@camstack/addon-export-hap 1.2.118 → 1.2.120

package/dist/hap-export.addon.js

@@ -1081,7 +1081,7 @@ function partial(Class, schema, mask) {
 		checks: []
 	}));
 }
-function required(Class, schema, mask) {
+function required$2(Class, schema, mask) {
 	return clone(schema, mergeDefs(schema._zod.def, { get shape() {
 		const oldShape = schema._zod.def.shape;
 		const shape = { ...oldShape };
@@ -1339,7 +1339,7 @@ var guid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-
 /** Returns a regex for validating an RFC 9562/4122 UUID.
 *
 * @param version Optionally specify a version 1-8. If no version is specified, all versions are supported. */
-var uuid$1 = (version) => {
+var uuid$3 = (version) => {
 	if (!version) return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
 	return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
 };
@@ -1909,8 +1909,8 @@ var $ZodUUID = /*@__PURE__*/ $constructor("$ZodUUID", (inst, def) => {
 			v8: 8
 		}[def.version];
 		if (v === void 0) throw new Error(`Invalid UUID version: "${def.version}"`);
-		def.pattern ?? (def.pattern = uuid$1(v));
-	} else def.pattern ?? (def.pattern = uuid$1());
+		def.pattern ?? (def.pattern = uuid$3(v));
+	} else def.pattern ?? (def.pattern = uuid$3());
 	$ZodStringFormat.init(inst, def);
 });
 var $ZodEmail = /*@__PURE__*/ $constructor("$ZodEmail", (inst, def) => {
@@ -4487,8 +4487,8 @@ var parse = /* @__PURE__ */ _parse(ZodRealError);
 var parseAsync = /* @__PURE__ */ _parseAsync(ZodRealError);
 var safeParse = /* @__PURE__ */ _safeParse(ZodRealError);
 var safeParseAsync = /* @__PURE__ */ _safeParseAsync(ZodRealError);
-var encode = /* @__PURE__ */ _encode(ZodRealError);
-var decode = /* @__PURE__ */ _decode(ZodRealError);
+var encode$5 = /* @__PURE__ */ _encode(ZodRealError);
+var decode$2 = /* @__PURE__ */ _decode(ZodRealError);
 var encodeAsync = /* @__PURE__ */ _encodeAsync(ZodRealError);
 var decodeAsync = /* @__PURE__ */ _decodeAsync(ZodRealError);
 var safeEncode = /* @__PURE__ */ _safeEncode(ZodRealError);
@@ -4548,8 +4548,8 @@ var ZodType = /*@__PURE__*/ $constructor("ZodType", (inst, def) => {
 	inst.parseAsync = async (data, params) => parseAsync(inst, data, params, { callee: inst.parseAsync });
 	inst.safeParseAsync = async (data, params) => safeParseAsync(inst, data, params);
 	inst.spa = inst.safeParseAsync;
-	inst.encode = (data, params) => encode(inst, data, params);
-	inst.decode = (data, params) => decode(inst, data, params);
+	inst.encode = (data, params) => encode$5(inst, data, params);
+	inst.decode = (data, params) => decode$2(inst, data, params);
 	inst.encodeAsync = async (data, params) => encodeAsync(inst, data, params);
 	inst.decodeAsync = async (data, params) => decodeAsync(inst, data, params);
 	inst.safeEncode = (data, params) => safeEncode(inst, data, params);
@@ -5055,7 +5055,7 @@ var ZodObject = /*@__PURE__*/ $constructor("ZodObject", (inst, def) => {
 			return partial(ZodOptional, this, args[0]);
 		},
 		required(...args) {
-			return required(ZodNonOptional, this, args[0]);
+			return required$2(ZodNonOptional, this, args[0]);
 		}
 	});
 });
@@ -13040,7 +13040,23 @@ var PickStreamRequirementsSchema = object({
 	* This is what lets one picker serve both the bypass and the full source
 	* choice, instead of a consumer scoring privately when the bypass misses.
 	*/
-	allowTranscode: boolean().optional()
+	allowTranscode: boolean().optional(),
+	/**
+	* Consider ONLY streams the broker has bound to a profile slot.
+	*
+	* A consumer that dials the broker — which is every exporter, since none
+	* of them may open the camera's own URL — can do nothing with a source
+	* that has no slot: there is no restream to dial. Without this the picker
+	* can name such a stream, and each consumer discovers the dead end for
+	* itself: Alexa's `profileForCamStream` returns `null` and it quietly
+	* falls back, and HomeKit would have had to grow the same function again.
+	*
+	* Default `false`, and deliberately so: the BROKER itself picks through
+	* here when it decides which source to BIND to a slot
+	* (`computeInitialAssignment`), and it must see the unbound ones or it
+	* could never bind them.
+	*/
+	requireProfileBound: boolean().optional()
 }).readonly();
 var PickStreamPreferencesSchema = object({
 	/**
@@ -13081,7 +13097,43 @@ var PickedCamStreamSchema = object({
 	*/
 	transcodes: boolean(),
 	/** One-line explanation of why this stream won — for logs / debug UI. */
-	reason: string()
+	reason: string(),
+	/**
+	* The broker profile slot this source is bound to, when it is bound.
+	*
+	* Answered HERE because every consumer needs it and none of them can get it
+	* from the `camStreamId` alone. Alexa wrote `profileForCamStream` for it —
+	* a second cap read plus a `null` branch — and HomeKit was about to write
+	* the same function a second time.
+	*
+	* Absent when the source has no slot, which a caller passing
+	* `requireProfileBound` can never see.
+	*/
+	profile: CamProfileSchema.optional(),
+	/** The broker id of that slot, for logs that must name what was dialled. */
+	brokerId: string().optional(),
+	/**
+	* The broker restream URL to dial for this stream.
+	*
+	* An exporter must never open the camera's own URL — the broker is the one
+	* that dials the camera, and every consumer goes through its restream. So
+	* the picker answers with the thing a consumer may actually use, instead of
+	* naming a source and leaving each caller to look the URL up.
+	*/
+	url: string().optional(),
+	/**
+	* Frames per second this stream really delivers, and where the number came
+	* from.
+	*
+	* It is here because getting it wrong is expensive and silent: a HomeKit
+	* accessory advertised 720p at 24 fps while the slot serving it ran at 9,
+	* and the controller rendered nothing at all. The source is carried with the
+	* value for the same reason the bitrate evidence is: `published` is what the
+	* publisher declares and `measured` is what the broker observed, and they
+	* are not interchangeable.
+	*/
+	fps: number().positive().optional(),
+	fpsSource: _enum(["published", "measured"]).optional()
 });
 DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), array(CameraStreamSchema).readonly()), method(object({ deviceId: number().int().nonnegative() }), array(ProfileSlotSchema).readonly()), method(object({
 	deviceId: number().int().nonnegative(),
@@ -14136,6 +14188,70 @@ var LocationIconAssignmentSchema = object({
 	locationKey: string(),
 	icon: LocationIconIdSchema
 });
+/**
+* One (location, description) assignment as it travels.
+*
+* Same key discipline as {@link LocationIconAssignmentSchema}, and for the same
+* reason: this lived for a while in the post-analysis addon's own settings,
+* keyed by a HAND-TYPED label matched exactly and case-sensitively. A rename in
+* the Locations page carried the icon and silently orphaned the description —
+* two authorities for one thing, joined by two different rules. Now both hang
+* off the location itself, on `locationIconKey`.
+*/
+var LocationDescriptionAssignmentSchema = object({
+	locationKey: string(),
+	description: string()
+});
+/**
+* A SITE ZONE — a named part of the property that several locations belong to.
+*
+* "Zona notte" holds every bedroom; "Zona giorno" the living room and the
+* kitchen. A camera belongs to exactly one location, and a location to at most
+* one zone, so a camera's zone is derived and never stored on the device: the
+* whole point of this entity is that grouping rooms touches no device row.
+*
+* ## Why not `zone`
+*
+* Because `zone` is already the most loaded word in this product: 612 source
+* files and 24 Italian strings where it means a DETECTION zone drawn on a
+* camera. The two are unrelated — one is a polygon in a frame, the other is a
+* set of rooms — and a reader who confuses them will look for a camera's
+* bedrooms. So the code says `siteZone` everywhere, and the UI frees the plain
+* word by calling the drawn one what it actually is: a detection zone.
+*
+* ## The key
+*
+* `siteZoneKey(label)` — trimmed, lower-cased, the SAME derivation locations
+* use (`locationIconKey`). Membership and the icon both hang off it, so a
+* case-only rename keeps them, which is exactly the orphaning that cost us a
+* silently-dropped location description.
+*
+* The icon vocabulary is the location one, unchanged: a zone is drawn on the
+* same two surfaces by the same glyph map, so a second vocabulary would be a
+* second thing to keep drawable (`scripts/check-location-icons-drawable.ts`).
+*/
+/**
+* One zone as it travels: its key, the label the operator typed, its icon and
+* the locations inside it.
+*
+* The LABEL is carried alongside the key because the key is lossy on purpose —
+* a surface must show "Zona notte", not "zona notte". Locations are carried
+* here, rather than left to a second call, because every consumer wants both
+* at once and a viewer that asked twice could render a zone whose membership
+* it has not fetched yet.
+*
+* `icon: null` means nobody chose one, which is NOT the fallback pin: only one
+* of those two is a choice, and a picker has to draw them differently.
+*/
+var SiteZoneSchema = object({
+	zoneKey: string(),
+	label: string(),
+	icon: LocationIconIdSchema.nullable(),
+	/** Folded location keys, sorted. A location listed here need not be
+	*  REGISTERED — devices carry labels nobody registered, and those rooms are
+	*  the ones that most want grouping. */
+	locationKeys: array(string())
+});
 var ProviderStatusSchema = object({
 	connected: boolean(),
 	deviceCount: number(),
@@ -14653,6 +14769,33 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(_void(), array(LocationDescriptionAssignmentSchema)), method(object({
+	location: string(),
+	description: string().max(400).nullable()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), array(SiteZoneSchema)), method(object({
+	name: string(),
+	icon: LocationIconIdSchema.nullable().optional()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ name: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	from: string(),
+	to: string()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	location: string(),
+	zone: string().nullable()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	disabled: boolean()
@@ -33537,6 +33680,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.listLocationDescriptions": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.listLocationIcons": {
 		capName: "device-manager",
 		capScope: "system",
@@ -33555,6 +33704,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.listSiteZones": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.listWrappersForCap": {
 		capName: "device-manager",
 		capScope: "system",
@@ -33639,12 +33794,24 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"deviceManager.removeSiteZone": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"deviceManager.renameLocation": {
 		capName: "device-manager",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.renameSiteZone": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.runDeviceAction": {
 		capName: "device-manager",
 		capScope: "system",
@@ -33687,12 +33854,24 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.setLocationDescription": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.setLocationIcon": {
 		capName: "device-manager",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.setLocationZone": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.setMetadata": {
 		capName: "device-manager",
 		capScope: "system",
@@ -33723,6 +33902,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.setSiteZone": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.setStreamProfileMap": {
 		capName: "device-manager",
 		capScope: "system",
@@ -49770,7 +49955,7 @@ var require_hkdf = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* limitations under the License.
 	*/
 	var { Buffer: Buffer$2 } = require("buffer");
-	var { createHash: createHash$1, createHmac } = require("crypto");
+	var { createHash: createHash$2, createHmac } = require("crypto");
 	var g_digestLenCache = {};
 	/**
 	* Get expected hash length.
@@ -49799,7 +49984,7 @@ var require_hkdf = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			default: {
 				let len = g_digestLenCache[hash];
 				if (len === void 0) {
-					len = createHash$1(hash).digest().length;
+					len = createHash$2(hash).digest().length;
 					g_digestLenCache[hash] = len;
 				}
 				return len;
@@ -97908,6 +98093,239 @@ function slotForConnection(connection) {
 	}
 }
 //#endregion
+//#region src/multi-tier/video-stream-tiers.ts
+/**
+* The `Supported Video Stream Tiers` TLV8 — the characteristic through which an
+* accessory offers HEVC and 4K to HomeKit.
+*
+* ## Where this comes from
+*
+* Apple's *HomeKit Secure Video Open Source Compatibility Guide* (Developer
+* Preview, 2026-06-03). It defines TWO new streaming services beside the one
+* this addon uses today:
+*
+*  - `camera-multi-tier-rtp-stream-management` (0x8031) — still RTP, which is
+*    the plumbing we already have, and the reason this file exists at all.
+*  - `camera-webrtc-stream-management` (0x8033) — a different transport.
+*
+* Both advertise their capability with this TLV. Recording moves separately to
+* CMAF ingest (0x8000 + a client-certificate provisioning flow at 0x8080), and
+* is NOT in scope here: the certificate dance belongs to ingest, not to live
+* streaming, which is what makes the live path the tractable half.
+*
+* ## Why we write this ourselves rather than patching the library
+*
+* `@homebridge/hap-nodejs@2.1.7` models none of it — its `VideoCodecType` has
+* one member, `H264 = 0`, and the new specification numbers H.264 as **1**. It
+* is not the same enumeration, so there is nothing here to extend. But nothing
+* needs patching either: `Service` and `Characteristic` take arbitrary UUIDs,
+* `Accessory.addService` validates only for duplicates and a count, and the
+* `Controller` interface is public. So this is an EXTENSION, not a fork —
+* nothing to rebase when the library moves.
