@camstack/addon-pipeline 1.2.43 → 1.2.44

package/dist/{dist-B-VVBzrL.mjs → dist-DOu93i_g.mjs}

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 //#region ../types/dist/event-category-41fKf-q9.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
@@ -6589,9 +6590,38 @@ var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
 /**
 * Build the tRPC request options that pin a single capability call to `nodeId`.
 * Pass as the second argument to `.query(input, …)` / `.mutate(input, …)`.
+*
+* ## The id is normalised here, and it has to be
+*
+* A forked addon reads its own node from `ctx.kernel.localNodeId`, and inside a
+* worker that value is a RUNNER id — `hub/export-hap`, not `hub`. Routing
+* compares a pin against real node ids, so such a pin matches nothing and the
+* call fails with `no provider registered for cap "…"`. The local-first
+* resolver already guarded against this (`localNodeId.split('/')[0]`), which
+* made the hazard invisible: unpinned calls worked, and only an explicit pin —
+* the thing you reach for when you specifically need THIS node — silently
+* addressed a node that does not exist.
+*
+* Cost of it being missing: `addon-export-hap` pinned `decoder.getInfo` to its
+* own node to read the host's hardware-decode backend. It never once answered,
+* so every HomeKit egress transcode decoded in SOFTWARE — including 4K H.265 —
+* while D67's whole premise was that the decoder addon is the authority on
+* hardware. The warn said `decoding in SOFTWARE` and read as "this node has no
+* hardware", which was false.
+*
+* Normalising in the ONE constructor fixes every caller at once, which is why
+* it is here and not at the call sites.
 */
 function nodePin(nodeId) {
-	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: nodeId } };
+	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: toNodeId(nodeId) } };
+}
+/**
+* A runner id is `<nodeId>/<addonId>`; a node id has no slash. Taking the head
+* is idempotent, so passing an already-clean id costs nothing.
+*/
+function toNodeId(idOrRunnerId) {
+	const head = idOrRunnerId.split("/")[0];
+	return head === void 0 || head.length === 0 ? idOrRunnerId : head;
 }
 /**
 * Output schema shared by the contribution + live methods.
@@ -7090,6 +7120,39 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 }
 //#endregion
+//#region ../types/dist/canonical-hash-7nfBbEqR.mjs
+/**
+* Deterministic SHA-256 hash of an arbitrary serialisable value. The
+* canonical form sorts object keys alphabetically at every depth so two
+* structurally-equal inputs with different key insertion orders produce
+* the same hash. Returns a 64-char lowercase hex digest.
+*
+* Used by export adapters (Alexa, HAP) to short-circuit re-discovery /
+* accessory-rebuild work when the upstream shape is byte-identical to
+* the last applied state — preventing user-visible "re-discovery"
+* notifications on every addon-runner respawn. Each respawn re-fires
+* `DeviceBindingsChanged` for every cap registration, which without
+* this guard would propagate redundant pushes.
+*
+* Note: this is a SYMPTOMATIC fix layered on top of the binding-change
+* subscription. The proper fix is a single "device ready" lifecycle
+* barrier so exports react only when the full cap set has landed —
+* tracked separately for post-HA-integration work.
+*/
+function canonicalHash(value) {
+	const canonical = JSON.stringify(value, replaceWithSortedKeys);
+	return createHash("sha256").update(canonical ?? "").digest("hex");
+}
+function replaceWithSortedKeys(_key, value) {
+	if (value && typeof value === "object" && !Array.isArray(value)) {
+		const obj = value;
+		const out = {};
+		for (const k of Object.keys(obj).toSorted()) out[k] = obj[k];
+		return out;
+	}
+	return value;
+}
+//#endregion
 //#region ../types/dist/err-msg-IQTHeDzc.mjs
 /**
 import { errMsg } from '@camstack/types'
@@ -7224,6 +7287,8 @@ function buildInputArgs(input, decodeHwAccel) {
 	const args = [];
 	if (!isSoftwareDecode(decodeHwAccel)) args.push("-hwaccel", String(decodeHwAccel));
 	if (input.extraArgs?.length) args.push(...input.extraArgs);
+	if (input.analyzeDurationUs !== void 0) args.push("-analyzeduration", String(input.analyzeDurationUs));
+	if (input.probeSizeBytes !== void 0) args.push("-probesize", String(input.probeSizeBytes));
 	if (input.fflags?.length) for (const flag of input.fflags) args.push("-fflags", flag);
 	if (input.rtspTransport) args.push("-rtsp_transport", input.rtspTransport);
 	args.push("-i", input.url);
@@ -7272,6 +7337,7 @@ function buildVideoArgs(video, outputArgs) {
 	if (video.pixelFormat !== void 0) args.push("-pix_fmt", video.pixelFormat);
 	if (video.fps !== void 0) args.push("-r", String(video.fps));
 	if (video.gopFrames !== void 0) args.push("-g", String(video.gopFrames));
+	if (video.forceKeyFramesSeconds !== void 0) args.push("-force_key_frames", `expr:gte(t,n_forced*${video.forceKeyFramesSeconds})`);
 	if (video.bf !== void 0) args.push("-bf", String(video.bf));
 	args.push(...buildRateControlArgs(video));
 	if (video.bitstreamFilter !== void 0) args.push("-bsf:v", video.bitstreamFilter);
@@ -7307,6 +7373,56 @@ function isElementaryVideoSink(sink) {
 	return sink.kind === "stdout" && (sink.container === "h264" || sink.container === "hevc");
 }
 /**
+* The fragmented-MP4 muxer flags, in the order the recorder has proven them
+* (`recorder/addon/ffmpeg-args.ts` passes the same `movflags` string through
+* `-segment_format_options`, across every vendor in the fleet):
+*
+* - `frag_keyframe` — cut a fragment at each key frame, so every fragment
+*   opens on a sync sample. HKSV's whole requirement.
