@camstack/addon-export-hap 1.2.112 → 1.2.114

package/dist/hap-export.addon.mjs

@@ -72,7 +72,7 @@ function carryForward(base, existing, keys) {
 	return out;
 }
 //#endregion
-//#region ../types/dist/event-category-ZyX6jcse.mjs
+//#region ../types/dist/event-category-BVDXG4tB.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -689,6 +689,20 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	* pull-reconcile from the provider's `getStatus` on reconnect. */
 	EventCategory["MeshNetworkChanged"] = "network.mesh.changed";
 	EventCategory["BackupCompleted"] = "backup.completed";
+	/**
+	* A whole backup RUN finished — every destination attempted, win or lose.
+	*
+	* `backup.completed` fires once per DESTINATION, which is the right grain for
+	* a progress UI and the wrong one for a notification: an operator with three
+	* destinations would be told three times. And a run where two of three
+	* destinations succeeded is not a clean success — a single "backup
+	* completed" that hid the failed one would be a lie, so the count of each is
+	* carried here and the message says both.
+	*
+	* Emitted by the backup orchestrator only after the destination loop, so a
+	* run that dies during the BUILD phase produces no completion at all.
+	*/
+	EventCategory["BackupRunCompleted"] = "backup.run-completed";
 	EventCategory["BackupRestored"] = "backup.restored";
 	EventCategory["NotificationDispatched"] = "notification.dispatched";
 	EventCategory["NotificationFailed"] = "notification.failed";
@@ -5419,7 +5433,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DBKu2-U5.mjs
+//#region ../types/dist/sleep-DEuj7E3j.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7420,7 +7434,7 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 	input: unknown()
 }), unknown(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
 //#endregion
-//#region ../types/dist/canonical-hash-rO1sRmEK.mjs
+//#region ../types/dist/canonical-hash-Ch5bSjFG.mjs
 var AUDIO_ENCODER_BY_CODEC = {
 	opus: "libopus",
 	aac: "aac",
@@ -7523,6 +7537,7 @@ function buildVideoArgs(video, outputArgs) {
 	];
 	if (video.preset !== void 0) args.push("-preset", video.preset);
 	if (video.tune !== void 0) args.push("-tune", video.tune);
+	if (video.singleSlicePerFrame === true && video.encoder === "libx264") args.push("-x264-params", "sliced-threads=0");
 	if (video.profile !== void 0) args.push("-profile:v", video.profile);
 	if (video.level !== void 0) args.push("-level", video.level);
 	if (video.pixelFormat !== void 0) args.push("-pix_fmt", video.pixelFormat);
@@ -7924,7 +7939,7 @@ import { errMsg } from '@camstack/types'
 * Extract a human-readable message from an unknown error value.
 * Replaces the ubiquitous `errMsg(err)` pattern.
 */
-function errMsg$15(err) {
+function errMsg$16(err) {
 	if (err instanceof Error) return err.message;
 	if (typeof err === "string") return err;
 	return String(err);
@@ -8001,7 +8016,23 @@ var EncodeProfileSchema = object({
 			"zerolatency",
 			"film",
 			"animation"
-		]).optional()
+		]).optional(),
+		/**
+		* ONE slice per access unit.
+		*
+		* `-tune zerolatency` turns on x264's sliced threads, and a frame then leaves
+		* the encoder as five NAL slices that share one RTP timestamp and carry one
+		* marker bit. A libwebrtc depacketiser sees five frame-starts and one
+		* frame-end per frame: the first pictures render and the video then freezes
+		* for good while the audio, on its own plane, plays on. Measured on this hub
+		* 2026-09-13 against the Echo, and reduced to one slice by this flag alone.
+		*
+		* A NAMED field and not a raw flag, because {@link EgressEncodeSchema} omits
+		* `outputArgs` on purpose: an opaque array is part of the sharing key, so two
+		* consumers meaning the same thing spelled differently would stop sharing one
+		* child. Absent means "whatever the encoder does" — today's behaviour.
+		*/
+		singleSlicePerFrame: boolean().optional()
 	}),
 	audio: union([literal("passthrough"), object({
 		codec: _enum([
@@ -8030,6 +8061,28 @@ var EncodeProfileSchema = object({
 	outputArgs: array(string()).optional()
 });
 /**
+* THE target rule: which of two sizes serves a consumer better.
+*
+* "Prefer at or above the target so the consumer downscales instead of
+* upscaling; among those the SMALLEST, because the extra pixels are thrown
+* away and the decode is not; among the rest the LARGEST, because it is the
+* closest we can get." One sentence, and until now it was written twice — once
+* here in lines, once in `stream-selection.ts` in pixels, for the same two
+* exporters. The two agreed, which is luck, not a property.
+*
+* The `size` is whatever measure the caller ranks by: the cap ranks by LINES
+* (a consumer's requirement is stated in p), the RTSP picker by PIXELS (it
+* compares entries of possibly different aspect). The rule is the same either
+* way and the measure is the caller's business.
+*
+* Returns a sort delta: negative when `a` should come first.
+*/
+function compareToTarget(a, b, target) {
+	const aReaches = a >= target;
+	if (aReaches !== b >= target) return aReaches ? -1 : 1;
+	return aReaches ? a - b : b - a;
+}
+/**
 * The shape every live egress starts from: H.264 Baseline 3.1 at 720p25.
 * Baseline because it is the one profile every consumer in this repo decodes
 * (Echo, iOS, an old browser); 3.1 because that is what the SDPs advertise.
@@ -8051,7 +8104,7 @@ var BASE_LIVE_EGRESS_PROFILE = {
 	audio: "passthrough"
 };
 ({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
-({ ...BASE_LIVE_EGRESS_PROFILE });
+({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
 /** VBV window for a consumer whose budget is enforced per second (HomeKit). */
 var RATE_CONTROL_TIGHT = {
 	kind: "cbr",
@@ -9942,6 +9995,47 @@ var LogChannelWindowSchema = object({
 	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
 	deviceIds: array(number().int()).readonly().nullable()
 });
+/**
+* Shared stream-selection picker for export addons.
+*
+* Both `addon-export-alexa` and `addon-export-hap` resolve the
+* operator's `streamPreference` setting against the broker's RTSP
+* entries before dialling a camera. Each addon used to roll its own:
+* Alexa had `pickPreferredRtspEntry` under `handlers/`, HAP had an
+* inline `"prefer /mid, then /high, then first"` chain inside its
+* camera-streams mapper. The chains drifted (Alexa honoured
+* `streamPreference`, HAP didn't; only Alexa got the smart
+* resolution-targeted auto-pick) and the cross-addon import rule
+* blocks deduping in either direction.
+*
+* Lifting the picker into `@camstack/types` lets every exporter call
+* the same code path with the consumer's target resolution baked into
+* the call site — Alexa passes 1280×720, HomeKit passes 1920×1080,
+* the picker handles the rest.
+*
+* Selection algorithm:
+*   - pref === '<profile>' → profile-keyed entries (from
+*                         `getProfileRtspEntries`) match on `e.profile`;
+*                         legacy raw entries match on the brokerId
+*                         suffix (`brokerId` ENDS WITH `/${pref}`, shape
+*                         `${deviceId}/${camStreamId}`). Addons store the
+*                         bare profile/camStream id in their
+*                         `ExportDeviceSettings.streamPreference`. Falls
+*                         back to 'auto' when no enabled entry matches
+*                         either way.
+*   - pref === 'auto'   → when `targetResolution` is given, pick the
+*                         entry whose source resolution is closest to
+*                         it (prefer ≥ target so the consumer
+*                         downscales instead of upscaling). Without a
+*                         target, fall back to first-enabled. If no
+*                         entry advertises a resolution at all
+*                         (broker hasn't probed yet), also fall back
+*                         to first-enabled so cold start still serves.
+*
+* Returns `null` when nothing is publishable — callers fold that into
+* the consumer's "no stream" error (Alexa: STREAM_TYPE_UNSUPPORTED;
+* HAP: a thrown error inside `startFfmpegForSession`).
+*/
 function pickPreferredRtspEntry(entries, pref, deviceId, options = {}) {
 	if (entries.length === 0) return null;
 	const prefix = `${deviceId}/`;
@@ -9971,30 +10065,23 @@ function pickPreferredRtspEntry(entries, pref, deviceId, options = {}) {
 	return toPicked(eligible[0]);
 }
 /**
-* Pick the entry whose `resolution` is closest to `target`. Prefer
-* entries ≥ target (downscale is cheap at the consumer; upscale is
-* lossy). Among the rest pick the LARGEST still ≤ target so the
-* consumer gets the best feasible quality. "Closeness" is the
-* `width × height` pixel delta.
+* Pick the entry whose `resolution` is closest to `target`, by the ONE target
+* rule ({@link compareToTarget}): prefer at or above the target so the consumer
+* downscales instead of upscaling; among those the smallest; among the rest the
+* largest.
+*
+* This function used to implement that rule itself, in pixels, while
+* `rankStreams` implemented it again in lines — the same sentence written twice
+* for the same two exporters, agreeing by luck rather than by construction.
+* Only the MEASURE is this picker's own: it compares whole pixel counts because
+* its entries can differ in aspect, where the cap's requirement is stated in p.
