@camstack/system 1.2.146 → 1.2.147

package/dist/{dist-CG7kwIZp.mjs → dist-DrBc-7Y3.mjs}

@@ -1,5 +1,5 @@
 import { z } from "zod";
-//#region ../types/dist/event-category-CIa_iT6b.mjs
+//#region ../types/dist/event-category-BZL-fdNj.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -436,7 +436,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["MetricsNodeResourcesSnapshot"] = "metrics.node-resources-snapshot";
 	/**
 	* Periodic per-node process-tree snapshot (camstack-related pids
-	* with ghost / managed / root classification). Emitted ~0.2 Hz by
+	* with root / managed / system classification). Emitted ~0.2 Hz by
 	* the metrics-provider addon. Drives the Cluster → Processes tab
 	* without polling `metricsProvider.listNodeProcesses`.
 	*/
@@ -4340,6 +4340,143 @@ var DecoderSessionConfigSchema = z.object({
 	*/
 	debug: z.boolean().optional()
 });
+/** Bucket key for rows no addon owns. Stable, so its series is continuous. */
+var UNATTRIBUTED_BUCKET_KEY = "__unattributed__";
+var ROOT_BUCKET_KEY = "__root__";
+function bucketFor(row) {
+	if (row.addonId !== null) return {
+		key: row.addonId,
+		kind: "addon"
+	};
+	if (row.classification === "root") return {
+		key: ROOT_BUCKET_KEY,
+		kind: "root"
+	};
+	return {
+		key: UNATTRIBUTED_BUCKET_KEY,
+		kind: "unattributed"
+	};
+}
+/** Round to one decimal — the precision both producers already emit at. */
+function deci(value) {
+	return Math.round(value * 10) / 10;
+}
+/**
+* Fold one snapshot into one point per function.
+*
+* Produces a ONE-SAMPLE point: `min === max` on every field, `samples === 1`.
+* That is what lets a live event and a reduced server bucket sit in the same
+* series without the consumer knowing which is which.
+*/
+function foldSnapshotByFunction(rows, atMs) {
+	const acc = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const { key, kind } = bucketFor(row);
+		const cur = acc.get(key) ?? {
+			kind,
+			main: 0,
+			gc: 0,
+			lifetime: 0,
+			memory: 0,
+			count: 0,
+			splitKnown: true
+		};
+		const known = row.cpuMainPercent !== null && row.cpuGcPercent !== null;
+		acc.set(key, {
+			kind: cur.kind,
+			main: cur.main + (row.cpuMainPercent ?? 0),
+			gc: cur.gc + (row.cpuGcPercent ?? 0),
+			lifetime: cur.lifetime + row.cpuPercent,
+			memory: cur.memory + row.memoryRssBytes,
+			count: cur.count + 1,
+			splitKnown: cur.splitKnown && known
+		});
+	}
+	return [...acc.entries()].map(([key, a]) => {
+		const main = a.splitKnown ? deci(a.main) : null;
+		const gc = a.splitKnown ? deci(a.gc) : null;
+		const lifetime = deci(a.lifetime);
+		return {
+			key,
+			kind: a.kind,
+			point: {
+				atMs,
+				samples: 1,
+				cpuMainPercent: main,
+				cpuMainPercentMin: main,
+				cpuGcPercent: gc,
+				cpuGcPercentMin: gc,
+				cpuLifetimePercent: lifetime,
+				cpuLifetimePercentMin: lifetime,
+				memoryRssBytes: a.memory,
+				memoryRssBytesMin: a.memory,
+				processCount: a.count,
+				processCountMin: a.count
+			}
+		};
+	});
+}
+/** The narrower of two bounds, treating `null` (UNKNOWN) as absorbing. */
+function minNullable(a, b) {
+	if (a === null || b === null) return null;
+	return a < b ? a : b;
+}
+function maxNullable(a, b) {
+	if (a === null || b === null) return null;
+	return a > b ? a : b;
+}
+/** Merge `next` into `held`, keeping the widest [min, max] of each field. */
+function mergePoints(held, next, atMs) {
+	return {
+		atMs,
+		samples: held.samples + next.samples,
+		cpuMainPercent: maxNullable(held.cpuMainPercent, next.cpuMainPercent),
+		cpuMainPercentMin: minNullable(held.cpuMainPercentMin, next.cpuMainPercentMin),
+		cpuGcPercent: maxNullable(held.cpuGcPercent, next.cpuGcPercent),
+		cpuGcPercentMin: minNullable(held.cpuGcPercentMin, next.cpuGcPercentMin),
+		cpuLifetimePercent: Math.max(held.cpuLifetimePercent, next.cpuLifetimePercent),
+		cpuLifetimePercentMin: Math.min(held.cpuLifetimePercentMin, next.cpuLifetimePercentMin),
+		memoryRssBytes: Math.max(held.memoryRssBytes, next.memoryRssBytes),
+		memoryRssBytesMin: Math.min(held.memoryRssBytesMin, next.memoryRssBytesMin),
+		processCount: Math.max(held.processCount, next.processCount),
+		processCountMin: Math.min(held.processCountMin, next.processCountMin)
+	};
+}
+/**
+* The bucket width that brings `spanMs` down to at most `maxPoints` points,
+* snapped up to a whole multiple of the sampling cadence.
