@camstack/types 1.2.42 → 1.2.44

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_event_category = require("./event-category-BE4PDZ_3.js");
-const require_sleep = require("./sleep-Cvi1JxZp.js");
-const require_canonical_hash = require("./canonical-hash-BcZHRHIx.js");
+const require_sleep = require("./sleep-eiC10_cX.js");
+const require_fmp4_box_splitter = require("./fmp4-box-splitter-BkWH7O3L.js");
 const require_enums = require("./enums.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
 let zod = require("zod");
@@ -231,335 +231,6 @@ function encodeProfileFromStreamShape(stream) {
 	};
 }
 //#endregion
-//#region src/ffmpeg/invocation.ts
-var AUDIO_ENCODER_BY_CODEC = {
-	opus: "libopus",
-	aac: "aac",
-	pcmu: "pcm_mulaw",
-	pcma: "pcm_alaw"
-};
-/**
-* Camera-microphone audio, per codec. Lives HERE rather than in
-* `encode-defaults.ts` only to avoid an import cycle (`encode-defaults` depends
-* on these types); it is re-exported from there, which is where to read it.
-*
-* Every source in this repo is a mono camera mic. The former broker preset
-* encoded Opus at `channels: 2`, spending bitrate duplicating one channel —
-* that is the value this consolidation changed.
-*/
-var AUDIO_PRESETS = {
-	aac: {
-		kind: "encode",
-		codec: "aac",
-		bitrateKbps: 128,
-		sampleRateHz: 48e3,
-		channels: 1
-	},
-	opus: {
-		kind: "encode",
-		codec: "opus",
-		bitrateKbps: 64,
-		sampleRateHz: 48e3,
-		channels: 1
-	},
-	pcmu: {
-		kind: "encode",
-		codec: "pcmu",
-		sampleRateHz: 8e3,
-		channels: 1
-	}
-};
-/** `-hide_banner -loglevel <level>` — every ffmpeg site opens with this. */
-function logBannerArgs(level) {
-	return [
-		"-hide_banner",
-		"-loglevel",
-		level
-	];
-}
-/** `true` when the resolved value means "decode in software" (⇒ no `-hwaccel`). */
-function isSoftwareDecode(decodeHwAccel) {
-	return !decodeHwAccel || decodeHwAccel === "none" || decodeHwAccel === "copy";
-}
-/**
-* Every INPUT option, in order, terminated by `-i <url>`. Nothing may be
-* appended to this list by a caller — that is the whole point of the function.
-*/
-function buildInputArgs(input, decodeHwAccel) {
-	const args = [];
-	if (!isSoftwareDecode(decodeHwAccel)) args.push("-hwaccel", String(decodeHwAccel));
-	if (input.extraArgs?.length) args.push(...input.extraArgs);
-	if (input.fflags?.length) for (const flag of input.fflags) args.push("-fflags", flag);
-	if (input.rtspTransport) args.push("-rtsp_transport", input.rtspTransport);
-	args.push("-i", input.url);
-	return args;
-}
-/** The `-vf` filter args, or `[]` when a consumer `-vf` already claims the slot. */
-function buildVideoFilterArgs(scale, outputArgs) {
-	if (!scale) return [];
-	if (outputArgs.some((a) => a === "-vf")) return [];
-	if (scale.mode === "exact") return ["-vf", `scale=${scale.width}:${scale.height}`];
-	return ["-vf", `scale='min(${scale.width},iw)':'min(${scale.height},ih)':force_original_aspect_ratio=decrease:force_divisible_by=2`];
-}
-/** Rate-control args for an encode plan. */
-function buildRateControlArgs(video) {
-	const kbps = video.bitrateKbps;
-	if (kbps === void 0) return [];
-	const rc = video.rateControl ?? {
-		kind: "cap",
-		vbvSeconds: 2
-	};
-	const bufsize = Math.max(1, Math.round(kbps * rc.vbvSeconds));
-	return [
-		...rc.kind === "cbr" ? ["-b:v", `${kbps}k`] : [],
-		"-maxrate",
-		`${kbps}k`,
-		"-bufsize",
-		`${bufsize}k`
-	];
-}
-/** The whole video block (`-vf` … `-c:v` … knobs), after `-i`. */
-function buildVideoArgs(video, outputArgs) {
-	if (video.kind === "copy") return [
-		"-c:v",
-		"copy",
-		...video.bitstreamFilter ? ["-bsf:v", video.bitstreamFilter] : []
-	];
-	const args = [
-		...buildVideoFilterArgs(video.scale, outputArgs),
-		"-c:v",
-		video.encoder
-	];
-	if (video.preset !== void 0) args.push("-preset", video.preset);
-	if (video.tune !== void 0) args.push("-tune", video.tune);
-	if (video.profile !== void 0) args.push("-profile:v", video.profile);
-	if (video.level !== void 0) args.push("-level", video.level);
-	if (video.pixelFormat !== void 0) args.push("-pix_fmt", video.pixelFormat);
-	if (video.fps !== void 0) args.push("-r", String(video.fps));
-	if (video.gopFrames !== void 0) args.push("-g", String(video.gopFrames));
-	if (video.bf !== void 0) args.push("-bf", String(video.bf));
-	args.push(...buildRateControlArgs(video));
-	if (video.bitstreamFilter !== void 0) args.push("-bsf:v", video.bitstreamFilter);
-	return args;
-}
-/** The whole audio block, after `-i`. */
-function buildAudioArgs(audio) {
-	if (audio.kind === "none") return ["-an"];
-	if (audio.kind === "copy") return ["-c:a", "copy"];
-	const args = [];
-	if (audio.filter !== void 0) args.push("-af", audio.filter);
-	args.push("-c:a", AUDIO_ENCODER_BY_CODEC[audio.codec]);
-	if (audio.application !== void 0) args.push("-application", audio.application);
-	if (audio.frameDurationMs !== void 0) args.push("-frame_duration", String(audio.frameDurationMs));
-	if (audio.globalHeader === true) args.push("-flags", "+global_header");
-	if (audio.sampleRateHz !== void 0) args.push("-ar", String(audio.sampleRateHz));
-	if (audio.bitrateKbps !== void 0) args.push("-b:a", `${audio.bitrateKbps}k`);
-	if (audio.vbvBufferKbits !== void 0) args.push("-bufsize", `${audio.vbvBufferKbits}k`);
-	if (audio.channels !== void 0) args.push("-ac", String(audio.channels));
-	return args;
-}
-/** RTP output-leg args (`-payload_type`, `-ssrc`, `-sdp_file`, `-f rtp <url>`). */
-function buildRtpOutputArgs(out) {
-	const args = [];
-	if (out.payloadType !== void 0) args.push("-payload_type", String(out.payloadType));
-	if (out.ssrc !== void 0) args.push("-ssrc", String(out.ssrc));
-	if (out.sdpFile !== void 0) args.push("-sdp_file", out.sdpFile);
-	args.push("-f", "rtp", out.url);
-	return args;
-}
-/** `true` when the sink is a raw elementary bytestream that cannot mux audio. */
-function isElementaryVideoSink(sink) {
-	return sink.kind === "stdout" && (sink.container === "h264" || sink.container === "hevc");
-}
-/**
-* A second output mapping source audio to RTP-over-UDP. `0:a:0?` makes the
-* audio optional so a source with no audio skips it instead of failing the
-* whole invocation.
-*/
-function buildAudioSidecarArgs(sidecar) {
-	return [
-		"-map",
-		"0:a:0?",
-		...buildAudioArgs(sidecar.codec === "pcma" ? {
-			kind: "encode",
-			codec: "pcma",
-			sampleRateHz: 8e3,
-			channels: 1
-		} : AUDIO_PRESETS[sidecar.codec]),
-		...buildRtpOutputArgs({
-			url: sidecar.rtpUrl,
-			sdpFile: sidecar.sdpFile
-		})
-	];
-}
-/**
-* Assemble the full ffmpeg argument list. Layout:
-*
-*   -hide_banner -loglevel <level>
-*   [-hwaccel <backend|auto>]        ─┐ INPUT options — strictly before -i.
-*   [<input.extraArgs>]               │
-*   [-fflags <flag>…]                 │
-*   [-rtsp_transport tcp]             │
-*   -i <url>                         ─┘
-*   <video block>  <threads>  <audio block>   ─┐ OUTPUT options.
-*   <consumer outputArgs verbatim>             │
-*   <sink>                                    ─┘ terminal
-*/
-function buildFfmpegArgs(inv) {
-	const head = [...logBannerArgs(inv.logLevel), ...buildInputArgs(inv.input, inv.decodeHwAccel)];
-	const threadArgs = inv.threadCount > 0 ? ["-threads", String(inv.threadCount)] : [];
-	if (inv.sink.kind === "rtp-outputs") {
-		const videoLeg = inv.sink.video ? [
-			"-an",
-			"-map",
-			"0:v:0",
-			...buildVideoArgs(inv.video, inv.outputArgs),
-			...threadArgs,
-			...inv.outputArgs,
-			...buildRtpOutputArgs(inv.sink.video)
-		] : [];
-		const audioLeg = inv.sink.audio ? [
-			"-vn",
-			"-map",
-			"0:a:0?",
-			...buildAudioArgs(inv.audio),
-			...buildRtpOutputArgs(inv.sink.audio)
-		] : [];
-		return [
-			...head,
-			...videoLeg,
-			...audioLeg
-		];
-	}
-	const audioArgs = isElementaryVideoSink(inv.sink) ? ["-an"] : buildAudioArgs(inv.audio);
-	const sinkArgs = inv.sink.kind === "stdout" ? [
-		"-f",
-		inv.sink.container,
-		"pipe:1"
-	] : [
-		"-f",
-		"rtsp",
-		"-rtsp_transport",
-		"tcp",
-		"-rtsp_flags",
-		"listen",
-		inv.sink.url
-	];
-	return [
-		...head,
-		...buildVideoArgs(inv.video, inv.outputArgs),
-		...threadArgs,
-		...audioArgs,
-		...inv.outputArgs,
-		...sinkArgs,
-		...inv.audioSidecar ? buildAudioSidecarArgs(inv.audioSidecar) : []
-	];
-}
-/**
-* Hardware ENCODER ids per decode-hwaccel backend — a static, deterministic
-* map (the same shape the reference NVR uses: platform → encoder, no probe).
-*/
-var ENCODER_IDS_BY_BACKEND = {
-	videotoolbox: {
-		h264: "h264_videotoolbox",
-		h265: "hevc_videotoolbox"
-	},
-	vaapi: {
-		h264: "h264_vaapi",
-		h265: "hevc_vaapi"
-	},
-	qsv: {
-		h264: "h264_qsv",
-		h265: "hevc_qsv"
-	},
-	cuda: {
-		h264: "h264_nvenc",
-		h265: "hevc_nvenc"
-	},
-	nvdec: {
-		h264: "h264_nvenc",
-		h265: "hevc_nvenc"
-	},
-	amf: {
-		h264: "h264_amf",
-		h265: "hevc_amf"
-	}
-};
-/**
-* The hardware encoder for a target codec on `backend`, or the software one.
-* `'auto'` is NOT a backend identity (it is an instruction to ffmpeg), so it
-* maps to software encoding.
-*/
-function pickVideoEncoder(target, backend, useHardware) {
-	const software = target === "h264" ? "libx264" : "libx265";
-	if (!useHardware || backend === null || isSoftwareDecode(backend) || backend === "auto") return software;
-	const ids = ENCODER_IDS_BY_BACKEND[backend.toLowerCase()];
-	if (!ids) return software;
-	return target === "h264" ? ids.h264 : ids.h265;
-}
-/** Map an `EncodeProfile.audio` to an audio plan. */
-function audioPlanFromEncodeProfile(audio) {
-	if (audio === "passthrough") return { kind: "none" };
-	if (audio.codec === "copy") return { kind: "copy" };
-	return {
-		kind: "encode",
-		codec: audio.codec,
-		...audio.bitrateKbps !== void 0 ? { bitrateKbps: audio.bitrateKbps } : {},
-		...audio.sampleRateHz !== void 0 ? { sampleRateHz: audio.sampleRateHz } : {},
-		...audio.channels !== void 0 ? { channels: audio.channels } : {}
-	};
-}
-/**
-* Adapt an `EncodeProfile` (the operator/consumer-facing shape) into an
-* {@link FfmpegInvocation}. This is the ONLY bridge between the two models —
-* a second one is how the repo grew two argv builders that disagreed about
-* hardware.
-*
-* Smart video copy: when the source already speaks the requested codec the
-* encode block is elided entirely and ffmpeg runs as a re-muxer on the video
-* plane. Width / height / fps / bitrate in the profile are a downstream BUDGET,
-* not a forced rescale.
