@camstack/system 1.2.149 → 1.2.151

package/dist/{dist-DdEXjTDo.js → dist-CImxMt5h.js}

@@ -11607,6 +11607,133 @@ var logDestinationCapability = {
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
 	mount: { kind: "skip" }
 };
+/**
+* `failure-contribution` — the capability an addon reports its OWN losses
+* through, per camera, with the denominator attached. It stores nothing.
+*
+* ## The twin of `load-contribution`, and why it is a twin and not a field
+*
+* `load-contribution` answers *what did this camera COST*. This answers *what
+* did this camera LOSE*. The reporting discipline is identical and deliberately
+* copied: the contributor reports what it already knows, hub-main adds only
+* `addonId`, nothing needs global knowledge, and there is no central list for
+* somebody to forget to edit.
+*
+* They are not merged, because their invariants are opposites:
+*
+*  - a `load-contribution` measurement is **absent, never zero** — a zero would
+*    claim a camera cost nothing, which is a measurement nobody made;
+*  - a `failure-contribution` zero is the **most valuable value on the
+*    surface** — `attempts: 400, succeeded: 400` is the proof a fix landed,
+*    and it is exactly what an absent entry cannot say.
+*
+* Putting a loss counter on a cost entry would also break the reconciliation
+* that gives `load-contribution` its point: contributions are subtracted from
+* `metrics.node-processes-snapshot` to find processes nobody claims. A failure
+* has no process.
+*
+* ## Why not a log line, since the counters already exist
+*
+* Several of these paths already counted themselves — `CaptureScheduler`'s
+* per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
+* ends in a log line, and a log line is the thing the operator asked to stop
+* needing: *"possiamo armare questi errori intanto? Così al prossimo giro
+* ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
+* hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
+* media blackout were both diagnosed. The counters stay; this is where they can
+* be READ.
+*
+* ## The rate is served with its denominator or not at all
+*
+* Every entry carries `attempts` and `succeeded`. A miss count alone is
+* unreadable: on 2026-08-28 the enrichment-crop miss count read as "35x worse
+* than yesterday" and was **flat across twelve hours** once divided by the
+* successes on the same path. A surface that publishes only the numerator
+* reproduces that mistake on every read.
+*
+* ## Shape
+*
+* Copied from `load-contribution.cap.ts` (`mode: 'collection'`,
+* `internal: true`, `mount: { kind: 'skip' }`): no tRPC route of its own and no
+* generated hooks, while `addons.listCapabilityProviders` still enumerates it
+* and the hub's `CapabilityRegistry` still holds an RPC proxy per provider — so
+* a forked runner's entries reach hub-main over transport that already exists.
+* No new UDS message, no second registry (D3). The operator reads the assembled
+* result through `system.getFailureContributions`.
+*/
+var FailureReasonCountSchema = zod.z.object({
+	/**
+	* Why the attempt did not land, in the contributor's own vocabulary —
+	* `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
+	* strings that already appear in this repo's logs and, where one exists, the
+	* same string the per-track `previewMissReason` records (D276): a second
+	* vocabulary for the same loss would make the row and the counter
+	* un-joinable.
+	*/
+	reason: zod.z.string(),
+	count: zod.z.number().int().nonnegative()
+});
+var FailureContributionSchema = zod.z.object({
+	/**
+	* The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
+	* `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
+	* `unit` free: the families are owned by different addons and a shared enum
+	* is a central list that rots invisibly.
+	*/
+	family: zod.z.string(),
+	/**
+	* The NUMERIC device id — the same value every log line carries as
+	* `tags.deviceId`. Never nullable and never absent: a contributor that
+	* cannot name the camera must not emit the entry, because a fleet total
+	* cannot answer the only question anybody asks of this surface.
+	*/
+	deviceId: zod.z.number().int().positive(),
+	/**
+	* A second dimension inside the family: the model / step id for an inference
+	* timeout, so "which camera AND which model" is one read. Absent when the
+	* family has a single variant.
+	*/
+	variant: zod.z.string().optional(),
+	/**
+	* Epoch ms this counter started — the INCARNATION MARKER. A consumer
+	* differencing two reads must drop the interval when it changes, because the
+	* counter restarted from zero in a respawned runner. Same discipline as
+	* `LoadContribution.startedAtMs`.
+	*/
+	sinceMs: zod.z.number(),
+	/** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
+	atMs: zod.z.number(),
+	/**
+	* THE DENOMINATOR — every attempt on this path for this camera in the
+	* window. A failure count published without it is the mistake this schema
+	* exists to make impossible.
