@homebridge-plugins/homebridge-eufy-security 4.7.2 → 5.0.0-beta.0

package/dist/homekit/adapters/camera-streaming.js

@@ -0,0 +1,1515 @@
+import { NightVision } from '@mega-yfue/eufy-sdk';
+import { satisfiesMemberRequirements } from '../../device/member-evidence.js';
+import { cameraEnablementReader, observesCameraEnablement, untrusted } from '../../device/member-trust.js';
+import { deviceOperationIssuer, enablementAnnouncement, INVALID_OBSERVATION_CONDITION, observationReader, } from '../device-control.js';
+import { isBatteryPowered } from './battery.js';
+import { hasAdmittedDoorbellPress } from './doorbell.js';
+import { hasAdmittedMotionEvents, motionSensorService } from './motion.js';
+export const CAMERA_STREAMING_ADAPTER_KEY = 'camera.streaming';
+/**
+ * The resolutions every camera advertises to a controller.
+ *
+ * One 16:9 ladder for every camera, whatever shape its own source produces. A camera of another shape has its
+ * picture scaled to fit and centred, which preserves its aspect and costs it no bit rate. Dimensions are even
+ * because H.264 codes in macroblocks, and the frame rate is a ceiling a session may select below rather than a
+ * target.
+ */
+const ADVERTISED_RESOLUTIONS = [
+    [320, 180, 15],
+    [640, 360, 30],
+    [1280, 720, 30],
+    [1920, 1080, 30],
+];
+/**
+ * The stable key of the Camera Operating Mode service this bundle publishes for a camera that configures no
+ * HomeKit Secure Video recording, and therefore has no controller-owned service to carry the presented
+ * state.
+ */
+export const CAMERA_OPERATING_MODE_SERVICE_KEY = 'camera.operating-mode';
+const CAMERA_LIVE_SESSION_CONDITION = 'camera-live-session-failed';
+const CAMERA_LIVE_REFUSED_CONDITION = 'camera-live-session-refused';
+/**
+ * Why live view is unavailable for a camera the host has no room for, kept apart from the enablement refusal.
+ *
+ * The two cannot share a condition. They are withdrawn by different events, they name different things to do
+ * about them — one is a camera to switch on, the other a ceiling to raise or a viewer to close — and a camera
+ * cannot have two writers for why live view is unavailable, so a transient capacity refusal would otherwise
+ * clear the latch a disabled camera is holding.
+ */
+const CAMERA_MEDIA_AT_CAPACITY_CONDITION = 'camera-media-at-capacity';
+const CAMERA_SNAPSHOT_UNAVAILABLE_CONDITION = 'camera-snapshot-unavailable';
+const CAMERA_RECORDING_UNAVAILABLE_CONDITION = 'camera-recording-unavailable';
+const CAMERA_RECORDING_FAILED_CONDITION = 'camera-recording-failed';
+const CAMERA_RECORDING_REFUSED_CONDITION = 'camera-recording-refused';
+const CAMERA_TALKBACK_UNAVAILABLE_CONDITION = 'camera-talkback-capability-unavailable';
+const CAMERA_TALKBACK_FAILED_CONDITION = 'camera-talkback-failed';
+/**
+ * The pre-event media window this camera advertises and, when it is eligible, retains in milliseconds.
+ * HomeKit requires an accessory to advertise at least four seconds, so this is the floor rather than a
+ * choice, and a camera that retains it never retains more than a controller can select.
+ */
+const RECORDING_PREBUFFER_MS = 4_000;
+/** The fragment length this camera advertises, which is the value HomeKit Secure Video cameras use. */
+const RECORDING_FRAGMENT_LENGTH_MS = 4_000;
+/**
+ * The recorded audio sample rates this camera advertises, in kHz.
+ *
+ * A station sends 16 kHz mono, so every higher rate is resampled on the way out rather than being source
+ * truth. They are still advertised because the adaptation genuinely produces each of them, and a controller
+ * that finds no rate it accepts selects no recording configuration at all.
+ */
+const RECORDING_AUDIO_SAMPLE_RATES = [16, 24, 32, 48];
+/** The HomeKit identifier for each advertised recorded audio sample rate. */
+const RECORDING_SAMPLE_RATES = (hap) => ({
+    16: 1 /* hap.AudioRecordingSamplerate.KHZ_16 */,
+    24: 2 /* hap.AudioRecordingSamplerate.KHZ_24 */,
+    32: 3 /* hap.AudioRecordingSamplerate.KHZ_32 */,
+    48: 5 /* hap.AudioRecordingSamplerate.KHZ_48 */,
+});
+/**
+ * The indicator LED this bundle presents on the same service, and the operation that moves it. HomeKit
+ * calls it the camera operating mode indicator, which is what the Home app shows as the camera's status
+ * light, so it belongs on that service rather than on a switch of its own.
+ */
+const CAMERA_STATUS_LED_READ = { id: 'camera.statusLed.read', kind: 'read', type: 'bool', writable: true };
+const CAMERA_STATUS_LED_WRITE = { id: 'camera.statusLed.persistent-operation', kind: 'persistent-operation' };
+/**
+ * Night vision, presented on the same service. The SDK reports it as a three-value mode and HomeKit carries
+ * one boolean, so the projection is this plugin's: see {@link nightVisionPresentation}.
+ */
+const CAMERA_NIGHT_VISION_READ = { id: 'camera.nightVision.read', kind: 'read', type: 'enum', writable: true };
+const CAMERA_NIGHT_VISION_WRITE = {
+    id: 'camera.nightVision.persistent-operation',
+    kind: 'persistent-operation',
+};
+/** The operation that turns this camera off and on again, which HomeKit's own camera-active state drives. */
+const CAMERA_ENABLED_WRITE = { id: 'camera.enabled.persistent-operation', kind: 'persistent-operation' };
+/** The night-vision modes the SDK declares, which are the only readings this plugin will project. */
+const NIGHT_VISION_MODES = new Set(Object.values(NightVision));
+/**
+ * How often an active live session re-reads the enablement observation.
+ *
+ * The SDK announces an enablement change, and a session ends on that announcement rather than on this tick,
+ * so this is the backstop for a change no announcement reached: the push event covers only a write the SDK
+ * itself issued, and the poll event only fires as often as the account is polled. The read is an in-memory
+ * one whose own staleness policy bounds how often it reaches the network, so the tick period buys detection
+ * latency without buying requests.
+ */
+const ENABLEMENT_SUPERVISION_INTERVAL_MS = 5_000;
+/**
+ * How long a started request is given to reach an outcome before it is reported as having reached none.
+ *
+ * Comfortably past the longest legitimate start: a camera on a base costs a second or two to acquire, and the
+ * adaptation a moment more. Anything still owing an outcome here is not slow, it is lost.