+*
+* Pure bytes in, pure bytes out. No accessory, no service, no I/O: the wire
+* format is the part a test can hold still.
+*/
+/** Video codec, as the NEW specification numbers it. Deliberately not the
+*  library's `VideoCodecType`, whose `H264` is `0`. */
+var TierVideoCodec = /* @__PURE__ */ function(TierVideoCodec) {
+	TierVideoCodec[TierVideoCodec["H264"] = 1] = "H264";
+	TierVideoCodec[TierVideoCodec["H265"] = 2] = "H265";
+	return TierVideoCodec;
+}({});
+/**
+* Quality tier.
+*
+* `HIGHEST` is not "even better than HIGH": the guide reserves it for the 4K
+* stream of a camera that offers a 2K stream AT THE SAME TIME, and says a
+* camera that cannot do both should not use the value. Encoding it without that
+* capability advertises a camera we do not have.
+*/
+var TierQuality = /* @__PURE__ */ function(TierQuality) {
+	TierQuality[TierQuality["HIGHEST"] = 1] = "HIGHEST";
+	TierQuality[TierQuality["HIGH"] = 2] = "HIGH";
+	TierQuality[TierQuality["MEDIUM"] = 3] = "MEDIUM";
+	TierQuality[TierQuality["LOW"] = 4] = "LOW";
+	return TierQuality;
+}({});
+function uint8$2(value) {
+	const b = Buffer.alloc(1);
+	b.writeUInt8(value, 0);
+	return b;
+}
+function uint16$2(value) {
+	const b = Buffer.alloc(2);
+	b.writeUInt16LE(value, 0);
+	return b;
+}
+function uint32$3(value) {
+	const b = Buffer.alloc(4);
+	b.writeUInt32LE(value, 0);
+	return b;
+}
+/** One tier, as its own TLV8 blob. */
+function encodeVideoStreamTier(tier) {
+	return (0, import_dist.encode)(1, uint32$3(tier.identifier), 2, uint8$2(tier.quality), 3, uint32$3(tier.targetAverageBitrateKbps), 4, uint16$2(tier.width), 5, uint16$2(tier.height), 6, uint8$2(tier.frameRate));
+}
+/**
+* The whole characteristic value.
+*
+* The tier list is REPEATED — one TLV of type 3 per tier — and repetition is
+* how HAP carries a list. Emitting one blob with the tiers concatenated inside
+* would decode as a single unreadable tier.
+*/
+function encodeVideoStreamConfiguration(config) {
+	return (0, import_dist.encode)(1, uint8$2(config.codec), 2, uint8$2(config.payloadType), 3, config.tiers.map(encodeVideoStreamTier));
+}
+//#endregion
+//#region src/multi-tier/tiers-for-sensor.ts
+/**
+* Which tiers a camera is allowed to claim.
+*
+* Derived from the sensor, never assumed: a 1080p camera that advertises 4K is
+* telling the controller it can do something it cannot, and that surfaces as a
+* stream which never starts rather than as a refusal anyone can read.
+*
+* ## The table is the specification, not a suggestion
+*
+* § 2 *Minimum Requirements*: *"The accessory must support at least three
+* concurrent video encodings on each sensor"*, and for 16:9 it names them:
+*
+* |            | 4K camera | 2K camera | 1080p camera |
+* | ---------- | --------- | --------- | ------------ |
+* | **High**   | 3840x2160 | 2560x1440 | 1920x1080    |
+* | **Medium** | 1920x1080 | 1920x1080 | 1280x720     |
+* | **Low**    | 640x360   | 640x360   | 640x360      |
+*
+* The first version of this file built the list by pushing 1080p and 360p onto
+* whatever big tier applied, which is right for 4K and 2K and produces only
+* TWO tiers for a 1080p camera — its medium is 720p, and nothing emitted it.
+* Writing the table out means the 1080p column cannot be an afterthought.
+*
+* A tier's MEDIUM resolution can exceed what the camera publishes natively —
+* a 4K camera whose middle stream is 720p still owes a 1080p tier. That is the
+* specification's demand, not ours, and it is a demand on the ENCODER rather
+* than on the sensor.
+*
+* `HIGHEST` is never emitted: the guide reserves it for a 4K camera that also
+* serves 2K SIMULTANEOUSLY, and we cannot prove we do.
+*/
+/**
+* Target average and MAXIMUM bitrate per resolution, § 2.
+*
+* The maxima are the reason this is a table and not a multiplier. A peak
+* computed as average × 1.1 reads as "the 10% gap the guide recommends", and it
+* overshoots three of these five rows — 1080p would claim 1870 against a
+* ceiling of 1800, and *"maximum bitrates should not be exceeded"*.
+*/
+var BITRATE_BY_WIDTH = new Map([
+	[3840, {
+		average: 4500,
+		peak: 5e3
+	}],
+	[2560, {
+		average: 2800,
+		peak: 3e3
+	}],
+	[1920, {
+		average: 1700,
+		peak: 1800
+	}],
+	[1280, {
+		average: 768,
+		peak: 800
+	}],
+	[640, {
+		average: 180,
+		peak: 190
+	}]
+]);
+/** The lowest row, for a width the table does not name. Claiming a small
+*  budget for an unexpected size is the safe direction: it under-promises. */
+var FALLBACK_BITRATE = {
+	average: 180,
+	peak: 190
+};
+function bitrateFor(width) {
+	return BITRATE_BY_WIDTH.get(width) ?? FALLBACK_BITRATE;
+}
+function averageBitrateKbpsFor(width) {
+	return bitrateFor(width).average;
+}
+function peakBitrateKbpsFor(width) {
+	return bitrateFor(width).peak;
+}
+/** The three rows of the table, by the column the sensor falls in. */
+function rowsForSensor(width, height) {
+	if (width >= 3840 && height >= 2160) return [
+		{
+			width: 3840,
+			height: 2160,
+			frameRate: 30
+		},
+		{
+			width: 1920,
+			height: 1080,
+			frameRate: 30
+		},
+		{
+			width: 640,
+			height: 360,
+			frameRate: 15
+		}
+	];
+	if (width >= 2560 && height >= 1440) return [
+		{
+			width: 2560,
+			height: 1440,
+			frameRate: 30
+		},
+		{
+			width: 1920,
+			height: 1080,
+			frameRate: 30
+		},
+		{
+			width: 640,
+			height: 360,
+			frameRate: 15
+		}
+	];
+	return [
+		{
+			width: 1920,
+			height: 1080,
+			frameRate: 30
+		},
+		{
+			width: 1280,
+			height: 720,
+			frameRate: 30
+		},
+		{
+			width: 640,
+			height: 360,
+			frameRate: 15
+		}
+	];
+}
+function tiersForSensor(width, height) {
+	const rows = rowsForSensor(width, height);
+	const qualities = [
+		TierQuality.HIGH,
+		TierQuality.MEDIUM,
+		TierQuality.LOW
+	];
+	return rows.map((row, index) => ({
+		identifier: index + 1,
+		quality: qualities[index] ?? TierQuality.LOW,
+		targetAverageBitrateKbps: averageBitrateKbpsFor(row.width),
+		width: row.width,
+		height: row.height,
+		frameRate: row.frameRate
+	}));
+}
+//#endregion
 //#region src/mappers/builders/stream-bitrate.ts
 /**
 * Send a stream that FITS the rate HomeKit negotiated. (R5)
@@ -98020,6 +98438,38 @@ function budgetForNegotiatedRate(negotiatedMaxBitrateKbps) {
 	return budget > 0 ? budget : null;
 }
 /**
+* The rate a TRANSCODE may actually aim at.
+*
+* Measured on the hub, 2026-09-17: two cameras on the same link, both with a
+* negotiated ceiling of 299 kbps. The H.264 one was passed through at **8192
+* kbps** under `over-budget-tolerated`; the H.265 one, which must be
+* re-encoded, was held to **269**. Thirty times less, decided entirely by
+* which branch the camera fell into.
+*
+* That asymmetry contradicts the rule this module already adopted for copy:
+* *"the negotiated ceiling is a budget the controller copes with being
+* exceeded, not a contract that must be met"*, evidenced by a reference NVR
+* doing exactly that. The copy path stopped treating it as a contract and the
+* transcode path did not.
+*
+* So the negotiated budget becomes a FLOOR and the guide's own normative
+* average for the DELIVERED resolution becomes the target (§ 2: 1080p30 →
+* 1700, 720p30 → 768, 360p → 180). Two properties matter:
+*
+*  - it never LOWERS a budget the controller was willing to grant — a
+*    controller asking for more gets more;
+*  - it changes nothing for a relayed session, which negotiates 360p, where
+*    the guide asks less than the controller already granted. Spending an
+*    Apple relay's bandwidth for no picture gain is not an improvement.
+*
+* `null` stays `null`: it means "pass no `-maxrate` at all", and inventing a
+* number here would cap a stream that was deliberately uncapped.
+*/
+function encodeBudgetKbps(input) {
+	if (input.negotiatedBudgetKbps === null) return null;
+	return Math.max(input.negotiatedBudgetKbps, averageBitrateKbpsFor(input.width));
+}
+/**
 * Does this slot fit?
 *
 * Only the CONFIGURED rate can answer yes. The measured rate is a lower bound,
@@ -98050,6 +98500,7 @@ function classifyBitrateFit(evidence, budgetKbps) {
 function selectStreamForBudget(input) {
 	const budgetKbps = budgetForNegotiatedRate(input.negotiatedMaxBitrateKbps);
 	const notes = fitNotes(input.entries, input.bitrates, budgetKbps);
+	const allowHevc = input.allowHevcPassthrough === true;
 	const effectivePref = input.pref === "auto" ? slotForConnection(input.connection) : input.pref;
 	const fallback = pickPreferredRtspEntry(input.entries, effectivePref, input.deviceId, { targetResolution: input.targetResolution });
 	if (fallback === null) return null;
@@ -98061,18 +98512,25 @@ function selectStreamForBudget(input) {
 			budgetKbps: null,
 			notes
 		};
-		return canPassThrough(fallback.codec) ? {
-			kind: "copy",
-			reason: "no-negotiated-budget",
-			...base
-		} : {
+		if (!canPassThrough(fallback.codec, allowHevc)) return {
 			kind: "transcode",
 			reason: "source-codec",
 			...base
 		};
+		if (!fitsRequestedResolution(fallback, input.targetResolution)) return {
+			kind: "transcode",
+			reason: "over-resolution",
+			...base
+		};
+		return {
+			kind: "copy",
+			reason: "no-negotiated-budget",
+			...base
+		};
 	}
 	const affordable = (input.pref !== "auto" && fallbackProfile === input.pref ? input.entries.filter((entry) => entry.profile === fallbackProfile) : input.entries).filter((entry) => {
-		if (!canPassThrough(entry.codec)) return false;
+		if (!canPassThrough(entry.codec, allowHevc)) return false;
+		if (!fitsRequestedResolution(entry, input.targetResolution)) return false;
 		return classifyBitrateFit(input.bitrates.get(entry.profile), budgetKbps) === "fits";
 	});
 	if (affordable.length > 0) {
@@ -98086,7 +98544,7 @@ function selectStreamForBudget(input) {
 			notes
 		};
 	}
-	if (canPassThrough(fallback.codec)) return {
+	if (canPassThrough(fallback.codec, allowHevc) && fitsRequestedResolution(fallback, input.targetResolution)) return {
 		kind: "copy",
 		reason: "over-budget-tolerated",
 		picked: fallback,
@@ -98096,7 +98554,7 @@ function selectStreamForBudget(input) {
 	};
 	return {
 		kind: "transcode",
-		reason: transcodeReason(fallback, fallbackProfile, input.bitrates, budgetKbps),
+		reason: transcodeReason(fallback, fallbackProfile, input.bitrates, budgetKbps, allowHevc, input.targetResolution),
 		picked: fallback,
 		profile: fallbackProfile,
 		budgetKbps,
@@ -98150,11 +98608,57 @@ function withSlotCodecs(entries, slots) {
 * two load-bearing flags below back in play, with no hardware here to prove
 * they still hold. Hardware DECODE is where the measured cost is.
 */
+/**
+* The least this encoder can be given per pixel and still produce a picture a
+* decoder will lock onto.
+*
+* Not a quality target — a DECODABILITY one. The encode is pinned to
+* `ultrafast` + `zerolatency` + `baseline`, the three settings that trade
+* compression efficiency away for latency, so it needs more bits than a
+* default encoder would, not fewer.
+*
+* `0.03` is not invented: it is what the 269 kbps / 720p fixture this module
+* was tuned against works out to AT 10 FPS, which is the rate that fixture
+* dials and the rate the earlier overshoot fix was measured at.
+*/
+var MIN_BITS_PER_PIXEL = .03;
+/**
+* The highest frame rate this budget can carry at this picture size.
