@camstack/addon-decoder-ffmpeg 1.2.24 → 1.2.26

package/dist/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 let node_crypto = require("node:crypto");
 let node_child_process = require("node:child_process");
-//#region ../types/dist/event-category-XfKNtfCc.mjs
+//#region ../types/dist/event-category-CIa_iT6b.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -20,6 +20,15 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
 	/**
+	* The hub reissued its own TLS certificate at boot (`ensureTlsCert`).
+	* Emitted only when the material on disk actually changed, so an
+	* operator who trusted the old certificate by hand is told rather than
+	* discovering it as a browser error. Payload `TlsCertChangedPayload`.
+	*
+	* Rule: docs/decisions/adr-0227-*.md
+	*/
+	EventCategory["SystemTlsCertChanged"] = "system.tls-cert-changed";
+	/**
 	* A newer addon or server-root package version was found by the
 	* authoritative registry check. Emitted once when any observed
 	* `latestVersion` changes (or a package/node first appears behind);
@@ -8012,6 +8021,15 @@ var LabelDefinitionSchema = object({
 	description: string().optional(),
 	icon: string().optional()
 });
+var ClassMapDefinitionSchema = object({
+	mapping: record(string(), _enum([
+		"person",
+		"vehicle",
+		"animal",
+		"package"
+	])),
+	preserveOriginal: boolean()
+});
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -8190,7 +8208,13 @@ var ModelCatalogEntrySchema = object({
 	* `id` stays the source of truth for resolution/download/persistence; grouping
 	* is a presentation overlay resolved back to an `id`.
 	*/
-	group: ModelVariantGroupSchema.optional()
+	group: ModelVariantGroupSchema.optional(),
+	/**
+	* Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
+	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
+	* labels already ARE the CamStack macros (Scrypted identity map).
+	*/
+	classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -8219,7 +8243,8 @@ var ModelConvertMetadataSchema = object({
 		"ocr",
 		"segmentation"
 	]),
-	faceAlignment: boolean().optional()
+	faceAlignment: boolean().optional(),
+	classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertResultSchema = object({
 	entry: ModelCatalogEntrySchema,
@@ -17340,6 +17365,33 @@ var NativeCropRefSchema = object({
 		h: number()
 	})
 });
+object({
+	crop: object({
+		left: number(),
+		top: number(),
+		width: number().positive(),
+		height: number().positive()
+	}).optional(),
+	content: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	fit: _enum(["stretch", "contain"]),
+	format: _enum([
+		"rgb",
+		"gray",
+		"jpeg"
+	])
+});
+var FrameRefSchema = object({
+	registryId: string().min(1),
+	id: string().min(1),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum(["rgb", "gray"]),
+	timestamp: number(),
+	capturedAt: number().optional()
+});
 var ModelFormatSchema$1 = _enum([
 	"onnx",
 	"coreml",
@@ -17584,6 +17636,12 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	steps: array(PipelineStepInputSchema).min(1),
 	frame: FrameInputSchema.optional(),
 	/**
+	* Process-local lazy frame. Valid only when caller and provider resolve
+	* in the same execution-group process; split/cross-node callers use
+	* `frame`/`image` inline compatibility instead.
+	*/
+	frameRef: FrameRefSchema.optional(),
+	/**
 	* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
 	* the decoded pixels live in. One more member of the one-of
 	* frame/frameHandle/image/imageBase64/referenceImage group.
@@ -17839,7 +17897,10 @@ var NativeCropResultSchema = object({
 	* Which source served this crop, so a quality-sensitive consumer (the native
 	* `keyFrame`) can reject a degraded fallback:
 	* - `native` — cut from the decode worker's retained NATIVE surface (the
-	*   quality path).
+	*   quality path). A subject-tile serve is also native-resolution and stays
+	*   `native` here: the public enum cannot name `tile` without a breaking cap
+	*   change. Runner telemetry distinguishes lease vs tile via `source` on the
+	*   internal crop result (`nativeHits` vs `tileHits`).
 	* - `ram-fullframe` — the native surface MISSED but the request was full-frame,
 	*   so the ≤640 RAM `RetainedFrameStore` served it (honest lower-res; legit for
 	*   the blank-frame guard / 640-snapshot resolve, NOT for the clean keyFrame).
@@ -18330,12 +18391,41 @@ var RunnerLocalLoadSchema = object({
 * legacy `OrchestratorMetricsSchema` shape so existing dashboards keep
 * working unchanged when they switch to reading from the runner cap.
