@camstack/types 1.2.41 → 1.2.43

package/dist/index.js

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_event_category = require("./event-category-BE4PDZ_3.js");
-const require_sleep = require("./sleep-DTce7-ch.js");
+const require_sleep = require("./sleep-Bx9IIoT0.js");
+const require_canonical_hash = require("./canonical-hash-BcZHRHIx.js");
 const require_enums = require("./enums.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
 let zod = require("zod");
@@ -147,6 +148,14 @@ var VideoEncodeSchema = zod.z.object({
 		"main",
 		"high"
 	]).optional(),
+	/**
+	* `-level`, e.g. `'3.1'`. A consumer that ADVERTISES a level in its SDP
+	* (`profile-level-id=42e01f` is Baseline 3.1) must constrain the encoder to
+	* it, or it ships a stream that does not match its own advertisement — the
+	* defect class that kept HomeKit black for a year and that Alexa carried
+	* silently. Optional because a browser negotiates the level itself.
+	*/
+	level: zod.z.string().optional(),
 	width: zod.z.number().int().positive().optional(),
 	height: zod.z.number().int().positive().optional(),
 	fps: zod.z.number().positive().optional(),
@@ -222,6 +231,636 @@ function encodeProfileFromStreamShape(stream) {
 	};
 }
 //#endregion
+//#region src/ffmpeg/invocation.ts
+var AUDIO_ENCODER_BY_CODEC = {
+	opus: "libopus",
+	aac: "aac",
+	pcmu: "pcm_mulaw",
+	pcma: "pcm_alaw"
+};
+/**
+* Camera-microphone audio, per codec. Lives HERE rather than in
+* `encode-defaults.ts` only to avoid an import cycle (`encode-defaults` depends
+* on these types); it is re-exported from there, which is where to read it.
+*
+* Every source in this repo is a mono camera mic. The former broker preset
+* encoded Opus at `channels: 2`, spending bitrate duplicating one channel —
+* that is the value this consolidation changed.
+*/
+var AUDIO_PRESETS = {
+	aac: {
+		kind: "encode",
+		codec: "aac",
+		bitrateKbps: 128,
+		sampleRateHz: 48e3,
+		channels: 1
+	},
+	opus: {
+		kind: "encode",
+		codec: "opus",
+		bitrateKbps: 64,
+		sampleRateHz: 48e3,
+		channels: 1
+	},
+	pcmu: {
+		kind: "encode",
+		codec: "pcmu",
+		sampleRateHz: 8e3,
+		channels: 1
+	}
+};
+/** `-hide_banner -loglevel <level>` — every ffmpeg site opens with this. */
+function logBannerArgs(level) {
+	return [
+		"-hide_banner",
+		"-loglevel",
+		level
+	];
+}
+/** `true` when the resolved value means "decode in software" (⇒ no `-hwaccel`). */
+function isSoftwareDecode(decodeHwAccel) {
+	return !decodeHwAccel || decodeHwAccel === "none" || decodeHwAccel === "copy";
+}
+/**
+* Every INPUT option, in order, terminated by `-i <url>`. Nothing may be
+* appended to this list by a caller — that is the whole point of the function.
+*/
+function buildInputArgs(input, decodeHwAccel) {
+	const args = [];
+	if (!isSoftwareDecode(decodeHwAccel)) args.push("-hwaccel", String(decodeHwAccel));
+	if (input.extraArgs?.length) args.push(...input.extraArgs);
+	if (input.analyzeDurationUs !== void 0) args.push("-analyzeduration", String(input.analyzeDurationUs));
+	if (input.probeSizeBytes !== void 0) args.push("-probesize", String(input.probeSizeBytes));
+	if (input.fflags?.length) for (const flag of input.fflags) args.push("-fflags", flag);
+	if (input.rtspTransport) args.push("-rtsp_transport", input.rtspTransport);
+	args.push("-i", input.url);
+	return args;
+}
+/** The `-vf` filter args, or `[]` when a consumer `-vf` already claims the slot. */
+function buildVideoFilterArgs(scale, outputArgs) {
+	if (!scale) return [];
+	if (outputArgs.some((a) => a === "-vf")) return [];
+	if (scale.mode === "exact") return ["-vf", `scale=${scale.width}:${scale.height}`];
+	return ["-vf", `scale='min(${scale.width},iw)':'min(${scale.height},ih)':force_original_aspect_ratio=decrease:force_divisible_by=2`];
+}
+/** Rate-control args for an encode plan. */
+function buildRateControlArgs(video) {
+	const kbps = video.bitrateKbps;
+	if (kbps === void 0) return [];
+	const rc = video.rateControl ?? {
+		kind: "cap",
+		vbvSeconds: 2
+	};
+	const bufsize = Math.max(1, Math.round(kbps * rc.vbvSeconds));
+	return [
+		...rc.kind === "cbr" ? ["-b:v", `${kbps}k`] : [],
+		"-maxrate",
+		`${kbps}k`,
+		"-bufsize",
+		`${bufsize}k`
+	];
+}
+/** The whole video block (`-vf` … `-c:v` … knobs), after `-i`. */
+function buildVideoArgs(video, outputArgs) {
+	if (video.kind === "copy") return [
+		"-c:v",
+		"copy",
+		...video.bitstreamFilter ? ["-bsf:v", video.bitstreamFilter] : []
+	];
+	const args = [
+		...buildVideoFilterArgs(video.scale, outputArgs),
+		"-c:v",
+		video.encoder
+	];
+	if (video.preset !== void 0) args.push("-preset", video.preset);
+	if (video.tune !== void 0) args.push("-tune", video.tune);
+	if (video.profile !== void 0) args.push("-profile:v", video.profile);
+	if (video.level !== void 0) args.push("-level", video.level);
+	if (video.pixelFormat !== void 0) args.push("-pix_fmt", video.pixelFormat);
+	if (video.fps !== void 0) args.push("-r", String(video.fps));
+	if (video.gopFrames !== void 0) args.push("-g", String(video.gopFrames));
+	if (video.forceKeyFramesSeconds !== void 0) args.push("-force_key_frames", `expr:gte(t,n_forced*${video.forceKeyFramesSeconds})`);
+	if (video.bf !== void 0) args.push("-bf", String(video.bf));
+	args.push(...buildRateControlArgs(video));
+	if (video.bitstreamFilter !== void 0) args.push("-bsf:v", video.bitstreamFilter);
+	return args;
+}
+/** The whole audio block, after `-i`. */
+function buildAudioArgs(audio) {
+	if (audio.kind === "none") return ["-an"];
+	if (audio.kind === "copy") return ["-c:a", "copy"];
+	const args = [];
+	if (audio.filter !== void 0) args.push("-af", audio.filter);
+	args.push("-c:a", AUDIO_ENCODER_BY_CODEC[audio.codec]);
+	if (audio.application !== void 0) args.push("-application", audio.application);
+	if (audio.frameDurationMs !== void 0) args.push("-frame_duration", String(audio.frameDurationMs));
+	if (audio.globalHeader === true) args.push("-flags", "+global_header");
+	if (audio.sampleRateHz !== void 0) args.push("-ar", String(audio.sampleRateHz));
+	if (audio.bitrateKbps !== void 0) args.push("-b:a", `${audio.bitrateKbps}k`);
+	if (audio.vbvBufferKbits !== void 0) args.push("-bufsize", `${audio.vbvBufferKbits}k`);
+	if (audio.channels !== void 0) args.push("-ac", String(audio.channels));
+	return args;
+}
+/** RTP output-leg args (`-payload_type`, `-ssrc`, `-sdp_file`, `-f rtp <url>`). */
+function buildRtpOutputArgs(out) {
+	const args = [];
+	if (out.payloadType !== void 0) args.push("-payload_type", String(out.payloadType));
+	if (out.ssrc !== void 0) args.push("-ssrc", String(out.ssrc));
+	if (out.sdpFile !== void 0) args.push("-sdp_file", out.sdpFile);
+	args.push("-f", "rtp", out.url);
+	return args;
+}
+/** `true` when the sink is a raw elementary bytestream that cannot mux audio. */
+function isElementaryVideoSink(sink) {
+	return sink.kind === "stdout" && (sink.container === "h264" || sink.container === "hevc");
+}
+/**
+* The fragmented-MP4 muxer flags, in the order the recorder has proven them
+* (`recorder/addon/ffmpeg-args.ts` passes the same `movflags` string through
+* `-segment_format_options`, across every vendor in the fleet):
+*
+* - `frag_keyframe` — cut a fragment at each key frame, so every fragment
+*   opens on a sync sample. HKSV's whole requirement.
+* - `empty_moov` — write `ftyp`+`moov` up front with no samples in it, which
+*   is what makes the head a standalone INITIALISATION segment.
+* - `default_base_moof` — fragment offsets are self-relative, so a fragment is
+*   demuxable without the bytes that preceded it. D31's byte-range read path
+*   depends on exactly this property of the recorder's segments.
+*/
+var FMP4_MOVFLAGS = "+frag_keyframe+empty_moov+default_base_moof";
+/**
+* The terminal sink args for every non-`rtp-outputs` sink. Exhaustive over the
+* union so a new member cannot fall through to `['-f', container, 'pipe:1']`,
+* which is what a plain `container` read would have done for `mp4` — a valid
+* argv that writes a NON-fragmented, unseekable-to-a-pipe MP4 and produces one
+* unusable byte stream.
+*/
+function buildStdoutOrRtspSinkArgs(sink) {
+	if (sink.kind === "rtsp-listen") return [
+		"-f",
+		"rtsp",
+		"-rtsp_transport",
+		"tcp",
+		"-rtsp_flags",
+		"listen",
+		sink.url
+	];
+	if (sink.kind === "rtp-outputs") return [];
+	return sink.container === "mp4" ? buildFmp4SinkArgs(sink) : [
+		"-f",
+		sink.container,
+		"pipe:1"
+	];
+}
+/** `-movflags … -min_frag_duration <us> -f mp4 pipe:1`. */
+function buildFmp4SinkArgs(sink) {
+	return [
+		"-movflags",
+		FMP4_MOVFLAGS,
+		"-min_frag_duration",
+		String(Math.max(0, Math.round(sink.fragmentMs * 1e3))),
+		"-f",
+		"mp4",
+		"pipe:1"
+	];
+}
+/**
+* A second output mapping source audio to RTP-over-UDP. `0:a:0?` makes the
+* audio optional so a source with no audio skips it instead of failing the
+* whole invocation.
+*/
+function buildAudioSidecarArgs(sidecar) {
+	return [
+		"-map",
+		"0:a:0?",
+		...buildAudioArgs(sidecar.codec === "pcma" ? {
+			kind: "encode",
+			codec: "pcma",
+			sampleRateHz: 8e3,
+			channels: 1
+		} : AUDIO_PRESETS[sidecar.codec]),
+		...buildRtpOutputArgs({
+			url: sidecar.rtpUrl,
+			sdpFile: sidecar.sdpFile
+		})
+	];
+}
+/**
+* Assemble the full ffmpeg argument list. Layout:
+*
+*   -hide_banner -loglevel <level>
+*   [-hwaccel <backend|auto>]        ─┐ INPUT options — strictly before -i.
+*   [<input.extraArgs>]               │
+*   [-fflags <flag>…]                 │
+*   [-rtsp_transport tcp]             │
+*   -i <url>                         ─┘
+*   <video block>  <threads>  <audio block>   ─┐ OUTPUT options.
+*   <consumer outputArgs verbatim>             │
+*   <sink>                                    ─┘ terminal
+*/
+function buildFfmpegArgs(inv) {
+	const head = [...logBannerArgs(inv.logLevel), ...buildInputArgs(inv.input, inv.decodeHwAccel)];
+	const threadArgs = inv.threadCount > 0 ? ["-threads", String(inv.threadCount)] : [];
+	if (inv.sink.kind === "rtp-outputs") {
+		const videoLeg = inv.sink.video ? [
+			"-an",
+			"-map",
+			"0:v:0",
+			...buildVideoArgs(inv.video, inv.outputArgs),
+			...threadArgs,
+			...inv.outputArgs,
+			...buildRtpOutputArgs(inv.sink.video)
+		] : [];
+		const audioLeg = inv.sink.audio ? [
+			"-vn",
+			"-map",
+			"0:a:0?",
+			...buildAudioArgs(inv.audio),
+			...buildRtpOutputArgs(inv.sink.audio)
+		] : [];
+		return [
+			...head,
+			...videoLeg,
+			...audioLeg
+		];
+	}
+	const audioArgs = isElementaryVideoSink(inv.sink) ? ["-an"] : buildAudioArgs(inv.audio);
+	const sinkArgs = buildStdoutOrRtspSinkArgs(inv.sink);
+	return [
+		...head,
+		...buildVideoArgs(inv.video, inv.outputArgs),
+		...threadArgs,
+		...audioArgs,
+		...inv.outputArgs,
+		...sinkArgs,
+		...inv.audioSidecar ? buildAudioSidecarArgs(inv.audioSidecar) : []
+	];
+}
+/**
+* Hardware ENCODER ids per decode-hwaccel backend — a static, deterministic
+* map (the same shape the reference NVR uses: platform → encoder, no probe).
+*/
+var ENCODER_IDS_BY_BACKEND = {
+	videotoolbox: {
+		h264: "h264_videotoolbox",
+		h265: "hevc_videotoolbox"
+	},
+	vaapi: {
+		h264: "h264_vaapi",
+		h265: "hevc_vaapi"
+	},
+	qsv: {
+		h264: "h264_qsv",
+		h265: "hevc_qsv"
+	},
+	cuda: {
+		h264: "h264_nvenc",
+		h265: "hevc_nvenc"
+	},
+	nvdec: {
+		h264: "h264_nvenc",
+		h265: "hevc_nvenc"
+	},
+	amf: {
+		h264: "h264_amf",
+		h265: "hevc_amf"
+	}
+};
+/**
+* The hardware encoder for a target codec on `backend`, or the software one.
+* `'auto'` is NOT a backend identity (it is an instruction to ffmpeg), so it
+* maps to software encoding.
+*/
+function pickVideoEncoder(target, backend, useHardware) {
+	const software = target === "h264" ? "libx264" : "libx265";
+	if (!useHardware || backend === null || isSoftwareDecode(backend) || backend === "auto") return software;
+	const ids = ENCODER_IDS_BY_BACKEND[backend.toLowerCase()];
+	if (!ids) return software;
+	return target === "h264" ? ids.h264 : ids.h265;
+}
+/** Map an `EncodeProfile.audio` to an audio plan. */
+function audioPlanFromEncodeProfile(audio) {
+	if (audio === "passthrough") return { kind: "none" };
+	if (audio.codec === "copy") return { kind: "copy" };
+	return {
+		kind: "encode",
+		codec: audio.codec,
+		...audio.bitrateKbps !== void 0 ? { bitrateKbps: audio.bitrateKbps } : {},
+		...audio.sampleRateHz !== void 0 ? { sampleRateHz: audio.sampleRateHz } : {},
+		...audio.channels !== void 0 ? { channels: audio.channels } : {}
+	};
+}
+/**
+* Adapt an `EncodeProfile` (the operator/consumer-facing shape) into an
+* {@link FfmpegInvocation}. This is the ONLY bridge between the two models —
+* a second one is how the repo grew two argv builders that disagreed about
+* hardware.
+*
+* Smart video copy: when the source already speaks the requested codec the
+* encode block is elided entirely and ffmpeg runs as a re-muxer on the video
+* plane. Width / height / fps / bitrate in the profile are a downstream BUDGET,
+* not a forced rescale.
