@camstack/system 1.2.101 → 1.2.103

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tMrPAfpF.js");
+const require_dist = require("../../dist-qnwy_iWM.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, v as addonPagesCapability, vt as errMsg, yt as BaseAddon } from "../../dist-RbFV8cX7.mjs";
+import { Gt as EventCategory, v as addonPagesCapability, vt as errMsg, yt as BaseAddon } from "../../dist-DHKXob1m.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tMrPAfpF.js");
+const require_dist = require("../../dist-qnwy_iWM.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, b as addonWidgetsCapability, vt as errMsg, yt as BaseAddon } from "../../dist-RbFV8cX7.mjs";
+import { Gt as EventCategory, b as addonWidgetsCapability, vt as errMsg, yt as BaseAddon } from "../../dist-DHKXob1m.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tMrPAfpF.js");
+const require_dist = require("../../dist-qnwy_iWM.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Mt as createEvent, n as AlertSchema, vt as errMsg, x as alertsCapability, yt as BaseAddon } from "../../dist-RbFV8cX7.mjs";
+import { Gt as EventCategory, Mt as createEvent, n as AlertSchema, vt as errMsg, x as alertsCapability, yt as BaseAddon } from "../../dist-DHKXob1m.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tMrPAfpF.js");
+const require_dist = require("../../dist-qnwy_iWM.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { C as backupCapability, Gt as EventCategory, yt as BaseAddon } from "../../dist-RbFV8cX7.mjs";
+import { C as backupCapability, Gt as EventCategory, yt as BaseAddon } from "../../dist-DHKXob1m.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tMrPAfpF.js");
+const require_dist = require("../../dist-qnwy_iWM.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-RbFV8cX7.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-DHKXob1m.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tMrPAfpF.js");
+const require_dist = require("../../dist-qnwy_iWM.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,4 +1,4 @@
-import { D as coreBlockAddonId, O as coreBlockIdFromAddonId, c as CoreBlockSchema, k as coreBlocksCapability, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, vt as errMsg, yt as BaseAddon } from "../../dist-RbFV8cX7.mjs";
+import { D as coreBlockAddonId, O as coreBlockIdFromAddonId, c as CoreBlockSchema, k as coreBlocksCapability, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, vt as errMsg, yt as BaseAddon } from "../../dist-DHKXob1m.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tMrPAfpF.js");
+const require_dist = require("../../dist-qnwy_iWM.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 //#region src/builtins/device-manager/adoption-job-engine.ts

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { Ct as DeviceFeature, E as buildStreamParamsConfigSchema, F as deviceStatusCapability, Gt as EventCategory, Lt as isDeviceConfigCap, N as deviceManagerCapability, Ot as WELL_KNOWN_TAB_MAP, P as deviceStateCapability, R as enumerateItemArrayFields, Tt as DeviceType, Wt as sleep, a as CAP_NAMES_WITH_STATUS, at as runtimeStatePolicyFor, et as normalizeUnit, nt as parseStreamParamsFormPatch, p as STREAM_PROFILE_META, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, vt as errMsg, wt as DeviceRole, yt as BaseAddon, z as enumerateSchemaFields } from "../../dist-RbFV8cX7.mjs";
+import { Ct as DeviceFeature, E as buildStreamParamsConfigSchema, F as deviceStatusCapability, Gt as EventCategory, Lt as isDeviceConfigCap, N as deviceManagerCapability, Ot as WELL_KNOWN_TAB_MAP, P as deviceStateCapability, R as enumerateItemArrayFields, Tt as DeviceType, Wt as sleep, a as CAP_NAMES_WITH_STATUS, at as runtimeStatePolicyFor, et as normalizeUnit, nt as parseStreamParamsFormPatch, p as STREAM_PROFILE_META, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, vt as errMsg, wt as DeviceRole, yt as BaseAddon, z as enumerateSchemaFields } from "../../dist-DHKXob1m.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tMrPAfpF.js");
