@camstack/addon-terminal 0.1.15 → 0.1.16

package/dist/addon.js

@@ -7047,6 +7047,18 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 	action: string().min(1),
 	input: unknown()
 }), unknown(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
+//#endregion
+//#region ../types/dist/err-msg-IQTHeDzc.mjs
+/**
+import { errMsg } from '@camstack/types'
+* Extract a human-readable message from an unknown error value.
+* Replaces the ubiquitous `errMsg(err)` pattern.
+*/
+function errMsg(err) {
+	if (err instanceof Error) return err.message;
+	if (typeof err === "string") return err;
+	return String(err);
+}
 var EncodeProfileSchema = object({
 	video: object({
 		codec: _enum([
@@ -7284,8 +7296,31 @@ var AdoptionJobSchema = object({
 	error: string().nullable()
 });
 /**
-* Per-camera FUNCTION SWITCHES — the one coherent on/off surface over the
-* pipeline functions an operator thinks in terms of.
+* Per-camera FUNCTION SWITCHES.
+*
+* ## The aggregate group is being withdrawn — the BADGE is not (D113)
+*
+* This file shipped as "the one coherent on/off surface over the pipeline
+* functions an operator thinks in terms of". The operator's verdict on
+* 2026-08-12 was that the coherent surface bought complexity and no clarity:
+* every function already had a settings page of its own, and a second place to
+* turn it off is a second place to look. Each switch is going back to its own
+* component's original options — detection to the detection-pipeline wrapper
+* binding, audio analysis to its own, recording to `RecordingConfig.enabled`
+* (which was always first-class; the switch was a veneer over
+* `recording.setDeviceConfig`), notifications to a notification-center
+* per-device setting, the two camera planes to their own components.
+*
+* What survives is {@link composeSwitchedOff}: `CameraStatus.switchedOff`, the
+* thing that lets a status surface say DISABLED instead of BROKEN, recomposed
+* straight from the authorities with no group in the middle. That rule was
+* never about a control panel.
+*
+* Everything else here — {@link CAMERA_SWITCH_CATALOG}, {@link CameraSwitch},
+* {@link deriveCameraSwitches}, the `pipelineOrchestrator.getCameraSwitches` /
+* `setCameraSwitch` pair — is a COMPATIBILITY surface for as long as deployed
+* viewers (v1.0.305) and the admin UI still call it. It is deleted when they
+* stop; nothing new may be built on it.
 *
 * ## This file adds no state
 *
@@ -7447,6 +7482,14 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
+* The wrapper capability each wrapper-backed switch controls. Named constants
+* because the same strings appear in `legacy-migrations.ts`, in
+* `isCapActiveForDevice` call sites and in the fake harness — a typo in any of
+* them is a switch that silently writes a binding nobody reads.
+*/
+var DETECTION_PIPELINE_CAP_NAME = "detection-pipeline";
+var AUDIO_ANALYSIS_CAP_NAME = "audio-analysis";
+/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -17822,9 +17865,16 @@ var CameraStatusSchema = object({
 	audio: CameraAudioStatusSchema.nullable(),
 	recording: CameraRecordingStatusSchema.nullable(),
 	/**
-	* Per-camera function switches an OPERATOR has turned off
+	* Per-camera functions an OPERATOR has turned off
 	* ([D61](../../../../docs/decisions/adr-0067.md)).
 	*
+	* Composed from the AUTHORITIES themselves — the wrapper bindings,
+	* `RecordingConfig.enabled`, the notification mute, the broker's audio
+	* policy, the camera's own microphone — via `composeSwitchedOff`, not from
+	* the deprecated `getCameraSwitches` group ([D113](../../../../docs/decisions/adr-0113.md)).
+	* The badge outlives the control panel: the panel was a convenience, this is
+	* the difference between a camera being off and a camera being dead.
+	*
 	* This is the difference between DISABLED and BROKEN. A camera whose
 	* `detection` block reports zero fps and whose `switchedOff` contains
 	* `'object-detection'` was switched off by a person; the same camera with an
@@ -24911,10 +24961,42 @@ method(object({
 */
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = number().min(.25).max(32);
+/**
+* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+*
+* Relative and not absolute epoch on purpose: the renderer's frame-select
+* expression sees ffmpeg's `t`, which starts at 0 for the export's source
+* playlist. Handing it absolute epochs would make every call site responsible
+* for the same subtraction, and the one that forgot would emit a filter that
+* selects nothing — silently, as a uniform timelapse.
