@camstack/addon-pipeline 1.2.40 → 1.2.41

package/dist/{dist-C6p8jcji.mjs → dist-DvUTPZ8J.mjs}

@@ -9666,7 +9666,68 @@ var NcZoneConditionSchema = object({
 * The P1 condition set — a flat AND of groups; absent group = pass;
 * membership lists are OR within the list (spec §2.3).
 */
+/**
+* What a rule may actuate.
+*
+* **No hand-maintained allowlist** (operator decision, and the right one — a
+* written list of methods is a third parallel map to keep aligned, and this
+* repo has paid for those). The boundary instead comes from a property the
+* capabilities already carry: an action may target only a **device-scoped**
+* capability method.
+*
+* That is not decoration. A rule can be authored by a NON-ADMIN — personal
+* rules are a supported flow — and the executor runs with the addon's
+* privileges, so an unbounded action is an arbitrary RPC channel with a
+* privilege escalation attached. Restricting to device scope excludes the
+* system caps (`device-manager.removeDevice` and friends) by construction,
+* costs nothing to maintain, and cannot rot: a cap that stops being
+* device-scoped stops being actuatable in the same change.
+*
+* The executor enforces it; {@link NcRuleActionSchema} carries the intent.
+*/
+/**
+* One step of a sequence.
+*
+* `wait` is a first-class step rather than a property of the next action: it is
+* what makes a sequence a SEQUENCE and not a list — "unlock, wait 5s, open"
+* cannot be expressed otherwise.
+*/
+var NcRuleActionSchema = discriminatedUnion("kind", [object({
+	kind: literal("wait"),
+	seconds: number().min(0).max(300)
+}), object({
+	kind: literal("cap"),
+	deviceId: number().int(),
+	/** Capability name, e.g. `alarm-panel`. */
+	cap: string().min(1),
+	/** Method on it. The executor refuses a non-device-scoped cap. */
+	method: string().min(1),
+	/** Method arguments, minus `deviceId` (the executor injects it). */
+	args: record(string(), unknown()).optional()
+})]);
+/**
+* Sequences a rule runs, by hook point.
+*
+* ONLY `onTrigger` is here, deliberately. The reference also has activation /
+* deactivation / reset / post-generation hooks, and they are wanted — but this
+* repo's expensive failure mode is declaring a surface nothing produces, so a
+* hook appears here in the same change that produces its edge, never before.
+*/
+var NcRuleActionsSchema = object({ 
+/** Runs when the rule MATCHES. */
+onTrigger: array(object({
+	name: string().min(1).max(120),
+	enabled: boolean(),
+	minDelaySec: number().int().min(0).max(86400).optional(),
+	actions: array(NcRuleActionSchema).min(1)
+})).optional() });
 var NcConditionsSchema = object({
+	/** Gate on ANOTHER device's current state (the alarm armed, a switch on). */
+	deviceState: object({
+		deviceId: number().int(),
+		/** Any of these matches. */
+		states: array(string().min(1)).min(1)
+	}).optional(),
 	/** Device scope — absent = all devices. */
 	devices: array(number()).optional(),
 	/** Detector class names (any overlap with the record's class set). */
@@ -9960,7 +10021,16 @@ var NcRuleInputSchema = object({
 	* read as `false` by {@link canSetGlobal} in the engine. Admins are not bound
 	* by this flag — see the scope rules on that function.
 	*/
-	snoozeAllowGlobal: boolean().optional()
+	snoozeAllowGlobal: boolean().optional(),
+	/**
+	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
+	*
+	* This is what makes the rule set the alarm's trigger set without the alarm
+	* being a special case: arming is
+	* `{ cap: 'alarm-panel', method: 'arm', args: { mode: 'away' } }`, the same
+	* shape as every other actuation.
+	*/
+	actions: NcRuleActionsSchema.optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -10031,7 +10101,8 @@ var NcConditionDescriptorSchema = object({
 		"packagePhase",
 		"crossingSelect",
 		"polygonDraw",
-		"occupancy"
+		"occupancy",
+		"deviceState"
 	]),
 	operator: _enum([
 		"in",
@@ -17316,7 +17387,20 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ addonId: string() }), array(SavedDeviceRowSchema)), method(object({ addonId: string().optional() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
