@camstack/system 1.2.289 → 1.2.291

package/dist/{dist-DKFb2936.mjs → dist-DiMNxNDh.mjs}

@@ -691,7 +691,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-i3eUVc-d.mjs
+//#region ../types/dist/sleep-PEo0-Fz9.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -1851,6 +1851,24 @@ function normalizeAddonInitResult(result) {
 * core proxy and the kernel listener) to keep both off a kernel↔core import.
 */
 var DATAPLANE_SECRET_HEADER = "x-camstack-dataplane-secret";
+/** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
+var PeerBytesTicketSchema = z.object({
+	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
+	url: z.string().min(1),
+	/**
+	* The HOST node this URL means something on — the hub or a named agent,
+	* never a runner. {@link AddonPeerBytes.open} compares it to its own and
+	* refuses `cross-node` by name when they differ, without dialling.
+	*/
+	hostNodeId: z.string().min(1),
+	expiresAtMs: z.number().int().nonnegative(),
+	/**
+	* What the producer DECLARED the body to be, when it knows — `null` when it
+	* does not. Never `0` for unknown (D393): a consumer sizing a bound off this
+	* must be able to tell "the producer did not say" from "the body is empty".
+	*/
+	declaredBytes: z.number().int().nonnegative().nullable()
+});
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = z.enum([
 	"high",
@@ -4160,7 +4178,7 @@ var AdoptionJobSchema = z.object({
 * component's original options — detection to the detection-pipeline wrapper
 * binding, audio analysis to its own, recording to `RecordingConfig.enabled`
 * (which was always first-class; the switch was a veneer over
-* `recording.setDeviceConfig`), notifications to a notification-center
+* `recordingArchive.setDeviceConfig`), notifications to a notification-center
 * per-device setting, the two camera planes to their own components.
 *
 * What survives is {@link composeSwitchedOff}: `CameraStatus.switchedOff`, the
@@ -4186,7 +4204,7 @@ var AdoptionJobSchema = z.object({
 * | `stream-broker` | `deviceManager.setDisabled` | `StreamBrokerManager.reconcileAllCatalogs` releases the brokers; `ensureBroker` refuses re-creation |
 * | `object-detection` | `deviceManager.setWrapperActive('detection-pipeline')` | `PipelineSettingsStore.resolvePipelineForDevice` returns `{ steps: [], audio: null }` |
 * | `audio-analysis` | `deviceManager.setWrapperActive('audio-analysis')` | `AudioSubscriptionController.subscribeAudioStream` returns `null` before opening the stream |
-* | `recording` | `recording.setDeviceConfig` → `RecordingConfig.enabled` | `band-decision.shouldRecord` returns false; the controller detaches the device |
+* | `recording` | `recordingArchive.setDeviceConfig` → `RecordingConfig.enabled` | `band-decision.shouldRecord` returns false; the controller detaches the device |
 * | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
 * | `privacy-mask` | `privacyMask.setMask({ enabled })` → the CAMERA | the camera blanks the masked regions itself; every stream and recording carries the black boxes |
 * | `device-audio` | `privacyMask.setAudioEnabled` → the CAMERA | the camera stops encoding an audio track at all; every consumer sees silent video |
@@ -9018,87 +9036,6 @@ var cameraPipelineConfigCapability = {
 	exposesDeviceSettings: true,
 	methods: {}
 };
-/**
-* The signals a device can emit to WAKE its own stream.
-*
-* A camera whose stream is built on demand sleeps until something asks for it,
-* and "something" cannot be a consumer that is merely attached — a Frigate-style
-* puller holds a session open for ever, and treating that as demand would keep
-* a battery camera awake for ever, which is the whole thing the battery is for
-* (D173). So the wake has to come from the CAMERA: an event it noticed by
-* itself, with no stream running.
-*
-* ## The vocabulary is the PROVIDER'S, not ours
-*
-* Like `consumables`, this cap declares no vocabulary of its own. A provider
-* names each signal with a `code` it chooses and a `label` an operator reads.
-* Reolink offers motion and camera-native detection; another provider may offer
-* a tamper, a doorbell press, a PIR, or something no camera in this fleet has
-* yet. A fixed enum here would mean every new signal is a framework release.
-*
-* It is deliberately NOT derived from the caps a device already binds. Whether
-* a camera CAN push firmware motion is expressed by `motionSources` containing
-* `'onboard'`, and whether it does AI on-camera by the `native-object-detection`
-* binding — but both answer "what drives the detection pipeline", which is a
-* different question from "what may wake a sleeping stream". A camera can do
-* the first and not be trusted with the second, and the operator picks per
-* camera. Two questions, two authorities.
-*
-* ## Availability is not permission
-*
-* `listSignals` says what the device CAN emit. Whether a given signal actually
-* wakes the stream is the operator's per-camera choice, held by the broker
-* alongside the cooldown — see the stream-broker cap's wake settings. A
-* provider declaring a signal is not a provider enabling it.
-*/
-/** One signal a device can emit. */
-var StreamSignalSchema = z.object({
-	/** Stable id chosen by the provider, e.g. `'motion'`, `'person'`, `'tamper'`. */
-	code: z.string().min(1),
-	/** What an operator reads in the picker. The provider's own wording. */
-	label: z.string().min(1),
-	/**
-	* Whether the provider recommends this signal ON when a camera is first set
-	* up. A provider knows which of its signals are cheap and reliable; an
-	* operator should not have to discover that by trial. Reolink recommends
-	* both of its own.
-	*/
-	recommended: z.boolean()
-});
-var StreamSignalsStatusSchema = z.object({
-	signals: z.array(StreamSignalSchema),
-	lastFetchedAt: z.number()
-});
-var streamSignalsCapability = {
-	name: "stream-signals",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	deviceTypes: Object.values(DeviceType),
-	runtimeState: StreamSignalsStatusSchema,
-	/**
-	* Runtime-state durability: **session** — mirrored in RAM, never written.
-	*
-	* The slice holds what the DEVICE says it can emit. That is a probed fact,
-	* not an operator choice: the provider re-declares it on every registration,
-	* so losing it loses nothing and persisting it would freeze an answer the
-	* camera is entitled to change. Measured the same day on the sibling case —
-	* `native-object-detection.supportedClasses` was persisted, and a firmware
-	* class the camera really detected stayed missing for the life of the row
-	* because the fix could not reach it.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "session",
-	methods: { 
-	/**
-	* What this device can emit. Empty is a valid and common answer — most
-	* cameras have nothing to offer here, and an empty list is what makes the
-	* broker's picker show nothing rather than a false choice.
-	*/
-listSignals: method(z.void(), z.array(StreamSignalSchema).readonly()) }
-};
 /** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
 var StreamFormatSchema = z.enum([
 	"webrtc",
@@ -11477,6 +11414,118 @@ var detectionPipelineCapability = {
 	methods: {}
 };
 /**
+* device-admin-link — "this device has a management page of its own, and here
+* is its address".
+*
+* ## Why this is not a `deviceConfig` cap
+*
+* There is nothing to edit. A `deviceConfig` cap (D14) exists so the framework
+* can DERIVE a settings form from `getOptions` + `getStatus` and route a flat
+* patch back through a setter; it costs a `builderId` reducer in
+* `device-config-contribution.ts` and a `*-config-schema.ts` beside it, and it
+* renders a form section. This cap answers ONE question with ONE read and
+* renders a button. Nothing about it is a form, so it carries no `deviceConfig`
+* block, no `settings`, no `runtimeState` and no reducer — exactly like
+* `reboot`, the other pure-RPC device-native cap.
+*
+* ## Absent, and the difference between "no page" and "we cannot say"
+*
+* The two are answered at DIFFERENT layers, on purpose:
+*
+*  - **"We cannot say"** → the provider never registers the cap for that
+*    device. A VeSync humidifier, a Petkit feeder, a Dreame vacuum and a Dreo
+*    fan are reached only through a vendor cloud; there is no address to hand
+*    out and no page to open. A Tuya plug, a Wyze camera and a Gree air
+*    conditioner DO have a LAN IP, and still have no HTTP management page
+*    behind it. None of them register, so `deviceManager.getBindings` never
+*    lists the cap and no surface asks.
+*  - **"This device has no page, and I know that"** → the provider registers
+*    and `getAdminLink` returns `null`. This is the answer for a device whose
+*    sibling DOES have a page: a Reolink battery camera reached over UDP by
+*    `uid` with a blank `host`, an Ecowitt gateway configured in `listener`
+*    transport, a Home Assistant broker authenticated by supervisor token
+*    (which carries no `baseUrl` at all).
+*
+* Both draw NOTHING. A button that opens a browser error is worse than no
+* button, and D62 is the same rule from the other side: an off switch is
+* reported off, never made to look broken. There is no third state where the
+* UI renders a disabled button "because the device might have a page".
+*
+* ## The URL never carries credentials
+*
+* Not in userinfo, not in a query string. Every provider builds through
+* `buildDeviceAdminUrl` (`device-admin-link-url.ts`), which takes host, port,
+* scheme and path as separate arguments — there is no parameter a secret could
+* arrive in — and re-checks its own output for the `scheme://user:pass@` shape
+* that `scripts/check-no-credential-urls-in-fixtures.ts` bans from recorded
+* output. `scripts/check-admin-link-builder-is-the-only-url-source.ts` is what
+* keeps providers from hand-rolling one anyway.
+*
+* This matters here more than anywhere else in the repo, because every provider
+* that knows a device's host knows its PASSWORD too: `{ host, port, username,
+* password }` sit in one object on Hikvision, Amcrest, Reolink and ONVIF alike,
+* and `http://admin:hunter2@192.168.50.139/` is a URL a browser accepts. The
+* camera's own page will ask for its own login. That is correct, and pre-
+* filling it is the operator's business, not ours.
+*
+* ## It is a LAN fact
+*
+* The URL addresses the device where the NODE can see it. It is not proxied,
+* not made reachable from outside, and not sent anywhere. A surface renders it
+* as a link the operator's own browser follows, on the operator's own network,
+* or renders nothing.
+*/
+/**
+* Whose page is it. The distinction is for the OPERATOR, who needs to know
+* before clicking whether he is about to land on a camera's own web server or
+* inside Home Assistant.
+*/
+var AdminLinkTargetEnum = z.enum(["device", "integration"]);
+var DeviceAdminLinkSchema = z.object({
+	/**
+	* Absolute `http(s)://` URL. Built by `buildDeviceAdminUrl` and therefore
+	* free of userinfo and of any credential-shaped query key.
+	*/
+	url: z.string(),
+	/**
+	* What the surface calls it — "Web UI", "Home Assistant", "UniFi controller".
+	* The PROVIDER names it, because only the provider knows what the page is;
+	* a UI that invented the label from the addon id would call the Home
+	* Assistant device page "Provider Homeassistant".
+	*/
+	label: z.string(),
+	target: AdminLinkTargetEnum,
+	/**
+	* Host the URL points at, without scheme, port or path — for the tooltip, so
+	* an operator can see WHERE the button goes before he follows it. Redundant
+	* with `url` by construction; carried separately so no surface has to parse
+	* a URL to show it.
+	*/
+	host: z.string()
+});
+var deviceAdminLinkCapability = {
+	name: "device-admin-link",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	methods: { 
+	/**
+	* The device's management page, or `null` when this device has none.
+	*
+	* `auth: 'admin'` deliberately. This is administration, not actuation —
+	* the same bucket as `reboot` and `camera-credentials`, and explicitly NOT
+	* the actuation set `scripts/check-actuation-not-admin.ts` protects (D403).
+	* The URL is also a statement about the LAN, which a household member with
+	* a `view` grant on a light has no reason to be handed.
+	*
+	* The surfaces gate on the QUERY, never on a role they guessed: a caller
+	* without the right loses the query and draws nothing, which is the same
+	* thing a device with no page draws. There is no path on which a button
+	* appears and then fails — the D403 failure mode, from the other end.
+	*/
+getAdminLink: method(z.object({ deviceId: z.number().int().nonnegative() }), DeviceAdminLinkSchema.nullable(), { auth: "admin" }) }
+};
+/**
 * Identity envelope for a device's upstream-system metadata.
 *
 * Two jobs:
@@ -11973,118 +12022,6 @@ var deviceAdoptionCapability = {
 	}
 };
 /**
-* device-admin-link — "this device has a management page of its own, and here
-* is its address".
-*
-* ## Why this is not a `deviceConfig` cap
-*
-* There is nothing to edit. A `deviceConfig` cap (D14) exists so the framework
-* can DERIVE a settings form from `getOptions` + `getStatus` and route a flat
-* patch back through a setter; it costs a `builderId` reducer in
-* `device-config-contribution.ts` and a `*-config-schema.ts` beside it, and it
-* renders a form section. This cap answers ONE question with ONE read and
-* renders a button. Nothing about it is a form, so it carries no `deviceConfig`
-* block, no `settings`, no `runtimeState` and no reducer — exactly like
-* `reboot`, the other pure-RPC device-native cap.
-*
-* ## Absent, and the difference between "no page" and "we cannot say"
-*
-* The two are answered at DIFFERENT layers, on purpose:
-*
-*  - **"We cannot say"** → the provider never registers the cap for that
-*    device. A VeSync humidifier, a Petkit feeder, a Dreame vacuum and a Dreo
-*    fan are reached only through a vendor cloud; there is no address to hand
-*    out and no page to open. A Tuya plug, a Wyze camera and a Gree air
-*    conditioner DO have a LAN IP, and still have no HTTP management page
-*    behind it. None of them register, so `deviceManager.getBindings` never
-*    lists the cap and no surface asks.
-*  - **"This device has no page, and I know that"** → the provider registers
-*    and `getAdminLink` returns `null`. This is the answer for a device whose
-*    sibling DOES have a page: a Reolink battery camera reached over UDP by
-*    `uid` with a blank `host`, an Ecowitt gateway configured in `listener`
-*    transport, a Home Assistant broker authenticated by supervisor token
-*    (which carries no `baseUrl` at all).
-*
-* Both draw NOTHING. A button that opens a browser error is worse than no
-* button, and D62 is the same rule from the other side: an off switch is
-* reported off, never made to look broken. There is no third state where the
-* UI renders a disabled button "because the device might have a page".
-*
-* ## The URL never carries credentials
-*
-* Not in userinfo, not in a query string. Every provider builds through
-* `buildDeviceAdminUrl` (`device-admin-link-url.ts`), which takes host, port,
-* scheme and path as separate arguments — there is no parameter a secret could
-* arrive in — and re-checks its own output for the `scheme://user:pass@` shape
-* that `scripts/check-no-credential-urls-in-fixtures.ts` bans from recorded
-* output. `scripts/check-admin-link-builder-is-the-only-url-source.ts` is what
-* keeps providers from hand-rolling one anyway.
-*
-* This matters here more than anywhere else in the repo, because every provider
-* that knows a device's host knows its PASSWORD too: `{ host, port, username,
-* password }` sit in one object on Hikvision, Amcrest, Reolink and ONVIF alike,
-* and `http://admin:hunter2@192.168.50.139/` is a URL a browser accepts. The
-* camera's own page will ask for its own login. That is correct, and pre-
-* filling it is the operator's business, not ours.
-*
-* ## It is a LAN fact
-*
-* The URL addresses the device where the NODE can see it. It is not proxied,
-* not made reachable from outside, and not sent anywhere. A surface renders it
-* as a link the operator's own browser follows, on the operator's own network,
-* or renders nothing.
-*/
-/**
-* Whose page is it. The distinction is for the OPERATOR, who needs to know
-* before clicking whether he is about to land on a camera's own web server or
-* inside Home Assistant.
