@camstack/types 1.2.42 → 1.2.43

package/dist/interfaces/camera-switches.d.ts

@@ -5,7 +5,7 @@
  * ## This file adds no state
  *
  * Every switch here is a VIEW onto an authority that already existed
- * ([D61](../../../../docs/decisions/adr-0062.md)). The whole point of the
+ * ([D62](../../../../docs/decisions/adr-0062.md)). The whole point of the
  * group is that there is exactly one place each function is turned off, and
  * the group routes to it:
  *
@@ -16,6 +16,40 @@
  * | `audio-analysis` | `deviceManager.setWrapperActive('audio-analysis')` | `AudioSubscriptionController.subscribeAudioStream` returns `null` before opening the stream |
  * | `recording` | `recording.setDeviceConfig` → `RecordingConfig.enabled` | `band-decision.shouldRecord` returns false; the controller detaches the device |
  * | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
+ * | `privacy-mask` | `privacyMask.setMask({ enabled })` → the CAMERA | the camera blanks the masked regions itself; every stream and recording carries the black boxes |
+ * | `device-audio` | `privacyMask.setAudioEnabled` → the CAMERA | the camera stops encoding an audio track at all; every consumer sees silent video |
+ *
+ * ## The two switches whose authority is not on this server
+ *
+ * `privacy-mask` and `device-audio` write the CAMERA. That is not a loophole
+ * in "the group stores nothing" — it is the purest form of it: the camera
+ * holds the fact, every read is a read-through, and there is no server-side
+ * copy that could drift. Their availability therefore cannot come from
+ * `listBindableCapsForDeviceType` (a device-NATIVE cap carries no wrappers and
+ * is filtered out there); it comes from the cap's own camera-probed
+ * `privacyMask.getOptions()`, which is strictly more honest — it answers for
+ * THIS camera rather than for the device type
+ * ([D74](../../../../docs/decisions/adr-0074.md)).
+ *
+ * ## `privacy-mask` is the one row whose ON is not "the function is working"
+ *
+ * Every other switch means *this camera's function is doing its job*, so
+ * `enabled: false` is a thing an operator took away. `privacy-mask` means **the
+ * MASK is active** — `enabled: true` is video deliberately obscured. The
+ * polarity is not a choice made here: `addon-export-hap`'s privacy `Switch`
+ * (`builders/privacy-switch.ts`) already mirrors `patch.enabled` verbatim, and
+ * a HomeKit toggle that disagreed with the app's toggle for the same camera is
+ * worse than either surface not having one.
+ *
+ * Two consequences follow and both are load-bearing:
+ *
+ * - **It never counts as `switchedOff`.** `countsAsSwitchedOff` is `false` for
+ *   exactly this row. With the polarity above, every camera that has NOT drawn
+ *   a privacy mask would otherwise report `switchedOff: ['privacy-mask']` — the
+ *   normal, healthy state of most cameras rendered as an operator disablement.
+ * - **Its cost line names BOTH directions.** `costWhenOff` is rendered
+ *   unconditionally by both clients, so for this row it has to read correctly
+ *   whichever way the switch is sitting.
  *
  * The wrapper-binding pair is not a new idea: `legacy-migrations.ts` already
  * migrated the legacy `audioEnabled` / `pipelineEnabled` /
@@ -35,20 +69,34 @@
  */
 import { z } from 'zod';
 /**
- * The five functions the operator named (2026-08-05). Deliberately NOT one id
- * per pipeline step: face recognition and plate/LPR are per-step toggles on
+ * The functions the operator named — five on 2026-08-05, plus the camera's own
+ * microphone on 2026-08-07. Deliberately NOT one id per pipeline step: face
+ * recognition and plate/LPR are per-step toggles on
  * `pipelineOrchestrator.setCameraStepToggle` and belong in the pipeline
- * editor, not in a five-button safety group.
+ * editor, not in a safety group.
  */
 export declare const CameraSwitchIdSchema: z.ZodEnum<{
+    "privacy-mask": "privacy-mask";
     "audio-analysis": "audio-analysis";
     recording: "recording";
     "stream-broker": "stream-broker";
     notifications: "notifications";
     "object-detection": "object-detection";
+    "device-audio": "device-audio";
 }>;
 export type CameraSwitchId = z.infer<typeof CameraSwitchIdSchema>;
-/** Stable render order — broadest blast radius first. */
+/**
+ * Stable render order — broadest blast radius first, and a source before the
+ * thing that consumes it. `device-audio` sits ABOVE `audio-analysis` because
+ * turning the microphone off leaves the analyzer with nothing to analyse; the
+ * reverse is not true.
+ *
+ * `privacy-mask` sits directly ABOVE `device-audio` because they are literal
+ * siblings — one cap, one device plane, video then audio — and NOT above
+ * `object-detection` despite feeding it: a mask blanks REGIONS, so its blast
+ * radius is partial, and the "broadest first" rule does not rank a partial
+ * control above a whole-function one.