+* - `empty_moov` — write `ftyp`+`moov` up front with no samples in it, which
+*   is what makes the head a standalone INITIALISATION segment.
+* - `default_base_moof` — fragment offsets are self-relative, so a fragment is
+*   demuxable without the bytes that preceded it. D31's byte-range read path
+*   depends on exactly this property of the recorder's segments.
+*/
+var FMP4_MOVFLAGS = "+frag_keyframe+empty_moov+default_base_moof";
+/**
+* The terminal sink args for every non-`rtp-outputs` sink. Exhaustive over the
+* union so a new member cannot fall through to `['-f', container, 'pipe:1']`,
+* which is what a plain `container` read would have done for `mp4` — a valid
+* argv that writes a NON-fragmented, unseekable-to-a-pipe MP4 and produces one
+* unusable byte stream.
+*/
+function buildStdoutOrRtspSinkArgs(sink) {
+	if (sink.kind === "rtsp-listen") return [
+		"-f",
+		"rtsp",
+		"-rtsp_transport",
+		"tcp",
+		"-rtsp_flags",
+		"listen",
+		sink.url
+	];
+	if (sink.kind === "rtp-outputs") return [];
+	return sink.container === "mp4" ? buildFmp4SinkArgs(sink) : [
+		"-f",
+		sink.container,
+		"pipe:1"
+	];
+}
+/** `-movflags … -min_frag_duration <us> -f mp4 pipe:1`. */
+function buildFmp4SinkArgs(sink) {
+	return [
+		"-movflags",
+		FMP4_MOVFLAGS,
+		"-min_frag_duration",
+		String(Math.max(0, Math.round(sink.fragmentMs * 1e3))),
+		"-f",
+		"mp4",
+		"pipe:1"
+	];
+}
+/**
 * A second output mapping source audio to RTP-over-UDP. `0:a:0?` makes the
 * audio optional so a source with no audio skips it instead of failing the
 * whole invocation.
@@ -7367,19 +7483,7 @@ function buildFfmpegArgs(inv) {
 		];
 	}
 	const audioArgs = isElementaryVideoSink(inv.sink) ? ["-an"] : buildAudioArgs(inv.audio);
-	const sinkArgs = inv.sink.kind === "stdout" ? [
-		"-f",
-		inv.sink.container,
-		"pipe:1"
-	] : [
-		"-f",
-		"rtsp",
-		"-rtsp_transport",
-		"tcp",
-		"-rtsp_flags",
-		"listen",
-		inv.sink.url
-	];
+	const sinkArgs = buildStdoutOrRtspSinkArgs(inv.sink);
 	return [
 		...head,
 		...buildVideoArgs(inv.video, inv.outputArgs),
@@ -7464,7 +7568,10 @@ function invocationFromEncodeProfile(input) {
 		height: v.height
 	} : null;
 	const target = v.codec === "h265" ? "h265" : "h264";
-	const video = shouldCopy ? { kind: "copy" } : {
+	const video = shouldCopy ? {
+		kind: "copy",
+		...input.bitstreamFilter !== void 0 ? { bitstreamFilter: input.bitstreamFilter } : {}
+	} : {
 		kind: "encode",
 		encoder: pickVideoEncoder(target, input.decodeHwAccel, input.hardwareEncoders === true),
 		scale,
@@ -7472,10 +7579,14 @@ function invocationFromEncodeProfile(input) {
 		...v.tune !== void 0 ? { tune: v.tune } : {},
 		...v.profile !== void 0 ? { profile: v.profile } : {},
 		...v.level !== void 0 ? { level: v.level } : {},
+		...input.pixelFormat !== void 0 ? { pixelFormat: input.pixelFormat } : {},
 		...v.fps !== void 0 ? { fps: v.fps } : {},
 		...v.gopFrames !== void 0 ? { gopFrames: v.gopFrames } : {},
+		...input.forceKeyFramesSeconds !== void 0 ? { forceKeyFramesSeconds: input.forceKeyFramesSeconds } : {},
 		...v.bf !== void 0 ? { bf: v.bf } : {},
-		...v.bitrateKbps !== void 0 ? { bitrateKbps: v.bitrateKbps } : {}
+		...v.bitrateKbps !== void 0 ? { bitrateKbps: v.bitrateKbps } : {},
+		...input.rateControl !== void 0 ? { rateControl: input.rateControl } : {},
+		...input.bitstreamFilter !== void 0 ? { bitstreamFilter: input.bitstreamFilter } : {}
 	};
 	return {
 		logLevel: input.logLevel ?? "error",
@@ -7517,6 +7628,159 @@ var BASE_LIVE_EGRESS_PROFILE = {
 };
 ({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
 ({ ...BASE_LIVE_EGRESS_PROFILE });
+/** VBV window for a consumer whose budget is enforced per second (HomeKit). */
+var RATE_CONTROL_TIGHT = {
+	kind: "cbr",
+	vbvSeconds: 1
+};
+/** VBV window for a consumer that tolerates a keyframe spike (browser, Echo). */
+var RATE_CONTROL_RELAXED = {
+	kind: "cap",
+	vbvSeconds: 2
+};
+function createHwAccelCache(options) {
+	const now = options.now ?? (() => Date.now());
+	let value = null;
+	let writtenAt = Number.NEGATIVE_INFINITY;
+	return {
+		read() {
+			return now() - writtenAt < options.ttlMs ? value : void 0;
+		},
+		write(next) {
+			value = next;
+			writtenAt = now();
+		}
+	};
+}
+/** `true` when a value means "decode in software". */
+function meansSoftware(value) {
+	return !value || value === "none" || value === "copy";
+}
+/**
+* Resolve the `-hwaccel` value for an egress transcode. Hardware is the
+* DEFAULT — an egress that decodes in software on a hub with working vaapi is
+* paying for nothing — and every software outcome is announced.
+*
+* Returns a concrete backend name, the literal `'auto'`, or `null` for
+* software decode (⇒ {@link buildFfmpegArgs} emits no `-hwaccel` at all).