-*/
-var AdminLinkTargetEnum = z.enum(["device", "integration"]);
-var DeviceAdminLinkSchema = z.object({
-	/**
-	* Absolute `http(s)://` URL. Built by `buildDeviceAdminUrl` and therefore
-	* free of userinfo and of any credential-shaped query key.
-	*/
-	url: z.string(),
-	/**
-	* What the surface calls it — "Web UI", "Home Assistant", "UniFi controller".
-	* The PROVIDER names it, because only the provider knows what the page is;
-	* a UI that invented the label from the addon id would call the Home
-	* Assistant device page "Provider Homeassistant".
-	*/
-	label: z.string(),
-	target: AdminLinkTargetEnum,
-	/**
-	* Host the URL points at, without scheme, port or path — for the tooltip, so
-	* an operator can see WHERE the button goes before he follows it. Redundant
-	* with `url` by construction; carried separately so no surface has to parse
-	* a URL to show it.
-	*/
-	host: z.string()
-});
-var deviceAdminLinkCapability = {
-	name: "device-admin-link",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	methods: { 
-	/**
-	* The device's management page, or `null` when this device has none.
-	*
-	* `auth: 'admin'` deliberately. This is administration, not actuation —
-	* the same bucket as `reboot` and `camera-credentials`, and explicitly NOT
-	* the actuation set `scripts/check-actuation-not-admin.ts` protects (D403).
-	* The URL is also a statement about the LAN, which a household member with
-	* a `view` grant on a light has no reason to be handed.
-	*
-	* The surfaces gate on the QUERY, never on a role they guessed: a caller
-	* without the right loses the query and draws nothing, which is the same
-	* thing a device with no page draws. There is no path on which a button
-	* appears and then fails — the D403 failure mode, from the other end.
-	*/
-getAdminLink: method(z.object({ deviceId: z.number().int().nonnegative() }), DeviceAdminLinkSchema.nullable(), { auth: "admin" }) }
-};
-/**
 * `device-export` — collection cap for addons that export camstack
 * devices to external ecosystems (HomeAssistant via MQTT discovery,
 * HomeKit/HAP, Alexa Smart Home, …).
@@ -25431,6 +25368,87 @@ var storageProviderCapability = {
 		})
 	}
 };
+/**
+* The signals a device can emit to WAKE its own stream.
+*
+* A camera whose stream is built on demand sleeps until something asks for it,
+* and "something" cannot be a consumer that is merely attached — a Frigate-style
+* puller holds a session open for ever, and treating that as demand would keep
+* a battery camera awake for ever, which is the whole thing the battery is for
+* (D173). So the wake has to come from the CAMERA: an event it noticed by
+* itself, with no stream running.
+*
+* ## The vocabulary is the PROVIDER'S, not ours
+*
+* Like `consumables`, this cap declares no vocabulary of its own. A provider
+* names each signal with a `code` it chooses and a `label` an operator reads.
+* Reolink offers motion and camera-native detection; another provider may offer
+* a tamper, a doorbell press, a PIR, or something no camera in this fleet has
+* yet. A fixed enum here would mean every new signal is a framework release.
+*
+* It is deliberately NOT derived from the caps a device already binds. Whether
+* a camera CAN push firmware motion is expressed by `motionSources` containing
+* `'onboard'`, and whether it does AI on-camera by the `native-object-detection`
+* binding — but both answer "what drives the detection pipeline", which is a
+* different question from "what may wake a sleeping stream". A camera can do
+* the first and not be trusted with the second, and the operator picks per
+* camera. Two questions, two authorities.
+*
+* ## Availability is not permission
+*
+* `listSignals` says what the device CAN emit. Whether a given signal actually
+* wakes the stream is the operator's per-camera choice, held by the broker
+* alongside the cooldown — see the stream-broker cap's wake settings. A
+* provider declaring a signal is not a provider enabling it.
+*/
+/** One signal a device can emit. */
+var StreamSignalSchema = z.object({
+	/** Stable id chosen by the provider, e.g. `'motion'`, `'person'`, `'tamper'`. */
+	code: z.string().min(1),
+	/** What an operator reads in the picker. The provider's own wording. */
+	label: z.string().min(1),
+	/**
+	* Whether the provider recommends this signal ON when a camera is first set
+	* up. A provider knows which of its signals are cheap and reliable; an
+	* operator should not have to discover that by trial. Reolink recommends
+	* both of its own.
+	*/
+	recommended: z.boolean()
+});
+var StreamSignalsStatusSchema = z.object({
+	signals: z.array(StreamSignalSchema),
+	lastFetchedAt: z.number()
+});
+var streamSignalsCapability = {
+	name: "stream-signals",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: Object.values(DeviceType),
+	runtimeState: StreamSignalsStatusSchema,
+	/**
+	* Runtime-state durability: **session** — mirrored in RAM, never written.
+	*
+	* The slice holds what the DEVICE says it can emit. That is a probed fact,
+	* not an operator choice: the provider re-declares it on every registration,
+	* so losing it loses nothing and persisting it would freeze an answer the
+	* camera is entitled to change. Measured the same day on the sibling case —
+	* `native-object-detection.supportedClasses` was persisted, and a firmware
+	* class the camera really detected stayed missing for the life of the row
+	* because the fix could not reach it.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
+	methods: { 
+	/**
+	* What this device can emit. Empty is a valid and common answer — most
+	* cameras have nothing to offer here, and an empty list is what makes the
+	* broker's picker show nothing rather than a false choice.
+	*/
+listSignals: method(z.void(), z.array(StreamSignalSchema).readonly()) }
+};
 /** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
 var ProfileSettingsSchemaBridge = z.unknown().nullable();
 var ProfileSettingsBagSchema = z.record(z.string(), z.unknown());
@@ -26133,6 +26151,7 @@ z.enum([
 	"sleeping",
 	"camera-refused",
 	"no-keyframe",
+	"decode-failed",
 	"no-catalog-row",
 	"unsupported",
 	"unknown-device",
@@ -26407,6 +26426,32 @@ var ClipBytesSchema = z.object({
 	durationMs: z.number().positive().optional()
 });
 /**
+* Where a clip's finished bytes can be TAKEN (D613) — the answer to
+* {@link videoclipsCapability.methods.offerClipBytes}.
+*
+* Everything {@link ClipBytesSchema} carries except the bytes themselves, plus
+* the one-shot ticket that leads to them. The metadata is answered BEFORE the
+* transfer on purpose: a consumer learns which twin it got, what to call the
+* file and how long the clip runs without having to read a byte, so a decision
+* it would make on that metadata (a wrong twin, an implausible duration) costs
+* no transfer at all.
+*/
+var ClipBytesOfferSchema = z.object({
+	/**
+	* One shot, seconds-long, loopback, on the PROVIDER's own host. Open it with
+	* `ctx.peerBytes.open(...)`, which refuses a ticket from another node by
+	* name rather than dialling a port that means something else here.
+	*/
+	ticket: PeerBytesTicketSchema,
+	contentType: z.string(),
+	/** Suggested filename, extension included. */
+	name: z.string(),
+	/** Which twin was actually served — see {@link ClipBytesSchema.served}. */
+	served: CamProfileSchema,
+	/** See {@link ClipBytesSchema.durationMs}. Absent when nothing measured it. */
+	durationMs: z.number().positive().optional()
+});
+/**
 * Where a clip's STREAM can be dialled (D597) — the answer to
 * {@link videoclipsCapability.methods.dialClipStream}.
 *
@@ -26482,6 +26527,44 @@ var ClipStreamDialSchema = z.object({
 	/** Why `servedAudio` is `none` although sound was asked for. */
 	audioReason: ClipStreamAudioReasonSchema.optional()
 });
+/**
+* What a surface may DRAW for this provider's clips — the answer to
+* {@link videoclipsCapability.methods.getPlaybackOptions} (D612).
+*
+* The envelope is a PROVIDER fact, not a clip fact, and that is measured, not
+* assumed: the broker's `chooseClipPath` reads exactly two inputs — whether
+* `dialClipStream` and `readClipBytes` are wired — and both are constants of
+* the broker's own closure over the provider's methods. The `profile` it is
+* handed is explicitly not read. So every clip of a provider is served the
+* same way, and a per-clip channel carried a value that could not vary. The
+* per-clip `clipTransport` server message was removed for exactly that reason.
+*
+* Queried per camera, before a clip is picked, so a control is rendered or
+* DISABLED rather than offered and refused at play time (D62: a disabled
+* control reads as unavailable, one that undoes the gesture reads as broken).
+*/
+var ClipPlaybackOptionsSchema = z.object({
+	/**
+	* How this provider's clips reach the player. `stream` is the provider's
+	* forward-only fMP4 (D597); `file` is one bounded by-handle fetch of the
+	* whole clip, `stbl` indexed (D575).
+	*/
+	transport: z.enum(["stream", "file"]),
+	/** `forward` = only ahead of the playhead. `free` = anywhere. */
+	seek: z.enum(["forward", "free"]),
+	/** Frame-step BACKWARD is meaningful. Forward always is. */
+	stepBack: z.boolean(),
+	/** Whether the scrub gesture is served, as opposed to refused by name. */
+	scrub: z.boolean(),
+	/**
+	* The rates that can be delivered, ascending, always containing `1`. The
+	* viewer draws its picker from this and from nothing else — a constant it
+	* keeps instead is the second authority that produced the defect: `8` and
+	* `16` were offered, the broker clamped them to `4`, and no line anywhere
+	* said so. `0` is not a member: pause is the absence of a rate.
+	*/
+	rates: z.array(z.number().positive()).min(1).readonly()
+});
 var ClipSourceAvailabilitySchema = z.object({
 	state: z.enum([
 		"ok",
@@ -26660,14 +26743,18 @@ var videoclipsCapability = {
 		*
 		* `getClipPlayback` is the right answer for a player: it hands back a URL
 		* on a plane the hub serves `access:'authenticated'`, which a browser and a
-		* viewer session satisfy. It is the wrong answer for another ADDON. There
-		* is no addon→addon byte transport in this framework — `AddonDataPlane`
-		* only lets an addon SERVE, on `127.0.0.1` behind a per-listener secret
-		* only the hub may present — so a recorder that wants a camera's clip
-		* cannot fetch that URL. This method is the one seam that exists for it,
-		* and it is deliberately the same shape (and the same bound) as
-		* `recordingExport.readExportBytes`, which exists for the mirror-image
-		* reason.
+		* viewer session satisfy. It is the wrong answer for another ADDON: the
+		* hub's proxy in front of that plane takes only a user credential, which
+		* an addon does not hold, so a recorder that wants a camera's clip cannot
+		* fetch that URL. This method is the shape that answer forced — the same
+		* one (and the same bound) as `recordingExport.readExportBytes`.
+		*
+		* **It is no longer the only seam.** Until D613 there was no addon→addon
+		* byte transport at all; there is now
+		* ({@link offerClipBytes}, over `ctx.peerBytes`), it holds nothing on
+		* either side, and it is what a clip EXPORT uses. This method remains for
+		* a consumer that genuinely wants the bytes in hand, and as the named
+		* fallback for a provider not yet redeployed.
 		*
 		* Routing needs no `provider` pin: the id is source-prefixed and
 		* self-contained, so `device-collection-dispatch.ts` rule 3 hands the call
@@ -26734,6 +26821,65 @@ var videoclipsCapability = {
 			auth: "protected"
 		}),
 		/**
+		* Where this clip's finished bytes can be TAKEN — the by-handle read a
+		* clip EXPORT pulls, over the addon→addon byte transport (D613).
+		*
+		* This is {@link readClipBytes} with the envelope removed. Same gates,
+		* same vocabulary, same completion rules, same `served` contract — the
+		* only difference is that the bytes travel over a one-shot loopback
+		* socket instead of inside a base64 field, so neither side holds the
+		* payload whole and the 50 MiB refusal on a long `high` twin stops
+		* existing. The bound that remains is
+		* {@link VIDEOCLIPS_MAX_OFFER_BYTES}, and it bounds the PRODUCER's own
+		* copy rather than the transport.
+		*
+		* **The ticket is loopback and same-host.** A provider on an agent mints a
+		* URL that means nothing on the hub, and `ctx.peerBytes.open` refuses it
+		* `cross-node` by name rather than dialling whatever else holds that port
+		* here. A consumer that can be on the other side of a node boundary from
+		* its provider must be able to read that refusal and say so; it must not
+		* treat it as "no bytes".
+		*
+		* **A ticket is a one-shot bearer credential with a seconds-long life.**
+		* Take it immediately, never persist it, never log its `url`. An untaken
+		* ticket costs the provider one map entry until its TTL, and outstanding
+		* tickets are bounded — which is also what makes a per-frame misuse of
+		* this method refuse by name rather than work slowly (D9/D18: this is a
+		* by-handle fetch of finished media, not a frame pipe).
+		*
+		* Optional on the provider for the same reason `readClipBytes` is: a
+		* source with no camera socket behind it has no bytes. A provider that
+		* predates this method answers `NOT_IMPLEMENTED`, and a consumer may fall
+		* back to `readClipBytes` — but it says so in the log, with the deploy
+		* hint, because that fallback re-imposes the 50 MiB refusal and an
+		* operator who sees `too-large-to-transfer` after this shipped is looking
+		* at a stale addon, not at a clip that cannot be exported.
+		*/
+		offerClipBytes: optionalMethod(z.object({
+			deviceId: z.number(),
+			clipId: z.string().min(1),
+			/** WHICH provider holds the bytes — see `readClipBytes.provider`. */
+			provider: z.string().min(1),
+			/** Which twin — `low | mid` → the sub file, `high` → the main twin. */
+			profile: CamProfileSchema.optional(),
+			/**
+			* The CALLER's byte bound, so an over-size clip is refused before the
+			* camera is touched rather than after. Capped by
+			* {@link VIDEOCLIPS_MAX_OFFER_BYTES} whatever is passed; absent means
+			* that ceiling.
+			*/
+			maxBytes: z.number().int().positive().optional(),
+			/**
+			* The operator's authorisation to wake a sleeping camera for this
+			* read. Absent — the default — means a sleeping standalone battery
+			* camera is REFUSED by name, before any session is opened.
+			*/
+			wake: ClipWakeSchema.optional()
+		}), ClipBytesOfferSchema, {
+			kind: "query",
+			auth: "protected"
+		}),
+		/**
 		* Where this clip's STREAM can be dialled (D597) — the forward-only
 		* fMP4 the provider writes from the first muxed byte, for the broker to
 		* play through the same WebRTC session as recorded footage, with the
@@ -26770,6 +26916,36 @@ var videoclipsCapability = {
 		}), ClipStreamDialSchema, {
 			kind: "query",
 			auth: "protected"
+		}),
+		/**
+		* What a surface may DRAW for this provider's clips: the rates it can be
+		* played at, whether scrub is served, how far a position may be moved,
+		* and whether a backward frame-step means anything (D612).
+		*
+		* **The only authority.** The per-clip `clipTransport` server message
+		* that used to carry the same answer was removed: the broker's transport
+		* choice reads nothing that varies per clip, so the clip level had no
+		* information the provider does not already have, and two channels that
+		* can disagree are worse than one (D62).
+		*
+		* Asked per camera and per provider, so it must stay CHEAP — it is a
+		* statement about wiring, answered from a constant, never a call to the
+		* camera. A provider answers with one of {@link CLIP_PLAYBACK_OPTIONS}
+		* and never composes an envelope of its own.