+ */
 export declare const CAMERA_SWITCH_ORDER: readonly CameraSwitchId[];
 /**
  * WHERE the switch's state actually lives. A discriminated union rather than a
@@ -65,6 +113,12 @@ export declare const CameraSwitchAuthoritySchema: z.ZodDiscriminatedUnion<[z.Zod
     kind: z.ZodLiteral<"recording-config">;
 }, z.core.$strip>, z.ZodObject<{
     kind: z.ZodLiteral<"notification-mute">;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"camera-audio">;
+    capName: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"camera-mask">;
+    capName: z.ZodString;
 }, z.core.$strip>], "kind">;
 export type CameraSwitchAuthority = z.infer<typeof CameraSwitchAuthoritySchema>;
 /**
@@ -75,6 +129,7 @@ export type CameraSwitchAuthority = z.infer<typeof CameraSwitchAuthoritySchema>;
 export declare const CameraSwitchUnavailableReasonSchema: z.ZodEnum<{
     "no-provider": "no-provider";
     "source-unreachable": "source-unreachable";
+    "not-configured": "not-configured";
 }>;
 export type CameraSwitchUnavailableReason = z.infer<typeof CameraSwitchUnavailableReasonSchema>;
 /**
@@ -87,11 +142,13 @@ export type CameraSwitchUnavailableReason = z.infer<typeof CameraSwitchUnavailab
  */
 export declare const CameraSwitchSchema: z.ZodObject<{
     id: z.ZodEnum<{
+        "privacy-mask": "privacy-mask";
         "audio-analysis": "audio-analysis";
         recording: "recording";
         "stream-broker": "stream-broker";
         notifications: "notifications";
         "object-detection": "object-detection";
+        "device-audio": "device-audio";
     }>;
     label: z.ZodString;
     costWhenOff: z.ZodString;
@@ -99,6 +156,7 @@ export declare const CameraSwitchSchema: z.ZodObject<{
     unavailableReason: z.ZodOptional<z.ZodEnum<{
         "no-provider": "no-provider";
         "source-unreachable": "source-unreachable";
+        "not-configured": "not-configured";
     }>>;
     enabled: z.ZodBoolean;
     authority: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -110,6 +168,12 @@ export declare const CameraSwitchSchema: z.ZodObject<{
         kind: z.ZodLiteral<"recording-config">;
     }, z.core.$strip>, z.ZodObject<{
         kind: z.ZodLiteral<"notification-mute">;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"camera-audio">;
+        capName: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"camera-mask">;
+        capName: z.ZodString;
     }, z.core.$strip>], "kind">;
 }, z.core.$strip>;
 export type CameraSwitch = z.infer<typeof CameraSwitchSchema>;
@@ -118,11 +182,13 @@ export declare const CameraSwitchGroupSchema: z.ZodObject<{
     deviceId: z.ZodNumber;
     switches: z.ZodReadonly<z.ZodArray<z.ZodObject<{
         id: z.ZodEnum<{
+            "privacy-mask": "privacy-mask";
             "audio-analysis": "audio-analysis";
             recording: "recording";
             "stream-broker": "stream-broker";
             notifications: "notifications";
             "object-detection": "object-detection";
+            "device-audio": "device-audio";
         }>;
         label: z.ZodString;
         costWhenOff: z.ZodString;
@@ -130,6 +196,7 @@ export declare const CameraSwitchGroupSchema: z.ZodObject<{
         unavailableReason: z.ZodOptional<z.ZodEnum<{
             "no-provider": "no-provider";
             "source-unreachable": "source-unreachable";
+            "not-configured": "not-configured";
         }>>;
         enabled: z.ZodBoolean;
         authority: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -141,6 +208,12 @@ export declare const CameraSwitchGroupSchema: z.ZodObject<{
             kind: z.ZodLiteral<"recording-config">;
         }, z.core.$strip>, z.ZodObject<{
             kind: z.ZodLiteral<"notification-mute">;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"camera-audio">;
+            capName: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"camera-mask">;
+            capName: z.ZodString;
         }, z.core.$strip>], "kind">;
     }, z.core.$strip>>>;
     fetchedAt: z.ZodNumber;
@@ -154,12 +227,32 @@ export type CameraSwitchGroup = z.infer<typeof CameraSwitchGroupSchema>;
  */
 export declare const DETECTION_PIPELINE_CAP_NAME = "detection-pipeline";
 export declare const AUDIO_ANALYSIS_CAP_NAME = "audio-analysis";
+/**
+ * The device-NATIVE cap that owns what the camera does not capture — masked
+ * video regions and, since 2026-08-07, the microphone. Named here because the
+ * `camera-audio` authority, the orchestrator's gather and the fake harness all
+ * have to agree on it.