+*/
+async function resolveEgressDecodeHwAccel(deps) {
+	const override = deps.override;
+	if (override !== void 0 && override !== null && override !== "") return meansSoftware(override) ? null : override;
+	const cached = deps.cache?.read();
+	if (cached !== void 0) return cached;
+	let backend;
+	try {
+		backend = await deps.readDecoderBackend();
+	} catch (err) {
+		const kernelPreferred = await deps.readKernelPreferred().catch(() => []);
+		deps.onFallback({
+			reason: "decoder-unreadable",
+			kernelPreferred,
+			error: err instanceof Error ? err.message : String(err)
+		});
+		deps.cache?.write(null);
+		return null;
+	}
+	if (backend === "") {
+		const kernelPreferred = await deps.readKernelPreferred().catch(() => []);
+		deps.onFallback({
+			reason: "decoder-unprobed",
+			kernelPreferred
+		});
+		deps.cache?.write(null);
+		return null;
+	}
+	const resolved = meansSoftware(backend) ? null : backend;
+	deps.cache?.write(resolved);
+	return resolved;
+}
+/**
+* The sharing key for `streamBroker.acquireEgressTranscode`.
+*
+* **Two requesters asking for exactly the same argument set reach the same
+* process.** Exact match, never fuzzy: a quantised ladder that merged
+* NEARLY-identical requests would make the stream a consumer receives depend
+* on who else is watching and in what order they arrived — unpredictable in
+* precisely the way a debugging session cannot tolerate. Same arguments ⇒ same
+* process. Different arguments ⇒ different process, and that is fine; the
+* operator accepted the cost ("it's fine to have several processes").
+*
+* Derived from the STRUCTURED plan, not from a flag array. `pipelineKeyFor`
+* (`transcode-pipeline.ts`) folds `getStreamWithCodec`'s raw `outputArgs` into
+* its key, so that method's extensibility hatch and its sharing key are the
+* same field — a consumer needing one extra flag silently forks the child, and
+* two consumers that want the same thing but spell it differently never share.
+* Here every knob is a named field, and defaults are APPLIED before hashing so
+* an omitted field and its explicit default land on the same key.
+*/
+/**
+* The transport a CAP request describes. `fragments` is deliberately
+* unreachable from here — the request schema has no way to ask for it, so the
+* cap path can never be handed a fragment child by accident.
+*/
+function egressTransportFromRequest(request) {
+	return { transport: request.publishLocally === true ? "push" : "dial" };
+}
+/** Absent optional ⇒ this sentinel, so `undefined` and "not set" agree. */
+var UNSET = "\0unset";
+function canonicalVideo(video) {
+	return {
+		codec: video.codec,
+		profile: video.profile ?? UNSET,
+		level: video.level ?? UNSET,
+		width: video.width ?? -1,
+		height: video.height ?? -1,
+		fps: video.fps ?? -1,
+		bitrateKbps: video.bitrateKbps ?? -1,
+		gopFrames: video.gopFrames ?? -1,
+		bf: video.bf ?? -1,
+		preset: video.preset ?? UNSET,
+		tune: video.tune ?? UNSET
+	};
+}
+function canonicalAudio(audio) {
+	if (audio === "passthrough") return { codec: "passthrough" };
+	return {
+		codec: audio.codec,
+		bitrateKbps: audio.bitrateKbps ?? -1,
+		sampleRateHz: audio.sampleRateHz ?? -1,
+		channels: audio.channels ?? -1
+	};
+}
+/**
+* The normalised plan a key is computed from. Exported so a test — and a
+* future operator-facing "why are these two not sharing?" surface — can diff
+* two requests without reversing a hash.
+*/
+function canonicalEgressPlan(request, delivery = egressTransportFromRequest(request)) {
+	return {
+		deviceId: request.deviceId,
+		source: request.source.kind === "profile" ? `profile:${request.source.profile}` : `cam-stream:${request.source.camStreamId}`,
+		transport: delivery.transport,
+		fragmentMs: delivery.fragmentMs ?? -1,
+		video: canonicalVideo(request.encode.video),
+		audio: canonicalAudio(request.encode.audio),
+		rateControl: request.rateControl ?? "relaxed",
+		bitstreamFilter: request.bitstreamFilter ?? UNSET,
+		pixelFormat: request.pixelFormat ?? UNSET,
+		decodeHwAccel: request.decodeHwAccel ?? UNSET
+	};
+}
+/**
+* The refcount / dedup key. `canonicalHash` sorts object keys at every depth,
+* so a request built with a different field order produces the same digest.
+*
+* The handle this keys is IMMUTABLE: there is no `reconfigure`. A consumer
+* whose requirements change RELEASES and re-acquires; the refcount does the
+* rest. That is what stops co-tenants disturbing each other — the co-tenant
+* hazard that made Alexa's shared `derived:alexa-<id>` stream a hazard was
+* exactly a mutable shared object, where one consumer's downgrade dragged
+* every other consumer to 360p.
