@camstack/addon-pipeline-orchestrator 1.2.264 → 1.2.265

package/dist/index.js

@@ -8036,7 +8036,59 @@ function errMsg$1(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-BK-GTFYb.mjs
+//#region ../types/dist/composition-Dq42XWp0.mjs
+/**
+* The ffmpeg build every CamStack node downloads, per platform and arch.
+*
+* ## Why a download, on every node, including the container
+*
+* The version of ffmpeg used to be CODE: baked into the image, changeable only
+* by rebuilding and rolling it. Now it is DATA — this file states the release,
+* and a node that boots with a different one downloads it. Changing ffmpeg is a
+* framework bump, not an image rebuild.
+*
+* It also settles the licence question by removing it. FFmpeg's licence is
+* chosen at compile time: the core is LGPL 2.1+, `--enable-gpl` makes it GPL
+* (for x264/x265), `--enable-version3` makes that v3, and `--enable-nonfree`
+* makes the result undistributable. These are GPL v3 builds, and we do not
+* distribute them: the user's own node fetches the archive from the project
+* that publishes it, so we convey no GPL work and inherit none of the
+* obligations that come with conveying one. That is the whole reason the image
+* no longer installs ffmpeg at all — not a technical preference.
+*
+* ## Why jellyfin-ffmpeg
+*
+* One vendor covering linux-amd64, linux-arm64, darwin-arm64 and darwin-x64
+* from one release, with the widest hardware surface of anything maintained:
+* VAAPI, QSV, NVENC/NVDEC, AMF, Vulkan, OpenCL and DRM on amd64, plus Rockchip
+* MPP on arm64. It reaches the vendor libraries through dlopen trampolines,
+* so the binary is not linked against a driver stack it may not find.
+*
+* **What it still needs from the host, measured 2026-09-19.** On the Unraid
+* HOST, which has no libva, `-vaapi_device` aborts the process outright —
+* `implib-gen: libva-drm.so.2: failed to load library ... Assertion '0 &&
+* "Assertion in generated code"' failed`. Inside our container, which installs
+* libva plus the iHD driver, the same command encodes: verified end to end with
+* `testsrc → format=nv12,hwupload → h264_vaapi`. So the image drops ffmpeg and
+* KEEPS the Intel media stack; the drivers are the part a binary cannot bring.
+*
+* ## Why each artifact carries a checksum and a claim
+*
+* The download is now the only source, so `sha256` is verified before anything
+* is extracted — jellyfin publishes no checksums on its release assets, so
+* these are ours, taken at the version bump. And `expectedHwaccels` is what the
+* build is supposed to be able to do: a binary that probes short of its own
+* claim is a source that changed under us, which is precisely what went
+* unnoticed for months when a static build turned out to carry no VAAPI at all
+* (D536).
+*/
+/** The pinned jellyfin-ffmpeg release. Changing this is the version change. */
+var FFMPEG_RELEASE = "8.1.2-5";
+var BASE = `https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/v${FFMPEG_RELEASE}`;
+function portable(target) {
+	return `${BASE}/jellyfin-ffmpeg_${FFMPEG_RELEASE}_portable_${target}-gpl.tar.xz`;
+}
+portable("linux64"), portable("linuxarm64"), portable("macarm64"), portable("mac64");
 /**
 * LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
 * valutatore puro del suo FRONTE.
@@ -14076,6 +14128,70 @@ var CompositionBlockStateSchema = object({
 	reason: string().optional(),
 	fields: array(CompositionFieldStateSchema)
 });
+var NUMBER = {
+	kind: "fixed",
+	result: ["number"]
+};
+var BOOLEAN = {
+	kind: "fixed",
+	result: ["boolean"]
+};
+Object.freeze({
+	min: NUMBER,
+	max: NUMBER,
+	abs: NUMBER,
+	floor: NUMBER,
+	ceil: NUMBER,
+	sqrt: NUMBER,
+	round: NUMBER,
+	pow: NUMBER,
+	clamp: NUMBER,
+	avg: NUMBER,
+	sum: NUMBER,
+	age: NUMBER,
+	convert: NUMBER,
+	coalesce: { kind: "coalesce" },
+	any: BOOLEAN,
+	all: BOOLEAN,
+	within: BOOLEAN,
+	latest: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	number: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	rose: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	count: NUMBER
+});
+`${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
+/**
+* What a composition may BUILD on a device type (G2, D676): the caps a new
+* device of that type, or an existing one that lacks them, can be given. The
+* blockers are the validator's own refusal codes, and a spec compares this
+* listing with `planComposition` for every capability — the editor can never
+* offer a feature the save would refuse for the same reason.
