@camstack/addon-pipeline 1.2.258 → 1.2.259

package/dist/pipeline-runner/index.js

@@ -9,7 +9,7 @@ const require_default_detection_model = require("../default-detection-model-vVWc
 const require_worker_protocol = require("../worker-protocol-B2MfQLlu.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_lazy_sharp = require("../lazy-sharp-BuwKlQLR.js");
-const require_restream_intent = require("../restream-intent-B0GOuR-F.js");
+const require_restream_intent = require("../restream-intent-iKGCB9IR.js");
 const require_remote_restream = require("../remote-restream-CO36Sr30.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);

package/dist/pipeline-runner/index.mjs

@@ -4,7 +4,7 @@ import { a as localFrameRegistry, d as getStepDefinition, i as rootObjectGate, o
 import { t as isWorkerReply } from "../worker-protocol-C_W-P_g-.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { t as getSharp } from "../lazy-sharp-DXsqwpph.mjs";
-import { a as preRollRequestOf, o as withDetectionIntent, t as DETECTION_PRE_ROLL_REQUEST_MS } from "../restream-intent-CgyZI565.mjs";
+import { c as withDetectionIntent, o as preRollRequestOf, t as DETECTION_PRE_ROLL_REQUEST_MS } from "../restream-intent-CW79dvFV.mjs";
 import { n as profileForStreamId, t as isRemoteRestream } from "../remote-restream-BeHi78PZ.mjs";
 import * as os from "node:os";
 import { fork } from "node:child_process";

package/dist/recorder/index.js

@@ -6,7 +6,7 @@ const require_chunk = require("../chunk-emK7D4bc.js");
 const require_dist = require("../dist-CsJJPDQW.js");
 const require_node = require("../node-1vbEWzPZ.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
-const require_restream_intent = require("../restream-intent-B0GOuR-F.js");
+const require_restream_intent = require("../restream-intent-iKGCB9IR.js");
 const require_retire_root_keys = require("../retire-root-keys-Csb8z2f3.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");

package/dist/recorder/index.mjs

@@ -1,7 +1,7 @@
 import { $t as hydrateSchema, C as OpsLogEntrySchema, Ct as recordingExportCapability, D as RECORDING_EXPORT_MAX_READ_BYTES, Dt as resolveLocationMode, H as deriveBatteryPresence, I as batteryCapability, Kt as DeviceFeature, Lt as errMsg, Mt as storageOccupancyCapability, O as RecordingConfigSchema, Pt as stripRetiredBandPreBufferSec, Q as evictionPolicyOfLocation, St as recordingCapability, W as deriveRecordingMode, Wt as BaseAddon, Xt as customAction, Y as evaluateSensorEdge, Z as evictionPolicyForMode, Zt as defineCustomActions, _n as record, bn as EventCategory, cn as _enum, ct as mayReadLocation, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, dt as modeMayWrite, et as gbToBytes, g as ExportRecordSchema, gn as preprocess, hn as object, i as BatteryStatusSchema, it as loadContributionCapability, jt as storageEvictableCapability, k as RecordingSignalStatusSchema, kt as resolveRecordingProfiles, ln as array, lt as mayWriteToLocation, mn as number, on as selectAssignedProfileSlots, qt as DeviceType, rn as nodePin, rt as isFirstLevelMacroClass, sn as sleep$1, un as boolean, ut as migrateLegacyDeviceSignalConfig, vn as string, wt as recordingSignalCapability } from "../dist-D3w2fwD4.mjs";
 import { a as physicalRootOf, i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-IHGNrWH9.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
-import { l as PREBUFFER_MAX_MS, r as RECORDING_PRE_ROLL_REQUEST_MS, s as withRecordingIntent } from "../restream-intent-CgyZI565.mjs";
+import { d as PREBUFFER_MAX_MS, l as withRecordingIntent, r as RECORDING_PRE_ROLL_REQUEST_MS } from "../restream-intent-CW79dvFV.mjs";
 import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DZvlso2l.mjs";
 import { randomUUID } from "node:crypto";
 import { createReadStream, promises, realpathSync } from "node:fs";

package/dist/{restream-intent-CgyZI565.mjs → restream-intent-CW79dvFV.mjs}

@@ -128,7 +128,10 @@ var RECORDING_PATH_SUFFIX = "/recording";
 * Every profile gets one, exactly as every profile gets a `/muted`: a consumer
 * dials `<token>/sentry` instead of `<token>` and is asking for the stream
 * WITHOUT asking for the camera. It is fed the last picture while the camera
-* sleeps, and the real media the moment something wakes it.
+* sleeps, and the real media the moment something wakes it — on BOTH planes.
+* The audio track is announced and filled with silence for as long as the
+* picture is being served, and the camera's own audio takes it over the instant
+* media flows (D525). Only the placeholder is mute; the path never was.
 *
 * A separate path and not a flag, for the reason `/muted` is one: the choice
 * belongs to the URL a consumer was given, so a Frigate configured once keeps
@@ -234,7 +237,7 @@ function parseRestreamPath(streamPath) {
 	});
 	if (rest.endsWith("/sentry")) return {
 		lookupPath: rest.slice(0, -7),
-		muted: true,
+		muted: false,
 		declaration: declare("sentry")
 	};
 	if (rest.endsWith("/recording")) return {
@@ -258,6 +261,35 @@ function parseRestreamPath(streamPath) {
 		declaration: NO_DECLARATION
 	};
 }
+/** The variant this dial is answered with. */
+function sdpVariantFor(parsed) {
+	if (parsed.declaration.intent === "sentry") return "sentry";
+	return parsed.muted ? "muted" : "full";
+}
+/**
+* Whether this dial is a RE-CLOCKING leg, which may only join at the live edge.
+*
+* `isMuted()` used to answer two unrelated questions at once, and un-muting the
+* sentry made the conflation load-bearing:
+*
+*  - "serve this session no audio" — what the word means, and all it means now;
+*  - "this consumer re-emits what it receives on a real-time clock, has ~zero
+*    decode headroom, and never drains a 2-3 s catch-up burst" — the rule
+*    `LIVE_EDGE_MAX_SPAN_MS` was measured for (a HomeKit leg that is an ffmpeg
+*    copy of this restream).
+*
+* The two coincided only because every consumer that re-clocked also happened
+* to be video-only. A sentry is the counter-example: it re-clocks exactly like
+* the `/muted` legs — it is the same ffmpeg-copy shape — and it now carries
+* audio. So the join rule asks THIS, not the mute, and every population keeps
+* its measured behaviour byte-for-byte: `/muted` yes, `/sentry` yes, detection
+* no (it drains the burst by construction — D193), recording and plain no.
+*/
+function isLiveEdgeOnlyDial(dial) {
+	if (dial.declaration.intent === "detection") return false;
+	if (dial.declaration.intent === "sentry") return true;
+	return dial.muted;
+}
 /**
 * The amount a dial URL asks for, read back off the URL itself.
 *
@@ -334,4 +366,4 @@ function withSentryIntent(restreamUrl) {
 	return `${rest}${SENTRY_PATH_SUFFIX}`;
 }
 //#endregion
-export { preRollRequestOf as a, withSentryIntent as c, prebufferRetentionMs as d, resolvePrebuffer as f, parseRestreamPath as i, PREBUFFER_MAX_MS as l, NO_DECLARATION as n, withDetectionIntent as o, RECORDING_PRE_ROLL_REQUEST_MS as r, withRecordingIntent as s, DETECTION_PRE_ROLL_REQUEST_MS as t, capPreRollRequestMs as u };
+export { parseRestreamPath as a, withDetectionIntent as c, PREBUFFER_MAX_MS as d, capPreRollRequestMs as f, isLiveEdgeOnlyDial as i, withRecordingIntent as l, resolvePrebuffer as m, NO_DECLARATION as n, preRollRequestOf as o, prebufferRetentionMs as p, RECORDING_PRE_ROLL_REQUEST_MS as r, sdpVariantFor as s, DETECTION_PRE_ROLL_REQUEST_MS as t, withSentryIntent as u };

