@camstack/system 1.2.157 → 1.2.160

package/dist/{manifest-python-deps-CD14Pv0-.mjs → manifest-system-deps-DnoPpLGp.mjs}

@@ -1,4 +1,4 @@
-import "./dist-LvKus-mT.mjs";
+import "./dist-DKs---Vx.mjs";
 import * as crypto$1 from "node:crypto";
 import { randomBytes, randomUUID } from "node:crypto";
 import { ensureBinary, ensureFfmpeg, ensurePython, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
@@ -1603,7 +1603,7 @@ function createAddonDataPlaneFacility(args) {
 * Failures THROW with an actionable message — a caller must never proceed as
 * if dependencies were installed when they were not.
 */
-var execFileAsync$1 = promisify(execFile);
+var execFileAsync$2 = promisify(execFile);
 var DEFAULT_REGISTRY = "https://registry.npmjs.org";
 /** Where the bootstrap lands inside `cacheDir` (npm tgz carries a `package/` prefix). */
 function bootstrappedCliPath(cacheDir) {
@@ -1611,7 +1611,7 @@ function bootstrappedCliPath(cacheDir) {
 }
 async function defaultProbeSystemNpm() {
 	try {
-		await execFileAsync$1("npm", ["--version"], { timeout: 15e3 });
+		await execFileAsync$2("npm", ["--version"], { timeout: 15e3 });
 		return true;
 	} catch {
 		return false;
@@ -1629,7 +1629,7 @@ async function defaultDownloadTarball(url, destTgz) {
 	await fs.promises.writeFile(destTgz, bytes);
 }
 async function defaultExtractTarball(tgzPath, destDir) {
-	await execFileAsync$1("tar", [
+	await execFileAsync$2("tar", [
 		"-xzf",
 		tgzPath,
 		"-C",
@@ -1668,7 +1668,7 @@ async function runNpm(args, options) {
 		registry: options.registry,
 		logger: options.logger
 	});
-	return execFileAsync$1(invocation.command, [...invocation.argsPrefix, ...args], {
+	return execFileAsync$2(invocation.command, [...invocation.argsPrefix, ...args], {
 		...options.cwd !== void 0 ? { cwd: options.cwd } : {},
 		timeout: options.timeout ?? 3e5
 	});
@@ -1748,7 +1748,7 @@ function resolveAddonClass(mod) {
 }
 //#endregion
 //#region src/kernel/deps/manifest-native-deps.ts
-var execFileAsync = promisify(execFile);
+var execFileAsync$1 = promisify(execFile);
 /**
 * Fallback bootstrap-cache location when the caller doesn't thread one
 * through (the forked addon-runner's spawn-time install). tmpdir survives the
@@ -2057,7 +2057,7 @@ async function rebuildNativeDeps(addonDir, packageNames, logger, npmCacheDir, re
 				return;
 			}
 			logger.warn("@electron/rebuild not available — falling back to npx", { meta: { addonDir } });
-			await execFileAsync("npx", [
+			await execFileAsync$1("npx", [
 				"--yes",
 				"electron-rebuild",
 				"-m",
@@ -5546,6 +5546,246 @@ function createLocalTransport() {
 	};
 }
 //#endregion
+//#region src/kernel/moleculer/cap-usage-registry.ts
+/**
+* In-memory observation of tRPC cap calls between addons — the store behind
+* `nodes.getCapUsageGraph`.
+*
+* Storage: `Map<callerAddonId, Map<providerAddonId, Map<capName, RollingWindow>>>`.
+* `RollingWindow` is a fixed-size ring of 1-second buckets — default 300
+* buckets = 5 minutes retention. Queries narrower than the retention window
+* filter buckets at read time.
+*
+* ── The ring ages, and that is not free decoration ─────────────────────────
+* Buckets are indexed `second % retention`, so a bucket written at second S is
+* hit again at S + retention·k forever. Until 2026-08-30 nothing ever zeroed
+* them: the `lastCallAtMs` guard hid it while a triple was fully idle, but ONE
+* fresh call re-armed the entire stale ring. A triple that made 1000 calls and
+* then one call five minutes later reported **1001 calls/min instead of 1**.
+* An over-counted edge is worse than the empty graph this instrument shipped
+* with — silence invites doubt, a confident wrong number sends the next
+* investigation at the wrong addon.
