@camstack/addon-post-analysis 1.2.48 → 1.2.50

package/dist/{dist-4NhN1aPx.mjs → dist-BhadCxSQ.mjs}

@@ -6460,7 +6460,20 @@ var BrokerStatsSchema = object({
 		sampleRate: number(),
 		channels: number(),
 		supported: boolean()
-	}).nullable().optional()
+	}).nullable().optional(),
+	/**
+	* BROKER-SIDE AUDIO MUTE (D83). `true` = this broker is deliberately
+	* distributing none of the device's audio, on live or recording.
+	*
+	* Present so a silent camera can be told apart from a broken one on the
+	* stream panel itself, without cross-referencing the switch group: a
+	* broker holding an `audio` track descriptor while `audioMuted` is true is
+	* working exactly as asked. `audioMutedDropped` counts the audio units
+	* thrown away since the current dial — it is how you confirm from stats
+	* alone that the mute is on the packet path and not merely persisted.
+	*/
+	audioMuted: boolean().optional(),
+	audioMutedDropped: number().optional()
 });
 /**
 * Exporter-facing "profile restream" entry. Returned by
@@ -6509,9 +6522,38 @@ var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
 /**
 * Build the tRPC request options that pin a single capability call to `nodeId`.
 * Pass as the second argument to `.query(input, …)` / `.mutate(input, …)`.
+*
+* ## The id is normalised here, and it has to be
+*
+* A forked addon reads its own node from `ctx.kernel.localNodeId`, and inside a
+* worker that value is a RUNNER id — `hub/export-hap`, not `hub`. Routing
+* compares a pin against real node ids, so such a pin matches nothing and the
+* call fails with `no provider registered for cap "…"`. The local-first
+* resolver already guarded against this (`localNodeId.split('/')[0]`), which
+* made the hazard invisible: unpinned calls worked, and only an explicit pin —
+* the thing you reach for when you specifically need THIS node — silently
+* addressed a node that does not exist.
+*
+* Cost of it being missing: `addon-export-hap` pinned `decoder.getInfo` to its
+* own node to read the host's hardware-decode backend. It never once answered,
+* so every HomeKit egress transcode decoded in SOFTWARE — including 4K H.265 —
+* while D67's whole premise was that the decoder addon is the authority on
+* hardware. The warn said `decoding in SOFTWARE` and read as "this node has no
+* hardware", which was false.
+*
+* Normalising in the ONE constructor fixes every caller at once, which is why
+* it is here and not at the call sites.
 */
 function nodePin(nodeId) {
-	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: nodeId } };
+	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: toNodeId(nodeId) } };
+}
+/**
+* A runner id is `<nodeId>/<addonId>`; a node id has no slash. Taking the head
+* is idempotent, so passing an already-clean id costs nothing.
+*/
+function toNodeId(idOrRunnerId) {
+	const head = idOrRunnerId.split("/")[0];
+	return head === void 0 || head.length === 0 ? idOrRunnerId : head;
 }
 /**
 * Output schema shared by the contribution + live methods.
@@ -7249,7 +7291,7 @@ object({
 * ## This file adds no state
 *
 * Every switch here is a VIEW onto an authority that already existed
-* ([D61](../../../../docs/decisions/adr-0062.md)). The whole point of the
+* ([D62](../../../../docs/decisions/adr-0062.md)). The whole point of the
 * group is that there is exactly one place each function is turned off, and
 * the group routes to it:
 *
@@ -7260,6 +7302,53 @@ object({
 * | `audio-analysis` | `deviceManager.setWrapperActive('audio-analysis')` | `AudioSubscriptionController.subscribeAudioStream` returns `null` before opening the stream |
 * | `recording` | `recording.setDeviceConfig` → `RecordingConfig.enabled` | `band-decision.shouldRecord` returns false; the controller detaches the device |
 * | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
+* | `privacy-mask` | `privacyMask.setMask({ enabled })` → the CAMERA | the camera blanks the masked regions itself; every stream and recording carries the black boxes |
+* | `device-audio` | `privacyMask.setAudioEnabled` → the CAMERA | the camera stops encoding an audio track at all; every consumer sees silent video |
+* | `broker-audio` | `streamBroker.setDeviceAudioMute` → `DeviceOverride.audioMuted` | `StreamBroker.setAudioMuted` drops the audio plane at the source: no `type:'audio'` packet leaves `fanOutEncoded`, no RTP reaches the restreamer, and the restreamer serves the video-only SDP |
+*
+* ## `device-audio` and `broker-audio` are two functions, not two knobs
+*
+* They look adjacent and they are not the same control ([D83](../../../../docs/decisions/adr-0083.md)):
+* `device-audio` writes the CAMERA, so it is hardware privacy — the microphone
+* genuinely stops, it survives CamStack entirely, and it costs a multi-second
+* encoder restart on every flip. `broker-audio` writes THIS server, so it is
+* instant, vendor-independent and reversible without touching the camera, and
+* a camera that ignores or lacks the ISAPI/Reolink control is still silenced.
+* D62 forbids a second switch that *disagrees* with the first; these two
+* cannot disagree, because neither reads the other's store — the camera holds
+* one, the broker holds the other, and each reports its own fact.
+*
+* ## The two switches whose authority is not on this server
+*
+* `privacy-mask` and `device-audio` write the CAMERA. That is not a loophole
+* in "the group stores nothing" — it is the purest form of it: the camera
+* holds the fact, every read is a read-through, and there is no server-side
+* copy that could drift. Their availability therefore cannot come from
+* `listBindableCapsForDeviceType` (a device-NATIVE cap carries no wrappers and
+* is filtered out there); it comes from the cap's own camera-probed
+* `privacyMask.getOptions()`, which is strictly more honest — it answers for
+* THIS camera rather than for the device type
+* ([D74](../../../../docs/decisions/adr-0074.md)).
