel.get(child.channel);
+			if (entry === void 0) continue;
+			if (entry.status !== "sleeping" && entry.status !== "online") continue;
+			child.applyHubSleepState(entry.status === "sleeping");
+		}
+	}
+	/**
+	* Push the hub's per-channel battery read into each adopted battery child.
+	* `getAllChannelsBatteryInfo` is one CGI on the hub's own socket — it never touches a battery
+	* camera — and it is the ONLY way a sleeping child's percentage/charging ever moves.
+	* Independent of the refresh's success path: a battery-read failure must not fail the refresh.
+	*/
+	async reconcileChildBattery() {
+		const children = this.#deps.children();
+		if (children.length === 0) return;
+		try {
+			const data = await (await this.getApi()).getAllChannelsBatteryInfo();
+			const entries = Object.entries(data.batteryInfoData);
+			if (entries.length === 0) return;
+			if (!this.#batteryShapeLogged) {
+				this.#batteryShapeLogged = true;
+				this.#logger.info("Reolink hub: per-channel battery payload (first read)", {
+					tags: { integrationId: this.integrationId },
+					meta: { raw: entries.map(([ch, v]) => ({
+						channel: Number(ch),
+						...v
+					})) }
+				});
+			}
+			for (const [chKey, info] of entries) {
+				const child = children.find((c) => c.channel === Number(chKey));
+				if (child === void 0) continue;
+				const power = mapHubBatteryPower(info.entries[0]);
+				for (const { field, value } of power.unmapped) {
+					if (!this.#unmappedBatteryCodes.firstSeen(child.id, field, value)) continue;
+					this.#logger.warn("Reolink hub: unmapped battery power code — field dropped", {
+						tags: { deviceId: child.id },
+						meta: {
+							channel: Number(chKey),
+							field,
+							value
+						}
+					});
+				}
+				child.applyHubBatteryInfo({
+					batteryPercent: info.batteryLevel,
+					...power.fields
+				});
+			}
+		} catch (err) {
+			this.#logger.debug("Reolink hub: per-channel battery refresh failed", {
+				tags: { integrationId: this.integrationId },
+				meta: { error: errMsg$3(err) }
+			});
+		}
+	}
+	/** Dispatch a hub-received simpleEvent to the matching child's `handleSimpleEvent`. */
+	routeSimpleEvent(event) {
+		const channel = event?.channel;
+		if (typeof channel !== "number") return;
+		const motionSensor = event.type === "motion" ? this.#motionSensors.take(channel) : null;
+		const child = this.#deps.children().find((c) => c.channel === channel);
+		if (child === void 0) {
+			const last = this.#unroutedLoggedAt.get(channel) ?? 0;
+			const now = this.#now();
+			if (now - last > UNROUTED_LOG_THROTTLE_MS) {
+				this.#unroutedLoggedAt.set(channel, now);
+				const knownUnadopted = this.#knownUnadoptedChannels.has(channel);
+				this.#logger[knownUnadopted ? "debug" : "warn"]("Reolink hub: simpleEvent for an unmapped channel dropped", {
+					tags: { integrationId: this.integrationId },
+					meta: {
+						channel,
+						type: event?.type ?? "unknown",
+						knownUnadopted
+					}
+				});
+			}
+			return;
+		}
+		try {
+			if (shouldTraceSimpleEventDispatch({
+				hubDebugGeneral: this.#connection.debugGeneral,
+				hubSocketFlags: this.#connection.debugSocketLogs,
+				childDebugGeneral: child.debugGeneral,
+				childSocketFlags: child.debugSocketFlags
+			})) this.#logger.info("Reolink hub: simpleEvent dispatch", {
+				tags: { deviceId: child.id },
+				meta: {
+					type: event?.type ?? "unknown",
+					channel,
+					timestamp: event?.timestamp,
+					name: child.name
+				}
+			});
+			child.handleSimpleEvent(event, motionSensor);
+		} catch (err) {
+			this.#logger.debug("Reolink hub simpleEvent dispatch failed", {
+				tags: { deviceId: child.id },
+				meta: {
+					channel,
+					error: errMsg$3(err)
+				}
+			});
+		}
+	}
+};
+/**
+* A stable per-child identifier. UID is preferred when available (it identifies a paired camera
+* across re-pairings); otherwise `channel-N`, which is stable for a fixed channel assignment.
+*/
+function computeChildNativeId(channel, uid) {
+	if (uid && uid.length > 0) return `cam-${uid}`;
+	return `channel-${channel}`;
+}
+/**
+* Map the lib's per-channel summary booleans to our `DiscoveredChildStatus`. Precedence:
+* `online === false` → offline; `sleeping === true` → sleeping; `online === true` → online;
+* any non-empty state → online; unknown otherwise (the cmd_id 145 push has not landed yet).
+*/
+function discoveredStatusFor(d) {
+	if (d.online === false) return "offline";
+	if (d.sleeping === true) return "sleeping";
+	if (d.online === true) return "online";
+	if (typeof d.state === "string" && d.state.length > 0) return "online";
+	return "unknown";
+}
+/** The wire-shaped channel the adoption surface lists. */
+function toDiscoveredChild(channel, adoptedDeviceId) {
+	return {
+		childNativeId: channel.childNativeId,
+		name: channel.name,
+		type: DeviceType.Camera,
+		status: channel.status,
+		metadata: {
+			...channel.model ? { model: channel.model } : {},
+			...channel.serialNumber ? { serialNumber: channel.serialNumber } : {},
+			...channel.uid ? { uid: channel.uid } : {},
+			rtspChannel: channel.channel,
+			isBattery: channel.isBattery,
+			isDoorbell: channel.isDoorbell,
+			isMultifocal: channel.isMultifocal
+		},
+		alreadyAdopted: adoptedDeviceId !== null,
+		adoptedDeviceId
+	};
+}
+var GATEWAY_SUFFIX = ":gateway";
+/** The `childNativeId` of the hub box itself, one per integration. */
+function hubGatewayNativeId(integrationId) {
+	return `${integrationId}${GATEWAY_SUFFIX}`;
+}
+/**
+* The hub (NVR / Home Hub) as an adoption candidate: a {@link DeviceType.Gateway} that is a
+* sibling of its channel cameras, never their parent. Only what the library really exposes:
+* `reboot` (Baichuan `Reboot`) and the unit's web page.
+*/
+function toDiscoveredGateway(input) {
+	return {
+		childNativeId: hubGatewayNativeId(input.integrationId),
+		name: input.name,
+		type: DeviceType.Gateway,
+		status: input.online ? "online" : "offline",
+		metadata: { manufacturer: "Reolink" },
+		alreadyAdopted: input.adoptedDeviceId !== null,
+		adoptedDeviceId: input.adoptedDeviceId,
+		capabilities: [rebootCapability.name, deviceAdminLinkCapability.name]
+	};
+}
+/**
+* The per-integration registry the cameras reach their session through (the shape of
+* `veluxGateways` / `enpalConnections`). It also holds the children, so a child that activates
+* before its session exists (boot order) is already routable the moment the session starts.
+*/
+var ReolinkHubSessions = class {
+	#sessions = /* @__PURE__ */ new Map();
+	#children = /* @__PURE__ */ new Map();
+	set(integrationId, session) {
+		if (session === null) {
+			this.#sessions.delete(integrationId);
+			return;
+		}
+		this.#sessions.set(integrationId, session);
+	}
+	get(integrationId) {
+		return this.#sessions.get(integrationId) ?? null;
+	}
+	attach(integrationId, child) {
+		let set = this.#children.get(integrationId);
+		if (set === void 0) {
+			set = /* @__PURE__ */ new Map();
+			this.#children.set(integrationId, set);
+		}
+		set.set(child.id, child);
+	}
+	/** Detach only if `child` is still the attached handle — a rebuilt device keeps its slot. */
+	detach(integrationId, child) {
+		const set = this.#children.get(integrationId);
+		if (set?.get(child.id) === child) set.delete(child.id);
+	}
+	childrenOf(integrationId) {
+		return [...this.#children.get(integrationId)?.values() ?? []];
+	}
+	clear() {
+		this.#sessions.clear();
+		this.#children.clear();
+	}
+};
+/** The module-level registry (one per addon process). */
+var reolinkHubSessions = new ReolinkHubSessions();
+/** Dial a real hub. The default `connect` dependency of a session. */
+async function connectReolinkHub(connection) {
+	const api = new ReolinkBaichuanApi({
+		host: connection.host,
+		port: connection.port,
+		username: connection.username,
+		password: connection.password,
+		transport: connection.transport,
+		...connection.uid ? { uid: connection.uid } : {}
+	});
+	await api.login();
+	return api;
+}
+//#endregion
 //#region src/sleep-state-decision.ts
 /**
 * Hysteresis is ASYMMETRIC, because the two directions have very different
@@ -207518,6 +207535,34 @@ function decideSnapshotCameraAccess(input) {
 	};
 }
 //#endregion
+//#region src/webhook-generation.ts
+/**
+* Point a battery camera's webhook at the data-plane URL ONCE per URL generation.
+*
+* Runs on a camera's first Baichuan contact after the upgrade (the one moment it is awake without
+* us waking it). Only a camera that is actually armed is moved: reading its HaCfg decides, so a
+* camera on e-mail push is never switched to the webhook by an upgrade. The generation is written
+* only when the camera was moved or found not to need moving; a failure (no internal address, the
+* camera refusing the write) leaves it unwritten, so the next contact tries again.