+*
+* The fix is clear-forward: on each record, zero the buckets the ring has
+* ADVANCED over since the previous write, and never read past the last written
+* second. Amortised O(1) — a busy triple clears 0–1 buckets per call, and an
+* idle one clears at most `retention` once, when it wakes.
+*
+* ── Cardinality is bounded, because this map lives on hub-main ─────────────
+* The previous docblock claimed "~22 MB worst case … under 200 KB at ~10 active
+* triples". Both numbers were written for a smaller machine and the second was
+* an assumption, not a bound: the key space is caller × provider × cap, and on
+* the live hub that is 64 addons × 64 runners × ~150 caps. Nothing capped it.
+*
+* Today a ring is one `Uint32Array(retention)` — 1.2 KB of ArrayBuffer at the
+* default — plus the three Map entries that reach it. MEASURED (`heapUsed` +
+* `arrayBuffers`, node 24, `--expose-gc`): **1.7 KB per triple**, so ≈1.0 MB at
+* the realistic hub figure (64 callers × a handful of caps each, ≈600 triples)
+* and **6.3 MB at the {@link DEFAULT_MAX_TRIPLES} ceiling**. `recordCall` costs
+* ≈46 ns (1e6 calls in 46 ms) — at the 39 717 calls/min that started this
+* investigation, ≈30 µs of hub-main per second.
+*
+* Reclamation is what keeps it at the low end: a triple whose ring has entirely
+* aged out is dead data and is dropped on the next admission sweep. The hard
+* cap only exists so that a pathological key space (a caller id derived from
+* something unbounded) cannot take hub-main's heap with it — and when it bites,
+* {@link CapUsageRegistry.getStats} says how often, because an instrument that
+* truncates silently is the defect this whole file exists to fix (D237).
+*/
+/** Ring length in seconds when the caller does not pick one. */
+var DEFAULT_RETENTION_SECONDS = 300;
+/**
+* Ceiling on live `(caller, provider, cap)` triples. ≈1.5 KB each → ≈6 MB.
+* Roughly 6× the realistic hub figure, so it is a backstop against an
+* unbounded key space, not a working limit.
+*/
+var DEFAULT_MAX_TRIPLES = 4e3;
+/**
+* Provider placeholder for a call the PARENT routed rather than short-
+* circuiting to a sibling runner: hub-in-process (`settings-store`,
+* `device-manager`, the `$core-caps` bridge), or a remote node. At the layer
+* that records — the parent's `cap-call-out` handler — the sibling id IS the
+* provider and everything else has not been resolved yet.
+*
+* It is a NAMED unknown, not a dropped observation, for the reason D237 was
+* written: the caller is always known, and "who is hammering `settings-store`"
+* is the question this graph exists to answer. Sibling to
+* `UNRESOLVED_PROVIDER_ADDON_ID` in `trpc-links.ts`, which names the same kind
+* of unknown one layer up.
+*/
+var PARENT_ROUTED_PROVIDER_ADDON_ID = "(unresolved: parent-routed)";
+var CapUsageRegistry = class {
+	retentionSeconds;
+	maxTriples;
+	map = /* @__PURE__ */ new Map();
+	triples = 0;
+	droppedTriples = 0;
+	constructor(opts) {
+		this.retentionSeconds = Math.max(1, opts?.retentionSeconds ?? DEFAULT_RETENTION_SECONDS);
+		this.maxTriples = Math.max(1, opts?.maxTriples ?? DEFAULT_MAX_TRIPLES);
+	}
+	/**
+	* Record one observed cap call.
+	*
+	* On the hot path: this runs once per cross-process cap call on hub-main's
+	* event loop, which is the cluster's only queue (D181). Three Map lookups, an
+	* integer increment, and — only when the wall clock has moved on — a bounded
+	* clear. No allocation once a triple exists, and it NEVER throws into the
+	* call it observes.