 */
+var FrameLazyCountersSchema = object({
+	framesDecoded: number(),
+	framesAdmitted: number(),
+	framesDroppedPixelFree: number(),
+	viewsMaterialized: number(),
+	viewsSkipped: number(),
+	workerToRunnerBytes: number(),
+	runnerToPoolRawBytes: number(),
+	runnerToPoolJpegBytes: number(),
+	onDemandFullFrameRequests: number(),
+	onDemandCropRequests: number(),
+	nativeHits: number(),
+	nativeMisses: number(),
+	tileHits: number(),
+	tileMisses: number(),
+	fallbackHits: number(),
+	fallbackMisses: number(),
+	retainedWritesAvoided: number(),
+	residentRefs: number(),
+	residentBytes: number(),
+	releases: number(),
+	evictions: number(),
+	staleMisses: number()
+});
+var FrameLazyMetricsSchema = object({
+	node: FrameLazyCountersSchema,
+	cameras: array(FrameLazyCountersSchema.extend({ deviceId: number() }))
+});
 var RunnerLocalMetricsSchema = object({
 	nodeId: string(),
 	activeCameras: number(),
 	throttledCameras: number(),
 	avgInferenceTimeMs: number(),
-	queueDepth: number()
+	queueDepth: number(),
+	frameLazy: FrameLazyMetricsSchema.optional()
 });
 method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mutation" }), method(object({ deviceId: number() }), object({ success: literal(true) }), { kind: "mutation" }), method(ReportMotionInputSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), RunnerLocalLoadSchema), method(_void(), RunnerLocalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(_void(), array(CameraMetricsWithDeviceIdSchema).readonly()), method(_void(), array(number()).readonly()), method(object({
 	handle: FrameHandleSchema,
@@ -19635,6 +19725,9 @@ method(_void(), ProviderInfoSchema), method(object({ config: record(string(), un
 	location: StorageLocationSchema,
 	relativePath: string()
 }), _void(), { kind: "mutation" }), method(object({ location: StorageLocationSchema }), number().nullable()), method(BeginUploadInputSchema, BeginUploadResultSchema, { kind: "mutation" }), method(WriteChunkInputSchema, _void(), { kind: "mutation" }), method(FinalizeUploadInputSchema, _void(), { kind: "mutation" }), method(AbortUploadInputSchema, _void(), { kind: "mutation" }), method(BeginDownloadInputSchema, BeginDownloadResultSchema, { kind: "mutation" }), method(ReadChunkInputSchema, _instanceof(Uint8Array)), method(EndDownloadInputSchema, _void(), { kind: "mutation" });
+/** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
+var ProfileSettingsSchemaBridge = unknown().nullable();
+var ProfileSettingsBagSchema = record(string(), unknown());
 /**
 * A live terminal session hosted by the provider addon. Output and input do
 * NOT flow through the capability — they use the addon data plane
@@ -19664,7 +19757,14 @@ var TerminalSessionInfoSchema = object({
 var TerminalProfileInfoSchema = object({
 	profileId: string(),
 	label: string(),
-	description: string().optional()
+	description: string().optional(),
+	/** Spawn defaults the instance form copies on create. */
+	executable: string().optional(),
+	args: array(string()).readonly().optional(),
+	cwd: string().optional(),
+	environment: array(string()).readonly().optional(),
+	/** ConfigUISchema for instance knobs, or null when the profile has none. */
+	settingsSchema: ProfileSettingsSchemaBridge.optional()
 });
 /**
 * A durable operator-created Terminal instance. Profiles are templates; only
@@ -19677,7 +19777,12 @@ var TerminalInstanceInfoSchema = object({
 	profileId: string(),
 	profileLabel: string(),
 	name: string(),
-	enabled: boolean()
+	enabled: boolean(),
+	executable: string(),
+	args: array(string()).readonly(),
+	cwd: string(),
+	environment: array(string()).readonly(),
+	profileSettings: ProfileSettingsBagSchema
 });
 var TerminalLegacyCameraSchema = object({
 	stableId: string(),
@@ -19707,7 +19812,23 @@ var TerminalOutputBatchSchema = object({
 method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }), method(_void(), array(TerminalInstanceInfoSchema).readonly(), { auth: "admin" }), method(object({
 	targetNodeId: string().min(1),
 	profileId: string().min(1),
-	name: string().trim().min(1).max(160).optional()
+	name: string().trim().min(1).max(160).optional(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional(),
+	profileSettings: ProfileSettingsBagSchema.optional()
+}), TerminalInstanceInfoSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	instanceId: string().min(1),
+	name: string().trim().min(1).max(160).optional(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional(),
+	profileSettings: ProfileSettingsBagSchema.optional()
 }), TerminalInstanceInfoSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -19729,7 +19850,11 @@ method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }),
 }), method(_void(), array(TerminalSessionInfoSchema).readonly(), { auth: "admin" }), method(object({
 	profileId: string(),
 	cols: number().int().positive(),
-	rows: number().int().positive()
+	rows: number().int().positive(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional()
 }), TerminalSessionInfoSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -22511,10 +22636,10 @@ DeviceType.LawnMower, method(object({ deviceId: number().int().nonnegative() }),
 *
 *  • The SDK (mobile / web client) consumes `getConnectionEndpoints()`
 *    to receive an ordered list of candidate base URLs it should race
-*    on connect — LAN IPv4 first (lowest latency when on same network),
-*    then public hostname (if a tunnel is up), then IPv6. The SDK can
-*    race them with short timeouts and stick with the winner for the
-*    session.
