@camstack/system 1.2.58 → 1.2.59

package/dist/{dist-UrXyJ9Zm.mjs → dist-BqJJWCS8.mjs}

@@ -2299,9 +2299,38 @@ var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
 /**
 * Build the tRPC request options that pin a single capability call to `nodeId`.
 * Pass as the second argument to `.query(input, …)` / `.mutate(input, …)`.
+*
+* ## The id is normalised here, and it has to be
+*
+* A forked addon reads its own node from `ctx.kernel.localNodeId`, and inside a
+* worker that value is a RUNNER id — `hub/export-hap`, not `hub`. Routing
+* compares a pin against real node ids, so such a pin matches nothing and the
+* call fails with `no provider registered for cap "…"`. The local-first
+* resolver already guarded against this (`localNodeId.split('/')[0]`), which
+* made the hazard invisible: unpinned calls worked, and only an explicit pin —
+* the thing you reach for when you specifically need THIS node — silently
+* addressed a node that does not exist.
+*
+* Cost of it being missing: `addon-export-hap` pinned `decoder.getInfo` to its
+* own node to read the host's hardware-decode backend. It never once answered,
+* so every HomeKit egress transcode decoded in SOFTWARE — including 4K H.265 —
+* while D67's whole premise was that the decoder addon is the authority on
+* hardware. The warn said `decoding in SOFTWARE` and read as "this node has no
+* hardware", which was false.
+*
+* Normalising in the ONE constructor fixes every caller at once, which is why
+* it is here and not at the call sites.
 */
 function nodePin(nodeId) {
-	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: nodeId } };
+	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: toNodeId(nodeId) } };
+}
+/**
+* A runner id is `<nodeId>/<addonId>`; a node id has no slash. Taking the head
+* is idempotent, so passing an already-clean id costs nothing.
+*/
+function toNodeId(idOrRunnerId) {
+	const head = idOrRunnerId.split("/")[0];
+	return head === void 0 || head.length === 0 ? idOrRunnerId : head;
 }
 /**
 * Generic types for capability definitions.
@@ -3164,7 +3193,7 @@ z.object({
 * ## This file adds no state
 *
 * Every switch here is a VIEW onto an authority that already existed
-* ([D61](../../../../docs/decisions/adr-0062.md)). The whole point of the
+* ([D62](../../../../docs/decisions/adr-0062.md)). The whole point of the
 * group is that there is exactly one place each function is turned off, and
 * the group routes to it:
 *
@@ -3175,6 +3204,40 @@ z.object({
 * | `audio-analysis` | `deviceManager.setWrapperActive('audio-analysis')` | `AudioSubscriptionController.subscribeAudioStream` returns `null` before opening the stream |
 * | `recording` | `recording.setDeviceConfig` → `RecordingConfig.enabled` | `band-decision.shouldRecord` returns false; the controller detaches the device |
 * | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
+* | `privacy-mask` | `privacyMask.setMask({ enabled })` → the CAMERA | the camera blanks the masked regions itself; every stream and recording carries the black boxes |
+* | `device-audio` | `privacyMask.setAudioEnabled` → the CAMERA | the camera stops encoding an audio track at all; every consumer sees silent video |
+*
+* ## The two switches whose authority is not on this server
+*
+* `privacy-mask` and `device-audio` write the CAMERA. That is not a loophole
+* in "the group stores nothing" — it is the purest form of it: the camera
+* holds the fact, every read is a read-through, and there is no server-side
+* copy that could drift. Their availability therefore cannot come from
+* `listBindableCapsForDeviceType` (a device-NATIVE cap carries no wrappers and
+* is filtered out there); it comes from the cap's own camera-probed
+* `privacyMask.getOptions()`, which is strictly more honest — it answers for
+* THIS camera rather than for the device type
+* ([D74](../../../../docs/decisions/adr-0074.md)).