 */
 function pickClosestResolution(entries, target) {
 	const targetPixels = target.width * target.height;
-	let bestAbove;
-	let bestBelow;
-	for (const e of entries) {
-		if (e.resolution === void 0) continue;
-		const pixels = e.resolution.width * e.resolution.height;
-		if (pixels >= targetPixels) {
-			if (!bestAbove || pixels < bestAbove.pixels) bestAbove = {
-				entry: e,
-				pixels
-			};
-		} else if (!bestBelow || pixels > bestBelow.pixels) bestBelow = {
-			entry: e,
-			pixels
-		};
-	}
-	return bestAbove?.entry ?? bestBelow?.entry;
+	return [...entries.flatMap((entry) => entry.resolution === void 0 ? [] : [{
+		entry,
+		pixels: entry.resolution.width * entry.resolution.height
+	}])].sort((a, b) => compareToTarget(a.pixels, b.pixels, targetPixels))[0]?.entry;
 }
 var MODEL_FORMATS = [
 	"onnx",
@@ -12182,6 +12269,58 @@ method(ListInputSchema, array(BrokerInfoSchema$1)), method(GetInputSchema, Broke
 	auth: "admin"
 }), method(GetStateInputSchema, unknown().nullable()), method(_void(), RegistryStatusSchema);
 DeviceType.Camera;
+/**
+* The signals a device can emit to WAKE its own stream.
+*
+* A camera whose stream is built on demand sleeps until something asks for it,
+* and "something" cannot be a consumer that is merely attached — a Frigate-style
+* puller holds a session open for ever, and treating that as demand would keep
+* a battery camera awake for ever, which is the whole thing the battery is for
+* (D173). So the wake has to come from the CAMERA: an event it noticed by
+* itself, with no stream running.
+*
+* ## The vocabulary is the PROVIDER'S, not ours
+*
+* Like `consumables`, this cap declares no vocabulary of its own. A provider
+* names each signal with a `code` it chooses and a `label` an operator reads.
+* Reolink offers motion and camera-native detection; another provider may offer
+* a tamper, a doorbell press, a PIR, or something no camera in this fleet has
+* yet. A fixed enum here would mean every new signal is a framework release.
+*
+* It is deliberately NOT derived from the caps a device already binds. Whether
+* a camera CAN push firmware motion is expressed by `motionSources` containing
+* `'onboard'`, and whether it does AI on-camera by the `native-object-detection`
+* binding — but both answer "what drives the detection pipeline", which is a
+* different question from "what may wake a sleeping stream". A camera can do
+* the first and not be trusted with the second, and the operator picks per
+* camera. Two questions, two authorities.
+*
+* ## Availability is not permission
+*
+* `listSignals` says what the device CAN emit. Whether a given signal actually
+* wakes the stream is the operator's per-camera choice, held by the broker
+* alongside the cooldown — see the stream-broker cap's wake settings. A
+* provider declaring a signal is not a provider enabling it.
+*/
+/** One signal a device can emit. */
+var StreamSignalSchema = object({
+	/** Stable id chosen by the provider, e.g. `'motion'`, `'person'`, `'tamper'`. */
+	code: string().min(1),
+	/** What an operator reads in the picker. The provider's own wording. */
+	label: string().min(1),
+	/**
+	* Whether the provider recommends this signal ON when a camera is first set
+	* up. A provider knows which of its signals are cheap and reliable; an
+	* operator should not have to discover that by trial. Reolink recommends
+	* both of its own.
+	*/
+	recommended: boolean()
+});
+object({
+	signals: array(StreamSignalSchema),
+	lastFetchedAt: number()
+});
+Object.values(DeviceType), method(_void(), array(StreamSignalSchema).readonly());
 /** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
 var StreamFormatSchema = _enum([
 	"webrtc",
@@ -12578,6 +12717,22 @@ var EgressTranscodeSchema = object({
 	camStreamId: string().nullable()
 });
 method(object({
+	deviceId: number().int().nonnegative(),
+	/** The provider's signal code. */
+	code: string().min(1),
+	/** Ms epoch. Absent ⇒ now. */
+	at: number().optional()
+}), object({
+	/** Whether the broker acted on it, and if not, why. */
+	accepted: boolean(),
+	reason: _enum([
+		"woke",
+		"hold-extended",
+		"not-enabled",
+		"no-consumer",
+		"unknown-code"
+	])
+}), { kind: "mutation" }), method(object({
 	deviceId: number().int().nonnegative(),
 	camStreamId: string().min(1),
 	kind: CamStreamKindSchema,
@@ -12832,6 +12987,16 @@ var PickStreamRequirementsSchema = object({
 	acceptCodecs: array(StreamCodecSchema).readonly().optional(),
 	/** Minimum vertical resolution. Streams shorter than this are dropped. */
 	minHeight: number().int().positive().optional(),
+	/**
+	* Maximum vertical resolution. Streams TALLER than this are dropped.
+	*
+	* A consumer can have a ceiling as real as its floor: Alexa documents
+	* 480p to 1080p, and a 4K stream is as unusable to an Echo as a 360p one.
+	* Without this the ceiling had to be re-implemented by every caller — and
+	* one caller implementing it privately is how a second scoring authority
+	* gets born.
+	*/
+	maxHeight: number().int().positive().optional(),
 	/** Minimum horizontal resolution. */
 	minWidth: number().int().positive().optional(),
 	/**
@@ -12848,7 +13013,22 @@ var PickStreamRequirementsSchema = object({
 	* transcoded" guard: if the device is already serving the consumer's
 	* codec end-to-end, there's nothing to optimise.
 	*/
-	requireSiblingCodec: array(StreamCodecSchema).readonly().optional()
+	requireSiblingCodec: array(StreamCodecSchema).readonly().optional(),
+	/**
+	* Whether a stream the consumer CANNOT decode may still be picked, on the
+	* understanding that it will be transcoded.
+	*
+	* Default `false` — today's behaviour, and the right one for a bypass
+	* question ("is there a stream I can forward untouched?"). Set `true` to
+	* ask the larger question: "what is the best stream for me, transcoding if
+	* I must?" A stream that satisfies `acceptCodecs` always outranks one that
+	* does not, so a passthrough is never lost to a transcode; the answer says
+	* which it is in {@link PickedCamStreamSchema.transcodes}.
+	*
+	* This is what lets one picker serve both the bypass and the full source
+	* choice, instead of a consumer scoring privately when the bypass misses.
+	*/
+	allowTranscode: boolean().optional()
 }).readonly();
 var PickStreamPreferencesSchema = object({
 	/**
@@ -12862,12 +13042,32 @@ var PickStreamPreferencesSchema = object({
 	* picks the tallest stream; `'lowest'` picks the shortest (used by
 	* memory-constrained consumers / Apple Home guest sessions).
 	*/
-	resolutionPreference: _enum(["highest", "lowest"]).optional()
+	resolutionPreference: _enum(["highest", "lowest"]).optional(),
+	/**
+	* The height the consumer actually wants to DELIVER.
+	*
+	* Not a constraint — an ordering. With it set, the SMALLEST stream at or
+	* above the target wins, and only if nothing reaches it does the tallest
+	* take over. Pulling 1296 lines to draw 720 on a 1280x800 Echo panel costs
+	* a decode and buys nothing, and `resolutionPreference: 'highest'` cannot
+	* express that: it says "as big as possible", which is a different wish.
+	*
+	* Ignored when absent, so every existing caller keeps its ordering.
+	*/
+	targetHeight: number().int().positive().optional()
 }).readonly();
 var PickedCamStreamSchema = object({
 	camStreamId: string(),
 	codec: string().optional(),
 	resolution: CamStreamResolutionSchema.optional(),
+	/**
+	* Whether serving this stream requires a decode + re-encode.
+	*
+	* `false` is a stream the consumer can take as it stands. Only ever `true`
+	* when the caller asked for it with `allowTranscode`, so a caller that did
+	* not ask cannot be handed a cost it never agreed to pay.
+	*/
+	transcodes: boolean(),
 	/** One-line explanation of why this stream won — for logs / debug UI. */
 	reason: string()
 });
@@ -16974,7 +17174,7 @@ var AlarmArmModeSchema = _enum([
 	"vacation",
 	"custom_bypass"
 ]);
-object({
+var AlarmPanelStatusSchema = object({
 	/** Current lifecycle state. */
 	state: AlarmStateSchema,
 	/** Subset of arm modes the panel accepts. UI renders one button per
@@ -17137,6 +17337,8 @@ var NcSystemEventKindSchema = _enum([
 	"device-enabled",
 	"device-battery-low",
 	"device-battery-normal",
+	"device-consumable-low",
+	"device-consumable-normal",
 	"stream-online",
 	"stream-offline",
 	"node-online",
@@ -17155,6 +17357,7 @@ var NcSystemEventKindSchema = _enum([
 	"addon-updated",
 	"server-updated",
 	"export-completed",
+	"backup-completed",
 	"camera-online",
 	"camera-offline",
 	"camera-disabled",
@@ -24396,10 +24599,28 @@ DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), ar
 }), boolean()), method(object({
 	deviceId: number().int().nonnegative(),
 	sessionId: string()
-}), object({ pendingRenegotiation: object({
-	target: WebrtcStreamTargetSchema,
-	epoch: number()
-}).nullable() }));
+}), object({
+	pendingRenegotiation: object({
+		target: WebrtcStreamTargetSchema,
+		epoch: number()
+	}).nullable(),
+	/**
+	* Whether the session still EXISTS.
+	*
+	* A consumer that holds a resource for the life of a session needs to
+	* be able to ask, because a session does not always end the way it
+	* began. Measured on this hub 2026-09-13: an Echo that got stuck never
+	* sent `SessionDisconnected`, so the Alexa exporter's
+	* `releaseEgressTranscode` never ran, and a 2304x1296 HEVC to 720p
+	* H.264 transcode kept running for NOBODY for more than twenty
+	* minutes. The WebRTC session had logged `WebRTC session closed`
+	* minutes earlier — the broker knew; the holder had no way to ask.