+*
+* ## `privacy-mask` is the one row whose ON is not "the function is working"
+*
+* Every other switch means *this camera's function is doing its job*, so
+* `enabled: false` is a thing an operator took away. `privacy-mask` means **the
+* MASK is active** — `enabled: true` is video deliberately obscured. The
+* polarity is not a choice made here: `addon-export-hap`'s privacy `Switch`
+* (`builders/privacy-switch.ts`) already mirrors `patch.enabled` verbatim, and
+* a HomeKit toggle that disagreed with the app's toggle for the same camera is
+* worse than either surface not having one.
+*
+* Two consequences follow and both are load-bearing:
+*
+* - **It never counts as `switchedOff`.** `countsAsSwitchedOff` is `false` for
+*   exactly this row. With the polarity above, every camera that has NOT drawn
+*   a privacy mask would otherwise report `switchedOff: ['privacy-mask']` — the
+*   normal, healthy state of most cameras rendered as an operator disablement.
+* - **Its cost line names BOTH directions.** `costWhenOff` is rendered
+*   unconditionally by both clients, so for this row it has to read correctly
+*   whichever way the switch is sitting.
 *
 * The wrapper-binding pair is not a new idea: `legacy-migrations.ts` already
 * migrated the legacy `audioEnabled` / `pipelineEnabled` /
@@ -7278,14 +7367,18 @@ object({
 *   `CameraStatus.switchedOff`.
 */
 /**
-* The five functions the operator named (2026-08-05). Deliberately NOT one id
-* per pipeline step: face recognition and plate/LPR are per-step toggles on
+* The functions the operator named — five on 2026-08-05, plus the camera's own
+* microphone on 2026-08-07. Deliberately NOT one id per pipeline step: face
+* recognition and plate/LPR are per-step toggles on
 * `pipelineOrchestrator.setCameraStepToggle` and belong in the pipeline
-* editor, not in a five-button safety group.
+* editor, not in a safety group.
 */
 var CameraSwitchIdSchema = _enum([
 	"stream-broker",
 	"object-detection",
+	"privacy-mask",
+	"device-audio",
+	"broker-audio",
 	"audio-analysis",
 	"recording",
 	"notifications"
@@ -7303,14 +7396,27 @@ var CameraSwitchAuthoritySchema = discriminatedUnion("kind", [
 		capName: string()
 	}),
 	object({ kind: literal("recording-config") }),
-	object({ kind: literal("notification-mute") })
+	object({ kind: literal("notification-mute") }),
+	object({
+		kind: literal("camera-audio"),
+		capName: string()
+	}),
+	object({
+		kind: literal("camera-mask"),
+		capName: string()
+	}),
+	object({ kind: literal("broker-audio-mute") })
 ]);
 /**
 * Why a switch is not offered for this camera. Rendered instead of the
 * control, never as a dead control — an absent function and a broken one must
 * not look the same.
 */
-var CameraSwitchUnavailableReasonSchema = _enum(["no-provider", "source-unreachable"]);
+var CameraSwitchUnavailableReasonSchema = _enum([
+	"no-provider",
+	"source-unreachable",
+	"not-configured"
+]);
 /**
 * One switch, resolved for one camera.
 *
@@ -9303,6 +9409,26 @@ var EgressTranscodeRequestSchema = object({
 		"h264_mp4toannexb",
 		"hevc_mp4toannexb"
 	]).optional(),
+	/**
+	* Publish the transcode as a LOCAL push cam stream, instead of leaving the
+	* consumer to dial the returned url. The broker picks the id and returns it
+	* as `camStreamId` — a caller-supplied one would be circular, since the
+	* sharing key is computed FROM this request.
+	*
+	* The url is still returned and still the contract for a transcode pinned to
+	* another node. But dialling it locally costs an RTSP round trip that changes
+	* the transport underneath the consumer: a dialled stream is an RTP source,
+	* so `isRtpSource()` is true and the session takes the RTP-passthrough +
+	* repacketizer branch. The push branch — the one the derived mechanism has
+	* live hours on — is never reached. Measured on Alexa: broker registered, RTP
+	* arriving, key frame arriving, black screen, on a chain healthy at every
+	* other point.
+	*
+	* Same idea the transport already applies to CALLS, where `classifyCapRoute`
+	* gives priority to `hub-in-process` so a local call never leaves the node.
+	* This is that rule for media.
+	*/
+	publishLocally: boolean().optional(),
 	pixelFormat: _enum(["yuv420p", "nv12"]).optional(),
 	/**
 	* Operator/consumer override for decode hardware. ABSENT is the normal case
@@ -9347,7 +9473,13 @@ var EgressTranscodeSchema = object({
 	* Returned rather than assumed: a consumer that asked for hardware and got
 	* software needs to be able to see that without reading the broker's logs.
 	*/
-	decodeHwAccel: string().nullable()
+	decodeHwAccel: string().nullable(),
+	/**
+	* Set when `publishLocally` was honoured: attach to THIS instead of dialling
+	* `url`, and the session takes the push/deframe transport rather than the
+	* RTP-passthrough one. `null` means the consumer must dial.
+	*/
+	camStreamId: string().nullable()
 });
 method(object({
 	deviceId: number().int().nonnegative(),
@@ -9495,7 +9627,25 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ brokerId: string() }), boolean()), object({
+}), method(object({ brokerId: string() }), boolean()), method(object({ deviceId: number().int() }), object({
+	muted: boolean(),
+	/**
+	* How many live non-derived brokers currently hold the mute. Purely
+	* diagnostic: `muted` is the policy and is authoritative on its own
+	* (it applies to brokers that do not exist yet), while this says
+	* whether anything is presently being silenced.
+	*/
+	appliedBrokers: number().int().nonnegative()
+})), method(object({
+	deviceId: number().int(),
+	muted: boolean()
+}), object({
+	muted: boolean(),
+	appliedBrokers: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), object({
 	deviceId: number().int().nonnegative(),
 	camStreamId: string(),
 	profile: CamProfileSchema
@@ -15451,6 +15601,30 @@ var TrackSourceSchema = _enum([
 	"audio"
 ]);
 /**
+* Where a track sits in the RETRAIN lifecycle (D81).