+*
+* ## `privacy-mask` is the one row whose ON is not "the function is working"
+*
+* Every other switch means *this camera's function is doing its job*, so
+* `enabled: false` is a thing an operator took away. `privacy-mask` means **the
+* MASK is active** — `enabled: true` is video deliberately obscured. The
+* polarity is not a choice made here: `addon-export-hap`'s privacy `Switch`
+* (`builders/privacy-switch.ts`) already mirrors `patch.enabled` verbatim, and
+* a HomeKit toggle that disagreed with the app's toggle for the same camera is
+* worse than either surface not having one.
+*
+* Two consequences follow and both are load-bearing:
+*
+* - **It never counts as `switchedOff`.** `countsAsSwitchedOff` is `false` for
+*   exactly this row. With the polarity above, every camera that has NOT drawn
+*   a privacy mask would otherwise report `switchedOff: ['privacy-mask']` — the
+*   normal, healthy state of most cameras rendered as an operator disablement.
+* - **Its cost line names BOTH directions.** `costWhenOff` is rendered
+*   unconditionally by both clients, so for this row it has to read correctly
+*   whichever way the switch is sitting.
 *
 * The wrapper-binding pair is not a new idea: `legacy-migrations.ts` already
 * migrated the legacy `audioEnabled` / `pipelineEnabled` /
@@ -3193,14 +3256,17 @@ z.object({
 *   `CameraStatus.switchedOff`.
 */
 /**
-* The five functions the operator named (2026-08-05). Deliberately NOT one id
-* per pipeline step: face recognition and plate/LPR are per-step toggles on
+* The functions the operator named — five on 2026-08-05, plus the camera's own
+* microphone on 2026-08-07. Deliberately NOT one id per pipeline step: face
+* recognition and plate/LPR are per-step toggles on
 * `pipelineOrchestrator.setCameraStepToggle` and belong in the pipeline
-* editor, not in a five-button safety group.
+* editor, not in a safety group.
 */
 var CameraSwitchIdSchema = z.enum([
 	"stream-broker",
 	"object-detection",
+	"privacy-mask",
+	"device-audio",
 	"audio-analysis",
 	"recording",
 	"notifications"
@@ -3218,14 +3284,26 @@ var CameraSwitchAuthoritySchema = z.discriminatedUnion("kind", [
 		capName: z.string()
 	}),
 	z.object({ kind: z.literal("recording-config") }),
-	z.object({ kind: z.literal("notification-mute") })
+	z.object({ kind: z.literal("notification-mute") }),
+	z.object({
+		kind: z.literal("camera-audio"),
+		capName: z.string()
+	}),
+	z.object({
+		kind: z.literal("camera-mask"),
+		capName: z.string()
+	})
 ]);
 /**
 * Why a switch is not offered for this camera. Rendered instead of the
 * control, never as a dead control — an absent function and a broken one must
 * not look the same.
 */
-var CameraSwitchUnavailableReasonSchema = z.enum(["no-provider", "source-unreachable"]);
+var CameraSwitchUnavailableReasonSchema = z.enum([
+	"no-provider",
+	"source-unreachable",
+	"not-configured"
+]);
 /**
 * One switch, resolved for one camera.
 *
@@ -5589,6 +5667,26 @@ var EgressTranscodeRequestSchema = z.object({
 		"h264_mp4toannexb",
 		"hevc_mp4toannexb"
 	]).optional(),
+	/**
+	* Publish the transcode as a LOCAL push cam stream, instead of leaving the
+	* consumer to dial the returned url. The broker picks the id and returns it
+	* as `camStreamId` — a caller-supplied one would be circular, since the
+	* sharing key is computed FROM this request.
+	*
+	* The url is still returned and still the contract for a transcode pinned to
+	* another node. But dialling it locally costs an RTSP round trip that changes
+	* the transport underneath the consumer: a dialled stream is an RTP source,
+	* so `isRtpSource()` is true and the session takes the RTP-passthrough +
+	* repacketizer branch. The push branch — the one the derived mechanism has
+	* live hours on — is never reached. Measured on Alexa: broker registered, RTP
+	* arriving, key frame arriving, black screen, on a chain healthy at every
+	* other point.