+*
+* Returns `cadenceMs` (no reduction) when the span already fits. A caller that
+* asks for a `maxPoints` of 0 or less gets no reduction rather than an
+* infinite bucket — a nonsensical request must not produce a plausible chart.
+*/
+function resolveBucketMs(spanMs, cadenceMs, maxPoints) {
+	if (maxPoints <= 0 || cadenceMs <= 0 || spanMs <= 0) return Math.max(cadenceMs, 1);
+	const wanted = spanMs / maxPoints;
+	if (wanted <= cadenceMs) return cadenceMs;
+	return Math.ceil(wanted / cadenceMs) * cadenceMs;
+}
+/**
+* Reduce one function's points into buckets of `bucketMs`, preserving the
+* extremes.
+*
+* Points are expected oldest-first and are returned oldest-first. A bucket
+* with no samples is ABSENT — not zero, not interpolated, not the previous
+* value held over.
+*/
+function reducePoints(points, bucketMs, origin) {
+	if (bucketMs <= 0 || points.length === 0) return points;
+	const buckets = /* @__PURE__ */ new Map();
+	for (const point of points) {
+		const start = origin + Math.floor((point.atMs - origin) / bucketMs) * bucketMs;
+		const held = buckets.get(start);
+		buckets.set(start, held === void 0 ? {
+			...point,
+			atMs: start
+		} : mergePoints(held, point, start));
+	}
+	return [...buckets.values()].toSorted((a, b) => a.atMs - b.atMs);
+}
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -8274,6 +8411,19 @@ var SettingsRecordSchema = z.object({
 	data: z.record(z.string(), z.unknown())
 });
 /**
+* One record of a BULK insert — {@link SettingsRecordSchema} with the id made
+* optional.
+*
+* A separate schema rather than loosening the shared one: every other method
+* on this cap addresses a row BY its id, and making that field optional
+* everywhere would turn a forgotten key into a silently generated one on
+* `update` and `delete` as well.
+*/
+var BulkRecordSchema = z.object({
+	id: z.string().optional(),
+	data: z.record(z.string(), z.unknown())
+});
+/**
 * Column declaration for a structured (SQL-backed) collection.
 *
 * Logical types — the backend translates each to the matching SQLite
@@ -8386,6 +8536,34 @@ var settingsStoreCapability = {
 			collection: z.string(),
 			record: SettingsRecordSchema
 		}), z.void(), { kind: "mutation" }),
+		/**
+		* Insert MANY records in ONE transaction, returning how many landed.
+		*
+		* The write-side twin of {@link deleteWhere}, and it exists for the same
+		* reason: without it, appending a batch is N round trips and N COMMITs on
+		* the single shared connection that also serves every cluster-wide
+		* configuration read. The durable load series writes one process row per
+		* process per sample — 76 rows every 10 s on the live fleet — and the
+		* operator's rule for it is *one transaction per sample, never one per
+		* row*. `insert` cannot express that; nothing else could.
+		*
+		* **All or nothing.** A batch that fails on its fifth row leaves none of
+		* the five behind. A half-written sample is worse than a missing one: the
+		* missing one reads as "nobody reported", which is true, while the half
+		* one reads as "these were the only processes running", which is not.