+*    on connect — LAN IPv4 and stable LAN IPv6 first (lowest latency
+*    when on the same network), then public hostname (if a tunnel is
+*    up). The SDK can race them with short timeouts and stick with the
+*    winner for the session.
 *
 * Why hub-only: agents are not directly addressable by the operator's
 * clients — they reverse-connect to the hub. Exposing their interfaces
@@ -22669,6 +22794,17 @@ var NotificationEndpointSchema = object({
 	/** What the ranking currently resolves to (null when nothing is reachable). */
 	resolved: string().nullable()
 });
+/**
+* The URLs the SDK / viewer should race for API access. `baseUrls` empty =
+* AUTO (every LAN IPv4 + the public tunnel). `resolved` is what that choice
+* currently expands to, so the UI can show the effective set either way.
+*/
+var ViewerEndpointsSchema = object({
+	/** The operator's explicit race set, or empty for AUTO. */
+	baseUrls: array(string()).readonly(),
+	/** What the ranking currently resolves to (may be empty if nothing is up). */
+	resolved: array(string()).readonly()
+});
 var AllowedAddressesSchema = object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -22677,6 +22813,20 @@ var AllowedAddressesSchema = object({
 * Network Addresses admin page and persisted by the addon.
 */
 addresses: array(string()).readonly() });
+var TlsStatusSchema = object({
+	mode: _enum([
+		"generated",
+		"uploaded",
+		"disabled"
+	]),
+	leafFingerprintSha256: string().nullable(),
+	caFingerprintSha256: string().nullable(),
+	validTo: string().nullable(),
+	sans: array(string()),
+	caCertPem: string().nullable(),
+	reissueError: string().nullable(),
+	restartRequired: boolean()
+});
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
 	/**
 	* LEGACY HINT — do not send from new code. Kept optional so clients
@@ -22686,17 +22836,31 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*/
 	port: number().int().min(1).max(65535).optional(),
 	/** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
-	*  candidate. Default `true`. */
+	*  candidate. Default `false` — loopback is not a client route. */
 	includeLoopback: boolean().optional(),
-	/** Skip IPv6 entries. Some legacy clients can't parse them.
-	*  Default `false`. */
+	/** Skip IPv6 entries. Default `false` — the palette includes stable
+	*  LAN IPv6 (ICE/WebRTC uses dual-stack regardless). Pass `true` to
+	*  hide them. The viewer HTTP/WS race is `getViewerEndpoints`. */
 	ipv4Only: boolean().optional(),
 	/** Scheme to emit for LAN/loopback URLs. Default `'http'`.
 	*  Pass `'https'` when the caller is itself loaded over HTTPS
 	*  to avoid mixed-content blocks in the browser. The public
 	*  tunnel always emits `https://` regardless. */
 	scheme: _enum(["http", "https"]).optional()
-}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" });
+}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), ViewerEndpointsSchema), method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	certPem: string().min(1),
+	keyPem: string().min(1),
+	caPem: string().optional()
+}), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), object({ pem: string() })), method(_void(), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 object({
 	/** Lifecycle state of the lock. `jammed` means the motor reported
 	*  failure to reach the target — operator intervention required. */
@@ -28459,6 +28623,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.downloadCa": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -28483,18 +28653,42 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getTlsStatus": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"localNetwork.getViewerEndpoints": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.list": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.regenerateCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.resetAllowlistToBestMatch": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"localNetwork.revertToGeneratedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.setAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -28507,6 +28701,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.setViewerEndpoints": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"localNetwork.uploadCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -31387,6 +31593,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.updateInstance": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.writeInput": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -33874,6 +34086,35 @@ Object.freeze(Object.fromEntries([{
 	}]
 }].map((s) => [s.stepId, s.defaultModelId])));
 string().min(1);
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -34065,113 +34306,14 @@ var RingBuffer = class {
 * decoder is an explicit opt-in fallback only. A stale/failed settings read at
 * boot therefore resolves to node-av (never leaves the node with no decoder). */
 var DEFAULT_DECODER_BACKEND = "nodeav";
-/** Narrow an unknown settings value to a {@link DecoderBackend}, else `null`. */
-function parseDecoderBackend(value) {
-	return value === "ffmpeg" || value === "nodeav" ? value : null;
-}
-/**
-* Normalise a raw kernel node id to the bare node id used for scoping.
-* `localNodeId` can carry a `<node>/<addon>` suffix; the decoder selection is
-* per-NODE, so strip the addon segment. Falls back to `hub`.