+}), method(object({ addonId: string() }), array(SavedDeviceRowSchema)), method(object({
+	addonId: string().optional(),
+	/**
+	* `slim` omits `config` (returned `{}`), `metadata` (null) and the
+	* `sourceInfo` derived from config — and skips the per-device settings
+	* read that produces them. Everything identifying a device (id, name,
+	* type, online, features, isCamera, parent/link ids) is unchanged.
+	* Do not use it for dispatch routing, which needs `sourceInfo`.
+	*/
+	projection: _enum(["full", "slim"]).optional(),
+	/** Return only camera devices. Filtering server-side instead of
+	*  shipping 293 rows to find 12. */
+	isCamera: boolean().optional()
+}), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
 	mode: DeviceLinkModeSchema,
 	devices: array(LinkedDeviceSchema)
 })), method(object({ deviceId: number() }), array(StreamSourceEntrySchema$1)), method(object({ deviceId: number() }), array(ConfigEntrySchema)), method(object({ deviceId: number() }), ConfigUISchemaOutput), method(object({
@@ -18515,6 +18599,103 @@ method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSche
 	enabled: boolean()
 }), _void(), { kind: "mutation" });
 /**
+* core-blocks — user-authored TypeScript, stored in the kernel and executed in
+* its own process.
+*
+* Spec: `docs/superpowers/specs/2026-08-04-core-blocks-and-synthetic-devices-design.md`.
+*
+* The first use is **owning devices without being a device provider**: a block
+* declares devices under a system or custom integration and drives their state,
+* with the same `ctx` an addon gets. Automations come later; nothing here
+* models a trigger.
+*
+* **Stated plainly, because it does not change by being true:** a block has an
+* addon's powers — devices, storage, the event bus, `ctx.api`. It is a plugin
+* with no review step. What makes that survivable is not a sandbox, it is
+* PROCESS ISOLATION: one process per block, supervised by `CrashSupervisor`,
+* so a block that throws or never returns is marked `failed` and visible
+* instead of taking the hub with it (D6). Every method here is admin-only, and
+* must stay so.
+*/
+/** Where a block runs. The operator chooses — a block driving a device on an
+*  agent is the reason placement is not fixed to the hub. */
+var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
+/** What a block's process is doing. Mirrors the addon runner's own lifecycle so
+*  a failing block reads the same way a failing addon does. */
+var CoreBlockStatusSchema = _enum([
+	"stopped",
+	"starting",
+	"running",
+	"failed"
+]);
+/** Client-authored fields. */
+var CoreBlockInputSchema = object({
+	name: string().min(1).max(120),
+	/** TypeScript source. Compiled server-side before it is ever stored — a
+	*  block that does not compile is a fork failure the operator would meet
+	*  minutes later, in a log, instead of in the editor. */
+	code: string().max(2e5),
+	enabled: boolean(),
+	placement: CoreBlockPlacementSchema,
+	/**
+	* Integration the block's devices hang from. Absent = the system integration
+	* blocks share. A block may declare its own instead.
+	*/
+	integrationId: string().optional()
+});
+/** A stored block. */
+var CoreBlockSchema = CoreBlockInputSchema.extend({
+	id: string(),
+	createdAt: number(),
+	updatedAt: number(),
+	/** Server-stamped author. */
+	createdBy: string(),
+	status: CoreBlockStatusSchema,
+	/**
+	* Why the block is not running, when it is not. The operator's ONLY window
+	* into a block that failed at load — a block that is silently absent is the
+	* failure mode this whole feature has to avoid.
+	*/
+	lastError: string().optional(),
+	/** Ms epoch of the last state change. */
+	lastChangedAt: number()
+});
+/** What a compile attempt produced. */
+var CoreBlockCompileResultSchema = object({
+	ok: boolean(),
+	/** Present when `ok` is false — the first error, in the author's words. */
+	error: string().optional(),
+	line: number().optional(),
+	column: number().optional()
+});
