@camstack/addon-pipeline 1.2.257 → 1.2.259

package/dist/stream-broker/index.js

@@ -3,12 +3,12 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-BMARLLlX.js");
-const require_node = require("../node-Ca-vE0xX.js");
-const require_restream_intent = require("../restream-intent-VVJiUAkh.js");
+const require_dist = require("../dist-CsJJPDQW.js");
+const require_node = require("../node-1vbEWzPZ.js");
+const require_restream_intent = require("../restream-intent-iKGCB9IR.js");
 const require_remote_restream = require("../remote-restream-CO36Sr30.js");
 const require_retire_root_keys = require("../retire-root-keys-Csb8z2f3.js");
-const require_segment_demux_js = require("../segment-demux-js-DHV7EOQf.js");
+const require_segment_demux_js = require("../segment-demux-js-OQT6wqXH.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_crypto = require("node:crypto");
@@ -2550,6 +2550,218 @@ function deviceIdFromBrokerId$1(brokerId) {
 	const parsed = Number(brokerId.split("/")[0]);
 	return Number.isFinite(parsed) ? parsed : void 0;
 }
+//#endregion
+//#region src/stream-broker/rtsp/audio/g711-silence.ts
+var SILENCE_BYTE = {
+	/** µ-law digital zero. */
+	PCMU: 255,
+	/** A-law digital zero. */
+	PCMA: 213
+};
+var STATIC_PAYLOAD_TYPE = {
+	PCMU: 0,
+	PCMA: 8
+};
+/** G.711 is 8 kHz mono by definition (RFC 3551). */
+var G711_CLOCK_RATE_HZ = 8e3;
+var G711_CHANNELS = 1;
+/**
+* The track for a codec name as the camera's SDP spelled it, or `null`.
+*
+* `null` is a REFUSAL with a reason the caller must log, never a fallback to
+* PCMU: a sentry filled with the wrong codec's bytes is audible garbage on
+* every consumer, which is strictly worse than the silence of no track at all.
+*/
+function g711TrackFor(codec) {
+	if (codec === void 0) return null;
+	const upper = codec.toUpperCase();
+	if (upper !== "PCMU" && upper !== "PCMA") return null;
+	return {
+		codec: upper,
+		payloadType: STATIC_PAYLOAD_TYPE[upper],
+		clockRateHz: G711_CLOCK_RATE_HZ,
+		channels: G711_CHANNELS
+	};
+}
+/**
+* The `m=audio` block grafted onto the sentry's video-only SDP.
+*
+* Built rather than extracted from the camera's SDP on purpose. A static
+* payload type makes the description fully determined by the codec, so the
+* block is correct even when no camera SDP exists — which is the state this
+* whole path is for. `extractAudioMediaBlock` cannot serve here: it remaps a
+* dynamic payload type to 97 for the ffmpeg egress graft, and a remap is
+* exactly what must not happen to a track the camera will later fill itself.
+*/
+function g711AudioMediaBlock(track, trackId) {
+	return [
+		`m=audio 0 RTP/AVP ${track.payloadType}`,
+		"c=IN IP4 0.0.0.0",
+		`a=rtpmap:${track.payloadType} ${track.codec}/${track.clockRateHz}`,
+		`a=control:trackID=${trackId}`
+	].join("\r\n");
+}
+/**
+* One complete RTP packet of silence: 12-byte header plus one frame of the
+* codec's zero byte. Pure — the caller owns the sequence, the clock and the
+* decision to send.
+*/
+function buildG711SilenceRtp(input) {
+	const packet = Buffer.alloc(172, SILENCE_BYTE[input.track.codec]);
+	packet[0] = 128;
+	packet[1] = (input.marker ? 128 : 0) | input.track.payloadType & 127;
+	packet.writeUInt16BE(input.sequenceNumber & 65535, 2);
+	packet.writeUInt32BE(input.rtpTimestamp >>> 0, 4);
+	packet.writeUInt32BE(input.ssrc >>> 0, 8);
+	return packet;
+}
+//#endregion
+//#region src/stream-broker/rtsp/audio/sentry-audio-silence.ts
+/**
+* How long the camera must be quiet before the filler takes the track back.