+*/
+function invocationFromEncodeProfile(input) {
+	const v = input.profile.video;
+	const shouldCopy = v.codec === "copy" || input.forceReencode !== true && v.codec === input.sourceCodec;
+	const scale = v.width !== void 0 && v.height !== void 0 ? {
+		mode: "fit",
+		width: v.width,
+		height: v.height
+	} : null;
+	const target = v.codec === "h265" ? "h265" : "h264";
+	const video = shouldCopy ? {
+		kind: "copy",
+		...input.bitstreamFilter !== void 0 ? { bitstreamFilter: input.bitstreamFilter } : {}
+	} : {
+		kind: "encode",
+		encoder: pickVideoEncoder(target, input.decodeHwAccel, input.hardwareEncoders === true),
+		scale,
+		...v.preset !== void 0 ? { preset: v.preset } : {},
+		...v.tune !== void 0 ? { tune: v.tune } : {},
+		...v.profile !== void 0 ? { profile: v.profile } : {},
+		...v.level !== void 0 ? { level: v.level } : {},
+		...input.pixelFormat !== void 0 ? { pixelFormat: input.pixelFormat } : {},
+		...v.fps !== void 0 ? { fps: v.fps } : {},
+		...v.gopFrames !== void 0 ? { gopFrames: v.gopFrames } : {},
+		...input.forceKeyFramesSeconds !== void 0 ? { forceKeyFramesSeconds: input.forceKeyFramesSeconds } : {},
+		...v.bf !== void 0 ? { bf: v.bf } : {},
+		...v.bitrateKbps !== void 0 ? { bitrateKbps: v.bitrateKbps } : {},
+		...input.rateControl !== void 0 ? { rateControl: input.rateControl } : {},
+		...input.bitstreamFilter !== void 0 ? { bitstreamFilter: input.bitstreamFilter } : {}
+	};
+	return {
+		logLevel: input.logLevel ?? "error",
+		decodeHwAccel: input.decodeHwAccel,
+		input: {
+			url: input.sourceUrl,
+			rtspTransport: "tcp",
+			fflags: ["+discardcorrupt"],
+			...input.profile.inputArgs?.length ? { extraArgs: input.profile.inputArgs } : {}
+		},
+		video,
+		audio: audioPlanFromEncodeProfile(input.profile.audio),
+		threadCount: input.threadCount ?? 0,
+		outputArgs: input.profile.outputArgs ?? [],
+		sink: input.sink,
+		...input.audioSidecar !== void 0 ? { audioSidecar: input.audioSidecar } : {}
+	};
+}
+//#endregion
+//#region src/ffmpeg/encode-defaults.ts
+/**
+* The shape every live egress starts from: H.264 Baseline 3.1 at 720p25.
+* Baseline because it is the one profile every consumer in this repo decodes
+* (Echo, iOS, an old browser); 3.1 because that is what the SDPs advertise.
+*/
+var BASE_LIVE_EGRESS_PROFILE = {
+	video: {
+		codec: "h264",
+		profile: "baseline",
+		level: "3.1",
+		width: 1280,
+		height: 720,
+		fps: 25,
+		bitrateKbps: 2500,
+		gopFrames: 25,
+		bf: 0,
+		preset: "veryfast",
+		tune: "zerolatency"
+	},
+	audio: "passthrough"
+};
+/**
+* The browser WebRTC viewer's transcode profile. Used only when the broker
+* MUST spawn ffmpeg (source codec ∉ the browser-accepted set — an H.265 source
+* on an H.264-only browser). Audio is `passthrough` because werift carries the
+* audio plane out-of-band; putting it in the video pipeline would encode a
+* track nothing reads.
+*/
+var WEBRTC_EGRESS_PROFILE = {
+	...BASE_LIVE_EGRESS_PROFILE,
+	video: {
+		...BASE_LIVE_EGRESS_PROFILE.video,
+		bitrateKbps: 3e3,
+		gopFrames: 30,
+		preset: "ultrafast"
+	},
+	audio: "passthrough"
+};
+/**
+* Alexa's egress profile. Alexa's audio ALSO rides the WebRTC session's own
+* audio plane (out-of-band), so this is `passthrough` exactly like the browser
+* — see the ADR for why the previous in-band Opus was encoded and discarded.
+*/
+/**
+* Alexa's egress asks for OPUS, and that is a change with a history.
+*
+* The previous profile encoded Opus IN-BAND into an MPEG-TS, where it was
+* discarded: Opus is `stream_type 0x06` and the broker's demuxer maps only
+* `0x0f` (aac), `0x03`/`0x04` (mp2) and `0x81` (ac3). Every frame it produced
+* died at the demuxer, so the encode was replaced with `passthrough` — correct,
+* because paying libopus for nothing is worse than silence.
+*
+* But `passthrough` means the egress emits NO audio at all, and Alexa's audio
+* does not arrive by magic: it rides the published stream, which is what the
+* WebRTC session dials. So the Echo had video and silence either way.
+*
+* Opus here now reaches the egress AUDIO SIDECAR — a separate RTP leg the
+* restreamer grafts onto its SDP — which never touches the MPEG-TS demuxer that
+* killed the in-band attempt. Same codec, different plane, and this one the
+* consumer can actually negotiate.
+*/
+var ALEXA_EGRESS_PROFILE = {
+	...BASE_LIVE_EGRESS_PROFILE,
+	audio: { codec: "opus" }
+};
+/** VBV window for a consumer whose budget is enforced per second (HomeKit). */
+var RATE_CONTROL_TIGHT = {
+	kind: "cbr",
+	vbvSeconds: 1
+};
+/** VBV window for a consumer that tolerates a keyframe spike (browser, Echo). */
+var RATE_CONTROL_RELAXED = {
+	kind: "cap",
+	vbvSeconds: 2
+};
+/**
+* Transcode-DOWN ceiling: the shape a remote/unhealthy WebRTC session is
+* reduced to. 360p / 400 kbps is the `low` rung of the adaptive ladder — a
+* session steered here is already failing, so the ceiling is chosen to survive
+* a bad link, not to look good.
+*/
+var TRANSCODE_DOWN_MAX_HEIGHT = 360;
+var TRANSCODE_DOWN_MAX_BITRATE_KBPS = 400;
+/**
+* HomeKit's two-way audio leg. `lowdelay` + a short frame duration because the
+* leg is interactive; `globalHeader` because HAP owns the SDP and ffmpeg must
+* not put extradata in-band. `sampleRateHz` and `frameDurationMs` are
+* NEGOTIATED per session — the controller picks them — so they are absent here
+* and filled in by the caller.
+*/
+var HAP_AUDIO_BITRATE_KBPS = 24;
+var HAP_AUDIO_BASE = {
+	kind: "encode",
+	codec: "opus",
+	bitrateKbps: 24,
+	channels: 1,
+	application: "lowdelay",
+	globalHeader: true,
+	filter: "aresample=async=1000:first_pts=0"
+};
+/** HomeKit's `-bufsize` for the audio plane — four seconds of its 24 kbps. */
+var HAP_AUDIO_VBV_KBITS = 96;
+/** Seconds between forced IDRs on a HomeKit transcode. */
+var HAP_KEYFRAME_INTERVAL_SEC = 4;
+//#endregion
+//#region src/ffmpeg/hwaccel.ts
+function createHwAccelCache(options) {
+	const now = options.now ?? (() => Date.now());
+	let value = null;
+	let writtenAt = Number.NEGATIVE_INFINITY;
+	return {
+		read() {
+			return now() - writtenAt < options.ttlMs ? value : void 0;
+		},
+		write(next) {
+			value = next;
+			writtenAt = now();
+		}
+	};
+}
+/** `true` when a value means "decode in software". */
+function meansSoftware(value) {
+	return !value || value === "none" || value === "copy";
+}
+/**
+* Resolve the `-hwaccel` value for an egress transcode. Hardware is the
+* DEFAULT — an egress that decodes in software on a hub with working vaapi is
+* paying for nothing — and every software outcome is announced.
+*
+* Returns a concrete backend name, the literal `'auto'`, or `null` for
+* software decode (⇒ {@link buildFfmpegArgs} emits no `-hwaccel` at all).
+*/
+async function resolveEgressDecodeHwAccel(deps) {
+	const override = deps.override;
+	if (override !== void 0 && override !== null && override !== "") return meansSoftware(override) ? null : override;
+	const cached = deps.cache?.read();
+	if (cached !== void 0) return cached;
+	let backend;
+	try {
+		backend = await deps.readDecoderBackend();
+	} catch (err) {
+		const kernelPreferred = await deps.readKernelPreferred().catch(() => []);
+		deps.onFallback({
+			reason: "decoder-unreadable",
+			kernelPreferred,
+			error: err instanceof Error ? err.message : String(err)
+		});
+		deps.cache?.write(null);
+		return null;
+	}
+	if (backend === "") {
+		const kernelPreferred = await deps.readKernelPreferred().catch(() => []);
+		deps.onFallback({
+			reason: "decoder-unprobed",
+			kernelPreferred
+		});
+		deps.cache?.write(null);
+		return null;
+	}
+	const resolved = meansSoftware(backend) ? null : backend;
+	deps.cache?.write(resolved);
+	return resolved;
+}
+//#endregion
+//#region src/ffmpeg/sharing-key.ts
+/**
+* The sharing key for `streamBroker.acquireEgressTranscode`.
+*
+* **Two requesters asking for exactly the same argument set reach the same
+* process.** Exact match, never fuzzy: a quantised ladder that merged
+* NEARLY-identical requests would make the stream a consumer receives depend
+* on who else is watching and in what order they arrived — unpredictable in
+* precisely the way a debugging session cannot tolerate. Same arguments ⇒ same
+* process. Different arguments ⇒ different process, and that is fine; the
+* operator accepted the cost ("it's fine to have several processes").
+*
+* Derived from the STRUCTURED plan, not from a flag array. `pipelineKeyFor`
+* (`transcode-pipeline.ts`) folds `getStreamWithCodec`'s raw `outputArgs` into
+* its key, so that method's extensibility hatch and its sharing key are the
+* same field — a consumer needing one extra flag silently forks the child, and
+* two consumers that want the same thing but spell it differently never share.
+* Here every knob is a named field, and defaults are APPLIED before hashing so
+* an omitted field and its explicit default land on the same key.
+*/
+/**
+* The transport a CAP request describes. `fragments` is deliberately
+* unreachable from here — the request schema has no way to ask for it, so the
+* cap path can never be handed a fragment child by accident.
+*/
+function egressTransportFromRequest(request) {
+	return { transport: request.publishLocally === true ? "push" : "dial" };
+}
+/** Absent optional ⇒ this sentinel, so `undefined` and "not set" agree. */
+var UNSET = "\0unset";
+function canonicalVideo(video) {
+	return {
+		codec: video.codec,
+		profile: video.profile ?? UNSET,
+		level: video.level ?? UNSET,
+		width: video.width ?? -1,
+		height: video.height ?? -1,
+		fps: video.fps ?? -1,
+		bitrateKbps: video.bitrateKbps ?? -1,
+		gopFrames: video.gopFrames ?? -1,
+		bf: video.bf ?? -1,
+		preset: video.preset ?? UNSET,
+		tune: video.tune ?? UNSET
+	};
+}
+function canonicalAudio(audio) {
+	if (audio === "passthrough") return { codec: "passthrough" };
+	return {
+		codec: audio.codec,
+		bitrateKbps: audio.bitrateKbps ?? -1,
+		sampleRateHz: audio.sampleRateHz ?? -1,
+		channels: audio.channels ?? -1
+	};
+}
+/**
+* The normalised plan a key is computed from. Exported so a test — and a
+* future operator-facing "why are these two not sharing?" surface — can diff
+* two requests without reversing a hash.
+*/
+function canonicalEgressPlan(request, delivery = egressTransportFromRequest(request)) {
+	return {
+		deviceId: request.deviceId,
+		source: request.source.kind === "profile" ? `profile:${request.source.profile}` : `cam-stream:${request.source.camStreamId}`,
+		transport: delivery.transport,
+		fragmentMs: delivery.fragmentMs ?? -1,
+		video: canonicalVideo(request.encode.video),
+		audio: canonicalAudio(request.encode.audio),
+		rateControl: request.rateControl ?? "relaxed",
+		bitstreamFilter: request.bitstreamFilter ?? UNSET,
+		pixelFormat: request.pixelFormat ?? UNSET,
+		decodeHwAccel: request.decodeHwAccel ?? UNSET
+	};
+}
+/**
+* The refcount / dedup key. `canonicalHash` sorts object keys at every depth,
+* so a request built with a different field order produces the same digest.
+*
+* The handle this keys is IMMUTABLE: there is no `reconfigure`. A consumer
+* whose requirements change RELEASES and re-acquires; the refcount does the
+* rest. That is what stops co-tenants disturbing each other — the co-tenant
+* hazard that made Alexa's shared `derived:alexa-<id>` stream a hazard was
+* exactly a mutable shared object, where one consumer's downgrade dragged
+* every other consumer to 360p.
+*/
+function egressTranscodeSharingKey(request, delivery = egressTransportFromRequest(request)) {
+	return `egress:${require_canonical_hash.canonicalHash(canonicalEgressPlan(request, delivery))}`;
+}
+//#endregion
 //#region src/health/wiring-health.ts
 /**
 * Deep wiring healthcheck — snapshot of active reachability probes across
@@ -331,6 +970,395 @@ var DEFAULT_RETENTION = {
 	snapshotsDays: 14
 };
 //#endregion
+//#region src/interfaces/camera-switches.ts
+/**
+* Per-camera FUNCTION SWITCHES — the one coherent on/off surface over the
+* pipeline functions an operator thinks in terms of.
+*
+* ## This file adds no state
+*
+* Every switch here is a VIEW onto an authority that already existed
+* ([D62](../../../../docs/decisions/adr-0062.md)). The whole point of the
+* group is that there is exactly one place each function is turned off, and
+* the group routes to it:
+*
+* | Switch | Authority | Proven "off stops the work" gate |
+* | --- | --- | --- |
+* | `stream-broker` | `deviceManager.setDisabled` | `StreamBrokerManager.reconcileAllCatalogs` releases the brokers; `ensureBroker` refuses re-creation |
+* | `object-detection` | `deviceManager.setWrapperActive('detection-pipeline')` | `PipelineSettingsStore.resolvePipelineForDevice` returns `{ steps: [], audio: null }` |
+* | `audio-analysis` | `deviceManager.setWrapperActive('audio-analysis')` | `AudioSubscriptionController.subscribeAudioStream` returns `null` before opening the stream |
+* | `recording` | `recording.setDeviceConfig` → `RecordingConfig.enabled` | `band-decision.shouldRecord` returns false; the controller detaches the device |
+* | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
+* | `privacy-mask` | `privacyMask.setMask({ enabled })` → the CAMERA | the camera blanks the masked regions itself; every stream and recording carries the black boxes |
+* | `device-audio` | `privacyMask.setAudioEnabled` → the CAMERA | the camera stops encoding an audio track at all; every consumer sees silent video |
+*
+* ## The two switches whose authority is not on this server
+*
+* `privacy-mask` and `device-audio` write the CAMERA. That is not a loophole
+* in "the group stores nothing" — it is the purest form of it: the camera
+* holds the fact, every read is a read-through, and there is no server-side
+* copy that could drift. Their availability therefore cannot come from
+* `listBindableCapsForDeviceType` (a device-NATIVE cap carries no wrappers and
+* is filtered out there); it comes from the cap's own camera-probed
+* `privacyMask.getOptions()`, which is strictly more honest — it answers for
+* THIS camera rather than for the device type
+* ([D74](../../../../docs/decisions/adr-0074.md)).
+*
+* ## `privacy-mask` is the one row whose ON is not "the function is working"
+*
+* Every other switch means *this camera's function is doing its job*, so
+* `enabled: false` is a thing an operator took away. `privacy-mask` means **the
+* MASK is active** — `enabled: true` is video deliberately obscured. The
+* polarity is not a choice made here: `addon-export-hap`'s privacy `Switch`
+* (`builders/privacy-switch.ts`) already mirrors `patch.enabled` verbatim, and
+* a HomeKit toggle that disagreed with the app's toggle for the same camera is
+* worse than either surface not having one.