+*/
+var ExportDenseRangeSchema = object({
+	fromSec: number().nonnegative(),
+	toSec: number().nonnegative()
+}).refine((r) => r.toSec > r.fromSec, { message: "dense range must have toSec > fromSec" });
+/**
+* Dense-interval overlay for a timelapse: sample at `dense.everyMs` INSIDE the
+* listed ranges and at the base `everyMs` everywhere else.
+*
+* `everyMs` must be strictly smaller than the base cadence — a dense rate that
+* is not denser renders a uniform timelapse the operator believes is two-rate.
+*/
+var ExportDenseSchema = object({
+	everyMs: number().int().positive(),
+	ranges: array(ExportDenseRangeSchema).min(1).max(200)
+});
 /** Timelapse cadence — sample one source frame per `everyMs`, output at `outputFps`. */
 var ExportTimelapseSchema = object({
 	everyMs: number().int().positive(),
-	outputFps: number().int().min(1).max(60).optional()
+	outputFps: number().int().min(1).max(60).optional(),
+	/** Optional second, FASTER rate over the intervals that matter. */
+	dense: ExportDenseSchema.optional()
+}).superRefine((v, ctx) => {
+	if (v.dense !== void 0 && v.dense.everyMs >= v.everyMs) ctx.addIssue({
+		code: ZodIssueCode.custom,
+		message: "dense.everyMs must be strictly smaller than the base everyMs",
+		path: ["dense", "everyMs"]
+	});
 });
 /**
 * Render options. `speed` and `timelapse` are mutually exclusive. `includeAudio`
@@ -24972,6 +25054,19 @@ var ExportDownloadSchema = object({
 	url: string(),
 	endpoints: array(string())
 });
+/**
+* A finished export's bytes, inline.
+*
+* `bytes` is the DECODED length — the number the caller bounds and logs
+* against, so nobody has to infer it from the base64 length.
+*/
+var ExportBytesSchema = object({
+	base64: string(),
+	contentType: string(),
+	/** Suggested filename, extension included. */
+	name: string(),
+	bytes: number().int().nonnegative()
+});
 method(object({
 	deviceId: number(),
 	profile: string(),
@@ -24996,6 +25091,9 @@ method(object({
 }), method(object({ exportId: string() }), ExportDownloadSchema, {
 	kind: "query",
 	auth: "protected"
+}), method(object({ exportId: string() }), ExportBytesSchema, {
+	kind: "query",
+	auth: "protected"
 });
 /**
 * scene-monitor — device-scoped reference-region state cap. An operator marks
@@ -31847,6 +31945,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recordingExport.readExportBytes": {
+		capName: "recordingExport",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"sceneMonitor.captureReference": {
 		capName: "scene-monitor",
 		capScope: "device",
@@ -33264,10 +33368,28 @@ TimelapseRuleInputSchema.extend({
 	*/
 	ownerUserId: string().optional(),
 	/**
-	* Epoch-ms of the last successful generation — the 1-hour re-generation
-	* guard's durable state (predecessor parity). Absent = never generated.
+	* Epoch-ms of the NEWEST successful generation across every camera of this
+	* rule. What a UI shows, and the compatibility floor for
+	* {@link readTimelapseGeneratedAt}. Absent = never generated.
 	*/
 	lastGeneratedAt: number().optional(),
+	/**
+	* PER-CAMERA generation state, keyed by `String(deviceId)` — the
+	* re-generation guard's real durable state.
+	*
+	* One rule covers several cameras and each renders its own video, so a rule
+	* -wide stamp is wrong in the direction that DESTROYS work: camera A
+	* succeeding at 06:05 tells camera B, whose render failed, that it is
+	* already done — and B's night is gone for good, because the window will not
+	* come back.