+method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }), method(object({ blockId: string() }), object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }), method(object({ block: CoreBlockInputSchema }), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({
+	blockId: string(),
+	block: CoreBlockInputSchema.partial()
+}), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ blockId: string() }), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	blockId: string(),
+	enabled: boolean()
+}), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ code: string() }), CoreBlockCompileResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({ libs: array(object({
+	filePath: string(),
+	content: string()
+})) }), { auth: "admin" });
+/**
 * Zod schemas for persisted record types.
 *
 * These schemas serve as the single source of truth for types that are
@@ -18761,6 +18942,11 @@ var EventKindDescriptorSchema = object({
 		deviceId: number()
 	})
 });
+/** One camera's event vocabulary, as returned by `listEventKindsBatch`. */
+var EventKindsForDeviceSchema = object({
+	deviceId: number(),
+	kinds: array(EventKindDescriptorSchema).readonly()
+});
 var SensorEventSchema = object({
 	id: string(),
 	/** The CAMERA the event is attributed to (a sensor linked to N cameras
@@ -19017,6 +19203,19 @@ var MediaFileSchema = object({
 	sizeBytes: number(),
 	timestamp: number()
 });
+/**
+* One media row WITHOUT its bytes.
+*
+* A track's media is 5-8 MB of base64 (measured: 7.67 MB across 23 files for a
+* 140 s track), and a client that renders tiles from the media data plane needs
+* to know only WHAT EXISTS — the bytes then arrive per tile, lazily, over HTTP
+* with an immutable cache, instead of all at once inside a tRPC response that
+* blocks the whole view.
+*
+* `sizeBytes` is carried because it is what lets a client decide between the
+* stored blob and a `?variant=thumb` rendering without fetching either.
+*/
+var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
 var DEFAULT_EVENT_QUERY_LIMIT = 1e3;
 var MAX_EVENT_QUERY_LIMIT = 5e3;
 var DeviceEventQueryInput = object({
@@ -19166,7 +19365,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number() }), array(EventKindDescriptorSchema).readonly()), method(object({
+}), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number() }), array(EventKindDescriptorSchema).readonly()), method(object({ deviceIds: array(number()).min(1).max(200) }), array(EventKindsForDeviceSchema).readonly()), method(object({
 	deviceId: number(),
 	since: number().optional(),
 	until: number().optional(),
@@ -19240,7 +19439,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), array(MediaFileSchema).readonly()), method(object({
 	trackId: string(),
 	kinds: array(MediaFileKindEnum).optional()
-}), array(MediaFileSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), object({
+}), array(MediaFileSchema).readonly()), method(object({ trackId: string() }), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), object({
 	deviceId: number(),
 	timestamp: number(),
 	frameWidth: number(),
@@ -24021,6 +24220,54 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"coreBlocks.compile": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"coreBlocks.create": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"coreBlocks.delete": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"coreBlocks.get": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"coreBlocks.getTypeDefs": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"coreBlocks.list": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"coreBlocks.setEnabled": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"coreBlocks.update": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"cover.close": {
 		capName: "cover",
 		capScope: "device",
@@ -26187,6 +26434,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listEventKindsBatch": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listOpsLog": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -26199,6 +26452,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listTrackMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",

