@camstack/addon-provider-reolink 1.2.18 → 1.2.19

package/dist/addon.js

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
 const require_chunk_MZUSWKF3 = require("./chunk-MZUSWKF3-CwIAby8V.js");
+let node_crypto = require("node:crypto");
 let events = require("events");
 let fs = require("fs");
 fs = require_chunk.__toESM(fs, 1);
@@ -9,7 +10,6 @@ path = require_chunk.__toESM(path, 1);
 let crypto$1 = require("crypto");
 crypto$1 = require_chunk.__toESM(crypto$1, 1);
 let child_process = require("child_process");
-let node_crypto = require("node:crypto");
 let stream = require("stream");
 let util = require("util");
 let dgram = require("dgram");
@@ -6999,6 +6999,14 @@ var EncodeProfileSchema = object({
 			"main",
 			"high"
 		]).optional(),
+		/**
+		* `-level`, e.g. `'3.1'`. A consumer that ADVERTISES a level in its SDP
+		* (`profile-level-id=42e01f` is Baseline 3.1) must constrain the encoder to
+		* it, or it ships a stream that does not match its own advertisement — the
+		* defect class that kept HomeKit black for a year and that Alexa carried
+		* silently. Optional because a browser negotiates the level itself.
+		*/
+		level: string().optional(),
 		width: number().int().positive().optional(),
 		height: number().int().positive().optional(),
 		fps: number().positive().optional(),
@@ -7046,6 +7054,29 @@ var EncodeProfileSchema = object({
 	outputArgs: array(string()).optional()
 });
 /**
+* The shape every live egress starts from: H.264 Baseline 3.1 at 720p25.
+* Baseline because it is the one profile every consumer in this repo decodes
+* (Echo, iOS, an old browser); 3.1 because that is what the SDPs advertise.
+*/
+var BASE_LIVE_EGRESS_PROFILE = {
+	video: {
+		codec: "h264",
+		profile: "baseline",
+		level: "3.1",
+		width: 1280,
+		height: 720,
+		fps: 25,
+		bitrateKbps: 2500,
+		gopFrames: 25,
+		bf: 0,
+		preset: "veryfast",
+		tune: "zerolatency"
+	},
+	audio: "passthrough"
+};
+({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
+({ ...BASE_LIVE_EGRESS_PROFILE });
+/**
 * Deep wiring healthcheck — snapshot of active reachability probes across
 * every declared capability + widget of every installed plugin, on every
 * node. Produced by the backend `WiringHealthService` and surfaced via
@@ -7095,6 +7126,154 @@ object({
 	})
 });
 /**
+* Per-camera FUNCTION SWITCHES — the one coherent on/off surface over the
+* pipeline functions an operator thinks in terms of.
+*
+* ## This file adds no state
+*
+* Every switch here is a VIEW onto an authority that already existed
+* ([D62](../../../../docs/decisions/adr-0062.md)). The whole point of the
+* group is that there is exactly one place each function is turned off, and
+* the group routes to it:
+*
+* | Switch | Authority | Proven "off stops the work" gate |
+* | --- | --- | --- |
+* | `stream-broker` | `deviceManager.setDisabled` | `StreamBrokerManager.reconcileAllCatalogs` releases the brokers; `ensureBroker` refuses re-creation |
+* | `object-detection` | `deviceManager.setWrapperActive('detection-pipeline')` | `PipelineSettingsStore.resolvePipelineForDevice` returns `{ steps: [], audio: null }` |
+* | `audio-analysis` | `deviceManager.setWrapperActive('audio-analysis')` | `AudioSubscriptionController.subscribeAudioStream` returns `null` before opening the stream |
+* | `recording` | `recording.setDeviceConfig` → `RecordingConfig.enabled` | `band-decision.shouldRecord` returns false; the controller detaches the device |
+* | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
+* | `privacy-mask` | `privacyMask.setMask({ enabled })` → the CAMERA | the camera blanks the masked regions itself; every stream and recording carries the black boxes |
+* | `device-audio` | `privacyMask.setAudioEnabled` → the CAMERA | the camera stops encoding an audio track at all; every consumer sees silent video |
+*
+* ## The two switches whose authority is not on this server
+*
+* `privacy-mask` and `device-audio` write the CAMERA. That is not a loophole
+* in "the group stores nothing" — it is the purest form of it: the camera
+* holds the fact, every read is a read-through, and there is no server-side
+* copy that could drift. Their availability therefore cannot come from
+* `listBindableCapsForDeviceType` (a device-NATIVE cap carries no wrappers and
+* is filtered out there); it comes from the cap's own camera-probed
+* `privacyMask.getOptions()`, which is strictly more honest — it answers for
+* THIS camera rather than for the device type
+* ([D74](../../../../docs/decisions/adr-0074.md)).
+*
+* ## `privacy-mask` is the one row whose ON is not "the function is working"
+*
+* Every other switch means *this camera's function is doing its job*, so
+* `enabled: false` is a thing an operator took away. `privacy-mask` means **the
+* MASK is active** — `enabled: true` is video deliberately obscured. The
+* polarity is not a choice made here: `addon-export-hap`'s privacy `Switch`
+* (`builders/privacy-switch.ts`) already mirrors `patch.enabled` verbatim, and
+* a HomeKit toggle that disagreed with the app's toggle for the same camera is
+* worse than either surface not having one.
+*
+* Two consequences follow and both are load-bearing:
+*
+* - **It never counts as `switchedOff`.** `countsAsSwitchedOff` is `false` for
+*   exactly this row. With the polarity above, every camera that has NOT drawn
+*   a privacy mask would otherwise report `switchedOff: ['privacy-mask']` — the
+*   normal, healthy state of most cameras rendered as an operator disablement.
+* - **Its cost line names BOTH directions.** `costWhenOff` is rendered
+*   unconditionally by both clients, so for this row it has to read correctly
+*   whichever way the switch is sitting.
+*
+* The wrapper-binding pair is not a new idea: `legacy-migrations.ts` already
+* migrated the legacy `audioEnabled` / `pipelineEnabled` /
+* `motionDetectionEnabled` booleans ONTO `setWrapperActive`. The group is the
+* surface that decision never got.
+*
+* ## Two rules that are load-bearing
+*
+* - **Recording's switch is `enabled`, never the bands.** `bands` is the only
+*   authored intent and `mode` is derived from it (`deriveRecordingMode`).
+*   Expressing "off" by clearing bands destroys the operator's schedule and
+*   turning the camera back on would then silently record nothing.
+* - **A switch that is off must be reported as off**, not merely produce
+*   nothing. {@link CameraSwitch.enabled} is what a status surface renders as
+*   "disabled by an operator" instead of "broken" — see
+*   `CameraStatus.switchedOff`.
+*/
+/**
+* The functions the operator named — five on 2026-08-05, plus the camera's own
+* microphone on 2026-08-07. Deliberately NOT one id per pipeline step: face
+* recognition and plate/LPR are per-step toggles on
+* `pipelineOrchestrator.setCameraStepToggle` and belong in the pipeline
+* editor, not in a safety group.
+*/
+var CameraSwitchIdSchema = _enum([
+	"stream-broker",
+	"object-detection",
+	"privacy-mask",
+	"device-audio",
+	"audio-analysis",
+	"recording",
+	"notifications"
+]);
+/**
+* WHERE the switch's state actually lives. A discriminated union rather than a
+* string so both the writer (the orchestrator's `setCameraSwitch`) and any
+* reader can exhaustively narrow — and so "the group added a parallel map" is
+* a compile error rather than a review comment.
+*/
+var CameraSwitchAuthoritySchema = discriminatedUnion("kind", [
+	object({ kind: literal("device-disabled") }),
+	object({
+		kind: literal("wrapper-binding"),
+		capName: string()
+	}),
+	object({ kind: literal("recording-config") }),
+	object({ kind: literal("notification-mute") }),
+	object({
+		kind: literal("camera-audio"),
+		capName: string()
+	}),
+	object({
+		kind: literal("camera-mask"),
+		capName: string()
+	})
+]);
+/**
+* Why a switch is not offered for this camera. Rendered instead of the
+* control, never as a dead control — an absent function and a broken one must
+* not look the same.
+*/
+var CameraSwitchUnavailableReasonSchema = _enum([
+	"no-provider",
+	"source-unreachable",
+	"not-configured"
+]);
+/**
+* One switch, resolved for one camera.
+*
+* `label` and `costWhenOff` travel ON THE WIRE rather than being looked up
+* client-side: the viewer is a separate repository that does not import
+* `@camstack/types`, and a cost line duplicated in two clients is a cost line
+* that will disagree with itself. Five rows per camera is nothing.
+*/
+var CameraSwitchSchema = object({
+	id: CameraSwitchIdSchema,
+	label: string(),
+	/**
+	* What the operator LOSES while this is off, in one sentence. Required, not
+	* optional: a switch that cannot say what it costs should not ship.
+	*/
+	costWhenOff: string(),
+	/** False = do not render a control. `unavailableReason` says why. */
+	available: boolean(),
+	unavailableReason: CameraSwitchUnavailableReasonSchema.optional(),
+	/** Current state. Meaningless when `available` is false — read it as `true`. */
+	enabled: boolean(),
+	authority: CameraSwitchAuthoritySchema
+});
+/** The whole group for one camera. */
+var CameraSwitchGroupSchema = object({
+	deviceId: number().int(),
+	switches: array(CameraSwitchSchema).readonly(),
+	/** Unix ms when the group was composed server-side. */
+	fetchedAt: number()
+});
+/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -7113,14 +7292,16 @@ var OpsLogOpSchema = _enum([
 	"manual-delete",
 	"rescan",
 	"retention-run",
-	"relocate"
+	"relocate",
+	"orphan-audit"
 ]);
 /** Why the operation ran. */
 var OpsLogReasonSchema = _enum([
 	"retention",
 	"quota",
 	"manual",
-	"operator"
+	"operator",
+	"maintenance"
 ]);
 /** One audit row, shared verbatim by both domains. */
 var OpsLogEntrySchema = object({
@@ -9156,6 +9337,126 @@ var RtpSourceSchema = object({
 	encoder: string(),
 	pipelineKey: string()
 });
+/**
+* The encode request — **structured and serialisable, with NO raw-flag escape
+* hatch.** This is deliberate and it is the one lesson taken from
+* `getStreamWithCodec`: that method's `outputArgs: string[]` is simultaneously
+* its extensibility mechanism AND part of `pipelineKeyFor`'s sharing key, so
+* adding a flag silently forks the shared child, and two consumers that mean
+* the same thing but spell it differently never share. Here every knob is a
+* NAMED field: a new requirement becomes a schema field (and a codegen run),
+* never an opaque array.
+*
+* `inputArgs` / `outputArgs` are omitted from the profile for the same reason.
+* The operator-facing derived-stream transform editor still has them — that is
+* a different surface (`publishCameraStream({ kind: 'derived' })`) with a
+* different purpose (reshaping a badly-behaved SOURCE), and it is unchanged.
+*/
+var EgressEncodeSchema = EncodeProfileSchema.omit({
+	inputArgs: true,
+	outputArgs: true
+});
+/**
+* How the encoder is bounded. `'tight'` is a one-second VBV window for a
+* consumer whose budget is enforced per second (HomeKit); `'relaxed'` is two
+* seconds, letting a keyframe spike borrow from the next second (a browser,
+* an Echo). Named rather than numeric so the INTENT survives.
+*/
+var EgressRateControlSchema = _enum(["tight", "relaxed"]);
+var EgressTranscodeRequestSchema = object({
+	deviceId: number().int().nonnegative(),
+	/** Which published stream to read. */
+	source: discriminatedUnion("kind", [object({
+		kind: literal("profile"),
+		profile: CamProfileSchema
+	}), object({
+		kind: literal("cam-stream"),
+		camStreamId: string().min(1)
+	})]),
+	encode: EgressEncodeSchema,
+	rateControl: EgressRateControlSchema.optional(),
+	/**
+	* `-bsf:v`. A consumer that negotiates its OWN SDP (HomeKit) cannot carry
+	* out-of-band extradata and needs `dump_extra` on both the copy and encode
+	* branches. Enumerated, not free text.
+	*/
+	bitstreamFilter: _enum([
+		"dump_extra",
+		"h264_mp4toannexb",
+		"hevc_mp4toannexb"
+	]).optional(),
+	/**
+	* Publish the transcode as a LOCAL push cam stream, instead of leaving the
+	* consumer to dial the returned url. The broker picks the id and returns it
+	* as `camStreamId` — a caller-supplied one would be circular, since the
+	* sharing key is computed FROM this request.
+	*
+	* The url is still returned and still the contract for a transcode pinned to
+	* another node. But dialling it locally costs an RTSP round trip that changes
+	* the transport underneath the consumer: a dialled stream is an RTP source,
+	* so `isRtpSource()` is true and the session takes the RTP-passthrough +
+	* repacketizer branch. The push branch — the one the derived mechanism has
+	* live hours on — is never reached. Measured on Alexa: broker registered, RTP
+	* arriving, key frame arriving, black screen, on a chain healthy at every
+	* other point.
+	*
+	* Same idea the transport already applies to CALLS, where `classifyCapRoute`
+	* gives priority to `hub-in-process` so a local call never leaves the node.
+	* This is that rule for media.
+	*/
+	publishLocally: boolean().optional(),
+	pixelFormat: _enum(["yuv420p", "nv12"]).optional(),
+	/**
+	* Operator/consumer override for decode hardware. ABSENT is the normal case
+	* and the one that matters: the broker then resolves the backend from the
+	* DECODER ADDON's per-node `probedBestHwaccel` (see
+	* `@camstack/types` `ffmpeg/hwaccel.ts`), which is the ranking known to work
+	* on this hardware — never the raw kernel resolver's qsv-first order.
+	*/
+	decodeHwAccel: _enum([
+		"auto",
+		"none",
+		"videotoolbox",
+		"vaapi",
+		"qsv",
+		"cuda"
+	]).optional(),
+	/**
+	* Host to embed in the returned restream `url`. The broker mints hub-local
+	* `127.0.0.1` URLs; a consumer on another node passes a cluster-resolvable
+	* host (`NodeTopologyService.reachableHostByNode`) so the returned URL is
+	* dialable from there. Same contract as `getStreamWithCodec.hostname` —
+	* `substituteRtspHost` rewrites only the dial address, never the restreamer.
+	*/
+	hostname: string().optional(),
+	/** Attribution for the broker panel. Never part of the sharing key. */
+	tag: string().optional()
+});
+var EgressTranscodeSchema = object({
+	/** Dial-able RTSP url (host-substituted when `hostname` was supplied). */
+	url: string(),
+	/** Release handle. Refcounted — the child dies when the last holder releases. */
+	pipelineKey: string(),
+	videoCodec: _enum(["H264", "H265"]),
+	resolution: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	transcoded: boolean(),
+	encoder: string(),
+	/**
+	* The decode backend the child ACTUALLY ran with — `null` for software.
+	* Returned rather than assumed: a consumer that asked for hardware and got
+	* software needs to be able to see that without reading the broker's logs.
+	*/
+	decodeHwAccel: string().nullable(),
+	/**
+	* Set when `publishLocally` was honoured: attach to THIS instead of dialling
+	* `url`, and the session takes the push/deframe transport rather than the
+	* RTP-passthrough one. `null` means the consumer must dial.
+	*/
+	camStreamId: string().nullable()
+});
 method(object({
 	deviceId: number().int().nonnegative(),
 	camStreamId: string().min(1),
@@ -9265,6 +9566,15 @@ method(object({
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(EgressTranscodeRequestSchema, EgressTranscodeSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ pipelineKey: string() }), object({
+	released: boolean(),
+	refcount: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
 }), method(SubscribeAudioChunksInputSchema, SubscribeAudioChunksResultSchema, { kind: "mutation" }), method(object({
 	subscriptionId: string(),
 	maxCount: number().int().positive().default(8)
@@ -13881,12 +14191,13 @@ var NcConditionsSchema = object({
 	* source; otherwise the subject's source must equal it. Legacy records
 	* with no stamped source are treated as `pipeline`. The union spans both
 	* record kinds — object events carry `pipeline` | `onboard`, synthetic
-	* tracks carry `sensor`.
+	* tracks carry `sensor` (a linked device) or `audio` (a D62 audio marker).