-*/
-function normalizeDecoderNodeId(rawNodeId) {
-	const raw = rawNodeId ?? "hub";
-	return raw.includes("/") ? raw.split("/")[0] ?? "hub" : raw;
-}
 //#endregion
 //#region src/shared/decoder-backend.ts
-/** The NEUTRAL addon (pipeline-orchestrator, hub-resident) whose global
-* settings OWN the per-node `backend` selector. Neither decoder addon owns
-* it, so decoder-nodeav / decoder-ffmpeg stay fully independent. */
-var DECODER_OWNER_ADDON_ID = "pipeline-orchestrator";
-function isHydratedField(entry) {
-	return typeof entry === "object" && entry !== null && "key" in entry;
-}
-/**
-* Pure selection from an already-read hydrated settings payload: extract the
-* owner's `backend` field value (which the owner projected per-node from its
-* scoped store key) and narrow it. A missing/invalid field or a null payload
-* resolves to {@link DEFAULT_DECODER_BACKEND} — never a bare store key.
-*/
-function pickDecoderBackendFromSettings(view) {
-	if (view === null) return DEFAULT_DECODER_BACKEND;
-	for (const section of view.sections) for (const entry of section.fields) {
-		if (!isHydratedField(entry) || entry.key !== "backend") continue;
-		return parseDecoderBackend(entry.value) ?? "nodeav";
-	}
-	return DEFAULT_DECODER_BACKEND;
-}
-/** Missing optional owner fingerprints: ffmpeg may be uninstalled. */
-function isMissingOwnerSettingsError(message) {
-	return /not routable/i.test(message) || /provider not available/i.test(message);
-}
-/** Transient transport/settings-store fingerprints worth retrying on. */
-function isTransientSettingsError(message) {
-	return /not loaded/i.test(message) || /transport-failed/i.test(message) || /not connected/i.test(message) || /SqliteSettingsBackend not initialized/i.test(message);
-}
 /**
-* Resolve the decoder backend a NON-OWNER addon (`decoder-nodeav`) should run,
-* by reading the OWNER's (`decoder-ffmpeg`) hub-central per-node `backend`.
-*
-* The read routes to the owner addon's child runner; during a simultaneous
-* (re)start the owner may not be up yet → a transient `transport-failed (addon
-* not loaded)`. Immediately defaulting here would ignore an explicit `ffmpeg`
-* selection (the node would silently run the node-av default instead). So retry
-* on the transient fingerprints with a bounded budget (mirrors
-* `BaseAddon.readAddonStoreWithRetry`) until the owner answers; only a
-* persistent failure falls back to {@link DEFAULT_DECODER_BACKEND}.
-*
-* The OWNER addon must NOT call this (it would self-route + deadlock) — it uses
-* {@link resolveOwnDecoderBackend} against its own store instead.
+* Resolve the decoder backend this addon should run. Owner settings are
+* ignored: persisted `backend@<nodeId>` rows stay in the store and are not
+* consulted. The runtime default is always {@link DEFAULT_DECODER_BACKEND}.
 */
-async function resolveDecoderBackend(api, nodeId, logger) {
-	if (!api) {
-		logger.warn("decoder-backend: no api surface — using default backend", { meta: { default: DEFAULT_DECODER_BACKEND } });
-		return DEFAULT_DECODER_BACKEND;
-	}
-	const normalized = normalizeDecoderNodeId(nodeId);
-	const delaysMs = [
-		150,
-		350,
-		600,
-		900,
-		1200
-	];
-	let lastErr;
-	for (let attempt = 0; attempt <= delaysMs.length; attempt++) {
-		try {
-			const view = await api.addonSettings.getGlobalSettings.query({
-				addonId: DECODER_OWNER_ADDON_ID,
-				nodeId: normalized
-			});
-			if (view !== null) return pickDecoderBackendFromSettings(view);
-			lastErr = /* @__PURE__ */ new Error("owner settings unavailable (null)");
-		} catch (err) {
-			lastErr = err;
-			const msg = err instanceof Error ? err.message : String(err);
-			if (isTransientSettingsError(msg)) {} else if (isMissingOwnerSettingsError(msg)) {
-				logger.warn("decoder-backend: optional owner unavailable — using default backend", { meta: {
-					default: DEFAULT_DECODER_BACKEND,
-					owner: DECODER_OWNER_ADDON_ID,
-					error: msg
-				} });
-				return DEFAULT_DECODER_BACKEND;
-			} else {
-				logger.warn("decoder-backend: settings read failed — using default backend", { meta: {
-					default: DEFAULT_DECODER_BACKEND,
-					error: msg
-				} });
-				return DEFAULT_DECODER_BACKEND;
-			}
-		}
-		if (attempt === delaysMs.length) break;
-		await new Promise((resolve) => setTimeout(resolve, delaysMs[attempt]));
-	}
-	logger.warn("decoder-backend: owner settings unavailable after retries — using default backend", { meta: {
-		default: DEFAULT_DECODER_BACKEND,
-		owner: DECODER_OWNER_ADDON_ID,
-		error: lastErr instanceof Error ? lastErr.message : String(lastErr)
-	} });
+async function resolveDecoderBackend(_api, _nodeId, _logger) {
 	return DEFAULT_DECODER_BACKEND;
 }
 //#endregion

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
-//#region ../types/dist/event-category-XfKNtfCc.mjs
+//#region ../types/dist/event-category-CIa_iT6b.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -16,6 +16,15 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
 	/**
+	* The hub reissued its own TLS certificate at boot (`ensureTlsCert`).