-*/
-function invocationFromEncodeProfile(input) {
-	const v = input.profile.video;
-	const shouldCopy = v.codec === "copy" || input.forceReencode !== true && v.codec === input.sourceCodec;
-	const scale = v.width !== void 0 && v.height !== void 0 ? {
-		mode: "fit",
-		width: v.width,
-		height: v.height
-	} : null;
-	const target = v.codec === "h265" ? "h265" : "h264";
-	const video = shouldCopy ? { kind: "copy" } : {
-		kind: "encode",
-		encoder: pickVideoEncoder(target, input.decodeHwAccel, input.hardwareEncoders === true),
-		scale,
-		...v.preset !== void 0 ? { preset: v.preset } : {},
-		...v.tune !== void 0 ? { tune: v.tune } : {},
-		...v.profile !== void 0 ? { profile: v.profile } : {},
-		...v.level !== void 0 ? { level: v.level } : {},
-		...v.fps !== void 0 ? { fps: v.fps } : {},
-		...v.gopFrames !== void 0 ? { gopFrames: v.gopFrames } : {},
-		...v.bf !== void 0 ? { bf: v.bf } : {},
-		...v.bitrateKbps !== void 0 ? { bitrateKbps: v.bitrateKbps } : {}
-	};
-	return {
-		logLevel: input.logLevel ?? "error",
-		decodeHwAccel: input.decodeHwAccel,
-		input: {
-			url: input.sourceUrl,
-			rtspTransport: "tcp",
-			fflags: ["+discardcorrupt"],
-			...input.profile.inputArgs?.length ? { extraArgs: input.profile.inputArgs } : {}
-		},
-		video,
-		audio: audioPlanFromEncodeProfile(input.profile.audio),
-		threadCount: input.threadCount ?? 0,
-		outputArgs: input.profile.outputArgs ?? [],
-		sink: input.sink,
-		...input.audioSidecar !== void 0 ? { audioSidecar: input.audioSidecar } : {}
-	};
-}
-//#endregion
 //#region src/ffmpeg/encode-defaults.ts
 /**
 * The shape every live egress starts from: H.264 Baseline 3.1 at 720p25.
@@ -604,9 +275,27 @@ var WEBRTC_EGRESS_PROFILE = {
 * audio plane (out-of-band), so this is `passthrough` exactly like the browser
 * — see the ADR for why the previous in-band Opus was encoded and discarded.
 */
+/**
+* Alexa's egress asks for OPUS, and that is a change with a history.
+*
+* The previous profile encoded Opus IN-BAND into an MPEG-TS, where it was
+* discarded: Opus is `stream_type 0x06` and the broker's demuxer maps only
+* `0x0f` (aac), `0x03`/`0x04` (mp2) and `0x81` (ac3). Every frame it produced
+* died at the demuxer, so the encode was replaced with `passthrough` — correct,
+* because paying libopus for nothing is worse than silence.
+*
+* But `passthrough` means the egress emits NO audio at all, and Alexa's audio
+* does not arrive by magic: it rides the published stream, which is what the
+* WebRTC session dials. So the Echo had video and silence either way.
+*
+* Opus here now reaches the egress AUDIO SIDECAR — a separate RTP leg the
+* restreamer grafts onto its SDP — which never touches the MPEG-TS demuxer that
+* killed the in-band attempt. Same codec, different plane, and this one the
+* consumer can actually negotiate.
+*/
 var ALEXA_EGRESS_PROFILE = {
 	...BASE_LIVE_EGRESS_PROFILE,
-	audio: "passthrough"
+	audio: { codec: "opus" }
 };
 /** VBV window for a consumer whose budget is enforced per second (HomeKit). */
 var RATE_CONTROL_TIGHT = {
@@ -727,6 +416,14 @@ async function resolveEgressDecodeHwAccel(deps) {
 * Here every knob is a named field, and defaults are APPLIED before hashing so
 * an omitted field and its explicit default land on the same key.
 */
+/**
+* The transport a CAP request describes. `fragments` is deliberately
+* unreachable from here — the request schema has no way to ask for it, so the
+* cap path can never be handed a fragment child by accident.
+*/
+function egressTransportFromRequest(request) {
+	return { transport: request.publishLocally === true ? "push" : "dial" };
+}
 /** Absent optional ⇒ this sentinel, so `undefined` and "not set" agree. */
 var UNSET = "\0unset";
 function canonicalVideo(video) {
@@ -758,10 +455,12 @@ function canonicalAudio(audio) {
 * future operator-facing "why are these two not sharing?" surface — can diff
 * two requests without reversing a hash.
 */
-function canonicalEgressPlan(request) {
+function canonicalEgressPlan(request, delivery = egressTransportFromRequest(request)) {
 	return {
 		deviceId: request.deviceId,
 		source: request.source.kind === "profile" ? `profile:${request.source.profile}` : `cam-stream:${request.source.camStreamId}`,
+		transport: delivery.transport,
+		fragmentMs: delivery.fragmentMs ?? -1,
 		video: canonicalVideo(request.encode.video),
 		audio: canonicalAudio(request.encode.audio),
 		rateControl: request.rateControl ?? "relaxed",
@@ -781,8 +480,8 @@ function canonicalEgressPlan(request) {
 * exactly a mutable shared object, where one consumer's downgrade dragged
 * every other consumer to 360p.
 */
-function egressTranscodeSharingKey(request) {
-	return `egress:${require_canonical_hash.canonicalHash(canonicalEgressPlan(request))}`;
+function egressTranscodeSharingKey(request, delivery = egressTransportFromRequest(request)) {
+	return `egress:${require_fmp4_box_splitter.canonicalHash(canonicalEgressPlan(request, delivery))}`;
 }
 //#endregion
 //#region src/health/wiring-health.ts
@@ -902,7 +601,7 @@ var DEFAULT_RETENTION = {
 * ## This file adds no state
 *
 * Every switch here is a VIEW onto an authority that already existed
-* ([D61](../../../../docs/decisions/adr-0062.md)). The whole point of the
+* ([D62](../../../../docs/decisions/adr-0062.md)). The whole point of the
 * group is that there is exactly one place each function is turned off, and
 * the group routes to it:
 *
@@ -913,6 +612,53 @@ var DEFAULT_RETENTION = {
 * | `audio-analysis` | `deviceManager.setWrapperActive('audio-analysis')` | `AudioSubscriptionController.subscribeAudioStream` returns `null` before opening the stream |
 * | `recording` | `recording.setDeviceConfig` → `RecordingConfig.enabled` | `band-decision.shouldRecord` returns false; the controller detaches the device |
 * | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
+* | `privacy-mask` | `privacyMask.setMask({ enabled })` → the CAMERA | the camera blanks the masked regions itself; every stream and recording carries the black boxes |
+* | `device-audio` | `privacyMask.setAudioEnabled` → the CAMERA | the camera stops encoding an audio track at all; every consumer sees silent video |
+* | `broker-audio` | `streamBroker.setDeviceAudioMute` → `DeviceOverride.audioMuted` | `StreamBroker.setAudioMuted` drops the audio plane at the source: no `type:'audio'` packet leaves `fanOutEncoded`, no RTP reaches the restreamer, and the restreamer serves the video-only SDP |
+*
+* ## `device-audio` and `broker-audio` are two functions, not two knobs
+*
+* They look adjacent and they are not the same control ([D83](../../../../docs/decisions/adr-0083.md)):
+* `device-audio` writes the CAMERA, so it is hardware privacy — the microphone
+* genuinely stops, it survives CamStack entirely, and it costs a multi-second
+* encoder restart on every flip. `broker-audio` writes THIS server, so it is
+* instant, vendor-independent and reversible without touching the camera, and
+* a camera that ignores or lacks the ISAPI/Reolink control is still silenced.
+* D62 forbids a second switch that *disagrees* with the first; these two
+* cannot disagree, because neither reads the other's store — the camera holds
+* one, the broker holds the other, and each reports its own fact.
+*
+* ## The two switches whose authority is not on this server
+*
+* `privacy-mask` and `device-audio` write the CAMERA. That is not a loophole
+* in "the group stores nothing" — it is the purest form of it: the camera
+* holds the fact, every read is a read-through, and there is no server-side
+* copy that could drift. Their availability therefore cannot come from
+* `listBindableCapsForDeviceType` (a device-NATIVE cap carries no wrappers and
+* is filtered out there); it comes from the cap's own camera-probed
+* `privacyMask.getOptions()`, which is strictly more honest — it answers for
+* THIS camera rather than for the device type
+* ([D74](../../../../docs/decisions/adr-0074.md)).
+*
+* ## `privacy-mask` is the one row whose ON is not "the function is working"
+*
+* Every other switch means *this camera's function is doing its job*, so
+* `enabled: false` is a thing an operator took away. `privacy-mask` means **the
+* MASK is active** — `enabled: true` is video deliberately obscured. The
+* polarity is not a choice made here: `addon-export-hap`'s privacy `Switch`
+* (`builders/privacy-switch.ts`) already mirrors `patch.enabled` verbatim, and
+* a HomeKit toggle that disagreed with the app's toggle for the same camera is
+* worse than either surface not having one.
+*
+* Two consequences follow and both are load-bearing:
+*
+* - **It never counts as `switchedOff`.** `countsAsSwitchedOff` is `false` for
+*   exactly this row. With the polarity above, every camera that has NOT drawn
+*   a privacy mask would otherwise report `switchedOff: ['privacy-mask']` — the
+*   normal, healthy state of most cameras rendered as an operator disablement.
+* - **Its cost line names BOTH directions.** `costWhenOff` is rendered
+*   unconditionally by both clients, so for this row it has to read correctly
+*   whichever way the switch is sitting.
 *
 * The wrapper-binding pair is not a new idea: `legacy-migrations.ts` already
 * migrated the legacy `audioEnabled` / `pipelineEnabled` /
@@ -931,22 +677,44 @@ var DEFAULT_RETENTION = {
 *   `CameraStatus.switchedOff`.
 */
 /**
-* The five functions the operator named (2026-08-05). Deliberately NOT one id
-* per pipeline step: face recognition and plate/LPR are per-step toggles on
+* The functions the operator named — five on 2026-08-05, plus the camera's own
+* microphone on 2026-08-07. Deliberately NOT one id per pipeline step: face
+* recognition and plate/LPR are per-step toggles on
 * `pipelineOrchestrator.setCameraStepToggle` and belong in the pipeline
-* editor, not in a five-button safety group.
+* editor, not in a safety group.
 */
 var CameraSwitchIdSchema = zod.z.enum([
 	"stream-broker",
 	"object-detection",
+	"privacy-mask",
+	"device-audio",
+	"broker-audio",
 	"audio-analysis",
 	"recording",
 	"notifications"
 ]);
-/** Stable render order — broadest blast radius first. */
+/**
+* Stable render order — broadest blast radius first, and a source before the
+* thing that consumes it. `device-audio` sits ABOVE `audio-analysis` because
+* turning the microphone off leaves the analyzer with nothing to analyse; the
+* reverse is not true.
+*
+* `privacy-mask` sits directly ABOVE `device-audio` because they are literal
+* siblings — one cap, one device plane, video then audio — and NOT above
+* `object-detection` despite feeding it: a mask blanks REGIONS, so its blast
+* radius is partial, and the "broadest first" rule does not rank a partial
+* control above a whole-function one.
+*
+* `broker-audio` sits directly BELOW `device-audio` by the same source-first
+* rule: the camera's microphone feeds the broker, so silencing the camera
+* leaves the broker's mute with nothing to suppress; the reverse is not true.
+*/
 var CAMERA_SWITCH_ORDER = [
 	"stream-broker",
 	"object-detection",
+	"privacy-mask",
+	"device-audio",
+	"broker-audio",
 	"audio-analysis",
 	"recording",
 	"notifications"
@@ -964,14 +732,27 @@ var CameraSwitchAuthoritySchema = zod.z.discriminatedUnion("kind", [
 		capName: zod.z.string()
 	}),
 	zod.z.object({ kind: zod.z.literal("recording-config") }),
-	zod.z.object({ kind: zod.z.literal("notification-mute") })
+	zod.z.object({ kind: zod.z.literal("notification-mute") }),
+	zod.z.object({
+		kind: zod.z.literal("camera-audio"),
+		capName: zod.z.string()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("camera-mask"),
+		capName: zod.z.string()
+	}),
+	zod.z.object({ kind: zod.z.literal("broker-audio-mute") })
 ]);
 /**
 * Why a switch is not offered for this camera. Rendered instead of the
 * control, never as a dead control — an absent function and a broken one must
 * not look the same.
 */
-var CameraSwitchUnavailableReasonSchema = zod.z.enum(["no-provider", "source-unreachable"]);
+var CameraSwitchUnavailableReasonSchema = zod.z.enum([
+	"no-provider",
+	"source-unreachable",
+	"not-configured"
+]);
 /**
 * One switch, resolved for one camera.
 *
@@ -1011,6 +792,13 @@ var CameraSwitchGroupSchema = zod.z.object({
 var DETECTION_PIPELINE_CAP_NAME = "detection-pipeline";
 var AUDIO_ANALYSIS_CAP_NAME = "audio-analysis";
 /**
+* The device-NATIVE cap that owns what the camera does not capture — masked
+* video regions and, since 2026-08-07, the microphone. Named here because the
+* `camera-audio` authority, the orchestrator's gather and the fake harness all
+* have to agree on it.
