@camstack/addon-pipeline 1.2.44 → 1.2.45

package/dist/{dist-DOu93i_g.mjs → dist-BDkEhx4Z.mjs}

@@ -6541,7 +6541,20 @@ var BrokerStatsSchema = object({
 		sampleRate: number(),
 		channels: number(),
 		supported: boolean()
-	}).nullable().optional()
+	}).nullable().optional(),
+	/**
+	* BROKER-SIDE AUDIO MUTE (D83). `true` = this broker is deliberately
+	* distributing none of the device's audio, on live or recording.
+	*
+	* Present so a silent camera can be told apart from a broken one on the
+	* stream panel itself, without cross-referencing the switch group: a
+	* broker holding an `audio` track descriptor while `audioMuted` is true is
+	* working exactly as asked. `audioMutedDropped` counts the audio units
+	* thrown away since the current dial — it is how you confirm from stats
+	* alone that the mute is on the packet path and not merely persisted.
+	*/
+	audioMuted: boolean().optional(),
+	audioMutedDropped: number().optional()
 });
 /**
 * Exporter-facing "profile restream" entry. Returned by
@@ -7120,116 +7133,7 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 }
 //#endregion
-//#region ../types/dist/canonical-hash-7nfBbEqR.mjs
-/**
-* Deterministic SHA-256 hash of an arbitrary serialisable value. The
-* canonical form sorts object keys alphabetically at every depth so two
-* structurally-equal inputs with different key insertion orders produce
-* the same hash. Returns a 64-char lowercase hex digest.
-*
-* Used by export adapters (Alexa, HAP) to short-circuit re-discovery /
-* accessory-rebuild work when the upstream shape is byte-identical to
-* the last applied state — preventing user-visible "re-discovery"
-* notifications on every addon-runner respawn. Each respawn re-fires
-* `DeviceBindingsChanged` for every cap registration, which without
-* this guard would propagate redundant pushes.
-*
-* Note: this is a SYMPTOMATIC fix layered on top of the binding-change
-* subscription. The proper fix is a single "device ready" lifecycle
-* barrier so exports react only when the full cap set has landed —
-* tracked separately for post-HA-integration work.
-*/
-function canonicalHash(value) {
-	const canonical = JSON.stringify(value, replaceWithSortedKeys);
-	return createHash("sha256").update(canonical ?? "").digest("hex");
-}
-function replaceWithSortedKeys(_key, value) {
-	if (value && typeof value === "object" && !Array.isArray(value)) {
-		const obj = value;
-		const out = {};
-		for (const k of Object.keys(obj).toSorted()) out[k] = obj[k];
-		return out;
-	}
-	return value;
-}
-//#endregion
-//#region ../types/dist/err-msg-IQTHeDzc.mjs
-/**
-import { errMsg } from '@camstack/types'
-* Extract a human-readable message from an unknown error value.
-* Replaces the ubiquitous `errMsg(err)` pattern.
-*/
-function errMsg(err) {
-	if (err instanceof Error) return err.message;
-	if (typeof err === "string") return err;
-	return String(err);
-}
-var EncodeProfileSchema = object({
-	video: object({
-		codec: _enum([
-			"h264",
-			"h265",
-			"copy"
-		]),
-		profile: _enum([
-			"baseline",
-			"main",
-			"high"
-		]).optional(),
-		/**
-		* `-level`, e.g. `'3.1'`. A consumer that ADVERTISES a level in its SDP
-		* (`profile-level-id=42e01f` is Baseline 3.1) must constrain the encoder to
-		* it, or it ships a stream that does not match its own advertisement — the
-		* defect class that kept HomeKit black for a year and that Alexa carried
-		* silently. Optional because a browser negotiates the level itself.
-		*/
-		level: string().optional(),
-		width: number().int().positive().optional(),
-		height: number().int().positive().optional(),
-		fps: number().positive().optional(),
-		bitrateKbps: number().int().positive().optional(),
-		gopFrames: number().int().positive().optional(),
-		bf: number().int().min(0).optional(),
-		preset: _enum([
-			"ultrafast",
-			"superfast",
-			"veryfast",
-			"faster",
-			"fast",
-			"medium"
-		]).optional(),
-		tune: _enum([
-			"zerolatency",
-			"film",
-			"animation"
-		]).optional()
-	}),
-	audio: union([literal("passthrough"), object({
-		codec: _enum([
-			"opus",
-			"aac",
-			"pcmu",
-			"pcma",
-			"copy"
-		]),
-		bitrateKbps: number().int().positive().optional(),
-		sampleRateHz: number().int().positive().optional(),
-		channels: union([literal(1), literal(2)]).optional()
-	})]),
-	/**
-	* ffmpeg input-side args, inserted between the fixed global flags
-	* (`-hide_banner -loglevel error`) and `-i pipe:0`. Free-text array
-	* — the widget surfaces a textarea + suggestion chips for the most-
-	* used demuxer/format options.
-	*/
-	inputArgs: array(string()).optional(),
-	/**
-	* ffmpeg output-side args, inserted between the encode block and
-	* the final `-f <muxer> pipe:1`. Use for muxer options, bitstream
-	* filters, codec-specific overrides. Free-text array.