+*
+* ## Why the FPS gives and not the bitrate
+*
+* The obvious move is to lift the bitrate until the picture is decodable. This
+* module already refused that once, for a reason recorded in its tests: an
+* encoder overshooting its ceiling (421 kbps against 299 negotiated) produced
+* three seconds of jitter, and the one-second VBV window is the only lever
+* there is on it. Raising the ceiling would buy a decodable picture and pay
+* for it in the exact currency that incident was about.
+*
+* So the ceiling holds and the frame rate gives way. A stream at 10 fps that
+* DECODES beats one at 30 fps that does not — and the controller never asked
+* for 30 in particular; it asked for a ceiling and a maximum rate.
+*
+* ## The measurement behind it
+*
+* Operator, 2026-09-16: the one H.265 camera shows a loader in the Home app,
+* the three H.264 ones are fine. H.264 is pass-through, H.265 is transcode.
+* Same controller, same 299 kbps ceiling: pass-through delivered 714 video
+* packets/s and worked; the transcode delivered 66 and produced a loader with
+* a `decode-suspect` verdict, three sessions running. It was encoding 1280x720
+* at 30 fps into 269 kbps — about 0.01 bits per pixel, a third of what the
+* fixture this was tuned on gets.
+*/
+function fpsForBudget(budgetKbps, width, height, requestedFps) {
+	const pixels = Math.max(1, width) * Math.max(1, height);
+	const affordableFps = Math.round(budgetKbps * 1e3 / (pixels * MIN_BITS_PER_PIXEL));
+	return Math.max(1, Math.min(requestedFps, affordableFps));
+}
 function buildVideoPlan(input) {
 	if (!input.transcode) return {
 		kind: "copy",
 		bitstreamFilter: "dump_extra"
 	};
+	const deliveredFps = input.budgetKbps === null ? input.fps : fpsForBudget(input.budgetKbps, input.width, input.height, input.fps);
 	return {
 		kind: "encode",
 		encoder: "libx264",
@@ -98165,11 +98669,12 @@ function buildVideoPlan(input) {
 		},
 		preset: "ultrafast",
 		tune: "zerolatency",
-		profile: "baseline",
-		level: "3.1",
+		singleSlicePerFrame: true,
+		profile: input.profile ?? "baseline",
+		level: input.level ?? "3.1",
 		pixelFormat: "yuv420p",
-		fps: input.fps,
-		gopFrames: Math.max(1, Math.round(input.fps * 4)),
+		fps: deliveredFps,
+		gopFrames: Math.max(1, Math.round(deliveredFps * 4)),
 		...input.budgetKbps === null ? {} : {
 			bitrateKbps: input.budgetKbps,
 			rateControl: RATE_CONTROL_TIGHT
@@ -98192,23 +98697,64 @@ function fitNotes(entries, bitrates, budgetKbps) {
 		};
 	});
 }
-function transcodeReason(picked, profile, bitrates, budgetKbps) {
-	if (!canPassThrough(picked.codec)) return "source-codec";
+function transcodeReason(picked, profile, bitrates, budgetKbps, allowHevc, target) {
+	if (!canPassThrough(picked.codec, allowHevc)) return "source-codec";
+	if (!fitsRequestedResolution(picked, target)) return "over-resolution";
 	if (profile === null) return "unknown-bitrate";
 	return classifyBitrateFit(bitrates.get(profile), budgetKbps) === "over-budget" ? "over-budget" : "unknown-bitrate";
 }
 /**
-* iOS Home renders only H.264 over the classic HAP SRTP path, so an H.265
-* source can never be passed through. An UNKNOWN codec is treated the same
-* way: guessing H.264 is how a camera that changed its encoder ends up
-* shipping bytes no controller can decode.
+* Which source codecs may go on the wire untouched.
+*
+* H.264 always. H.265 only when the SESSION was negotiated on Apple's
+* multi-tier RTP service, which advertises `VideoCodecType 2 = H.265` in its
+* tiers — the classic HAP SRTP path renders H.264 only, and sending HEVC there
+* is a black picture with no error.
+*
+* The permission belongs to the session rather than to the camera because the
+* same camera serves both services: which one negotiated decides what may be
+* copied. Refusing HEVC on the new service transcodes 4K HEVC down to H.264
+* for a controller that explicitly asked for the HEVC, which is the entire cost
+* that service exists to remove.
+*
+* An UNKNOWN codec is refused on BOTH. Guessing H.264 is how a camera that
+* changed its encoder ends up shipping bytes no controller can decode, and the
+* new service's permission is for H.265 specifically — not for "whatever this
+* turns out to be".
 */
-function canPassThrough(codec) {
+function canPassThrough(codec, allowHevc) {
 	if (codec === void 0) return false;
 	const lower = codec.toLowerCase();
-	if (lower.includes("h265") || lower.includes("hevc")) return false;
+	if (lower.includes("h265") || lower.includes("hevc")) return allowHevc;
 	return lower.includes("h264") || lower.includes("avc");
 }
+/**
+* May this slot be forwarded UNTOUCHED at the resolution the controller asked
+* for?
+*
+* Measured on the hub, 2026-09-17, from iOS's own Receiver Reports: two
+* cameras forwarding a 3840x2160 slot to a controller that had negotiated
+* 1280x720, and the busier of the two reported losing **52.7 %** of packets in
+* its worst window, 617 packets cumulative, jitter 54 618. The third camera,
+* transcoded to 720p because its source is HEVC, lost one packet. The operator
+* saw this as "the H.264 cameras are slower to load than the H.265 one" — and
+* they were, because a 4K key frame spans hundreds of packets and losing any
+* one of them makes the picture wait for the next key frame, up to 3.5 s away.
+*
+* `over-budget-tolerated` is unchanged and still right: a RATE overshoot is
+* something a controller copes with. A RESOLUTION overshoot is a different
+* thing — it hands the controller a picture it never asked to decode.
+*
+* Smaller than asked for is fine and is copied: we cannot add detail, and an
+* encoder run that only enlarges pixels spends CPU to make the picture no
+* better and the stream bigger.
+*/
+function fitsRequestedResolution(entry, target) {
+	const width = entry.resolution?.width;
+	const height = entry.resolution?.height;
+	if (width === void 0 || height === void 0) return true;
+	return width <= target.width && height <= target.height;
+}
 function plausibleMeasured(value) {
 	if (value === null || !Number.isFinite(value)) return null;
 	return value >= 64 ? value : null;
@@ -98396,6 +98942,21 @@ async function probe$1(call, label, log) {
 	}
 }
 //#endregion
+//#region src/mappers/builders/passthrough-request.ts
+function passthroughRequest(input) {
+	const acceptCodecs = ["h264"];
+	if (input.multiTier && input.codec !== TierVideoCodec.H264) acceptCodecs.push("h265", "hevc");
+	return {
+		requirements: {
+			acceptCodecs,
+			allowTranscode: false,
+			requireProfileBound: true,
+			maxHeight: input.negotiatedHeight
+		},
+		preferences: { targetHeight: input.negotiatedHeight }
+	};
+}
+//#endregion
 //#region src/mappers/builders/stream-ffmpeg-args.ts
 /**
 * The ffmpeg PLAN for one HomeKit streaming session.
@@ -98498,6 +99059,26 @@ var HAP_INPUT_PROBE = {
 	analyzeDurationUs: 2e5,
 	probeSizeBytes: 64 * 1024
 };
+/**
+* ONE encoder thread on the encode branch, none pinned on a copy. (D515)
+*
+* The plan asks x264 for one slice per access unit (`sliced-threads=0`). On
+* its own that flag hands x264 its AUTO thread count — 30 on the 20-core hub —
+* as FRAME threads, and frame threading delays output by `threads − 1`
+* frames: measured on the live hub as the first packet leaving ~3 s later at
+* the 10 fps a 269 kbps budget dials. Four threads still cost ~1 s. One thread
+* was measured with no start-up delay, one slice, and — unlike the eleven-slice
+* encode — no `VBV underflow` from x264, and a 720p `ultrafast` encode is far
+* inside what one core carries. A session is bounded by what one controller
+* asked for, never by this host's core count.
+*
+* `-threads` is an OUTPUT option here, emitted inside the video leg by the
+* shared builder, so it never reaches the decoder or the audio leg.
+*/
+var HAP_ENCODER_THREADS = 1;
+function encoderThreadCount(video) {
+	return video.kind === "encode" ? HAP_ENCODER_THREADS : 0;
+}
 function buildSessionInvocation(input) {
 	return {
 		logLevel: "warning",
@@ -98511,7 +99092,7 @@ function buildSessionInvocation(input) {
 		},
 		video: input.video,
 		audio: audioPlan(input),
-		threadCount: 0,
+		threadCount: encoderThreadCount(input.video),
 		outputArgs: [],
 		sink: {
 			kind: "rtp-outputs",
@@ -98669,7 +99250,7 @@ function toCamProfile(profileId) {
 //#endregion
 //#region src/mappers/builders/h264-idr.ts
 /**
-* Does this RTP packet carry the start of an H.264 IDR?
+* Does this RTP packet carry the start of a key frame?
 *
 * A pass-through session cannot manufacture a key frame on demand — it can
 * only forward the one the camera decides to emit. So the number that decides
@@ -98683,6 +99264,16 @@ function toCamProfile(profileId) {
 * boolean per packet, no state, no allocation, and it never throws. It runs on
 * every forwarded video packet, and a parser that throws on a malformed packet
 * would take the media path down with it.
+*
+* ## Two codecs, two headers
+*
+* H.264 (RFC 6184) has a ONE-byte NAL header whose type is the low 5 bits.
+* HEVC (RFC 7798) has a TWO-byte header whose type is bits 1..6 of the first.
+* The H.264 parser applied to an HEVC packet reads a type that means nothing
+* and answers "no key frame" forever — which, since this is telemetry and not
+* a gate, would show an HEVC session streaming perfectly with `videoKeyframes`
+* stuck at zero. That is the exact shape of the bug these counters exist to
+* detect (D515), so the codec is a parameter rather than an assumption.
 */
 /** NAL unit type carrying a coded slice of an IDR picture (RFC 6184 §5.2). */
 var NAL_TYPE_IDR = 5;
@@ -98695,6 +99286,16 @@ var RTP_MIN_HEADER_BYTES = 12;
 var NAL_TYPE_MASK = 31;
 /** FU header start bit — set only on the FIRST fragment of a fragmented NAL. */
 var FU_START_BIT = 128;
+/** HEVC NAL types 16..23 are IRAP pictures — the key frames of HEVC. */
+var HEVC_IRAP_MIN = 16;
+var HEVC_IRAP_MAX = 23;
+/** RFC 7798 payload structures: 48 aggregation, 49 fragmentation unit. */
+var HEVC_TYPE_AP = 48;
+var HEVC_TYPE_FU = 49;
+var HEVC_TYPE_MASK = 63;
+function rtpPacketCarriesKeyframe(packet, codec) {
+	return codec === "h265" ? rtpPacketCarriesIrap(packet) : rtpPacketCarriesIdr(packet);
+}
 function rtpPacketCarriesIdr(packet) {
 	const payloadStart = rtpPayloadOffset(packet);
 	if (payloadStart === null) return false;
@@ -98744,6 +99345,158 @@ function stapContainsIdr(packet, start) {
 	}
 	return false;
 }
+/** HEVC's half: the same shape, read through RFC 7798's two-byte header. */
+function rtpPacketCarriesIrap(packet) {
+	const payloadStart = rtpPayloadOffset(packet);
+	if (payloadStart === null) return false;
+	const firstPayloadByte = packet[payloadStart];
+	if (firstPayloadByte === void 0) return false;
+	const nalType = firstPayloadByte >> 1 & HEVC_TYPE_MASK;
+	if (nalType === HEVC_TYPE_FU) {
+		const fuHeader = packet[payloadStart + 2];
+		if (fuHeader === void 0) return false;
+		if ((fuHeader & FU_START_BIT) === 0) return false;
+		return isHevcIrap(fuHeader & HEVC_TYPE_MASK);
+	}
+	if (nalType === HEVC_TYPE_AP) return hevcAggregationContainsIrap(packet, payloadStart + 2);
+	return isHevcIrap(nalType);
+}
+function isHevcIrap(nalType) {
+	return nalType >= HEVC_IRAP_MIN && nalType <= HEVC_IRAP_MAX;
+}
+/** Walk an aggregation packet's `[size][nal]` pairs looking for an IRAP. */
+function hevcAggregationContainsIrap(packet, start) {
+	let offset = start;
+	while (offset + 2 <= packet.length) {
+		const size = packet.readUInt16BE(offset);
+		offset += 2;
+		if (size === 0 || offset + size > packet.length) return false;
+		const nalHeader = packet[offset];
+		if (nalHeader === void 0) return false;
+		if (isHevcIrap(nalHeader >> 1 & HEVC_TYPE_MASK)) return true;
+		offset += size;
+	}
+	return false;
+}
+//#endregion
+//#region src/multi-tier/native-codec.ts
+/**
+* The codec the camera really publishes, for the multi-tier service's tier
+* declaration.
+*
+* A tier list names ONE codec for all its tiers, so this has to pick. It picks
+* from the LARGEST stream, because that is the one the high tier will carry and
+* the one whose codec decides whether we transcode. A camera that offers a tiny
+* HEVC substream beside a 1080p H.264 main is an H.264 camera for our purposes.