 	*/
 	source: _enum([
 		"pipeline",
 		"onboard",
 		"sensor",
+		"audio",
 		"any"
 	]).optional(),
 	/**
@@ -14462,6 +14773,12 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({}), object({ mutedDeviceIds: array(number().int()).readonly() }), { auth: "admin" }), method(object({
+	deviceId: number().int(),
+	muted: boolean()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	rule: NcRuleInputSchema,
 	lookbackMinutes: number().int().min(1).max(1440).default(60)
@@ -14800,12 +15117,60 @@ var TrackAudioLabelSchema = object({
 });
 /**
 * How a track was produced. `pipeline` (default / absent) = the spatial
-* detection+tracking pipeline. `sensor` = a SYNTHETIC track projected from a
-* linked sensor/control state change (no positions; carries a snapshot). The
-* spatial subsystems (tracker association, occupancy count, re-id/embedding,
-* resurrection) MUST skip `sensor` tracks — they have no bbox trajectory.
+* detection+tracking pipeline. Every OTHER value is a SYNTHETIC projection —
+* no positions, a single snapshot, and no bbox trajectory at all:
+*
+*  - `sensor` — a linked sensor/control device state change.
+*  - `audio` — an audio event on the camera itself that was anomalous for
+*    THAT camera, loud, and heard while nothing visual was happening (D62).
+*
+* The spatial subsystems (tracker association, occupancy count, re-id /
+* embedding, resurrection) MUST skip every synthetic source. Test for that
+* with `isSpatialTrack`, which allow-lists `pipeline` — a `!== 'sensor'`
+* check silently readmits every source added after it was written.
 */
-var TrackSourceSchema = _enum(["pipeline", "sensor"]);
+var TrackSourceSchema = _enum([
+	"pipeline",
+	"sensor",
+	"audio"
+]);
+/**
+* Per-track OPERATOR flags — set by hand from the admin UI or the viewer, never
+* by the pipeline. Spread into `TrackSchema` and `KeyEventSchema` from one place
+* so the two surfaces cannot drift.
+*
+* **Absent ≠ false.** A track that has never been touched omits the field; an
+* explicitly un-flagged track carries `false`. Legacy rows written before the
+* columns existed read as absent, and a consumer that needs a boolean should say
+* `flag === true`, not `flag !== false`.
+*
+* What the flags DO is deliberately UNDEFINED at the time of writing: they are
+* operator curation, and the behaviour they drive will be specified separately.
+* In particular a `markForTrain` track is NOT pinned against retention — see
+* `docs/decisions/adr-0059.md` for why that is a store-level change, not a flag.
+*/
+var TrackFlagFields = {
+	/** Operator marked this track as training material. */
+	markForTrain: boolean().optional(),
+	/** Operator marked this track for diagnostic attention. */
+	debug: boolean().optional()
+};
+/**
+* The write half: a PARTIAL patch. An omitted key is left untouched, so setting
+* one flag can never clear the other — the toggles are independent and are
+* driven from three surfaces that do not know about each other.
+*/
+var TrackFlagsPatchSchema = object(TrackFlagFields);
+/**
+* The resolved flag state after a write. Both fields are REQUIRED here (absent
+* collapses to `false`) so a caller can drive a toggle's checked state off the
+* mutation result without a re-fetch.
+*/
+var TrackFlagsSchema = object({
+	trackId: string(),
+	markForTrain: boolean(),
+	debug: boolean()
+});
 var TrackSchema = object({
 	trackId: string(),
 	deviceId: number(),
@@ -14848,7 +15213,8 @@ var TrackSchema = object({
 	/** Normalized 0..1 trajectory envelope (see {@link TrackEnvelopeSchema}).
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
-	envelope: TrackEnvelopeSchema.optional()
+	envelope: TrackEnvelopeSchema.optional(),
+	...TrackFlagFields
 });
 var BaseEventFields = {
 	id: string(),
@@ -15061,7 +15427,8 @@ var KeyEventSchema = object({
 	/** Highest-confidence ObjectEvent id for the track (empty when none). */
 	bestEventId: string(),
 	/** Track lifetime in ms (lastSeen - firstSeen). */
-	windowMs: number().optional()
+	windowMs: number().optional(),
+	...TrackFlagFields
 });
 object({
 	trackId: string(),
@@ -15132,6 +15499,104 @@ var EventPruneCountsSchema = object({
 	object: number().int(),
 	audio: number().int()
 });
+/**
+* Re-embed stored tracks from their key frames.
+*
+* The reason this is an operator-callable method and not a migration script:
+* every knob that decides what a vector MEANS — encoder model, crop margin,
+* squaring — is only changeable if the existing vectors can be regenerated.
+* Mixing feature spaces in one index makes cosine scores incomparable, and the
+* symptom is a quality regression with no visible cause.
+*/
+var RebuildObjectEmbeddingsInput = object({
+	/** Restrict to one camera. Omit for the whole fleet. */
+	deviceId: number().optional(),
+	since: number().optional(),
+	until: number().optional(),
+	/** Stop after this many tracks; the result reports whether more remain. */
+	maxTracks: number().int().positive().optional(),
+	/**
+	* Run every embedding on THIS node instead of round-robining the fleet.
+	*
+	* Named `executeOnNodeId` and not `nodeId` on purpose: an inline `nodeId`
+	* field in cap args is read by `parent-unowned-call.ts` as a ROUTING PIN, so
+	* calling it that would pin the rebuild REQUEST itself to that node — the
+	* rebuild orchestration lives on the hub, and only the per-track step runs
+	* remotely. This field is data; the per-track pin is applied inside.
+	*
+	* Absent ⇒ round-robin over every online node whose runner can serve the
+	* pinned model.
+	*/
+	executeOnNodeId: string().optional(),
+	/**
+	* Milliseconds to wait between tracks; omit for the built-in default, `0` to
+	* run flat out.
+	*
+	* A rebuild is bulk maintenance on hub-main's single thread. Measured
+	* 2026-08-06, an unpaced pass held that thread busy 82.2 s out of 120 and
+	* pushed `nodes.topology` from 0.25 s to 26 s for 43 minutes. The value in
+	* force is logged at start and finish so a deliberately slow pass reads
+	* differently from a stalled one.
+	*/
+	pacingMs: number().int().nonnegative().optional()
+});
+/**
+* Result of emptying the CLIP index.
+*
+* The clean slate before a policy change: a new crop margin or encoder model
+* leaves two feature spaces in one index whose cosine scores are not
+* comparable, so wiping and rebuilding is the only way to be sure every vector
+* means the same thing.
+*/
+var WipeObjectEmbeddingsResultSchema = object({ deleted: number() });
+/**
+* Acknowledgement that a rebuild STARTED.
+*
+* The pass costs ~1s per track — 45 minutes for a 2,600-track fleet — so it
+* runs detached and this returns immediately. Waiting for it made the client
+* time out while the work carried on server-side, which is the worst of both:
+* no result and no way to know it was still going. Poll
+* `getObjectEmbeddingRebuildStatus` for progress.
+*/
+var RebuildObjectEmbeddingsResultSchema = object({
+	started: boolean(),
+	/** True when a pass was already running; the new request is ignored. */
+	alreadyRunning: boolean()
+});
+var RebuildStatusSchema = object({
+	running: boolean(),
+	scanned: number(),
+	rebuilt: number(),
+	/** Tracks whose key frame is gone — nothing to re-embed from. */
+	missingKeyFrame: number(),
+	/** Tracks with no usable detection box. */
+	missingBbox: number(),
+	/**
+	* Tracks an executing node REFUSED rather than broke on — an unreadable key
+	* frame, a step that threw. Separate from `failed` because the remedy is
+	* different, and because a whole camera silently contributing zero vectors
+	* is the shape of failure a rebuild must never hide.
+	*/
+	notRunnable: number(),
+	/**
+	* The pass stopped because NO node could serve the pinned model.
+	*
+	* Distinct from `notRunnable` on purpose: that one says "this track was
+	* refused", this one says "the cluster cannot do this work at all" — every
+	* candidate node either lacks the `clip-embedding` step, lacks a build of the
+	* pinned model for its engine format, or dropped out. The remedy is a model /
+	* engine change, not a per-camera one. Non-zero here always comes with
+	* `complete: false`.
+	*/
+	noCapableNode: number(),
+	failed: number(),
+	/** Set once a pass ends: true only when EVERYTHING was covered. */
+	complete: boolean().nullable(),
+	startedAtMs: number().nullable(),
+	finishedAtMs: number().nullable(),
+	/** Present when the pass ended by throwing. */
+	error: string().nullable()
+});
 DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).readonly()), method(object({
 	deviceId: number(),
 	trackId: string()
@@ -15195,7 +15660,12 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), EventStoreFootprintSchema, {
+}), method(object({
+	/** Log/audit scope only — the trackId is globally unique on its own. */
+	deviceId: number(),
+	trackId: string(),
+	flags: TrackFlagsPatchSchema
+}), TrackFlagsSchema, { kind: "mutation" }), method(object({}), EventStoreFootprintSchema, {
 	kind: "query",
 	auth: "admin"
 }), method(object({
@@ -15225,7 +15695,13 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), array(MediaFileSchema).readonly()), method(object({
 	trackId: string(),
 	kinds: array(MediaFileKindEnum).optional()
-}), array(MediaFileSchema).readonly()), method(object({ trackId: string() }), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), object({
+}), array(MediaFileSchema).readonly()), method(object({ trackId: string() }), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), RebuildStatusSchema), object({
 	deviceId: number(),
 	timestamp: number(),
 	frameWidth: number(),
@@ -15832,6 +16308,53 @@ var DetailResultSchema = object({
 	nativeFaceShortSidePx: number().optional()
 });
 /**
+* Why an executing node REFUSED a stateless step run (`runStatelessStep`).
+*
+* A refusal is a first-class answer, not an error, because the caller's next
+* move depends on WHICH one it is — and because "the pass produced nothing"
+* must never be reachable without a named, counted cause. The two tiers:
+*
+* - **node-level** (`unknown-step`, `model-not-servable`) — this node can
+*   never serve this (step, model) pair. The caller drops it from its rotation
+*   and retries the same work elsewhere; nothing about the work changes.
+* - **work-level** (`unreadable-frame`, `execution-failed`) — this node is
+*   fine, this one request is not. Retrying it on another node would only
+*   spread the same failure.
+*/
+var StatelessStepRefusalSchema = _enum([
+	"unknown-step",
+	"model-not-servable",
+	"unreadable-frame",
+	"execution-failed"
+]);
+/**
+* Answer to `runStatelessStep` — a discriminated union rather than a nullable
+* result, because `null` is exactly what made the camera-bound detail path
+* unable to tell "refused" from "never asked".
+*/
+var RunStatelessStepResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("ran"),
+	/** The node that actually executed it — the pin, echoed back for the log. */
+	nodeId: string(),
+	/**
+	* The model the step ran with.
+	*
+	* The node verified this exact id has a build for the format it dispatched
+	* on BEFORE running, so the executor's format resolution returns it
+	* unchanged. A caller that pinned a model must compare this field and
+	* treat a mismatch as a refusal — the whole point of the pin is that a
+	* pass writes one feature space.
+	*/
+	modelId: string(),
+	details: array(DetailResultSchema)
+}), object({
+	kind: literal("refused"),
+	nodeId: string(),
+	reason: StatelessStepRefusalSchema,
+	/** Human-readable specifics — the format tried, the formats shipped, etc. */
+	detail: string()
+})]);
+/**
 * Per-camera tunable ranges + defaults. Single source of truth used
 * by both the Zod data schema (validation + default fallback) and
 * the device settings UI (slider min/max/step). Touch one place and
@@ -16167,10 +16690,46 @@ method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mu
 }), NativeCropResultSchema.nullable()), method(object({
 	deviceId: number(),
 	frameHandle: FrameHandleSchema.optional(),
+	/**
+	* FULL FRAME (base64 JPEG). The runner derives the crop rectangle from
+	* `parent.bbox` with the cluster crop convention and cuts it itself —
+	* do NOT pre-crop for this field, that is what `cropJpeg` is.
+	*/
+	frameJpeg: string().optional(),
+	/**
+	* PRE-CUT tile (base64 JPEG), used verbatim — NO padding is applied.
+	* The fallback when the lease/session backing the frame is gone and the
+	* caller already holds a crop.
+	*/
 	cropJpeg: string().optional(),
 	parent: DetailParentSchema,
 	steps: array(string()).optional()
-}), object({ details: array(DetailResultSchema) }).nullable(), { kind: "mutation" });
+}), object({ details: array(DetailResultSchema) }).nullable(), { kind: "mutation" }), method(object({
+	/** Catalog step id, e.g. `clip-embedding`. */
+	stepId: string(),
+	/**
+	* REQUIRED model pin. The node runs this exact model or refuses with
+	* `model-not-servable` — it never substitutes a format default, because
+	* a fleet pass that round-robins across nodes would then fill one index
+	* from several encoders.
+	*/
+	modelId: string(),
+	/** FULL FRAME, base64 JPEG. The runner cuts — do NOT pre-crop. */
+	frameJpeg: string(),
+	/**
+	* The subject box, NORMALISED [0,1] against `frameJpeg`. Normalised on
+	* purpose: the caller stores boxes against a downscaled analysis frame
+	* while the stored key frame is native-resolution, and the only side
+	* that reliably knows the image's pixel dimensions is the side that
+	* decodes it. Denormalising here removes a second reader of the
+	* dimensions and the class of mismatch that comes with it.
+	*/
+	bbox: NativeCropBboxSchema,
+	/** Parent class of the subject (`person`, `vehicle`, …) — carried into the result. */
+	className: string(),
+	/** Camera the pixels came from. Diagnostics + log tags ONLY — never routing. */
+	sourceDeviceId: number()
+}), RunStatelessStepResultSchema, { kind: "mutation" });
 var CameraPipelineConfigSchema = object({
 	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).readonly(),
@@ -16468,6 +17027,20 @@ var CameraStatusSchema = object({
 	detection: CameraDetectionStatusSchema.nullable(),
 	audio: CameraAudioStatusSchema.nullable(),
 	recording: CameraRecordingStatusSchema.nullable(),
+	/**
+	* Per-camera function switches an OPERATOR has turned off
+	* ([D61](../../../../docs/decisions/adr-0067.md)).
+	*
+	* This is the difference between DISABLED and BROKEN. A camera whose
+	* `detection` block reports zero fps and whose `switchedOff` contains
+	* `'object-detection'` was switched off by a person; the same camera with an
+	* empty list is failing. Every status surface must render the two
+	* differently — a quiet camera that looks identical to a dead one is the
+	* silence-reads-as-never-happened trap this repo keeps paying for.
+	*
+	* Empty when nothing is off. Never contains a switch no provider offers.
+	*/
+	switchedOff: array(CameraSwitchIdSchema).readonly(),
 	/** Unix timestamp (ms) when this snapshot was composed server-side. */
 	fetchedAt: number()
 });
@@ -16636,7 +17209,14 @@ method(object({
 }), method(object({
 	deviceId: number(),
 	agentNodeId: string().optional()
-}), CameraPipelineConfigSchema), method(object({ deviceId: number() }), CameraStatusSchema), method(object({ deviceIds: array(number()).optional() }), array(CameraStatusSchema).readonly()), method(_void(), array(PipelineTemplateSchema).readonly()), method(object({
+}), CameraPipelineConfigSchema), method(object({ deviceId: number() }), CameraSwitchGroupSchema), method(object({
+	deviceId: number(),
+	switchId: CameraSwitchIdSchema,
+	enabled: boolean()
+}), CameraSwitchGroupSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number() }), CameraStatusSchema), method(object({ deviceIds: array(number()).optional() }), array(CameraStatusSchema).readonly()), method(_void(), array(PipelineTemplateSchema).readonly()), method(object({
 	name: string(),
 	description: string().optional(),
 	config: CameraPipelineConfigSchema
@@ -16995,9 +17575,15 @@ var snapshotCapability = {
 			* Bypass the cache freshness check and fetch directly from the
 			* native (or stream-broker fallback). Triggered by the UI's
 			* "refresh" button so an operator can force a fresh frame
-			* even when the cache is well within `snapshotMaxAgeMs`.
-			* On battery cams this WILL wake the camera — accept the
-			* cost only when the user explicitly asks for it.
+			* even when the cache is well within the device's
+			* `snapshotMaxAgeS` window.