+	*
+	* ADDITIVE, so the migration is free: a row written before this field simply
+	* has no map, and {@link readTimelapseGeneratedAt} falls back to
+	* {@link TimelapseRuleSchema.shape.lastGeneratedAt}. Reading an old row as
+	* "never generated" would re-render and re-notify every camera of every rule
+	* once, on the deploy that shipped the map.
+	*/
+	generatedByDevice: record(string(), number()).optional(),
 	/** userId of the caller who created the rule (server-stamped). */
 	createdBy: string(),
 	createdAt: number(),
@@ -33516,6 +33638,91 @@ async function warmNodePty() {
 	await loadNodePty();
 }
 //#endregion
+//#region src/silence-analysis.ts
+/**
+* Every analyzer a Terminal camera is created with switched OFF.
+*
+* `motion-detection` sits first deliberately: it is the one that holds the
+* decode session open, so it is the one whose absence is the difference between
+* a terminal costing a screen scrape and costing a decode pipeline.
+*/
+var TERMINAL_SILENCED_CAP_NAMES = [
+	"motion-detection",
+	DETECTION_PIPELINE_CAP_NAME,
+	AUDIO_ANALYSIS_CAP_NAME
+];
+/**
+* Resolve the addon currently providing `capName` for this device.
+*
+* Inlined rather than reached for through a helper because there is exactly one
+* honest source: the device's own bindings. `listBindableCapsForDeviceType`
+* answers for the device TYPE and would happily name a wrapper that is not the
+* one bound here.
+*
+* Returns `null` when the cap is not bound at all — which is not an error: a
+* deployment with no audio analyzer has nothing to switch off, and demanding one
+* would make every terminal creation fail on a perfectly valid hub.
+*/
+async function resolveBoundWrapper(api, deviceId, capName) {
+	const bindings = await api.deviceManager.getBindings.query({ deviceId });
+	for (const entry of bindings.entries) {
+		if (entry.capName !== capName) continue;
+		if (entry.kind !== "wrapped") continue;
+		if (entry.providerAddonId === "") return null;
+		return entry.providerAddonId;
+	}
+	return null;
+}
+/**
+* Switch every analyzer in {@link TERMINAL_SILENCED_CAP_NAMES} off for one
+* Terminal camera.
+*
+* Called ONLY on creation. An operator who deliberately turns detection back on
+* for a terminal must win, and a reconcile that re-asserted every pass would
+* silently overrule them once a minute.
+*
+* @throws if a cap IS bound and the write to its authority failed. The camera
+* would then be running a full analyzer for a screen recording, which is the
+* exact cost this exists to remove — and a silent version of that failure is
+* unfindable.
+*/
+async function silenceAnalysisFor(deps, deviceId) {
+	const failures = [];
+	for (const capName of TERMINAL_SILENCED_CAP_NAMES) try {
+		const wrapperAddonId = await resolveBoundWrapper(deps.api, deviceId, capName);
+		if (wrapperAddonId === null) {
+			deps.logger.debug("terminal camera: no analyzer bound for this capability", {
+				tags: { deviceId },
+				meta: { capName }
+			});
+			continue;
+		}
+		await deps.api.deviceManager.setWrapperActive.mutate({
+			deviceId,
+			capName,
+			wrapperAddonId,
+			active: false
+		});
+		deps.logger.info("terminal camera: analyzer switched off at its authority", {
+			tags: { deviceId },
+			meta: {
+				capName,
+				wrapperAddonId
+			}
+		});
+	} catch (err) {
+		failures.push(`${capName}: ${errMsg(err)}`);
+		deps.logger.error("terminal camera: could NOT switch an analyzer off", {
+			tags: { deviceId },
+			meta: {
+				capName,
+				error: errMsg(err)
+			}
+		});
+	}
+	if (failures.length > 0) throw new Error(`terminal camera ${deviceId}: could not switch off ${failures.length} analyzer(s) — it will run at full detection cost (${failures.join("; ")})`);
+}
+//#endregion
 //#region src/terminal-camera-declarations.ts
 /**
 * Feed DeclaredDevices every live declaration plus one deterministic orphan
@@ -40049,37 +40256,22 @@ var TerminalAddon = class extends BaseAddon {
 		}
 	}
 	/**
-	* A Terminal camera is a rendered screen. Object detection on it finds
-	* nothing, forever, at full cost.