+*
+* Absence falls back to H.264: it is what every controller accepts and what the
+* classic path already serves, so an unreadable publisher costs us the feature
+* rather than the camera.
+*/
+/** The spellings publishers in this fleet actually use for HEVC. */
+function isHevc(codec) {
+	if (codec === void 0) return false;
+	const normalised = codec.toLowerCase().replace(/[.\-_\s]/g, "");
+	return normalised === "h265" || normalised === "hevc";
+}
+/** The stream whose codec and size describe this camera at its best. */
+function largestReadableStream(streams) {
+	let best;
+	let bestArea = -1;
+	for (const stream of streams) {
+		if (stream.codec === void 0) continue;
+		const area = stream.resolution === void 0 ? 0 : stream.resolution.width * stream.resolution.height;
+		if (area > bestArea) {
+			bestArea = area;
+			best = stream;
+		}
+	}
+	return best;
+}
+/**
+* The sensor the new camera service describes: size AND codec, from ONE stream.
+*
+* They used to come from two places and the kitchen camera showed what that
+* costs. The codec was read off the published streams -- h265, correct --
+* while the size came from the CLASSIC service's advertised resolution list,
+* which is capped at 1080p because that is the ceiling the classic service
+* accepts. So the accessory advertised "H.265, 1920x1080" for a camera whose
+* main stream is 3840x2160 H.265, and the 4K the new service exists to carry
+* was never offered.
+*
+* One stream answers both questions, so the two cannot disagree again.
+*/
+function sensorForStreams(streams) {
+	const best = largestReadableStream(streams);
+	const resolution = best?.resolution;
+	return {
+		width: resolution?.width ?? 1920,
+		height: resolution?.height ?? 1080,
+		codec: isHevc(best?.codec) ? TierVideoCodec.H265 : TierVideoCodec.H264
+	};
+}
+//#endregion
+//#region src/mappers/builders/stream-fps-probe.ts
+async function probeAdvertisedVideoProfile(bctx) {
+	const { ctx, proxy, numericDeviceId, options } = bctx;
+	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
+	const entries = await probe(() => proxy.cameraStreams?.getProfileRtspEntries({}), "cameraStreams.getProfileRtspEntries", log);
+	const slots = await probe(() => proxy.cameraStreams?.getBrokerStreams({}), "cameraStreams.getBrokerStreams", log);
+	const camStreams = await probe(() => proxy.cameraStreams?.getCameraStreams({}), "cameraStreams.getCameraStreams", log);
+	const choices = await probe(() => proxy.webrtcSession?.listStreams({}), "webrtcSession.listStreams", log);
+	const fpsByProfile = resolveProfileFps({
+		choices: choices ?? [],
+		slots: slots ?? [],
+		camStreams: camStreams ?? []
+	});
+	const sensor = sensorForStreams(camStreams ?? []);
+	const resolutions = deriveAdvertisedResolutions({
+		candidates: CANDIDATE_RESOLUTIONS,
+		entries: entries ?? [],
+		deviceId: numericDeviceId,
+		pref: options.hapDeviceSettings.streamPreference,
+		fpsByProfile
+	});
+	const assumed = resolutions.filter((r) => r.source === "assumed").length;
+	log.info("export-hap: advertised video profile derived", { meta: {
+		streamPreference: options.hapDeviceSettings.streamPreference,
+		resolutions: formatAdvertisedResolutions(resolutions),
+		sensor: `${sensor.width}x${sensor.height} ${sensor.codec === TierVideoCodec.H265 ? "h265" : "h264"}`,
+		profileFps: [...fpsByProfile.values()].map((f) => `${f.profile}=${f.fps}(${f.source})`),
+		assumedCount: assumed,
+		previouslyAdvertisedFps: 30
+	} });
+	if (assumed === resolutions.length) log.warn("export-hap: no measured or published frame rate for ANY profile — advertising the assumed rate", { meta: {
+		entries: entries?.length ?? 0,
+		choices: choices?.length ?? 0
+	} });
+	return {
+		resolutions,
+		fpsByProfile,
+		sensor
+	};
+}
+/**
+* Run one cap read. Returns null both when the cap is not bound and when the
+* call throws — and LOGS which, because "the camera has no telemetry" and "the
+* telemetry call failed" lead to different fixes.
+*/
+async function probe(call, label, log) {
+	try {
+		const pending = call();
+		if (pending === void 0) {
+			log.info("export-hap: fps probe skipped — cap not bound on this device", { meta: { call: label } });
+			return null;
+		}
+		return await pending;
+	} catch (err) {
+		log.warn("export-hap: fps probe failed — falling back to a lower-authority source", { meta: {
+			call: label,
+			error: err instanceof Error ? err.message : String(err)
+		} });
+		return null;
+	}
+}
 /**
 * How long after spawn an exit still counts as "hardware init failed".
 *
@@ -99196,6 +99949,17 @@ var SESSION_HEARTBEAT_MS = 5e3;
 * what the controller thinks without becoming one.
 */
 var RECEIVER_REPORT_LOG_INTERVAL_MS = 5e3;
+/** HAP's profile/level enums are numeric; ffmpeg wants their names. */
+var HAP_PROFILE_NAMES = {
+	0: "baseline",
+	1: "main",
+	2: "high"
+};
+var HAP_LEVEL_NAMES = {
+	0: "3.1",
+	1: "3.2",
+	2: "4.0"
+};
 function buildCameraStreamingDelegate(bctx, advertised) {
 	const { ctx, numericDeviceId } = bctx;
 	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
@@ -99209,7 +99973,7 @@ function buildCameraStreamingDelegate(bctx, advertised) {
 				});
 			},
 			prepareStream(request, callback) {
-				prepareStream(request, sessions, bctx).then((resp) => callback(void 0, resp)).catch((err) => {
+				prepareStream(request, sessions, bctx, "classic").then((resp) => callback(void 0, resp)).catch((err) => {
 					log.warn("export-hap: prepareStream failed", { meta: { error: errMsg$12(err) } });
 					callback(err instanceof Error ? err : new Error(errMsg$12(err)));
 				});
@@ -99249,6 +100013,29 @@ function buildCameraStreamingDelegate(bctx, advertised) {
 				comfort_noise: false
 			}
 		},
+		negotiator: {
+			async prepare(request) {
+				const response = await prepareStream(request, sessions, bctx, "multi-tier");
+				const session = sessions.get(request.sessionID);
+				if (session === void 0) throw new Error("export-hap: prepareStream returned without registering a session");
+				const video = response.video;
+				const audio = response.audio;
+				if (!("port" in video) || audio === void 0 || !("port" in audio)) throw new Error("export-hap: the multi-tier path does not support a proxied source");
+				return {
+					localAddress: session.localAddress,
+					videoPort: video.port,
+					audioPort: audio.port,
+					videoSsrc: video.ssrc,
+					audioSsrc: audio.ssrc
+				};
+			},
+			async control(request) {
+				await handleStreamRequest(request, sessions, bctx, advertised);
+			},
+			has(sessionId) {
+				return sessions.has(sessionId);
+			}
+		},
 		dispose: async () => {
 			for (const session of sessions.values()) {
 				session.teardownTrigger = "accessory-dispose";
@@ -99279,7 +100066,7 @@ async function handleSnapshot(bctx, request) {
 	}
 	return Buffer.from(result.base64, "base64");
 }
-async function prepareStream(request, sessions, bctx) {
+async function prepareStream(request, sessions, bctx, negotiatedVia) {
 	const ipVersion = request.addressVersion;
 	const localIp = pickLocalInterfaceIp(request.targetAddress, ipVersion);
 	const videoUdp = await bindUdp(ipVersion, localIp);
@@ -99353,6 +100140,9 @@ async function prepareStream(request, sessions, bctx) {
 	const audioSsrc = randomSsrc();
 	const session = {
 		sessionId: request.sessionID,
+		localAddress: localIp,
+		negotiatedVia,
+		wireCodec: "h264",
 		startedAtMs: null,
 		endedAtMs: null,
 		negotiated: null,
@@ -99451,7 +100241,7 @@ async function prepareStream(request, sessions, bctx) {
 	});
 	videoLoopUdp.on("message", (rtpPacket) => {
 		session.videoPacketsForwarded += 1;
-		if (rtpPacketCarriesIdr(rtpPacket)) recordKeyframe(session);
+		if (rtpPacketCarriesKeyframe(rtpPacket, session.wireCodec)) recordKeyframe(session);
 		if (session.videoPacketsForwarded === 1) tagLog.info("export-hap: first video packet from ffmpeg", { meta: {
 			sessionId: session.sessionId,
 			bytes: rtpPacket.length
@@ -100081,7 +100871,9 @@ async function handleStreamRequest(request, sessions, bctx, advertised) {
 			audioPt: request.audio.pt,
 			audioSsrc: session.audioOutSsrc,
 			audioSampleRateEnum: request.audio.sample_rate,
-			audioPacketTimeMs: packetTimeMs
+			audioPacketTimeMs: packetTimeMs,
+			profile: request.video.profile,
+			level: request.video.level
 		};
 		const startParams = {
 			width: request.video.width,
@@ -100090,6 +100882,8 @@ async function handleStreamRequest(request, sessions, bctx, advertised) {
 			max_bit_rate: request.video.max_bit_rate,
 			mtu: request.video.mtu,
 			pt: request.video.pt,
+			profile: request.video.profile,
+			level: request.video.level,
 			audio_pt: request.audio.pt,
 			audio_ssrc: session.audioOutSsrc,
 			sample_rate: request.audio.sample_rate,
@@ -100121,7 +100915,9 @@ async function handleStreamRequest(request, sessions, bctx, advertised) {
 			audio_pt: session.lastStartParams.audioPt,
 			audio_ssrc: session.lastStartParams.audioSsrc,
 			sample_rate: session.lastStartParams.audioSampleRateEnum,
-			packet_time: session.lastStartParams.audioPacketTimeMs
+			packet_time: session.lastStartParams.audioPacketTimeMs,
+			profile: session.lastStartParams.profile,
+			level: session.lastStartParams.level
 		};
 		log.info("export-hap: stream reconfigured", { meta: {
 			sessionId: request.sessionID,
@@ -100146,6 +100942,22 @@ async function startFfmpegForSession(bctx, session, sessionId, video, advertised
 		throw new Error(`export-hap: no profile RTSP entries for device ${numericDeviceId}`);
 	}
 	const pref = options.hapDeviceSettings.streamPreference;
+	const capPick = pref === "auto" ? await probe(() => proxy.cameraStreams?.pickStream(passthroughRequest({
+		negotiatedHeight: video.height,
+		multiTier: session.negotiatedVia === "multi-tier"
+	})), "cameraStreams.pickStream", startLog) : null;
+	if (capPick?.profile !== void 0) startLog.info("export-hap: the shared picker chose the slot", { meta: {
+		sessionId,
+		profile: capPick.profile,
+		camStreamId: capPick.camStreamId,
+		codec: capPick.codec ?? "unknown",
+		fps: capPick.fps ?? null,
+		fpsSource: capPick.fpsSource ?? null,
+		negotiated: `${video.width}x${video.height}`,
+		reason: capPick.reason
+	} });
+	/** The picker's slot when it found one, otherwise the operator's setting. */
+	const effectivePref = capPick?.profile ?? pref;
 	const bitrates = await probeProfileBitrates({
 		bctx,
 		slots: brokerStreams,
@@ -100159,14 +100971,15 @@ async function startFfmpegForSession(bctx, session, sessionId, video, advertised
 	const fit = selectStreamForBudget({
 		entries: withSlotCodecs(entries, brokerStreams),
 		deviceId: numericDeviceId,
-		pref,
+		pref: effectivePref,
 		connection,
 		targetResolution: {
 			width: video.width,
 			height: video.height
 		},
 		negotiatedMaxBitrateKbps: video.max_bit_rate,
-		bitrates
+		bitrates,
+		allowHevcPassthrough: session.negotiatedVia === "multi-tier"
 	});
 	if (fit === null) {
 		startLog.warn("export-hap: stream start DROPPED — no ENABLED profile RTSP entry", { meta: {
@@ -100195,6 +101008,11 @@ async function startFfmpegForSession(bctx, session, sessionId, video, advertised
 	const slot = brokerStreams.find((s) => s.profile === fit.profile);
 	const codec = (picked.codec ?? slot?.codec ?? "").toLowerCase();
 	const needsTranscode = fit.kind === "transcode";
+	const encodeBudget = needsTranscode ? encodeBudgetKbps({
+		negotiatedBudgetKbps: fit.budgetKbps,
+		width: video.width
+	}) : fit.budgetKbps;
+	session.wireCodec = !needsTranscode && (codec.includes("h265") || codec.includes("hevc")) ? "h265" : "h264";
 	const pickedProfile = toKnownProfile(picked.profileId);
 	const resolvedFps = pickedProfile === null ? void 0 : advertised.fpsByProfile.get(pickedProfile);
 	const advertisedFps = resolvedFps?.fps ?? video.fps;
