@camstack/addon-pipeline 1.2.373 → 1.2.374

package/dist/stream-broker/index.mjs

@@ -1,10 +1,9 @@
 import { r as __toESM } from "../chunk-DnnnRqeS.mjs";
-import { $n as _enum, An as errMsg, At as gifFromMp4Args, Bt as memoizePinnedFfmpeg, D as G711_SCALE_CORRECTION_DB, Dn as isSoftwareDecode, Dt as ffmpegRate, En as invocationFromEncodeProfile, Ft as loadContributionCapability, Gn as makeProfileBrokerId, I as RATE_CONTROL_RELAXED, It as logChannelsCapability, J as addonWidgetsSourceCapability, Jn as nodePin, Kn as makeSourceBrokerId, L as RATE_CONTROL_TIGHT, Mn as BaseAddon, Nn as CAM_PROFILE_ORDER, On as DeviceFeature, Pn as CamProfileSchema, Qt as rankStreams, Rn as createEvent, Vn as expandAudioChunkToF32le, W as RingBuffer, Wn as isEvent, Yn as parseProfileBrokerId, an as resolveEgressDecodeHwAccel, ar as number, bn as webrtcSessionCapability, bt as egressTransportFromRequest, c as CLIP_STILL_REASON_CODE_HEADER, cr as record, dr as EventCategory, dt as declareLogChannel, er as array, gn as streamBrokerCapability, ir as literal, it as cameraStreamsCapability, jn as BOOT_RECOVERY_BACKOFF_MS, kn as DeviceType, kt as gifDeriveSpeed, lr as string, lt as createHwAccelCache, nr as discriminatedUnion, o as BatteryStatusSchema, or as object, ot as clipExportFailureOf, pt as deriveBatteryPresence, qn as maskUrlCredentials, s as CLIP_BROKER_PACED_RATES, tr as boolean, tt as batteryCapability, ur as union, ut as createLogChannelsProvider, w as EncodeProfileSchema, wn as buildFfmpegArgs, xn as AUDIO_PRESETS, yt as egressTranscodeSharingKey } from "../dist-BT3uSeR7.mjs";
-import { i as NO_COST_CLAIM, n as Fmp4FragmentChild, o as probeFfmpegBinary, r as Fmp4FragmentPlane, t as ChildCostRegistry } from "../node-BVRFl1hZ.mjs";
+import { An as errMsg, At as gifFromMp4Args, Bt as memoizePinnedFfmpeg, D as G711_SCALE_CORRECTION_DB, Dn as isSoftwareDecode, Dt as ffmpegRate, En as invocationFromEncodeProfile, Ft as loadContributionCapability, Gn as isSecretMarker, I as RATE_CONTROL_RELAXED, It as logChannelsCapability, J as addonWidgetsSourceCapability, Jn as maskUrlCredentials, Kn as makeProfileBrokerId, L as RATE_CONTROL_TIGHT, Mn as BaseAddon, Nn as CAM_PROFILE_ORDER, On as DeviceFeature, Pn as CamProfileSchema, Qt as rankStreams, Rn as createEvent, Vn as expandAudioChunkToF32le, W as RingBuffer, Wn as isEvent, Xn as parseProfileBrokerId, Yn as nodePin, Z as armRemovalReconcile, an as resolveEgressDecodeHwAccel, ar as literal, bn as webrtcSessionCapability, bt as egressTransportFromRequest, c as CLIP_STILL_REASON_CODE_HEADER, dr as union, dt as declareLogChannel, er as _enum, fr as EventCategory, gn as streamBrokerCapability, it as cameraStreamsCapability, jn as BOOT_RECOVERY_BACKOFF_MS, kn as DeviceType, kt as gifDeriveSpeed, lr as record, lt as createHwAccelCache, nr as boolean, o as BatteryStatusSchema, or as number, ot as clipExportFailureOf, pt as deriveBatteryPresence, qn as makeSourceBrokerId, rr as discriminatedUnion, s as CLIP_BROKER_PACED_RATES, sr as object, tr as array, tt as batteryCapability, ur as string, ut as createLogChannelsProvider, vt as deviceRemovalHookCapability, w as EncodeProfileSchema, wn as buildFfmpegArgs, xn as AUDIO_PRESETS, yt as egressTranscodeSharingKey } from "../dist-CmdLCb_F.mjs";
+import { i as NO_COST_CLAIM, n as Fmp4FragmentChild, o as probeFfmpegBinary, r as Fmp4FragmentPlane, t as ChildCostRegistry } from "../node-C3r8kiOo.mjs";
 import { a as parseRestreamPath, d as PREBUFFER_MAX_MS, f as capPreRollRequestMs, i as isLiveEdgeOnlyDial, m as resolvePrebuffer, n as NO_DECLARATION, p as prebufferRetentionMs, s as sdpVariantFor, u as withSentryIntent } from "../restream-intent-DyGmLAU9.mjs";
 import { n as profileForStreamId } from "../remote-restream-BeHi78PZ.mjs";
-import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DZvlso2l.mjs";
-import { a as require_mp4box_all, c as parseNalLengthSize, i as runFfmpegOnce, n as demuxSegmentPreferJs, o as avccSampleToAnnexB, r as FfmpegFallbackRefusedError, s as buildKeyframeAnnexB, t as demuxSegmentFullJs } from "../segment-demux-js-8CfbEFeD.mjs";
+import { a as require_mp4box_all, c as parseNalLengthSize, i as runFfmpegOnce, n as demuxSegmentPreferJs, o as avccSampleToAnnexB, r as FfmpegFallbackRefusedError, s as buildKeyframeAnnexB, t as demuxSegmentFullJs } from "../segment-demux-js-IKEO1XBz.mjs";
 import { createRequire } from "node:module";
 import * as os$1 from "node:os";
 import { networkInterfaces, tmpdir } from "node:os";
@@ -360,207 +359,253 @@ function formatProbedSummary(declared, snapshot, opts) {
 	return parts.join(SEP);
 }
 //#endregion
-//#region src/stream-broker/broker-row-stores.ts
-/**
-* The stream-broker's flattened settings maps — one row per entry.
-*
-* ## What this replaced
-*
-* `stream-broker:addon-settings` / `root` was 33 155 bytes on the reference
-* hub, and three keys were 32 735 of it: `probeSnapshots` (17 282 B, 109
-* streams), `rtspTokens` (13 147 B, 243 streams) and `profileMap` (2 306 B, 29
-* cameras — a per-DEVICE map, so it grows with the fleet). Every read of that
-* row parsed all of it, including `BaseAddon.resolveConfig`, and every write
-* rewrote all of it — a probe flush every few seconds while streams are live.
-*
-* Two keys deliberately STAY blob keys on that row, and the reasons are not
-* "they are small":
-*
-*   - `rtspEnabled` — brokerId → boolean, EMPTY on the reference hub. Its
-*     persister replaces the whole map from the set of registered restreamers,
-*     and reproducing that on rows means an authoritative prune. A prune driven
-*     by a map that shrinks whenever a broker unregisters is exactly the shape
-*     that turns an unbind into a wipe (D130, D49), and the twin key
-*     `rtspTokens` carries a comment about precisely that loss. Nothing is
-*     bought by moving 0 bytes at that risk.
-*   - `deviceOverrides` — 354 B, two cameras, same replace-the-whole-map
-*     persister, written only when an operator edits an override.
-*
-* The row survives either way: it is also where `BaseAddon.resolveConfig` reads
-* the operator's config fields from. The problem was a 33 KB row, not a blob.