+const require_dist = require("../../dist-qnwy_iWM.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { G as isSameAddonId, Gt as EventCategory, I as doorbellCapability, Mt as createEvent, Tt as DeviceType, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-RbFV8cX7.mjs";
+import { G as isSameAddonId, Gt as EventCategory, I as doorbellCapability, Mt as createEvent, Tt as DeviceType, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-DHKXob1m.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tMrPAfpF.js");
+const require_dist = require("../../dist-qnwy_iWM.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-RbFV8cX7.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-DHKXob1m.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tMrPAfpF.js");
+const require_dist = require("../../dist-qnwy_iWM.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Mt as createEvent, vt as errMsg, yt as BaseAddon } from "../../dist-RbFV8cX7.mjs";
+import { Gt as EventCategory, Mt as createEvent, vt as errMsg, yt as BaseAddon } from "../../dist-DHKXob1m.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tMrPAfpF.js");
+const require_dist = require("../../dist-qnwy_iWM.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { S as authProviderCapability, _ as UserRecordSchema, ht as userManagementCapability, m as ScopedTokenSchema, r as ApiKeyRecordSchema, yt as BaseAddon } from "../../dist-RbFV8cX7.mjs";
+import { S as authProviderCapability, _ as UserRecordSchema, ht as userManagementCapability, m as ScopedTokenSchema, r as ApiKeyRecordSchema, yt as BaseAddon } from "../../dist-DHKXob1m.mjs";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tMrPAfpF.js");
+const require_dist = require("../../dist-qnwy_iWM.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 //#region src/builtins/local-network/local-network.addon.ts

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Y as localNetworkCapability, yt as BaseAddon } from "../../dist-RbFV8cX7.mjs";
+import { Gt as EventCategory, Y as localNetworkCapability, yt as BaseAddon } from "../../dist-DHKXob1m.mjs";
 import * as os from "node:os";
 //#region src/builtins/local-network/local-network.addon.ts
 /**

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tMrPAfpF.js");
+const require_dist = require("../../dist-qnwy_iWM.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-RbFV8cX7.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-DHKXob1m.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tMrPAfpF.js");
+const require_dist = require("../../dist-qnwy_iWM.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as metricsProviderCapability, Gt as EventCategory, Mt as createEvent, yt as BaseAddon } from "../../dist-RbFV8cX7.mjs";
+import { $ as metricsProviderCapability, Gt as EventCategory, Mt as createEvent, yt as BaseAddon } from "../../dist-DHKXob1m.mjs";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
 import * as os from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tMrPAfpF.js");
+const require_dist = require("../../dist-qnwy_iWM.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Gt as EventCategory, L as enumerateInferenceDevices, Pt as emitReadiness, ct as scoreRuntimes, rt as platformProbeCapability, vt as errMsg, yt as BaseAddon } from "../../dist-RbFV8cX7.mjs";
+import { Gt as EventCategory, L as enumerateInferenceDevices, Pt as emitReadiness, ct as scoreRuntimes, rt as platformProbeCapability, vt as errMsg, yt as BaseAddon } from "../../dist-DHKXob1m.mjs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import * as os from "node:os";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tMrPAfpF.js");
+const require_dist = require("../../dist-qnwy_iWM.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, yt as BaseAddon } from "../../dist-RbFV8cX7.mjs";
+import { Gt as EventCategory, yt as BaseAddon } from "../../dist-DHKXob1m.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-tMrPAfpF.js");
+const require_dist = require("../../dist-qnwy_iWM.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -22,25 +22,94 @@ var SnapshotCache = class {