-	*
-	* Measured on the hub 2026-08-11, for ONE terminal camera: 19 frames per 10 s
-	* through the detection pipeline at ~61 ms of inference each, plus 115
-	* capture-scheduler requests a minute — against `detections=0`. Multiply by
-	* one terminal per node and it is a standing tax on a hub that was already
-	* shedding 86 % of its capture queue.
+	* A Terminal camera is a rendered screen. Every analyzer on it finds nothing,
+	* forever, at full cost — see `silence-analysis.ts` for the measurements, the
+	* reason `motion-detection` is in the list, and why a failure THROWS instead
+	* of warning.
 	*
-	* Written through `setCameraSwitch`, which is the authority that already owns
-	* this function — [D62] forbids a second store that disagrees with it. And
-	* written ONLY on creation: an operator who deliberately turns detection back
-	* on for a terminal must win, and a reconcile that re-asserted every pass
-	* would silently overrule them once a minute.
-	*/
-	async silenceAnalysisFor(deviceId) {
-		for (const switchId of ["object-detection", "audio-analysis"]) try {
-			await this.ctx.api.pipelineOrchestrator.setCameraSwitch.mutate({
-				deviceId,
-				switchId,
-				enabled: false
-			});
-		} catch (err) {
-			this.ctx.logger.warn("could not switch off analysis for a Terminal camera", {
-				tags: { deviceId },
-				meta: {
-					switchId,
-					error: err instanceof Error ? err.message : String(err)
-				}
-			});
-		}
+	* Written to the AUTHORITIES (`deviceManager.setWrapperActive`), not through
+	* the deprecated switch cap the previous version used (D113). Written ONLY on
+	* creation: an operator who deliberately turns detection back on for a
+	* terminal must win, and a reconcile that re-asserted every pass would
+	* silently overrule them once a minute.
+	*/
+	silenceAnalysisFor(deviceId) {
+		return silenceAnalysisFor({
+			api: this.ctx.api,
+			logger: this.ctx.logger
+		}, deviceId);
 	}
 	terminalInstanceControl() {
 		return {

package/dist/addon.mjs

@@ -7024,6 +7024,18 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 	action: string().min(1),
 	input: unknown()
 }), unknown(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
+//#endregion
+//#region ../types/dist/err-msg-IQTHeDzc.mjs
+/**
+import { errMsg } from '@camstack/types'
+* Extract a human-readable message from an unknown error value.
+* Replaces the ubiquitous `errMsg(err)` pattern.
+*/
+function errMsg(err) {
+	if (err instanceof Error) return err.message;
+	if (typeof err === "string") return err;
+	return String(err);
+}
 var EncodeProfileSchema = object({
 	video: object({
 		codec: _enum([
@@ -7261,8 +7273,31 @@ var AdoptionJobSchema = object({
 	error: string().nullable()
 });
 /**
-* Per-camera FUNCTION SWITCHES — the one coherent on/off surface over the
-* pipeline functions an operator thinks in terms of.
+* Per-camera FUNCTION SWITCHES.
+*
+* ## The aggregate group is being withdrawn — the BADGE is not (D113)
+*
+* This file shipped as "the one coherent on/off surface over the pipeline
+* functions an operator thinks in terms of". The operator's verdict on
+* 2026-08-12 was that the coherent surface bought complexity and no clarity:
+* every function already had a settings page of its own, and a second place to
+* turn it off is a second place to look. Each switch is going back to its own
+* component's original options — detection to the detection-pipeline wrapper
+* binding, audio analysis to its own, recording to `RecordingConfig.enabled`
+* (which was always first-class; the switch was a veneer over
+* `recording.setDeviceConfig`), notifications to a notification-center
+* per-device setting, the two camera planes to their own components.
+*
+* What survives is {@link composeSwitchedOff}: `CameraStatus.switchedOff`, the
+* thing that lets a status surface say DISABLED instead of BROKEN, recomposed
+* straight from the authorities with no group in the middle. That rule was
+* never about a control panel.