+*
+*  - `none` — never marked, or un-marked. Evictable.
+*  - `staging` — the operator wants this track as training material and has not
+*    finished with it. **This is the only state retention holds**: the track and
+*    everything it owns (object events, crops, keyframes, CLIP vector) survive
+*    the device's age window.
+*  - `trained` — the retrain page has taken what it needed. The frames it chose
+*    were COPIED into the retrain dataset at selection time, so the dataset no
+*    longer depends on the track's media and the track becomes EVICTABLE again.
+*    Terminal for the plain `markForTrain` toggle: returning it to `staging` is
+*    a deliberate action of the retrain page, not a side effect of a checkbox.
+*
+* There is no `null`. The state is stored `TEXT NOT NULL DEFAULT 'none'` because
+* the store's filter language has only positive equality and `whereIn` — no
+* negation, no IS NULL — so a NULL would be unselectable by ANY predicate and
+* would make the entire pre-column history immortal in one deploy.
+*/
+var RetrainStatusSchema = _enum([
+	"none",
+	"staging",
+	"trained"
+]);
+/**
 * Per-track OPERATOR flags — set by hand from the admin UI or the viewer, never
 * by the pipeline. Spread into `TrackSchema` and `KeyEventSchema` from one place
 * so the two surfaces cannot drift.
@@ -15460,18 +15634,31 @@ var TrackSourceSchema = _enum([
 * columns existed read as absent, and a consumer that needs a boolean should say
 * `flag === true`, not `flag !== false`.
 *
-* What the flags DO is deliberately UNDEFINED at the time of writing: they are
-* operator curation, and the behaviour they drive will be specified separately.
-* In particular a `markForTrain` track is NOT pinned against retention — see
-* `docs/decisions/adr-0059.md` for why that is a store-level change, not a flag.
+* `markForTrain` is the WIRE FACE of {@link RetrainStatusSchema}, not a column:
+* it is exactly `retrainStatus === 'staging'`, in both directions. Writing
+* `true` moves `none → staging`, writing `false` moves `staging → none`, and a
+* `trained` track reports `false` while refusing both writes. The boolean is
+* kept because three surfaces drive a toggle off it; anything that needs to tell
+* "never marked" from "already trained" must read `retrainStatus`.
+*
+* `debug` does NOT pin; it is attention, not durability.
 */
 var TrackFlagFields = {
-	/** Operator marked this track as training material. */
+	/** Operator marked this track as training material — i.e. `retrainStatus` is
+	*  `'staging'`. */
 	markForTrain: boolean().optional(),
 	/** Operator marked this track for diagnostic attention. */
 	debug: boolean().optional()
 };
 /**
+* The lifecycle field itself, on the READ surfaces only (`Track`, `KeyEvent`).
+* Deliberately NOT part of {@link TrackFlagFields}: that group also builds the
+* write patch, and the status is not something the toggle sets — it is what the
+* toggle's boolean is derived from. Absent on an in-RAM track never touched;
+* always present on a persisted row (the column default materialises `'none'`).
+*/
+var TrackRetrainFields = { retrainStatus: RetrainStatusSchema.optional() };
+/**
 * The write half: a PARTIAL patch. An omitted key is left untouched, so setting
 * one flag can never clear the other — the toggles are independent and are
 * driven from three surfaces that do not know about each other.
@@ -15485,7 +15672,32 @@ var TrackFlagsPatchSchema = object(TrackFlagFields);
 var TrackFlagsSchema = object({
 	trackId: string(),
 	markForTrain: boolean(),
-	debug: boolean()
+	debug: boolean(),
+	/** The lifecycle state the boolean was derived from. Required here (unlike on
+	*  a track row) because this shape is only ever produced by the write body,
+	*  which always knows it — and a surface that has just written needs to render
+	*  `trained` without a re-fetch. */
+	retrainStatus: RetrainStatusSchema
+});
+/** Per-camera slice of a training-export estimate. */
+var TrainingExportDeviceTotalsSchema = object({
+	deviceId: number(),
+	tracks: number().int(),
+	files: number().int(),
+	bytes: number().int()
+});
+/**
+* What a training export WOULD contain. Computed from media index rows only —
+* no blob is read to produce this.
+*/
+var TrainingExportSummarySchema = object({
+	generatedAt: number(),
+	trackCount: number().int(),
+	fileCount: number().int(),
+	byteCount: number().int(),
+	/** More marked tracks exist than a single pass carries. */
+	truncated: boolean(),
+	devices: array(TrainingExportDeviceTotalsSchema).readonly()
 });
 var TrackSchema = object({
 	trackId: string(),
@@ -15530,7 +15742,8 @@ var TrackSchema = object({
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
 	envelope: TrackEnvelopeSchema.optional(),
-	...TrackFlagFields
+	...TrackFlagFields,
+	...TrackRetrainFields
 });
 var BaseEventFields = {
 	id: string(),
@@ -15744,7 +15957,8 @@ var KeyEventSchema = object({
 	bestEventId: string(),
 	/** Track lifetime in ms (lastSeen - firstSeen). */
 	windowMs: number().optional(),
-	...TrackFlagFields
+	...TrackFlagFields,
+	...TrackRetrainFields
 });
 object({
 	trackId: string(),
@@ -16106,11 +16320,29 @@ var pipelineAnalyticsCapability = {
 		*
 		* `auth: 'protected'` (the default), NOT `admin`: the viewer is an
 		* authenticated non-admin surface and two of the three call sites are
-		* there. Revisit if a flag ever gains an effect that costs storage —
-		* `deleteTracks` next door is admin for exactly that reason.
+		* there. The note that used to sit here said to revisit this the day a flag
+		* gained an effect that costs storage, and D81 is that day — `markForTrain`
+		* now pins. It STAYS protected, and the reason is that the alternative
+		* makes the feature pointless: marking a track is something you do while
+		* looking at it, on the surface you were already looking at it on, and that
+		* surface is the viewer. What the storage cost gets instead is a BOUND — a
+		* per-device pin budget enforced in the body, refusing a new pin past the
+		* limit while always allowing un-marking. `deleteTracks` next door is still
+		* admin, because destroying evidence and preserving it are not symmetric.