+*/
+async function repointWebhookOnce(ports) {
+	const stored = ports.readGeneration();
+	if (stored !== void 0 && stored >= 1) return "current";
+	const armed = await ports.readCameraHaCfg();
+	if (armed === void 0 || !armed.enable || armed.url.length === 0) {
+		await ports.writeGeneration(1);
+		return "not-armed";
+	}
+	const url = await ports.targetUrl();
+	if (armed.url === url) {
+		await ports.writeGeneration(1);
+		return "already-there";
+	}
+	await ports.arm(url);
+	await ports.writeGeneration(1);
+	return "repointed";
+}
+//#endregion
 //#region src/accessories/base.ts
 /**
 * Reolink accessory base layer — kind enum, parent-host contract,
@@ -211934,7 +211979,7 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 		}
 		if (!this.baichuanWebhookParamsResolver) throw userError("reolink.webhook-not-wired", void 0, "HaCfg Webhook Server is not wired — restart the Reolink addon");
 		const params = await this.baichuanWebhookParamsResolver();
-		if (!params) throw new Error("Enable the HaCfg Webhook Server in the Reolink addon settings, and ensure this host has a reachable LAN address.");
+		if (!params) throw new Error("The HaCfg webhook cannot be armed for this camera (it is not a standalone battery camera).");
 		await this.wakeIfSleeping();
 		const api = await this.ensureApi();
 		const supported = await api.probeBaichuanWebhookSupport();
@@ -211951,12 +211996,47 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 		try {
 			await api.subscribeEvents();
 		} catch {}
+		await this.config.setAll({ webhookUrlGeneration: 1 });
 		this.ctx.logger.info("baichuan-webhook: camera auto-configure applied", {
 			tags: { deviceId: this.id },
 			meta: { url: params.url }
 		});
 	}
 	/**
+	* Move this battery camera's HaCfg webhook to the addon's data-plane URL, once, on the first
+	* Baichuan contact after the upgrade (the camera is awake: this costs no wake). Only a camera
+	* that is armed is touched; a failure is logged and retried at the next contact.
+	*/
+	async repointWebhookOnFirstContact(api) {
+		const resolver = this.baichuanWebhookParamsResolver;
+		if (!this.isBattery || !this.isEmailPushEligible || resolver === void 0) return;
+		try {
+			if (await repointWebhookOnce({
+				readGeneration: () => this.config.get("webhookUrlGeneration"),
+				writeGeneration: async (generation) => {
+					await this.config.setAll({ webhookUrlGeneration: generation });
+				},
+				readCameraHaCfg: async () => await api.getHaCfg(),
+				targetUrl: async () => {
+					const params = await resolver();
+					if (params === null) throw new Error("this camera has no webhook URL");
+					return params.url;
+				},
+				arm: async (url) => {
+					await api.setupBaichuanWebhookToManager({
+						url,
+						verifyCert: false
+					});
+				}
+			}) === "repointed") this.ctx.logger.info("baichuan-webhook: camera moved to the data-plane URL", { tags: { deviceId: this.id } });
+		} catch (err) {
+			this.ctx.logger.warn("baichuan-webhook: re-point failed — retried at the next contact", {
+				tags: { deviceId: this.id },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+		}
+	}
+	/**
 	* Read the camera's OWN email/SMTP config (`getEmail` cmd 42 + `getEmailTask`
 	* cmd 216) and persist a snapshot into `deviceCache.emailConfigSnapshot` so
 	* the Email Push settings section can show the camera's CURRENT mail config
@@ -218157,6 +218237,7 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 				this.registerBatteryIfSupported();
 				this.refreshBatteryFromApi("demand");
 			}
+			if (this.isBattery) this.repointWebhookOnFirstContact(api);
 			this.startWatchdogs();
 			this.probeAndPersistFeatures(api).catch((err) => {
 				this.ctx.logger.debug("Reolink feature probe failed (non-fatal)", {
@@ -218211,7 +218292,7 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 		return {
 			type: "device",
 			id: this.id,
-			addonId: REOLINK_ADDON_ID,
+			addonId: REOLINK_ADDON_ID$1,
 			deviceId: this.id
 		};
 	}
@@ -218304,7 +218385,7 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 				this.ctx.logger.info("Reolink camera woke up", { tags: { deviceId: this.id } });
 				this.ctx.eventBus.emit(createEvent(EventCategory.DeviceAwake, eventSource, {
 					deviceId: this.id,
-					providerId: REOLINK_ADDON_ID,
+					providerId: REOLINK_ADDON_ID$1,
 					reason: "awake"
 				}));
 				this.onWakeTransition("simple-event").catch(() => {});
@@ -218318,12 +218399,12 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 				this.markOnline(next);
 				this.ctx.eventBus.emit(createEvent(next ? EventCategory.DeviceOnline : EventCategory.DeviceOffline, eventSource, next ? {
 					deviceId: this.id,
-					providerId: REOLINK_ADDON_ID,
+					providerId: REOLINK_ADDON_ID$1,
 					profileCount: 0,
 					reason: "firmware-push"
 				} : {
 					deviceId: this.id,
-					providerId: REOLINK_ADDON_ID,
+					providerId: REOLINK_ADDON_ID$1,
 					reason: "firmware-push"
 				}));
 			}
@@ -218334,7 +218415,7 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 			if (!this.commitSleepState(true, "simple-event")) return;
 			if (!wasSleeping) this.ctx.eventBus.emit(createEvent(EventCategory.DeviceSleeping, eventSource, {
 				deviceId: this.id,
-				providerId: REOLINK_ADDON_ID,
+				providerId: REOLINK_ADDON_ID$1,
 				reason: "sleeping"
 			}));
 			if (this.active.size > 0) {
@@ -218566,7 +218647,7 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 		this.markOnline(false);
 		this.ctx.eventBus.emit(createEvent(EventCategory.DeviceOffline, this.eventSource(), {
 			deviceId: this.id,
-			providerId: REOLINK_ADDON_ID,
+			providerId: REOLINK_ADDON_ID$1,
 			reason: "unreachable"
 		}));
 	}
@@ -218580,7 +218661,7 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 		this.markOnline(true);
 		this.ctx.eventBus.emit(createEvent(EventCategory.DeviceOnline, this.eventSource(), {
 			deviceId: this.id,
-			providerId: REOLINK_ADDON_ID,
+			providerId: REOLINK_ADDON_ID$1,
 			profileCount: 0,
 			reason: "reachable-again"
 		}));
@@ -218763,281 +218844,6 @@ var AutodetectCache = class {
 	}
 };
 //#endregion
-//#region src/baichuan-webhook-shared.ts
-/** Default HTTP listen port for HaCfg POSTs (matches nodelink docs / HA). */
-var DEFAULT_BAICHUAN_WEBHOOK_PORT = 9081;
-/** Path prefix before the camera id. Final route: `${prefix}/:cameraId`. */
-var DEFAULT_BAICHUAN_WEBHOOK_PATH_PREFIX = "/webhook";
-/**
-* Absolute URL a camera should POST HaCfg events to.
-* HTTP (not HTTPS): Reolink HaCfg often fails TLS verify against the hub's
-* self-signed cert; the intake binds a dedicated LAN port like SMTP.
-*/
-function buildBaichuanWebhookUrl(params) {
-	const prefix = (params.pathPrefix ?? "/webhook").replace(/\/$/, "");
-	const id = encodeURIComponent(params.cameraId);
-	return `http://${params.host}:${String(params.port)}${prefix}/${id}`;
-}
-//#endregion
-//#region src/baichuan-webhook-schema.ts
-/**
-* Addon-level settings for the Baichuan HaCfg HTTP intake.
-*
-* Sibling of the Email/SMTP Push sections — same integration home
-* (System → Integrations → Reolink). Declared via
-* `integrationSettingSections()`.
-*/
-var BAICHUAN_WEBHOOK_SECTION_IDS = ["baichuan-webhook"];
-function buildBaichuanWebhookSettingsSchema(recommendedHost) {
-	return { sections: [{
-		id: "baichuan-webhook",
-		title: "Battery-cam Motion (HaCfg Webhook)",
-		titleKey: "provider-reolink:baichuanWebhookSettings.s_baichuan-webhook.title",
-		description: "Preferred over email push when the camera firmware supports it.",
-		descriptionKey: "provider-reolink:baichuanWebhookSettings.s_baichuan-webhook.description",
-		columns: 2,
-		fields: [
-			{
-				type: "boolean",
-				key: "baichuanWebhookEnabled",
-				label: "Enable HaCfg Webhook Server",
-				labelKey: "provider-reolink:baichuanWebhookSettings.s_baichuan-webhook.baichuanWebhookEnabled.label",
-				default: true
-			},
-			{
-				type: "info",
-				key: "baichuanWebhookRecommendedHost",
-				label: "Camera-facing host",
-				labelKey: "provider-reolink:baichuanWebhookSettings.s_baichuan-webhook.baichuanWebhookRecommendedHost.label",
-				content: `Point cameras at this host: ${recommendedHost}`
-			},
-			{
-				type: "number",
-				key: "baichuanWebhookPort",
-				label: "HTTP Port",
-				labelKey: "provider-reolink:baichuanWebhookSettings.s_baichuan-webhook.baichuanWebhookPort.label",
-				default: DEFAULT_BAICHUAN_WEBHOOK_PORT,
-				min: 1,
-				max: 65535
-			},
-			{
-				type: "text",
-				key: "baichuanWebhookBindHost",
-				label: "Bind host",
-				labelKey: "provider-reolink:baichuanWebhookSettings.s_baichuan-webhook.baichuanWebhookBindHost.label",
-				default: "0.0.0.0",
-				description: "0.0.0.0 accepts on every interface (cameras on LAN).",
-				descriptionKey: "provider-reolink:baichuanWebhookSettings.s_baichuan-webhook.baichuanWebhookBindHost.description"
-			}
-		]
-	}] };
-}
-//#endregion
-//#region src/email-push-shared.ts
-/**
-* Map the lib's email-push classifier output onto the `ReolinkSimpleEvent`
-* types the camera should be fed. AI subtypes + motion pass through;
-* anything unrecognised collapses to plain `motion` so a wake is never
-* silently dropped.