+ */
+const UNACCOUNTED_REQUEST_MS = 30_000;
+const CAMERA_LIVE = {
+    id: 'camera.live.momentary-action',
+    kind: 'momentary-action',
+};
+const CAMERA_SNAPSHOT_STORED = {
+    id: 'camera.snapshotStored.momentary-action',
+    kind: 'momentary-action',
+};
+const CAMERA_SNAPSHOT_LIVE = {
+    id: 'camera.snapshotLive.momentary-action',
+    kind: 'momentary-action',
+};
+const CAMERA_RECORD_FRAGMENTS = {
+    id: 'camera.recordFragments.momentary-action',
+    kind: 'momentary-action',
+};
+const CAMERA_TALKBACK = {
+    id: 'camera.talkback.momentary-action',
+    kind: 'momentary-action',
+};
+const CAMERA_STREAMING_OWNERS = new WeakMap();
+const CAMERA_STREAMING_STATES = new WeakMap();
+/** Complete HomeKit RTP policy for an exactly evidenced SDK live-camera action. */
+export const CAMERA_STREAMING_ADAPTER = {
+    key: CAMERA_STREAMING_ADAPTER_KEY,
+    role: 'primary-purpose',
+    requires: [CAMERA_LIVE],
+    coverage: [
+        CAMERA_LIVE.id,
+        CAMERA_TALKBACK.id,
+        CAMERA_SNAPSHOT_STORED.id,
+        CAMERA_SNAPSHOT_LIVE.id,
+        CAMERA_RECORD_FRAGMENTS.id,
+        CAMERA_STATUS_LED_READ.id,
+        CAMERA_STATUS_LED_WRITE.id,
+        CAMERA_NIGHT_VISION_READ.id,
+        CAMERA_NIGHT_VISION_WRITE.id,
+        CAMERA_ENABLED_WRITE.id,
+    ],
+    attach: attachCameraStreaming,
+};
+function attachCameraStreaming(context) {
+    const device = context.device;
+    let camera;
+    try {
+        camera = device.camera?.();
+    }
+    catch {
+        context.diagnose(unavailable(true, 'sdk-fault'));
+        return undefined;
+    }
+    if (!camera || typeof camera.live !== 'function' || !context.liveMedia) {
+        context.diagnose(unavailable(true, !camera || typeof camera.live !== 'function' ? 'missing' : 'adapter-missing'));
+        return undefined;
+    }
+    context.diagnose(unavailable(false, 'recovered'));
+    const snapshotMode = context.snapshotMode ?? 'Refresh';
+    const storedEvidence = context.evidence.has(CAMERA_SNAPSHOT_STORED.id);
+    const liveEvidence = context.evidence.has(CAMERA_SNAPSHOT_LIVE.id);
+    const storedAvailable = storedEvidence && typeof camera.snapshotStored === 'function';
+    const liveAvailable = liveEvidence && typeof camera.snapshotLive === 'function';
+    const storedReason = !context.snapshotMedia
+        ? 'adapter-missing'
+        : !storedEvidence
+            ? 'missing-evidence'
+            : storedAvailable
+                ? 'recovered'
+                : 'missing';
+    const liveReason = !context.snapshotMedia
+        ? 'adapter-missing'
+        : !liveEvidence
+            ? 'missing-evidence'
+            : liveAvailable
+                ? 'recovered'
+                : 'missing';
+    const requiresStored = snapshotMode === 'Cloud' || (snapshotMode === 'Refresh' && !liveAvailable);
+    const requiresLive = snapshotMode === 'Live' || (snapshotMode === 'Refresh' && !storedAvailable);
+    context.diagnose(snapshotUnavailable(requiresStored && storedReason !== 'recovered', 'snapshotStored', storedReason));
+    context.diagnose(snapshotUnavailable(requiresLive && liveReason !== 'recovered', 'snapshotLive', liveReason));
+    const recordingEvidence = context.evidence.has(CAMERA_RECORD_FRAGMENTS.id);
+    const recordingAvailable = recordingEvidence && typeof camera.recordFragments === 'function';
+    const recordingMotion = hasAdmittedMotionEvents(context.evidence);
+    const recordingPress = hasAdmittedDoorbellPress(context.evidence);
+    const recordingConfigured = recordingAvailable && context.recordingMedia !== undefined && (recordingMotion || recordingPress);
+    const talkbackEvidence = context.evidence.has(CAMERA_TALKBACK.id);
+    const talkbackConfigured = talkbackEvidence && typeof camera.talkback === 'function' && context.audioEnabled !== false;
+    context.diagnose({
+        code: CAMERA_TALKBACK_UNAVAILABLE_CONDITION,
+        capability: 'camera',
+        member: 'talkback',
+        active: context.audioEnabled !== false && talkbackEvidence && !talkbackConfigured,
+        reason: context.audioEnabled !== false && talkbackEvidence && !talkbackConfigured ? 'missing' : 'recovered',
+    });
+    context.diagnose({
+        code: CAMERA_RECORDING_UNAVAILABLE_CONDITION,
+        capability: 'camera',
+        member: 'recordFragments',
+        active: !recordingConfigured,
+        reason: recordingConfigured
+            ? 'recovered'
+            : !recordingEvidence
+                ? 'missing-evidence'
+                : !recordingAvailable
+                    ? 'missing'
+                    : context.recordingMedia === undefined
+                        ? 'adapter-missing'
+                        : 'missing-trigger',
+    });
+    const prebufferLengthMs = recordingConfigured ? retainedPrebufferMs(context.evidence) : 0;
+    const liveSourceOptions = prebufferLengthMs > 0 ? { preBufferSeconds: prebufferLengthMs / 1_000 } : undefined;
+    const openLiveSource = camera.live.bind(camera);
+    const observed = observesCameraEnablement(camera, context.evidence);
+    const enablement = cameraEnablementReader(camera, context.evidence);
+    const detachRejectors = new Set();
+    let detached = false;
+    const readBoolean = observationReader(context, 'boolean');
+    const readNumber = observationReader(context, 'number');
+    const reportAdmission = cameraCondition(context, CAMERA_LIVE_REFUSED_CONDITION, 'live');
+    const reportCapacity = cameraCondition(context, CAMERA_MEDIA_AT_CAPACITY_CONDITION, 'live');
+    const acquireLiveSnapshot = liveAvailable ? camera.snapshotLive.bind(camera) : undefined;
+    const openTalkback = talkbackConfigured ? camera.talkback.bind(camera) : undefined;
+    const source = {
+        live: () => openLiveSource(liveSourceOptions),
+        ...(storedAvailable ? { snapshotStored: camera.snapshotStored.bind(camera) } : {}),
+        ...(acquireLiveSnapshot ? { snapshotLive: () => acquireLiveSnapshot(liveSourceOptions) } : {}),
+        ...(recordingAvailable ? { recordFragments: camera.recordFragments.bind(camera) } : {}),
+        ...(openTalkback ? { talkback: () => openTalkback(liveSourceOptions) } : {}),
+    };
+    const existing = CAMERA_STREAMING_STATES.get(context.accessory);
+    const owner = Symbol('camera-streaming-owner');
+    const operations = existing?.operations ?? {
+        owner,
+        activeOperations: new Map(),
+        blockedOperations: new Set(),
+    };
+    operations.owner = owner;
+    const issue = deviceOperationIssuer({
+        context,
+        state: operations,
+        owned: () => CAMERA_STREAMING_OWNERS.get(context.accessory) === owner,
+        detached: () => detached,
+        detachRejectors,
+    });
+    /** Everything the operating mode service presents and operates, resolved once per attachment. */
+    const controls = { camera, enablement, observed, issue, readBoolean, readNumber };
+    /** Wakes every write still in flight when this attachment stops being the one HomeKit is talking to. */
+    const releaseOperations = () => {
+        detached = true;
+        const error = new context.hap.HapStatusError(context.hap.HAPStatus.SERVICE_COMMUNICATION_FAILURE);
+        for (const reject of detachRejectors) {
+            reject(error);
+        }
+        detachRejectors.clear();
+    };
+    const binding = {
+        serial: context.device.sn,
+        source,
+        media: context.liveMedia,
+        ...(context.snapshotMedia ? { snapshotMedia: context.snapshotMedia } : {}),
+        audioEnabled: context.audioEnabled !== false,
+        snapshotMode,
+        enablement,
+        availability: availabilityObservation(context.device.sn, context.availability),
+        reportSession: liveSessionReporter(context, reportAdmission),
+        reportRelease: () => context.trace?.({ event: 'live-session-released' }),
+        reportTalkback: talkbackReporter(context),
+        reportAdmission,
+        reportCapacity,
+        ...(context.mediaBudget ? { budget: context.mediaBudget } : {}),
+        reportSnapshot: cameraCondition(context, CAMERA_SNAPSHOT_UNAVAILABLE_CONDITION, 'snapshot'),
+        reportSelection: context.trace,
+        ...(context.device.stationSn ? { stationSn: context.device.stationSn } : {}),
+        ...(context.stationLiveSessions ? { stations: context.stationLiveSessions } : {}),
+    };
+    const recordingBinding = recordingConfigured
+        ? {
+            serial: context.device.sn,
+            ...(binding.stationSn ? { stationSn: binding.stationSn } : {}),
+            ...(binding.stations ? { stations: binding.stations } : {}),
+            source,
+            media: context.recordingMedia,
+            audioEnabled: context.audioEnabled !== false,
+            prebufferLengthMs,
+            enablement: binding.enablement,
+            reportRecording: recordingReporter(context),
+            reportAdmission: cameraCondition(context, CAMERA_RECORDING_REFUSED_CONDITION, 'recordFragments'),
+        }
+        : undefined;
+    if (existing && existing.audio === binding.audioEnabled && existing.talkback === talkbackConfigured) {
+        existing.owner = owner;
+        existing.operations = operations;
+        existing.delegate.update(binding);
+        existing.recording?.update(recordingBinding);
+        CAMERA_STREAMING_OWNERS.set(context.accessory, owner);
+        return attachment(context, existing.controller, existing.delegate, existing.recording, owner, controls, releaseOperations);
+    }
+    if (existing) {
+        existing.delegate.stop();
+        existing.recording?.stop();
+        context.accessory.removeController(existing.controller);
+        if (!talkbackConfigured) {
+            context.observed(CAMERA_TALKBACK_FAILED_CONDITION);
+        }
+    }
+    const delegate = new LiveCameraDelegate(device.sn, binding, context.hap);
+    const recording = recordingConfigured ? new RecordingCameraDelegate(recordingBinding, context.hap) : undefined;
+    const controller = new context.hap.CameraController({
+        cameraStreamCount: 2,
+        delegate,
+        streamingOptions: {
+            supportedCryptoSuites: [0 /* context.hap.SRTPCryptoSuites.AES_CM_128_HMAC_SHA1_80 */],
+            video: {
+                codec: {
+                    profiles: [0 /* context.hap.H264Profile.BASELINE */, 1 /* context.hap.H264Profile.MAIN */, 2 /* context.hap.H264Profile.HIGH */],
+                    levels: [0 /* context.hap.H264Level.LEVEL3_1 */, 1 /* context.hap.H264Level.LEVEL3_2 */, 2 /* context.hap.H264Level.LEVEL4_0 */],
+                },
+                resolutions: ADVERTISED_RESOLUTIONS.map((entry) => [...entry]),
+            },
+            ...(context.audioEnabled === false
+                ? {}
+                : {
+                    audio: {
+                        twoWayAudio: talkbackConfigured,
+                        codecs: [
+                            {
+                                type: "AAC-eld" /* context.hap.AudioStreamingCodecType.AAC_ELD */,
+                                audioChannels: 1,
+                                bitrate: 0,
+                                samplerate: talkbackConfigured
+                                    ? [16 /* context.hap.AudioStreamingSamplerate.KHZ_16 */]
+                                    : [16 /* context.hap.AudioStreamingSamplerate.KHZ_16 */, 24 /* context.hap.AudioStreamingSamplerate.KHZ_24 */],
+                            },
+                        ],
+                    },
+                }),
+        },
+        ...(recording
+            ? {
+                recording: { options: recordingOptions(context, recordingPress), delegate: recording },
+                ...(recordingMotion ? { sensors: { motion: motionSensorService(context) } } : {}),
+            }
+            : {}),
+    }, true);
+    delegate.controller = controller;
+    if (recording) {
+        removeOperatingMode(context);
+    }
+    context.accessory.configureController(controller);
+    if (recording) {
+        recording.recordingManagement = controller.recordingManagement;
+    }
+    CAMERA_STREAMING_STATES.set(context.accessory, {
+        owner,
+        controller,
+        delegate,
+        operations,
+        audio: binding.audioEnabled,
+        talkback: talkbackConfigured,
+        ...(recording ? { recording } : {}),
+    });
+    CAMERA_STREAMING_OWNERS.set(context.accessory, owner);
+    return attachment(context, controller, delegate, recording, owner, controls, releaseOperations);
+}
+/**
+ * What this camera advertises as recordable.