+		*
+		* `markForTrain` writes the retrain LIFECYCLE, not a boolean column: `true`
+		* is `none → staging`, `false` is `staging → none`. A track already
+		* `trained` refuses BOTH — its frames are copies inside the retrain dataset
+		* and re-staging it from a generic toggle is how the same material gets
+		* annotated twice under two ground truths. Returning a trained track to
+		* staging is a deliberate action of the retrain page, which is also the only
+		* thing that produces `trained` in the first place.
 		*
-		* Returns the RESOLVED state of both flags (absent → `false`) so a caller
-		* can drive its toggle without a re-fetch. Rejects an unknown track.
+		* Returns the RESOLVED state of both flags (absent → `false`) plus the
+		* `retrainStatus` they were derived from, so a caller can drive its toggle
+		* — and render a `trained` badge — without a re-fetch. Rejects an unknown
+		* track, a new staging mark on a device already holding its full budget, and
+		* any `markForTrain` write against a trained track.
 		*/
 		setTrackFlags: method(object({
 			/** Log/audit scope only — the trackId is globally unique on its own. */
@@ -16174,6 +16406,42 @@ var pipelineAnalyticsCapability = {
 			kind: "query",
 			auth: "admin"
 		}),
+		/**
+		* The CHEAP QUESTION, asked before any media moves: how big is the dataset
+		* the marked (`markForTrain`) tracks would produce?
+		*
+		* Answered from media INDEX rows only — key, kind, size, timestamp — so it
+		* costs ~2 KB of reads per track and no blob reads at all. The measured harm
+		* behind D56 was a bulk pass that read and base64'd every blob a track owned
+		* before deciding anything, taking hub-main to 82 s busy out of 120; an
+		* export is that same I/O shape, so it inherits the same discipline: know
+		* the size, then decide.
+		*
+		* `truncated` reports that more marked tracks exist than one pass carries.
+		* Empty `deviceIds` ⇒ every device that has marked tracks.
+		*/
+		getTrainingExportSummary: method(object({ deviceIds: array(number()).optional() }), TrainingExportSummarySchema, {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* Where to download the dataset archive.
+		*
+		* The BYTES do not come back through this cap — they come from the returned
+		* data-plane URL, which streams a tar built entry by entry. A multi-gigabyte
+		* archive base64'd through a unary RPC envelope would be held whole in
+		* memory twice on a hub this repo has already OOM'd once (D9/D18 are the
+		* same lesson about frames). `getDownloadUrl` on `recordingExport` is the
+		* precedent, and this follows it deliberately.
+		*
+		* The archive contains a `manifest.json` FIRST, then the stored media
+		* VERBATIM under `tracks/<deviceId>/<trackId>/…`. No crop is derived and no
+		* model is run: a training set's pixels must be the pixels the pipeline saw.
+		*/
+		getTrainingExportUrl: method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
+			kind: "query",
+			auth: "admin"
+		}),
 		getEventMedia: method(object({
 			eventId: string(),
 			kind: MediaFileKindEnum.optional()
@@ -18106,9 +18374,15 @@ DeviceType.Camera, method(object({
 	* Bypass the cache freshness check and fetch directly from the
 	* native (or stream-broker fallback). Triggered by the UI's
 	* "refresh" button so an operator can force a fresh frame
-	* even when the cache is well within `snapshotMaxAgeMs`.
-	* On battery cams this WILL wake the camera — accept the
-	* cost only when the user explicitly asks for it.
+	* even when the cache is well within the device's
+	* `snapshotMaxAgeS` window.
+	*
+	* **`force` is an OPERATOR signal, not a freshness preference.** On a
+	* battery camera it is the one thing that walks past the wrapper's
+	* sleep gate and wakes the camera, so a background caller — a poller,
+	* an event handler, a thumbnail — must NEVER set it. Every such caller
+	* gets the cached frame, which on a sleeping battery camera is the
+	* correct answer: stale but honest beats woken.
 	*/
 	force: boolean().optional()
 }), SnapshotImageSchema.nullable()), method(object({ deviceId: number() }), _void(), {
@@ -23000,6 +23274,173 @@ DeviceType.Camera, method(object({
 	status: OsdStatusSchema
 });
 /**
+* `osd-manager` — the ORCHESTRATOR over the device-scope `osd` cap.
+*
+* The `osd` cap is the firmware contract: it probes a camera's overlay
+* SLOTS and writes literal text into one. It has no idea WHERE that text
+* comes from, and it must not — a driver that grew a "show the temperature
+* here" feature would grow it once per vendor.
+*
+* This cap owns the other half: a per-(camera, slot) BINDING that says
+* which value feeds the slot, how it is formatted, and under which
+* conditions it is shown at all. One addon renders every binding on every
+* camera, so a new source costs zero driver code.
+*
+* Three deliberate choices, each with a rejected alternative:
+*
+*  1. A source is `(capName, valuePath)` over the kernel's device
+*     runtime-state mirror — NOT a closed enum of source kinds. Every
+*     cap-keyed slice a device publishes is bindable the day the cap
+*     ships. The rejected alternative (one enum member per source, with
+*     a resolver branch each) is what makes "add the humidity too" a
+*     code change.
+*  2. The display gate reuses `NcConditionsSchema` verbatim — the
+*     notification centre's condition vocabulary — rather than a parallel
+*     model. An operator who has learned one condition editor has learned
+*     both.
+*  3. Because the renderer's facts are device STATE and not a detection
+*     record, only a SUBSET of that vocabulary can be answered here.
+*     `setSlotBinding` REJECTS the rest at write time (see
+*     `getConditionSupport`). It does not accept-then-fail-closed: a
+*     condition that can never be true renders a permanently blank
+*     overlay, and a blank overlay looks exactly like a broken camera.