-*
-* Returns a LIST rather than a single type because of `doorbell`. The
-* camera's `handleSimpleEvent` emits `ProviderMotion` for `motion`
-* and for every AI class, but the `doorbell` branch emits ONLY
-* `DoorbellOnPressed` and returns. An email is the sole signal a sleeping
-* battery camera can send, so a doorbell-classified email mapped to
-* `doorbell` alone rang the bell and left motion, recording and
-* notification rules blind — the exact "silently dropped wake" this mapping
-* exists to prevent. Pairing it with `motion` keeps the doorbell semantic
-* AND the wake.
-*/
-function mapInferredTypeToSimpleEvents(inferred) {
-	switch (inferred) {
-		case "people":
-		case "vehicle":
-		case "animal":
-		case "face":
-		case "package":
-		case "motion": return [inferred];
-		case "doorbell": return ["doorbell", "motion"];
-		default: return ["motion"];
-	}
-}
-/**
-* Enumerate candidate camera-facing LAN addresses, best first (private
-* RFC-1918 ranges ranked ahead of public). Link-local and internal
-* interfaces are excluded — a camera can't reach 127.0.0.1.
-*/
-function listLanHosts() {
-	const ifaces = os.networkInterfaces();
-	const candidates = [];
-	for (const list of Object.values(ifaces)) {
-		if (!list) continue;
-		for (const addr of list) {
-			if (addr.family !== "IPv4") continue;
-			if (addr.internal) continue;
-			if (addr.address.startsWith("169.254.")) continue;
-			const rank = addr.address.startsWith("192.168.") ? 0 : addr.address.startsWith("10.") ? 1 : /^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(addr.address) ? 2 : 3;
-			candidates.push({
-				addr: addr.address,
-				rank
-			});
-		}
-	}
-	candidates.sort((a, b) => a.rank - b.rank);
-	return candidates.map((c) => c.addr);
-}
-//#endregion
-//#region src/baichuan-webhook-server.ts
-function readString(raw, key, fallback) {
-	const v = raw[key];
-	return typeof v === "string" && v.length > 0 ? v : fallback;
-}
-function readNumber(raw, key, fallback) {
-	const v = raw[key];
-	return typeof v === "number" && Number.isFinite(v) ? v : fallback;
-}
-function readBoolean(raw, key, fallback) {
-	const v = raw[key];
-	return typeof v === "boolean" ? v : fallback;
-}
-var ReolinkBaichuanWebhookServer = class {
-	deps;
-	instance;
-	busOff;
-	settings;
-	constructor(deps) {
-		this.deps = deps;
-	}
-	async resolveSettings() {
-		if (this.settings) return this.settings;
-		const raw = await this.deps.readStore();
-		this.settings = {
-			enabled: readBoolean(raw, "baichuanWebhookEnabled", true),
-			port: readNumber(raw, "baichuanWebhookPort", DEFAULT_BAICHUAN_WEBHOOK_PORT),
-			bindHost: readString(raw, "baichuanWebhookBindHost", "0.0.0.0")
-		};
-		return this.settings;
-	}
-	/** Drop the cached settings so the next start re-reads the store. */
-	reloadSettings() {
-		this.settings = void 0;
-	}
-	findCameraByStableId(stableId) {
-		return this.deps.listCameras().find((c) => c.stableId === stableId);
-	}
-	resolveCameraId(pathId) {
-		const cam = this.findCameraByStableId(pathId);
-		if (!cam || !cam.isEmailPushEligible) return void 0;
-		return pathId;
-	}
-	dispatchEvent(event) {
-		const cam = this.findCameraByStableId(event.cameraId);
-		if (!cam) {
-			this.deps.logger.warn("baichuan-webhook: event for unknown camera id — dropping", { meta: {
-				cameraId: event.cameraId,
-				event: event.event
-			} });
-			return;
-		}
-		const types = mapBaichuanWebhookToSimpleEvents({
-			event: event.event,
-			reason: event.reason
-		});
-		this.deps.logger.info("baichuan-webhook: event received from battery camera", {
-			tags: { deviceId: cam.id },
-			meta: {
-				event: event.event,
-				reason: event.reason,
-				types
-			}
-		});
-		const timestamp = Date.now();
-		const channel = cam.emailPushChannel;
-		for (const type of types) cam.handleSimpleEvent({
-			type,
-			channel,
-			timestamp,
-			source: "baichuanWebhook"
-		});
-	}
-	async start() {
-		const settings = await this.resolveSettings();
-		if (!settings.enabled) {
-			this.deps.logger.debug("baichuan-webhook: disabled — HTTP intake not started");
-			return;
-		}
-		if (this.instance) {
-			this.instance.updateConfig({
-				port: settings.port,
-				bindHost: settings.bindHost,
-				pathPrefix: DEFAULT_BAICHUAN_WEBHOOK_PATH_PREFIX
-			});
-			return;
-		}
-		this.instance = createBaichuanWebhookServer({
-			config: {
-				port: settings.port,
-				bindHost: settings.bindHost,
-				pathPrefix: DEFAULT_BAICHUAN_WEBHOOK_PATH_PREFIX
-			},
-			cameraResolver: (pathId) => this.resolveCameraId(pathId),
-			enabled: true,
-			logger: {
-				debug: (m) => this.deps.logger.debug(`[hacfg] ${m}`),
-				info: (m) => this.deps.logger.info(`[hacfg] ${m}`),
-				warn: (m) => this.deps.logger.warn(`[hacfg] ${m}`),
-				error: (m) => this.deps.logger.error(`[hacfg] ${m}`)
-			}
-		});
-		this.busOff = onBaichuanWebhookEvent((event) => this.dispatchEvent(event));
-		try {
-			await this.instance.start();
-			this.deps.logger.info("baichuan-webhook: HTTP intake listening", { meta: {
-				host: settings.bindHost,
-				port: settings.port,
-				pathPrefix: DEFAULT_BAICHUAN_WEBHOOK_PATH_PREFIX
-			} });
-		} catch (err) {
-			this.deps.logger.error("baichuan-webhook: HTTP intake failed to start", { meta: { error: err instanceof Error ? err.message : String(err) } });
-			this.busOff?.();
-			this.busOff = void 0;
-			this.instance = void 0;
-		}
-	}
-	async restart() {
-		await this.stop();
-		this.reloadSettings();
-		await this.start();
-	}
-	async stop() {
-		this.busOff?.();
-		this.busOff = void 0;
-		if (this.instance) {
-			await this.instance.stop().catch(() => {});
-			this.instance = void 0;
-		}
-	}
-	/**
-	* Absolute HaCfg URL for one camera, or null when the intake is off /
-	* has no LAN host / the camera is ineligible.
-	*/
-	async buildCameraSetupParams(cam) {
-		if (!cam.isEmailPushEligible) return null;
-		const settings = await this.resolveSettings();
-		if (!settings.enabled) return null;
-		const managerHost = listLanHosts()[0];
-		if (!managerHost) return null;
-		return {
-			url: buildBaichuanWebhookUrl({
-				host: managerHost,
-				port: settings.port,
-				cameraId: cam.stableId
-			}),
-			verifyCert: false
-		};
-	}
-};
-//#endregion
 //#region src/creation-schema.ts
 /**
 * Creation form for Reolink devices.
@@ -219221,6 +219027,36 @@ function buildCreationFormSchema() {
 	] };
 }
 //#endregion
+//#region src/email-push-shared.ts
+/**
+* Map the lib's email-push classifier output onto the `ReolinkSimpleEvent`
+* types the camera should be fed. AI subtypes + motion pass through;
+* anything unrecognised collapses to plain `motion` so a wake is never
+* silently dropped.
+*
+* Returns a LIST rather than a single type because of `doorbell`. The
+* camera's `handleSimpleEvent` emits `ProviderMotion` for `motion`
+* and for every AI class, but the `doorbell` branch emits ONLY
+* `DoorbellOnPressed` and returns. An email is the sole signal a sleeping
+* battery camera can send, so a doorbell-classified email mapped to
+* `doorbell` alone rang the bell and left motion, recording and
+* notification rules blind — the exact "silently dropped wake" this mapping
+* exists to prevent. Pairing it with `motion` keeps the doorbell semantic
+* AND the wake.
+*/
+function mapInferredTypeToSimpleEvents(inferred) {
+	switch (inferred) {
+		case "people":
+		case "vehicle":
+		case "animal":
+		case "face":
+		case "package":
+		case "motion": return [inferred];
+		case "doorbell": return ["doorbell", "motion"];
+		default: return ["motion"];
+	}
+}
+//#endregion
 //#region src/email-push-bridge.ts
 /**
 * The Reolink side of the `smtp-inbound` broker kind (D999).