+*
+* Longer than any plausible inter-packet gap on a live G.711 stream (20 ms
+* nominal, 50 pps) by two orders of magnitude, so a momentary stutter in real
+* audio can never be papered over with generated frames; short enough that a
+* consumer's decoder does not see a hole when the camera goes back to sleep.
+*/
+var DEFAULT_RESUME_GAP_MS = 1e3;
+var SentryAudioSilence = class {
+	options;
+	frameMs;
+	resumeGapMs;
+	tags;
+	ssrc;
+	timer;
+	resumeTimer;
+	sequenceNumber;
+	rtpTimestamp = 0;
+	markNext = true;
+	emitted = 0;
+	/** Frames that reached at least one session. See {@link stopRun}. */
+	delivered = 0;
+	lastRealAudioAt = 0;
+	wanted = false;
+	constructor(options) {
+		this.options = options;
+		this.frameMs = options.frameMs ?? 20;
+		this.resumeGapMs = options.resumeGapMs ?? DEFAULT_RESUME_GAP_MS;
+		this.tags = options.deviceId === void 0 ? {} : { tags: { deviceId: options.deviceId } };
+		this.ssrc = Math.random() * 4294967295 >>> 0;
+		this.sequenceNumber = Math.random() * 65535 & 65535;
+	}
+	/** The audio shape this filler was built for. */
+	get track() {
+		return this.options.track;
+	}
+	/** True while packets are actually being produced. */
+	get running() {
+		return this.timer !== void 0;
+	}
+	/**
+	* Somebody wants the track filled. Idempotent — reconciliation calls this on
+	* every session edge, and a second call while a run is in flight must not
+	* restart the clock or re-log.
+	*/
+	want() {
+		this.wanted = true;
+		this.startRun();
+	}
+	/**
+	* Nobody wants the track filled any more (the last sentry left, the operator
+	* muted the device, the broker is going away). Idempotent.
+	*/
+	release(reason) {
+		this.wanted = false;
+		this.clearResume();
+		this.stopRun(reason);
+	}
+	/**
+	* The camera's own audio just arrived.
+	*
+	* Synchronous, and the first thing `pushAudioRtpPassthrough` does: the timer
+	* is gone before this packet is written to any session, so no generated frame
+	* can follow it. Called on EVERY real packet, not only the first — the rolling
+	* gap is what lets the filler come back when the camera sleeps again, without
+	* a second signal anybody has to remember to send.
+	*/
+	noteRealAudio(nowMs) {
+		this.lastRealAudioAt = nowMs;
+		this.stopRun("real audio");
+		this.armResume();
+	}
+	startRun() {
+		if (this.timer !== void 0) return;
+		if (!this.wanted) return;
+		if (Date.now() - this.lastRealAudioAt < this.resumeGapMs) {
+			this.armResume();
+			return;
+		}
+		this.rtpTimestamp = Math.floor(Date.now() * this.options.track.clockRateHz / 1e3) >>> 0;
+		this.markNext = true;
+		this.emitted = 0;
+		this.delivered = 0;
+		this.timer = setInterval(() => this.tick(), this.frameMs);
+		this.options.logger?.info("sentry audio: filling the track with silence", {
+			...this.tags,
+			meta: {
+				codec: this.options.track.codec,
+				payloadType: this.options.track.payloadType,
+				frameMs: this.frameMs,
+				clockRateHz: this.options.track.clockRateHz
+			}
+		});
+	}
+	stopRun(reason) {
+		if (this.timer === void 0) return;
+		clearInterval(this.timer);
+		this.timer = void 0;
+		this.options.logger?.info("sentry audio: stopped filling the track", {
+			...this.tags,
+			meta: {
+				reason,
+				framesEmitted: this.emitted,
+				framesDelivered: this.delivered
+			}
+		});
+	}
+	/**
+	* Re-check once the gap has elapsed.