+*/
+function egressTranscodeSharingKey(request, delivery = egressTransportFromRequest(request)) {
+	return `egress:${canonicalHash(canonicalEgressPlan(request, delivery))}`;
+}
 /**
 * Deep wiring healthcheck — snapshot of active reachability probes across
 * every declared capability + widget of every installed plugin, on every
@@ -7573,7 +7837,7 @@ object({
 * ## This file adds no state
 *
 * Every switch here is a VIEW onto an authority that already existed
-* ([D61](../../../../docs/decisions/adr-0062.md)). The whole point of the
+* ([D62](../../../../docs/decisions/adr-0062.md)). The whole point of the
 * group is that there is exactly one place each function is turned off, and
 * the group routes to it:
 *
@@ -7584,6 +7848,40 @@ object({
 * | `audio-analysis` | `deviceManager.setWrapperActive('audio-analysis')` | `AudioSubscriptionController.subscribeAudioStream` returns `null` before opening the stream |
 * | `recording` | `recording.setDeviceConfig` → `RecordingConfig.enabled` | `band-decision.shouldRecord` returns false; the controller detaches the device |
 * | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
+* | `privacy-mask` | `privacyMask.setMask({ enabled })` → the CAMERA | the camera blanks the masked regions itself; every stream and recording carries the black boxes |
+* | `device-audio` | `privacyMask.setAudioEnabled` → the CAMERA | the camera stops encoding an audio track at all; every consumer sees silent video |
+*
+* ## The two switches whose authority is not on this server
+*
+* `privacy-mask` and `device-audio` write the CAMERA. That is not a loophole
+* in "the group stores nothing" — it is the purest form of it: the camera
+* holds the fact, every read is a read-through, and there is no server-side
+* copy that could drift. Their availability therefore cannot come from
+* `listBindableCapsForDeviceType` (a device-NATIVE cap carries no wrappers and
+* is filtered out there); it comes from the cap's own camera-probed
+* `privacyMask.getOptions()`, which is strictly more honest — it answers for
+* THIS camera rather than for the device type
+* ([D74](../../../../docs/decisions/adr-0074.md)).
+*
+* ## `privacy-mask` is the one row whose ON is not "the function is working"
+*
+* Every other switch means *this camera's function is doing its job*, so
+* `enabled: false` is a thing an operator took away. `privacy-mask` means **the
+* MASK is active** — `enabled: true` is video deliberately obscured. The
+* polarity is not a choice made here: `addon-export-hap`'s privacy `Switch`
+* (`builders/privacy-switch.ts`) already mirrors `patch.enabled` verbatim, and
+* a HomeKit toggle that disagreed with the app's toggle for the same camera is
+* worse than either surface not having one.
+*
+* Two consequences follow and both are load-bearing:
+*
+* - **It never counts as `switchedOff`.** `countsAsSwitchedOff` is `false` for
+*   exactly this row. With the polarity above, every camera that has NOT drawn
+*   a privacy mask would otherwise report `switchedOff: ['privacy-mask']` — the
+*   normal, healthy state of most cameras rendered as an operator disablement.
+* - **Its cost line names BOTH directions.** `costWhenOff` is rendered
+*   unconditionally by both clients, so for this row it has to read correctly
+*   whichever way the switch is sitting.
 *
 * The wrapper-binding pair is not a new idea: `legacy-migrations.ts` already
 * migrated the legacy `audioEnabled` / `pipelineEnabled` /
@@ -7602,14 +7900,17 @@ object({
 *   `CameraStatus.switchedOff`.
 */
 /**
-* The five functions the operator named (2026-08-05). Deliberately NOT one id
-* per pipeline step: face recognition and plate/LPR are per-step toggles on
+* The functions the operator named — five on 2026-08-05, plus the camera's own
+* microphone on 2026-08-07. Deliberately NOT one id per pipeline step: face
+* recognition and plate/LPR are per-step toggles on
 * `pipelineOrchestrator.setCameraStepToggle` and belong in the pipeline
-* editor, not in a five-button safety group.
+* editor, not in a safety group.
 */
 var CameraSwitchIdSchema = _enum([
 	"stream-broker",
 	"object-detection",
+	"privacy-mask",
+	"device-audio",
 	"audio-analysis",
 	"recording",
 	"notifications"
@@ -7627,14 +7928,26 @@ var CameraSwitchAuthoritySchema = discriminatedUnion("kind", [
 		capName: string()
 	}),
 	object({ kind: literal("recording-config") }),
-	object({ kind: literal("notification-mute") })
+	object({ kind: literal("notification-mute") }),
+	object({
+		kind: literal("camera-audio"),
+		capName: string()
+	}),
+	object({
+		kind: literal("camera-mask"),
+		capName: string()
+	})
 ]);
 /**
 * Why a switch is not offered for this camera. Rendered instead of the
 * control, never as a dead control — an absent function and a broken one must
 * not look the same.
 */
-var CameraSwitchUnavailableReasonSchema = _enum(["no-provider", "source-unreachable"]);
+var CameraSwitchUnavailableReasonSchema = _enum([
+	"no-provider",
+	"source-unreachable",
+	"not-configured"
+]);
 /**
 * One switch, resolved for one camera.
 *
@@ -9728,6 +10041,26 @@ var EgressTranscodeRequestSchema = object({
 		"h264_mp4toannexb",
 		"hevc_mp4toannexb"
 	]).optional(),
+	/**
+	* Publish the transcode as a LOCAL push cam stream, instead of leaving the
+	* consumer to dial the returned url. The broker picks the id and returns it
+	* as `camStreamId` — a caller-supplied one would be circular, since the
+	* sharing key is computed FROM this request.
+	*
+	* The url is still returned and still the contract for a transcode pinned to
+	* another node. But dialling it locally costs an RTSP round trip that changes
+	* the transport underneath the consumer: a dialled stream is an RTP source,
+	* so `isRtpSource()` is true and the session takes the RTP-passthrough +
+	* repacketizer branch. The push branch — the one the derived mechanism has
+	* live hours on — is never reached. Measured on Alexa: broker registered, RTP
+	* arriving, key frame arriving, black screen, on a chain healthy at every
+	* other point.
+	*
+	* Same idea the transport already applies to CALLS, where `classifyCapRoute`
+	* gives priority to `hub-in-process` so a local call never leaves the node.
+	* This is that rule for media.
+	*/
+	publishLocally: boolean().optional(),
 	pixelFormat: _enum(["yuv420p", "nv12"]).optional(),
 	/**
 	* Operator/consumer override for decode hardware. ABSENT is the normal case
@@ -9772,7 +10105,13 @@ var EgressTranscodeSchema = object({
 	* Returned rather than assumed: a consumer that asked for hardware and got
 	* software needs to be able to see that without reading the broker's logs.