@@ -219558,6 +219394,78 @@ function createEmailPushRemovalHook(deps) {
 		listDeviceData: async () => []
 	};
 }
+var LEGACY_PREFIX = "/webhook/";
+async function startLegacyWebhookIntake(deps) {
+	const warned = /* @__PURE__ */ new Set();
+	const server = createServer((req, res) => {
+		const url = req.url ?? "";
+		if (!url.startsWith(LEGACY_PREFIX)) {
+			res.writeHead(404).end();
+			return;
+		}
+		const rest = url.slice(8);
+		req.url = rest;
+		const id = decodeURIComponent(rest.replace(/^\//, "").split("?")[0] ?? "");
+		const camera = deps.listCameras().find((c) => c.stableId === id);
+		if (camera !== void 0 && !warned.has(id)) {
+			warned.add(id);
+			deps.logger.warn("legacy webhook port used — camera will be re-pointed", {
+				tags: { deviceId: camera.id },
+				meta: { port: deps.port ?? 9081 }
+			});
+		}
+		Promise.resolve(deps.handler(req, res)).catch((err) => {
+			deps.logger.error("legacy webhook intake failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			if (!res.headersSent) res.writeHead(500);
+			res.end();
+		});
+	});
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(deps.port ?? 9081, "0.0.0.0", () => {
+			server.off("error", reject);
+			resolve();
+		});
+	});
+	return {
+		server,
+		close: () => new Promise((resolve) => server.close(() => resolve()))
+	};
+}
+//#endregion
+//#region src/migrations/drop-webhook-intake-settings.ts
+/**
+* The camera webhook is a plane of the addon's HTTP data plane, not a private listener
+* (D999): its enable switch, port and bind host are gone. The three keys older versions
+* persisted are deleted; every other key is left exactly as stored.
+*
+* Idempotent: a store without the keys yields an empty plan, which writes nothing.
+*/
+/** The addon id, the prefix of its rows in the canonical settings table. */
+var REOLINK_ADDON_ID = "provider-reolink";
+/** The canonical `addon-settings` table: one row per key, id `<addonId>.<key>`, data `{ addonId, key, value }`. */
+var ADDON_SETTINGS_TABLE = "addon-settings";
+var RETIRED_WEBHOOK_INTAKE_KEYS = [
+	"baichuanWebhookEnabled",
+	"baichuanWebhookPort",
+	"baichuanWebhookBindHost"
+];
+async function planDropWebhookIntakeSettings(ports) {
+	const stored = await ports.readStoredRaw();
+	const present = RETIRED_WEBHOOK_INTAKE_KEYS.filter((key) => key in stored);
+	if (present.length === 0) return { edits: [] };
+	const rowId = (key) => `${REOLINK_ADDON_ID}.${key}`;
+	return { edits: [{
+		op: "deleteKeys",
+		scope: ADDON_SETTINGS_TABLE,
+		keys: present.map(rowId),
+		precondition: preconditionOf(Object.fromEntries(present.map((key) => [rowId(key), {
+			addonId: REOLINK_ADDON_ID,
+			key,
+			value: stored[key]
+		}])))
+	}] };
+}
 //#endregion
 //#region src/migrations/email-push-to-mailbox.ts
 /** The pending mailbox as kept in the addon store: everything but the password (a keychain secret). */
@@ -219633,146 +219541,23 @@ var REOLINK_MIGRATIONS = [{
 		fixtureMark: "a setting key the migration does not know"
 	},
 	procedure: moveEmailPushToMailbox
+}, {
+	meta: {
+		id: "provider-reolink/2026-11-02-drop-webhook-intake-settings",
+		owner: "provider-reolink",
+		level: "addon-state",
+		seq: 2,
+		dependsOn: [],
+		store: "settings",
+		scope: "cluster",
+		onFailure: "tolerate",
+		bodyKind: "plan",
+		description: "Delete the retired baichuanWebhookEnabled, baichuanWebhookPort and baichuanWebhookBindHost settings; the webhook is served on the addon data plane",
+		fixtureMark: "a setting key the migration does not know"
+	},
+	plan: planDropWebhookIntakeSettings
 }];
 //#endregion
-//#region src/reolink-discovery-map.ts
-/**
-* Flatten a host (IP / hostname) into a flat row-key slug — shared by `generateStableId` and the
-* discovery candidate mapping so a host-keyed camera is detected as already onboarded on re-scan.
-*/
-function slugifyReolinkHost(host) {
-	return host.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-}
-/**
-* Decide whether a discovered host is a device this provider already owns.
-*
-* Matching is by UID first (stable across a DHCP lease change) and by host second. A UID match
-* wins even when the host differs, because the address is the thing that moves.
-*/
-function findOnboardedMatch(discovered, onboarded) {
-	if (discovered.uid !== void 0 && discovered.uid !== "") {
-		const byUid = onboarded.find((o) => o.uid === discovered.uid);
-		if (byUid !== void 0) return byUid;
-	}
-	return onboarded.find((o) => o.host !== void 0 && o.host === discovered.host);
-}
-/** Baichuan control port of an NVR / Home Hub (the scan only ever reports the HTTP/ONVIF one). */
-var HUB_BAICHUAN_PORT = 9e3;
-/**
-* `true` for a model string that names an NVR or a Home Hub: a device that fronts channels
-* rather than being one camera. Such a device is offered as an INTEGRATION to set up (D985), never
-* as a camera to add.
-*/
-function looksLikeReolinkHub(model) {
-	if (model === void 0) return false;
-	return /\b(nvr|rln\d*|home\s*hub|hub)\b/i.test(model);
-}
-/**
-* The stableId of an NVR / Home Hub candidate. UID first (it survives a DHCP lease change), host
-* second. The boot migration derives the SAME id for an old Hub device, so the integration it
-* creates hides this candidate through `originStableId`.
-*/
-function reolinkHubStableId(identity) {
-	const uid = identity.uid?.trim() ?? "";
-	if (uid !== "") return `reolink-hub-uid-${slugifyReolinkHost(uid)}`;
-	return `reolink-hub-host-${slugifyReolinkHost(identity.host)}`;
-}
-function isKnownHub(d, known) {
-	return known.some((k) => k.uid !== void 0 && k.uid !== "" && k.uid === d.uid || k.host !== void 0 && k.host !== "" && k.host === d.host);
-}
-/**
-* Map discovered Reolink hosts to adoption {@link DiscoveryCandidate}s, de-duplicated by host (the
-* same camera can answer on more than one discovery method — UDP broadcast, ONVIF, HTTP scan). The
-* first responder for a host wins. Pure: no I/O.
-*
-* **The scan never supplies `port`.** `port` in the Reolink config schema is the BAICHUAN port
-* (default 9000). Discovery reports `httpPort`, the HTTP/ONVIF listener — on a Reolink Home Hub
-* that is 8000, while Baichuan lives on `mediaPort` 9000. Writing the discovered value into `port`
-* pointed every Baichuan login at the ONVIF listener, which accepts the TCP connection and then
-* closes it: `Baichuan socket closed`, 316 times in 12 hours, taking the hub and all three of its
-* child cameras offline. The default is correct; a non-default Baichuan port is an operator edit,
-* never a scan result.
-*
-* The authoritative stableId is `mac-<mac>` (learned during autodetect at adopt time), which discovery
-* can't produce — so candidates carry `alreadyOnboarded` rather than relying on a stableId match,
-* which never fires for a MAC-keyed device. Re-adding an owned device is how the port got clobbered
-* in the first place, so a scan says so instead of offering it again.
-*/
-function mapReolinkDiscoveryToCandidates(devices, credentials, onboarded = [], hubIntegrations = []) {
-	const username = credentials.username?.trim() ?? "";
-	const password = credentials.password ?? "";
-	const byHost = /* @__PURE__ */ new Map();
-	for (const d of devices) if (!byHost.has(d.host)) byHost.set(d.host, d);
-	return [...byHost.values()].flatMap((d) => {
-		const displayName = d.name ?? d.model ?? d.host;
-		if (looksLikeReolinkHub(d.model)) {
-			if (isKnownHub(d, hubIntegrations)) return [];
-			return [{
-				stableId: reolinkHubStableId(d),
-				type: DeviceType.Gateway,
-				suggestedName: displayName,
-				prefilledConfig: {
-					host: d.host,
-					port: HUB_BAICHUAN_PORT,
-					...d.uid ? { uid: d.uid } : {},
-					...username ? { username } : {}
-				},
-				setupIntegration: true
-			}];
-		}
-		const match = findOnboardedMatch(d, onboarded);
-		return [{
-			stableId: `host-${slugifyReolinkHost(d.host)}`,
-			type: DeviceType.Camera,
-			suggestedName: displayName,
-			prefilledConfig: {
-				name: displayName,
-				host: d.host,
-				transport: "auto",
-				...d.uid ? { uid: d.uid } : {},
-				...username ? { username } : {},
-				...password ? { password } : {}
-			},
-			...match !== void 0 ? {
-				alreadyOnboarded: true,
-				onboardedDeviceId: match.deviceId,
-				onboardedName: match.name
-			} : {}
-		}];
-	});
-}
-//#endregion
-//#region src/reolink-subnet-scan.ts
-/**
-* Reolink cameras answer a vendor UDP broadcast (Baichuan) and ONVIF through the nodelink
-* library, which owns both protocols' framing. The engine cannot send either, so the addon
-* keeps `discoverDevices` and runs the library once per subnet the engine covers.
-*/
-var REOLINK_DISCOVERY_MODES = [{
-	kind: "custom",
-	reason: "Reolink answers a Baichuan vendor UDP broadcast and ONVIF that only the nodelink library speaks; this addon runs it once per covered subnet"
-}];
-/** The subnets handed in by the discovery orchestrator (`params.subnets`), or [] when absent. */
-function subnetsFromParams(params) {
-	const raw = params?.["subnets"];
-	if (!Array.isArray(raw)) return [];
-	return raw.filter((s) => typeof s === "string" && s.length > 0);
-}
-/**
-* Run `scan` once per covered subnet (once with no CIDR when the engine named none) and merge
-* the answers by host. A subnet whose scan fails is skipped and reported to `onError`.