+		*
+		* `id` is OPTIONAL per record, and that is the difference from
+		* {@link insert}. A collection whose primary key is an `INTEGER` rowid
+		* alias has no id to supply — SQLite assigns it, for free, and inventing a
+		* `randomUUID()` for such a column would write a 36-character string into
+		* an integer key. Omitted on a TEXT key, a uuid is generated exactly as
+		* `insert` does.
+		*/
+		insertMany: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			records: z.array(BulkRecordSchema).readonly()
+		}), z.object({ inserted: z.number().int() }), { kind: "mutation" }),
 		/** Update an existing record by ID. */
 		update: method(z.object({
 			namespace: z.string().optional(),
@@ -8623,6 +8801,15 @@ var dataStoreProviderCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/** Insert many records in ONE transaction. All or nothing. */
+		insertMany: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			records: z.array(BulkRecordSchema).readonly()
+		}), z.object({ inserted: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Update an existing record by ID. */
 		update: method(z.object({
 			namespace: z.string().optional(),
@@ -11298,6 +11485,82 @@ var logDestinationCapability = {
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
 	mount: { kind: "skip" }
 };
+var LoadContributionSchema = z.object({
+	role: z.enum([
+		"decode",
+		"transcode",
+		"recording",
+		"streaming",
+		"detection"
+	]),
+	/**
+	* The NUMERIC device id — the same value every log line carries as
+	* `tags.deviceId`. `null` means this cost genuinely belongs to no single
+	* camera (a shared pool), NOT that the contributor forgot to look it up: a
+	* contributor that cannot name its camera must not emit the entry at all,
+	* because an unnamed per-camera entry is indistinguishable from a shared one
+	* and would quietly turn one camera's cost into everybody's.
+	*/
+	deviceId: z.number().int().positive().nullable(),
+	attribution: z.enum([
+		"measured",
+		"accounted",
+		"unattributable"
+	]),
+	/**
+	* What ONE entry is, in the contributor's own words — `615/high`,
+	* `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
+	* family and inventing a common one would lose the only information that
+	* makes two entries for the same camera distinguishable.
+	*/
+	unit: z.string(),
+	/**
+	* The OS process this cost lives in, when there is one. Present so a
+	* consumer can (a) tell two generations of the same unit apart across a
+	* restart, and (b) subtract claimed processes from the node's process
+	* snapshot to see what NOBODY claimed. Absent for an entry that owns no
+	* process of its own.
+	*/
+	pid: z.number().int().positive().optional(),
+	/**
+	* When this generation started. The pid's incarnation marker: a consumer
+	* differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
+	* window when this changes, because the counter restarted from zero in a new
+	* process.
+	*/
+	startedAtMs: z.number().optional(),
+	/**
+	* CUMULATIVE CPU seconds this unit has consumed since it started — user +
+	* system, read from the child's own `/proc/<pid>/stat` at the moment the
+	* contribution is asked for.
+	*
+	* Cumulative and not a rate on purpose: a rate needs a window, a window
+	* needs a sampler, and a new per-node sampler is the defect half of
+	* `docs/architecture/load-ledger.md` documents. A counter can be differenced
+	* by whoever already keeps a history; a rate cannot be un-averaged.
+	*
+	* Absent — never zero — on a node with no `/proc`, on a read failure, and on
+	* an entry with no process.
+	*/
+	cpuSeconds: z.number().optional(),
+	/** Resident bytes of this unit's process, same source and same rules. */
+	rssBytes: z.number().optional()
+});
+var loadContributionCapability = {
+	name: "load-contribution",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { 
+	/**
+	* This addon's own cost entries, computed live from state it already
+	* holds. Inert: no persistence, no sampling, no timer. It is answered on
+	* whatever beat the caller already has.