-	*/
-	outputArgs: array(string()).optional()
-});
+//#region ../types/dist/fmp4-box-splitter-B53u9-Nu.mjs
 var AUDIO_ENCODER_BY_CODEC = {
 	opus: "libopus",
 	aac: "aac",
@@ -7410,13 +7314,42 @@ function buildStdoutOrRtspSinkArgs(sink) {
 		"pipe:1"
 	];
 }
+/**
+* How far BELOW the negotiated fragment length `-min_frag_duration` is set.
+*
+* `-min_frag_duration` refuses to cut before that much media has accumulated,
+* and then waits for the next key frame. Set to exactly `fragmentMs`, the
+* commonest camera configuration in existence — a key-frame grid EQUAL to the
+* requested fragment length — lands the deadline on the same instant as the key
+* frame, loses the race, and skips to the following one: **every fragment comes
+* out at twice the requested length.**
+*
+* Measured on the live fleet 2026-08-07, camera 615, `-c:v copy` (D84):
+*
+* | slot | GOP | `-min_frag_duration` | median gap |
+* | --- | --- | --- | --- |
+* | 1280×720 | 40 f @ 10 fps = 4.0 s | 4000 ms | **7944 ms** |
+* | 1280×720 | 40 f @ 10 fps = 4.0 s | 3600 ms | 3973 ms |
+* | 3840×2160 | 100 f @ 25 fps = 4.0 s | 4000 ms | 8042 ms |
+* | 3840×2160 | 100 f @ 25 fps = 4.0 s | 3600 ms | 3998 ms |
+*
+* A doubled fragment is not a cosmetic overshoot: HKSV requires every fragment
+* to be no longer than the length the controller SELECTED, so the shipped-but-
+* inert phase-1 sink would have violated the contract on its first real clip.
+*
+* 10 % is chosen against the two failures either side of it. Too small and
+* ordinary jitter (measured spread 3953-4096 ms) re-loses the race; too large
+* and a source with a key frame slightly EARLY than the grid gets cut there,
+* yielding a short fragment for no reason.
+*/
+var FMP4_MIN_FRAG_MARGIN = .9;
 /** `-movflags … -min_frag_duration <us> -f mp4 pipe:1`. */
 function buildFmp4SinkArgs(sink) {
 	return [
 		"-movflags",
 		FMP4_MOVFLAGS,
 		"-min_frag_duration",
-		String(Math.max(0, Math.round(sink.fragmentMs * 1e3))),
+		String(Math.max(0, Math.round(sink.fragmentMs * FMP4_MIN_FRAG_MARGIN * 1e3))),
 		"-f",
 		"mp4",
 		"pipe:1"
@@ -7606,6 +7539,287 @@ function invocationFromEncodeProfile(input) {
 	};
 }
 /**
+* Deterministic SHA-256 hash of an arbitrary serialisable value. The
+* canonical form sorts object keys alphabetically at every depth so two
+* structurally-equal inputs with different key insertion orders produce
+* the same hash. Returns a 64-char lowercase hex digest.
+*
+* Used by export adapters (Alexa, HAP) to short-circuit re-discovery /
+* accessory-rebuild work when the upstream shape is byte-identical to
+* the last applied state — preventing user-visible "re-discovery"
+* notifications on every addon-runner respawn. Each respawn re-fires
+* `DeviceBindingsChanged` for every cap registration, which without
+* this guard would propagate redundant pushes.
+*
+* Note: this is a SYMPTOMATIC fix layered on top of the binding-change
+* subscription. The proper fix is a single "device ready" lifecycle
+* barrier so exports react only when the full cap set has landed —
+* tracked separately for post-HA-integration work.
+*/
+function canonicalHash(value) {
+	const canonical = JSON.stringify(value, replaceWithSortedKeys);
+	return createHash("sha256").update(canonical ?? "").digest("hex");
+}
+function replaceWithSortedKeys(_key, value) {
+	if (value && typeof value === "object" && !Array.isArray(value)) {
+		const obj = value;
+		const out = {};
+		for (const k of Object.keys(obj).toSorted()) out[k] = obj[k];
+		return out;
+	}
+	return value;
+}
+var DEFAULT_MAX_UNIT_BYTES = 16 * 1024 * 1024;
+/** Header size for a normal box, and for one carrying a 64-bit `largesize`. */
+var BOX_HEADER_BYTES = 8;
+var LARGE_BOX_HEADER_BYTES = 16;
+var Fmp4BoxSplitter = class {
+	maxUnitBytes;
+	/** Bytes of the CURRENT unit plus any partial box after it. */
+	buffer = new Uint8Array(0);
+	/** Where the current unit starts inside {@link buffer}. */
+	unitStart = 0;
+	/** Where the box scanner has reached inside {@link buffer}. */
+	cursor = 0;
+	state = "init";
+	nextSequence = 0;
+	faultReason = null;
+	interstitial = /* @__PURE__ */ new Set();
+	constructor(options = {}) {
+		this.maxUnitBytes = options.maxUnitBytes ?? DEFAULT_MAX_UNIT_BYTES;
+	}
+	/**
+	* Non-null once the stream cannot be split. The splitter emits nothing
+	* further, so a caller polls this to kill the child rather than watching a
+	* silent stall — a fragmenter that quietly stops producing looks exactly like
+	* a camera with no motion.