-*/
-async function scanReolinkSubnets(input) {
-	const targets = input.subnets.length > 0 ? input.subnets : [void 0];
-	const byHost = /* @__PURE__ */ new Map();
-	for (const cidr of targets) try {
-		for (const device of await input.scan(cidr)) if (!byHost.has(device.host)) byHost.set(device.host, device);
-	} catch (error) {
-		input.onError?.(cidr, error);
-	}
-	return [...byHost.values()];
-}
-//#endregion
 //#region src/reolink-adoption-provider.ts
 var DEVICES_FILTER = {
 	id: "devices",
@@ -219937,233 +219722,111 @@ function buildReolinkAdoptionProvider(deps) {
 	};
 }
 //#endregion
-//#region src/reolink-hub-manager.ts
+//#region src/reolink-discovery-map.ts
 /**
-* One {@link ReolinkHubSession} per NVR / Home Hub INTEGRATION (D985). `reconcile` is the one
-* entry point: it is handed the live list of this addon's enabled integrations at boot and on
-* every integration lifecycle event, and makes the sessions match it — upsert, re-dial on a
-* changed connection, close what vanished. The default integration (no host) stays a plain
-* container of standalone cameras and gets no session.
+* Flatten a host (IP / hostname) into a flat row-key slug — shared by `generateStableId` and the
+* discovery candidate mapping so a host-keyed camera is detected as already onboarded on re-scan.
 */
-var ReolinkHubManager = class {
-	#sessions = /* @__PURE__ */ new Map();
-	#deps;
-	constructor(deps) {
-		this.#deps = deps;
-	}
-	list() {
-		return [...this.#sessions.keys()];
-	}
-	get(integrationId) {
-		return this.#sessions.get(integrationId) ?? null;
-	}
-	async reconcile(integrations) {
-		const { logger } = this.#deps;
-		const wanted = /* @__PURE__ */ new Set();
-		for (const integration of integrations) {
-			const read = readHubConnection(integration.settings);
-			if (read.kind === "no-host") continue;
-			wanted.add(integration.id);
-			if (read.kind !== "ok") {
-				logger.warn("Reolink NVR integration has no usable password — no session started", { meta: {
-					integrationId: integration.id,
-					reason: read.kind
-				} });
-				continue;
-			}
-			const existing = this.#sessions.get(integration.id);
-			if (existing !== void 0) {
-				if (!sameHubConnection(existing.connection, read.connection)) await existing.reconfigure(read.connection);
-				continue;
-			}
-			const session = new ReolinkHubSession({
-				integrationId: integration.id,
-				name: integration.name,
-				logger: logger.child(`hub-${integration.id}`),
-				connection: read.connection,
-				connect: this.#deps.connect,
-				children: () => this.#deps.childrenOf(integration.id),
-				onConnectionChange: (online) => this.#deps.onConnectionChange(integration.id, online)
-			});
-			this.#sessions.set(integration.id, session);
-			this.#deps.publish(integration.id, session);
-			session.start();
-		}
-		for (const [id, session] of [...this.#sessions]) {
-			if (wanted.has(id)) continue;
-			this.#sessions.delete(id);
-			this.#deps.publish(id, null);
-			await session.close();
-		}
-	}
-	async shutdown() {
-		for (const [id, session] of [...this.#sessions]) {
-			this.#sessions.delete(id);
-			this.#deps.publish(id, null);
-			await session.close();
-		}
-	}
-};
-/** The manager of a real addon process: dials real hubs. */
-function createReolinkHubManager(deps, registry) {
-	return new ReolinkHubManager({
-		...deps,
-		childrenOf: (id) => registry.childrenOf(id),
-		publish: (id, session) => registry.set(id, session),
-		connect: connectReolinkHub
-	});
-}
-function positivePort(value) {
-	return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : void 0;
-}
-var CONNECTION_FIELDS = [
-	"host",
-	"port",
-	"username",
-	"transport"
-];
-function str(value) {
-	return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+function slugifyReolinkHost(host) {
+	return host.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
-function migratedChildConfig(child, hub, integrationId) {
-	const filled = {};
-	for (const key of CONNECTION_FIELDS) {
-		const own = child[key];
-		const inherited = hub[key];
-		if ((own === void 0 || own === null || own === "") && inherited !== void 0) filled[key] = inherited;
+/**
+* Decide whether a discovered host is a device this provider already owns.
+*
+* Matching is by UID first (stable across a DHCP lease change) and by host second. A UID match
+* wins even when the host differs, because the address is the thing that moves.
+*/
+function findOnboardedMatch(discovered, onboarded) {
+	if (discovered.uid !== void 0 && discovered.uid !== "") {
+		const byUid = onboarded.find((o) => o.uid === discovered.uid);
+		if (byUid !== void 0) return byUid;
 	}
-	return {
-		...child,
-		...filled,
-		integrationId
-	};
+	return onboarded.find((o) => o.host !== void 0 && o.host === discovered.host);
 }
-async function migrateOneHub(hub, children, integrations, ports) {
-	const read = readHubConnection(hub.config);
-	if (read.kind !== "ok") throw new Error(`hub connection unusable (${read.kind}) — left in place`);
-	const { connection } = read;
-	const uid = str(hub.config["uid"]);
-	const integrationId = integrations.find((i) => i.addonId === ports.addonId && i.info["migratedFromHubDeviceId"] === hub.id)?.id ?? (await ports.createIntegration({
-		addonId: ports.addonId,
-		name: hub.name,
-		info: { ["migratedFromHubDeviceId"]: hub.id },
-		originStableId: reolinkHubStableId({
-			...uid !== void 0 ? { uid } : {},
-			host: connection.host
-		}),
-		settings: {
-			host: connection.host,
-			port: connection.port,
-			rtspPort: positivePort(hub.config["rtspPort"]) ?? connection.rtspPort,
-			username: connection.username,
-			password: connection.password,
-			transport: connection.transport,
-			...uid !== void 0 ? { uid } : {},
-			debugGeneral: connection.debugGeneral,
-			debugSocketLogs: connection.debugSocketLogs
-		},
-		secretKeys: ["password"]
-	})).id;
-	const rewritten = [];
-	for (const child of children) {
-		const config = migratedChildConfig(child.config, hub.config, integrationId);
-		await ports.persistConfig(child.stableId, config);
-		await ports.setIntegrationId(child.id, integrationId);
-		rewritten.push({
-			...child,
-			config,
-			parentDeviceId: null
-		});
-	}
-	return {
-		rows: rewritten,
-		retirement: {
-			hubDeviceId: hub.id,
-			hubName: hub.name,
-			integrationId
-		}
-	};
+/** Baichuan control port of an NVR / Home Hub (the scan only ever reports the HTTP/ONVIF one). */
+var HUB_BAICHUAN_PORT = 9e3;
+/**
+* `true` for a model string that names an NVR or a Home Hub: a device that fronts channels
+* rather than being one camera. Such a device is offered as an INTEGRATION to set up (D985), never
+* as a camera to add.
+*/
+function looksLikeReolinkHub(model) {
+	if (model === void 0) return false;
+	return /\b(nvr|rln\d*|home\s*hub|hub)\b/i.test(model);
 }
-/** Plan and persist the migration of every Hub row in `saved`. Never throws. */
-async function planHubMigration(saved, ports) {
-	const hubs = saved.filter((row) => row.type === DeviceType.Hub);
-	if (hubs.length === 0) return {
-		rows: saved,
-		retirements: []
-	};
-	let integrations;
-	try {
-		integrations = await ports.listIntegrations();
-	} catch (err) {
-		ports.logger.warn("Reolink hub migration: integrations unreadable — hubs left in place", { meta: { error: errMsg$3(err) } });
-		return {
-			rows: saved.filter((row) => row.type !== DeviceType.Hub),
-			retirements: []
-		};
-	}
-	const hubIds = new Set(hubs.map((h) => h.id));
-	const rewrittenById = /* @__PURE__ */ new Map();
-	const retirements = [];
-	for (const hub of hubs) {
-		const children = saved.filter((row) => row.parentDeviceId === hub.id);
-		try {
-			const done = await migrateOneHub(hub, children, integrations, ports);
-			for (const row of done.rows) rewrittenById.set(row.id, row);
-			retirements.push(done.retirement);
-			ports.logger.info("Reolink hub migrated to an integration", {
-				tags: { deviceId: hub.id },
-				meta: {
-					integrationId: done.retirement.integrationId,
-					children: children.length,
-					name: hub.name
-				}
-			});
-		} catch (err) {
-			ports.logger.warn("Reolink hub migration failed — the hub device is left in place", {
-				tags: { deviceId: hub.id },
-				meta: {
-					error: errMsg$3(err),
-					name: hub.name
-				}
-			});
-		}
-	}
-	return {
-		rows: saved.filter((row) => !hubIds.has(row.id)).map((row) => rewrittenById.get(row.id) ?? row),
-		retirements
-	};
+/**
+* The stableId of an NVR / Home Hub candidate. UID first (it survives a DHCP lease change), host
+* second. The boot migration derives the SAME id for an old Hub device, so the integration it
+* creates hides this candidate through `originStableId`.