+	*
+	* A single pending timeout rather than a free-running ticker that decides per
+	* frame: while the camera is awake this costs one timer per second instead of
+	* fifty, and while it is asleep it costs nothing at all — the run is the
+	* ticker.
+	*/
+	armResume() {
+		if (!this.wanted) return;
+		if (this.resumeTimer !== void 0) return;
+		this.resumeTimer = setTimeout(() => {
+			this.resumeTimer = void 0;
+			this.startRun();
+		}, this.resumeGapMs);
+		this.resumeTimer.unref?.();
+	}
+	clearResume() {
+		if (this.resumeTimer === void 0) return;
+		clearTimeout(this.resumeTimer);
+		this.resumeTimer = void 0;
+	}
+	tick() {
+		const rtp = buildG711SilenceRtp({
+			track: this.options.track,
+			ssrc: this.ssrc,
+			sequenceNumber: this.sequenceNumber,
+			rtpTimestamp: this.rtpTimestamp,
+			marker: this.markNext
+		});
+		this.sequenceNumber = this.sequenceNumber + 1 & 65535;
+		this.rtpTimestamp = this.rtpTimestamp + 160 >>> 0;
+		this.markNext = false;
+		this.emitted += 1;
+		if (this.options.emit(rtp) > 0) this.delivered += 1;
+	}
+};
 /**
 * Extract the `m=audio` media block from an ffmpeg-generated SDP, normalised
 * for grafting (port 0, non-colliding payload type, own `a=control`, explicit
@@ -2597,7 +2809,7 @@ function appendAudioMediaBlock(videoSdp, audioBlock) {
 * the result onto its counters and its `continue`.
 */
 function admitJoinBurst(input) {
-	if (input.muted && !input.detectionIntent) return !input.fromRing || input.spanMs > input.liveEdgeMaxSpanMs ? "live-edge" : "none";
+	if (input.liveEdgeOnly) return !input.fromRing || input.spanMs > input.liveEdgeMaxSpanMs ? "live-edge" : "none";
 	if (!input.detectionIntent && input.spanMs > input.bound.maxSpanMs) return "span";
 	if (input.packets > input.bound.maxPackets) return "packets";
 	return "none";
@@ -2799,6 +3011,14 @@ var LIVE_EDGE_MAX_SPAN_MS = 500;
 */
 var PRIME_MAX_SPAN_MS = 2e3;
 /**
+* The `a=control:trackID=` the sentry's grafted audio block is given.
+*
+* The same id the transcode egress grafts its own audio onto
+* (`extractAudioMediaBlock`'s default) and the same one `sendAudioRtp` writes
+* to (`tracks[1]`), because the video track is always trackID=0.
+*/
+var SENTRY_AUDIO_TRACK_ID = 1;
+/**
 * Defensive packet ceiling on a join burst, independent of {@link
 * PRIME_MAX_SPAN_MS}. The ring is trimmed to one GOP by RTP timestamp, so a
 * burst this large means the timestamps stopped describing the stream (wrap,
@@ -2891,6 +3111,27 @@ var RtspRestreamer = class {
 	* a broker going idle overnight would wake up distributing audio again.
 	*/
 	deviceAudioMuted = false;
+	/**
+	* The camera's audio shape, remembered so a SENTRY can be handed a track to
+	* fill while the camera is asleep.
+	*
+	* NOT cleared by {@link resetStreamState}, for exactly the reason
+	* {@link deviceAudioMuted} is not: that method resets what belongs to one
+	* CONNECTION, and this describes the CAMERA. A sleeping camera has no SDP to
+	* read — it is the whole premise of the sentry — so if this did not survive
+	* the suspend there would never be an audio track to announce at the moment
+	* one is needed.