+	*/
+	get fault() {
+		return this.faultReason;
+	}
+	/** Bytes currently held. The memory bound, observable rather than asserted. */
+	get pendingBytes() {
+		return this.buffer.length - this.unitStart;
+	}
+	/**
+	* Top-level box types seen BETWEEN fragments and discarded — `mfra`, `free`,
+	* a stray `sidx`. Reported rather than dropped in silence: they are legal and
+	* useless to a fragment consumer, but a type nobody expected showing up here
+	* is the first symptom of a muxer that is not writing what we think it is.
+	*/
+	get discardedInterstitialTypes() {
+		return [...this.interstitial];
+	}
+	/**
+	* Feed bytes; get back whatever units completed. Returns `[]` once faulted.
+	*/
+	push(chunk) {
+		if (this.faultReason !== null || chunk.length === 0) return [];
+		this.append(chunk);
+		if (this.pendingBytes > this.maxUnitBytes) return this.fail(`a single fMP4 unit exceeded ${this.maxUnitBytes} bytes — this stream is not fragmented`);
+		return this.drainBoxes();
+	}
+	append(chunk) {
+		if (this.buffer.length === 0) {
+			this.buffer = chunk.slice();
+			return;
+		}
+		const next = new Uint8Array(this.buffer.length + chunk.length);
+		next.set(this.buffer, 0);
+		next.set(chunk, this.buffer.length);
+		this.buffer = next;
+	}
+	/** Consume every COMPLETE top-level box now in the buffer. */
+	drainBoxes() {
+		const units = [];
+		for (;;) {
+			const header = this.readHeader();
+			if (this.faultReason !== null) return units;
+			if (header === null) break;
+			if (this.cursor + header.totalBytes > this.buffer.length) break;
+			const boxStart = this.cursor;
+			const boxEnd = boxStart + header.totalBytes;
+			this.cursor = boxEnd;
+			const unit = this.consumeBox(header.type, boxStart, boxEnd);
+			if (this.faultReason !== null) return units;
+			if (unit !== null) units.push(unit);
+		}
+		this.compact();
+		return units;
+	}
+	/**
+	* Apply one box to the state machine. Returns a unit when this box CLOSED
+	* one, `null` otherwise.
+	*/
+	consumeBox(type, boxStart, boxEnd) {
+		if (this.state === "init") {
+			if (type !== "moof") return null;
+			if (boxStart === this.unitStart) {
+				this.fail("a moof arrived before any initialisation box — there is no ftyp/moov to send");
+				return null;
+			}
+			const init = this.emit("init", this.unitStart, boxStart);
+			this.unitStart = boxStart;
+			this.state = "fragment";
+			return init;
+		}
+		if (this.state === "idle") {
+			if (type !== "moof") {
+				this.interstitial.add(type);
+				this.unitStart = boxEnd;
+				return null;
+			}
+			this.unitStart = boxStart;
+			this.state = "fragment";
+			return null;
+		}
+		if (type !== "mdat") return null;
+		const fragment = this.emit("fragment", this.unitStart, boxEnd);
+		this.unitStart = boxEnd;
+		this.state = "idle";
+		return fragment;
+	}
+	/**
+	* Parse the header at {@link cursor}, or `null` when too few bytes have
+	* arrived to know. Faults on a size the splitter cannot honour.
+	*/
+	readHeader() {
+		const available = this.buffer.length - this.cursor;
+		if (available < BOX_HEADER_BYTES) return null;
+		const view = new DataView(this.buffer.buffer, this.buffer.byteOffset, this.buffer.byteLength);
+		const size = view.getUint32(this.cursor);
+		const type = String.fromCharCode(this.buffer[this.cursor + 4] ?? 0, this.buffer[this.cursor + 5] ?? 0, this.buffer[this.cursor + 6] ?? 0, this.buffer[this.cursor + 7] ?? 0);
+		if (size === 0) {
+			this.fail(`box "${type}" declares size 0 (to EOF) — an unbounded box cannot be fragmented`);
+			return null;
+		}
+		if (size === 1) {
+			if (available < LARGE_BOX_HEADER_BYTES) return null;
+			const large = view.getBigUint64(this.cursor + BOX_HEADER_BYTES);
+			if (large > BigInt(this.maxUnitBytes)) {
+				this.fail(`box "${type}" declares ${large} bytes, over the ${this.maxUnitBytes} byte bound`);
+				return null;
+			}
+			return {
+				type,
+				totalBytes: Number(large)
+			};
+		}
+		if (size < BOX_HEADER_BYTES) {
+			this.fail(`box "${type}" declares an impossible size of ${size} bytes`);
+			return null;
+		}
+		return {
+			type,
+			totalBytes: size
+		};
+	}
+	emit(kind, start, end) {
+		const sequence = this.nextSequence;
+		this.nextSequence += 1;
+		return {
+			kind,
+			data: this.buffer.slice(start, end),
+			sequence
+		};
+	}
+	/**
+	* Drop everything already emitted or discarded. Without this the buffer is
+	* the whole stream and the process dies in hours, not minutes.