package/dist/{event-loop-stall-monitor-oL9xanvX.js → event-loop-stall-monitor-C5P2bcwP.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DcMBfoCg.js");
+const require_dist = require("./dist-BS7wLqoV.js");
 let node_perf_hooks = require("node:perf_hooks");
 //#region src/detection-pipeline/registry/model-catalogs.ts
 var HF_REPO = "camstack/camstack-models";

package/dist/{event-loop-stall-monitor-BHqCesa1.mjs → event-loop-stall-monitor-a2u9e1qx.mjs}

@@ -1,4 +1,4 @@
-import { D as hfModelUrl, a as COCO_TO_MACRO, i as COCO_80_LABELS, r as AUDIO_MACRO_LABELS } from "./dist-C6p8jcji.mjs";
+import { D as hfModelUrl, a as COCO_TO_MACRO, i as COCO_80_LABELS, r as AUDIO_MACRO_LABELS } from "./dist-DvUTPZ8J.mjs";
 import { PerformanceObserver } from "node:perf_hooks";
 //#region src/detection-pipeline/registry/model-catalogs.ts
 var HF_REPO = "camstack/camstack-models";

package/dist/motion-wasm/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-DcMBfoCg.js");
+const require_dist = require("../dist-BS7wLqoV.js");
 const require_lazy_sharp = require("../lazy-sharp-CcYuXtsa.js");
 let node_fs = require("node:fs");
 let node_path = require("node:path");

package/dist/motion-wasm/index.mjs

@@ -1,4 +1,4 @@
-import { A as motionDetectionCapability, E as evaluateZoneRules, K as hydrateSchema, V as BaseAddon, W as DeviceType } from "../dist-C6p8jcji.mjs";
+import { A as motionDetectionCapability, E as evaluateZoneRules, K as hydrateSchema, V as BaseAddon, W as DeviceType } from "../dist-DvUTPZ8J.mjs";
 import { t as getSharp } from "../lazy-sharp-B-mb8uWx.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/pipeline-runner/index.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-DcMBfoCg.js");
-const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-oL9xanvX.js");
+const require_dist = require("../dist-BS7wLqoV.js");
+const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-C5P2bcwP.js");
 const require_worker_protocol = require("../worker-protocol-DextwlTX.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_lazy_sharp = require("../lazy-sharp-CcYuXtsa.js");

package/dist/pipeline-runner/index.mjs

@@ -1,5 +1,5 @@
-import { B as errMsg, G as createEvent, M as pipelineRunnerCapability, S as defineCustomActions, V as BaseAddon, X as nodePin, at as lazy, b as customAction, ct as object, ft as EventCategory, nt as array, ot as literal, rt as boolean, s as DEVICE_BACKEND_TO_FORMAT, st as number, tt as _enum, ut as string } from "../dist-C6p8jcji.mjs";
-import { c as getStepDefinition, t as attributeStall } from "../event-loop-stall-monitor-BHqCesa1.mjs";
+import { B as errMsg, G as createEvent, M as pipelineRunnerCapability, S as defineCustomActions, V as BaseAddon, X as nodePin, at as lazy, b as customAction, ct as object, ft as EventCategory, nt as array, ot as literal, rt as boolean, s as DEVICE_BACKEND_TO_FORMAT, st as number, tt as _enum, ut as string } from "../dist-DvUTPZ8J.mjs";
+import { c as getStepDefinition, t as attributeStall } from "../event-loop-stall-monitor-a2u9e1qx.mjs";
 import { t as isWorkerReply } from "../worker-protocol-D7RzZIla.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { t as getSharp } from "../lazy-sharp-B-mb8uWx.mjs";

package/dist/recorder/index.js

@@ -1,5 +1,5 @@
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-DcMBfoCg.js");
+const require_dist = require("../dist-BS7wLqoV.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_model_download_service_Cp9f4dk6 = require("../model-download-service-Cp9f4dk6-fsdDExML.js");
 let node_child_process = require("node:child_process");

