@camstack/types 1.2.274 → 1.2.275

package/dist/{composition-BRxAnxtU.js → composition-DG4jVTfB.js}

@@ -714,6 +714,191 @@ function replaceWithSortedKeys(_key, value) {
 	return value;
 }
 //#endregion
+//#region src/deps/ffmpeg-artifacts.ts
+/**
+* The ffmpeg build every CamStack node downloads, per platform and arch.
+*
+* ## Why a download, on every node, including the container
+*
+* The version of ffmpeg used to be CODE: baked into the image, changeable only
+* by rebuilding and rolling it. Now it is DATA — this file states the release,
+* and a node that boots with a different one downloads it. Changing ffmpeg is a
+* framework bump, not an image rebuild.
+*
+* It also settles the licence question by removing it. FFmpeg's licence is
+* chosen at compile time: the core is LGPL 2.1+, `--enable-gpl` makes it GPL
+* (for x264/x265), `--enable-version3` makes that v3, and `--enable-nonfree`
+* makes the result undistributable. These are GPL v3 builds, and we do not
+* distribute them: the user's own node fetches the archive from the project
+* that publishes it, so we convey no GPL work and inherit none of the
+* obligations that come with conveying one. That is the whole reason the image
+* no longer installs ffmpeg at all — not a technical preference.
+*
+* ## Why jellyfin-ffmpeg
+*
+* One vendor covering linux-amd64, linux-arm64, darwin-arm64 and darwin-x64
+* from one release, with the widest hardware surface of anything maintained:
+* VAAPI, QSV, NVENC/NVDEC, AMF, Vulkan, OpenCL and DRM on amd64, plus Rockchip
+* MPP on arm64. It reaches the vendor libraries through dlopen trampolines,
+* so the binary is not linked against a driver stack it may not find.
+*
+* **What it still needs from the host, measured 2026-09-19.** On the Unraid
+* HOST, which has no libva, `-vaapi_device` aborts the process outright —
+* `implib-gen: libva-drm.so.2: failed to load library ... Assertion '0 &&
+* "Assertion in generated code"' failed`. Inside our container, which installs
+* libva plus the iHD driver, the same command encodes: verified end to end with
+* `testsrc → format=nv12,hwupload → h264_vaapi`. So the image drops ffmpeg and
+* KEEPS the Intel media stack; the drivers are the part a binary cannot bring.
+*
+* ## Why each artifact carries a checksum and a claim
+*
+* The download is now the only source, so `sha256` is verified before anything
+* is extracted — jellyfin publishes no checksums on its release assets, so
+* these are ours, taken at the version bump. And `expectedHwaccels` is what the
+* build is supposed to be able to do: a binary that probes short of its own
+* claim is a source that changed under us, which is precisely what went
+* unnoticed for months when a static build turned out to carry no VAAPI at all
+* (D536).
+*/
+/** The pinned jellyfin-ffmpeg release. Changing this is the version change. */
+var FFMPEG_RELEASE = "8.1.2-5";
+var BASE = `https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/v${FFMPEG_RELEASE}`;
+function portable(target) {
+	return `${BASE}/jellyfin-ffmpeg_${FFMPEG_RELEASE}_portable_${target}-gpl.tar.xz`;
+}
+/**
+* Every artifact below was fetched and hashed on 2026-09-19, and each one's
+* capability claim was verified by RUNNING it: the linux64 build on the hub
+* itself, the two macOS builds on an M-series Mac (the x86_64 one under
+* Rosetta, which translates x86 to arm — never the reverse, which is why the
+* darwin split matters at all).
+*
+* linux-arm64 is hashed but NOT executed — there is no arm64 Linux node in
+* this cluster yet. Its claim is taken from the project's build script, so the
+* first ARM node to boot will either confirm it or trip the assertion, which is
+* the outcome the assertion exists for.