package/dist/{restream-intent-B0GOuR-F.js → restream-intent-iKGCB9IR.js}

@@ -128,7 +128,10 @@ var RECORDING_PATH_SUFFIX = "/recording";
 * Every profile gets one, exactly as every profile gets a `/muted`: a consumer
 * dials `<token>/sentry` instead of `<token>` and is asking for the stream
 * WITHOUT asking for the camera. It is fed the last picture while the camera
-* sleeps, and the real media the moment something wakes it.
+* sleeps, and the real media the moment something wakes it — on BOTH planes.
+* The audio track is announced and filled with silence for as long as the
+* picture is being served, and the camera's own audio takes it over the instant
+* media flows (D525). Only the placeholder is mute; the path never was.
 *
 * A separate path and not a flag, for the reason `/muted` is one: the choice
 * belongs to the URL a consumer was given, so a Frigate configured once keeps
@@ -234,7 +237,7 @@ function parseRestreamPath(streamPath) {
 	});
 	if (rest.endsWith("/sentry")) return {
 		lookupPath: rest.slice(0, -7),
-		muted: true,
+		muted: false,
 		declaration: declare("sentry")
 	};
 	if (rest.endsWith("/recording")) return {
@@ -258,6 +261,35 @@ function parseRestreamPath(streamPath) {
 		declaration: NO_DECLARATION
 	};
 }
+/** The variant this dial is answered with. */
+function sdpVariantFor(parsed) {
+	if (parsed.declaration.intent === "sentry") return "sentry";
+	return parsed.muted ? "muted" : "full";
+}
+/**
+* Whether this dial is a RE-CLOCKING leg, which may only join at the live edge.
+*
+* `isMuted()` used to answer two unrelated questions at once, and un-muting the
+* sentry made the conflation load-bearing:
+*
+*  - "serve this session no audio" — what the word means, and all it means now;
+*  - "this consumer re-emits what it receives on a real-time clock, has ~zero
+*    decode headroom, and never drains a 2-3 s catch-up burst" — the rule
+*    `LIVE_EDGE_MAX_SPAN_MS` was measured for (a HomeKit leg that is an ffmpeg
+*    copy of this restream).
+*
+* The two coincided only because every consumer that re-clocked also happened
+* to be video-only. A sentry is the counter-example: it re-clocks exactly like
+* the `/muted` legs — it is the same ffmpeg-copy shape — and it now carries
+* audio. So the join rule asks THIS, not the mute, and every population keeps
+* its measured behaviour byte-for-byte: `/muted` yes, `/sentry` yes, detection
+* no (it drains the burst by construction — D193), recording and plain no.
+*/
+function isLiveEdgeOnlyDial(dial) {
+	if (dial.declaration.intent === "detection") return false;
+	if (dial.declaration.intent === "sentry") return true;
+	return dial.muted;
+}
 /**
 * The amount a dial URL asks for, read back off the URL itself.
 *
@@ -364,6 +396,12 @@ Object.defineProperty(exports, "capPreRollRequestMs", {
 		return capPreRollRequestMs;
 	}
 });
+Object.defineProperty(exports, "isLiveEdgeOnlyDial", {
+	enumerable: true,
+	get: function() {
+		return isLiveEdgeOnlyDial;
+	}
+});
 Object.defineProperty(exports, "parseRestreamPath", {
 	enumerable: true,
 	get: function() {
@@ -388,6 +426,12 @@ Object.defineProperty(exports, "resolvePrebuffer", {
 		return resolvePrebuffer;
 	}
 });
+Object.defineProperty(exports, "sdpVariantFor", {
+	enumerable: true,
+	get: function() {
+		return sdpVariantFor;
+	}
+});
 Object.defineProperty(exports, "withDetectionIntent", {
 	enumerable: true,
 	get: function() {