+ *
+ * The motion trigger is derived from the sensor service the controller is given rather than declared
+ * separately, because HomeKit needs the sensor that triggers a recording to be linked to the recording
+ * management service, carry its own active state, and follow the camera's HomeKit-active state. Declaring
+ * the trigger alone advertises a recording nothing will ever start. That service is resolved through the
+ * detection adapter that owns it, so one accessory still carries exactly one motion service whichever of
+ * the two attaches first.
+ *
+ * A press trigger is declared rather than derived, and that asymmetry with motion is deliberate. HomeKit
+ * links nothing for a press and mirrors no state onto the doorbell service, so the advertised trigger is the
+ * whole mechanism; the service carrying the press stays wholly owned by the doorbell adapter. Deriving it
+ * instead would mean building the doorbell controller, which cannot be told to leave the microphone and
+ * speaker services alone and would put a second one of each on an accessory that already has them.
+ *
+ * Whether a home hub enables a press trigger is the hub's decision to publish in the configuration it
+ * selects, so it is advertised wherever a press exists rather than asserted here.
+ *
+ * Only the resolutions and rates a recording can actually be coded at are advertised, and only AAC-ELD,
+ * so a controller cannot select a contract the adaptation would then have to approximate.
+ */
+function recordingOptions(context, press) {
+    const { hap } = context;
+    return {
+        prebufferLength: RECORDING_PREBUFFER_MS,
+        ...(press ? { overrideEventTriggerOptions: [2 /* hap.EventTriggerOption.DOORBELL */] } : {}),
+        mediaContainerConfiguration: {
+            type: 0 /* hap.MediaContainerType.FRAGMENTED_MP4 */,
+            fragmentLength: RECORDING_FRAGMENT_LENGTH_MS,
+        },
+        video: {
+            type: 0 /* hap.VideoCodecType.H264 */,
+            parameters: {
+                profiles: [0 /* hap.H264Profile.BASELINE */, 1 /* hap.H264Profile.MAIN */, 2 /* hap.H264Profile.HIGH */],
+                levels: [0 /* hap.H264Level.LEVEL3_1 */, 1 /* hap.H264Level.LEVEL3_2 */, 2 /* hap.H264Level.LEVEL4_0 */],
+            },
+            resolutions: [
+                [1280, 720, 15],
+                [1280, 720, 30],
+                [1920, 1080, 15],
+                [1920, 1080, 30],
+            ],
+        },
+        audio: {
+            codecs: [0 /* hap.AudioRecordingCodecType.AAC_LC */, 1 /* hap.AudioRecordingCodecType.AAC_ELD */].map((type) => ({
+                type,
+                audioChannels: 1,
+                bitrateMode: 0 /* hap.AudioBitrate.VARIABLE */,
+                samplerate: RECORDING_AUDIO_SAMPLE_RATES.map((rate) => RECORDING_SAMPLE_RATES(hap)[rate]),
+            })),
+        },
+    };
+}
+/**
+ * How much pre-event media a camera admitted to HomeKit Secure Video retains on its shared source, in
+ * milliseconds. A camera with no recording to serve retains none, because a window nothing can drain is
+ * only memory.
+ *
+ * Only a mains-powered camera retains any. The window is a rolling buffer of media the source was already
+ * carrying, and it is configured on the source rather than kept warm for it, so a camera nobody is watching
+ * still answers a recording from its trigger: nothing here opens a stream to fill a buffer. A battery or
+ * solar camera is withheld from it entirely, because the only way its buffer would ever hold anything is a
+ * stream held open on its own power.
+ *
+ * The window belongs to whichever consumer opens the shared source, so live view asks for the same one a
+ * recording drains: measured on a wired camera, a source opened with the window handed a recording media it
+ * had captured before the recording attached, and the same window asked for only at recording time on a
+ * source opened without it delivered none. Live snapshots ask for the same window because they can also be
+ * the call that opens the source; no source-creating path may silently decide that later recordings retain
+ * nothing.
+ */
+function retainedPrebufferMs(evidence) {
+    return isBatteryPowered(evidence) ? 0 : RECORDING_PREBUFFER_MS;
+}
+function attachment(context, controller, delegate, recording, owner, controls, releaseOperations) {
+    const presentation = operatingModePresentation(context, controller, controls);
+    return {
+        /**
+         * Follows an announced enablement change: a session watching a camera which just went off is ended at
+         * once rather than at the next supervision read, and the trace states whether the reading behind that
+         * decision answered.
+         */
+        event(event) {
+            const trace = enablementAnnouncement(context, event, presentation.observe);
+            if (trace === undefined) {
+                return undefined;
+            }
+            delegate.observeEnablement();
+            return trace;
+        },
+        detach(reason) {
+            if (CAMERA_STREAMING_OWNERS.get(context.accessory) !== owner) {
+                return;
+            }
+            delegate.stop();
+            recording?.stop();
+            releaseOperations();
+            if (reason === 'shutdown') {
+                return;
+            }
+            CAMERA_STREAMING_OWNERS.delete(context.accessory);
+            CAMERA_STREAMING_STATES.delete(context.accessory);
+            context.accessory.removeController(controller);
+            presentation.remove();
+        },
+    };
+}
+function unavailable(active, reason) {
+    return {
+        code: 'camera-streaming-capability-unavailable',
+        capability: 'camera',
+        member: 'live',
+        active,
+        reason,
+    };
+}
+function snapshotUnavailable(active, member, reason) {
+    return {
+        code: 'camera-snapshot-capability-unavailable',
+        capability: 'camera',
+        member,
+        active,
+        reason: active ? reason : 'recovered',
+    };
+}
+/**
+ * Latches why the most recent live session ended without usable video and clears that condition once a
+ * later session reaches the negotiated output.
+ *
+ * A session a camera answered with audio and never a video frame is reported as that camera being switched
+ * off, not as a transport failure, when its admitted observation says it is off: measured on a real camera
+ * that had been turned off, the source accepted the start, delivered audio for the whole warm-up window and
+ * reported the SDK's `audio-only` stage, which is the corroboration where a reading taken before the
+ * session could have been stale. The caller decides that, because it holds the latch which decides whether
+ * the same refusal has already been reported; the enablement refusal condition itself is the one the admission
+ * gate reports through, so that condition cannot have two writers. A refusal for host capacity is a separate
+ * condition with a writer of its own, because the two are withdrawn by different events.