+	*/
+	compact() {
+		if (this.unitStart === 0) return;
+		this.buffer = this.buffer.slice(this.unitStart);
+		this.cursor -= this.unitStart;
+		this.unitStart = 0;
+	}
+	fail(reason) {
+		this.faultReason = reason;
+		this.buffer = new Uint8Array(0);
+		this.unitStart = 0;
+		this.cursor = 0;
+		return [];
+	}
+};
+//#endregion
+//#region ../types/dist/err-msg-IQTHeDzc.mjs
+/**
+import { errMsg } from '@camstack/types'
+* Extract a human-readable message from an unknown error value.
+* Replaces the ubiquitous `errMsg(err)` pattern.
+*/
+function errMsg(err) {
+	if (err instanceof Error) return err.message;
+	if (typeof err === "string") return err;
+	return String(err);
+}
+var EncodeProfileSchema = object({
+	video: object({
+		codec: _enum([
+			"h264",
+			"h265",
+			"copy"
+		]),
+		profile: _enum([
+			"baseline",
+			"main",
+			"high"
+		]).optional(),
+		/**
+		* `-level`, e.g. `'3.1'`. A consumer that ADVERTISES a level in its SDP
+		* (`profile-level-id=42e01f` is Baseline 3.1) must constrain the encoder to
+		* it, or it ships a stream that does not match its own advertisement — the
+		* defect class that kept HomeKit black for a year and that Alexa carried
+		* silently. Optional because a browser negotiates the level itself.
+		*/
+		level: string().optional(),
+		width: number().int().positive().optional(),
+		height: number().int().positive().optional(),
+		fps: number().positive().optional(),
+		bitrateKbps: number().int().positive().optional(),
+		gopFrames: number().int().positive().optional(),
+		bf: number().int().min(0).optional(),
+		preset: _enum([
+			"ultrafast",
+			"superfast",
+			"veryfast",
+			"faster",
+			"fast",
+			"medium"
+		]).optional(),
+		tune: _enum([
+			"zerolatency",
+			"film",
+			"animation"
+		]).optional()
+	}),
+	audio: union([literal("passthrough"), object({
+		codec: _enum([
+			"opus",
+			"aac",
+			"pcmu",
+			"pcma",
+			"copy"
+		]),
+		bitrateKbps: number().int().positive().optional(),
+		sampleRateHz: number().int().positive().optional(),
+		channels: union([literal(1), literal(2)]).optional()
+	})]),
+	/**
+	* ffmpeg input-side args, inserted between the fixed global flags
+	* (`-hide_banner -loglevel error`) and `-i pipe:0`. Free-text array
+	* — the widget surfaces a textarea + suggestion chips for the most-
+	* used demuxer/format options.
+	*/
+	inputArgs: array(string()).optional(),
+	/**
+	* ffmpeg output-side args, inserted between the encode block and
+	* the final `-f <muxer> pipe:1`. Use for muxer options, bitstream
+	* filters, codec-specific overrides. Free-text array.
+	*/
+	outputArgs: array(string()).optional()
+});
+/**
 * The shape every live egress starts from: H.264 Baseline 3.1 at 720p25.
 * Baseline because it is the one profile every consumer in this repo decodes
 * (Echo, iOS, an old browser); 3.1 because that is what the SDPs advertise.
@@ -7850,6 +8064,19 @@ object({
 * | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
 * | `privacy-mask` | `privacyMask.setMask({ enabled })` → the CAMERA | the camera blanks the masked regions itself; every stream and recording carries the black boxes |
 * | `device-audio` | `privacyMask.setAudioEnabled` → the CAMERA | the camera stops encoding an audio track at all; every consumer sees silent video |
+* | `broker-audio` | `streamBroker.setDeviceAudioMute` → `DeviceOverride.audioMuted` | `StreamBroker.setAudioMuted` drops the audio plane at the source: no `type:'audio'` packet leaves `fanOutEncoded`, no RTP reaches the restreamer, and the restreamer serves the video-only SDP |
+*
+* ## `device-audio` and `broker-audio` are two functions, not two knobs
+*
+* They look adjacent and they are not the same control ([D83](../../../../docs/decisions/adr-0083.md)):
+* `device-audio` writes the CAMERA, so it is hardware privacy — the microphone
+* genuinely stops, it survives CamStack entirely, and it costs a multi-second
+* encoder restart on every flip. `broker-audio` writes THIS server, so it is
+* instant, vendor-independent and reversible without touching the camera, and
+* a camera that ignores or lacks the ISAPI/Reolink control is still silenced.
+* D62 forbids a second switch that *disagrees* with the first; these two
+* cannot disagree, because neither reads the other's store — the camera holds
+* one, the broker holds the other, and each reports its own fact.