+*
+* Two consequences follow and both are load-bearing:
+*
+* - **It never counts as `switchedOff`.** `countsAsSwitchedOff` is `false` for
+*   exactly this row. With the polarity above, every camera that has NOT drawn
+*   a privacy mask would otherwise report `switchedOff: ['privacy-mask']` — the
+*   normal, healthy state of most cameras rendered as an operator disablement.
+* - **Its cost line names BOTH directions.** `costWhenOff` is rendered
+*   unconditionally by both clients, so for this row it has to read correctly
+*   whichever way the switch is sitting.
+*
+* The wrapper-binding pair is not a new idea: `legacy-migrations.ts` already
+* migrated the legacy `audioEnabled` / `pipelineEnabled` /
+* `motionDetectionEnabled` booleans ONTO `setWrapperActive`. The group is the
+* surface that decision never got.
+*
+* ## Two rules that are load-bearing
+*
+* - **Recording's switch is `enabled`, never the bands.** `bands` is the only
+*   authored intent and `mode` is derived from it (`deriveRecordingMode`).
+*   Expressing "off" by clearing bands destroys the operator's schedule and
+*   turning the camera back on would then silently record nothing.
+* - **A switch that is off must be reported as off**, not merely produce
+*   nothing. {@link CameraSwitch.enabled} is what a status surface renders as
+*   "disabled by an operator" instead of "broken" — see
+*   `CameraStatus.switchedOff`.
+*/
+/**
+* The functions the operator named — five on 2026-08-05, plus the camera's own
+* microphone on 2026-08-07. Deliberately NOT one id per pipeline step: face
+* recognition and plate/LPR are per-step toggles on
+* `pipelineOrchestrator.setCameraStepToggle` and belong in the pipeline
+* editor, not in a safety group.
+*/
+var CameraSwitchIdSchema = zod.z.enum([
+	"stream-broker",
+	"object-detection",
+	"privacy-mask",
+	"device-audio",
+	"audio-analysis",
+	"recording",
+	"notifications"
+]);
+/**
+* Stable render order — broadest blast radius first, and a source before the
+* thing that consumes it. `device-audio` sits ABOVE `audio-analysis` because
+* turning the microphone off leaves the analyzer with nothing to analyse; the
+* reverse is not true.
+*
+* `privacy-mask` sits directly ABOVE `device-audio` because they are literal
+* siblings — one cap, one device plane, video then audio — and NOT above
+* `object-detection` despite feeding it: a mask blanks REGIONS, so its blast
+* radius is partial, and the "broadest first" rule does not rank a partial
+* control above a whole-function one.
+*/
+var CAMERA_SWITCH_ORDER = [
+	"stream-broker",
+	"object-detection",
+	"privacy-mask",
+	"device-audio",
+	"audio-analysis",
+	"recording",
+	"notifications"
+];
+/**
+* WHERE the switch's state actually lives. A discriminated union rather than a
+* string so both the writer (the orchestrator's `setCameraSwitch`) and any
+* reader can exhaustively narrow — and so "the group added a parallel map" is
+* a compile error rather than a review comment.
+*/
+var CameraSwitchAuthoritySchema = zod.z.discriminatedUnion("kind", [
+	zod.z.object({ kind: zod.z.literal("device-disabled") }),
+	zod.z.object({
+		kind: zod.z.literal("wrapper-binding"),
+		capName: zod.z.string()
+	}),
+	zod.z.object({ kind: zod.z.literal("recording-config") }),
+	zod.z.object({ kind: zod.z.literal("notification-mute") }),
+	zod.z.object({
+		kind: zod.z.literal("camera-audio"),
+		capName: zod.z.string()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("camera-mask"),
+		capName: zod.z.string()
+	})
+]);
+/**
+* Why a switch is not offered for this camera. Rendered instead of the
+* control, never as a dead control — an absent function and a broken one must
+* not look the same.
+*/
+var CameraSwitchUnavailableReasonSchema = zod.z.enum([
+	"no-provider",
+	"source-unreachable",
+	"not-configured"
+]);
+/**
+* One switch, resolved for one camera.
+*
+* `label` and `costWhenOff` travel ON THE WIRE rather than being looked up
+* client-side: the viewer is a separate repository that does not import
+* `@camstack/types`, and a cost line duplicated in two clients is a cost line
+* that will disagree with itself. Five rows per camera is nothing.
+*/
+var CameraSwitchSchema = zod.z.object({
+	id: CameraSwitchIdSchema,
+	label: zod.z.string(),
+	/**
+	* What the operator LOSES while this is off, in one sentence. Required, not
+	* optional: a switch that cannot say what it costs should not ship.
+	*/
+	costWhenOff: zod.z.string(),
+	/** False = do not render a control. `unavailableReason` says why. */
+	available: zod.z.boolean(),
+	unavailableReason: CameraSwitchUnavailableReasonSchema.optional(),
+	/** Current state. Meaningless when `available` is false — read it as `true`. */
+	enabled: zod.z.boolean(),
+	authority: CameraSwitchAuthoritySchema
+});
+/** The whole group for one camera. */
+var CameraSwitchGroupSchema = zod.z.object({
+	deviceId: zod.z.number().int(),
+	switches: zod.z.array(CameraSwitchSchema).readonly(),
+	/** Unix ms when the group was composed server-side. */
+	fetchedAt: zod.z.number()
+});
+/**
+* The wrapper capability each wrapper-backed switch controls. Named constants
+* because the same strings appear in `legacy-migrations.ts`, in
+* `isCapActiveForDevice` call sites and in the fake harness — a typo in any of
+* them is a switch that silently writes a binding nobody reads.
+*/
+var DETECTION_PIPELINE_CAP_NAME = "detection-pipeline";
+var AUDIO_ANALYSIS_CAP_NAME = "audio-analysis";
+/**
+* The device-NATIVE cap that owns what the camera does not capture — masked
+* video regions and, since 2026-08-07, the microphone. Named here because the
+* `camera-audio` authority, the orchestrator's gather and the fake harness all
+* have to agree on it.
+*/
+var PRIVACY_MASK_CAP_NAME = "privacy-mask";
+/**
+* THE catalog. One entry per switch; the cost lines are the operator-facing
+* contract and are written to be true rather than reassuring.
+*/
+var CAMERA_SWITCH_CATALOG = {
+	"stream-broker": {
+		id: "stream-broker",
+		label: "Camera",
+		costWhenOff: "Off: the whole camera stops. No live view, no recording, no detection and no notifications — its streams are released and nothing dials it again until you turn it back on.",
+		authority: { kind: "device-disabled" },
+		countsAsSwitchedOff: true
+	},
+	"object-detection": {
+		id: "object-detection",
+		label: "Object detection & tracking",
+		costWhenOff: "Off: nothing is detected or tracked on this camera, so it produces no events — and with no events there are no object notifications and no event-triggered recording. Live view and continuous recording are unaffected.",
+		authority: {
+			kind: "wrapper-binding",
+			capName: DETECTION_PIPELINE_CAP_NAME
+		},
+		countsAsSwitchedOff: true
+	},
+	"privacy-mask": {
+		id: "privacy-mask",
+		label: "Privacy mask",
+		costWhenOff: "On: the zones you drew on this camera are blacked out by the camera itself — live view, playback, exports and detection all see the black boxes, and nothing behind them was ever recorded. Off: the camera captures the whole frame, and your zones are kept for when you turn it back on.",
+		authority: {
+			kind: "camera-mask",
+			capName: PRIVACY_MASK_CAP_NAME
+		},
+		countsAsSwitchedOff: false
+	},
+	"device-audio": {
+		id: "device-audio",
+		label: "Camera microphone",
+		costWhenOff: "Off: the camera captures no sound at all. Live view and recordings become silent video, and audio detection and classification have nothing left to analyse — turning them back on will not recover it. The picture, motion and object detection are unaffected, and two-way talk still works. Applies at the camera, so every consumer sees the same silence.",
+		authority: {
+			kind: "camera-audio",
+			capName: PRIVACY_MASK_CAP_NAME
+		},
+		countsAsSwitchedOff: true
+	},
+	"audio-analysis": {
+		id: "audio-analysis",
+		label: "Audio detection & classification",
+		costWhenOff: "Off: no audio is decoded or classified for this camera. Tracks carry no audio labels and no audio-triggered rule can fire. Audio recorded alongside video is unaffected.",
+		authority: {
+			kind: "wrapper-binding",
+			capName: AUDIO_ANALYSIS_CAP_NAME
+		},
+		countsAsSwitchedOff: true
+	},
+	recording: {
+		id: "recording",
+		label: "Recording",
+		costWhenOff: "Off: nothing new is written to disk. Footage already recorded stays, but retention keeps deleting it — so this camera’s history shrinks and is not replaced. Your recording schedule is kept and resumes when you turn it back on.",
+		authority: { kind: "recording-config" },
+		countsAsSwitchedOff: true
+	},
+	notifications: {
+		id: "notifications",
+		label: "Notifications",
+		costWhenOff: "Off: this camera never notifies anyone, on any rule, with no expiry. Detection, events and recording carry on exactly as before — you simply stop being told about them.",
+		authority: { kind: "notification-mute" },
+		countsAsSwitchedOff: true
+	}
+};
+/** Resolve one switch's `{ available, enabled }` pair. */
+function resolveState(descriptor, input) {
+	switch (descriptor.authority.kind) {
+		case "device-disabled": return {
+			available: true,
+			enabled: !input.deviceDisabled
+		};
+		case "wrapper-binding": {
+			const capName = descriptor.authority.capName;
+			if (input.bindableCapNames === null || input.activeWrapperCapNames === null) return {
+				available: false,
+				enabled: true,
+				unavailableReason: "source-unreachable"
+			};
+			if (!input.bindableCapNames.includes(capName)) return {
+				available: false,
+				enabled: true,
+				unavailableReason: "no-provider"
+			};
+			return {
+				available: true,
+				enabled: input.activeWrapperCapNames.includes(capName)
+			};
+		}
+		case "recording-config":
+			if (input.recordingEnabled === null) return {
+				available: false,
+				enabled: true,
+				unavailableReason: "source-unreachable"
+			};
+			return {
+				available: true,
+				enabled: input.recordingEnabled
+			};
+		case "notification-mute":
+			if (input.notificationsMuted === null) return {
+				available: false,
+				enabled: true,
+				unavailableReason: "source-unreachable"
+			};
+			return {
+				available: true,
+				enabled: !input.notificationsMuted
+			};
+		case "camera-audio": {
+			const audio = input.deviceAudio;
+			if (audio === null) return {
+				available: false,
+				enabled: true,
+				unavailableReason: "source-unreachable"
+			};
+			if (!audio.supported) return {
+				available: false,
+				enabled: true,
+				unavailableReason: "no-provider"
+			};
+			if (audio.enabled === null) return {
+				available: false,
+				enabled: true,
+				unavailableReason: "source-unreachable"
+			};
+			return {
+				available: true,
+				enabled: audio.enabled
+			};
+		}
+		case "camera-mask": {
+			const mask = input.privacyMask;
+			if (mask === null) return {
+				available: false,
+				enabled: false,
+				unavailableReason: "source-unreachable"
+			};
+			if (!mask.supported) return {
+				available: false,
+				enabled: false,
+				unavailableReason: "no-provider"
+			};
+			if (mask.configuredRegions === null || mask.enabled === null) return {
+				available: false,
+				enabled: false,
+				unavailableReason: "source-unreachable"
+			};
+			if (mask.configuredRegions === 0) return {
+				available: false,
+				enabled: false,
+				unavailableReason: "not-configured"
+			};
+			return {
+				available: true,
+				enabled: mask.enabled
+			};
+		}
+	}
+}
+/**
+* Pure derivation of the whole group. No I/O — the orchestrator gathers, this
+* decides, so the decision is testable without a hub.
+*
+* Order is {@link CAMERA_SWITCH_ORDER}; unavailable switches are RETURNED
+* rather than filtered out, so a client can explain the gap instead of
+* silently rendering four buttons where another camera shows five.
+*/
+function deriveCameraSwitches(input) {
+	return CAMERA_SWITCH_ORDER.map((id) => {
+		const descriptor = CAMERA_SWITCH_CATALOG[id];
+		const state = resolveState(descriptor, input);
+		return {
+			id: descriptor.id,
+			label: descriptor.label,
+			costWhenOff: descriptor.costWhenOff,
+			available: state.available,
+			...state.unavailableReason !== void 0 ? { unavailableReason: state.unavailableReason } : {},
+			enabled: state.enabled,
+			authority: descriptor.authority
+		};
+	});
+}
+/**
+* The ids an operator has switched OFF, for a status surface.
+*
+* This is the answer to "a disabled function must be visible as DISABLED, not
+* merely quiet": a camera reporting zero detections with
+* `switchedOff: ['object-detection']` was turned off; the same camera with an
+* empty list is broken. Unavailable switches never appear — a function nobody
+* provides was not switched off by anyone.
+*
+* `privacy-mask` never appears either, whichever way it is sitting, because its
+* ON means "the mask is active" rather than "the function works"
+* ({@link CameraSwitchDescriptor.countsAsSwitchedOff}). Without that filter the
+* ordinary state of every camera nobody has masked would carry a
+* "switched off" badge, and the badge that matters would be lost in it.
+*/
+function switchedOffIds(switches) {
+	return switches.filter((s) => CAMERA_SWITCH_CATALOG[s.id].countsAsSwitchedOff && s.available && !s.enabled).map((s) => s.id);
+}
+//#endregion
 //#region src/interfaces/device-capabilities/camera.ts
 /** Friendly display labels for stream quality IDs. */
 var STREAM_QUALITY_LABELS = {
@@ -526,14 +1554,16 @@ var OpsLogOpSchema = zod.z.enum([
 	"manual-delete",
 	"rescan",
 	"retention-run",
-	"relocate"
+	"relocate",
+	"orphan-audit"
 ]);
 /** Why the operation ran. */
 var OpsLogReasonSchema = zod.z.enum([
 	"retention",
 	"quota",
 	"manual",
-	"operator"
+	"operator",
+	"maintenance"
 ]);
 /** One audit row, shared verbatim by both domains. */
 var OpsLogEntrySchema = zod.z.object({
@@ -3314,6 +4344,126 @@ var RtpSourceSchema = zod.z.object({
 	encoder: zod.z.string(),
 	pipelineKey: zod.z.string()
 });
+/**
+* The encode request — **structured and serialisable, with NO raw-flag escape
+* hatch.** This is deliberate and it is the one lesson taken from
+* `getStreamWithCodec`: that method's `outputArgs: string[]` is simultaneously
+* its extensibility mechanism AND part of `pipelineKeyFor`'s sharing key, so
+* adding a flag silently forks the shared child, and two consumers that mean
+* the same thing but spell it differently never share. Here every knob is a
+* NAMED field: a new requirement becomes a schema field (and a codegen run),
+* never an opaque array.
+*
+* `inputArgs` / `outputArgs` are omitted from the profile for the same reason.
+* The operator-facing derived-stream transform editor still has them — that is
+* a different surface (`publishCameraStream({ kind: 'derived' })`) with a
+* different purpose (reshaping a badly-behaved SOURCE), and it is unchanged.
+*/
+var EgressEncodeSchema = EncodeProfileSchema.omit({
+	inputArgs: true,
+	outputArgs: true
+});
+/**
+* How the encoder is bounded. `'tight'` is a one-second VBV window for a
+* consumer whose budget is enforced per second (HomeKit); `'relaxed'` is two
+* seconds, letting a keyframe spike borrow from the next second (a browser,
+* an Echo). Named rather than numeric so the INTENT survives.