+	*
+	* `false` for a session id the provider has never heard of, which is
+	* the same answer as "it ended": either way nothing is holding it up.
+	*/
+	alive: boolean()
+}));
 object({
 	/** All accessory children of the parent. */
 	childDeviceIds: array(number()).readonly(),
@@ -36964,6 +37185,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.reportStreamSignal": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.restartProfile": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -37048,6 +37275,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamSignals.listSignals": {
+		capName: "stream-signals",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"switch.setState": {
 		capName: "switch",
 		capScope: "device",
@@ -39420,6 +39653,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"streamBroker.reportStreamSignal": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"streamBroker.restartProfile": [{
 		name: "deviceId",
 		form: "single",
@@ -40208,7 +40446,7 @@ var Fmp4FragmentChild = class {
 				meta: {
 					sourceId: this.args.sourceId,
 					decodeHwAccel: requested,
-					error: errMsg$15(err)
+					error: errMsg$16(err)
 				}
 			});
 			this.killChild();
@@ -40387,7 +40625,7 @@ var Fmp4FragmentChild = class {
 				tags: { deviceId: this.args.deviceId },
 				meta: {
 					sourceId: this.args.sourceId,
-					error: errMsg$15(err)
+					error: errMsg$16(err)
 				}
 			});
 		}
@@ -87041,9 +87279,126 @@ function clearPairingFiles(accessoryUuid, logger) {
 		} });
 	}
 }
+/**
+* Whether this device's accessory belongs on the bridge.
+*
+* A camera is `false` whatever the operator picked — the answer is HomeKit's,
+* not ours, and an operator who switched it on before the field was gated must
+* not end up with a camera nobody can pair.
+*
+* Absent means ON for everything else: the field did not exist for entries
+* persisted before it, and the default the operator asked for is the bridge.
+*/
+function shouldBridge(input) {
+	if (input.mapperKind === "camera") return false;
+	return input.useBridge !== false;
+}
+/** Whether the bridge has room for one more. */
+function bridgeHasRoom(current) {
+	return current < 149;
+}
+//#endregion
+//#region src/bridge-host.ts
+/**
+* THE bridge accessory — one per node, created on demand, holding every
+* non-camera accessory the operator routed onto it.
+*
+* One mDNS advertisement, one HAP connection, one pairing, N accessories
+* inside. The alternative — what this addon did until now — gives every
+* switch, sensor and alarm panel its own port, its own advertisement and its
+* own "Add Accessory" in the Home app. Cameras stay standalone, because
+* HomeKit forbids bridging them (`bridge-policy.ts`).
+*
+* ONE bridge, deliberately. The ceiling is 149 accessories
+* ({@link MAX_BRIDGED_ACCESSORIES}) and this hub exposes 46 devices in total,
+* cameras included; a second bridge is a thing to build when the count
+* approaches the ceiling, not before, and the refusal at the ceiling is
+* explicit rather than a library throw.
+*
+* The bridge is LAZY: it is published the first time an accessory needs it,
+* so a fleet of nothing but cameras advertises no empty bridge. It is not
+* unpublished when the last accessory leaves — an unpublish would drop the
+* pairing record the operator already entered a code for, and an empty bridge
+* in the Home app is a far smaller cost than a re-pair.
+*/
+var BridgeHost = class {
+	opts;
+	bridge = null;
+	published = false;
+	constructor(opts) {
+		this.opts = opts;
+	}
+	/** The live bridge accessory, or `null` before anything needed one. */
+	get accessory() {
+		return this.bridge;
+	}
+	/** How many accessories are riding it right now. */
+	get size() {
+		return this.bridge?.bridgedAccessories.length ?? 0;
+	}
+	/**
+	* Put an accessory on the bridge, publishing the bridge if this is the
+	* first. Returns `false` — without throwing, and having logged — when the
+	* bridge is full: the caller then falls back to standalone, which is worse
+	* for the operator and still works.
+	*/
+	async add(accessory) {
+		const bridge = this.ensure();
+		if (!bridgeHasRoom(bridge.bridgedAccessories.length)) {
+			this.opts.logger.warn("export-hap: the bridge is FULL — publishing standalone instead", { meta: {
+				uuid: accessory.UUID,
+				bridged: bridge.bridgedAccessories.length,
+				max: 149
+			} });
+			return false;
+		}
+		bridge.addBridgedAccessory(accessory);
+		await this.publishOnce();
+		return true;
+	}
+	/** Take an accessory off the bridge. A bridged accessory is never
+	*  `unpublish`ed — it has no server of its own. */
+	remove(accessory) {
+		if (this.bridge === null) return;
+		if (!this.bridge.bridgedAccessories.some((a) => a.UUID === accessory.UUID)) return;
+		this.bridge.removeBridgedAccessory(accessory, false);
+	}
+	/** Whether this accessory is currently on the bridge. */
+	holds(accessory) {
+		return this.bridge?.bridgedAccessories.some((a) => a.UUID === accessory.UUID) ?? false;
+	}
+	/** Tear the bridge down — process shutdown only. */
+	async dispose() {
+		if (this.bridge === null || !this.published) return;
+		await unpublishAccessory(this.bridge, this.opts.logger);
+		this.published = false;
+	}
+	ensure() {
+		if (this.bridge !== null) return this.bridge;
+		const bridge = new import_dist.Accessory(this.opts.displayName, this.opts.uuid);
+		bridge.category = import_dist.Categories.BRIDGE;
+		this.bridge = bridge;
+		return bridge;
+	}
+	async publishOnce() {
+		if (this.published || this.bridge === null) return;
+		if (this.opts.publish !== void 0) await this.opts.publish(this.bridge, this.opts.pincode);
+		else await publishStandalone(this.bridge, {
+			pincode: this.opts.pincode,
+			port: 0,
+			bind: this.opts.bind,
+			logger: this.opts.logger
+		});
+		this.published = true;
+		this.opts.logger.info("export-hap: the bridge is published", { meta: {
+			displayName: this.opts.displayName,
+			uuid: this.opts.uuid
+		} });
+	}
+};
 //#endregion
 //#region src/hap-setup-uri.ts
-function errMsg$14(e) {
+function errMsg$15(e) {
 	return e instanceof Error ? e.message : String(e);
 }
 /**
@@ -87070,7 +87425,7 @@ function firstExposedAccessorySetupUri(exposed, logger) {
 		try {
 			return first.setupURI();
 		} catch (err) {
-			logger.debug("export-hap: setupURI failed on first exposed accessory", { meta: { error: errMsg$14(err) } });
+			logger.debug("export-hap: setupURI failed on first exposed accessory", { meta: { error: errMsg$15(err) } });
 			return;
 		}
 	}
@@ -87423,7 +87778,7 @@ async function buildBattery(bctx) {
 		const status = await proxy.battery?.getStatus({});
 		if (status !== void 0 && status !== null) applyToService(service, status);
 	} catch (err) {
-		log.debug("export-hap: battery getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$13(err) } });
+		log.debug("export-hap: battery getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$14(err) } });
 	}
 	const unsubscribes = [];
 	if (proxy.state.battery) {
@@ -87442,7 +87797,7 @@ async function buildBattery(bctx) {
 function applyToService(service, status) {
 	applyUpdates(service, batteryCharacteristicUpdates(status));
 }
-function errMsg$13(err) {
+function errMsg$14(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -98194,7 +98549,7 @@ var VIDEO_LOOPBACK_RCVBUF_BYTES = 8 * 1024 * 1024;
 * not burst size.