+*/
+var PRIVACY_MASK_CAP_NAME = "privacy-mask";
+/**
 * THE catalog. One entry per switch; the cost lines are the operator-facing
 * contract and are written to be true rather than reassuring.
 */
@@ -1019,7 +807,8 @@ var CAMERA_SWITCH_CATALOG = {
 		id: "stream-broker",
 		label: "Camera",
 		costWhenOff: "Off: the whole camera stops. No live view, no recording, no detection and no notifications — its streams are released and nothing dials it again until you turn it back on.",
-		authority: { kind: "device-disabled" }
+		authority: { kind: "device-disabled" },
+		countsAsSwitchedOff: true
 	},
 	"object-detection": {
 		id: "object-detection",
@@ -1028,7 +817,35 @@ var CAMERA_SWITCH_CATALOG = {
 		authority: {
 			kind: "wrapper-binding",
 			capName: DETECTION_PIPELINE_CAP_NAME
-		}
+		},
+		countsAsSwitchedOff: true
+	},
+	"privacy-mask": {
+		id: "privacy-mask",
+		label: "Privacy mask",
+		costWhenOff: "On: the zones you drew on this camera are blacked out by the camera itself — live view, playback, exports and detection all see the black boxes, and nothing behind them was ever recorded. Off: the camera captures the whole frame, and your zones are kept for when you turn it back on.",
+		authority: {
+			kind: "camera-mask",
+			capName: PRIVACY_MASK_CAP_NAME
+		},
+		countsAsSwitchedOff: false
+	},
+	"device-audio": {
+		id: "device-audio",
+		label: "Camera microphone",
+		costWhenOff: "Off: the camera captures no sound at all. Live view and recordings become silent video, and audio detection and classification have nothing left to analyse — turning them back on will not recover it. The picture, motion and object detection are unaffected, and two-way talk still works. Applies at the camera, so every consumer sees the same silence.",
+		authority: {
+			kind: "camera-audio",
+			capName: PRIVACY_MASK_CAP_NAME
+		},
+		countsAsSwitchedOff: true
+	},
+	"broker-audio": {
+		id: "broker-audio",
+		label: "Audio distribution",
+		costWhenOff: "Off: this server distributes no sound for this camera — live view is silent and everything recorded while it is off is silent FOREVER, even after you turn it back on. Audio detection and classification also have nothing to analyse. The camera keeps capturing sound, so nothing about the camera changes and turning this back on is instant, with no interruption to the picture.",
+		authority: { kind: "broker-audio-mute" },
+		countsAsSwitchedOff: true
 	},
 	"audio-analysis": {
 		id: "audio-analysis",
@@ -1037,19 +854,22 @@ var CAMERA_SWITCH_CATALOG = {
 		authority: {
 			kind: "wrapper-binding",
 			capName: AUDIO_ANALYSIS_CAP_NAME
-		}
+		},
+		countsAsSwitchedOff: true
 	},
 	recording: {
 		id: "recording",
 		label: "Recording",
 		costWhenOff: "Off: nothing new is written to disk. Footage already recorded stays, but retention keeps deleting it — so this camera’s history shrinks and is not replaced. Your recording schedule is kept and resumes when you turn it back on.",
-		authority: { kind: "recording-config" }
+		authority: { kind: "recording-config" },
+		countsAsSwitchedOff: true
 	},
 	notifications: {
 		id: "notifications",
 		label: "Notifications",
 		costWhenOff: "Off: this camera never notifies anyone, on any rule, with no expiry. Detection, events and recording carry on exactly as before — you simply stop being told about them.",
-		authority: { kind: "notification-mute" }
+		authority: { kind: "notification-mute" },
+		countsAsSwitchedOff: true
 	}
 };
 /** Resolve one switch's `{ available, enabled }` pair. */
@@ -1096,6 +916,67 @@ function resolveState(descriptor, input) {
 				available: true,
 				enabled: !input.notificationsMuted
 			};
+		case "camera-audio": {
+			const audio = input.deviceAudio;
+			if (audio === null) return {
+				available: false,
+				enabled: true,
+				unavailableReason: "source-unreachable"
+			};
+			if (!audio.supported) return {
+				available: false,
+				enabled: true,
+				unavailableReason: "no-provider"
+			};
+			if (audio.enabled === null) return {
+				available: false,
+				enabled: true,
+				unavailableReason: "source-unreachable"
+			};
+			return {
+				available: true,
+				enabled: audio.enabled
+			};
+		}
+		case "camera-mask": {
+			const mask = input.privacyMask;
+			if (mask === null) return {
+				available: false,
+				enabled: false,
+				unavailableReason: "source-unreachable"
+			};
+			if (!mask.supported) return {
+				available: false,
+				enabled: false,
+				unavailableReason: "no-provider"
+			};
+			if (mask.configuredRegions === null || mask.enabled === null) return {
+				available: false,
+				enabled: false,
+				unavailableReason: "source-unreachable"
+			};
+			if (mask.configuredRegions === 0) return {
+				available: false,
+				enabled: false,
+				unavailableReason: "not-configured"
+			};
+			return {
+				available: true,
+				enabled: mask.enabled
+			};
+		}
+		case "broker-audio-mute": {
+			const broker = input.brokerAudio;
+			if (broker === null) return {
+				available: false,
+				enabled: true,
+				unavailableReason: "source-unreachable"
+			};
+			return {
+				available: true,
+				enabled: !broker.muted
+			};
+		}
 	}
 }
 /**
@@ -1129,9 +1010,15 @@ function deriveCameraSwitches(input) {
 * `switchedOff: ['object-detection']` was turned off; the same camera with an
 * empty list is broken. Unavailable switches never appear — a function nobody
 * provides was not switched off by anyone.
+*
+* `privacy-mask` never appears either, whichever way it is sitting, because its
+* ON means "the mask is active" rather than "the function works"
+* ({@link CameraSwitchDescriptor.countsAsSwitchedOff}). Without that filter the
+* ordinary state of every camera nobody has masked would carry a
+* "switched off" badge, and the badge that matters would be lost in it.
 */
 function switchedOffIds(switches) {
-	return switches.filter((s) => s.available && !s.enabled).map((s) => s.id);
+	return switches.filter((s) => CAMERA_SWITCH_CATALOG[s.id].countsAsSwitchedOff && s.available && !s.enabled).map((s) => s.id);
 }
 //#endregion
 //#region src/interfaces/device-capabilities/camera.ts
@@ -4167,6 +4054,26 @@ var EgressTranscodeRequestSchema = zod.z.object({
 		"h264_mp4toannexb",
 		"hevc_mp4toannexb"
 	]).optional(),
+	/**
+	* Publish the transcode as a LOCAL push cam stream, instead of leaving the
+	* consumer to dial the returned url. The broker picks the id and returns it
+	* as `camStreamId` — a caller-supplied one would be circular, since the
+	* sharing key is computed FROM this request.
+	*
+	* The url is still returned and still the contract for a transcode pinned to
+	* another node. But dialling it locally costs an RTSP round trip that changes
+	* the transport underneath the consumer: a dialled stream is an RTP source,
+	* so `isRtpSource()` is true and the session takes the RTP-passthrough +
+	* repacketizer branch. The push branch — the one the derived mechanism has
+	* live hours on — is never reached. Measured on Alexa: broker registered, RTP
+	* arriving, key frame arriving, black screen, on a chain healthy at every
+	* other point.
+	*
+	* Same idea the transport already applies to CALLS, where `classifyCapRoute`
+	* gives priority to `hub-in-process` so a local call never leaves the node.
+	* This is that rule for media.
+	*/
+	publishLocally: zod.z.boolean().optional(),
 	pixelFormat: zod.z.enum(["yuv420p", "nv12"]).optional(),
 	/**
 	* Operator/consumer override for decode hardware. ABSENT is the normal case
@@ -4211,7 +4118,13 @@ var EgressTranscodeSchema = zod.z.object({
 	* Returned rather than assumed: a consumer that asked for hardware and got
 	* software needs to be able to see that without reading the broker's logs.
 	*/
-	decodeHwAccel: zod.z.string().nullable()
+	decodeHwAccel: zod.z.string().nullable(),
+	/**
+	* Set when `publishLocally` was honoured: attach to THIS instead of dialling
+	* `url`, and the session takes the push/deframe transport rather than the
+	* RTP-passthrough one. `null` means the consumer must dial.
+	*/
+	camStreamId: zod.z.string().nullable()
 });
 var streamBrokerCapability = {
 	name: "stream-broker",
@@ -4505,7 +4418,44 @@ var streamBrokerCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		isRtspEnabled: require_sleep.method(zod.z.object({ brokerId: zod.z.string() }), zod.z.boolean())
+		isRtspEnabled: require_sleep.method(zod.z.object({ brokerId: zod.z.string() }), zod.z.boolean()),
+		/**
+		* ── Per-device audio-plane policy (D83) ───────────────────────────
+		*
+		* The BROKER-side mute: while `muted`, this node distributes none of
+		* the device's audio, on any plane it serves — live (WebRTC / encoded
+		* subscribers) AND recording (the RTSP restreamer the recorder pulls,
+		* which additionally serves the video-only SDP so the recorder's ffmpeg
+		* never declares an audio stream it will not receive).
+		*
+		* Keyed by `deviceId`, not `brokerId`: every one of a camera's streams
+		* carries the same microphone, and a per-stream answer would let main
+		* and sub disagree about whether the camera is silent.
+		*
+		* The state lives in the broker's existing `DeviceOverride` blob — no
+		* new store — and the mute is applied to a fresh broker at creation, so
+		* a restart, a re-dial or a catalog republish never un-mutes a camera.
+		*/
+		getDeviceAudioMute: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int() }), zod.z.object({
+			muted: zod.z.boolean(),
+			/**
+			* How many live non-derived brokers currently hold the mute. Purely
+			* diagnostic: `muted` is the policy and is authoritative on its own
+			* (it applies to brokers that do not exist yet), while this says
+			* whether anything is presently being silenced.
+			*/
+			appliedBrokers: zod.z.number().int().nonnegative()
+		})),
+		setDeviceAudioMute: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number().int(),
+			muted: zod.z.boolean()
+		}), zod.z.object({
+			muted: zod.z.boolean(),
+			appliedBrokers: zod.z.number().int().nonnegative()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	},
 	events: {
 		onCamStreamDemand: require_sleep.event(zod.z.object({
@@ -12352,6 +12302,30 @@ var TrackSourceSchema = zod.z.enum([
 	"audio"
 ]);
 /**
+* Where a track sits in the RETRAIN lifecycle (D81).
+*
+*  - `none` — never marked, or un-marked. Evictable.
+*  - `staging` — the operator wants this track as training material and has not
+*    finished with it. **This is the only state retention holds**: the track and
+*    everything it owns (object events, crops, keyframes, CLIP vector) survive
+*    the device's age window.
+*  - `trained` — the retrain page has taken what it needed. The frames it chose
+*    were COPIED into the retrain dataset at selection time, so the dataset no
+*    longer depends on the track's media and the track becomes EVICTABLE again.
+*    Terminal for the plain `markForTrain` toggle: returning it to `staging` is
+*    a deliberate action of the retrain page, not a side effect of a checkbox.
+*
+* There is no `null`. The state is stored `TEXT NOT NULL DEFAULT 'none'` because
+* the store's filter language has only positive equality and `whereIn` — no
+* negation, no IS NULL — so a NULL would be unselectable by ANY predicate and
+* would make the entire pre-column history immortal in one deploy.
+*/
+var RetrainStatusSchema = zod.z.enum([
+	"none",
+	"staging",
+	"trained"
+]);
+/**
 * Per-track OPERATOR flags — set by hand from the admin UI or the viewer, never
 * by the pipeline. Spread into `TrackSchema` and `KeyEventSchema` from one place
 * so the two surfaces cannot drift.
@@ -12361,18 +12335,31 @@ var TrackSourceSchema = zod.z.enum([
 * columns existed read as absent, and a consumer that needs a boolean should say
 * `flag === true`, not `flag !== false`.
 *
-* What the flags DO is deliberately UNDEFINED at the time of writing: they are
-* operator curation, and the behaviour they drive will be specified separately.
-* In particular a `markForTrain` track is NOT pinned against retention — see
-* `docs/decisions/adr-0059.md` for why that is a store-level change, not a flag.
+* `markForTrain` is the WIRE FACE of {@link RetrainStatusSchema}, not a column:
+* it is exactly `retrainStatus === 'staging'`, in both directions. Writing
+* `true` moves `none → staging`, writing `false` moves `staging → none`, and a
+* `trained` track reports `false` while refusing both writes. The boolean is
+* kept because three surfaces drive a toggle off it; anything that needs to tell
+* "never marked" from "already trained" must read `retrainStatus`.
+*
+* `debug` does NOT pin; it is attention, not durability.