 	byKey = /* @__PURE__ */ new Map();
 	/** deviceId → its live keys, so invalidation is O(streams) not O(cache). */
 	keysByDevice = /* @__PURE__ */ new Map();
+	maxBytes;
+	idleTtlMs;
+	now;
+	onEvict;
+	totalBytes = 0;
+	constructor(options = {}) {
+		this.maxBytes = options.maxBytes ?? 67108864;
+		this.idleTtlMs = options.idleTtlMs ?? 36e5;
+		this.now = options.now ?? (() => Date.now());
+		this.onEvict = options.onEvict;
+	}
 	get(deviceId, streamId) {
-		return this.byKey.get(keyOf(deviceId, streamId));
+		return this.read(keyOf(deviceId, streamId));
 	}
 	set(deviceId, streamId, entry) {
 		const key = keyOf(deviceId, streamId);
-		this.byKey.set(key, entry);
+		this.forget(key);
+		this.byKey.set(key, {
+			entry,
+			deviceId,
+			bytes: entry.data.base64.length,
+			lastAccessAt: this.now()
+		});
+		this.totalBytes += entry.data.base64.length;
 		const keys = this.keysByDevice.get(deviceId) ?? /* @__PURE__ */ new Set();
 		keys.add(key);
 		this.keysByDevice.set(deviceId, keys);
+		this.enforceBudget(key);
 	}
 	/** The newest entry for a device, whichever stream produced it. */
 	latest(deviceId) {
 		let newest;
-		for (const key of this.keysByDevice.get(deviceId) ?? []) {
-			const entry = this.byKey.get(key);
+		for (const key of [...this.keysByDevice.get(deviceId) ?? []]) {
+			const entry = this.read(key);
 			if (entry !== void 0 && (newest === void 0 || entry.ts > newest.ts)) newest = entry;
 		}
 		return newest;
 	}
+	/** Base64 bytes currently retained. The number the budget is enforced on. */
+	sizeBytes() {
+		return this.totalBytes;
+	}
+	/** Entries currently retained. */
+	entryCount() {
+		return this.byKey.size;
+	}
+	/** Read through the idle timeout: an entry nobody has touched inside
+	*  `idleTtlMs` is dropped here rather than on a sweep, so the cost is paid by
+	*  the caller that proves it was not wanted. */
+	read(key) {
+		const slot = this.byKey.get(key);
+		if (slot === void 0) return void 0;
+		const at = this.now();
+		if (at - slot.lastAccessAt > this.idleTtlMs) {
+			this.evict(key, "idle");
+			return;
+		}
+		slot.lastAccessAt = at;
+		return slot.entry;
+	}
+	/** Evict least-recently-ACCESSED first until the budget holds. `protectedKey`
+	*  is the entry just written — evicting it would make `set` a no-op. */
+	enforceBudget(protectedKey) {
+		if (this.totalBytes <= this.maxBytes) return;
+		const coldestFirst = [...this.byKey.entries()].filter(([key]) => key !== protectedKey).toSorted((a, b) => a[1].lastAccessAt - b[1].lastAccessAt);
+		for (const [key] of coldestFirst) {
+			if (this.totalBytes <= this.maxBytes) return;
+			this.evict(key, "budget");
+		}
+	}
+	evict(key, reason) {
+		const slot = this.byKey.get(key);
+		if (slot === void 0) return;
+		this.forget(key);
+		this.onEvict?.(slot.deviceId, slot.entry.streamId, reason);
+	}
+	/** Remove a key and everything that indexes or accounts for it. */
+	forget(key) {
+		const slot = this.byKey.get(key);
+		if (slot === void 0) return;
+		this.totalBytes -= slot.bytes;
+		this.byKey.delete(key);
+		const keys = this.keysByDevice.get(slot.deviceId);
+		if (keys !== void 0) {
+			keys.delete(key);
+			if (keys.size === 0) this.keysByDevice.delete(slot.deviceId);
+		}
+	}
 	/**
 	* Drop every stream of one device.
 	*
@@ -49,12 +118,13 @@ var SnapshotCache = class {
 	* serving the pre-change frame from the other key.
 	*/
 	deleteDevice(deviceId) {
-		for (const key of this.keysByDevice.get(deviceId) ?? []) this.byKey.delete(key);
+		for (const key of [...this.keysByDevice.get(deviceId) ?? []]) this.forget(key);
 		this.keysByDevice.delete(deviceId);
 	}
 	clear() {
 		this.byKey.clear();
 		this.keysByDevice.clear();
+		this.totalBytes = 0;
 	}
 };
 //#endregion
@@ -759,48 +829,114 @@ function resizeJpeg(bytes, width, timeoutMs = RESIZE_TIMEOUT_MS) {
 		if (timer !== void 0) clearTimeout(timer);
 	});
 }
-/**
-* Resized frames, keyed by (device, stream, width, state treatment) AND
-* validated against the source frame's timestamp.