+*
+* Everything else here — {@link CAMERA_SWITCH_CATALOG}, {@link CameraSwitch},
+* {@link deriveCameraSwitches}, the `pipelineOrchestrator.getCameraSwitches` /
+* `setCameraSwitch` pair — is a COMPATIBILITY surface for as long as deployed
+* viewers (v1.0.305) and the admin UI still call it. It is deleted when they
+* stop; nothing new may be built on it.
 *
 * ## This file adds no state
 *
@@ -7424,6 +7459,14 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
+* The wrapper capability each wrapper-backed switch controls. Named constants
+* because the same strings appear in `legacy-migrations.ts`, in
+* `isCapActiveForDevice` call sites and in the fake harness — a typo in any of
+* them is a switch that silently writes a binding nobody reads.
+*/
+var DETECTION_PIPELINE_CAP_NAME = "detection-pipeline";
+var AUDIO_ANALYSIS_CAP_NAME = "audio-analysis";
+/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -17799,9 +17842,16 @@ var CameraStatusSchema = object({
 	audio: CameraAudioStatusSchema.nullable(),
 	recording: CameraRecordingStatusSchema.nullable(),
 	/**
-	* Per-camera function switches an OPERATOR has turned off
+	* Per-camera functions an OPERATOR has turned off
 	* ([D61](../../../../docs/decisions/adr-0067.md)).
 	*
+	* Composed from the AUTHORITIES themselves — the wrapper bindings,
+	* `RecordingConfig.enabled`, the notification mute, the broker's audio
+	* policy, the camera's own microphone — via `composeSwitchedOff`, not from
+	* the deprecated `getCameraSwitches` group ([D113](../../../../docs/decisions/adr-0113.md)).
+	* The badge outlives the control panel: the panel was a convenience, this is
+	* the difference between a camera being off and a camera being dead.
+	*
 	* This is the difference between DISABLED and BROKEN. A camera whose
 	* `detection` block reports zero fps and whose `switchedOff` contains
 	* `'object-detection'` was switched off by a person; the same camera with an
@@ -24888,10 +24938,42 @@ method(object({
 */
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = number().min(.25).max(32);
+/**
+* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+*
+* Relative and not absolute epoch on purpose: the renderer's frame-select
+* expression sees ffmpeg's `t`, which starts at 0 for the export's source
+* playlist. Handing it absolute epochs would make every call site responsible
+* for the same subtraction, and the one that forgot would emit a filter that
+* selects nothing — silently, as a uniform timelapse.
+*/
+var ExportDenseRangeSchema = object({
+	fromSec: number().nonnegative(),
+	toSec: number().nonnegative()
+}).refine((r) => r.toSec > r.fromSec, { message: "dense range must have toSec > fromSec" });
+/**
+* Dense-interval overlay for a timelapse: sample at `dense.everyMs` INSIDE the
+* listed ranges and at the base `everyMs` everywhere else.
+*
+* `everyMs` must be strictly smaller than the base cadence — a dense rate that
+* is not denser renders a uniform timelapse the operator believes is two-rate.
+*/
+var ExportDenseSchema = object({
+	everyMs: number().int().positive(),
+	ranges: array(ExportDenseRangeSchema).min(1).max(200)
+});
 /** Timelapse cadence — sample one source frame per `everyMs`, output at `outputFps`. */
 var ExportTimelapseSchema = object({
 	everyMs: number().int().positive(),
-	outputFps: number().int().min(1).max(60).optional()
+	outputFps: number().int().min(1).max(60).optional(),
+	/** Optional second, FASTER rate over the intervals that matter. */
+	dense: ExportDenseSchema.optional()
+}).superRefine((v, ctx) => {
+	if (v.dense !== void 0 && v.dense.everyMs >= v.everyMs) ctx.addIssue({
+		code: ZodIssueCode.custom,
+		message: "dense.everyMs must be strictly smaller than the base everyMs",
+		path: ["dense", "everyMs"]
+	});
 });
 /**
 * Render options. `speed` and `timelapse` are mutually exclusive. `includeAudio`
@@ -24949,6 +25031,19 @@ var ExportDownloadSchema = object({
 	url: string(),
 	endpoints: array(string())
 });
+/**
+* A finished export's bytes, inline.
+*
+* `bytes` is the DECODED length — the number the caller bounds and logs
+* against, so nobody has to infer it from the base64 length.