+		*
+		* Optional, and absence is load-bearing: a provider that has not answered
+		* has not restricted anything, and a viewer reads it as the freedom it
+		* always had. See D612 on the rollout order that absence implies.
+		*/
+		getPlaybackOptions: optionalMethod(z.object({
+			deviceId: z.number(),
+			/** WHICH provider to ask — the `addonId` a {@link ClipSourceSchema}
+			*  row carries. Required for the same reason `listClips` requires it:
+			*  a collection cap has no "the bound one" to resolve to (D554). */
+			provider: z.string().min(1)
+		}), ClipPlaybackOptionsSchema, {
+			kind: "query",
+			auth: "protected"
 		})
 	}
 };
@@ -28515,6 +28691,179 @@ getCredentials: method(z.object({ deviceId: z.number() }), CameraCredentialsSche
 	}
 };
 /**
+* camera-grid-layout — the geometry of a COMPOSITE camera, on the camera's own
+* page.
+*
+* ## Why this is a capability and not an addon settings schema
+*
+* It was one, and it did not render. The addon declared the editor as a
+* `type: 'widget'` field inside its own `deviceSettingsSchema()`; the hub
+* returned that section correctly and `ConfigFormField` renders `type:'widget'`
+* perfectly well — and nothing ever asked camera-grid for it. The Cluster →
+* Pipeline → Device Overrides page interrogates a HAND-WRITTEN list of four
+* addons (`PIPELINE_CLUSTER_DEVICE_ADDONS`), whose own comment says an addon
+* not on it "falls off silently".
+*
+* Adding a fifth name to that list would have been the wrong fix twice over:
+* that page is per-camera DETECTION tuning, and a grid's geometry belongs
+* beside PTZ and motion zones on the camera itself. The device page is
+* BINDING-driven (D12), so the way in is a capability bound to the device —
+* and this cap carries its section the way `recording` does, by RETURNING it
+* from `getDeviceSettingsContribution`.
+*
+* Seven other widgets are still declared the other way, through a
+* `deviceConfig.ui` block the framework derives a section from. That route
+* gives the addon no say in where its own panel lands and no way to decline
+* for a device the panel does not suit, which is why this one does not use it.
+*
+* ## Why one addon may implement it
+*
+* It is a device-scoped NATIVE cap, registered by the grid camera device
+* itself. Nothing else declares a composite camera, so nothing else has a
+* layout — and the device-scoped route means the widget asks THE camera, not
+* "the camera-grid addon", which is what let the old custom-action pair be
+* reached only by a caller that already knew the addon id.
+*
+* ## The tab
+*
+* `streaming`, not a top-tab of its own. A grid's geometry IS what its stream
+* is, so the Streaming tab is where it belongs; a `grid` top-tab would need an
+* entry in `WELL_KNOWN_TAB_MAP` or the device page renders the raw id as the
+* label (measured on the robot camera, 2026-09-06 — a tab called "navigation"
+* next to "PTZ").
+*/
+/** A rectangle in normalized [0,1] coordinates of whatever contains it. */
+var GridNormalizedRectSchema = z.object({
+	x: z.number().min(0).max(1),
+	y: z.number().min(0).max(1),
+	width: z.number().gt(0).max(1),
+	height: z.number().gt(0).max(1)
+});
+/**
+* One source camera, the part of its picture taken, and where that part lands.
+*
+* Both rectangles are NORMALIZED (D519): a source camera can change resolution
+* — a profile switch, a firmware update, a substream that comes back different
+* — and a stored PIXEL rectangle would quietly start cutting the wrong region,
+* which is the class of bug nobody files.
+*/
+var GridLayoutCellSchema = z.object({
+	deviceId: z.number().int().positive(),
+	/** The part of the SOURCE taken, normalized against the source. */
+	source: GridNormalizedRectSchema,
+	/** Where it lands, normalized against the CANVAS. */
+	cell: GridNormalizedRectSchema
+});
+/**
+* Which profiles this grid can actually compose, and why not.
+*
+* A grid's `high` composes its sources' `high` and its `low` their `low`, so a
+* profile is on offer only when EVERY source can serve it. The refusal NAMES
+* the sources, because "this grid has no low" is not a finding — "615 has no
+* low" is, and it is the one an operator can act on.
+*/
+var GridProfileOfferSchema = z.object({
+	profile: z.enum([
+		"high",
+		"mid",
+		"low"
+	]),
+	offered: z.boolean(),
+	/** Sources that cannot serve it. Empty when it is offered, or when there are no cells. */
+	missingSources: z.array(z.number().int().positive()),
+	/**
+	* The canvas this profile composes onto, `WxH`, or empty when it is not
+	* offered. DERIVED from the cells and the sources' own size at this profile —
+	* it is reported because nothing else in the system would ever say what the
+	* grid came out as, and because it is the number an operator would otherwise
+	* expect to type.
+	*/
+	canvas: z.string(),
+	/**
+	* Whether this profile is PUBLISHED, of the ones the grid could serve.
+	*
+	* A grid's `high` is composed of its sources' `high`, so on a 4K fleet it is
+	* a 4K canvas built from 4K decodes — something to opt into, not something a
+	* viewer's adaptive should be handed by climbing to the top rung it can see.
+	* Default is `mid` + `low`.
+	*/
+	published: z.boolean()
+});
+var GridLayoutViewSchema = z.object({
+	/** The persisted grid row this camera was declared from. */
+	instanceId: z.string(),
+	deviceId: z.number().int().nonnegative(),
+	name: z.string(),
+	/**
+	* NO canvas size. A grid's resolution is not authored: each profile derives
+	* its own from the cells and its sources' dimensions. The two numbers that
+	* used to be here were a text field that silently decided both how much the
+	* composite cost and how sharp it was — see `profiles[].canvas` for what it
+	* came out as.
+	*/
+	fps: z.number().int(),
+	cells: z.array(GridLayoutCellSchema),
+	/** What the catalog will publish, and what it refuses to. Read-only. */
+	profiles: z.array(GridProfileOfferSchema)
+});
+var GridLayoutPatchSchema = z.object({
+	deviceId: z.number().int().nonnegative(),
+	name: z.string().min(1).max(160).optional(),
+	fps: z.number().int().min(1).max(60).optional(),
+	/** Which profiles to publish. See `GridProfileOffer.published`. */
+	publishedProfiles: z.array(z.enum([
+		"high",
+		"mid",
+		"low"
+	])).max(3).optional(),
+	/**
+	* The whole cell list at once. A per-cell patch would need an ordering the
+	* editor does not have, and a half-applied layout is a picture nobody asked
+	* for.
+	*/
+	cells: z.array(GridLayoutCellSchema).max(16)
+});
+var cameraGridLayoutCapability = {
+	name: "camera-grid-layout",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	/**
+	* The section is built by the ADDON and returned from
+	* `getDeviceSettingsContribution`, not derived by the framework from a
+	* `deviceConfig.ui` block.
+	*
+	* Both mechanisms render the same widget. This one hands the addon two
+	* things the framework-derived route cannot give it:
+	*
+	*  - it chooses its own section, `tab`, `location` and `order`, the way any
+	*    other setting does, instead of receiving them from a cap declaration;
+	*  - it can DECLINE per device. A camera that is not a grid gets no section
+	*    at all, rather than a widget that renders its own "not a grid" state.
+	*
+	* `recording` is the precedent (`recorder/recording-device-settings.ts`): it
+	* returns `null` for anything that is not a camera, so the Recording tab
+	* never appears there.
+	*/
+	exposesDeviceSettings: true,
+	methods: {
+		/**
+		* The grid behind this device.
+		*
+		* `null` means ANSWERED and this camera is not a grid — not "not yet
+		* known". The widget renders its "this is not a grid camera" state only
+		* from this answer, never from an unresolved query (D315).
+		*/
+		getLayout: method(z.object({ deviceId: z.number().int().nonnegative() }), GridLayoutViewSchema.nullable(), { auth: "admin" }),
+		/** Write the geometry back. Returns the grid as it now stands, profiles included. */
+		saveLayout: method(GridLayoutPatchSchema, GridLayoutViewSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
 * Carbon-monoxide alarm sensor. Drives Home Assistant `binary_sensor`
 * entries with `device_class: carbon_monoxide`. Push-driven.
 */
@@ -29371,390 +29720,6 @@ var dayNightCapability = {
 	volatileStateFields: ["lastFetchedAt"]
 };
 /**
-* Vendor-neutral **onboard** recording + storage cap — what the CAMERA
-* writes to the CAMERA's own card, on the camera's own schedule.
-*
-* This is NOT `recording.cap.ts`. That one is CamStack's recorder: our
-* footage ledger, our storage locations, our retention. This one has a
-* different authority — the camera's firmware — and per D62 it stores
-* nothing of its own. Every value here is read from the camera and every
-* write goes back to the camera; there is no CamStack-side mirror that
-* could disagree with the device.
-*
-* ## One shape, two firmwares
-*
-* Measured 2026-09-22 against the live fleet:
-*
-* | fact | Hikvision (ISAPI) | Reolink (Baichuan) |
-* | --- | --- | --- |
-* | storage | `ContentMgmt/Storage` `<hdd>` rows: status, capacity, freeSpace (MB) | `getHddInfoList` (cmd 102): `mount`, `format`, `capacity` GB + `capacityM` MB remainder |
-* | tracks | several (101 **and** 103 on both 1436 and 3833), each with its own schedule | one per channel |
-* | schedule | per track, 7 `ScheduleAction` blocks: DayOfWeek + TimeOfDay range + ONE `ActionRecordingMode` | per trigger type, a 168-char weekly HOUR mask |
-* | triggers | `CMR`, `MOTION` | `Normal`, `MD`, `people`, `vehicle`, `dog_cat`, `crossline`, `intrude`, `loitering` |
-* | pre-record | `PreRecordTimeSeconds` | `preRecordTime` |
-* | post-record | `PostRecordTimeSeconds` | `recordDelayTime` |
-* | overwrite | per track `LoopEnable` | `cycle`, with `cycleList` enumerating the accepted values |
-* | segment length | not exposed on V5.7.1 | `packageTime` (minutes) |
-*
-* The two schedule models look different and are the same thing in
-* different coordinates: both answer "for this trigger, during which
-* weekly windows does the camera record". {@link RecordWindow} is that
-* question in one shape — Hikvision's ranges map straight onto it,
-* Reolink's mask expands into hour-aligned windows.
-*
-* ## Union, not intersection
-*
-* **The same fields exist on every camera.** What differs per device is
-* which VALUES that device accepts, and that is what {@link
-* RecordingOnboardOptions} reports — a `{ readable, writable, reason }`
-* per field plus the schedule's own limits. A control a camera cannot
-* honour is rendered DISABLED WITH ITS REASON, never missing and never
-* dead: disabled must not look like broken.
-*
-* ## Refusal by name
-*
-* A write a camera cannot honour is refused with a sentence the operator
-* can read — never accepted and dropped. Both providers refuse through
-* {@link describeOnboardRefusal}, so the vocabulary is one function and
-* one test, not two hand-written vendor opinions.
-*
-* Follows the D14 `deviceConfig` archetype (see `stream-params.cap.ts`):
-* `getOptions` advertises per-camera availability, `getStatus` (auto-
-* injected from `status`) reports the live values, and a single
-* `setSettings` mutation applies a partial change. No hand-written
-* settings-contribution methods.
-*/
-/**
-* What makes the camera start recording during a window.
-*
-* The union of both vendors' vocabularies. `continuous` is Hikvision's
-* `CMR` and Reolink's `Normal`; `motion` is `MOTION` / `MD`. The
-* object-class triggers are Reolink-only today and the smart-event ones
-* (`lineCrossing`, `intrusion`, `loitering`) are Reolink-only on the
-* firmwares measured — a camera that cannot record on a trigger simply
-* does not list it in `options.schedule.triggers`, and a window naming
-* it is REFUSED, not dropped.
-*/
-var RecordTriggerSchema = z.enum([
-	"continuous",
-	"motion",
-	"person",
-	"vehicle",
-	"animal",
-	"lineCrossing",
-	"intrusion",
-	"loitering",
-	"alarmInput"
-]);
-/**
-* One weekly recording window: "on `day`, from `startMinute` to
-* `endMinute`, record on `trigger`".
-*
-* `day` is 0 = Monday … 6 = Sunday (ISO order, which is also the order
-* both firmwares enumerate). Minutes are local camera time since
-* midnight; `endMinute` may be 1440, meaning end of day — that is
-* Hikvision's literal `24:00` and Reolink's 24th mask slot, and
-* collapsing it to 0 would turn a whole-day window into an empty one.
-*/
-var RecordWindowSchema = z.object({
-	trigger: RecordTriggerSchema,
-	day: z.number().int().min(0).max(6),
-	startMinute: z.number().int().min(0).max(1439),
-	endMinute: z.number().int().min(1).max(1440)
-});
-/** Status of one physical volume, as the camera itself describes it. */
-var OnboardStorageVolumeSchema = z.object({
-	/** The camera's own id for the volume (`hdd/id`, Reolink `HddInfo/number`). */
-	id: z.string(),
-	/** The camera's own name for it, when it gives one (`hddName`). */
-	label: z.string().optional(),
-	status: z.enum([
-		"ok",
-		"unformatted",
-		"error",
-		"offline",
-		"unknown"
-	]),
-	/**
-	* Total size in MB, or **null when the camera did not say**.
-	*
-	* Never 0 for an unreadable value: a measurement that failed is not a
-	* measurement (D393), and a card whose size is unknown must not be
-	* rendered as a card of size zero.
-	*/
-	capacityMb: z.number().nullable(),
-	/**
-	* Free space in MB, or null when unknown.
-	*
-	* **Not a proxy for "has footage".** Measured 2026-09-22: 1436 and
-	* 1439 both report exactly 11776 MB free — the fixed reserve a looping
-	* card converges on once it has wrapped. At loop steady state the
-	* number is identical whether the camera recorded yesterday or stopped
-	* a month ago.
-	*/
-	freeMb: z.number().nullable(),
-	/** True when the camera reports the volume writable (`property` RW). */
-	writable: z.boolean().optional()
-});
-/**
-* Whether the camera has usable onboard storage.
-*
-* Three states, never two: an unreadable answer is `unknown`, never
-* folded into `absent`. Folding a failed read into "no card" is how a
-* healthy camera gets reported as broken, and the inverse is how a
-* camera with no card reports `ok` and then an empty list (D393).
-*/
-var OnboardStorageSchema = z.discriminatedUnion("kind", [
-	z.object({
-		kind: z.literal("present"),
-		volumes: z.array(OnboardStorageVolumeSchema)
-	}),
-	z.object({
-		kind: z.literal("absent"),
-		reason: z.string()
-	}),
-	z.object({
-		kind: z.literal("unknown"),
-		reason: z.string()
-	})
-]);
-/**
-* One recording track the camera exposes. Read-only.
-*
-* Hikvision lists several — 1436 and 3833 each list 101 AND 103, with
-* DIFFERENT schedules (101 MOTION all day, 103 CMR 00:05–23:57) — so a
-* cap that reported one number for "the schedule" would be lying on
-* every Hikvision in the fleet. Reolink has exactly one per channel.
-*
-* There is deliberately **no `framerate`**. Hikvision declares it in the
-* track `Description` and it is WRONG: 1436 says `2.260000 fps` while
-* the media measures 12.55 fps. `codec` and `resolution` from the same
-* string ARE right — those are the only two worth surfacing.