+*/
+/** Where a slot's value comes from. */
+var OsdSourceSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("static"),
+		text: string().max(64)
+	}),
+	object({
+		kind: literal("clock"),
+		/** Token pattern: `YYYY MM DD HH mm ss`. Everything else is literal. */
+		pattern: string().min(1).max(32).default("HH:mm"),
+		/** IANA zone. Omitted = the server's zone. */
+		timezone: string().min(1).max(64).optional()
+	}),
+	object({
+		kind: literal("device-state"),
+		deviceId: number().int().optional(),
+		capName: string().min(1).max(64),
+		/** Dot path inside the slice, e.g. `detected`, `value`, `mode`. */
+		valuePath: string().min(1).max(64)
+	})
+]);
+var OsdSlotBindingSchema = object({
+	/** Off = the manager stops driving this slot. It does NOT clear it. */
+	enabled: boolean().default(true),
+	source: OsdSourceSchema,
+	/** `${value}` and `${unit}` are substituted; every occurrence. */
+	template: string().max(96).default("${value}"),
+	/** Truncate with an ellipsis past this length. Absent = no limit. */
+	maxCharacters: number().int().min(4).max(64).optional(),
+	/**
+	* Decimal places for a numeric value. `0` yields an integer — the
+	* documented workaround for firmwares that reject `.` in overlay text.
+	*/
+	maxDecimals: number().int().min(0).max(4).default(1),
+	/** Appended via `${unit}`. The state mirror does not carry units. */
+	unitLabel: string().max(8).optional(),
+	/** Raw value → display text, e.g. `{"true":"MOTION","false":""}`. */
+	valueMap: record(string(), string()).optional(),
+	/** Time windows in which the slot is shown. Absent = always. */
+	schedule: NcScheduleSchema.optional(),
+	/**
+	* Display gate, in the notification centre's condition vocabulary.
+	* Only the keys reported by `getConditionSupport` are accepted.
+	*/
+	conditions: NcConditionsSchema.optional(),
+	/** Rendered when the gate is closed or the value unreadable. Empty = hide. */
+	fallbackText: string().max(64).default("")
+});
+/** One camera slot, as the operator sees it: firmware truth + our binding. */
+var OsdSlotViewSchema = object({
+	slotId: string(),
+	kind: OsdOverlayKindEnum,
+	/** Firmware refuses text edits (a timestamp, the channel name). */
+	readOnly: boolean(),
+	cameraEnabled: boolean(),
+	cameraText: string().optional(),
+	binding: OsdSlotBindingSchema.nullable()
+});
+/**
+* What happened to one slot on one render pass. `unchanged` exists so the
+* operator can tell "we are driving this and the value is steady" from
+* "we never got there" — and so the loop can prove it is not rewriting
+* identical text to the camera every tick.
+*/
+var OsdRenderOutcomeEnum = _enum([
+	"written",
+	"unchanged",
+	"gated",
+	"unreadable",
+	"disabled",
+	"unbound",
+	"failed"
+]);
+var OsdRenderResultSchema = object({
+	slotId: string(),
+	outcome: OsdRenderOutcomeEnum,
+	/** The text the slot should carry. Empty = the slot is switched off. */
+	text: string(),
+	/** Why, whenever the outcome is not a plain write. Never silent. */
+	reason: string().optional()
+});
+var OsdSourceValueTypeEnum = _enum([
+	"number",
+	"boolean",
+	"string",
+	"enum"
+]);
+/**
+* One bindable value, derived from a cap's `runtimeState` schema — never
+* hand-listed. The editor renders from this, so a cap that ships a new
+* state field becomes bindable with no UI change.
+*/
+var OsdSourceOptionSchema = object({
+	deviceId: number().int(),
+	deviceName: string(),
+	capName: string(),
+	valuePath: string(),
+	label: string(),
+	valueType: OsdSourceValueTypeEnum,
+	/** Present for `enum`; the editor offers these as `valueMap` keys. */
+	enumValues: array(string()).readonly().optional()
+});
+method(object({ deviceId: number().int() }), object({
+	supported: boolean(),
+	slots: array(OsdSlotViewSchema)
+}), { auth: "admin" }), method(object({ deviceId: number().int() }), object({ sources: array(OsdSourceOptionSchema) }), { auth: "admin" }), method(object({}), object({
+	supported: array(string()),
+	catalog: array(NcConditionDescriptorSchema)
+}), { auth: "admin" }), method(object({
+	deviceId: number().int(),
+	slotId: string().min(1),
+	binding: OsdSlotBindingSchema
+}), object({
+	slot: OsdSlotViewSchema,
+	render: OsdRenderResultSchema
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int(),
+	slotId: string().min(1)
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int(),
+	slotId: string().min(1),
+	binding: OsdSlotBindingSchema.optional()
+}), OsdRenderResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int() }), object({ results: array(OsdRenderResultSchema) }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * Feeder connectivity / power status — mirrors the HA petkit device-status
 * enum: `normal` (online, mains), `offline` (not reaching PetKit cloud),
 * `on_batteries` (running on battery backup). `null` until first reported.
@@ -23590,12 +24031,30 @@ var pressureSensorCapability = {
 	runtimeState: PressureSensorStatusSchema
 };
 /**
-* Privacy mask = up to `maxRegions` SHAPES the camera blanks out (NOT a
-* cell grid). Reolink `<shelterList>` zones are rectangles; Hikvision
-* ISAPI `<RegionCoordinatesList>` zones are free polygons (this camera:
-* exactly 4 vertices, not necessarily axis-aligned). The cap composes the
-* shared rect|polygon subset of the MaskShape vocabulary. All coords are
-* normalized 0..1 (top-left origin).
+* PRIVACY — what the camera deliberately does not capture. Two planes:
+*
+*  - **video**: up to `maxRegions` SHAPES the camera blanks out (NOT a cell
+*    grid). Reolink `<shelterList>` zones are rectangles; Hikvision ISAPI
+*    `<RegionCoordinatesList>` zones are free polygons (this camera: exactly
+*    4 vertices, not necessarily axis-aligned). The cap composes the shared
+*    rect|polygon subset of the MaskShape vocabulary. All coords are
+*    normalized 0..1 (top-left origin).