 */
 var AUDIO_LOOPBACK_RCVBUF_BYTES = 1024 * 1024;
-function errMsg$12(err) {
+function errMsg$13(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 /**
@@ -98209,13 +98564,13 @@ function applyReceiveBuffer(socket, requestedBytes) {
 	try {
 		socket.setRecvBufferSize(requestedBytes);
 	} catch (err) {
-		error = errMsg$12(err);
+		error = errMsg$13(err);
 	}
 	let effectiveBytes = null;
 	try {
 		effectiveBytes = socket.getRecvBufferSize();
 	} catch (err) {
-		if (error === null) error = errMsg$12(err);
+		if (error === null) error = errMsg$13(err);
 	}
 	return {
 		requestedBytes,
@@ -98475,20 +98830,20 @@ function buildCameraStreamingDelegate(bctx, advertised) {
 		delegate: {
 			handleSnapshotRequest(request, callback) {
 				handleSnapshot(bctx, request).then((buf) => callback(void 0, buf)).catch((err) => {
-					log.warn("export-hap: snapshot failed", { meta: { error: errMsg$11(err) } });
-					callback(err instanceof Error ? err : new Error(errMsg$11(err)));
+					log.warn("export-hap: snapshot failed", { meta: { error: errMsg$12(err) } });
+					callback(err instanceof Error ? err : new Error(errMsg$12(err)));
 				});
 			},
 			prepareStream(request, callback) {
 				prepareStream(request, sessions, bctx).then((resp) => callback(void 0, resp)).catch((err) => {
-					log.warn("export-hap: prepareStream failed", { meta: { error: errMsg$11(err) } });
-					callback(err instanceof Error ? err : new Error(errMsg$11(err)));
+					log.warn("export-hap: prepareStream failed", { meta: { error: errMsg$12(err) } });
+					callback(err instanceof Error ? err : new Error(errMsg$12(err)));
 				});
 			},
 			handleStreamRequest(request, callback) {
 				handleStreamRequest(request, sessions, bctx, advertised).then(() => callback()).catch((err) => {
-					log.warn("export-hap: handleStreamRequest failed", { meta: { error: errMsg$11(err) } });
-					callback(err instanceof Error ? err : new Error(errMsg$11(err)));
+					log.warn("export-hap: handleStreamRequest failed", { meta: { error: errMsg$12(err) } });
+					callback(err instanceof Error ? err : new Error(errMsg$12(err)));
 				});
 			}
 		},
@@ -98604,7 +98959,7 @@ async function prepareStream(request, sessions, bctx) {
 		closeSocket(audioUdp);
 		closeSocket(videoLoopUdp);
 		closeSocket(audioLoopUdp);
-		throw new Error(`export-hap: outbound SrtpSession init failed: ${errMsg$11(err)}`, { cause: err });
+		throw new Error(`export-hap: outbound SrtpSession init failed: ${errMsg$12(err)}`, { cause: err });
 	}
 	let upstreamAudioSrtp = null;
 	try {
@@ -98618,7 +98973,7 @@ async function prepareStream(request, sessions, bctx) {
 			profile: import_src.ProtectionProfileAes128CmHmacSha1_80
 		});
 	} catch (err) {
-		bctx.ctx.logger.withTags({ deviceId: bctx.numericDeviceId }).warn("export-hap: SrtpSession init failed (upstream audio decrypt disabled)", { meta: { error: errMsg$11(err) } });
+		bctx.ctx.logger.withTags({ deviceId: bctx.numericDeviceId }).warn("export-hap: SrtpSession init failed (upstream audio decrypt disabled)", { meta: { error: errMsg$12(err) } });
 	}
 	const videoSsrc = randomSsrc();
 	const audioSsrc = randomSsrc();
@@ -98735,7 +99090,7 @@ async function prepareStream(request, sessions, bctx) {
 	});
 	audioUdp.on("message", (packet, rinfo) => {
 		handleIncomingAudioRtp(session, packet, rinfo.address, bctx).catch((err) => {
-			bctx.ctx.logger.withTags({ deviceId: bctx.numericDeviceId }).debug("export-hap: incoming-audio handler error (dropped)", { meta: { error: errMsg$11(err) } });
+			bctx.ctx.logger.withTags({ deviceId: bctx.numericDeviceId }).debug("export-hap: incoming-audio handler error (dropped)", { meta: { error: errMsg$12(err) } });
 		});
 	});
 	logLoopbackBuffer(tagLog, request.sessionID, "video", videoLoop.buffer);
@@ -98931,7 +99286,7 @@ function readControllerRtcp(session, leg, packet, log) {
 	} catch (err) {
 		drop(session, "inbound-rtcp-decrypt-failed");
 		storeReceiverReports(session, leg, recordUnreadableRtcp(tally));
-		logUnreadableRtcp(session, leg, `decrypt: ${errMsg$11(err)}`, log);
+		logUnreadableRtcp(session, leg, `decrypt: ${errMsg$12(err)}`, log);
 		return;
 	}
 	const outcome = ingestDecryptedRtcp(plaintext, tally);
@@ -99448,6 +99803,19 @@ async function startFfmpegForSession(bctx, session, sessionId, video, advertised
 		} });
 		throw new Error(`export-hap: no enabled RTSP entries for device ${numericDeviceId}`);
 	}
+	if (fit.kind === "transcode" && bctx.options.hapDeviceSettings?.allowTranscode === false) {
+		startLog.warn("export-hap: stream start REFUSED — transcoding is switched off", {
+			tags: { deviceId: numericDeviceId },
+			meta: {
+				sessionId,
+				streamPreference: pref,
+				negotiated: `${video.width}x${video.height}`,
+				pickedProfile: fit.profile,
+				pickedCodec: fit.picked.codec ?? "unknown"
+			}
+		});
+		throw new Error(`export-hap: device ${numericDeviceId} needs a transcode and transcoding is switched off`);
+	}
 	const picked = fit.picked;
 	const rtspUrl = picked.url;
 	const slot = brokerStreams.find((s) => s.profile === fit.profile);
@@ -99697,7 +100065,7 @@ async function handleIncomingAudioRtp(session, packet, sourceAddress, bctx) {
 		session.upstreamRtpDecryptFailures += 1;
 		if (session.upstreamRtpDecryptFailures % 100 === 1) log.debug("export-hap: SRTP decrypt failed (rate-limited)", { meta: {
 			failures: session.upstreamRtpDecryptFailures,
-			error: errMsg$11(err)
+			error: errMsg$12(err)
 		} });
 		return;
 	}
@@ -99711,7 +100079,7 @@ async function handleIncomingAudioRtp(session, packet, sourceAddress, bctx) {
 		rtpPayloadType = parsedRtp.header.payloadType;
 	} catch (err) {
 		drop(session, "upstream-parse-failed");
-		log.debug("export-hap: RTP parse failed after decrypt", { meta: { error: errMsg$11(err) } });
+		log.debug("export-hap: RTP parse failed after decrypt", { meta: { error: errMsg$12(err) } });
 		return;
 	}
 	const negotiatedAudioPt = session.lastStartParams?.audioPt;
@@ -99735,7 +100103,7 @@ async function handleIncomingAudioRtp(session, packet, sourceAddress, bctx) {
 	if (session.intercomTalkSessionId === null) {
 		session.intercomTalkSessionId = "";
 		const opened = await openIntercomTalkSession(bctx).catch((err) => {
-			log.warn("export-hap: intercom.startTalkSession failed", { meta: { error: errMsg$11(err) } });
+			log.warn("export-hap: intercom.startTalkSession failed", { meta: { error: errMsg$12(err) } });
 			return null;
 		});
 		if (opened) {
@@ -99762,7 +100130,7 @@ async function handleIncomingAudioRtp(session, packet, sourceAddress, bctx) {
 		drop(session, "upstream-push-failed");
 		log.debug("export-hap: intercom.pushTalkAudio failed (will re-open on next frame)", { meta: {
 			sequenceNumber: session.intercomPcmSequence,
-			error: errMsg$11(err)
+			error: errMsg$12(err)
 		} });
 		session.intercomTalkSessionId = null;
 	}
@@ -99794,7 +100162,7 @@ async function closeIntercomTalkSession(session, bctx) {
 	} catch (err) {
 		log.debug("export-hap: intercom.endTalkSession failed (continuing)", { meta: {
 			sessionId,
-			error: errMsg$11(err)
+			error: errMsg$12(err)
 		} });
 	}
 }
@@ -99819,7 +100187,7 @@ function closeSocket(udp) {
 function randomSsrc() {
 	return Math.floor(Math.random() * 2147483646) + 1 | 0;
 }
-function errMsg$11(err) {
+function errMsg$12(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -99903,14 +100271,14 @@ async function buildDoorbell(input) {
 			}
 			log.info("export-hap: doorbell SINGLE_PRESS pushed to HomeKit", { meta: { ...delivery } });
 		} catch (err) {
-			log.warn("export-hap: ringDoorbell() failed", { meta: { error: errMsg$10(err) } });
+			log.warn("export-hap: ringDoorbell() failed", { meta: { error: errMsg$11(err) } });
 		}
 	});
 	return { async dispose() {
 		unsubscribe();
 	} };
 }
-function errMsg$10(err) {
+function errMsg$11(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -99958,7 +100326,7 @@ async function buildMotionSensor(bctx, existing = null) {
 		const detected = await proxy.motion?.isDetected({});
 		if (typeof detected === "boolean") motionService.updateCharacteristic(import_dist.Characteristic.MotionDetected, detected);
 	} catch (err) {
-		ctx.logger.withTags({ deviceId: numericDeviceId }).debug("export-hap: initial motion hydrate failed (non-fatal)", { meta: { error: errMsg$9(err) } });
+		ctx.logger.withTags({ deviceId: numericDeviceId }).debug("export-hap: initial motion hydrate failed (non-fatal)", { meta: { error: errMsg$10(err) } });
 	}
 	let resetTimer = null;
 	const armReset = () => {
@@ -99992,7 +100360,7 @@ async function buildMotionSensor(bctx, existing = null) {
 		}
 	} };
 }
-function errMsg$9(err) {
+function errMsg$10(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -100023,7 +100391,7 @@ async function buildPrivacySwitch(bctx) {
 		const status = await proxy.privacyMask?.getStatus({});