 */
 var TrackFlagFields = {
-	/** Operator marked this track as training material. */
+	/** Operator marked this track as training material — i.e. `retrainStatus` is
+	*  `'staging'`. */
 	markForTrain: zod.z.boolean().optional(),
 	/** Operator marked this track for diagnostic attention. */
 	debug: zod.z.boolean().optional()
 };
 /**
+* The lifecycle field itself, on the READ surfaces only (`Track`, `KeyEvent`).
+* Deliberately NOT part of {@link TrackFlagFields}: that group also builds the
+* write patch, and the status is not something the toggle sets — it is what the
+* toggle's boolean is derived from. Absent on an in-RAM track never touched;
+* always present on a persisted row (the column default materialises `'none'`).
+*/
+var TrackRetrainFields = { retrainStatus: RetrainStatusSchema.optional() };
+/**
 * The write half: a PARTIAL patch. An omitted key is left untouched, so setting
 * one flag can never clear the other — the toggles are independent and are
 * driven from three surfaces that do not know about each other.
@@ -12386,7 +12373,32 @@ var TrackFlagsPatchSchema = zod.z.object(TrackFlagFields);
 var TrackFlagsSchema = zod.z.object({
 	trackId: zod.z.string(),
 	markForTrain: zod.z.boolean(),
-	debug: zod.z.boolean()
+	debug: zod.z.boolean(),
+	/** The lifecycle state the boolean was derived from. Required here (unlike on
+	*  a track row) because this shape is only ever produced by the write body,
+	*  which always knows it — and a surface that has just written needs to render
+	*  `trained` without a re-fetch. */
+	retrainStatus: RetrainStatusSchema
+});
+/** Per-camera slice of a training-export estimate. */
+var TrainingExportDeviceTotalsSchema = zod.z.object({
+	deviceId: zod.z.number(),
+	tracks: zod.z.number().int(),
+	files: zod.z.number().int(),
+	bytes: zod.z.number().int()
+});
+/**
+* What a training export WOULD contain. Computed from media index rows only —
+* no blob is read to produce this.
+*/
+var TrainingExportSummarySchema = zod.z.object({
+	generatedAt: zod.z.number(),
+	trackCount: zod.z.number().int(),
+	fileCount: zod.z.number().int(),
+	byteCount: zod.z.number().int(),
+	/** More marked tracks exist than a single pass carries. */
+	truncated: zod.z.boolean(),
+	devices: zod.z.array(TrainingExportDeviceTotalsSchema).readonly()
 });
 var TrackSchema = zod.z.object({
 	trackId: zod.z.string(),
@@ -12431,7 +12443,8 @@ var TrackSchema = zod.z.object({
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
 	envelope: TrackEnvelopeSchema.optional(),
-	...TrackFlagFields
+	...TrackFlagFields,
+	...TrackRetrainFields
 });
 var BaseEventFields = {
 	id: zod.z.string(),
@@ -12653,7 +12666,8 @@ var KeyEventSchema = zod.z.object({
 	bestEventId: zod.z.string(),
 	/** Track lifetime in ms (lastSeen - firstSeen). */
 	windowMs: zod.z.number().optional(),
-	...TrackFlagFields
+	...TrackFlagFields,
+	...TrackRetrainFields
 });
 var TrackedDetectionSchema = zod.z.object({
 	trackId: zod.z.string(),
@@ -13015,11 +13029,29 @@ var pipelineAnalyticsCapability = {
 		*
 		* `auth: 'protected'` (the default), NOT `admin`: the viewer is an
 		* authenticated non-admin surface and two of the three call sites are
-		* there. Revisit if a flag ever gains an effect that costs storage —
-		* `deleteTracks` next door is admin for exactly that reason.
+		* there. The note that used to sit here said to revisit this the day a flag
+		* gained an effect that costs storage, and D81 is that day — `markForTrain`
+		* now pins. It STAYS protected, and the reason is that the alternative
+		* makes the feature pointless: marking a track is something you do while
+		* looking at it, on the surface you were already looking at it on, and that
+		* surface is the viewer. What the storage cost gets instead is a BOUND — a
+		* per-device pin budget enforced in the body, refusing a new pin past the
+		* limit while always allowing un-marking. `deleteTracks` next door is still
+		* admin, because destroying evidence and preserving it are not symmetric.
+		*
+		* `markForTrain` writes the retrain LIFECYCLE, not a boolean column: `true`
+		* is `none → staging`, `false` is `staging → none`. A track already
+		* `trained` refuses BOTH — its frames are copies inside the retrain dataset
+		* and re-staging it from a generic toggle is how the same material gets
+		* annotated twice under two ground truths. Returning a trained track to
+		* staging is a deliberate action of the retrain page, which is also the only
+		* thing that produces `trained` in the first place.
 		*
-		* Returns the RESOLVED state of both flags (absent → `false`) so a caller
-		* can drive its toggle without a re-fetch. Rejects an unknown track.
+		* Returns the RESOLVED state of both flags (absent → `false`) plus the
+		* `retrainStatus` they were derived from, so a caller can drive its toggle
+		* — and render a `trained` badge — without a re-fetch. Rejects an unknown
+		* track, a new staging mark on a device already holding its full budget, and
+		* any `markForTrain` write against a trained track.
 		*/
 		setTrackFlags: require_sleep.method(zod.z.object({
 			/** Log/audit scope only — the trackId is globally unique on its own. */
@@ -13083,6 +13115,42 @@ var pipelineAnalyticsCapability = {
 			kind: "query",
 			auth: "admin"
 		}),
+		/**
+		* The CHEAP QUESTION, asked before any media moves: how big is the dataset
+		* the marked (`markForTrain`) tracks would produce?
+		*
+		* Answered from media INDEX rows only — key, kind, size, timestamp — so it
+		* costs ~2 KB of reads per track and no blob reads at all. The measured harm
+		* behind D56 was a bulk pass that read and base64'd every blob a track owned
+		* before deciding anything, taking hub-main to 82 s busy out of 120; an
+		* export is that same I/O shape, so it inherits the same discipline: know
+		* the size, then decide.
+		*
+		* `truncated` reports that more marked tracks exist than one pass carries.
+		* Empty `deviceIds` ⇒ every device that has marked tracks.
+		*/
+		getTrainingExportSummary: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), TrainingExportSummarySchema, {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* Where to download the dataset archive.
+		*
+		* The BYTES do not come back through this cap — they come from the returned
+		* data-plane URL, which streams a tar built entry by entry. A multi-gigabyte
+		* archive base64'd through a unary RPC envelope would be held whole in
+		* memory twice on a hub this repo has already OOM'd once (D9/D18 are the
+		* same lesson about frames). `getDownloadUrl` on `recordingExport` is the
+		* precedent, and this follows it deliberately.
+		*
+		* The archive contains a `manifest.json` FIRST, then the stored media
+		* VERBATIM under `tracks/<deviceId>/<trackId>/…`. No crop is derived and no
+		* model is run: a training set's pixels must be the pixels the pipeline saw.
+		*/
+		getTrainingExportUrl: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), zod.z.object({ url: zod.z.string() }), {
+			kind: "query",
+			auth: "admin"
+		}),
 		getEventMedia: require_sleep.method(zod.z.object({
 			eventId: zod.z.string(),
 			kind: MediaFileKindEnum.optional()
@@ -15863,9 +15931,15 @@ var snapshotCapability = {
 			* Bypass the cache freshness check and fetch directly from the
 			* native (or stream-broker fallback). Triggered by the UI's
 			* "refresh" button so an operator can force a fresh frame
-			* even when the cache is well within `snapshotMaxAgeMs`.
-			* On battery cams this WILL wake the camera — accept the
-			* cost only when the user explicitly asks for it.
+			* even when the cache is well within the device's
+			* `snapshotMaxAgeS` window.
+			*
+			* **`force` is an OPERATOR signal, not a freshness preference.** On a
+			* battery camera it is the one thing that walks past the wrapper's
+			* sleep gate and wakes the camera, so a background caller — a poller,
+			* an event handler, a thumbnail — must NEVER set it. Every such caller
+			* gets the cached frame, which on a sleeping battery camera is the
+			* correct answer: stale but honest beats woken.
 			*/
 			force: zod.z.boolean().optional()
 		}), SnapshotImageSchema.nullable()),
@@ -21841,6 +21915,216 @@ setOverlay: require_sleep.method(zod.z.object({
 	}] }
 };
 //#endregion
+//#region src/capabilities/osd-manager.cap.ts
+/**
+* `osd-manager` — the ORCHESTRATOR over the device-scope `osd` cap.
+*
+* The `osd` cap is the firmware contract: it probes a camera's overlay
+* SLOTS and writes literal text into one. It has no idea WHERE that text
+* comes from, and it must not — a driver that grew a "show the temperature
+* here" feature would grow it once per vendor.
+*
+* This cap owns the other half: a per-(camera, slot) BINDING that says
+* which value feeds the slot, how it is formatted, and under which
+* conditions it is shown at all. One addon renders every binding on every
+* camera, so a new source costs zero driver code.
+*
+* Three deliberate choices, each with a rejected alternative:
+*
+*  1. A source is `(capName, valuePath)` over the kernel's device
+*     runtime-state mirror — NOT a closed enum of source kinds. Every
+*     cap-keyed slice a device publishes is bindable the day the cap
+*     ships. The rejected alternative (one enum member per source, with
+*     a resolver branch each) is what makes "add the humidity too" a
+*     code change.
+*  2. The display gate reuses `NcConditionsSchema` verbatim — the
+*     notification centre's condition vocabulary — rather than a parallel
+*     model. An operator who has learned one condition editor has learned
+*     both.
+*  3. Because the renderer's facts are device STATE and not a detection
+*     record, only a SUBSET of that vocabulary can be answered here.
+*     `setSlotBinding` REJECTS the rest at write time (see
+*     `getConditionSupport`). It does not accept-then-fail-closed: a
+*     condition that can never be true renders a permanently blank
+*     overlay, and a blank overlay looks exactly like a broken camera.
+*/
+/** Where a slot's value comes from. */
+var OsdSourceSchema = zod.z.discriminatedUnion("kind", [
+	zod.z.object({
+		kind: zod.z.literal("static"),
+		text: zod.z.string().max(64)
+	}),
+	zod.z.object({
+		kind: zod.z.literal("clock"),
+		/** Token pattern: `YYYY MM DD HH mm ss`. Everything else is literal. */
+		pattern: zod.z.string().min(1).max(32).default("HH:mm"),
+		/** IANA zone. Omitted = the server's zone. */
+		timezone: zod.z.string().min(1).max(64).optional()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("device-state"),
+		deviceId: zod.z.number().int().optional(),
+		capName: zod.z.string().min(1).max(64),
+		/** Dot path inside the slice, e.g. `detected`, `value`, `mode`. */
+		valuePath: zod.z.string().min(1).max(64)
+	})
+]);
+var OsdSlotBindingSchema = zod.z.object({
+	/** Off = the manager stops driving this slot. It does NOT clear it. */
+	enabled: zod.z.boolean().default(true),
+	source: OsdSourceSchema,
+	/** `${value}` and `${unit}` are substituted; every occurrence. */
+	template: zod.z.string().max(96).default("${value}"),
+	/** Truncate with an ellipsis past this length. Absent = no limit. */
+	maxCharacters: zod.z.number().int().min(4).max(64).optional(),
+	/**
+	* Decimal places for a numeric value. `0` yields an integer — the
+	* documented workaround for firmwares that reject `.` in overlay text.
+	*/
+	maxDecimals: zod.z.number().int().min(0).max(4).default(1),
+	/** Appended via `${unit}`. The state mirror does not carry units. */
+	unitLabel: zod.z.string().max(8).optional(),
+	/** Raw value → display text, e.g. `{"true":"MOTION","false":""}`. */
+	valueMap: zod.z.record(zod.z.string(), zod.z.string()).optional(),
+	/** Time windows in which the slot is shown. Absent = always. */
+	schedule: NcScheduleSchema.optional(),
+	/**
+	* Display gate, in the notification centre's condition vocabulary.
+	* Only the keys reported by `getConditionSupport` are accepted.
+	*/
+	conditions: NcConditionsSchema.optional(),
+	/** Rendered when the gate is closed or the value unreadable. Empty = hide. */
+	fallbackText: zod.z.string().max(64).default("")
+});
+/** One camera slot, as the operator sees it: firmware truth + our binding. */
+var OsdSlotViewSchema = zod.z.object({
+	slotId: zod.z.string(),
+	kind: OsdOverlayKindEnum,
+	/** Firmware refuses text edits (a timestamp, the channel name). */
+	readOnly: zod.z.boolean(),
+	cameraEnabled: zod.z.boolean(),
+	cameraText: zod.z.string().optional(),
+	binding: OsdSlotBindingSchema.nullable()
+});
+/**
+* What happened to one slot on one render pass. `unchanged` exists so the
+* operator can tell "we are driving this and the value is steady" from
+* "we never got there" — and so the loop can prove it is not rewriting
+* identical text to the camera every tick.