-*/
-/**
-* The addon id — the settings-store namespace whose `root` row the flattened
-* keys are being retired from. Matches `packages/addon-pipeline/package.json`
-* (`camstack.addons[].id`).
-*/
-var STREAM_BROKER_ADDON_ID = "stream-broker";
-/**
-* Every one of these collections is keyed by the BROKER ID
-* (`<deviceId>/<camStreamId>`) or by the numeric deviceId. `brokerDeviceId`
-* recovers the numeric device from either, for the projected column that makes
-* a per-camera question an indexed query — and for `tags: { deviceId }` on
-* every line these stores log.
-*
-* Returns `null` rather than guessing: a key whose head is not a number is a
-* key this addon did not write, and inventing a device for it would put a row
-* on a camera at random.
-*/
-function brokerDeviceId(key) {
-	const head = key.includes("/") ? key.slice(0, key.indexOf("/")) : key;
-	const id = Number(head);
-	return Number.isInteger(id) && id > 0 ? id : null;
-}
-/**
-* Bound for a whole-map read. `settings-store.query` silently caps an unbounded
-* read at 2 000 rows and answers as if that were everything; at 974 devices ×
-* up to 5 streams the default is HALF the margin, so every read here names its
-* own ceiling and a truncation is reported rather than shrunk.
-*/
-var BROKER_ROWS_LIMIT = 2e4;
-/**
-* @durable class=mirror owner=stream-broker
-*   write="one row per broker (`<deviceId>/<camStreamId>`), replaced wholesale from the
-*     manager's live probe map by the throttled metrics flush and once on shutdown"
-*   retention="the flush is authoritative: a broker the manager no longer holds loses its
-*     row. Losing the whole collection costs the settings 'Probed' field showing 'not yet
-*     probed' until the stream is pulled again — it is re-derived from the next probe."
-*/
-var BROKER_PROBE_SNAPSHOTS_COLLECTION = "stream-broker:probe-snapshots";
-var BROKER_PROBE_SNAPSHOTS_SPEC = {
-	collection: BROKER_PROBE_SNAPSHOTS_COLLECTION,
-	schema: ProbedSnapshotSchema,
-	columns: [{
-		name: "deviceId",
-		type: "INTEGER"
-	}, {
-		name: "at",
-		type: "INTEGER",
-		notNull: true
-	}],
-	indexes: [{
-		name: "idx_stream_broker_probe_device",
-		columns: ["deviceId"]
-	}],
-	project: (key, value) => ({
-		deviceId: brokerDeviceId(key),
-		at: value.at
-	}),
-	deviceIdColumn: "deviceId",
-	loadLimit: BROKER_ROWS_LIMIT
-};
-function probeSnapshotsStore(store, logger) {
-	return new RowMapStore({
-		spec: BROKER_PROBE_SNAPSHOTS_SPEC,
-		store,
-		logger
-	});
-}
-/**
-* The token, wrapped in an object rather than stored bare.
-*
-* A bare string in a `JSON` column round-trips only because the engine's
-* decoder JSON-parses a stored string ONLY when it starts with `{` or `[`. That
-* is a heuristic, not a contract; a token is opaque hex today and a future
-* format that starts with a brace would come back as an object. One field costs
-* nothing and makes the row self-describing.
-*/
-var RtspTokenRowSchema = object({ token: string().min(1) });
-/**
-* @durable class=ledger owner=stream-broker
-*   write="one row per broker (`<deviceId>/<camStreamId>`), upserted when the restream
-*     server mints a token. MERGE only — a token is stable forever per stream unless it
-*     is explicitly regenerated"
-*   retention="nothing deletes a row. The persister receives only the CURRENTLY registered
-*     restreamers, so a replace would erase the token of an unregistered broker and turn
-*     an external NVR URL into a dead 404 at the next idle or reboot."
-*/
-var BROKER_RTSP_TOKENS_COLLECTION = "stream-broker:rtsp-tokens";
-var BROKER_RTSP_TOKENS_SPEC = {
-	collection: BROKER_RTSP_TOKENS_COLLECTION,
-	schema: RtspTokenRowSchema,
-	columns: [{
-		name: "deviceId",
-		type: "INTEGER"
-	}],
-	indexes: [{
-		name: "idx_stream_broker_rtsp_tokens_device",
-		columns: ["deviceId"]
-	}],
-	project: (key) => ({ deviceId: brokerDeviceId(key) }),
-	deviceIdColumn: "deviceId",
-	loadLimit: BROKER_ROWS_LIMIT
-};
-function rtspTokensStore(store, logger) {
-	return new RowMapStore({
-		spec: BROKER_RTSP_TOKENS_SPEC,
-		store,
-		logger
-	});
-}
-/** One camera's profile → camStreamId assignment, plus whether it is automatic. */
+//#region src/stream-broker/broker-device-state.ts
+/**
+* The stream-broker's per-camera state, kept as per-device settings (D870).
+*
+* Three maps used to be collections of their own (`stream-broker:probe-snapshots`,
+* `:profile-map`, `:rtsp-tokens`), each keyed by the camera. A camera's data in
+* a side table is a row somebody must remember to delete when the camera goes;
+* as a KEY of the camera's own settings it is cleared by the central device
+* delete (D865) with everything else.
+*
+* | key              | value for one camera                                      |
+* | ---------------- | --------------------------------------------------------- |
+* | `probeSnapshots` | `{ [camStreamId]: ProbedSnapshot }` - what the broker last probed |
+* | `brokerProfile`  | `{ map, auto }` - the profile -> camStreamId assignment   |
+* | `rtspTokens`     | JSON text of `{ [camStreamId]: token }` - a SECRET: declared in `secretStatePaths`, so the settings view stores a keychain marker and the text lives in the keychain |
+*
+* Failure direction: a load that cannot ask the store THROWS (D49). The writers
+* built on {@link DeviceKeyMirror} refuse to write until a load has succeeded,
+* because a replace driven by an empty "known" set would otherwise drop or
+* shrink rows it never saw.
+*/
+/** Per-device settings keys. */
+var PROBE_SNAPSHOTS_KEY = "probeSnapshots";
+var BROKER_PROFILE_KEY = "brokerProfile";
+var RTSP_TOKENS_KEY = "rtspTokens";
+/** One camera's profile -> camStreamId assignment, plus whether it is automatic. */
 var ProfileAssignmentSchema = object({
 	map: record(string(), string()),
 	auto: boolean()
 });
+var ProbeSnapshotsOfDeviceSchema = record(string(), ProbedSnapshotSchema);
+var RtspTokensOfDeviceSchema = record(string(), string().min(1));
 /**
-* @durable class=config owner=stream-broker
-*   write="one row per camera, replaced wholesale from the manager's assignment map on
-*     every profile mutation — the map is authoritative and its boot pass PRUNES cameras
-*     the device registry no longer knows, which is why the write is a replace and not
-*     an upsert"
-*   retention="the replace is the retention: a camera dropped from the manager's map loses
-*     its row. Losing a row costs one automatic re-assignment on the next catalog pull."