+	*
+	* Same idea the transport already applies to CALLS, where `classifyCapRoute`
+	* gives priority to `hub-in-process` so a local call never leaves the node.
+	* This is that rule for media.
+	*/
+	publishLocally: z.boolean().optional(),
 	pixelFormat: z.enum(["yuv420p", "nv12"]).optional(),
 	/**
 	* Operator/consumer override for decode hardware. ABSENT is the normal case
@@ -5633,7 +5731,13 @@ var EgressTranscodeSchema = z.object({
 	* Returned rather than assumed: a consumer that asked for hardware and got
 	* software needs to be able to see that without reading the broker's logs.
 	*/
-	decodeHwAccel: z.string().nullable()
+	decodeHwAccel: z.string().nullable(),
+	/**
+	* Set when `publishLocally` was honoured: attach to THIS instead of dialling
+	* `url`, and the session takes the push/deframe transport rather than the
+	* RTP-passthrough one. `null` means the consumer must dial.
+	*/
+	camStreamId: z.string().nullable()
 });
 var streamBrokerCapability = {
 	name: "stream-broker",
@@ -16100,9 +16204,15 @@ var snapshotCapability = {
 			* Bypass the cache freshness check and fetch directly from the
 			* native (or stream-broker fallback). Triggered by the UI's
 			* "refresh" button so an operator can force a fresh frame
-			* even when the cache is well within `snapshotMaxAgeMs`.
-			* On battery cams this WILL wake the camera — accept the
-			* cost only when the user explicitly asks for it.
+			* even when the cache is well within the device's
+			* `snapshotMaxAgeS` window.
+			*
+			* **`force` is an OPERATOR signal, not a freshness preference.** On a
+			* battery camera it is the one thing that walks past the wrapper's
+			* sleep gate and wakes the camera, so a background caller — a poller,
+			* an event handler, a thumbnail — must NEVER set it. Every such caller
+			* gets the cached frame, which on a sleeping battery camera is the
+			* correct answer: stale but honest beats woken.
 			*/
 			force: z.boolean().optional()
 		}), SnapshotImageSchema.nullable()),
@@ -22557,12 +22667,30 @@ var pressureSensorCapability = {
 	runtimeState: PressureSensorStatusSchema
 };
 /**
-* Privacy mask = up to `maxRegions` SHAPES the camera blanks out (NOT a
-* cell grid). Reolink `<shelterList>` zones are rectangles; Hikvision
-* ISAPI `<RegionCoordinatesList>` zones are free polygons (this camera:
-* exactly 4 vertices, not necessarily axis-aligned). The cap composes the
-* shared rect|polygon subset of the MaskShape vocabulary. All coords are
-* normalized 0..1 (top-left origin).
+* PRIVACY — what the camera deliberately does not capture. Two planes:
+*
+*  - **video**: up to `maxRegions` SHAPES the camera blanks out (NOT a cell
+*    grid). Reolink `<shelterList>` zones are rectangles; Hikvision ISAPI
+*    `<RegionCoordinatesList>` zones are free polygons (this camera: exactly
+*    4 vertices, not necessarily axis-aligned). The cap composes the shared
+*    rect|polygon subset of the MaskShape vocabulary. All coords are
+*    normalized 0..1 (top-left origin).
+*  - **audio**: the camera's microphone. `setAudioEnabled(false)` stops the
+*    camera encoding an audio track at all, so EVERY consumer — live view,
+*    recording, the audio analyzer, an export — sees silent video. There is
+*    no server-side copy of this fact; the camera is the store and every read
+*    is a read-through, which is why a switch over it cannot drift
+*    ([D62](../../../../docs/decisions/adr-0062.md)).