+*  - **audio**: the camera's microphone. `setAudioEnabled(false)` stops the
+*    camera encoding an audio track at all, so EVERY consumer — live view,
+*    recording, the audio analyzer, an export — sees silent video. There is
+*    no server-side copy of this fact; the camera is the store and every read
+*    is a read-through, which is why a switch over it cannot drift
+*    ([D62](../../../../docs/decisions/adr-0062.md)).
+*
+* Both belong here for one reason: they are the two things an operator turns
+* off when the answer to "what is this camera allowed to record" changes, and
+* both are applied ON the device, before anything leaves it.
+*
+* **The audio flag has exactly one writer.** `stream-params` used to carry a
+* per-profile `audio` in its patch schema — reachable from no UI and honoured
+* by one provider — and it was removed when this landed. A second writer onto
+* one device register is the shape of every knob this repo has shipped that
+* disagreed with the one the reader read.
 */
 /** A privacy-mask region's geometry — rectangle or free polygon. */
 var PrivacyMaskShapeSchema = discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
@@ -23607,21 +24066,45 @@ var PrivacyMaskRegionSchema = object({
 	enabled: boolean(),
 	shape: PrivacyMaskShapeSchema
 });
-/** Current on-camera privacy-mask state — master enable + zones. */
+/** Current on-camera privacy state — mask master enable + zones + microphone. */
 var PrivacyMaskStatusSchema = object({
 	enabled: boolean(),
 	/** Active zones (normalized 0..1). Length ≤ maxRegions. */
 	regions: array(PrivacyMaskRegionSchema),
+	/**
+	* Is the camera capturing sound right now? Read from the camera, never from
+	* a server-side mirror.
+	*
+	* `null` means "no answer" — either this camera exposes no controllable
+	* microphone (`getOptions().supportsAudioMute === false`) or the read
+	* failed. A consumer must render `null` as UNKNOWN and never as `false`:
+	* "the microphone is off" and "we could not ask" look identical to an
+	* operator only until one of them is wrong.
+	*
+	* On a camera whose profiles carry the flag independently (Reolink writes
+	* it per stream), `true` means AT LEAST ONE profile still carries audio —
+	* privacy is only satisfied when every one of them is silent.
+	*/
+	audioEnabled: boolean().nullable(),
 	lastFetchedAt: number()
 });
-/** Per-camera availability. */
+/** Per-camera availability. Probed, never assumed from the model name. */
 var PrivacyMaskOptionsSchema = object({
 	/** Maximum number of supported zones. */
 	maxRegions: number(),
 	/** Shape kinds this camera accepts — Reolink: ['rect']; Hikvision: ['rect','polygon']. */
 	supportedShapes: array(MaskShapeKindSchema),
 	/** Polygon vertex bounds when 'polygon' is supported (Hikvision: {min:4,max:4}). */
-	polygonVertices: MaskPolygonVerticesSchema.optional()
+	polygonVertices: MaskPolygonVerticesSchema.optional(),
+	/**
+	* Does this camera expose a microphone switch we can actually write?
+	*
+	* Camera-probed: `true` only when the firmware answered with an audio flag
+	* we know how to patch. A camera that never answered is `false` — a control
+	* the operator can press that changes nothing is worse than no control, and
+	* the switch group renders "not available" instead.
+	*/
+	supportsAudioMute: boolean()
 });
 /** Partial change — every field optional. */
 var PrivacyMaskPatchSchema = object({
@@ -23648,6 +24131,27 @@ var privacyMaskCapability = {
 		}), _void(), {
 			kind: "mutation",
 			auth: "admin"
+		}),
+		/**
+		* Turn the camera's microphone on or off, at the camera.
+		*
+		* Deliberately its OWN mutation rather than a field on
+		* {@link PrivacyMaskPatchSchema}: `patch.enabled` already means "the video
+		* mask master switch", and overloading it would make one boolean mean two
+		* unrelated things on the same call. It is also the only method here whose
+		* write leaves the device in a state a later `getStatus` reads back
+		* verbatim, which is what makes it safe as a switch authority.
+		*
+		* A camera whose `getOptions().supportsAudioMute` is false must REJECT
+		* this rather than silently accept it — a write nothing applies is exactly
+		* what the switch group exists to remove.
+		*/
+		setAudioEnabled: method(object({
+			deviceId: number(),
+			enabled: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
 		})
 	},
 	status: {
@@ -23930,6 +24434,21 @@ var LocateSegmentResultSchema = discriminatedUnion("kind", [object({
 })]);
 /** Raw bytes of one finalized footage segment (read off disk on the recording node). */
 var ReadSegmentBytesResultSchema = object({ data: _instanceof(Uint8Array) });
+/**
+* One GOP of a finalized segment, cut by byte range through the segment's own
+* `mfra` (D31 on the D42 feeder path). `data` is the `ftyp`+`moov` head plus
+* the single `moof`+`mdat` covering the requested instant — standalone-
+* demuxable, never the whole file. When the segment's index cannot be parsed
+* the provider degrades INSIDE the mechanism to the whole segment (still one
+* `data`, `gopStartMs` = the segment start) — a worse read, not another path.
+*/
+var ReadGopBytesResultSchema = object({
+	data: _instanceof(Uint8Array),
+	/** Absolute epoch ms of the returned fragment's first sample. */
+	gopStartMs: number(),
+	/** Media ms the returned fragment covers. */
+	gopDurMs: number()
+});
 method(object({
 	deviceId: number(),
 	fromMs: number(),
@@ -23972,6 +24491,14 @@ method(object({
 }), ReadSegmentBytesResultSchema, {
 	kind: "query",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	profile: string(),
+	startMs: number(),
+	epochMs: number()
+}), ReadGopBytesResultSchema, {
+	kind: "query",
+	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	config: RecordingConfigSchema
@@ -24531,6 +25058,16 @@ var StreamProfileConfigSchema = object({
 		"baseline"
 	]).optional(),
 	gop: number().optional(),
+	/**
+	* Whether THIS profile currently carries an audio track. READ-ONLY here.