-*/
-var OnboardRecordTrackSchema = z.object({
-	id: z.string(),
-	enabled: z.boolean(),
-	isVideo: z.boolean(),
-	/** From the camera's own track description. Null when it does not say. */
-	codec: z.string().nullable(),
-	resolution: z.string().nullable(),
-	/** Per-track overwrite flag, where the firmware keeps it per track. */
-	overwriteWhenFull: z.boolean().nullable()
-});
-/**
-* What the camera is doing with its own storage, right now.
-*
-* Every scalar is nullable and **null means the camera did not answer**,
-* never a default. A form that seeds `0` from an unanswered read invites
-* the operator to save that 0 back onto the camera.
-*/
-var RecordingOnboardStatusSchema = z.object({
-	storage: OnboardStorageSchema,
-	tracks: z.array(OnboardRecordTrackSchema),
-	/**
-	* The track the write path targets — the enabled VIDEO one. Null when
-	* no track could be identified, which is itself a refusal reason.
-	*/
-	primaryTrackId: z.string().nullable(),
-	/** Master "record to the card at all" switch. */
-	enabled: z.boolean().nullable(),
-	overwriteWhenFull: z.boolean().nullable(),
-	preRecordSec: z.number().nullable(),
-	postRecordSec: z.number().nullable(),
-	/** Length of one recorded file, in minutes. */
-	segmentMinutes: z.number().nullable(),
-	/** The primary track's weekly windows, flattened. */
-	windows: z.array(RecordWindowSchema),
-	/**
-	* How many windows the camera described that CamStack could NOT read —
-	* an unrecognised trigger, an unparseable clock, a weekday it does not
-	* name.
-	*
-	* A dropped window is work the reader threw away, and a schedule that
-	* silently shows fewer rows than the camera holds is how an operator
-	* saves back a schedule shorter than the one they were looking at
-	* (D391). Non-zero means the window list is INCOMPLETE and a write
-	* that replaces it would delete what was not shown — which is why a
-	* provider reporting a non-zero count also reports the schedule as not
-	* writable.
-	*/
-	unreadableWindows: z.number(),
-	/**
-	* The camera is scheduled to record and has NO usable storage.
-	*
-	* A first-class fact because it is the fleet's most common silent
-	* defect: measured 2026-09-22, 1441 and 3831 are both motion-recording
-	* to a card that is not there. Neither the schedule nor the storage
-	* read says anything wrong on its own; only the pair does.
-	*/
-	recordingToNowhere: z.boolean(),
-	lastFetchedAt: z.number()
-});
-/** Numeric range descriptor — `{ min, max, step }` per the getOptions convention. */
-var RangeSchema = z.object({
-	min: z.number(),
-	max: z.number(),
-	step: z.number()
-});
-/**
-* The values a camera actually takes for a numeric field, when they are a SET
-* rather than a range.
-*
-* `{min,max,step}` cannot say what these two firmwares do. Measured on 1436
-* (I91DN) on 2026-09-22 by writing each value and reading it back:
-*
-* - pre-record: `0, 5, 10, 15, 20, 25, 30` and `2147483647` (INT32_MAX, the
-*   camera's "no limit" — `-1` and `4294967295` both land on it);
-* - post-record: `5, 10, 30, 60, 120, 300, 600`.
-*
-* Neither is expressible as a step: the first has a sentinel two billion away
-* from its neighbours, the second doubles and then jumps. A range that tried
-* would forbid values the camera takes AND permit values it silently replaces
-* with 5 — wrong in both directions at once.
-*
-* `sentinel` names the member that is not a duration, so a surface can render
-* "no limit" instead of `2147483647` seconds.
-*/
-var AllowedValuesSchema = z.object({
-	values: z.array(z.number()).min(1),
-	sentinel: z.object({
-		value: z.number(),
-		meaning: z.enum(["no-limit", "disabled"])
-	}).optional()
-});
-/**
-* Per-field availability on ONE camera.
-*
-* The field exists on every camera — this says whether this one can be
-* read and whether it can be written, and `reason` says why not when
-* either is false. The UI renders the control DISABLED with the reason
-* rather than hiding it, so a limitation is legible instead of looking
-* like a missing feature.
-*/
-var OnboardFieldSupportSchema = z.object({
-	readable: z.boolean(),
-	writable: z.boolean(),
-	/** Required whenever `readable` or `writable` is false. */
-	reason: z.string().optional()
-});
-/** What this camera's schedule model can express. */
-var OnboardScheduleSupportSchema = z.object({
-	support: OnboardFieldSupportSchema,
-	/**
-	* The smallest time step the camera can express, in minutes.
-	*
-	* Hikvision takes arbitrary minutes (`00:05:00`–`23:57:00` observed on
-	* 1436's track 103). Reolink's schedule is a 7×24 HOUR mask, so 60. A
-	* window whose edges are not a multiple of this is REFUSED rather than
-	* quietly rounded — rounding is how an operator's 06:30 becomes 06:00
-	* and nothing says so.
-	*/
-	granularityMinutes: z.number(),
-	/** Triggers this camera can record on. A window naming another is refused. */
-	triggers: z.array(RecordTriggerSchema),
-	/**
-	* False when the camera stores ONE trigger per time range, so two
-	* windows overlapping on the same day cannot carry different triggers.
-	* True on Reolink, whose mask is per-trigger and independent.
-	*/
-	supportsOverlappingTriggers: z.boolean()
-});
-var RecordingOnboardOptionsSchema = z.object({
-	enabled: OnboardFieldSupportSchema,
-	overwriteWhenFull: OnboardFieldSupportSchema,
-	preRecordSec: OnboardFieldSupportSchema,
-	preRecordSecRange: RangeSchema.optional(),
-	/** Preferred over the range when the camera takes a SET, not a span. */
-	preRecordSecAllowed: AllowedValuesSchema.optional(),
-	postRecordSec: OnboardFieldSupportSchema,
-	postRecordSecRange: RangeSchema.optional(),
-	/** Preferred over the range when the camera takes a SET, not a span. */
-	postRecordSecAllowed: AllowedValuesSchema.optional(),
-	segmentMinutes: OnboardFieldSupportSchema,
-	segmentMinutesRange: RangeSchema.optional(),
-	/** Preferred over the range when the camera takes a SET, not a span. */
-	segmentMinutesAllowed: AllowedValuesSchema.optional(),
-	schedule: OnboardScheduleSupportSchema
-});
-/**
-* A partial change. Every field optional.
-*
-* Unlike the other `deviceConfig` caps, a provider here does **NOT**
-* silently ignore a field it cannot support — it refuses, by name,
-* through {@link describeOnboardRefusal}. Silence on a recording setting
-* is the failure D62 exists to prevent: the operator believes the camera
-* is recording the way the form says, and it is not.
-*/
-var RecordingOnboardPatchSchema = z.object({
-	enabled: z.boolean().optional(),
-	overwriteWhenFull: z.boolean().optional(),
-	preRecordSec: z.number().optional(),
-	postRecordSec: z.number().optional(),
-	segmentMinutes: z.number().optional(),
-	/** The complete new window set for the primary track — not a delta. */
-	windows: z.array(RecordWindowSchema).optional()
-});
-var recordingOnboardCapability = {
-	name: "recording-onboard",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
-	deviceConfig: { ui: {
-		kind: "derived-form",
-		builderId: "recording-onboard",
-		tab: "recording"
-	} },
-	methods: {
-		getOptions: method(z.object({ deviceId: z.number() }), RecordingOnboardOptionsSchema),
-		setSettings: method(z.object({
-			deviceId: z.number(),
-			settings: RecordingOnboardPatchSchema
-		}), z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
-	},
-	status: {
-		schema: RecordingOnboardStatusSchema,
-		kind: "poll"
-	},
-	runtimeState: RecordingOnboardStatusSchema,
-	/**
-	* Runtime-state durability: **restored** — operator-set camera-side
-	* recording config; mutation-driven, and the storage half is the last
-	* thing the camera said about its own card.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored",
-	/** Clock fields: written, but excluded from the compare that decides
-	*  whether persisting is worth a SQLite commit. */
-	volatileStateFields: ["lastFetchedAt"]
-};
-/** Minutes in a day. `endMinute === 1440` means "to end of day". */
-var MINUTES_PER_DAY = 1440;
-/**
-* Day-of-week names in the cap's index order (0 = Monday), for messages
-* an operator reads and for Hikvision's `<DayOfWeek>` element.
-*/
-var DAY_NAMES = [
-	"Monday",
-	"Tuesday",
-	"Wednesday",
-	"Thursday",
-	"Friday",
-	"Saturday",
-	"Sunday"
-];
-/** `510` → `08:30`. For messages, not for the wire. */
-function formatMinutes(minute) {
-	const hour = Math.floor(minute / 60);
-	const rest = minute % 60;
-	return `${String(hour).padStart(2, "0")}:${String(rest).padStart(2, "0")}`;
-}
-/**
 * Generic device-level status snapshot. Auto-registered by `BaseDevice`
 * for every device, regardless of provider — the kernel needs a uniform
 * cap-keyed slice for the basic device flags every consumer expects to
@@ -29973,40 +29938,6 @@ var eventEmitterCapability = {
 	*/
 	durability: "session"
 };
-var EventItemSchema = z.object({
-	id: z.string(),
-	type: z.string(),
-	timestamp: z.number(),
-	label: z.string().optional(),
-	thumbnailUrl: z.string().optional(),
-	clipUrl: z.string().optional(),
-	metadata: z.record(z.string(), z.unknown()).optional()
-});
-var eventsCapability = {
-	name: "events",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
-	methods: {
-		getEvents: method(z.object({
-			deviceId: z.number(),
-			from: z.number().optional(),
-			to: z.number().optional(),
-			limit: z.number().optional()
-		}), z.array(EventItemSchema)),
-		getEventThumbnail: method(z.object({
-			deviceId: z.number(),
-			eventId: z.string()
-		}), z.object({
-			base64: z.string(),
-			contentType: z.string()
-		}).nullable()),
-		getEventClipUrl: method(z.object({
-			deviceId: z.number(),
-			eventId: z.string()
-		}), z.string().nullable())
-	}
-};
 var IdentitySchema = z.object({
 	id: z.string(),
 	name: z.string(),
@@ -32540,179 +32471,6 @@ var motionTriggerCapability = {
 	durability: "session"
 };
 /**
-* camera-grid-layout — the geometry of a COMPOSITE camera, on the camera's own
-* page.
-*
-* ## Why this is a capability and not an addon settings schema
-*
-* It was one, and it did not render. The addon declared the editor as a
-* `type: 'widget'` field inside its own `deviceSettingsSchema()`; the hub
-* returned that section correctly and `ConfigFormField` renders `type:'widget'`
-* perfectly well — and nothing ever asked camera-grid for it. The Cluster →
-* Pipeline → Device Overrides page interrogates a HAND-WRITTEN list of four
-* addons (`PIPELINE_CLUSTER_DEVICE_ADDONS`), whose own comment says an addon
-* not on it "falls off silently".
-*
-* Adding a fifth name to that list would have been the wrong fix twice over:
-* that page is per-camera DETECTION tuning, and a grid's geometry belongs
-* beside PTZ and motion zones on the camera itself. The device page is
-* BINDING-driven (D12), so the way in is a capability bound to the device —
-* and this cap carries its section the way `recording` does, by RETURNING it
-* from `getDeviceSettingsContribution`.
-*
-* Seven other widgets are still declared the other way, through a
-* `deviceConfig.ui` block the framework derives a section from. That route
-* gives the addon no say in where its own panel lands and no way to decline
-* for a device the panel does not suit, which is why this one does not use it.
-*
-* ## Why one addon may implement it
-*
-* It is a device-scoped NATIVE cap, registered by the grid camera device
-* itself. Nothing else declares a composite camera, so nothing else has a
-* layout — and the device-scoped route means the widget asks THE camera, not
-* "the camera-grid addon", which is what let the old custom-action pair be
-* reached only by a caller that already knew the addon id.
-*
-* ## The tab
-*
-* `streaming`, not a top-tab of its own. A grid's geometry IS what its stream
-* is, so the Streaming tab is where it belongs; a `grid` top-tab would need an
-* entry in `WELL_KNOWN_TAB_MAP` or the device page renders the raw id as the
-* label (measured on the robot camera, 2026-09-06 — a tab called "navigation"
-* next to "PTZ").
-*/
-/** A rectangle in normalized [0,1] coordinates of whatever contains it. */
-var GridNormalizedRectSchema = z.object({
-	x: z.number().min(0).max(1),
-	y: z.number().min(0).max(1),
-	width: z.number().gt(0).max(1),
-	height: z.number().gt(0).max(1)
-});
-/**
-* One source camera, the part of its picture taken, and where that part lands.
-*
-* Both rectangles are NORMALIZED (D519): a source camera can change resolution
-* — a profile switch, a firmware update, a substream that comes back different
-* — and a stored PIXEL rectangle would quietly start cutting the wrong region,
-* which is the class of bug nobody files.
-*/
-var GridLayoutCellSchema = z.object({
-	deviceId: z.number().int().positive(),
-	/** The part of the SOURCE taken, normalized against the source. */
-	source: GridNormalizedRectSchema,
-	/** Where it lands, normalized against the CANVAS. */
-	cell: GridNormalizedRectSchema
-});
-/**
-* Which profiles this grid can actually compose, and why not.
-*
-* A grid's `high` composes its sources' `high` and its `low` their `low`, so a
-* profile is on offer only when EVERY source can serve it. The refusal NAMES
-* the sources, because "this grid has no low" is not a finding — "615 has no
-* low" is, and it is the one an operator can act on.
-*/
-var GridProfileOfferSchema = z.object({
-	profile: z.enum([
-		"high",
-		"mid",
-		"low"
-	]),
-	offered: z.boolean(),
-	/** Sources that cannot serve it. Empty when it is offered, or when there are no cells. */
-	missingSources: z.array(z.number().int().positive()),
-	/**
-	* The canvas this profile composes onto, `WxH`, or empty when it is not
-	* offered. DERIVED from the cells and the sources' own size at this profile —
-	* it is reported because nothing else in the system would ever say what the
-	* grid came out as, and because it is the number an operator would otherwise
-	* expect to type.
-	*/
-	canvas: z.string(),
-	/**
-	* Whether this profile is PUBLISHED, of the ones the grid could serve.
-	*
-	* A grid's `high` is composed of its sources' `high`, so on a 4K fleet it is
-	* a 4K canvas built from 4K decodes — something to opt into, not something a
-	* viewer's adaptive should be handed by climbing to the top rung it can see.
-	* Default is `mid` + `low`.
-	*/
-	published: z.boolean()
-});
-var GridLayoutViewSchema = z.object({
-	/** The persisted grid row this camera was declared from. */
-	instanceId: z.string(),
-	deviceId: z.number().int().nonnegative(),
-	name: z.string(),
-	/**
-	* NO canvas size. A grid's resolution is not authored: each profile derives
-	* its own from the cells and its sources' dimensions. The two numbers that
-	* used to be here were a text field that silently decided both how much the
-	* composite cost and how sharp it was — see `profiles[].canvas` for what it
-	* came out as.
-	*/
-	fps: z.number().int(),
-	cells: z.array(GridLayoutCellSchema),
-	/** What the catalog will publish, and what it refuses to. Read-only. */
-	profiles: z.array(GridProfileOfferSchema)
-});
-var GridLayoutPatchSchema = z.object({
-	deviceId: z.number().int().nonnegative(),
-	name: z.string().min(1).max(160).optional(),
-	fps: z.number().int().min(1).max(60).optional(),
-	/** Which profiles to publish. See `GridProfileOffer.published`. */
-	publishedProfiles: z.array(z.enum([
-		"high",
-		"mid",
-		"low"
-	])).max(3).optional(),
-	/**
-	* The whole cell list at once. A per-cell patch would need an ordering the
-	* editor does not have, and a half-applied layout is a picture nobody asked
-	* for.