+*
+* Both belong here for one reason: they are the two things an operator turns
+* off when the answer to "what is this camera allowed to record" changes, and
+* both are applied ON the device, before anything leaves it.
+*
+* **The audio flag has exactly one writer.** `stream-params` used to carry a
+* per-profile `audio` in its patch schema — reachable from no UI and honoured
+* by one provider — and it was removed when this landed. A second writer onto
+* one device register is the shape of every knob this repo has shipped that
+* disagreed with the one the reader read.
 */
 /** A privacy-mask region's geometry — rectangle or free polygon. */
 var PrivacyMaskShapeSchema = z.discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
@@ -22574,21 +22702,45 @@ var PrivacyMaskRegionSchema = z.object({
 	enabled: z.boolean(),
 	shape: PrivacyMaskShapeSchema
 });
-/** Current on-camera privacy-mask state — master enable + zones. */
+/** Current on-camera privacy state — mask master enable + zones + microphone. */
 var PrivacyMaskStatusSchema = z.object({
 	enabled: z.boolean(),
 	/** Active zones (normalized 0..1). Length ≤ maxRegions. */
 	regions: z.array(PrivacyMaskRegionSchema),
+	/**
+	* Is the camera capturing sound right now? Read from the camera, never from
+	* a server-side mirror.
+	*
+	* `null` means "no answer" — either this camera exposes no controllable
+	* microphone (`getOptions().supportsAudioMute === false`) or the read
+	* failed. A consumer must render `null` as UNKNOWN and never as `false`:
+	* "the microphone is off" and "we could not ask" look identical to an
+	* operator only until one of them is wrong.
+	*
+	* On a camera whose profiles carry the flag independently (Reolink writes
+	* it per stream), `true` means AT LEAST ONE profile still carries audio —
+	* privacy is only satisfied when every one of them is silent.
+	*/
+	audioEnabled: z.boolean().nullable(),
 	lastFetchedAt: z.number()
 });
-/** Per-camera availability. */
+/** Per-camera availability. Probed, never assumed from the model name. */
 var PrivacyMaskOptionsSchema = z.object({
 	/** Maximum number of supported zones. */
 	maxRegions: z.number(),
 	/** Shape kinds this camera accepts — Reolink: ['rect']; Hikvision: ['rect','polygon']. */
 	supportedShapes: z.array(MaskShapeKindSchema),
 	/** Polygon vertex bounds when 'polygon' is supported (Hikvision: {min:4,max:4}). */
-	polygonVertices: MaskPolygonVerticesSchema.optional()
+	polygonVertices: MaskPolygonVerticesSchema.optional(),
+	/**
+	* Does this camera expose a microphone switch we can actually write?
+	*
+	* Camera-probed: `true` only when the firmware answered with an audio flag
+	* we know how to patch. A camera that never answered is `false` — a control
+	* the operator can press that changes nothing is worse than no control, and
+	* the switch group renders "not available" instead.
+	*/
+	supportsAudioMute: z.boolean()
 });
 /** Partial change — every field optional. */
 var PrivacyMaskPatchSchema = z.object({
@@ -22615,6 +22767,27 @@ var privacyMaskCapability = {
 		}), z.void(), {
 			kind: "mutation",
 			auth: "admin"
+		}),
+		/**
+		* Turn the camera's microphone on or off, at the camera.
+		*
+		* Deliberately its OWN mutation rather than a field on
+		* {@link PrivacyMaskPatchSchema}: `patch.enabled` already means "the video
+		* mask master switch", and overloading it would make one boolean mean two
+		* unrelated things on the same call. It is also the only method here whose
+		* write leaves the device in a state a later `getStatus` reads back
+		* verbatim, which is what makes it safe as a switch authority.
+		*
+		* A camera whose `getOptions().supportsAudioMute` is false must REJECT
+		* this rather than silently accept it — a write nothing applies is exactly
+		* what the switch group exists to remove.