+*/
+var FFMPEG_ARTIFACTS = {
+	"linux-x64": {
+		url: portable("linux64"),
+		archiveFormat: "tar.xz",
+		sha256: "1fd859927053c44a4f2dbf67ae8b9ba8d29fb3b8930df0dd57d91aa60589363d",
+		sizeBytes: 60255400,
+		expectedHwaccels: [
+			"vaapi",
+			"qsv",
+			"drm",
+			"vulkan",
+			"opencl"
+		]
+	},
+	"linux-arm64": {
+		url: portable("linuxarm64"),
+		archiveFormat: "tar.xz",
+		sha256: "1bd4fafaf4c309cad896d3479152c31d6b7604d4be8b8526882ea16cc6d5f589",
+		sizeBytes: 53958064,
+		expectedHwaccels: ["vaapi", "drm"]
+	},
+	"darwin-arm64": {
+		url: portable("macarm64"),
+		archiveFormat: "tar.xz",
+		sha256: "b2ac80bb184e9a2f3f7c236876b2f56a5639596a95b42f41ced34fab66ad720d",
+		sizeBytes: 32896684,
+		expectedHwaccels: ["videotoolbox"]
+	},
+	"darwin-x64": {
+		url: portable("mac64"),
+		archiveFormat: "tar.xz",
+		sha256: "021cd321ea169722cd2e4aca35884305449666a0d231d3378af7f87d6a5626e5",
+		sizeBytes: 37852180,
+		expectedHwaccels: ["videotoolbox"]
+	}
+};
+/** The artifact for this node, or a refusal naming what was asked for. */
+function getFfmpegArtifact(platform, arch) {
+	const artifact = FFMPEG_ARTIFACTS[`${platform}-${arch}`];
+	if (!artifact) throw new Error(`Unsupported platform/architecture for ffmpeg: ${platform}-${arch}. Point CAMSTACK_FFMPEG_PATH at a binary this node can run.`);
+	return artifact;
+}
+/** The URL alone, for a caller that wants nothing else. */
+function getFfmpegDownloadUrl(platform, arch) {
+	return getFfmpegArtifact(platform, arch).url;
+}
+//#endregion
+//#region src/deps/ffmpeg-binary-source.ts
+/**
+* WHICH ffmpeg a node runs — one rule, on every node.
+*
+* ## The rule
+*
+* 1. `CAMSTACK_FFMPEG_PATH`, when the operator set it and it exists. Pointing
+*    at your own build is a deliberate act and it wins over everything.
+* 2. The pinned build this node has already downloaded, named by release
+*    (`ffmpeg-<release>`), in `<dataDir>/deps`.
+* 3. Nothing — the caller downloads it. See `ffmpeg-artifacts.ts`.
+*
+* The system PATH is not on that list and must never be. A host binary is an
+* unknown version with unknown vendor libraries, and it changes under us on any
+* host update; a self-hosted NVR cannot assume the host has ffmpeg at all
+* (D536).
+*
+* ## Why the container image is not special any more
+*
+* It was, for one day: the image installed ffmpeg, CamStack preferred it, and
+* that made the answer depend on where a node ran — an image node got VAAPI, a
+* native one got a portable build with none. Now every node downloads the same
+* pinned build, so:
+*
+*  - the ffmpeg version is DATA, not code: changing it is a framework bump, not
+*    an image rebuild and a container swap on every machine;
+*  - we ship no ffmpeg binary, so we convey no GPL work — the node fetches it
+*    from the project that publishes it;
+*  - one binary, one set of capabilities, everywhere. A bug that depends on
+*    which ffmpeg answered stops being possible.
+*
+* What the image still owes is the DRIVERS, which no binary can bring: libva
+* plus the iHD media driver for Intel. Measured 2026-09-19 — the portable build
+* encodes VAAPI inside our container and ABORTS on the bare Unraid host, where
+* `libva-drm.so.2` does not exist.
+*
+* ## Absent is absent
+*
+* The naming carries the release, so two versions coexist during a change and a
+* rollback is a file that is already on disk rather than a download.
+*/
+/** Operator override. Unset on every node unless a human deliberately set it. */
+var FFMPEG_PATH_ENV = "CAMSTACK_FFMPEG_PATH";
+/**
+* The file name the pinned build is stored under.
+*
+* Versioned on purpose: a download is then idempotent, two releases can sit
+* side by side while a change rolls through a cluster, and going back is a path
+* that already exists instead of a fetch that has to succeed.
+*/
+function ffmpegBinaryName(platform) {
+	return `ffmpeg-${FFMPEG_RELEASE}${platform === "win32" ? ".exe" : ""}`;
+}
+/**
+* The binary to use, or `null` when it has to be downloaded first.
+*
+* An override that does not exist is NOT silently skipped — it is an operator
+* mistake, and falling through to a different binary than the one they named
+* would hide it. The caller reports it and carries on with the pinned build,
+* which is the only safe direction: a typo must not stop a node serving video.