+	*
+	* `null` means nothing has ever described this camera's audio to us (a cold
+	* hub whose battery camera has not been awake since boot), or its codec is
+	* one whose silence cannot be generated exactly. Both are logged; neither is
+	* guessed at.
+	*/
+	sentryAudioTrack = null;
+	/** Fills a sentry's audio track while the camera sleeps. Built on demand. */
+	sentryAudioSilence = null;
+	/** One-shot guard for "a sentry attached and there is no track to fill". */
+	sentryAudioGapLogged = false;
 	/** Cached last keyframe NALs (SPS/PPS + IDR) for late-joining clients. */
 	lastKeyframeNals = [];
 	lastKeyframeNalBytes = 0;
@@ -3099,6 +3340,156 @@ var RtspRestreamer = class {
 		return this.mutedSdp ?? this.sdp;
 	}
 	/**
+	* The SDP a SENTRY dial is answered with: the picture it is being served,
+	* plus the audio track that picture will be accompanied by.
+	*
+	* Three cases, in this order and no other:
+	*
+	*  1. The operator muted this camera broker-side (D83). That mute IS a device
+	*     policy and outranks everything here — the sentry is answered video-only,
+	*     exactly as every other consumer is.
+	*  2. The current connection already describes audio (the camera is up and we
+	*     are serving its own SDP). It is served verbatim: grafting on top would
+	*     announce the track twice, and the camera's own description is by
+	*     definition the one its RTP will match.
+	*  3. Otherwise — the sleeping case, where the SDP is built from the
+	*     placeholder frame and has no audio at all — the retained shape is
+	*     grafted on as trackID=1.
+	*
+	* Without a retained shape this degrades to the video-only SDP, which is what
+	* the whole path used to serve unconditionally. That is a REFUSAL, reported
+	* by {@link reconcileSentryAudio}: a sentry with no audio is a sentry that
+	* will never have any, and the operator has to be able to see it rather than
+	* infer it from a silent stream.
+	*/
+	getSentrySdp() {
+		if (this.deviceAudioMuted) return this.getMutedSdp();
+		const full = this.sdp;
+		if (full !== null && /^m=audio/m.test(full)) return full;
+		const videoOnly = this.getMutedSdp();
+		const track = this.sentryAudioTrack;
+		if (track === null || videoOnly === null) return videoOnly;
+		return appendAudioMediaBlock(videoOnly, g711AudioMediaBlock(track, SENTRY_AUDIO_TRACK_ID));
+	}
+	/**
+	* The SDP for a parsed dial's variant.
+	*
+	* One switch and not three call sites: the listen server reads the SDP twice
+	* (once to wait for it, once to answer with it), and those two reads
+	* disagreeing about which variant a dial gets is a class of bug that costs a
+	* consumer an empty DESCRIBE.
+	*/
+	getSdpFor(variant) {
+		if (variant === "sentry") return this.getSentrySdp();
+		if (variant === "muted") return this.getMutedSdp();
+		return this.getSdp();
+	}
+	/**
+	* Remember (or forget) the camera's audio shape for the sentry.
+	*
+	* Called from the broker's `onAudioTrack`, which is the only place the
+	* camera's own SDP is parsed. `null` forgets it — a camera whose audio was
+	* turned off, or whose codec this system cannot fill exactly.
+	*/
+	retainSentryAudioTrack(track) {
+		const prior = this.sentryAudioTrack;
+		if (prior?.codec === track?.codec && prior?.payloadType === track?.payloadType) return;
+		this.sentryAudioTrack = track;
+		this.sentryAudioSilence?.release("audio shape changed");
+		this.sentryAudioSilence = null;
+		this.sentryAudioGapLogged = false;
+		this.logger?.info("sentry audio: track shape retained", {
+			tags: { deviceId: this.deviceId },
+			meta: {
+				streamName: this.streamName,
+				codec: track?.codec ?? null
+			}
+		});
+		this.reconcileSentryAudio();
+	}
+	/** The retained audio shape, or `null`. Survives a suspend by design. */
+	getSentryAudioTrack() {
+		return this.sentryAudioTrack;
+	}
+	/**
+	* Whether generated silence is being produced for this stream right now.