-*/
-var BROKER_PROFILE_MAP_COLLECTION = "stream-broker:profile-map";
-var BROKER_PROFILE_MAP_SPEC = {
-	collection: BROKER_PROFILE_MAP_COLLECTION,
-	schema: ProfileAssignmentSchema,
-	columns: [{
-		name: "deviceId",
-		type: "INTEGER",
-		notNull: true
-	}, {
-		name: "auto",
-		type: "BOOLEAN",
-		notNull: true
-	}],
-	project: (key, value) => ({
-		deviceId: Number(key),
-		auto: value.auto
-	}),
-	deviceIdColumn: "deviceId",
-	loadLimit: BROKER_ROWS_LIMIT
+* A broker id is `<deviceId>/<camStreamId>`. Returns `null` rather than
+* guessing: a key whose head is not a number is a key this addon did not
+* write, and inventing a device for it would put a value on a camera at random.
+*/
+function splitBrokerId(brokerId) {
+	const slash = brokerId.indexOf("/");
+	if (slash <= 0) return null;
+	const deviceId = Number(brokerId.slice(0, slash));
+	if (!Number.isInteger(deviceId) || deviceId <= 0) return null;
+	return {
+		deviceId,
+		camStreamId: brokerId.slice(slash + 1)
+	};
+}
+/** Group `<deviceId>/<camStreamId>` -> value into deviceId -> camStreamId -> value. */
+function groupByDevice(flat) {
+	const entries = flat instanceof Map ? [...flat.entries()] : Object.entries(flat);
+	const out = /* @__PURE__ */ new Map();
+	for (const [brokerId, value] of entries) {
+		const parts = splitBrokerId(brokerId);
+		if (parts === null) continue;
+		const group = out.get(parts.deviceId) ?? {};
+		group[parts.camStreamId] = value;
+		out.set(parts.deviceId, group);
+	}
+	return out;
+}
+/** The inverse of {@link groupByDevice}. */
+function flattenByDevice(grouped) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [deviceId, group] of grouped) for (const [camStreamId, value] of Object.entries(group)) out.set(`${deviceId}/${camStreamId}`, value);
+	return out;
+}
+/** A stored value that exists but cannot be read now (see `DeviceKeyMirrorDeps.decode`). */
+var HELD_UNAVAILABLE = Symbol("held-unavailable");
+/**
+* One settings key across the fleet: loaded once, then written by diff.
+*
+* `replace` is authoritative (a camera the caller no longer holds loses the
+* key, but only if this mirror has SEEN it - it never deletes what it did not
+* load); `merge` only ever adds and changes.
+*/
+var DeviceKeyMirror = class {
+	deps;
+	/** The JSON of what the store holds per device, as of the last load or write. */
+	held = /* @__PURE__ */ new Map();
+	values = /* @__PURE__ */ new Map();
+	blocked = /* @__PURE__ */ new Map();
+	/** Cameras whose stored value is GONE: a load never re-blocks them. */
+	released = /* @__PURE__ */ new Set();
+	loaded = false;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** Read the key of every camera that has it. THROWS when the store cannot be asked. */
+	async load() {
+		const ids = await this.deps.settings.listDeviceStoreIds();
+		const blobs = await this.deps.settings.readDeviceStoreBatch(ids);
+		const out = /* @__PURE__ */ new Map();
+		this.held.clear();
+		this.values.clear();
+		this.loaded = false;
+		this.blocked.clear();
+		for (const [deviceId, blob] of blobs) {
+			const stored = blob[this.deps.key];
+			if (stored === void 0) continue;
+			const value = this.deps.decode(stored);
+			if (value === HELD_UNAVAILABLE) {
+				if (!this.released.has(deviceId)) this.blocked.set(deviceId, stored);
+				continue;
+			}
+			if (value === null) {
+				this.deps.logger.warn("broker device state skipped - it does not parse", {
+					tags: { deviceId },
+					meta: { key: this.deps.key }
+				});
+				continue;
+			}
+			out.set(deviceId, value);
+			this.values.set(deviceId, value);
+			this.held.set(deviceId, JSON.stringify(this.deps.encode(value)));
+		}
+		this.loaded = true;
+		return out;
+	}
+	/** Cameras whose stored value exists but could not be read: never written, never replaced. */
+	heldDevices() {
+		return this.blocked;
+	}
+	/**
+	* Stop protecting a camera whose stored value is GONE (the secret was deleted
+	* or the keychain restored without it): there is nothing left to overwrite.
+	*/
+	release(deviceId) {
+		this.blocked.delete(deviceId);
+		this.released.add(deviceId);
+	}
+	/** Is this camera's token write (and restream URL) blocked right now? */
+	isBlocked(deviceId) {
+		return this.blocked.has(deviceId);
+	}
+	assertLoaded() {
+		if (!this.loaded) throw new Error(`broker device state "${this.deps.key}" was never loaded - refusing to write`);
+	}
+	async writeChanged(next) {
+		let written = 0;
+		for (const [deviceId, value] of next) {
+			if (this.blocked.has(deviceId)) continue;
+			const encoded = this.deps.encode(value);
+			const text = JSON.stringify(encoded);
+			if (this.held.get(deviceId) === text) continue;
+			await this.deps.settings.writeDeviceStore(deviceId, { [this.deps.key]: encoded });
+			this.held.set(deviceId, text);
+			this.values.set(deviceId, value);
+			written += 1;
+		}
+		return written;
+	}
+	/** Make the store hold exactly `next` for the cameras this mirror knows. */
+	async replace(next) {
+		this.assertLoaded();
+		const written = await this.writeChanged(next);
+		let removed = 0;
+		for (const deviceId of [...this.held.keys()]) {
+			if (next.has(deviceId) || this.blocked.has(deviceId)) continue;
+			await this.deps.settings.writeDeviceStore(deviceId, { [this.deps.key]: void 0 });
+			this.held.delete(deviceId);
+			this.values.delete(deviceId);
+			removed += 1;
+		}
+		return {
+			written,
+			removed
+		};
+	}
+	/** Add or change; never remove. */
+	async merge(next) {
+		this.assertLoaded();
+		return this.writeChanged(next);
+	}
+	/** Drop one camera's key (a device that changed hardware under its number). */
+	async remove(deviceId) {
+		this.assertLoaded();
+		if (!this.held.has(deviceId) || this.blocked.has(deviceId)) return false;
+		await this.deps.settings.writeDeviceStore(deviceId, { [this.deps.key]: void 0 });
+		this.held.delete(deviceId);
+		this.values.delete(deviceId);
+		return true;
+	}
+	/** What the store holds for the camera as of the last load or write. */
+	current(deviceId) {
+		return this.values.get(deviceId);
+	}
+	/** Whether a load has answered; a writer that was never loaded refuses. */
+	get isLoaded() {
+		return this.loaded;
+	}
 };
-function profileMapStore(store, logger) {
-	return new RowMapStore({
-		spec: BROKER_PROFILE_MAP_SPEC,
-		store,
-		logger
+function parseWith(schema) {
+	return (stored) => {
+		const parsed = schema.safeParse(stored);
+		return parsed.success ? parsed.data : null;
+	};
+}
+function probeSnapshotsMirror(settings, logger) {
+	return new DeviceKeyMirror({
+		settings,
+		key: PROBE_SNAPSHOTS_KEY,
+		logger,
+		decode: parseWith(ProbeSnapshotsOfDeviceSchema),
+		encode: (value) => value
+	});
+}
+function profileMapMirror(settings, logger) {
+	return new DeviceKeyMirror({
+		settings,
+		key: BROKER_PROFILE_KEY,
+		logger,
+		decode: parseWith(ProfileAssignmentSchema),
+		encode: (value) => value
+	});
+}
+/** The tokens of one camera are ONE keychain-held text: JSON of `{ camStreamId: token }`. */
+function rtspTokensMirror(settings, logger) {
+	return new DeviceKeyMirror({
+		settings,
+		key: RTSP_TOKENS_KEY,
+		logger,
+		decode: (stored) => {
+			if (isSecretMarker(stored)) return HELD_UNAVAILABLE;
+			if (typeof stored !== "string") return null;
+			try {
+				const parsed = RtspTokensOfDeviceSchema.safeParse(JSON.parse(stored));
+				return parsed.success ? parsed.data : null;
+			} catch {
+				return null;
+			}
+		},
+		encode: (value) => JSON.stringify(value)
 	});
 }
 /**
-* The dead `addon-settings` / `root` keys. A CLAIM that each key is dead,
-* enforced by nothing else — the migration script names the same three, keep
-* the two in lockstep.