+ */
+export declare const PRIVACY_MASK_CAP_NAME = "privacy-mask";
 /** Static half of a switch: everything that does not depend on a device. */
 export interface CameraSwitchDescriptor {
     readonly id: CameraSwitchId;
     readonly label: string;
     readonly costWhenOff: string;
     readonly authority: CameraSwitchAuthority;
+    /**
+     * May `enabled: false` on this row appear in {@link switchedOffIds}?
+     *
+     * `true` for every switch that means "this camera's function is doing its
+     * job", where OFF is something a person took away and a status surface must
+     * render as disabled rather than broken.
+     *
+     * `false` for `privacy-mask` alone, and only because its polarity is
+     * inverted: OFF there means the mask is not obscuring anything, which is the
+     * ordinary state of nearly every camera. Reporting it would put a
+     * `switchedOff` badge on healthy cameras and drown the badge that matters.
+     */
+    readonly countsAsSwitchedOff: boolean;
 }
 /**
  * THE catalog. One entry per switch; the cost lines are the operator-facing
@@ -195,6 +288,65 @@ export interface CameraSwitchDerivationInput {
     readonly recordingEnabled: boolean | null;
     /** `notificationRules` per-camera mute; `null` when the cap did not answer. */
     readonly notificationsMuted: boolean | null;
+    /**
+     * The camera's own microphone, read through the `privacy-mask` native cap.
+     * `null` = the cap is bound to this camera but did not answer.
+     *
+     * A camera with no `privacy-mask` provider at all is `{ supported: false }`,
+     * not `null` — "this camera has no such control" and "we could not read it"
+     * are different answers and the operator is shown different copy for each.
+     */
+    readonly deviceAudio: DeviceAudioSwitchState | null;
+    /**
+     * The camera's own VIDEO privacy mask, read through the same `privacy-mask`
+     * native cap and the same pair of round trips as {@link deviceAudio} — one
+     * `getOptions` + one `getStatus` answer both, so the second switch is free.
+     *
+     * `null` = the cap is bound to this camera but did not answer.
+     */
+    readonly privacyMask: PrivacyMaskSwitchState | null;
+}
+/** What the camera-probed audio switch reported for one camera. */
+export interface DeviceAudioSwitchState {
+    /**
+     * `privacyMask.getOptions().supportsAudioMute` — camera-probed, never a
+     * device-type guess. A camera that does not expose the control renders no
+     * switch rather than a toggle that silently does nothing.
+     */
+    readonly supported: boolean;
+    /**
+     * `privacyMask.getStatus().audioEnabled` — the camera's current answer.
+     * `null` when unsupported, or when supported but unreadable; the second
+     * case yields `source-unreachable`, never a control defaulted to "on".
+     */
+    readonly enabled: boolean | null;
+}
+/** What the camera-probed VIDEO privacy mask reported for one camera. */
+export interface PrivacyMaskSwitchState {
+    /**
+     * Can this camera store privacy zones at all? Derived from the probed
+     * `getOptions()`: `maxRegions > 0` AND at least one supported shape kind.
+     * Reolink answers `maxNum: 0` / `supportedShapes: []` honestly on models
+     * that cannot, and that must render no control rather than a toggle whose
+     * write the camera discards.
+     */
+    readonly supported: boolean;
+    /**
+     * How many zones are actually drawn on the camera right now
+     * (`getStatus().regions.length`). `null` = supported, but the status could
+     * not be read.
+     *
+     * **Zero is not "off", it is "nothing to switch".** Toggling the master
+     * enable with no zones changes not one pixel — the dead control D62 exists
+     * to remove — so it resolves to `not-configured`, which tells the operator
+     * to go and draw one instead of leaving them pressing a button.
+     */
+    readonly configuredRegions: number | null;
+    /**
+     * `getStatus().enabled` — the camera's master mask flag, `true` when the
+     * zones are being blanked. `null` when unreadable; never defaulted.
+     */
+    readonly enabled: boolean | null;
 }
 /**
  * Pure derivation of the whole group. No I/O — the orchestrator gathers, this
@@ -213,5 +365,11 @@ export declare function deriveCameraSwitches(input: CameraSwitchDerivationInput)
  * `switchedOff: ['object-detection']` was turned off; the same camera with an
  * empty list is broken. Unavailable switches never appear — a function nobody
  * provides was not switched off by anyone.
+ *
+ * `privacy-mask` never appears either, whichever way it is sitting, because its
+ * ON means "the mask is active" rather than "the function works"
+ * ({@link CameraSwitchDescriptor.countsAsSwitchedOff}). Without that filter the
+ * ordinary state of every camera nobody has masked would carry a
+ * "switched off" badge, and the badge that matters would be lost in it.