+	*/
+list: method(z.void(), z.array(LoadContributionSchema).readonly()) },
+	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
+	mount: { kind: "skip" }
+};
 /**
 * `login-method` — collection cap through which auth addons contribute
 * their pre-auth login surfaces to the login page. This is the SINGLE,
@@ -11529,8 +11792,7 @@ var NodeProcessSchema = z.object({
 	classification: z.enum([
 		"root",
 		"managed",
-		"system",
-		"ghost"
+		"system"
 	]),
 	/** `$process` addon binding when `managed`, else null. */
 	addonId: z.string().nullable(),
@@ -11538,22 +11800,39 @@ var NodeProcessSchema = z.object({
 	nodeId: z.string().nullable(),
 	/** Truncated command line. */
 	command: z.string(),
+	/**
+	* `ps pcpu` — CPU averaged over the process's WHOLE LIFETIME, not a rate.
+	* On a runner up for days it barely moves. Fine as a column, useless as a
+	* series: use `cpuMainPercent + cpuGcPercent` for anything time-varying.
+	*/
 	cpuPercent: z.number(),
 	memoryRssBytes: z.number(),
+	/**
+	* Instantaneous CPU% of the process's own threads over the last
+	* process-snapshot window, from a `/proc/<pid>/task/*` tick delta.
+	*
+	* `null` = UNKNOWN, never zero: no previous sample yet (first tick after
+	* boot), the pid was recycled, or this node is not Linux.
+	*/
+	cpuMainPercent: z.number().nullable(),
+	/**
+	* Instantaneous CPU% of V8's `V8Worker` platform pool over the same window.
+	*
+	* This is the number that rewrote the 2026-08-27 diagnosis — hub-main 73%,
+	* `stream-broker` 61% (`docs/architecture/load-ledger.md`). A CPU chart that
+	* does not separate it from `cpuMainPercent` shows "busy" where the truth is
+	* "allocating too much".
+	*
+	* Concurrent GC is the dominant tenant of that pool but not the only one
+	* (background compilation runs there too), so it is reported as
+	* "GC / V8 helpers" rather than as pure collection time. `null` has the same
+	* meaning as on `cpuMainPercent`.
+	*/
+	cpuGcPercent: z.number().nullable(),
+	/** Threads seen in the tick scan. `null` under the same conditions. */
+	threadCount: z.number().nullable(),
 	/** Wall-clock uptime (seconds). Parsed from `ps etime`. */
-	uptimeSec: z.number(),
-	/** True when ancestor walk reaches `ppid=1` (reparented to init/launchd). */
-	orphaned: z.boolean()
-});
-var KillProcessInputSchema = z.object({
-	pid: z.number(),
-	/** Force = SIGKILL. Default is SIGTERM. */
-	force: z.boolean().optional()
-});
-var KillProcessResultSchema = z.object({
-	success: z.boolean(),
-	reason: z.string().optional(),
-	signal: z.enum(["SIGTERM", "SIGKILL"]).optional()
+	uptimeSec: z.number()
 });
 var DumpHeapSnapshotInputSchema = z.object({ 
 /** The addon whose runner should dump a heap snapshot. */
@@ -11566,6 +11845,104 @@ var DumpHeapSnapshotResultSchema = z.object({
 	pid: z.number().optional(),
 	reason: z.string().optional()
 });
+/**
+* One point of one function's series.
+*
+* The unsuffixed fields are the bucket's **MAXIMUM**, and that choice is the
+* point of the whole surface. The two obvious reductions both lie: a mean per
+* bucket smears a spike away, and taking every Nth sample skips it outright.
+* Either would give us a tool built to find peaks that does not show peaks.
+* `...Min` carries the other end, `samples` says how many raw snapshots folded
+* into the bucket, and a mean stays derivable where it is wanted.
+*
+* An UNREDUCED point is a one-sample bucket: `samples === 1` and each `...Min`
+* equals its unsuffixed twin. Reduced and unreduced are the same shape, so a
+* caller cannot tell which it received — which is what "one reader" means.
+*/
+var LoadPointSchema = z.object({
+	/** Bucket START, or the snapshot's own timestamp when unreduced. */
+	atMs: z.number(),
+	/** Raw snapshots in this bucket. Never 0 — AN EMPTY BUCKET IS ABSENT. */
+	samples: z.number().int(),
+	/**
+	* `null` = UNKNOWN and it PROPAGATES: a bucket is null unless every process
+	* of every snapshot in it reported a thread split. A partial sum is a
+	* smaller number that looks exactly as real as a complete one.