+	*/
+	attempts: zod.z.number().int().nonnegative(),
+	/** Attempts that landed. `attempts - succeeded` is the loss. */
+	succeeded: zod.z.number().int().nonnegative(),
+	/** The loss, partitioned. Sums to `attempts - succeeded`. */
+	reasons: zod.z.array(FailureReasonCountSchema).readonly()
+});
+var failureContributionCapability = {
+	name: "failure-contribution",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { 
+	/**
+	* This addon's per-camera failure counters, read live from bounded in-RAM
+	* state it already keeps. Inert: no persistence, no sampling, no timer.
+	*
+	* READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
+	* consumer that wants a rate differences two reads. A draining read would
+	* make two operators with the page open each destroy half of the other's
+	* numbers, and `load-contribution` already settled the same question the
+	* same way for `cpuSeconds`.
+	*/
+list: method(zod.z.void(), zod.z.array(FailureContributionSchema).readonly()) },
+	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
+	mount: { kind: "skip" }
+};
 var LoadContributionSchema = zod.z.object({
 	role: zod.z.enum([
 		"decode",
@@ -16717,6 +16844,20 @@ var TrackSchema = zod.z.object({
 	* `=== true` and render nothing otherwise — never infer "no rider".
 	*/
 	hasRider: zod.z.boolean().optional(),
+	/**
+	* WHY this track ended without a NATIVE best-shot tile
+	* ([D276](../decisions/adr-0276-a-stand-in-tile-is-provisional-and-a-close-says-why.md)) —
+	* a composed token line (`no-key-frame capture=keyframe:native-missx4`,
+	* `derive-returned-null tile=standin`, …) written at close and CLEARED by
+	* the late-keyFrame upgrade when a native tile lands after all. The
+	* operator-facing answer to "perché manca l'immagine?" on a track whose
+	* tile is a face/plate stand-in, a raster crop, or an icon.
+	*
+	* **Absent ≠ "missed silently"**: a row written before the column, a hub
+	* that predates the field, and every track whose tile landed native all
+	* omit it. Render nothing when absent.
+	*/
+	previewMissReason: zod.z.string().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -30672,6 +30813,13 @@ var LoggingSettingsPatchSchema = zod.z.object({
 * anyone but its owner.
 */
 var ReportedLoadContributionSchema = LoadContributionSchema.extend({ addonId: zod.z.string() });
+/**
+* One per-camera failure counter, plus WHO reported it.
+*
+* Same rule as {@link ReportedLoadContributionSchema}: `addonId` is stamped by
+* the hub as it enumerates providers, never by the contributor.
+*/
+var ReportedFailureContributionSchema = FailureContributionSchema.extend({ addonId: zod.z.string() });
 var GetLoggingSettingsInputSchema = zod.z.object({
 	scopeNodeId: zod.z.string().optional(),
 	/**
@@ -30790,6 +30938,28 @@ var systemCapability = {
 		*/
 		getLoadContributions: method(zod.z.void(), zod.z.array(ReportedLoadContributionSchema).readonly(), { auth: "admin" }),
 		/**
+		* Every `failure-contribution` an addon on this cluster reports — per
+		* camera, per reason, **with the denominator attached**.
+		*
+		* This is the surface the operator asked for on 2026-08-28 (*"possiamo
+		* armare questi errori intanto? Così al prossimo giro ricontrolliamo tutti
+		* questi punti"*). Before it, four live failure modes could only be counted
+		* by grepping Loki and hand-correlating timestamps, which is exactly how a
+		* 22% thumbnail gap and a 3-hour media blackout were diagnosed — twice.
+		*
+		* Read it as a RATIO, never as a count. `attempts` is on every entry
+		* because the count on its own lies: `enrichment crop native miss` read as
+		* "35x worse than yesterday" and was flat across twelve hours once divided
+		* by the successes on the same path.
+		*
+		* The counters are CUMULATIVE since each entry's `sinceMs`. Reading does
+		* not reset them, and `sinceMs` changing means the reporting runner
+		* respawned — a consumer differencing two reads drops that interval.
+		*
+		* Admin-only: the rows name cameras and the paths that fail on them.
+		*/
+		getFailureContributions: method(zod.z.void(), zod.z.array(ReportedFailureContributionSchema).readonly(), { auth: "admin" }),
+		/**
 		* The logging settings document — levels and armed diagnostics — resolved
 		* for `nodeId`, or for the cluster when `nodeId` is absent.