+			*
+			* **`force` is an OPERATOR signal, not a freshness preference.** On a
+			* battery camera it is the one thing that walks past the wrapper's
+			* sleep gate and wakes the camera, so a background caller — a poller,
+			* an event handler, a thumbnail — must NEVER set it. Every such caller
+			* gets the cached frame, which on a sleeping battery camera is the
+			* correct answer: stale but honest beats woken.
 			*/
 			force: boolean().optional()
 		}), SnapshotImageSchema.nullable()),
@@ -17543,6 +18129,24 @@ var VectorDeleteByFilterInputSchema = object({
 	filter: VectorFilterSchema
 });
 var VectorDeleteResultSchema = object({ deleted: number() });
+var VectorGetInputSchema = object({
+	index: string(),
+	ids: array(string())
+});
+/**
+* Metadata for the requested ids, WITHOUT their vectors.
+*
+* The only caller is a best-of gate that compares a candidate's confidence
+* against the stored one, and shipping 512 floats back to answer "is 0.91 >
+* 0.87" would undo the point of the compact encoding. Ids with no row are
+* simply absent — a caller distinguishing "not stored" from "stored" reads the
+* length, and a null placeholder would invite a `?? 0` that treats a missing
+* row as confidence zero.
+*/
+var VectorGetResultSchema = object({ items: array(object({
+	id: string(),
+	metadata: VectorMetadataSchema
+})) });
 var VectorStatsInputSchema = object({ index: string() });
 var VectorStatsResultSchema = object({
 	/** Provider id, so an operator can tell brute force from an ANN index. */
@@ -17555,7 +18159,7 @@ var VectorStatsResultSchema = object({
 	/** False when the backend ranks approximately. */
 	exact: boolean()
 });
-method(VectorDeclareIndexInputSchema, _void(), { kind: "mutation" }), method(VectorUpsertInputSchema, VectorUpsertResultSchema, { kind: "mutation" }), method(VectorQueryInputSchema, VectorQueryResultSchema), method(VectorDeleteInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorStatsInputSchema, VectorStatsResultSchema);
+method(VectorDeclareIndexInputSchema, _void(), { kind: "mutation" }), method(VectorUpsertInputSchema, VectorUpsertResultSchema, { kind: "mutation" }), method(VectorQueryInputSchema, VectorQueryResultSchema), method(VectorGetInputSchema, VectorGetResultSchema), method(VectorDeleteInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorStatsInputSchema, VectorStatsResultSchema);
 /**
 * `videoclips` — the unified, navigable-clip surface for a camera.
 *
@@ -22457,12 +23061,30 @@ var pressureSensorCapability = {
 	runtimeState: PressureSensorStatusSchema
 };
 /**
-* Privacy mask = up to `maxRegions` SHAPES the camera blanks out (NOT a
-* cell grid). Reolink `<shelterList>` zones are rectangles; Hikvision
-* ISAPI `<RegionCoordinatesList>` zones are free polygons (this camera:
-* exactly 4 vertices, not necessarily axis-aligned). The cap composes the
-* shared rect|polygon subset of the MaskShape vocabulary. All coords are
-* normalized 0..1 (top-left origin).
+* PRIVACY — what the camera deliberately does not capture. Two planes:
+*
+*  - **video**: up to `maxRegions` SHAPES the camera blanks out (NOT a cell
+*    grid). Reolink `<shelterList>` zones are rectangles; Hikvision ISAPI
+*    `<RegionCoordinatesList>` zones are free polygons (this camera: exactly
+*    4 vertices, not necessarily axis-aligned). The cap composes the shared
+*    rect|polygon subset of the MaskShape vocabulary. All coords are
+*    normalized 0..1 (top-left origin).
+*  - **audio**: the camera's microphone. `setAudioEnabled(false)` stops the
+*    camera encoding an audio track at all, so EVERY consumer — live view,
+*    recording, the audio analyzer, an export — sees silent video. There is
+*    no server-side copy of this fact; the camera is the store and every read
+*    is a read-through, which is why a switch over it cannot drift
+*    ([D62](../../../../docs/decisions/adr-0062.md)).
+*
+* Both belong here for one reason: they are the two things an operator turns
+* off when the answer to "what is this camera allowed to record" changes, and
+* both are applied ON the device, before anything leaves it.
+*
+* **The audio flag has exactly one writer.** `stream-params` used to carry a
+* per-profile `audio` in its patch schema — reachable from no UI and honoured
+* by one provider — and it was removed when this landed. A second writer onto
+* one device register is the shape of every knob this repo has shipped that
+* disagreed with the one the reader read.
 */
 /** A privacy-mask region's geometry — rectangle or free polygon. */
 var PrivacyMaskShapeSchema = discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
@@ -22474,21 +23096,45 @@ var PrivacyMaskRegionSchema = object({
 	enabled: boolean(),
 	shape: PrivacyMaskShapeSchema
 });
-/** Current on-camera privacy-mask state — master enable + zones. */
+/** Current on-camera privacy state — mask master enable + zones + microphone. */
 var PrivacyMaskStatusSchema = object({
 	enabled: boolean(),
 	/** Active zones (normalized 0..1). Length ≤ maxRegions. */
 	regions: array(PrivacyMaskRegionSchema),
+	/**
+	* Is the camera capturing sound right now? Read from the camera, never from
+	* a server-side mirror.
+	*
+	* `null` means "no answer" — either this camera exposes no controllable
+	* microphone (`getOptions().supportsAudioMute === false`) or the read
+	* failed. A consumer must render `null` as UNKNOWN and never as `false`:
+	* "the microphone is off" and "we could not ask" look identical to an
+	* operator only until one of them is wrong.
+	*
+	* On a camera whose profiles carry the flag independently (Reolink writes
+	* it per stream), `true` means AT LEAST ONE profile still carries audio —
+	* privacy is only satisfied when every one of them is silent.
+	*/
+	audioEnabled: boolean().nullable(),
 	lastFetchedAt: number()
 });
-/** Per-camera availability. */
+/** Per-camera availability. Probed, never assumed from the model name. */
 var PrivacyMaskOptionsSchema = object({
 	/** Maximum number of supported zones. */
 	maxRegions: number(),
 	/** Shape kinds this camera accepts — Reolink: ['rect']; Hikvision: ['rect','polygon']. */
 	supportedShapes: array(MaskShapeKindSchema),
 	/** Polygon vertex bounds when 'polygon' is supported (Hikvision: {min:4,max:4}). */
-	polygonVertices: MaskPolygonVerticesSchema.optional()
+	polygonVertices: MaskPolygonVerticesSchema.optional(),
+	/**
+	* Does this camera expose a microphone switch we can actually write?
+	*
+	* Camera-probed: `true` only when the firmware answered with an audio flag
+	* we know how to patch. A camera that never answered is `false` — a control
+	* the operator can press that changes nothing is worse than no control, and
+	* the switch group renders "not available" instead.
+	*/
+	supportsAudioMute: boolean()
 });
 /** Partial change — every field optional. */
 var PrivacyMaskPatchSchema = object({
@@ -22515,6 +23161,27 @@ var privacyMaskCapability = {
 		}), _void(), {
 			kind: "mutation",
 			auth: "admin"
+		}),
+		/**
+		* Turn the camera's microphone on or off, at the camera.
+		*
+		* Deliberately its OWN mutation rather than a field on
+		* {@link PrivacyMaskPatchSchema}: `patch.enabled` already means "the video
+		* mask master switch", and overloading it would make one boolean mean two
+		* unrelated things on the same call. It is also the only method here whose
+		* write leaves the device in a state a later `getStatus` reads back
+		* verbatim, which is what makes it safe as a switch authority.
+		*
+		* A camera whose `getOptions().supportsAudioMute` is false must REJECT
+		* this rather than silently accept it — a write nothing applies is exactly
+		* what the switch group exists to remove.
+		*/
+		setAudioEnabled: method(object({
+			deviceId: number(),
+			enabled: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
 		})
 	},
 	status: {
@@ -22523,6 +23190,26 @@ var privacyMaskCapability = {
 	},
 	runtimeState: PrivacyMaskStatusSchema
 };
+/**
+* Collapse a camera's PER-PROFILE audio flags into the one answer
+* {@link PrivacyMaskStatusSchema.shape.audioEnabled} promises.
+*
+* Both firmwares this cap talks to store the flag per stream profile, and
+* both let those profiles disagree. The rule is `some`, not `every`: privacy
+* is only satisfied when NOTHING is carrying sound, so a camera whose sub
+* stream is still audible must read as `true` and be switchable off — not as
+* `false` because the main stream happens to be muted already.
+*
+* An empty list is `null` ("this camera reported no audio flag at all"),
+* never `false`.
+*
+* Lives here rather than in each provider so the rule the schema documents
+* and the rule the providers apply cannot drift apart.
+*/
+function summarisePrivacyAudio(profiles) {
+	if (profiles.length === 0) return null;
+	return profiles.some((p) => p.audioEnabled);
+}
 var PtzPresetSchema = object({
 	id: string(),
 	name: string()
@@ -22864,6 +23551,21 @@ var LocateSegmentResultSchema = discriminatedUnion("kind", [object({
 })]);
 /** Raw bytes of one finalized footage segment (read off disk on the recording node). */
 var ReadSegmentBytesResultSchema = object({ data: _instanceof(Uint8Array) });
+/**
+* One GOP of a finalized segment, cut by byte range through the segment's own
+* `mfra` (D31 on the D42 feeder path). `data` is the `ftyp`+`moov` head plus
+* the single `moof`+`mdat` covering the requested instant — standalone-
+* demuxable, never the whole file. When the segment's index cannot be parsed
+* the provider degrades INSIDE the mechanism to the whole segment (still one
+* `data`, `gopStartMs` = the segment start) — a worse read, not another path.
+*/
+var ReadGopBytesResultSchema = object({
+	data: _instanceof(Uint8Array),
+	/** Absolute epoch ms of the returned fragment's first sample. */
+	gopStartMs: number(),
+	/** Media ms the returned fragment covers. */
+	gopDurMs: number()
+});
 method(object({
 	deviceId: number(),
 	fromMs: number(),
@@ -22906,6 +23608,14 @@ method(object({
 }), ReadSegmentBytesResultSchema, {
 	kind: "query",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	profile: string(),
+	startMs: number(),
+	epochMs: number()
+}), ReadGopBytesResultSchema, {
+	kind: "query",
+	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	config: RecordingConfigSchema
@@ -23478,6 +24188,16 @@ var StreamProfileConfigSchema = object({
 		"baseline"
 	]).optional(),
 	gop: number().optional(),
+	/**
+	* Whether THIS profile currently carries an audio track. READ-ONLY here.
+	*
+	* There is no matching field on {@link StreamProfilePatchSchema}: the
+	* camera's microphone is owned by `privacy-mask` (`setAudioEnabled`), which
+	* writes every profile at once so "audio off" means silent everywhere. A
+	* per-profile writer beside it would let a camera be half-muted and would be
+	* a second knob onto one device register — the failure D62 exists to
+	* prevent. Absent when the firmware does not report the flag.
+	*/
 	audio: boolean().optional()
 });
 var StreamParamsStatusSchema = object({
@@ -23518,7 +24238,13 @@ var StreamParamsOptionsSchema = object({
 	ext: StreamProfileOptionsSchema.optional()
 });
 /** A partial change to one profile — every field optional; a provider
-*  ignores fields it doesn't support. */
+*  ignores fields it doesn't support.
+*
+*  There is deliberately NO `audio` here. It existed until 2026-08-07,
+*  reachable from no form and honoured by exactly one provider, while the
+*  camera's microphone is a whole-device fact. It now has one writer,
+*  `privacyMask.setAudioEnabled`, which writes every profile — see
+*  `privacy-mask.cap.ts`. */
 var StreamProfilePatchSchema = object({
 	width: number().optional(),
 	height: number().optional(),
@@ -23531,8 +24257,7 @@ var StreamProfilePatchSchema = object({
 		"main",
 		"baseline"
 	]).optional(),
-	gop: number().optional(),
-	audio: boolean().optional()
+	gop: number().optional()
 });
 var streamParamsCapability = {
 	name: "stream-params",
@@ -28696,6 +29421,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.listDeviceMutes": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.listRules": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -28714,6 +29445,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.setDeviceMuted": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.setRuleEnabled": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -28888,6 +29625,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getObjectEmbeddingRebuildStatus": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getObjectEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -28966,6 +29709,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.rebuildObjectEmbeddings": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.relocateMedia": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -28978,12 +29727,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.setTrackFlags": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.wipeAllAnalytics": {
 		capName: "pipeline-analytics",
 		capScope: "device",
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.wipeObjectEmbeddings": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineExecutor.cacheFrameInPool": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -29278,6 +30039,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getCameraSwitches": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getCapabilityBindings": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -29410,6 +30177,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraSwitch": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCapabilityBinding": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -29500,6 +30273,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.runStatelessStep": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"plateGallery.assignPlate": {
 		capName: "plate-gallery",
 		capScope: "system",
@@ -29632,6 +30411,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"privacyMask.setAudioEnabled": {
+		capName: "privacy-mask",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"privacyMask.setMask": {
 		capName: "privacy-mask",
 		capScope: "device",
@@ -29800,6 +30585,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.readGopBytes": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.readSegmentBytes": {
 		capName: "recording",
 		capScope: "system",
@@ -30316,6 +31107,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.acquireEgressTranscode": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.assignProfile": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -30424,6 +31221,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.releaseEgressTranscode": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.releaseStreamWithCodec": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -30904,6 +31707,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"vectorStore.getByIds": {
+		capName: "vector-store",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"vectorStore.query": {
 		capName: "vector-store",
 		capScope: "system",
@@ -31178,6 +31987,112 @@ TimelapseRuleInputSchema.extend({
 	createdAt: number(),
 	updatedAt: number()
 });
+object({
+	/**
+	* Fraction of the box's own size added on EACH side before cutting.
+	*
+	* CLIP is trained on natural images WITH surroundings; a pixel-tight crop
+	* removes exactly the context it is strongest on (a dog cut to its outline
+	* is a dark blob). The right value is an empirical question, which is why it
+	* is a setting: 0 / 0.15 / 0.2 / 0.5 are the interesting points.
+	*/
+	paddingRatio: number().min(0).max(4),
+	/**
+	* Square the window (in PIXELS) before cutting.
+	*
+	* CLIP's input is square, so a tall bbox resized straight to NxN is squashed
+	* — a standing person becomes a shape the model never saw. Squaring costs
+	* extra background, which is context the model wants anyway. Off by default
+	* because the live path has never squared and the stored index reflects that.
+	*/
+	square: boolean()
+});
+({
+	paddingRatio: .15,
+	square: false
+}).paddingRatio;
+/**
+* WHICH delivered frames the decode worker retains a native copy of.
+*
+* - `all` — every frame the worker delivered to the runner. The shipped
+*   behaviour, and the only correct one if something can ask for a crop of a
+*   frame the runner never sent to inference.
+* - `inferred` — only the frames the runner ADMITTED to its detection queue.
+*   A native-crop request always names a `frameId` that rode an inference
+*   result, so that is the only set a request can name. How much it drops is
+*   the two-plane governor's admit ratio and nothing else: measured at ~50% on
+*   this cluster, not the ~80% the design sketch assumed, because the governor
+*   was not throttling as hard as the sketch supposed. Read
+*   `leaseAdmitted`/`leaseOffered` off the metrics line for the camera in front
+*   of you rather than quoting a number from here. The newest delivered frame is
+*   croppable regardless — it is still the worker's reserved slot, not a lease —
+*   which covers the one-frame race between a mark and the supersede that
+*   consumes it.
+*/
+var NativeLeaseAdmissionSchema = _enum(["all", "inferred"]);
+object({
+	/**
+	* How long a retained native frame is served before it counts as a miss.
+	*
+	* Must cover the FULL late-crop horizon: detection inference + the
+	* cross-process inference-result hop to hub post-analysis + tracking + the
+	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
+	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
+	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	*/
+	ttlMs: number().int().min(250).max(1e4),
+	/**
+	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
+	*
+	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
+	* which one is actually binding before reasoning from that. At the shipped
+	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
+	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
+	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
+	* change that admits fewer frames buys retention WINDOW at constant RAM
+	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* `0` DISABLES the lease entirely and falls the worker back to the tiny
+	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
+	* to replace).