+*/
+var ComposableFieldSchema = object({
+	path: string(),
+	kind: CompositionFieldKindSchema,
+	nullable: boolean(),
+	required: boolean(),
+	enumValues: array(string()).optional()
+});
+var ComposableCapabilitiesSchema = object({ caps: array(object({
+	cap: string(),
+	fields: array(ComposableFieldSchema),
+	/** Present for an item-array cap (`consumables.items`). */
+	itemArray: object({
+		path: string(),
+		keyField: string()
+	}).optional()
+})) });
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
@@ -14240,7 +14356,7 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 }), method(object({ blockId: string() }), CompositionGetReadSchema, { auth: "admin" }), method(object({}), CompositionListReadSchema, { auth: "admin" }), method(object({
 	addonId: string().min(1),
 	stableId: string().min(1)
-}), CompositionCustomizationReadSchema, { auth: "admin" }), method(object({
+}), CompositionCustomizationReadSchema, { auth: "admin" }), method(object({ deviceType: _enum(DeviceType) }), ComposableCapabilitiesSchema, { auth: "admin" }), method(object({
 	composition: CompositionSchema,
 	blockId: string().optional()
 }), CompositionValidationSchema, {
@@ -25698,6 +25814,16 @@ var NodeInferenceDevicesSchema = object({
 * Strictly the control plane: never sees a frame, never calls inference,
 * never drains queues. The runner does that work locally on each agent.
 */
+/**
+* The input of `setCameraSensors` (G5, D676): the ONE typed write path of a
+* camera's attached sensors (D672). `config: null` removes the attachment —
+* the camera reads `not-configured` again, never `unreadable`.
+*/
+var SetCameraSensorsInputSchema = object({
+	deviceId: number().int().nonnegative(),
+	/** `null` removes the attachment: the camera goes back to `not-configured`. */
+	config: CameraSensorsConfigSchema.nullable()
+});
 var pipelineOrchestratorCapability = {
 	name: "pipeline-orchestrator",
 	scope: "system",
@@ -26163,6 +26289,18 @@ var pipelineOrchestratorCapability = {
 		*/
 		getCameraStatuses: method(object({ deviceIds: array(number()).optional() }), array(CameraStatusSchema).readonly()),
 		/**
+		* Attach sensors to a camera, or detach them with `config: null` (D672
+		* configuration, G5/D676). Written to the orchestrator's per-device store
+		* under the same key `applyDeviceSettingsPatch` writes, and announced as a
+		* settings change so the camera-sensors bridge refreshes. Refused by name
+		* — nothing written — for a device that cannot be read, does not exist,
+		* is not a camera, or names itself as its own sensor.
+		*/
+		setCameraSensors: method(SetCameraSensorsInputSchema, object({ success: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Disk-wins fleet reconcile after a recordings wipe. Starts the walk in
 		* the addon process and returns immediately with the job snapshot — the
 		* work outlives the tRPC/UDS 60s timeout. Poll `getReconcileFromDiskStatus`.
@@ -37192,47 +37330,6 @@ var zoneRulesCapability = {
 	*/
 	durability: "restored"
 };
-var NUMBER = {
-	kind: "fixed",
-	result: ["number"]
-};
-var BOOLEAN = {
-	kind: "fixed",
-	result: ["boolean"]
-};
-Object.freeze({
-	min: NUMBER,
-	max: NUMBER,
-	abs: NUMBER,
-	floor: NUMBER,
-	ceil: NUMBER,
-	sqrt: NUMBER,
-	round: NUMBER,
-	pow: NUMBER,
-	clamp: NUMBER,
-	avg: NUMBER,
-	sum: NUMBER,
-	age: NUMBER,
-	convert: NUMBER,
-	coalesce: { kind: "coalesce" },
-	any: BOOLEAN,
-	all: BOOLEAN,
-	within: BOOLEAN,
-	latest: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	number: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	rose: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	count: NUMBER
-});
-`${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
 /**
 * Accessory device helpers — shared across drivers.