 		*
@@ -32574,6 +32744,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	eventEmitterCapability,
 	eventsCapability,
 	faceGalleryCapability,
+	failureContributionCapability,
 	fanControlCapability,
 	featureProbeCapability,
 	filesystemBrowseCapability,
@@ -34578,6 +34749,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"failureContribution.list": {
+		capName: "failure-contribution",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"fanControl.setDirection": {
 		capName: "fan-control",
 		capScope: "device",
@@ -37884,6 +38061,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.getFailureContributions": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"system.getLoadContributions": {
 		capName: "system",
 		capScope: "system",

package/dist/{dist-CZWAU40-.mjs → dist-CbRciAbu.mjs}

@@ -11607,6 +11607,133 @@ var logDestinationCapability = {
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
 	mount: { kind: "skip" }
 };
+/**
+* `failure-contribution` — the capability an addon reports its OWN losses
+* through, per camera, with the denominator attached. It stores nothing.
+*
+* ## The twin of `load-contribution`, and why it is a twin and not a field
+*
+* `load-contribution` answers *what did this camera COST*. This answers *what
+* did this camera LOSE*. The reporting discipline is identical and deliberately
+* copied: the contributor reports what it already knows, hub-main adds only
+* `addonId`, nothing needs global knowledge, and there is no central list for
+* somebody to forget to edit.
+*
+* They are not merged, because their invariants are opposites:
+*
+*  - a `load-contribution` measurement is **absent, never zero** — a zero would
+*    claim a camera cost nothing, which is a measurement nobody made;
+*  - a `failure-contribution` zero is the **most valuable value on the
+*    surface** — `attempts: 400, succeeded: 400` is the proof a fix landed,
+*    and it is exactly what an absent entry cannot say.
+*
+* Putting a loss counter on a cost entry would also break the reconciliation
+* that gives `load-contribution` its point: contributions are subtracted from
+* `metrics.node-processes-snapshot` to find processes nobody claims. A failure
+* has no process.
+*
+* ## Why not a log line, since the counters already exist
+*
+* Several of these paths already counted themselves — `CaptureScheduler`'s
+* per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
+* ends in a log line, and a log line is the thing the operator asked to stop
+* needing: *"possiamo armare questi errori intanto? Così al prossimo giro
+* ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
+* hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
+* media blackout were both diagnosed. The counters stay; this is where they can
+* be READ.
+*
+* ## The rate is served with its denominator or not at all
+*
+* Every entry carries `attempts` and `succeeded`. A miss count alone is
+* unreadable: on 2026-08-28 the enrichment-crop miss count read as "35x worse
+* than yesterday" and was **flat across twelve hours** once divided by the
+* successes on the same path. A surface that publishes only the numerator
+* reproduces that mistake on every read.
+*
+* ## Shape
+*
+* Copied from `load-contribution.cap.ts` (`mode: 'collection'`,
+* `internal: true`, `mount: { kind: 'skip' }`): no tRPC route of its own and no
+* generated hooks, while `addons.listCapabilityProviders` still enumerates it
+* and the hub's `CapabilityRegistry` still holds an RPC proxy per provider — so
+* a forked runner's entries reach hub-main over transport that already exists.
+* No new UDS message, no second registry (D3). The operator reads the assembled
+* result through `system.getFailureContributions`.
+*/
+var FailureReasonCountSchema = z.object({
+	/**
+	* Why the attempt did not land, in the contributor's own vocabulary —
+	* `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
+	* strings that already appear in this repo's logs and, where one exists, the
+	* same string the per-track `previewMissReason` records (D276): a second
+	* vocabulary for the same loss would make the row and the counter
+	* un-joinable.
+	*/
+	reason: z.string(),
+	count: z.number().int().nonnegative()
+});
+var FailureContributionSchema = z.object({
+	/**
+	* The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
+	* `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
+	* `unit` free: the families are owned by different addons and a shared enum
+	* is a central list that rots invisibly.
+	*/
+	family: z.string(),
+	/**
+	* The NUMERIC device id — the same value every log line carries as
+	* `tags.deviceId`. Never nullable and never absent: a contributor that
+	* cannot name the camera must not emit the entry, because a fleet total
+	* cannot answer the only question anybody asks of this surface.
+	*/
+	deviceId: z.number().int().positive(),
+	/**
+	* A second dimension inside the family: the model / step id for an inference
+	* timeout, so "which camera AND which model" is one read. Absent when the
+	* family has a single variant.
+	*/
+	variant: z.string().optional(),
+	/**
+	* Epoch ms this counter started — the INCARNATION MARKER. A consumer
+	* differencing two reads must drop the interval when it changes, because the
+	* counter restarted from zero in a respawned runner. Same discipline as
+	* `LoadContribution.startedAtMs`.