+*/
+function chooseFfmpegBinary(input) {
+	const override = input.override?.trim() ?? "";
+	if (override.length > 0 && input.exists(override)) return {
+		origin: "override",
+		path: override
+	};
+	if (input.exists(input.pinnedPath)) return {
+		origin: "downloaded",
+		path: input.pinnedPath
+	};
+	return null;
+}
+//#endregion
 //#region src/catalogs/sensor-active-state.ts
 /**
 * LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
@@ -2268,6 +2453,18 @@ Object.defineProperty(exports, "ExpressionParseError", {
 		return ExpressionParseError;
 	}
 });
+Object.defineProperty(exports, "FFMPEG_PATH_ENV", {
+	enumerable: true,
+	get: function() {
+		return FFMPEG_PATH_ENV;
+	}
+});
+Object.defineProperty(exports, "FFMPEG_RELEASE", {
+	enumerable: true,
+	get: function() {
+		return FFMPEG_RELEASE;
+	}
+});
 Object.defineProperty(exports, "Fmp4BoxSplitter", {
 	enumerable: true,
 	get: function() {
@@ -2394,6 +2591,12 @@ Object.defineProperty(exports, "canonicalHash", {
 		return canonicalHash;
 	}
 });
+Object.defineProperty(exports, "chooseFfmpegBinary", {
+	enumerable: true,
+	get: function() {
+		return chooseFfmpegBinary;
+	}
+});
 Object.defineProperty(exports, "cloneStatefulExpressionMemory", {
 	enumerable: true,
 	get: function() {
@@ -2520,12 +2723,30 @@ Object.defineProperty(exports, "featureSources", {
 		return featureSources;
 	}
 });
+Object.defineProperty(exports, "ffmpegBinaryName", {
+	enumerable: true,
+	get: function() {
+		return ffmpegBinaryName;
+	}
+});
 Object.defineProperty(exports, "fieldReads", {
 	enumerable: true,
 	get: function() {
 		return fieldReads;
 	}
 });
+Object.defineProperty(exports, "getFfmpegArtifact", {
+	enumerable: true,
+	get: function() {
+		return getFfmpegArtifact;
+	}
+});
+Object.defineProperty(exports, "getFfmpegDownloadUrl", {
+	enumerable: true,
+	get: function() {
+		return getFfmpegDownloadUrl;
+	}
+});
 Object.defineProperty(exports, "invocationFromEncodeProfile", {
 	enumerable: true,
 	get: function() {

package/dist/{composition-BK-GTFYb.mjs → composition-Dq42XWp0.mjs}

@@ -714,6 +714,191 @@ function replaceWithSortedKeys(_key, value) {
 	return value;
 }
 //#endregion
+//#region src/deps/ffmpeg-artifacts.ts
+/**
+* The ffmpeg build every CamStack node downloads, per platform and arch.
+*
+* ## Why a download, on every node, including the container
+*
+* The version of ffmpeg used to be CODE: baked into the image, changeable only
+* by rebuilding and rolling it. Now it is DATA — this file states the release,
+* and a node that boots with a different one downloads it. Changing ffmpeg is a
+* framework bump, not an image rebuild.
+*
+* It also settles the licence question by removing it. FFmpeg's licence is
+* chosen at compile time: the core is LGPL 2.1+, `--enable-gpl` makes it GPL
+* (for x264/x265), `--enable-version3` makes that v3, and `--enable-nonfree`
+* makes the result undistributable. These are GPL v3 builds, and we do not
+* distribute them: the user's own node fetches the archive from the project
+* that publishes it, so we convey no GPL work and inherit none of the
+* obligations that come with conveying one. That is the whole reason the image
+* no longer installs ffmpeg at all — not a technical preference.
+*
+* ## Why jellyfin-ffmpeg
+*
+* One vendor covering linux-amd64, linux-arm64, darwin-arm64 and darwin-x64
+* from one release, with the widest hardware surface of anything maintained:
+* VAAPI, QSV, NVENC/NVDEC, AMF, Vulkan, OpenCL and DRM on amd64, plus Rockchip
+* MPP on arm64. It reaches the vendor libraries through dlopen trampolines,
+* so the binary is not linked against a driver stack it may not find.
+*
+* **What it still needs from the host, measured 2026-09-19.** On the Unraid
+* HOST, which has no libva, `-vaapi_device` aborts the process outright —
+* `implib-gen: libva-drm.so.2: failed to load library ... Assertion '0 &&
+* "Assertion in generated code"' failed`. Inside our container, which installs
+* libva plus the iHD driver, the same command encodes: verified end to end with
+* `testsrc → format=nv12,hwupload → h264_vaapi`. So the image drops ffmpeg and
+* KEEPS the Intel media stack; the drivers are the part a binary cannot bring.