 *
@@ -39683,6 +39780,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.listComposableCaps": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"coreBlocks.listCompositions": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -43367,6 +43470,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraSensors": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCameraStepOverride": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -47077,6 +47186,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.setCameraSensors": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.setCameraStepOverride": [{
 		name: "deviceId",
 		form: "single",
@@ -49698,6 +49812,52 @@ var AudioSubscriptionController = class {
 	}
 };
 //#endregion
+//#region src/camera-sensors/write.ts
+/**
+* The ONE typed write path of a camera's attached sensors (D672 config,
+* G5/D676) — `pipelineOrchestrator.setCameraSensors`.
+*
+* The input is already validated by the cap schema at the router. Here it is
+* refused BY NAME, and logged with the device tag, before anything is written
+* (D391): a device that could not be read (a failed read changes nothing,
+* D49), an unknown device, a non-camera, a camera named as its own sensor.
+* The value is then handed to `writeDeviceStore` under the CS-1 key, which the
+* addon binds to `applyDeviceSettingsPatch` — so the D672 patch gate, the
+* PARSED value, the store and the settings-updated event that refreshes the
+* bridge's resolver are ONE path, never a copy of it. `null` clears: the
+* device store keeps a null key, and `parseCameraSensorsSetting` reads it as
+* not-configured.
+*/
+function refuse(deps, deviceId, reason) {
+	deps.logger.warn("camera sensors write refused", {
+		tags: { deviceId },
+		meta: { reason }
+	});
+	throw new Error(`pipeline-orchestrator: camera sensors of ${deviceId} not saved — ${reason}`);
+}
+async function readOrRefuse(deps, deviceId) {
+	let device;
+	try {
+		device = await deps.readDevice(deviceId);
+	} catch (err) {
+		return refuse(deps, deviceId, `could not read device ${deviceId}: ${errMsg$1(err)}`);
+	}
+	if (device === null) return refuse(deps, deviceId, `no device ${deviceId}`);
+	return device;
+}
+async function writeCameraSensors(deps, input) {
+	const { deviceId, config } = input;
+	const device = await readOrRefuse(deps, deviceId);
+	if (device.type !== DeviceType.Camera) return refuse(deps, deviceId, `device ${deviceId} is not a camera`);
+	if (config !== null && config.sensors.some((s) => s.addonId === device.addonId && s.stableId === device.stableId)) return refuse(deps, deviceId, "a camera cannot be its own sensor");
+	await deps.writeDeviceStore(deviceId, { [CAMERA_SENSORS_SETTINGS_KEY]: config });
+	deps.logger.info("camera sensors saved", {
+		tags: { deviceId },
+		meta: { sensors: config === null ? 0 : config.sensors.length }
+	});
+	return { success: true };
+}
+//#endregion
 //#region src/disk-reconcile-fleet.ts
 async function reconcileFleetFromDisk(deps) {
 	const deviceIds = await deps.listDeviceIds();
@@ -66215,6 +66375,37 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		return this.deviceConfig.applyDeviceSettingsPatch(input);
 	}
 	/**
+	* The one typed write path of a camera's attached sensors (G5, D676) — see
+	* `camera-sensors/write.ts`. Its refusals run first; the store write then
+	* goes THROUGH `applyDeviceSettingsPatch`, so the D672 patch gate, the
+	* parsed value, the key and the `OrchestrationSettingsUpdated` event are the
+	* one path a camera configured through the device page already takes.
+	*/
+	async setCameraSensors(input) {
+		const ctx = this.ctx;
+		const deviceConfig = this.deviceConfig;
+		if (deviceConfig === null) throw new Error("pipeline-orchestrator: not initialised — camera sensors not saved");
+		const api = ctx.api;
+		return writeCameraSensors({
+			readDevice: async (deviceId) => {
+				if (!api) throw new Error("the device registry is not reachable");
+				const dev = await api.deviceManager.getDevice.query({ deviceId });
+				return dev === null || dev === void 0 ? null : {
+					type: dev.type,
+					addonId: dev.addonId,
+					stableId: dev.stableId
+				};
+			},
+			writeDeviceStore: async (deviceId, patch) => {
+				await deviceConfig.applyDeviceSettingsPatch({
+					deviceId,
+					patch
+				});
+			},
+			logger: ctx.logger.child("camera-sensors")
+		}, input);
+	}
+	/**
 	* Apply the subset of global settings that affect runtime behaviour
 	* (balancer thresholds, broker timeout, failover policy) into the
 	* in-memory state so subsequent `balance()` / `handleNodeDisconnect`

package/dist/index.mjs

@@ -8008,7 +8008,59 @@ function errMsg$1(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-BK-GTFYb.mjs
+//#region ../types/dist/composition-Dq42XWp0.mjs
+/**
+* The ffmpeg build every CamStack node downloads, per platform and arch.