+	* Emitted only when the material on disk actually changed, so an
+	* operator who trusted the old certificate by hand is told rather than
+	* discovering it as a browser error. Payload `TlsCertChangedPayload`.
+	*
+	* Rule: docs/decisions/adr-0227-*.md
+	*/
+	EventCategory["SystemTlsCertChanged"] = "system.tls-cert-changed";
+	/**
 	* A newer addon or server-root package version was found by the
 	* authoritative registry check. Emitted once when any observed
 	* `latestVersion` changes (or a package/node first appears behind);
@@ -8008,6 +8017,15 @@ var LabelDefinitionSchema = object({
 	description: string().optional(),
 	icon: string().optional()
 });
+var ClassMapDefinitionSchema = object({
+	mapping: record(string(), _enum([
+		"person",
+		"vehicle",
+		"animal",
+		"package"
+	])),
+	preserveOriginal: boolean()
+});
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -8186,7 +8204,13 @@ var ModelCatalogEntrySchema = object({
 	* `id` stays the source of truth for resolution/download/persistence; grouping
 	* is a presentation overlay resolved back to an `id`.
 	*/
-	group: ModelVariantGroupSchema.optional()
+	group: ModelVariantGroupSchema.optional(),
+	/**
+	* Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
+	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
+	* labels already ARE the CamStack macros (Scrypted identity map).
+	*/
+	classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -8215,7 +8239,8 @@ var ModelConvertMetadataSchema = object({
 		"ocr",
 		"segmentation"
 	]),
-	faceAlignment: boolean().optional()
+	faceAlignment: boolean().optional(),
+	classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertResultSchema = object({
 	entry: ModelCatalogEntrySchema,
@@ -17336,6 +17361,33 @@ var NativeCropRefSchema = object({
 		h: number()
 	})
 });
+object({
+	crop: object({
+		left: number(),
+		top: number(),
+		width: number().positive(),
+		height: number().positive()
+	}).optional(),
+	content: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	fit: _enum(["stretch", "contain"]),
+	format: _enum([
+		"rgb",
+		"gray",
+		"jpeg"
+	])
+});
+var FrameRefSchema = object({
+	registryId: string().min(1),
+	id: string().min(1),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum(["rgb", "gray"]),
+	timestamp: number(),
+	capturedAt: number().optional()
+});
 var ModelFormatSchema$1 = _enum([
 	"onnx",
 	"coreml",
@@ -17580,6 +17632,12 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	steps: array(PipelineStepInputSchema).min(1),
 	frame: FrameInputSchema.optional(),
 	/**
+	* Process-local lazy frame. Valid only when caller and provider resolve
+	* in the same execution-group process; split/cross-node callers use
+	* `frame`/`image` inline compatibility instead.
+	*/
+	frameRef: FrameRefSchema.optional(),
+	/**
 	* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
 	* the decoded pixels live in. One more member of the one-of
 	* frame/frameHandle/image/imageBase64/referenceImage group.
@@ -17835,7 +17893,10 @@ var NativeCropResultSchema = object({
 	* Which source served this crop, so a quality-sensitive consumer (the native
 	* `keyFrame`) can reject a degraded fallback:
 	* - `native` — cut from the decode worker's retained NATIVE surface (the
-	*   quality path).
+	*   quality path). A subject-tile serve is also native-resolution and stays
+	*   `native` here: the public enum cannot name `tile` without a breaking cap
+	*   change. Runner telemetry distinguishes lease vs tile via `source` on the
+	*   internal crop result (`nativeHits` vs `tileHits`).
 	* - `ram-fullframe` — the native surface MISSED but the request was full-frame,
 	*   so the ≤640 RAM `RetainedFrameStore` served it (honest lower-res; legit for
 	*   the blank-frame guard / 640-snapshot resolve, NOT for the clean keyFrame).
@@ -18326,12 +18387,41 @@ var RunnerLocalLoadSchema = object({
 * legacy `OrchestratorMetricsSchema` shape so existing dashboards keep
 * working unchanged when they switch to reading from the runner cap.