+	*/
+	budgetMb: number().int().min(0).max(4096),
+	/**
+	* Demand window: eager per-frame native retention runs only within this many
+	* ms of the last native-crop request (or of the dial starting).
+	*
+	* `0` means ALWAYS ON — it disables the gate, it does not disable retention.
+	* That is the legacy behaviour that saturated an N100 (24 native-4K downloads
+	* per second on a camera with zero crop demand), so leave it non-zero unless
+	* you are reproducing that.
+	*/
+	activityMs: number().int().min(0).max(12e4),
+	/**
+	* Which delivered frames are retained at all — see
+	* {@link NativeLeaseAdmissionSchema}. This is the only knob of the four that
+	* changes WHAT is kept rather than for how long, so it is also the only one
+	* that can turn a crop that used to hit into a miss. The worker counts every
+	* crop request naming a frame it did NOT see marked
+	* (`leaseUnmarkedCrops` on the session-decode metrics line): a non-zero value
+	* there is the signal that some caller names frames outside the inference set
+	* and that this must go back to `all`.
+	*/
+	admission: NativeLeaseAdmissionSchema
+});
+/**
+* The values in force when the operator has set nothing — byte-for-byte the
+* constants the decode worker shipped with as env-var defaults, so making these
+* settings changed no behaviour on the day it landed.
+*/
+var DEFAULT_NATIVE_LEASE_SETTINGS = {
+	ttlMs: 1200,
+	budgetMb: 1024,
+	activityMs: 15e3,
+	admission: "inferred"
+};
+DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
+DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 //#endregion
 //#region ../../node_modules/undici/lib/core/symbols.js
 var require_symbols = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, module) => {
@@ -219545,69 +220460,6 @@ function buildInitialStatus(config) {
 	};
 }
 //#endregion
-//#region src/raw-state.ts
-/**
-* Source tag for every raw-state blob this provider emits.
-*/
-var RAW_STATE_SOURCE = "reolink";
-/**
-* Key fragments that mark a field as secret/credential bearing. Any
-* object key matching this (case-insensitive) is dropped from the
-* display-safe raw-state blob.
-*/
-var SECRET_KEY_PATTERN = /password|token|secret|credential|passwd|auth/i;
-/**
-* Deep-copy `value`, dropping any object key that looks like a
-* credential. Recurses into nested plain objects and arrays; leaves
-* primitives untouched. Never mutates the input.
-*/
-function redactValue(value) {
-	if (Array.isArray(value)) return value.map(redactValue);
-	if (value && typeof value === "object") {
-		const out = {};
-		for (const [key, child] of Object.entries(value)) {
-			if (SECRET_KEY_PATTERN.test(key)) continue;
-			out[key] = redactValue(child);
-		}
-		return out;
-	}
-	return value;
-}
-/**
-* Return a deep copy of `obj` with every credential-bearing key
-* removed at any depth. Display-safe.
-*/
-function redactSecrets(obj) {
-	return redactValue(obj);
-}
-/**
-* Snapshot every cached cap slice from `reader` and strip secrets.
-* Returns a `Record<capName, redactedSlice>`; empty when no slice has
-* been written yet.
-*/
-function collectRedactedSnapshot(reader) {
-	const snap = reader.snapshot();
-	const out = {};
-	for (const [capName, slice] of Object.entries(snap)) out[capName] = redactSecrets({ ...slice });
-	return out;
-}
-/**
-* Build the display-safe `{ source:'reolink', data }` raw-state blob
-* from a device's cached runtime-state slices. Returns `null` when
-* the device has no cached state at all (so the State panel hides the
-* Raw toggle rather than showing an empty object).
-*
-* No camera round-trip — reads only the in-memory runtime-state cache.
-*/
-function buildRawState(reader) {
-	const data = collectRedactedSnapshot(reader);
-	if (Object.keys(data).length === 0) return null;
-	return {
-		source: RAW_STATE_SOURCE,
-		data
-	};
-}
-//#endregion
 //#region src/day-night-mapping.ts
 /**
 * Maps between the vendor-neutral `day-night` cap's `DayNightMode` and
@@ -219720,44 +220572,68 @@ function overlayLiveNativeRfc4571Sdp(descriptors, liveServerFor) {
 	});
 }
 //#endregion
-//#region src/accessory-probe-flags.ts
-var FLAG_KEYS = [
-	"hasBattery",
-	"hasPtz",
-	"hasIntercom",
-	"hasDoorbell",
-	"hasFloodlight",
-	"hasSiren",
-	"hasPirSensor",
-	"hasAutotrack"
-];
+//#region src/raw-state.ts
 /**
-* True when EITHER the live `feature-probe` slice has completed a probe
-* this session (`sliceProbed`) OR a prior successful probe is persisted
-* in the `deviceCache` config blob (`probedAt` stamp). The latter
-* survives restarts, so a camera probed in an earlier session is still
-* "probed" for accessory-derivation purposes even if its live probe is
-* currently slow/failing.
+* Source tag for every raw-state blob this provider emits.
 */
-function hasEverProbed(sliceProbed, deviceCache) {
-	return sliceProbed || deviceCache?.probedAt !== void 0;
+var RAW_STATE_SOURCE = "reolink";
+/**
+* Key fragments that mark a field as secret/credential bearing. Any
+* object key matching this (case-insensitive) is dropped from the
+* display-safe raw-state blob.
+*/
+var SECRET_KEY_PATTERN = /password|token|secret|credential|passwd|auth/i;
+/**
+* Deep-copy `value`, dropping any object key that looks like a
+* credential. Recurses into nested plain objects and arrays; leaves
+* primitives untouched. Never mutates the input.
+*/
+function redactValue(value) {
+	if (Array.isArray(value)) return value.map(redactValue);
+	if (value && typeof value === "object") {
+		const out = {};
+		for (const [key, child] of Object.entries(value)) {
+			if (SECRET_KEY_PATTERN.test(key)) continue;
+			out[key] = redactValue(child);
+		}
+		return out;
+	}
+	return value;
 }
 /**
-* Effective ability flags for accessory derivation: the live slice
-* flags when the slice has probed this session, otherwise the boolean
-* flags persisted in `deviceCache` from the last successful probe.
-* Returns an empty bag when neither source carries a completed probe.
+* Return a deep copy of `obj` with every credential-bearing key
+* removed at any depth. Display-safe.
 */
-function resolveAccessoryProbeFlags(sliceProbed, sliceFlags, deviceCache) {
-	if (sliceProbed) return sliceFlags;
-	if (deviceCache?.probedAt === void 0) return {};
+function redactSecrets(obj) {
+	return redactValue(obj);
+}
+/**
+* Snapshot every cached cap slice from `reader` and strip secrets.
+* Returns a `Record<capName, redactedSlice>`; empty when no slice has
+* been written yet.
+*/
+function collectRedactedSnapshot(reader) {
+	const snap = reader.snapshot();
 	const out = {};
-	for (const key of FLAG_KEYS) {
-		const value = deviceCache[key];
-		if (typeof value === "boolean") out[key] = value;
-	}
+	for (const [capName, slice] of Object.entries(snap)) out[capName] = redactSecrets({ ...slice });
 	return out;
 }
+/**
+* Build the display-safe `{ source:'reolink', data }` raw-state blob
+* from a device's cached runtime-state slices. Returns `null` when
+* the device has no cached state at all (so the State panel hides the
+* Raw toggle rather than showing an empty object).
+*
+* No camera round-trip — reads only the in-memory runtime-state cache.
+*/
+function buildRawState(reader) {
+	const data = collectRedactedSnapshot(reader);
+	if (Object.keys(data).length === 0) return null;
+	return {
+		source: RAW_STATE_SOURCE,
+		data
+	};
+}
 //#endregion
 //#region src/accessories/base.ts
 /**
@@ -220885,6 +221761,45 @@ function createAccessoryDevice(kind, ctx, parent) {
 	}
 }
 //#endregion
+//#region src/accessory-probe-flags.ts
+var FLAG_KEYS = [
+	"hasBattery",
+	"hasPtz",
+	"hasIntercom",
+	"hasDoorbell",
+	"hasFloodlight",
+	"hasSiren",
+	"hasPirSensor",
+	"hasAutotrack"
+];
+/**
+* True when EITHER the live `feature-probe` slice has completed a probe
+* this session (`sliceProbed`) OR a prior successful probe is persisted
+* in the `deviceCache` config blob (`probedAt` stamp). The latter
+* survives restarts, so a camera probed in an earlier session is still
+* "probed" for accessory-derivation purposes even if its live probe is
+* currently slow/failing.
+*/
+function hasEverProbed(sliceProbed, deviceCache) {
+	return sliceProbed || deviceCache?.probedAt !== void 0;
+}
+/**
+* Effective ability flags for accessory derivation: the live slice
+* flags when the slice has probed this session, otherwise the boolean
+* flags persisted in `deviceCache` from the last successful probe.
+* Returns an empty bag when neither source carries a completed probe.
+*/
+function resolveAccessoryProbeFlags(sliceProbed, sliceFlags, deviceCache) {
+	if (sliceProbed) return sliceFlags;
+	if (deviceCache?.probedAt === void 0) return {};
+	const out = {};
+	for (const key of FLAG_KEYS) {
+		const value = deviceCache[key];
+		if (typeof value === "boolean") out[key] = value;
+	}
+	return out;
+}
+//#endregion
 //#region src/metadata-populator.ts
 var EXTENDED_INFO_TAGS = [
 	"type",
@@ -220988,6 +221903,760 @@ async function populateReolinkMetadata(api, channel, target) {
 	}
 }
 //#endregion
+//#region src/error-classifier.ts
+/**
+* Recognise transient Baichuan/socket failures that are expected to
+* recover on the next reconnect cycle. Mirrors
+* `scrypted-reolink-native/src/camera.ts isRecoverableBaichuanError` —
+* keeping parity so the same wire-level conditions are treated the
+* same way across plugins.
+*
+* Ported categories:
+*   - Baichuan-specific transport closes (`Baichuan socket closed`,
+*     `Baichuan UDP stream closed`, `Baichuan TCP socket is not
+*     connected`)
+*   - Generic TCP errors that fire as part of the same disconnect
+*     storm (`ECONNRESET`, `EPIPE`, `socket hang up`)
+*   - D2C disconnects (`D2C_DISC`) — UDP relay path teardown
+*
+* Callers downgrade these to WARN-level logs and trigger a fresh
+* login on the next demand instead of bubbling a hard ERROR.
+*/
+var RECOVERABLE_FRAGMENTS = [
+	"Baichuan socket closed",
+	"Baichuan UDP stream closed",
+	"Baichuan TCP socket is not connected",
+	"socket hang up",
+	"ECONNRESET",
+	"EPIPE",
+	"D2C_DISC"
+];
+function isRecoverableBaichuanError(err) {
+	const message = err instanceof Error ? err.message : typeof err === "string" ? err : err?.toString?.() ?? "";
+	return RECOVERABLE_FRAGMENTS.some((fragment) => message.includes(fragment));
+}
+//#endregion
+//#region src/intercom-encoder.ts
+/**
+* IMA ADPCM (DVI4) encoder — Reolink Baichuan talk-back wire format.
+*
+* Ported from `scrypted-reolink-native/src/intercom.ts` (BSD-2 like the
+* rest of the cross-cam Scrypted infra). Reolink cameras expect ADPCM
+* blocks of (4 + N) bytes:
+*   - 2 bytes: little-endian Int16 predictor (first PCM sample of the
+*     block, used to seed the decoder state on the camera side)
+*   - 1 byte: index into the IMA step table (always 0 — we re-seed
+*     the predictor on every block instead of carrying state forward)
+*   - 1 byte: padding
+*   - N bytes: 2 nibbles per byte, low nibble first, each nibble
+*     encodes one PCM sample's delta as `sign | delta3` (4 bits)
+*
+* The block size is camera-firmware specific; the lib reports it as
+* `TalkSessionInfo.blockSize` per session.
+*
+* Why standalone?
+*   - Pure function — no I/O, easy to unit-test
+*   - Reusable from the (currently stub) WebRTC server-side intercom
+*     path AND from any future direct-PCM caller
+*   - Decoupled from werift / lib types
+*/
+var IMA_INDEX_TABLE = Int8Array.from([
+	-1,
+	-1,
+	-1,
+	-1,
+	2,
+	4,
+	6,
+	8,
+	-1,
+	-1,
+	-1,
+	-1,
+	2,
+	4,
+	6,
+	8
+]);
+var IMA_STEP_TABLE = Int16Array.from([
+	7,
+	8,
+	9,
+	10,
+	11,
+	12,
+	13,
+	14,
+	16,
+	17,
+	19,
+	21,
+	23,
+	25,
+	28,
+	31,
+	34,
+	37,
+	41,
+	45,
+	50,
+	55,
+	60,
+	66,
+	73,
+	80,
+	88,
+	97,
+	107,
+	118,
+	130,
+	143,
+	157,
+	173,
+	190,
+	209,
+	230,
+	253,
+	279,
+	307,
+	337,
+	371,
+	408,
+	449,
+	494,
+	544,
+	598,
+	658,
+	724,
+	796,
+	876,
+	963,
+	1060,
+	1166,
+	1282,
+	1411,
+	1552,
+	1707,
+	1878,
+	2066,
+	2272,
+	2499,
+	2749,
+	3024,
+	3327,
+	3660,
+	4026,
+	4428,
+	4871,
+	5358,
+	5894,
+	6484,
+	7132,
+	7845,
+	8630,
+	9493,
+	10442,
+	11487,
+	12635,
+	13899,
+	15289,
+	16818,
+	18500,
+	20350,
+	22385,
+	24623,
+	27086,
+	29794,
+	32767
+]);
+function clamp16(x) {
+	if (x > 32767) return 32767;
+	if (x < -32768) return -32768;
+	return x | 0;
+}
+/**
+* Encode a PCM s16le buffer into IMA ADPCM blocks of size
+* `(4 + blockSizeBytes)` each. The output length is a multiple of
+* `4 + blockSizeBytes`. PCM samples that don't fit a full block at
+* the end get folded into a final partial block (the camera tolerates
+* trailing zeros from the unpopulated nibbles).
+*
+* Block layout per Reolink's wire format:
+*   bytes [0..1]   = predictor (Int16 LE)
+*   byte  [2]      = step index (always 0 — re-seed each block)
+*   byte  [3]      = padding (0x00)
+*   bytes [4..N+3] = packed nibbles (2 samples per byte, low first)
+*
+* Each block carries `blockSizeBytes * 2 + 1` PCM samples (the +1
+* is the predictor sample stored explicitly in the header).