+	*/
+	cpuMainPercent: z.number().nullable(),
+	cpuMainPercentMin: z.number().nullable(),
+	cpuGcPercent: z.number().nullable(),
+	cpuGcPercentMin: z.number().nullable(),
+	/** Lifetime-average CPU%, summed. Always known — and never a rate. */
+	cpuLifetimePercent: z.number(),
+	cpuLifetimePercentMin: z.number(),
+	memoryRssBytes: z.number(),
+	memoryRssBytesMin: z.number(),
+	processCount: z.number().int(),
+	processCountMin: z.number().int()
+});
+/** One function's series. `key` is an addonId, `__root__` or `__unattributed__`. */
+var LoadFunctionSeriesSchema = z.object({
+	key: z.string(),
+	kind: z.enum([
+		"addon",
+		"root",
+		"unattributed"
+	]),
+	/** Oldest-first. A missing interval is MISSING — never zero-filled. */
+	points: z.array(LoadPointSchema).readonly()
+});
+var NodeLoadSeriesSchema = z.object({
+	nodeId: z.string(),
+	/** One entry per function seen in the window, heaviest-first. */
+	series: z.array(LoadFunctionSeriesSchema).readonly(),
+	/**
+	* Width of one returned bucket, in ms. Equals the sampling cadence when no
+	* reduction was needed — so a caller can always say what one point covers
+	* without having to know whether it was reduced.
+	*/
+	bucketMs: z.number(),
+	/** Raw snapshots that went into this answer, across both tiers. */
+	retainedSamples: z.number(),
+	/** Oldest snapshot represented, or `null` when nothing is retained. */
+	oldestAtMs: z.number().nullable(),
+	/** The fixed sampling cadence in force on the cluster, in ms. */
+	cadenceMs: z.number(),
+	/**
+	* Did the DURABLE tier contribute? `false` means the answer is the hot ring
+	* alone — an agent (which holds no table), or a store that refused.
+	* Reported because "the last hour" and "the last six hours" are different
+	* questions and an operator must not have to guess which was answered.
+	*/
+	durable: z.boolean()
+});
+var GetLoadSeriesInputSchema = z.object({
+	/**
+	* The node whose series is wanted.
+	*
+	* NOT named `nodeId`: the generated cap router strips a top-level
+	* `nodeId` from every method input and uses it to ROUTE the call to
+	* that node's provider (`generated-cap-routers.ts`). A series target
+	* called `nodeId` would silently become a routing pin and never reach
+	* the provider. The hub holds every node it hears from, so the
+	* ordinary call is unpinned — answered by the hub, for any node.
+	*/
+	forNodeId: z.string(),
+	/**
+	* EXCLUSIVE lower bound. A caller passes the newest `atMs` it already
+	* holds and receives only what it is missing, so seeding a live chart
+	* from this method cannot double a point already drawn.
+	*/
+	sinceMs: z.number().optional(),
+	/**
+	* Most points the caller wants PER FUNCTION. The window is reduced to fit,
+	* preserving min and max per bucket.
+	*
+	* Absent means NO reduction — legitimate for a short window and a trap for a
+	* long one, which is why a chart passes its own pixel width.
+	*/
+	maxPoints: z.number().int().positive().optional()
+});
 var SystemMetricsSchema = z.object({
 	cpuPercent: z.number(),
 	memoryPercent: z.number(),
@@ -11611,28 +11988,44 @@ var metricsProviderCapability = {
 		getAddonStats: method(z.object({ addonId: z.string() }), PidResourceStatsSchema.nullable()),
 		/**
 		* Snapshot of every camstack-related process on this node with a
-		* ghost/managed/root classification. Powers the Cluster → Agent →
-		* Processes tab: cross-references `$process.list` against a `ps` scan
-		* so orphaned trees (PPID=1) or unknown children show up as `ghost`
-		* and can be killed from the UI.
+		* root/managed/system classification. Powers the Cluster → Agent →
+		* Processes tab: cross-references `$process.list` against a `ps` scan so
+		* per-addon CPU and RSS can be attributed, and so a process the cluster
+		* does not manage is still visible.
+		*
+		* **Read-only, by design.** This cap once carried a `killProcess`
+		* mutation; it was deleted on 2026-08-27. A runner's lifecycle belongs to
+		* `CrashSupervisor` and is driven through `addons.restartAddon` /
+		* `$process.restart` — signalling a raw pid went around the supervisor
+		* (D6), and the one class it was willing to signal turned out to be the
+		* container's own init and the operator's desktop app.