@@ -100215,7 +101033,7 @@ async function startFfmpegForSession(bctx, session, sessionId, video, advertised
 		fitReason: fit.reason,
 		publishedKbps: slotEvidence?.publishedKbps ?? null,
 		measuredKbps: slotEvidence?.measuredKbps ?? null,
-		budgetKbps: fit.budgetKbps,
+		budgetKbps: encodeBudget,
 		fitNotes
 	};
 	startLog.info("export-hap: stream bitrate fit resolved", { meta: {
@@ -100223,7 +101041,7 @@ async function startFfmpegForSession(bctx, session, sessionId, video, advertised
 		decision: fit.kind,
 		reason: fit.reason,
 		negotiatedMaxBitrateKbps: video.max_bit_rate,
-		encodeBudgetKbps: fit.budgetKbps,
+		encodeBudgetKbps: encodeBudget,
 		profile: pickedProfile,
 		brokerId: picked.brokerId,
 		slotPublishedKbps: slotEvidence?.publishedKbps ?? null,
@@ -100244,12 +101062,23 @@ async function startFfmpegForSession(bctx, session, sessionId, video, advertised
 	const audioLoopPort = session.audioLoopUdp.address().port;
 	const videoTarget = `rtp://127.0.0.1:${videoLoopPort}?pkt_size=${video.mtu}`;
 	const audioTarget = `rtp://127.0.0.1:${audioLoopPort}?pkt_size=${video.mtu}`;
+	const selectedProfile = HAP_PROFILE_NAMES[video.profile] ?? "baseline";
+	const selectedLevel = HAP_LEVEL_NAMES[video.level] ?? "3.1";
+	ctx.logger.info("export-hap: encoder profile", {
+		tags: { deviceId: numericDeviceId },
+		meta: {
+			selectedByController: `${selectedProfile}/${selectedLevel}`,
+			transcode: needsTranscode
+		}
+	});
 	const videoPlan = buildVideoPlan({
 		transcode: needsTranscode,
 		width: video.width,
 		height: video.height,
 		fps: deliveredFps,
-		budgetKbps: fit.budgetKbps
+		budgetKbps: encodeBudget,
+		profile: selectedProfile,
+		level: selectedLevel
 	});
 	const hwDecode = selectHwDecode({
 		transcode: needsTranscode,
@@ -100358,7 +101187,7 @@ async function startFfmpegForSession(bctx, session, sessionId, video, advertised
 		slotFpsSource: advertisedFpsSource,
 		deliveredFps,
 		fitReason: fit.reason,
-		encodeBudgetKbps: fit.budgetKbps,
+		encodeBudgetKbps: encodeBudget,
 		audioCodec: "opus",
 		audioBitrateKbps: OPUS_BITRATE_KBPS,
 		videoDecode: hwDecode.kind === "hardware" ? hwDecode.backend : "software"
@@ -100965,65 +101794,6 @@ function errMsg$8(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
-//#region src/mappers/builders/stream-fps-probe.ts
-async function probeAdvertisedVideoProfile(bctx) {
-	const { ctx, proxy, numericDeviceId, options } = bctx;
-	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
-	const entries = await probe(() => proxy.cameraStreams?.getProfileRtspEntries({}), "cameraStreams.getProfileRtspEntries", log);
-	const slots = await probe(() => proxy.cameraStreams?.getBrokerStreams({}), "cameraStreams.getBrokerStreams", log);
-	const camStreams = await probe(() => proxy.cameraStreams?.getCameraStreams({}), "cameraStreams.getCameraStreams", log);
-	const choices = await probe(() => proxy.webrtcSession?.listStreams({}), "webrtcSession.listStreams", log);
-	const fpsByProfile = resolveProfileFps({
-		choices: choices ?? [],
-		slots: slots ?? [],
-		camStreams: camStreams ?? []
-	});
-	const resolutions = deriveAdvertisedResolutions({
-		candidates: CANDIDATE_RESOLUTIONS,
-		entries: entries ?? [],
-		deviceId: numericDeviceId,
-		pref: options.hapDeviceSettings.streamPreference,
-		fpsByProfile
-	});
-	const assumed = resolutions.filter((r) => r.source === "assumed").length;
-	log.info("export-hap: advertised video profile derived", { meta: {
-		streamPreference: options.hapDeviceSettings.streamPreference,
-		resolutions: formatAdvertisedResolutions(resolutions),
-		profileFps: [...fpsByProfile.values()].map((f) => `${f.profile}=${f.fps}(${f.source})`),
-		assumedCount: assumed,
-		previouslyAdvertisedFps: 30
-	} });
-	if (assumed === resolutions.length) log.warn("export-hap: no measured or published frame rate for ANY profile — advertising the assumed rate", { meta: {
-		entries: entries?.length ?? 0,
-		choices: choices?.length ?? 0
-	} });
-	return {
-		resolutions,
-		fpsByProfile
-	};
-}
-/**
-* Run one cap read. Returns null both when the cap is not bound and when the
-* call throws — and LOGS which, because "the camera has no telemetry" and "the
-* telemetry call failed" lead to different fixes.
-*/
-async function probe(call, label, log) {
-	try {
-		const pending = call();
-		if (pending === void 0) {
-			log.info("export-hap: fps probe skipped — cap not bound on this device", { meta: { call: label } });
-			return null;
-		}
-		return await pending;
-	} catch (err) {
-		log.warn("export-hap: fps probe failed — falling back to a lower-authority source", { meta: {
-			call: label,
-			error: err instanceof Error ? err.message : String(err)
-		} });
-		return null;
-	}
-}
-//#endregion
 //#region src/hksv/controller-census.ts
 var EMPTY_CENSUS = {
 	serverPublished: false,
@@ -102178,6 +102948,776 @@ function accessoryUuidFor(kind, deviceId) {
 	return import_dist.uuid.generate(kind === "camera" ? `camstack:camera:${deviceId}` : `camstack:device:${deviceId}`);
 }
 //#endregion
+//#region src/multi-tier/rtp-streaming-control.ts
+/**
+* `RTP Streaming Control` (0x8045) — start and stop, on the new service.
+*
+* It replaces the classic `Selected RTP Stream Configuration`, and it is a
+* different shape, not a variation. The classic one carries the whole selected
+* configuration inside the start: codec, profile, level, resolution, bitrate.
+* This one carries a **tier identifier**. The configuration was agreed when we
+* published `Supported Video Stream Tiers`; the controller now names one of
+* those entries.
+*
+* That is why the adapter maps an identifier back to the tier we advertised
+* instead of reading parameters off the write — and why a tier identifier we
+* never published is `No Such Stream` rather than something to improvise from.
+*
+* Bytes only. The engine lives elsewhere.
+*/
+var RtpStreamingCommand = /* @__PURE__ */ function(RtpStreamingCommand) {
+	RtpStreamingCommand[RtpStreamingCommand["END"] = 1] = "END";
+	RtpStreamingCommand[RtpStreamingCommand["START"] = 2] = "START";
+	return RtpStreamingCommand;
+}({});
+var RtpStreamingStatus = /* @__PURE__ */ function(RtpStreamingStatus) {
+	RtpStreamingStatus[RtpStreamingStatus["SUCCESS"] = 0] = "SUCCESS";
+	RtpStreamingStatus[RtpStreamingStatus["UNKNOWN_SESSION_IDENTIFIER"] = 1] = "UNKNOWN_SESSION_IDENTIFIER";
+	/** An End for a stream that is not started. */
+	RtpStreamingStatus[RtpStreamingStatus["NO_SUCH_STREAM"] = 2] = "NO_SUCH_STREAM";
+	RtpStreamingStatus[RtpStreamingStatus["BUSY"] = 3] = "BUSY";
+	RtpStreamingStatus[RtpStreamingStatus["ERROR"] = 4] = "ERROR";
+	return RtpStreamingStatus;
+}({});
+function required$1(map, type, what) {
+	const value = map[String(type)];
+	if (value === void 0) throw new Error(`rtp-streaming-control: ${what} is missing from the controller's write`);
+	return value;
+}
+function optionalUint32(map, type) {
+	const value = map[String(type)];
+	return value === void 0 ? void 0 : value.readUInt32LE(0);
+}
+function decodeRtpStreamingControl(base64) {
+	const map = (0, import_dist.decode)(Buffer.from(base64, "base64"));
+	const command = required$1(map, 2, "the command").readUInt8(0);
+	if (command !== 2 && command !== 1) throw new Error(`rtp-streaming-control: command ${command} is reserved or unknown`);
+	return {
+		sessionId: import_dist.uuid.unparse(required$1(map, 1, "the session identifier")),
+		command,
+		videoTier: optionalUint32(map, 3),
+		videoSsrc: optionalUint32(map, 4),
+		audioTier: optionalUint32(map, 5),
+		audioSsrc: optionalUint32(map, 6)
+	};
+}
+/**
+* The value the characteristic reads back with: the status of the last write.
+*
+* `sessionId` is null before any write has happened. The read still has to
+* answer — a characteristic that answers nothing is what put the kitchen camera
+* on "loading" — so it answers with a status and no session rather than with an
+* invented one.
+*/
+function encodeRtpStreamingControlStatus(sessionId, status) {
+	if (sessionId === null) return (0, import_dist.encode)(2, Buffer.from([status])).toString("base64");
+	return (0, import_dist.encode)(1, import_dist.uuid.write(sessionId), 2, Buffer.from([status])).toString("base64");
+}
+//#endregion
+//#region src/multi-tier/setup-endpoints.ts
+/**
+* The `Setup Endpoints` exchange, for the multi-tier RTP service.
+*
+* § 3.6 lists this characteristic among the service's required ones and does
+* NOT redefine it: it is R17's, byte for byte, and hap-nodejs already speaks it
+* on the classic service. The types below are transcribed from that
+* implementation rather than guessed, and the spec file decodes what this
+* encodes with the same library — a transcription error is otherwise entirely
+* plausible on review.
+*
+* Nothing here talks to a socket. The bytes are the part a test can hold still;
+* the adapter that drives the streaming engine is a separate file for exactly
+* that reason.
+*/
+var SetupEndpointsStatus = /* @__PURE__ */ function(SetupEndpointsStatus) {
+	SetupEndpointsStatus[SetupEndpointsStatus["SUCCESS"] = 0] = "SUCCESS";
+	SetupEndpointsStatus[SetupEndpointsStatus["BUSY"] = 1] = "BUSY";
+	SetupEndpointsStatus[SetupEndpointsStatus["ERROR"] = 2] = "ERROR";
+	return SetupEndpointsStatus;
+}({});
+/**
+* Read a TLV field that must be present, naming it when it is not.
+*
+* A controller's bytes really can be short, and the refusal we send back has to
+* carry a reason — "undefined is not an object", thrown three frames away in
+* the socket code, is not one.
+*/
+function required(map, type, what) {
+	const value = map[String(type)];
+	if (value === void 0) throw new Error(`setup-endpoints: ${what} is missing from the controller's write`);
+	return value;
+}
+function uint16$1(value) {
+	const b = Buffer.alloc(2);
+	b.writeUInt16LE(value, 0);
+	return b;
+}
+function uint32$2(value) {
+	const b = Buffer.alloc(4);
+	b.writeUInt32LE(value, 0);
+	return b;
+}
+function decodeSrtp(payload, what) {
+	const map = (0, import_dist.decode)(payload);
+	return {
+		cryptoSuite: required(map, 1, `${what} crypto suite`).readUInt8(0),
+		key: required(map, 2, `${what} master key`),
+		salt: required(map, 3, `${what} master salt`)
+	};
+}
+function decodeSetupEndpointsRequest(base64) {
+	const map = (0, import_dist.decode)(Buffer.from(base64, "base64"));
+	const address = (0, import_dist.decode)(required(map, 3, "the controller address"));
+	return {
+		sessionId: import_dist.uuid.unparse(required(map, 1, "the session id")),
+		addressVersion: required(address, 1, "the address version").readUInt8(0) === 0 ? "ipv4" : "ipv6",
+		controllerAddress: required(address, 2, "the address").toString("utf8"),
+		videoPort: required(address, 3, "the video port").readUInt16LE(0),
+		audioPort: required(address, 4, "the audio port").readUInt16LE(0),
+		videoSrtp: decodeSrtp(required(map, 4, "the video srtp parameters"), "video"),
+		audioSrtp: decodeSrtp(required(map, 5, "the audio srtp parameters"), "audio")
+	};
+}
+function encodeSetupEndpointsResponse(response) {
+	const address = (0, import_dist.encode)(1, Buffer.from([response.addressVersion === "ipv4" ? 0 : 1]), 2, Buffer.from(response.accessoryAddress, "utf8"), 3, uint16$1(response.videoPort), 4, uint16$1(response.audioPort));
+	const srtp = (params) => (0, import_dist.encode)(1, Buffer.from([0]), 2, params.key, 3, params.salt);
+	return (0, import_dist.encode)(1, import_dist.uuid.write(response.sessionId), 2, Buffer.from([0]), 3, address, 4, srtp(response.videoSrtp), 5, srtp(response.audioSrtp), 6, uint32$2(response.videoSsrc), 7, uint32$2(response.audioSsrc)).toString("base64");
+}
+/**
+* A refusal: STATUS and nothing else, which is exactly what the classic
+* service writes. Not even the session id — matching it byte for byte means a
+* controller parses our refusal with the code it already has.