 */
+var FrameLazyCountersSchema = object({
+	framesDecoded: number(),
+	framesAdmitted: number(),
+	framesDroppedPixelFree: number(),
+	viewsMaterialized: number(),
+	viewsSkipped: number(),
+	workerToRunnerBytes: number(),
+	runnerToPoolRawBytes: number(),
+	runnerToPoolJpegBytes: number(),
+	onDemandFullFrameRequests: number(),
+	onDemandCropRequests: number(),
+	nativeHits: number(),
+	nativeMisses: number(),
+	tileHits: number(),
+	tileMisses: number(),
+	fallbackHits: number(),
+	fallbackMisses: number(),
+	retainedWritesAvoided: number(),
+	residentRefs: number(),
+	residentBytes: number(),
+	releases: number(),
+	evictions: number(),
+	staleMisses: number()
+});
+var FrameLazyMetricsSchema = object({
+	node: FrameLazyCountersSchema,
+	cameras: array(FrameLazyCountersSchema.extend({ deviceId: number() }))
+});
 var RunnerLocalMetricsSchema = object({
 	nodeId: string(),
 	activeCameras: number(),
 	throttledCameras: number(),
 	avgInferenceTimeMs: number(),
-	queueDepth: number()
+	queueDepth: number(),
+	frameLazy: FrameLazyMetricsSchema.optional()
 });
 method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mutation" }), method(object({ deviceId: number() }), object({ success: literal(true) }), { kind: "mutation" }), method(ReportMotionInputSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), RunnerLocalLoadSchema), method(_void(), RunnerLocalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(_void(), array(CameraMetricsWithDeviceIdSchema).readonly()), method(_void(), array(number()).readonly()), method(object({
 	handle: FrameHandleSchema,
@@ -19631,6 +19721,9 @@ method(_void(), ProviderInfoSchema), method(object({ config: record(string(), un
 	location: StorageLocationSchema,
 	relativePath: string()
 }), _void(), { kind: "mutation" }), method(object({ location: StorageLocationSchema }), number().nullable()), method(BeginUploadInputSchema, BeginUploadResultSchema, { kind: "mutation" }), method(WriteChunkInputSchema, _void(), { kind: "mutation" }), method(FinalizeUploadInputSchema, _void(), { kind: "mutation" }), method(AbortUploadInputSchema, _void(), { kind: "mutation" }), method(BeginDownloadInputSchema, BeginDownloadResultSchema, { kind: "mutation" }), method(ReadChunkInputSchema, _instanceof(Uint8Array)), method(EndDownloadInputSchema, _void(), { kind: "mutation" });
+/** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
+var ProfileSettingsSchemaBridge = unknown().nullable();
+var ProfileSettingsBagSchema = record(string(), unknown());
 /**
 * A live terminal session hosted by the provider addon. Output and input do
 * NOT flow through the capability — they use the addon data plane
@@ -19660,7 +19753,14 @@ var TerminalSessionInfoSchema = object({
 var TerminalProfileInfoSchema = object({
 	profileId: string(),
 	label: string(),
-	description: string().optional()
+	description: string().optional(),
+	/** Spawn defaults the instance form copies on create. */
+	executable: string().optional(),
+	args: array(string()).readonly().optional(),
+	cwd: string().optional(),
+	environment: array(string()).readonly().optional(),
+	/** ConfigUISchema for instance knobs, or null when the profile has none. */
+	settingsSchema: ProfileSettingsSchemaBridge.optional()
 });
 /**
 * A durable operator-created Terminal instance. Profiles are templates; only
@@ -19673,7 +19773,12 @@ var TerminalInstanceInfoSchema = object({
 	profileId: string(),
 	profileLabel: string(),
 	name: string(),
-	enabled: boolean()
+	enabled: boolean(),
+	executable: string(),
+	args: array(string()).readonly(),
+	cwd: string(),
+	environment: array(string()).readonly(),
+	profileSettings: ProfileSettingsBagSchema
 });
 var TerminalLegacyCameraSchema = object({
 	stableId: string(),
@@ -19703,7 +19808,23 @@ var TerminalOutputBatchSchema = object({
 method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }), method(_void(), array(TerminalInstanceInfoSchema).readonly(), { auth: "admin" }), method(object({
 	targetNodeId: string().min(1),
 	profileId: string().min(1),
-	name: string().trim().min(1).max(160).optional()
+	name: string().trim().min(1).max(160).optional(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional(),
+	profileSettings: ProfileSettingsBagSchema.optional()
+}), TerminalInstanceInfoSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	instanceId: string().min(1),
+	name: string().trim().min(1).max(160).optional(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional(),
+	profileSettings: ProfileSettingsBagSchema.optional()
 }), TerminalInstanceInfoSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -19725,7 +19846,11 @@ method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }),
 }), method(_void(), array(TerminalSessionInfoSchema).readonly(), { auth: "admin" }), method(object({
 	profileId: string(),
 	cols: number().int().positive(),
-	rows: number().int().positive()
+	rows: number().int().positive(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional()
 }), TerminalSessionInfoSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -22507,10 +22632,10 @@ DeviceType.LawnMower, method(object({ deviceId: number().int().nonnegative() }),
 *
 *  • The SDK (mobile / web client) consumes `getConnectionEndpoints()`
 *    to receive an ordered list of candidate base URLs it should race
-*    on connect — LAN IPv4 first (lowest latency when on same network),
-*    then public hostname (if a tunnel is up), then IPv6. The SDK can
-*    race them with short timeouts and stick with the winner for the
-*    session.