 		*/
 		listNodeProcesses: method(z.void(), z.array(NodeProcessSchema).readonly()),
 		/**
-		* Send SIGTERM (or SIGKILL when `force`) to a pid inside this node's
-		* process tree. The provider refuses pids that aren't in the live
-		* `listNodeProcesses()` snapshot — callers can't use this endpoint
-		* to kill arbitrary system processes.
+		* The retained per-node load series — the ONE reader over BOTH tiers.
+		*
+		* The in-memory ring is the HOT window (the last 180 snapshots, held by
+		* every node's `native-metrics`); the hub's `metrics:node-load-samples`
+		* table is the COLD one (the operator's retention, six hours by default).
+		* This method merges them and DEDUPES on `atMs`, so a snapshot present in
+		* both contributes once and the caller never learns which tier a point
+		* came from. There is deliberately no second read surface: two readers is
+		* how two charts start disagreeing about the same node.
+		*
+		* Reads only; nothing is sampled to answer it. Normally called UNPINNED —
+		* the hub hears every node's snapshot and holds every node's rows — and
+		* answers for any `forNodeId`. Pinned to an agent it answers from that
+		* agent's ring alone (`durable: false`). Empty is a legitimate answer: a
+		* node nobody has heard from has no series, and saying so is the truth.
 		*/
-		killProcess: method(KillProcessInputSchema, KillProcessResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
+		getLoadSeries: method(GetLoadSeriesInputSchema, NodeLoadSeriesSchema),
 		/**
 		* Tell the addon's forked runner to write a V8 heap snapshot to disk (via
 		* SIGUSR2 — the runner's diagnostic handler). Also logs its
-		* `process.memoryUsage()` + heap-space breakdown. Refuses pids not in the
-		* live `listNodeProcesses()` snapshot. Use for deep per-addon memory
-		* attribution; copy the returned path off the node to analyze.
+		* `process.memoryUsage()` + heap-space breakdown. Resolves the pid from
+		* `$process.list`, so it can only reach a runner this node spawned. Use
+		* for deep per-addon memory attribution; copy the returned path off the
+		* node to analyze.
 		*/
 		dumpHeapSnapshot: method(DumpHeapSnapshotInputSchema, DumpHeapSnapshotResultSchema, {
 			kind: "mutation",
@@ -30148,6 +30541,15 @@ var LoggingSettingsPatchSchema = z.object({
 * authority over the whole hierarchy and answers for every layer, so the
 * layer selector needs a name the transport does not already own.
 */
+/**
+* One contribution, plus WHO reported it.
+*
+* The addon and node are added by the hub as it enumerates providers, never by
+* the contributor: an addon reporting its own identity could report somebody
+* else's, and the whole point of this surface is that no claim is made by
+* anyone but its owner.
+*/
+var ReportedLoadContributionSchema = LoadContributionSchema.extend({ addonId: z.string() });
 var GetLoggingSettingsInputSchema = z.object({
 	scopeNodeId: z.string().optional(),
 	/**
@@ -30250,6 +30652,22 @@ var systemCapability = {
 		*/
 		getRequestCensus: method(z.void(), RequestCensusStatusSchema, { auth: "admin" }),
 		/**
+		* Every `load-contribution` an addon on this cluster reports — each
+		* addon's OWN cost, already attributed by the addon that owns it.
+		*
+		* There is no central list of what costs what: an addon that spawns a
+		* per-camera child declares it, and one that cannot attribute its cost
+		* (the shared inference pool) declares THAT. So a new cost family appears
+		* here the moment its addon is redeployed, with nobody editing anything.
+		*
+		* What this does NOT do is measure the node. `metrics.node-processes-
+		* snapshot` still does that, and the difference between the two is the
+		* finding: a process no contribution claims is either a leak or a family
+		* nobody has taught to report. Both belong in the unattributed bucket, and
+		* neither may be folded into a camera.
+		*/
+		getLoadContributions: method(z.void(), z.array(ReportedLoadContributionSchema).readonly(), { auth: "admin" }),
+		/**
 		* The logging settings document — levels and armed diagnostics — resolved
 		* for `nodeId`, or for the cluster when `nodeId` is absent.