+	*
+	* Exposed because "is the filler still running" is not answerable from the
+	* wire: a run whose last sentry has left writes to nobody, so a socket that
+	* sees nothing looks exactly like a timer that was released and exactly like
+	* one that was leaked. That ambiguity survived a deliberate sabotage of
+	* {@link removeSession}'s reconcile with the whole suite green.
+	*/
+	isSentryAudioFilling() {
+		return this.sentryAudioSilence?.running === true;
+	}
+	/**
+	* Start or stop filling the sentry audio track to match who is attached.
+	*
+	* Called on every edge that can change the answer — a session arriving or
+	* leaving, the operator's mute, a new audio shape — and never on a per-packet
+	* path. Idempotent in both directions.
+	*/
+	reconcileSentryAudio() {
+		if (!(this.getPrestreamSessionCount() > 0 && !this.deviceAudioMuted)) {
+			this.sentryAudioSilence?.release("no sentry session");
+			return;
+		}
+		const track = this.sentryAudioTrack;
+		if (track === null) {
+			if (!this.sentryAudioGapLogged) {
+				this.sentryAudioGapLogged = true;
+				this.logger?.info("sentry audio: no track to fill — this dial gets no audio", {
+					tags: { deviceId: this.deviceId },
+					meta: {
+						streamName: this.streamName,
+						reason: "no retained g711 audio shape"
+					}
+				});
+			}
+			return;
+		}
+		if (this.sentryAudioSilence === null) this.sentryAudioSilence = new SentryAudioSilence({
+			track,
+			emit: (rtp) => this.sendSilenceToSentrySessions(rtp),
+			...this.logger ? { logger: this.logger } : {},
+			...this.deviceId === void 0 ? {} : { deviceId: this.deviceId }
+		});
+		this.sentryAudioSilence.want();
+	}
+	/**
+	* Hand one generated packet to every sentry session that can take it.
+	*
+	* Gated on PLAY, on the sentry intent and on the session's own mute — and
+	* deliberately NOT on `pendingKeyframe`, which is the one gate the real audio
+	* path applies and this one must not.
+	*
+	* That gate exists to keep live audio behind a video join REPLAY, so a
+	* session's two tracks are not handed media from two different moments.
+	* Generated silence belongs to no replay and to no GOP. Worse, waiting for
+	* the video would reproduce the defect: the placeholder picture arrives at
+	* 1 fps at best and not at all when the sentry refuses (unknown geometry, no
+	* cached snapshot), so the track a consumer's ffmpeg is waiting on would stay
+	* empty for exactly as long as the picture did — which is the stall the
+	* announced-but-unfilled `m=audio` was feared for in the first place.
+	*
+	* Returns how many took it, so a run that delivers to nobody is visible.
+	*/
+	sendSilenceToSentrySessions(rtp) {
+		const packet = {
+			data: rtp,
+			marker: (rtp[1] & 128) !== 0
+		};
+		let served = 0;
+		for (const session of this.sessions.values()) {
+			if (!session.isPrestreamIntent()) continue;
+			if (session.isMuted()) continue;
+			if (!session.isPlaying()) continue;
+			if (session.sendAudioRtp(packet) === "written") served += 1;
+		}
+		return served;
+	}
+	/**
 	* Apply the broker-side audio mute. Returns how many audio-bearing pull
 	* sessions were closed so they re-`DESCRIBE` against the new SDP.