+ */
+function liveSessionReporter(context, refusal) {
+    const condition = cameraCondition(context, CAMERA_LIVE_SESSION_CONDITION, 'live');
+    return (outcome, switchedOff) => {
+        if (outcome.outcome === 'streaming') {
+            condition();
+            context.trace?.({ event: 'live-session-streaming' });
+            return;
+        }
+        context.trace?.({ event: 'live-session-failed', ...outcome });
+        if (switchedOff) {
+            refusal('disabled-no-video');
+            return;
+        }
+        condition(outcome.reason);
+    };
+}
+/**
+ * Latches one bounded reason for a camera live condition and withdraws it when the condition recovers.
+ * Only the reason vocabulary its caller owns is reported; no device identity, address, key, media byte, or
+ * SDK message crosses this seam.
+ */
+function cameraCondition(context, code, member) {
+    return (reason) => {
+        if (reason === undefined) {
+            context.observed(code);
+            return;
+        }
+        context.diagnose({ code, capability: 'camera', member, active: true, reason });
+    };
+}
+/**
+ * Latches why the most recent recording produced no usable output and clears that condition once a later
+ * recording produces some.
+ */
+function recordingReporter(context) {
+    const condition = cameraCondition(context, CAMERA_RECORDING_FAILED_CONDITION, 'recordFragments');
+    return (outcome) => condition(outcome.outcome === 'recording' ? undefined : outcome.reason);
+}
+/** Latches an isolated return-audio failure and clears it when later talkback starts producing audio. */
+function talkbackReporter(context) {
+    const condition = cameraCondition(context, CAMERA_TALKBACK_FAILED_CONDITION, 'talkback');
+    return (outcome) => condition(outcome.outcome === 'talking' ? undefined : outcome.reason);
+}
+/**
+ * Attaches the controls this bundle owns on the one Camera Operating Mode service the accessory carries.
+ *
+ * A camera configured for HomeKit Secure Video already carries that service, created and owned by the HAP
+ * recording controller, which documents attaching an optional characteristic to it rather than adding a
+ * second service; a camera with no recording carries none, so this bundle adds one under its own stable
+ * key. Exactly one may exist, because HAP identifies a service by type and subtype and the controller's own
+ * carries an empty subtype: a plugin-owned service surviving from a run without recording would make the
+ * controller's own service fail to attach.
+ *
+ * The camera's own power is deliberately not published here as HomeKit's `ManuallyDisabled`, and an accessory
+ * restored from a version that published it has that state withdrawn along with the record kept for it. Apple
+ * Home answers a camera reporting it by declining to write that camera's operating mode at all, so publishing
+ * it costs the ability to switch the camera on from HomeKit — see `docs/architecture.md`. The power is offered
+ * as the Camera Enabled switch instead, and a session a disabled camera cannot serve is still refused by its
+ * own gate under a named reason.
+ */
+function operatingModePresentation(context, controller, { camera, enablement, observed, issue, readBoolean, readNumber }) {
+    const { hap } = context;
+    const indicated = indicatesStatusLed(context, camera);
+    const nightVisible = presentsNightVision(context, camera);
+    /** Whether HomeKit's camera-active state is carried to the device, which needs a reading to compare against. */
+    const carriesCameraActive = observed && satisfiesMemberRequirements(context.evidence, [CAMERA_ENABLED_WRITE]);
+    let service;
+    let hooked = false;
+    const resolve = () => {
+        service ??= operatingModeService(context, controller);
+        if (!hooked) {
+            hooked = true;
+            if (carriesCameraActive) {
+                homeKitActiveOperation(context, service, { camera, enablement, issue });
+            }
+        }
+        return service;
+    };
+    withdrawCharacteristic(context, controller, 'ManuallyDisabled');
+    const retained = context.accessory.context;
+    if (retained?.homebridgeEufyCameraHomeKitActive !== undefined) {
+        delete retained.homebridgeEufyCameraHomeKitActive;
+        context.persist();
+    }
+    if (!indicated) {
+        withdrawCharacteristic(context, controller, 'CameraOperatingModeIndicator');
+    }
+    if (!nightVisible) {
+        withdrawCharacteristic(context, controller, 'NightVision');
+    }
+    if (!carriesCameraActive && !indicated && !nightVisible) {
+        removeOperatingMode(context);
+        return { observe: enablementTrace(enablement), remove: () => undefined };
+    }
+    if (indicated) {
+        const read = () => readBoolean('camera', 'statusLed', () => camera.statusLed);
+        const indicator = resolve().getCharacteristic(hap.Characteristic.CameraOperatingModeIndicator);
+        indicator.onGet(read);
+        indicator.onSet((value) => {
+            if (typeof value !== 'boolean') {
+                throw new hap.HapStatusError(hap.HAPStatus.INVALID_VALUE_IN_REQUEST);
+            }
+            return issue('camera', 'statusLed', () => camera.setStatusLed(value), () => {
+                try {
+                    indicator.updateValue(read());
+                }
+                catch { }
+            });
+        });
+    }
+    if (nightVisible) {
+        nightVisionPresentation(context, resolve(), { camera, issue, readNumber });
+    }
+    resolve();
+    return {
+        observe: enablementTrace(enablement),
+        remove() {
+            removeOperatingMode(context);
+        },
+    };
+}
+/**
+ * Reports whether the enablement observation answered, for the one trace an announced change records.
+ *
+ * The event is still acted on — a session watching a camera that just went off is ended at once — so the
+ * trace states whether the reading behind that decision was there, without publishing anything from it.
+ */
+function enablementTrace(enablement) {
+    return () => (enablement() === undefined ? 'missing' : 'valid');
+}
+/**
+ * Carries HomeKit's own camera-active state through to the camera's power, where the camera accepts it.
+ *
+ * HomeKit owns this state: the Home app writes it when a camera is set to off for the mode the home is in,
+ * and where HomeKit Secure Video created the service HAP gates streams, snapshots and recordings on it
+ * itself — on a service this bundle publishes instead, HAP gates nothing and the state is carried only here.
+ * Turning the camera off physically as well is this plugin's product policy, because a camera the user has
+ * told HomeKit not to use is a camera they have asked not to be watched by, and leaving it powered means it
+ * keeps recording to the vendor's cloud.
+ *
+ * Two things must be true before the camera is written:
+ *
+ * - **A controller wrote it.** An internal write carries no connection, so seeding a required state or
+ *   restoring one cannot reach the device.
+ * - **The camera disagrees.** A camera already off is not told to turn off, which also stops a command that
+ *   cannot succeed from being reissued on every reconnection.
+ *
+ * A value a controller merely re-asserts is deliberately not rejected. HomeKit decides whether this camera is
+ * on, so the state it holds is applied to a camera that disagrees with it however that state arrived — which
+ * is also what reconciles the device after a restart, since the home hub re-asserts its per-mode setting when
+ * the bridge reappears. Requiring the value to have moved instead left a divergence no action in the Home app
+ * could resolve, because the only value a user can write is the one HomeKit already holds.
+ *
+ * A camera whose power this plugin cannot write still accepts the state, because refusing it would leave the
+ * user unable to turn the camera off in HomeKit at all; the write is simply HomeKit's own then. A camera that
+ * refuses the change has it reverted to what the camera reports, so HomeKit never keeps a claim the device did
+ * not reach.
+ */
+function homeKitActiveOperation(context, service, { camera, enablement, issue }) {
+    const { hap } = context;
+    const operable = satisfiesMemberRequirements(context.evidence, [CAMERA_ENABLED_WRITE]) &&
+        typeof camera.setEnabled === 'function' &&
+        !untrusted(camera, 'enabled');
+    const active = service.getCharacteristic(hap.Characteristic.HomeKitCameraActive);
+    /**
+     * Answers HomeKit with the state HomeKit itself holds here, which this bundle only carries.
+     *
+     * The value is not this plugin's to decide, but the read must be answered all the same: HAP throws the
+     * status a failed write left on a characteristic that registers no read handler, on every later read and
+     * for good, so a camera whose power refused one write would be reported unresponsive until the bridge
+     * restarted. Answering also clears that status, because HAP marks a served read successful.
+     */
+    active.onGet(() => active.value ?? hap.Characteristic.HomeKitCameraActive.ON);
+    active.onSet(async (value, _context, connection) => {
+        const enable = value === hap.Characteristic.HomeKitCameraActive.ON;
+        if (!operable || connection === undefined || enablement() === enable) {
+            return;
+        }
+        try {
+            await issue('camera', 'enabled', () => camera.setEnabled(enable), () => undefined);
+        }
+        catch (error) {
+            const enabled = enablement();
+            if (enabled !== undefined) {
+                active.updateValue(enabled ? hap.Characteristic.HomeKitCameraActive.ON : hap.Characteristic.HomeKitCameraActive.OFF);
+            }
+            throw error;
+        }
+    });
+}
+/**
+ * Presents night vision as the one boolean HomeKit carries, over the three modes the SDK reports.