package/dist/recorder/index.mjs

@@ -1,4 +1,4 @@
-import { $ as selectAssignedProfileSlots, B as errMsg, C as deriveRecordingMode, I as storageEvictableCapability, K as hydrateSchema, N as recordingCapability, P as recordingExportCapability, V as BaseAddon, W as DeviceType, X as nodePin, c as EVENT_PAD_MS, f as OpsLogEntrySchema, ft as EventCategory, lt as record, nt as array, p as RecordingConfigSchema, u as ExportRecordSchema, ut as string } from "../dist-C6p8jcji.mjs";
+import { $ as selectAssignedProfileSlots, B as errMsg, C as deriveRecordingMode, I as storageEvictableCapability, K as hydrateSchema, N as recordingCapability, P as recordingExportCapability, V as BaseAddon, W as DeviceType, X as nodePin, c as EVENT_PAD_MS, f as OpsLogEntrySchema, ft as EventCategory, lt as record, nt as array, p as RecordingConfigSchema, u as ExportRecordSchema, ut as string } from "../dist-DvUTPZ8J.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { n as createFileDataPlaneHandler, s as parseRangeHeader, t as contentTypeFor } from "../model-download-service-Cp9f4dk6-CwUb5v3Y.mjs";
 import { spawn } from "node:child_process";

package/dist/session-decode/decode-worker-child.js

@@ -682,6 +682,15 @@ function toLeasedRgbNavFrame(frame) {
 	};
 }
 /** Re-dial backoff on a transient dial error/EOF (mirrors the decoder's PULL_REDIAL_MS). */
+/**
+* RSS at which a decode worker is reported anomalous.
+*
+* Chosen from the incident rather than from theory: on 2026-08-05 the healthy
+* fleet sat at 1.1-1.3 GB per worker while the one that broke the host reached
+* 4.9 GB. 2 GB is clear of the normal band and well below the point where it
+* costs anyone anything.
+*/
+var WORKER_RSS_WARN_MB = 2048;
 var REDIAL_MS = 3e3;
 /** How often the worker emits its `framesDecoded/framesSkipped/deliveredFps` line. */
 var METRICS_INTERVAL_MS = 1e4;
@@ -1079,6 +1088,12 @@ var DecodeWorkerChild = class {
 	/** Frames actually handed to the parent as a `frame` reply. */
 	framesDelivered = 0;
 	lastMetricsAt = 0;
+	/** Process start, for the `ageS` field. A worker that outlives its siblings
+	*  by two orders of magnitude is the signal this exists to surface. */
+	startedAt = Date.now();
+	/** One-shot, so a legitimately long session does not repeat the warning
+	*  every ten seconds. */
+	warnedLarge = false;
 	lastDeliveredSnapshot = 0;
 	metricsTimer = null;
 	demuxer = null;
@@ -1170,16 +1185,38 @@ var DecodeWorkerChild = class {
 			this.send({ kind: "ended" });
 		}
 	}
-	/** Emit the compact throughput line (window `deliveredFps`); cheap, integer-only. */
+	/**
+	* Emit the compact throughput line (window `deliveredFps`); cheap,
+	* integer-only.
+	*
+	* **`rssMb` and `ageS` are here because their absence cost a Home Assistant
+	* outage.** On 2026-08-05 one worker stayed alive 1h58m and grew to 4.9 GiB
+	* at ~46 MB/min while its eleven siblings recycled every ~30 s; the host ran
+	* out of memory and the kernel killed the largest process on the box, which
+	* was somebody else's VM. Nothing in any log said a decode worker was large,
+	* or old — the leak was only found by sampling `ps` by hand.
+	*
+	* This line already runs every 10 s per session and is already grouped by
+	* device in Loki, so carrying the worker's own RSS and age turns "a runner
+	* is big" into "THIS camera's worker has been climbing for an hour", which
+	* is the question that was unanswerable. Retained-store sizes ride along
+	* because they are the first thing to suspect and they are free to read.
+	*/
 	logMetrics(final) {
 		const now = Date.now();
 		const windowMs = Math.max(1, now - this.lastMetricsAt);
 		const deliveredDelta = this.framesDelivered - this.lastDeliveredSnapshot;
 		const deliveredFps = Math.round(deliveredDelta / windowMs * 1e3 * 10) / 10;
 		const skipped = this.framesSkipped + this.frames.droppedCount;
-		this.emitStderr(`session-decode metrics {framesDecoded:${this.framesDecoded}, framesSkipped:${skipped}, deliveredFps:${deliveredFps}, nativeCropHits:${this.nativeCropHits}, nativeCropMisses:${this.nativeCropMisses}}${final ? " (final)" : ""}\n`);
+		const rssMb = Math.round(process.memoryUsage().rss / 1048576);
+		const ageS = Math.round((now - this.startedAt) / 1e3);
+		this.emitStderr(`session-decode metrics {framesDecoded:${this.framesDecoded}, framesSkipped:${skipped}, deliveredFps:${deliveredFps}, nativeCropHits:${this.nativeCropHits}, nativeCropMisses:${this.nativeCropMisses}, rssMb:${rssMb}, ageS:${ageS}}${final ? " (final)" : ""}\n`);
 		this.lastMetricsAt = now;
 		this.lastDeliveredSnapshot = this.framesDelivered;
+		if (!this.warnedLarge && rssMb >= WORKER_RSS_WARN_MB) {
+			this.warnedLarge = true;
+			this.emitStderr(`decode-worker-child: WORKER IS LARGE — rssMb=${rssMb} ageS=${ageS} framesDecoded=${this.framesDecoded}. Siblings normally recycle in ~30s; a worker this size at this age is how the host ran out of memory on 2026-08-05.\n`);
+		}
 	}
 	handleStart(source, opts) {
 		if (this.started) {