  */
 export declare function switchedOffIds(switches: readonly CameraSwitch[]): readonly CameraSwitchId[];

package/dist/interfaces/inference-engine.d.ts

@@ -16,16 +16,36 @@ import type { RawFrameFormat } from '../types/io.js';
  * raw buffer to JPEG internally rather than throwing — `infer()` must
  * always succeed for either kind.
  */
-export type InferenceInput = {
+/**
+ * Fields every `InferenceInput` variant carries regardless of pixel transport.
+ */
+interface InferenceInputCommon {
+    /**
+     * The camera this frame belongs to — **diagnostic only**. It changes no
+     * dispatch decision, no deadline and no shed rule; it exists so an inference
+     * failure inside a SHARED pool can name the camera that paid for it.
+     *
+     * A `SharedInferencePool` serves every camera on its
+     * `(node, runtime, device)`, so its `inference request timed out` and
+     * `worker saturated` lines could describe the pool and nothing else — and
+     * "why is 617 worse than 615?" is the question those lines always get asked.
+     *
+     * Omitted by callers with no camera (commands, model loads, the benchmark);
+     * the failure line then carries no `deviceId` tag rather than a fabricated
+     * one.
+     */
+    readonly deviceId?: number;
+}
+export type InferenceInput = ({
     readonly kind: 'jpeg';
     readonly data: Buffer;
-} | {
+} & InferenceInputCommon) | ({
     readonly kind: 'raw';
     readonly data: Buffer;
     readonly width: number;
     readonly height: number;
     readonly format: RawFrameFormat;
-};
+} & InferenceInputCommon);
 export interface IInferenceEngine {
     readonly runtime: DetectionRuntime;
     readonly device: DetectionDevice;
@@ -34,3 +54,4 @@ export interface IInferenceEngine {
     run?(input: Float32Array, inputShape: readonly number[]): Promise<Float32Array>;
     dispose(): Promise<void>;
 }
+export {};

package/dist/pipeline/native-lease.d.ts

@@ -0,0 +1,150 @@
+/**
+ * THE native-frame **lease** knobs — TTL, RAM budget and demand window for the
+ * decode worker's native-resolution frame retention.
+ *
+ * ## Why they live here and not in the addon that reads them
+ *
+ * The WRITER is `pipeline-orchestrator` (the cluster-wide settings authority);
+ * the READER is a private child process of `addon-pipeline`'s pipeline-runner.
+ * Addons never import each other, so a key owned by either side would have to
+ * be hand-copied by the other — and a hand-copied key is how a setting silently
+ * stops arriving while both sides still look correct. Same reasoning, same
+ * placement as `detail-crop.ts` (D52's "one cluster-wide orchestrator setting").
+ *
+ * ## Why cluster-wide and not per-node
+ *
+ * The lease is a per-decode-worker RAM window. Its purpose — the late
+ * cross-process native crop landing on a full-resolution frame rather than the
+ * ≤640 detection fallback — is a property of the PIPELINE, not of a node's
+ * hardware: a per-node TTL would mean the same camera produces different crop
+ * quality depending on which node the balancer placed it on, and nobody could
+ * tell that from the stored media. Node-level RAM pressure is already handled
+ * by the per-session budget ceiling, which is itself one of these knobs.
+ *
+ * ## What each knob costs
+ *
+ * A retained frame is a full NATIVE-resolution copy in system RAM. With the
+ * default pinned-RGB24 lease path (`CAMSTACK_SESSION_PINNED_RGB_CROP`, on):
+ * 4K ≈ 24.9 MB/frame, 1080p ≈ 6.2 MB/frame. On the YUV420P path (flag off, and
+ * for software-decoded sessions): 4K ≈ 12.4 MB, 1080p ≈ 3.1 MB. Worst-case
+ * resident RAM for ONE busy camera ≈ frameBytes × deliveredFps × ttlSeconds,
+ * clamped by the budget ceiling. See `docs/design/decode-path.md` → "Lease
+ * admission" for what actually gets admitted.
+ */
+import { z } from 'zod';
+import type { HydratedSettingsView } from './detail-crop.js';
+/**
+ * Store identity of the lease knobs in `pipeline-orchestrator`'s GLOBAL
+ * (cluster-wide) settings. Keys are unique across that addon's whole schema, so
+ * the reader can walk every section instead of trusting the section id.
+ */
+export declare const NATIVE_LEASE_SECTION_ID = "native-lease";
+export declare const NATIVE_LEASE_TTL_KEY = "nativeLeaseTtlMs";
+export declare const NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
+export declare const NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
+export declare const NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
+/**
+ * WHICH delivered frames the decode worker retains a native copy of.
+ *
+ * - `all` — every frame the worker delivered to the runner. The shipped
+ *   behaviour, and the only correct one if something can ask for a crop of a
+ *   frame the runner never sent to inference.