-	*/
-	cells: z.array(GridLayoutCellSchema).max(16)
-});
-var cameraGridLayoutCapability = {
-	name: "camera-grid-layout",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
-	/**
-	* The section is built by the ADDON and returned from
-	* `getDeviceSettingsContribution`, not derived by the framework from a
-	* `deviceConfig.ui` block.
-	*
-	* Both mechanisms render the same widget. This one hands the addon two
-	* things the framework-derived route cannot give it:
-	*
-	*  - it chooses its own section, `tab`, `location` and `order`, the way any
-	*    other setting does, instead of receiving them from a cap declaration;
-	*  - it can DECLINE per device. A camera that is not a grid gets no section
-	*    at all, rather than a widget that renders its own "not a grid" state.
-	*
-	* `recording` is the precedent (`recorder/recording-device-settings.ts`): it
-	* returns `null` for anything that is not a camera, so the Recording tab
-	* never appears there.
-	*/
-	exposesDeviceSettings: true,
-	methods: {
-		/**
-		* The grid behind this device.
-		*
-		* `null` means ANSWERED and this camera is not a grid — not "not yet
-		* known". The widget renders its "this is not a grid camera" state only
-		* from this answer, never from an unresolved query (D315).
-		*/
-		getLayout: method(z.object({ deviceId: z.number().int().nonnegative() }), GridLayoutViewSchema.nullable(), { auth: "admin" }),
-		/** Write the geometry back. Returns the grid as it now stands, profiles included. */
-		saveLayout: method(GridLayoutPatchSchema, GridLayoutViewSchema, {
-			kind: "mutation",
-			auth: "admin"
-		})
-	}
-};
-/**
 * Motion-zones share the same MaskShape vocabulary as privacy-mask — the
 * on-camera motion-detection mask is a single `grid` region (a row-major
 * boolean cell lattice the camera's onboard VMD evaluates). Composing it as
@@ -35421,37 +35179,40 @@ var rebootCapability = {
 		auth: "admin"
 	}) }
 };
-/**
-* `recording` cap — footage availability + HLS playback manifests + per-device
-* recording config. NOTE on events (source of truth, R5/C3): this cap carries
-* NO event surface — `getPlaybackManifest` returns playlist URLs only. Timeline
-* events (motion/object/audio) come from `pipelineAnalytics` (durable SQLite
-* rows) and are the ONLY event surface — the recorder has none. The in-RAM
-* playback markers it used to build were deleted on 2026-08-29 because nothing
-* ever read them. Event<->footage joins are by time, padded with the shared
-* `EVENT_PAD_MS` (`interfaces/recording-config.ts`).
-*/
-var RecordingStatusSchema = z.object({
-	deviceId: z.number(),
-	enabled: z.boolean(),
-	/** THE derived storage mode, from the one definition
-	*  (`deriveRecordingMode`) — never a second enum. A duplicated list is how
-	*  `on-device-decision` could have reached the recorder and not the status. */
-	activeMode: RecordingStorageModeSchema,
-	nodeId: z.string(),
-	storageBytes: z.number()
-});
+/** The one addon allowed to serve {@link RECORDING_SOURCE_CAMSTACK}: the
+*  recorder, which is the addon that writes the footage (D560). */
+var RECORDING_SOURCE_CAMSTACK_ADDON = "recorder";
 var RecordingRangeSchema = z.object({
 	profile: z.string(),
 	startMs: z.number(),
 	endMs: z.number()
 });
+/**
+* How a source ANSWERED, on every singular read of this cap.
+*
+* `'read'` — it looked. `ranges: []` / `days: []` is then a real claim: this
+* source has no coverage in the window. `'unreadable'` — nobody could look
+* (the camera was unreachable, the calendar rung threw, the location is
+* unmounted, the node is still on the old build), and the emptiness beside it
+* means NOTHING.
+*
+* The batch rows have carried this since the grid existed; the SINGULAR
+* answers gained it with the collection (D625 §10.4), because they are the
+* ones the single-camera picker uses and because a half-converted fleet makes
+* "nobody looked" common for the length of a deploy. Without it the timeline
+* has no vocabulary for it, and `(data ?? [])` in a viewer turns a rollout into
+* a fleet of cameras that appear to have lost their recordings (D315, D393).
+*/
+var RecordingReadSchema = z.enum(["read", "unreadable"]);
 var RecordingAvailabilitySchema = z.object({
 	deviceId: z.number(),
+	/** See {@link RecordingReadSchema}. An `'unreadable'` answer carries an empty
+	*  `ranges` that means nothing — never draw it as "no footage". */
+	read: RecordingReadSchema,
 	ranges: z.array(RecordingRangeSchema),
 	/**
-	* Every profile this camera has footage in — not only the one `ranges`
-	* describes (D433).
+	* Every profile this camera has footage in AT THIS SOURCE — not only the one
+	* `ranges` describes (D433).
 	*
 	* `ranges` answers for ONE profile by design: the timeline is a single bar,
 	* and enumerating all of them triples the directory reads for a bar that
@@ -35468,15 +35229,344 @@ var RecordingAvailabilitySchema = z.object({
 });
 var RecordingDaysSchema = z.object({
 	deviceId: z.number(),
+	/** See {@link RecordingReadSchema}. `days: []` on an `'unreadable'` answer is
+	*  "nobody could look", and the date-picker must not spell it the same as
+	*  "no footage this month". */
+	read: RecordingReadSchema,
 	/** Local-midnight epochs (UTC ms) of days that have ≥1 recorded segment. */
 	days: z.array(z.number())
 });
+var RecordingManifestSchema = z.object({
+	deviceId: z.number(),
+	/** Local filesystem path to the master playlist; null when no recording exists for the requested range. */
+	localMasterPath: z.string().nullable(),
+	/** HTTP(S) URL to the master playlist on the recording node's playback server
+	*  (the PRIMARY candidate); null when no recording / server. Carries the
+	*  scoped playback token in its path. */
+	playbackUrl: z.string().nullable(),
+	/**
+	* Candidate master-playlist URLs the client tries in order (LAN first, then
+	* remote — Tailscale/Cloudflare if the operator configured extra hosts), each
+	* carrying the same scoped token. `playbackUrl` is the first entry. Empty when
+	* there is no recording / server.
+	*/
+	playbackEndpoints: z.array(z.string())
+});
+var RecordingSourceAvailabilitySchema = z.object({
+	state: z.enum([
+		"ok",
+		"sleeping",
+		"unreachable",
+		"no-storage",
+		"index-empty"
+	]),
+	/** Free text, shown verbatim. Names the camera's own refusal when there is one. */
+	reason: z.string().optional(),
+	/** When this source's coverage was last CONFIRMED. A cached answer is never
+	*  drawn as current: the surface shows the age whenever it is older than the
+	*  refresh interval. The clip catalog's `catalogAsOf`, under the name the
+	*  timeline uses for it. */
+	coverageAsOf: z.number().optional()
+});
+/**
+* One SOURCE of recorded coverage for a camera — a row of the picker.
+*
+* A provider lists the sources IT serves for that device, and answers for each
+* of them whether it can answer at all. A provider with nothing to offer on a
+* camera returns `[]` — it is not that camera's business. The five availability
+* states are `ClipSourceAvailability`'s verbatim: they mean exactly the same
+* things about a coverage index as about a clip catalog, and `sleeping` in
+* particular is what stops a battery camera being woken to paint a bar.
+*/
+var RecordingSourceSchema = z.object({
+	/** The source id. {@link RECORDING_SOURCE_CAMSTACK} for ours (RESERVED), a
+	*  vendor namespace (`native:reolink:onboard`, …) for a camera's own store. */
+	source: z.string(),
+	/** Operator-facing name of the source ("CamStack recordings", "SD card"). */
+	label: z.string(),
+	/**
+	* The addon that SERVES this row, and the value a later call passes as
+	* `provider`.
+	*
+	* Optional for version skew only. The collection dispatcher stamps it from
+	* the registry, so a row that travelled through the fan-out carries the
+	* authoritative id whatever the provider filled in (D557 §4).
+	*/
+	addonId: z.string().optional(),
+	availability: RecordingSourceAvailabilitySchema
+});
+/**
+* What a surface may DRAW for this (camera, source) — D612's rule applied to a
+* timeline: **the source declares what it can do, and the surface draws what
+* was declared. It never assumes, and never offers a gesture it will then
+* refuse.** D612 exists because `8` and `16` were offered as clip rates, the
+* broker clamped them to `4`, and no line anywhere said so.
+*
+* Asked once per (camera, source) before anything is drawn — never replaced by
+* a constant the surface keeps, which is the second authority D612 ends.
+*/
+var RecordingSourceOptionsSchema = z.object({
+	/** How this source's media reaches the player.
+	*  `archive` = our own indexed segment tree; `stream` = the provider's
+	*  forward-only fMP4 (D597); `realtime` = a replay bound to wall clock. */
+	transport: z.enum([
+		"archive",
+		"stream",
+		"realtime"
+	]),
+	/** What the BAR means. `continuous` = gaps are holes in a recording;
+	*  `sparse` = gaps are the absence of one, and must be drawn as such.
+	*
+	*  Not an onboard-only concession: measured 2026-09-24, OUR bar covers 98.8 %
+	*  of 592's day and 1.2 % of 1436's. It is a fact about a (source, camera)
+	*  pair, and ours answers it per camera from `deriveRecordingMode`. */
+	coverage: z.enum(["continuous", "sparse"]),
+	/** Where the playhead may be put.
+	*  `free`    — anywhere, to the frame.
+	*  `forward` — only ahead of the current position.
+	*  `segment` — a position SNAPS to the head of the covering segment; a finer
+	*              ask is accepted by the camera and SILENTLY IGNORED. Measured
+	*              on 1436 (Hikvision V5.7.1, 2026-09-23): a window-narrowed
+	*              `ContentMgmt/search` returns a row and a `playbackURI`, the
+	*              replay opens 200 and delivers media — and the burned-in OSD of
+	*              the first frame reads the SEGMENT HEAD every time. Calling
+	*              that `forward` would tell the surface it may move the playhead
+	*              ahead within a loaded segment, which it may not. */
+	seek: z.enum([
+		"free",
+		"forward",
+		"segment"
+	]),
+	/** Frame-step BACKWARD is meaningful. */
+	stepBack: z.boolean(),
+	/** Whether the drag-scrub gesture is served, as opposed to refused by name. */
+	scrub: z.boolean(),
+	/** Deliverable rates, ascending, always containing `1`. The surface draws its
+	*  picker from this and from NOTHING else (D612, D620, D621). `0` is not a
+	*  member: pause is the absence of a rate. */
+	rates: z.array(z.number().positive()).min(1).readonly(),
+	/** TRUE when a read of this source HOLDS the camera's only playback session.
+	*  A surface with this set makes at most ONE read at a time and draws no
+	*  scrub-thumbnail strip, no hover preview, no prefetch and no background
+	*  refresh. The precedent is exact and expensive: filling one screen of
+	*  Hikvision thumbnails at 1.01× realtime consumed fifteen minutes of that
+	*  camera's only playback session (1.2.126, reported within minutes), and a
+	*  timeline is a screenful of reads by construction. */
+	exclusive: z.boolean()
+});
+/**
+* How to PLAY the instant that was asked for, from the chosen source.
+*
+* No new media transport is built for onboard sources: the `clip` arm is a
+* DELEGATION to the `videoclips` transport that vendor already has (D597 /
+* D616 / D617). The onboard half of this collection is a PROJECTION of
+* `videoclips` for coverage and a delegation to it for bytes.
+*/
+var RecordingPlaybackSchema = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("hls"),
+		manifest: RecordingManifestSchema
+	}),
+	z.object({
+		kind: z.literal("clip"),
+		/** The `videoclips` source namespace this clip id belongs to. */
+		source: z.string(),
+		clipId: z.string(),
+		/** Where this clip actually STARTS. On a `seek: 'segment'` source the
+		*  playhead lands here, not at the requested instant — the surface must be
+		*  TOLD, not left to discover it from a burned-in OSD. */
+		startsAtMs: z.number()
+	}),
+	z.object({
+		kind: z.literal("none"),
+		reason: z.string()
+	})
+]);
+var recordingCapability = {
+	name: "recording",
+	scope: "device",
+	/** Several sources per camera, listed beside each other. The mount stays
+	*  `device-scoped` — see `resolveCapMount`'s ordering and D554: per-device
+	*  wins over the global collection fan-out. */
+	mode: "collection",
+	kind: "wrapper",
+	defaultActive: true,
+	/** Recorded coverage is a property of a camera — the cap is meaningless on a
+	*  sensor, a button or an event emitter, and the `defaultActive` auto-bind
+	*  reads this to decide which devices it may claim. */
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		/**
+		* The sources this camera has, WITH the reason any of them cannot answer.
+		*
+		* Asked separately from `getAvailability` because an empty bar is
+		* ambiguous and this is the only place the ambiguity is resolved: every
+		* bound provider contributes its own rows, and a provider that could not be
+		* reached at all still produces one row saying so. A surface that draws "no
+		* recordings" without reading this is drawing a guess.
+		*
+		* The ONLY method here without a `provider` — it is the call that tells the
+		* caller what to put there.
+		*/
+		listSources: method(z.object({ deviceId: z.number() }), z.array(RecordingSourceSchema).readonly(), {
+			kind: "query",
+			auth: "protected"
+		}),
+		/**
+		* Recorded coverage of `[fromMs, toMs)` at ONE source — the timeline bar.
+		*
+		* `protected`, not `admin`: a per-camera read is exactly what a camera
+		* viewer is FOR, and the device-scoped mount routes through
+		* `getProviderForDevice`, so a camera outside the caller's scope is refused
+		* before a provider is reached.
+		*/
+		getAvailability: method(z.object({
+			deviceId: z.number(),
+			/**
+			* WHICH provider to ask — the `addonId` a {@link RecordingSourceSchema}
+			* row carries, never a source id and never a list. **REQUIRED**, in the
+			* schema, where the generated types make it unomittable rather than
+			* merely discouraged (D554 amended).
+			*
+			* It was learned the expensive way on `videoclips.listClips`: measured
+			* on the live hub 2026-09-20, device 592 bound to `recorder` AND
+			* `provider-reolink`, a bare call with `limit: 3` answered SIX rows,
+			* three from each source, merged — `device-collection-dispatch.ts`
+			* leaves an unpinned fan-out un-narrowed, so absence buys the union the
+			* method exists not to be. An un-narrowed `getAvailability` would do
+			* that to a TIMELINE: our ranges and the card's clips unioned into one
+			* bar, which is "two sources are never drawn together" broken in the
+			* one place it matters most.
+			*
+			* A provider the device is not bound to is refused BY NAME (D552's
+			* `rejectUnresolvedAddonPin`), never answered by another one.
+			*/
+			provider: z.string().min(1),
+			fromMs: z.number(),
+			toMs: z.number(),
+			/**
+			* Answer for THIS profile instead of the source's preferred one (D433).
+			* Absent keeps the timeline's behaviour — one bar, one profile, one set
+			* of reads. `profilesWithFootage` on the answer says what may be asked
+			* for.