+*
+* ## Why each artifact carries a checksum and a claim
+*
+* The download is now the only source, so `sha256` is verified before anything
+* is extracted — jellyfin publishes no checksums on its release assets, so
+* these are ours, taken at the version bump. And `expectedHwaccels` is what the
+* build is supposed to be able to do: a binary that probes short of its own
+* claim is a source that changed under us, which is precisely what went
+* unnoticed for months when a static build turned out to carry no VAAPI at all
+* (D536).
+*/
+/** The pinned jellyfin-ffmpeg release. Changing this is the version change. */
+var FFMPEG_RELEASE = "8.1.2-5";
+var BASE = `https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/v${FFMPEG_RELEASE}`;
+function portable(target) {
+	return `${BASE}/jellyfin-ffmpeg_${FFMPEG_RELEASE}_portable_${target}-gpl.tar.xz`;
+}
+/**
+* Every artifact below was fetched and hashed on 2026-09-19, and each one's
+* capability claim was verified by RUNNING it: the linux64 build on the hub
+* itself, the two macOS builds on an M-series Mac (the x86_64 one under
+* Rosetta, which translates x86 to arm — never the reverse, which is why the
+* darwin split matters at all).
+*
+* linux-arm64 is hashed but NOT executed — there is no arm64 Linux node in
+* this cluster yet. Its claim is taken from the project's build script, so the
+* first ARM node to boot will either confirm it or trip the assertion, which is
+* the outcome the assertion exists for.
+*/
+var FFMPEG_ARTIFACTS = {
+	"linux-x64": {
+		url: portable("linux64"),
+		archiveFormat: "tar.xz",
+		sha256: "1fd859927053c44a4f2dbf67ae8b9ba8d29fb3b8930df0dd57d91aa60589363d",
+		sizeBytes: 60255400,
+		expectedHwaccels: [
+			"vaapi",
+			"qsv",
+			"drm",
+			"vulkan",
+			"opencl"
+		]
+	},
+	"linux-arm64": {
+		url: portable("linuxarm64"),
+		archiveFormat: "tar.xz",
+		sha256: "1bd4fafaf4c309cad896d3479152c31d6b7604d4be8b8526882ea16cc6d5f589",
+		sizeBytes: 53958064,
+		expectedHwaccels: ["vaapi", "drm"]
+	},
+	"darwin-arm64": {
+		url: portable("macarm64"),
+		archiveFormat: "tar.xz",
+		sha256: "b2ac80bb184e9a2f3f7c236876b2f56a5639596a95b42f41ced34fab66ad720d",
+		sizeBytes: 32896684,
+		expectedHwaccels: ["videotoolbox"]
+	},
+	"darwin-x64": {
+		url: portable("mac64"),
+		archiveFormat: "tar.xz",
+		sha256: "021cd321ea169722cd2e4aca35884305449666a0d231d3378af7f87d6a5626e5",
+		sizeBytes: 37852180,
+		expectedHwaccels: ["videotoolbox"]
+	}
+};
+/** The artifact for this node, or a refusal naming what was asked for. */
+function getFfmpegArtifact(platform, arch) {
+	const artifact = FFMPEG_ARTIFACTS[`${platform}-${arch}`];
+	if (!artifact) throw new Error(`Unsupported platform/architecture for ffmpeg: ${platform}-${arch}. Point CAMSTACK_FFMPEG_PATH at a binary this node can run.`);
+	return artifact;
+}
+/** The URL alone, for a caller that wants nothing else. */
+function getFfmpegDownloadUrl(platform, arch) {
+	return getFfmpegArtifact(platform, arch).url;
+}
+//#endregion
+//#region src/deps/ffmpeg-binary-source.ts
+/**
+* WHICH ffmpeg a node runs — one rule, on every node.
+*
+* ## The rule
+*
+* 1. `CAMSTACK_FFMPEG_PATH`, when the operator set it and it exists. Pointing
+*    at your own build is a deliberate act and it wins over everything.
+* 2. The pinned build this node has already downloaded, named by release
+*    (`ffmpeg-<release>`), in `<dataDir>/deps`.
+* 3. Nothing — the caller downloads it. See `ffmpeg-artifacts.ts`.
+*
+* The system PATH is not on that list and must never be. A host binary is an
+* unknown version with unknown vendor libraries, and it changes under us on any
+* host update; a self-hosted NVR cannot assume the host has ffmpeg at all
+* (D536).