+	*/
+	recordCall(rec) {
+		try {
+			if (rec.callerAddonId === "" || rec.providerAddonId === "" || rec.capName === "") return;
+			if (!Number.isFinite(rec.atMs) || rec.atMs < 0) return;
+			const window = this.windowFor(rec);
+			if (window === null) return;
+			const sec = Math.floor(rec.atMs / 1e3);
+			if (window.lastCallAtMs !== 0) {
+				const lastSec = Math.floor(window.lastCallAtMs / 1e3);
+				const advanced = Math.min(sec - lastSec, this.retentionSeconds);
+				for (let k = 1; k <= advanced; k++) window.buckets[(lastSec + k) % this.retentionSeconds] = 0;
+			}
+			const idx = sec % this.retentionSeconds;
+			window.buckets[idx] = (window.buckets[idx] ?? 0) + 1;
+			if (rec.atMs > window.lastCallAtMs) window.lastCallAtMs = rec.atMs;
+		} catch {}
+	}
+	getGraph(opts) {
+		const windowSeconds = Math.max(1, Math.min(opts.windowSeconds, this.retentionSeconds));
+		const minMs = opts.nowMs - windowSeconds * 1e3;
+		const nowSec = Math.floor(opts.nowMs / 1e3);
+		const out = [];
+		for (const [caller, byProvider] of this.map) for (const [provider, byCap] of byProvider) for (const [capName, window] of byCap) {
+			if (window.lastCallAtMs < minMs) continue;
+			const count = this.sumWindow(window, nowSec, windowSeconds);
+			if (count === 0) continue;
+			const callsPerMin = count / windowSeconds * 60;
+			out.push({
+				callerAddonId: caller,
+				providerAddonId: provider,
+				capName,
+				callsPerMin,
+				lastCallAtMs: window.lastCallAtMs
+			});
+		}
+		return out;
+	}
+	/** See {@link CapUsageStats}. Cheap — three counters, no scan. */
+	getStats() {
+		return {
+			triples: this.triples,
+			maxTriples: this.maxTriples,
+			droppedTriples: this.droppedTriples
+		};
+	}
+	/** Test / diagnostic helper — drops all recorded calls. */
+	clear() {
+		this.map.clear();
+		this.triples = 0;
+		this.droppedTriples = 0;
+	}
+	/**
+	* Sum the buckets covering `(nowSec - windowSeconds, nowSec]`.
+	*
+	* The scan starts at `lastSec`, never at `nowSec`. `recordCall` clears the
+	* buckets the ring has advanced OVER, which by definition stops at the last
+	* write: the buckets for the seconds since then still hold whatever the
+	* previous pass left in them, and reading `nowSec` down would count it. A
+	* triple that went quiet for a couple of minutes and then made one call would
+	* report the burst it made five minutes earlier.
+	*
+	* No lower bound is needed beyond the window itself: every bucket at or below
+	* `lastSec - retention` was cleared by the advance that reached `lastSec`, so
+	* it reads zero anyway. The loop is bounded by `windowSeconds ≤ retention`.
+	*/
+	sumWindow(window, nowSec, windowSeconds) {
+		const lastSec = Math.floor(window.lastCallAtMs / 1e3);
+		const from = Math.min(nowSec, lastSec);
+		const floorSec = nowSec - windowSeconds;
+		let count = 0;
+		for (let s = from; s > floorSec; s--) count += window.buckets[s % this.retentionSeconds] ?? 0;
+		return count;
+	}
+	/**
+	* The ring for this triple, creating it if the ceiling allows. `null` means
+	* the observation is dropped — counted, never silent (see
+	* {@link CapUsageStats.droppedTriples}).
+	*/
+	windowFor(rec) {
+		let byProvider = this.map.get(rec.callerAddonId);
+		if (!byProvider) {
+			byProvider = /* @__PURE__ */ new Map();
+			this.map.set(rec.callerAddonId, byProvider);
+		}
+		let byCap = byProvider.get(rec.providerAddonId);
+		if (!byCap) {
+			byCap = /* @__PURE__ */ new Map();
+			byProvider.set(rec.providerAddonId, byCap);
+		}
+		const existing = byCap.get(rec.capName);
+		if (existing) return existing;
+		if (this.triples >= this.maxTriples) {
+			this.reclaimExpired(rec.atMs);
+			if (this.triples >= this.maxTriples) {
+				this.droppedTriples++;
+				return null;
+			}
+			byProvider = this.map.get(rec.callerAddonId);
+			if (!byProvider) {
+				byProvider = /* @__PURE__ */ new Map();
+				this.map.set(rec.callerAddonId, byProvider);
+			}
+			byCap = byProvider.get(rec.providerAddonId);
+			if (!byCap) {
+				byCap = /* @__PURE__ */ new Map();
+				byProvider.set(rec.providerAddonId, byCap);
+			}
+		}
+		const created = {
+			buckets: new Uint32Array(this.retentionSeconds),
+			lastCallAtMs: 0
+		};
+		byCap.set(rec.capName, created);
+		this.triples++;
+		return created;
+	}
+	/**
+	* Drop every triple whose whole ring has aged out — its last call is older
+	* than the retention window, so it can contribute to no query. O(triples),
+	* and only reachable when the ceiling is full, so it is amortised away by the
+	* admissions it enables.