 	*/
-	decodeHwAccel: string().nullable()
+	decodeHwAccel: string().nullable(),
+	/**
+	* Set when `publishLocally` was honoured: attach to THIS instead of dialling
+	* `url`, and the session takes the push/deframe transport rather than the
+	* RTP-passthrough one. `null` means the consumer must dial.
+	*/
+	camStreamId: string().nullable()
 });
 var streamBrokerCapability = {
 	name: "stream-broker",
@@ -18467,9 +18806,15 @@ DeviceType.Camera, method(object({
 	* Bypass the cache freshness check and fetch directly from the
 	* native (or stream-broker fallback). Triggered by the UI's
 	* "refresh" button so an operator can force a fresh frame
-	* even when the cache is well within `snapshotMaxAgeMs`.
-	* On battery cams this WILL wake the camera — accept the
-	* cost only when the user explicitly asks for it.
+	* even when the cache is well within the device's
+	* `snapshotMaxAgeS` window.
+	*
+	* **`force` is an OPERATOR signal, not a freshness preference.** On a
+	* battery camera it is the one thing that walks past the wrapper's
+	* sleep gate and wakes the camera, so a background caller — a poller,
+	* an event handler, a thumbnail — must NEVER set it. Every such caller
+	* gets the cached frame, which on a sleeping battery camera is the
+	* correct answer: stale but honest beats woken.
 	*/
 	force: boolean().optional()
 }), SnapshotImageSchema.nullable()), method(object({ deviceId: number() }), _void(), {
@@ -22846,12 +23191,30 @@ object({
 });
 DeviceType.Sensor;
 /**
-* Privacy mask = up to `maxRegions` SHAPES the camera blanks out (NOT a
-* cell grid). Reolink `<shelterList>` zones are rectangles; Hikvision
-* ISAPI `<RegionCoordinatesList>` zones are free polygons (this camera:
-* exactly 4 vertices, not necessarily axis-aligned). The cap composes the
-* shared rect|polygon subset of the MaskShape vocabulary. All coords are
-* normalized 0..1 (top-left origin).
+* PRIVACY — what the camera deliberately does not capture. Two planes:
+*
+*  - **video**: up to `maxRegions` SHAPES the camera blanks out (NOT a cell
+*    grid). Reolink `<shelterList>` zones are rectangles; Hikvision ISAPI
+*    `<RegionCoordinatesList>` zones are free polygons (this camera: exactly
+*    4 vertices, not necessarily axis-aligned). The cap composes the shared
+*    rect|polygon subset of the MaskShape vocabulary. All coords are
+*    normalized 0..1 (top-left origin).
+*  - **audio**: the camera's microphone. `setAudioEnabled(false)` stops the
+*    camera encoding an audio track at all, so EVERY consumer — live view,
+*    recording, the audio analyzer, an export — sees silent video. There is
+*    no server-side copy of this fact; the camera is the store and every read
+*    is a read-through, which is why a switch over it cannot drift
+*    ([D62](../../../../docs/decisions/adr-0062.md)).
+*
+* Both belong here for one reason: they are the two things an operator turns
+* off when the answer to "what is this camera allowed to record" changes, and
+* both are applied ON the device, before anything leaves it.
+*
+* **The audio flag has exactly one writer.** `stream-params` used to carry a
+* per-profile `audio` in its patch schema — reachable from no UI and honoured
+* by one provider — and it was removed when this landed. A second writer onto
+* one device register is the shape of every knob this repo has shipped that
+* disagreed with the one the reader read.
 */
 /** A privacy-mask region's geometry — rectangle or free polygon. */
 var PrivacyMaskShapeSchema = discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
@@ -22867,16 +23230,40 @@ object({
 	enabled: boolean(),
 	/** Active zones (normalized 0..1). Length ≤ maxRegions. */
 	regions: array(PrivacyMaskRegionSchema),
+	/**
+	* Is the camera capturing sound right now? Read from the camera, never from
+	* a server-side mirror.
+	*
+	* `null` means "no answer" — either this camera exposes no controllable
+	* microphone (`getOptions().supportsAudioMute === false`) or the read
+	* failed. A consumer must render `null` as UNKNOWN and never as `false`:
+	* "the microphone is off" and "we could not ask" look identical to an
+	* operator only until one of them is wrong.
+	*
+	* On a camera whose profiles carry the flag independently (Reolink writes
+	* it per stream), `true` means AT LEAST ONE profile still carries audio —
+	* privacy is only satisfied when every one of them is silent.
+	*/
+	audioEnabled: boolean().nullable(),
 	lastFetchedAt: number()
 });
-/** Per-camera availability. */
+/** Per-camera availability. Probed, never assumed from the model name. */
 var PrivacyMaskOptionsSchema = object({
 	/** Maximum number of supported zones. */
 	maxRegions: number(),
 	/** Shape kinds this camera accepts — Reolink: ['rect']; Hikvision: ['rect','polygon']. */
 	supportedShapes: array(MaskShapeKindSchema),
 	/** Polygon vertex bounds when 'polygon' is supported (Hikvision: {min:4,max:4}). */
-	polygonVertices: MaskPolygonVerticesSchema.optional()
+	polygonVertices: MaskPolygonVerticesSchema.optional(),
+	/**
+	* Does this camera expose a microphone switch we can actually write?
+	*
+	* Camera-probed: `true` only when the firmware answered with an audio flag
+	* we know how to patch. A camera that never answered is `false` — a control
+	* the operator can press that changes nothing is worse than no control, and
+	* the switch group renders "not available" instead.