+	*
+	* There is no matching field on {@link StreamProfilePatchSchema}: the
+	* camera's microphone is owned by `privacy-mask` (`setAudioEnabled`), which
+	* writes every profile at once so "audio off" means silent everywhere. A
+	* per-profile writer beside it would let a camera be half-muted and would be
+	* a second knob onto one device register — the failure D62 exists to
+	* prevent. Absent when the firmware does not report the flag.
+	*/
 	audio: boolean().optional()
 });
 var StreamParamsStatusSchema = object({
@@ -24571,7 +25108,13 @@ var StreamParamsOptionsSchema = object({
 	ext: StreamProfileOptionsSchema.optional()
 });
 /** A partial change to one profile — every field optional; a provider
-*  ignores fields it doesn't support. */
+*  ignores fields it doesn't support.
+*
+*  There is deliberately NO `audio` here. It existed until 2026-08-07,
+*  reachable from no form and honoured by exactly one provider, while the
+*  camera's microphone is a whole-device fact. It now has one writer,
+*  `privacyMask.setAudioEnabled`, which writes every profile — see
+*  `privacy-mask.cap.ts`. */
 var StreamProfilePatchSchema = object({
 	width: number().optional(),
 	height: number().optional(),
@@ -24584,8 +25127,7 @@ var StreamProfilePatchSchema = object({
 		"main",
 		"baseline"
 	]).optional(),
-	gop: number().optional(),
-	audio: boolean().optional()
+	gop: number().optional()
 });
 var streamParamsCapability = {
 	name: "stream-params",
@@ -29399,6 +29941,48 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"osdManager.clearSlotBinding": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"osdManager.getConditionSupport": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"osdManager.getDeviceOsd": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"osdManager.getSourceCatalog": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"osdManager.previewSlot": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"osdManager.renderDevice": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"osdManager.setSlotBinding": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"petFeeder.callPet": {
 		capName: "pet-feeder",
 		capScope: "device",
@@ -29561,6 +30145,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getTrainingExportSummary": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.getTrainingExportUrl": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listEventKinds": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -30317,6 +30913,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"privacyMask.setAudioEnabled": {
+		capName: "privacy-mask",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"privacyMask.setMask": {
 		capName: "privacy-mask",
 		capScope: "device",
@@ -30485,6 +31087,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.readGopBytes": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.readSegmentBytes": {
 		capName: "recording",
 		capScope: "system",
@@ -31025,6 +31633,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"streamBroker.getDeviceAudioMute": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"streamBroker.getPreBufferInfo": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -31145,6 +31759,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.setDeviceAudioMute": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.setPreBufferDuration": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -31792,6 +32412,66 @@ Object.freeze({
 	"smtp-provider": "email"
 });
 new Set(["devices", "classes"]);
+var WEEKDAY_TO_DAY = {
+	Sun: 0,
+	Mon: 1,
+	Tue: 2,
+	Wed: 3,
+	Thu: 4,
+	Fri: 5,
+	Sat: 6
+};
+/** Resolve (weekday, minute-of-day) of `atMs` in the schedule's timezone.
+*  An invalid/unknown IANA name falls back to the host timezone. */
+function localDayMinute(atMs, timezone) {
+	const d = new Date(atMs);
+	if (timezone !== void 0) try {
+		const parts = new Intl.DateTimeFormat("en-US", {
+			timeZone: timezone,
+			weekday: "short",
+			hour: "numeric",
+			minute: "numeric",
+			hourCycle: "h23"
+		}).formatToParts(d);
+		let weekday;
+		let hour;
+		let minute;
+		for (const p of parts) if (p.type === "weekday") weekday = p.value;
+		else if (p.type === "hour") hour = Number(p.value);
+		else if (p.type === "minute") minute = Number(p.value);
+		const day = weekday !== void 0 ? WEEKDAY_TO_DAY[weekday] : void 0;
+		if (day !== void 0 && hour !== void 0 && minute !== void 0) return {
+			day,
+			minute: hour * 60 + minute
+		};
+	} catch {}
+	return {
+		day: d.getDay(),
+		minute: d.getHours() * 60 + d.getMinutes()
+	};
+}
+/**
+* Is the schedule active at `atMs`? No schedule = always active. Windows
+* are OR'd; a window with `startMinute > endMinute` crosses midnight (it
+* starts on a listed day and spills into the next). `invert` flips the
+* result (active OUTSIDE the windows).
+*/
+function isScheduleActive(schedule, atMs) {
+	if (schedule === void 0) return true;
+	const { day, minute } = localDayMinute(atMs, schedule.timezone);
+	const prevDay = (day + 6) % 7;
+	let inside = false;
+	for (const w of schedule.windows) if (w.startMinute <= w.endMinute) {
+		if (w.days.includes(day) && minute >= w.startMinute && minute < w.endMinute) {
+			inside = true;
+			break;
+		}
+	} else if (w.days.includes(day) && minute >= w.startMinute || w.days.includes(prevDay) && minute < w.endMinute) {
+		inside = true;
+		break;
+	}
+	return schedule.invert === true ? !inside : inside;
+}
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -31951,5 +32631,87 @@ object({
 	paddingRatio: .15,
 	square: false
 }).paddingRatio;
+/**
+* WHICH delivered frames the decode worker retains a native copy of.
+*
+* - `all` — every frame the worker delivered to the runner. The shipped
+*   behaviour, and the only correct one if something can ask for a crop of a
+*   frame the runner never sent to inference.
+* - `inferred` — only the frames the runner ADMITTED to its detection queue.