+*/
+function encodeImaAdpcm(pcm, blockSizeBytes) {
+	const samplesPerBlock = blockSizeBytes * 2 + 1;
+	const totalBlocks = Math.ceil(pcm.length / samplesPerBlock);
+	const outBlocks = [];
+	let sampleIndex = 0;
+	for (let b = 0; b < totalBlocks; b++) {
+		const block = Buffer.alloc(4 + blockSizeBytes);
+		let predictor = pcm[sampleIndex] ?? 0;
+		let index = 0;
+		block.writeInt16LE(predictor, 0);
+		block.writeUInt8(index, 2);
+		block.writeUInt8(0, 3);
+		sampleIndex++;
+		const codes = new Uint8Array(blockSizeBytes * 2);
+		for (let i = 0; i < codes.length; i++) {
+			const sample = pcm[sampleIndex] ?? predictor;
+			sampleIndex++;
+			let diff = sample - predictor;
+			let sign = 0;
+			if (diff < 0) {
+				sign = 8;
+				diff = -diff;
+			}
+			let step = IMA_STEP_TABLE[index] ?? 7;
+			let delta = 0;
+			let vpdiff = step >> 3;
+			if (diff >= step) {
+				delta |= 4;
+				diff -= step;
+				vpdiff += step;
+			}
+			step >>= 1;
+			if (diff >= step) {
+				delta |= 2;
+				diff -= step;
+				vpdiff += step;
+			}
+			step >>= 1;
+			if (diff >= step) {
+				delta |= 1;
+				vpdiff += step;
+			}
+			predictor = sign ? clamp16(predictor - vpdiff) : clamp16(predictor + vpdiff);
+			index += IMA_INDEX_TABLE[delta] ?? 0;
+			if (index < 0) index = 0;
+			if (index > 88) index = 88;
+			codes[i] = (delta | sign) & 15;
+		}
+		for (let i = 0; i < blockSizeBytes; i++) {
+			const lo = codes[i * 2] ?? 0;
+			const hi = codes[i * 2 + 1] ?? 0;
+			block[4 + i] = lo & 15 | (hi & 15) << 4;
+		}
+		outBlocks.push(block);
+	}
+	return Buffer.concat(outBlocks);
+}
+//#endregion
+//#region src/intercom-session.ts
+var DEFAULT_BACKLOG_MS = 120;
+var MAX_BACKLOG_MS = 5e3;
+var MIN_BACKLOG_MS = 20;
+var DEFAULT_BLOCKS_PER_PAYLOAD = 1;
+var DEFAULT_GAIN = 1;
+var MIN_GAIN = .1;
+var MAX_GAIN = 10;
+var ReolinkIntercomSession = class {
+	opts;
+	session = null;
+	pcmBuffer = Buffer.alloc(0);
+	pumping = false;
+	pumpPromise = null;
+	maxBacklogBytes = 0;
+	bytesPerBlock = 0;
+	blockSize = 0;
+	lastBacklogClampLogAtMs = 0;
+	outputGain = DEFAULT_GAIN;
+	constructor(opts) {
+		this.opts = opts;
+	}
+	/** True once `start()` has resolved and not yet been `stop()`'d. */
+	get isOpen() {
+		return this.session !== null;
+	}
+	/** Sample rate the camera negotiated. Throws when not started. */
+	get sampleRate() {
+		if (!this.session) throw new Error("ReolinkIntercomSession.sampleRate read before start()");
+		return this.session.info.audioConfig.sampleRate;
+	}
+	async start() {
+		if (this.session) return;
+		this.outputGain = clampGain(this.opts.outputGain);
+		const session = await this.opts.api.createDedicatedTalkSession(this.opts.channel, {
+			blocksPerPayload: clampBlocks(this.opts.blocksPerPayload),
+			idleTimeoutMs: this.opts.idleTimeoutMs ?? 3e4,
+			deviceId: this.opts.deviceTag,
+			logger: { log: (msg, ...rest) => this.opts.logger.debug(`talk: ${msg}`, { meta: { rest } }) }
+		});
+		const { blockSize, fullBlockSize } = session.info;
+		if (!Number.isFinite(blockSize) || blockSize <= 0 || fullBlockSize !== blockSize + 4) {
+			try {
+				await session.stop();
+			} catch {}
+			throw new Error(`Reolink talk session reported invalid block sizes: blockSize=${blockSize} fullBlockSize=${fullBlockSize}`);
+		}
+		const samplesPerBlock = blockSize * 2 + 1;
+		this.bytesPerBlock = samplesPerBlock * 2;
+		this.blockSize = blockSize;
+		const sampleRate = session.info.audioConfig.sampleRate;
+		if (!Number.isFinite(sampleRate) || sampleRate <= 0) {
+			try {
+				await session.stop();
+			} catch {}
+			throw new Error(`Reolink talk session reported invalid sampleRate: ${sampleRate}`);
+		}
+		const wantedBacklogMs = Math.max(MIN_BACKLOG_MS, Math.min(MAX_BACKLOG_MS, this.opts.maxBacklogMs ?? DEFAULT_BACKLOG_MS));
+		this.maxBacklogBytes = Math.max(this.bytesPerBlock, Math.floor(wantedBacklogMs / 1e3 * sampleRate * 2));
+		this.session = session;
+		this.pcmBuffer = Buffer.alloc(0);
+		this.opts.logger.info("intercom talk session opened", { meta: {
+			channel: this.opts.channel,
+			sampleRate,
+			blockSize,
+			bytesPerBlock: this.bytesPerBlock,
+			backlogMs: wantedBacklogMs,
+			maxBacklogBytes: this.maxBacklogBytes,
+			blocksPerPayload: clampBlocks(this.opts.blocksPerPayload),
+			outputGain: this.outputGain
+		} });
+	}
+	/**
+	* Feed a chunk of PCM s16le at `this.sampleRate` Hz. Returns
+	* immediately after enqueueing — the actual encode + send happens
+	* in a background pump. Calls before `start()` (or after `stop()`)
+	* silently drop the chunk so callers don't have to gate every
+	* push on `isOpen`.
+	*/
+	feedPcm(pcm) {
+		if (!this.session) return;
+		if (pcm.length === 0) return;
+		this.pcmBuffer = this.pcmBuffer.length ? Buffer.concat([this.pcmBuffer, pcm]) : pcm;
+		if (this.pcmBuffer.length > this.maxBacklogBytes) {
+			const keep = this.maxBacklogBytes - this.maxBacklogBytes % 2;
+			const dropped = this.pcmBuffer.length - keep;
+			this.pcmBuffer = this.pcmBuffer.subarray(this.pcmBuffer.length - keep);
+			const now = Date.now();
+			if (now - this.lastBacklogClampLogAtMs > 2e3) {
+				this.lastBacklogClampLogAtMs = now;
+				this.opts.logger.warn("intercom backlog clamped (dropping PCM)", { meta: {
+					droppedBytes: dropped,
+					keptBytes: keep,
+					maxBytes: this.maxBacklogBytes
+				} });
+			}
+		}
+		if (!this.pumping) this.startPump();
+	}
+	startPump() {
+		const session = this.session;
+		if (!session) return;
+		this.pumping = true;
+		this.pumpPromise = (async () => {
+			try {
+				while (true) {
+					if (this.session !== session) return;
+					if (this.pcmBuffer.length < this.bytesPerBlock) return;
+					const chunk = this.pcmBuffer.subarray(0, this.bytesPerBlock);
+					this.pcmBuffer = this.pcmBuffer.subarray(this.bytesPerBlock);
+					const samples = new Int16Array(chunk.buffer, chunk.byteOffset, chunk.length / 2);
+					const adpcm = encodeImaAdpcm(this.outputGain === 1 ? samples : applyGainInt16(samples, this.outputGain), this.blockSize);
+					await session.sendAudio(adpcm);
+				}
+			} catch (err) {
+				this.opts.logger.warn("intercom pump error — stopping", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			} finally {
+				this.pumping = false;
+			}
+		})();
+	}
+	async stop() {
+		const session = this.session;
+		if (!session) return;
+		this.session = null;
+		this.pcmBuffer = Buffer.alloc(0);
+		if (this.pumpPromise) {
+			try {
+				await Promise.race([this.pumpPromise, new Promise((r) => setTimeout(r, 250))]);
+			} catch {}
+			this.pumpPromise = null;
+		}
+		try {
+			await Promise.race([session.stop(), new Promise((_, rej) => setTimeout(() => rej(/* @__PURE__ */ new Error("talk session stop timeout")), 2e3))]);
+		} catch (err) {
+			this.opts.logger.warn("intercom session stop error", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
+};
+/** Clamp `blocksPerPayload` into the lib's accepted range. Mirrors
+*  scrypted-reolink-native's `intercom-mixin.ts:96-101` clamp. */
+function clampBlocks(value) {
+	if (value === void 0 || !Number.isFinite(value)) return DEFAULT_BLOCKS_PER_PAYLOAD;
+	return Math.max(1, Math.min(8, Math.floor(value)));
+}
+/** Clamp `outputGain` into the operator-safe range. Same `[0.1, 10]`
+*  band as Scrypted (`intercom-mixin.ts:104-107`). */
+function clampGain(value) {
+	if (value === void 0 || !Number.isFinite(value)) return DEFAULT_GAIN;
+	return Math.max(MIN_GAIN, Math.min(MAX_GAIN, value));
+}
+/** Apply a floating-point gain to each `Int16` sample in-place into
+*  a freshly-allocated buffer. The result is hard-clipped to int16
+*  bounds — soft saturation isn't worth the tradeoff for an intercom
+*  channel where occasional clipping is preferable to a perceived
+*  loudness mismatch. */
+function applyGainInt16(samples, gain) {
+	const out = new Int16Array(samples.length);
+	for (let i = 0; i < samples.length; i++) {
+		const scaled = (samples[i] ?? 0) * gain;
+		out[i] = scaled > 32767 ? 32767 : scaled < -32768 ? -32768 : scaled;
+	}
+	return out;
+}
+//#endregion
+//#region src/intercom-orchestrator.ts
+/** Default Opus parameters used when the orchestrator caller doesn't
+*  override them. Browser Opus is canonically 48 kHz; mono is the only
+*  practical choice for an intercom (the camera's talk channel is
+*  mono — sending stereo would just cost bandwidth). */
+var DEFAULT_OPUS_SAMPLE_RATE = 48e3;
+var DEFAULT_OPUS_CHANNELS = 1;
+var DEFAULT_CAMERA_SAMPLE_RATE = 16e3;
+var IntercomOrchestrator = class {
+	opts;
+	session = null;
+	constructor(opts) {
+		this.opts = opts;
+	}
+	/** True while a session is open (between `start()` resolve and
+	*  `stop()` resolve). */
+	get isOpen() {
+		return this.session !== null && !this.session.closed;
+	}
+	/**
+	* Open a fresh WebRTC peer + audio-codec decode session + Reolink
+	* talk session, wire them, return the SDP offer. Throws (and tears
+	* down everything it had spun up) on any failure — the cap router
+	* surfaces the error to the client unchanged.
+	*
+	* Single-active-session semantics: a second `start()` while the
+	* first is still open closes the old session before opening the
+	* new one. The cap router enforces this on the caller side via
+	* `intercomSessions.size === 1` invariants.
+	*/
+	async start() {
+		if (this.session && !this.session.closed) await this.stop(this.session.sessionId, "superseded-by-new-start").catch(() => {});
+		const sessionId = generateSessionId();
+		const cameraRate = this.opts.cameraSampleRate ?? DEFAULT_CAMERA_SAMPLE_RATE;
+		const opusRate = this.opts.opusSampleRate ?? DEFAULT_OPUS_SAMPLE_RATE;
+		const opusChannels = this.opts.opusChannels ?? DEFAULT_OPUS_CHANNELS;
+		this.opts.logger.info("intercom: negotiate (opening session)", { meta: {
+			sessionId,
+			channel: this.opts.channel,
+			opusRate,
+			opusChannels
+		} });
+		if (this.opts.wakeBeforeStart) try {
+			await this.opts.wakeBeforeStart();
+		} catch (err) {
+			this.opts.logger.warn("intercom: pre-wake failed", { meta: { error: errMsg$1(err) } });
+			throw err;
+		}
+		const talkSession = new ReolinkIntercomSession({
+			channel: this.opts.channel,
+			api: this.opts.api,
+			logger: this.opts.logger.withTags?.({ sessionId }) ?? this.opts.logger,
+			deviceTag: this.opts.deviceTag,
+			...this.opts.blocksPerPayload !== void 0 ? { blocksPerPayload: this.opts.blocksPerPayload } : {},
+			...this.opts.maxBacklogMs !== void 0 ? { maxBacklogMs: this.opts.maxBacklogMs } : {},
+			...this.opts.outputGain !== void 0 ? { outputGain: this.opts.outputGain } : {}
+		});
+		try {
+			await talkSession.start();
+		} catch (err) {
+			this.opts.logger.warn("intercom: talk session open failed", { meta: { error: errMsg$1(err) } });
+			throw err;
+		}
+		const realCameraRate = talkSession.sampleRate;
+		const targetRate = Number.isFinite(realCameraRate) && realCameraRate > 0 ? realCameraRate : cameraRate;
+		let codec;
+		try {
+			codec = await this.opts.audioCodec.createDecodeSession({
+				codec: "opus",
+				sourceSampleRate: opusRate,
+				sourceChannels: opusChannels,
+				targetSampleRate: targetRate,
+				targetChannels: 1,
+				targetFormat: "s16le",
+				tag: `reolink-intercom:${this.opts.deviceTag}:${sessionId}`
+			});
+		} catch (err) {
+			await talkSession.stop().catch(() => {});
+			this.opts.logger.warn("intercom: audio-codec createDecodeSession failed", { meta: {
+				error: errMsg$1(err),
+				opusRate,
+				opusChannels,
+				targetRate
+			} });
+			throw err;
+		}
+		const peer = this.opts.peerFactory({ logger: this.opts.logger });
+		const active = {
+			sessionId,
+			peer,
+			talkSession,
+			codec,
+			closed: false,
+			startedAtMs: Date.now(),
+			framesPushed: 0,
+			pcmBytesPushed: 0,
+			answerApplied: false
+		};
+		this.session = active;
+		peer.onOpusFrame((frame, pts) => {
+			this.handleOpusFrame(active, frame, pts).catch((err) => {
+				this.opts.logger.debug("intercom: opus frame pump error (dropped)", { meta: { error: errMsg$1(err) } });
+			});
+		});
+		let offer;
+		try {
+			offer = await peer.createOffer();
+		} catch (err) {
+			await this.stop(sessionId, "start-failed-cleanup").catch(() => {});
+			this.opts.logger.warn("intercom: webrtc createOffer failed", { meta: { error: errMsg$1(err) } });
+			throw err;
+		}
+		this.opts.logger.info("intercom session opened", { meta: {
+			sessionId,
+			channel: this.opts.channel,
+			targetRate,
+			codecSessionId: codec.sessionId,
+			codecNodeId: codec.nodeId
+		} });
+		return {
+			sessionId,
+			sdpOffer: offer.sdp
+		};
+	}
+	/**
+	* Apply the browser's SDP answer. The session is identified by id
+	* (callers may have multiple cameras with overlapping intercom
+	* sessions in flight — though this orchestrator only tracks one).
+	* Mismatched session id throws.
+	*/
+	async handleAnswer(sessionId, sdpAnswer) {
+		const active = this.requireActive(sessionId);
+		await active.peer.setAnswer(sdpAnswer);
+		active.answerApplied = true;
+		this.opts.logger.info("intercom: SDP answer accepted (handshake complete)", { meta: { sessionId } });
+	}
+	/**
+	* Tear down the session in reverse-open order. Idempotent: a stop
+	* for an unknown / already-closed session resolves silently. Best-
+	* effort: a partial teardown (e.g. peer.close fails) does NOT
+	* abort the rest — the next steps still try to release their own
+	* resources.
+	*
+	* `reason` records WHY the session ended — surfaced in the close log so an
+	* immediate-close is diagnosable from one line. The cap-router stop path
+	* passes nothing and defaults to `'client-stop'`; internal teardown paths
+	* (supersede, start-failure cleanup) pass their specific reason.
+	*/
+	async stop(sessionId, reason = "client-stop") {
+		const active = this.session;
+		if (!active || active.sessionId !== sessionId || active.closed) return;
+		active.closed = true;
+		this.session = null;
+		try {
+			await active.peer.close();
+		} catch (err) {
+			this.opts.logger.debug("intercom: peer.close error (continuing)", { meta: {
+				sessionId,
+				error: errMsg$1(err)
+			} });
+		}
+		try {
+			await this.opts.audioCodec.closeSession({
+				sessionId: active.codec.sessionId,
+				nodeId: active.codec.nodeId
+			});
+		} catch (err) {
+			this.opts.logger.debug("intercom: audio-codec.closeSession error (continuing)", { meta: {
+				sessionId,
+				error: errMsg$1(err)
+			} });
+		}
+		try {
+			await active.talkSession.stop();
+		} catch (err) {
+			this.opts.logger.debug("intercom: talk-session.stop error (continuing)", { meta: {
+				sessionId,
+				error: errMsg$1(err)
+			} });
+		}
+		this.opts.logger.info("intercom session closed", { meta: {
+			sessionId,
+			reason,
+			answerApplied: active.answerApplied,
+			framesPushed: active.framesPushed,
+			pcmBytesPushed: active.pcmBytesPushed,
+			durationMs: Date.now() - active.startedAtMs
+		} });
+	}
+	/**
+	* Push one Opus frame into the audio-codec, immediately drain any
+	* decoded PCM, and feed it to the talk session. Push-then-pull
+	* keeps latency tight: each Opus frame produces ~20ms of PCM and
+	* we surface it on the same async tick.
+	*
+	* Errors here are isolated to a single frame — the caller wraps in
+	* a void-fire-and-forget so an audio-codec hiccup doesn't break
+	* the RTP receive loop.