+*/
+function encodeSetupEndpointsRefusal(status) {
+	return (0, import_dist.encode)(2, Buffer.from([status])).toString("base64");
+}
+//#endregion
+//#region src/multi-tier/audio-stream-tiers.ts
+/**
+* The `Supported Audio Stream Tiers` TLV8 — 0x8044, a REQUIRED characteristic
+* of `camera-multi-tier-rtp-stream-management`.
+*
+* ## Not the WebRTC one
+*
+* The WebRTC service has its own audio characteristic at 0x805A, and the two
+* are easy to confuse because they carry the same idea. This file is the RTP
+* one. A service that declares the wrong sibling is a service the controller
+* reads and abandons without saying why.
+*
+* ## What the revision fixes, and why that is encoded as a refusal
+*
+* Three of the six fields are not choices in this revision of the guide:
+* packet time is 20 ms, channels is 1, and **exactly one tier is allowed**.
+* The tier count is the one that cannot be expressed in a type, so it is
+* checked — a second tier would be silently dropped by a controller, or worse,
+* accepted and then used to select a stream we never meant to offer.
+*
+* Pure bytes in, pure bytes out, like its video sibling.
+*/
+/** Audio codec. Opus is the only value this revision defines, and the guide
+*  requires the accessory to support it. */
+var TierAudioCodec = /* @__PURE__ */ function(TierAudioCodec) {
+	TierAudioCodec[TierAudioCodec["OPUS"] = 3] = "OPUS";
+	return TierAudioCodec;
+}({});
+function uint8$1(value) {
+	const b = Buffer.alloc(1);
+	b.writeUInt8(value, 0);
+	return b;
+}
+function uint32$1(value) {
+	const b = Buffer.alloc(4);
+	b.writeUInt32LE(value, 0);
+	return b;
+}
+/**
+* The one Opus tier we offer, from the rate the camera actually captures at.
+*
+* The capture rate is an input only so that the caller cannot forget it exists;
+* what goes on the wire is 48 kHz either way. Returning a tier rather than
+* bytes keeps the "what do we offer" decision separate from the encoding.
+*/
+function opusTierForCapture(captureSampleRateHz) {
+	return {
+		identifier: 1,
+		targetAverageBitrateBps: captureSampleRateHz >= 24e3 ? 32e3 : 24e3,
+		sampleRate: 4,
+		bitDepth: 2,
+		packetTimeMs: 20,
+		channels: 1
+	};
+}
+function encodeAudioStreamTier(tier) {
+	return (0, import_dist.encode)(1, uint32$1(tier.identifier), 2, uint32$1(tier.targetAverageBitrateBps), 3, uint8$1(tier.sampleRate), 4, uint8$1(tier.bitDepth), 5, uint8$1(tier.packetTimeMs), 6, uint8$1(tier.channels));
+}
+function encodeAudioStreamConfiguration(config) {
+	if (config.tiers.length !== 1) throw new Error(`supported-audio-stream-tiers allows exactly one tier in this revision, got ${config.tiers.length}`);
+	return (0, import_dist.encode)(1, uint8$1(config.codec), 2, uint8$1(config.payloadType), 3, config.tiers.map(encodeAudioStreamTier));
+}
+//#endregion
+//#region src/multi-tier/camera-capabilities.ts
+/**
+* `Camera Capabilities` — the handshake that says "I speak the new camera
+* specification".
+*
+* The guide, § 4.5, is explicit: *"the presence of this service and
+* characteristic with versions as specified in this document is required to
+* signify that this camera supports the camera functionality described in this
+* specification."*
+*
+* That sentence is the diagnosis of this addon's first attempt. We declared
+* `camera-multi-tier-rtp-stream-management` and nothing else, and iOS read its
+* tiers and opened the session on the classic service two seconds later. It was
+* not refusing the tiers; it had never been told the accessory speaks the
+* specification the tiers belong to.
+*
+* ## Two different versions, and they are not interchangeable
+*
+*  - The SERVICE (0x8010) carries `Version`, a **string**, whose value is the
+*    specification revision: `"17.99"`.
+*  - The CHARACTERISTIC (0x8011) carries `Version`, a **uint8**, which versions
+*    the TLV layout below it.
+*
+* ## The sensor UUID
+*
+* `data` on the wire, and it must be stable across restarts: a controller
+* correlates a stream with it, and it appears in three places. Deriving it from
+* the device id makes it stable with nothing to persist and nothing to lose.
+*/
+/** Service and characteristic UUIDs, § 3.1 and § 4.5. */
+var CAMERA_CAPABILITIES_SERVICE_UUID = "00008010-0000-1000-8000-0026BB765291";
+var CHAR_CAMERA_CAPABILITIES = "00008011-0000-1000-8000-0026BB765291";
+/**
+* The specification revision, as the SERVICE's `Version` string.
+*
+* The guide notes this "may be updated prior to release". When it is, this is
+* the one place to change — and a controller that wants a newer revision will
+* decline rather than misbehave, which is the failure we can see.
+*/
+var CAMERA_CAPABILITIES_SPEC_VERSION = "17.99";
+var SensorType = /* @__PURE__ */ function(SensorType) {
+	SensorType[SensorType["UNKNOWN"] = 0] = "UNKNOWN";
+	SensorType[SensorType["PRIMARY"] = 1] = "PRIMARY";
+	SensorType[SensorType["GENERIC"] = 255] = "GENERIC";
+	return SensorType;
+}({});
+var SensorIntent = /* @__PURE__ */ function(SensorIntent) {
+	SensorIntent[SensorIntent["UNKNOWN"] = 0] = "UNKNOWN";
+	SensorIntent[SensorIntent["MAIN"] = 1] = "MAIN";
+	SensorIntent[SensorIntent["PACKAGE"] = 2] = "PACKAGE";
+	SensorIntent[SensorIntent["GENERIC"] = 255] = "GENERIC";
+	return SensorIntent;
+}({});
+function uint8(value) {
+	const b = Buffer.alloc(1);
+	b.writeUInt8(value, 0);
+	return b;
+}
+function uint16(value) {
+	const b = Buffer.alloc(2);
+	b.writeUInt16LE(value, 0);
+	return b;
+}
+function uint32(value) {
+	const b = Buffer.alloc(4);
+	b.writeUInt32LE(value, 0);
+	return b;
+}
+/**
+* A stable 16-byte sensor UUID for a device.
+*
+* Hashed rather than random so that it survives a restart without being
+* persisted — a value we would have to store is a value that can go missing
+* while the accessory that references it does not.
+*/
+function sensorUuidForDevice(deviceId) {
+	return (0, node_crypto.createHash)("sha256").update(`camstack:hap:sensor:${deviceId}`).digest().subarray(0, 16);
+}
+function encodeVideoStreamCapability(capability) {
+	return (0, import_dist.encode)(1, capability.identifier, 2, uint8(capability.quality), 3, uint16(capability.width), 4, uint16(capability.height), 5, uint8(capability.framesPerSecond), 6, uint32(capability.averageBitrateKbps), 7, uint32(capability.peakBitrateKbps));
+}
+function encodeSensorConfiguration(sensor) {
+	return (0, import_dist.encode)(1, (0, import_dist.encode)(1, uint16(sensor.width), 2, uint16(sensor.height)), 2, sensor.sensorUuid, 3, uint8(sensor.type), 4, uint8(sensor.intent), 5, sensor.videoStreams.map(encodeVideoStreamCapability));
+}
+function encodeCameraCapabilities(sensors) {
+	return (0, import_dist.encode)(1, uint8(1), 2, (0, import_dist.encode)(1, sensors.map(encodeSensorConfiguration)));
+}
+//#endregion
+//#region src/multi-tier/multi-tier-service.ts
+/**
+* The three services Apple's new camera specification requires, built together
+* because none of them means anything alone.
+*
+* ## What the first attempt got wrong
+*
+* It declared `camera-multi-tier-rtp-stream-management` (0x8031) with two of
+* its eight required characteristics, and nothing else. Measured on the hub,
+* 2026-09-16: at 22:53:21 iOS read the tiers, at 22:53:23 it opened the session
+* on the CLASSIC service. That was read as "it engages and declines".
+*
+* Reading the guide closes the question differently. § 4.5: *"the presence of
+* this service and characteristic with versions as specified in this document
+* is required to signify that this camera supports the camera functionality
+* described in this specification."* `Camera Capabilities` (0x8010) is the
+* handshake, and we never sent it. iOS was not declining our tiers — it had no
+* reason to believe the accessory spoke the specification they belong to.
+*
+* So this builds all three:
+*
+*  - **Camera Capabilities** (0x8010) — the claim, with `Version = "17.99"`.
+*  - **Camera Global Operating Mode** (0x8032) — the master switches, which
+*    `Status Active` on the streaming service is defined in terms of.
+*  - **Camera Multi-Tier RTP Stream Management** (0x8031) — all eight required
+*    characteristics.
+*
+* ## Why it is honest to ship this before the negotiation exists
+*
+* The guide defines the state we are in. § 3.6: *"Status Active must be set to
+* false if ... Streaming Enabled on this service is false"*, and *"the
+* accessory must reject any request to start a stream if Status Active is set
+* to false."* An accessory that cannot serve a session yet is not a
+* half-written accessory — it is a conformant one with streaming off, and it
+* says so in the field designed to say it.
+*
+* What is NOT allowed is declaring a characteristic we cannot answer. An empty
+* string is not a valid TLV8, and the Home app reads a camera's characteristics
+* in ONE batch to draw it — one malformed member took the kitchen camera's
+* whole read down and left it on "loading". Every characteristic here answers
+* with a real value, and the two that would negotiate a session answer with the
+* specification's own explicit refusal.
+*/
+/** Service UUIDs, § 3.2 and § 3.6. */
+var MULTI_TIER_RTP_SERVICE_UUID = "00008031-0000-1000-8000-0026BB765291";
+var GLOBAL_OPERATING_MODE_SERVICE_UUID = "00008032-0000-1000-8000-0026BB765291";
+/**
+* Characteristic UUIDs this specification adds.
+*
+* The RTP service and the WebRTC service each have their OWN tier
+* characteristics and they are not interchangeable — video is 0x8043 here and
+* 0x8059 there, audio is 0x8044 here and 0x805A there. Declaring a sibling's
+* UUID produces a service a controller reads and abandons with no error.