+*   A native-crop request always names a `frameId` that rode an inference
+*   result, so that is the only set a request can name. How much it drops is
+*   the two-plane governor's admit ratio and nothing else: measured at ~50% on
+*   this cluster, not the ~80% the design sketch assumed, because the governor
+*   was not throttling as hard as the sketch supposed. Read
+*   `leaseAdmitted`/`leaseOffered` off the metrics line for the camera in front
+*   of you rather than quoting a number from here. The newest delivered frame is
+*   croppable regardless — it is still the worker's reserved slot, not a lease —
+*   which covers the one-frame race between a mark and the supersede that
+*   consumes it.
+*/
+var NativeLeaseAdmissionSchema = _enum(["all", "inferred"]);
+object({
+	/**
+	* How long a retained native frame is served before it counts as a miss.
+	*
+	* Must cover the FULL late-crop horizon: detection inference + the
+	* cross-process inference-result hop to hub post-analysis + tracking + the
+	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
+	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
+	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	*/
+	ttlMs: number().int().min(250).max(1e4),
+	/**
+	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
+	*
+	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
+	* which one is actually binding before reasoning from that. At the shipped
+	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
+	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
+	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
+	* change that admits fewer frames buys retention WINDOW at constant RAM
+	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* `0` DISABLES the lease entirely and falls the worker back to the tiny
+	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
+	* to replace).
+	*/
+	budgetMb: number().int().min(0).max(4096),
+	/**
+	* Demand window: eager per-frame native retention runs only within this many
+	* ms of the last native-crop request (or of the dial starting).
+	*
+	* `0` means ALWAYS ON — it disables the gate, it does not disable retention.
+	* That is the legacy behaviour that saturated an N100 (24 native-4K downloads
+	* per second on a camera with zero crop demand), so leave it non-zero unless
+	* you are reproducing that.
+	*/
+	activityMs: number().int().min(0).max(12e4),
+	/**
+	* Which delivered frames are retained at all — see
+	* {@link NativeLeaseAdmissionSchema}. This is the only knob of the four that
+	* changes WHAT is kept rather than for how long, so it is also the only one
+	* that can turn a crop that used to hit into a miss. The worker counts every
+	* crop request naming a frame it did NOT see marked
+	* (`leaseUnmarkedCrops` on the session-decode metrics line): a non-zero value
+	* there is the signal that some caller names frames outside the inference set
+	* and that this must go back to `all`.
+	*/
+	admission: NativeLeaseAdmissionSchema
+});
+/**
+* The values in force when the operator has set nothing — byte-for-byte the
+* constants the decode worker shipped with as env-var defaults, so making these
+* settings changed no behaviour on the day it landed.
+*/
+var DEFAULT_NATIVE_LEASE_SETTINGS = {
+	ttlMs: 1200,
+	budgetMb: 1024,
+	activityMs: 15e3,
+	admission: "inferred"
+};
+DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
+DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 //#endregion
-export { object as $, hfModelUrl as A, errMsg as B, buildEventKindDescriptor as C, embeddingEncoderCapability as D, defineCustomActions as E, readDeviceStateFrom as F, isDeviceScopedCap as G, DeviceType as H, subKindsOf as I, _enum as J, nodePin as K, vectorDimFromBase64 as L, notificationRulesCapability as M, pipelineAnalyticsCapability as N, encodeVectorBase64 as O, plateGalleryCapability as P, number as Q, videoclipsCapability as R, audioMetricsCapability as S, customAction as T, createEvent as U, BaseAddon as V, hydrateSchema as W, boolean as X, array as Y, literal as Z, TimelapseRuleInputSchema as _, MACRO_LABELS as a, addonWidgetsSourceCapability as b, NcConditionDescriptorSchema as c, NcRuleSchema as d, record as et, NcSnoozeInputSchema as f, OpsLogEntrySchema as g, NcTaxonomySchema as h, EVENT_PAD_MS as i, kebabToCamel as j, faceGalleryCapability as k, NcRuleInputSchema as l, NcSnoozeSuppressedSchema as m, DEFAULT_EVENT_COLOR as n, unknown as nt, NC_CONDITION_CATALOG as o, NcSnoozeSchema as p, sleep as q, EVENT_KIND_BY_CAP as r, EventCategory as rt, NC_TAXONOMY as s, BaseDevice as t, string as tt, NcRulePatchSchema as u, TimelapseRuleSchema as v, cosineSimilarity as w, alarmPanelCapability as x, TrackSourceSchema as y, zoneAnalyticsCapability as z };
+export { literal as $, faceGalleryCapability as A, videoclipsCapability as B, audioMetricsCapability as C, defineCustomActions as D, customAction as E, pipelineAnalyticsCapability as F, createEvent as G, errMsg as H, plateGalleryCapability as I, nodePin as J, hydrateSchema as K, readDeviceStateFrom as L, isScheduleActive as M, kebabToCamel as N, embeddingEncoderCapability as O, notificationRulesCapability as P, boolean as Q, subKindsOf as R, alarmPanelCapability as S, cosineSimilarity as T, BaseAddon as U, zoneAnalyticsCapability as V, DeviceType as W, _enum as X, sleep as Y, array as Z, RetrainStatusSchema as _, MACRO_LABELS as a, EventCategory as at, TrackSourceSchema as b, NcConditionDescriptorSchema as c, NcRuleSchema as d, number as et, NcSnoozeInputSchema as f, OpsLogEntrySchema as g, NcTaxonomySchema as h, EVENT_PAD_MS as i, unknown as it, hfModelUrl as j, encodeVectorBase64 as k, NcRuleInputSchema as l, NcSnoozeSuppressedSchema as m, DEFAULT_EVENT_COLOR as n, record as nt, NC_CONDITION_CATALOG as o, NcSnoozeSchema as p, isDeviceScopedCap as q, EVENT_KIND_BY_CAP as r, string as rt, NC_TAXONOMY as s, BaseDevice as t, object as tt, NcRulePatchSchema as u, TimelapseRuleInputSchema as v, buildEventKindDescriptor as w, addonWidgetsSourceCapability as x, TimelapseRuleSchema as y, vectorDimFromBase64 as z };