+* Fold freshly minted tokens (`<deviceId>/<camStreamId>` -> token) into what
+* each camera already holds. Only ever adds or changes: a token is stable
+* forever per stream unless explicitly regenerated.
 */
-var STREAM_BROKER_RETIRED_ROOT_KEYS = [
-	{
-		key: "probeSnapshots",
-		successor: BROKER_PROBE_SNAPSHOTS_COLLECTION,
-		reason: "one row per broker since the flatten; as a blob it was 17 KB of the 33 KB root row, rewritten whole by the throttled metrics flush"
-	},
-	{
-		key: "rtspTokens",
-		successor: BROKER_RTSP_TOKENS_COLLECTION,
-		reason: "one row per broker since the flatten; as a blob a single minted token rewrote 33 KB"
-	},
-	{
-		key: "profileMap",
-		successor: BROKER_PROFILE_MAP_COLLECTION,
-		reason: "one row per camera since the flatten; a per-DEVICE map, so as a blob it grew with the fleet — 2.3 KB at 29 cameras, ~77 KB at 974"
-	}
-];
+function mergeRtspTokens(mirror, minted) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [deviceId, group] of groupByDevice(minted)) out.set(deviceId, {
+		...mirror.current(deviceId),
+		...group
+	});
+	return out;
+}
 //#endregion
 //#region src/stream-broker/live-viewers.ts
 /**
@@ -5528,6 +5573,18 @@ var RtspListenServer = class RtspListenServer {
 	brokerTokens = /* @__PURE__ */ new Map();
 	/** token → brokerId (reverse map) */
 	tokenBrokers = /* @__PURE__ */ new Map();
+	/**
+	* brokerId → INTERNAL loopback-only alias token (D870). A camera whose
+	* external restream token is held in an unreadable keychain has NO external
+	* URL, but the broker's own consumers (recording, decode, snapshots, grid,
+	* egress) still ride its restream: they get this ephemeral token, which is
+	* never persisted, never handed out through the consumer URL APIs, and only
+	* answers loopback / local-network peers.
+	*/
+	internalAliases = /* @__PURE__ */ new Map();
+	internalAliasTokens = /* @__PURE__ */ new Set();
+	/** Which peers may dial an internal alias; replaceable for tests. */
+	aliasPeerPolicy = isClusterLocalAddress;
 	/** brokerId → enabled (default true) */
 	brokerEnabled = /* @__PURE__ */ new Map();
 	/** brokerId → warm-up closure registered alongside the restreamer */
@@ -5558,7 +5615,37 @@ var RtspListenServer = class RtspListenServer {
 		if (sentryOpener) this.brokerPrestreamOpeners.set(brokerId, sentryOpener);
 		return token;
 	}
+	/**
+	* Register (or refresh) the internal loopback-only alias of a broker. Returns
+	* its token. The external token map is untouched, so the alias can never be
+	* listed, persisted or surfaced as a consumer URL.
+	*/
+	registerInternalAlias(brokerId, restreamer, warmUp, sentryOpener) {
+		const token = this.internalAliases.get(brokerId) ?? RtspListenServer.generateToken();
+		this.restreamers.set(token, restreamer);
+		this.tokenBrokers.set(token, brokerId);
+		this.internalAliases.set(brokerId, token);
+		this.internalAliasTokens.add(token);
+		if (warmUp) this.brokerWarmUps.set(brokerId, warmUp);
+		if (sentryOpener) this.brokerPrestreamOpeners.set(brokerId, sentryOpener);
+		return token;
+	}
+	/** Replace the peer policy of the internal aliases (tests only). */
+	setAliasPeerPolicy(policy) {
+		this.aliasPeerPolicy = policy;
+	}
+	/** The token an IN-PROCESS consumer dials: the internal alias when there is one, else the external token. */
+	getInternalToken(brokerId) {
+		return this.internalAliases.get(brokerId) ?? this.brokerTokens.get(brokerId);
+	}
 	unregisterRestreamer(brokerId) {
+		const alias = this.internalAliases.get(brokerId);
+		if (alias !== void 0) {
+			this.restreamers.delete(alias);
+			this.tokenBrokers.delete(alias);
+			this.internalAliasTokens.delete(alias);
+			this.internalAliases.delete(brokerId);
+		}
 		const token = this.brokerTokens.get(brokerId);
 		if (token) {
 			this.restreamers.delete(token);
@@ -5580,6 +5667,17 @@ var RtspListenServer = class RtspListenServer {
 		this.restreamers.set(newToken, restreamer);
 		this.brokerTokens.set(brokerId, newToken);
 		this.tokenBrokers.set(newToken, brokerId);
+		const alias = this.internalAliases.get(brokerId);
+		if (alias !== void 0) {
+			this.restreamers.delete(alias);
+			this.tokenBrokers.delete(alias);
+			this.internalAliasTokens.delete(alias);
+			const newAlias = RtspListenServer.generateToken();
+			this.restreamers.set(newAlias, restreamer);
+			this.tokenBrokers.set(newAlias, brokerId);
+			this.internalAliases.set(brokerId, newAlias);
+			this.internalAliasTokens.add(newAlias);
+		}
 		return newToken;
 	}
 	/** Get the current token for a broker. */
@@ -5663,6 +5761,11 @@ var RtspListenServer = class RtspListenServer {
 			socket.destroy();
 			return;
 		}
+		if (this.internalAliasTokens.has(lookupPath) && !this.aliasPeerPolicy(socket.remoteAddress)) {
+			socket.write(`RTSP/1.0 403 Forbidden\r\nCSeq: 1\r\n\r\n`);
+			socket.destroy();
+			return;
+		}
 		const brokerId = this.tokenBrokers.get(lookupPath);
 		if (brokerId && !this.isEnabled(brokerId)) {
 			socket.write(`RTSP/1.0 403 Forbidden\r\nCSeq: 1\r\n\r\n`);
@@ -5721,6 +5824,24 @@ var RtspListenServer = class RtspListenServer {
 		});
 	}
 };
+/**
+* Is the peer on the loopback interface or the local network (RFC 1918, link-local,
+* ULA)? The internal alias answers only these: a recorder or decoder on another
+* node of the cluster is a legitimate consumer, the public internet is not.