+*/
+var EgressRateControlSchema = zod.z.enum(["tight", "relaxed"]);
+var EgressTranscodeRequestSchema = zod.z.object({
+	deviceId: zod.z.number().int().nonnegative(),
+	/** Which published stream to read. */
+	source: zod.z.discriminatedUnion("kind", [zod.z.object({
+		kind: zod.z.literal("profile"),
+		profile: require_sleep.CamProfileSchema
+	}), zod.z.object({
+		kind: zod.z.literal("cam-stream"),
+		camStreamId: zod.z.string().min(1)
+	})]),
+	encode: EgressEncodeSchema,
+	rateControl: EgressRateControlSchema.optional(),
+	/**
+	* `-bsf:v`. A consumer that negotiates its OWN SDP (HomeKit) cannot carry
+	* out-of-band extradata and needs `dump_extra` on both the copy and encode
+	* branches. Enumerated, not free text.
+	*/
+	bitstreamFilter: zod.z.enum([
+		"dump_extra",
+		"h264_mp4toannexb",
+		"hevc_mp4toannexb"
+	]).optional(),
+	/**
+	* Publish the transcode as a LOCAL push cam stream, instead of leaving the
+	* consumer to dial the returned url. The broker picks the id and returns it
+	* as `camStreamId` — a caller-supplied one would be circular, since the
+	* sharing key is computed FROM this request.
+	*
+	* The url is still returned and still the contract for a transcode pinned to
+	* another node. But dialling it locally costs an RTSP round trip that changes
+	* the transport underneath the consumer: a dialled stream is an RTP source,
+	* so `isRtpSource()` is true and the session takes the RTP-passthrough +
+	* repacketizer branch. The push branch — the one the derived mechanism has
+	* live hours on — is never reached. Measured on Alexa: broker registered, RTP
+	* arriving, key frame arriving, black screen, on a chain healthy at every
+	* other point.
+	*
+	* Same idea the transport already applies to CALLS, where `classifyCapRoute`
+	* gives priority to `hub-in-process` so a local call never leaves the node.
+	* This is that rule for media.
+	*/
+	publishLocally: zod.z.boolean().optional(),
+	pixelFormat: zod.z.enum(["yuv420p", "nv12"]).optional(),
+	/**
+	* Operator/consumer override for decode hardware. ABSENT is the normal case
+	* and the one that matters: the broker then resolves the backend from the
+	* DECODER ADDON's per-node `probedBestHwaccel` (see
+	* `@camstack/types` `ffmpeg/hwaccel.ts`), which is the ranking known to work
+	* on this hardware — never the raw kernel resolver's qsv-first order.
+	*/
+	decodeHwAccel: zod.z.enum([
+		"auto",
+		"none",
+		"videotoolbox",
+		"vaapi",
+		"qsv",
+		"cuda"
+	]).optional(),
+	/**
+	* Host to embed in the returned restream `url`. The broker mints hub-local
+	* `127.0.0.1` URLs; a consumer on another node passes a cluster-resolvable
+	* host (`NodeTopologyService.reachableHostByNode`) so the returned URL is
+	* dialable from there. Same contract as `getStreamWithCodec.hostname` —
+	* `substituteRtspHost` rewrites only the dial address, never the restreamer.
+	*/
+	hostname: zod.z.string().optional(),
+	/** Attribution for the broker panel. Never part of the sharing key. */
+	tag: zod.z.string().optional()
+});
+var EgressTranscodeSchema = zod.z.object({
+	/** Dial-able RTSP url (host-substituted when `hostname` was supplied). */
+	url: zod.z.string(),
+	/** Release handle. Refcounted — the child dies when the last holder releases. */
+	pipelineKey: zod.z.string(),
+	videoCodec: zod.z.enum(["H264", "H265"]),
+	resolution: zod.z.object({
+		width: zod.z.number().int().positive(),
+		height: zod.z.number().int().positive()
+	}),
+	transcoded: zod.z.boolean(),
+	encoder: zod.z.string(),
+	/**
+	* The decode backend the child ACTUALLY ran with — `null` for software.
+	* Returned rather than assumed: a consumer that asked for hardware and got
+	* software needs to be able to see that without reading the broker's logs.
+	*/
+	decodeHwAccel: zod.z.string().nullable(),
+	/**
+	* Set when `publishLocally` was honoured: attach to THIS instead of dialling
+	* `url`, and the session takes the push/deframe transport rather than the
+	* RTP-passthrough one. `null` means the consumer must dial.
+	*/
+	camStreamId: zod.z.string().nullable()
+});
 var streamBrokerCapability = {
 	name: "stream-broker",
 	scope: "system",
@@ -3485,6 +4635,40 @@ var streamBrokerCapability = {
 			auth: "admin"
 		}),
 		/**
+		* THE ffmpeg primitive. Acquire an encoded stream matching a structured
+		* encode plan; the broker builds the argv through the ONE builder
+		* (`@camstack/types` `ffmpeg/invocation.ts`), resolves decode hardware from
+		* the DECODER ADDON's per-node ranking, and returns a dialable RTSP url.
+		*
+		* **Refcounted and deduplicated on EXACT match.** Two requesters whose
+		* requests produce the same `egressTranscodeSharingKey` receive the SAME
+		* `pipelineKey` and the same child process. Nearly-identical requests are
+		* NOT merged.
+		*
+		* **The handle is immutable.** There is deliberately no `reconfigure`
+		* method and this one never accepts a `pipelineKey` alongside encode
+		* parameters: a consumer whose requirements change releases and
+		* re-acquires. A mutable shared handle is exactly what made Alexa's old
+		* `derived:alexa-<id>` stream a co-tenant hazard — one consumer's
+		* downgrade dragged every other consumer down with it.
+		*
+		* Placement: unpinned, `classifyCapRoute` serves this hub-in-process
+		* (Priority 1). A caller that wants the transcode elsewhere passes
+		* `nodePin(nodeId)` and a `hostname` it can dial.
+		*/
+		acquireEgressTranscode: require_sleep.method(EgressTranscodeRequestSchema, EgressTranscodeSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Drop one reference. The child dies when the last holder releases. */
+		releaseEgressTranscode: require_sleep.method(zod.z.object({ pipelineKey: zod.z.string() }), zod.z.object({
+			released: zod.z.boolean(),
+			refcount: zod.z.number().int().nonnegative()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* ── Decoded audio-chunk plane (Phase 5 / D9) ──────────────────────
 		*
 		* The serialisable replacement for the live-object `IStreamBroker.
@@ -10029,12 +11213,13 @@ var NcConditionsSchema = zod.z.object({
 	* source; otherwise the subject's source must equal it. Legacy records
 	* with no stamped source are treated as `pipeline`. The union spans both
 	* record kinds — object events carry `pipeline` | `onboard`, synthetic
-	* tracks carry `sensor`.
+	* tracks carry `sensor` (a linked device) or `audio` (a D62 audio marker).
 	*/
 	source: zod.z.enum([
 		"pipeline",
 		"onboard",
 		"sensor",
+		"audio",
 		"any"
 	]).optional(),
 	/**
@@ -10588,6 +11773,10 @@ var NC_CONDITION_CATALOG = [
 			{
 				value: "sensor",
 				label: "Sensor"
+			},
+			{
+				value: "audio",
+				label: "Audio marker"
 			}
 		],
 		operator: "in",
@@ -10598,7 +11787,7 @@ var NC_CONDITION_CATALOG = [
 			"package-event"
 		],
 		phase: "P1",
-		description: "pipeline / onboard / sensor; a record with no stamped source counts as pipeline."
+		description: "pipeline / onboard / sensor / audio; a record with no stamped source counts as pipeline."
 	},
 	{
 		id: "deviceState",
@@ -10950,6 +12139,35 @@ var notificationRulesCapability = {
 			auth: "admin"
 		}),
 		/**
+		* PERMANENT per-camera mute — the notifications half of the per-camera
+		* function switch group ([D61](../../../../docs/decisions/adr-0067.md)).
+		*
+		* Deliberately NOT a snooze. A snooze is bounded at
+		* {@link NC_SNOOZE_MAX_MINUTES} on purpose — "a snooze that could not
+		* expire would be an outage the operator asked for once and forgot" — and
+		* widening it to express "this camera never notifies" would destroy that
+		* property for every snooze. A mute is the other thing: an explicit,
+		* indefinite, admin-only decision, visible in the switch group next to the
+		* other four, and reported on `CameraStatus.switchedOff` so a silent
+		* camera never reads as a working one.
+		*
+		* Returned as ONE list rather than a per-camera query: the group's reader
+		* needs every camera's state, and a per-camera fan-out over the viewer's
+		* single WebSocket is N frames serialised on one socket.
+		*/
+		listDeviceMutes: require_sleep.method(zod.z.object({}), zod.z.object({ mutedDeviceIds: zod.z.array(zod.z.number().int()).readonly() }), { auth: "admin" }),
+		/**
+		* Mute or unmute one camera. Idempotent; an unmute of a camera that was
+		* never muted succeeds.
+		*/
+		setDeviceMuted: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number().int(),
+			muted: zod.z.boolean()
+		}), zod.z.object({ success: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Dry-run a rule against recently persisted records (object events for
 		* `immediate`, closed tracks for `track-end`). Mutation kind only to
 		* carry the full rule object safely; no side effects.
@@ -11367,12 +12585,60 @@ var TrackAudioLabelSchema = zod.z.object({
 });
 /**
 * How a track was produced. `pipeline` (default / absent) = the spatial
-* detection+tracking pipeline. `sensor` = a SYNTHETIC track projected from a
-* linked sensor/control state change (no positions; carries a snapshot). The
-* spatial subsystems (tracker association, occupancy count, re-id/embedding,
-* resurrection) MUST skip `sensor` tracks — they have no bbox trajectory.
+* detection+tracking pipeline. Every OTHER value is a SYNTHETIC projection —
+* no positions, a single snapshot, and no bbox trajectory at all:
+*
+*  - `sensor` — a linked sensor/control device state change.
+*  - `audio` — an audio event on the camera itself that was anomalous for
+*    THAT camera, loud, and heard while nothing visual was happening (D62).
+*
+* The spatial subsystems (tracker association, occupancy count, re-id /
+* embedding, resurrection) MUST skip every synthetic source. Test for that
+* with `isSpatialTrack`, which allow-lists `pipeline` — a `!== 'sensor'`
+* check silently readmits every source added after it was written.
 */
-var TrackSourceSchema = zod.z.enum(["pipeline", "sensor"]);
+var TrackSourceSchema = zod.z.enum([
+	"pipeline",
+	"sensor",
+	"audio"
+]);
+/**
+* Per-track OPERATOR flags — set by hand from the admin UI or the viewer, never
+* by the pipeline. Spread into `TrackSchema` and `KeyEventSchema` from one place
+* so the two surfaces cannot drift.
+*
+* **Absent ≠ false.** A track that has never been touched omits the field; an
+* explicitly un-flagged track carries `false`. Legacy rows written before the
+* columns existed read as absent, and a consumer that needs a boolean should say
+* `flag === true`, not `flag !== false`.
+*
+* What the flags DO is deliberately UNDEFINED at the time of writing: they are
+* operator curation, and the behaviour they drive will be specified separately.
+* In particular a `markForTrain` track is NOT pinned against retention — see
+* `docs/decisions/adr-0059.md` for why that is a store-level change, not a flag.
+*/
+var TrackFlagFields = {
+	/** Operator marked this track as training material. */
+	markForTrain: zod.z.boolean().optional(),
+	/** Operator marked this track for diagnostic attention. */
+	debug: zod.z.boolean().optional()
+};
+/**
+* The write half: a PARTIAL patch. An omitted key is left untouched, so setting
+* one flag can never clear the other — the toggles are independent and are
+* driven from three surfaces that do not know about each other.
+*/
+var TrackFlagsPatchSchema = zod.z.object(TrackFlagFields);
+/**
+* The resolved flag state after a write. Both fields are REQUIRED here (absent
+* collapses to `false`) so a caller can drive a toggle's checked state off the
+* mutation result without a re-fetch.
+*/
+var TrackFlagsSchema = zod.z.object({
+	trackId: zod.z.string(),
+	markForTrain: zod.z.boolean(),
+	debug: zod.z.boolean()
+});
 var TrackSchema = zod.z.object({
 	trackId: zod.z.string(),
 	deviceId: zod.z.number(),
@@ -11415,7 +12681,8 @@ var TrackSchema = zod.z.object({
 	/** Normalized 0..1 trajectory envelope (see {@link TrackEnvelopeSchema}).
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
-	envelope: TrackEnvelopeSchema.optional()
+	envelope: TrackEnvelopeSchema.optional(),
+	...TrackFlagFields
 });
 var BaseEventFields = {
 	id: zod.z.string(),
@@ -11636,7 +12903,8 @@ var KeyEventSchema = zod.z.object({
 	/** Highest-confidence ObjectEvent id for the track (empty when none). */
 	bestEventId: zod.z.string(),
 	/** Track lifetime in ms (lastSeen - firstSeen). */
-	windowMs: zod.z.number().optional()
+	windowMs: zod.z.number().optional(),
+	...TrackFlagFields
 });
 var TrackedDetectionSchema = zod.z.object({
 	trackId: zod.z.string(),
@@ -11722,7 +12990,31 @@ var RebuildObjectEmbeddingsInput = zod.z.object({
 	since: zod.z.number().optional(),
 	until: zod.z.number().optional(),
 	/** Stop after this many tracks; the result reports whether more remain. */
-	maxTracks: zod.z.number().int().positive().optional()
+	maxTracks: zod.z.number().int().positive().optional(),
+	/**
+	* Run every embedding on THIS node instead of round-robining the fleet.
+	*
+	* Named `executeOnNodeId` and not `nodeId` on purpose: an inline `nodeId`
+	* field in cap args is read by `parent-unowned-call.ts` as a ROUTING PIN, so
+	* calling it that would pin the rebuild REQUEST itself to that node — the
+	* rebuild orchestration lives on the hub, and only the per-track step runs
+	* remotely. This field is data; the per-track pin is applied inside.
+	*
+	* Absent ⇒ round-robin over every online node whose runner can serve the
+	* pinned model.
+	*/
+	executeOnNodeId: zod.z.string().optional(),
+	/**
+	* Milliseconds to wait between tracks; omit for the built-in default, `0` to
+	* run flat out.
+	*
+	* A rebuild is bulk maintenance on hub-main's single thread. Measured
+	* 2026-08-06, an unpaced pass held that thread busy 82.2 s out of 120 and
+	* pushed `nodes.topology` from 0.25 s to 26 s for 43 minutes. The value in
+	* force is logged at start and finish so a deliberately slow pass reads
+	* differently from a stalled one.
+	*/
+	pacingMs: zod.z.number().int().nonnegative().optional()
 });
 /**
 * Result of emptying the CLIP index.
@@ -11756,13 +13048,23 @@ var RebuildStatusSchema = zod.z.object({
 	/** Tracks with no usable detection box. */
 	missingBbox: zod.z.number(),
 	/**
-	* Tracks the pipeline REFUSED rather than broke on: the camera is not
-	* attached, or `clip-embedding` is not enabled in its step tree. Separate
-	* from `failed` because the remedy is a configuration change, not an engine
-	* investigation — and because a pass over decommissioned cameras would
-	* otherwise read as a total engine outage.
+	* Tracks an executing node REFUSED rather than broke on — an unreadable key
+	* frame, a step that threw. Separate from `failed` because the remedy is
+	* different, and because a whole camera silently contributing zero vectors
+	* is the shape of failure a rebuild must never hide.
 	*/
 	notRunnable: zod.z.number(),
+	/**
+	* The pass stopped because NO node could serve the pinned model.