+	*/
+	reclaimExpired(nowMs) {
+		const cutoff = nowMs - this.retentionSeconds * 1e3;
+		for (const [caller, byProvider] of this.map) {
+			for (const [provider, byCap] of byProvider) {
+				for (const [capName, window] of byCap) {
+					if (window.lastCallAtMs >= cutoff) continue;
+					byCap.delete(capName);
+					this.triples--;
+				}
+				if (byCap.size === 0) byProvider.delete(provider);
+			}
+			if (byProvider.size === 0) this.map.delete(caller);
+		}
+	}
+};
+var singleton = null;
+/**
+* The registry for THIS process. Deliberately per-process: the reader
+* (`nodes.getCapUsageGraph` → `cap-providers.ts`) runs on hub-main, so only
+* writes made on hub-main are ever visible. See the blind-spot list on
+* `LocalChildRegistryOptions.capUsageObserver` for what that excludes.
+*/
+function getCapUsageRegistry() {
+	if (!singleton) singleton = new CapUsageRegistry();
+	return singleton;
+}
+/** Test helper — clears the singleton (kept module-private elsewhere). */
+function __resetCapUsageRegistryForTests() {
+	singleton = null;
+}
+//#endregion
 //#region src/kernel/moleculer/event-bus-core.ts
 /**
 * @param retainRecent - `true` ONLY for the hub main broker bus (it serves
@@ -6237,6 +6477,8 @@ var LocalChildRegistry = class {
 	isAddonPinnedCall;
 	/** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
 	capTimeoutMs;
+	/** See {@link LocalChildRegistryOptions.capUsageObserver}. */
+	capUsageObserver;
 	/** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
 	egressRoutedCaps = /* @__PURE__ */ new Set();
 	/** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
@@ -6268,6 +6510,7 @@ var LocalChildRegistry = class {
 			this.isAggregatedCollectionMethod = opts.isAggregatedCollectionMethod;
 			this.isAddonPinnedCall = opts.isAddonPinnedCall;
 			this.capTimeoutMs = opts.capTimeoutMs;
+			this.capUsageObserver = opts.capUsageObserver;
 		} else {
 			this.server = serverOrOptions;
 			this.onUnownedCall = onUnownedCallArg;
@@ -6434,6 +6677,29 @@ var LocalChildRegistry = class {
 		}
 		return candidates[0];
 	}
+	/**
+	* Publish one cap-usage observation, if a sink is wired.
+	*
+	* Cost discipline — this is on the hot path (D181: hub-main's event loop is
+	* the cluster's only queue): no sink means one undefined check; with a sink
+	* it is one object literal and one `Date.now()`, and the sink itself is O(1).
+	* Wrapped so a broken observer can never fail the call it observes — the
+	* registry swallows too, and BOTH matter: this catch also covers a sink that
+	* is not the registry.