+*/
+function reolinkHubStableId(identity) {
+	const uid = identity.uid?.trim() ?? "";
+	if (uid !== "") return `reolink-hub-uid-${slugifyReolinkHost(uid)}`;
+	return `reolink-hub-host-${slugifyReolinkHost(identity.host)}`;
+}
+function isKnownHub(d, known) {
+	return known.some((k) => k.uid !== void 0 && k.uid !== "" && k.uid === d.uid || k.host !== void 0 && k.host !== "" && k.host === d.host);
 }
 /**
-* Retire the hubs whose children all restored. A hub that still has a child in the store is left
-* and named: removing it would cascade the camera away with it.
+* Map discovered Reolink hosts to adoption {@link DiscoveryCandidate}s, de-duplicated by host (the
+* same camera can answer on more than one discovery method — UDP broadcast, ONVIF, HTTP scan). The
+* first responder for a host wins. Pure: no I/O.
+*
+* **The scan never supplies `port`.** `port` in the Reolink config schema is the BAICHUAN port
+* (default 9000). Discovery reports `httpPort`, the HTTP/ONVIF listener — on a Reolink Home Hub
+* that is 8000, while Baichuan lives on `mediaPort` 9000. Writing the discovered value into `port`
+* pointed every Baichuan login at the ONVIF listener, which accepts the TCP connection and then
+* closes it: `Baichuan socket closed`, 316 times in 12 hours, taking the hub and all three of its
+* child cameras offline. The default is correct; a non-default Baichuan port is an operator edit,
+* never a scan result.
+*
+* The authoritative stableId is `mac-<mac>` (learned during autodetect at adopt time), which discovery
+* can't produce — so candidates carry `alreadyOnboarded` rather than relying on a stableId match,
+* which never fires for a MAC-keyed device. Re-adding an owned device is how the port got clobbered
+* in the first place, so a scan says so instead of offering it again.
 */
-async function retireMigratedHubs(retirements, ports) {
-	let retired = 0;
-	for (const r of retirements) try {
-		const remaining = await ports.childIdsOf(r.hubDeviceId);
-		if (remaining.length > 0) {
-			ports.logger.warn("Reolink hub kept — a child did not restore, retiring it would remove it", {
-				tags: { deviceId: r.hubDeviceId },
-				meta: {
-					remaining: [...remaining],
-					integrationId: r.integrationId
-				}
-			});
-			continue;
+function mapReolinkDiscoveryToCandidates(devices, credentials, onboarded = [], hubIntegrations = []) {
+	const username = credentials.username?.trim() ?? "";
+	const password = credentials.password ?? "";
+	const byHost = /* @__PURE__ */ new Map();
+	for (const d of devices) if (!byHost.has(d.host)) byHost.set(d.host, d);
+	return [...byHost.values()].flatMap((d) => {
+		const displayName = d.name ?? d.model ?? d.host;
+		if (looksLikeReolinkHub(d.model)) {
+			if (isKnownHub(d, hubIntegrations)) return [];
+			return [{
+				stableId: reolinkHubStableId(d),
+				type: DeviceType.Gateway,
+				suggestedName: displayName,
+				prefilledConfig: {
+					host: d.host,
+					port: HUB_BAICHUAN_PORT,
+					...d.uid ? { uid: d.uid } : {},
+					...username ? { username } : {}
+				},
+				setupIntegration: true
+			}];
 		}
-		await ports.removeDevice(r.hubDeviceId);
-		retired++;
-		ports.logger.info("Reolink hub device retired", {
-			tags: { deviceId: r.hubDeviceId },
-			meta: { integrationId: r.integrationId }
-		});
-	} catch (err) {
-		ports.logger.warn("Reolink hub retirement failed — retried next boot", {
-			tags: { deviceId: r.hubDeviceId },
-			meta: { error: errMsg$3(err) }
-		});
-	}
-	return retired;
+		const match = findOnboardedMatch(d, onboarded);
+		return [{
+			stableId: `host-${slugifyReolinkHost(d.host)}`,
+			type: DeviceType.Camera,
+			suggestedName: displayName,
+			prefilledConfig: {
+				name: displayName,
+				host: d.host,
+				transport: "auto",
+				...d.uid ? { uid: d.uid } : {},
+				...username ? { username } : {},
+				...password ? { password } : {}
+			},
+			...match !== void 0 ? {
+				alreadyOnboarded: true,
+				onboardedDeviceId: match.deviceId,
+				onboardedName: match.name
+			} : {}
+		}];
+	});
 }
 //#endregion
 //#region src/reolink-gateway-device.ts
@@ -220246,6 +219909,375 @@ var ReolinkGatewayDevice = class extends BaseDevice {
 	}
 };
 //#endregion
+//#region src/reolink-hub-manager.ts
+/**
+* One {@link ReolinkHubSession} per NVR / Home Hub INTEGRATION (D985). `reconcile` is the one
+* entry point: it is handed the live list of this addon's enabled integrations at boot and on
+* every integration lifecycle event, and makes the sessions match it — upsert, re-dial on a
+* changed connection, close what vanished. The default integration (no host) stays a plain
+* container of standalone cameras and gets no session.
+*/
+var ReolinkHubManager = class {
+	#sessions = /* @__PURE__ */ new Map();
+	#deps;
+	constructor(deps) {
+		this.#deps = deps;
+	}
+	list() {
+		return [...this.#sessions.keys()];
+	}
+	get(integrationId) {
+		return this.#sessions.get(integrationId) ?? null;
+	}
+	async reconcile(integrations) {
+		const { logger } = this.#deps;
+		const wanted = /* @__PURE__ */ new Set();
+		for (const integration of integrations) {
+			const read = readHubConnection(integration.settings);
+			if (read.kind === "no-host") continue;
+			wanted.add(integration.id);
+			if (read.kind !== "ok") {
+				logger.warn("Reolink NVR integration has no usable password — no session started", { meta: {
+					integrationId: integration.id,
+					reason: read.kind
+				} });
+				continue;
+			}
+			const existing = this.#sessions.get(integration.id);
+			if (existing !== void 0) {
+				if (!sameHubConnection(existing.connection, read.connection)) await existing.reconfigure(read.connection);
+				continue;
+			}
+			const session = new ReolinkHubSession({
+				integrationId: integration.id,
+				name: integration.name,
+				logger: logger.child(`hub-${integration.id}`),
+				connection: read.connection,
+				connect: this.#deps.connect,
+				children: () => this.#deps.childrenOf(integration.id),
+				onConnectionChange: (online) => this.#deps.onConnectionChange(integration.id, online)
+			});
+			this.#sessions.set(integration.id, session);
+			this.#deps.publish(integration.id, session);
+			session.start();
+		}
+		for (const [id, session] of [...this.#sessions]) {
+			if (wanted.has(id)) continue;
+			this.#sessions.delete(id);
+			this.#deps.publish(id, null);
+			await session.close();
+		}
+	}
+	async shutdown() {
+		for (const [id, session] of [...this.#sessions]) {
+			this.#sessions.delete(id);
+			this.#deps.publish(id, null);
+			await session.close();
+		}
+	}
+};
+/** The manager of a real addon process: dials real hubs. */
+function createReolinkHubManager(deps, registry) {
+	return new ReolinkHubManager({
+		...deps,
+		childrenOf: (id) => registry.childrenOf(id),
+		publish: (id, session) => registry.set(id, session),
+		connect: connectReolinkHub
+	});
+}
+function positivePort(value) {
+	return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : void 0;
+}
+var CONNECTION_FIELDS = [
+	"host",
+	"port",
+	"username",
+	"transport"
+];
+function str(value) {
+	return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+}
+function migratedChildConfig(child, hub, integrationId) {
+	const filled = {};
+	for (const key of CONNECTION_FIELDS) {
+		const own = child[key];
+		const inherited = hub[key];
+		if ((own === void 0 || own === null || own === "") && inherited !== void 0) filled[key] = inherited;
+	}
+	return {
+		...child,
+		...filled,
+		integrationId
+	};
+}
+async function migrateOneHub(hub, children, integrations, ports) {
+	const read = readHubConnection(hub.config);
+	if (read.kind !== "ok") throw new Error(`hub connection unusable (${read.kind}) — left in place`);
+	const { connection } = read;
+	const uid = str(hub.config["uid"]);
+	const integrationId = integrations.find((i) => i.addonId === ports.addonId && i.info["migratedFromHubDeviceId"] === hub.id)?.id ?? (await ports.createIntegration({
+		addonId: ports.addonId,
+		name: hub.name,
+		info: { ["migratedFromHubDeviceId"]: hub.id },
+		originStableId: reolinkHubStableId({
+			...uid !== void 0 ? { uid } : {},
+			host: connection.host
+		}),
+		settings: {
+			host: connection.host,
+			port: connection.port,
+			rtspPort: positivePort(hub.config["rtspPort"]) ?? connection.rtspPort,
+			username: connection.username,
+			password: connection.password,
+			transport: connection.transport,
+			...uid !== void 0 ? { uid } : {},
+			debugGeneral: connection.debugGeneral,
+			debugSocketLogs: connection.debugSocketLogs
+		},
+		secretKeys: ["password"]
+	})).id;
+	const rewritten = [];
+	for (const child of children) {
+		const config = migratedChildConfig(child.config, hub.config, integrationId);
+		await ports.persistConfig(child.stableId, config);
+		await ports.setIntegrationId(child.id, integrationId);
+		rewritten.push({
+			...child,
+			config,
+			parentDeviceId: null
+		});
+	}
+	return {
+		rows: rewritten,
+		retirement: {
+			hubDeviceId: hub.id,
+			hubName: hub.name,
+			integrationId
+		}
+	};
+}
+/** Plan and persist the migration of every Hub row in `saved`. Never throws. */
+async function planHubMigration(saved, ports) {
+	const hubs = saved.filter((row) => row.type === DeviceType.Hub);
+	if (hubs.length === 0) return {
+		rows: saved,
+		retirements: []
+	};
+	let integrations;
+	try {
+		integrations = await ports.listIntegrations();
+	} catch (err) {
+		ports.logger.warn("Reolink hub migration: integrations unreadable — hubs left in place", { meta: { error: errMsg$3(err) } });
+		return {
+			rows: saved.filter((row) => row.type !== DeviceType.Hub),
+			retirements: []
+		};
+	}
+	const hubIds = new Set(hubs.map((h) => h.id));
+	const rewrittenById = /* @__PURE__ */ new Map();
+	const retirements = [];
+	for (const hub of hubs) {
+		const children = saved.filter((row) => row.parentDeviceId === hub.id);
+		try {
+			const done = await migrateOneHub(hub, children, integrations, ports);
+			for (const row of done.rows) rewrittenById.set(row.id, row);
+			retirements.push(done.retirement);
+			ports.logger.info("Reolink hub migrated to an integration", {
+				tags: { deviceId: hub.id },
+				meta: {
+					integrationId: done.retirement.integrationId,
+					children: children.length,
+					name: hub.name
+				}
+			});
+		} catch (err) {
+			ports.logger.warn("Reolink hub migration failed — the hub device is left in place", {
+				tags: { deviceId: hub.id },
+				meta: {
+					error: errMsg$3(err),
+					name: hub.name
+				}
+			});
+		}
+	}
+	return {
+		rows: saved.filter((row) => !hubIds.has(row.id)).map((row) => rewrittenById.get(row.id) ?? row),
+		retirements
+	};
+}
+/**
+* Retire the hubs whose children all restored. A hub that still has a child in the store is left
+* and named: removing it would cascade the camera away with it.