 		if (status && typeof status.enabled === "boolean") service.updateCharacteristic(import_dist.Characteristic.On, status.enabled);
 	} catch (err) {
-		log.debug("export-hap: privacy-mask getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$8(err) } });
+		log.debug("export-hap: privacy-mask getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$9(err) } });
 	}
 	service.getCharacteristic(import_dist.Characteristic.On).onSet(async (value) => {
 		const enabled = value === true;
@@ -100032,7 +100400,7 @@ async function buildPrivacySwitch(bctx) {
 		} catch (err) {
 			log.warn("export-hap: privacy-mask setMask failed", { meta: {
 				enabled,
-				error: errMsg$8(err)
+				error: errMsg$9(err)
 			} });
 		}
 	});
@@ -100050,7 +100418,7 @@ async function buildPrivacySwitch(bctx) {
 		} catch {}
 	} };
 }
-function errMsg$8(err) {
+function errMsg$9(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -100141,7 +100509,7 @@ async function buildPtz(bctx) {
 			} catch (err) {
 				log.warn("export-hap: ptz.goToPreset failed", { meta: {
 					presetId: preset.id,
-					error: errMsg$7(err)
+					error: errMsg$8(err)
 				} });
 			}
 			armReset(() => service.updateCharacteristic(import_dist.Characteristic.On, false), MOMENTARY_RESET_MS);
@@ -100159,14 +100527,14 @@ async function buildPtz(bctx) {
 					try {
 						await proxy.ptz?.stop({});
 					} catch (err) {
-						log.debug("export-hap: ptz.stop failed (non-fatal)", { meta: { error: errMsg$7(err) } });
+						log.debug("export-hap: ptz.stop failed (non-fatal)", { meta: { error: errMsg$8(err) } });
 					}
 					service.updateCharacteristic(import_dist.Characteristic.On, false);
 				}, options.ptzPulseMs);
 			} catch (err) {
 				log.warn("export-hap: ptz.continuousMove failed", { meta: {
 					dir: dir.label,
-					error: errMsg$7(err)
+					error: errMsg$8(err)
 				} });
 				service.updateCharacteristic(import_dist.Characteristic.On, false);
 			}
@@ -100189,7 +100557,7 @@ async function readPresets(bctx) {
 			name: p.name
 		}));
 	} catch (err) {
-		ctx.logger.withTags({ deviceId: numericDeviceId }).debug("export-hap: ptz.getPresets failed (non-fatal)", { meta: { error: errMsg$7(err) } });
+		ctx.logger.withTags({ deviceId: numericDeviceId }).debug("export-hap: ptz.getPresets failed (non-fatal)", { meta: { error: errMsg$8(err) } });
 		return [];
 	}
 }
@@ -100204,7 +100572,7 @@ async function tryBuildAutotrack(bctx) {
 		const status = await proxy.ptzAutotrack.getStatus({});
 		if (status && typeof status.enabled === "boolean") service.updateCharacteristic(import_dist.Characteristic.On, status.enabled);
 	} catch (err) {
-		log.debug("export-hap: ptzAutotrack.getStatus failed (non-fatal)", { meta: { error: errMsg$7(err) } });
+		log.debug("export-hap: ptzAutotrack.getStatus failed (non-fatal)", { meta: { error: errMsg$8(err) } });
 	}
 	service.getCharacteristic(import_dist.Characteristic.On).onSet(async (value) => {
 		const enabled = value === true;
@@ -100213,13 +100581,13 @@ async function tryBuildAutotrack(bctx) {
 		} catch (err) {
 			log.warn("export-hap: ptzAutotrack.setEnabled failed", { meta: {
 				enabled,
-				error: errMsg$7(err)
+				error: errMsg$8(err)
 			} });
 		}
 	});
 	return { async dispose() {} };
 }
-function errMsg$7(err) {
+function errMsg$8(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -101250,13 +101618,13 @@ async function buildChildSwitch(bctx, subtype, deviceType) {
 		const switchStatus = await proxy.switch?.getStatus({});
 		if (switchStatus && typeof switchStatus.on === "boolean") service.updateCharacteristic(import_dist.Characteristic.On, switchStatus.on);
 	} catch (err) {
-		log.debug("export-hap: child switch.getStatus failed (non-fatal)", { meta: { error: errMsg$6(err) } });
+		log.debug("export-hap: child switch.getStatus failed (non-fatal)", { meta: { error: errMsg$7(err) } });
 	}
 	if (useLightbulb) try {
 		const status = await proxy.brightness?.getStatus({});
 		if (status && typeof status.percentage === "number") service.updateCharacteristic(import_dist.Characteristic.Brightness, status.percentage);
 	} catch (err) {
-		log.debug("export-hap: child brightness.getStatus failed (non-fatal)", { meta: { error: errMsg$6(err) } });
+		log.debug("export-hap: child brightness.getStatus failed (non-fatal)", { meta: { error: errMsg$7(err) } });
 	}
 	if (hasSwitch) service.getCharacteristic(import_dist.Characteristic.On).onSet(async (value) => {
 		const on = value === true;
@@ -101265,7 +101633,7 @@ async function buildChildSwitch(bctx, subtype, deviceType) {
 		} catch (err) {
 			log.warn("export-hap: child switch.setState failed", { meta: {
 				on,
-				error: errMsg$6(err)
+				error: errMsg$7(err)
 			} });
 		}
 	});
@@ -101277,7 +101645,7 @@ async function buildChildSwitch(bctx, subtype, deviceType) {
 		} catch (err) {
 			log.warn("export-hap: child brightness.setBrightness failed", { meta: {
 				percentage,
-				error: errMsg$6(err)
+				error: errMsg$7(err)
 			} });
 		}
 	});
@@ -101300,7 +101668,7 @@ async function buildChildSwitch(bctx, subtype, deviceType) {
 		} catch {}
 	} };
 }
-function errMsg$6(err) {
+function errMsg$7(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -101327,7 +101695,7 @@ async function buildChildServicesFor(input) {
 		for (const h of handles) try {
 			await h.dispose();
 		} catch (err) {
-			ctx.logger.withTags({ deviceId: parentNumericId }).debug("export-hap: child service dispose failed (continuing)", { meta: { error: errMsg$5(err) } });
+			ctx.logger.withTags({ deviceId: parentNumericId }).debug("export-hap: child service dispose failed (continuing)", { meta: { error: errMsg$6(err) } });
 		}
 	} };
 }
@@ -101343,7 +101711,7 @@ async function listChildren(ctx, parentNumericId) {
 			features: Array.isArray(c.features) ? c.features.filter((f) => typeof f === "string") : []
 		}));
 	} catch (err) {
-		ctx.logger.withTags({ deviceId: parentNumericId }).debug("export-hap: deviceManager.getChildren failed (non-fatal)", { meta: { error: errMsg$5(err) } });
+		ctx.logger.withTags({ deviceId: parentNumericId }).debug("export-hap: deviceManager.getChildren failed (non-fatal)", { meta: { error: errMsg$6(err) } });
 		return [];
 	}
 }
@@ -101359,7 +101727,7 @@ function asDeviceType(raw) {
 	for (const value of Object.values(DeviceType)) if (value === lower) return value;
 	return DeviceType.Generic;
 }
-function errMsg$5(err) {
+function errMsg$6(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -101381,12 +101749,18 @@ var SUPPORTED_MAPPER_KINDS = ["camera", "generic"];
 * doctrine the HA exporter writes down, and the thing that confined the
 * previous exporter to cameras when it was ignored.
 *
-* Tier A: the types whose HomeKit services exist today and need no
-* feature-dependent shape. `cover`, `climate`, `fan`, `valve`, `humidifier`,
-* `water-heater`, `alarm-panel`, `button` and `media-player` are deliberately
+* Tier A plus `alarm-panel`: the types whose HomeKit services exist today and
+* need no feature-dependent shape. `cover`, `climate`, `fan`, `valve`,
+* `humidifier`, `water-heater`, `button` and `media-player` are deliberately
 * absent — each needs a service whose semantics the table cannot yet honour,
 * and offering the tab before the mapping exists is how an operator gets an
 * accessory that pairs and does nothing.
+*
+* `alarm-panel` is no longer one of them. It maps to `Service.SecuritySystem`
+* (`builders/generic/security-system.ts`), and the two things the table could
+* not previously honour are now honoured explicitly: HomeKit is only ever
+* offered the arm modes the panel accepts, and a panel that requires a PIN
+* refuses the write out loud instead of pretending to arm.
 */
 var HAP_EXPORTABLE_DEVICE_TYPES = [
 	DeviceType.Camera,
@@ -101396,6 +101770,7 @@ var HAP_EXPORTABLE_DEVICE_TYPES = [
 	DeviceType.Sensor,
 	DeviceType.Lock,
 	DeviceType.Presence,
+	DeviceType.AlarmPanel,
 	DeviceType.Generic
 ];
 /**
@@ -101521,17 +101896,17 @@ async function buildCameraAccessory(input) {
 			for (const h of handles) try {
 				await h.dispose();
 			} catch (err) {
-				log.debug("export-hap: builder dispose failed (continuing)", { meta: { error: errMsg$4(err) } });
+				log.debug("export-hap: builder dispose failed (continuing)", { meta: { error: errMsg$5(err) } });
 			}
 			try {
 				await streams.dispose();
 			} catch (err) {
-				log.debug("export-hap: streams dispose failed", { meta: { error: errMsg$4(err) } });
+				log.debug("export-hap: streams dispose failed", { meta: { error: errMsg$5(err) } });
 			}
 		}
 	};
 }
-function errMsg$4(err) {
+function errMsg$5(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -101560,7 +101935,7 @@ function errMsg$4(err) {
 * counterpart on this service and is deliberately not wired — a Switch that
 * silently buzzes a door open would be a second knob nobody asked for.