+*/
+var OsdRenderOutcomeEnum = zod.z.enum([
+	"written",
+	"unchanged",
+	"gated",
+	"unreadable",
+	"disabled",
+	"unbound",
+	"failed"
+]);
+var OsdRenderResultSchema = zod.z.object({
+	slotId: zod.z.string(),
+	outcome: OsdRenderOutcomeEnum,
+	/** The text the slot should carry. Empty = the slot is switched off. */
+	text: zod.z.string(),
+	/** Why, whenever the outcome is not a plain write. Never silent. */
+	reason: zod.z.string().optional()
+});
+var OsdSourceValueTypeEnum = zod.z.enum([
+	"number",
+	"boolean",
+	"string",
+	"enum"
+]);
+/**
+* One bindable value, derived from a cap's `runtimeState` schema — never
+* hand-listed. The editor renders from this, so a cap that ships a new
+* state field becomes bindable with no UI change.
+*/
+var OsdSourceOptionSchema = zod.z.object({
+	deviceId: zod.z.number().int(),
+	deviceName: zod.z.string(),
+	capName: zod.z.string(),
+	valuePath: zod.z.string(),
+	label: zod.z.string(),
+	valueType: OsdSourceValueTypeEnum,
+	/** Present for `enum`; the editor offers these as `valueMap` keys. */
+	enumValues: zod.z.array(zod.z.string()).readonly().optional()
+});
+var osdManagerCapability = {
+	name: "osd-manager",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		/**
+		* The camera's slots, each with its binding. `supported: false` when
+		* the camera publishes no `osd` cap — the page then says so instead
+		* of rendering an empty list that reads as "no overlays configured".
+		*/
+		getDeviceOsd: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int() }), zod.z.object({
+			supported: zod.z.boolean(),
+			slots: zod.z.array(OsdSlotViewSchema)
+		}), { auth: "admin" }),
+		/**
+		* Every value bindable on this camera: its own state leaves first,
+		* then every other device's. Derived from the cap definitions, so it
+		* cannot drift from what the resolver can actually read.
+		*/
+		getSourceCatalog: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int() }), zod.z.object({ sources: zod.z.array(OsdSourceOptionSchema) }), { auth: "admin" }),
+		/**
+		* The condition ids this gate can answer, alongside the FULL notification
+		* condition catalog. Both, in one call, on purpose: an editor that showed
+		* the catalog without the supported set would offer conditions that
+		* `setSlotBinding` then rejects.
+		*/
+		getConditionSupport: require_sleep.method(zod.z.object({}), zod.z.object({
+			supported: zod.z.array(zod.z.string()),
+			catalog: zod.z.array(NcConditionDescriptorSchema)
+		}), { auth: "admin" }),
+		/**
+		* Persist a binding and render it immediately, returning the slot as
+		* it now stands. Throws when the binding names an unsupported
+		* condition, an unknown cap, or a value path that cap does not have.
+		*/
+		setSlotBinding: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number().int(),
+			slotId: zod.z.string().min(1),
+			binding: OsdSlotBindingSchema
+		}), zod.z.object({
+			slot: OsdSlotViewSchema,
+			render: OsdRenderResultSchema
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Forget the binding. The slot keeps whatever text it last carried. */
+		clearSlotBinding: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number().int(),
+			slotId: zod.z.string().min(1)
+		}), zod.z.object({ success: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Render without writing. `binding` overrides the stored one so an
+		* editor can preview an unsaved change. Mutation kind only to carry
+		* the binding object safely; no side effects.
+		*/
+		previewSlot: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number().int(),
+			slotId: zod.z.string().min(1),
+			binding: OsdSlotBindingSchema.optional()
+		}), OsdRenderResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Force a render pass over one camera now, instead of at the next tick. */
+		renderDevice: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int() }), zod.z.object({ results: zod.z.array(OsdRenderResultSchema) }), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+//#endregion
 //#region src/capabilities/pet-feeder.cap.ts
 /**
 * PetKit pet-feeder cap. Models the control + telemetry surface of a
@@ -22488,12 +22772,30 @@ var pressureSensorCapability = {
 //#endregion
 //#region src/capabilities/privacy-mask.cap.ts
 /**
-* Privacy mask = up to `maxRegions` SHAPES the camera blanks out (NOT a
-* cell grid). Reolink `<shelterList>` zones are rectangles; Hikvision
-* ISAPI `<RegionCoordinatesList>` zones are free polygons (this camera:
-* exactly 4 vertices, not necessarily axis-aligned). The cap composes the
-* shared rect|polygon subset of the MaskShape vocabulary. All coords are
-* normalized 0..1 (top-left origin).
+* PRIVACY — what the camera deliberately does not capture. Two planes:
+*
+*  - **video**: up to `maxRegions` SHAPES the camera blanks out (NOT a cell
+*    grid). Reolink `<shelterList>` zones are rectangles; Hikvision ISAPI
+*    `<RegionCoordinatesList>` zones are free polygons (this camera: exactly
+*    4 vertices, not necessarily axis-aligned). The cap composes the shared
+*    rect|polygon subset of the MaskShape vocabulary. All coords are
+*    normalized 0..1 (top-left origin).
+*  - **audio**: the camera's microphone. `setAudioEnabled(false)` stops the
+*    camera encoding an audio track at all, so EVERY consumer — live view,
+*    recording, the audio analyzer, an export — sees silent video. There is
+*    no server-side copy of this fact; the camera is the store and every read
+*    is a read-through, which is why a switch over it cannot drift
+*    ([D62](../../../../docs/decisions/adr-0062.md)).
+*
+* Both belong here for one reason: they are the two things an operator turns
+* off when the answer to "what is this camera allowed to record" changes, and
+* both are applied ON the device, before anything leaves it.
+*
+* **The audio flag has exactly one writer.** `stream-params` used to carry a
+* per-profile `audio` in its patch schema — reachable from no UI and honoured
+* by one provider — and it was removed when this landed. A second writer onto
+* one device register is the shape of every knob this repo has shipped that
+* disagreed with the one the reader read.
 */
 /** A privacy-mask region's geometry — rectangle or free polygon. */
 var PrivacyMaskShapeSchema = zod.z.discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
@@ -22505,21 +22807,45 @@ var PrivacyMaskRegionSchema = zod.z.object({
 	enabled: zod.z.boolean(),
 	shape: PrivacyMaskShapeSchema
 });
-/** Current on-camera privacy-mask state — master enable + zones. */
+/** Current on-camera privacy state — mask master enable + zones + microphone. */
 var PrivacyMaskStatusSchema = zod.z.object({
 	enabled: zod.z.boolean(),
 	/** Active zones (normalized 0..1). Length ≤ maxRegions. */
 	regions: zod.z.array(PrivacyMaskRegionSchema),
+	/**
+	* Is the camera capturing sound right now? Read from the camera, never from
+	* a server-side mirror.
+	*
+	* `null` means "no answer" — either this camera exposes no controllable
+	* microphone (`getOptions().supportsAudioMute === false`) or the read
+	* failed. A consumer must render `null` as UNKNOWN and never as `false`:
+	* "the microphone is off" and "we could not ask" look identical to an
+	* operator only until one of them is wrong.
+	*
+	* On a camera whose profiles carry the flag independently (Reolink writes
+	* it per stream), `true` means AT LEAST ONE profile still carries audio —
+	* privacy is only satisfied when every one of them is silent.
+	*/
+	audioEnabled: zod.z.boolean().nullable(),
 	lastFetchedAt: zod.z.number()
 });
-/** Per-camera availability. */
+/** Per-camera availability. Probed, never assumed from the model name. */
 var PrivacyMaskOptionsSchema = zod.z.object({
 	/** Maximum number of supported zones. */
 	maxRegions: zod.z.number(),
 	/** Shape kinds this camera accepts — Reolink: ['rect']; Hikvision: ['rect','polygon']. */
 	supportedShapes: zod.z.array(MaskShapeKindSchema),
 	/** Polygon vertex bounds when 'polygon' is supported (Hikvision: {min:4,max:4}). */
-	polygonVertices: MaskPolygonVerticesSchema.optional()
+	polygonVertices: MaskPolygonVerticesSchema.optional(),
+	/**
+	* Does this camera expose a microphone switch we can actually write?
+	*
+	* Camera-probed: `true` only when the firmware answered with an audio flag
+	* we know how to patch. A camera that never answered is `false` — a control
+	* the operator can press that changes nothing is worse than no control, and
+	* the switch group renders "not available" instead.
+	*/
+	supportsAudioMute: zod.z.boolean()
 });
 /** Partial change — every field optional. */
 var PrivacyMaskPatchSchema = zod.z.object({
@@ -22546,6 +22872,27 @@ var privacyMaskCapability = {
 		}), zod.z.void(), {
 			kind: "mutation",
 			auth: "admin"
+		}),
+		/**
+		* Turn the camera's microphone on or off, at the camera.
+		*
+		* Deliberately its OWN mutation rather than a field on
+		* {@link PrivacyMaskPatchSchema}: `patch.enabled` already means "the video
+		* mask master switch", and overloading it would make one boolean mean two
+		* unrelated things on the same call. It is also the only method here whose
+		* write leaves the device in a state a later `getStatus` reads back
+		* verbatim, which is what makes it safe as a switch authority.
+		*
+		* A camera whose `getOptions().supportsAudioMute` is false must REJECT
+		* this rather than silently accept it — a write nothing applies is exactly
+		* what the switch group exists to remove.
+		*/
+		setAudioEnabled: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			enabled: zod.z.boolean()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
 		})
 	},
 	status: {
@@ -22554,6 +22901,26 @@ var privacyMaskCapability = {
 	},
 	runtimeState: PrivacyMaskStatusSchema
 };
+/**
+* Collapse a camera's PER-PROFILE audio flags into the one answer
+* {@link PrivacyMaskStatusSchema.shape.audioEnabled} promises.
+*
+* Both firmwares this cap talks to store the flag per stream profile, and
+* both let those profiles disagree. The rule is `some`, not `every`: privacy
+* is only satisfied when NOTHING is carrying sound, so a camera whose sub
+* stream is still audible must read as `true` and be switchable off — not as
+* `false` because the main stream happens to be muted already.
+*
+* An empty list is `null` ("this camera reported no audio flag at all"),
+* never `false`.
+*
+* Lives here rather than in each provider so the rule the schema documents
+* and the rule the providers apply cannot drift apart.
+*/
+function summarisePrivacyAudio(profiles) {
+	if (profiles.length === 0) return null;
+	return profiles.some((p) => p.audioEnabled);
+}
 //#endregion
 //#region src/capabilities/ptz.cap.ts
 var PtzPresetSchema = zod.z.object({
@@ -22938,6 +23305,21 @@ var LocateSegmentResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
 })]);
 /** Raw bytes of one finalized footage segment (read off disk on the recording node). */
 var ReadSegmentBytesResultSchema = zod.z.object({ data: zod.z.instanceof(Uint8Array) });
+/**
+* One GOP of a finalized segment, cut by byte range through the segment's own
+* `mfra` (D31 on the D42 feeder path). `data` is the `ftyp`+`moov` head plus
+* the single `moof`+`mdat` covering the requested instant — standalone-
+* demuxable, never the whole file. When the segment's index cannot be parsed
+* the provider degrades INSIDE the mechanism to the whole segment (still one
+* `data`, `gopStartMs` = the segment start) — a worse read, not another path.
+*/
+var ReadGopBytesResultSchema = zod.z.object({
+	data: zod.z.instanceof(Uint8Array),
+	/** Absolute epoch ms of the returned fragment's first sample. */
+	gopStartMs: zod.z.number(),
+	/** Media ms the returned fragment covers. */
+	gopDurMs: zod.z.number()
+});
 var recordingCapability = {
 	name: "recording",
 	scope: "system",
@@ -23005,6 +23387,18 @@ var recordingCapability = {
 			kind: "query",
 			auth: "admin"
 		}),
+		/** Read the single GOP of segment `startMs` covering `epochMs`, by mfra
+		*  byte range — the scrub-granular read (D31 letter on the feeder path).
+		*  See {@link ReadGopBytesResultSchema} for the degradation contract. */
+		readGopBytes: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			profile: zod.z.string(),
+			startMs: zod.z.number(),
+			epochMs: zod.z.number()
+		}), ReadGopBytesResultSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
 		setDeviceConfig: require_sleep.method(zod.z.object({
 			deviceId: zod.z.number(),
 			config: RecordingConfigSchema
@@ -23666,6 +24060,16 @@ var StreamProfileConfigSchema = zod.z.object({
 		"baseline"
 	]).optional(),
 	gop: zod.z.number().optional(),
+	/**
+	* Whether THIS profile currently carries an audio track. READ-ONLY here.
+	*
+	* There is no matching field on {@link StreamProfilePatchSchema}: the
+	* camera's microphone is owned by `privacy-mask` (`setAudioEnabled`), which
+	* writes every profile at once so "audio off" means silent everywhere. A
+	* per-profile writer beside it would let a camera be half-muted and would be
+	* a second knob onto one device register — the failure D62 exists to
+	* prevent. Absent when the firmware does not report the flag.