+*/
+async function retireMigratedHubs(retirements, ports) {
+	let retired = 0;
+	for (const r of retirements) try {
+		const remaining = await ports.childIdsOf(r.hubDeviceId);
+		if (remaining.length > 0) {
+			ports.logger.warn("Reolink hub kept — a child did not restore, retiring it would remove it", {
+				tags: { deviceId: r.hubDeviceId },
+				meta: {
+					remaining: [...remaining],
+					integrationId: r.integrationId
+				}
+			});
+			continue;
+		}
+		await ports.removeDevice(r.hubDeviceId);
+		retired++;
+		ports.logger.info("Reolink hub device retired", {
+			tags: { deviceId: r.hubDeviceId },
+			meta: { integrationId: r.integrationId }
+		});
+	} catch (err) {
+		ports.logger.warn("Reolink hub retirement failed — retried next boot", {
+			tags: { deviceId: r.hubDeviceId },
+			meta: { error: errMsg$3(err) }
+		});
+	}
+	return retired;
+}
+//#endregion
+//#region src/reolink-subnet-scan.ts
+/**
+* Reolink cameras answer a vendor UDP broadcast (Baichuan) and ONVIF through the nodelink
+* library, which owns both protocols' framing. The engine cannot send either, so the addon
+* keeps `discoverDevices` and runs the library once per subnet the engine covers.
+*/
+var REOLINK_DISCOVERY_MODES = [{
+	kind: "custom",
+	reason: "Reolink answers a Baichuan vendor UDP broadcast and ONVIF that only the nodelink library speaks; this addon runs it once per covered subnet"
+}];
+/** The subnets handed in by the discovery orchestrator (`params.subnets`), or [] when absent. */
+function subnetsFromParams(params) {
+	const raw = params?.["subnets"];
+	if (!Array.isArray(raw)) return [];
+	return raw.filter((s) => typeof s === "string" && s.length > 0);
+}
+/**
+* Run `scan` once per covered subnet (once with no CIDR when the engine named none) and merge
+* the answers by host. A subnet whose scan fails is skipped and reported to `onError`.
+*/
+async function scanReolinkSubnets(input) {
+	const targets = input.subnets.length > 0 ? input.subnets : [void 0];
+	const byHost = /* @__PURE__ */ new Map();
+	for (const cidr of targets) try {
+		for (const device of await input.scan(cidr)) if (!byHost.has(device.host)) byHost.set(device.host, device);
+	} catch (error) {
+		input.onError?.(cidr, error);
+	}
+	return [...byHost.values()];
+}
+//#endregion
+//#region src/webhook-plane.ts
+/**
+* The Baichuan HaCfg webhook (battery sleep push, cmd 807) as a plane of this addon's HTTP data
+* plane: a camera POSTs `{"event":"wake","reason":"pir"}` to
+* `http://<internal-host>:<lan-http-port>/addon/provider-reolink/webhook/<stableId>`. The hub
+* proxies it without auth (`access: 'public'`: the firmware cannot sign in), so this handler is
+* the whole gate: a known battery camera, a small JSON body, nothing else.
+*/
+/** The firmware's body is a few dozen bytes; this bounds what an unauthenticated peer can make us hold. */
+var WEBHOOK_MAX_BODY_BYTES = 64 * 1024;
+var BodyTooLarge = class extends Error {};
+function reply(res, status, allow) {
+	res.writeHead(status, {
+		"content-type": "text/plain",
+		...allow === void 0 ? {} : { allow }
+	});
+	res.end();
+}
+async function readBody(req) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+		size += buffer.length;
+		if (size > 65536) throw new BodyTooLarge();
+		chunks.push(buffer);
+	}
+	return Buffer.concat(chunks);
+}
+/** The stable id in `req.url` (`/<id>`, already stripped of the plane's prefix), or null. */
+function stableIdOf(url) {
+	const segment = ((url ?? "").split("?")[0] ?? "").replace(/^\/+/, "");
+	if (segment.length === 0 || segment.includes("/")) return null;
+	try {
+		return decodeURIComponent(segment);
+	} catch {
+		return null;
+	}
+}
+function createWebhookHandler(deps) {
+	const { logger } = deps;
+	return async (req, res) => {
+		if (req.method !== "POST" && req.method !== "PUT") {
+			reply(res, 405, "POST, PUT");
+			return;
+		}
+		const stableId = stableIdOf(req.url);
+		const camera = stableId === null ? void 0 : deps.listCameras().find((c) => c.stableId === stableId);
+		if (camera === void 0 || !camera.isEmailPushEligible) {
+			logger.warn("baichuan-webhook: push for an unknown or ineligible camera — refused", {
+				...camera === void 0 ? {} : { tags: { deviceId: camera.id } },
+				meta: {
+					stableId: stableId ?? "(none)",
+					known: camera !== void 0
+				}
+			});
+			reply(res, 404);
+			return;
+		}
+		let body;
+		try {
+			body = await readBody(req);
+		} catch (err) {
+			const tooLarge = err instanceof BodyTooLarge;
+			logger.warn(tooLarge ? "baichuan-webhook: push body over the bound — refused" : "baichuan-webhook: push body unreadable — refused", {
+				tags: { deviceId: camera.id },
+				meta: { maxBytes: WEBHOOK_MAX_BODY_BYTES }
+			});
+			reply(res, tooLarge ? 413 : 400);
+			if (tooLarge) req.destroy();
+			return;
+		}
+		const parsed = parseBaichuanWebhookBody(body);
+		if (parsed === void 0) {
+			logger.warn("baichuan-webhook: push body is not a webhook payload — refused", { tags: { deviceId: camera.id } });
+			reply(res, 400);
+			return;
+		}
+		if (parsed.kind !== "event") {
+			logger.debug("baichuan-webhook: command-shaped push ignored", {
+				tags: { deviceId: camera.id },
+				meta: { cmdId: parsed.cmdId }
+			});
+			reply(res, 202);
+			return;
+		}
+		const types = mapBaichuanWebhookToSimpleEvents({
+			event: parsed.event,
+			reason: parsed.reason
+		});
+		logger.info("baichuan-webhook: event received from battery camera", {
+			tags: { deviceId: camera.id },
+			meta: {
+				event: parsed.event,
+				reason: parsed.reason,
+				types
+			}
+		});
+		const timestamp = Date.now();
+		for (const type of types) camera.handleSimpleEvent({
+			type,
+			channel: camera.emailPushChannel,
+			timestamp,
+			source: "baichuanWebhook"
+		});
+		reply(res, 200);
+	};
+}
+//#endregion
 //#region src/addon.ts
 /**
 * Adapt a camstack scoped logger to the lib's `Logger` shape (just
@@ -220407,7 +220439,7 @@ async function enrichHostIdentifiersFromLiveApi(detection, logger) {
 var ReolinkProviderAddon = class extends BaseDeviceProvider {
 	/** The email-push SMTP password is hidden state — kept in the keychain (D787). */
 	secretStatePaths = ["emailPushAuthPassword", "mailboxPendingPassword"];
-	addonId = REOLINK_ADDON_ID;
+	addonId = REOLINK_ADDON_ID$1;
 	providerName = "Reolink";
 	deviceClasses = {
 		[DeviceType.Camera]: ReolinkCamera,
@@ -220427,7 +220459,6 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 	* simple event. Built in `onInitialize`, once the addon context exists.