 *
 * ## The two switches whose authority is not on this server
 *
@@ -7911,6 +8138,7 @@ var CameraSwitchIdSchema = _enum([
 	"object-detection",
 	"privacy-mask",
 	"device-audio",
+	"broker-audio",
 	"audio-analysis",
 	"recording",
 	"notifications"
@@ -7936,7 +8164,8 @@ var CameraSwitchAuthoritySchema = discriminatedUnion("kind", [
 	object({
 		kind: literal("camera-mask"),
 		capName: string()
-	})
+	}),
+	object({ kind: literal("broker-audio-mute") })
 ]);
 /**
 * Why a switch is not offered for this camera. Rendered instead of the
@@ -10405,7 +10634,44 @@ var streamBrokerCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		isRtspEnabled: method(object({ brokerId: string() }), boolean())
+		isRtspEnabled: method(object({ brokerId: string() }), boolean()),
+		/**
+		* ── Per-device audio-plane policy (D83) ───────────────────────────
+		*
+		* The BROKER-side mute: while `muted`, this node distributes none of
+		* the device's audio, on any plane it serves — live (WebRTC / encoded
+		* subscribers) AND recording (the RTSP restreamer the recorder pulls,
+		* which additionally serves the video-only SDP so the recorder's ffmpeg
+		* never declares an audio stream it will not receive).
+		*
+		* Keyed by `deviceId`, not `brokerId`: every one of a camera's streams
+		* carries the same microphone, and a per-stream answer would let main
+		* and sub disagree about whether the camera is silent.
+		*
+		* The state lives in the broker's existing `DeviceOverride` blob — no
+		* new store — and the mute is applied to a fresh broker at creation, so
+		* a restart, a re-dial or a catalog republish never un-mutes a camera.
+		*/
+		getDeviceAudioMute: method(object({ deviceId: number().int() }), object({
+			muted: boolean(),
+			/**
+			* How many live non-derived brokers currently hold the mute. Purely
+			* diagnostic: `muted` is the policy and is authoritative on its own
+			* (it applies to brokers that do not exist yet), while this says
+			* whether anything is presently being silenced.
+			*/
+			appliedBrokers: number().int().nonnegative()
+		})),
+		setDeviceAudioMute: method(object({
+			deviceId: number().int(),
+			muted: boolean()
+		}), object({
+			muted: boolean(),
+			appliedBrokers: number().int().nonnegative()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	},
 	events: {
 		onCamStreamDemand: event(object({
@@ -16141,6 +16407,30 @@ var TrackSourceSchema = _enum([
 	"audio"
 ]);
 /**
+* Where a track sits in the RETRAIN lifecycle (D81).
+*
+*  - `none` — never marked, or un-marked. Evictable.
+*  - `staging` — the operator wants this track as training material and has not
+*    finished with it. **This is the only state retention holds**: the track and
+*    everything it owns (object events, crops, keyframes, CLIP vector) survive
+*    the device's age window.
+*  - `trained` — the retrain page has taken what it needed. The frames it chose
+*    were COPIED into the retrain dataset at selection time, so the dataset no
+*    longer depends on the track's media and the track becomes EVICTABLE again.
+*    Terminal for the plain `markForTrain` toggle: returning it to `staging` is
+*    a deliberate action of the retrain page, not a side effect of a checkbox.
+*
+* There is no `null`. The state is stored `TEXT NOT NULL DEFAULT 'none'` because
+* the store's filter language has only positive equality and `whereIn` — no
+* negation, no IS NULL — so a NULL would be unselectable by ANY predicate and
+* would make the entire pre-column history immortal in one deploy.
+*/
+var RetrainStatusSchema = _enum([
+	"none",
+	"staging",
+	"trained"
+]);
+/**
 * Per-track OPERATOR flags — set by hand from the admin UI or the viewer, never
 * by the pipeline. Spread into `TrackSchema` and `KeyEventSchema` from one place
 * so the two surfaces cannot drift.
@@ -16150,18 +16440,31 @@ var TrackSourceSchema = _enum([
 * columns existed read as absent, and a consumer that needs a boolean should say
 * `flag === true`, not `flag !== false`.
 *
-* What the flags DO is deliberately UNDEFINED at the time of writing: they are
-* operator curation, and the behaviour they drive will be specified separately.
-* In particular a `markForTrain` track is NOT pinned against retention — see
-* `docs/decisions/adr-0059.md` for why that is a store-level change, not a flag.
+* `markForTrain` is the WIRE FACE of {@link RetrainStatusSchema}, not a column:
+* it is exactly `retrainStatus === 'staging'`, in both directions. Writing
+* `true` moves `none → staging`, writing `false` moves `staging → none`, and a
+* `trained` track reports `false` while refusing both writes. The boolean is
+* kept because three surfaces drive a toggle off it; anything that needs to tell
+* "never marked" from "already trained" must read `retrainStatus`.
+*
+* `debug` does NOT pin; it is attention, not durability.
 */
 var TrackFlagFields = {
-	/** Operator marked this track as training material. */
+	/** Operator marked this track as training material — i.e. `retrainStatus` is
+	*  `'staging'`. */
 	markForTrain: boolean().optional(),
 	/** Operator marked this track for diagnostic attention. */
 	debug: boolean().optional()
 };
 /**
+* The lifecycle field itself, on the READ surfaces only (`Track`, `KeyEvent`).
+* Deliberately NOT part of {@link TrackFlagFields}: that group also builds the
+* write patch, and the status is not something the toggle sets — it is what the
+* toggle's boolean is derived from. Absent on an in-RAM track never touched;
+* always present on a persisted row (the column default materialises `'none'`).