+*
+* ## Why a download, on every node, including the container
+*
+* The version of ffmpeg used to be CODE: baked into the image, changeable only
+* by rebuilding and rolling it. Now it is DATA — this file states the release,
+* and a node that boots with a different one downloads it. Changing ffmpeg is a
+* framework bump, not an image rebuild.
+*
+* It also settles the licence question by removing it. FFmpeg's licence is
+* chosen at compile time: the core is LGPL 2.1+, `--enable-gpl` makes it GPL
+* (for x264/x265), `--enable-version3` makes that v3, and `--enable-nonfree`
+* makes the result undistributable. These are GPL v3 builds, and we do not
+* distribute them: the user's own node fetches the archive from the project
+* that publishes it, so we convey no GPL work and inherit none of the
+* obligations that come with conveying one. That is the whole reason the image
+* no longer installs ffmpeg at all — not a technical preference.
+*
+* ## Why jellyfin-ffmpeg
+*
+* One vendor covering linux-amd64, linux-arm64, darwin-arm64 and darwin-x64
+* from one release, with the widest hardware surface of anything maintained:
+* VAAPI, QSV, NVENC/NVDEC, AMF, Vulkan, OpenCL and DRM on amd64, plus Rockchip
+* MPP on arm64. It reaches the vendor libraries through dlopen trampolines,
+* so the binary is not linked against a driver stack it may not find.
+*
+* **What it still needs from the host, measured 2026-09-19.** On the Unraid
+* HOST, which has no libva, `-vaapi_device` aborts the process outright —
+* `implib-gen: libva-drm.so.2: failed to load library ... Assertion '0 &&
+* "Assertion in generated code"' failed`. Inside our container, which installs
+* libva plus the iHD driver, the same command encodes: verified end to end with
+* `testsrc → format=nv12,hwupload → h264_vaapi`. So the image drops ffmpeg and
+* KEEPS the Intel media stack; the drivers are the part a binary cannot bring.
+*
+* ## Why each artifact carries a checksum and a claim
+*
+* The download is now the only source, so `sha256` is verified before anything
+* is extracted — jellyfin publishes no checksums on its release assets, so
+* these are ours, taken at the version bump. And `expectedHwaccels` is what the
+* build is supposed to be able to do: a binary that probes short of its own
+* claim is a source that changed under us, which is precisely what went
+* unnoticed for months when a static build turned out to carry no VAAPI at all
+* (D536).
+*/
+/** The pinned jellyfin-ffmpeg release. Changing this is the version change. */
+var FFMPEG_RELEASE = "8.1.2-5";
+var BASE = `https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/v${FFMPEG_RELEASE}`;
+function portable(target) {
+	return `${BASE}/jellyfin-ffmpeg_${FFMPEG_RELEASE}_portable_${target}-gpl.tar.xz`;
+}
+portable("linux64"), portable("linuxarm64"), portable("macarm64"), portable("mac64");
 /**
 * LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
 * valutatore puro del suo FRONTE.
@@ -14048,6 +14100,70 @@ var CompositionBlockStateSchema = object({
 	reason: string().optional(),
 	fields: array(CompositionFieldStateSchema)
 });
+var NUMBER = {
+	kind: "fixed",
+	result: ["number"]
+};
+var BOOLEAN = {
+	kind: "fixed",
+	result: ["boolean"]
+};
+Object.freeze({
+	min: NUMBER,
+	max: NUMBER,
+	abs: NUMBER,
+	floor: NUMBER,
+	ceil: NUMBER,
+	sqrt: NUMBER,
+	round: NUMBER,
+	pow: NUMBER,
+	clamp: NUMBER,
+	avg: NUMBER,
+	sum: NUMBER,
+	age: NUMBER,
+	convert: NUMBER,
+	coalesce: { kind: "coalesce" },
+	any: BOOLEAN,
+	all: BOOLEAN,
+	within: BOOLEAN,
+	latest: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	number: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	rose: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	count: NUMBER
+});
+`${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
+/**
+* What a composition may BUILD on a device type (G2, D676): the caps a new
+* device of that type, or an existing one that lacks them, can be given. The
+* blockers are the validator's own refusal codes, and a spec compares this
+* listing with `planComposition` for every capability — the editor can never
+* offer a feature the save would refuse for the same reason.