+ * - `inferred` — only the frames the runner ADMITTED to its detection queue.
+ *   A native-crop request always names a `frameId` that rode an inference
+ *   result, so that is the only set a request can name. How much it drops is
+ *   the two-plane governor's admit ratio and nothing else: measured at ~50% on
+ *   this cluster, not the ~80% the design sketch assumed, because the governor
+ *   was not throttling as hard as the sketch supposed. Read
+ *   `leaseAdmitted`/`leaseOffered` off the metrics line for the camera in front
+ *   of you rather than quoting a number from here. The newest delivered frame is
+ *   croppable regardless — it is still the worker's reserved slot, not a lease —
+ *   which covers the one-frame race between a mark and the supersede that
+ *   consumes it.
+ */
+export declare const NativeLeaseAdmissionSchema: z.ZodEnum<{
+    all: "all";
+    inferred: "inferred";
+}>;
+export type NativeLeaseAdmission = z.infer<typeof NativeLeaseAdmissionSchema>;
+/**
+ * Operator-tunable native-lease settings. Bounds are enforced HERE (not only in
+ * the slider) because the value also travels to a forked child process, where a
+ * junk number would silently become a 0-length or unbounded retention window.
+ */
+export declare const NativeLeaseSettingsSchema: z.ZodObject<{
+    ttlMs: z.ZodNumber;
+    budgetMb: z.ZodNumber;
+    activityMs: z.ZodNumber;
+    admission: z.ZodEnum<{
+        all: "all";
+        inferred: "inferred";
+    }>;
+}, z.core.$strip>;
+export type NativeLeaseSettings = z.infer<typeof NativeLeaseSettingsSchema>;
+/**
+ * The values in force when the operator has set nothing — byte-for-byte the
+ * constants the decode worker shipped with as env-var defaults, so making these
+ * settings changed no behaviour on the day it landed.
+ */
+export declare const DEFAULT_NATIVE_LEASE_SETTINGS: NativeLeaseSettings;
+/**
+ * Only the knobs the operator has ACTUALLY set. Distinguishing "set" from
+ * "absent" is what makes the documented precedence (setting > env > default)
+ * expressible: an absent knob leaves the env-var escape hatch working.
+ */
+export type NativeLeaseSettingsOverride = Partial<NativeLeaseSettings>;
+/** Slider bounds for the operator-facing knobs (orchestrator settings UI). */
+export declare const NATIVE_LEASE_TTL_FIELD: {
+    readonly min: 250;
+    readonly max: 10000;
+    readonly step: 50;
+    readonly default: number;
+};
+export declare const NATIVE_LEASE_BUDGET_FIELD: {
+    readonly min: 0;
+    readonly max: 4096;
+    readonly step: 64;
+    readonly default: number;
+};
+export declare const NATIVE_LEASE_ACTIVITY_FIELD: {
+    readonly min: 0;
+    readonly max: 120000;
+    readonly step: 1000;
+    readonly default: number;
+};
+/** Select options for the admission knob (orchestrator settings UI). */
+export declare const NATIVE_LEASE_ADMISSION_FIELD: {
+    readonly options: readonly [{
+        readonly value: "all";
+        readonly label: "Every delivered frame";
+    }, {
+        readonly value: "inferred";
+        readonly label: "Only frames sent to inference";
+    }];
+    readonly default: "all" | "inferred";
+};
+/** The four knobs, as a key union. */
+export type NativeLeaseKnob = keyof NativeLeaseSettings;
+/** The three knobs whose value is a bounded integer (everything but `admission`). */
+export type NativeLeaseNumberKnob = 'ttlMs' | 'budgetMb' | 'activityMs';
+/**
+ * Narrow a FLAT settings record to the knobs the operator set.
+ *
+ * Per-FIELD parse, deliberately: a junk TTL must not also discard a valid
+ * budget. An absent, out-of-bounds or default-valued knob is OMITTED (not
+ * clamped, not defaulted) so the caller can still fall through to the env
+ * override — clamping here would turn a typo into a value nobody chose. See
+ * {@link readKnob} for why the default counts as unset.
+ */
+export declare function readNativeLeaseOverride(config: Readonly<Record<string, unknown>>): NativeLeaseSettingsOverride;
+/**
+ * Extract the operator's lease overrides from an
+ * `addon-settings.getGlobalSettings` payload.
+ *
+ * Walks EVERY section rather than looking inside {@link NATIVE_LEASE_SECTION_ID}
+ * alone: the keys are unique across the addon's schema, and a section rename
+ * must not silently revert the whole cluster to the defaults. A `null` payload
+ * (addon mid-boot) means "operator set nothing" — the env/default fallback then
+ * applies, which is the correct read of "I could not ask".