+*/
+var ExportBytesSchema = object({
+	base64: string(),
+	contentType: string(),
+	/** Suggested filename, extension included. */
+	name: string(),
+	bytes: number().int().nonnegative()
+});
 method(object({
 	deviceId: number(),
 	profile: string(),
@@ -24973,6 +25068,9 @@ method(object({
 }), method(object({ exportId: string() }), ExportDownloadSchema, {
 	kind: "query",
 	auth: "protected"
+}), method(object({ exportId: string() }), ExportBytesSchema, {
+	kind: "query",
+	auth: "protected"
 });
 /**
 * scene-monitor — device-scoped reference-region state cap. An operator marks
@@ -31824,6 +31922,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recordingExport.readExportBytes": {
+		capName: "recordingExport",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"sceneMonitor.captureReference": {
 		capName: "scene-monitor",
 		capScope: "device",
@@ -33241,10 +33345,28 @@ TimelapseRuleInputSchema.extend({
 	*/
 	ownerUserId: string().optional(),
 	/**
-	* Epoch-ms of the last successful generation — the 1-hour re-generation
-	* guard's durable state (predecessor parity). Absent = never generated.
+	* Epoch-ms of the NEWEST successful generation across every camera of this
+	* rule. What a UI shows, and the compatibility floor for
+	* {@link readTimelapseGeneratedAt}. Absent = never generated.
 	*/
 	lastGeneratedAt: number().optional(),
+	/**
+	* PER-CAMERA generation state, keyed by `String(deviceId)` — the
+	* re-generation guard's real durable state.
+	*
+	* One rule covers several cameras and each renders its own video, so a rule
+	* -wide stamp is wrong in the direction that DESTROYS work: camera A
+	* succeeding at 06:05 tells camera B, whose render failed, that it is
+	* already done — and B's night is gone for good, because the window will not
+	* come back.
+	*
+	* ADDITIVE, so the migration is free: a row written before this field simply
+	* has no map, and {@link readTimelapseGeneratedAt} falls back to
+	* {@link TimelapseRuleSchema.shape.lastGeneratedAt}. Reading an old row as
+	* "never generated" would re-render and re-notify every camera of every rule
+	* once, on the deploy that shipped the map.
+	*/
+	generatedByDevice: record(string(), number()).optional(),
 	/** userId of the caller who created the rule (server-stamped). */
 	createdBy: string(),
 	createdAt: number(),
@@ -33493,6 +33615,91 @@ async function warmNodePty() {
 	await loadNodePty();
 }
 //#endregion
+//#region src/silence-analysis.ts
+/**
+* Every analyzer a Terminal camera is created with switched OFF.
+*
+* `motion-detection` sits first deliberately: it is the one that holds the
+* decode session open, so it is the one whose absence is the difference between
+* a terminal costing a screen scrape and costing a decode pipeline.
+*/
+var TERMINAL_SILENCED_CAP_NAMES = [
+	"motion-detection",
+	DETECTION_PIPELINE_CAP_NAME,
+	AUDIO_ANALYSIS_CAP_NAME
+];
+/**
+* Resolve the addon currently providing `capName` for this device.
+*
+* Inlined rather than reached for through a helper because there is exactly one
+* honest source: the device's own bindings. `listBindableCapsForDeviceType`
+* answers for the device TYPE and would happily name a wrapper that is not the
+* one bound here.
+*
+* Returns `null` when the cap is not bound at all — which is not an error: a
+* deployment with no audio analyzer has nothing to switch off, and demanding one
+* would make every terminal creation fail on a perfectly valid hub.
+*/
+async function resolveBoundWrapper(api, deviceId, capName) {
+	const bindings = await api.deviceManager.getBindings.query({ deviceId });
+	for (const entry of bindings.entries) {
+		if (entry.capName !== capName) continue;
+		if (entry.kind !== "wrapped") continue;
+		if (entry.providerAddonId === "") return null;
+		return entry.providerAddonId;
+	}
+	return null;
+}
+/**
+* Switch every analyzer in {@link TERMINAL_SILENCED_CAP_NAMES} off for one
+* Terminal camera.
+*
+* Called ONLY on creation. An operator who deliberately turns detection back on
+* for a terminal must win, and a reconcile that re-asserted every pass would
+* silently overrule them once a minute.