+*/
+function isClusterLocalAddress(address) {
+	if (address === void 0) return false;
+	const v4 = address.startsWith("::ffff:") ? address.slice(7) : address;
+	if (v4 === "::1") return true;
+	const m = /^(\d+)\.(\d+)\.\d+\.\d+$/.exec(v4);
+	if (m !== null) {
+		const a = Number(m[1]);
+		const b = Number(m[2]);
+		return a === 127 || a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254 || a === 100 && b >= 64 && b <= 127;
+	}
+	const lower = address.toLowerCase();
+	return lower.startsWith("fe80:") || lower.startsWith("fc") || lower.startsWith("fd");
+}
 //#endregion
 //#region src/stream-broker/rtsp/rtsp-restream-provider.ts
 /**
@@ -5802,6 +5923,24 @@ var RtspRestreamProviderImpl = class {
 			enabled: this.server.isEnabled(brokerId)
 		};
 	}
+	/**
+	* The entry an IN-PROCESS consumer dials (recording, decode, snapshots, grid,
+	* egress): the loopback-only internal alias when the camera's external token
+	* is held back (D870), else the external entry. NEVER hand this out through a
+	* consumer URL API - use {@link getEntry} for that.
+	*/
+	getInternalEntry(brokerId, hostname) {
+		const token = this.server.getInternalToken(brokerId);
+		if (!token) return null;
+		const port = this.server.getPort();
+		const host = hostname ?? "127.0.0.1";
+		return {
+			brokerId,
+			url: `rtsp://${host}:${port}/${token}`,
+			mutedUrl: `rtsp://${host}:${port}/${token}/muted`,
+			enabled: this.server.isEnabled(brokerId)
+		};
+	}
 	regenerateToken(brokerId) {
 		const token = this.server.regenerateToken(brokerId);
 		if (token) {
@@ -17535,6 +17674,14 @@ var StreamBrokerManager = class StreamBrokerManager {
 	rtspProvider;
 	persistedTokens = /* @__PURE__ */ new Map();
 	/**
+	* True for a camera whose restream tokens are held in an unreadable keychain
+	* (D870). Such a camera gets NO restream URL - minting a temporary token would
+	* hand consumers a URL that dies as soon as the real one is restored - while
+	* every other camera, and the camera's own streams and recording, are
+	* untouched.
+	*/
+	restreamGate = () => false;
+	/**
 	* Last runtime probe per broker, captured while the broker was streaming.
 	* Survives the stream going idle so the per-stream "Probed" settings field
 	* stays populated (with an "as of" tag). In-memory only — repopulates on the
@@ -17734,7 +17881,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 			hwaccel: this.hwaccel ?? void 0,
 			cameraStreamLookup: (deviceId) => this.getCameraStreamsForDevice(deviceId),
 			rtspEntryLookup: (brokerId) => {
-				const entry = this.rtspProvider.getEntry(brokerId);
+				const entry = this.rtspProvider.getInternalEntry(brokerId);
 				return entry ? {
 					url: entry.url,
 					mutedUrl: entry.mutedUrl
@@ -17793,7 +17940,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 				cameraStreamLookup: (deviceId) => this.getCameraStreamsForDevice(deviceId),
 				resolveProfileSource: (deviceId, profile) => this.assignments.get(deviceId)?.map[profile] ?? null,
 				rtspEntryLookup: (brokerId) => {
-					const entry = this.rtspProvider.getEntry(brokerId);
+					const entry = this.rtspProvider.getInternalEntry(brokerId);
 					return entry ? { url: entry.url } : null;
 				},
 				sourceHasMedia: (brokerId) => {
@@ -18857,6 +19004,20 @@ var StreamBrokerManager = class StreamBrokerManager {
 	loadPersistedTokens(tokens) {
 		this.persistedTokens = new Map(tokens);
 	}
+	/** See {@link restreamGate}. */
+	setRestreamGate(gate) {
+		this.restreamGate = gate;
+	}
+	/**
+	* Register the restream URLs of ONE camera now (its tokens became readable, or
+	* were issued fresh): each of its source brokers and the profile restreamers
+	* over them. No broker is torn down or recreated, so nothing stops recording.
+	*/
+	registerRestreamersForDevice(deviceId) {
+		if (this.restreamGate(deviceId)) return;
+		for (const [brokerId, broker] of this.brokers) if (brokerId.startsWith(`${deviceId}/`)) this.registerSourceRestreamer(brokerId, broker);
+		this.syncProfileRestreamers(deviceId);
+	}
 	/** Upsert a single SOURCE (non-derived) cam-stream into the registry
 	*  WITHOUT ranking or broker creation. Returns the prior entry (if any)
 	*  so callers can detect url refresh / already-existed. */
@@ -19600,6 +19761,20 @@ var StreamBrokerManager = class StreamBrokerManager {
 		return { success: true };
 	}
 	/**
+	* Drop a DELETED camera's whole override entry and persist (D870). The
+	* device-removal hook's one reach into the override map; `forgetDeviceHardware`
+	* keeps the entry's non-hardware fields, a deleted camera keeps nothing.
+	*/
+	dropDeviceOverride(deviceId) {
+		if (!this.deviceOverrides.delete(deviceId)) return false;
+		this.deviceOverridePersister?.(this.deviceOverrides);
+		return true;
+	}
+	/** Cameras that have an override entry. */
+	listDeviceOverrideIds() {
+		return [...this.deviceOverrides.keys()];
+	}
+	/**
 	* The hardware behind `deviceId` was replaced (`deviceManager.migrateDevice`)
 	* — forget everything this broker knows that described the OLD box. See the
 	* cap doc for the inventory. What deliberately SURVIVES is the role-scoped
@@ -20378,6 +20553,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 			const sourceBrokerId = brokerIdFor(deviceId, camStreamId);
 			const sourceBroker = this.brokers.get(sourceBrokerId);
 			if (!sourceBroker) continue;
+			if (this.restreamGate(deviceId)) continue;
 			const existingToken = this.persistedTokens.get(profileBrokerId);
 			const warmUp = () => sourceBroker.onEncodedData(() => {}, RTSP_DESCRIBE_WARMUP_ATTRIBUTION);
 			const openPrestreamWindow = () => sourceBroker.openPrestreamWindow();
@@ -22037,11 +22213,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 		}
 		this.brokers.set(brokerId, broker);
 		this.applyClipRetention(deviceId);
-		const existingToken = this.persistedTokens.get(brokerId);
-		const warmUp = () => broker.onEncodedData(() => {}, RTSP_DESCRIBE_WARMUP_ATTRIBUTION);
-		const openPrestreamWindow = () => broker.openPrestreamWindow();
-		this.rtspServer.registerRestreamer(brokerId, broker.getRtspRestreamer(), warmUp, existingToken, openPrestreamWindow);
-		if (!existingToken) this.rtspProvider.persistTokens();
+		this.registerSourceRestreamer(brokerId, broker);
 		await this.fanOutRegistration(deviceId, brokerId, cam, broker);
 		this.syncProfileRestreamers(deviceId);
 		if (cam.kind === "derived") {
@@ -22050,6 +22222,28 @@ var StreamBrokerManager = class StreamBrokerManager {
 		}
 	}
 	/**
+	* Register one source broker's RTSP restreamer with its persisted token (or a
+	* freshly minted one). A camera whose tokens are held in an unreadable keychain
+	* gets no EXTERNAL token, only the internal loopback-only alias.