+	*/
+	recordCapUsage(callerChildId, providerChildId, capName, methodName) {
+		const sink = this.capUsageObserver;
+		if (sink === void 0 || callerChildId === null) return;
+		try {
+			sink({
+				callerAddonId: callerChildId,
+				providerAddonId: providerChildId ?? "(unresolved: parent-routed)",
+				capName,
+				methodName,
+				atMs: Date.now()
+			});
+		} catch {}
+	}
 	/** First child whose cap manifest contains a descriptor matching `predicate`. */
 	findChildId(predicate) {
 		for (const entry of this.children.values()) if (entry.caps.some(predicate)) return entry.childId;
@@ -6703,7 +6969,9 @@ var LocalChildRegistry = class {
 				const pinTargetsThisNode = pinnedNodeId !== void 0 && this.ownNodeId !== void 0 && pinnedNodeId === this.ownNodeId;
 				const aggregated = pinnedNodeId === void 0 && this.isAggregatedCollectionMethod?.(out.capName, out.method) === true;
 				const addonPinned = pinnedNodeId === void 0 && this.isAddonPinnedCall?.(out.capName, out.method, out.args) === true;
-				if ((!(out.native === true) && !aggregated && !addonPinned && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null) !== null) {
+				const target = !(out.native === true) && !aggregated && !addonPinned && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null;
+				this.recordCapUsage(childId, target, out.capName, out.method);
+				if (target !== null) {
 					if (!this.egressRoutedCaps.has(out.capName)) {
 						this.egressRoutedCaps.add(out.capName);
 						this.logger?.info("routed child egress over UDS", { capName: out.capName });
@@ -7855,80 +8123,6 @@ function buildLinkChain(target, localResolver, hookup) {
 	return links;
 }
 //#endregion
-//#region src/kernel/moleculer/cap-usage-registry.ts
-var CapUsageRegistry = class {
-	retentionSeconds;
-	map = /* @__PURE__ */ new Map();
-	constructor(opts) {
-		this.retentionSeconds = Math.max(1, opts?.retentionSeconds ?? 300);
-	}
-	recordCall(rec) {
-		try {
-			if (rec.callerAddonId === "" || rec.providerAddonId === "" || rec.capName === "") return;
-			if (!Number.isFinite(rec.atMs) || rec.atMs < 0) return;
-			let byProvider = this.map.get(rec.callerAddonId);
-			if (!byProvider) {
-				byProvider = /* @__PURE__ */ new Map();
-				this.map.set(rec.callerAddonId, byProvider);
-			}
-			let byCap = byProvider.get(rec.providerAddonId);
-			if (!byCap) {
-				byCap = /* @__PURE__ */ new Map();
-				byProvider.set(rec.providerAddonId, byCap);
-			}
-			let window = byCap.get(rec.capName);
-			if (!window) {
-				window = {
-					buckets: Array.from({ length: this.retentionSeconds }, () => 0),
-					lastCallAtMs: 0
-				};
-				byCap.set(rec.capName, window);
-			}
-			const bucketIdx = Math.floor(rec.atMs / 1e3) % this.retentionSeconds;
-			window.buckets[bucketIdx] = (window.buckets[bucketIdx] ?? 0) + 1;
-			if (rec.atMs > window.lastCallAtMs) window.lastCallAtMs = rec.atMs;
-		} catch {}
-	}
-	getGraph(opts) {
-		const windowSeconds = Math.max(1, Math.min(opts.windowSeconds, this.retentionSeconds));
-		const minMs = opts.nowMs - windowSeconds * 1e3;
-		const out = [];
-		for (const [caller, byProvider] of this.map) for (const [provider, byCap] of byProvider) for (const [capName, window] of byCap) {
-			if (window.lastCallAtMs < minMs) continue;
-			const nowBucket = Math.floor(opts.nowMs / 1e3);
-			let count = 0;
-			for (let i = 0; i < windowSeconds; i++) {
-				const b = (nowBucket - i + this.retentionSeconds * 1e6) % this.retentionSeconds;
-				count += window.buckets[b] ?? 0;
-			}
-			if (count === 0) continue;
-			const callsPerMin = count / windowSeconds * 60;
-			out.push({
-				callerAddonId: caller,
-				providerAddonId: provider,
-				capName,
-				callsPerMin,
-				lastCallAtMs: window.lastCallAtMs
-			});
-		}
-		return out;
-	}
-	/** Test / diagnostic helper — drops all recorded calls. */
-	clear() {
-		this.map.clear();
-	}
-};
-var singleton = null;
-/** Hub-side singleton. The first caller seeds it; subsequent calls return the same. */
-function getCapUsageRegistry() {
-	if (!singleton) singleton = new CapUsageRegistry();
-	return singleton;
-}
-/** Test helper — clears the singleton (kept module-private elsewhere). */
-function __resetCapUsageRegistryForTests() {
-	singleton = null;
-}
-//#endregion
 //#region src/kernel/hwaccel/hwaccel-resolver.ts
 /**
 * Platform-probe for hardware video decode acceleration.