+*
+* ## Why the container image is not special any more
+*
+* It was, for one day: the image installed ffmpeg, CamStack preferred it, and
+* that made the answer depend on where a node ran — an image node got VAAPI, a
+* native one got a portable build with none. Now every node downloads the same
+* pinned build, so:
+*
+*  - the ffmpeg version is DATA, not code: changing it is a framework bump, not
+*    an image rebuild and a container swap on every machine;
+*  - we ship no ffmpeg binary, so we convey no GPL work — the node fetches it
+*    from the project that publishes it;
+*  - one binary, one set of capabilities, everywhere. A bug that depends on
+*    which ffmpeg answered stops being possible.
+*
+* What the image still owes is the DRIVERS, which no binary can bring: libva
+* plus the iHD media driver for Intel. Measured 2026-09-19 — the portable build
+* encodes VAAPI inside our container and ABORTS on the bare Unraid host, where
+* `libva-drm.so.2` does not exist.
+*
+* ## Absent is absent
+*
+* The naming carries the release, so two versions coexist during a change and a
+* rollback is a file that is already on disk rather than a download.
+*/
+/** Operator override. Unset on every node unless a human deliberately set it. */
+var FFMPEG_PATH_ENV = "CAMSTACK_FFMPEG_PATH";
+/**
+* The file name the pinned build is stored under.
+*
+* Versioned on purpose: a download is then idempotent, two releases can sit
+* side by side while a change rolls through a cluster, and going back is a path
+* that already exists instead of a fetch that has to succeed.
+*/
+function ffmpegBinaryName(platform) {
+	return `ffmpeg-${FFMPEG_RELEASE}${platform === "win32" ? ".exe" : ""}`;
+}
+/**
+* The binary to use, or `null` when it has to be downloaded first.
+*
+* An override that does not exist is NOT silently skipped — it is an operator
+* mistake, and falling through to a different binary than the one they named
+* would hide it. The caller reports it and carries on with the pinned build,
+* which is the only safe direction: a typo must not stop a node serving video.
+*/
+function chooseFfmpegBinary(input) {
+	const override = input.override?.trim() ?? "";
+	if (override.length > 0 && input.exists(override)) return {
+		origin: "override",
+		path: override
+	};
+	if (input.exists(input.pinnedPath)) return {
+		origin: "downloaded",
+		path: input.pinnedPath
+	};
+	return null;
+}
+//#endregion
 //#region src/catalogs/sensor-active-state.ts
 /**
 * LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
@@ -2076,4 +2261,4 @@ function featureSources(feature) {
 	return featureFieldEntries(feature).map((e) => e.source);
 }
 //#endregion
-export { MAX_EXPRESSION_AST_NODES as $, compositionFeatureEnabled as A, invocationFromEncodeProfile as At, createStatefulExpressionMemory as B, CompositionTargetSchema as C, Fmp4BoxSplitter as Ct, MAX_COMPOSITION_ITEMS as D, buildFfmpegArgs as Dt, MAX_COMPOSITION_FIELDS_PER_FEATURE as E, buildAudioArgs as Et, featureFieldEntries as F, createExpressionScope as G, evaluateStatefulExpressionCall as H, featureSources as I, compileExpressionSafe as J, evaluateAst as K, fieldReads as L, compositionReadKey as M, logBannerArgs as Mt, compositionSliceKey as N, pickVideoEncoder as Nt, composedDeviceRef as O, buildInputArgs as Ot, compositionSourceKey as P, resolveStreamMaps as Pt, EXPRESSION_IDENTIFIER_RE as Q, EXPRESSION_INJECTED_NOW as R, CompositionSourceRefSchema as S, canonicalHash as St, MAX_COMPOSITION_FEATURES as T, audioPlanFromEncodeProfile as Tt, toExpressionValue as U, evaluateExpressionSource as V, validateExpressionSource as W, tokenize as X, parseExpression as Y, EXPRESSION_COMPILE_CACHE_CAPACITY as Z, CompositionItemEntrySchema as _, evaluateSensorEdge as _t, CUSTOMIZATION_BLOCK_NAME_PREFIX