+	*/
+	async handleOpusFrame(active, frame, pts) {
+		if (active.closed) return;
+		if (active.framesPushed === 0) this.opts.logger.info("intercom: first Opus frame received (feeding camera)", { meta: { sessionId: active.sessionId } });
+		active.framesPushed += 1;
+		await this.opts.audioCodec.pushEncodedFrame({
+			sessionId: active.codec.sessionId,
+			nodeId: active.codec.nodeId,
+			data: frame,
+			pts
+		});
+		if (active.closed) return;
+		const chunks = await this.opts.audioCodec.pullPcm({
+			sessionId: active.codec.sessionId,
+			nodeId: active.codec.nodeId,
+			maxCount: 8
+		});
+		if (active.closed) return;
+		for (const chunk of chunks) {
+			const buf = Buffer.from(chunk.data.buffer, chunk.data.byteOffset, chunk.data.byteLength);
+			active.pcmBytesPushed += buf.length;
+			active.talkSession.feedPcm(buf);
+		}
+	}
+	requireActive(sessionId) {
+		const active = this.session;
+		if (!active || active.closed || active.sessionId !== sessionId) throw new Error(`Reolink intercom: unknown or closed sessionId ${sessionId}`);
+		return active;
+	}
+};
+/** Random-enough session id — no crypto requirement, just needs to be
+*  unique-per-camera across reasonable timescales. */
+function generateSessionId() {
+	return `intercom-${Date.now().toString(36)}-${Math.floor(Math.random() * 16777215).toString(36)}`;
+}
+function errMsg$1(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
+//#region src/intercom-webrtc-peer.ts
+var _werift;
+/**
+* Lazy import — werift is an optional peer dep of this package
+* (declared via peerDependenciesMeta so npm install doesn't fail on
+* agents/clusters where the intercom is never used).
+*/
+async function loadWerift() {
+	if (_werift) return _werift;
+	try {
+		_werift = await Function("m", "return import(m)")("werift");
+		return _werift;
+	} catch {
+		throw new Error("The 'werift' package is required for Reolink intercom support but is not installed. Install it with: npm install werift");
+	}
+}
+var WeriftIntercomPeer = class {
+	opts;
+	pc = null;
+	opusCallbacks = [];
+	rtpUnsubscribe = null;
+	trackUnsubscribe = null;
+	closed = false;
+	/** Anchor PTS to the first observed RTP timestamp so the audio-
+	*  codec receives monotonically-increasing PTS values from zero
+	*  rather than the camera's free-running 32-bit RTP clock. */
+	firstRtpTimestamp = null;
+	constructor(opts) {
+		this.opts = opts;
+	}
+	onOpusFrame(cb) {
+		if (this.closed) return;
+		this.opusCallbacks.push(cb);
+	}
+	async createOffer() {
+		if (this.pc) throw new Error("WeriftIntercomPeer: createOffer called twice");
+		const werift = await loadWerift();
+		const pcOptions = {};
+		if (this.opts.iceServers && this.opts.iceServers.length > 0) pcOptions.iceServers = [...this.opts.iceServers];
+		const pc = new werift.RTCPeerConnection(pcOptions);
+		this.pc = pc;
+		const localTrack = new werift.MediaStreamTrack({ kind: "audio" });
+		const trackSub = pc.addTransceiver(localTrack, { direction: "sendrecv" }).onTrack.subscribe((track) => {
+			if (track.kind !== "audio") return;
+			const rtpSub = track.onReceiveRtp.subscribe((pkt) => {
+				if (this.closed) return;
+				const payload = pkt.payload;
+				if (!payload || payload.length === 0) return;
+				const ts = pkt.header.timestamp;
+				if (this.firstRtpTimestamp === null) this.firstRtpTimestamp = ts;
+				const relTs = ts - this.firstRtpTimestamp >>> 0;
+				const ptsMs = Math.round(relTs / 48);
+				for (const cb of this.opusCallbacks) try {
+					cb(payload, ptsMs);
+				} catch (err) {
+					this.opts.logger.debug("intercom-peer: opus callback threw", { meta: { error: errMsg(err) } });
+				}
+			});
+			if (rtpSub && typeof rtpSub.unsubscribe === "function") this.rtpUnsubscribe = () => rtpSub.unsubscribe?.();
+		});
+		if (trackSub && typeof trackSub.unsubscribe === "function") this.trackUnsubscribe = () => trackSub.unsubscribe?.();
+		pc.iceConnectionStateChange.subscribe((state) => {
+			this.opts.logger.info("intercom-peer: ICE state", { meta: { state } });
+		});
+		pc.iceGatheringStateChange.subscribe((state) => {
+			this.opts.logger.debug("intercom-peer: ICE gathering", { meta: { state } });
+		});
+		const offer = await pc.createOffer();
+		await pc.setLocalDescription(offer);
+		return { sdp: pc.localDescription?.sdp ?? offer.sdp };
+	}
+	async setAnswer(sdp) {
+		if (!this.pc) throw new Error("WeriftIntercomPeer: setAnswer called before createOffer");
+		if (this.closed) throw new Error("WeriftIntercomPeer: setAnswer called on closed peer");
+		await this.pc.setRemoteDescription({
+			sdp,
+			type: "answer"
+		});
+	}
+	async close() {
+		if (this.closed) return;
+		this.closed = true;
+		this.opusCallbacks = [];
+		if (this.rtpUnsubscribe) {
+			try {
+				this.rtpUnsubscribe();
+			} catch {}
+			this.rtpUnsubscribe = null;
+		}
+		if (this.trackUnsubscribe) {
+			try {
+				this.trackUnsubscribe();
+			} catch {}
+			this.trackUnsubscribe = null;
+		}
+		if (this.pc) {
+			try {
+				await Promise.resolve(this.pc.close());
+			} catch {}
+			this.pc = null;
+		}
+	}
+};
+function errMsg(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
 //#region src/schema.ts
 /**
 * Single source of truth for the addon id used in event source tags +
@@ -221827,842 +223496,6 @@ function mapDetectionEvent(event, cameraId, nowMs) {
 function isNativeObjectForwardingEnabled(capState) {
 	return capState?.enabled === true;
 }
-//#endregion
-//#region src/stream-routing.ts
-var KIND_RE = /^(native|rtsp|rtmp|flv):(.+)$/;
-var CH_PROFILE_RE = /^ch(\d+)-(main|sub|ext)$/;
-var PROFILE_ONLY_RE = /^(main|sub|ext)$/;
-/**
-* Build a camStreamId from the (kind, channel, profile) tuple. Single-channel
-* devices omit the `ch{N}-` infix; NVR / Hub include it so per-channel
-* routing survives the round-trip through the broker.
-*/
-function buildCamStreamId(kind, channel, profile, channelCount) {
-	if (channelCount > 1) return `${kind}:ch${channel}-${profile}`;
-	return `${kind}:${profile}`;
-}
-/**
-* Parse a Reolink camStreamId back to its (kind, channel, profile) tuple.
-* Returns `null` if the id does not match our format — the demand handler
-* uses this to ignore non-native streams (broker pulls those directly).
-*/
-function parseCamStreamId(camStreamId, defaultChannel) {
-	const m = KIND_RE.exec(camStreamId);
-	if (!m) return null;
-	const kind = m[1];
-	const rest = m[2];
-	const ch = CH_PROFILE_RE.exec(rest);
-	if (ch) return {
-		kind,
-		channel: parseInt(ch[1], 10),
-		profile: ch[2]
-	};
-	const p = PROFILE_ONLY_RE.exec(rest);
-	if (p) return {
-		kind,
-		channel: defaultChannel,
-		profile: p[1]
-	};
-	return null;
-}
-/** Render a human-readable label for the device-settings dropdown. */
-function streamLabel(s, kind) {
-	const parts = [];
-	if (kind) parts.push(kindLabel(kind));
-	if (s.channel !== void 0) parts.push(`Ch${s.channel}`);
-	parts.push(s.profile.charAt(0).toUpperCase() + s.profile.slice(1));
-	if (s.lens && s.lens !== "wide") parts.push(`(${s.lens})`);
-	return parts.join(" ");
-}
-function kindLabel(kind) {
-	switch (kind) {
-		case "native": return "Native";
-		case "rtsp": return "RTSP";
-		case "rtmp": return "RTMP";
-		case "flv": return "FLV";
-	}
-}
-/**
-* Synthetic native cam-stream id list used by `getStreamSources()` to
-* advertise the device's expected stream shape before the lib has been
-* called. `publishToBroker` ignores this — it always uses the live
-* result of `buildVideoStreamOptions()` instead.
-*/
-function buildStreamIds(channelCount) {
-	if (channelCount <= 1) return [{
-		id: "native:main",
-		label: "Native Main"
-	}, {
-		id: "native:sub",
-		label: "Native Sub"
-	}];
-	const out = [];
-	for (let ch = 0; ch < channelCount; ch++) {
-		out.push({
-			id: `native:ch${ch}-main`,
-			label: `Native Ch${ch} Main`
-		});
-		out.push({
-			id: `native:ch${ch}-sub`,
-			label: `Native Ch${ch} Sub`
-		});
-	}
-	return out;
-}
-//#endregion
-//#region src/error-classifier.ts
-/**
-* Recognise transient Baichuan/socket failures that are expected to
-* recover on the next reconnect cycle. Mirrors
-* `scrypted-reolink-native/src/camera.ts isRecoverableBaichuanError` —
-* keeping parity so the same wire-level conditions are treated the
-* same way across plugins.
-*
-* Ported categories:
-*   - Baichuan-specific transport closes (`Baichuan socket closed`,
-*     `Baichuan UDP stream closed`, `Baichuan TCP socket is not
-*     connected`)
-*   - Generic TCP errors that fire as part of the same disconnect
-*     storm (`ECONNRESET`, `EPIPE`, `socket hang up`)
-*   - D2C disconnects (`D2C_DISC`) — UDP relay path teardown
-*
-* Callers downgrade these to WARN-level logs and trigger a fresh
-* login on the next demand instead of bubbling a hard ERROR.
-*/
-var RECOVERABLE_FRAGMENTS = [
-	"Baichuan socket closed",
-	"Baichuan UDP stream closed",
-	"Baichuan TCP socket is not connected",
-	"socket hang up",
-	"ECONNRESET",
-	"EPIPE",
-	"D2C_DISC"
-];
-function isRecoverableBaichuanError(err) {
-	const message = err instanceof Error ? err.message : typeof err === "string" ? err : err?.toString?.() ?? "";
-	return RECOVERABLE_FRAGMENTS.some((fragment) => message.includes(fragment));
-}
-//#endregion
-//#region src/intercom-encoder.ts
-/**
-* IMA ADPCM (DVI4) encoder — Reolink Baichuan talk-back wire format.
-*
-* Ported from `scrypted-reolink-native/src/intercom.ts` (BSD-2 like the
-* rest of the cross-cam Scrypted infra). Reolink cameras expect ADPCM
-* blocks of (4 + N) bytes:
-*   - 2 bytes: little-endian Int16 predictor (first PCM sample of the
-*     block, used to seed the decoder state on the camera side)
-*   - 1 byte: index into the IMA step table (always 0 — we re-seed
-*     the predictor on every block instead of carrying state forward)
-*   - 1 byte: padding
-*   - N bytes: 2 nibbles per byte, low nibble first, each nibble
-*     encodes one PCM sample's delta as `sign | delta3` (4 bits)
-*
-* The block size is camera-firmware specific; the lib reports it as
-* `TalkSessionInfo.blockSize` per session.
-*
-* Why standalone?
-*   - Pure function — no I/O, easy to unit-test
-*   - Reusable from the (currently stub) WebRTC server-side intercom
-*     path AND from any future direct-PCM caller
-*   - Decoupled from werift / lib types
-*/
-var IMA_INDEX_TABLE = Int8Array.from([
-	-1,
-	-1,
-	-1,
-	-1,
-	2,
-	4,
-	6,
-	8,
-	-1,
-	-1,
-	-1,
-	-1,
-	2,
-	4,
-	6,
-	8
-]);
-var IMA_STEP_TABLE = Int16Array.from([
-	7,
-	8,
-	9,
-	10,
-	11,
-	12,
-	13,
-	14,
-	16,
-	17,
-	19,
-	21,
-	23,
-	25,
-	28,
-	31,
-	34,
-	37,
-	41,
-	45,
-	50,
-	55,
-	60,
-	66,
-	73,
-	80,
-	88,
-	97,
-	107,
-	118,
-	130,
-	143,
-	157,
-	173,
-	190,
-	209,
-	230,
-	253,
-	279,
-	307,
-	337,
-	371,
-	408,
-	449,
-	494,
-	544,
-	598,
-	658,
-	724,
-	796,
-	876,
-	963,
-	1060,
-	1166,
-	1282,
-	1411,
-	1552,
-	1707,
-	1878,
-	2066,
-	2272,
-	2499,
-	2749,
-	3024,
-	3327,
-	3660,
-	4026,
-	4428,
-	4871,
-	5358,
-	5894,
-	6484,
-	7132,
-	7845,
-	8630,
-	9493,
-	10442,
-	11487,
-	12635,
-	13899,
-	15289,
-	16818,
-	18500,
-	20350,
-	22385,
-	24623,
-	27086,
-	29794,
-	32767
-]);
-function clamp16(x) {
-	if (x > 32767) return 32767;
-	if (x < -32768) return -32768;
-	return x | 0;
-}
-/**
-* Encode a PCM s16le buffer into IMA ADPCM blocks of size
-* `(4 + blockSizeBytes)` each. The output length is a multiple of
-* `4 + blockSizeBytes`. PCM samples that don't fit a full block at
-* the end get folded into a final partial block (the camera tolerates
-* trailing zeros from the unpopulated nibbles).
-*
-* Block layout per Reolink's wire format:
-*   bytes [0..1]   = predictor (Int16 LE)
-*   byte  [2]      = step index (always 0 — re-seed each block)
-*   byte  [3]      = padding (0x00)
-*   bytes [4..N+3] = packed nibbles (2 samples per byte, low first)
-*
-* Each block carries `blockSizeBytes * 2 + 1` PCM samples (the +1
-* is the predictor sample stored explicitly in the header).