+	*/
+	sinceMs: z.number(),
+	/** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
+	atMs: z.number(),
+	/**
+	* THE DENOMINATOR — every attempt on this path for this camera in the
+	* window. A failure count published without it is the mistake this schema
+	* exists to make impossible.
+	*/
+	attempts: z.number().int().nonnegative(),
+	/** Attempts that landed. `attempts - succeeded` is the loss. */
+	succeeded: z.number().int().nonnegative(),
+	/** The loss, partitioned. Sums to `attempts - succeeded`. */
+	reasons: z.array(FailureReasonCountSchema).readonly()
+});
+var failureContributionCapability = {
+	name: "failure-contribution",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { 
+	/**
+	* This addon's per-camera failure counters, read live from bounded in-RAM
+	* state it already keeps. Inert: no persistence, no sampling, no timer.
+	*
+	* READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
+	* consumer that wants a rate differences two reads. A draining read would
+	* make two operators with the page open each destroy half of the other's
+	* numbers, and `load-contribution` already settled the same question the
+	* same way for `cpuSeconds`.
+	*/
+list: method(z.void(), z.array(FailureContributionSchema).readonly()) },
+	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
+	mount: { kind: "skip" }
+};
 var LoadContributionSchema = z.object({
 	role: z.enum([
 		"decode",
@@ -16717,6 +16844,20 @@ var TrackSchema = z.object({
 	* `=== true` and render nothing otherwise — never infer "no rider".
 	*/
 	hasRider: z.boolean().optional(),
+	/**
+	* WHY this track ended without a NATIVE best-shot tile
+	* ([D276](../decisions/adr-0276-a-stand-in-tile-is-provisional-and-a-close-says-why.md)) —
+	* a composed token line (`no-key-frame capture=keyframe:native-missx4`,
+	* `derive-returned-null tile=standin`, …) written at close and CLEARED by
+	* the late-keyFrame upgrade when a native tile lands after all. The
+	* operator-facing answer to "perché manca l'immagine?" on a track whose
+	* tile is a face/plate stand-in, a raster crop, or an icon.
+	*
+	* **Absent ≠ "missed silently"**: a row written before the column, a hub
+	* that predates the field, and every track whose tile landed native all
+	* omit it. Render nothing when absent.
+	*/
+	previewMissReason: z.string().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -30672,6 +30813,13 @@ var LoggingSettingsPatchSchema = z.object({
 * anyone but its owner.
 */
 var ReportedLoadContributionSchema = LoadContributionSchema.extend({ addonId: z.string() });
+/**
+* One per-camera failure counter, plus WHO reported it.
+*
+* Same rule as {@link ReportedLoadContributionSchema}: `addonId` is stamped by
+* the hub as it enumerates providers, never by the contributor.
+*/
+var ReportedFailureContributionSchema = FailureContributionSchema.extend({ addonId: z.string() });
 var GetLoggingSettingsInputSchema = z.object({
 	scopeNodeId: z.string().optional(),
 	/**
@@ -30790,6 +30938,28 @@ var systemCapability = {
 		*/
 		getLoadContributions: method(z.void(), z.array(ReportedLoadContributionSchema).readonly(), { auth: "admin" }),
 		/**
+		* Every `failure-contribution` an addon on this cluster reports — per
+		* camera, per reason, **with the denominator attached**.
+		*
+		* This is the surface the operator asked for on 2026-08-28 (*"possiamo
+		* armare questi errori intanto? Così al prossimo giro ricontrolliamo tutti
+		* questi punti"*). Before it, four live failure modes could only be counted
+		* by grepping Loki and hand-correlating timestamps, which is exactly how a
+		* 22% thumbnail gap and a 3-hour media blackout were diagnosed — twice.
+		*
+		* Read it as a RATIO, never as a count. `attempts` is on every entry
+		* because the count on its own lies: `enrichment crop native miss` read as
+		* "35x worse than yesterday" and was flat across twelve hours once divided
+		* by the successes on the same path.
+		*
+		* The counters are CUMULATIVE since each entry's `sinceMs`. Reading does
+		* not reset them, and `sinceMs` changing means the reporting runner
+		* respawned — a consumer differencing two reads drops that interval.
+		*
+		* Admin-only: the rows name cameras and the paths that fail on them.
+		*/
+		getFailureContributions: method(z.void(), z.array(ReportedFailureContributionSchema).readonly(), { auth: "admin" }),
+		/**
 		* The logging settings document — levels and armed diagnostics — resolved
 		* for `nodeId`, or for the cluster when `nodeId` is absent.