as a, EXPRESSION_BUILTINS as at, CompositionPassthroughFeatureSchema as b, sliceActiveValue as bt, CompositionCommandTargetSchema as c, evaluateRose as ct, CompositionFeatureSchema as d, ExpressionParseError as dt, MAX_EXPRESSION_BINDINGS as et, CompositionFieldReadSchema as f, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as ft, CompositionFromSourceSchema as g, SOURCE_DEVICE_TYPES as gt, CompositionForwardCommandSchema as h, SOURCE_CAP_CHANGED_AT_FIELD as ht, COMPOSITION_ITEM_KEY_RE as i, RESERVED_BINDING_NAMES as it, compositionItemFieldPath as j, isSoftwareDecode as jt, composedDeviceStableId as k, buildVideoArgs as kt, CompositionExistingTargetSchema as l, isStatefulBuiltin as lt, CompositionFieldsFeatureSchema as m, SOURCE_CAP_ACTIVE_FIELD as mt, COMPOSER_ADDON_ID as n, MAX_EXPRESSION_EVAL_STEPS as nt, CompositionBindingSchema as o, EXPRESSION_BUILTIN_NAMES as ot, CompositionFieldSourceSchema as p, SOURCE_CAPS as pt, compileExpression as q, COMPOSITION_ITEM_ARRAY_PATH as r, MAX_EXPRESSION_SOURCE_LENGTH as rt, CompositionCodeSourceSchema as s, evaluateCount as st, COMPOSED_DEVICE_STABLE_ID_PREFIX as t, MAX_EXPRESSION_CALL_ARGS as tt, CompositionExpressionSourceSchema as u, ExpressionEvalError as ut, CompositionLiteralBindingSchema as v, evaluateSensorLevelEdge as vt, MAX_COMPOSITION_CODE_LENGTH as w, AUDIO_PRESETS as wt, CompositionSchema as x, sliceChangedAt as xt, CompositionNewTargetSchema as y, isSourceCap as yt, cloneStatefulExpressionMemory as z };
+export { MAX_EXPRESSION_AST_NODES as $, compositionFeatureEnabled as A, AUDIO_PRESETS as At, createStatefulExpressionMemory as B, resolveStreamMaps as Bt, CompositionTargetSchema as C, chooseFfmpegBinary as Ct, MAX_COMPOSITION_ITEMS as D, getFfmpegDownloadUrl as Dt, MAX_COMPOSITION_FIELDS_PER_FEATURE as E, getFfmpegArtifact as Et, featureFieldEntries as F, buildVideoArgs as Ft, createExpressionScope as G, evaluateStatefulExpressionCall as H, featureSources as I, invocationFromEncodeProfile as It, compileExpressionSafe as J, evaluateAst as K, fieldReads as L, isSoftwareDecode as Lt, compositionReadKey as M, buildAudioArgs as Mt, compositionSliceKey as N, buildFfmpegArgs as Nt, composedDeviceRef as O, canonicalHash as Ot, compositionSourceKey as P, buildInputArgs as Pt, EXPRESSION_IDENTIFIER_RE as Q, EXPRESSION_INJECTED_NOW as R, logBannerArgs as Rt, CompositionSourceRefSchema as S, FFMPEG_PATH_ENV as St, MAX_COMPOSITION_FEATURES as T, FFMPEG_RELEASE as Tt, toExpressionValue as U, evaluateExpressionSource as V, validateExpressionSource as W, tokenize as X, parseExpression as Y, EXPRESSION_COMPILE_CACHE_CAPACITY as Z, CompositionItemEntrySchema as _, evaluateSensorEdge as _t, CUSTOMIZATION_BLOCK_NAME_PREFIX as a, EXPRESSION_BUILTINS as at, CompositionPassthroughFeatureSchema as b, sliceActiveValue as bt, CompositionCommandTargetSchema as c, evaluateRose as ct, CompositionFeatureSchema as d, ExpressionParseError as dt, MAX_EXPRESSION_BINDINGS as et, CompositionFieldReadSchema as f, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as ft, CompositionFromSourceSchema as g, SOURCE_DEVICE_TYPES as gt, CompositionForwardCommandSchema as h, SOURCE_CAP_CHANGED_AT_FIELD as ht, COMPOSITION_ITEM_KEY_RE as i, RESERVED_BINDING_NAMES as it, compositionItemFieldPath as j, audioPlanFromEncodeProfile as jt, composedDeviceStableId as k, Fmp4BoxSplitter as kt, CompositionExistingTargetSchema as l, isStatefulBuiltin as lt, CompositionFieldsFeatureSchema as m, SOURCE_CAP_ACTIVE_FIELD as mt, COMPOSER_ADDON_ID as n, MAX_EXPRESSION_EVAL_STEPS as nt, CompositionBindingSchema as o, EXPRESSION_BUILTIN_NAMES as ot, CompositionFieldSourceSchema as p, SOURCE_CAPS as pt, compileExpression as q, COMPOSITION_ITEM_ARRAY_PATH as r, MAX_EXPRESSION_SOURCE_LENGTH as rt, CompositionCodeSourceSchema as s, evaluateCount as st, COMPOSED_DEVICE_STABLE_ID_PREFIX as t, MAX_EXPRESSION_CALL_ARGS as tt, CompositionExpressionSourceSchema as u, ExpressionEvalError as ut, CompositionLiteralBindingSchema as v, evaluateSensorLevelEdge as vt, MAX_COMPOSITION_CODE_LENGTH as w, ffmpegBinaryName as wt, CompositionSchema as x, sliceChangedAt as xt, CompositionNewTargetSchema as y, isSourceCap as yt, cloneStatefulExpressionMemory as z, pickVideoEncoder as zt };