package/dist/session-decode/decode-worker-child.mjs

@@ -678,6 +678,15 @@ function toLeasedRgbNavFrame(frame) {
 	};
 }
 /** Re-dial backoff on a transient dial error/EOF (mirrors the decoder's PULL_REDIAL_MS). */
+/**
+* RSS at which a decode worker is reported anomalous.
+*
+* Chosen from the incident rather than from theory: on 2026-08-05 the healthy
+* fleet sat at 1.1-1.3 GB per worker while the one that broke the host reached
+* 4.9 GB. 2 GB is clear of the normal band and well below the point where it
+* costs anyone anything.
+*/
+var WORKER_RSS_WARN_MB = 2048;
 var REDIAL_MS = 3e3;
 /** How often the worker emits its `framesDecoded/framesSkipped/deliveredFps` line. */
 var METRICS_INTERVAL_MS = 1e4;
@@ -1075,6 +1084,12 @@ var DecodeWorkerChild = class {
 	/** Frames actually handed to the parent as a `frame` reply. */
 	framesDelivered = 0;
 	lastMetricsAt = 0;
+	/** Process start, for the `ageS` field. A worker that outlives its siblings
+	*  by two orders of magnitude is the signal this exists to surface. */
+	startedAt = Date.now();
+	/** One-shot, so a legitimately long session does not repeat the warning
+	*  every ten seconds. */
+	warnedLarge = false;
 	lastDeliveredSnapshot = 0;
 	metricsTimer = null;
 	demuxer = null;
@@ -1166,16 +1181,38 @@ var DecodeWorkerChild = class {
 			this.send({ kind: "ended" });
 		}
 	}
-	/** Emit the compact throughput line (window `deliveredFps`); cheap, integer-only. */
+	/**
+	* Emit the compact throughput line (window `deliveredFps`); cheap,
+	* integer-only.
+	*
+	* **`rssMb` and `ageS` are here because their absence cost a Home Assistant
+	* outage.** On 2026-08-05 one worker stayed alive 1h58m and grew to 4.9 GiB
+	* at ~46 MB/min while its eleven siblings recycled every ~30 s; the host ran
+	* out of memory and the kernel killed the largest process on the box, which
+	* was somebody else's VM. Nothing in any log said a decode worker was large,
+	* or old — the leak was only found by sampling `ps` by hand.
+	*
+	* This line already runs every 10 s per session and is already grouped by
+	* device in Loki, so carrying the worker's own RSS and age turns "a runner
+	* is big" into "THIS camera's worker has been climbing for an hour", which
+	* is the question that was unanswerable. Retained-store sizes ride along
+	* because they are the first thing to suspect and they are free to read.
+	*/
 	logMetrics(final) {
 		const now = Date.now();
 		const windowMs = Math.max(1, now - this.lastMetricsAt);
 		const deliveredDelta = this.framesDelivered - this.lastDeliveredSnapshot;
 		const deliveredFps = Math.round(deliveredDelta / windowMs * 1e3 * 10) / 10;
 		const skipped = this.framesSkipped + this.frames.droppedCount;
-		this.emitStderr(`session-decode metrics {framesDecoded:${this.framesDecoded}, framesSkipped:${skipped}, deliveredFps:${deliveredFps}, nativeCropHits:${this.nativeCropHits}, nativeCropMisses:${this.nativeCropMisses}}${final ? " (final)" : ""}\n`);
+		const rssMb = Math.round(process.memoryUsage().rss / 1048576);
+		const ageS = Math.round((now - this.startedAt) / 1e3);
+		this.emitStderr(`session-decode metrics {framesDecoded:${this.framesDecoded}, framesSkipped:${skipped}, deliveredFps:${deliveredFps}, nativeCropHits:${this.nativeCropHits}, nativeCropMisses:${this.nativeCropMisses}, rssMb:${rssMb}, ageS:${ageS}}${final ? " (final)" : ""}\n`);
 		this.lastMetricsAt = now;
 		this.lastDeliveredSnapshot = this.framesDelivered;
+		if (!this.warnedLarge && rssMb >= WORKER_RSS_WARN_MB) {
+			this.warnedLarge = true;
+			this.emitStderr(`decode-worker-child: WORKER IS LARGE — rssMb=${rssMb} ageS=${ageS} framesDecoded=${this.framesDecoded}. Siblings normally recycle in ~30s; a worker this size at this age is how the host ran out of memory on 2026-08-05.\n`);
+		}
 	}
 	handleStart(source, opts) {
 		if (this.started) {