 */
-var SUBTYPE = "lock-control";
+var SUBTYPE$1 = "lock-control";
 var readLock = reader(LockControlStatusSchema.pick({ state: true }), (status) => {
 	const current = status.state === "locked" ? import_dist.Characteristic.LockCurrentState.SECURED : status.state === "unlocked" ? import_dist.Characteristic.LockCurrentState.UNSECURED : status.state === "jammed" ? import_dist.Characteristic.LockCurrentState.JAMMED : import_dist.Characteristic.LockCurrentState.UNKNOWN;
 	const target = status.state === "locked" || status.state === "locking" ? import_dist.Characteristic.LockTargetState.SECURED : status.state === "unlocked" || status.state === "unlocking" ? import_dist.Characteristic.LockTargetState.UNSECURED : null;
@@ -101576,7 +101951,7 @@ async function buildLockMechanism(bctx) {
 	const { ctx, accessory, proxy, numericDeviceId, displayName } = bctx;
 	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
 	const label = hapServiceName([displayName], `Lock ${numericDeviceId}`);
-	const service = accessory.addService(import_dist.Service.LockMechanism, label, SUBTYPE);
+	const service = accessory.addService(import_dist.Service.LockMechanism, label, SUBTYPE$1);
 	applyServiceLabel(service, label);
 	const apply = (status, source) => {
 		const updates = readLock(status);
@@ -101590,7 +101965,7 @@ async function buildLockMechanism(bctx) {
 		const status = await proxy.lockControl?.getStatus({});
 		if (status !== void 0 && status !== null) apply(status, "getStatus");
 	} catch (err) {
-		log.debug("export-hap: lock getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$3(err) } });
+		log.debug("export-hap: lock getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$4(err) } });
 	}
 	service.getCharacteristic(import_dist.Characteristic.LockTargetState).onSet(async (value) => {
 		const secure = value === import_dist.Characteristic.LockTargetState.SECURED;
@@ -101600,7 +101975,7 @@ async function buildLockMechanism(bctx) {
 		} catch (err) {
 			log.warn("export-hap: lock command failed", { meta: {
 				secure,
-				error: errMsg$3(err)
+				error: errMsg$4(err)
 			} });
 		}
 	});
@@ -101614,6 +101989,296 @@ async function buildLockMechanism(bctx) {
 		} catch {}
 	} };
 }
+function errMsg$4(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
+//#region src/mappers/builders/generic/security-state.ts
+/** Is this a settled arm state worth remembering? */
+function armedMemoOf(state) {
+	return state === "armed_home" || state === "armed_away" || state === "armed_night" || state === "armed_vacation" || state === "armed_custom_bypass" ? state : null;
+}
+function currentForArmed(state) {
+	switch (state) {
+		case "armed_home":
+		case "armed_custom_bypass": return import_dist.Characteristic.SecuritySystemCurrentState.STAY_ARM;
+		case "armed_night": return import_dist.Characteristic.SecuritySystemCurrentState.NIGHT_ARM;
+		default: return import_dist.Characteristic.SecuritySystemCurrentState.AWAY_ARM;
+	}
+}
+function targetForArmed(state) {
+	switch (state) {
+		case "armed_home":
+		case "armed_custom_bypass": return import_dist.Characteristic.SecuritySystemTargetState.STAY_ARM;
+		case "armed_night": return import_dist.Characteristic.SecuritySystemTargetState.NIGHT_ARM;
+		default: return import_dist.Characteristic.SecuritySystemTargetState.AWAY_ARM;
+	}
+}
+function securityStateFor(state, memo) {
+	const settled = armedMemoOf(state);
+	if (settled !== null) return {
+		current: currentForArmed(settled),
+		target: targetForArmed(settled)
+	};
+	switch (state) {
+		case "disarmed": return {
+			current: import_dist.Characteristic.SecuritySystemCurrentState.DISARMED,
+			target: import_dist.Characteristic.SecuritySystemTargetState.DISARM
+		};
+		case "arming": return {
+			current: import_dist.Characteristic.SecuritySystemCurrentState.DISARMED,
+			target: memo === null ? null : targetForArmed(memo)
+		};
+		case "disarming": return {
+			current: memo === null ? import_dist.Characteristic.SecuritySystemCurrentState.DISARMED : currentForArmed(memo),
+			target: import_dist.Characteristic.SecuritySystemTargetState.DISARM
+		};
+		case "pending": return {
+			current: memo === null ? import_dist.Characteristic.SecuritySystemCurrentState.DISARMED : currentForArmed(memo),
+			target: memo === null ? null : targetForArmed(memo)
+		};
+		default: return {
+			current: import_dist.Characteristic.SecuritySystemCurrentState.ALARM_TRIGGERED,
+			target: memo === null ? null : targetForArmed(memo)
+		};
+	}
+}
+/**
+* The arm mode behind a HomeKit target, or `null` for DISARM and for anything
+* outside the four values HomeKit defines.
+*
+* `null` is not an error the caller can ignore: DISARM is a different COMMAND,
+* and a value HomeKit never sends is a write this builder refuses to translate.
+*/
+function alarmArmModeFor(target) {
+	switch (target) {
+		case import_dist.Characteristic.SecuritySystemTargetState.STAY_ARM: return "home";
+		case import_dist.Characteristic.SecuritySystemTargetState.AWAY_ARM: return "away";
+		case import_dist.Characteristic.SecuritySystemTargetState.NIGHT_ARM: return "night";
+		default: return null;
+	}
+}
+//#endregion
+//#region src/mappers/builders/generic/security-target.ts
+/**
+* The panel modes behind each HomeKit target, PRIMARY first.
+*
+* The primary is the mode `alarmArmModeFor` names; the secondary is the other
+* mode `security-state.ts` reports through the same HomeKit value, so the two
+* modules agree in both directions by construction.
+*/
+var MODES_BY_TARGET = new Map([
+	[import_dist.Characteristic.SecuritySystemTargetState.STAY_ARM, ["home", "custom_bypass"]],
+	[import_dist.Characteristic.SecuritySystemTargetState.AWAY_ARM, ["away", "vacation"]],
+	[import_dist.Characteristic.SecuritySystemTargetState.NIGHT_ARM, ["night"]]
+]);
+/** Arm targets in the order HomeKit numbers them; DISARM is appended last. */
+var ARM_TARGETS = [
+	import_dist.Characteristic.SecuritySystemTargetState.STAY_ARM,
+	import_dist.Characteristic.SecuritySystemTargetState.AWAY_ARM,
+	import_dist.Characteristic.SecuritySystemTargetState.NIGHT_ARM
+];
+/**
+* The `validValues` for `SecuritySystemTargetState`, or `null` to leave
+* HomeKit's own four values in place.
+*
+* DISARM is always present: disarming is not one of the panel's arm modes and
+* a panel that cannot be disarmed is not a thing this cap can express.
+*/
+function targetValidValuesFor(availableModes) {
+	if (availableModes.length === 0) return null;
+	return [...ARM_TARGETS.filter((target) => (MODES_BY_TARGET.get(target) ?? []).some((mode) => availableModes.includes(mode))), import_dist.Characteristic.SecuritySystemTargetState.DISARM];
+}
+/**
+* The arm mode to send for a HomeKit target, or `null` when there is none.
+*
+* `null` is not a shrug the caller may swallow: DISARM is a different command,
+* and an arm target the panel accepts no mode for is a write this module
+* refuses to translate rather than guess at.
+*/
+function armModeForTarget(target, availableModes) {
+	const primary = alarmArmModeFor(target);
+	if (primary === null) return null;
+	if (availableModes.length === 0) return primary;
+	return (MODES_BY_TARGET.get(target) ?? [primary]).find((mode) => availableModes.includes(mode)) ?? null;
+}
+//#endregion
+//#region src/mappers/builders/generic/security-system.ts
+/**
+* `alarm-panel` → `Service.SecuritySystem`.
+*
+* The lock builder's shape (a current/target pair, a hydrate, an `onSet`, a
+* slice subscription, a dispose) applied to the one device on the fleet where
+* reporting a state that is not true has a consequence worse than a stalled
+* motor. The mapping itself is NOT here: `security-state.ts` owns what the
+* panel's state looks like to HomeKit and `security-target.ts` owns what
+* HomeKit may ask for, both pure and both tested on their own. This file is
+* the service around them.
+*
+* ## The memo
+*
+* `pending`, `disarming` and `triggered` do not carry the mode the panel was
+* armed to — only the last settled state knows it. This builder is the caller
+* `security-state.ts` describes: it remembers the last settled arm and forgets
+* it on `disarmed`, because a memo that outlives a disarm makes the next
+* `arming` claim a target nobody asked for.
+*
+* The memo is deliberately NOT seeded from the controller's own write. HomeKit
+* already holds the target the operator just set; not writing it back is
+* exactly right. The cost is a panel armed from its own keypad during an exit
+* delay, where the target stays at whatever HomeKit last knew — a stale target
+* for the length of the delay, against inventing an intent, and the invention
+* is worse.
+*
+* ## `requiresCode`: the arm is REFUSED, not attempted
+*
+* HomeKit's SecuritySystem has no PIN prompt — there is no characteristic for
+* it and no way to ask the operator mid-write. So a panel that requires a code
+* cannot be armed or disarmed from the Home app, and this builder says so
+* twice: the write fails with `INSUFFICIENT_AUTHORIZATION` (iOS renders the
+* tile's failure) and a WARN names the device, the command and the mode.
+*
+* Sending the command code-less and letting the panel reject it was the
+* alternative. It is worse: the refusal costs a round trip, it is
+* indistinguishable from a broken panel in the log, and repeated code-less
+* attempts are what locks a real alarm panel out.
+*/
+var SUBTYPE = "alarm-panel";
+/** The subset of the status this builder reads. */
+var PanelReadSchema = AlarmPanelStatusSchema.pick({
+	state: true,
+	availableModes: true,
+	requiresCode: true
+});
+/**
+* Turn a panel status into characteristic writes, folding the memo.
+*
+* A payload that does not match the cap's own schema yields NO updates and
+* leaves the memo alone — it is a status we could not read, not a panel that
+* changed. The caller logs the drop; a frozen characteristic is otherwise
+* indistinguishable from a quiet panel.