package/dist/stream-broker/index.js

@@ -5,7 +5,7 @@ Object.defineProperties(exports, {
 const require_chunk = require("../chunk-emK7D4bc.js");
 const require_dist = require("../dist-CsJJPDQW.js");
 const require_node = require("../node-1vbEWzPZ.js");
-const require_restream_intent = require("../restream-intent-B0GOuR-F.js");
+const require_restream_intent = require("../restream-intent-iKGCB9IR.js");
 const require_remote_restream = require("../remote-restream-CO36Sr30.js");
 const require_retire_root_keys = require("../retire-root-keys-Csb8z2f3.js");
 const require_segment_demux_js = require("../segment-demux-js-OQT6wqXH.js");
@@ -2550,6 +2550,218 @@ function deviceIdFromBrokerId$1(brokerId) {
 	const parsed = Number(brokerId.split("/")[0]);
 	return Number.isFinite(parsed) ? parsed : void 0;
 }
+//#endregion
+//#region src/stream-broker/rtsp/audio/g711-silence.ts
+var SILENCE_BYTE = {
+	/** µ-law digital zero. */
+	PCMU: 255,
+	/** A-law digital zero. */
+	PCMA: 213
+};
+var STATIC_PAYLOAD_TYPE = {
+	PCMU: 0,
+	PCMA: 8
+};
+/** G.711 is 8 kHz mono by definition (RFC 3551). */
+var G711_CLOCK_RATE_HZ = 8e3;
+var G711_CHANNELS = 1;
+/**
+* The track for a codec name as the camera's SDP spelled it, or `null`.
+*
+* `null` is a REFUSAL with a reason the caller must log, never a fallback to
+* PCMU: a sentry filled with the wrong codec's bytes is audible garbage on
+* every consumer, which is strictly worse than the silence of no track at all.
+*/
+function g711TrackFor(codec) {
+	if (codec === void 0) return null;
+	const upper = codec.toUpperCase();
+	if (upper !== "PCMU" && upper !== "PCMA") return null;
+	return {
+		codec: upper,
+		payloadType: STATIC_PAYLOAD_TYPE[upper],
+		clockRateHz: G711_CLOCK_RATE_HZ,
+		channels: G711_CHANNELS
+	};
+}
+/**
+* The `m=audio` block grafted onto the sentry's video-only SDP.
+*
+* Built rather than extracted from the camera's SDP on purpose. A static
+* payload type makes the description fully determined by the codec, so the
+* block is correct even when no camera SDP exists — which is the state this
+* whole path is for. `extractAudioMediaBlock` cannot serve here: it remaps a
+* dynamic payload type to 97 for the ffmpeg egress graft, and a remap is
+* exactly what must not happen to a track the camera will later fill itself.
+*/
+function g711AudioMediaBlock(track, trackId) {
+	return [
+		`m=audio 0 RTP/AVP ${track.payloadType}`,
+		"c=IN IP4 0.0.0.0",
+		`a=rtpmap:${track.payloadType} ${track.codec}/${track.clockRateHz}`,
+		`a=control:trackID=${trackId}`
+	].join("\r\n");
+}
+/**
+* One complete RTP packet of silence: 12-byte header plus one frame of the
+* codec's zero byte. Pure — the caller owns the sequence, the clock and the
+* decision to send.
+*/
+function buildG711SilenceRtp(input) {
+	const packet = Buffer.alloc(172, SILENCE_BYTE[input.track.codec]);
+	packet[0] = 128;
+	packet[1] = (input.marker ? 128 : 0) | input.track.payloadType & 127;
+	packet.writeUInt16BE(input.sequenceNumber & 65535, 2);
+	packet.writeUInt32BE(input.rtpTimestamp >>> 0, 4);
+	packet.writeUInt32BE(input.ssrc >>> 0, 8);
+	return packet;
+}
+//#endregion
+//#region src/stream-broker/rtsp/audio/sentry-audio-silence.ts
+/**
+* How long the camera must be quiet before the filler takes the track back.
+*
+* Longer than any plausible inter-packet gap on a live G.711 stream (20 ms
+* nominal, 50 pps) by two orders of magnitude, so a momentary stutter in real
+* audio can never be papered over with generated frames; short enough that a
+* consumer's decoder does not see a hole when the camera goes back to sleep.
+*/
+var DEFAULT_RESUME_GAP_MS = 1e3;
+var SentryAudioSilence = class {
+	options;
+	frameMs;
+	resumeGapMs;
+	tags;
+	ssrc;
+	timer;
+	resumeTimer;
+	sequenceNumber;
+	rtpTimestamp = 0;
+	markNext = true;
+	emitted = 0;
+	/** Frames that reached at least one session. See {@link stopRun}. */
+	delivered = 0;
+	lastRealAudioAt = 0;
+	wanted = false;
+	constructor(options) {
+		this.options = options;
+		this.frameMs = options.frameMs ?? 20;
+		this.resumeGapMs = options.resumeGapMs ?? DEFAULT_RESUME_GAP_MS;
+		this.tags = options.deviceId === void 0 ? {} : { tags: { deviceId: options.deviceId } };
+		this.ssrc = Math.random() * 4294967295 >>> 0;
+		this.sequenceNumber = Math.random() * 65535 & 65535;
+	}
+	/** The audio shape this filler was built for. */
+	get track() {
+		return this.options.track;
+	}
+	/** True while packets are actually being produced. */
+	get running() {
+		return this.timer !== void 0;
+	}
+	/**
+	* Somebody wants the track filled. Idempotent — reconciliation calls this on
+	* every session edge, and a second call while a run is in flight must not
+	* restart the clock or re-log.
+	*/
+	want() {
+		this.wanted = true;
+		this.startRun();
+	}
+	/**
+	* Nobody wants the track filled any more (the last sentry left, the operator
+	* muted the device, the broker is going away). Idempotent.
+	*/
+	release(reason) {
+		this.wanted = false;
+		this.clearResume();
+		this.stopRun(reason);
+	}
+	/**
+	* The camera's own audio just arrived.
+	*
+	* Synchronous, and the first thing `pushAudioRtpPassthrough` does: the timer
+	* is gone before this packet is written to any session, so no generated frame
+	* can follow it. Called on EVERY real packet, not only the first — the rolling
+	* gap is what lets the filler come back when the camera sleeps again, without
+	* a second signal anybody has to remember to send.
+	*/
+	noteRealAudio(nowMs) {
+		this.lastRealAudioAt = nowMs;
+		this.stopRun("real audio");
+		this.armResume();
+	}
+	startRun() {
+		if (this.timer !== void 0) return;
+		if (!this.wanted) return;
+		if (Date.now() - this.lastRealAudioAt < this.resumeGapMs) {
+			this.armResume();
+			return;
+		}
+		this.rtpTimestamp = Math.floor(Date.now() * this.options.track.clockRateHz / 1e3) >>> 0;
+		this.markNext = true;
+		this.emitted = 0;
+		this.delivered = 0;
+		this.timer = setInterval(() => this.tick(), this.frameMs);
+		this.options.logger?.info("sentry audio: filling the track with silence", {
+			...this.tags,
+			meta: {
+				codec: this.options.track.codec,
+				payloadType: this.options.track.payloadType,
+				frameMs: this.frameMs,
+				clockRateHz: this.options.track.clockRateHz
+			}
+		});
+	}
+	stopRun(reason) {
+		if (this.timer === void 0) return;
+		clearInterval(this.timer);
+		this.timer = void 0;
+		this.options.logger?.info("sentry audio: stopped filling the track", {
+			...this.tags,
+			meta: {
+				reason,
+				framesEmitted: this.emitted,
+				framesDelivered: this.delivered
+			}
+		});
+	}
+	/**
+	* Re-check once the gap has elapsed.
+	*
+	* A single pending timeout rather than a free-running ticker that decides per
+	* frame: while the camera is awake this costs one timer per second instead of
+	* fifty, and while it is asleep it costs nothing at all — the run is the
+	* ticker.
+	*/
+	armResume() {
+		if (!this.wanted) return;
+		if (this.resumeTimer !== void 0) return;
+		this.resumeTimer = setTimeout(() => {
+			this.resumeTimer = void 0;
+			this.startRun();
+		}, this.resumeGapMs);
+		this.resumeTimer.unref?.();
+	}
+	clearResume() {
+		if (this.resumeTimer === void 0) return;
+		clearTimeout(this.resumeTimer);
+		this.resumeTimer = void 0;
+	}
+	tick() {
+		const rtp = buildG711SilenceRtp({
+			track: this.options.track,
+			ssrc: this.ssrc,
+			sequenceNumber: this.sequenceNumber,
+			rtpTimestamp: this.rtpTimestamp,
+			marker: this.markNext
+		});
+		this.sequenceNumber = this.sequenceNumber + 1 & 65535;
+		this.rtpTimestamp = this.rtpTimestamp + 160 >>> 0;
+		this.markNext = false;
+		this.emitted += 1;
+		if (this.options.emit(rtp) > 0) this.delivered += 1;
+	}