-*
-* The timestamp is the whole correctness argument: a variant outlives nothing.
-* When the underlying frame is recaptured its `capturedAt` moves, every variant
-* derived from the old one stops matching, and the next request re-derives.
-* Without that check a card would keep showing a thumbnail of a frame the
-* full-size view had already replaced.
-*/
 var SnapshotVariantCache = class SnapshotVariantCache {
 	byKey = /* @__PURE__ */ new Map();
 	keysByDevice = /* @__PURE__ */ new Map();
+	maxBytes;
+	now;
+	totalBytes = 0;
+	constructor(options = {}) {
+		this.maxBytes = options.maxBytes ?? 16777216;
+		this.now = options.now ?? (() => Date.now());
+	}
 	static key(deviceId, streamId, width, variantKey) {
 		return `${deviceId}:${streamId ?? "auto"}:${width}:${variantKey ?? "raw"}`;
 	}
 	/** The variant for this exact frame, or undefined when it is missing or was
-	*  derived from an older capture. */
+	*  derived from an older capture.
+	*
+	*  A superseded variant is DELETED here, not merely reported missing. It used
+	*  to be left in the map: unreachable by every future read (its `sourceTs` can
+	*  never match again) and removed by nothing, so every recapture added a dead
+	*  key. Returning `undefined` while retaining the bytes is the leak. */
 	get(deviceId, streamId, width, sourceTs, variantKey) {
-		const entry = this.byKey.get(SnapshotVariantCache.key(deviceId, streamId, width, variantKey));
-		return entry !== void 0 && entry.sourceTs === sourceTs ? entry.bytes : void 0;
+		const key = SnapshotVariantCache.key(deviceId, streamId, width, variantKey);
+		const slot = this.byKey.get(key);
+		if (slot === void 0) return void 0;
+		if (slot.sourceTs !== sourceTs) {
+			this.forget(key);
+			return;
+		}
+		slot.lastAccessAt = this.now();
+		return slot.bytes;
 	}
 	set(deviceId, streamId, width, sourceTs, bytes, variantKey) {
 		const key = SnapshotVariantCache.key(deviceId, streamId, width, variantKey);
+		this.forget(key);
 		this.byKey.set(key, {
 			bytes,
-			sourceTs
+			sourceTs,
+			deviceId,
+			lastAccessAt: this.now()
 		});
+		this.totalBytes += bytes.byteLength;
 		const keys = this.keysByDevice.get(deviceId) ?? /* @__PURE__ */ new Set();
 		keys.add(key);
 		this.keysByDevice.set(deviceId, keys);
+		this.enforceBudget(key);
+	}
+	/** Variant bytes currently retained. */
+	sizeBytes() {
+		return this.totalBytes;
+	}
+	/** Variants currently retained — including any that are no longer readable.
+	*  The number that used to only ever go up. */
+	entryCount() {
+		return this.byKey.size;
+	}
+	/** Evict least-recently-accessed first until the budget holds. */
+	enforceBudget(protectedKey) {
+		if (this.totalBytes <= this.maxBytes) return;
+		const coldestFirst = [...this.byKey.entries()].filter(([key]) => key !== protectedKey).toSorted((a, b) => a[1].lastAccessAt - b[1].lastAccessAt);
+		for (const [key] of coldestFirst) {
+			if (this.totalBytes <= this.maxBytes) return;
+			this.forget(key);
+		}
+	}
+	forget(key) {
+		const slot = this.byKey.get(key);
+		if (slot === void 0) return;
+		this.totalBytes -= slot.bytes.byteLength;
+		this.byKey.delete(key);
+		const keys = this.keysByDevice.get(slot.deviceId);
+		if (keys !== void 0) {
+			keys.delete(key);
+			if (keys.size === 0) this.keysByDevice.delete(slot.deviceId);
+		}
 	}
 	deleteDevice(deviceId) {
-		for (const key of this.keysByDevice.get(deviceId) ?? []) this.byKey.delete(key);
+		for (const key of [...this.keysByDevice.get(deviceId) ?? []]) this.forget(key);
 		this.keysByDevice.delete(deviceId);
 	}
 	clear() {
 		this.byKey.clear();
 		this.keysByDevice.clear();
+		this.totalBytes = 0;
 	}
 };
 //#endregion
+//#region src/builtins/snapshot/snapshot-grab-pick.ts
+/**
+* Which restream ffmpeg should grab a snapshot JPEG from.