+*/
+var CHAR_RTP_SUPPORTED_VIDEO_STREAM_TIERS = "00008043-0000-1000-8000-0026BB765291";
+var CHAR_RTP_SUPPORTED_AUDIO_STREAM_TIERS = "00008044-0000-1000-8000-0026BB765291";
+var CHAR_RTP_STREAMING_CONTROL = "00008045-0000-1000-8000-0026BB765291";
+var CHAR_STREAMING_ENABLED = "00008041-0000-1000-8000-0026BB765291";
+var CHAR_SENSOR_UUID = "0000805B-0000-1000-8000-0026BB765291";
+/** Supported RTP Configuration, § 3.6: "must be set to AES_CM_128_HMAC_SHA1_80". */
+var SRTP_CRYPTO_SUITE_TYPE = 2;
+var AES_CM_128_HMAC_SHA1_80 = 0;
+function tlvCharacteristic(uuid, name, writable) {
+	return new import_dist.Characteristic(name, uuid, {
+		format: import_dist.Formats.TLV8,
+		perms: writable ? [
+			import_dist.Perms.PAIRED_READ,
+			import_dist.Perms.PAIRED_WRITE,
+			import_dist.Perms.NOTIFY
+		] : [import_dist.Perms.PAIRED_READ, import_dist.Perms.NOTIFY]
+	});
+}
+/** The video configurations advertised in Camera Capabilities, from the tiers
+*  we would actually offer — one source, so the two cannot drift. */
+function capabilitiesFromTiers(tiers, deviceId) {
+	return tiers.map((tier) => ({
+		identifier: sensorUuidForDevice(deviceId * 1e3 + tier.identifier),
+		quality: tier.quality,
+		width: tier.width,
+		height: tier.height,
+		framesPerSecond: tier.frameRate,
+		averageBitrateKbps: tier.targetAverageBitrateKbps,
+		peakBitrateKbps: peakBitrateKbpsFor(tier.width)
+	}));
+}
+function buildMultiTierServices(input) {
+	const { deviceId, logger } = input;
+	const sensorUuid = sensorUuidForDevice(deviceId);
+	const tiers = tiersForSensor(input.width, input.height);
+	const note = (what) => {
+		logger.info("hap multi-tier: controller touched a characteristic", {
+			tags: { deviceId },
+			meta: { characteristic: what }
+		});
+	};
+	const capabilities = new import_dist.Service("Camera Capabilities", CAMERA_CAPABILITIES_SERVICE_UUID, "camera-capabilities");
+	const version = new import_dist.Characteristic.Version();
+	version.onGet(() => {
+		note("version");
+		return CAMERA_CAPABILITIES_SPEC_VERSION;
+	});
+	capabilities.addCharacteristic(version);
+	const capabilitiesValue = encodeCameraCapabilities([{
+		sensorUuid,
+		type: SensorType.PRIMARY,
+		intent: SensorIntent.MAIN,
+		width: input.width,
+		height: input.height,
+		videoStreams: capabilitiesFromTiers(tiers, deviceId)
+	}]).toString("base64");
+	const capabilitiesChar = tlvCharacteristic(CHAR_CAMERA_CAPABILITIES, "Camera Capabilities", false);
+	capabilitiesChar.onGet(() => {
+		note("camera-capabilities");
+		return capabilitiesValue;
+	});
+	capabilities.addCharacteristic(capabilitiesChar);
+	const globalOperatingMode = new import_dist.Service("Camera Operating Mode", GLOBAL_OPERATING_MODE_SERVICE_UUID, "global-operating-mode");
+	let homeKitCameraActive = true;
+	const cameraActive = new import_dist.Characteristic.HomeKitCameraActive();
+	cameraActive.onGet(() => {
+		note("homekit-camera-active");
+		return homeKitCameraActive ? 1 : 0;
+	});
+	cameraActive.onSet((value) => {
+		homeKitCameraActive = value === 1 || value === true;
+	});
+	globalOperatingMode.addCharacteristic(cameraActive);
+	let globalStreamingEnabled = true;
+	const globalStreaming = new import_dist.Characteristic("Streaming Enabled", CHAR_STREAMING_ENABLED, {
+		format: import_dist.Formats.BOOL,
+		perms: [
+			import_dist.Perms.PAIRED_READ,
+			import_dist.Perms.PAIRED_WRITE,
+			import_dist.Perms.NOTIFY
+		]
+	});
+	globalStreaming.onGet(() => globalStreamingEnabled);
+	globalStreaming.onSet((value) => {
+		globalStreamingEnabled = value === true;
+	});
+	globalOperatingMode.addCharacteristic(globalStreaming);
+	const indicator = new import_dist.Characteristic.CameraOperatingModeIndicator();
+	indicator.onGet(() => 0);
+	globalOperatingMode.addCharacteristic(indicator);
+	const streamManagement = new import_dist.Service("CamStack multi tier", MULTI_TIER_RTP_SERVICE_UUID, "multi-tier");
+	let serviceStreamingEnabled = true;
+	const streamingEnabled = new import_dist.Characteristic("Streaming Enabled", CHAR_STREAMING_ENABLED, {
+		format: import_dist.Formats.BOOL,
+		perms: [
+			import_dist.Perms.PAIRED_READ,
+			import_dist.Perms.PAIRED_WRITE,
+			import_dist.Perms.NOTIFY
+		]
+	});
+	streamingEnabled.onGet(() => {
+		note("streaming-enabled");
+		return serviceStreamingEnabled;
+	});
+	streamingEnabled.onSet((value) => {
+		serviceStreamingEnabled = value === true;
+	});
+	streamManagement.addCharacteristic(streamingEnabled);
+	/**
+	* § 3.6's rule, written once and read everywhere it matters.
+	*
+	* It is deliberately an AND over four terms rather than a stored flag: a
+	* stored one would have to be invalidated from four places, and the one that
+	* got forgotten would leave the accessory claiming it can stream.
+	*/
+	const statusActive = () => serviceStreamingEnabled && globalStreamingEnabled && homeKitCameraActive && input.negotiation !== void 0;
+	const active = new import_dist.Characteristic.StatusActive();
+	active.onGet(() => {
+		const value = statusActive();
+		logger.info("hap multi-tier: status active read", {
+			tags: { deviceId },
+			meta: {
+				value,
+				serviceStreamingEnabled,
+				globalStreamingEnabled,
+				homeKitCameraActive,
+				hasNegotiator: input.negotiation !== void 0
+			}
+		});
+		return value;
+	});
+	streamManagement.addCharacteristic(active);
+	const videoTiersValue = encodeVideoStreamConfiguration({
+		codec: input.codec,
+		payloadType: 96,
+		tiers
+	}).toString("base64");
+	const videoTiers = tlvCharacteristic(CHAR_RTP_SUPPORTED_VIDEO_STREAM_TIERS, "Supported Video Stream Tiers", false);
+	videoTiers.onGet(() => {
+		note("supported-video-stream-tiers");
+		return videoTiersValue;
+	});
+	streamManagement.addCharacteristic(videoTiers);
+	const audioTiersValue = encodeAudioStreamConfiguration({
+		codec: TierAudioCodec.OPUS,
+		payloadType: 110,
+		tiers: [opusTierForCapture(input.audioCaptureRateHz)]
+	}).toString("base64");
+	const audioTiers = tlvCharacteristic(CHAR_RTP_SUPPORTED_AUDIO_STREAM_TIERS, "Supported Audio Stream Tiers", false);
+	audioTiers.onGet(() => {
+		note("supported-audio-stream-tiers");
+		return audioTiersValue;
+	});
+	streamManagement.addCharacteristic(audioTiers);
+	const rtpConfiguration = new import_dist.Characteristic.SupportedRTPConfiguration();
+	const rtpConfigurationValue = (0, import_dist.encode)(SRTP_CRYPTO_SUITE_TYPE, Buffer.from([AES_CM_128_HMAC_SHA1_80])).toString("base64");
+	rtpConfiguration.onGet(() => {
+		note("supported-rtp-configuration");
+		return rtpConfigurationValue;
+	});
+	streamManagement.addCharacteristic(rtpConfiguration);
+	const setupEndpoints = new import_dist.Characteristic.SetupEndpoints();
+	setupEndpoints.onGet(() => {
+		note("setup-endpoints");
+		return input.negotiation?.readSetupEndpoints() ?? encodeSetupEndpointsRefusal(SetupEndpointsStatus.ERROR);
+	});
+	setupEndpoints.onSet(async (value) => {
+		if (input.negotiation === void 0 || typeof value !== "string") {
+			logger.info("hap multi-tier: refused a setup-endpoints write", {
+				tags: { deviceId },
+				meta: { reason: input.negotiation === void 0 ? "no-negotiator" : "not-a-string" }
+			});
+			return;
+		}
+		await input.negotiation.handleSetupEndpointsWrite(value);
+	});
+	streamManagement.addCharacteristic(setupEndpoints);
+	const streamingControl = new import_dist.Characteristic("RTP Streaming Control", CHAR_RTP_STREAMING_CONTROL, {
+		format: import_dist.Formats.TLV8,
+		perms: [import_dist.Perms.PAIRED_READ, import_dist.Perms.PAIRED_WRITE]
+	});
+	streamingControl.onGet(() => {
+		note("rtp-streaming-control");
+		return input.negotiation?.readStreamingControl() ?? encodeRtpStreamingControlStatus(null, RtpStreamingStatus.ERROR);
+	});
+	streamingControl.onSet(async (value) => {
+		if (input.negotiation === void 0 || typeof value !== "string") {
+			logger.info("hap multi-tier: refused an rtp streaming control write", {
+				tags: { deviceId },
+				meta: { reason: input.negotiation === void 0 ? "no-negotiator" : "not-a-string" }
+			});
+			return;
+		}
+		await input.negotiation.handleStreamingControlWrite(value);
+	});
+	streamManagement.addCharacteristic(streamingControl);
+	const sensor = new import_dist.Characteristic("Sensor UUID", CHAR_SENSOR_UUID, {
+		format: import_dist.Formats.DATA,
+		perms: [import_dist.Perms.PAIRED_READ]
+	});
+	const sensorValue = sensorUuid.toString("base64");
+	sensor.onGet(() => {
+		note("sensor-uuid");
+		return sensorValue;
+	});
+	streamManagement.addCharacteristic(sensor);
+	return {
+		capabilities,
+		globalOperatingMode,
+		streamManagement
+	};
+}
+//#endregion
+//#region src/multi-tier/negotiation.ts
+/**
+* The adapter between Apple's new characteristics and the streaming engine this
+* addon already has.
+*
+* ## Why an adapter and not a second engine
+*
+* The multi-tier RTP service owns its OWN `Setup Endpoints` and `RTP Streaming
+* Control`, so hap-nodejs's `CameraController` never negotiates for it — and
+* the library's own handlers are all `private`, so its engine cannot be
+* borrowed either. But the sockets, the SRTP contexts, the ffmpeg pipeline and
+* the teardown are the same ones the classic service uses. A second copy would
+* be two engines to keep in agreement, and this repo has paid for that shape
+* before. So: new characteristics, one engine, through `StreamNegotiator`.
+*
+* ## What is different about the new flow
+*
+* The classic `Selected RTP Stream Configuration` carries the whole selected
+* configuration in its start — codec, profile, level, resolution, bitrate.
+* `RTP Streaming Control` carries a **tier identifier**, because the
+* configuration was agreed when we published `Supported Video Stream Tiers`.
+* So this maps an identifier back to the tier WE published, and a tier we never
+* published is `No Such Stream` — improvising a geometry there would serve a
+* stream the controller did not ask for and it would look like it worked.
+*
+* ## Every path answers
+*
+* A read of either characteristic always produces a valid TLV8. The Home app
+* reads a camera's characteristics in one batch, and one member that answers
+* nothing took the kitchen camera's whole read down and left it on "loading".
+* So an engine failure, a malformed write and "nothing has happened yet" are
+* all statuses, never silence.
+*/
+/** RTP payload types. 96 is the first dynamic one (RFC 3551); 110 is what our
+*  own Opus offers use. Both are echoed in the tier declaration. */
+var VIDEO_PAYLOAD_TYPE = 96;
+var AUDIO_PAYLOAD_TYPE = 110;
+/** RTCP interval in SECONDS, which is the unit the engine reads. */
+var RTCP_INTERVAL_SECONDS = 5;
+/** The MTU the classic path uses for an Ethernet-sized path. */
+var DEFAULT_MTU = 1378;
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function buildMultiTierNegotiation(input) {
+	const { deviceId, logger, negotiator } = input;
+	const log = logger.withTags({ deviceId });
+	let setupResponse = encodeSetupEndpointsRefusal(SetupEndpointsStatus.ERROR);
+	let controlResponse = encodeRtpStreamingControlStatus(null, RtpStreamingStatus.ERROR);
+	/** Sessions we have STARTED, so an End can tell "not started" from "unknown". */
+	const started = /* @__PURE__ */ new Set();
+	async function handleSetupEndpointsWrite(base64) {
+		let sessionId = null;
+		try {
+			const request = decodeSetupEndpointsRequest(base64);
+			sessionId = request.sessionId;
+			const prepareRequest = {
+				sessionID: request.sessionId,
+				sourceAddress: request.controllerAddress,
+				targetAddress: request.controllerAddress,
+				addressVersion: request.addressVersion,
+				video: {
+					port: request.videoPort,
+					srtpCryptoSuite: import_dist.SRTPCryptoSuites.AES_CM_128_HMAC_SHA1_80,
+					srtp_key: request.videoSrtp.key,
+					srtp_salt: request.videoSrtp.salt
+				},
+				audio: {
+					port: request.audioPort,
+					srtpCryptoSuite: import_dist.SRTPCryptoSuites.AES_CM_128_HMAC_SHA1_80,
+					srtp_key: request.audioSrtp.key,
+					srtp_salt: request.audioSrtp.salt
+				}
+			};
+			const prepared = await negotiator.prepare(prepareRequest);
+			setupResponse = encodeSetupEndpointsResponse({
+				sessionId: request.sessionId,
+				addressVersion: request.addressVersion,
+				accessoryAddress: prepared.localAddress,
+				videoPort: prepared.videoPort,
+				audioPort: prepared.audioPort,
+				videoSrtp: {
+					key: request.videoSrtp.key,
+					salt: request.videoSrtp.salt
+				},
+				audioSrtp: {
+					key: request.audioSrtp.key,
+					salt: request.audioSrtp.salt
+				},
+				videoSsrc: prepared.videoSsrc,
+				audioSsrc: prepared.audioSsrc
+			});
+			log.info("hap multi-tier: endpoints prepared", { meta: {
+				sessionId: request.sessionId,
+				controller: `${request.controllerAddress}:${request.videoPort}/${request.audioPort}`,