+};
 /**
 * Extract the `m=audio` media block from an ffmpeg-generated SDP, normalised
 * for grafting (port 0, non-colliding payload type, own `a=control`, explicit
@@ -2597,7 +2809,7 @@ function appendAudioMediaBlock(videoSdp, audioBlock) {
 * the result onto its counters and its `continue`.
 */
 function admitJoinBurst(input) {
-	if (input.muted && !input.detectionIntent) return !input.fromRing || input.spanMs > input.liveEdgeMaxSpanMs ? "live-edge" : "none";
+	if (input.liveEdgeOnly) return !input.fromRing || input.spanMs > input.liveEdgeMaxSpanMs ? "live-edge" : "none";
 	if (!input.detectionIntent && input.spanMs > input.bound.maxSpanMs) return "span";
 	if (input.packets > input.bound.maxPackets) return "packets";
 	return "none";
@@ -2799,6 +3011,14 @@ var LIVE_EDGE_MAX_SPAN_MS = 500;
 */
 var PRIME_MAX_SPAN_MS = 2e3;
 /**
+* The `a=control:trackID=` the sentry's grafted audio block is given.
+*
+* The same id the transcode egress grafts its own audio onto
+* (`extractAudioMediaBlock`'s default) and the same one `sendAudioRtp` writes
+* to (`tracks[1]`), because the video track is always trackID=0.
+*/
+var SENTRY_AUDIO_TRACK_ID = 1;
+/**
 * Defensive packet ceiling on a join burst, independent of {@link
 * PRIME_MAX_SPAN_MS}. The ring is trimmed to one GOP by RTP timestamp, so a
 * burst this large means the timestamps stopped describing the stream (wrap,
@@ -2891,6 +3111,27 @@ var RtspRestreamer = class {
 	* a broker going idle overnight would wake up distributing audio again.
 	*/
 	deviceAudioMuted = false;
+	/**
+	* The camera's audio shape, remembered so a SENTRY can be handed a track to
+	* fill while the camera is asleep.
+	*
+	* NOT cleared by {@link resetStreamState}, for exactly the reason
+	* {@link deviceAudioMuted} is not: that method resets what belongs to one
+	* CONNECTION, and this describes the CAMERA. A sleeping camera has no SDP to
+	* read — it is the whole premise of the sentry — so if this did not survive
+	* the suspend there would never be an audio track to announce at the moment
+	* one is needed.
+	*
+	* `null` means nothing has ever described this camera's audio to us (a cold
+	* hub whose battery camera has not been awake since boot), or its codec is
+	* one whose silence cannot be generated exactly. Both are logged; neither is
+	* guessed at.
+	*/
+	sentryAudioTrack = null;
+	/** Fills a sentry's audio track while the camera sleeps. Built on demand. */
+	sentryAudioSilence = null;
+	/** One-shot guard for "a sentry attached and there is no track to fill". */
+	sentryAudioGapLogged = false;
 	/** Cached last keyframe NALs (SPS/PPS + IDR) for late-joining clients. */
 	lastKeyframeNals = [];
 	lastKeyframeNalBytes = 0;
@@ -3099,6 +3340,156 @@ var RtspRestreamer = class {
 		return this.mutedSdp ?? this.sdp;
 	}
 	/**
+	* The SDP a SENTRY dial is answered with: the picture it is being served,
+	* plus the audio track that picture will be accompanied by.
+	*
+	* Three cases, in this order and no other:
+	*
+	*  1. The operator muted this camera broker-side (D83). That mute IS a device
+	*     policy and outranks everything here — the sentry is answered video-only,
+	*     exactly as every other consumer is.
+	*  2. The current connection already describes audio (the camera is up and we
+	*     are serving its own SDP). It is served verbatim: grafting on top would
+	*     announce the track twice, and the camera's own description is by
+	*     definition the one its RTP will match.
+	*  3. Otherwise — the sleeping case, where the SDP is built from the
+	*     placeholder frame and has no audio at all — the retained shape is
+	*     grafted on as trackID=1.
+	*
+	* Without a retained shape this degrades to the video-only SDP, which is what
+	* the whole path used to serve unconditionally. That is a REFUSAL, reported
+	* by {@link reconcileSentryAudio}: a sentry with no audio is a sentry that
+	* will never have any, and the operator has to be able to see it rather than
+	* infer it from a silent stream.
+	*/
+	getSentrySdp() {
+		if (this.deviceAudioMuted) return this.getMutedSdp();
+		const full = this.sdp;
+		if (full !== null && /^m=audio/m.test(full)) return full;
+		const videoOnly = this.getMutedSdp();
+		const track = this.sentryAudioTrack;
+		if (track === null || videoOnly === null) return videoOnly;
+		return appendAudioMediaBlock(videoOnly, g711AudioMediaBlock(track, SENTRY_AUDIO_TRACK_ID));
+	}
+	/**
+	* The SDP for a parsed dial's variant.
+	*
+	* One switch and not three call sites: the listen server reads the SDP twice
+	* (once to wait for it, once to answer with it), and those two reads
+	* disagreeing about which variant a dial gets is a class of bug that costs a
+	* consumer an empty DESCRIBE.
+	*/
+	getSdpFor(variant) {
+		if (variant === "sentry") return this.getSentrySdp();
+		if (variant === "muted") return this.getMutedSdp();
+		return this.getSdp();
+	}
+	/**
+	* Remember (or forget) the camera's audio shape for the sentry.
+	*
+	* Called from the broker's `onAudioTrack`, which is the only place the
+	* camera's own SDP is parsed. `null` forgets it — a camera whose audio was
+	* turned off, or whose codec this system cannot fill exactly.
+	*/
+	retainSentryAudioTrack(track) {
+		const prior = this.sentryAudioTrack;
+		if (prior?.codec === track?.codec && prior?.payloadType === track?.payloadType) return;
+		this.sentryAudioTrack = track;
+		this.sentryAudioSilence?.release("audio shape changed");
+		this.sentryAudioSilence = null;
+		this.sentryAudioGapLogged = false;
+		this.logger?.info("sentry audio: track shape retained", {
+			tags: { deviceId: this.deviceId },
+			meta: {
+				streamName: this.streamName,
+				codec: track?.codec ?? null
+			}
+		});
+		this.reconcileSentryAudio();
+	}
+	/** The retained audio shape, or `null`. Survives a suspend by design. */
+	getSentryAudioTrack() {
+		return this.sentryAudioTrack;
+	}
+	/**
+	* Whether generated silence is being produced for this stream right now.
+	*
+	* Exposed because "is the filler still running" is not answerable from the
+	* wire: a run whose last sentry has left writes to nobody, so a socket that
+	* sees nothing looks exactly like a timer that was released and exactly like
+	* one that was leaked. That ambiguity survived a deliberate sabotage of
+	* {@link removeSession}'s reconcile with the whole suite green.
+	*/
+	isSentryAudioFilling() {
+		return this.sentryAudioSilence?.running === true;
+	}
+	/**
+	* Start or stop filling the sentry audio track to match who is attached.
+	*
+	* Called on every edge that can change the answer — a session arriving or
+	* leaving, the operator's mute, a new audio shape — and never on a per-packet
+	* path. Idempotent in both directions.
+	*/
+	reconcileSentryAudio() {
+		if (!(this.getPrestreamSessionCount() > 0 && !this.deviceAudioMuted)) {
+			this.sentryAudioSilence?.release("no sentry session");
+			return;
+		}
+		const track = this.sentryAudioTrack;
+		if (track === null) {
+			if (!this.sentryAudioGapLogged) {
+				this.sentryAudioGapLogged = true;
+				this.logger?.info("sentry audio: no track to fill — this dial gets no audio", {
+					tags: { deviceId: this.deviceId },
+					meta: {
+						streamName: this.streamName,
+						reason: "no retained g711 audio shape"
+					}
+				});
+			}
+			return;
+		}
+		if (this.sentryAudioSilence === null) this.sentryAudioSilence = new SentryAudioSilence({
+			track,
+			emit: (rtp) => this.sendSilenceToSentrySessions(rtp),
+			...this.logger ? { logger: this.logger } : {},
+			...this.deviceId === void 0 ? {} : { deviceId: this.deviceId }
+		});
+		this.sentryAudioSilence.want();
+	}
+	/**
+	* Hand one generated packet to every sentry session that can take it.