+	*
+	* Distinct from `notRunnable` on purpose: that one says "this track was
+	* refused", this one says "the cluster cannot do this work at all" — every
+	* candidate node either lacks the `clip-embedding` step, lacks a build of the
+	* pinned model for its engine format, or dropped out. The remedy is a model /
+	* engine change, not a per-camera one. Non-zero here always comes with
+	* `complete: false`.
+	*/
+	noCapableNode: zod.z.number(),
 	failed: zod.z.number(),
 	/** Set once a pass ends: true only when EVERYTHING was covered. */
 	complete: zod.z.boolean().nullable(),
@@ -11952,6 +13254,31 @@ var pipelineAnalyticsCapability = {
 			auth: "admin"
 		}),
 		/**
+		* Set the per-track operator flags (`markForTrain`, `debug`) on ONE track.
+		* The patch is PARTIAL — an omitted key is left untouched — because the
+		* three surfaces that write it (admin Events grid, viewer track detail,
+		* viewer cluster detail) each own one toggle and must not clobber the other.
+		*
+		* Writes the track ROW: `markForTrain`/`debug` are per-TRACK state, so they
+		* live where `label` and `importance` live, not in any per-device settings
+		* store. Updates the in-RAM active track too, so a flag set on a live track
+		* survives its expiry-time persist.
+		*
+		* `auth: 'protected'` (the default), NOT `admin`: the viewer is an
+		* authenticated non-admin surface and two of the three call sites are
+		* there. Revisit if a flag ever gains an effect that costs storage —
+		* `deleteTracks` next door is admin for exactly that reason.
+		*
+		* Returns the RESOLVED state of both flags (absent → `false`) so a caller
+		* can drive its toggle without a re-fetch. Rejects an unknown track.
+		*/
+		setTrackFlags: require_sleep.method(zod.z.object({
+			/** Log/audit scope only — the trackId is globally unique on its own. */
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			flags: TrackFlagsPatchSchema
+		}), TrackFlagsSchema, { kind: "mutation" }),
+		/**
 		* Durable event-store footprint for the management UI: event rows
 		* (motion + object + audio) counted per camera + total, plus the
 		* event-owned media bytes on disk per camera + total. Stat/count-based,
@@ -12840,6 +14167,53 @@ var DetailResultSchema = zod.z.object({
 	nativeFaceShortSidePx: zod.z.number().optional()
 });
 /**
+* Why an executing node REFUSED a stateless step run (`runStatelessStep`).
+*
+* A refusal is a first-class answer, not an error, because the caller's next
+* move depends on WHICH one it is — and because "the pass produced nothing"
+* must never be reachable without a named, counted cause. The two tiers:
+*
+* - **node-level** (`unknown-step`, `model-not-servable`) — this node can
+*   never serve this (step, model) pair. The caller drops it from its rotation
+*   and retries the same work elsewhere; nothing about the work changes.
+* - **work-level** (`unreadable-frame`, `execution-failed`) — this node is
+*   fine, this one request is not. Retrying it on another node would only
+*   spread the same failure.
+*/
+var StatelessStepRefusalSchema = zod.z.enum([
+	"unknown-step",
+	"model-not-servable",
+	"unreadable-frame",
+	"execution-failed"
+]);
+/**
+* Answer to `runStatelessStep` — a discriminated union rather than a nullable
+* result, because `null` is exactly what made the camera-bound detail path
+* unable to tell "refused" from "never asked".
+*/
+var RunStatelessStepResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("ran"),
+	/** The node that actually executed it — the pin, echoed back for the log. */
+	nodeId: zod.z.string(),
+	/**
+	* The model the step ran with.
+	*
+	* The node verified this exact id has a build for the format it dispatched
+	* on BEFORE running, so the executor's format resolution returns it
+	* unchanged. A caller that pinned a model must compare this field and
+	* treat a mismatch as a refusal — the whole point of the pin is that a
+	* pass writes one feature space.
+	*/
+	modelId: zod.z.string(),
+	details: zod.z.array(DetailResultSchema)
+}), zod.z.object({
+	kind: zod.z.literal("refused"),
+	nodeId: zod.z.string(),
+	reason: StatelessStepRefusalSchema,
+	/** Human-readable specifics — the format tried, the formats shipped, etc. */
+	detail: zod.z.string()
+})]);
+/**
 * Per-camera tunable ranges + defaults. Single source of truth used
 * by both the Zod data schema (validation + default fallback) and
 * the device settings UI (slider min/max/step). Touch one place and
@@ -13423,7 +14797,77 @@ var pipelineRunnerCapability = {
 			cropJpeg: zod.z.string().optional(),
 			parent: DetailParentSchema,
 			steps: zod.z.array(zod.z.string()).optional()
-		}), zod.z.object({ details: zod.z.array(DetailResultSchema) }).nullable(), { kind: "mutation" })
+		}), zod.z.object({ details: zod.z.array(DetailResultSchema) }).nullable(), { kind: "mutation" }),
+		/**
+		* Run ONE enrichment step against caller-supplied pixels, with NO camera
+		* session — no attach, no frame handle, no device affinity.
+		*
+		* ## Why this exists next to `runDetailSubtree` and not inside it
+		*
+		* `runDetailSubtree` resolves its step tree from the LIVE ATTACH STATE. That
+		* is correct for it: its reason to exist is a frame HANDLE, and a handle is
+		* only resolvable while a decode session is open. But it makes the method
+		* useless to anything walking history — cameras run `detectionMode:
+		* 'on-motion'` and detach ~30 s after motion stops, so a fleet-wide
+		* embedding rebuild found most cameras detached and rebuilt only whatever
+		* happened to be attached at that second (measured 2026-08-06: 1125 tracks
+		* scanned, 121 rebuilt, 601 refused as "camera is not attached").
+		*
+		* A caller that ships its own pixels needs none of that machinery. So this
+		* method takes the three things a step actually needs — an image, a box, a
+		* step id — resolves the step from the CATALOG rather than from an
+		* attachment, and runs it on whichever node the caller pinned.
+		*
+		* ## What it deliberately keeps
+		*
+		* The crop rectangle is derived by the SAME `deriveDetailCropRect` call the
+		* live detail plane uses, from the same cluster-wide convention
+		* ([D52](../../../docs/decisions/adr-0052.md)). `frameJpeg` is a FULL frame,
+		* never a pre-cut tile, for exactly the reason `runDetailSubtree` documents:
+		* a caller that cuts is a second feature space.
+		*
+		* ## What it deliberately drops
+		*
+		* No device jump and no `deviceKey`: the jump roster comes from the attach
+		* config, which does not exist here. The step runs on the node's default
+		* engine. This is a maintenance path, not a latency-sensitive one.
+		*
+		* ## Routing
+		*
+		* NOT device-bound. `sourceDeviceId` is DIAGNOSTIC — the camera whose track
+		* these pixels came from, so every log line on the executing node can carry
+		* `tags: { deviceId }`. It is deliberately not named `deviceId`: that field
+		* is a routing hint that would send the call to the camera's owning node,
+		* which is the placement constraint this method exists to remove. Callers
+		* choose the node with `nodePin(nodeId)`; unpinned, an unowned call is
+		* served hub-in-process like any other singleton.
+		*/
+		runStatelessStep: require_sleep.method(zod.z.object({
+			/** Catalog step id, e.g. `clip-embedding`. */
+			stepId: zod.z.string(),
+			/**
+			* REQUIRED model pin. The node runs this exact model or refuses with
+			* `model-not-servable` — it never substitutes a format default, because
+			* a fleet pass that round-robins across nodes would then fill one index
+			* from several encoders.
+			*/
+			modelId: zod.z.string(),
+			/** FULL FRAME, base64 JPEG. The runner cuts — do NOT pre-crop. */
+			frameJpeg: zod.z.string(),
+			/**
+			* The subject box, NORMALISED [0,1] against `frameJpeg`. Normalised on
+			* purpose: the caller stores boxes against a downscaled analysis frame
+			* while the stored key frame is native-resolution, and the only side
+			* that reliably knows the image's pixel dimensions is the side that
+			* decodes it. Denormalising here removes a second reader of the
+			* dimensions and the class of mismatch that comes with it.
+			*/
+			bbox: NativeCropBboxSchema,
+			/** Parent class of the subject (`person`, `vehicle`, …) — carried into the result. */
+			className: zod.z.string(),
+			/** Camera the pixels came from. Diagnostics + log tags ONLY — never routing. */
+			sourceDeviceId: zod.z.number()
+		}), RunStatelessStepResultSchema, { kind: "mutation" })
 	}
 };
 //#endregion
@@ -13733,6 +15177,20 @@ var CameraStatusSchema = zod.z.object({
 	detection: CameraDetectionStatusSchema.nullable(),
 	audio: CameraAudioStatusSchema.nullable(),
 	recording: CameraRecordingStatusSchema.nullable(),
+	/**
+	* Per-camera function switches an OPERATOR has turned off
+	* ([D61](../../../../docs/decisions/adr-0067.md)).
+	*
+	* This is the difference between DISABLED and BROKEN. A camera whose
+	* `detection` block reports zero fps and whose `switchedOff` contains
+	* `'object-detection'` was switched off by a person; the same camera with an
+	* empty list is failing. Every status surface must render the two
+	* differently — a quiet camera that looks identical to a dead one is the
+	* silence-reads-as-never-happened trap this repo keeps paying for.
+	*
+	* Empty when nothing is off. Never contains a switch no provider offers.
+	*/
+	switchedOff: zod.z.array(CameraSwitchIdSchema).readonly(),
 	/** Unix timestamp (ms) when this snapshot was composed server-side. */
 	fetchedAt: zod.z.number()
 });
@@ -14132,6 +15590,43 @@ var pipelineOrchestratorCapability = {
 			agentNodeId: zod.z.string().optional()
 		}), CameraPipelineConfigSchema),
 		/**
+		* The whole per-camera function switch group, DERIVED — never a stored
+		* list ([D61](../../../../docs/decisions/adr-0067.md)).
+		*
+		* The group adds no state. Each switch is a view onto the authority that
+		* already owned it (`deviceManager.setDisabled`,
+		* `deviceManager.setWrapperActive`, `RecordingConfig.enabled`,
+		* `notificationRules.setDeviceMuted`), and `switch.authority` says which.
+		* Availability comes from `deviceManager.listBindableCapsForDeviceType`,
+		* so a deployment with no audio analyzer renders no audio switch.
+		*
+		* `auth: 'view'` deliberately — a NON-admin must be able to see that a
+		* camera is quiet because somebody switched it off. Only the mutation is
+		* admin-gated.
+		*/
+		getCameraSwitches: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), CameraSwitchGroupSchema),
+		/**
+		* Flip ONE switch, routed to its existing authority.
+		*
+		* Never writes a parallel map: `recording` patches `RecordingConfig.enabled`
+		* and leaves `bands` byte-identical (clearing bands to express "off"
+		* destroys the operator's authored schedule and turning the camera back on
+		* would silently record nothing), and the two pipeline switches write the
+		* SAME wrapper binding the legacy `pipelineEnabled` / `audioEnabled`
+		* booleans were migrated onto.
+		*
+		* Rejects a switch this camera does not offer rather than persisting a
+		* write nothing reads.
+		*/
+		setCameraSwitch: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			switchId: CameraSwitchIdSchema,
+			enabled: zod.z.boolean()
+		}), CameraSwitchGroupSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Server-composed aggregated status for a single camera.
 		*
 		* Fans out in parallel (bounded, per-stage graceful degradation) to
@@ -14619,9 +16114,15 @@ var snapshotCapability = {
 			* Bypass the cache freshness check and fetch directly from the
 			* native (or stream-broker fallback). Triggered by the UI's
 			* "refresh" button so an operator can force a fresh frame
-			* even when the cache is well within `snapshotMaxAgeMs`.
-			* On battery cams this WILL wake the camera — accept the
-			* cost only when the user explicitly asks for it.
+			* even when the cache is well within the device's
+			* `snapshotMaxAgeS` window.
+			*
+			* **`force` is an OPERATOR signal, not a freshness preference.** On a
+			* battery camera it is the one thing that walks past the wrapper's
+			* sleep gate and wakes the camera, so a background caller — a poller,
+			* an event handler, a thumbnail — must NEVER set it. Every such caller
+			* gets the cached frame, which on a sleeping battery camera is the
+			* correct answer: stale but honest beats woken.
 			*/
 			force: zod.z.boolean().optional()
 		}), SnapshotImageSchema.nullable()),
@@ -21244,12 +22745,30 @@ var pressureSensorCapability = {
 //#endregion
 //#region src/capabilities/privacy-mask.cap.ts
 /**
-* Privacy mask = up to `maxRegions` SHAPES the camera blanks out (NOT a
-* cell grid). Reolink `<shelterList>` zones are rectangles; Hikvision
-* ISAPI `<RegionCoordinatesList>` zones are free polygons (this camera:
-* exactly 4 vertices, not necessarily axis-aligned). The cap composes the
-* shared rect|polygon subset of the MaskShape vocabulary. All coords are
-* normalized 0..1 (top-left origin).
+* PRIVACY — what the camera deliberately does not capture. Two planes:
+*
+*  - **video**: up to `maxRegions` SHAPES the camera blanks out (NOT a cell
+*    grid). Reolink `<shelterList>` zones are rectangles; Hikvision ISAPI
+*    `<RegionCoordinatesList>` zones are free polygons (this camera: exactly
+*    4 vertices, not necessarily axis-aligned). The cap composes the shared
+*    rect|polygon subset of the MaskShape vocabulary. All coords are
+*    normalized 0..1 (top-left origin).
+*  - **audio**: the camera's microphone. `setAudioEnabled(false)` stops the
+*    camera encoding an audio track at all, so EVERY consumer — live view,
+*    recording, the audio analyzer, an export — sees silent video. There is
+*    no server-side copy of this fact; the camera is the store and every read
+*    is a read-through, which is why a switch over it cannot drift
+*    ([D62](../../../../docs/decisions/adr-0062.md)).
+*
+* Both belong here for one reason: they are the two things an operator turns
+* off when the answer to "what is this camera allowed to record" changes, and
+* both are applied ON the device, before anything leaves it.
+*
+* **The audio flag has exactly one writer.** `stream-params` used to carry a
+* per-profile `audio` in its patch schema — reachable from no UI and honoured
+* by one provider — and it was removed when this landed. A second writer onto
+* one device register is the shape of every knob this repo has shipped that
+* disagreed with the one the reader read.
 */
 /** A privacy-mask region's geometry — rectangle or free polygon. */
 var PrivacyMaskShapeSchema = zod.z.discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
@@ -21261,21 +22780,45 @@ var PrivacyMaskRegionSchema = zod.z.object({
 	enabled: zod.z.boolean(),
 	shape: PrivacyMaskShapeSchema
 });
-/** Current on-camera privacy-mask state — master enable + zones. */
+/** Current on-camera privacy state — mask master enable + zones + microphone. */
 var PrivacyMaskStatusSchema = zod.z.object({
 	enabled: zod.z.boolean(),
 	/** Active zones (normalized 0..1). Length ≤ maxRegions. */
 	regions: zod.z.array(PrivacyMaskRegionSchema),
+	/**
+	* Is the camera capturing sound right now? Read from the camera, never from
+	* a server-side mirror.
+	*
+	* `null` means "no answer" — either this camera exposes no controllable
+	* microphone (`getOptions().supportsAudioMute === false`) or the read
+	* failed. A consumer must render `null` as UNKNOWN and never as `false`:
+	* "the microphone is off" and "we could not ask" look identical to an
+	* operator only until one of them is wrong.
+	*
+	* On a camera whose profiles carry the flag independently (Reolink writes
+	* it per stream), `true` means AT LEAST ONE profile still carries audio —
+	* privacy is only satisfied when every one of them is silent.