+	*/
+	registerSourceRestreamer(brokerId, broker) {
+		const deviceId = parseBrokerId(brokerId)?.deviceId;
+		if (deviceId === void 0) return;
+		if (this.restreamGate(deviceId)) {
+			this.logger.warn("external restream URL withheld - the tokens are held but unreadable", {
+				tags: { deviceId },
+				meta: { brokerId }
+			});
+			this.rtspServer.registerInternalAlias(brokerId, broker.getRtspRestreamer(), () => broker.onEncodedData(() => {}, RTSP_DESCRIBE_WARMUP_ATTRIBUTION), () => broker.openPrestreamWindow());
+			return;
+		}
+		const existingToken = this.persistedTokens.get(brokerId);
+		const warmUp = () => broker.onEncodedData(() => {}, RTSP_DESCRIBE_WARMUP_ATTRIBUTION);
+		const openPrestreamWindow = () => broker.openPrestreamWindow();
+		this.rtspServer.registerRestreamer(brokerId, broker.getRtspRestreamer(), warmUp, existingToken, openPrestreamWindow);
+		if (!existingToken) this.rtspProvider.persistTokens();
+	}
+	/**
 	* Tear down the broker for a `(deviceId, camStreamId)` pair. No-op
 	* when no broker exists. Called by `retractCameraStream` and by the
 	* teardown half of `restartBroker`.
@@ -22169,7 +22363,7 @@ var StreamBrokerManager = class StreamBrokerManager {
 			};
 		} else {
 			const sourceBrokerId = brokerIdFor(deviceId, request.camStreamId);
-			const entry = this.rtspProvider.getEntry(sourceBrokerId, "127.0.0.1");
+			const entry = this.rtspProvider.getInternalEntry(sourceBrokerId, "127.0.0.1");
 			if (!entry) throw new Error(`derived source camStream loopback unavailable: ${sourceBrokerId}`);
 			loopbackUrl = entry.url;
 			release = async () => {};
@@ -38304,18 +38498,177 @@ function subscribeDeviceRemoval(subscribe, deps) {
 	});
 }
 //#endregion
+//#region src/stream-broker/device-removal-hook.ts
+/**
+* The stream-broker's `device-removal-hook` (D870).
+*
+* What the broker keeps PER CAMERA is a key of the camera's own settings
+* (`probeSnapshots`, `brokerProfile`, `rtspTokens` - see `broker-device-state.ts`),
+* and the central device delete (D865) clears those for every addon. What is
+* left is the broker's live state and its one addon-level map keyed by camera,
+* `deviceOverrides`: the hook retracts the camera's streams, purges its slot
+* assignments and drops its override entry. Idempotent - a camera with nothing
+* left answers zero counts.
+*/
+function createBrokerRemovalHook(deps) {
+	return {
+		onDeviceRemoved: async (input) => {
+			const { deviceId } = input;
+			try {
+				await deps.retractDevice(deviceId);
+			} catch (err) {
+				deps.logger.warn("stream-broker: retract of a deleted device failed", {
+					tags: { deviceId },
+					meta: { error: errMsg(err) }
+				});
+				throw err;
+			}
+			const overrides = deps.dropDeviceOverride(deviceId) ? 1 : 0;
+			if (overrides > 0) deps.logger.info("stream-broker: removed the override of a deleted device", {
+				tags: { deviceId },
+				meta: { deletedAt: input.deletedAt }
+			});
+			return { counts: { "device-overrides": overrides } };
+		},
+		listDeviceData: async () => deps.overrideDeviceIds().filter((deviceId) => Number.isInteger(deviceId) && deviceId > 0).map((deviceId) => ({
+			store: "device-overrides",
+			deviceId,
+			count: 1
+		}))
+	};
+}
+/** Classify every held camera against the keychain: wait for it, or give up on the value. */
+async function classifyHeld(held, secrets) {
+	const refs = /* @__PURE__ */ new Map();
+	for (const [deviceId, stored] of held) if (isSecretMarker(stored)) refs.set(deviceId, stored.$secret);
+	if (refs.size === 0) return [];
+	const resolved = await secrets.resolve([...refs.values()]);
+	const out = [];
+	for (const [deviceId, ref] of refs) {
+		const entry = resolved[ref];
+		if (entry === void 0 || entry.kind === "unavailable") out.push({
+			deviceId,
+			ref,
+			kind: "unavailable",
+			reason: entry?.kind === "unavailable" ? entry.reason : null
+		});
+		else if (entry.kind === "missing") out.push({
+			deviceId,
+			ref,
+			kind: "missing",
+			reason: null
+		});
+		else if (entry.kind === "forbidden") out.push({
+			deviceId,
+			ref,
+			kind: "unavailable",
+			reason: "forbidden"
+		});
+	}
+	return out;
+}
+var UNAVAILABLE_TEXT = "The camera's RTSP restream URLs are unavailable (consumers such as Home Assistant or an NVR get errors) until the keychain is readable. Its streams and recording are not affected.";
+var issuedText = (deviceId) => `New RTSP restream URLs were issued for camera ${deviceId} - update the consumers (NVR, Home Assistant). The previous tokens were lost: the keychain no longer holds them.`;
+var TokenRecovery = class {
+	deps;
+	/** Cameras alerted as unavailable: the alert is cleared when the value resolves. */
+	waiting = /* @__PURE__ */ new Set();
+	/** Consecutive `missing` reads per camera (D49: two before the value is given up). */
+	missingReads = /* @__PURE__ */ new Map();
+	timer = null;
+	running = false;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** Cameras currently blocked. */
+	blocked() {
+		return [...this.deps.mirror.heldDevices().keys()].toSorted((a, b) => a - b);
+	}
+	/** Check now, then on a timer while any camera is still held. */
+	start() {
+		if (this.timer !== null) return;
+		this.tick();
+		this.timer = setInterval(() => void this.tick(), this.deps.recheckMs ?? 3e4);
+		this.timer.unref?.();
+	}
+	stop() {
+		if (this.timer !== null) clearInterval(this.timer);
+		this.timer = null;
+	}
+	/** One scheduled / change-triggered check; never overlaps itself, never throws. */
+	async tick() {
+		if (this.running) return;
+		this.running = true;
+		try {
+			await this.check();
+		} catch (err) {
+			this.deps.logger.warn("restream-token re-check failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		} finally {
+			this.running = false;
+		}
+		if (this.blocked().length === 0 && this.waiting.size === 0) this.stop();
+	}
+	/** See the module doc. Idempotent. */
+	async check() {
+		const before = new Set(this.deps.mirror.heldDevices().keys());
+		if (before.size === 0 && this.waiting.size === 0) return;
+		const tokens = await this.deps.mirror.load();
+		const now = new Set(this.deps.mirror.heldDevices().keys());
+		const classified = await classifyHeld(this.deps.mirror.heldDevices(), this.deps.secrets);
+		const released = [];
+		for (const camera of classified) {
+			if (camera.kind === "missing") {
+				const reads = (this.missingReads.get(camera.deviceId) ?? 0) + 1;
+				this.missingReads.set(camera.deviceId, reads);
+				if (reads < 2) continue;
+				this.deps.mirror.release(camera.deviceId);
+				this.missingReads.delete(camera.deviceId);
+				if (this.waiting.delete(camera.deviceId)) await this.deps.alerts.clear(camera.deviceId);
+				released.push(camera.deviceId);
+				continue;
+			}
+			this.missingReads.delete(camera.deviceId);
+			if (this.waiting.has(camera.deviceId)) continue;
+			this.waiting.add(camera.deviceId);
+			this.deps.logger.error("restream tokens held but not readable", {
+				tags: { deviceId: camera.deviceId },
+				meta: {
+					reason: camera.reason,
+					ref: camera.ref
+				}
+			});
+			await this.deps.alerts.raise({
+				deviceId: camera.deviceId,
+				kind: "unavailable",
+				message: UNAVAILABLE_TEXT
+			});
+		}
+		const recovered = [...before].filter((id) => !now.has(id) && !released.includes(id));
+		for (const deviceId of recovered) if (this.waiting.delete(deviceId)) await this.deps.alerts.clear(deviceId);
+		if (recovered.length > 0) this.deps.logger.info("restream tokens readable again", { meta: { cameras: recovered.length } });
+		const cameras = [...recovered, ...released];
+		if (cameras.length > 0) await this.deps.onRegister(tokens, cameras);
+		for (const deviceId of released) {
+			this.deps.logger.error("restream tokens lost - new URLs issued", { tags: { deviceId } });
+			await this.deps.alerts.raise({
+				deviceId,
+				kind: "missing",
+				message: issuedText(deviceId)
+			});
+		}
+	}
+};
+//#endregion
 //#region src/stream-broker/addon.ts
 /**
-* Hydrate the persisted RTSP restream state. Tokens come from their own
-* collection (one row per broker); `rtspEnabled` is still a key of the settings
-* row. An unparseable token row is skipped by the store — one dead token, not
-* every token — and an empty set keeps first-boot silence (no loader call, no
-* log).