+	*/
+	supportsAudioMute: boolean()
 });
 /** Partial change — every field optional. */
 var PrivacyMaskPatchSchema = object({
@@ -22889,6 +23276,12 @@ DeviceType.Camera, method(object({ deviceId: number() }), PrivacyMaskOptionsSche
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	enabled: boolean()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
 });
 var PtzPresetSchema = object({
 	id: string(),
@@ -23098,6 +23491,21 @@ var LocateSegmentResultSchema = discriminatedUnion("kind", [object({
 })]);
 /** Raw bytes of one finalized footage segment (read off disk on the recording node). */
 var ReadSegmentBytesResultSchema = object({ data: _instanceof(Uint8Array) });
+/**
+* One GOP of a finalized segment, cut by byte range through the segment's own
+* `mfra` (D31 on the D42 feeder path). `data` is the `ftyp`+`moov` head plus
+* the single `moof`+`mdat` covering the requested instant — standalone-
+* demuxable, never the whole file. When the segment's index cannot be parsed
+* the provider degrades INSIDE the mechanism to the whole segment (still one
+* `data`, `gopStartMs` = the segment start) — a worse read, not another path.
+*/
+var ReadGopBytesResultSchema = object({
+	data: _instanceof(Uint8Array),
+	/** Absolute epoch ms of the returned fragment's first sample. */
+	gopStartMs: number(),
+	/** Media ms the returned fragment covers. */
+	gopDurMs: number()
+});
 var recordingCapability = {
 	name: "recording",
 	scope: "system",
@@ -23165,6 +23573,18 @@ var recordingCapability = {
 			kind: "query",
 			auth: "admin"
 		}),
+		/** Read the single GOP of segment `startMs` covering `epochMs`, by mfra
+		*  byte range — the scrub-granular read (D31 letter on the feeder path).
+		*  See {@link ReadGopBytesResultSchema} for the degradation contract. */
+		readGopBytes: method(object({
+			deviceId: number(),
+			profile: string(),
+			startMs: number(),
+			epochMs: number()
+		}), ReadGopBytesResultSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
 		setDeviceConfig: method(object({
 			deviceId: number(),
 			config: RecordingConfigSchema
@@ -23716,6 +24136,16 @@ var StreamProfileConfigSchema = object({
 		"baseline"
 	]).optional(),
 	gop: number().optional(),
+	/**
+	* Whether THIS profile currently carries an audio track. READ-ONLY here.
+	*
+	* There is no matching field on {@link StreamProfilePatchSchema}: the
+	* camera's microphone is owned by `privacy-mask` (`setAudioEnabled`), which
+	* writes every profile at once so "audio off" means silent everywhere. A
+	* per-profile writer beside it would let a camera be half-muted and would be
+	* a second knob onto one device register — the failure D62 exists to
+	* prevent. Absent when the firmware does not report the flag.
+	*/
 	audio: boolean().optional()
 });
 object({
@@ -23756,7 +24186,13 @@ var StreamParamsOptionsSchema = object({
 	ext: StreamProfileOptionsSchema.optional()
 });
 /** A partial change to one profile — every field optional; a provider
-*  ignores fields it doesn't support. */
+*  ignores fields it doesn't support.
+*
+*  There is deliberately NO `audio` here. It existed until 2026-08-07,
+*  reachable from no form and honoured by exactly one provider, while the
+*  camera's microphone is a whole-device fact. It now has one writer,
+*  `privacyMask.setAudioEnabled`, which writes every profile — see
+*  `privacy-mask.cap.ts`. */
 var StreamProfilePatchSchema = object({
 	width: number().optional(),
 	height: number().optional(),
@@ -23769,8 +24205,7 @@ var StreamProfilePatchSchema = object({
 		"main",
 		"baseline"
 	]).optional(),
-	gop: number().optional(),
-	audio: boolean().optional()
+	gop: number().optional()
 });
 DeviceType.Camera, method(object({ deviceId: number() }), StreamParamsOptionsSchema), method(object({
 	deviceId: number(),
@@ -28283,6 +28718,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"privacyMask.setAudioEnabled": {
+		capName: "privacy-mask",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"privacyMask.setMask": {
 		capName: "privacy-mask",
 		capScope: "device",
@@ -28451,6 +28892,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.readGopBytes": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.readSegmentBytes": {
 		capName: "recording",
 		capScope: "system",
@@ -30085,7 +30532,7 @@ function readDetailCropConvention(config) {
 		square: square.success ? square.data : DEFAULT_DETAIL_CROP_CONVENTION.square
 	};
 }
-function isHydratedField(entry) {
+function isHydratedField$1(entry) {
 	return typeof entry === "object" && entry !== null && "key" in entry;
 }
 /**
@@ -30100,7 +30547,7 @@ function pickDetailCropConvention(view) {
 	if (view === null) return DEFAULT_DETAIL_CROP_CONVENTION;
 	const flat = {};
 	for (const section of view.sections) for (const entry of section.fields) {
-		if (!isHydratedField(entry) || typeof entry.key !== "string") continue;
+		if (!isHydratedField$1(entry) || typeof entry.key !== "string") continue;
 		if (entry.key === "detailCropPaddingRatio" || entry.key === "detailCropSquare") flat[entry.key] = entry.value;
 	}
 	return readDetailCropConvention(flat);
@@ -30180,6 +30627,178 @@ function slideInsideFrame(rect, frameWidth, frameHeight) {
 		h
 	};
 }
+var NATIVE_LEASE_TTL_KEY = "nativeLeaseTtlMs";
+var NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
+var NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
+var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
+/**
+* WHICH delivered frames the decode worker retains a native copy of.
+*
+* - `all` — every frame the worker delivered to the runner. The shipped
+*   behaviour, and the only correct one if something can ask for a crop of a
+*   frame the runner never sent to inference.
+* - `inferred` — only the frames the runner ADMITTED to its detection queue.
+*   A native-crop request always names a `frameId` that rode an inference
+*   result, so that is the only set a request can name. How much it drops is
+*   the two-plane governor's admit ratio and nothing else: measured at ~50% on
+*   this cluster, not the ~80% the design sketch assumed, because the governor
+*   was not throttling as hard as the sketch supposed. Read
+*   `leaseAdmitted`/`leaseOffered` off the metrics line for the camera in front
+*   of you rather than quoting a number from here. The newest delivered frame is
+*   croppable regardless — it is still the worker's reserved slot, not a lease —
+*   which covers the one-frame race between a mark and the supersede that
+*   consumes it.