+*/
+var ComposableFieldSchema = object({
+	path: string(),
+	kind: CompositionFieldKindSchema,
+	nullable: boolean(),
+	required: boolean(),
+	enumValues: array(string()).optional()
+});
+var ComposableCapabilitiesSchema = object({ caps: array(object({
+	cap: string(),
+	fields: array(ComposableFieldSchema),
+	/** Present for an item-array cap (`consumables.items`). */
+	itemArray: object({
+		path: string(),
+		keyField: string()
+	}).optional()
+})) });
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
@@ -14212,7 +14328,7 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 }), method(object({ blockId: string() }), CompositionGetReadSchema, { auth: "admin" }), method(object({}), CompositionListReadSchema, { auth: "admin" }), method(object({
 	addonId: string().min(1),
 	stableId: string().min(1)
-}), CompositionCustomizationReadSchema, { auth: "admin" }), method(object({
+}), CompositionCustomizationReadSchema, { auth: "admin" }), method(object({ deviceType: _enum(DeviceType) }), ComposableCapabilitiesSchema, { auth: "admin" }), method(object({
 	composition: CompositionSchema,
 	blockId: string().optional()
 }), CompositionValidationSchema, {
@@ -25670,6 +25786,16 @@ var NodeInferenceDevicesSchema = object({
 * Strictly the control plane: never sees a frame, never calls inference,
 * never drains queues. The runner does that work locally on each agent.
 */
+/**
+* The input of `setCameraSensors` (G5, D676): the ONE typed write path of a
+* camera's attached sensors (D672). `config: null` removes the attachment —
+* the camera reads `not-configured` again, never `unreadable`.
+*/
+var SetCameraSensorsInputSchema = object({
+	deviceId: number().int().nonnegative(),
+	/** `null` removes the attachment: the camera goes back to `not-configured`. */
+	config: CameraSensorsConfigSchema.nullable()
+});
 var pipelineOrchestratorCapability = {
 	name: "pipeline-orchestrator",
 	scope: "system",
@@ -26135,6 +26261,18 @@ var pipelineOrchestratorCapability = {
 		*/
 		getCameraStatuses: method(object({ deviceIds: array(number()).optional() }), array(CameraStatusSchema).readonly()),
 		/**
+		* Attach sensors to a camera, or detach them with `config: null` (D672
+		* configuration, G5/D676). Written to the orchestrator's per-device store
+		* under the same key `applyDeviceSettingsPatch` writes, and announced as a
+		* settings change so the camera-sensors bridge refreshes. Refused by name
+		* — nothing written — for a device that cannot be read, does not exist,
+		* is not a camera, or names itself as its own sensor.
+		*/
+		setCameraSensors: method(SetCameraSensorsInputSchema, object({ success: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Disk-wins fleet reconcile after a recordings wipe. Starts the walk in
 		* the addon process and returns immediately with the job snapshot — the
 		* work outlives the tRPC/UDS 60s timeout. Poll `getReconcileFromDiskStatus`.
@@ -37164,47 +37302,6 @@ var zoneRulesCapability = {
 	*/
 	durability: "restored"
 };
-var NUMBER = {
-	kind: "fixed",
-	result: ["number"]
-};
-var BOOLEAN = {
-	kind: "fixed",
-	result: ["boolean"]
-};
-Object.freeze({
-	min: NUMBER,
-	max: NUMBER,
-	abs: NUMBER,
-	floor: NUMBER,
-	ceil: NUMBER,
-	sqrt: NUMBER,
-	round: NUMBER,
-	pow: NUMBER,
-	clamp: NUMBER,
-	avg: NUMBER,
-	sum: NUMBER,
-	age: NUMBER,
-	convert: NUMBER,
-	coalesce: { kind: "coalesce" },
-	any: BOOLEAN,
-	all: BOOLEAN,
-	within: BOOLEAN,
-	latest: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	number: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	rose: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	count: NUMBER
-});
-`${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
 /**
 * Accessory device helpers — shared across drivers.