+*    on connect — LAN IPv4 and stable LAN IPv6 first (lowest latency
+*    when on the same network), then public hostname (if a tunnel is
+*    up). The SDK can race them with short timeouts and stick with the
+*    winner for the session.
 *
 * Why hub-only: agents are not directly addressable by the operator's
 * clients — they reverse-connect to the hub. Exposing their interfaces
@@ -22665,6 +22790,17 @@ var NotificationEndpointSchema = object({
 	/** What the ranking currently resolves to (null when nothing is reachable). */
 	resolved: string().nullable()
 });
+/**
+* The URLs the SDK / viewer should race for API access. `baseUrls` empty =
+* AUTO (every LAN IPv4 + the public tunnel). `resolved` is what that choice
+* currently expands to, so the UI can show the effective set either way.
+*/
+var ViewerEndpointsSchema = object({
+	/** The operator's explicit race set, or empty for AUTO. */
+	baseUrls: array(string()).readonly(),
+	/** What the ranking currently resolves to (may be empty if nothing is up). */
+	resolved: array(string()).readonly()
+});
 var AllowedAddressesSchema = object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -22673,6 +22809,20 @@ var AllowedAddressesSchema = object({
 * Network Addresses admin page and persisted by the addon.
 */
 addresses: array(string()).readonly() });
+var TlsStatusSchema = object({
+	mode: _enum([
+		"generated",
+		"uploaded",
+		"disabled"
+	]),
+	leafFingerprintSha256: string().nullable(),
+	caFingerprintSha256: string().nullable(),
+	validTo: string().nullable(),
+	sans: array(string()),
+	caCertPem: string().nullable(),
+	reissueError: string().nullable(),
+	restartRequired: boolean()
+});
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
 	/**
 	* LEGACY HINT — do not send from new code. Kept optional so clients
@@ -22682,17 +22832,31 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*/
 	port: number().int().min(1).max(65535).optional(),
 	/** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
-	*  candidate. Default `true`. */
+	*  candidate. Default `false` — loopback is not a client route. */
 	includeLoopback: boolean().optional(),
-	/** Skip IPv6 entries. Some legacy clients can't parse them.
-	*  Default `false`. */
+	/** Skip IPv6 entries. Default `false` — the palette includes stable
+	*  LAN IPv6 (ICE/WebRTC uses dual-stack regardless). Pass `true` to
+	*  hide them. The viewer HTTP/WS race is `getViewerEndpoints`. */
 	ipv4Only: boolean().optional(),
 	/** Scheme to emit for LAN/loopback URLs. Default `'http'`.
 	*  Pass `'https'` when the caller is itself loaded over HTTPS
 	*  to avoid mixed-content blocks in the browser. The public
 	*  tunnel always emits `https://` regardless. */
 	scheme: _enum(["http", "https"]).optional()
-}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" });
+}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), ViewerEndpointsSchema), method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	certPem: string().min(1),
+	keyPem: string().min(1),
+	caPem: string().optional()
+}), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), object({ pem: string() })), method(_void(), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 object({
 	/** Lifecycle state of the lock. `jammed` means the motor reported
 	*  failure to reach the target — operator intervention required. */
@@ -28455,6 +28619,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.downloadCa": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -28479,18 +28649,42 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getTlsStatus": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"localNetwork.getViewerEndpoints": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.list": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.regenerateCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.resetAllowlistToBestMatch": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"localNetwork.revertToGeneratedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.setAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -28503,6 +28697,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.setViewerEndpoints": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"localNetwork.uploadCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -31383,6 +31589,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.updateInstance": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.writeInput": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -33870,6 +34082,35 @@ Object.freeze(Object.fromEntries([{
 	}]
 }].map((s) => [s.stepId, s.defaultModelId])));
 string().min(1);
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -34061,113 +34302,14 @@ var RingBuffer = class {
 * decoder is an explicit opt-in fallback only. A stale/failed settings read at
 * boot therefore resolves to node-av (never leaves the node with no decoder). */
 var DEFAULT_DECODER_BACKEND = "nodeav";
-/** Narrow an unknown settings value to a {@link DecoderBackend}, else `null`. */
-function parseDecoderBackend(value) {
-	return value === "ffmpeg" || value === "nodeav" ? value : null;
-}
-/**
-* Normalise a raw kernel node id to the bare node id used for scoping.
-* `localNodeId` can carry a `<node>/<addon>` suffix; the decoder selection is
-* per-NODE, so strip the addon segment. Falls back to `hub`.
-*/
-function normalizeDecoderNodeId(rawNodeId) {
-	const raw = rawNodeId ?? "hub";
-	return raw.includes("/") ? raw.split("/")[0] ?? "hub" : raw;
-}
 //#endregion
 //#region src/shared/decoder-backend.ts
-/** The NEUTRAL addon (pipeline-orchestrator, hub-resident) whose global
-* settings OWN the per-node `backend` selector. Neither decoder addon owns
-* it, so decoder-nodeav / decoder-ffmpeg stay fully independent. */
-var DECODER_OWNER_ADDON_ID = "pipeline-orchestrator";
-function isHydratedField(entry) {
-	return typeof entry === "object" && entry !== null && "key" in entry;
-}
-/**
-* Pure selection from an already-read hydrated settings payload: extract the
-* owner's `backend` field value (which the owner projected per-node from its
-* scoped store key) and narrow it. A missing/invalid field or a null payload
-* resolves to {@link DEFAULT_DECODER_BACKEND} — never a bare store key.