+*/
+var NativeLeaseAdmissionSchema = _enum(["all", "inferred"]);
+/**
+* Operator-tunable native-lease settings. Bounds are enforced HERE (not only in
+* the slider) because the value also travels to a forked child process, where a
+* junk number would silently become a 0-length or unbounded retention window.
+*/
+var NativeLeaseSettingsSchema = object({
+	/**
+	* How long a retained native frame is served before it counts as a miss.
+	*
+	* Must cover the FULL late-crop horizon: detection inference + the
+	* cross-process inference-result hop to hub post-analysis + tracking + the
+	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
+	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
+	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	*/
+	ttlMs: number().int().min(250).max(1e4),
+	/**
+	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
+	*
+	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
+	* which one is actually binding before reasoning from that. At the shipped
+	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
+	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
+	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
+	* change that admits fewer frames buys retention WINDOW at constant RAM
+	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* `0` DISABLES the lease entirely and falls the worker back to the tiny
+	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
+	* to replace).
+	*/
+	budgetMb: number().int().min(0).max(4096),
+	/**
+	* Demand window: eager per-frame native retention runs only within this many
+	* ms of the last native-crop request (or of the dial starting).
+	*
+	* `0` means ALWAYS ON — it disables the gate, it does not disable retention.
+	* That is the legacy behaviour that saturated an N100 (24 native-4K downloads
+	* per second on a camera with zero crop demand), so leave it non-zero unless
+	* you are reproducing that.
+	*/
+	activityMs: number().int().min(0).max(12e4),
+	/**
+	* Which delivered frames are retained at all — see
+	* {@link NativeLeaseAdmissionSchema}. This is the only knob of the four that
+	* changes WHAT is kept rather than for how long, so it is also the only one
+	* that can turn a crop that used to hit into a miss. The worker counts every
+	* crop request naming a frame it did NOT see marked
+	* (`leaseUnmarkedCrops` on the session-decode metrics line): a non-zero value
+	* there is the signal that some caller names frames outside the inference set
+	* and that this must go back to `all`.
+	*/
+	admission: NativeLeaseAdmissionSchema
+});
+/**
+* The values in force when the operator has set nothing — byte-for-byte the
+* constants the decode worker shipped with as env-var defaults, so making these
+* settings changed no behaviour on the day it landed.
+*/
+var DEFAULT_NATIVE_LEASE_SETTINGS = {
+	ttlMs: 1200,
+	budgetMb: 1024,
+	activityMs: 15e3,
+	admission: "inferred"
+};
+DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
+DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.admission;
+/**
+* Parse one knob, reporting `null` for absent, junk, out-of-bounds — AND for a
+* value equal to the shipped default.
+*
+* That last rule is not tidiness, it is the difference between the documented
+* precedence being true and being a lie. `addon-settings.getGlobalSettings`
+* returns a HYDRATED payload, and `hydrateField` fills an unstored field with
+* the schema's own `default` (verified live on the hub: a cluster that has never
+* opened the form still reports `nativeLeaseTtlMs = 1200`). A reader that took
+* that at face value would report all three knobs as "set" on every cluster on
+* the day this shipped, permanently retiring the `CAMSTACK_SESSION_NATIVE_LEASE_*`
+* emergency override that the precedence promises. There is no raw-store read on
+* this cap to distinguish the two, so the default value itself is treated as
+* "the operator has expressed no preference" — which is also what leaving a
+* slider untouched means.
+*
+* The cost is one honest edge: an operator who deliberately selects the default
+* value in order to overrule an env var does not get it. Clear the env var
+* instead; the worker's spawn line names the source, so this is visible rather
+* than mysterious.
+*/
+function readKnob(knob, raw) {
+	const parsed = NativeLeaseSettingsSchema.shape[knob].safeParse(raw);
+	if (!parsed.success) return null;
+	return parsed.data === DEFAULT_NATIVE_LEASE_SETTINGS[knob] ? null : parsed.data;
+}
+/** {@link readKnob} for the one non-numeric knob. Same default-means-unset rule. */
+function readAdmissionKnob(raw) {
+	const parsed = NativeLeaseAdmissionSchema.safeParse(raw);
+	if (!parsed.success) return null;
+	return parsed.data === DEFAULT_NATIVE_LEASE_SETTINGS.admission ? null : parsed.data;
+}
+/**
+* Narrow a FLAT settings record to the knobs the operator set.
+*
+* Per-FIELD parse, deliberately: a junk TTL must not also discard a valid
+* budget. An absent, out-of-bounds or default-valued knob is OMITTED (not
+* clamped, not defaulted) so the caller can still fall through to the env
+* override — clamping here would turn a typo into a value nobody chose. See
+* {@link readKnob} for why the default counts as unset.
+*/
+function readNativeLeaseOverride(config) {
+	const ttlMs = readKnob("ttlMs", config[NATIVE_LEASE_TTL_KEY]);
+	const budgetMb = readKnob("budgetMb", config[NATIVE_LEASE_BUDGET_KEY]);
+	const activityMs = readKnob("activityMs", config[NATIVE_LEASE_ACTIVITY_KEY]);
+	const admission = readAdmissionKnob(config[NATIVE_LEASE_ADMISSION_KEY]);
+	return {
+		...ttlMs === null ? {} : { ttlMs },
+		...budgetMb === null ? {} : { budgetMb },
+		...activityMs === null ? {} : { activityMs },
+		...admission === null ? {} : { admission }
+	};
+}
+function isHydratedField(entry) {
+	return typeof entry === "object" && entry !== null && "key" in entry;
+}
+var LEASE_KEYS = [
+	NATIVE_LEASE_TTL_KEY,
+	NATIVE_LEASE_BUDGET_KEY,
+	NATIVE_LEASE_ACTIVITY_KEY,
+	NATIVE_LEASE_ADMISSION_KEY
+];
+/**
+* Extract the operator's lease overrides from an
+* `addon-settings.getGlobalSettings` payload.