+	*
+	* Gated on PLAY, on the sentry intent and on the session's own mute — and
+	* deliberately NOT on `pendingKeyframe`, which is the one gate the real audio
+	* path applies and this one must not.
+	*
+	* That gate exists to keep live audio behind a video join REPLAY, so a
+	* session's two tracks are not handed media from two different moments.
+	* Generated silence belongs to no replay and to no GOP. Worse, waiting for
+	* the video would reproduce the defect: the placeholder picture arrives at
+	* 1 fps at best and not at all when the sentry refuses (unknown geometry, no
+	* cached snapshot), so the track a consumer's ffmpeg is waiting on would stay
+	* empty for exactly as long as the picture did — which is the stall the
+	* announced-but-unfilled `m=audio` was feared for in the first place.
+	*
+	* Returns how many took it, so a run that delivers to nobody is visible.
+	*/
+	sendSilenceToSentrySessions(rtp) {
+		const packet = {
+			data: rtp,
+			marker: (rtp[1] & 128) !== 0
+		};
+		let served = 0;
+		for (const session of this.sessions.values()) {
+			if (!session.isPrestreamIntent()) continue;
+			if (session.isMuted()) continue;
+			if (!session.isPlaying()) continue;
+			if (session.sendAudioRtp(packet) === "written") served += 1;
+		}
+		return served;
+	}
+	/**
 	* Apply the broker-side audio mute. Returns how many audio-bearing pull
 	* sessions were closed so they re-`DESCRIBE` against the new SDP.
 	*
@@ -3110,6 +3501,7 @@ var RtspRestreamer = class {
 	setAudioMuted(muted) {
 		if (this.deviceAudioMuted === muted) return 0;
 		this.deviceAudioMuted = muted;
+		this.reconcileSentryAudio();
 		const audioBearing = [...this.sessions.values()].filter((s) => !s.isMuted());
 		for (const session of audioBearing) this.killSession(session.getSessionId());
 		if (audioBearing.length > 0) this.logger?.info("audio mute changed — closing audio-bearing RTSP pulls so they re-DESCRIBE", {
@@ -3161,6 +3553,7 @@ var RtspRestreamer = class {
 			total: this.sessions.size
 		} });
 		this._onSessionCountChanged?.();
+		this.reconcileSentryAudio();
 		if (this._rtpPassthroughMode) setTimeout(() => this.servePendingSessionsRtp(), 0);
 		else if (this.lastKeyframeNals.length > 0 && this.packetizer) setTimeout(() => this.servePendingSessions(), 0);
 	}
@@ -3336,7 +3729,7 @@ var RtspRestreamer = class {
 				}
 			}
 			const withhold = admitJoinBurst({
-				muted: session.isMuted(),
+				liveEdgeOnly: session.isLiveEdgeOnly(),
 				detectionIntent,
 				fromRing,
 				spanMs,
@@ -3599,6 +3992,7 @@ var RtspRestreamer = class {
 	*/
 	pushAudioRtpPassthrough(rtpData) {
 		if (this.deviceAudioMuted) return;
+		this.sentryAudioSilence?.noteRealAudio(Date.now());
 		if (this.sessions.size === 0) return;
 		const rtpPacket = {
 			data: rtpData,
@@ -3619,6 +4013,7 @@ var RtspRestreamer = class {
 			total: this.sessions.size
 		} });
 		this._onSessionCountChanged?.();
+		this.reconcileSentryAudio();
 	}
 	/**
 	* Force-close + remove a session by id. Used by the admin `killClient`
@@ -3647,6 +4042,7 @@ var RtspRestreamer = class {
 	}
 	destroy() {
 		this._onSessionCountChanged = null;
+		this.sentryAudioSilence?.release("restreamer destroyed");
 		this.abortAllReplays();
 		this.deframer?.flush();
 		for (const session of this.sessions.values()) session.close();
@@ -3816,9 +4212,11 @@ var RtspSession = class {
 	* {@link NO_DECLARATION} when it declared nothing — which is every consumer
 	* except the per-session detection decode and the recorder's writer.
 	*
-	* Kept separate from {@link muted} deliberately: `isMuted()` is shared by the
-	* WebRTC/HomeKit loopback legs, and the join rule that keys on it must stay
-	* true for them. Only an explicit declaration changes behaviour.
+	* Kept separate from {@link muted} deliberately: the two say different things
+	* and, since D525, they no longer coincide — a `/sentry` dial declares an
+	* intent and is NOT muted, while the join rule that used to read `isMuted()`
+	* now reads {@link isLiveEdgeOnly} and keeps every older population's
+	* behaviour byte-for-byte.
 	*
 	* One field and not two, because the purpose and the amount are one
 	* statement (D382): a session that names a purpose without naming an amount
@@ -3880,6 +4278,20 @@ var RtspSession = class {
 		return this.muted;
 	}
 	/**
+	* Whether this session is a RE-CLOCKING leg that may only join at the live
+	* edge — the second question `isMuted()` used to answer.
+	*
+	* Derived from the one authority (`isLiveEdgeOnlyDial`) rather than stored,
+	* so the rule cannot drift between the parser and the session. Unchanged for
+	* every population that existed before the sentry gained audio.
+	*/
+	isLiveEdgeOnly() {
+		return require_restream_intent.isLiveEdgeOnlyDial({
+			muted: this.muted,
+			declaration: this.declaration
+		});
+	}
+	/**
 	* The `User-Agent` this client put on its first request, or `null`.
 	*
 	* The ONLY identity that crosses from a consumer process into this session.
@@ -4329,7 +4741,9 @@ var RtspListenServer = class RtspListenServer {
 	async dispatch(socket, requestBuffer) {
 		const uriMatch = (requestBuffer.split("\r\n")[0] ?? "").match(/\s(rtsp:\/\/[^\s]+)\s/);
 		const pathMatch = (uriMatch ? uriMatch[1] : "").match(/rtsp:\/\/[^/]+(\/.*?)(?:\s|$)/);
-		const { lookupPath, muted: isMuted, declaration } = require_restream_intent.parseRestreamPath(pathMatch ? pathMatch[1].replace(/^\//, "").replace(/\/trackID=\d+$/, "") : "");
+		const parsed = require_restream_intent.parseRestreamPath(pathMatch ? pathMatch[1].replace(/^\//, "").replace(/\/trackID=\d+$/, "") : "");
+		const { lookupPath, muted: isMuted, declaration } = parsed;
+		const sdpVariant = require_restream_intent.sdpVariantFor(parsed);
 		const restreamer = this.restreamers.get(lookupPath);
 		if (!restreamer) {
 			socket.write(`RTSP/1.0 404 Not Found\r\nCSeq: 1\r\n\r\n`);
@@ -4356,8 +4770,8 @@ var RtspListenServer = class RtspListenServer {
 		};
 		socket.once("close", releaseOnce);
 		socket.once("error", releaseOnce);
-		await this.waitForSdp(restreamer, isMuted, 3e3);
-		const session = new RtspSession(socket, isMuted ? restreamer.getMutedSdp() ?? restreamer.getSdp() ?? "" : restreamer.getSdp() ?? "", () => {
+		await this.waitForSdp(restreamer, sdpVariant, 3e3);
+		const session = new RtspSession(socket, restreamer.getSdpFor(sdpVariant) ?? restreamer.getSdp() ?? "", () => {
 			restreamer.removeSession(session.getSessionId());
 			releaseOnce();
 		}, isMuted, declaration);
@@ -4372,10 +4786,10 @@ var RtspListenServer = class RtspListenServer {
 	* a cold broker that's typically ~200-1000 ms. Resolves `true` if the
 	* SDP becomes non-empty within the budget, `false` on timeout.
 	*/
-	async waitForSdp(restreamer, isMuted, timeoutMs) {
+	async waitForSdp(restreamer, variant, timeoutMs) {
 		const start = Date.now();
 		const have = () => {
-			const s = isMuted ? restreamer.getMutedSdp() ?? restreamer.getSdp() : restreamer.getSdp();
+			const s = restreamer.getSdpFor(variant) ?? restreamer.getSdp();
 			return !!s && s.length > 0;
 		};
 		if (have()) return true;
@@ -15022,6 +15436,12 @@ var StreamBroker = class StreamBroker {
 						supportedNative
 					}
 				});
+				const sentryTrack = g711TrackFor(codecUpper);
+				this.rtspRestreamer.retainSentryAudioTrack(sentryTrack);
+				if (sentryTrack === null) this.logger?.info("sentry audio: codec cannot be filled — a sentry gets no audio", {
+					tags: { deviceId: this.numericDeviceId },
+					meta: { codec: codecUpper }
+				});
 				let supported = supportedNative;
 				let effectiveSampleRate = audioTrack.clockRate;
 				let effectiveChannels = audioTrack.channels;