+	*/
 	audio: zod.z.boolean().optional()
 });
 var StreamParamsStatusSchema = zod.z.object({
@@ -23706,7 +24110,13 @@ var StreamParamsOptionsSchema = zod.z.object({
 	ext: StreamProfileOptionsSchema.optional()
 });
 /** A partial change to one profile — every field optional; a provider
-*  ignores fields it doesn't support. */
+*  ignores fields it doesn't support.
+*
+*  There is deliberately NO `audio` here. It existed until 2026-08-07,
+*  reachable from no form and honoured by exactly one provider, while the
+*  camera's microphone is a whole-device fact. It now has one writer,
+*  `privacyMask.setAudioEnabled`, which writes every profile — see
+*  `privacy-mask.cap.ts`. */
 var StreamProfilePatchSchema = zod.z.object({
 	width: zod.z.number().optional(),
 	height: zod.z.number().optional(),
@@ -23719,8 +24129,7 @@ var StreamProfilePatchSchema = zod.z.object({
 		"main",
 		"baseline"
 	]).optional(),
-	gop: zod.z.number().optional(),
-	audio: zod.z.boolean().optional()
+	gop: zod.z.number().optional()
 });
 var streamParamsCapability = {
 	name: "stream-params",
@@ -26639,10 +27048,7 @@ var BATTERY_DEVICE_PROFILE = {
 		audioMode: "disabled",
 		detectionMode: "on-motion"
 	},
-	settings: {
-		"snapshot.minRefreshIntervalSec": 3600,
-		"streamBroker.preBufferEnabled": false
-	}
+	settings: {}
 };
 /**
 * Profile registry — order matters when multiple profiles match the
@@ -27494,7 +27900,7 @@ var SystemMirror = class {
 	}
 	async refreshDeviceMetadata(deviceId, kind) {
 		try {
-			const info = (await this.api.deviceManager.listAll.query({})).find((d) => d.id === deviceId);
+			const info = await this.api.deviceManager.getDevice.query({ deviceId });
 			if (!info) return;
 			const wasNew = !this.devices.has(deviceId);
 			this.devices.set(deviceId, info);
@@ -27806,6 +28212,7 @@ var CAPABILITY_NAMES = {
 	numericSensor: "numeric-sensor",
 	oauthIntegration: "oauth-integration",
 	osd: "osd",
+	osdManager: "osd-manager",
 	petFeeder: "pet-feeder",
 	pipelineAnalytics: "pipeline-analytics",
 	pipelineExecutor: "pipeline-executor",
@@ -28237,6 +28644,10 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "osd",
 		name: "osd"
 	},
+	{
+		key: "osdManager",
+		name: "osd-manager"
+	},
 	{
 		key: "petFeeder",
 		name: "pet-feeder"
@@ -28550,6 +28961,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	numericSensorCapability,
 	oauthIntegrationCapability,
 	osdCapability,
+	osdManagerCapability,
 	petFeederCapability,
 	pipelineAnalyticsCapability,
 	pipelineExecutorCapability,
@@ -31468,6 +31880,48 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"osdManager.clearSlotBinding": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"osdManager.getConditionSupport": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"osdManager.getDeviceOsd": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"osdManager.getSourceCatalog": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"osdManager.previewSlot": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"osdManager.renderDevice": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"osdManager.setSlotBinding": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"petFeeder.callPet": {
 		capName: "pet-feeder",
 		capScope: "device",
@@ -31630,6 +32084,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getTrainingExportSummary": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.getTrainingExportUrl": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listEventKinds": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -32386,6 +32852,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"privacyMask.setAudioEnabled": {
+		capName: "privacy-mask",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"privacyMask.setMask": {
 		capName: "privacy-mask",
 		capScope: "device",
@@ -32554,6 +33026,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.readGopBytes": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.readSegmentBytes": {
 		capName: "recording",
 		capScope: "system",
@@ -33094,6 +33572,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"streamBroker.getDeviceAudioMute": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"streamBroker.getPreBufferInfo": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -33214,6 +33698,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.setDeviceAudioMute": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.setPreBufferDuration": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -33929,6 +34419,7 @@ var KNOWN_CAP_NAMES = [
 	"notifier",
 	"oauth-integration",
 	"osd",
+	"osd-manager",
 	"pet-feeder",
 	"pipeline-analytics",
 	"pipeline-executor",
@@ -34076,6 +34567,7 @@ var SYSTEM_CAP_NAMES = [
 	"notification-output",
 	"notification-rules",
 	"oauth-integration",
+	"osd-manager",
 	"pipeline-executor",
 	"pipeline-orchestrator",
 	"pipeline-runner",
@@ -34534,6 +35026,7 @@ function createSystemProxy(api) {
 			deleteTarget: (input) => dispatch("notificationOutput", "deleteTarget", "mutation", input),
 			setTargetEnabled: (input) => dispatch("notificationOutput", "setTargetEnabled", "mutation", input)
 		},
+		osdManager: { getConditionSupport: (input) => dispatch("osdManager", "getConditionSupport", "query", input) },
 		pipelineExecutor: {
 			getAvailableEngines: (input) => dispatch("pipelineExecutor", "getAvailableEngines", "query", input),
 			getSelectedEngine: (input) => dispatch("pipelineExecutor", "getSelectedEngine", "query", input),
@@ -35075,6 +35568,68 @@ function prepareNotification(caps, n) {
 	};
 }
 //#endregion
+//#region src/notification/schedule.ts
+var WEEKDAY_TO_DAY = {
+	Sun: 0,
+	Mon: 1,
+	Tue: 2,
+	Wed: 3,
+	Thu: 4,
+	Fri: 5,
+	Sat: 6
+};
+/** Resolve (weekday, minute-of-day) of `atMs` in the schedule's timezone.
+*  An invalid/unknown IANA name falls back to the host timezone. */
+function localDayMinute(atMs, timezone) {
+	const d = new Date(atMs);
+	if (timezone !== void 0) try {
+		const parts = new Intl.DateTimeFormat("en-US", {
+			timeZone: timezone,
+			weekday: "short",
+			hour: "numeric",
+			minute: "numeric",
+			hourCycle: "h23"
+		}).formatToParts(d);
+		let weekday;
+		let hour;
+		let minute;
+		for (const p of parts) if (p.type === "weekday") weekday = p.value;
+		else if (p.type === "hour") hour = Number(p.value);
+		else if (p.type === "minute") minute = Number(p.value);
+		const day = weekday !== void 0 ? WEEKDAY_TO_DAY[weekday] : void 0;
+		if (day !== void 0 && hour !== void 0 && minute !== void 0) return {
+			day,
+			minute: hour * 60 + minute
+		};
+	} catch {}
+	return {
+		day: d.getDay(),
+		minute: d.getHours() * 60 + d.getMinutes()
+	};
+}
+/**
+* Is the schedule active at `atMs`? No schedule = always active. Windows
+* are OR'd; a window with `startMinute > endMinute` crosses midnight (it
+* starts on a listed day and spills into the next). `invert` flips the
+* result (active OUTSIDE the windows).
+*/
+function isScheduleActive(schedule, atMs) {
+	if (schedule === void 0) return true;
+	const { day, minute } = localDayMinute(atMs, schedule.timezone);
+	const prevDay = (day + 6) % 7;
+	let inside = false;
+	for (const w of schedule.windows) if (w.startMinute <= w.endMinute) {
+		if (w.days.includes(day) && minute >= w.startMinute && minute < w.endMinute) {
+			inside = true;
+			break;
+		}
+	} else if (w.days.includes(day) && minute >= w.startMinute || w.days.includes(prevDay) && minute < w.endMinute) {
+		inside = true;
+		break;
+	}
+	return schedule.invert === true ? !inside : inside;
+}
+//#endregion
 //#region src/notification/timelapse-rule.ts
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
@@ -35572,6 +36127,44 @@ function bestLocationMatch(externalName, existing, threshold = .8) {
 	return best;
 }
 //#endregion
+//#region src/utils/addon-id.ts
+/**
+* The addon id as the REGISTRY, the wire and the durable stores spell it.
+*
+* `AddonContext.id` does not agree with itself across the two context
+* factories:
+*
+*   - a FORKED addon gets the bare manifest id
+*     (`kernel/moleculer/addon-context-factory.ts` → `id: addonId`);
+*   - an addon co-located in hub-main gets it PREFIXED
+*     (`server/backend/src/core/addon/addon-registry.service.ts` →
+*      ``id: `addon:${addonId}` ``).
+*
+* Everything an addon might compare `ctx.id` AGAINST carries the bare form:
+* `DeviceBindingEntry.providerAddonId`, the `device-manager` bindings store's
+* `wrapperAddonId`, `CapabilityRegistry` provider keys, manifest ids.
+*
+* So `entry.providerAddonId === this.ctx.id` is silently, permanently false
+* for a builtin — and only for a builtin, which is why it survives a green
+* suite whose fake supplies the bare id. That is exactly how camera 615's
+* virtual doorbell latched `unbound` for twelve hours on 2026-08-07 while its
+* binding was intact ([D72](../../../../docs/decisions/adr-0072.md)).
+*
+* Route every comparison between `ctx.id` and a registry/store addon id
+* through {@link isSameAddonId}. `scripts/check-addon-id-comparison.ts`
+* enforces it in the processes where the prefix exists.
+*/
+/** The prefix the hub-main context factory prepends to the manifest id. */
+var ADDON_ID_PREFIX = "addon:";
+/** The manifest id, whichever spelling of `ctx.id` you were handed. */
+function bareAddonId(id) {
+	return id.startsWith(ADDON_ID_PREFIX) ? id.slice(6) : id;
+}
+/** True when both ids name the same addon, prefixed or not. */
+function isSameAddonId(a, b) {
+	return bareAddonId(a) === bareAddonId(b);
+}
+//#endregion
 //#region src/utils/cosine-similarity.ts
 /** Cosine similarity between two embedding vectors */
 function cosineSimilarity(a, b) {
@@ -36298,7 +36891,7 @@ function readDetailCropConvention(config) {
 		square: square.success ? square.data : DEFAULT_DETAIL_CROP_CONVENTION.square
 	};
 }
-function isHydratedField(entry) {
+function isHydratedField$1(entry) {
 	return typeof entry === "object" && entry !== null && "key" in entry;
 }
 /**
@@ -36313,7 +36906,7 @@ function pickDetailCropConvention(view) {
 	if (view === null) return DEFAULT_DETAIL_CROP_CONVENTION;
 	const flat = {};
 	for (const section of view.sections) for (const entry of section.fields) {
-		if (!isHydratedField(entry) || typeof entry.key !== "string") continue;
+		if (!isHydratedField$1(entry) || typeof entry.key !== "string") continue;
 		if (entry.key === "detailCropPaddingRatio" || entry.key === "detailCropSquare") flat[entry.key] = entry.value;
 	}
 	return readDetailCropConvention(flat);
@@ -36400,6 +36993,245 @@ function slideInsideFrame(rect, frameWidth, frameHeight) {
 	};
 }
 //#endregion
+//#region src/pipeline/native-lease.ts
+/**
+* THE native-frame **lease** knobs — TTL, RAM budget and demand window for the
+* decode worker's native-resolution frame retention.
+*
+* ## Why they live here and not in the addon that reads them
+*
+* The WRITER is `pipeline-orchestrator` (the cluster-wide settings authority);
+* the READER is a private child process of `addon-pipeline`'s pipeline-runner.
+* Addons never import each other, so a key owned by either side would have to
+* be hand-copied by the other — and a hand-copied key is how a setting silently
+* stops arriving while both sides still look correct. Same reasoning, same
+* placement as `detail-crop.ts` (D52's "one cluster-wide orchestrator setting").
+*
+* ## Why cluster-wide and not per-node
+*
+* The lease is a per-decode-worker RAM window. Its purpose — the late
+* cross-process native crop landing on a full-resolution frame rather than the
+* ≤640 detection fallback — is a property of the PIPELINE, not of a node's
+* hardware: a per-node TTL would mean the same camera produces different crop
+* quality depending on which node the balancer placed it on, and nobody could
+* tell that from the stored media. Node-level RAM pressure is already handled
+* by the per-session budget ceiling, which is itself one of these knobs.
+*
+* ## What each knob costs
+*
+* A retained frame is a full NATIVE-resolution copy in system RAM. With the
+* default pinned-RGB24 lease path (`CAMSTACK_SESSION_PINNED_RGB_CROP`, on):
+* 4K ≈ 24.9 MB/frame, 1080p ≈ 6.2 MB/frame. On the YUV420P path (flag off, and
+* for software-decoded sessions): 4K ≈ 12.4 MB, 1080p ≈ 3.1 MB. Worst-case
+* resident RAM for ONE busy camera ≈ frameBytes × deliveredFps × ttlSeconds,
+* clamped by the budget ceiling. See `docs/design/decode-path.md` → "Lease
+* admission" for what actually gets admitted.