+*
+* Walks EVERY section rather than looking inside {@link NATIVE_LEASE_SECTION_ID}
+* alone: the keys are unique across the addon's schema, and a section rename
+* must not silently revert the whole cluster to the defaults. A `null` payload
+* (addon mid-boot) means "operator set nothing" — the env/default fallback then
+* applies, which is the correct read of "I could not ask".
+*/
+function pickNativeLeaseOverride(view) {
+	if (view === null) return {};
+	const flat = {};
+	for (const section of view.sections) for (const entry of section.fields) {
+		if (!isHydratedField(entry) || typeof entry.key !== "string") continue;
+		if (LEASE_KEYS.includes(entry.key)) flat[entry.key] = entry.value;
+	}
+	return readNativeLeaseOverride(flat);
+}
 var AUTO = {
 	value: "auto",
 	label: "Auto"
@@ -30397,4 +31016,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { isEvent as $, evaluateZoneRules as A, recordingExportCapability as B, customAction as C, deriveRecordingMode as D, deriveDetailCropRect as E, motionDetectionCapability as F, webrtcSessionCapability as G, storageEvictableCapability as H, pickDetailCropConvention as I, CAM_PROFILE_ORDER as J, errMsg as K, pipelineExecutorCapability as L, invocationFromEncodeProfile as M, mapAudioLabelToMacro as N, detectionPipelineCapability as O, maskUrlCredentials as P, hydrateSchema as Q, pipelineRunnerCapability as R, cameraStreamsCapability as S, defineCustomActions as T, streamBrokerCapability as U, runtimeDevices as V, supportedRuntimes as W, DeviceType as X, DeviceFeature as Y, createEvent as Z, YAMNET_TO_MACRO as _, union as _t, COCO_80_LABELS as a, selectAssignedProfileSlots as at, audioAnalyzerCapability as b, DEFAULT_DETAIL_CROP_CONVENTION as c, array as ct, EncodeProfileSchema as d, lazy as dt, makeProfileBrokerId as et, ExportRecordSchema as f, literal as ft, RingBuffer as g, string as gt, RecordingConfigSchema as h, record as ht, AUDIO_PRESETS as i, parseProfileBrokerId as it, hfModelUrl as j, enumerateInferenceDevices as k, DEVICE_BACKEND_TO_FORMAT as l, boolean as lt, OpsLogEntrySchema as m, object as mt, AUDIO_BACKEND_CHOICES as n, nodePin as nt, COCO_TO_MACRO as o, sleep as ot, HF_BASE_URL as p, number as pt, BaseAddon as q, AUDIO_MACRO_LABELS as r, parseJsonUnknown as rt, DEFAULT_AUDIO_ANALYZER_CONFIG as s, _enum as st, APPLE_SA_TO_MACRO as t, makeSourceBrokerId as tt, EVENT_PAD_MS as u, discriminatedUnion as ut, addonWidgetsSourceCapability as v, EventCategory as vt, defaultDeviceFor as w, buildFfmpegArgs as x, audioAnalysisCapability as y, recordingCapability as z };
+export { storageEvictableCapability as $, defaultDeviceFor as A, invocationFromEncodeProfile as B, addonWidgetsSourceCapability as C, literal as Ct, cameraStreamsCapability as D, string as Dt, buildFfmpegArgs as E, record as Et, egressTranscodeSharingKey as F, pickDetailCropConvention as G, mapAudioLabelToMacro as H, egressTransportFromRequest as I, pipelineRunnerCapability as J, pickNativeLeaseOverride as K, enumerateInferenceDevices as L, deriveDetailCropRect as M, deriveRecordingMode as N, createHwAccelCache as O, union as Ot, detectionPipelineCapability as P, runtimeDevices as Q, evaluateZoneRules as R, YAMNET_TO_MACRO as S, lazy as St, audioAnalyzerCapability as T, object as Tt, maskUrlCredentials as U, isSoftwareDecode as V, motionDetectionCapability as W, recordingExportCapability as X, recordingCapability as Y, resolveEgressDecodeHwAccel as Z, OpsLogEntrySchema as _, sleep as _t, COCO_80_LABELS as a, CAM_PROFILE_ORDER as at, RecordingConfigSchema as b, boolean as bt, DEFAULT_DETAIL_CROP_CONVENTION as c, createEvent as ct, EVENT_PAD_MS as d, makeProfileBrokerId as dt, streamBrokerCapability as et, EncodeProfileSchema as f, makeSourceBrokerId as ft, NativeLeaseSettingsSchema as g, selectAssignedProfileSlots as gt, NativeLeaseAdmissionSchema as h, parseProfileBrokerId as ht, AUDIO_PRESETS as i, BaseAddon as it, defineCustomActions as j, customAction as k, EventCategory as kt, DEFAULT_NATIVE_LEASE_SETTINGS as l, hydrateSchema as lt, HF_BASE_URL as m, parseJsonUnknown as mt, AUDIO_BACKEND_CHOICES as n, webrtcSessionCapability as nt, COCO_TO_MACRO as o, DeviceFeature as ot, ExportRecordSchema as p, nodePin as pt, pipelineExecutorCapability as q, AUDIO_MACRO_LABELS as r, errMsg as rt, DEFAULT_AUDIO_ANALYZER_CONFIG as s, DeviceType as st, APPLE_SA_TO_MACRO as t, supportedRuntimes as tt, DEVICE_BACKEND_TO_FORMAT as u, isEvent as ut, RATE_CONTROL_RELAXED as v, _enum as vt, audioAnalysisCapability as w, number as wt, RingBuffer as x, discriminatedUnion as xt, RATE_CONTROL_TIGHT as y, array as yt, hfModelUrl as z };