 		*
@@ -32574,6 +32744,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	eventEmitterCapability,
 	eventsCapability,
 	faceGalleryCapability,
+	failureContributionCapability,
 	fanControlCapability,
 	featureProbeCapability,
 	filesystemBrowseCapability,
@@ -34578,6 +34749,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"failureContribution.list": {
+		capName: "failure-contribution",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"fanControl.setDirection": {
 		capName: "fan-control",
 		capScope: "device",
@@ -37884,6 +38061,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.getFailureContributions": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"system.getLoadContributions": {
 		capName: "system",
 		capScope: "system",

package/dist/index.d.ts

@@ -46,8 +46,8 @@ export { createFileDataPlaneHandler } from './http/file-data-plane.js';
 export { allFamiliesListenHost, applyLanHttp, bindPendingLanHttp, closeLanHttp, DEFAULT_LAN_HTTP_PORT, readLanHttpState, registerLanHttpHandler, } from './http/lan-http-bind.js';
 export type { ReverseProxyOptions } from './http/reverse-proxy.js';
 export { proxyToUpstream } from './http/reverse-proxy.js';
-export type { HeapReclaimer, HeapReclaimOptions, HeapSample, HeapWatchSink, RssBreakdown, RssBudgetOptions, RssBudgetState, RssGrowthShape, RunnerHeapWatchOptions, } from './kernel/heap-watch.js';
-export { buildHeapSample, createV8Reclaimer, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, hubMainRssBudget, describeRss, nextRssBudgetState, parseRssBudgetMb, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, shouldReclaim, startHeapWatch, startRunnerHeapWatch, strandedMb, } from './kernel/heap-watch.js';
+export type { DeferredHeapWatchSink, HeapReclaimer, HeapReclaimOptions, HeapSample, HeapWatchSink, RssBreakdown, RssBudgetOptions, RssBudgetState, RssGrowthShape, RunnerHeapWatchOptions, } from './kernel/heap-watch.js';
+export { buildHeapSample, createDeferredHeapWatchSink, createV8Reclaimer, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, hubMainRssBudget, describeRss, nextRssBudgetState, parseRssBudgetMb, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, shouldReclaim, startHeapWatch, startRunnerHeapWatch, strandedMb, } from './kernel/heap-watch.js';
 export type { AddonDataPlaneFacility, DataPlaneSink, } from './kernel/moleculer/addon-data-plane-facility.js';
 export { createAddonDataPlaneFacility } from './kernel/moleculer/addon-data-plane-facility.js';
 export type { ElementState, ElementStatus, } from './lifecycle/lifecycle-state-machine.js';

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DdEXjTDo.js");
+const require_dist = require("./dist-CImxMt5h.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -26,7 +26,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
 const require_tls$1 = require("./tls-u8QCJCFE.js");
-const require_manifest_python_deps = require("./manifest-python-deps-CivtrAha.js");
+const require_manifest_python_deps = require("./manifest-python-deps-BqWrDjSN.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");
@@ -95348,6 +95348,7 @@ exports.HEAP_WATCH_INTERVAL_MS = require_manifest_python_deps.HEAP_WATCH_INTERVA
 exports.HEAP_WATCH_WARN_RATIO = require_manifest_python_deps.HEAP_WATCH_WARN_RATIO;
 exports.HUB_CAP_FWD_ACTION = require_manifest_python_deps.HUB_CAP_FWD_ACTION;
 exports.HUB_CAP_FWD_SERVICE = require_manifest_python_deps.HUB_CAP_FWD_SERVICE;
+exports.HUB_MAIN_HEAP_WATCH_LABEL = require_manifest_python_deps.HUB_MAIN_HEAP_WATCH_LABEL;
 exports.HUB_MAIN_RSS_BUDGET_MB = require_manifest_python_deps.HUB_MAIN_RSS_BUDGET_MB;
 exports.HUB_RSS_BUDGET_ENV = require_manifest_python_deps.HUB_RSS_BUDGET_ENV;
 exports.HubForwarderAddon = require_builtins_hub_forwarder_index.HubForwarderAddon$1;
@@ -95468,6 +95469,7 @@ exports.createAuthenticatedFileServer = require_file_data_plane.createAuthentica
 exports.createBroker = createBroker;
 exports.createBrokerDeviceManagerApi = require_manifest_python_deps.createBrokerDeviceManagerApi;
 exports.createCoreCapService = createCoreCapService;
+exports.createDeferredHeapWatchSink = require_manifest_python_deps.createDeferredHeapWatchSink;