+ */
+export declare function pickNativeLeaseOverride(view: HydratedSettingsView | null): NativeLeaseSettingsOverride;

package/dist/{sleep-Cvi1JxZp.js → sleep-Bx9IIoT0.js}

@@ -1934,9 +1934,38 @@ var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
 /**
 * Build the tRPC request options that pin a single capability call to `nodeId`.
 * Pass as the second argument to `.query(input, …)` / `.mutate(input, …)`.
+*
+* ## The id is normalised here, and it has to be
+*
+* A forked addon reads its own node from `ctx.kernel.localNodeId`, and inside a
+* worker that value is a RUNNER id — `hub/export-hap`, not `hub`. Routing
+* compares a pin against real node ids, so such a pin matches nothing and the
+* call fails with `no provider registered for cap "…"`. The local-first
+* resolver already guarded against this (`localNodeId.split('/')[0]`), which
+* made the hazard invisible: unpinned calls worked, and only an explicit pin —
+* the thing you reach for when you specifically need THIS node — silently
+* addressed a node that does not exist.
+*
+* Cost of it being missing: `addon-export-hap` pinned `decoder.getInfo` to its
+* own node to read the host's hardware-decode backend. It never once answered,
+* so every HomeKit egress transcode decoded in SOFTWARE — including 4K H.265 —
+* while D67's whole premise was that the decoder addon is the authority on
+* hardware. The warn said `decoding in SOFTWARE` and read as "this node has no
+* hardware", which was false.
+*
+* Normalising in the ONE constructor fixes every caller at once, which is why
+* it is here and not at the call sites.
 */
 function nodePin(nodeId) {
-	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: nodeId } };
+	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: toNodeId(nodeId) } };
+}
+/**
+* A runner id is `<nodeId>/<addonId>`; a node id has no slash. Taking the head
+* is idempotent, so passing an already-clean id costs nothing.
+*/
+function toNodeId(idOrRunnerId) {
+	const head = idOrRunnerId.split("/")[0];
+	return head === void 0 || head.length === 0 ? idOrRunnerId : head;
 }
 /**
 * Read a per-call node pin out of a tRPC `op.context` (transport side).
@@ -3180,6 +3209,7 @@ function createDeviceProxy(api, binding, opts) {
 		privacyMask: {
 			getOptions: (input) => dispatch("privacy-mask", "privacyMask", "getOptions", "query", input),
 			setMask: (input) => dispatch("privacy-mask", "privacyMask", "setMask", "mutation", input),
+			setAudioEnabled: (input) => dispatch("privacy-mask", "privacyMask", "setAudioEnabled", "mutation", input),
 			getStatus: (input) => dispatch("privacy-mask", "privacyMask", "getStatus", "query", input)
 		},
 		ptz: {
@@ -3414,6 +3444,7 @@ function createDeviceProxy(api, binding, opts) {
 			getDeviceConfig: (input) => dispatchSystem("recording", "getDeviceConfig", "query", input),
 			locateSegment: (input) => dispatchSystem("recording", "locateSegment", "query", input),
 			readSegmentBytes: (input) => dispatchSystem("recording", "readSegmentBytes", "query", input),
+			readGopBytes: (input) => dispatchSystem("recording", "readGopBytes", "query", input),
 			setDeviceConfig: (input) => dispatchSystem("recording", "setDeviceConfig", "mutation", input),
 			rescanStorage: (input) => dispatchSystem("recording", "rescanStorage", "mutation", input),
 			pruneFootage: (input) => dispatchSystem("recording", "pruneFootage", "mutation", input),
@@ -4129,6 +4160,12 @@ Object.defineProperty(exports, "systemMethod", {
 		return systemMethod;
 	}
 });
+Object.defineProperty(exports, "toNodeId", {
+	enumerable: true,
+	get: function() {
+		return toNodeId;
+	}
+});
 Object.defineProperty(exports, "viewerUiCapability", {
 	enumerable: true,
 	get: function() {

package/dist/{sleep-BmNKsY7v.mjs → sleep-DtstvzWm.mjs}

@@ -1934,9 +1934,38 @@ var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
 /**
 * Build the tRPC request options that pin a single capability call to `nodeId`.
 * Pass as the second argument to `.query(input, …)` / `.mutate(input, …)`.
+*
+* ## The id is normalised here, and it has to be
+*
+* A forked addon reads its own node from `ctx.kernel.localNodeId`, and inside a
+* worker that value is a RUNNER id — `hub/export-hap`, not `hub`. Routing
+* compares a pin against real node ids, so such a pin matches nothing and the
+* call fails with `no provider registered for cap "…"`. The local-first
+* resolver already guarded against this (`localNodeId.split('/')[0]`), which
+* made the hazard invisible: unpinned calls worked, and only an explicit pin —
+* the thing you reach for when you specifically need THIS node — silently
+* addressed a node that does not exist.