+*/
+/**
+* Store identity of the lease knobs in `pipeline-orchestrator`'s GLOBAL
+* (cluster-wide) settings. Keys are unique across that addon's whole schema, so
+* the reader can walk every section instead of trusting the section id.
+*/
+var NATIVE_LEASE_SECTION_ID = "native-lease";
+var NATIVE_LEASE_TTL_KEY = "nativeLeaseTtlMs";
+var NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
+var NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
+var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
+/**
+* WHICH delivered frames the decode worker retains a native copy of.
+*
+* - `all` — every frame the worker delivered to the runner. The shipped
+*   behaviour, and the only correct one if something can ask for a crop of a
+*   frame the runner never sent to inference.
+* - `inferred` — only the frames the runner ADMITTED to its detection queue.
+*   A native-crop request always names a `frameId` that rode an inference
+*   result, so that is the only set a request can name. How much it drops is
+*   the two-plane governor's admit ratio and nothing else: measured at ~50% on
+*   this cluster, not the ~80% the design sketch assumed, because the governor
+*   was not throttling as hard as the sketch supposed. Read
+*   `leaseAdmitted`/`leaseOffered` off the metrics line for the camera in front
+*   of you rather than quoting a number from here. The newest delivered frame is
+*   croppable regardless — it is still the worker's reserved slot, not a lease —
+*   which covers the one-frame race between a mark and the supersede that
+*   consumes it.
+*/
+var NativeLeaseAdmissionSchema = zod.z.enum(["all", "inferred"]);
+/**
+* Operator-tunable native-lease settings. Bounds are enforced HERE (not only in
+* the slider) because the value also travels to a forked child process, where a
+* junk number would silently become a 0-length or unbounded retention window.
+*/
+var NativeLeaseSettingsSchema = zod.z.object({
+	/**
+	* How long a retained native frame is served before it counts as a miss.
+	*
+	* Must cover the FULL late-crop horizon: detection inference + the
+	* cross-process inference-result hop to hub post-analysis + tracking + the
+	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
+	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
+	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	*/
+	ttlMs: zod.z.number().int().min(250).max(1e4),
+	/**
+	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
+	*
+	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
+	* which one is actually binding before reasoning from that. At the shipped
+	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
+	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
+	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
+	* change that admits fewer frames buys retention WINDOW at constant RAM
+	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* `0` DISABLES the lease entirely and falls the worker back to the tiny
+	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
+	* to replace).
+	*/
+	budgetMb: zod.z.number().int().min(0).max(4096),
+	/**
+	* Demand window: eager per-frame native retention runs only within this many
+	* ms of the last native-crop request (or of the dial starting).
+	*
+	* `0` means ALWAYS ON — it disables the gate, it does not disable retention.
+	* That is the legacy behaviour that saturated an N100 (24 native-4K downloads
+	* per second on a camera with zero crop demand), so leave it non-zero unless
+	* you are reproducing that.
+	*/
+	activityMs: zod.z.number().int().min(0).max(12e4),
+	/**
+	* Which delivered frames are retained at all — see
+	* {@link NativeLeaseAdmissionSchema}. This is the only knob of the four that
+	* changes WHAT is kept rather than for how long, so it is also the only one
+	* that can turn a crop that used to hit into a miss. The worker counts every
+	* crop request naming a frame it did NOT see marked
+	* (`leaseUnmarkedCrops` on the session-decode metrics line): a non-zero value
+	* there is the signal that some caller names frames outside the inference set
+	* and that this must go back to `all`.
+	*/
+	admission: NativeLeaseAdmissionSchema
+});
+/**
+* The values in force when the operator has set nothing — byte-for-byte the
+* constants the decode worker shipped with as env-var defaults, so making these
+* settings changed no behaviour on the day it landed.
+*/
+var DEFAULT_NATIVE_LEASE_SETTINGS = {
+	ttlMs: 1200,
+	budgetMb: 1024,
+	activityMs: 15e3,
+	admission: "inferred"
+};
+/** Slider bounds for the operator-facing knobs (orchestrator settings UI). */
+var NATIVE_LEASE_TTL_FIELD = {
+	min: 250,
+	max: 1e4,
+	step: 50,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs
+};
+var NATIVE_LEASE_BUDGET_FIELD = {
+	min: 0,
+	max: 4096,
+	step: 64,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb
+};
+var NATIVE_LEASE_ACTIVITY_FIELD = {
+	min: 0,
+	max: 12e4,
+	step: 1e3,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.activityMs
+};
+/** Select options for the admission knob (orchestrator settings UI). */
+var NATIVE_LEASE_ADMISSION_FIELD = {
+	options: [{
+		value: "all",
+		label: "Every delivered frame"
+	}, {
+		value: "inferred",
+		label: "Only frames sent to inference"
+	}],
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.admission
+};
+/**
+* Parse one knob, reporting `null` for absent, junk, out-of-bounds — AND for a
+* value equal to the shipped default.
+*
+* That last rule is not tidiness, it is the difference between the documented
+* precedence being true and being a lie. `addon-settings.getGlobalSettings`
+* returns a HYDRATED payload, and `hydrateField` fills an unstored field with
+* the schema's own `default` (verified live on the hub: a cluster that has never
+* opened the form still reports `nativeLeaseTtlMs = 1200`). A reader that took
+* that at face value would report all three knobs as "set" on every cluster on
+* the day this shipped, permanently retiring the `CAMSTACK_SESSION_NATIVE_LEASE_*`
+* emergency override that the precedence promises. There is no raw-store read on
+* this cap to distinguish the two, so the default value itself is treated as
+* "the operator has expressed no preference" — which is also what leaving a
+* slider untouched means.
+*
+* The cost is one honest edge: an operator who deliberately selects the default
+* value in order to overrule an env var does not get it. Clear the env var
+* instead; the worker's spawn line names the source, so this is visible rather
+* than mysterious.
+*/
+function readKnob(knob, raw) {
+	const parsed = NativeLeaseSettingsSchema.shape[knob].safeParse(raw);
+	if (!parsed.success) return null;
+	return parsed.data === DEFAULT_NATIVE_LEASE_SETTINGS[knob] ? null : parsed.data;
+}
+/** {@link readKnob} for the one non-numeric knob. Same default-means-unset rule. */
+function readAdmissionKnob(raw) {
+	const parsed = NativeLeaseAdmissionSchema.safeParse(raw);
+	if (!parsed.success) return null;
+	return parsed.data === DEFAULT_NATIVE_LEASE_SETTINGS.admission ? null : parsed.data;
+}
+/**
+* Narrow a FLAT settings record to the knobs the operator set.
+*
+* Per-FIELD parse, deliberately: a junk TTL must not also discard a valid
+* budget. An absent, out-of-bounds or default-valued knob is OMITTED (not
+* clamped, not defaulted) so the caller can still fall through to the env
+* override — clamping here would turn a typo into a value nobody chose. See
+* {@link readKnob} for why the default counts as unset.
+*/
+function readNativeLeaseOverride(config) {
+	const ttlMs = readKnob("ttlMs", config[NATIVE_LEASE_TTL_KEY]);
+	const budgetMb = readKnob("budgetMb", config[NATIVE_LEASE_BUDGET_KEY]);
+	const activityMs = readKnob("activityMs", config[NATIVE_LEASE_ACTIVITY_KEY]);
+	const admission = readAdmissionKnob(config[NATIVE_LEASE_ADMISSION_KEY]);
+	return {
+		...ttlMs === null ? {} : { ttlMs },
+		...budgetMb === null ? {} : { budgetMb },
+		...activityMs === null ? {} : { activityMs },
+		...admission === null ? {} : { admission }
+	};
+}
+function isHydratedField(entry) {
+	return typeof entry === "object" && entry !== null && "key" in entry;
+}
+var LEASE_KEYS = [
+	NATIVE_LEASE_TTL_KEY,
+	NATIVE_LEASE_BUDGET_KEY,
+	NATIVE_LEASE_ACTIVITY_KEY,
+	NATIVE_LEASE_ADMISSION_KEY
+];
+/**
+* Extract the operator's lease overrides from an
+* `addon-settings.getGlobalSettings` payload.
+*
+* Walks EVERY section rather than looking inside {@link NATIVE_LEASE_SECTION_ID}
+* alone: the keys are unique across the addon's schema, and a section rename
+* must not silently revert the whole cluster to the defaults. A `null` payload
+* (addon mid-boot) means "operator set nothing" — the env/default fallback then
+* applies, which is the correct read of "I could not ask".
+*/
+function pickNativeLeaseOverride(view) {
+	if (view === null) return {};
+	const flat = {};
+	for (const section of view.sections) for (const entry of section.fields) {
+		if (!isHydratedField(entry) || typeof entry.key !== "string") continue;
+		if (LEASE_KEYS.includes(entry.key)) flat[entry.key] = entry.value;
+	}
+	return readNativeLeaseOverride(flat);
+}
+//#endregion
 //#region src/helpers/bind-addon-actions.ts
 /**
 * Bind an addon's custom-action catalog to its tRPC surface, returning a
@@ -36658,7 +37490,7 @@ exports.APPLE_SA_TO_MACRO = APPLE_SA_TO_MACRO;
 exports.AUDIO_ANALYSIS_CAP_NAME = AUDIO_ANALYSIS_CAP_NAME;
 exports.AUDIO_BACKEND_CHOICES = AUDIO_BACKEND_CHOICES;
 exports.AUDIO_MACRO_LABELS = AUDIO_MACRO_LABELS;
-exports.AUDIO_PRESETS = AUDIO_PRESETS;
+exports.AUDIO_PRESETS = require_fmp4_box_splitter.AUDIO_PRESETS;
 exports.AccessoriesStatusSchema = AccessoriesStatusSchema;
 exports.AccessoryKind = AccessoryKind;
 exports.AddBrokerInputSchema = AddBrokerInputSchema;
@@ -36833,6 +37665,7 @@ exports.DEFAULT_DECODER_HWACCEL_CONFIG = DEFAULT_DECODER_HWACCEL_CONFIG;
 exports.DEFAULT_DETAIL_CROP_CONVENTION = DEFAULT_DETAIL_CROP_CONVENTION;
 exports.DEFAULT_EVENT_COLOR = DEFAULT_EVENT_COLOR;
 exports.DEFAULT_FEATURES = DEFAULT_FEATURES;
+exports.DEFAULT_NATIVE_LEASE_SETTINGS = DEFAULT_NATIVE_LEASE_SETTINGS;
 exports.DEFAULT_RETENTION = DEFAULT_RETENTION;
 exports.DEFAULT_SCRUB_THUMBNAIL_PRESET = DEFAULT_SCRUB_THUMBNAIL_PRESET;
 exports.DETAIL_CROP_PADDING_FIELD = DETAIL_CROP_PADDING_FIELD;
@@ -36891,6 +37724,10 @@ exports.EXPRESSION_BUILTIN_NAMES = EXPRESSION_BUILTIN_NAMES;
 exports.EXPRESSION_COMPILE_CACHE_CAPACITY = EXPRESSION_COMPILE_CACHE_CAPACITY;
 exports.EXPRESSION_IDENTIFIER_RE = EXPRESSION_IDENTIFIER_RE;
 exports.EXPRESSION_INJECTED_NOW = EXPRESSION_INJECTED_NOW;
+exports.EgressEncodeSchema = EgressEncodeSchema;
+exports.EgressRateControlSchema = EgressRateControlSchema;
+exports.EgressTranscodeRequestSchema = EgressTranscodeRequestSchema;
+exports.EgressTranscodeSchema = EgressTranscodeSchema;
 exports.ElementConfigStore = ElementConfigStore;
 exports.EmbeddingInfoSchema = EmbeddingInfoSchema;
 exports.EmbeddingResultSchema = EmbeddingResultSchema;