 	*/
 	emailBridge;
-	baichuanWebhookServer;
 	/** The `log-channels` provider for this process. Stopped on shutdown so a
 	*  diagnostic timer is never the reason a runner refuses to exit. */
 	logChannels;
@@ -220465,11 +220496,10 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 	listReolinkCameras() {
 		const all = this.ctx.kernel.deviceRegistry?.getAll() ?? [];
 		const emailBridge = this.emailBridge;
-		const webhookServer = this.baichuanWebhookServer;
 		const cameras = [];
 		for (const d of all) if (d instanceof ReolinkCamera) {
 			if (emailBridge) d.setEmailPushParamsResolver(() => emailBridge.buildCameraSetupParams(d));
-			if (webhookServer) d.setBaichuanWebhookParamsResolver(() => webhookServer.buildCameraSetupParams(d));
+			d.setBaichuanWebhookParamsResolver(() => this.buildWebhookParams(d));
 			cameras.push(d);
 		}
 		return cameras;
@@ -220547,14 +220577,50 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 			emailPushAuthPassword: password
 		} : raw;
 	}
-	/** Lazily build the HaCfg webhook intake, wiring its provider deps. */
-	ensureBaichuanWebhookServer() {
-		if (!this.baichuanWebhookServer) this.baichuanWebhookServer = new ReolinkBaichuanWebhookServer({
-			logger: this.ctx.logger.child("baichuan-webhook"),
-			listCameras: () => this.listReolinkCameras(),
-			readStore: async () => await this.resolveGlobalStore()
-		});
-		return this.baichuanWebhookServer;
+	/**
+	* What a battery camera needs to arm its HaCfg webhook: the data-plane URL on the hub's
+	* plain-HTTP LAN listener. The host is the `internal` role of the palette, read on every use
+	* (D729). `null` for a camera that cannot do it; throws the reason when the hub has no address.
+	*/
+	async buildWebhookParams(cam) {
+		if (!cam.isEmailPushEligible) return null;
+		return {
+			url: buildBaichuanWebhookUrl({
+				...resolveWebhookEndpoint(await this.ctx.api.localNetwork.getAddresses.query()),
+				stableId: cam.stableId
+			}),
+			verifyCert: false
+		};
+	}
+	/**
+	* Serve the camera's HaCfg push on the addon's HTTP data plane. Public: the firmware cannot sign
+	* in, so the handler is the gate. Like the clip planes it is served from `onInitialize` (the hub
+	* pulls planes during registration) and a host without the facility only loses this intake.
+	*/
+	legacyWebhook;
+	async serveWebhookPlane() {
+		try {
+			const handler = createWebhookHandler({
+				logger: this.ctx.logger.child("baichuan-webhook"),
+				listCameras: () => this.listReolinkCameras()
+			});
+			await this.ctx.dataPlane?.serve({
+				prefix: BAICHUAN_WEBHOOK_PREFIX,
+				access: "public",
+				handler
+			});
+			try {
+				this.legacyWebhook = await startLegacyWebhookIntake({
+					logger: this.ctx.logger.child("baichuan-webhook"),
+					listCameras: () => this.listReolinkCameras(),
+					handler
+				});
+			} catch (err) {
+				this.ctx.logger.warn("baichuan-webhook: legacy :9081 intake not bound (port in use?)", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			}
+		} catch (err) {
+			this.ctx.logger.warn("baichuan-webhook: data plane failed to serve — battery push will not arrive", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
 	}
 	/**
 	* Reolink stableId derivation — uniform `mac → host(IP)` chain for
@@ -220622,7 +220688,7 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 		}
 		this.logChannels?.stop();
 		await this.clipService?.disposeClipStreamDial().catch(() => {});
-		await this.baichuanWebhookServer?.stop().catch(() => {});
+		await this.legacyWebhook?.close().catch(() => void 0);
 		await this.hubManager?.shutdown().catch((err) => {
 			this.ctx.logger.warn("Reolink NVR sessions did not close cleanly", { meta: { error: errMsg$3(err) } });
 		});
@@ -220811,32 +220877,17 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 		return report;
 	}
 	/**
-	* Settings changed → rebind the SMTP / HaCfg intakes so port/domain/auth
-	* edits apply without a full addon restart. Best-effort: a bind failure is
-	* logged inside the server and leaves it stopped until the next edit.
+	* Settings changed → refresh the mirror the clip refresh timer reads.
 	*/
 	async onConfigChanged() {
 		await this.refreshClipRefreshGlobalStore();
-		await this.baichuanWebhookServer?.restart().catch((err) => {
-			this.ctx.logger.warn("baichuan-webhook: restart after settings change failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
-		});
 	}
 	/**
-	* The addon's global settings schema.
-	*
-	* This used to override `getGlobalSettings()` wholesale, on the belief that a
-	* dynamic `recommendedHost` could not come from a static schema declaration.
-	* It can: `listLanHosts()` is synchronous, so the schema builder runs here
-	* and `BaseAddon.getGlobalSettings` does the identical
-	* `resolveGlobalStore` + `hydrateSchema` the override did by hand.
-	*
-	* Declaring the SCHEMA rather than overriding the GETTER is what lets core
-	* serve `getIntegrationSettings()` — it selects the declared sections out of
-	* this schema, so an addon that hides its schema behind a getter has nothing
-	* for core to select from.
+	* The addon's global settings schema: the clip-catalog refresh default. (The battery push has
+	* no addon-level setting: the mailbox is a broker and the webhook is a plane of the data plane.)
 	*/
 	globalSettingsSchema() {
-		return { sections: [...buildBaichuanWebhookSettingsSchema(listLanHosts()[0] ?? "127.0.0.1").sections, ...buildClipRefreshSettingsSchema().sections] };
+		return { sections: [...buildClipRefreshSettingsSchema().sections] };
 	}
 	/**
 	* Per-instance form (D985): an NVR / Home Hub integration shows its connection only; the
@@ -220860,13 +220911,6 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 			return null;
 		}
 	}
-	/**
-	* The HaCfg webhook section IS this integration's configuration — one intake serving
-	* every Reolink camera. See `baichuan-webhook-schema.ts`. (The camera mailbox is a broker.)
-	*/
-	integrationSettingSections() {
-		return [...BAICHUAN_WEBHOOK_SECTION_IDS];
-	}
 	async onInitialize() {
 		const regs = this.providerRegistrationsFromSuper(await super.onInitialize());
 		this.logChannels = createLogChannelsProvider(this.ctx.logger.child("log-channels"));
@@ -220910,11 +220954,9 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 		this.startClipCatalogRefresh(this.clipService);
 		this.wireClipCatalogRefreshers();
 		await this.serveClipPlanes(this.clipService);
+		await this.serveWebhookPlane();
 		await this.runMigrations(defineAddonMigrations(REOLINK_MIGRATIONS, this.migrationPorts()));
 		this.wireEmailBridge();
-		this.ensureBaichuanWebhookServer().start().catch((err) => {
-			this.ctx.logger.warn("baichuan-webhook: HTTP intake failed to start at init", { meta: { error: err instanceof Error ? err.message : String(err) } });
-		});
 		const wireSleepPushResolvers = (event, via) => {
 			const data = event.data;
 			if (data.providerId !== this.addonId) return;
@@ -220924,8 +220966,7 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 				const emailBridge = this.ensureEmailBridge();
 				dev.setEmailPushParamsResolver(() => emailBridge.buildCameraSetupParams(dev));
 				emailBridge.sync();
-				const webhookServer = this.ensureBaichuanWebhookServer();
-				dev.setBaichuanWebhookParamsResolver(() => webhookServer.buildCameraSetupParams(dev));
+				dev.setBaichuanWebhookParamsResolver(() => this.buildWebhookParams(dev));
 				this.wireClipCatalogRefreshers();
 				this.ctx.logger.debug("sleep-push: resolvers wired", {
 					tags: { deviceId: data.deviceId },
@@ -220959,6 +221000,7 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 	migrationPorts() {
 		return {
 			readStored: () => this.readLegacyEmailPush(),
+			readStoredRaw: () => this.resolveGlobalStore(),
 			stashPending: (settings) => this.stashPendingMailbox(settings),
 			warn: (message) => {
 				this.ctx.logger.warn(message);
@@ -221102,9 +221144,9 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 				handler: service.streamHandler
 			});
 			this.ctx.logger.info("Reolink clip data planes served", { meta: {
-				thumbPath: `/addon/${REOLINK_ADDON_ID}/${service.thumbPrefix}`,
-				mediaPath: `/addon/${REOLINK_ADDON_ID}/${service.mediaPrefix}`,
-				streamPath: `/addon/${REOLINK_ADDON_ID}/${service.streamPrefix}`,
+				thumbPath: `/addon/${REOLINK_ADDON_ID$1}/${service.thumbPrefix}`,
+				mediaPath: `/addon/${REOLINK_ADDON_ID$1}/${service.mediaPrefix}`,
+				streamPath: `/addon/${REOLINK_ADDON_ID$1}/${service.streamPrefix}`,
 				thumbServed: thumb !== void 0,
 				mediaServed: media !== void 0,
 				streamServed: stream !== void 0
@@ -221344,8 +221386,7 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 					device.adoptApi(detectedApi);
 					const emailBridge = this.ensureEmailBridge();
 					device.setEmailPushParamsResolver(() => emailBridge.buildCameraSetupParams(device));
-					const webhookServer = this.ensureBaichuanWebhookServer();
-					device.setBaichuanWebhookParamsResolver(() => webhookServer.buildCameraSetupParams(device));
+					device.setBaichuanWebhookParamsResolver(() => this.buildWebhookParams(device));
 				}
 				ctx.api?.pipelineOrchestrator?.applyDeviceSettingsPatch?.mutate({
 					deviceId: device.id,