-*/
-function pickDecoderBackendFromSettings(view) {
-	if (view === null) return DEFAULT_DECODER_BACKEND;
-	for (const section of view.sections) for (const entry of section.fields) {
-		if (!isHydratedField(entry) || entry.key !== "backend") continue;
-		return parseDecoderBackend(entry.value) ?? "nodeav";
-	}
-	return DEFAULT_DECODER_BACKEND;
-}
-/** Missing optional owner fingerprints: ffmpeg may be uninstalled. */
-function isMissingOwnerSettingsError(message) {
-	return /not routable/i.test(message) || /provider not available/i.test(message);
-}
-/** Transient transport/settings-store fingerprints worth retrying on. */
-function isTransientSettingsError(message) {
-	return /not loaded/i.test(message) || /transport-failed/i.test(message) || /not connected/i.test(message) || /SqliteSettingsBackend not initialized/i.test(message);
-}
 /**
-* Resolve the decoder backend a NON-OWNER addon (`decoder-nodeav`) should run,
-* by reading the OWNER's (`decoder-ffmpeg`) hub-central per-node `backend`.
-*
-* The read routes to the owner addon's child runner; during a simultaneous
-* (re)start the owner may not be up yet → a transient `transport-failed (addon
-* not loaded)`. Immediately defaulting here would ignore an explicit `ffmpeg`
-* selection (the node would silently run the node-av default instead). So retry
-* on the transient fingerprints with a bounded budget (mirrors
-* `BaseAddon.readAddonStoreWithRetry`) until the owner answers; only a
-* persistent failure falls back to {@link DEFAULT_DECODER_BACKEND}.
-*
-* The OWNER addon must NOT call this (it would self-route + deadlock) — it uses
-* {@link resolveOwnDecoderBackend} against its own store instead.
+* Resolve the decoder backend this addon should run. Owner settings are
+* ignored: persisted `backend@<nodeId>` rows stay in the store and are not
+* consulted. The runtime default is always {@link DEFAULT_DECODER_BACKEND}.
 */
-async function resolveDecoderBackend(api, nodeId, logger) {
-	if (!api) {
-		logger.warn("decoder-backend: no api surface — using default backend", { meta: { default: DEFAULT_DECODER_BACKEND } });
-		return DEFAULT_DECODER_BACKEND;
-	}
-	const normalized = normalizeDecoderNodeId(nodeId);
-	const delaysMs = [
-		150,
-		350,
-		600,
-		900,
-		1200
-	];
-	let lastErr;
-	for (let attempt = 0; attempt <= delaysMs.length; attempt++) {
-		try {
-			const view = await api.addonSettings.getGlobalSettings.query({
-				addonId: DECODER_OWNER_ADDON_ID,
-				nodeId: normalized
-			});
-			if (view !== null) return pickDecoderBackendFromSettings(view);
-			lastErr = /* @__PURE__ */ new Error("owner settings unavailable (null)");
-		} catch (err) {
-			lastErr = err;
-			const msg = err instanceof Error ? err.message : String(err);
-			if (isTransientSettingsError(msg)) {} else if (isMissingOwnerSettingsError(msg)) {
-				logger.warn("decoder-backend: optional owner unavailable — using default backend", { meta: {
-					default: DEFAULT_DECODER_BACKEND,
-					owner: DECODER_OWNER_ADDON_ID,
-					error: msg
-				} });
-				return DEFAULT_DECODER_BACKEND;
-			} else {
-				logger.warn("decoder-backend: settings read failed — using default backend", { meta: {
-					default: DEFAULT_DECODER_BACKEND,
-					error: msg
-				} });
-				return DEFAULT_DECODER_BACKEND;
-			}
-		}
-		if (attempt === delaysMs.length) break;
-		await new Promise((resolve) => setTimeout(resolve, delaysMs[attempt]));
-	}
-	logger.warn("decoder-backend: owner settings unavailable after retries — using default backend", { meta: {
-		default: DEFAULT_DECODER_BACKEND,
-		owner: DECODER_OWNER_ADDON_ID,
-		error: lastErr instanceof Error ? lastErr.message : String(lastErr)
-	} });
+async function resolveDecoderBackend(_api, _nodeId, _logger) {
 	return DEFAULT_DECODER_BACKEND;
 }
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-decoder-ffmpeg",
-  "version": "1.2.24",
+  "version": "1.2.26",
   "description": "Standalone ffmpeg-subprocess decoder fallback addon for CamStack",
   "keywords": [
     "camstack",