package/dist/stream-broker/index.mjs

@@ -1,7 +1,7 @@
 import { r as __toESM } from "../chunk-DnnnRqeS.mjs";
 import { A as RingBuffer, B as declareLogChannel, Bt as buildFfmpegArgs$1, E as RATE_CONTROL_TIGHT, Et as resolveEgressDecodeHwAccel, Gt as CAM_PROFILE_ORDER, H as deriveBatteryPresence, Ht as isSoftwareDecode, I as batteryCapability, It as webrtcSessionCapability, K as egressTranscodeSharingKey, Kt as DeviceFeature, L as cameraStreamsCapability, Lt as errMsg, M as addonWidgetsSourceCapability, Nt as streamBrokerCapability, Qt as expandAudioChunkToF32le, R as createHwAccelCache, Rt as AUDIO_PRESETS, T as RATE_CONTROL_RELAXED, Ut as BOOT_RECOVERY_BACKOFF_MS, Vt as invocationFromEncodeProfile, Wt as BaseAddon, Yt as createEvent, _n as record, an as parseProfileBrokerId, at as logChannelsCapability, bn as EventCategory, cn as _enum, dn as discriminatedUnion, en as isEvent, h as EncodeProfileSchema, hn as object, i as BatteryStatusSchema, it as loadContributionCapability, ln as array, mn as number, nn as makeSourceBrokerId, pn as literal, q as egressTransportFromRequest, qt as DeviceType, rn as nodePin, st as maskUrlCredentials, tn as makeProfileBrokerId, un as boolean, v as G711_SCALE_CORRECTION_DB, vn as string, xt as rankStreams, yn as union, z as createLogChannelsProvider } from "../dist-D3w2fwD4.mjs";
 import { i as NO_COST_CLAIM, n as Fmp4FragmentChild, r as Fmp4FragmentPlane, t as ChildCostRegistry } from "../node-IHGNrWH9.mjs";
-import { c as withSentryIntent, d as prebufferRetentionMs, f as resolvePrebuffer, i as parseRestreamPath, l as PREBUFFER_MAX_MS, n as NO_DECLARATION, u as capPreRollRequestMs } from "../restream-intent-CgyZI565.mjs";
+import { a as parseRestreamPath, d as PREBUFFER_MAX_MS, f as capPreRollRequestMs, i as isLiveEdgeOnlyDial, m as resolvePrebuffer, n as NO_DECLARATION, p as prebufferRetentionMs, s as sdpVariantFor, u as withSentryIntent } from "../restream-intent-CW79dvFV.mjs";
 import { n as profileForStreamId } from "../remote-restream-BeHi78PZ.mjs";
 import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DZvlso2l.mjs";
 import { i as require_mp4box_all, n as demuxSegmentPreferJs, r as runFfmpegOnce, t as demuxSegmentFullJs } from "../segment-demux-js-BZAiu_2h.mjs";
@@ -2546,6 +2546,218 @@ function deviceIdFromBrokerId$1(brokerId) {
 	const parsed = Number(brokerId.split("/")[0]);
 	return Number.isFinite(parsed) ? parsed : void 0;
 }
+//#endregion
+//#region src/stream-broker/rtsp/audio/g711-silence.ts
+var SILENCE_BYTE = {
+	/** µ-law digital zero. */
+	PCMU: 255,
+	/** A-law digital zero. */
+	PCMA: 213
+};
+var STATIC_PAYLOAD_TYPE = {
+	PCMU: 0,
+	PCMA: 8
+};
+/** G.711 is 8 kHz mono by definition (RFC 3551). */
+var G711_CLOCK_RATE_HZ = 8e3;
+var G711_CHANNELS = 1;
+/**
+* The track for a codec name as the camera's SDP spelled it, or `null`.
+*
+* `null` is a REFUSAL with a reason the caller must log, never a fallback to
+* PCMU: a sentry filled with the wrong codec's bytes is audible garbage on
+* every consumer, which is strictly worse than the silence of no track at all.
+*/
+function g711TrackFor(codec) {
+	if (codec === void 0) return null;
+	const upper = codec.toUpperCase();
+	if (upper !== "PCMU" && upper !== "PCMA") return null;
+	return {
+		codec: upper,
+		payloadType: STATIC_PAYLOAD_TYPE[upper],
+		clockRateHz: G711_CLOCK_RATE_HZ,
+		channels: G711_CHANNELS
+	};
+}
+/**
+* The `m=audio` block grafted onto the sentry's video-only SDP.
+*
+* Built rather than extracted from the camera's SDP on purpose. A static
+* payload type makes the description fully determined by the codec, so the
+* block is correct even when no camera SDP exists — which is the state this
+* whole path is for. `extractAudioMediaBlock` cannot serve here: it remaps a
+* dynamic payload type to 97 for the ffmpeg egress graft, and a remap is
+* exactly what must not happen to a track the camera will later fill itself.
+*/
+function g711AudioMediaBlock(track, trackId) {
+	return [
+		`m=audio 0 RTP/AVP ${track.payloadType}`,
+		"c=IN IP4 0.0.0.0",
+		`a=rtpmap:${track.payloadType} ${track.codec}/${track.clockRateHz}`,
+		`a=control:trackID=${trackId}`
+	].join("\r\n");
+}
+/**
+* One complete RTP packet of silence: 12-byte header plus one frame of the
+* codec's zero byte. Pure — the caller owns the sequence, the clock and the
+* decision to send.
+*/
+function buildG711SilenceRtp(input) {
+	const packet = Buffer.alloc(172, SILENCE_BYTE[input.track.codec]);
+	packet[0] = 128;
+	packet[1] = (input.marker ? 128 : 0) | input.track.payloadType & 127;
+	packet.writeUInt16BE(input.sequenceNumber & 65535, 2);
+	packet.writeUInt32BE(input.rtpTimestamp >>> 0, 4);
+	packet.writeUInt32BE(input.ssrc >>> 0, 8);
+	return packet;
+}
+//#endregion
+//#region src/stream-broker/rtsp/audio/sentry-audio-silence.ts
+/**
+* How long the camera must be quiet before the filler takes the track back.
+*
+* Longer than any plausible inter-packet gap on a live G.711 stream (20 ms
+* nominal, 50 pps) by two orders of magnitude, so a momentary stutter in real
+* audio can never be papered over with generated frames; short enough that a
+* consumer's decoder does not see a hole when the camera goes back to sleep.
+*/
+var DEFAULT_RESUME_GAP_MS = 1e3;
+var SentryAudioSilence = class {
+	options;
+	frameMs;
+	resumeGapMs;
+	tags;
+	ssrc;
+	timer;
+	resumeTimer;
+	sequenceNumber;
+	rtpTimestamp = 0;
+	markNext = true;
+	emitted = 0;
+	/** Frames that reached at least one session. See {@link stopRun}. */
+	delivered = 0;
+	lastRealAudioAt = 0;
+	wanted = false;
+	constructor(options) {
+		this.options = options;
+		this.frameMs = options.frameMs ?? 20;
+		this.resumeGapMs = options.resumeGapMs ?? DEFAULT_RESUME_GAP_MS;
+		this.tags = options.deviceId === void 0 ? {} : { tags: { deviceId: options.deviceId } };
+		this.ssrc = Math.random() * 4294967295 >>> 0;
+		this.sequenceNumber = Math.random() * 65535 & 65535;
+	}
+	/** The audio shape this filler was built for. */
+	get track() {
+		return this.options.track;
+	}
+	/** True while packets are actually being produced. */
+	get running() {
+		return this.timer !== void 0;
+	}
+	/**
+	* Somebody wants the track filled. Idempotent — reconciliation calls this on
+	* every session edge, and a second call while a run is in flight must not
+	* restart the clock or re-log.
+	*/
+	want() {
+		this.wanted = true;
+		this.startRun();
+	}
+	/**
+	* Nobody wants the track filled any more (the last sentry left, the operator
+	* muted the device, the broker is going away). Idempotent.
+	*/
+	release(reason) {
+		this.wanted = false;
+		this.clearResume();
+		this.stopRun(reason);
+	}
+	/**
+	* The camera's own audio just arrived.
+	*
+	* Synchronous, and the first thing `pushAudioRtpPassthrough` does: the timer
+	* is gone before this packet is written to any session, so no generated frame
+	* can follow it. Called on EVERY real packet, not only the first — the rolling
+	* gap is what lets the filler come back when the camera sleeps again, without
+	* a second signal anybody has to remember to send.
+	*/
+	noteRealAudio(nowMs) {
+		this.lastRealAudioAt = nowMs;
+		this.stopRun("real audio");
+		this.armResume();
+	}
+	startRun() {
+		if (this.timer !== void 0) return;
+		if (!this.wanted) return;
+		if (Date.now() - this.lastRealAudioAt < this.resumeGapMs) {
+			this.armResume();
+			return;
+		}
+		this.rtpTimestamp = Math.floor(Date.now() * this.options.track.clockRateHz / 1e3) >>> 0;
+		this.markNext = true;
+		this.emitted = 0;
+		this.delivered = 0;
+		this.timer = setInterval(() => this.tick(), this.frameMs);
+		this.options.logger?.info("sentry audio: filling the track with silence", {
+			...this.tags,
+			meta: {
+				codec: this.options.track.codec,
+				payloadType: this.options.track.payloadType,
+				frameMs: this.frameMs,
+				clockRateHz: this.options.track.clockRateHz
+			}
+		});
+	}
+	stopRun(reason) {
+		if (this.timer === void 0) return;
+		clearInterval(this.timer);
+		this.timer = void 0;
+		this.options.logger?.info("sentry audio: stopped filling the track", {
+			...this.tags,
+			meta: {
+				reason,
+				framesEmitted: this.emitted,
+				framesDelivered: this.delivered
+			}
+		});
+	}
+	/**
+	* Re-check once the gap has elapsed.
+	*
+	* A single pending timeout rather than a free-running ticker that decides per