+*/
+var TrackRetrainFields = { retrainStatus: RetrainStatusSchema.optional() };
+/**
 * The write half: a PARTIAL patch. An omitted key is left untouched, so setting
 * one flag can never clear the other — the toggles are independent and are
 * driven from three surfaces that do not know about each other.
@@ -16175,7 +16478,32 @@ var TrackFlagsPatchSchema = object(TrackFlagFields);
 var TrackFlagsSchema = object({
 	trackId: string(),
 	markForTrain: boolean(),
-	debug: boolean()
+	debug: boolean(),
+	/** The lifecycle state the boolean was derived from. Required here (unlike on
+	*  a track row) because this shape is only ever produced by the write body,
+	*  which always knows it — and a surface that has just written needs to render
+	*  `trained` without a re-fetch. */
+	retrainStatus: RetrainStatusSchema
+});
+/** Per-camera slice of a training-export estimate. */
+var TrainingExportDeviceTotalsSchema = object({
+	deviceId: number(),
+	tracks: number().int(),
+	files: number().int(),
+	bytes: number().int()
+});
+/**
+* What a training export WOULD contain. Computed from media index rows only —
+* no blob is read to produce this.
+*/
+var TrainingExportSummarySchema = object({
+	generatedAt: number(),
+	trackCount: number().int(),
+	fileCount: number().int(),
+	byteCount: number().int(),
+	/** More marked tracks exist than a single pass carries. */
+	truncated: boolean(),
+	devices: array(TrainingExportDeviceTotalsSchema).readonly()
 });
 var TrackSchema = object({
 	trackId: string(),
@@ -16220,7 +16548,8 @@ var TrackSchema = object({
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
 	envelope: TrackEnvelopeSchema.optional(),
-	...TrackFlagFields
+	...TrackFlagFields,
+	...TrackRetrainFields
 });
 var BaseEventFields = {
 	id: string(),
@@ -16434,7 +16763,8 @@ var KeyEventSchema = object({
 	bestEventId: string(),
 	/** Track lifetime in ms (lastSeen - firstSeen). */
 	windowMs: number().optional(),
-	...TrackFlagFields
+	...TrackFlagFields,
+	...TrackRetrainFields
 });
 object({
 	trackId: string(),
@@ -16695,6 +17025,12 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
 	kind: "query",
 	auth: "admin"
+}), method(object({ deviceIds: array(number()).optional() }), TrainingExportSummarySchema, {
+	kind: "query",
+	auth: "admin"
+}), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
+	kind: "query",
+	auth: "admin"
 }), method(object({
 	eventId: string(),
 	kind: MediaFileKindEnum.optional()
@@ -22744,6 +23080,173 @@ DeviceType.Camera, method(object({
 	status: OsdStatusSchema
 });
 /**
+* `osd-manager` — the ORCHESTRATOR over the device-scope `osd` cap.
+*
+* The `osd` cap is the firmware contract: it probes a camera's overlay
+* SLOTS and writes literal text into one. It has no idea WHERE that text
+* comes from, and it must not — a driver that grew a "show the temperature
+* here" feature would grow it once per vendor.
+*
+* This cap owns the other half: a per-(camera, slot) BINDING that says
+* which value feeds the slot, how it is formatted, and under which
+* conditions it is shown at all. One addon renders every binding on every
+* camera, so a new source costs zero driver code.
+*
+* Three deliberate choices, each with a rejected alternative:
+*
+*  1. A source is `(capName, valuePath)` over the kernel's device
+*     runtime-state mirror — NOT a closed enum of source kinds. Every
+*     cap-keyed slice a device publishes is bindable the day the cap
+*     ships. The rejected alternative (one enum member per source, with
+*     a resolver branch each) is what makes "add the humidity too" a
+*     code change.
+*  2. The display gate reuses `NcConditionsSchema` verbatim — the
+*     notification centre's condition vocabulary — rather than a parallel
+*     model. An operator who has learned one condition editor has learned
+*     both.
+*  3. Because the renderer's facts are device STATE and not a detection
+*     record, only a SUBSET of that vocabulary can be answered here.
+*     `setSlotBinding` REJECTS the rest at write time (see
+*     `getConditionSupport`). It does not accept-then-fail-closed: a
+*     condition that can never be true renders a permanently blank
+*     overlay, and a blank overlay looks exactly like a broken camera.
+*/
+/** Where a slot's value comes from. */
+var OsdSourceSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("static"),
+		text: string().max(64)
+	}),
+	object({
+		kind: literal("clock"),
+		/** Token pattern: `YYYY MM DD HH mm ss`. Everything else is literal. */
+		pattern: string().min(1).max(32).default("HH:mm"),
+		/** IANA zone. Omitted = the server's zone. */
+		timezone: string().min(1).max(64).optional()
+	}),
+	object({
+		kind: literal("device-state"),
+		deviceId: number().int().optional(),
+		capName: string().min(1).max(64),
+		/** Dot path inside the slice, e.g. `detected`, `value`, `mode`. */
+		valuePath: string().min(1).max(64)
+	})
+]);
+var OsdSlotBindingSchema = object({
+	/** Off = the manager stops driving this slot. It does NOT clear it. */
+	enabled: boolean().default(true),
+	source: OsdSourceSchema,
+	/** `${value}` and `${unit}` are substituted; every occurrence. */
+	template: string().max(96).default("${value}"),
+	/** Truncate with an ellipsis past this length. Absent = no limit. */
+	maxCharacters: number().int().min(4).max(64).optional(),
+	/**
+	* Decimal places for a numeric value. `0` yields an integer — the
+	* documented workaround for firmwares that reject `.` in overlay text.