+		*/
+		setAudioEnabled: method(z.object({
+			deviceId: z.number(),
+			enabled: z.boolean()
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
 		})
 	},
 	status: {
@@ -22999,6 +23172,21 @@ var LocateSegmentResultSchema = z.discriminatedUnion("kind", [z.object({
 })]);
 /** Raw bytes of one finalized footage segment (read off disk on the recording node). */
 var ReadSegmentBytesResultSchema = z.object({ data: z.instanceof(Uint8Array) });
+/**
+* One GOP of a finalized segment, cut by byte range through the segment's own
+* `mfra` (D31 on the D42 feeder path). `data` is the `ftyp`+`moov` head plus
+* the single `moof`+`mdat` covering the requested instant — standalone-
+* demuxable, never the whole file. When the segment's index cannot be parsed
+* the provider degrades INSIDE the mechanism to the whole segment (still one
+* `data`, `gopStartMs` = the segment start) — a worse read, not another path.
+*/
+var ReadGopBytesResultSchema = z.object({
+	data: z.instanceof(Uint8Array),
+	/** Absolute epoch ms of the returned fragment's first sample. */
+	gopStartMs: z.number(),
+	/** Media ms the returned fragment covers. */
+	gopDurMs: z.number()
+});
 var recordingCapability = {
 	name: "recording",
 	scope: "system",
@@ -23066,6 +23254,18 @@ var recordingCapability = {
 			kind: "query",
 			auth: "admin"
 		}),
+		/** Read the single GOP of segment `startMs` covering `epochMs`, by mfra
+		*  byte range — the scrub-granular read (D31 letter on the feeder path).
+		*  See {@link ReadGopBytesResultSchema} for the degradation contract. */
+		readGopBytes: method(z.object({
+			deviceId: z.number(),
+			profile: z.string(),
+			startMs: z.number(),
+			epochMs: z.number()
+		}), ReadGopBytesResultSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
 		setDeviceConfig: method(z.object({
 			deviceId: z.number(),
 			config: RecordingConfigSchema
@@ -23709,6 +23909,16 @@ var StreamProfileConfigSchema = z.object({
 		"baseline"
 	]).optional(),
 	gop: z.number().optional(),
+	/**
+	* Whether THIS profile currently carries an audio track. READ-ONLY here.
+	*
+	* There is no matching field on {@link StreamProfilePatchSchema}: the
+	* camera's microphone is owned by `privacy-mask` (`setAudioEnabled`), which
+	* writes every profile at once so "audio off" means silent everywhere. A
+	* per-profile writer beside it would let a camera be half-muted and would be
+	* a second knob onto one device register — the failure D62 exists to
+	* prevent. Absent when the firmware does not report the flag.
+	*/
 	audio: z.boolean().optional()
 });
 var StreamParamsStatusSchema = z.object({
@@ -23749,7 +23959,13 @@ var StreamParamsOptionsSchema = z.object({
 	ext: StreamProfileOptionsSchema.optional()
 });
 /** A partial change to one profile — every field optional; a provider
-*  ignores fields it doesn't support. */
+*  ignores fields it doesn't support.
+*
+*  There is deliberately NO `audio` here. It existed until 2026-08-07,
+*  reachable from no form and honoured by exactly one provider, while the
+*  camera's microphone is a whole-device fact. It now has one writer,
+*  `privacyMask.setAudioEnabled`, which writes every profile — see
+*  `privacy-mask.cap.ts`. */
 var StreamProfilePatchSchema = z.object({
 	width: z.number().optional(),
 	height: z.number().optional(),
@@ -23762,8 +23978,7 @@ var StreamProfilePatchSchema = z.object({
 		"main",
 		"baseline"
 	]).optional(),
-	gop: z.number().optional(),
-	audio: z.boolean().optional()
+	gop: z.number().optional()
 });
 var streamParamsCapability = {
 	name: "stream-params",
@@ -29368,6 +29583,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"privacyMask.setAudioEnabled": {
+		capName: "privacy-mask",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"privacyMask.setMask": {
 		capName: "privacy-mask",
 		capScope: "device",
@@ -29536,6 +29757,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.readGopBytes": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.readSegmentBytes": {
 		capName: "recording",
 		capScope: "system",
@@ -30933,6 +31160,42 @@ TimelapseRuleInputSchema.extend({
 	updatedAt: z.number()
 });
 /**
+* The addon id as the REGISTRY, the wire and the durable stores spell it.