 *
@@ -39655,6 +39752,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.listComposableCaps": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"coreBlocks.listCompositions": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -43339,6 +43442,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraSensors": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCameraStepOverride": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -47049,6 +47158,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.setCameraSensors": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.setCameraStepOverride": [{
 		name: "deviceId",
 		form: "single",
@@ -49670,6 +49784,52 @@ var AudioSubscriptionController = class {
 	}
 };
 //#endregion
+//#region src/camera-sensors/write.ts
+/**
+* The ONE typed write path of a camera's attached sensors (D672 config,
+* G5/D676) — `pipelineOrchestrator.setCameraSensors`.
+*
+* The input is already validated by the cap schema at the router. Here it is
+* refused BY NAME, and logged with the device tag, before anything is written
+* (D391): a device that could not be read (a failed read changes nothing,
+* D49), an unknown device, a non-camera, a camera named as its own sensor.
+* The value is then handed to `writeDeviceStore` under the CS-1 key, which the
+* addon binds to `applyDeviceSettingsPatch` — so the D672 patch gate, the
+* PARSED value, the store and the settings-updated event that refreshes the
+* bridge's resolver are ONE path, never a copy of it. `null` clears: the
+* device store keeps a null key, and `parseCameraSensorsSetting` reads it as
+* not-configured.
+*/
+function refuse(deps, deviceId, reason) {
+	deps.logger.warn("camera sensors write refused", {
+		tags: { deviceId },
+		meta: { reason }
+	});
+	throw new Error(`pipeline-orchestrator: camera sensors of ${deviceId} not saved — ${reason}`);
+}
+async function readOrRefuse(deps, deviceId) {
+	let device;
+	try {
+		device = await deps.readDevice(deviceId);
+	} catch (err) {
+		return refuse(deps, deviceId, `could not read device ${deviceId}: ${errMsg$1(err)}`);
+	}
+	if (device === null) return refuse(deps, deviceId, `no device ${deviceId}`);
+	return device;
+}
+async function writeCameraSensors(deps, input) {
+	const { deviceId, config } = input;
+	const device = await readOrRefuse(deps, deviceId);
+	if (device.type !== DeviceType.Camera) return refuse(deps, deviceId, `device ${deviceId} is not a camera`);
+	if (config !== null && config.sensors.some((s) => s.addonId === device.addonId && s.stableId === device.stableId)) return refuse(deps, deviceId, "a camera cannot be its own sensor");
+	await deps.writeDeviceStore(deviceId, { [CAMERA_SENSORS_SETTINGS_KEY]: config });
+	deps.logger.info("camera sensors saved", {
+		tags: { deviceId },
+		meta: { sensors: config === null ? 0 : config.sensors.length }
+	});
+	return { success: true };
+}
+//#endregion
 //#region src/disk-reconcile-fleet.ts
 async function reconcileFleetFromDisk(deps) {
 	const deviceIds = await deps.listDeviceIds();
@@ -66187,6 +66347,37 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		return this.deviceConfig.applyDeviceSettingsPatch(input);
 	}
 	/**
+	* The one typed write path of a camera's attached sensors (G5, D676) — see
+	* `camera-sensors/write.ts`. Its refusals run first; the store write then
+	* goes THROUGH `applyDeviceSettingsPatch`, so the D672 patch gate, the
+	* parsed value, the key and the `OrchestrationSettingsUpdated` event are the
+	* one path a camera configured through the device page already takes.
+	*/
+	async setCameraSensors(input) {
+		const ctx = this.ctx;
+		const deviceConfig = this.deviceConfig;
+		if (deviceConfig === null) throw new Error("pipeline-orchestrator: not initialised — camera sensors not saved");
+		const api = ctx.api;
+		return writeCameraSensors({
+			readDevice: async (deviceId) => {
+				if (!api) throw new Error("the device registry is not reachable");
+				const dev = await api.deviceManager.getDevice.query({ deviceId });
+				return dev === null || dev === void 0 ? null : {
+					type: dev.type,
+					addonId: dev.addonId,
+					stableId: dev.stableId
+				};
+			},
+			writeDeviceStore: async (deviceId, patch) => {
+				await deviceConfig.applyDeviceSettingsPatch({
+					deviceId,
+					patch
+				});
+			},
+			logger: ctx.logger.child("camera-sensors")
+		}, input);
+	}
+	/**
 	* Apply the subset of global settings that affect runtime behaviour
 	* (balancer thresholds, broker timeout, failover policy) into the
 	* in-memory state so subsequent `balance()` / `handleNodeDisconnect`