+* Hydrate the persisted RTSP restream state. Tokens come from the cameras' own
+* settings; `rtspEnabled` is still a key of the settings row. An unreadable
+* token set THROWS (the caller refuses to write tokens afterwards - a
+* replacement minted over a token that was merely unreadable would turn every
+* external NVR URL into a 404), and an empty set keeps first-boot silence.
 */
 async function hydratePersistedRtspState(deps) {
-	const rows = await deps.tokensStore.readAll();
-	const tokens = /* @__PURE__ */ new Map();
-	for (const [brokerId, row] of rows) tokens.set(brokerId, row.token);
+	const tokens = flattenByDevice(await deps.tokensMirror.load());
 	if (tokens.size > 0) {
 		deps.loadTokens(tokens);
 		deps.logger.info("Loaded persisted RTSP tokens", { meta: { tokenCount: tokens.size } });
@@ -38384,6 +38737,8 @@ var PROBE_SNAPSHOTS_PERSIST_INTERVAL_MS = 6e4;
 * the sample as absent (the RTCP Receiver-Report path drives the ladder anyway). */
 var NETWORK_QUALITY_STATS_TIMEOUT_MS = 2e3;
 var StreamBrokerAddon = class extends BaseAddon {
+	/** The restream tokens of a camera are a per-device setting held in the keychain (D870). */
+	secretStatePaths = ["rtspTokens"];
 	brokerManager = null;
 	/** The node's pinned ffmpeg, mirrored here so the recorded-playback demuxers
 	*  (segment-demux/segment-audio) spawn the same binary as the transcode
@@ -38440,6 +38795,7 @@ var StreamBrokerAddon = class extends BaseAddon {
 	*  restarts). Loaded on activate, flushed throttled from the metrics loop and
 	*  once on shutdown. */
 	probeSnapshots = null;
+	removalHook = null;
 	lastProbePersistAt = 0;
 	constructor() {
 		super({
@@ -38502,24 +38858,26 @@ var StreamBrokerAddon = class extends BaseAddon {
 			logger: this.ctx.logger
 		});
 		await this.ffmpegWiring.load();
-		await this.declareRowCollections();
-		await this.purgeFlattenedSettingsKeys();
+		const deviceSettings = this.deviceSettings();
 		const rtspProvider = this.brokerManager.getRtspRestreamProvider();
 		const brokerManager = this.brokerManager;
-		const rtspTokens = rtspTokensStore(this.ctx.api.settingsStore, this.ctx.logger);
+		const rtspTokens = rtspTokensMirror(deviceSettings, this.ctx.logger);
 		const rtspEnabledState = this.state("rtspEnabled", RtspEnabledSchema, {});
 		try {
 			await hydratePersistedRtspState({
-				tokensStore: rtspTokens,
+				tokensMirror: rtspTokens,
 				enabledState: rtspEnabledState,
 				loadTokens: (tokens) => brokerManager.loadPersistedTokens(tokens),
 				loadEnabled: (states) => rtspProvider.loadPersistedEnabled(states),
 				logger: this.ctx.logger
 			});
-		} catch {}
+		} catch (err) {
+			this.ctx.logger.warn("Failed to load persisted RTSP state - tokens will not be written", { meta: { error: errMsg(err) } });
+		}
+		this.startTokenRecovery(rtspTokens, brokerManager);
 		rtspProvider.setTokenPersister(async (tokens) => {
 			try {
-				for (const [brokerId, token] of tokens) await rtspTokens.write(brokerId, { token });
+				await rtspTokens.merge(mergeRtspTokens(rtspTokens, tokens));
 				this.ctx.logger.info("Persisted RTSP tokens", { meta: { current: tokens.size } });
 			} catch (err) {
 				this.ctx.logger.warn("Failed to persist RTSP tokens", { meta: { error: errMsg(err) } });
@@ -38552,24 +38910,22 @@ var StreamBrokerAddon = class extends BaseAddon {
 				this.ctx.logger.warn("Failed to persist device overrides", { meta: { error: errMsg(err) } });
 			});
 		});
-		const profileMap = profileMapStore(this.ctx.api.settingsStore, this.ctx.logger);
+		const profileMap = profileMapMirror(deviceSettings, this.ctx.logger);
 		const profileMapPersister = (assignments) => {
 			const next = /* @__PURE__ */ new Map();
-			for (const [deviceId, assignment] of assignments) next.set(`${deviceId}`, {
+			for (const [deviceId, assignment] of assignments) next.set(deviceId, {
 				map: { ...assignment.map },
 				auto: assignment.auto
 			});
-			profileMap.replaceAll(next).catch((err) => {
+			profileMap.replace(next).catch((err) => {
 				this.ctx.logger.warn("Failed to persist profile map", { meta: { error: errMsg(err) } });
 			});
 		};
 		this.brokerManager.setProfileMapPersister(profileMapPersister);
 		try {
-			const rows = await profileMap.readAll();
+			const rows = await profileMap.load();
 			const loaded = /* @__PURE__ */ new Map();
-			for (const [rawKey, val] of rows) {
-				const deviceId = Number(rawKey);
-				if (!Number.isInteger(deviceId)) continue;
+			for (const [deviceId, val] of rows) {
 				const map = {};
 				for (const profile of PROFILE_KEYS) {
 					const v = val.map[profile];
@@ -38585,18 +38941,18 @@ var StreamBrokerAddon = class extends BaseAddon {
 		} catch (err) {
 			this.ctx.logger.warn("Failed to load profile map", { meta: { error: errMsg(err) } });
 		}
-		const probeSnapshots = probeSnapshotsStore(this.ctx.api.settingsStore, this.ctx.logger);
+		const probeSnapshots = probeSnapshotsMirror(deviceSettings, this.ctx.logger);
 		this.probeSnapshots = probeSnapshots;
 		try {
-			const rows = await probeSnapshots.readAll();
-			const blob = Object.fromEntries(rows);
+			const rows = await probeSnapshots.load();
+			const blob = Object.fromEntries(flattenByDevice(rows));
 			this.brokerManager.loadProbeSnapshots(blob);
-			this.ctx.logger.info("Loaded persisted probe snapshots", { meta: { streamCount: rows.size } });
+			this.ctx.logger.info("Loaded persisted probe snapshots", { meta: { streamCount: Object.keys(blob).length } });
 		} catch (err) {
 			this.ctx.logger.warn("Failed to load probe snapshots", { meta: { error: errMsg(err) } });
 		}
 		this.brokerManager.setDeviceHardwareForgetHook(async (deviceId) => {
-			const rtspTokenRowsDeleted = await rtspTokens.deleteWhere({ where: { deviceId } });
+			const rtspTokenRowsDeleted = await rtspTokens.remove(deviceId) ? 1 : 0;
 			this.flushProbeSnapshots(Date.now(), true);
 			return { rtspTokenRowsDeleted };
 		});
@@ -38854,6 +39210,14 @@ var StreamBrokerAddon = class extends BaseAddon {
 		} catch (err) {
 			this.ctx.logger.warn("stream-broker: client-log ingest failed to serve", { meta: { error: errMsg(err) } });
 		}
+		this.removalHook = createBrokerRemovalHook({
+			logger: this.ctx.logger,
+			retractDevice: async (deviceId) => {
+				await retractRemovedDevice(deviceId, this.deviceRemovalDeps());
+			},
+			dropDeviceOverride: (deviceId) => brokerManager.dropDeviceOverride(deviceId),
+			overrideDeviceIds: () => brokerManager.listDeviceOverrideIds()
+		});
 		return [
 			{
 				capability: streamBrokerCapability,
@@ -38872,9 +39236,90 @@ var StreamBrokerAddon = class extends BaseAddon {
 				provider: widgetsProvider
 			},
 			logChannelsRegistration,
-			loadContributionRegistration
+			loadContributionRegistration,
+			{
+				capability: deviceRemovalHookCapability,
+				provider: this.removalHook
+			}
 		];
 	}
+	/**
+	* Watch the cameras whose restream tokens are held but unreadable (D870): no
+	* restream URL is registered for them (the manager's gate), an alert says so,
+	* and when a value resolves ONLY that camera's restreamers are registered with
+	* the stored tokens - no teardown. A lost secret is released after two
+	* consistent reads and gets new, persisted tokens.