+	*/
+	audioEnabled: zod.z.boolean().nullable(),
 	lastFetchedAt: zod.z.number()
 });
-/** Per-camera availability. */
+/** Per-camera availability. Probed, never assumed from the model name. */
 var PrivacyMaskOptionsSchema = zod.z.object({
 	/** Maximum number of supported zones. */
 	maxRegions: zod.z.number(),
 	/** Shape kinds this camera accepts — Reolink: ['rect']; Hikvision: ['rect','polygon']. */
 	supportedShapes: zod.z.array(MaskShapeKindSchema),
 	/** Polygon vertex bounds when 'polygon' is supported (Hikvision: {min:4,max:4}). */
-	polygonVertices: MaskPolygonVerticesSchema.optional()
+	polygonVertices: MaskPolygonVerticesSchema.optional(),
+	/**
+	* Does this camera expose a microphone switch we can actually write?
+	*
+	* Camera-probed: `true` only when the firmware answered with an audio flag
+	* we know how to patch. A camera that never answered is `false` — a control
+	* the operator can press that changes nothing is worse than no control, and
+	* the switch group renders "not available" instead.
+	*/
+	supportsAudioMute: zod.z.boolean()
 });
 /** Partial change — every field optional. */
 var PrivacyMaskPatchSchema = zod.z.object({
@@ -21302,6 +22845,27 @@ var privacyMaskCapability = {
 		}), zod.z.void(), {
 			kind: "mutation",
 			auth: "admin"
+		}),
+		/**
+		* Turn the camera's microphone on or off, at the camera.
+		*
+		* Deliberately its OWN mutation rather than a field on
+		* {@link PrivacyMaskPatchSchema}: `patch.enabled` already means "the video
+		* mask master switch", and overloading it would make one boolean mean two
+		* unrelated things on the same call. It is also the only method here whose
+		* write leaves the device in a state a later `getStatus` reads back
+		* verbatim, which is what makes it safe as a switch authority.
+		*
+		* A camera whose `getOptions().supportsAudioMute` is false must REJECT
+		* this rather than silently accept it — a write nothing applies is exactly
+		* what the switch group exists to remove.
+		*/
+		setAudioEnabled: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			enabled: zod.z.boolean()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
 		})
 	},
 	status: {
@@ -21310,6 +22874,26 @@ var privacyMaskCapability = {
 	},
 	runtimeState: PrivacyMaskStatusSchema
 };
+/**
+* Collapse a camera's PER-PROFILE audio flags into the one answer
+* {@link PrivacyMaskStatusSchema.shape.audioEnabled} promises.
+*
+* Both firmwares this cap talks to store the flag per stream profile, and
+* both let those profiles disagree. The rule is `some`, not `every`: privacy
+* is only satisfied when NOTHING is carrying sound, so a camera whose sub
+* stream is still audible must read as `true` and be switchable off — not as
+* `false` because the main stream happens to be muted already.
+*
+* An empty list is `null` ("this camera reported no audio flag at all"),
+* never `false`.
+*
+* Lives here rather than in each provider so the rule the schema documents
+* and the rule the providers apply cannot drift apart.
+*/
+function summarisePrivacyAudio(profiles) {
+	if (profiles.length === 0) return null;
+	return profiles.some((p) => p.audioEnabled);
+}
 //#endregion
 //#region src/capabilities/ptz.cap.ts
 var PtzPresetSchema = zod.z.object({
@@ -21694,6 +23278,21 @@ var LocateSegmentResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
 })]);
 /** Raw bytes of one finalized footage segment (read off disk on the recording node). */
 var ReadSegmentBytesResultSchema = zod.z.object({ data: zod.z.instanceof(Uint8Array) });
+/**
+* One GOP of a finalized segment, cut by byte range through the segment's own
+* `mfra` (D31 on the D42 feeder path). `data` is the `ftyp`+`moov` head plus
+* the single `moof`+`mdat` covering the requested instant — standalone-
+* demuxable, never the whole file. When the segment's index cannot be parsed
+* the provider degrades INSIDE the mechanism to the whole segment (still one
+* `data`, `gopStartMs` = the segment start) — a worse read, not another path.
+*/
+var ReadGopBytesResultSchema = zod.z.object({
+	data: zod.z.instanceof(Uint8Array),
+	/** Absolute epoch ms of the returned fragment's first sample. */
+	gopStartMs: zod.z.number(),
+	/** Media ms the returned fragment covers. */
+	gopDurMs: zod.z.number()
+});
 var recordingCapability = {
 	name: "recording",
 	scope: "system",
@@ -21761,6 +23360,18 @@ var recordingCapability = {
 			kind: "query",
 			auth: "admin"
 		}),
+		/** Read the single GOP of segment `startMs` covering `epochMs`, by mfra
+		*  byte range — the scrub-granular read (D31 letter on the feeder path).
+		*  See {@link ReadGopBytesResultSchema} for the degradation contract. */
+		readGopBytes: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			profile: zod.z.string(),
+			startMs: zod.z.number(),
+			epochMs: zod.z.number()
+		}), ReadGopBytesResultSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
 		setDeviceConfig: require_sleep.method(zod.z.object({
 			deviceId: zod.z.number(),
 			config: RecordingConfigSchema
@@ -22422,6 +24033,16 @@ var StreamProfileConfigSchema = zod.z.object({
 		"baseline"
 	]).optional(),
 	gop: zod.z.number().optional(),
+	/**
+	* Whether THIS profile currently carries an audio track. READ-ONLY here.
+	*
+	* There is no matching field on {@link StreamProfilePatchSchema}: the
+	* camera's microphone is owned by `privacy-mask` (`setAudioEnabled`), which
+	* writes every profile at once so "audio off" means silent everywhere. A
+	* per-profile writer beside it would let a camera be half-muted and would be
+	* a second knob onto one device register — the failure D62 exists to
+	* prevent. Absent when the firmware does not report the flag.
+	*/
 	audio: zod.z.boolean().optional()
 });
 var StreamParamsStatusSchema = zod.z.object({
@@ -22462,7 +24083,13 @@ var StreamParamsOptionsSchema = zod.z.object({
 	ext: StreamProfileOptionsSchema.optional()
 });
 /** A partial change to one profile — every field optional; a provider
-*  ignores fields it doesn't support. */
+*  ignores fields it doesn't support.
+*
+*  There is deliberately NO `audio` here. It existed until 2026-08-07,
+*  reachable from no form and honoured by exactly one provider, while the
+*  camera's microphone is a whole-device fact. It now has one writer,
+*  `privacyMask.setAudioEnabled`, which writes every profile — see
+*  `privacy-mask.cap.ts`. */
 var StreamProfilePatchSchema = zod.z.object({
 	width: zod.z.number().optional(),
 	height: zod.z.number().optional(),
@@ -22475,8 +24102,7 @@ var StreamProfilePatchSchema = zod.z.object({
 		"main",
 		"baseline"
 	]).optional(),
-	gop: zod.z.number().optional(),
-	audio: zod.z.boolean().optional()
+	gop: zod.z.number().optional()
 });
 var streamParamsCapability = {
 	name: "stream-params",
@@ -25395,10 +27021,7 @@ var BATTERY_DEVICE_PROFILE = {
 		audioMode: "disabled",
 		detectionMode: "on-motion"
 	},
-	settings: {
-		"snapshot.minRefreshIntervalSec": 3600,
-		"streamBroker.preBufferEnabled": false
-	}
+	settings: {}
 };
 /**
 * Profile registry — order matters when multiple profiles match the
@@ -26250,7 +27873,7 @@ var SystemMirror = class {
 	}
 	async refreshDeviceMetadata(deviceId, kind) {
 		try {
-			const info = (await this.api.deviceManager.listAll.query({})).find((d) => d.id === deviceId);
+			const info = await this.api.deviceManager.getDevice.query({ deviceId });
 			if (!info) return;
 			const wasNew = !this.devices.has(deviceId);
 			this.devices.set(deviceId, info);
@@ -30152,6 +31775,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.listDeviceMutes": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.listRules": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -30170,6 +31799,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.setDeviceMuted": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.setRuleEnabled": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -30446,6 +32081,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.setTrackFlags": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.wipeAllAnalytics": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -30752,6 +32393,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getCameraSwitches": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getCapabilityBindings": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -30884,6 +32531,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraSwitch": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCapabilityBinding": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -30974,6 +32627,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.runStatelessStep": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"plateGallery.assignPlate": {
 		capName: "plate-gallery",
 		capScope: "system",
@@ -31106,6 +32765,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"privacyMask.setAudioEnabled": {
+		capName: "privacy-mask",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"privacyMask.setMask": {
 		capName: "privacy-mask",
 		capScope: "device",
@@ -31274,6 +32939,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.readGopBytes": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.readSegmentBytes": {
 		capName: "recording",
 		capScope: "system",
@@ -31790,6 +33461,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.acquireEgressTranscode": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.assignProfile": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -31898,6 +33575,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.releaseEgressTranscode": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.releaseStreamWithCodec": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -33310,7 +34993,8 @@ function createSystemProxy(api) {
 			getLocalMetrics: (input) => dispatch("pipelineRunner", "getLocalMetrics", "query", input),
 			getAllCameraMetrics: (input) => dispatch("pipelineRunner", "getAllCameraMetrics", "query", input),
 			getLocalCameras: (input) => dispatch("pipelineRunner", "getLocalCameras", "query", input),
-			getNativeCrop: (input) => dispatch("pipelineRunner", "getNativeCrop", "query", input)
+			getNativeCrop: (input) => dispatch("pipelineRunner", "getNativeCrop", "query", input),
+			runStatelessStep: (input) => dispatch("pipelineRunner", "runStatelessStep", "mutation", input)
 		},
 		plateGallery: {
 			getPlateMedia: (input) => dispatch("plateGallery", "getPlateMedia", "query", input),
@@ -33397,6 +35081,8 @@ function createSystemProxy(api) {
 			getStreamUrl: (input) => dispatch("streamBroker", "getStreamUrl", "query", input),
 			getStreamWithCodec: (input) => dispatch("streamBroker", "getStreamWithCodec", "mutation", input),
 			releaseStreamWithCodec: (input) => dispatch("streamBroker", "releaseStreamWithCodec", "mutation", input),
+			acquireEgressTranscode: (input) => dispatch("streamBroker", "acquireEgressTranscode", "mutation", input),
+			releaseEgressTranscode: (input) => dispatch("streamBroker", "releaseEgressTranscode", "mutation", input),
 			subscribeAudioChunks: (input) => dispatch("streamBroker", "subscribeAudioChunks", "mutation", input),
 			pullAudioChunks: (input) => dispatch("streamBroker", "pullAudioChunks", "query", input),
 			unsubscribeAudioChunks: (input) => dispatch("streamBroker", "unsubscribeAudioChunks", "mutation", input),
@@ -34277,6 +35963,44 @@ function bestLocationMatch(externalName, existing, threshold = .8) {
 	return best;
 }
 //#endregion
+//#region src/utils/addon-id.ts
+/**
+* The addon id as the REGISTRY, the wire and the durable stores spell it.
+*
+* `AddonContext.id` does not agree with itself across the two context
+* factories:
+*
+*   - a FORKED addon gets the bare manifest id
+*     (`kernel/moleculer/addon-context-factory.ts` → `id: addonId`);
+*   - an addon co-located in hub-main gets it PREFIXED
+*     (`server/backend/src/core/addon/addon-registry.service.ts` →
+*      ``id: `addon:${addonId}` ``).
+*
+* Everything an addon might compare `ctx.id` AGAINST carries the bare form:
+* `DeviceBindingEntry.providerAddonId`, the `device-manager` bindings store's
+* `wrapperAddonId`, `CapabilityRegistry` provider keys, manifest ids.
+*
+* So `entry.providerAddonId === this.ctx.id` is silently, permanently false
+* for a builtin — and only for a builtin, which is why it survives a green
+* suite whose fake supplies the bare id. That is exactly how camera 615's
+* virtual doorbell latched `unbound` for twelve hours on 2026-08-07 while its
+* binding was intact ([D72](../../../../docs/decisions/adr-0072.md)).
+*
+* Route every comparison between `ctx.id` and a registry/store addon id
+* through {@link isSameAddonId}. `scripts/check-addon-id-comparison.ts`
+* enforces it in the processes where the prefix exists.
+*/
+/** The prefix the hub-main context factory prepends to the manifest id. */
+var ADDON_ID_PREFIX = "addon:";
+/** The manifest id, whichever spelling of `ctx.id` you were handed. */
+function bareAddonId(id) {
+	return id.startsWith(ADDON_ID_PREFIX) ? id.slice(6) : id;
+}
+/** True when both ids name the same addon, prefixed or not. */
+function isSameAddonId(a, b) {
+	return bareAddonId(a) === bareAddonId(b);
+}
+//#endregion
 //#region src/utils/cosine-similarity.ts
 /** Cosine similarity between two embedding vectors */
 function cosineSimilarity(a, b) {
@@ -35003,7 +36727,7 @@ function readDetailCropConvention(config) {
 		square: square.success ? square.data : DEFAULT_DETAIL_CROP_CONVENTION.square
 	};
 }
-function isHydratedField(entry) {
+function isHydratedField$1(entry) {
 	return typeof entry === "object" && entry !== null && "key" in entry;
 }
 /**
@@ -35018,7 +36742,7 @@ function pickDetailCropConvention(view) {
 	if (view === null) return DEFAULT_DETAIL_CROP_CONVENTION;
 	const flat = {};
 	for (const section of view.sections) for (const entry of section.fields) {
-		if (!isHydratedField(entry) || typeof entry.key !== "string") continue;
+		if (!isHydratedField$1(entry) || typeof entry.key !== "string") continue;
 		if (entry.key === "detailCropPaddingRatio" || entry.key === "detailCropSquare") flat[entry.key] = entry.value;
 	}
 	return readDetailCropConvention(flat);
@@ -35105,6 +36829,245 @@ function slideInsideFrame(rect, frameWidth, frameHeight) {
 	};
 }
 //#endregion
+//#region src/pipeline/native-lease.ts
+/**
+* THE native-frame **lease** knobs — TTL, RAM budget and demand window for the
+* decode worker's native-resolution frame retention.
+*
+* ## Why they live here and not in the addon that reads them
+*
+* The WRITER is `pipeline-orchestrator` (the cluster-wide settings authority);
+* the READER is a private child process of `addon-pipeline`'s pipeline-runner.
+* Addons never import each other, so a key owned by either side would have to
+* be hand-copied by the other — and a hand-copied key is how a setting silently
+* stops arriving while both sides still look correct. Same reasoning, same
+* placement as `detail-crop.ts` (D52's "one cluster-wide orchestrator setting").
+*
+* ## Why cluster-wide and not per-node
+*
+* The lease is a per-decode-worker RAM window. Its purpose — the late
+* cross-process native crop landing on a full-resolution frame rather than the
+* ≤640 detection fallback — is a property of the PIPELINE, not of a node's
+* hardware: a per-node TTL would mean the same camera produces different crop
+* quality depending on which node the balancer placed it on, and nobody could
+* tell that from the stored media. Node-level RAM pressure is already handled
+* by the per-session budget ceiling, which is itself one of these knobs.
+*
+* ## What each knob costs
+*
+* A retained frame is a full NATIVE-resolution copy in system RAM. With the
+* default pinned-RGB24 lease path (`CAMSTACK_SESSION_PINNED_RGB_CROP`, on):
+* 4K ≈ 24.9 MB/frame, 1080p ≈ 6.2 MB/frame. On the YUV420P path (flag off, and
+* for software-decoded sessions): 4K ≈ 12.4 MB, 1080p ≈ 3.1 MB. Worst-case
+* resident RAM for ONE busy camera ≈ frameBytes × deliveredFps × ttlSeconds,
+* clamped by the budget ceiling. See `docs/design/decode-path.md` → "Lease
+* admission" for what actually gets admitted.