+*
+* `AddonContext.id` does not agree with itself across the two context
+* factories:
+*
+*   - a FORKED addon gets the bare manifest id
+*     (`kernel/moleculer/addon-context-factory.ts` → `id: addonId`);
+*   - an addon co-located in hub-main gets it PREFIXED
+*     (`server/backend/src/core/addon/addon-registry.service.ts` →
+*      ``id: `addon:${addonId}` ``).
+*
+* Everything an addon might compare `ctx.id` AGAINST carries the bare form:
+* `DeviceBindingEntry.providerAddonId`, the `device-manager` bindings store's
+* `wrapperAddonId`, `CapabilityRegistry` provider keys, manifest ids.
+*
+* So `entry.providerAddonId === this.ctx.id` is silently, permanently false
+* for a builtin — and only for a builtin, which is why it survives a green
+* suite whose fake supplies the bare id. That is exactly how camera 615's
+* virtual doorbell latched `unbound` for twelve hours on 2026-08-07 while its
+* binding was intact ([D72](../../../../docs/decisions/adr-0072.md)).
+*
+* Route every comparison between `ctx.id` and a registry/store addon id
+* through {@link isSameAddonId}. `scripts/check-addon-id-comparison.ts`
+* enforces it in the processes where the prefix exists.
+*/
+/** The prefix the hub-main context factory prepends to the manifest id. */
+var ADDON_ID_PREFIX = "addon:";
+/** The manifest id, whichever spelling of `ctx.id` you were handed. */
+function bareAddonId(id) {
+	return id.startsWith(ADDON_ID_PREFIX) ? id.slice(6) : id;
+}
+/** True when both ids name the same addon, prefixed or not. */
+function isSameAddonId(a, b) {
+	return bareAddonId(a) === bareAddonId(b);
+}
+/**
 * Decode base64 little-endian Float32 back into a vector.
 *
 * Throws on a byte length that is not a multiple of 4 — a truncated vector
@@ -30975,6 +31238,88 @@ z.object({
 	square: false
 }).paddingRatio;
 /**
+* WHICH delivered frames the decode worker retains a native copy of.
+*
+* - `all` — every frame the worker delivered to the runner. The shipped
+*   behaviour, and the only correct one if something can ask for a crop of a
+*   frame the runner never sent to inference.
+* - `inferred` — only the frames the runner ADMITTED to its detection queue.
+*   A native-crop request always names a `frameId` that rode an inference
+*   result, so that is the only set a request can name. How much it drops is
+*   the two-plane governor's admit ratio and nothing else: measured at ~50% on
+*   this cluster, not the ~80% the design sketch assumed, because the governor
+*   was not throttling as hard as the sketch supposed. Read
+*   `leaseAdmitted`/`leaseOffered` off the metrics line for the camera in front
+*   of you rather than quoting a number from here. The newest delivered frame is
+*   croppable regardless — it is still the worker's reserved slot, not a lease —
+*   which covers the one-frame race between a mark and the supersede that
+*   consumes it.
+*/
+var NativeLeaseAdmissionSchema = z.enum(["all", "inferred"]);
+z.object({
+	/**
+	* How long a retained native frame is served before it counts as a miss.