+ *
+ * `Off` is the only mode that is not night vision, so anything else reads as on. Turning it on again restores
+ * the mode this camera last reported for itself rather than a mode chosen here, because full colour night
+ * vision is not offered by every model — the SDK says so, and writing infrared blindly would silently
+ * downgrade a camera whose owner had chosen colour. That mode is retained on the accessory, so it survives a
+ * reconciliation and a restart: an attachment-local memory would be empty exactly when the camera currently
+ * reads off, which is when the restore matters. A camera whose lit mode has never been observed at all is
+ * turned on to infrared, which is the mode the SDK reports for every family and the one it says a model may
+ * offer without offering colour.
+ *
+ * A reading outside the modes the SDK declares is refused rather than projected, because "not off" would
+ * otherwise make any unexpected number read as night vision and be written back as a mode.
+ */
+function nightVisionPresentation(context, service, { camera, issue, readNumber, }) {
+    const { hap } = context;
+    const retained = (context.accessory.context ?? {});
+    context.accessory.context = retained;
+    const stored = retained.homebridgeEufyCameraNightVision;
+    let lit = stored?.version === 1 && NIGHT_VISION_MODES.has(stored.mode) && stored.mode !== NightVision.Off
+        ? stored.mode
+        : undefined;
+    const mode = () => {
+        const reading = readNumber('camera', 'nightVision', () => camera.nightVision);
+        if (!NIGHT_VISION_MODES.has(reading)) {
+            context.diagnose({
+                code: INVALID_OBSERVATION_CONDITION,
+                capability: 'camera',
+                member: 'nightVision',
+                active: true,
+                reason: 'malformed',
+            });
+            throw new hap.HapStatusError(hap.HAPStatus.SERVICE_COMMUNICATION_FAILURE);
+        }
+        if (reading !== NightVision.Off && lit !== reading) {
+            lit = reading;
+            retained.homebridgeEufyCameraNightVision = { version: 1, mode: reading };
+            context.persist();
+        }
+        return reading;
+    };
+    const characteristic = service.getCharacteristic(hap.Characteristic.NightVision);
+    characteristic.onGet(() => mode() !== NightVision.Off);
+    characteristic.onSet((value) => {
+        if (typeof value !== 'boolean') {
+            throw new hap.HapStatusError(hap.HAPStatus.INVALID_VALUE_IN_REQUEST);
+        }
+        const requested = value ? (lit ?? NightVision.Infrared) : NightVision.Off;
+        return issue('camera', 'nightVision', () => camera.setNightVision(requested), () => {
+            try {
+                characteristic.updateValue(mode() !== NightVision.Off);
+            }
+            catch { }
+        });
+    });
+}
+/** Whether this camera reports its night-vision mode and accepts a change to it. */
+function presentsNightVision(context, camera) {
+    return (satisfiesMemberRequirements(context.evidence, [CAMERA_NIGHT_VISION_READ, CAMERA_NIGHT_VISION_WRITE]) &&
+        typeof camera.setNightVision === 'function' &&
+        !untrusted(camera, 'nightVision'));
+}
+/**
+ * Whether this camera's indicator LED may be presented and operated: the SDK reports its state as an
+ * exactly evidenced boolean, accepts a write for it, and installed the setter on this device. A camera that
+ * offers the setter without reporting the state publishes nothing, because a control HomeKit cannot read is
+ * a control it would answer with a guess.
+ */
+function indicatesStatusLed(context, camera) {
+    return (satisfiesMemberRequirements(context.evidence, [CAMERA_STATUS_LED_READ, CAMERA_STATUS_LED_WRITE]) &&
+        typeof camera.setStatusLed === 'function' &&
+        !untrusted(camera, 'statusLed'));
+}
+/**
+ * The operating mode service this accessory already carries, without creating one.
+ *
+ * Exactly one may exist: the recording controller's own where HomeKit Secure Video created it, this
+ * bundle's own under its stable key, or one the accessory restored from a cached run whose recording is no
+ * longer configured, which carries no subtype and would otherwise make a second service look absent.
+ */
+function existingOperatingMode(context, controller) {
+    const { accessory, hap } = context;
+    return (controller.recordingManagement?.operatingModeService ??
+        accessory.getServiceById(hap.Service.CameraOperatingMode, CAMERA_OPERATING_MODE_SERVICE_KEY) ??
+        accessory.services.find((service) => service.UUID === hap.Service.CameraOperatingMode.UUID));
+}
+/** That service, adding this bundle's own when the accessory carries none. */
+function operatingModeService(context, controller) {
+    return existingOperatingMode(context, controller) ?? publishedOperatingMode(context);
+}
+/**
+ * Withdraws one state this plugin published, because a stale published value is a claim about a camera
+ * nothing is checking any more. Only the characteristic is withdrawn here: a controller-owned service is
+ * not this bundle's to remove, and a service this bundle owns is removed by its caller once nothing at all
+ * is left to publish on it.
+ */
+function withdrawCharacteristic(context, controller, attached) {
+    const service = existingOperatingMode(context, controller);
+    const characteristic = context.hap.Characteristic[attached];
+    if (service?.testCharacteristic(characteristic)) {
+        service.removeCharacteristic(service.getCharacteristic(characteristic));
+    }
+}
+/**
+ * This bundle's own Camera Operating Mode service, seeded with the two states HomeKit requires it to carry.
+ *
+ * Both are seeded active because this camera does stream and does answer snapshot requests, and the
+ * recording controller seeds its own service the same way. Neither is driven from a device observation:
+ * HomeKit owns them, and on a controller-owned service HAP itself gates streams and snapshots on the
+ * HomeKit-active state.
+ */
+function publishedOperatingMode(context) {
+    const { accessory, hap } = context;
+    const service = accessory.addService(hap.Service.CameraOperatingMode, accessory.displayName, CAMERA_OPERATING_MODE_SERVICE_KEY);
+    service.setCharacteristic(hap.Characteristic.HomeKitCameraActive, hap.Characteristic.HomeKitCameraActive.ON);
+    service.setCharacteristic(hap.Characteristic.EventSnapshotsActive, hap.Characteristic.EventSnapshotsActive.ENABLE);
+    return service;
+}
+/** Withdraws this bundle's own operating mode service, leaving a controller-owned one to its owner. */
+function removeOperatingMode(context) {
+    const service = context.accessory.getServiceById(context.hap.Service.CameraOperatingMode, CAMERA_OPERATING_MODE_SERVICE_KEY);
+    if (service) {
+        context.accessory.removeService(service);
+    }
+}
+/** Reduces only a well-formed, correctly attributed SDK observation to snapshot presentation state. */
+function availabilityObservation(serial, read) {
+    return () => {
+        try {
+            const observation = read?.();
+            if (!observation ||
+                observation.entity?.kind !== 'device' ||
+                observation.entity.sn !== serial ||
+                observation.scope !== 'device' ||
+                observation.source?.transport !== 'smqtt' ||
+                observation.source.signal !== 'state-info' ||
+                (observation.availability !== 'available' && observation.availability !== 'unavailable') ||
+                !Number.isFinite(observation.receivedAt) ||
+                (observation.observedAt !== undefined && !Number.isFinite(observation.observedAt)) ||
+                (observation.sequence !== undefined && !Number.isFinite(observation.sequence))) {
+                return undefined;
+            }
+            return observation.availability;
+        }
+        catch {
+            return undefined;
+        }
+    };
+}
+/**
+ * What an attachment given no budget counts against: nothing, because nothing was declared.
+ *
+ * Normalising the absent budget to one that admits everything keeps a single encoding of "no ceiling". Reading
+ * the absence at each decision instead would make one `undefined` mean both "nothing was declared" and "the
+ * host has no room", which are opposite answers.
+ */
+const UNBOUNDED_MEDIA = { claim: () => ({ release: () => undefined }) };
+/** Owns HomeKit camera negotiation while delegating source adaptation to the media domain. */
+class LiveCameraDelegate {
+    binding;
+    hap;
+    controller;
+    /** Assigned once the accessory has a service to present on, which is only true after the controller is. */
+    sessions = new Map();
+    prepareGenerations = new Map();
+    /**
+     * The share of host capacity each HomeKit session holds, keyed by the identifier HomeKit gave it.
+     *
+     * One session is one share however often its endpoints are negotiated. A controller may answer
+     * `SetupEndpoints` again for a session it already has, and the replacement is only recorded once the new
+     * preparation succeeds, so a share held per prepared session would have that controller competing with
+     * itself and refuse it at a ceiling it is already inside.