+*
+* `status: 'streaming'` is not enough. A derived whose source profile is
+* unassigned sits in that state with zero packets (618, 2026-08-16: `derived:Mid
+* to low` had four subscribers and never a frame). Preferring it as "warm"
+* parked every grab on a 15 s ffmpeg timeout, so the connecting poster never
+* moved.
+*
+* Derived brokers are never the warm shortcut. A native that is actually
+* streaming still wins; otherwise the caller walks the ranked list and will
+* wake an idle source.
+*/
+function isDerivedBrokerId(brokerId, devicePrefix) {
+	return (brokerId.startsWith(devicePrefix) ? brokerId.slice(devicePrefix.length) : brokerId).startsWith("derived:");
+}
+/** Highest-quality currently-streaming NON-derived broker, or undefined. */
+function pickWarmSnapshotBroker(ranked, devicePrefix) {
+	return ranked.find((c) => c.status === "streaming" && !isDerivedBrokerId(c.brokerId, devicePrefix));
+}
+//#endregion
 //#region src/builtins/snapshot/snapshot.addon.ts
 /**
 * How long `getSnapshotLinks` waits for the capture it triggered before minting
@@ -886,7 +1022,21 @@ function effectiveMaxAgeS(prefs, isBattery) {
 * publishes stream endpoints.
 */
 var SnapshotAddon = class SnapshotAddon extends require_dist.BaseAddon {
-	cache = new SnapshotCache();
+	/**
+	* The frame cache. Bounded by a byte budget + an idle timeout — it used to be
+	* unbounded in both. Every eviction is logged with the device tag: a frame
+	* that silently left the cache is the reason a later capture had to happen,
+	* and per-camera is the only way that question is ever asked.
+	*/
+	cache = new SnapshotCache({ onEvict: (deviceId, streamId, reason) => {
+		this.ctx.logger.debug("snapshot cache evicted", {
+			tags: { deviceId },
+			meta: {
+				stream: streamId ?? "auto",
+				reason
+			}
+		});
+	} });
 	/** Card-sized derivatives of the frames above, keyed by width and validated
 	*  against the source frame's timestamp. */
 	variants = new SnapshotVariantCache();
@@ -1799,12 +1949,19 @@ var SnapshotAddon = class SnapshotAddon extends require_dist.BaseAddon {
 			entry: e,
 			status: statusByBrokerId.get(e.brokerId) ?? "idle"
 		}));
-		const warm = statuses.find((s) => s.status === "streaming");
+		const warm = pickWarmSnapshotBroker(statuses.map((s) => ({
+			brokerId: s.entry.brokerId,
+			status: s.status
+		})), prefix);
 		if (warm) {
-			const grabbed = await this.runGrabWithResumeRetry(warm.entry.url, deviceId);
-			if (grabbed) return grabbed;
+			const match = statuses.find((s) => s.entry.brokerId === warm.brokerId);
+			if (match) {
+				const grabbed = await this.runGrabWithResumeRetry(match.entry.url, deviceId);
+				if (grabbed) return grabbed;
+			}
 		}
 		for (const { entry } of statuses) {
+			if (isDerivedBrokerId(entry.brokerId, prefix)) continue;
 			const grabbed = await this.runGrabWithResumeRetry(entry.url, deviceId).catch(() => null);
 			if (grabbed) return grabbed;
 		}