+	*
+	* Must cover the FULL late-crop horizon: detection inference + the
+	* cross-process inference-result hop to hub post-analysis + tracking + the
+	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
+	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
+	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	*/
+	ttlMs: z.number().int().min(250).max(1e4),
+	/**
+	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
+	*
+	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
+	* which one is actually binding before reasoning from that. At the shipped
+	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
+	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
+	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
+	* change that admits fewer frames buys retention WINDOW at constant RAM
+	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* `0` DISABLES the lease entirely and falls the worker back to the tiny
+	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
+	* to replace).
+	*/
+	budgetMb: z.number().int().min(0).max(4096),
+	/**
+	* Demand window: eager per-frame native retention runs only within this many
+	* ms of the last native-crop request (or of the dial starting).
+	*
+	* `0` means ALWAYS ON — it disables the gate, it does not disable retention.
+	* That is the legacy behaviour that saturated an N100 (24 native-4K downloads
+	* per second on a camera with zero crop demand), so leave it non-zero unless
+	* you are reproducing that.
+	*/
+	activityMs: z.number().int().min(0).max(12e4),
+	/**
+	* Which delivered frames are retained at all — see
+	* {@link NativeLeaseAdmissionSchema}. This is the only knob of the four that
+	* changes WHAT is kept rather than for how long, so it is also the only one
+	* that can turn a crop that used to hit into a miss. The worker counts every
+	* crop request naming a frame it did NOT see marked
+	* (`leaseUnmarkedCrops` on the session-decode metrics line): a non-zero value
+	* there is the signal that some caller names frames outside the inference set
+	* and that this must go back to `all`.
+	*/
+	admission: NativeLeaseAdmissionSchema
+});
+/**
+* The values in force when the operator has set nothing — byte-for-byte the
+* constants the decode worker shipped with as env-var defaults, so making these
+* settings changed no behaviour on the day it landed.
+*/
+var DEFAULT_NATIVE_LEASE_SETTINGS = {
+	ttlMs: 1200,
+	budgetMb: 1024,
+	activityMs: 15e3,
+	admission: "inferred"
+};
+DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
+DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.admission;
+/**
 * Scores all applicable inference backends for the given hardware.
 *
 * Rules (hardware-driven only — no Python import probes):
@@ -31088,4 +31433,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { setByPath as $, enumerateItemArrayFields as A, nodePin as At, kebabToCamel as B, dataStoreProviderCapability as C, asString as Ct, deviceStatusCapability as D, expandCapMethods as Dt, deviceStateCapability as E, emitReadiness as Et, getByPath as F, scopeKey as Ft, looseSchema as G, localNetworkCapability as H, isArrayOutputSchema as I, sleep as It, objectInputDeclaresAddonId as J, metricsProviderCapability as K, isCollectionArrayMethod as L, EventCategory as Lt, evaluateLinkExpression as M, parseJsonUnknown as Mt, extractNestedAddonId as N, readinessKey as Nt, doorbellCapability as O, hydrateSchema as Ot, filesystemBrowseCapability as P, resolveCapMount as Pt, scoreRuntimes as Q, isObjectInput as R, coreBlocksCapability as S, asNumber as St, deviceManagerCapability as T, emitDownForOwnedCaps as Tt, logDestinationCapability as U, lifecycleJobSchema as V, logLevelAtMost as W, platformProbeCapability