package/dist/stream-broker/_stub.js

@@ -1,8 +1,8 @@
-import { a as e, c as t, d as n, i as r, l as i, n as a, o, r as s, s as c, t as l, u } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-BsNhZnfZ.mjs";
+import { a as e, c as t, d as n, i as r, l as i, n as a, o, r as s, s as c, t as l, u } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-CciPNnL7.mjs";
 import { a as d, i as f, n as p, o as m, r as h, t as g } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare__react__loadShare__.js-C9j-2lBe.mjs";
 import { n as _, r as v, t as y } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-XO0-Pyu6.mjs";
 import { n as b, t as x } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-BO7TIbJV.mjs";
-import { t as S } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_camstack_mf_1_types__loadShare__.js-DJnh97n9.mjs";
+import { t as S } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_camstack_mf_1_types__loadShare__.js-CDzxDzcv.mjs";
 //#region ../../node_modules/lucide-react/dist/esm/shared/src/utils.js
 var C = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase(), w = (e) => e.replace(/^([A-Z])|[\s-_]+(\w)/g, (e, t, n) => n ? n.toUpperCase() : t.toLowerCase()), T = (e) => {
 	let t = w(e);

package/dist/stream-broker/{_virtual_mf-localSharedImportMap___mfe_internal__addon_stream_broker_widgets-Bt1YkfUW.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_stream_broker_widgets-CS82x0lt.mjs}

@@ -3,7 +3,7 @@ import "./dist-CYZr2fwk.mjs";
 var e = {
 	"@camstack/sdk": {
 		name: "@camstack/sdk",
-		version: "1.2.9",
+		version: "1.2.10",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_stream_broker_widgets",
@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.25",
+		version: "1.2.31",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_stream_broker_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.19",
+		version: "1.2.25",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_stream_broker_widgets",