+     */
+    claims = new Map();
+    /** Station holds taken for the life of a session, so opportunistic work elsewhere on it stands aside. */
+    stationHolds = new Map();
+    /** Started requests still waiting for an outcome, so one that never reaches either can say so. */
+    unaccounted = new Map();
+    snapshotScope;
+    acceptingSessions = true;
+    refused = false;
+    capacityRefused = false;
+    supervision;
+    constructor(serial, binding, hap) {
+        this.binding = binding;
+        this.hap = hap;
+        this.snapshotScope = {
+            identity: {},
+            serial,
+            ...(binding.stationSn ? { stationSn: binding.stationSn } : {}),
+        };
+    }
+    update(binding) {
+        this.binding = binding;
+        this.acceptingSessions = true;
+    }
+    /**
+     * Answers a snapshot request from the camera's own acquisition policy, passing it the admitted enablement
+     * observation because a camera that is off is presented rather than photographed.
+     *
+     * A request no camera image could answer latches exactly one bounded reason naming the acquisition that
+     * left it unanswered, and keeps it until a later real image withdraws it, so an intermittently failing
+     * camera is distinguishable in the log from one that is permanently unequipped: the intermittent one
+     * latches and clears repeatedly, while the unequipped one latches once. The reason is latched whether a
+     * placeholder was substituted or the request failed outright, and a live refresh that fails afterwards
+     * supersedes it while the camera still has nothing to show.
+     *
+     * A disabled camera latches nothing: its image is the intended presentation, and live view already reports
+     * why it cannot be watched. A camera with no snapshot adaptation at all latches the missing adaptation
+     * itself, because no acquisition was reached to report anything about.
+     */
+    handleSnapshotRequest(_request, callback) {
+        const snapshotMedia = this.binding.snapshotMedia;
+        if (!snapshotMedia) {
+            this.binding.reportSnapshot('adapter-missing');
+            callback(new Error('camera snapshot adaptation is unavailable'));
+            return;
+        }
+        let unanswered = false;
+        const enabled = this.binding.enablement();
+        const availability = this.binding.availability();
+        void snapshotMedia
+            .acquire(this.snapshotScope, this.binding.source, this.binding.snapshotMode, {
+            ...(enabled === undefined ? {} : { enabled }),
+            ...(availability === undefined ? {} : { availability }),
+            onUnavailable: (failure) => {
+                unanswered = true;
+                this.binding.reportSnapshot(failure);
+            },
+        })
+            .then((buffer) => {
+            if (!unanswered) {
+                this.binding.reportSnapshot();
+            }
+            callback(undefined, buffer);
+        }, (error) => callback(error instanceof Error ? error : new Error('camera snapshot failed')));
+    }
+    /**
+     * Answers `SetupEndpoints` with reservations whose lifetime is the controller's HAP connection. A
+     * prepared session holds one UDP port for video, a second when audio is negotiated, and no SDK handle,
+     * process, or device session; HomeKit bounds it by that connection rather than by a timer, so a
+     * controller that negotiates and then waits keeps a valid answer instead of being invalidated by a
+     * plugin deadline.
+     *
+     * A camera an admitted observation reports as disabled is refused here, which is the only refusal point
+     * HAP offers, so no port, handle, or process is opened for it at all.
+     */
+    prepareStream(request, callback) {
+        if (this.refuseWhenDisabled('disabled')) {
+            this.traceRefusal('disabled');
+            callback(new Error('camera is disabled'));
+            return;
+        }
+        if (!this.claimCapacity(request.sessionID)) {
+            this.traceRefusal('at-capacity');
+            callback(new Error('the declared concurrent media limit is reached'));
+            return;
+        }
+        const generation = Symbol('camera-stream-prepare');
+        this.prepareGenerations.set(request.sessionID, generation);
+        void this.prepare(request).then(({ response, session }) => {
+            if (!this.acceptingSessions || this.prepareGenerations.get(request.sessionID) !== generation) {
+                session.prepared.stop();
+                this.releaseUnheldClaim(request.sessionID);
+                this.traceRefusal('cancelled');
+                callback(new Error('live media preparation was cancelled'));
+                return;
+            }
+            const superseded = this.sessions.get(request.sessionID);
+            this.sessions.delete(request.sessionID);
+            this.prepareGenerations.delete(request.sessionID);
+            superseded?.prepared.stop();
+            this.sessions.set(request.sessionID, session);
+            this.admit();
+            this.withdrawCapacityRefusal();
+            callback(undefined, response);
+        }, (error) => {
+            if (this.prepareGenerations.get(request.sessionID) === generation) {
+                this.prepareGenerations.delete(request.sessionID);
+            }
+            this.releaseUnheldClaim(request.sessionID);
+            this.traceRefusal('prepare-failed');
+            callback(error instanceof Error ? error : new Error('failed to prepare live media'));
+        });
+    }
+    /**
+     * Holds this session's share of the declared media ceiling, reporting one bounded reason where the host has
+     * no room for it.
+     *
+     * The share is taken before any await, so two cameras asked at once cannot both pass the same check. It is
+     * held for the whole session lifetime rather than only while media flows, because a prepared session holds a
+     * reserved port and HomeKit bounds it by its own connection; releasing it earlier would let a controller
+     * that prepares and waits sit outside the count it was admitted under.
+     */
+    claimCapacity(sessionID) {
+        if (this.claims.has(sessionID)) {
+            return true;
+        }
+        const claim = (this.binding.budget ?? UNBOUNDED_MEDIA).claim();
+        if (!claim) {
+            this.capacityRefused = true;
+            this.binding.reportCapacity('at-capacity');
+            return false;
+        }
+        this.claims.set(sessionID, claim);
+        if (this.binding.stationSn && this.binding.stations && !this.stationHolds.has(sessionID)) {
+            this.stationHolds.set(sessionID, this.binding.stations.hold(this.binding.stationSn, this.binding.serial, 'live'));
+        }
+        return true;
+    }
+    /** Give back this session's station hold. Idempotent, and safe for a session that never took one. */
+    releaseStationHold(sessionID) {
+        this.stationHolds.get(sessionID)?.();
+        this.stationHolds.delete(sessionID);
+    }
+    /** Gives back a share taken for a preparation that never became a session, and only then. */
+    releaseUnheldClaim(sessionID) {
+        if (this.sessions.has(sessionID)) {
+            return;
+        }
+        this.claims.get(sessionID)?.release();
+        this.claims.delete(sessionID);
+        this.releaseStationHold(sessionID);
+    }
+    /** Withdraws a latched capacity refusal once a session is admitted again, and only then. */
+    withdrawCapacityRefusal() {
+        if (!this.capacityRefused) {
+            return;
+        }
+        this.capacityRefused = false;
+        this.binding.reportCapacity();
+    }
+    async prepare(request) {
+        const videoSsrc = this.hap.CameraController.generateSynchronisationSource();
+        const audioSsrc = this.binding.audioEnabled ? this.hap.CameraController.generateSynchronisationSource() : undefined;
+        let session;
+        const prepared = await this.binding.media.prepare({
+            addressVersion: request.addressVersion,
+            targetAddress: request.targetAddress,
+            video: mediaTarget(request.video),
+            ...(this.binding.audioEnabled ? { audio: mediaTarget(request.audio) } : {}),
+            onVideoFailure: () => {
+                this.controller?.forceStopStreamingSession(request.sessionID);
+                this.release(request.sessionID);
+            },
+            onSessionOutcome: (outcome) => {
+                const switchedOff = outcome.outcome === 'failed' && outcome.reason === 'source-audio-only' && this.binding.enablement() === false;
+                if (switchedOff) {
+                    this.refused = true;
+                }
+                this.settleOutcome(request.sessionID);
+                this.binding.reportSession(outcome, switchedOff);
+                if (outcome.outcome === 'streaming' &&
+                    session?.source &&
+                    session.snapshotMedia?.captureFromWarmLive &&
+                    !session.capturedFallback) {
+                    session.capturedFallback = true;
+                    void session.snapshotMedia.captureFromWarmLive(this.snapshotScope, session.source).catch(() => undefined);
+                }
+            },
+            onSessionReleased: this.binding.reportRelease,
+            onTalkbackOutcome: (outcome) => this.binding.reportTalkback(outcome),
+        });
+        session = {
+            prepared,
+            videoSsrc,
+            addressVersion: request.addressVersion,
+            ...(audioSsrc === undefined ? {} : { audioSsrc }),
+            ...(this.binding.snapshotMedia ? { snapshotMedia: this.binding.snapshotMedia } : {}),
+        };
+        return {
+            session,
+            response: {
+                video: {
+                    port: prepared.videoPort,
+                    ssrc: videoSsrc,
+                    srtp_key: request.video.srtp_key,
+                    srtp_salt: request.video.srtp_salt,
+                },
+                ...(prepared.audioPort === undefined || audioSsrc === undefined
+                    ? {}
+                    : {
+                        audio: {
+                            port: prepared.audioPort,
+                            ssrc: audioSsrc,
+                            srtp_key: request.audio.srtp_key,
+                            srtp_salt: request.audio.srtp_salt,
+                        },
+                    }),
+            },
+        };
+    }
+    handleStreamRequest(request, callback) {
+        if (request.type === 'stop') {
+            this.release(request.sessionID);
+            callback();
+            return;
+        }
+        const session = this.sessions.get(request.sessionID);
+        if (!session) {
+            callback(new Error('live media session was not prepared'));
+            return;
+        }
+        if (request.type === 'reconfigure') {
+            if (!session.selection) {
+                this.release(request.sessionID);
+                callback(new Error('live media session has not started'));
+                return;
+            }
+            const video = negotiatedVideo({ ...session.selection.video, ...request.video }, session.videoSsrc, this.hap);
+            session.prepared.reconfigure(video);
+            session.selection = { ...session.selection, video: { ...session.selection.video, ...request.video } };
+            this.traceSelection('reconfigure', video, session.addressVersion);
+            callback();
+            return;
+        }
+        if (this.refuseWhenDisabled('disabled')) {
+            this.release(request.sessionID);
+            callback(new Error('camera is disabled'));
+            return;
+        }
+        session.selection = request;
+        const video = negotiatedVideo(request.video, session.videoSsrc, this.hap);
+        this.traceSelection('start', video, session.addressVersion);
+        this.watchForOutcome(request.sessionID);
+        const source = this.binding.source;
+        session.source = source;
+        this.supervise();
+        void session.prepared
+            .start(source, {
+            video,
+            ...(this.binding.audioEnabled && session.audioSsrc !== undefined
+                ? {
+                    audio: {
+                        codec: 'AAC-eld',
+                        channels: request.audio.channel,
+                        sampleRate: request.audio.sample_rate === 24 /* this.hap.AudioStreamingSamplerate.KHZ_24 */ ? 24 : 16,
+                        maxBitRate: request.audio.max_bit_rate,
+                        payloadType: request.audio.pt,
+                        ssrc: session.audioSsrc,
+                    },
+                }
+                : {}),
+        })
+            .then(() => callback(), (error) => {
+            this.release(request.sessionID);
+            callback(error instanceof Error ? error : new Error('stream failed'));
+        });
+    }
+    /**
+     * Report a request refused before it reached the source.