 	*
@@ -3110,6 +3501,7 @@ var RtspRestreamer = class {
 	setAudioMuted(muted) {
 		if (this.deviceAudioMuted === muted) return 0;
 		this.deviceAudioMuted = muted;
+		this.reconcileSentryAudio();
 		const audioBearing = [...this.sessions.values()].filter((s) => !s.isMuted());
 		for (const session of audioBearing) this.killSession(session.getSessionId());
 		if (audioBearing.length > 0) this.logger?.info("audio mute changed — closing audio-bearing RTSP pulls so they re-DESCRIBE", {
@@ -3161,6 +3553,7 @@ var RtspRestreamer = class {
 			total: this.sessions.size
 		} });
 		this._onSessionCountChanged?.();
+		this.reconcileSentryAudio();
 		if (this._rtpPassthroughMode) setTimeout(() => this.servePendingSessionsRtp(), 0);
 		else if (this.lastKeyframeNals.length > 0 && this.packetizer) setTimeout(() => this.servePendingSessions(), 0);
 	}
@@ -3336,7 +3729,7 @@ var RtspRestreamer = class {
 				}
 			}
 			const withhold = admitJoinBurst({
-				muted: session.isMuted(),
+				liveEdgeOnly: session.isLiveEdgeOnly(),
 				detectionIntent,
 				fromRing,
 				spanMs,
@@ -3599,6 +3992,7 @@ var RtspRestreamer = class {
 	*/
 	pushAudioRtpPassthrough(rtpData) {
 		if (this.deviceAudioMuted) return;
+		this.sentryAudioSilence?.noteRealAudio(Date.now());
 		if (this.sessions.size === 0) return;
 		const rtpPacket = {
 			data: rtpData,
@@ -3619,6 +4013,7 @@ var RtspRestreamer = class {
 			total: this.sessions.size
 		} });
 		this._onSessionCountChanged?.();
+		this.reconcileSentryAudio();
 	}
 	/**
 	* Force-close + remove a session by id. Used by the admin `killClient`
@@ -3647,6 +4042,7 @@ var RtspRestreamer = class {
 	}
 	destroy() {
 		this._onSessionCountChanged = null;
+		this.sentryAudioSilence?.release("restreamer destroyed");
 		this.abortAllReplays();
 		this.deframer?.flush();
 		for (const session of this.sessions.values()) session.close();
@@ -3816,9 +4212,11 @@ var RtspSession = class {
 	* {@link NO_DECLARATION} when it declared nothing — which is every consumer
 	* except the per-session detection decode and the recorder's writer.
 	*
-	* Kept separate from {@link muted} deliberately: `isMuted()` is shared by the
-	* WebRTC/HomeKit loopback legs, and the join rule that keys on it must stay
-	* true for them. Only an explicit declaration changes behaviour.
+	* Kept separate from {@link muted} deliberately: the two say different things
+	* and, since D525, they no longer coincide — a `/sentry` dial declares an
+	* intent and is NOT muted, while the join rule that used to read `isMuted()`
+	* now reads {@link isLiveEdgeOnly} and keeps every older population's
+	* behaviour byte-for-byte.
 	*
 	* One field and not two, because the purpose and the amount are one
 	* statement (D382): a session that names a purpose without naming an amount
@@ -3880,6 +4278,20 @@ var RtspSession = class {
 		return this.muted;
 	}
 	/**
+	* Whether this session is a RE-CLOCKING leg that may only join at the live
+	* edge — the second question `isMuted()` used to answer.
+	*
+	* Derived from the one authority (`isLiveEdgeOnlyDial`) rather than stored,
+	* so the rule cannot drift between the parser and the session. Unchanged for
+	* every population that existed before the sentry gained audio.
+	*/
+	isLiveEdgeOnly() {
+		return require_restream_intent.isLiveEdgeOnlyDial({
+			muted: this.muted,
+			declaration: this.declaration
+		});
+	}
+	/**
 	* The `User-Agent` this client put on its first request, or `null`.