 exports.createDoorSettingsView = createDoorSettingsView;
 exports.createFileDataPlaneHandler = require_file_data_plane.createFileDataPlaneHandler;
 exports.createHubCapForwardService = require_manifest_python_deps.createHubCapForwardService;

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $ as isVoidInput, $t as scopeKey, At as DATAPLANE_SECRET_HEADER$1, Bt as asNumber, C as addonSettingsCapability, G as extractNestedAddonId, Gt as expandCapMethods, Ht as createEvent, It as ReadinessRegistry, J as isArrayOutputSchema, Lt as ReadinessTimeoutError, Mt as DEVICE_STATUS_METHOD, Ot as errMsg$1, Qt as resolveCapMount, Ut as emitDownForOwnedCaps, Vt as asString$1, X as isObjectInput, Xt as parseJsonUnknown$1, Y as isCollectionArrayMethod, Yt as parseJsonObject, Zt as readinessKey, _t as scopesAllowDeviceCap, at as looseSchema, ct as objectInputDeclaresAddonId, dt as procedureAuthKey, et as kebabToCamel, f as LOG_LEVEL_RANK, gt as scopesAllowAddon, it as logLevelAtMost, jt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, m as RUNTIME_DEFAULTS, mt as resolveMethodAuth, p as METHOD_ACCESS_MAP, t as ALL_CAPABILITY_DEFINITIONS, tn as EventCategory$1, tt as lifecycleJobSchema, zt as asJsonObject$1 } from "./dist-CZWAU40-.mjs";
+import { $ as isVoidInput, $t as scopeKey, At as DATAPLANE_SECRET_HEADER$1, Bt as asNumber, C as addonSettingsCapability, G as extractNestedAddonId, Gt as expandCapMethods, Ht as createEvent, It as ReadinessRegistry, J as isArrayOutputSchema, Lt as ReadinessTimeoutError, Mt as DEVICE_STATUS_METHOD, Ot as errMsg$1, Qt as resolveCapMount, Ut as emitDownForOwnedCaps, Vt as asString$1, X as isObjectInput, Xt as parseJsonUnknown$1, Y as isCollectionArrayMethod, Yt as parseJsonObject, Zt as readinessKey, _t as scopesAllowDeviceCap, at as looseSchema, ct as objectInputDeclaresAddonId, dt as procedureAuthKey, et as kebabToCamel, f as LOG_LEVEL_RANK, gt as scopesAllowAddon, it as logLevelAtMost, jt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, m as RUNTIME_DEFAULTS, mt as resolveMethodAuth, p as METHOD_ACCESS_MAP, t as ALL_CAPABILITY_DEFINITIONS, tn as EventCategory$1, tt as lifecycleJobSchema, zt as asJsonObject$1 } from "./dist-CbRciAbu.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -25,7 +25,7 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-BhKdxJgf.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-CQhPGSJm.mjs";
-import { $ as buildUdsNativeCapProxy, A as createParentUnownedCallHandler, At as RSS_BUDGET_REANNOUNCE_MIN_MS, B as AGENT_CAP_FWD_SERVICE, Bt as shouldReclaim, C as brokerTransportLink, Ct as createAddonDataPlaneFacility, D as HUB_CAP_FWD_ACTION, Dt as HEAP_WATCH_WARN_RATIO, E as localProviderLink, Et as HEAP_WATCH_INTERVAL_MS, F as createUdsLoggerWithControl, Ft as createV8Reclaimer, G as createLocalTransport, H as CapRouteError, Ht as startRunnerHeapWatch, I as LocalChildClient, It as describeRss, J as SocketChannel, K as UdsLocalTransportClient, L as LocalChildRegistry, Lt as hubMainRssBudget, M as createUdsEventBus, Mt as RUNNER_HEAP_WATCH_INTERVAL_MS, N as udsChildLogToWorkerEntry, Nt as RUNNER_RSS_BUDGET_ENV, O as HUB_CAP_FWD_SERVICE, Ot as HUB_MAIN_RSS_BUDGET_MB, P as createUdsLogger, Pt as buildHeapSample, Q as buildNativeCapProxy, R as UDS_NO_ROUTE_PREFIX, Rt as nextRssBudgetState, S as brokerCallForCap, St as runNpm, T as ipcParentLink, Tt as HEAP_RECLAIM_TRIGGER_MB, U as classifyCapRoute, Ut as strandedMb, V as CapRouteResolver, Vt as startHeapWatch, W as callWithServiceDiscovery, X as FrameDecoder, Y as localEndpointPath, Z as encodeFrame, _ as createKernelHwAccel, _t as CapabilityUnavailableError, a as getWorkerDeviceRegistry, at as createAddonService, b as __resetCapUsageRegistryForTests, bt as resolveAddonClass, c as setHubConnected, ct as capActionName, d as getBrokerEventBus, dt as capServiceName, et as createBrokerDeviceManagerApi, f as getMoleculerEventStats, ft as parseCapAction, g as AddonDepsManager, gt as CapabilityHandle, h as subscribePassthrough, ht as DeviceRegistry, i as createUdsAddonContext, j as createUdsEventBridge, jt as RSS_BUDGET_RELEASE_RATIO, k as