+     *
+     * A controller is answered instantly and badges the camera instantly, so without this the badge an operator
+     * sees at the moment of a switch has no counterpart anywhere. `cancelled` and `at-capacity` are the two a
+     * fast switch produces, and neither is a fault.
+     */
+    traceRefusal(reason) {
+        this.binding.reportSelection?.({ event: 'live-request-refused', reason });
+    }
+    /**
+     * Report a started request that reached neither a streaming outcome nor a failure.
+     *
+     * Every request is supposed to end in one or the other, and a controller badges the camera either way. One
+     * that ends in neither leaves the operator looking at a failure the log has no record of, which is
+     * unfixable by anyone: measured once as a selection followed by no adaptation, no source command and no
+     * outcome at all. This does not repair that request. It makes it visible, which is the prerequisite.
+     */
+    watchForOutcome(sessionID) {
+        this.settleOutcome(sessionID);
+        const armed = Date.now();
+        const timer = setTimeout(() => {
+            this.unaccounted.delete(sessionID);
+            this.binding.reportSelection?.({ event: 'live-request-unaccounted', afterMs: Date.now() - armed });
+        }, UNACCOUNTED_REQUEST_MS);
+        timer.unref?.();
+        this.unaccounted.set(sessionID, timer);
+    }
+    /** A request has reached an outcome, or is gone, so it is no longer owed one. */
+    settleOutcome(sessionID) {
+        const timer = this.unaccounted.get(sessionID);
+        if (timer) {
+            clearTimeout(timer);
+            this.unaccounted.delete(sessionID);
+        }
+    }
+    /**
+     * Records one identity-free live video selection.
+     *
+     * A reconfigure carries the packet size the start selection negotiated: HomeKit's reconfigure request
+     * declares geometry, frame rate and bit rate but no MTU, so the merged selection keeps the original.
+     */
+    traceSelection(operation, video, addressVersion) {
+        this.binding.reportSelection?.({
+            event: 'live-video-selected',
+            operation,
+            profile: video.profile,
+            level: video.level,
+            width: video.width,
+            height: video.height,
+            fps: video.fps,
+            mtu: video.mtu,
+            addressVersion,
+        });
+    }
+    stop() {
+        this.acceptingSessions = false;
+        for (const sessionID of [...this.sessions.keys()]) {
+            this.release(sessionID);
+        }
+        for (const claim of this.claims.values()) {
+            claim.release();
+        }
+        this.claims.clear();
+        for (const release of this.stationHolds.values()) {
+            release();
+        }
+        this.stationHolds.clear();
+        this.prepareGenerations.clear();
+        this.unsupervise();
+    }
+    /**
+     * Releases the reservations of one recorded session exactly once, whatever ended it. HomeKit ends a
+     * session without delivering a stop request when it force-stops one or when a stream request reports an
+     * error, so those paths release here too and no ended session is retained. A preparation cancelled
+     * before it was recorded releases itself where it completes.
+     */
+    release(sessionID) {
+        this.settleOutcome(sessionID);
+        this.prepareGenerations.delete(sessionID);
+        const session = this.sessions.get(sessionID);
+        this.sessions.delete(sessionID);
+        session?.prepared.stop();
+        this.claims.get(sessionID)?.release();
+        this.claims.delete(sessionID);
+        this.releaseStationHold(sessionID);
+        if (this.sessions.size === 0) {
+            this.unsupervise();
+        }
+    }
+    /** Reports one refusal when an admitted observation says the camera is disabled. */
+    refuseWhenDisabled(refusal) {
+        const enabled = this.binding.enablement();
+        if (enabled !== false) {
+            return false;
+        }
+        this.refused = true;
+        this.binding.reportAdmission(refusal);
+        return true;
+    }
+    /** Withdraws a latched refusal once a session is admitted again, and only then. */
+    admit() {
+        if (!this.refused) {
+            return;
+        }
+        this.refused = false;
+        this.binding.reportAdmission();
+    }
+    /**
+     * Supervises the sessions of a camera that is streaming. HomeKit is told the session ended, because a
+     * force-stop does not reach this delegate, and the same single release path stops adaptation and the SDK
+     * consumer rather than letting a disabled camera keep delivering blank frames.
+     */
+    supervise() {
+        if (this.supervision) {
+            return;
+        }
+        this.supervision = setInterval(() => this.observeEnablement(), ENABLEMENT_SUPERVISION_INTERVAL_MS);
+        this.supervision.unref?.();
+    }
+    /**
+     * Acts on the enablement observation as it reads now, whether an announced change or the supervision tick
+     * asked. A camera with nothing being watched needs no action here: presentation already followed the
+     * change, and admission is decided when the next session asks.
+     */
+    observeEnablement() {
+        if (this.sessions.size === 0 || !this.refuseWhenDisabled('disabled-mid-session')) {
+            return;
+        }
+        for (const sessionID of [...this.sessions.keys()]) {
+            this.controller?.forceStopStreamingSession(sessionID);
+            this.release(sessionID);
+        }
+    }
+    unsupervise() {
+        clearInterval(this.supervision);
+        this.supervision = undefined;
+    }
+}
+/** The one crypto suite this controller advertises, so it is the only one a controller can have selected. */
+function mediaTarget(source) {
+    return {
+        port: source.port,
+        srtpCryptoSuite: 'AES_CM_128_HMAC_SHA1_80',
+        srtpKey: source.srtp_key,
+        srtpSalt: source.srtp_salt,
+    };
+}
+function negotiatedVideo(video, ssrc, hap) {
+    return {
+        width: video.width,
+        height: video.height,
+        fps: video.fps,
+        maxBitRate: video.max_bit_rate,
+        profile: h264Profile(video.profile, hap),
+        level: h264Level(video.level, hap),
+        payloadType: video.pt,
+        ssrc,
+        mtu: video.mtu,
+        rtcpInterval: video.rtcp_interval,
+    };
+}
+function h264Profile(profile, hap) {
+    return profile === 2 /* hap.H264Profile.HIGH */ ? 'high' : profile === 1 /* hap.H264Profile.MAIN */ ? 'main' : 'baseline';
+}
+function h264Level(level, hap) {
+    return level === 2 /* hap.H264Level.LEVEL4_0 */ ? '4.0' : level === 1 /* hap.H264Level.LEVEL3_2 */ ? '3.2' : '3.1';
+}
+/**
+ * Owns HomeKit Secure Video negotiation while delegating fragment adaptation to the media domain.