+*
+* Cost of it being missing: `addon-export-hap` pinned `decoder.getInfo` to its
+* own node to read the host's hardware-decode backend. It never once answered,
+* so every HomeKit egress transcode decoded in SOFTWARE — including 4K H.265 —
+* while D67's whole premise was that the decoder addon is the authority on
+* hardware. The warn said `decoding in SOFTWARE` and read as "this node has no
+* hardware", which was false.
+*
+* Normalising in the ONE constructor fixes every caller at once, which is why
+* it is here and not at the call sites.
 */
 function nodePin(nodeId) {
-	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: nodeId } };
+	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: toNodeId(nodeId) } };
+}
+/**
+* A runner id is `<nodeId>/<addonId>`; a node id has no slash. Taking the head
+* is idempotent, so passing an already-clean id costs nothing.
+*/
+function toNodeId(idOrRunnerId) {
+	const head = idOrRunnerId.split("/")[0];
+	return head === void 0 || head.length === 0 ? idOrRunnerId : head;
 }
 /**
 * Read a per-call node pin out of a tRPC `op.context` (transport side).
@@ -3180,6 +3209,7 @@ function createDeviceProxy(api, binding, opts) {
 		privacyMask: {
 			getOptions: (input) => dispatch("privacy-mask", "privacyMask", "getOptions", "query", input),
 			setMask: (input) => dispatch("privacy-mask", "privacyMask", "setMask", "mutation", input),
+			setAudioEnabled: (input) => dispatch("privacy-mask", "privacyMask", "setAudioEnabled", "mutation", input),
 			getStatus: (input) => dispatch("privacy-mask", "privacyMask", "getStatus", "query", input)
 		},
 		ptz: {
@@ -3414,6 +3444,7 @@ function createDeviceProxy(api, binding, opts) {
 			getDeviceConfig: (input) => dispatchSystem("recording", "getDeviceConfig", "query", input),
 			locateSegment: (input) => dispatchSystem("recording", "locateSegment", "query", input),
 			readSegmentBytes: (input) => dispatchSystem("recording", "readSegmentBytes", "query", input),
+			readGopBytes: (input) => dispatchSystem("recording", "readGopBytes", "query", input),
 			setDeviceConfig: (input) => dispatchSystem("recording", "setDeviceConfig", "mutation", input),
 			rescanStorage: (input) => dispatchSystem("recording", "rescanStorage", "mutation", input),
 			pruneFootage: (input) => dispatchSystem("recording", "pruneFootage", "mutation", input),
@@ -3661,4 +3692,4 @@ function sleepCancellable(ms, signal) {
 	});
 }
 //#endregion
-export { ProfileRtspEntrySchema as $, method as A, scopeKey as B, DeviceType as C, collectHydratedFieldValues as Ct, event as D, DEVICE_STATUS_METHOD as E, readNodePin as F, CamStreamKindSchema as G, BrokerStatusSchema as H, ReadinessRegistry as I, DecodedAudioChunkSchema as J, CamStreamResolutionSchema as K, ReadinessTimeoutError as L, systemMethod as M, CAP_NODE_PIN_CONTEXT_KEY as N, expandCapMethods as O, nodePin as P, FrameHandleSchema as Q, emitDownForOwnedCaps as R, DeviceRole as S, collectHydratedFieldEntries as St, DEVICE_SETTINGS_CONTRIBUTION_METHODS as T, resolveHydratedFieldValue as Tt, CAM_PROFILE_ORDER as U, BrokerStatsSchema as V, CamProfileSchema as W, EncodedPacketSchema as X, DecodedFrameSchema as Y, FrameHandleFormatSchema as Z, RawStateResultSchema as _, createEvent as _t, asJsonObject as a, SubscribeAudioChunksResultSchema as at, ChargingStatus as b, WELL_KNOWN_TABS as bt, parseJsonArray as c, makeProfileBrokerId as ct, DEVICE_SCOPED_CAPS as d, selectAssignedProfileSlots as dt, ProfileSlotSchema as et, isDeviceScopedCap as f, DATAPLANE_SECRET_HEADER as ft, createSliceHandle as g, createDurableState as gt, createMirrorSource as h, normalizeAddonInitResult as ht, asJsonArray as i, SubscribeAudioChunksInputSchema as it, resolveCapMount as j, isDeviceConfigCap as k, parseJsonObject as l, makeSourceBrokerId as lt, createLazyTrpcSource as m, BaseAddon as mt, sleepCancellable as n, StreamSourceEntrySchema$1 as nt, asNumber as o, SubscribeFramesInputSchema as ot, createDeviceProxy as p, DisposerChain as pt, CameraStreamSchema as q, asBoolean as r, StreamSourceSchema as rt, asString as s, SubscribeFramesResultSchema as st, sleep as t, ProfileSlotStatusSchema as tt, parseJsonUnknown as u, parseProfileBrokerId as ut, deviceOpsCapability as v, emitReadiness as vt, adminUiCapability as w, hydrateSchema as wt, DeviceFeature as x, WELL_KNOWN_TAB_MAP as xt, viewerUiCapability as y, isEvent as yt, readinessKey as z };