+	* frame: while the camera is awake this costs one timer per second instead of
+	* fifty, and while it is asleep it costs nothing at all — the run is the
+	* ticker.
+	*/
+	armResume() {
+		if (!this.wanted) return;
+		if (this.resumeTimer !== void 0) return;
+		this.resumeTimer = setTimeout(() => {
+			this.resumeTimer = void 0;
+			this.startRun();
+		}, this.resumeGapMs);
+		this.resumeTimer.unref?.();
+	}
+	clearResume() {
+		if (this.resumeTimer === void 0) return;
+		clearTimeout(this.resumeTimer);
+		this.resumeTimer = void 0;
+	}
+	tick() {
+		const rtp = buildG711SilenceRtp({
+			track: this.options.track,
+			ssrc: this.ssrc,
+			sequenceNumber: this.sequenceNumber,
+			rtpTimestamp: this.rtpTimestamp,
+			marker: this.markNext
+		});
+		this.sequenceNumber = this.sequenceNumber + 1 & 65535;
+		this.rtpTimestamp = this.rtpTimestamp + 160 >>> 0;
+		this.markNext = false;
+		this.emitted += 1;
+		if (this.options.emit(rtp) > 0) this.delivered += 1;
+	}
+};
 /**
 * Extract the `m=audio` media block from an ffmpeg-generated SDP, normalised
 * for grafting (port 0, non-colliding payload type, own `a=control`, explicit
@@ -2593,7 +2805,7 @@ function appendAudioMediaBlock(videoSdp, audioBlock) {
 * the result onto its counters and its `continue`.
 */
 function admitJoinBurst(input) {
-	if (input.muted && !input.detectionIntent) return !input.fromRing || input.spanMs > input.liveEdgeMaxSpanMs ? "live-edge" : "none";
+	if (input.liveEdgeOnly) return !input.fromRing || input.spanMs > input.liveEdgeMaxSpanMs ? "live-edge" : "none";
 	if (!input.detectionIntent && input.spanMs > input.bound.maxSpanMs) return "span";
 	if (input.packets > input.bound.maxPackets) return "packets";
 	return "none";
@@ -2795,6 +3007,14 @@ var LIVE_EDGE_MAX_SPAN_MS = 500;
 */
 var PRIME_MAX_SPAN_MS = 2e3;
 /**
+* The `a=control:trackID=` the sentry's grafted audio block is given.
+*
+* The same id the transcode egress grafts its own audio onto
+* (`extractAudioMediaBlock`'s default) and the same one `sendAudioRtp` writes
+* to (`tracks[1]`), because the video track is always trackID=0.
+*/
+var SENTRY_AUDIO_TRACK_ID = 1;
+/**
 * Defensive packet ceiling on a join burst, independent of {@link
 * PRIME_MAX_SPAN_MS}. The ring is trimmed to one GOP by RTP timestamp, so a
 * burst this large means the timestamps stopped describing the stream (wrap,
@@ -2887,6 +3107,27 @@ var RtspRestreamer = class {
 	* a broker going idle overnight would wake up distributing audio again.
 	*/
 	deviceAudioMuted = false;
+	/**
+	* The camera's audio shape, remembered so a SENTRY can be handed a track to
+	* fill while the camera is asleep.
+	*
+	* NOT cleared by {@link resetStreamState}, for exactly the reason
+	* {@link deviceAudioMuted} is not: that method resets what belongs to one
+	* CONNECTION, and this describes the CAMERA. A sleeping camera has no SDP to
+	* read — it is the whole premise of the sentry — so if this did not survive
+	* the suspend there would never be an audio track to announce at the moment
+	* one is needed.
+	*
+	* `null` means nothing has ever described this camera's audio to us (a cold
+	* hub whose battery camera has not been awake since boot), or its codec is
+	* one whose silence cannot be generated exactly. Both are logged; neither is
+	* guessed at.
+	*/
+	sentryAudioTrack = null;
+	/** Fills a sentry's audio track while the camera sleeps. Built on demand. */
+	sentryAudioSilence = null;
+	/** One-shot guard for "a sentry attached and there is no track to fill". */
+	sentryAudioGapLogged = false;
 	/** Cached last keyframe NALs (SPS/PPS + IDR) for late-joining clients. */
 	lastKeyframeNals = [];
 	lastKeyframeNalBytes = 0;
@@ -3095,6 +3336,156 @@ var RtspRestreamer = class {
 		return this.mutedSdp ?? this.sdp;
 	}
 	/**
+	* The SDP a SENTRY dial is answered with: the picture it is being served,
+	* plus the audio track that picture will be accompanied by.
+	*
+	* Three cases, in this order and no other:
+	*
+	*  1. The operator muted this camera broker-side (D83). That mute IS a device
+	*     policy and outranks everything here — the sentry is answered video-only,
+	*     exactly as every other consumer is.
+	*  2. The current connection already describes audio (the camera is up and we
+	*     are serving its own SDP). It is served verbatim: grafting on top would
+	*     announce the track twice, and the camera's own description is by
+	*     definition the one its RTP will match.
+	*  3. Otherwise — the sleeping case, where the SDP is built from the
+	*     placeholder frame and has no audio at all — the retained shape is
+	*     grafted on as trackID=1.
+	*
+	* Without a retained shape this degrades to the video-only SDP, which is what
+	* the whole path used to serve unconditionally. That is a REFUSAL, reported
+	* by {@link reconcileSentryAudio}: a sentry with no audio is a sentry that
+	* will never have any, and the operator has to be able to see it rather than
+	* infer it from a silent stream.
+	*/
+	getSentrySdp() {
+		if (this.deviceAudioMuted) return this.getMutedSdp();
+		const full = this.sdp;
+		if (full !== null && /^m=audio/m.test(full)) return full;
+		const videoOnly = this.getMutedSdp();
+		const track = this.sentryAudioTrack;
+		if (track === null || videoOnly === null) return videoOnly;
+		return appendAudioMediaBlock(videoOnly, g711AudioMediaBlock(track, SENTRY_AUDIO_TRACK_ID));
+	}
+	/**
+	* The SDP for a parsed dial's variant.
+	*
+	* One switch and not three call sites: the listen server reads the SDP twice
+	* (once to wait for it, once to answer with it), and those two reads
+	* disagreeing about which variant a dial gets is a class of bug that costs a
+	* consumer an empty DESCRIBE.
+	*/
+	getSdpFor(variant) {
+		if (variant === "sentry") return this.getSentrySdp();
+		if (variant === "muted") return this.getMutedSdp();
+		return this.getSdp();
+	}
+	/**
+	* Remember (or forget) the camera's audio shape for the sentry.
+	*
+	* Called from the broker's `onAudioTrack`, which is the only place the
+	* camera's own SDP is parsed. `null` forgets it — a camera whose audio was
+	* turned off, or whose codec this system cannot fill exactly.
+	*/
+	retainSentryAudioTrack(track) {
+		const prior = this.sentryAudioTrack;
+		if (prior?.codec === track?.codec && prior?.payloadType === track?.payloadType) return;
+		this.sentryAudioTrack = track;
+		this.sentryAudioSilence?.release("audio shape changed");
+		this.sentryAudioSilence = null;
+		this.sentryAudioGapLogged = false;
+		this.logger?.info("sentry audio: track shape retained", {
+			tags: { deviceId: this.deviceId },
+			meta: {
+				streamName: this.streamName,
+				codec: track?.codec ?? null
+			}
+		});
+		this.reconcileSentryAudio();
+	}
+	/** The retained audio shape, or `null`. Survives a suspend by design. */
+	getSentryAudioTrack() {
+		return this.sentryAudioTrack;
+	}
+	/**
+	* Whether generated silence is being produced for this stream right now.
+	*
+	* Exposed because "is the filler still running" is not answerable from the
+	* wire: a run whose last sentry has left writes to nobody, so a socket that
+	* sees nothing looks exactly like a timer that was released and exactly like
+	* one that was leaked. That ambiguity survived a deliberate sabotage of
+	* {@link removeSession}'s reconcile with the whole suite green.
+	*/
+	isSentryAudioFilling() {
+		return this.sentryAudioSilence?.running === true;
+	}
+	/**
+	* Start or stop filling the sentry audio track to match who is attached.
+	*
+	* Called on every edge that can change the answer — a session arriving or
+	* leaving, the operator's mute, a new audio shape — and never on a per-packet
+	* path. Idempotent in both directions.
+	*/
+	reconcileSentryAudio() {
+		if (!(this.getPrestreamSessionCount() > 0 && !this.deviceAudioMuted)) {
+			this.sentryAudioSilence?.release("no sentry session");
+			return;
+		}
+		const track = this.sentryAudioTrack;
+		if (track === null) {
+			if (!this.sentryAudioGapLogged) {
+				this.sentryAudioGapLogged = true;
+				this.logger?.info("sentry audio: no track to fill — this dial gets no audio", {
+					tags: { deviceId: this.deviceId },
+					meta: {
+						streamName: this.streamName,
+						reason: "no retained g711 audio shape"
+					}
+				});