+	*/
+	maxDecimals: number().int().min(0).max(4).default(1),
+	/** Appended via `${unit}`. The state mirror does not carry units. */
+	unitLabel: string().max(8).optional(),
+	/** Raw value → display text, e.g. `{"true":"MOTION","false":""}`. */
+	valueMap: record(string(), string()).optional(),
+	/** Time windows in which the slot is shown. Absent = always. */
+	schedule: NcScheduleSchema.optional(),
+	/**
+	* Display gate, in the notification centre's condition vocabulary.
+	* Only the keys reported by `getConditionSupport` are accepted.
+	*/
+	conditions: NcConditionsSchema.optional(),
+	/** Rendered when the gate is closed or the value unreadable. Empty = hide. */
+	fallbackText: string().max(64).default("")
+});
+/** One camera slot, as the operator sees it: firmware truth + our binding. */
+var OsdSlotViewSchema = object({
+	slotId: string(),
+	kind: OsdOverlayKindEnum,
+	/** Firmware refuses text edits (a timestamp, the channel name). */
+	readOnly: boolean(),
+	cameraEnabled: boolean(),
+	cameraText: string().optional(),
+	binding: OsdSlotBindingSchema.nullable()
+});
+/**
+* What happened to one slot on one render pass. `unchanged` exists so the
+* operator can tell "we are driving this and the value is steady" from
+* "we never got there" — and so the loop can prove it is not rewriting
+* identical text to the camera every tick.
+*/
+var OsdRenderOutcomeEnum = _enum([
+	"written",
+	"unchanged",
+	"gated",
+	"unreadable",
+	"disabled",
+	"unbound",
+	"failed"
+]);
+var OsdRenderResultSchema = object({
+	slotId: string(),
+	outcome: OsdRenderOutcomeEnum,
+	/** The text the slot should carry. Empty = the slot is switched off. */
+	text: string(),
+	/** Why, whenever the outcome is not a plain write. Never silent. */
+	reason: string().optional()
+});
+var OsdSourceValueTypeEnum = _enum([
+	"number",
+	"boolean",
+	"string",
+	"enum"
+]);
+/**
+* One bindable value, derived from a cap's `runtimeState` schema — never
+* hand-listed. The editor renders from this, so a cap that ships a new
+* state field becomes bindable with no UI change.
+*/
+var OsdSourceOptionSchema = object({
+	deviceId: number().int(),
+	deviceName: string(),
+	capName: string(),
+	valuePath: string(),
+	label: string(),
+	valueType: OsdSourceValueTypeEnum,
+	/** Present for `enum`; the editor offers these as `valueMap` keys. */
+	enumValues: array(string()).readonly().optional()
+});
+method(object({ deviceId: number().int() }), object({
+	supported: boolean(),
+	slots: array(OsdSlotViewSchema)
+}), { auth: "admin" }), method(object({ deviceId: number().int() }), object({ sources: array(OsdSourceOptionSchema) }), { auth: "admin" }), method(object({}), object({
+	supported: array(string()),
+	catalog: array(NcConditionDescriptorSchema)
+}), { auth: "admin" }), method(object({
+	deviceId: number().int(),
+	slotId: string().min(1),
+	binding: OsdSlotBindingSchema
+}), object({
+	slot: OsdSlotViewSchema,
+	render: OsdRenderResultSchema
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int(),
+	slotId: string().min(1)
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int(),
+	slotId: string().min(1),
+	binding: OsdSlotBindingSchema.optional()
+}), OsdRenderResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int() }), object({ results: array(OsdRenderResultSchema) }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * Feeder connectivity / power status — mirrors the HA petkit device-status
 * enum: `normal` (online, mains), `offline` (not reaching PetKit cloud),
 * `on_batteries` (running on battery backup). `null` until first reported.