+export { FrameHandleSchema as $, method as A, readinessKey as B, DeviceType as C, collectHydratedFieldEntries as Ct, event as D, DEVICE_STATUS_METHOD as E, resolveHydratedFieldValue as Et, readNodePin as F, CamProfileSchema as G, BrokerStatsSchema as H, toNodeId as I, CameraStreamSchema as J, CamStreamKindSchema as K, ReadinessRegistry as L, systemMethod as M, CAP_NODE_PIN_CONTEXT_KEY as N, expandCapMethods as O, nodePin as P, FrameHandleFormatSchema as Q, ReadinessTimeoutError as R, DeviceRole as S, WELL_KNOWN_TAB_MAP as St, DEVICE_SETTINGS_CONTRIBUTION_METHODS as T, hydrateSchema as Tt, BrokerStatusSchema as U, scopeKey as V, CAM_PROFILE_ORDER as W, DecodedFrameSchema as X, DecodedAudioChunkSchema as Y, EncodedPacketSchema as Z, RawStateResultSchema as _, createDurableState as _t, asJsonObject as a, SubscribeAudioChunksInputSchema as at, ChargingStatus as b, isEvent as bt, parseJsonArray as c, SubscribeFramesResultSchema as ct, DEVICE_SCOPED_CAPS as d, parseProfileBrokerId as dt, ProfileRtspEntrySchema as et, isDeviceScopedCap as f, selectAssignedProfileSlots as ft, createSliceHandle as g, normalizeAddonInitResult as gt, createMirrorSource as h, BaseAddon as ht, asJsonArray as i, StreamSourceSchema as it, resolveCapMount as j, isDeviceConfigCap as k, parseJsonObject as l, makeProfileBrokerId as lt, createLazyTrpcSource as m, DisposerChain as mt, sleepCancellable as n, ProfileSlotStatusSchema as nt, asNumber as o, SubscribeAudioChunksResultSchema as ot, createDeviceProxy as p, DATAPLANE_SECRET_HEADER as pt, CamStreamResolutionSchema as q, asBoolean as r, StreamSourceEntrySchema$1 as rt, asString as s, SubscribeFramesInputSchema as st, sleep as t, ProfileSlotSchema as tt, parseJsonUnknown as u, makeSourceBrokerId as ut, deviceOpsCapability as v, createEvent as vt, adminUiCapability as w, collectHydratedFieldValues as wt, DeviceFeature as x, WELL_KNOWN_TABS as xt, viewerUiCapability as y, emitReadiness as yt, emitDownForOwnedCaps as z };

package/dist/utils/addon-id.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The addon id as the REGISTRY, the wire and the durable stores spell it.
+ *
+ * `AddonContext.id` does not agree with itself across the two context
+ * factories:
+ *
+ *   - a FORKED addon gets the bare manifest id
+ *     (`kernel/moleculer/addon-context-factory.ts` → `id: addonId`);
+ *   - an addon co-located in hub-main gets it PREFIXED
+ *     (`server/backend/src/core/addon/addon-registry.service.ts` →
+ *      ``id: `addon:${addonId}` ``).
+ *
+ * Everything an addon might compare `ctx.id` AGAINST carries the bare form:
+ * `DeviceBindingEntry.providerAddonId`, the `device-manager` bindings store's
+ * `wrapperAddonId`, `CapabilityRegistry` provider keys, manifest ids.
+ *
+ * So `entry.providerAddonId === this.ctx.id` is silently, permanently false
+ * for a builtin — and only for a builtin, which is why it survives a green
+ * suite whose fake supplies the bare id. That is exactly how camera 615's
+ * virtual doorbell latched `unbound` for twelve hours on 2026-08-07 while its
+ * binding was intact ([D72](../../../../docs/decisions/adr-0072.md)).
+ *
+ * Route every comparison between `ctx.id` and a registry/store addon id
+ * through {@link isSameAddonId}. `scripts/check-addon-id-comparison.ts`
+ * enforces it in the processes where the prefix exists.
+ */
+/** The manifest id, whichever spelling of `ctx.id` you were handed. */
+export declare function bareAddonId(id: string): string;
+/** True when both ids name the same addon, prefixed or not. */
+export declare function isSameAddonId(a: string, b: string): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/types",
-  "version": "1.2.42",
+  "version": "1.2.43",
   "description": "Shared types, interfaces, and model catalogs for the CamStack detection ecosystem",
   "keywords": [
     "camstack",