+*/
+function securityUpdatesFor(status, memo) {
+	const parsed = PanelReadSchema.safeParse(status);
+	if (!parsed.success) return {
+		updates: [],
+		memo,
+		panel: null
+	};
+	const nextMemo = parsed.data.state === "disarmed" ? null : armedMemoOf(parsed.data.state) ?? memo;
+	const { current, target } = securityStateFor(parsed.data.state, nextMemo);
+	return {
+		updates: [{
+			characteristic: import_dist.Characteristic.SecuritySystemCurrentState,
+			value: current
+		}, ...target === null ? [] : [{
+			characteristic: import_dist.Characteristic.SecuritySystemTargetState,
+			value: target
+		}]],
+		memo: nextMemo,
+		panel: {
+			availableModes: parsed.data.availableModes,
+			requiresCode: parsed.data.requiresCode
+		}
+	};
+}
+async function buildSecuritySystem(bctx) {
+	const { ctx, accessory, proxy, numericDeviceId, displayName } = bctx;
+	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
+	const label = hapServiceName([displayName], `Alarm ${numericDeviceId}`);
+	const service = accessory.addService(import_dist.Service.SecuritySystem, label, SUBTYPE);
+	applyServiceLabel(service, label);
+	let memo = null;
+	let availableModes = [];
+	let requiresCode = false;
+	/** Only log the `validValues` narrowing when it actually changes. */
+	let lastValidValues = "";
+	const applyValidValues = () => {
+		const validValues = targetValidValuesFor(availableModes);
+		if (validValues === null) {
+			if (lastValidValues !== "unconstrained") {
+				lastValidValues = "unconstrained";
+				log.info("export-hap: alarm panel named no arm modes — leaving HomeKit’s targets unconstrained", { meta: { subtype: SUBTYPE } });
+			}
+			return;
+		}
+		const key = validValues.join(",");
+		if (key === lastValidValues) return;
+		lastValidValues = key;
+		service.getCharacteristic(import_dist.Characteristic.SecuritySystemTargetState).setProps({ validValues: [...validValues] });
+		log.info("export-hap: alarm panel target constrained to the modes it accepts", { meta: {
+			subtype: SUBTYPE,
+			availableModes: [...availableModes],
+			validValues
+		} });
+	};
+	const apply = (status, source) => {
+		const next = securityUpdatesFor(status, memo);
+		if (next.updates.length === 0) {
+			log.debug("export-hap: alarm panel status did not match the cap schema — no update", { meta: {
+				subtype: SUBTYPE,
+				source
+			} });
+			return;
+		}
+		memo = next.memo;
+		if (next.panel !== null) {
+			availableModes = next.panel.availableModes;
+			requiresCode = next.panel.requiresCode;
+			applyValidValues();
+		}
+		applyUpdates(service, next.updates);
+	};
+	try {
+		const status = await proxy.alarmPanel?.getStatus({});
+		if (status !== void 0 && status !== null) apply(status, "getStatus");
+	} catch (err) {
+		log.debug("export-hap: alarm panel getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$3(err) } });
+	}
+	service.getCharacteristic(import_dist.Characteristic.SecuritySystemTargetState).onSet(async (value) => {
+		const target = typeof value === "number" ? value : Number(value);
+		const disarm = target === import_dist.Characteristic.SecuritySystemTargetState.DISARM;
+		const mode = disarm ? null : armModeForTarget(target, availableModes);
+		if (requiresCode) {
+			log.warn("export-hap: alarm panel requires a PIN — HomeKit cannot supply one, command REFUSED", { meta: {
+				subtype: SUBTYPE,
+				command: disarm ? "disarm" : "arm",
+				mode,
+				target
+			} });
+			throw new import_dist.HapStatusError(import_dist.HAPStatus.INSUFFICIENT_AUTHORIZATION);
+		}
+		if (!disarm && mode === null) {
+			log.warn("export-hap: alarm panel cannot honour this HomeKit arm target — REFUSED", { meta: {
+				subtype: SUBTYPE,
+				target,
+				availableModes: [...availableModes]
+			} });
+			throw new import_dist.HapStatusError(import_dist.HAPStatus.INVALID_VALUE_IN_REQUEST);
+		}
+		try {
+			if (mode === null) await proxy.alarmPanel?.disarm({});
+			else await proxy.alarmPanel?.arm({ mode });
+		} catch (err) {
+			log.warn("export-hap: alarm panel command failed", { meta: {
+				subtype: SUBTYPE,
+				command: mode === null ? "disarm" : "arm",
+				mode,
+				error: errMsg$3(err)
+			} });
+			throw new import_dist.HapStatusError(import_dist.HAPStatus.SERVICE_COMMUNICATION_FAILURE);
+		}
+	});
+	const unsubscribe = proxy.state.alarmPanel?.subscribe((value) => {
+		if (value === void 0 || value === null) return;
+		apply(value, "slice");
+	}) ?? null;
+	return { async dispose() {
+		try {
+			unsubscribe?.();
+		} catch {}
+	} };
+}
 function errMsg$3(err) {
 	return err instanceof Error ? err.message : String(err);
 }
@@ -101688,11 +102353,16 @@ function errMsg$2(err) {
 *
 * ## Tier
 *
-* Tier A only: the caps whose HomeKit service exists today and needs no
-* feature-dependent shape (`cover` needs `cover-positionable`, `climate-control`
-* needs the dual-setpoint split, `alarm-panel` must survive a refused `arm`).
-* Those are a separate task; adding a row here must never mean adding a service
-* whose semantics this file cannot fully honour.
+* Tier A, plus `alarm-panel`: the caps whose HomeKit service exists today and
+* needs no feature-dependent shape. `cover` still needs `cover-positionable`
+* and `climate-control` the dual-setpoint split; those are a separate task,
+* and adding a row here must never mean adding a service whose semantics this
+* file cannot fully honour.
+*
+* `alarm-panel` earned its row by answering the two questions that kept it
+* out: a target the panel would refuse is never offered (`availableModes` →
+* `validValues`, `security-target.ts`) and an arm a PIN-gated panel cannot
+* accept is refused out loud rather than attempted (`security-system.ts`).
 */
 /** HomeKit's floor for `CurrentAmbientLightLevel`; 0 lux is out of range. */
 var MIN_LUX = 1e-4;
@@ -101834,6 +102504,14 @@ var HAP_CAP_SERVICES = [
 			displayName: name
 		})
 	},
+	{
+		caps: ["alarm-panel"],
+		label: "Alarm",
+		build: ({ bctx, name }) => buildSecuritySystem({
+			...bctx,
+			displayName: name
+		})
+	},
 	{
 		caps: ["battery"],
 		label: BATTERY_SPEC.label,
@@ -101871,7 +102549,8 @@ var ACCESSORY_CATEGORY_BY_TYPE = {
 	[DeviceType.Siren]: import_dist.Categories.SWITCH,
 	[DeviceType.Lock]: import_dist.Categories.DOOR_LOCK,
 	[DeviceType.Sensor]: import_dist.Categories.SENSOR,
-	[DeviceType.Presence]: import_dist.Categories.SENSOR
+	[DeviceType.Presence]: import_dist.Categories.SENSOR,
+	[DeviceType.AlarmPanel]: import_dist.Categories.SECURITY_SYSTEM
 };
 function accessoryCategoryFor(deviceType) {
 	return ACCESSORY_CATEGORY_BY_TYPE[deviceType] ?? import_dist.Categories.OTHER;
@@ -102256,6 +102935,12 @@ var ExportHapAddon = class extends BaseAddon {
 	* hardware init.
 	*/
 	decodeMemos = createHapDecodeMemos();
+	/**
+	* THE bridge. Lazily created and published the first time a non-camera
+	* accessory needs it; never torn down while the addon runs, because an
+	* unpublish would drop a pairing the operator already entered a code for.