+*
+* @throws if a cap IS bound and the write to its authority failed. The camera
+* would then be running a full analyzer for a screen recording, which is the
+* exact cost this exists to remove — and a silent version of that failure is
+* unfindable.
+*/
+async function silenceAnalysisFor(deps, deviceId) {
+	const failures = [];
+	for (const capName of TERMINAL_SILENCED_CAP_NAMES) try {
+		const wrapperAddonId = await resolveBoundWrapper(deps.api, deviceId, capName);
+		if (wrapperAddonId === null) {
+			deps.logger.debug("terminal camera: no analyzer bound for this capability", {
+				tags: { deviceId },
+				meta: { capName }
+			});
+			continue;
+		}
+		await deps.api.deviceManager.setWrapperActive.mutate({
+			deviceId,
+			capName,
+			wrapperAddonId,
+			active: false
+		});
+		deps.logger.info("terminal camera: analyzer switched off at its authority", {
+			tags: { deviceId },
+			meta: {
+				capName,
+				wrapperAddonId
+			}
+		});
+	} catch (err) {
+		failures.push(`${capName}: ${errMsg(err)}`);
+		deps.logger.error("terminal camera: could NOT switch an analyzer off", {
+			tags: { deviceId },
+			meta: {
+				capName,
+				error: errMsg(err)
+			}
+		});
+	}
+	if (failures.length > 0) throw new Error(`terminal camera ${deviceId}: could not switch off ${failures.length} analyzer(s) — it will run at full detection cost (${failures.join("; ")})`);
+}
+//#endregion
 //#region src/terminal-camera-declarations.ts
 /**
 * Feed DeclaredDevices every live declaration plus one deterministic orphan
@@ -40026,37 +40233,22 @@ var TerminalAddon = class extends BaseAddon {
 		}
 	}
 	/**
-	* A Terminal camera is a rendered screen. Object detection on it finds
-	* nothing, forever, at full cost.
-	*
-	* Measured on the hub 2026-08-11, for ONE terminal camera: 19 frames per 10 s
-	* through the detection pipeline at ~61 ms of inference each, plus 115
-	* capture-scheduler requests a minute — against `detections=0`. Multiply by
-	* one terminal per node and it is a standing tax on a hub that was already
-	* shedding 86 % of its capture queue.
+	* A Terminal camera is a rendered screen. Every analyzer on it finds nothing,
+	* forever, at full cost — see `silence-analysis.ts` for the measurements, the
+	* reason `motion-detection` is in the list, and why a failure THROWS instead
+	* of warning.
 	*
-	* Written through `setCameraSwitch`, which is the authority that already owns
-	* this function — [D62] forbids a second store that disagrees with it. And
-	* written ONLY on creation: an operator who deliberately turns detection back
-	* on for a terminal must win, and a reconcile that re-asserted every pass
-	* would silently overrule them once a minute.
-	*/
-	async silenceAnalysisFor(deviceId) {
-		for (const switchId of ["object-detection", "audio-analysis"]) try {
-			await this.ctx.api.pipelineOrchestrator.setCameraSwitch.mutate({
-				deviceId,
-				switchId,
-				enabled: false
-			});
-		} catch (err) {
-			this.ctx.logger.warn("could not switch off analysis for a Terminal camera", {
-				tags: { deviceId },
-				meta: {
-					switchId,
-					error: err instanceof Error ? err.message : String(err)
-				}
-			});
-		}
+	* Written to the AUTHORITIES (`deviceManager.setWrapperActive`), not through
+	* the deprecated switch cap the previous version used (D113). Written ONLY on
+	* creation: an operator who deliberately turns detection back on for a
+	* terminal must win, and a reconcile that re-asserted every pass would
+	* silently overrule them once a minute.
+	*/
+	silenceAnalysisFor(deviceId) {
+		return silenceAnalysisFor({
+			api: this.ctx.api,
+			logger: this.ctx.logger
+		}, deviceId);
 	}
 	terminalInstanceControl() {
 		return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-terminal",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "Interactive terminal sessions (pty + xterm) as a CamStack addon",
   "keywords": [
     "camstack",