+			}
+			return;
+		}
+		if (this.sentryAudioSilence === null) this.sentryAudioSilence = new SentryAudioSilence({
+			track,
+			emit: (rtp) => this.sendSilenceToSentrySessions(rtp),
+			...this.logger ? { logger: this.logger } : {},
+			...this.deviceId === void 0 ? {} : { deviceId: this.deviceId }
+		});
+		this.sentryAudioSilence.want();
+	}
+	/**
+	* Hand one generated packet to every sentry session that can take it.
+	*
+	* Gated on PLAY, on the sentry intent and on the session's own mute — and
+	* deliberately NOT on `pendingKeyframe`, which is the one gate the real audio
+	* path applies and this one must not.
+	*
+	* That gate exists to keep live audio behind a video join REPLAY, so a
+	* session's two tracks are not handed media from two different moments.
+	* Generated silence belongs to no replay and to no GOP. Worse, waiting for
+	* the video would reproduce the defect: the placeholder picture arrives at
+	* 1 fps at best and not at all when the sentry refuses (unknown geometry, no
+	* cached snapshot), so the track a consumer's ffmpeg is waiting on would stay
+	* empty for exactly as long as the picture did — which is the stall the
+	* announced-but-unfilled `m=audio` was feared for in the first place.
+	*
+	* Returns how many took it, so a run that delivers to nobody is visible.
+	*/
+	sendSilenceToSentrySessions(rtp) {
+		const packet = {
+			data: rtp,
+			marker: (rtp[1] & 128) !== 0
+		};
+		let served = 0;
+		for (const session of this.sessions.values()) {
+			if (!session.isPrestreamIntent()) continue;
+			if (session.isMuted()) continue;
+			if (!session.isPlaying()) continue;
+			if (session.sendAudioRtp(packet) === "written") served += 1;
+		}
+		return served;
+	}
+	/**
 	* Apply the broker-side audio mute. Returns how many audio-bearing pull
 	* sessions were closed so they re-`DESCRIBE` against the new SDP.
 	*
@@ -3106,6 +3497,7 @@ var RtspRestreamer = class {
 	setAudioMuted(muted) {
 		if (this.deviceAudioMuted === muted) return 0;
 		this.deviceAudioMuted = muted;
+		this.reconcileSentryAudio();
 		const audioBearing = [...this.sessions.values()].filter((s) => !s.isMuted());
 		for (const session of audioBearing) this.killSession(session.getSessionId());
 		if (audioBearing.length > 0) this.logger?.info("audio mute changed — closing audio-bearing RTSP pulls so they re-DESCRIBE", {
@@ -3157,6 +3549,7 @@ var RtspRestreamer = class {
 			total: this.sessions.size
 		} });
 		this._onSessionCountChanged?.();
+		this.reconcileSentryAudio();
 		if (this._rtpPassthroughMode) setTimeout(() => this.servePendingSessionsRtp(), 0);
 		else if (this.lastKeyframeNals.length > 0 && this.packetizer) setTimeout(() => this.servePendingSessions(), 0);
 	}
@@ -3332,7 +3725,7 @@ var RtspRestreamer = class {
 				}
 			}
 			const withhold = admitJoinBurst({
-				muted: session.isMuted(),
+				liveEdgeOnly: session.isLiveEdgeOnly(),
 				detectionIntent,
 				fromRing,
 				spanMs,
@@ -3595,6 +3988,7 @@ var RtspRestreamer = class {
 	*/
 	pushAudioRtpPassthrough(rtpData) {
 		if (this.deviceAudioMuted) return;
+		this.sentryAudioSilence?.noteRealAudio(Date.now());
 		if (this.sessions.size === 0) return;
 		const rtpPacket = {
 			data: rtpData,
@@ -3615,6 +4009,7 @@ var RtspRestreamer = class {
 			total: this.sessions.size
 		} });
 		this._onSessionCountChanged?.();
+		this.reconcileSentryAudio();
 	}
 	/**
 	* Force-close + remove a session by id. Used by the admin `killClient`
@@ -3643,6 +4038,7 @@ var RtspRestreamer = class {
 	}
 	destroy() {
 		this._onSessionCountChanged = null;
+		this.sentryAudioSilence?.release("restreamer destroyed");
 		this.abortAllReplays();
 		this.deframer?.flush();
 		for (const session of this.sessions.values()) session.close();
@@ -3812,9 +4208,11 @@ var RtspSession = class {
 	* {@link NO_DECLARATION} when it declared nothing — which is every consumer
 	* except the per-session detection decode and the recorder's writer.
 	*
-	* Kept separate from {@link muted} deliberately: `isMuted()` is shared by the
-	* WebRTC/HomeKit loopback legs, and the join rule that keys on it must stay
-	* true for them. Only an explicit declaration changes behaviour.
+	* Kept separate from {@link muted} deliberately: the two say different things
+	* and, since D525, they no longer coincide — a `/sentry` dial declares an
+	* intent and is NOT muted, while the join rule that used to read `isMuted()`
+	* now reads {@link isLiveEdgeOnly} and keeps every older population's
+	* behaviour byte-for-byte.
 	*
 	* One field and not two, because the purpose and the amount are one
 	* statement (D382): a session that names a purpose without naming an amount
@@ -3876,6 +4274,20 @@ var RtspSession = class {
 		return this.muted;
 	}
 	/**
+	* Whether this session is a RE-CLOCKING leg that may only join at the live
+	* edge — the second question `isMuted()` used to answer.
+	*
+	* Derived from the one authority (`isLiveEdgeOnlyDial`) rather than stored,
+	* so the rule cannot drift between the parser and the session. Unchanged for
+	* every population that existed before the sentry gained audio.
+	*/
+	isLiveEdgeOnly() {
+		return isLiveEdgeOnlyDial({
+			muted: this.muted,
+			declaration: this.declaration
+		});
+	}
+	/**
 	* The `User-Agent` this client put on its first request, or `null`.
 	*
 	* The ONLY identity that crosses from a consumer process into this session.
@@ -4325,7 +4737,9 @@ var RtspListenServer = class RtspListenServer {
 	async dispatch(socket, requestBuffer) {
 		const uriMatch = (requestBuffer.split("\r\n")[0] ?? "").match(/\s(rtsp:\/\/[^\s]+)\s/);
 		const pathMatch = (uriMatch ? uriMatch[1] : "").match(/rtsp:\/\/[^/]+(\/.*?)(?:\s|$)/);
-		const { lookupPath, muted: isMuted, declaration } = parseRestreamPath(pathMatch ? pathMatch[1].replace(/^\//, "").replace(/\/trackID=\d+$/, "") : "");
+		const parsed = parseRestreamPath(pathMatch ? pathMatch[1].replace(/^\//, "").replace(/\/trackID=\d+$/, "") : "");
+		const { lookupPath, muted: isMuted, declaration } = parsed;
+		const sdpVariant = sdpVariantFor(parsed);
 		const restreamer = this.restreamers.get(lookupPath);
 		if (!restreamer) {
 			socket.write(`RTSP/1.0 404 Not Found\r\nCSeq: 1\r\n\r\n`);
@@ -4352,8 +4766,8 @@ var RtspListenServer = class RtspListenServer {
 		};
 		socket.once("close", releaseOnce);
 		socket.once("error", releaseOnce);
-		await this.waitForSdp(restreamer, isMuted, 3e3);
-		const session = new RtspSession(socket, isMuted ? restreamer.getMutedSdp() ?? restreamer.getSdp() ?? "" : restreamer.getSdp() ?? "", () => {
+		await this.waitForSdp(restreamer, sdpVariant, 3e3);
+		const session = new RtspSession(socket, restreamer.getSdpFor(sdpVariant) ?? restreamer.getSdp() ?? "", () => {
 			restreamer.removeSession(session.getSessionId());
 			releaseOnce();
 		}, isMuted, declaration);
@@ -4368,10 +4782,10 @@ var RtspListenServer = class RtspListenServer {
 	* a cold broker that's typically ~200-1000 ms. Resolves `true` if the
 	* SDP becomes non-empty within the budget, `false` on timeout.
 	*/
-	async waitForSdp(restreamer, isMuted, timeoutMs) {
+	async waitForSdp(restreamer, variant, timeoutMs) {
 		const start = Date.now();
 		const have = () => {
-			const s = isMuted ? restreamer.getMutedSdp() ?? restreamer.getSdp() : restreamer.getSdp();
+			const s = restreamer.getSdpFor(variant) ?? restreamer.getSdp();
 			return !!s && s.length > 0;
 		};
 		if (have()) return true;
@@ -15018,6 +15432,12 @@ var StreamBroker = class StreamBroker {
 						supportedNative
 					}
 				});
+				const sentryTrack = g711TrackFor(codecUpper);
+				this.rtspRestreamer.retainSentryAudioTrack(sentryTrack);
+				if (sentryTrack === null) this.logger?.info("sentry audio: codec cannot be filled — a sentry gets no audio", {
+					tags: { deviceId: this.numericDeviceId },
+					meta: { codec: codecUpper }
+				});
 				let supported = supportedNative;
 				let effectiveSampleRate = audioTrack.clockRate;
 				let effectiveChannels = audioTrack.channels;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-pipeline",
-  "version": "1.2.258",
+  "version": "1.2.259",
   "description": "Pipeline bundle — runner, detection, motion, audio + stream broker. Multi-entry npm package shipping pipeline addons under a single bundle.",
   "keywords": [
     "camstack",