+*/
+/**
+* Store identity of the lease knobs in `pipeline-orchestrator`'s GLOBAL
+* (cluster-wide) settings. Keys are unique across that addon's whole schema, so
+* the reader can walk every section instead of trusting the section id.
+*/
+var NATIVE_LEASE_SECTION_ID = "native-lease";
+var NATIVE_LEASE_TTL_KEY = "nativeLeaseTtlMs";
+var NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
+var NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
+var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
+/**
+* WHICH delivered frames the decode worker retains a native copy of.
+*
+* - `all` — every frame the worker delivered to the runner. The shipped
+*   behaviour, and the only correct one if something can ask for a crop of a
+*   frame the runner never sent to inference.
+* - `inferred` — only the frames the runner ADMITTED to its detection queue.
+*   A native-crop request always names a `frameId` that rode an inference
+*   result, so that is the only set a request can name. How much it drops is
+*   the two-plane governor's admit ratio and nothing else: measured at ~50% on
+*   this cluster, not the ~80% the design sketch assumed, because the governor
+*   was not throttling as hard as the sketch supposed. Read
+*   `leaseAdmitted`/`leaseOffered` off the metrics line for the camera in front
+*   of you rather than quoting a number from here. The newest delivered frame is
+*   croppable regardless — it is still the worker's reserved slot, not a lease —
+*   which covers the one-frame race between a mark and the supersede that
+*   consumes it.
+*/
+var NativeLeaseAdmissionSchema = zod.z.enum(["all", "inferred"]);
+/**
+* Operator-tunable native-lease settings. Bounds are enforced HERE (not only in
+* the slider) because the value also travels to a forked child process, where a
+* junk number would silently become a 0-length or unbounded retention window.
+*/
+var NativeLeaseSettingsSchema = zod.z.object({
+	/**
+	* How long a retained native frame is served before it counts as a miss.
+	*
+	* Must cover the FULL late-crop horizon: detection inference + the
+	* cross-process inference-result hop to hub post-analysis + tracking + the
+	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
+	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
+	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	*/
+	ttlMs: zod.z.number().int().min(250).max(1e4),
+	/**
+	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
+	*
+	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
+	* which one is actually binding before reasoning from that. At the shipped
+	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
+	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
+	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
+	* change that admits fewer frames buys retention WINDOW at constant RAM
+	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* `0` DISABLES the lease entirely and falls the worker back to the tiny
+	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
+	* to replace).
+	*/
+	budgetMb: zod.z.number().int().min(0).max(4096),
+	/**
+	* Demand window: eager per-frame native retention runs only within this many
+	* ms of the last native-crop request (or of the dial starting).
+	*
+	* `0` means ALWAYS ON — it disables the gate, it does not disable retention.
+	* That is the legacy behaviour that saturated an N100 (24 native-4K downloads
+	* per second on a camera with zero crop demand), so leave it non-zero unless
+	* you are reproducing that.
+	*/
+	activityMs: zod.z.number().int().min(0).max(12e4),
+	/**
+	* Which delivered frames are retained at all — see
+	* {@link NativeLeaseAdmissionSchema}. This is the only knob of the four that
+	* changes WHAT is kept rather than for how long, so it is also the only one
+	* that can turn a crop that used to hit into a miss. The worker counts every
+	* crop request naming a frame it did NOT see marked
+	* (`leaseUnmarkedCrops` on the session-decode metrics line): a non-zero value
+	* there is the signal that some caller names frames outside the inference set
+	* and that this must go back to `all`.
+	*/
+	admission: NativeLeaseAdmissionSchema
+});
+/**
+* The values in force when the operator has set nothing — byte-for-byte the
+* constants the decode worker shipped with as env-var defaults, so making these
+* settings changed no behaviour on the day it landed.
+*/
+var DEFAULT_NATIVE_LEASE_SETTINGS = {
+	ttlMs: 1200,
+	budgetMb: 1024,
+	activityMs: 15e3,
+	admission: "inferred"
+};
+/** Slider bounds for the operator-facing knobs (orchestrator settings UI). */
+var NATIVE_LEASE_TTL_FIELD = {
+	min: 250,
+	max: 1e4,
+	step: 50,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs
+};
+var NATIVE_LEASE_BUDGET_FIELD = {
+	min: 0,
+	max: 4096,
+	step: 64,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb
+};
+var NATIVE_LEASE_ACTIVITY_FIELD = {
+	min: 0,
+	max: 12e4,
+	step: 1e3,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.activityMs
+};
+/** Select options for the admission knob (orchestrator settings UI). */
+var NATIVE_LEASE_ADMISSION_FIELD = {
+	options: [{
+		value: "all",
+		label: "Every delivered frame"
+	}, {
+		value: "inferred",
+		label: "Only frames sent to inference"
+	}],
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.admission
+};
+/**
+* Parse one knob, reporting `null` for absent, junk, out-of-bounds — AND for a
+* value equal to the shipped default.
+*
+* That last rule is not tidiness, it is the difference between the documented
+* precedence being true and being a lie. `addon-settings.getGlobalSettings`
+* returns a HYDRATED payload, and `hydrateField` fills an unstored field with
+* the schema's own `default` (verified live on the hub: a cluster that has never
+* opened the form still reports `nativeLeaseTtlMs = 1200`). A reader that took
+* that at face value would report all three knobs as "set" on every cluster on
+* the day this shipped, permanently retiring the `CAMSTACK_SESSION_NATIVE_LEASE_*`
+* emergency override that the precedence promises. There is no raw-store read on
+* this cap to distinguish the two, so the default value itself is treated as
+* "the operator has expressed no preference" — which is also what leaving a
+* slider untouched means.
+*
+* The cost is one honest edge: an operator who deliberately selects the default
+* value in order to overrule an env var does not get it. Clear the env var
+* instead; the worker's spawn line names the source, so this is visible rather
+* than mysterious.
+*/
+function readKnob(knob, raw) {
+	const parsed = NativeLeaseSettingsSchema.shape[knob].safeParse(raw);
+	if (!parsed.success) return null;
+	return parsed.data === DEFAULT_NATIVE_LEASE_SETTINGS[knob] ? null : parsed.data;
+}
+/** {@link readKnob} for the one non-numeric knob. Same default-means-unset rule. */
+function readAdmissionKnob(raw) {
+	const parsed = NativeLeaseAdmissionSchema.safeParse(raw);
+	if (!parsed.success) return null;
+	return parsed.data === DEFAULT_NATIVE_LEASE_SETTINGS.admission ? null : parsed.data;
+}
+/**
+* Narrow a FLAT settings record to the knobs the operator set.
+*
+* Per-FIELD parse, deliberately: a junk TTL must not also discard a valid
+* budget. An absent, out-of-bounds or default-valued knob is OMITTED (not
+* clamped, not defaulted) so the caller can still fall through to the env
+* override — clamping here would turn a typo into a value nobody chose. See
+* {@link readKnob} for why the default counts as unset.
+*/
+function readNativeLeaseOverride(config) {
+	const ttlMs = readKnob("ttlMs", config[NATIVE_LEASE_TTL_KEY]);
+	const budgetMb = readKnob("budgetMb", config[NATIVE_LEASE_BUDGET_KEY]);
+	const activityMs = readKnob("activityMs", config[NATIVE_LEASE_ACTIVITY_KEY]);
+	const admission = readAdmissionKnob(config[NATIVE_LEASE_ADMISSION_KEY]);
+	return {
+		...ttlMs === null ? {} : { ttlMs },
+		...budgetMb === null ? {} : { budgetMb },
+		...activityMs === null ? {} : { activityMs },
+		...admission === null ? {} : { admission }
+	};
+}
+function isHydratedField(entry) {
+	return typeof entry === "object" && entry !== null && "key" in entry;
+}
+var LEASE_KEYS = [
+	NATIVE_LEASE_TTL_KEY,
+	NATIVE_LEASE_BUDGET_KEY,
+	NATIVE_LEASE_ACTIVITY_KEY,
+	NATIVE_LEASE_ADMISSION_KEY
+];
+/**
+* Extract the operator's lease overrides from an
+* `addon-settings.getGlobalSettings` payload.
+*
+* Walks EVERY section rather than looking inside {@link NATIVE_LEASE_SECTION_ID}
+* alone: the keys are unique across the addon's schema, and a section rename
+* must not silently revert the whole cluster to the defaults. A `null` payload
+* (addon mid-boot) means "operator set nothing" — the env/default fallback then
+* applies, which is the correct read of "I could not ask".
+*/
+function pickNativeLeaseOverride(view) {
+	if (view === null) return {};
+	const flat = {};
+	for (const section of view.sections) for (const entry of section.fields) {
+		if (!isHydratedField(entry) || typeof entry.key !== "string") continue;
+		if (LEASE_KEYS.includes(entry.key)) flat[entry.key] = entry.value;
+	}
+	return readNativeLeaseOverride(flat);
+}
+//#endregion
 //#region src/helpers/bind-addon-actions.ts
 /**
 * Bind an addon's custom-action catalog to its tRPC surface, returning a
@@ -35357,10 +37320,13 @@ function enumerateInferenceDevices(hw) {
 }
 //#endregion
 exports.ACCESSORY_LABEL = ACCESSORY_LABEL;
+exports.ALEXA_EGRESS_PROFILE = ALEXA_EGRESS_PROFILE;
 exports.ALL_CAPABILITY_DEFINITIONS = ALL_CAPABILITY_DEFINITIONS;
 exports.APPLE_SA_TO_MACRO = APPLE_SA_TO_MACRO;
+exports.AUDIO_ANALYSIS_CAP_NAME = AUDIO_ANALYSIS_CAP_NAME;
 exports.AUDIO_BACKEND_CHOICES = AUDIO_BACKEND_CHOICES;
 exports.AUDIO_MACRO_LABELS = AUDIO_MACRO_LABELS;
+exports.AUDIO_PRESETS = AUDIO_PRESETS;
 exports.AccessoriesStatusSchema = AccessoriesStatusSchema;
 exports.AccessoryKind = AccessoryKind;
 exports.AddBrokerInputSchema = AddBrokerInputSchema;
@@ -35414,6 +37380,7 @@ exports.AutoUpdateSettingsSchema = AutoUpdateSettingsSchema;
 exports.AutomationControlStatusSchema = AutomationControlStatusSchema;
 exports.AvailableIntegrationTypeSchema = AvailableIntegrationTypeSchema;
 exports.BACKEND_TO_FORMAT = BACKEND_TO_FORMAT;
+exports.BASE_LIVE_EGRESS_PROFILE = BASE_LIVE_EGRESS_PROFILE;
 exports.BATTERY_DEVICE_PROFILE = BATTERY_DEVICE_PROFILE;
 exports.BacklightModeSchema = BacklightModeSchema;
 exports.BackupDestinationInfoSchema = BackupDestinationInfoSchema;
@@ -35446,6 +37413,8 @@ exports.BrokerSubscribeInputSchema = SubscribeInputSchema;
 exports.BrokerSubscribeResultSchema = SubscribeResultSchema;
 exports.BrokerTestConnectionResultSchema = TestConnectionResultSchema;
 exports.BrokerUnsubscribeInputSchema = UnsubscribeInputSchema;
+exports.CAMERA_SWITCH_CATALOG = CAMERA_SWITCH_CATALOG;
+exports.CAMERA_SWITCH_ORDER = CAMERA_SWITCH_ORDER;
 exports.CAM_PROFILE_ORDER = require_sleep.CAM_PROFILE_ORDER;
 exports.CAPABILITY_NAMES = CAPABILITY_NAMES;
 exports.CAPABILITY_ROUTER_KEYS = CAPABILITY_ROUTER_KEYS;
@@ -35479,6 +37448,11 @@ exports.CameraSourceStatusSchema = CameraSourceStatusSchema;
 exports.CameraSourceStreamSchema = CameraSourceStreamSchema;
 exports.CameraStatusSchema = CameraStatusSchema;
 exports.CameraStreamSchema = require_sleep.CameraStreamSchema;
+exports.CameraSwitchAuthoritySchema = CameraSwitchAuthoritySchema;
+exports.CameraSwitchGroupSchema = CameraSwitchGroupSchema;
+exports.CameraSwitchIdSchema = CameraSwitchIdSchema;
+exports.CameraSwitchSchema = CameraSwitchSchema;
+exports.CameraSwitchUnavailableReasonSchema = CameraSwitchUnavailableReasonSchema;
 exports.CandidateQueryFilterSchema = CandidateQueryFilterSchema;
 exports.CapScopeSchema = CapScopeSchema;
 exports.CapabilityBindingsSchema = CapabilityBindingsSchema;
@@ -35527,12 +37501,14 @@ exports.DEFAULT_DECODER_HWACCEL_CONFIG = DEFAULT_DECODER_HWACCEL_CONFIG;
 exports.DEFAULT_DETAIL_CROP_CONVENTION = DEFAULT_DETAIL_CROP_CONVENTION;
 exports.DEFAULT_EVENT_COLOR = DEFAULT_EVENT_COLOR;
 exports.DEFAULT_FEATURES = DEFAULT_FEATURES;
+exports.DEFAULT_NATIVE_LEASE_SETTINGS = DEFAULT_NATIVE_LEASE_SETTINGS;
 exports.DEFAULT_RETENTION = DEFAULT_RETENTION;
 exports.DEFAULT_SCRUB_THUMBNAIL_PRESET = DEFAULT_SCRUB_THUMBNAIL_PRESET;
 exports.DETAIL_CROP_PADDING_FIELD = DETAIL_CROP_PADDING_FIELD;
 exports.DETAIL_CROP_PADDING_KEY = DETAIL_CROP_PADDING_KEY;
 exports.DETAIL_CROP_SECTION_ID = DETAIL_CROP_SECTION_ID;
 exports.DETAIL_CROP_SQUARE_KEY = DETAIL_CROP_SQUARE_KEY;
+exports.DETECTION_PIPELINE_CAP_NAME = DETECTION_PIPELINE_CAP_NAME;
 exports.DEVICE_BACKEND_TO_FORMAT = DEVICE_BACKEND_TO_FORMAT;
 exports.DEVICE_CAP_NAMES = DEVICE_CAP_NAMES;
 exports.DEVICE_PROFILES = DEVICE_PROFILES;
@@ -35584,6 +37560,10 @@ exports.EXPRESSION_BUILTIN_NAMES = EXPRESSION_BUILTIN_NAMES;
 exports.EXPRESSION_COMPILE_CACHE_CAPACITY = EXPRESSION_COMPILE_CACHE_CAPACITY;
 exports.EXPRESSION_IDENTIFIER_RE = EXPRESSION_IDENTIFIER_RE;