 		*
@@ -32048,6 +32466,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	lawnMowerControlCapability,
 	llmCapability,
 	llmRuntimeCapability,
+	loadContributionCapability,
 	localNetworkCapability,
 	lockControlCapability,
 	logChannelsCapability,
@@ -33071,6 +33490,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"dataStoreProvider.insertMany": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dataStoreProvider.isEmpty": {
 		capName: "data-store-provider",
 		capScope: "system",
@@ -34385,6 +34810,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"loadContribution.list": {
+		capName: "load-contribution",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.downloadCa": {
 		capName: "local-network",
 		capScope: "system",
@@ -34685,17 +35116,17 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"metricsProvider.getProcessStats": {
+	"metricsProvider.getLoadSeries": {
 		capName: "metrics-provider",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"metricsProvider.killProcess": {
+	"metricsProvider.getProcessStats": {
 		capName: "metrics-provider",
 		capScope: "system",
 		addonId: null,
-		access: "create"
+		access: "view"
 	},
 	"metricsProvider.listAddonInstances": {
 		capName: "metrics-provider",
@@ -36707,6 +37138,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.insertMany": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"settingsStore.isEmpty": {
 		capName: "settings-store",
 		capScope: "system",
@@ -37319,6 +37756,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.getLoadContributions": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"system.getLoggingSettings": {
 		capName: "system",
 		capScope: "system",
@@ -40647,4 +41090,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { kebabToCamel as $, buildStreamParamsConfigSchema as A, DeviceFeature as At, doorbellCapability as B, emitDownForOwnedCaps as Bt, addonSettingsCapability as C, vectorDimFromBase64 as Ct, backupCapability as D, DATAPLANE_SECRET_HEADER as Dt, authProviderCapability as E, BaseAddon as Et, decodeVectorBase64 as F, WELL_KNOWN_TAB_MAP as Ft, extractNestedAddonId as G, nodePin as Gt, enumerateItemArrayFields as H, expandCapMethods as Ht, deriveBatteryPresence as I, asJsonObject as It, isCollectionArrayMethod as J, readinessKey as Jt, filesystemBrowseCapability as K, parseJsonObject as Kt, deviceManagerCapability as L, asNumber as Lt, coreBlockIdFromAddonId as M, DeviceType as Mt, coreBlocksCapability as N, ReadinessRegistry as Nt, bareAddonId as O, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Ot, dataStoreProviderCapability as P, ReadinessTimeoutError as Pt, isVoidInput as Q, EventCategory as Qt, deviceStateCapability as R, asString as Rt, addonPagesCapability as S, userManagementCapability as St, alertsCapability as T, errMsg as Tt, enumerateSchemaFields as U, hydrateSchema as Ut, enumerateInferenceDevices as V, emitReadiness as Vt, evaluateSensorEdge as W, isDeviceConfigCap as Wt, isSameAddonId as X, scopeKey as Xt, isObjectInput as Y, resolveCapMount as Yt, isSourceCap as Z, sleep as Zt, STREAM_PROFILE_META as _, snapshotCapability as _t, CAP_NAMES_WITH_STATUS as a, metricsProviderCapability as at, StorageMigrationJobSchema as b, storageProviderCapability as bt, CoreBlockSchema as c, parseStreamParamsFormPatch as ct, DeviceStatusSchema as d, resolveMethodAuth as dt, lifecycleJobSchema as et, LOG_LEVEL_RANK as f, runtimeStatePolicyFor as ft, SOURCE_DEVICE_TYPES as g, settingsStoreCapability as gt, SOURCE_CAPS as h, scoreRuntimes as ht, BatteryStatusSchema as i, looseSchema as it, coreBlockAddonId as j, DeviceRole as jt, batteryCapability as k, DEVICE_STATUS_METHOD