+			*/
+			profile: z.string().optional()
+		}), RecordingAvailabilitySchema, {
+			kind: "query",
+			auth: "protected"
+		}),
+		/** Which calendar days in [fromMs,toMs) this source has ≥1 recording in,
+		*  bucketed by the client's local day (`tzOffsetMinutes` = minutes to add
+		*  to UTC). Drives the theater date-picker's day dots. `provider` is
+		*  REQUIRED for the reason `getAvailability` states. */
+		getDaysWithRecordings: method(z.object({
+			deviceId: z.number(),
+			provider: z.string().min(1),
+			fromMs: z.number(),
+			toMs: z.number(),
+			tzOffsetMinutes: z.number()
+		}), RecordingDaysSchema, {
+			kind: "query",
+			auth: "protected"
+		}),
+		/**
+		* How to PLAY `[fromMs, toMs)` at this source.
+		*
+		* It was `getPlaybackManifest`, and the rename is not cosmetic: a
+		* "manifest" is an HLS master playlist, which is a property of OUR recorder
+		* and of nothing else. Keeping the name would make every onboard
+		* implementation a lie in its signature. The old shape survives verbatim
+		* inside the union's `hls` arm, so the recorder's implementation is
+		* unchanged behind it.
+		*/
+		getPlayback: method(z.object({
+			deviceId: z.number(),
+			provider: z.string().min(1),
+			fromMs: z.number(),
+			toMs: z.number(),
+			profile: CamProfileSchema.optional()
+		}), RecordingPlaybackSchema, {
+			kind: "query",
+			auth: "protected"
+		}),
+		/**
+		* What this (camera, source) can actually DO — asked before anything is
+		* drawn. See {@link RecordingSourceOptionsSchema}; a constant the surface
+		* keeps instead is the second authority D612 exists to end.
+		*/
+		getPlaybackOptions: method(z.object({
+			deviceId: z.number(),
+			provider: z.string().min(1)
+		}), RecordingSourceOptionsSchema, {
+			kind: "query",
+			auth: "protected"
+		})
+	}
+};
+/**
+* `recording-archive` — OUR archive, and the intent that fills it.
+*
+* The system-singleton half of the 2026-09-24 cut (D625). `recording` used to
+* be one 33-method system singleton holding two unrelated subjects: three
+* per-camera READS about coverage and playback, and everything else — storage
+* locations, retention, relocation, rebalance, the ops log, the placement
+* table and the byte-plane primitives our scrub and export are built on.
+*
+* The reads became a device-scoped COLLECTION, so a camera's own card can be a
+* source beside ours (`recording.cap.ts`). Everything that is about OUR store,
+* or unimplementable by a camera, stayed here.
+*
+* ## On the name
+*
+* `recording-storage` was the obvious choice and is wrong: this cap also holds
+* `getDeviceConfig`/`setDeviceConfig`, which are recording INTENT — bands,
+* retention, the D62 switch authority — and a name that says "storage" invites
+* the next reader to move them out again. An archive is a thing we keep, and
+* what we keep it under is a policy; the name covers both halves honestly and
+* sits in the existing family (`recording-onboard`, `recording-export`,
+* `recording-signal`).
+*
+* ## What must NOT happen to it
+*
+* It stays a SINGLETON. It is registered by `recorder`, which is
+* `placement: 'any-node'` and runs on every recording node; the hub dispatches
+* to one of them. Putting the ledger, the placement table or the relocation
+* jobs behind a fan-out is the one genuinely dangerous move in this cut.
+*
+* `getDeviceConfig` / `setDeviceConfig` in particular are the D62 recording
+* authority (`CameraSwitch.authority`). If a write reached a different provider
+* than the read — which a collection fan-out permits — two authorities would
+* decide when one camera records, and the symptom (recording silently off, or
+* a `bands` array clobbered by a partial write) is durable and silent. Keeping
+* them here means the worst case during a rollout is a 412: the switch refuses
+* to flip and SAYS so. **Do not move them into the collection, at any point,
+* for any reason.**
+*
+* ## The two batch reads
+*
+* `getAvailabilityBatch` / `getDaysWithRecordingsBatch` take `deviceIds:
+* number[]` with no single `deviceId`, and a device-scoped mount routes
+* through `getProviderForDevice(deviceId)` — there is nothing for it to route
+* on. They stay here, and on this cap the batch is explicitly OURS: a grid has
+* no per-camera picker, and a caller that wants another source's coverage asks
+* `recording.getAvailability` per device with that source's `provider`.
+*/
+var RecordingStatusSchema = z.object({
+	deviceId: z.number(),
+	enabled: z.boolean(),
+	/** THE derived storage mode, from the one definition
+	*  (`deriveRecordingMode`) — never a second enum. A duplicated list is how
+	*  `on-device-decision` could have reached the recorder and not the status. */
+	activeMode: RecordingStorageModeSchema,
+	nodeId: z.string(),
+	storageBytes: z.number()
+});
 /**
 * One camera's row in a `getAvailabilityBatch` answer.
 *
-* `ranges` is EXACTLY what `getAvailability` returns for that camera — the
-* batch collapses the transport, not the work — plus the one thing the singular
-* method never had to say:
+* `ranges` is EXACTLY what `recording.getAvailability` returns for that camera
+* at OUR source — the batch collapses the transport, not the work — plus the
+* `read` mark the singular answer now carries too (D625):
 *
 *  - `read: 'read'` — answered. `ranges: []` means "read, and this camera has
 *    no footage in the window", which is a real claim.
@@ -35508,22 +35598,6 @@ var RecordingDaysForDeviceSchema = z.object({
 	/** Local-midnight epochs (UTC ms) of days that have ≥1 recorded segment. */
 	days: z.array(z.number()).readonly()
 });
-var RecordingManifestSchema = z.object({
-	deviceId: z.number(),
-	/** Local filesystem path to the master playlist; null when no recording exists for the requested range. */
-	localMasterPath: z.string().nullable(),
-	/** HTTP(S) URL to the master playlist on the recording node's playback server
-	*  (the PRIMARY candidate); null when no recording / server. Carries the
-	*  scoped playback token in its path. */
-	playbackUrl: z.string().nullable(),
-	/**
-	* Candidate master-playlist URLs the client tries in order (LAN first, then
-	* remote — Tailscale/Cloudflare if the operator configured extra hosts), each
-	* carrying the same scoped token. `playbackUrl` is the first entry. Empty when
-	* there is no recording / server.
-	*/
-	playbackEndpoints: z.array(z.string())
-});
 /**
 * Recording storage usage for one camera — what the ARCHIVE holds for it,
 * across every profile and every resolvable location on this node.
@@ -35781,33 +35855,22 @@ var ReadWindowBytesResultSchema = z.discriminatedUnion("kind", [z.object({
 	*  not a retry hint (retrying the same window would refuse again). */
 	segmentEndMs: z.number()
 })]);
-var recordingCapability = {
-	name: "recording",
+var recordingArchiveCapability = {
+	name: "recording-archive",
 	scope: "system",
 	mode: "singleton",
+	/** Moves here with the config pair — the derived Recording settings
+	*  section is a view over `getDeviceConfig`/`setDeviceConfig` (D14), and
+	*  those did not move (D625). */
 	exposesDeviceSettings: true,
 	status: {
 		schema: RecordingStatusSchema,
 		kind: "command-driven"
 	},
 	methods: {
-		getAvailability: method(z.object({
-			deviceId: z.number(),
-			fromMs: z.number(),
-			toMs: z.number(),
-			/**
-			* Answer for THIS profile instead of the preferred one (D433). Absent
-			* keeps the timeline's behaviour — one bar, one profile, one set of
-			* reads. `profilesWithFootage` on the answer says what may be asked
-			* for.
-			*/
-			profile: z.string().optional()
-		}), RecordingAvailabilitySchema, {
-			kind: "query",
-			auth: "protected"
-		}),
 		/**
-		* `getAvailability` for a SET of cameras, in one round trip.
+		* `recording.getAvailability` for a SET of cameras, in one round trip, at
+		* OUR source.
 		*
 		* A multi-camera timeline re-asks availability for every camera in the grid
 		* on every day change; fanned out that is one request per camera for N
@@ -35815,6 +35878,13 @@ var recordingCapability = {
 		* `availabilityProfileFor` + `rangesIn`, run concurrently inside the
 		* recorder) — only the transport collapses.
 		*
+		* It lives on the ARCHIVE, not on the `recording` collection, because it
+		* takes `deviceIds` with no single `deviceId` and a device-scoped mount has
+		* nothing to route on (D625 §10.2). The consequence is stated rather than
+		* hidden: the batch answers for OURS. A caller that needs another source's
+		* coverage asks `recording.getAvailability` per device, naming that
+		* source's provider.
+		*
 		* `protected` for the same reason the singular method is: every id in
 		* `deviceIds` is a device reference, so the F1 #3 gate refuses any camera
 		* outside the caller's scope — one id out of scope refuses the CALL, it
@@ -35832,20 +35902,10 @@ var recordingCapability = {
 			kind: "query",
 			auth: "protected"
 		}),
-		/** Which calendar days in [fromMs,toMs) have ≥1 recorded segment, bucketed by
-		*  the client's local day (`tzOffsetMinutes` = minutes to add to UTC). Drives
-		*  the theater date-picker's day dots. */
-		getDaysWithRecordings: method(z.object({
-			deviceId: z.number(),
-			fromMs: z.number(),
-			toMs: z.number(),
-			tzOffsetMinutes: z.number()
-		}), RecordingDaysSchema, {
-			kind: "query",
-			auth: "protected"
-		}),
 		/**
-		* `getDaysWithRecordings` for a SET of cameras, in one round trip.
+		* `recording.getDaysWithRecordings` for a SET of cameras, in one round
+		* trip, at OUR source. Same placement argument as
+		* {@link getAvailabilityBatch}.
 		*
 		* The cheapest question in the product, asked once per camera per month
 		* change. One directory read per day per camera at the owner, unchanged;
@@ -35864,14 +35924,6 @@ var recordingCapability = {
 			kind: "query",
 			auth: "protected"
 		}),
-		getPlaybackManifest: method(z.object({
-			deviceId: z.number(),
-			fromMs: z.number(),
-			toMs: z.number()
-		}), RecordingManifestSchema, {
-			kind: "query",
-			auth: "protected"
-		}),
 		getStorageUsage: method(z.object({}), RecordingStorageUsageSchema, {
 			kind: "query",
 			auth: "admin"
@@ -35887,6 +35939,10 @@ var recordingCapability = {
 		* value (D315, D393, D590). It carries schedules and retention, no secret,
 		* and the per-device gate in `scope-access.ts` still applies; `setDeviceConfig`
 		* stays `admin`.
+		*
+		* It is a SINGLETON method and stays one (D625 §16.2): it is the D62
+		* recording authority, and an authority that several providers could answer
+		* is the "two knobs over one decision" D62 forbids.
 		*/
 		getDeviceConfig: method(z.object({ deviceId: z.number() }), RecordingConfigSchema, {
 			kind: "query",
@@ -35894,7 +35950,13 @@ var recordingCapability = {
 		}),
 		/** Locate footage at a wall-clock instant: the covering segment's window,
 		*  or a gap with the forward nearest covered edge. Used by a feeder running
-		*  in another addon process to seek recorded footage over tRPC. */
+		*  in another addon process to seek recorded footage over tRPC.
+		*
+		*  BYTE PLANE: defined by `mfra` byte ranges over OUR own MP4 segment tree.
+		*  There is no vendor-neutral statement of it, its only callers are feeders
+		*  in other addon processes (the stream broker, the replay-clip source),
+		*  and an onboard source that ever needs bytes delegates to the
+		*  `videoclips` transport its vendor already has (D625 §9.3, §10.5). */
 		locateSegment: method(z.object({
 			deviceId: z.number(),
 			profile: z.string(),
@@ -36543,6 +36605,390 @@ var recordingExportCapability = {
 	}
 };
 /**
+* Vendor-neutral **onboard** recording + storage cap — what the CAMERA
+* writes to the CAMERA's own card, on the camera's own schedule.
+*
+* This is NOT `recording.cap.ts`. That one is CamStack's recorder: our
+* footage ledger, our storage locations, our retention. This one has a
+* different authority — the camera's firmware — and per D62 it stores
+* nothing of its own. Every value here is read from the camera and every
+* write goes back to the camera; there is no CamStack-side mirror that
+* could disagree with the device.
+*
+* ## One shape, two firmwares
+*
+* Measured 2026-09-22 against the live fleet:
+*
+* | fact | Hikvision (ISAPI) | Reolink (Baichuan) |
+* | --- | --- | --- |
+* | storage | `ContentMgmt/Storage` `<hdd>` rows: status, capacity, freeSpace (MB) | `getHddInfoList` (cmd 102): `mount`, `format`, `capacity` GB + `capacityM` MB remainder |
+* | tracks | several (101 **and** 103 on both 1436 and 3833), each with its own schedule | one per channel |
+* | schedule | per track, 7 `ScheduleAction` blocks: DayOfWeek + TimeOfDay range + ONE `ActionRecordingMode` | per trigger type, a 168-char weekly HOUR mask |
+* | triggers | `CMR`, `MOTION` | `Normal`, `MD`, `people`, `vehicle`, `dog_cat`, `crossline`, `intrude`, `loitering` |
+* | pre-record | `PreRecordTimeSeconds` | `preRecordTime` |
+* | post-record | `PostRecordTimeSeconds` | `recordDelayTime` |
+* | overwrite | per track `LoopEnable` | `cycle`, with `cycleList` enumerating the accepted values |
+* | segment length | not exposed on V5.7.1 | `packageTime` (minutes) |
+*
+* The two schedule models look different and are the same thing in
+* different coordinates: both answer "for this trigger, during which
+* weekly windows does the camera record". {@link RecordWindow} is that
+* question in one shape — Hikvision's ranges map straight onto it,
+* Reolink's mask expands into hour-aligned windows.
+*
+* ## Union, not intersection
+*
+* **The same fields exist on every camera.** What differs per device is
+* which VALUES that device accepts, and that is what {@link
+* RecordingOnboardOptions} reports — a `{ readable, writable, reason }`
+* per field plus the schedule's own limits. A control a camera cannot
+* honour is rendered DISABLED WITH ITS REASON, never missing and never
+* dead: disabled must not look like broken.
+*
+* ## Refusal by name
+*
+* A write a camera cannot honour is refused with a sentence the operator
+* can read — never accepted and dropped. Both providers refuse through
+* {@link describeOnboardRefusal}, so the vocabulary is one function and
+* one test, not two hand-written vendor opinions.
+*
+* Follows the D14 `deviceConfig` archetype (see `stream-params.cap.ts`):
+* `getOptions` advertises per-camera availability, `getStatus` (auto-
+* injected from `status`) reports the live values, and a single
+* `setSettings` mutation applies a partial change. No hand-written
+* settings-contribution methods.
+*/
+/**
+* What makes the camera start recording during a window.
+*
+* The union of both vendors' vocabularies. `continuous` is Hikvision's
+* `CMR` and Reolink's `Normal`; `motion` is `MOTION` / `MD`. The
+* object-class triggers are Reolink-only today and the smart-event ones
+* (`lineCrossing`, `intrusion`, `loitering`) are Reolink-only on the
+* firmwares measured — a camera that cannot record on a trigger simply
+* does not list it in `options.schedule.triggers`, and a window naming
+* it is REFUSED, not dropped.
+*/
+var RecordTriggerSchema = z.enum([
+	"continuous",
+	"motion",
+	"person",
+	"vehicle",
+	"animal",
+	"lineCrossing",
+	"intrusion",
+	"loitering",
+	"alarmInput"
+]);
+/**
+* One weekly recording window: "on `day`, from `startMinute` to
+* `endMinute`, record on `trigger`".