package/dist/constants.d.ts

@@ -54,7 +54,6 @@ export interface RuntimeDefaultsShape {
     'storage.provider': string;
     'storage.locations': Record<string, string>;
     providers: RuntimeDefaultsProvider[];
-    'ffmpeg.binaryPath': string;
     'ffmpeg.hwAccel': string;
     'ffmpeg.threadCount': number;
     'auth.tokenExpiry': string;

package/dist/ffmpeg/pinned-binary.d.ts

@@ -0,0 +1,27 @@
+/**
+ * How a runtime site gets the ffmpeg it spawns: the node's PINNED build, asked
+ * of `ctx.deps.ensureFfmpeg()` and never looked up on PATH (D540).
+ *
+ * Why a memo and not a bare `ensureFfmpeg()` per spawn: every call takes the
+ * deps file lock, probes the binary (`-version`, `-hwaccels`, `-encoders` —
+ * three children) and logs the resolution. That is right once per process and
+ * wrong once per still, per fragment or per preview.
+ *
+ * Why a memo and not a string resolved at init with a default: a default is
+ * what this repo kept writing — `ffmpegPath ?? 'ffmpeg'`, `binaryPath =
+ * 'ffmpeg'` — and every one of them turned "the pinned build is unavailable"
+ * into "run the host's binary" without a line in the log. A resolver that
+ * REJECTS has no such value to fall back to; the caller must say what it
+ * refused. `scripts/check-no-bare-ffmpeg.ts` refuses the default at commit.
+ */
+/** The pinned ffmpeg for this node; rejects when there is none to be had. */
+export type PinnedFfmpegResolver = () => Promise<string>;
+/**
+ * Memoize `ensure` on SUCCESS only.
+ *
+ * A failure is not remembered: the next caller asks again, so a node whose
+ * first download failed (no network at boot) recovers on the next spawn that
+ * needs it — with no timer and no retry loop, because the ask is driven by
+ * work that actually wants the binary.
+ */
+export declare function memoizePinnedFfmpeg(ensure: () => Promise<string>): PinnedFfmpegResolver;

package/dist/ffmpeg/pinned-spawn.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The spawn a one-shot ffmpeg site uses: the spec's seam when one is injected,
+ * else the node's PINNED binary (D540), else `null` — and the site refuses by
+ * name. There is no fourth answer: the `?? 'ffmpeg'` this replaces made "no
+ * pinned build" mean "run the host's", silently, at every clip site that had it.
+ *
+ * Node-only (`node:child_process`), so it lives under `@camstack/types/node`.
+ */
+import { type ChildProcess, type SpawnOptions } from 'node:child_process';
+/** One ffmpeg child from its argv. */
+export type FfmpegArgvSpawn = (args: readonly string[]) => ChildProcess;
+/** The detail a site refusing for want of a binary puts in its refusal. */
+export declare const NO_PINNED_FFMPEG_DETAIL = "no pinned ffmpeg on this node (D540)";
+/** What a site gets when it asks for its spawn: one, or the refusal to name. */
+export type PinnedFfmpegSpawnAnswer = {
+    readonly kind: 'ready';
+    readonly spawn: FfmpegArgvSpawn;
+} | {
+    readonly kind: 'refused';
+    readonly detail: string;
+};
+/**
+ * {@link pinnedFfmpegSpawner}, asked at the point of use through the node's
+ * resolver (`memoizePinnedFfmpeg`). A site that keeps the RESOLVER rather than
+ * a path captured at init recovers when a later resolution succeeds; a path
+ * captured as `null` at boot stayed `null` until the runner restarted.