as kt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as l, platformProbeCapability as lt, RUNTIME_DEFAULTS as m, scopesAllowDeviceCap as mt, AlertSchema as n, logDestinationCapability as nt, CORE_BLOCKS_ADDON_ID as o, normalizeUnit as ot, METHOD_ACCESS_MAP as p, scopesAllowAddon as pt, isArrayOutputSchema as q, parseJsonUnknown as qt, ApiKeyRecordSchema as r, logLevelAtMost as rt, CORE_BLOCK_ADDON_PREFIX as s, objectInputDeclaresAddonId as st, ALL_CAPABILITY_DEFINITIONS as t, localNetworkCapability as tt, DeclaredDevices as u, procedureAuthKey as ut, ScopedTokenSchema as v, storageCapability as vt, addonWidgetsCapability as w, vectorStoreCapability as wt, UserRecordSchema as x, streamQualityLabel as xt, StorageLocationTypeSchema as y, storageMigrationCapability as yt, deviceStatusCapability as z, createEvent as zt };
+export { isVoidInput as $, scopeKey as $t, buildStreamParamsConfigSchema as A, DATAPLANE_SECRET_HEADER as At, doorbellCapability as B, asNumber as Bt, addonSettingsCapability as C, storageProviderCapability as Ct, backupCapability as D, vectorStoreCapability as Dt, authProviderCapability as E, vectorDimFromBase64 as Et, decodeVectorBase64 as F, DeviceType as Ft, extractNestedAddonId as G, expandCapMethods as Gt, enumerateItemArrayFields as H, createEvent as Ht, deriveBatteryPresence as I, ReadinessRegistry as It, isArrayOutputSchema as J, nodePin as Jt, filesystemBrowseCapability as K, hydrateSchema as Kt, deviceManagerCapability as L, ReadinessTimeoutError as Lt, coreBlockIdFromAddonId as M, DEVICE_STATUS_METHOD as Mt, coreBlocksCapability as N, DeviceFeature as Nt, bareAddonId as O, errMsg as Ot, dataStoreProviderCapability as P, DeviceRole as Pt, isSourceCap as Q, resolveCapMount as Qt, deviceStateCapability as R, WELL_KNOWN_TAB_MAP as Rt, addonPagesCapability as S, storageMigrationCapability as St, alertsCapability as T, userManagementCapability as Tt, enumerateSchemaFields as U, emitDownForOwnedCaps as Ut, enumerateInferenceDevices as V, asString as Vt, evaluateSensorEdge as W, emitReadiness as Wt, isObjectInput as X, parseJsonUnknown as Xt, isCollectionArrayMethod as Y, parseJsonObject as Yt, isSameAddonId as Z, readinessKey as Zt, STREAM_PROFILE_META as _, scopesAllowDeviceCap as _t, CAP_NAMES_WITH_STATUS as a, looseSchema as at, StorageMigrationJobSchema as b, snapshotCapability as bt, CoreBlockSchema as c, objectInputDeclaresAddonId as ct, DeviceStatusSchema as d, procedureAuthKey as dt, sleep as en, kebabToCamel as et, LOG_LEVEL_RANK as f, reducePoints as ft, SOURCE_DEVICE_TYPES as g, scopesAllowAddon as gt, SOURCE_CAPS as h, runtimeStatePolicyFor as ht, BatteryStatusSchema as i, logLevelAtMost as it, coreBlockAddonId as j, DEVICE_SETTINGS_CONTRIBUTION_METHODS as jt, batteryCapability as k, BaseAddon as kt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as l, parseStreamParamsFormPatch as lt, RUNTIME_DEFAULTS as m, resolveMethodAuth as mt, AlertSchema as n, localNetworkCapability as nt, CORE_BLOCKS_ADDON_ID as o, metricsProviderCapability as ot, METHOD_ACCESS_MAP as p, resolveBucketMs as pt, foldSnapshotByFunction as q, isDeviceConfigCap as qt, ApiKeyRecordSchema as r, logDestinationCapability as rt, CORE_BLOCK_ADDON_PREFIX as s, normalizeUnit as st, ALL_CAPABILITY_DEFINITIONS as t, EventCategory as tn, lifecycleJobSchema as tt, DeclaredDevices as u, platformProbeCapability as ut, ScopedTokenSchema as v, scoreRuntimes as vt, addonWidgetsCapability as w, streamQualityLabel as wt, UserRecordSchema as x, storageCapability as xt, StorageLocationTypeSchema as y, settingsStoreCapability as yt, deviceStatusCapability as z, asJsonObject as zt };