+ *
+ * Nothing is held between recordings and no source is ever opened to build pre-event media. A camera
+ * eligible to retain a window has it configured on the shared source its live view and its recordings both
+ * use, so a recording drains whatever that source happened to be carrying and begins at its trigger
+ * otherwise. HomeKit persists whether recording is active and which configuration was selected, and this
+ * delegate keeps both only so that a recording request can be answered.
+ */
+class RecordingCameraDelegate {
+    binding;
+    hap;
+    recordingManagement;
+    configuration;
+    /** Every recording being served, held under its stream for as long as its consumer has not closed it. */
+    streams = new Map();
+    refused = false;
+    constructor(binding, hap) {
+        this.binding = binding;
+        this.hap = hap;
+    }
+    /**
+     * Rebinds this delegate to the current attachment, or withdraws it.
+     *
+     * A reconciliation that no longer admits recording leaves the HomeKit services in place, because a
+     * controller's services are fixed when it is configured, so withdrawal is expressed by refusing
+     * recordings rather than by continuing to serve them from a source this accessory no longer has. Any
+     * recording still running is stopped, since its source went with the binding that opened it.
+     */
+    update(binding) {
+        this.binding = binding;
+        if (!binding) {
+            this.stop();
+        }
+    }
+    /**
+     * HomeKit's recording-active state needs nothing of this delegate. It exists so a camera can start or
+     * stop maintaining pre-event media, and no camera here maintains any on HomeKit's word: an eligible
+     * camera's window is configured on its shared source and fills only while something else is already
+     * streaming, so there is nothing to start or stop.
+     */
+    updateRecordingActive() { }
+    updateRecordingConfiguration(configuration) {
+        this.configuration = configuration;
+    }
+    /**
+     * Streams one recording as the units its adaptation produces.
+     *
+     * The configuration is read once, so a selection HomeKit changes mid-recording applies to the next
+     * recording rather than to this one. Cancellation arrives three ways — an aborted signal, a closed
+     * stream, or a consumer that stops iterating — and every one of them reaches the same single stop, so
+     * the SDK handle and the adaptation are released once however the recording ended.
+     *
+     * A recording that ends while its consumer still holds the stream open ended without a unit marked
+     * last, and is cancelled rather than left for that consumer's force-close, which holds the camera's one
+     * recording stream and refuses every trigger until it elapses.
+     */
+    async *handleRecordingStreamRequest(streamId, signal) {
+        const binding = this.binding;
+        const configuration = this.configuration;
+        if (!binding || !configuration || !binding.source.recordFragments) {
+            throw new this.hap.HDSProtocolError(9 /* this.hap.HDSProtocolSpecificErrorReason.INVALID_CONFIGURATION */);
+        }
+        if (binding.enablement() === false) {
+            this.refused = true;
+            binding.reportAdmission('disabled');
+            throw new this.hap.HDSProtocolError(1 /* this.hap.HDSProtocolSpecificErrorReason.NOT_ALLOWED */);
+        }
+        if (this.refused) {
+            this.refused = false;
+            binding.reportAdmission();
+        }
+        /**
+         * A station already serving another of its cameras to something this recording does not outrank cannot
+         * serve this one, and the SDK refuses it. Reporting that here spares a round trip whose only outcome is
+         * the refusal, and states it as the bounded reason rather than letting it arrive as a source error.
+         */
+        if (binding.stationSn &&
+            binding.stations &&
+            !binding.stations.admits(binding.stationSn, binding.serial, 'recording')) {
+            binding.reportRecording({ outcome: 'failed', reason: 'station-busy' });
+            throw new this.hap.HDSProtocolError(1 /* this.hap.HDSProtocolSpecificErrorReason.NOT_ALLOWED */);
+        }
+        const recording = binding.media.record(binding.source, this.negotiated(binding, configuration), {
+            onOutcome: (outcome) => binding.reportRecording(outcome),
+        });
+        this.streams.set(streamId, recording);
+        const abort = () => this.closeRecordingStream(streamId);
+        signal?.addEventListener('abort', abort, { once: true });
+        /**
+         * A recording holds the station its camera belongs to, so a still elsewhere on that base stands aside and a
+         * live view opened on a sibling takes it. Yielding stops this recording rather than letting it run on a
+         * station that has been re-tasked, because a recording of a camera the base is no longer serving produces
+         * nothing and would keep asking for the channel the viewer needs.
+         *
+         * Work on this camera never yields to work on this camera: they share one pull.
+         */
+        const releaseStation = binding.stationSn && binding.stations
+            ? binding.stations.hold(binding.stationSn, binding.serial, 'recording', () => recording.stop())
+            : undefined;
+        try {
+            for await (const fragment of recording) {
+                yield { data: fragment.data, isLast: fragment.last };
+                if (fragment.last) {
+                    return;
+                }
+            }
+            if (this.streams.get(streamId) === recording) {
+                throw new this.hap.HDSProtocolError(3 /* this.hap.HDSProtocolSpecificErrorReason.CANCELLED */);
+            }
+        }
+        finally {
+            signal?.removeEventListener('abort', abort);
+            recording.stop();
+            releaseStation?.();
+            this.streams.delete(streamId);
+        }
+    }
+    acknowledgeStream(streamId) {
+        this.closeRecordingStream(streamId);
+    }
+    closeRecordingStream(streamId) {
+        this.streams.get(streamId)?.stop();
+        this.streams.delete(streamId);
+    }
+    /**
+     * Ends every recording this delegate is serving, because the binding that opened them is gone.
+     *
+     * Each recording is stopped without deregistering its stream, so its ending reaches its controller as
+     * the cancellation it is rather than as a close that controller asked for.
+     */
+    stop() {
+        for (const recording of this.streams.values()) {
+            recording.stop();
+        }
+    }
+    /**
+     * Translates one selected HomeKit recording configuration into the media domain's vocabulary.
+     *
+     * Audio is withheld whenever HomeKit's own recording-audio state is off, whenever the user turned this
+     * camera's audio off, and whenever a controller selected a codec or sample rate this camera never
+     * advertised, because a recording with no audio track is the truthful answer in every one of those cases
+     * and a substituted codec would not be.
+     *
+     * The pre-event window a controller selected is asked for up to what this camera retains, so a controller
+     * asking for less asks for less and one asking for more than was advertised gets the advertised window.
+     * The selection is a request rather than a bound, because how much media a source has retained is the
+     * source's own answer.
+     */
+    negotiated(binding, configuration) {
+        const [width, height, fps] = configuration.videoCodec.resolution;
+        const audio = this.recordedAudio(binding, configuration);
+        return {
+            width,
+            height,
+            fps,
+            maxBitRate: configuration.videoCodec.parameters.bitRate,
+            profile: h264Profile(configuration.videoCodec.parameters.profile, this.hap),
+            level: h264Level(configuration.videoCodec.parameters.level, this.hap),
+            iFrameIntervalMs: configuration.videoCodec.parameters.iFrameInterval,
+            fragmentLengthMs: configuration.mediaContainerConfiguration.fragmentLength,
+            prebufferLengthMs: Math.max(0, Math.min(configuration.prebufferLength, binding.prebufferLengthMs)),
+            ...(audio ? { audio } : {}),
+        };
+    }
+    recordedAudio(binding, configuration) {
+        if (!binding.audioEnabled || !this.recordingAudioActive()) {
+            return undefined;
+        }
+        const codec = configuration.audioCodec.type === 1 /* this.hap.AudioRecordingCodecType.AAC_ELD */
+            ? 'AAC-eld'
+            : configuration.audioCodec.type === 0 /* this.hap.AudioRecordingCodecType.AAC_LC */
+                ? 'AAC-lc'
+                : undefined;
+        const rates = RECORDING_SAMPLE_RATES(this.hap);
+        const sampleRate = RECORDING_AUDIO_SAMPLE_RATES.find((rate) => rates[rate] === configuration.audioCodec.samplerate);
+        if (!codec || sampleRate === undefined) {
+            return undefined;
+        }
+        return {
+            codec,
+            channels: configuration.audioCodec.audioChannels ?? 1,
+            sampleRate,
+            maxBitRate: configuration.audioCodec.bitrate,
+        };
+    }
+    /**
+     * Whether HomeKit currently wants recorded audio. The characteristic lives on the recording management
+     * service rather than the operating mode service, and an accessory starts with it off, so a recording
+     * carries no audio until a controller asks for it.
+     */
+    recordingAudioActive() {
+        const service = this.recordingManagement?.recordingManagementService;
+        if (!service) {
+            return false;
+        }
+        return Boolean(service.getCharacteristic(this.hap.Characteristic.RecordingAudioActive).value);
+    }
+}
+//# sourceMappingURL=camera-streaming.js.map