@@ -27800,6 +28303,48 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"osdManager.clearSlotBinding": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"osdManager.getConditionSupport": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"osdManager.getDeviceOsd": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"osdManager.getSourceCatalog": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"osdManager.previewSlot": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"osdManager.renderDevice": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"osdManager.setSlotBinding": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"petFeeder.callPet": {
 		capName: "pet-feeder",
 		capScope: "device",
@@ -27962,6 +28507,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getTrainingExportSummary": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.getTrainingExportUrl": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listEventKinds": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29438,6 +29995,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"streamBroker.getDeviceAudioMute": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"streamBroker.getPreBufferInfo": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -29558,6 +30121,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.setDeviceAudioMute": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.setPreBufferDuration": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -31016,4 +31585,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { storageEvictableCapability as $, defaultDeviceFor as A, invocationFromEncodeProfile as B, addonWidgetsSourceCapability as C, literal as Ct, cameraStreamsCapability as D, string as Dt, buildFfmpegArgs as E, record as Et, egressTranscodeSharingKey as F, pickDetailCropConvention as G, mapAudioLabelToMacro as H, egressTransportFromRequest as I, pipelineRunnerCapability as J, pickNativeLeaseOverride as K, enumerateInferenceDevices as L, deriveDetailCropRect as M, deriveRecordingMode as N, createHwAccelCache as O, union as Ot, detectionPipelineCapability as P, runtimeDevices as Q, evaluateZoneRules as R, YAMNET_TO_MACRO as S, lazy as St, audioAnalyzerCapability as T, object as Tt, maskUrlCredentials as U, isSoftwareDecode as V, motionDetectionCapability as W, recordingExportCapability as X, recordingCapability as Y, resolveEgressDecodeHwAccel as Z, OpsLogEntrySchema as _, sleep as _t, COCO_80_LABELS as a, CAM_PROFILE_ORDER as at, RecordingConfigSchema as b, boolean as bt, DEFAULT_DETAIL_CROP_CONVENTION as c, createEvent as ct, EVENT_PAD_MS as d, makeProfileBrokerId as dt, streamBrokerCapability as et, EncodeProfileSchema as f, makeSourceBrokerId as ft, NativeLeaseSettingsSchema as g, selectAssignedProfileSlots as gt, NativeLeaseAdmissionSchema as h, parseProfileBrokerId as ht, AUDIO_PRESETS as i, BaseAddon as it, defineCustomActions as j, customAction as k, EventCategory as kt, DEFAULT_NATIVE_LEASE_SETTINGS as l, hydrateSchema as lt, HF_BASE_URL as m, parseJsonUnknown as mt, AUDIO_BACKEND_CHOICES as n, webrtcSessionCapability as nt, COCO_TO_MACRO as o, DeviceFeature as ot, ExportRecordSchema as p, nodePin as pt, pipelineExecutorCapability as q, AUDIO_MACRO_LABELS as r, errMsg as rt, DEFAULT_AUDIO_ANALYZER_CONFIG as s, DeviceType as st, APPLE_SA_TO_MACRO as t, supportedRuntimes as tt, DEVICE_BACKEND_TO_FORMAT as u, isEvent as ut, RATE_CONTROL_RELAXED as v, _enum as vt, audioAnalysisCapability as w, number as wt, RingBuffer as x, discriminatedUnion as xt, RATE_CONTROL_TIGHT as y, array as yt, hfModelUrl as z };
+export { errMsg as $, deriveDetailCropRect as A, EventCategory as At, motionDetectionCapability as B, audioAnalysisCapability as C, lazy as Ct, customAction as D, record as Dt, createHwAccelCache as E, object as Et, enumerateInferenceDevices as F, recordingCapability as G, pickNativeLeaseOverride as H, evaluateZoneRules as I, runtimeDevices as J, recordingExportCapability as K, hfModelUrl as L, detectionPipelineCapability as M, egressTranscodeSharingKey as N, defaultDeviceFor as O, string as Ot, egressTransportFromRequest as P, webrtcSessionCapability as Q, mapAudioLabelToMacro as R, addonWidgetsSourceCapability as S, discriminatedUnion as St, cameraStreamsCapability as T, number as Tt, pipelineExecutorCapability as U, pickDetailCropConvention as V, pipelineRunnerCapability as W, streamBrokerCapability as X, storageEvictableCapability as Y, supportedRuntimes as Z, RATE_CONTROL_RELAXED as _, selectAssignedProfileSlots as _t, COCO_TO_MACRO as a, BaseAddon as at, RingBuffer as b, array as bt, DEFAULT_NATIVE_LEASE_SETTINGS as c, DeviceType as ct, EncodeProfileSchema as d, isEvent as dt, AUDIO_PRESETS as et, ExportRecordSchema as f, makeProfileBrokerId as ft, OpsLogEntrySchema as g, parseProfileBrokerId as gt, NativeLeaseSettingsSchema as h, parseJsonUnknown as ht, COCO_80_LABELS as i, isSoftwareDecode as it, deriveRecordingMode as j, defineCustomActions as k, union as kt, DEVICE_BACKEND_TO_FORMAT as l, createEvent as lt, NativeLeaseAdmissionSchema as m, nodePin as mt, AUDIO_BACKEND_CHOICES as n, buildFfmpegArgs as nt, DEFAULT_AUDIO_ANALYZER_CONFIG as o, CAM_PROFILE_ORDER as ot, HF_BASE_URL as p, makeSourceBrokerId as pt, resolveEgressDecodeHwAccel as q, AUDIO_MACRO_LABELS as r, invocationFromEncodeProfile as rt, DEFAULT_DETAIL_CROP_CONVENTION as s, DeviceFeature as st, APPLE_SA_TO_MACRO as t, Fmp4BoxSplitter as tt, EVENT_PAD_MS as u, hydrateSchema as ut, RATE_CONTROL_TIGHT as v, sleep as vt, audioAnalyzerCapability as w, literal as wt, YAMNET_TO_MACRO as x, boolean as xt, RecordingConfigSchema as y, _enum as yt, maskUrlCredentials as z };