as X, parseStreamParamsFormPatch as Y, procedureAuthKey as Z, alertsCapability as _, DeviceType as _t, CAP_NAMES_WITH_STATUS as a, toExpressionValue as at, backupCapability as b, WELL_KNOWN_TAB_MAP as bt, METHOD_ACCESS_MAP as c, vectorDimFromBase64 as ct, ScopedTokenSchema as d, BaseAddon as dt, settingsStoreCapability as et, StorageLocationTypeSchema as f, DATAPLANE_SECRET_HEADER as ft, addonWidgetsCapability as g, DeviceRole as gt, addonSettingsCapability as h, DeviceFeature as ht, BatteryStatusSchema as i, streamQualityLabel as it, enumerateSchemaFields as j, parseJsonObject as jt, enumerateInferenceDevices as k, isDeviceConfigCap as kt, RUNTIME_DEFAULTS as l, vectorStoreCapability as lt, addonPagesCapability as m, DEVICE_STATUS_METHOD as mt, AlertSchema as n, storageCapability as nt, CoreBlockSchema as o, userManagementCapability as ot, UserRecordSchema as p, DEVICE_SETTINGS_CONTRIBUTION_METHODS as pt, normalizeUnit as q, ApiKeyRecordSchema as r, storageProviderCapability as rt, DeviceStatusSchema as s, validateExpressionSource as st, ALL_CAPABILITY_DEFINITIONS as t, snapshotCapability as tt, STREAM_PROFILE_META as u, errMsg as ut, applyTransform as v, ReadinessRegistry as vt, decodeVectorBase64 as w, createEvent as wt, buildStreamParamsConfigSchema as x, asJsonObject as xt, authProviderCapability as y, ReadinessTimeoutError as yt, isVoidInput as z };
+export { procedureAuthKey as $, enumerateInferenceDevices as A, hydrateSchema as At, isSameAddonId as B, coreBlocksCapability as C, asJsonObject as Ct, deviceStateCapability as D, emitDownForOwnedCaps as Dt, deviceManagerCapability as E, createEvent as Et, filesystemBrowseCapability as F, readinessKey as Ft, logDestinationCapability as G, kebabToCamel as H, getByPath as I, resolveCapMount as It, metricsProviderCapability as J, logLevelAtMost as K, isArrayOutputSchema as L, scopeKey as Lt, enumerateSchemaFields as M, nodePin as Mt, evaluateLinkExpression as N, parseJsonObject as Nt, deviceStatusCapability as O, emitReadiness as Ot, extractNestedAddonId as P, parseJsonUnknown as Pt, platformProbeCapability as Q, isCollectionArrayMethod as R, sleep as Rt, buildStreamParamsConfigSchema as S, WELL_KNOWN_TAB_MAP as St, decodeVectorBase64 as T, asString as Tt, lifecycleJobSchema as U, isVoidInput as V, localNetworkCapability as W, objectInputDeclaresAddonId as X, normalizeUnit as Y, parseStreamParamsFormPatch as Z, alertsCapability as _, DeviceFeature as _t, CAP_NAMES_WITH_STATUS as a, storageProviderCapability as at, backupCapability as b, ReadinessRegistry as bt, METHOD_ACCESS_MAP as c, userManagementCapability as ct, ScopedTokenSchema as d, vectorStoreCapability as dt, scoreRuntimes as et, StorageLocationTypeSchema as f, errMsg as ft, addonWidgetsCapability as g, DEVICE_STATUS_METHOD as gt, addonSettingsCapability as h, DEVICE_SETTINGS_CONTRIBUTION_METHODS as ht, BatteryStatusSchema as i, storageCapability as it, enumerateItemArrayFields as j, isDeviceConfigCap as jt, doorbellCapability as k, expandCapMethods as kt, RUNTIME_DEFAULTS as l, validateExpressionSource as lt, addonPagesCapability as m, DATAPLANE_SECRET_HEADER as mt, AlertSchema as n, settingsStoreCapability as nt, CoreBlockSchema as o, streamQualityLabel as ot, UserRecordSchema as p, BaseAddon as pt, looseSchema as q, ApiKeyRecordSchema as r, snapshotCapability as rt, DeviceStatusSchema as s, toExpressionValue as st, ALL_CAPABILITY_DEFINITIONS as t, setByPath as tt, STREAM_PROFILE_META as u, vectorDimFromBase64 as ut, applyTransform as v, DeviceRole as vt, dataStoreProviderCapability as w, asNumber as wt, bareAddonId as x, ReadinessTimeoutError as xt, authProviderCapability as y, DeviceType as yt, isObjectInput as z, EventCategory as zt };