+*
+* `day` is 0 = Monday … 6 = Sunday (ISO order, which is also the order
+* both firmwares enumerate). Minutes are local camera time since
+* midnight; `endMinute` may be 1440, meaning end of day — that is
+* Hikvision's literal `24:00` and Reolink's 24th mask slot, and
+* collapsing it to 0 would turn a whole-day window into an empty one.
+*/
+var RecordWindowSchema = z.object({
+	trigger: RecordTriggerSchema,
+	day: z.number().int().min(0).max(6),
+	startMinute: z.number().int().min(0).max(1439),
+	endMinute: z.number().int().min(1).max(1440)
+});
+/** Status of one physical volume, as the camera itself describes it. */
+var OnboardStorageVolumeSchema = z.object({
+	/** The camera's own id for the volume (`hdd/id`, Reolink `HddInfo/number`). */
+	id: z.string(),
+	/** The camera's own name for it, when it gives one (`hddName`). */
+	label: z.string().optional(),
+	status: z.enum([
+		"ok",
+		"unformatted",
+		"error",
+		"offline",
+		"unknown"
+	]),
+	/**
+	* Total size in MB, or **null when the camera did not say**.
+	*
+	* Never 0 for an unreadable value: a measurement that failed is not a
+	* measurement (D393), and a card whose size is unknown must not be
+	* rendered as a card of size zero.
+	*/
+	capacityMb: z.number().nullable(),
+	/**
+	* Free space in MB, or null when unknown.
+	*
+	* **Not a proxy for "has footage".** Measured 2026-09-22: 1436 and
+	* 1439 both report exactly 11776 MB free — the fixed reserve a looping
+	* card converges on once it has wrapped. At loop steady state the
+	* number is identical whether the camera recorded yesterday or stopped
+	* a month ago.
+	*/
+	freeMb: z.number().nullable(),
+	/** True when the camera reports the volume writable (`property` RW). */
+	writable: z.boolean().optional()
+});
+/**
+* Whether the camera has usable onboard storage.
+*
+* Three states, never two: an unreadable answer is `unknown`, never
+* folded into `absent`. Folding a failed read into "no card" is how a
+* healthy camera gets reported as broken, and the inverse is how a
+* camera with no card reports `ok` and then an empty list (D393).
+*/
+var OnboardStorageSchema = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("present"),
+		volumes: z.array(OnboardStorageVolumeSchema)
+	}),
+	z.object({
+		kind: z.literal("absent"),
+		reason: z.string()
+	}),
+	z.object({
+		kind: z.literal("unknown"),
+		reason: z.string()
+	})
+]);
+/**
+* One recording track the camera exposes. Read-only.
+*
+* Hikvision lists several — 1436 and 3833 each list 101 AND 103, with
+* DIFFERENT schedules (101 MOTION all day, 103 CMR 00:05–23:57) — so a
+* cap that reported one number for "the schedule" would be lying on
+* every Hikvision in the fleet. Reolink has exactly one per channel.
+*
+* There is deliberately **no `framerate`**. Hikvision declares it in the
+* track `Description` and it is WRONG: 1436 says `2.260000 fps` while
+* the media measures 12.55 fps. `codec` and `resolution` from the same
+* string ARE right — those are the only two worth surfacing.
+*/
+var OnboardRecordTrackSchema = z.object({
+	id: z.string(),
+	enabled: z.boolean(),
+	isVideo: z.boolean(),
+	/** From the camera's own track description. Null when it does not say. */
+	codec: z.string().nullable(),
+	resolution: z.string().nullable(),
+	/** Per-track overwrite flag, where the firmware keeps it per track. */
+	overwriteWhenFull: z.boolean().nullable()
+});
+/**
+* What the camera is doing with its own storage, right now.
+*
+* Every scalar is nullable and **null means the camera did not answer**,
+* never a default. A form that seeds `0` from an unanswered read invites
+* the operator to save that 0 back onto the camera.
+*/
+var RecordingOnboardStatusSchema = z.object({
+	storage: OnboardStorageSchema,
+	tracks: z.array(OnboardRecordTrackSchema),
+	/**
+	* The track the write path targets — the enabled VIDEO one. Null when
+	* no track could be identified, which is itself a refusal reason.
+	*/
+	primaryTrackId: z.string().nullable(),
+	/** Master "record to the card at all" switch. */
+	enabled: z.boolean().nullable(),
+	overwriteWhenFull: z.boolean().nullable(),
+	preRecordSec: z.number().nullable(),
+	postRecordSec: z.number().nullable(),
+	/** Length of one recorded file, in minutes. */
+	segmentMinutes: z.number().nullable(),
+	/** The primary track's weekly windows, flattened. */
+	windows: z.array(RecordWindowSchema),
+	/**
+	* How many windows the camera described that CamStack could NOT read —
+	* an unrecognised trigger, an unparseable clock, a weekday it does not
+	* name.
+	*
+	* A dropped window is work the reader threw away, and a schedule that
+	* silently shows fewer rows than the camera holds is how an operator
+	* saves back a schedule shorter than the one they were looking at
+	* (D391). Non-zero means the window list is INCOMPLETE and a write
+	* that replaces it would delete what was not shown — which is why a
+	* provider reporting a non-zero count also reports the schedule as not
+	* writable.
+	*/
+	unreadableWindows: z.number(),
+	/**
+	* The camera is scheduled to record and has NO usable storage.
+	*
+	* A first-class fact because it is the fleet's most common silent
+	* defect: measured 2026-09-22, 1441 and 3831 are both motion-recording
+	* to a card that is not there. Neither the schedule nor the storage
+	* read says anything wrong on its own; only the pair does.
+	*/
+	recordingToNowhere: z.boolean(),
+	lastFetchedAt: z.number()
+});
+/** Numeric range descriptor — `{ min, max, step }` per the getOptions convention. */
+var RangeSchema = z.object({
+	min: z.number(),
+	max: z.number(),
+	step: z.number()
+});
+/**
+* The values a camera actually takes for a numeric field, when they are a SET
+* rather than a range.
+*
+* `{min,max,step}` cannot say what these two firmwares do. Measured on 1436
+* (I91DN) on 2026-09-22 by writing each value and reading it back:
+*
+* - pre-record: `0, 5, 10, 15, 20, 25, 30` and `2147483647` (INT32_MAX, the
+*   camera's "no limit" — `-1` and `4294967295` both land on it);
+* - post-record: `5, 10, 30, 60, 120, 300, 600`.
+*
+* Neither is expressible as a step: the first has a sentinel two billion away
+* from its neighbours, the second doubles and then jumps. A range that tried
+* would forbid values the camera takes AND permit values it silently replaces
+* with 5 — wrong in both directions at once.
+*
+* `sentinel` names the member that is not a duration, so a surface can render
+* "no limit" instead of `2147483647` seconds.
+*/
+var AllowedValuesSchema = z.object({
+	values: z.array(z.number()).min(1),
+	sentinel: z.object({
+		value: z.number(),
+		meaning: z.enum(["no-limit", "disabled"])
+	}).optional()
+});
+/**
+* Per-field availability on ONE camera.
+*
+* The field exists on every camera — this says whether this one can be
+* read and whether it can be written, and `reason` says why not when
+* either is false. The UI renders the control DISABLED with the reason
+* rather than hiding it, so a limitation is legible instead of looking
+* like a missing feature.
+*/
+var OnboardFieldSupportSchema = z.object({
+	readable: z.boolean(),
+	writable: z.boolean(),
+	/** Required whenever `readable` or `writable` is false. */
+	reason: z.string().optional()
+});
+/** What this camera's schedule model can express. */
+var OnboardScheduleSupportSchema = z.object({
+	support: OnboardFieldSupportSchema,
+	/**
+	* The smallest time step the camera can express, in minutes.
+	*
+	* Hikvision takes arbitrary minutes (`00:05:00`–`23:57:00` observed on
+	* 1436's track 103). Reolink's schedule is a 7×24 HOUR mask, so 60. A
+	* window whose edges are not a multiple of this is REFUSED rather than
+	* quietly rounded — rounding is how an operator's 06:30 becomes 06:00
+	* and nothing says so.
+	*/
+	granularityMinutes: z.number(),
+	/** Triggers this camera can record on. A window naming another is refused. */
+	triggers: z.array(RecordTriggerSchema),
+	/**
+	* False when the camera stores ONE trigger per time range, so two
+	* windows overlapping on the same day cannot carry different triggers.
+	* True on Reolink, whose mask is per-trigger and independent.
+	*/
+	supportsOverlappingTriggers: z.boolean()
+});
+var RecordingOnboardOptionsSchema = z.object({
+	enabled: OnboardFieldSupportSchema,
+	overwriteWhenFull: OnboardFieldSupportSchema,
+	preRecordSec: OnboardFieldSupportSchema,
+	preRecordSecRange: RangeSchema.optional(),
+	/** Preferred over the range when the camera takes a SET, not a span. */
+	preRecordSecAllowed: AllowedValuesSchema.optional(),
+	postRecordSec: OnboardFieldSupportSchema,
+	postRecordSecRange: RangeSchema.optional(),
+	/** Preferred over the range when the camera takes a SET, not a span. */
+	postRecordSecAllowed: AllowedValuesSchema.optional(),
+	segmentMinutes: OnboardFieldSupportSchema,
+	segmentMinutesRange: RangeSchema.optional(),
+	/** Preferred over the range when the camera takes a SET, not a span. */
+	segmentMinutesAllowed: AllowedValuesSchema.optional(),
+	schedule: OnboardScheduleSupportSchema
+});
+/**
+* A partial change. Every field optional.
+*
+* Unlike the other `deviceConfig` caps, a provider here does **NOT**
+* silently ignore a field it cannot support — it refuses, by name,
+* through {@link describeOnboardRefusal}. Silence on a recording setting
+* is the failure D62 exists to prevent: the operator believes the camera
+* is recording the way the form says, and it is not.
+*/
+var RecordingOnboardPatchSchema = z.object({
+	enabled: z.boolean().optional(),
+	overwriteWhenFull: z.boolean().optional(),
+	preRecordSec: z.number().optional(),
+	postRecordSec: z.number().optional(),
+	segmentMinutes: z.number().optional(),
+	/** The complete new window set for the primary track — not a delta. */
+	windows: z.array(RecordWindowSchema).optional()
+});
+var recordingOnboardCapability = {
+	name: "recording-onboard",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	deviceConfig: { ui: {
+		kind: "derived-form",
+		builderId: "recording-onboard",
+		tab: "recording"
+	} },
+	methods: {
+		getOptions: method(z.object({ deviceId: z.number() }), RecordingOnboardOptionsSchema),
+		setSettings: method(z.object({
+			deviceId: z.number(),
+			settings: RecordingOnboardPatchSchema
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: RecordingOnboardStatusSchema,
+		kind: "poll"
+	},
+	runtimeState: RecordingOnboardStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-set camera-side
+	* recording config; mutation-driven, and the storage half is the last
+	* thing the camera said about its own card.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
+};
+/** Minutes in a day. `endMinute === 1440` means "to end of day". */
+var MINUTES_PER_DAY = 1440;
+/**
+* Day-of-week names in the cap's index order (0 = Monday), for messages
+* an operator reads and for Hikvision's `<DayOfWeek>` element.
+*/
+var DAY_NAMES = [
+	"Monday",
+	"Tuesday",
+	"Wednesday",
+	"Thursday",
+	"Friday",
+	"Saturday",
+	"Sunday"
+];
+/** `510` → `08:30`. For messages, not for the wire. */
+function formatMinutes(minute) {
+	const hour = Math.floor(minute / 60);
+	const rest = minute % 60;
+	return `${String(hour).padStart(2, "0")}:${String(rest).padStart(2, "0")}`;
+}
+/**
 * A camera's own "record me NOW" LEVEL — a signal the device raises while
 * something it knows about is happening (a robot vacuum cleaning, a machine
 * running, a gate open) and lowers when it stops.