createHubCapForwardService, kt as HUB_RSS_BUDGET_ENV, l as EVENT_TOPIC_PREFIX, lt as capActionSuffix, m as setNodeEventInterest, mt as serializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as validateProviderRegistrations, p as registerEventBusService, pt as deserializeTypedArrays, q as UdsLocalTransportServer, r as createAddonContext, rt as mountNativeCapService, s as getOrInitReadinessRegistryForClient, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestPythonDeps, u as clusterEventTopic, ut as capBareAction, v as resolveHwAccel, vt as copyBundledNativeModules, w as buildLinkChain, wt as HEAP_RECLAIM_MIN_INTERVAL_MS, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as installManifestNativeDeps, z as AGENT_CAP_FWD_ACTION, zt as parseRssBudgetMb } from "./manifest-python-deps-HFh_iE0E.mjs";
+import { $ as buildUdsNativeCapProxy, A as createParentUnownedCallHandler, At as HUB_RSS_BUDGET_ENV, B as AGENT_CAP_FWD_SERVICE, Bt as nextRssBudgetState, C as brokerTransportLink, Ct as createAddonDataPlaneFacility, D as HUB_CAP_FWD_ACTION, Dt as HEAP_WATCH_WARN_RATIO, E as localProviderLink, Et as HEAP_WATCH_INTERVAL_MS, F as createUdsLoggerWithControl, Ft as buildHeapSample, G as createLocalTransport, Gt as strandedMb, H as CapRouteError, Ht as shouldReclaim, I as LocalChildClient, It as createDeferredHeapWatchSink, J as SocketChannel, K as UdsLocalTransportClient, L as LocalChildRegistry, Lt as createV8Reclaimer, M as createUdsEventBus, Mt as RSS_BUDGET_RELEASE_RATIO, N as udsChildLogToWorkerEntry, Nt as RUNNER_HEAP_WATCH_INTERVAL_MS, O as HUB_CAP_FWD_SERVICE, Ot as HUB_MAIN_HEAP_WATCH_LABEL, P as createUdsLogger, Pt as RUNNER_RSS_BUDGET_ENV, Q as buildNativeCapProxy, R as UDS_NO_ROUTE_PREFIX, Rt as describeRss, S as brokerCallForCap, St as runNpm, T as ipcParentLink, Tt as HEAP_RECLAIM_TRIGGER_MB, U as classifyCapRoute, Ut as startHeapWatch, V as CapRouteResolver, Vt as parseRssBudgetMb, W as callWithServiceDiscovery, Wt as startRunnerHeapWatch, X as FrameDecoder, Y as localEndpointPath, Z as encodeFrame, _ as createKernelHwAccel, _t as CapabilityUnavailableError, a as getWorkerDeviceRegistry, at as createAddonService, b as __resetCapUsageRegistryForTests, bt as resolveAddonClass, c as setHubConnected, ct as capActionName, d as getBrokerEventBus, dt as capServiceName, et as createBrokerDeviceManagerApi, f as getMoleculerEventStats, ft as parseCapAction, g as AddonDepsManager, gt as CapabilityHandle, h as subscribePassthrough, ht as DeviceRegistry, i as createUdsAddonContext, j as createUdsEventBridge, jt as RSS_BUDGET_REANNOUNCE_MIN_MS, k as createHubCapForwardService, kt as HUB_MAIN_RSS_BUDGET_MB, l as EVENT_TOPIC_PREFIX, lt as capActionSuffix, m as setNodeEventInterest, mt as serializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as validateProviderRegistrations, p as registerEventBusService, pt as deserializeTypedArrays, q as UdsLocalTransportServer, r as createAddonContext, rt as mountNativeCapService, s as getOrInitReadinessRegistryForClient, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestPythonDeps, u as clusterEventTopic, ut as capBareAction, v as resolveHwAccel, vt as copyBundledNativeModules, w as buildLinkChain, wt as HEAP_RECLAIM_MIN_INTERVAL_MS, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as installManifestNativeDeps, z as AGENT_CAP_FWD_ACTION, zt as hubMainRssBudget } from "./manifest-python-deps-DuQ3Uqoq.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { z } from "zod";
@@ -95283,4 +95283,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_LEAF_VALIDITY_DAYS, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createDoorSettingsView, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readLanHttpState, readPendingRestart, readTlsAccessStatus, readTlsMode, readinessKey, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_LEAF_VALIDITY_DAYS, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readLanHttpState, readPendingRestart, readTlsAccessStatus, readTlsMode, readinessKey, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/heap-watch.d.ts

@@ -1,3 +1,27 @@
+/**
+ * What hub-main calls itself in a `[mem]` line.