+	*/
+	bridgeHost = null;
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
 	}
@@ -102263,6 +102948,13 @@ var ExportHapAddon = class extends BaseAddon {
 		const identity = await this.ensureIdentity();
 		this.pincode = identity.pincode;
 		this.bind = this.config.interfaceName || void 0;
+		this.bridgeHost = new BridgeHost({
+			displayName: this.config.bridgeName,
+			uuid: identity.uuid,
+			pincode: identity.pincode,
+			bind: this.bind,
+			logger: this.ctx.logger
+		});
 		try {
 			await initHapStorage(path.join(this.ctx.dataDir, "hap-store"));
 		} catch (err) {
@@ -102291,6 +102983,7 @@ var ExportHapAddon = class extends BaseAddon {
 		}
 		this.ctx.addDisposer(async () => {
 			await this.detachAll();
+			await this.bridgeHost?.dispose();
 		});
 		this.subscribeDeviceProvisionedForReconcile();
 		this.subscribeDeviceReadyForReconcile();
@@ -102447,16 +103140,24 @@ var ExportHapAddon = class extends BaseAddon {
 				decodeMemos: this.decodeMemos,
 				hapDeviceSettings: {
 					streamPreference: entrySettings.streamPreference ?? "auto",
-					hksvRecording: resolveHksvRecording(entrySettings)
+					hksvRecording: resolveHksvRecording(entrySettings),
+					allowTranscode: entrySettings.allowTranscode !== false
 				}
 			}
 		});
-		for (const accessory of mapper.accessories) await publishStandalone(accessory, {
-			pincode: this.pincode,
-			port: 0,
-			bind: this.bind,
-			logger: this.ctx.logger
+		const wantsBridge = shouldBridge({
+			mapperKind: entry.mapperKind,
+			useBridge: entry.settings?.useBridge
 		});
+		for (const accessory of mapper.accessories) {
+			if (wantsBridge && this.bridgeHost !== null && await this.bridgeHost.add(accessory)) continue;
+			await publishStandalone(accessory, {
+				pincode: this.pincode,
+				port: 0,
+				bind: this.bind,
+				logger: this.ctx.logger
+			});
+		}
 		this.exposed.set(entry.deviceId, mapper);
 		return { childAccessoryUuids: [] };
 	}
@@ -102469,7 +103170,13 @@ var ExportHapAddon = class extends BaseAddon {
 		const mapper = this.exposed.get(deviceId);
 		if (!mapper) return;
 		this.exposed.delete(deviceId);
-		for (const accessory of mapper.accessories) await unpublishAccessory(accessory, this.ctx.logger);
+		for (const accessory of mapper.accessories) {
+			if (this.bridgeHost?.holds(accessory) === true) {
+				this.bridgeHost.remove(accessory);
+				continue;
+			}
+			await unpublishAccessory(accessory, this.ctx.logger);
+		}
 		await mapper.dispose().catch((err) => {
 			this.ctx.logger.withTags({ deviceId: Number.parseInt(deviceId, 10) }).warn("export-hap: mapper dispose failed", { meta: { error: errMsg(err) } });
 		});
@@ -102764,42 +103471,79 @@ var ExportHapAddon = class extends BaseAddon {
 		const enabledKey = `hap:${deviceId}:enabled`;
 		const streamPreferenceKey = `hap:${deviceId}:streamPreference`;
 		const hksvKey = `hap:${deviceId}:hksvRecording`;
+		const useBridgeKey = `hap:${deviceId}:useBridge`;
+		const allowTranscodeKey = `hap:${deviceId}:allowTranscode`;
 		const mapper = this.exposed.get(String(deviceId)) ?? null;
 		const paired = mapper ? accessoryPaired(mapper.accessory) : false;
+		const bridged = mapper !== null && this.bridgeHost?.holds(mapper.accessory) === true;
 		const name = entry?.displayName ?? `Device ${deviceId}`;
-		const statusLabel = !enabled ? "Not exposed" : paired ? `Paired — exposed as “${name}”` : `Exposed as “${name}” — not paired yet. In iOS Home: + → Add Accessory → “${name}”, then enter setup code ${this.config.identity.pincode}.`;
+		const bridgePaired = this.bridgeHost?.accessory !== null && this.bridgeHost?.accessory !== void 0 ? accessoryPaired(this.bridgeHost.accessory) : false;
+		const statusLabel = !enabled ? "Not exposed" : bridged ? bridgePaired ? `On the “${this.config.bridgeName}” bridge, as “${name}”` : `On the “${this.config.bridgeName}” bridge, as “${name}” — the BRIDGE is not paired yet. In iOS Home: + → Add Accessory → “${this.config.bridgeName}”, then enter setup code ${this.config.identity.pincode}. Every bridged device arrives with it.` : paired ? `Paired — exposed as “${name}”` : `Exposed as “${name}” — not paired yet. In iOS Home: + → Add Accessory → “${name}”, then enter setup code ${this.config.identity.pincode}.`;
+		const qrSource = bridged ? this.bridgeHost?.accessory ?? null : mapper?.accessory ?? null;
 		let qrValue = "";
-		if (mapper) try {
-			qrValue = mapper.accessory.setupURI();
+		if (qrSource) try {
+			qrValue = qrSource.setupURI();
 		} catch (err) {
 			this.ctx.logger.withTags({ deviceId }).debug("export-hap: setupURI failed for per-device contribution", { meta: { error: errMsg(err) } });
 		}
-		const cameraFields = kind !== "camera" ? [] : [{
-			type: "select",
-			key: streamPreferenceKey,
-			label: "Source stream (HomeKit)",
-			description: "Which camstack profile slot HomeKit pulls. Auto = the broker picks the slot closest to 1080p at session start.",
-			options: HAP_STREAM_PREFERENCE_OPTIONS,
-			required: true,
-			value: settings.streamPreference,
-			showWhen: {
-				field: enabledKey,
-				equals: true
-			},
-			immediate: true
-		}, {
+		const bridgeFields = kind === "camera" ? [] : [{
 			type: "boolean",
-			key: hksvKey,
-			label: "HomeKit recording (Secure Video)",
-			description: "Offer “Stream and Allow Recording” in iOS Home. Requires iCloud+ and a home hub. Keeps a continuous 8s prebuffer for this camera (~0.7% of one CPU core, H.264 sources only).",
+			key: useBridgeKey,
+			label: "Export through the bridge",
+			description: "Publish this device inside the shared CamStack bridge — one pairing and one entry in Add Accessory for every non-camera device, instead of one each. Turning this off gives it its own advertisement. Either way the switch REBUILDS the accessory and it must be added to the Home app again.",
 			style: "switch",
-			value: resolveHksvRecording(settings),
+			value: shouldBridge({
+				mapperKind: kind,
+				useBridge: settings.useBridge
+			}),
 			showWhen: {
 				field: enabledKey,
 				equals: true
 			},
 			immediate: true
 		}];
+		const cameraFields = kind !== "camera" ? [] : [
+			{
+				type: "select",
+				key: streamPreferenceKey,
+				label: "Source stream (HomeKit)",
+				description: "Which camstack profile slot HomeKit pulls. Auto = the broker picks the slot closest to 1080p at session start.",
+				options: HAP_STREAM_PREFERENCE_OPTIONS,
+				required: true,
+				value: settings.streamPreference,
+				showWhen: {
+					field: enabledKey,
+					equals: true
+				},
+				immediate: true
+			},
+			{
+				type: "boolean",
+				key: hksvKey,
+				label: "HomeKit recording (Secure Video)",
+				description: "Offer “Stream and Allow Recording” in iOS Home. Requires iCloud+ and a home hub. Keeps a continuous 8s prebuffer for this camera (~0.7% of one CPU core, H.264 sources only).",
+				style: "switch",
+				value: resolveHksvRecording(settings),
+				showWhen: {
+					field: enabledKey,
+					equals: true
+				},
+				immediate: true
+			},
+			{
+				type: "boolean",
+				key: allowTranscodeKey,
+				label: "Allow transcoding for HomeKit",
+				description: "Let the hub re-encode this camera when the resolution HomeKit negotiated cannot be served by a direct copy. Off means only a stream that can be forwarded as-is is offered — cheaper, but a session HomeKit negotiates outside what the camera publishes will be refused instead of transcoded.",
+				style: "switch",
+				value: settings.allowTranscode !== false,
+				showWhen: {
+					field: enabledKey,
+					equals: true
+				},
+				immediate: true
+			}
+		];
 		return {
 			tabs: [{
 				id: "export",
@@ -102844,6 +103588,7 @@ var ExportHapAddon = class extends BaseAddon {
 						value: enabled,
 						immediate: true
 					},
+					...bridgeFields,
 					...cameraFields
 				]
 			}]
@@ -102869,14 +103614,20 @@ var ExportHapAddon = class extends BaseAddon {
 		const enabledKey = `hap:${deviceId}:enabled`;
 		const streamPreferenceKey = `hap:${deviceId}:streamPreference`;
 		const hksvKey = `hap:${deviceId}:hksvRecording`;
+		const useBridgeKey = `hap:${deviceId}:useBridge`;
+		const allowTranscodeKey = `hap:${deviceId}:allowTranscode`;
 		const enabledValue = enabledKey in patch ? Boolean(patch[enabledKey]) : wasEnabled;
 		const streamPreferenceRaw = streamPreferenceKey in patch ? patch[streamPreferenceKey] : current?.settings?.streamPreference;
 		const streamPreference = typeof streamPreferenceRaw === "string" && streamPreferenceRaw.trim().length > 0 ? streamPreferenceRaw : "auto";
 		const hksvRecording = hksvKey in patch ? Boolean(patch[hksvKey]) : resolveHksvRecording(current?.settings);
+		const useBridge = useBridgeKey in patch ? Boolean(patch[useBridgeKey]) : current?.settings?.useBridge !== false;
+		const allowTranscode = allowTranscodeKey in patch ? Boolean(patch[allowTranscodeKey]) : current?.settings?.allowTranscode !== false;
 		const nextSettings = {
 			...current?.settings ?? DEFAULT_DEVICE_SETTINGS,
 			streamPreference,
-			hksvRecording
+			hksvRecording,
+			useBridge,
+			allowTranscode
 		};
 		if (!enabledValue) {
 			if (wasEnabled) await this.unexposeDevice(deviceIdStr);
@@ -102889,8 +103640,17 @@ var ExportHapAddon = class extends BaseAddon {
 		}
 		const currentPref = current?.settings?.streamPreference ?? "auto";
 		const currentHksv = resolveHksvRecording(current?.settings);
+		const mapperKind = current?.mapperKind ?? "generic";
+		const wasBridged = shouldBridge({
+			mapperKind,
+			useBridge: current?.settings?.useBridge
+		});
+		const willBridge = shouldBridge({
+			mapperKind,
+			useBridge
+		});
 		await this.updateEntrySettings(deviceIdStr, nextSettings);
-		if (currentPref !== streamPreference || currentHksv !== hksvRecording) {
+		if (currentPref !== streamPreference || currentHksv !== hksvRecording || wasBridged !== willBridge) {
 			log.info("export-hap: per-camera export settings changed — refreshing accessory", { meta: {
 				streamPreference: {
 					from: currentPref,
@@ -102899,10 +103659,14 @@ var ExportHapAddon = class extends BaseAddon {
 				hksvRecording: {
 					from: currentHksv,
 					to: hksvRecording
+				},
+				bridged: {
+					from: wasBridged,
+					to: willBridge
 				}
 			} });
 			try {
-				await this.unexposeDevice(deviceIdStr, { clearPairing: false });
+				await this.unexposeDevice(deviceIdStr, { clearPairing: wasBridged !== willBridge });
 				await this.exposeDevice(deviceIdStr);
 			} catch (err) {
 				log.warn("export-hap: failed to refresh accessory after a settings change", { meta: { error: errMsg(err) } });