+ */
+export declare function resolvePinnedFfmpegSpawner(seam: FfmpegArgvSpawn | undefined, resolveFfmpeg: () => Promise<string>, options: SpawnOptions): Promise<PinnedFfmpegSpawnAnswer>;
+export declare function pinnedFfmpegSpawner(seam: FfmpegArgvSpawn | undefined, ffmpegBinaryPath: string | null, options: SpawnOptions): FfmpegArgvSpawn | null;

package/dist/index.d.ts

@@ -19,6 +19,8 @@ export * from './ffmpeg/hwaccel.js';
 export * from './ffmpeg/gif-derive.js';
 export * from './ffmpeg/invocation.js';
 export * from './ffmpeg/sharing-key.js';
+export * from './ffmpeg/pinned-binary.js';
+export { FFMPEG_PATH_ENV } from './deps/ffmpeg-binary-source.js';
 export * from './health/wiring-health.js';
 export type * from './interfaces/addon.js';
 export { DEFAULT_ADDON_PLACEMENT, isAgentOnlyPlacement, isDeployableToAgent, isIsolatedBuiltin, resolveAddonExecution, resolveAddonGroup, resolveAddonPlacement, resolveRunnerId, } from './interfaces/addon.js';

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_sleep = require("./sleep-WOeeZ4FU.js");
 const require_event_category = require("./event-category-MbnB-6AN.js");
-const require_composition = require("./composition-BRxAnxtU.js");
+const require_composition = require("./composition-DG4jVTfB.js");
 const require_err_msg = require("./err-msg-Dx2Kor0g.js");
 const require_enums = require("./enums.js");
 let zod = require("zod");
@@ -833,6 +833,28 @@ function egressTranscodeSharingKey(request, delivery = egressTransportFromReques
 	return `egress:${require_composition.canonicalHash(canonicalEgressPlan(request, delivery))}`;
 }
 //#endregion
+//#region src/ffmpeg/pinned-binary.ts
+/**
+* Memoize `ensure` on SUCCESS only.
+*
+* A failure is not remembered: the next caller asks again, so a node whose
+* first download failed (no network at boot) recovers on the next spawn that
+* needs it — with no timer and no retry loop, because the ask is driven by
+* work that actually wants the binary.
+*/
+function memoizePinnedFfmpeg(ensure) {
+	let pending = null;
+	return () => {
+		if (pending !== null) return pending;
+		const attempt = ensure();
+		pending = attempt;
+		attempt.catch(() => {
+			if (pending === attempt) pending = null;
+		});
+		return attempt;
+	};
+}
+//#endregion
 //#region src/health/wiring-health.ts
 /**
 * Deep wiring healthcheck — snapshot of active reachability probes across
@@ -45952,7 +45974,6 @@ var RUNTIME_DEFAULTS = {
 		models: "camstack-data/models"
 	},
 	providers: [],
-	"ffmpeg.binaryPath": "ffmpeg",
 	"ffmpeg.hwAccel": "auto",
 	"ffmpeg.threadCount": 0,
 	"auth.tokenExpiry": "30d"
@@ -68816,6 +68837,7 @@ exports.ExtensionSourceHealthSchema = ExtensionSourceHealthSchema;
 exports.ExtensionSourceSchema = ExtensionSourceSchema;
 exports.FEEDER_EXAMPLE_ADDON_ID = FEEDER_EXAMPLE_ADDON_ID;
 exports.FEEDER_EXAMPLE_HA_DEVICE_ID = FEEDER_EXAMPLE_HA_DEVICE_ID;
+exports.FFMPEG_PATH_ENV = require_composition.FFMPEG_PATH_ENV;
 exports.FIRST_LEVEL_MACRO_CLASSES = FIRST_LEVEL_MACRO_CLASSES;
 exports.FULL_IMAGE_BBOX = FULL_IMAGE_BBOX;
 exports.FailureContributionSchema = FailureContributionSchema;
@@ -70024,6 +70046,7 @@ exports.maskUrlCredentials = maskUrlCredentials;
 exports.mayReadLocation = mayReadLocation;
 exports.mayWriteToLocation = mayWriteToLocation;
 exports.mediaPlayerCapability = mediaPlayerCapability;
+exports.memoizePinnedFfmpeg = memoizePinnedFfmpeg;
 exports.mergeSourceInfo = mergeSourceInfo;
 exports.meshNetworkCapability = meshNetworkCapability;
 exports.method = require_sleep.method;