@@ -36926,6 +37763,7 @@ exports.FanDirectionSchema = FanDirectionSchema;
 exports.FeatureManifestSchema = FeatureManifestSchema;
 exports.FeatureProbeStatusSchema = FeatureProbeStatusSchema;
 exports.FloodStatusSchema = FloodStatusSchema;
+exports.Fmp4BoxSplitter = require_fmp4_box_splitter.Fmp4BoxSplitter;
 exports.FrameHandleFormatSchema = require_sleep.FrameHandleFormatSchema;
 exports.FrameHandleSchema = require_sleep.FrameHandleSchema;
 exports.FrameInputSchema = FrameInputSchema;
@@ -37046,6 +37884,15 @@ exports.MotionZoneRegionSchema = MotionZoneRegionSchema;
 exports.MotionZoneStatusSchema = MotionZoneStatusSchema;
 exports.MqttBrokerStatusSchema = StatusSchema;
 exports.MutationFilterSchema = MutationFilterSchema;
+exports.NATIVE_LEASE_ACTIVITY_FIELD = NATIVE_LEASE_ACTIVITY_FIELD;
+exports.NATIVE_LEASE_ACTIVITY_KEY = NATIVE_LEASE_ACTIVITY_KEY;
+exports.NATIVE_LEASE_ADMISSION_FIELD = NATIVE_LEASE_ADMISSION_FIELD;
+exports.NATIVE_LEASE_ADMISSION_KEY = NATIVE_LEASE_ADMISSION_KEY;
+exports.NATIVE_LEASE_BUDGET_FIELD = NATIVE_LEASE_BUDGET_FIELD;
+exports.NATIVE_LEASE_BUDGET_KEY = NATIVE_LEASE_BUDGET_KEY;
+exports.NATIVE_LEASE_SECTION_ID = NATIVE_LEASE_SECTION_ID;
+exports.NATIVE_LEASE_TTL_FIELD = NATIVE_LEASE_TTL_FIELD;
+exports.NATIVE_LEASE_TTL_KEY = NATIVE_LEASE_TTL_KEY;
 exports.NC_BASE_CONDITION_KEYS = NC_BASE_CONDITION_KEYS;
 exports.NC_CONDITION_CATALOG = NC_CONDITION_CATALOG;
 exports.NC_HISTORY_LIMIT_DEFAULT = NC_HISTORY_LIMIT_DEFAULT;
@@ -37057,6 +37904,8 @@ exports.NativeCropBboxSchema = NativeCropBboxSchema;
 exports.NativeCropRefSchema = NativeCropRefSchema;
 exports.NativeCropResultSchema = NativeCropResultSchema;
 exports.NativeDetectionSchema = NativeDetectionSchema;
+exports.NativeLeaseAdmissionSchema = NativeLeaseAdmissionSchema;
+exports.NativeLeaseSettingsSchema = NativeLeaseSettingsSchema;
 exports.NativeObjectClassEnum = NativeObjectClassEnum;
 exports.NativeObjectDetectionRuntimeStateSchema = NativeObjectDetectionRuntimeStateSchema;
 exports.NativeObjectDetectionStatusSchema = NativeObjectDetectionStatusSchema;
@@ -37121,11 +37970,19 @@ exports.OsdOverlayKindEnum = OsdOverlayKindEnum;
 exports.OsdOverlayPatchSchema = OsdOverlayPatchSchema;
 exports.OsdOverlaySchema = OsdOverlaySchema;
 exports.OsdPositionEnum = OsdPositionEnum;
+exports.OsdRenderOutcomeEnum = OsdRenderOutcomeEnum;
+exports.OsdRenderResultSchema = OsdRenderResultSchema;
+exports.OsdSlotBindingSchema = OsdSlotBindingSchema;
+exports.OsdSlotViewSchema = OsdSlotViewSchema;
+exports.OsdSourceOptionSchema = OsdSourceOptionSchema;
+exports.OsdSourceSchema = OsdSourceSchema;
+exports.OsdSourceValueTypeEnum = OsdSourceValueTypeEnum;
 exports.OsdStatusSchema = OsdStatusSchema;
 exports.PET_FEEDER_MANUAL_FEED_MAX = PET_FEEDER_MANUAL_FEED_MAX;
 exports.PET_FEEDER_MANUAL_FEED_MIN = PET_FEEDER_MANUAL_FEED_MIN;
 exports.PIPELINE_FLOW_CAPABILITY_NAMES = PIPELINE_FLOW_CAPABILITY_NAMES;
 exports.PIPELINE_OWNER_CAPABILITY_NAMES = PIPELINE_OWNER_CAPABILITY_NAMES;
+exports.PRIVACY_MASK_CAP_NAME = PRIVACY_MASK_CAP_NAME;
 exports.PROVIDER_KIND_CAP_NAMES = PROVIDER_KIND_CAP_NAMES;
 exports.PYTHON_SCRIPT = PYTHON_SCRIPT;
 exports.PackageUpdateSchema = PackageUpdateSchema;
@@ -37179,6 +38036,7 @@ exports.RESERVED_BINDING_NAMES = RESERVED_BINDING_NAMES;
 exports.RUNTIME_DEFAULTS = RUNTIME_DEFAULTS;
 exports.RUNTIME_TO_FORMAT = RUNTIME_TO_FORMAT;
 exports.RawStateResultSchema = require_sleep.RawStateResultSchema;
+exports.ReadGopBytesResultSchema = ReadGopBytesResultSchema;
 exports.ReadSegmentBytesResultSchema = ReadSegmentBytesResultSchema;
 exports.ReadinessRegistry = require_sleep.ReadinessRegistry;
 exports.ReadinessTimeoutError = require_sleep.ReadinessTimeoutError;
@@ -37207,6 +38065,7 @@ exports.RelocateJobStateSchema = RelocateJobStateSchema;
 exports.RelocateMediaInputSchema = RelocateMediaInputSchema;
 exports.RenderedAsSchema = RenderedAsSchema;
 exports.ReportMotionInputSchema = ReportMotionInputSchema;
+exports.RetrainStatusSchema = RetrainStatusSchema;
 exports.RingBuffer = RingBuffer;
 exports.RtpSourceSchema = RtpSourceSchema;
 exports.RtspRestreamEntrySchema = RtspRestreamEntrySchema;
@@ -37329,6 +38188,8 @@ exports.TrackSourceSchema = TrackSourceSchema;
 exports.TrackStateSchema = TrackStateSchema;
 exports.TrackZoneFilterSchema = TrackZoneFilterSchema;
 exports.TrackedDetectionSchema = TrackedDetectionSchema;
+exports.TrainingExportDeviceTotalsSchema = TrainingExportDeviceTotalsSchema;
+exports.TrainingExportSummarySchema = TrainingExportSummarySchema;
 exports.TurnServerSchema = TurnServerSchema;
 exports.UNIT_TABLE = UNIT_TABLE;
 exports.UnifiedBrokerInfoSchema = BrokerInfoSchema$1;
@@ -37408,11 +38269,12 @@ exports.audioAnalysisCapability = audioAnalysisCapability;
 exports.audioAnalyzerCapability = audioAnalyzerCapability;
 exports.audioCodecCapability = audioCodecCapability;
 exports.audioMetricsCapability = audioMetricsCapability;
-exports.audioPlanFromEncodeProfile = audioPlanFromEncodeProfile;
+exports.audioPlanFromEncodeProfile = require_fmp4_box_splitter.audioPlanFromEncodeProfile;
 exports.authProviderCapability = authProviderCapability;
 exports.autoAssignProfiles = autoAssignProfiles;
 exports.automationControlCapability = automationControlCapability;
 exports.backupCapability = backupCapability;
+exports.bareAddonId = bareAddonId;
 exports.batteryCapability = batteryCapability;
 exports.bestLocationMatch = bestLocationMatch;
 exports.binaryCapability = binaryCapability;
@@ -37420,14 +38282,14 @@ exports.bindAddonActions = bindAddonActions;
 exports.brightnessCapability = brightnessCapability;
 exports.brokerCapability = brokerCapability;
 exports.buildAddonRouteProvider = buildAddonRouteProvider;
-exports.buildAudioArgs = buildAudioArgs;
+exports.buildAudioArgs = require_fmp4_box_splitter.buildAudioArgs;
 exports.buildEventKindDescriptor = buildEventKindDescriptor;
-exports.buildFfmpegArgs = buildFfmpegArgs;
-exports.buildInputArgs = buildInputArgs;
+exports.buildFfmpegArgs = require_fmp4_box_splitter.buildFfmpegArgs;
+exports.buildInputArgs = require_fmp4_box_splitter.buildInputArgs;
 exports.buildModelVariantGroups = buildModelVariantGroups;
 exports.buildNcTaxonomy = buildNcTaxonomy;
 exports.buildStreamParamsConfigSchema = buildStreamParamsConfigSchema;
-exports.buildVideoArgs = buildVideoArgs;
+exports.buildVideoArgs = require_fmp4_box_splitter.buildVideoArgs;
 exports.buttonCapability = buttonCapability;
 exports.cameraCredentialsCapability = cameraCredentialsCapability;
 exports.cameraPipelineConfigCapability = cameraPipelineConfigCapability;
@@ -37489,6 +38351,7 @@ exports.deviceStateCapability = deviceStateCapability;
 exports.deviceStatusCapability = deviceStatusCapability;
 exports.doorbellCapability = doorbellCapability;
 exports.egressTranscodeSharingKey = egressTranscodeSharingKey;
+exports.egressTransportFromRequest = egressTransportFromRequest;
 exports.embeddingEncoderCapability = embeddingEncoderCapability;
 exports.emitDownForOwnedCaps = require_sleep.emitDownForOwnedCaps;
 exports.emitReadiness = require_sleep.emitReadiness;
@@ -37531,7 +38394,7 @@ exports.imageCapability = imageCapability;
 exports.imageSettingsCapability = imageSettingsCapability;
 exports.integrationsCapability = integrationsCapability;
 exports.intercomCapability = intercomCapability;
-exports.invocationFromEncodeProfile = invocationFromEncodeProfile;
+exports.invocationFromEncodeProfile = require_fmp4_box_splitter.invocationFromEncodeProfile;
 exports.isAgentOnlyPlacement = isAgentOnlyPlacement;
 exports.isArrayOutputSchema = isArrayOutputSchema;
 exports.isBaseConditionKey = isBaseConditionKey;
@@ -37542,7 +38405,9 @@ exports.isDeviceScopedCap = require_sleep.isDeviceScopedCap;
 exports.isEvent = require_sleep.isEvent;
 exports.isNode = isNode;
 exports.isObjectInput = isObjectInput;
-exports.isSoftwareDecode = isSoftwareDecode;
+exports.isSameAddonId = isSameAddonId;
+exports.isScheduleActive = isScheduleActive;
+exports.isSoftwareDecode = require_fmp4_box_splitter.isSoftwareDecode;
 exports.isVoidInput = isVoidInput;
 exports.jobKindSchema = jobKindSchema;
 exports.kebabToCamel = kebabToCamel;
@@ -37557,7 +38422,7 @@ exports.llmRuntimeCapability = llmRuntimeCapability;
 exports.localNetworkCapability = localNetworkCapability;
 exports.locationSimilarity = locationSimilarity;
 exports.lockControlCapability = lockControlCapability;
-exports.logBannerArgs = logBannerArgs;
+exports.logBannerArgs = require_fmp4_box_splitter.logBannerArgs;
 exports.logDestinationCapability = logDestinationCapability;
 exports.logLevelAtMost = logLevelAtMost;
 exports.loginMethodCapability = loginMethodCapability;
@@ -37595,6 +38460,7 @@ exports.numericSensorCapability = numericSensorCapability;
 exports.oauthIntegrationCapability = oauthIntegrationCapability;
 exports.objectInputDeclaresAddonId = objectInputDeclaresAddonId;
 exports.osdCapability = osdCapability;
+exports.osdManagerCapability = osdManagerCapability;
 exports.parseCameraStreamConfig = parseCameraStreamConfig;
 exports.parseExpression = parseExpression;
 exports.parseJsonArray = require_sleep.parseJsonArray;
@@ -37605,8 +38471,9 @@ exports.parseStreamParamsFormPatch = parseStreamParamsFormPatch;
 exports.petFeederCapability = petFeederCapability;
 exports.pickAccessoryControl = pickAccessoryControl;
 exports.pickDetailCropConvention = pickDetailCropConvention;
+exports.pickNativeLeaseOverride = pickNativeLeaseOverride;
 exports.pickPreferredRtspEntry = pickPreferredRtspEntry;
-exports.pickVideoEncoder = pickVideoEncoder;
+exports.pickVideoEncoder = require_fmp4_box_splitter.pickVideoEncoder;
 exports.pickerForCondition = pickerForCondition;
 exports.pipelineAnalyticsCapability = pipelineAnalyticsCapability;
 exports.pipelineExecutorCapability = pipelineExecutorCapability;
@@ -37625,6 +38492,7 @@ exports.ptzCapability = ptzCapability;
 exports.pythonScriptForBackend = pythonScriptForBackend;
 exports.readDetailCropConvention = readDetailCropConvention;
 exports.readDeviceStateFrom = readDeviceStateFrom;
+exports.readNativeLeaseOverride = readNativeLeaseOverride;
 exports.readNodePin = require_sleep.readNodePin;
 exports.readinessKey = require_sleep.readinessKey;
 exports.rebootCapability = rebootCapability;
@@ -37675,6 +38543,7 @@ exports.streamParamsCapability = streamParamsCapability;
 exports.streamPixels = streamPixels;
 exports.streamQualityLabel = streamQualityLabel;
 exports.subKindsOf = subKindsOf;
+exports.summarisePrivacyAudio = summarisePrivacyAudio;
 exports.supportedRuntimes = supportedRuntimes;
 exports.switchCapability = switchCapability;
 exports.switchedOffIds = switchedOffIds;
@@ -37689,6 +38558,7 @@ exports.terminalSessionCapability = terminalSessionCapability;
 exports.textToHtml = textToHtml;
 exports.toDeviceSummary = toDeviceSummary;
 exports.toExpressionValue = toExpressionValue;
+exports.toNodeId = require_sleep.toNodeId;
 exports.toStreamSourceEntry = toStreamSourceEntry;
 exports.toastCapability = toastCapability;
 exports.tokenize = tokenize;