 	*
 	* The ONLY identity that crosses from a consumer process into this session.
@@ -4329,7 +4741,9 @@ var RtspListenServer = class RtspListenServer {
 	async dispatch(socket, requestBuffer) {
 		const uriMatch = (requestBuffer.split("\r\n")[0] ?? "").match(/\s(rtsp:\/\/[^\s]+)\s/);
 		const pathMatch = (uriMatch ? uriMatch[1] : "").match(/rtsp:\/\/[^/]+(\/.*?)(?:\s|$)/);
-		const { lookupPath, muted: isMuted, declaration } = require_restream_intent.parseRestreamPath(pathMatch ? pathMatch[1].replace(/^\//, "").replace(/\/trackID=\d+$/, "") : "");
+		const parsed = require_restream_intent.parseRestreamPath(pathMatch ? pathMatch[1].replace(/^\//, "").replace(/\/trackID=\d+$/, "") : "");
+		const { lookupPath, muted: isMuted, declaration } = parsed;
+		const sdpVariant = require_restream_intent.sdpVariantFor(parsed);
 		const restreamer = this.restreamers.get(lookupPath);
 		if (!restreamer) {
 			socket.write(`RTSP/1.0 404 Not Found\r\nCSeq: 1\r\n\r\n`);
@@ -4356,8 +4770,8 @@ var RtspListenServer = class RtspListenServer {
 		};
 		socket.once("close", releaseOnce);
 		socket.once("error", releaseOnce);
-		await this.waitForSdp(restreamer, isMuted, 3e3);
-		const session = new RtspSession(socket, isMuted ? restreamer.getMutedSdp() ?? restreamer.getSdp() ?? "" : restreamer.getSdp() ?? "", () => {
+		await this.waitForSdp(restreamer, sdpVariant, 3e3);
+		const session = new RtspSession(socket, restreamer.getSdpFor(sdpVariant) ?? restreamer.getSdp() ?? "", () => {
 			restreamer.removeSession(session.getSessionId());
 			releaseOnce();
 		}, isMuted, declaration);
@@ -4372,10 +4786,10 @@ var RtspListenServer = class RtspListenServer {
 	* a cold broker that's typically ~200-1000 ms. Resolves `true` if the
 	* SDP becomes non-empty within the budget, `false` on timeout.
 	*/
-	async waitForSdp(restreamer, isMuted, timeoutMs) {
+	async waitForSdp(restreamer, variant, timeoutMs) {
 		const start = Date.now();
 		const have = () => {
-			const s = isMuted ? restreamer.getMutedSdp() ?? restreamer.getSdp() : restreamer.getSdp();
+			const s = restreamer.getSdpFor(variant) ?? restreamer.getSdp();
 			return !!s && s.length > 0;
 		};
 		if (have()) return true;
@@ -15022,6 +15436,12 @@ var StreamBroker = class StreamBroker {
 						supportedNative
 					}
 				});
+				const sentryTrack = g711TrackFor(codecUpper);
+				this.rtspRestreamer.retainSentryAudioTrack(sentryTrack);
+				if (sentryTrack === null) this.logger?.info("sentry audio: codec cannot be filled — a sentry gets no audio", {
+					tags: { deviceId: this.numericDeviceId },
+					meta: { codec: codecUpper }
+				});
 				let supported = supportedNative;
 				let effectiveSampleRate = audioTrack.clockRate;
 				let effectiveChannels = audioTrack.channels;
@@ -15870,6 +16290,7 @@ var TranscodePipelineManager = class {
 	resolveStreamHwAccel;
 	spawnFn;
 	acquireChannel;
+	sentryOffered;
 	constructor(opts) {
 		this.logger = opts.logger;
 		this.hwaccel = opts.hwaccel ?? null;
@@ -15881,6 +16302,7 @@ var TranscodePipelineManager = class {
 		this.resolveStreamHwAccel = opts.resolveStreamHwAccel ?? null;
 		this.spawnFn = opts.spawnFn ?? node_child_process.spawn;
 		this.acquireChannel = opts.acquireChannel ?? null;
+		this.sentryOffered = opts.sentryOffered ?? null;