@@ -42316,7 +42762,7 @@ var CAP_NAMES_WITH_STATUS = [
 	"privacy-mask",
 	"ptz",
 	"ptz-autotrack",
-	"recording",
+	"recording-archive",
 	"recording-onboard",
 	"recording-signal",
 	"scene-monitor",
@@ -42401,7 +42847,6 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	embeddingEncoderCapability,
 	enumSensorCapability,
 	eventEmitterCapability,
-	eventsCapability,
 	faceGalleryCapability,
 	failureContributionCapability,
 	fanControlCapability,
@@ -42462,6 +42907,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	ptzAutotrackCapability,
 	rebootCapability,
 	recordingCapability,
+	recordingArchiveCapability,
 	recordingExportCapability,
 	recordingOnboardCapability,
 	recordingSignalCapability,
@@ -44696,24 +45142,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"events.getEventClipUrl": {
-		capName: "events",
-		capScope: "device",
-		addonId: null,
-		access: "view"
-	},
-	"events.getEvents": {
-		capName: "events",
-		capScope: "device",
-		addonId: null,
-		access: "view"
-	},
-	"events.getEventThumbnail": {
-		capName: "events",
-		capScope: "device",
-		addonId: null,
-		access: "view"
-	},
 	"faceGallery.assignFace": {
 		capName: "face-gallery",
 		capScope: "system",
@@ -47588,224 +48016,236 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"recording.applyDeviceSettingsPatch": {
+	"recording.getAvailability": {
 		capName: "recording",
-		capScope: "system",
+		capScope: "device",
 		addonId: null,
-		access: "create"
+		access: "view"
 	},
-	"recording.cancelRelocateJob": {
+	"recording.getDaysWithRecordings": {
 		capName: "recording",
-		capScope: "system",
+		capScope: "device",
 		addonId: null,
-		access: "create"
+		access: "view"
 	},
-	"recording.cancelStorageMigrationMove": {
+	"recording.getPlayback": {
 		capName: "recording",
-		capScope: "system",
+		capScope: "device",
 		addonId: null,
-		access: "create"
+		access: "view"
 	},
-	"recording.deleteFootprint": {
+	"recording.getPlaybackOptions": {
 		capName: "recording",
-		capScope: "system",
+		capScope: "device",
 		addonId: null,
-		access: "delete"
+		access: "view"
 	},
-	"recording.getAvailability": {
+	"recording.listSources": {
 		capName: "recording",
-		capScope: "system",
+		capScope: "device",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getAvailabilityBatch": {
-		capName: "recording",
+	"recordingArchive.applyDeviceSettingsPatch": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "create"
 	},
-	"recording.getDaysWithRecordings": {
-		capName: "recording",
+	"recordingArchive.cancelRelocateJob": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "create"
 	},
-	"recording.getDaysWithRecordingsBatch": {
-		capName: "recording",
+	"recordingArchive.cancelStorageMigrationMove": {
+		capName: "recording-archive",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"recordingArchive.deleteFootprint": {
+		capName: "recording-archive",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"recordingArchive.getAvailabilityBatch": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getDeviceConfig": {
-		capName: "recording",
+	"recordingArchive.getDaysWithRecordingsBatch": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getDeviceLiveContribution": {
-		capName: "recording",
+	"recordingArchive.getDeviceConfig": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getDeviceSettingsContribution": {
-		capName: "recording",
+	"recordingArchive.getDeviceLiveContribution": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getPlacement": {
-		capName: "recording",
+	"recordingArchive.getDeviceSettingsContribution": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getPlaybackManifest": {
-		capName: "recording",
+	"recordingArchive.getPlacement": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getRelocateResidue": {
-		capName: "recording",
+	"recordingArchive.getRelocateResidue": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getStatus": {
-		capName: "recording",
+	"recordingArchive.getStatus": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getStorageMigrationMoveStatus": {
-		capName: "recording",
+	"recordingArchive.getStorageMigrationMoveStatus": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.getStorageUsage": {
-		capName: "recording",
+	"recordingArchive.getStorageUsage": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.listOpsLog": {
-		capName: "recording",
+	"recordingArchive.listOpsLog": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.listRelocateJobs": {
-		capName: "recording",
+	"recordingArchive.listRelocateJobs": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.locateSegment": {
-		capName: "recording",
+	"recordingArchive.locateSegment": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.pauseForStorageMigration": {
-		capName: "recording",
+	"recordingArchive.pauseForStorageMigration": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.planStorageRebalance": {
-		capName: "recording",
+	"recordingArchive.planStorageRebalance": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.pruneFootage": {
-		capName: "recording",
+	"recordingArchive.pruneFootage": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.readGopBytes": {
-		capName: "recording",
+	"recordingArchive.readGopBytes": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.readSegmentBytes": {
-		capName: "recording",
+	"recordingArchive.readSegmentBytes": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.readWindowBytes": {
-		capName: "recording",
+	"recordingArchive.readWindowBytes": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"recording.reconcileLedgerAgainstDisk": {
-		capName: "recording",
+	"recordingArchive.reconcileLedgerAgainstDisk": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.refreshStorageLocationsForMigration": {
-		capName: "recording",
+	"recordingArchive.refreshStorageLocationsForMigration": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.relocateFootage": {
-		capName: "recording",
+	"recordingArchive.relocateFootage": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.renderClip": {
-		capName: "recording",
+	"recordingArchive.renderClip": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.renderGif": {
-		capName: "recording",
+	"recordingArchive.renderGif": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.rescanStorage": {
-		capName: "recording",
+	"recordingArchive.rescanStorage": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.resumeForStorageMigration": {
-		capName: "recording",
+	"recordingArchive.resumeForStorageMigration": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.setDeviceConfig": {
-		capName: "recording",
+	"recordingArchive.setDeviceConfig": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.setDevicePlacement": {
-		capName: "recording",
+	"recordingArchive.setDevicePlacement": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.startStorageMigrationMove": {
-		capName: "recording",
+	"recordingArchive.startStorageMigrationMove": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"recording.startStorageRebalance": {
-		capName: "recording",
+	"recordingArchive.startStorageRebalance": {
+		capName: "recording-archive",
 		capScope: "system",
 		addonId: null,
 		access: "create"
@@ -49334,6 +49774,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"videoclips.getPlaybackOptions": {
+		capName: "videoclips",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"videoclips.listClips": {
 		capName: "videoclips",
 		capScope: "device",
@@ -49346,6 +49792,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"videoclips.offerClipBytes": {
+		capName: "videoclips",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"videoclips.readClipBytes": {
 		capName: "videoclips",
 		capScope: "device",
@@ -50098,21 +50550,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"events.getEventClipUrl": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
-	"events.getEvents": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
-	"events.getEventThumbnail": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
 	"faceGallery.getFaceByTrack": [{
 		name: "deviceId",
 		form: "single",
@@ -51031,107 +51468,117 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"recording.deleteFootprint": [{
+	"recording.getAvailability": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.getAvailability": [{
+	"recording.getDaysWithRecordings": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.getAvailabilityBatch": [{
-		name: "deviceIds",
-		form: "array",
+	"recording.getPlayback": [{
+		name: "deviceId",
+		form: "single",
 		optional: false
 	}],
-	"recording.getDaysWithRecordings": [{
+	"recording.getPlaybackOptions": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.getDaysWithRecordingsBatch": [{
-		name: "deviceIds",
-		form: "array",
+	"recording.listSources": [{
+		name: "deviceId",
+		form: "single",
 		optional: false
 	}],
-	"recording.getDeviceConfig": [{
+	"recordingArchive.deleteFootprint": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.getPlaybackManifest": [{
+	"recordingArchive.getAvailabilityBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
+	"recordingArchive.getDaysWithRecordingsBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
+	"recordingArchive.getDeviceConfig": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.listOpsLog": [{
+	"recordingArchive.listOpsLog": [{
 		name: "deviceId",
 		form: "single",
 		optional: true
 	}],
-	"recording.locateSegment": [{
+	"recordingArchive.locateSegment": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.pruneFootage": [{
+	"recordingArchive.pruneFootage": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.readGopBytes": [{
+	"recordingArchive.readGopBytes": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.readSegmentBytes": [{
+	"recordingArchive.readSegmentBytes": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.readWindowBytes": [{
+	"recordingArchive.readWindowBytes": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.reconcileLedgerAgainstDisk": [{
+	"recordingArchive.reconcileLedgerAgainstDisk": [{
 		name: "deviceId",
 		form: "single",
 		optional: true
 	}],
-	"recording.relocateFootage": [{
+	"recordingArchive.relocateFootage": [{
 		name: "deviceId",
 		form: "single",
 		optional: true
 	}],
-	"recording.renderClip": [{
+	"recordingArchive.renderClip": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.renderGif": [{
+	"recordingArchive.renderGif": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.rescanStorage": [{
+	"recordingArchive.rescanStorage": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.setDeviceConfig": [{
+	"recordingArchive.setDeviceConfig": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.setDevicePlacement": [{
+	"recordingArchive.setDevicePlacement": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
-	"recording.startStorageMigrationMove": [{
+	"recordingArchive.startStorageMigrationMove": [{
 		name: "deviceId",
 		form: "single",
 		optional: true
@@ -51392,6 +51839,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"videoclips.getPlaybackOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"videoclips.listClips": [{
 		name: "deviceId",
 		form: "single",
@@ -51402,6 +51854,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"videoclips.offerClipBytes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"videoclips.readClipBytes": [{
 		name: "deviceId",
 		form: "single",
@@ -52533,4 +52990,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { deriveBatteryPresence as $, storageCapability as $t, ScopedTokenSchema as A, isEvent as An, mayWriteToLocation as At, authProviderCapability as B, ptzAutotrackCapability as Bt, REDACTED_SECRET as C, asString as Cn, lifecycleJobSchema as Ct, SOURCE_DEVICE_TYPES as D, expandCapMethods as Dn, logLevelAtMost as Dt, SOURCE_CAPS as E, emitReadiness as En, logDestinationCapability as Et, UserRecordSchema as F, resolveCapMount as Fn, objectInputDeclaresAddonId as Ft, cameraGridLayoutCapability as G, resolveMethodAuth as Gt, bareAddonId as H, resolveBucketMs as Ht, addonPagesCapability as I, scopeKey as In, objectInputDeclaresRequiredDeviceId as It, coreBlockIdFromAddonId as J, scopesAllowDeviceCap as Jt, collectSecretConfigKeys as K, runtimeStatePolicyFor as Kt, addonSettingsCapability as L, sleep as Ln, parseStreamParamsFormPatch as Lt, StorageLocationModeSchema as M, parseJsonObject as Mn, modeMayWrite as Mt, StorageLocationTypeSchema as N, parseJsonUnknown as Nn, motionCapability as Nt, STORAGE_ACCESS_FALLBACK as O, hydrateSchema as On, looseSchema as Ot, StorageMigrationJobSchema as P, readinessKey as Pn, normalizeUnit as Pt, decodeVectorBase64 as Q, snapshotCapability as Qt, addonWidgetsCapability as R, EventCategory as Rn, platformProbeCapability as Rt, MOTION_CLOSE_AFTER_MS as S, asNumber as Sn, legacyModeOf as St, RecordingStatusSchema as T, emitDownForOwnedCaps as Tn, locationIconKey as Tt, batteryCapability as U, resolveContainerPrimaryChild as Ut, backupCapability as V, reducePoints as Vt, buildStreamParamsConfigSchema as W, resolveLocationMode as Wt, dataStoreProviderCapability as X, settingsStoreCapability as Xt, coreBlocksCapability as Y, scoreRuntimes as Yt, declarationOwnerNodeId as Z, siteZoneKey as Zt, LOG_LEVEL_RANK as _, DeviceType as _n, isObjectInput as _t, BatteryStatusSchema as a, userManagementCapability as an, enumerateItemArrayFields as at, METHOD_ACCESS_MAP as b, WELL_KNOWN_TAB_MAP as bn, isVoidInput as bt, CORE_BLOCKS_ADDON_ID as c, withLocationMode as cn, evictionPolicyOfLocation as ct, DAY_NAMES as d, BaseAddon as dn, foldSnapshotByFunction as dt, storageMigrationCapability as en, deviceManagerCapability as et, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as f, DATAPLANE_SECRET_HEADER as fn, formatMinutes as ft, FIRST_LEVEL_MACRO_CLASSES as g, DeviceRole as gn, isLocationEnabled as gt, DeviceStatusSchema as h, DeviceFeature as hn, isCollectionArrayMethod as ht, BaseDevice as i, streamQualityLabel as in, enumerateInferenceDevices as it, StorageCleanupJobSchema as j, nodePin as jn, metricsProviderCapability as jt, STREAM_PROFILE_META as k, isDeviceConfigCap as kn, mayReadLocation as kt, CORE_BLOCK_ADDON_PREFIX as l, errMsg as ln, extractNestedAddonId as lt, DeclaredDevices as m, DEVICE_STATUS_METHOD as mn, isArrayOutputSchema as mt, AlertSchema as n, storageProviderCapability as nn, deviceStatusCapability as nt, CAMERA_SWITCH_ORDER as o, vectorDimFromBase64 as on, enumerateSchemaFields as ot, DERIVED_CAMERA_SILENCED_CAP_NAMES as p, DEVICE_SETTINGS_CONTRIBUTION_METHODS as pn, gbToBytes as pt, coreBlockAddonId as q, scopesAllowAddon as qt, ApiKeyRecordSchema as r, streamCatalogCapability as rn, doorbellCapability as rt, CAP_NAMES_WITH_STATUS as s, vectorStoreCapability as sn, evaluateSensorEdge as st, ALL_CAPABILITY_DEFINITIONS as t, storageOccupancyCapability as tn, deviceStateCapability as tt, CoreBlockSchema as u, buildFfmpegArgs as un, filesystemBrowseCapability as ut, LegacyStorageLocationDefaultSchema as v, ReadinessRegistry as vn, isSameAddonId as vt, RUNTIME_DEFAULTS as w, createEvent as wn, localNetworkCapability as wt, MINUTES_PER_DAY as x, asJsonObject as xn, kebabToCamel as xt, LocationIconIdSchema as y, ReadinessTimeoutError as yn, isSourceCap as yt, alertsCapability as z, procedureAuthKey as zt };
+export { decodeVectorBase64 as $, snapshotCapability as $t, STREAM_PROFILE_META as A, isDeviceConfigCap as An, mayReadLocation as At, alertsCapability as B, procedureAuthKey as Bt, RECORDING_SOURCE_CAMSTACK_ADDON as C, asNumber as Cn, legacyModeOf as Ct, SOURCE_CAPS as D, emitReadiness as Dn, logDestinationCapability as Dt, RecordingStatusSchema as E, emitDownForOwnedCaps as En, locationIconKey as Et, StorageMigrationJobSchema as F, readinessKey as Fn, normalizeUnit as Ft, buildStreamParamsConfigSchema as G, resolveLocationMode as Gt, backupCapability as H, reducePoints as Ht, UserRecordSchema as I, resolveCapMount as In, objectInputDeclaresAddonId as It, coreBlockAddonId as J, scopesAllowAddon as Jt, cameraGridLayoutCapability as K, resolveMethodAuth as Kt, addonPagesCapability as L, scopeKey as Ln, objectInputDeclaresRequiredDeviceId as Lt, StorageCleanupJobSchema as M, nodePin as Mn, metricsProviderCapability as Mt, StorageLocationModeSchema as N, parseJsonObject as Nn, modeMayWrite as Nt, SOURCE_DEVICE_TYPES as O, expandCapMethods as On, logLevelAtMost as Ot, StorageLocationTypeSchema as P, parseJsonUnknown as Pn, motionCapability as Pt, declarationOwnerNodeId as Q, siteZoneKey as Qt, addonSettingsCapability as R, sleep as Rn, parseStreamParamsFormPatch as Rt, MOTION_CLOSE_AFTER_MS as S, asJsonObject as Sn, kebabToCamel as St, RUNTIME_DEFAULTS as T, createEvent as Tn, localNetworkCapability as Tt, bareAddonId as U, resolveBucketMs as Ut, authProviderCapability as V, ptzAutotrackCapability as Vt, batteryCapability as W, resolveContainerPrimaryChild as Wt, coreBlocksCapability as X, scoreRuntimes as Xt, coreBlockIdFromAddonId as Y, scopesAllowDeviceCap as Yt, dataStoreProviderCapability as Z, settingsStoreCapability as Zt, LOG_LEVEL_RANK as _, DeviceRole as _n, isLocationEnabled as _t, BatteryStatusSchema as a, streamQualityLabel as an, enumerateInferenceDevices as at, METHOD_ACCESS_MAP as b, ReadinessTimeoutError as bn, isSourceCap as bt, CORE_BLOCKS_ADDON_ID as c, vectorStoreCapability as cn, evaluateSensorEdge as ct, DAY_NAMES as d, buildFfmpegArgs as dn, filesystemBrowseCapability as dt, storageCapability as en, deriveBatteryPresence as et, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as f, BaseAddon as fn, foldSnapshotByFunction as ft, FIRST_LEVEL_MACRO_CLASSES as g, DeviceFeature as gn, isCollectionArrayMethod as gt, DeviceStatusSchema as h, DEVICE_STATUS_METHOD as hn, isArrayOutputSchema as ht, BaseDevice as i, streamCatalogCapability as in, doorbellCapability as it, ScopedTokenSchema as j, isEvent as jn, mayWriteToLocation as jt, STORAGE_ACCESS_FALLBACK as k, hydrateSchema as kn, looseSchema as kt, CORE_BLOCK_ADDON_PREFIX as l, withLocationMode as ln, evictionPolicyOfLocation as lt, DeclaredDevices as m, DEVICE_SETTINGS_CONTRIBUTION_METHODS as mn, gbToBytes as mt, AlertSchema as n, storageOccupancyCapability as nn, deviceStateCapability as nt, CAMERA_SWITCH_ORDER as o, userManagementCapability as on, enumerateItemArrayFields as ot, DERIVED_CAMERA_SILENCED_CAP_NAMES as p, DATAPLANE_SECRET_HEADER as pn, formatMinutes as pt, collectSecretConfigKeys as q, runtimeStatePolicyFor as qt, ApiKeyRecordSchema as r, storageProviderCapability as rn, deviceStatusCapability as rt, CAP_NAMES_WITH_STATUS as s, vectorDimFromBase64 as sn, enumerateSchemaFields as st, ALL_CAPABILITY_DEFINITIONS as t, storageMigrationCapability as tn, deviceManagerCapability as tt, CoreBlockSchema as u, errMsg as un, extractNestedAddonId as ut, LegacyStorageLocationDefaultSchema as v, DeviceType as vn, isObjectInput as vt, REDACTED_SECRET as w, asString as wn, lifecycleJobSchema as wt, MINUTES_PER_DAY as x, WELL_KNOWN_TAB_MAP as xn, isVoidInput as xt, LocationIconIdSchema as y, ReadinessRegistry as yn, isSameAddonId as yt, addonWidgetsCapability as z, EventCategory as zn, platformProbeCapability as zt };