-*/
-function encodeImaAdpcm(pcm, blockSizeBytes) {
-	const samplesPerBlock = blockSizeBytes * 2 + 1;
-	const totalBlocks = Math.ceil(pcm.length / samplesPerBlock);
-	const outBlocks = [];
-	let sampleIndex = 0;
-	for (let b = 0; b < totalBlocks; b++) {
-		const block = Buffer.alloc(4 + blockSizeBytes);
-		let predictor = pcm[sampleIndex] ?? 0;
-		let index = 0;
-		block.writeInt16LE(predictor, 0);
-		block.writeUInt8(index, 2);
-		block.writeUInt8(0, 3);
-		sampleIndex++;
-		const codes = new Uint8Array(blockSizeBytes * 2);
-		for (let i = 0; i < codes.length; i++) {
-			const sample = pcm[sampleIndex] ?? predictor;
-			sampleIndex++;
-			let diff = sample - predictor;
-			let sign = 0;
-			if (diff < 0) {
-				sign = 8;
-				diff = -diff;
-			}
-			let step = IMA_STEP_TABLE[index] ?? 7;
-			let delta = 0;
-			let vpdiff = step >> 3;
-			if (diff >= step) {
-				delta |= 4;
-				diff -= step;
-				vpdiff += step;
-			}
-			step >>= 1;
-			if (diff >= step) {
-				delta |= 2;
-				diff -= step;
-				vpdiff += step;
-			}
-			step >>= 1;
-			if (diff >= step) {
-				delta |= 1;
-				vpdiff += step;
-			}
-			predictor = sign ? clamp16(predictor - vpdiff) : clamp16(predictor + vpdiff);
-			index += IMA_INDEX_TABLE[delta] ?? 0;
-			if (index < 0) index = 0;
-			if (index > 88) index = 88;
-			codes[i] = (delta | sign) & 15;
-		}
-		for (let i = 0; i < blockSizeBytes; i++) {
-			const lo = codes[i * 2] ?? 0;
-			const hi = codes[i * 2 + 1] ?? 0;
-			block[4 + i] = lo & 15 | (hi & 15) << 4;
-		}
-		outBlocks.push(block);
-	}
-	return Buffer.concat(outBlocks);
-}
-//#endregion
-//#region src/intercom-session.ts
-var DEFAULT_BACKLOG_MS = 120;
-var MAX_BACKLOG_MS = 5e3;
-var MIN_BACKLOG_MS = 20;
-var DEFAULT_BLOCKS_PER_PAYLOAD = 1;
-var DEFAULT_GAIN = 1;
-var MIN_GAIN = .1;
-var MAX_GAIN = 10;
-var ReolinkIntercomSession = class {
-	opts;
-	session = null;
-	pcmBuffer = Buffer.alloc(0);
-	pumping = false;
-	pumpPromise = null;
-	maxBacklogBytes = 0;
-	bytesPerBlock = 0;
-	blockSize = 0;
-	lastBacklogClampLogAtMs = 0;
-	outputGain = DEFAULT_GAIN;
-	constructor(opts) {
-		this.opts = opts;
-	}
-	/** True once `start()` has resolved and not yet been `stop()`'d. */
-	get isOpen() {
-		return this.session !== null;
-	}
-	/** Sample rate the camera negotiated. Throws when not started. */
-	get sampleRate() {
-		if (!this.session) throw new Error("ReolinkIntercomSession.sampleRate read before start()");
-		return this.session.info.audioConfig.sampleRate;
-	}
-	async start() {
-		if (this.session) return;
-		this.outputGain = clampGain(this.opts.outputGain);
-		const session = await this.opts.api.createDedicatedTalkSession(this.opts.channel, {
-			blocksPerPayload: clampBlocks(this.opts.blocksPerPayload),
-			idleTimeoutMs: this.opts.idleTimeoutMs ?? 3e4,
-			deviceId: this.opts.deviceTag,
-			logger: { log: (msg, ...rest) => this.opts.logger.debug(`talk: ${msg}`, { meta: { rest } }) }
-		});
-		const { blockSize, fullBlockSize } = session.info;
-		if (!Number.isFinite(blockSize) || blockSize <= 0 || fullBlockSize !== blockSize + 4) {
-			try {
-				await session.stop();
-			} catch {}
-			throw new Error(`Reolink talk session reported invalid block sizes: blockSize=${blockSize} fullBlockSize=${fullBlockSize}`);
-		}
-		const samplesPerBlock = blockSize * 2 + 1;
-		this.bytesPerBlock = samplesPerBlock * 2;
-		this.blockSize = blockSize;
-		const sampleRate = session.info.audioConfig.sampleRate;
-		if (!Number.isFinite(sampleRate) || sampleRate <= 0) {
-			try {
-				await session.stop();
-			} catch {}
-			throw new Error(`Reolink talk session reported invalid sampleRate: ${sampleRate}`);
-		}
-		const wantedBacklogMs = Math.max(MIN_BACKLOG_MS, Math.min(MAX_BACKLOG_MS, this.opts.maxBacklogMs ?? DEFAULT_BACKLOG_MS));
-		this.maxBacklogBytes = Math.max(this.bytesPerBlock, Math.floor(wantedBacklogMs / 1e3 * sampleRate * 2));
-		this.session = session;
-		this.pcmBuffer = Buffer.alloc(0);
-		this.opts.logger.info("intercom talk session opened", { meta: {
-			channel: this.opts.channel,
-			sampleRate,
-			blockSize,
-			bytesPerBlock: this.bytesPerBlock,
-			backlogMs: wantedBacklogMs,
-			maxBacklogBytes: this.maxBacklogBytes,
-			blocksPerPayload: clampBlocks(this.opts.blocksPerPayload),
-			outputGain: this.outputGain
-		} });
-	}
-	/**
-	* Feed a chunk of PCM s16le at `this.sampleRate` Hz. Returns
-	* immediately after enqueueing — the actual encode + send happens
-	* in a background pump. Calls before `start()` (or after `stop()`)
-	* silently drop the chunk so callers don't have to gate every
-	* push on `isOpen`.
-	*/
-	feedPcm(pcm) {
-		if (!this.session) return;
-		if (pcm.length === 0) return;
-		this.pcmBuffer = this.pcmBuffer.length ? Buffer.concat([this.pcmBuffer, pcm]) : pcm;
-		if (this.pcmBuffer.length > this.maxBacklogBytes) {
-			const keep = this.maxBacklogBytes - this.maxBacklogBytes % 2;
-			const dropped = this.pcmBuffer.length - keep;
-			this.pcmBuffer = this.pcmBuffer.subarray(this.pcmBuffer.length - keep);
-			const now = Date.now();
-			if (now - this.lastBacklogClampLogAtMs > 2e3) {
-				this.lastBacklogClampLogAtMs = now;
-				this.opts.logger.warn("intercom backlog clamped (dropping PCM)", { meta: {
-					droppedBytes: dropped,
-					keptBytes: keep,
-					maxBytes: this.maxBacklogBytes
-				} });
-			}
-		}
-		if (!this.pumping) this.startPump();
-	}
-	startPump() {
-		const session = this.session;
-		if (!session) return;
-		this.pumping = true;
-		this.pumpPromise = (async () => {
-			try {
-				while (true) {
-					if (this.session !== session) return;
-					if (this.pcmBuffer.length < this.bytesPerBlock) return;
-					const chunk = this.pcmBuffer.subarray(0, this.bytesPerBlock);
-					this.pcmBuffer = this.pcmBuffer.subarray(this.bytesPerBlock);
-					const samples = new Int16Array(chunk.buffer, chunk.byteOffset, chunk.length / 2);
-					const adpcm = encodeImaAdpcm(this.outputGain === 1 ? samples : applyGainInt16(samples, this.outputGain), this.blockSize);
-					await session.sendAudio(adpcm);
-				}
-			} catch (err) {
-				this.opts.logger.warn("intercom pump error — stopping", { meta: { error: err instanceof Error ? err.message : String(err) } });
-			} finally {
-				this.pumping = false;
-			}
-		})();
-	}
-	async stop() {
-		const session = this.session;
-		if (!session) return;
-		this.session = null;
-		this.pcmBuffer = Buffer.alloc(0);
-		if (this.pumpPromise) {
-			try {
-				await Promise.race([this.pumpPromise, new Promise((r) => setTimeout(r, 250))]);
-			} catch {}
-			this.pumpPromise = null;
-		}
-		try {
-			await Promise.race([session.stop(), new Promise((_, rej) => setTimeout(() => rej(/* @__PURE__ */ new Error("talk session stop timeout")), 2e3))]);
-		} catch (err) {
-			this.opts.logger.warn("intercom session stop error", { meta: { error: err instanceof Error ? err.message : String(err) } });
-		}
-	}
-};
-/** Clamp `blocksPerPayload` into the lib's accepted range. Mirrors
-*  scrypted-reolink-native's `intercom-mixin.ts:96-101` clamp. */
-function clampBlocks(value) {
-	if (value === void 0 || !Number.isFinite(value)) return DEFAULT_BLOCKS_PER_PAYLOAD;
-	return Math.max(1, Math.min(8, Math.floor(value)));
-}
-/** Clamp `outputGain` into the operator-safe range. Same `[0.1, 10]`
-*  band as Scrypted (`intercom-mixin.ts:104-107`). */
-function clampGain(value) {
-	if (value === void 0 || !Number.isFinite(value)) return DEFAULT_GAIN;
-	return Math.max(MIN_GAIN, Math.min(MAX_GAIN, value));
-}
-/** Apply a floating-point gain to each `Int16` sample in-place into
-*  a freshly-allocated buffer. The result is hard-clipped to int16
-*  bounds — soft saturation isn't worth the tradeoff for an intercom
-*  channel where occasional clipping is preferable to a perceived
-*  loudness mismatch. */
-function applyGainInt16(samples, gain) {
-	const out = new Int16Array(samples.length);
-	for (let i = 0; i < samples.length; i++) {
-		const scaled = (samples[i] ?? 0) * gain;
-		out[i] = scaled > 32767 ? 32767 : scaled < -32768 ? -32768 : scaled;
-	}
-	return out;
-}
-//#endregion
-//#region src/intercom-orchestrator.ts
-/** Default Opus parameters used when the orchestrator caller doesn't
-*  override them. Browser Opus is canonically 48 kHz; mono is the only
-*  practical choice for an intercom (the camera's talk channel is
-*  mono — sending stereo would just cost bandwidth). */
-var DEFAULT_OPUS_SAMPLE_RATE = 48e3;
-var DEFAULT_OPUS_CHANNELS = 1;
-var DEFAULT_CAMERA_SAMPLE_RATE = 16e3;
-var IntercomOrchestrator = class {
-	opts;
-	session = null;
-	constructor(opts) {
-		this.opts = opts;
-	}
-	/** True while a session is open (between `start()` resolve and
-	*  `stop()` resolve). */
-	get isOpen() {
-		return this.session !== null && !this.session.closed;
-	}
-	/**
-	* Open a fresh WebRTC peer + audio-codec decode session + Reolink
-	* talk session, wire them, return the SDP offer. Throws (and tears
-	* down everything it had spun up) on any failure — the cap router
-	* surfaces the error to the client unchanged.
-	*
-	* Single-active-session semantics: a second `start()` while the
-	* first is still open closes the old session before opening the
-	* new one. The cap router enforces this on the caller side via
-	* `intercomSessions.size === 1` invariants.
-	*/
-	async start() {
-		if (this.session && !this.session.closed) await this.stop(this.session.sessionId, "superseded-by-new-start").catch(() => {});
-		const sessionId = generateSessionId();
-		const cameraRate = this.opts.cameraSampleRate ?? DEFAULT_CAMERA_SAMPLE_RATE;
-		const opusRate = this.opts.opusSampleRate ?? DEFAULT_OPUS_SAMPLE_RATE;
-		const opusChannels = this.opts.opusChannels ?? DEFAULT_OPUS_CHANNELS;
-		this.opts.logger.info("intercom: negotiate (opening session)", { meta: {
-			sessionId,
-			channel: this.opts.channel,
-			opusRate,
-			opusChannels
-		} });
-		if (this.opts.wakeBeforeStart) try {
-			await this.opts.wakeBeforeStart();
-		} catch (err) {
-			this.opts.logger.warn("intercom: pre-wake failed", { meta: { error: errMsg$1(err) } });
-			throw err;
-		}
-		const talkSession = new ReolinkIntercomSession({
-			channel: this.opts.channel,
-			api: this.opts.api,
-			logger: this.opts.logger.withTags?.({ sessionId }) ?? this.opts.logger,
-			deviceTag: this.opts.deviceTag,
-			...this.opts.blocksPerPayload !== void 0 ? { blocksPerPayload: this.opts.blocksPerPayload } : {},
-			...this.opts.maxBacklogMs !== void 0 ? { maxBacklogMs: this.opts.maxBacklogMs } : {},
-			...this.opts.outputGain !== void 0 ? { outputGain: this.opts.outputGain } : {}
-		});
-		try {
-			await talkSession.start();
-		} catch (err) {
-			this.opts.logger.warn("intercom: talk session open failed", { meta: { error: errMsg$1(err) } });
-			throw err;
-		}
-		const realCameraRate = talkSession.sampleRate;
-		const targetRate = Number.isFinite(realCameraRate) && realCameraRate > 0 ? realCameraRate : cameraRate;
-		let codec;
-		try {
-			codec = await this.opts.audioCodec.createDecodeSession({
-				codec: "opus",
-				sourceSampleRate: opusRate,
-				sourceChannels: opusChannels,
-				targetSampleRate: targetRate,
-				targetChannels: 1,
-				targetFormat: "s16le",
-				tag: `reolink-intercom:${this.opts.deviceTag}:${sessionId}`
-			});
-		} catch (err) {
-			await talkSession.stop().catch(() => {});
-			this.opts.logger.warn("intercom: audio-codec createDecodeSession failed", { meta: {
-				error: errMsg$1(err),
-				opusRate,
-				opusChannels,
-				targetRate
-			} });
-			throw err;
-		}
-		const peer = this.opts.peerFactory({ logger: this.opts.logger });
-		const active = {
-			sessionId,
-			peer,
-			talkSession,
-			codec,
-			closed: false,
-			startedAtMs: Date.now(),
-			framesPushed: 0,
-			pcmBytesPushed: 0,
-			answerApplied: false
-		};
-		this.session = active;
-		peer.onOpusFrame((frame, pts) => {
-			this.handleOpusFrame(active, frame, pts).catch((err) => {
-				this.opts.logger.debug("intercom: opus frame pump error (dropped)", { meta: { error: errMsg$1(err) } });
-			});
-		});
-		let offer;
-		try {
-			offer = await peer.createOffer();
-		} catch (err) {
-			await this.stop(sessionId, "start-failed-cleanup").catch(() => {});
-			this.opts.logger.warn("intercom: webrtc createOffer failed", { meta: { error: errMsg$1(err) } });
-			throw err;
-		}
-		this.opts.logger.info("intercom session opened", { meta: {
-			sessionId,
-			channel: this.opts.channel,
-			targetRate,
-			codecSessionId: codec.sessionId,
-			codecNodeId: codec.nodeId
-		} });
-		return {
-			sessionId,
-			sdpOffer: offer.sdp
-		};
-	}
-	/**
-	* Apply the browser's SDP answer. The session is identified by id
-	* (callers may have multiple cameras with overlapping intercom
-	* sessions in flight — though this orchestrator only tracks one).
-	* Mismatched session id throws.
-	*/
-	async handleAnswer(sessionId, sdpAnswer) {
-		const active = this.requireActive(sessionId);
-		await active.peer.setAnswer(sdpAnswer);
-		active.answerApplied = true;
-		this.opts.logger.info("intercom: SDP answer accepted (handshake complete)", { meta: { sessionId } });
-	}
-	/**
-	* Tear down the session in reverse-open order. Idempotent: a stop
-	* for an unknown / already-closed session resolves silently. Best-
-	* effort: a partial teardown (e.g. peer.close fails) does NOT
-	* abort the rest — the next steps still try to release their own
-	* resources.
-	*
-	* `reason` records WHY the session ended — surfaced in the close log so an
-	* immediate-close is diagnosable from one line. The cap-router stop path
-	* passes nothing and defaults to `'client-stop'`; internal teardown paths
-	* (supersede, start-failure cleanup) pass their specific reason.
-	*/
-	async stop(sessionId, reason = "client-stop") {
-		const active = this.session;
-		if (!active || active.sessionId !== sessionId || active.closed) return;
-		active.closed = true;
-		this.session = null;
-		try {
-			await active.peer.close();
-		} catch (err) {
-			this.opts.logger.debug("intercom: peer.close error (continuing)", { meta: {
-				sessionId,
-				error: errMsg$1(err)
-			} });
-		}
-		try {
-			await this.opts.audioCodec.closeSession({
-				sessionId: active.codec.sessionId,
-				nodeId: active.codec.nodeId
-			});
-		} catch (err) {
-			this.opts.logger.debug("intercom: audio-codec.closeSession error (continuing)", { meta: {
-				sessionId,
-				error: errMsg$1(err)
-			} });
-		}
-		try {
-			await active.talkSession.stop();
-		} catch (err) {
-			this.opts.logger.debug("intercom: talk-session.stop error (continuing)", { meta: {
-				sessionId,
-				error: errMsg$1(err)
-			} });
-		}
-		this.opts.logger.info("intercom session closed", { meta: {
-			sessionId,
-			reason,
-			answerApplied: active.answerApplied,
-			framesPushed: active.framesPushed,
-			pcmBytesPushed: active.pcmBytesPushed,
-			durationMs: Date.now() - active.startedAtMs
-		} });
-	}
-	/**
-	* Push one Opus frame into the audio-codec, immediately drain any
-	* decoded PCM, and feed it to the talk session. Push-then-pull
-	* keeps latency tight: each Opus frame produces ~20ms of PCM and
-	* we surface it on the same async tick.
-	*
-	* Errors here are isolated to a single frame — the caller wraps in
-	* a void-fire-and-forget so an audio-codec hiccup doesn't break
-	* the RTP receive loop.