+				accessory: `${prepared.localAddress}:${prepared.videoPort}/${prepared.audioPort}`,
+				videoSsrc: prepared.videoSsrc,
+				audioSsrc: prepared.audioSsrc
+			} });
+		} catch (error) {
+			setupResponse = encodeSetupEndpointsRefusal(SetupEndpointsStatus.ERROR);
+			log.warn("hap multi-tier: setup endpoints refused", { meta: {
+				sessionId,
+				error: errorMessage(error)
+			} });
+		}
+	}
+	async function handleStreamingControlWrite(base64) {
+		let sessionId = null;
+		try {
+			const command = decodeRtpStreamingControl(base64);
+			sessionId = command.sessionId;
+			if (!negotiator.has(command.sessionId)) {
+				controlResponse = encodeRtpStreamingControlStatus(command.sessionId, RtpStreamingStatus.UNKNOWN_SESSION_IDENTIFIER);
+				log.warn("hap multi-tier: control write for a session that was never prepared", { meta: {
+					sessionId: command.sessionId,
+					command: command.command
+				} });
+				return;
+			}
+			if (command.command === RtpStreamingCommand.END) {
+				if (!started.has(command.sessionId)) {
+					controlResponse = encodeRtpStreamingControlStatus(command.sessionId, RtpStreamingStatus.NO_SUCH_STREAM);
+					return;
+				}
+				const stop = {
+					sessionID: command.sessionId,
+					type: import_dist.StreamRequestTypes.STOP
+				};
+				await negotiator.control(stop);
+				started.delete(command.sessionId);
+				controlResponse = encodeRtpStreamingControlStatus(command.sessionId, RtpStreamingStatus.SUCCESS);
+				log.info("hap multi-tier: stream ended", { meta: { sessionId: command.sessionId } });
+				return;
+			}
+			const tier = input.tiers.find((t) => t.identifier === command.videoTier);
+			if (tier === void 0) {
+				controlResponse = encodeRtpStreamingControlStatus(command.sessionId, RtpStreamingStatus.NO_SUCH_STREAM);
+				log.warn("hap multi-tier: start named a tier we never published", { meta: {
+					sessionId: command.sessionId,
+					requested: command.videoTier,
+					published: input.tiers.map((t) => t.identifier)
+				} });
+				return;
+			}
+			log.info("hap multi-tier: start ssrc comparison", { meta: {
+				sessionId: command.sessionId,
+				controllerVideoSsrc: command.videoSsrc ?? null,
+				controllerAudioSsrc: command.audioSsrc ?? null,
+				note: "accessory keeps the ssrcs it advertised at setup"
+			} });
+			const start = {
+				sessionID: command.sessionId,
+				type: import_dist.StreamRequestTypes.START,
+				video: {
+					codec: import_dist.VideoCodecType.H264,
+					profile: import_dist.H264Profile.HIGH,
+					level: import_dist.H264Level.LEVEL4_0,
+					packetizationMode: import_dist.VideoCodecPacketizationMode.NON_INTERLEAVED,
+					width: tier.width,
+					height: tier.height,
+					fps: tier.frameRate,
+					pt: VIDEO_PAYLOAD_TYPE,
+					ssrc: command.videoSsrc ?? 0,
+					max_bit_rate: tier.targetAverageBitrateKbps,
+					rtcp_interval: RTCP_INTERVAL_SECONDS,
+					mtu: DEFAULT_MTU
+				},
+				audio: {
+					codec: import_dist.AudioStreamingCodecType.OPUS,
+					channel: 1,
+					bit_rate: 24,
+					sample_rate: import_dist.AudioStreamingSamplerate.KHZ_24,
+					packet_time: 20,
+					pt: AUDIO_PAYLOAD_TYPE,
+					ssrc: command.audioSsrc ?? 0,
+					max_bit_rate: 24,
+					rtcp_interval: RTCP_INTERVAL_SECONDS,
+					comfort_pt: 13,
+					comfortNoiseEnabled: false
+				}
+			};
+			await negotiator.control(start);
+			started.add(command.sessionId);
+			controlResponse = encodeRtpStreamingControlStatus(command.sessionId, RtpStreamingStatus.SUCCESS);
+			log.info("hap multi-tier: stream started", { meta: {
+				sessionId: command.sessionId,
+				tier: tier.identifier,
+				geometry: `${tier.width}x${tier.height}@${tier.frameRate}`,
+				targetKbps: tier.targetAverageBitrateKbps,
+				codec: input.codec
+			} });
+		} catch (error) {
+			controlResponse = encodeRtpStreamingControlStatus(sessionId, RtpStreamingStatus.ERROR);
+			log.warn("hap multi-tier: control write refused", { meta: {
+				sessionId,
+				error: errorMessage(error)
+			} });
+		}
+	}
+	return {
+		handleSetupEndpointsWrite,
+		readSetupEndpoints: () => setupResponse,
+		handleStreamingControlWrite,
+		readStreamingControl: () => controlResponse
+	};
+}
+//#endregion
 //#region src/mappers/camera-accessory.ts
 /**
 * Camera accessory orchestrator — given a camstack deviceId, builds one
@@ -102243,6 +103783,35 @@ async function buildCameraAccessory(input) {
 		...recording === null || !capNames.has("motion-detection") ? {} : { sensors: { motion: true } }
 	});
 	accessory.configureController(controller);
+	if (options.hapDeviceSettings.multiTierService !== false) {
+		const sensor = advertisedVideo.sensor;
+		const services = buildMultiTierServices({
+			deviceId: numericId,
+			logger: ctx.logger,
+			width: sensor.width,
+			height: sensor.height,
+			codec: sensor.codec,
+			audioCaptureRateHz: 16e3,
+			negotiation: buildMultiTierNegotiation({
+				deviceId: numericId,
+				logger: ctx.logger,
+				negotiator: streams.negotiator,
+				tiers: tiersForSensor(sensor.width, sensor.height),
+				codec: sensor.codec
+			})
+		});
+		accessory.addService(services.capabilities);
+		accessory.addService(services.globalOperatingMode);
+		accessory.addService(services.streamManagement);
+		ctx.logger.info("hap multi-tier: services declared on this accessory", {
+			tags: { deviceId: numericId },
+			meta: {
+				serviceUuid: MULTI_TIER_RTP_SERVICE_UUID,
+				codec: sensor.codec === TierVideoCodec.H265 ? "h265" : "h264",
+				sensor: `${sensor.width}x${sensor.height}`
+			}
+		});
+	}
 	if (recording !== null) {
 		handles.push({ dispose: () => recording.dispose() });
 		const audioCharacteristic = (controller.recordingManagement?.operatingModeService)?.getCharacteristic(import_dist.Characteristic.RecordingAudioActive);
@@ -103223,6 +104792,24 @@ var DEFAULT_DEVICE_SETTINGS = {
 function resolveHksvRecording(settings) {
 	return settings?.hksvRecording !== false;
 }
+/**
+* Whether this camera offers Apple's NEW camera service alongside the classic
+* one — `camera-multi-tier-rtp-stream-management` (0x8031), where HEVC and 4K
+* live.
+*
+* ABSENT MEANS ON, like `resolveHksvRecording` and for the same reason: a
+* camera exposed before this field existed must not silently lose it. Only an
+* explicit `false` turns it off.
+*
+* Safe as a default because the FALLBACK is the controller's own and it was
+* measured: iOS reads the new service's characteristics and, finding it
+* unusable, opens its session on the classic one two seconds later. Until the
+* negotiation is built we say `streaming-enabled: false`, so declining is the
+* only thing a controller can do with it.
+*/
+function resolveMultiTierService(settings) {
+	return settings?.multiTierService === true;
+}
 var HAP_STREAM_PREFERENCE_OPTIONS = [
 	{
 		value: "auto",
@@ -103454,7 +105041,18 @@ var ExportHapAddon = class extends BaseAddon {
 			note: qr !== void 0 ? "Scan the QR with the iOS Camera app to pair the first exposed camera. Add additional cameras from iOS Home → + → Add Accessory; the setup code above applies to all of them." : "Each exposed camera is published as its OWN HomeKit accessory (cameras cannot be bridged). In the iOS Home app, tap + → Add Accessory: each exposed camera appears separately by name; add each one and enter this same setup code."
 		};
 	}
-	async exposeDevice(deviceId, capabilities) {
+	/**
+	* @param settings Settings to build the accessory WITH.
+	*
+	* Needed because the only path a per-camera settings change takes is
+	* `unexposeDevice` then `exposeDevice`, and the unexpose deletes the stored
+	* entry — so `carryForward` below has nothing to carry and the accessory is
+	* rebuilt on the DEFAULTS. Persisting the value afterwards is not enough:
+	* the mapper, and with it the advertised resolution list, is already built.
+	* Measured 2026-09-17 — the stored value read `mid` while the advertisement
+	* still said `streamPreference=auto`.
+	*/
+	async exposeDevice(deviceId, capabilities, settings) {
 		const numericId = Number.parseInt(deviceId, 10);
 		const log = this.ctx.logger.withTags({ deviceId: numericId });
 		if (this.exposed.has(deviceId)) {
@@ -103466,12 +105064,16 @@ var ExportHapAddon = class extends BaseAddon {
 		if (!mapperKind) throw new Error(`export-hap: device ${numericId} has type '${summary?.type ?? "unknown"}', which HomeKit export does not support`);
 		const displayName = summary?.name ?? `Device ${deviceId}`;
 		const previous = this.config.exposed.find((e) => e.deviceId === deviceId);
-		const baseEntry = carryForward({
+		const rebuilt = {
 			deviceId,
 			displayName,
 			mapperKind,
 			addedAt: previous?.addedAt ?? Date.now(),
 			...capabilities ? { capabilities: [...capabilities] } : {}
+		};
+		const baseEntry = carryForward(settings === void 0 ? rebuilt : {
+			...rebuilt,
+			settings
 		}, previous, ["settings", "capabilities"]);
 		const attached = await this.attachMapper(baseEntry);
 		const finalEntry = {
@@ -103515,6 +105117,7 @@ var ExportHapAddon = class extends BaseAddon {
 				hapDeviceSettings: {
 					streamPreference: entrySettings.streamPreference ?? "auto",
 					hksvRecording: resolveHksvRecording(entrySettings),
+					multiTierService: resolveMultiTierService(entrySettings),
 					allowTranscode: entrySettings.allowTranscode !== false
 				}
 			}
@@ -103845,6 +105448,7 @@ var ExportHapAddon = class extends BaseAddon {
 		const enabledKey = `hap:${deviceId}:enabled`;
 		const streamPreferenceKey = `hap:${deviceId}:streamPreference`;
 		const hksvKey = `hap:${deviceId}:hksvRecording`;
+		const multiTierKey = `hap:${deviceId}:multiTierService`;
 		const useBridgeKey = `hap:${deviceId}:useBridge`;
 		const allowTranscodeKey = `hap:${deviceId}:allowTranscode`;
 		const mapper = this.exposed.get(String(deviceId)) ?? null;
@@ -103904,6 +105508,19 @@ var ExportHapAddon = class extends BaseAddon {
 				},
 				immediate: true
 			},
+			{
+				type: "boolean",
+				key: multiTierKey,
+				label: "Offer the new HomeKit camera service (HEVC / 4K)",
+				description: "Declares Apple’s multi-tier camera service beside the classic one, advertising what this sensor can really produce. Today a controller reads it and still streams over the classic H.264 path — the negotiation is being built. Turn it off if this camera behaves oddly in iOS Home.",
+				style: "switch",
+				value: resolveMultiTierService(settings),
+				showWhen: {
+					field: enabledKey,
+					equals: true
+				},
+				immediate: true
+			},
 			{
 				type: "boolean",
 				key: allowTranscodeKey,
@@ -103990,18 +105607,21 @@ var ExportHapAddon = class extends BaseAddon {
 		const hksvKey = `hap:${deviceId}:hksvRecording`;
 		const useBridgeKey = `hap:${deviceId}:useBridge`;
 		const allowTranscodeKey = `hap:${deviceId}:allowTranscode`;
+		const multiTierKey = `hap:${deviceId}:multiTierService`;
 		const enabledValue = enabledKey in patch ? Boolean(patch[enabledKey]) : wasEnabled;
 		const streamPreferenceRaw = streamPreferenceKey in patch ? patch[streamPreferenceKey] : current?.settings?.streamPreference;
 		const streamPreference = typeof streamPreferenceRaw === "string" && streamPreferenceRaw.trim().length > 0 ? streamPreferenceRaw : "auto";
 		const hksvRecording = hksvKey in patch ? Boolean(patch[hksvKey]) : resolveHksvRecording(current?.settings);
 		const useBridge = useBridgeKey in patch ? Boolean(patch[useBridgeKey]) : current?.settings?.useBridge !== false;
 		const allowTranscode = allowTranscodeKey in patch ? Boolean(patch[allowTranscodeKey]) : current?.settings?.allowTranscode !== false;
+		const multiTierService = multiTierKey in patch ? Boolean(patch[multiTierKey]) : resolveMultiTierService(current?.settings);
 		const nextSettings = {
 			...current?.settings ?? DEFAULT_DEVICE_SETTINGS,
 			streamPreference,
 			hksvRecording,
 			useBridge,
-			allowTranscode
+			allowTranscode,
+			multiTierService
 		};
 		if (!enabledValue) {
 			if (wasEnabled) await this.unexposeDevice(deviceIdStr);
@@ -104041,7 +105661,7 @@ var ExportHapAddon = class extends BaseAddon {
 			} });
 			try {
 				await this.unexposeDevice(deviceIdStr, { clearPairing: wasBridged !== willBridge });
-				await this.exposeDevice(deviceIdStr);
+				await this.exposeDevice(deviceIdStr, void 0, nextSettings);
 			} catch (err) {
 				log.warn("export-hap: failed to refresh accessory after a settings change", { meta: { error: errMsg(err) } });
 			}
@@ -104071,4 +105691,5 @@ exports.deriveUsername = deriveUsername;
 exports.initHapStorage = initHapStorage;
 exports.publishStandalone = publishStandalone;
 exports.resolveHksvRecording = resolveHksvRecording;
+exports.resolveMultiTierService = resolveMultiTierService;
 exports.unpublishAccessory = unpublishAccessory;