 	}
 	async acquire(input) {
 		const wantedAudio = input.audio ?? "aac";
@@ -15906,8 +16328,9 @@ var TranscodePipelineManager = class {
 			const passVideoCodec = sourceCodec ?? "H264";
 			const url = this.resolveSourceUrl(input.deviceId, sourceStream.camStreamId, wantedAudio === "none");
 			const key = pipelineKeyFor(input.deviceId, sourceStream.camStreamId, "copy", wantedAudio, outResolution, outputArgs, false);
-			return this.shareOrCreatePassthrough(key, () => ({
+			return await this.shareOrCreatePassthroughAsync(key, async () => ({
 				url,
+				sentryUrl: await this.resolveSentryUrl(input.deviceId, url),
 				videoCodec: passVideoCodec,
 				audioCodec: "passthrough",
 				resolution: outResolution,
@@ -15977,6 +16400,7 @@ var TranscodePipelineManager = class {
 		const url = await egress.start();
 		const source = {
 			url,
+			sentryUrl: null,
 			videoCodec: opts.targetCodec,
 			audioCodec: opts.audio,
 			resolution: opts.outResolution,
@@ -16152,13 +16576,44 @@ var TranscodePipelineManager = class {
 		}
 		return entry;
 	}
-	shareOrCreatePassthrough(key, factory) {
+	/**
+	* The SENTRY counterpart of a passthrough url, or `null`.
+	*
+	* `sentryEligible` is asked through the injected lookup — the broker manager
+	* owns those facts — and an unwired lookup is a NO. A refusal is silent on
+	* purpose: "this mains camera has no sentry" is the answer for most of the
+	* fleet and logging it per acquire would be noise. A FAILED ask is not: it is
+	* a question that could not be answered, and it is reported as such before
+	* being resolved to `null`.
+	*/
+	async resolveSentryUrl(deviceId, url) {
+		if (this.sentryOffered === null) return null;
+		try {
+			if (!await this.sentryOffered(deviceId)) return null;
+		} catch (error) {
+			this.logger.warn("getStreamWithCodec: could not decide whether a sentry dial is offered", {
+				tags: { deviceId },
+				meta: { error: require_dist.errMsg(error) }
+			});
+			return null;
+		}
+		return require_restream_intent.withSentryIntent(url);
+	}
+	async shareOrCreatePassthroughAsync(key, factory) {
+		const existing = this.entries.get(key);
+		if (existing) {
+			this.shareEntry(existing);
+			return existing.source;
+		}
+		return this.shareOrCreatePassthrough(key, await factory());
+	}
+	shareOrCreatePassthrough(key, made) {
 		const existing = this.entries.get(key);
 		if (existing) {
 			this.shareEntry(existing);
 			return existing.source;
 		}
-		const source = factory();
+		const source = made;
 		const entry = {
 			key,
 			source,
@@ -16825,6 +17280,10 @@ var StreamBrokerManager = class StreamBrokerManager {
 			resolveProfileSource: (deviceId, profile) => this.assignments.get(deviceId)?.map[profile] ?? null,
 			ffmpegConfig: () => this.ffmpegConfig,
 			resolveStreamHwAccel: (deviceId, camStreamId) => this.getStreamHwAccelOverride(deviceId, camStreamId),
+			sentryOffered: async (deviceId) => sentryEligible({
+				batteryOperated: await this.isBatteryOperated(deviceId),
+				declaresSignals: (await this.declaredSignalCodes(deviceId)).length > 0
+			}).eligible,
 			acquireChannel: (brokerId) => {
 				const restreamer = new RtspRestreamer(brokerId);
 				const token = this.rtspServer.registerRestreamer(brokerId, restreamer);