-	*/
-	async handleOpusFrame(active, frame, pts) {
-		if (active.closed) return;
-		if (active.framesPushed === 0) this.opts.logger.info("intercom: first Opus frame received (feeding camera)", { meta: { sessionId: active.sessionId } });
-		active.framesPushed += 1;
-		await this.opts.audioCodec.pushEncodedFrame({
-			sessionId: active.codec.sessionId,
-			nodeId: active.codec.nodeId,
-			data: frame,
-			pts
-		});
-		if (active.closed) return;
-		const chunks = await this.opts.audioCodec.pullPcm({
-			sessionId: active.codec.sessionId,
-			nodeId: active.codec.nodeId,
-			maxCount: 8
-		});
-		if (active.closed) return;
-		for (const chunk of chunks) {
-			const buf = Buffer.from(chunk.data.buffer, chunk.data.byteOffset, chunk.data.byteLength);
-			active.pcmBytesPushed += buf.length;
-			active.talkSession.feedPcm(buf);
-		}
-	}
-	requireActive(sessionId) {
-		const active = this.session;
-		if (!active || active.closed || active.sessionId !== sessionId) throw new Error(`Reolink intercom: unknown or closed sessionId ${sessionId}`);
-		return active;
-	}
-};
-/** Random-enough session id — no crypto requirement, just needs to be
-*  unique-per-camera across reasonable timescales. */
-function generateSessionId() {
-	return `intercom-${Date.now().toString(36)}-${Math.floor(Math.random() * 16777215).toString(36)}`;
-}
-function errMsg$1(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-//#endregion
-//#region src/intercom-webrtc-peer.ts
-var _werift;
-/**
-* Lazy import — werift is an optional peer dep of this package
-* (declared via peerDependenciesMeta so npm install doesn't fail on
-* agents/clusters where the intercom is never used).
-*/
-async function loadWerift() {
-	if (_werift) return _werift;
-	try {
-		_werift = await Function("m", "return import(m)")("werift");
-		return _werift;
-	} catch {
-		throw new Error("The 'werift' package is required for Reolink intercom support but is not installed. Install it with: npm install werift");
-	}
-}
-var WeriftIntercomPeer = class {
-	opts;
-	pc = null;
-	opusCallbacks = [];
-	rtpUnsubscribe = null;
-	trackUnsubscribe = null;
-	closed = false;
-	/** Anchor PTS to the first observed RTP timestamp so the audio-
-	*  codec receives monotonically-increasing PTS values from zero
-	*  rather than the camera's free-running 32-bit RTP clock. */
-	firstRtpTimestamp = null;
-	constructor(opts) {
-		this.opts = opts;
-	}
-	onOpusFrame(cb) {
-		if (this.closed) return;
-		this.opusCallbacks.push(cb);
-	}
-	async createOffer() {
-		if (this.pc) throw new Error("WeriftIntercomPeer: createOffer called twice");
-		const werift = await loadWerift();
-		const pcOptions = {};
-		if (this.opts.iceServers && this.opts.iceServers.length > 0) pcOptions.iceServers = [...this.opts.iceServers];
-		const pc = new werift.RTCPeerConnection(pcOptions);
-		this.pc = pc;
-		const localTrack = new werift.MediaStreamTrack({ kind: "audio" });
-		const trackSub = pc.addTransceiver(localTrack, { direction: "sendrecv" }).onTrack.subscribe((track) => {
-			if (track.kind !== "audio") return;
-			const rtpSub = track.onReceiveRtp.subscribe((pkt) => {
-				if (this.closed) return;
-				const payload = pkt.payload;
-				if (!payload || payload.length === 0) return;
-				const ts = pkt.header.timestamp;
-				if (this.firstRtpTimestamp === null) this.firstRtpTimestamp = ts;
-				const relTs = ts - this.firstRtpTimestamp >>> 0;
-				const ptsMs = Math.round(relTs / 48);
-				for (const cb of this.opusCallbacks) try {
-					cb(payload, ptsMs);
-				} catch (err) {
-					this.opts.logger.debug("intercom-peer: opus callback threw", { meta: { error: errMsg(err) } });
-				}
-			});
-			if (rtpSub && typeof rtpSub.unsubscribe === "function") this.rtpUnsubscribe = () => rtpSub.unsubscribe?.();
-		});
-		if (trackSub && typeof trackSub.unsubscribe === "function") this.trackUnsubscribe = () => trackSub.unsubscribe?.();
-		pc.iceConnectionStateChange.subscribe((state) => {
-			this.opts.logger.info("intercom-peer: ICE state", { meta: { state } });
-		});
-		pc.iceGatheringStateChange.subscribe((state) => {
-			this.opts.logger.debug("intercom-peer: ICE gathering", { meta: { state } });
-		});
-		const offer = await pc.createOffer();
-		await pc.setLocalDescription(offer);
-		return { sdp: pc.localDescription?.sdp ?? offer.sdp };
-	}
-	async setAnswer(sdp) {
-		if (!this.pc) throw new Error("WeriftIntercomPeer: setAnswer called before createOffer");
-		if (this.closed) throw new Error("WeriftIntercomPeer: setAnswer called on closed peer");
-		await this.pc.setRemoteDescription({
-			sdp,
-			type: "answer"
-		});
-	}
-	async close() {
-		if (this.closed) return;
-		this.closed = true;
-		this.opusCallbacks = [];
-		if (this.rtpUnsubscribe) {
-			try {
-				this.rtpUnsubscribe();
-			} catch {}
-			this.rtpUnsubscribe = null;
-		}
-		if (this.trackUnsubscribe) {
-			try {
-				this.trackUnsubscribe();
-			} catch {}
-			this.trackUnsubscribe = null;
-		}
-		if (this.pc) {
-			try {
-				await Promise.resolve(this.pc.close());
-			} catch {}
-			this.pc = null;
-		}
-	}
-};
-function errMsg(err) {
-	return err instanceof Error ? err.message : String(err);
-}
 function formatUserLevel(level) {
 	if (level === void 0 || level === null) return "user";
 	if (typeof level === "string" && level.length > 0) return level;
@@ -222866,6 +223699,88 @@ function buildSessionsTabSections(snap, opts) {
 	}];
 }
 //#endregion
+//#region src/stream-routing.ts
+var KIND_RE = /^(native|rtsp|rtmp|flv):(.+)$/;
+var CH_PROFILE_RE = /^ch(\d+)-(main|sub|ext)$/;
+var PROFILE_ONLY_RE = /^(main|sub|ext)$/;
+/**
+* Build a camStreamId from the (kind, channel, profile) tuple. Single-channel
+* devices omit the `ch{N}-` infix; NVR / Hub include it so per-channel
+* routing survives the round-trip through the broker.
+*/
+function buildCamStreamId(kind, channel, profile, channelCount) {
+	if (channelCount > 1) return `${kind}:ch${channel}-${profile}`;
+	return `${kind}:${profile}`;
+}
+/**
+* Parse a Reolink camStreamId back to its (kind, channel, profile) tuple.
+* Returns `null` if the id does not match our format — the demand handler
+* uses this to ignore non-native streams (broker pulls those directly).
+*/
+function parseCamStreamId(camStreamId, defaultChannel) {
+	const m = KIND_RE.exec(camStreamId);
+	if (!m) return null;
+	const kind = m[1];
+	const rest = m[2];
+	const ch = CH_PROFILE_RE.exec(rest);
+	if (ch) return {
+		kind,
+		channel: parseInt(ch[1], 10),
+		profile: ch[2]
+	};
+	const p = PROFILE_ONLY_RE.exec(rest);
+	if (p) return {
+		kind,
+		channel: defaultChannel,
+		profile: p[1]
+	};
+	return null;
+}
+/** Render a human-readable label for the device-settings dropdown. */
+function streamLabel(s, kind) {
+	const parts = [];
+	if (kind) parts.push(kindLabel(kind));
+	if (s.channel !== void 0) parts.push(`Ch${s.channel}`);
+	parts.push(s.profile.charAt(0).toUpperCase() + s.profile.slice(1));
+	if (s.lens && s.lens !== "wide") parts.push(`(${s.lens})`);
+	return parts.join(" ");
+}
+function kindLabel(kind) {
+	switch (kind) {
+		case "native": return "Native";
+		case "rtsp": return "RTSP";
+		case "rtmp": return "RTMP";
+		case "flv": return "FLV";
+	}
+}
+/**
+* Synthetic native cam-stream id list used by `getStreamSources()` to
+* advertise the device's expected stream shape before the lib has been
+* called. `publishToBroker` ignores this — it always uses the live
+* result of `buildVideoStreamOptions()` instead.
+*/
+function buildStreamIds(channelCount) {
+	if (channelCount <= 1) return [{
+		id: "native:main",
+		label: "Native Main"
+	}, {
+		id: "native:sub",
+		label: "Native Sub"
+	}];
+	const out = [];
+	for (let ch = 0; ch < channelCount; ch++) {
+		out.push({
+			id: `native:ch${ch}-main`,
+			label: `Native Ch${ch} Main`
+		});
+		out.push({
+			id: `native:ch${ch}-sub`,
+			label: `Native Ch${ch} Sub`
+		});
+	}
+	return out;
+}
+//#endregion
 //#region src/synthetic-sdp.ts
 /**
 * Build a synthetic SDP for `pull-rfc4571` entries from device-side
@@ -222946,6 +223861,18 @@ function buildLazyRfc4571Url(camStreamId) {
 }
 //#endregion
 //#region src/reolink-camera.ts
+/**
+* The `<Compression>` stream blocks that can carry an audio flag, in the
+* order the camera reports them. Named once so the read
+* (`readStreamAudioProfiles`) and the write (`setAudioEnabled`) cannot cover
+* different sets — a mute that skipped a stream would leave the camera
+* audible while reporting itself silent.
+*/
+var REOLINK_AUDIO_STREAM_KEYS = [
+	"mainStream",
+	"subStream",
+	"thirdStream"
+];
 /** Generate a short random hex token for per-stream RTSP-style credentials. */
 function randomToken(bytes) {
 	return (0, node_crypto.randomBytes)(bytes).toString("hex");
@@ -225528,6 +226455,30 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	* 0..1 rect into the firmware-specific packed-int `(pixel << 16) | canvas`
 	* coords. The master `enable` flag rides the same call.
 	*/
+	/**
+	* Every `<Compression>` stream block of this camera that reports an audio
+	* flag, with its current value.
+	*
+	* A block whose `audio` field is absent is OMITTED, not reported as `false`
+	* — "this firmware does not expose an audio flag" and "the microphone is
+	* off" are different answers, and only the second justifies offering the
+	* operator a switch. An empty array is the honest "no controllable audio
+	* input here".
+	*/
+	async readStreamAudioProfiles() {
+		const compression = (await (await this.ensureApi()).getEnc(this.getChannel()))?.body?.Compression;
+		if (!compression) return [];
+		const out = [];
+		for (const streamKey of REOLINK_AUDIO_STREAM_KEYS) {
+			const raw = compression[streamKey]?.audio;
+			if (typeof raw !== "number") continue;
+			out.push({
+				streamKey,
+				audioEnabled: raw !== 0
+			});
+		}
+		return out;
+	}
 	registerPrivacyMaskCap() {
 		const channel = this.getChannel();
 		const CAP_NAME = "privacy-mask";
@@ -225536,7 +226487,8 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 			if (this.privacyMaskRefreshInFlight) return this.privacyMaskRefreshInFlight;
 			const promise = (async () => {
 				try {
-					const zones = await (await this.ensureApi()).getMaskZones(channel);
+					const api = await this.ensureApi();
+					const [zones, audioProfiles] = await Promise.all([api.getMaskZones(channel), this.readStreamAudioProfiles().catch(() => [])]);
 					this.ctx.logger.debug("reolink privacy-mask getMaskZones", {
 						tags: { deviceId: this.id },
 						meta: {
@@ -225559,6 +226511,7 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 					const next = {
 						enabled: zones.enable,
 						regions,
+						audioEnabled: summarisePrivacyAudio(audioProfiles),
 						lastFetchedAt: Date.now()
 					};
 					this.runtimeState.setCapState(CAP_NAME, next);
@@ -225586,27 +226539,32 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 				empty: () => ({
 					enabled: false,
 					regions: [],
+					audioEnabled: null,
 					lastFetchedAt: 0
 				})
 			}).getStatus,
 			getOptions: async ({ deviceId }) => {
 				if (deviceId !== this.id) return {
 					maxRegions: 4,
-					supportedShapes: ["rect"]
+					supportedShapes: ["rect"],
+					supportsAudioMute: false
 				};
 				return this.resolveCapOptions({
 					capName: CAP_NAME,
 					schema: PrivacyMaskOptionsSchema,
 					probe: async () => {
-						const zones = await (await this.ensureApi()).getMaskZones(channel);
+						const api = await this.ensureApi();
+						const [zones, audioProfiles] = await Promise.all([api.getMaskZones(channel), this.readStreamAudioProfiles().catch(() => [])]);
 						return {
 							maxRegions: zones.maxNum,
-							supportedShapes: zones.maxNum > 0 ? ["rect"] : []
+							supportedShapes: zones.maxNum > 0 ? ["rect"] : [],
+							supportsAudioMute: audioProfiles.length > 0
 						};
 					},
 					fallback: () => ({
 						maxRegions: 4,
-						supportedShapes: ["rect"]
+						supportedShapes: ["rect"],
+						supportsAudioMute: false
 					})
 				});
 			},
@@ -225644,6 +226602,49 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 					tags: { deviceId: this.id },
 					meta: { regions: JSON.stringify(this.runtimeState.getCapState(CAP_NAME)?.regions ?? []) }
 				});
+			},
+			setAudioEnabled: async ({ deviceId, enabled }) => {
+				if (deviceId !== this.id) return;
+				const profiles = await this.readStreamAudioProfiles();
+				if (profiles.length === 0) {
+					this.ctx.logger.warn("reolink privacy audio: camera reports NO audio flag — refusing", { tags: { deviceId: this.id } });
+					throw new Error(`device ${String(this.id)}: this camera exposes no controllable audio input`);
+				}
+				const value = enabled ? 1 : 0;
+				const api = await this.ensureApi();
+				for (const profile of profiles) {
+					const patch = { [profile.streamKey]: { audio: value } };
+					await api.setEnc(channel, patch);
+				}
+				const refused = (await this.readStreamAudioProfiles().catch(() => [])).filter((p) => p.audioEnabled !== enabled).map((p) => p.streamKey);
+				if (refused.length > 0) {
+					const revert = enabled ? 0 : 1;
+					for (const profile of profiles) {
+						if (refused.includes(profile.streamKey)) continue;
+						await api.setEnc(channel, { [profile.streamKey]: { audio: revert } }).catch(() => void 0);
+					}
+					this.ctx.logger.warn("reolink privacy audio: stream REFUSED the write — reverted, camera still audible", {
+						tags: { deviceId: this.id },
+						meta: {
+							enabled,
+							refused: refused.join(","),
+							asked: profiles.length
+						}
+					});
+					this.cachedStreamDescriptors = void 0;
+					await refreshFromCamera();
+					throw new Error(`device ${String(this.id)}: the camera refused to change audio on ${refused.join(", ")} — it would still carry sound, so the change was reverted`);
+				}
+				this.ctx.logger.info("reolink privacy audio: microphone written", {
+					tags: { deviceId: this.id },
+					meta: {
+						enabled,
+						streams: profiles.map((p) => p.streamKey).join(",")
+					}
+				});
+				this.cachedStreamDescriptors = void 0;
+				this.ctx.eventBus.emit(createEvent(EventCategory.StreamParamsChanged, this.eventSource(), { deviceId: this.id }));
+				await refreshFromCamera();
 			}
 		};
 		this.registerCapWarmer(CAP_NAME, async () => {
@@ -229344,8 +230345,13 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 *  cap `framerate`    → `frameRate`     (fps, same unit)
 *  cap `gop`          → `gop`           (seconds, same unit)
 *  cap `encoderProfile` → `encoderProfile` (direct passthrough)
-*  cap `audio`        → `audio`         (boolean → 0/1)
 *  cap `width`/`height` → `width`/`height` (pixels, direct passthrough)
+*
+* There is deliberately NO audio branch. `StreamProfilePatch` carried one
+* until 2026-08-07, reachable from no form and no caller, while the camera's
+* microphone is a whole-device fact. It now has exactly one writer —
+* `privacyMask.setAudioEnabled`, which patches every stream block together so
+* the camera cannot end up half-muted.
 */
 function buildEncStreamPatch(patch) {
 	const out = {};
@@ -229355,7 +230361,6 @@ function buildEncStreamPatch(patch) {
 	if (patch.framerate !== void 0) out.frameRate = patch.framerate;
 	if (patch.gop !== void 0) out.gop = patch.gop;
 	if (patch.encoderProfile !== void 0) out.encoderProfile = patch.encoderProfile;
-	if (patch.audio !== void 0) out.audio = patch.audio ? 1 : 0;
 	if (patch.width !== void 0) out.width = patch.width;
 	if (patch.height !== void 0) out.height = patch.height;
 	return out;