+ *
+ * ## Why not `hub/main`
+ *
+ * A runner's label is its nodeId, and a nodeId is built in exactly one place as
+ * `` `${parentNodeId}/${runnerId}` `` (`kernel/moleculer/addon-runner.ts:222`) —
+ * so every runner label contains a `/` and every hub-local one is `hub/<runner>`.
+ * A label with NO slash therefore cannot be produced by that rule, which makes
+ * `hub-main` unambiguous by construction rather than by convention: no future
+ * addon, group or agent can ever claim it.
+ *
+ * It also sorts where it belongs. `-` (0x2D) precedes `/` (0x2F), so a sorted
+ * `[mem]` census puts `hub-main` immediately before `hub/decoder`,
+ * `hub/recorder`, `hub/stream-broker` — the composition root first, then the
+ * runners it forked. `hub/main` would sort into the middle of its own children
+ * and would be one addon id away from a collision.
+ *
+ * And it is the name the rest of this repository already uses — the docblocks,
+ * {@link HUB_MAIN_RSS_BUDGET_MB}, {@link HUB_RSS_BUDGET_ENV}, every ADR. A log
+ * label that disagreed with the prose would be a second vocabulary for one
+ * process, which is the exact failure this telemetry exists to remove.
+ */
+export declare const HUB_MAIN_HEAP_WATCH_LABEL = "hub-main";
 /** Heartbeat period. Slow enough to be free, fast enough that the sample before
  *  a fatal is recent. */
 export declare const HEAP_WATCH_INTERVAL_MS = 60000;
@@ -201,6 +225,53 @@ export interface HeapWatchSink {
     readonly info: (line: string) => void;
     readonly warn: (line: string) => void;
 }
+/**
+ * A sink that starts on stdout and is repointed at the real logger the moment
+ * one exists.
+ *
+ * ## The gap this closes
+ *
+ * hub-main has had this heartbeat since 2026-08-02, started from
+ * `server/backend/src/main.ts` as the very first statement of `bootstrap()`.
+ * It was never wired to the LOG MANAGER, only to {@link consoleSink} — i.e. to
+ * `console.log`, which is not a destination. Every forked runner passes a sink
+ * backed by its `IScopedLogger` (`kernel/moleculer/addon-runner.ts:729`), so a
+ * runner's `[mem]` line fans out to the buffer, the console destination, the
+ * rotated file AND the Loki destination; hub-main's went to a file descriptor
+ * and nowhere else. Result: 42 hours of Loki with a `[mem]` line for every
+ * runner in the cluster and not one for the largest process in it, whose growth
+ * to ~4.8 GB was consequently never trended, only inferred.
+ *
+ * ## Why late binding rather than moving the call
+ *
+ * The heartbeat cannot simply be started later. Its whole point is that a
+ * process which dies early still leaves samples — the fatal that motivated it
+ * landed nine seconds after a viewer connected — and `LoggingService` does not
+ * exist until the Fastify app has been booted, hundreds of lines into
+ * `bootstrap()`. So the sink is handed over instead of the start being delayed:
+ * boot lines keep going to stdout exactly as they do today, and every line from
+ * the handover on enters the log manager.
+ *
+ * Nothing before the handover is lost from Loki by accident, only by design:
+ * `LogManager.addDestination` replays its ring buffer into a destination that
+ * registers late, so the heartbeat lines emitted between the handover and the
+ * Loki addon's own registration still ship.
+ */
+export interface DeferredHeapWatchSink {
+    /** Hand this to {@link startHeapWatch}. */
+    readonly sink: HeapWatchSink;
+    /** Point every SUBSEQUENT line at `target`. Last call wins. */
+    readonly attach: (target: HeapWatchSink) => void;
+}
+/**
+ * Build a {@link DeferredHeapWatchSink}.
+ *
+ * The handover announces itself, once, through the NEW target: that line is the
+ * only in-band evidence that hub-main's telemetry actually reached the log
+ * manager on a given boot. Its absence from Loki means the wiring is broken —
+ * which is precisely the state this module was in, undetected, for 42 hours.
+ */
+export declare function createDeferredHeapWatchSink(label?: string, fallback?: HeapWatchSink): DeferredHeapWatchSink;
 /**
  * RSS the process is holding but not using.
  *