 exports.EXPRESSION_INJECTED_NOW = EXPRESSION_INJECTED_NOW;
+exports.EgressEncodeSchema = EgressEncodeSchema;
+exports.EgressRateControlSchema = EgressRateControlSchema;
+exports.EgressTranscodeRequestSchema = EgressTranscodeRequestSchema;
+exports.EgressTranscodeSchema = EgressTranscodeSchema;
 exports.ElementConfigStore = ElementConfigStore;
 exports.EmbeddingInfoSchema = EmbeddingInfoSchema;
 exports.EmbeddingResultSchema = EmbeddingResultSchema;
@@ -35625,6 +37605,10 @@ exports.FrameInputSchema = FrameInputSchema;
 exports.GasStatusSchema = GasStatusSchema;
 exports.GetStreamWithCodecInputSchema = GetStreamWithCodecInputSchema;
 exports.GlobalMetricsSchema = GlobalMetricsSchema;
+exports.HAP_AUDIO_BASE = HAP_AUDIO_BASE;
+exports.HAP_AUDIO_BITRATE_KBPS = HAP_AUDIO_BITRATE_KBPS;
+exports.HAP_AUDIO_VBV_KBITS = HAP_AUDIO_VBV_KBITS;
+exports.HAP_KEYFRAME_INTERVAL_SEC = HAP_KEYFRAME_INTERVAL_SEC;
 exports.HF_BASE_URL = HF_BASE_URL;
 exports.HF_REPO = HF_REPO;
 exports.HWACCEL_OPTIONS = HWACCEL_OPTIONS;
@@ -35735,6 +37719,15 @@ exports.MotionZoneRegionSchema = MotionZoneRegionSchema;
 exports.MotionZoneStatusSchema = MotionZoneStatusSchema;
 exports.MqttBrokerStatusSchema = StatusSchema;
 exports.MutationFilterSchema = MutationFilterSchema;
+exports.NATIVE_LEASE_ACTIVITY_FIELD = NATIVE_LEASE_ACTIVITY_FIELD;
+exports.NATIVE_LEASE_ACTIVITY_KEY = NATIVE_LEASE_ACTIVITY_KEY;
+exports.NATIVE_LEASE_ADMISSION_FIELD = NATIVE_LEASE_ADMISSION_FIELD;
+exports.NATIVE_LEASE_ADMISSION_KEY = NATIVE_LEASE_ADMISSION_KEY;
+exports.NATIVE_LEASE_BUDGET_FIELD = NATIVE_LEASE_BUDGET_FIELD;
+exports.NATIVE_LEASE_BUDGET_KEY = NATIVE_LEASE_BUDGET_KEY;
+exports.NATIVE_LEASE_SECTION_ID = NATIVE_LEASE_SECTION_ID;
+exports.NATIVE_LEASE_TTL_FIELD = NATIVE_LEASE_TTL_FIELD;
+exports.NATIVE_LEASE_TTL_KEY = NATIVE_LEASE_TTL_KEY;
 exports.NC_BASE_CONDITION_KEYS = NC_BASE_CONDITION_KEYS;
 exports.NC_CONDITION_CATALOG = NC_CONDITION_CATALOG;
 exports.NC_HISTORY_LIMIT_DEFAULT = NC_HISTORY_LIMIT_DEFAULT;
@@ -35746,6 +37739,8 @@ exports.NativeCropBboxSchema = NativeCropBboxSchema;
 exports.NativeCropRefSchema = NativeCropRefSchema;
 exports.NativeCropResultSchema = NativeCropResultSchema;
 exports.NativeDetectionSchema = NativeDetectionSchema;
+exports.NativeLeaseAdmissionSchema = NativeLeaseAdmissionSchema;
+exports.NativeLeaseSettingsSchema = NativeLeaseSettingsSchema;
 exports.NativeObjectClassEnum = NativeObjectClassEnum;
 exports.NativeObjectDetectionRuntimeStateSchema = NativeObjectDetectionRuntimeStateSchema;
 exports.NativeObjectDetectionStatusSchema = NativeObjectDetectionStatusSchema;
@@ -35815,6 +37810,7 @@ exports.PET_FEEDER_MANUAL_FEED_MAX = PET_FEEDER_MANUAL_FEED_MAX;
 exports.PET_FEEDER_MANUAL_FEED_MIN = PET_FEEDER_MANUAL_FEED_MIN;
 exports.PIPELINE_FLOW_CAPABILITY_NAMES = PIPELINE_FLOW_CAPABILITY_NAMES;
 exports.PIPELINE_OWNER_CAPABILITY_NAMES = PIPELINE_OWNER_CAPABILITY_NAMES;
+exports.PRIVACY_MASK_CAP_NAME = PRIVACY_MASK_CAP_NAME;
 exports.PROVIDER_KIND_CAP_NAMES = PROVIDER_KIND_CAP_NAMES;
 exports.PYTHON_SCRIPT = PYTHON_SCRIPT;
 exports.PackageUpdateSchema = PackageUpdateSchema;
@@ -35858,6 +37854,8 @@ exports.PtzPositionSchema = PtzPositionSchema;
 exports.PtzPresetSchema = PtzPresetSchema;
 exports.PtzStatusSchema = PtzStatusSchema;
 exports.QueryFilterSchema = QueryFilterSchema;
+exports.RATE_CONTROL_RELAXED = RATE_CONTROL_RELAXED;
+exports.RATE_CONTROL_TIGHT = RATE_CONTROL_TIGHT;
 exports.REACHABILITY_FAILURES_TO_OFFLINE = REACHABILITY_FAILURES_TO_OFFLINE;
 exports.REACHABILITY_POLL_INTERVAL_MS = REACHABILITY_POLL_INTERVAL_MS;
 exports.REACHABILITY_PROBE_TIMEOUT_MS = REACHABILITY_PROBE_TIMEOUT_MS;
@@ -35866,6 +37864,7 @@ exports.RESERVED_BINDING_NAMES = RESERVED_BINDING_NAMES;
 exports.RUNTIME_DEFAULTS = RUNTIME_DEFAULTS;
 exports.RUNTIME_TO_FORMAT = RUNTIME_TO_FORMAT;
 exports.RawStateResultSchema = require_sleep.RawStateResultSchema;
+exports.ReadGopBytesResultSchema = ReadGopBytesResultSchema;
 exports.ReadSegmentBytesResultSchema = ReadSegmentBytesResultSchema;
 exports.ReadinessRegistry = require_sleep.ReadinessRegistry;
 exports.ReadinessTimeoutError = require_sleep.ReadinessTimeoutError;
@@ -35984,6 +37983,8 @@ exports.SystemMetricsSchema = SystemMetricsSchema;
 exports.SystemMirror = SystemMirror;
 exports.TAXONOMY_COLORS = TAXONOMY_COLORS;
 exports.TIMEZONES = TIMEZONES;
+exports.TRANSCODE_DOWN_MAX_BITRATE_KBPS = TRANSCODE_DOWN_MAX_BITRATE_KBPS;
+exports.TRANSCODE_DOWN_MAX_HEIGHT = TRANSCODE_DOWN_MAX_HEIGHT;
 exports.TamperStatusSchema = TamperStatusSchema;
 exports.TankStatusSchema = TankStatusSchema;
 exports.TargetKindCapsSchema = TargetKindCapsSchema;
@@ -36006,8 +38007,11 @@ exports.TopologyProcessSchema = TopologyProcessSchema;
 exports.TopologyServiceSchema = TopologyServiceSchema;
 exports.TrackCascadeCountsSchema = TrackCascadeCountsSchema;
 exports.TrackEnvelopeSchema = TrackEnvelopeSchema;
+exports.TrackFlagsPatchSchema = TrackFlagsPatchSchema;
+exports.TrackFlagsSchema = TrackFlagsSchema;
 exports.TrackProjectionSchema = TrackProjectionSchema;
 exports.TrackSchema = TrackSchema;
+exports.TrackSourceSchema = TrackSourceSchema;
 exports.TrackStateSchema = TrackStateSchema;
 exports.TrackZoneFilterSchema = TrackZoneFilterSchema;
 exports.TrackedDetectionSchema = TrackedDetectionSchema;
@@ -36043,6 +38047,7 @@ exports.VectorUpsertInputSchema = VectorUpsertInputSchema;
 exports.VectorUpsertResultSchema = VectorUpsertResultSchema;
 exports.VibrationStatusSchema = VibrationStatusSchema;
 exports.VideoEncodeSchema = VideoEncodeSchema;
+exports.WEBRTC_EGRESS_PROFILE = WEBRTC_EGRESS_PROFILE;
 exports.WELL_KNOWN_TABS = require_sleep.WELL_KNOWN_TABS;
 exports.WELL_KNOWN_TAB_MAP = require_sleep.WELL_KNOWN_TAB_MAP;
 exports.WaterHeaterStatusSchema = WaterHeaterStatusSchema;
@@ -36089,10 +38094,12 @@ exports.audioAnalysisCapability = audioAnalysisCapability;
 exports.audioAnalyzerCapability = audioAnalyzerCapability;
 exports.audioCodecCapability = audioCodecCapability;
 exports.audioMetricsCapability = audioMetricsCapability;
+exports.audioPlanFromEncodeProfile = audioPlanFromEncodeProfile;
 exports.authProviderCapability = authProviderCapability;
 exports.autoAssignProfiles = autoAssignProfiles;
 exports.automationControlCapability = automationControlCapability;
 exports.backupCapability = backupCapability;
+exports.bareAddonId = bareAddonId;
 exports.batteryCapability = batteryCapability;
 exports.bestLocationMatch = bestLocationMatch;
 exports.binaryCapability = binaryCapability;
@@ -36100,15 +38107,20 @@ exports.bindAddonActions = bindAddonActions;
 exports.brightnessCapability = brightnessCapability;
 exports.brokerCapability = brokerCapability;
 exports.buildAddonRouteProvider = buildAddonRouteProvider;
+exports.buildAudioArgs = buildAudioArgs;
 exports.buildEventKindDescriptor = buildEventKindDescriptor;
+exports.buildFfmpegArgs = buildFfmpegArgs;
+exports.buildInputArgs = buildInputArgs;
 exports.buildModelVariantGroups = buildModelVariantGroups;
 exports.buildNcTaxonomy = buildNcTaxonomy;
 exports.buildStreamParamsConfigSchema = buildStreamParamsConfigSchema;
+exports.buildVideoArgs = buildVideoArgs;
 exports.buttonCapability = buttonCapability;
 exports.cameraCredentialsCapability = cameraCredentialsCapability;
 exports.cameraPipelineConfigCapability = cameraPipelineConfigCapability;
 exports.cameraStreamsCapability = cameraStreamsCapability;
 exports.canConvertUnit = canConvertUnit;
+exports.canonicalEgressPlan = canonicalEgressPlan;
 exports.carbonMonoxideCapability = carbonMonoxideCapability;
 exports.cellsToRects = cellsToRects;
 exports.classifyStream = classifyStream;
@@ -36132,6 +38144,7 @@ exports.createDeviceProxy = require_sleep.createDeviceProxy;
 exports.createDurableState = require_sleep.createDurableState;
 exports.createEvent = require_sleep.createEvent;
 exports.createExpressionScope = createExpressionScope;
+exports.createHwAccelCache = createHwAccelCache;
 exports.createLazyTrpcSource = require_sleep.createLazyTrpcSource;
 exports.createMirrorSource = require_sleep.createMirrorSource;
 exports.createRuntimeStateBridge = createRuntimeStateBridge;
@@ -36145,6 +38158,7 @@ exports.decodeVectorBase64 = decodeVectorBase64;
 exports.decoderCapability = decoderCapability;
 exports.defaultDeviceFor = defaultDeviceFor;
 exports.defineCustomActions = defineCustomActions;
+exports.deriveCameraSwitches = deriveCameraSwitches;
 exports.deriveDetailCropRect = deriveDetailCropRect;
 exports.deriveRecordingMode = deriveRecordingMode;
 exports.describeModelVariant = describeModelVariant;
@@ -36161,6 +38175,8 @@ exports.deviceProviderCapability = deviceProviderCapability;
 exports.deviceStateCapability = deviceStateCapability;
 exports.deviceStatusCapability = deviceStatusCapability;
 exports.doorbellCapability = doorbellCapability;
+exports.egressTranscodeSharingKey = egressTranscodeSharingKey;
+exports.egressTransportFromRequest = egressTransportFromRequest;
 exports.embeddingEncoderCapability = embeddingEncoderCapability;
 exports.emitDownForOwnedCaps = require_sleep.emitDownForOwnedCaps;
 exports.emitReadiness = require_sleep.emitReadiness;
@@ -36203,6 +38219,7 @@ exports.imageCapability = imageCapability;
 exports.imageSettingsCapability = imageSettingsCapability;
 exports.integrationsCapability = integrationsCapability;
 exports.intercomCapability = intercomCapability;
+exports.invocationFromEncodeProfile = invocationFromEncodeProfile;
 exports.isAgentOnlyPlacement = isAgentOnlyPlacement;
 exports.isArrayOutputSchema = isArrayOutputSchema;
 exports.isBaseConditionKey = isBaseConditionKey;
@@ -36213,6 +38230,8 @@ exports.isDeviceScopedCap = require_sleep.isDeviceScopedCap;
 exports.isEvent = require_sleep.isEvent;
 exports.isNode = isNode;
 exports.isObjectInput = isObjectInput;
+exports.isSameAddonId = isSameAddonId;
+exports.isSoftwareDecode = isSoftwareDecode;
 exports.isVoidInput = isVoidInput;
 exports.jobKindSchema = jobKindSchema;
 exports.kebabToCamel = kebabToCamel;
@@ -36227,6 +38246,7 @@ exports.llmRuntimeCapability = llmRuntimeCapability;
 exports.localNetworkCapability = localNetworkCapability;
 exports.locationSimilarity = locationSimilarity;
 exports.lockControlCapability = lockControlCapability;
+exports.logBannerArgs = logBannerArgs;
 exports.logDestinationCapability = logDestinationCapability;
 exports.logLevelAtMost = logLevelAtMost;
 exports.loginMethodCapability = loginMethodCapability;
@@ -36274,7 +38294,9 @@ exports.parseStreamParamsFormPatch = parseStreamParamsFormPatch;
 exports.petFeederCapability = petFeederCapability;
 exports.pickAccessoryControl = pickAccessoryControl;
 exports.pickDetailCropConvention = pickDetailCropConvention;
+exports.pickNativeLeaseOverride = pickNativeLeaseOverride;
 exports.pickPreferredRtspEntry = pickPreferredRtspEntry;
+exports.pickVideoEncoder = pickVideoEncoder;
 exports.pickerForCondition = pickerForCondition;
 exports.pipelineAnalyticsCapability = pipelineAnalyticsCapability;
 exports.pipelineExecutorCapability = pipelineExecutorCapability;
@@ -36293,6 +38315,7 @@ exports.ptzCapability = ptzCapability;
 exports.pythonScriptForBackend = pythonScriptForBackend;
 exports.readDetailCropConvention = readDetailCropConvention;
 exports.readDeviceStateFrom = readDeviceStateFrom;
+exports.readNativeLeaseOverride = readNativeLeaseOverride;
 exports.readNodePin = require_sleep.readNodePin;
 exports.readinessKey = require_sleep.readinessKey;
 exports.rebootCapability = rebootCapability;
@@ -36308,6 +38331,7 @@ exports.resolveCapMount = require_sleep.resolveCapMount;
 exports.resolveDetectionRuntime = resolveDetectionRuntime;
 exports.resolveDeviceControlKind = resolveDeviceControlKind;
 exports.resolveDeviceProfile = resolveDeviceProfile;
+exports.resolveEgressDecodeHwAccel = resolveEgressDecodeHwAccel;
 exports.resolveFormat = resolveFormat;
 exports.resolveHydratedFieldValue = require_sleep.resolveHydratedFieldValue;
 exports.resolveModelFormat = resolveModelFormat;
@@ -36342,8 +38366,10 @@ exports.streamParamsCapability = streamParamsCapability;
 exports.streamPixels = streamPixels;
 exports.streamQualityLabel = streamQualityLabel;
 exports.subKindsOf = subKindsOf;
+exports.summarisePrivacyAudio = summarisePrivacyAudio;
 exports.supportedRuntimes = supportedRuntimes;
 exports.switchCapability = switchCapability;
+exports.switchedOffIds = switchedOffIds;
 exports.synthesizeSourceInfo = synthesizeSourceInfo;
 exports.systemCapability = systemCapability;
 exports.tamperCapability = tamperCapability;
@@ -36355,6 +38381,7 @@ exports.terminalSessionCapability = terminalSessionCapability;
 exports.textToHtml = textToHtml;
 exports.toDeviceSummary = toDeviceSummary;
 exports.toExpressionValue = toExpressionValue;
+exports.toNodeId = require_sleep.toNodeId;
 exports.toStreamSourceEntry = toStreamSourceEntry;
 exports.toastCapability = toastCapability;
 exports.tokenize = tokenize;