+	*/
+	startTokenRecovery(mirror, brokerManager) {
+		const secrets = this.ctx.secrets;
+		if (secrets === void 0) {
+			if (mirror.heldDevices().size > 0) this.ctx.logger.error("restream tokens look held but this addon has no keychain access", { meta: { cameras: mirror.heldDevices().size } });
+			return;
+		}
+		brokerManager.setRestreamGate((deviceId) => mirror.isBlocked(deviceId));
+		if (mirror.heldDevices().size === 0) return;
+		const alertId = (deviceId) => `stream-broker-tokens:${deviceId}`;
+		const warn = (what) => (err) => this.ctx.logger.warn(what, { meta: { error: errMsg(err) } });
+		const recovery = new TokenRecovery({
+			mirror,
+			secrets,
+			logger: this.ctx.logger,
+			alerts: {
+				raise: async ({ deviceId, kind, message }) => {
+					const now = Date.now();
+					await this.ctx.api.alerts.emit.mutate({
+						id: alertId(deviceId),
+						category: "streams",
+						severity: "warning",
+						title: kind === "missing" ? "New RTSP restream URLs issued" : "RTSP restream URLs unavailable",
+						message,
+						status: "active",
+						read: false,
+						createdAt: now,
+						updatedAt: now,
+						source: {
+							type: "device",
+							id: String(deviceId)
+						},
+						metadata: {
+							deviceId,
+							kind
+						}
+					}).catch(warn("could not raise the restream-token alert"));
+				},
+				clear: async (deviceId) => {
+					await this.ctx.api.alerts.update.mutate({
+						alertId: alertId(deviceId),
+						patch: {
+							status: "completed",
+							updatedAt: Date.now()
+						}
+					}).catch(warn("could not clear the restream-token alert"));
+				}
+			},
+			onRegister: async (tokens, cameras) => {
+				brokerManager.loadPersistedTokens(flattenByDevice(tokens));
+				for (const deviceId of cameras) brokerManager.registerRestreamersForDevice(deviceId);
+			}
+		});
+		recovery.start();
+		const unsubscribe = secrets.onChange((ref) => {
+			if (ref.startsWith("secret://stream-broker/device/")) recovery.tick();
+		});
+		this.ctx.addDisposer(() => {
+			recovery.stop();
+			unsubscribe();
+		});
+	}
+	async onHubReachable() {
+		const removalHook = this.removalHook;
+		if (removalHook === null) return;
+		this.ctx.addDisposer(armRemovalReconcile({
+			api: this.ctx.api,
+			logger: this.ctx.logger,
+			remove: (input) => removalHook.onDeviceRemoved(input)
+		}));
+	}
 	async onShutdown() {
 		this.logChannels?.stop();
 		this.logChannels = null;
@@ -38975,41 +39420,14 @@ var StreamBrokerAddon = class extends BaseAddon {
 		this.flushProbeSnapshots(timestamp, false);
 	}
 	/**
-	* Declare the three row collections that replaced the `probeSnapshots`,
-	* `rtspTokens` and `profileMap` blob keys. Idempotent — a re-declaration of
-	* the same shape is a no-op in the engine.
-	*
-	* Not swallowed: a broker whose `stream-broker:rtsp-tokens` is undeclared
-	* mints a new token for every stream and every external NVR URL in the
-	* installation goes dead. Crashing loudly is bounded by `CrashSupervisor`
-	* (D6); silently reissuing tokens is not.
-	*/
-	async declareRowCollections() {
-		const store = this.ctx.api.settingsStore;
-		const logger = this.ctx.logger;
-		await probeSnapshotsStore(store, logger).declare();
-		await rtspTokensStore(store, logger).declare();
-		await profileMapStore(store, logger).declare();
-	}
-	/**
-	* Drop the flattened keys from `stream-broker:addon-settings` / `root`, each
-	* gated on its own successor collection being non-empty. `rtspEnabled` and
-	* `deviceOverrides` stay — see `broker-row-stores.ts` for why.
-	*
-	* Best-effort: a purge that throws must not take the broker down. The keys
-	* are dead weight, not a fault.
+	* The per-device settings, as the broker persists through them. Resolved
+	* reads/writes (keychain markers never reach this code), and a context with
+	* no settings is a broker that cannot start.
 	*/
-	async purgeFlattenedSettingsKeys() {
-		try {
-			await retireRootKeys({
-				store: this.ctx.api.settingsStore,
-				addonId: STREAM_BROKER_ADDON_ID,
-				logger: this.ctx.logger,
-				specs: STREAM_BROKER_RETIRED_ROOT_KEYS
-			});
-		} catch (err) {
-			this.ctx.logger.warn("stream-broker: retiring the flattened settings keys failed", { meta: { error: errMsg(err) } });
-		}
+	deviceSettings() {
+		const settings = this.ctx.settings;
+		if (settings === void 0) throw new Error("stream-broker: device settings are not available");
+		return settings;
 	}
 	/**
 	* Persist the manager's probe map to the durable handle. Throttled to
@@ -39022,7 +39440,7 @@ var StreamBrokerAddon = class extends BaseAddon {
 		if (!store || !manager) return;
 		if (!force && now - this.lastProbePersistAt < PROBE_SNAPSHOTS_PERSIST_INTERVAL_MS) return;
 		this.lastProbePersistAt = now;
-		store.replaceAll(new Map(Object.entries(manager.getProbeSnapshots()))).catch((err) => {
+		store.replace(groupByDevice(manager.getProbeSnapshots())).catch((err) => {
 			this.ctx.logger.warn("Failed to persist probe snapshots", { meta: { error: errMsg(err) } });
 		});
 	}