@@ -9500,4 +9694,193 @@ async function installManifestPythonDeps(declaration, addonDir, deps, logger) {
 	await deps.installPythonRequirements(reqAbs);
 }
 //#endregion
-export { buildNativeCapProxy as $, RUNNER_HEAP_SNAPSHOT_ENV as $t, createParentUnownedCallHandler as A, HUB_MAIN_HEAP_WATCH_LABEL as At, AGENT_CAP_FWD_SERVICE as B, createLoopDelayMeter as Bt, brokerTransportLink as C, runNpm as Ct, HUB_CAP_FWD_ACTION as D, HEAP_RECLAIM_TRIGGER_MB as Dt, localProviderLink as E, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS as Et, createUdsLoggerWithControl as F, RUNNER_HEAP_WATCH_INTERVAL_MS as Ft, readMoleculerFanoutMode as G, parseRssBudgetMb as Gt, CapRouteError as H, describeRss as Ht, LocalChildClient as I, RUNNER_RSS_BUDGET_ENV as It, UdsLocalTransportServer as J, startHeapWatch as Jt, createLocalTransport as K, reclaimIntervalMs as Kt, LocalChildRegistry as L, ZERO_LOOP_DELAY as Lt, createUdsEventBus as M, HUB_RSS_BUDGET_ENV as Mt, udsChildLogToWorkerEntry as N, RSS_BUDGET_REANNOUNCE_MIN_MS as Nt, HUB_CAP_FWD_SERVICE as O, HEAP_WATCH_INTERVAL_MS as Ot, createUdsLogger as P, RSS_BUDGET_RELEASE_RATIO as Pt, encodeFrame as Q, HEAP_SPACE_REPORT_MIN_MB as Qt, UDS_NO_ROUTE_PREFIX as R, buildHeapSample as Rt, brokerCallForCap as S, formatEventPlane as Sn, resolveNpmInvocation as St, ipcParentLink as T, HEAP_RECLAIM_MIN_INTERVAL_MS as Tt, classifyCapRoute as U, hubMainRssBudget as Ut, CapRouteResolver as V, createV8Reclaimer as Vt, callWithServiceDiscovery as W, nextRssBudgetState as Wt, localEndpointPath as X, strandedMb as Xt, SocketChannel as Y, startRunnerHeapWatch as Yt, FrameDecoder as Z, DECISIVE_HEAP_SPACES as Zt, createKernelHwAccel as _, socketDirectionMessages as _n, CapabilityHandle as _t, getWorkerDeviceRegistry as a, selectReportedSpaces as an, setWorkerNativeCapsChangeListener as at, __resetCapUsageRegistryForTests as b, createEventPlaneReader as bn, installManifestNativeDeps as bt, setHubConnected as c, createSocketPlaneMeter as cn, NATIVE_PROVIDER_SERVICE_INFIX as ct, getBrokerEventBus as d, formatSocketPlane as dn, capBareAction as dt, emitHeapDiagnosticReport as en, buildUdsNativeCapProxy as et, getMoleculerEventStats as f, EMPTY_SOCKET_DIRECTION as fn, capServiceName as ft, AddonDepsManager as g, socketDirectionBytes as gn, DeviceRegistry as gt, subscribePassthrough as h, sampleSocketDirection as hn, serializeTypedArrays as ht, createUdsAddonContext as i, readHeapSpaces as in, mountNativeCapService as it, createUdsEventBridge as j, HUB_MAIN_RSS_BUDGET_MB as jt, createHubCapForwardService as k, HEAP_WATCH_WARN_RATIO as kt, EVENT_TOPIC_PREFIX as l, createSocketPlaneReader as ln, capActionName as lt, setNodeEventInterest as m, recordSocketFrame as mn, deserializeTypedArrays as mt, adaptBrokerToCluster as n, heapSnapshotAuthorised as nn, getWorkerNativeCapProvider as nt, getOrInitReadinessRegistry as o, EMPTY_SOCKET_PLANE_BASELINE as on, createAddonService as ot, registerEventBusService as p, createSocketDirectionCounters as pn, parseCapAction as pt, UdsLocalTransportClient as q, shouldReclaim as qt, createAddonContext as r, heapSpaceField as rn, getWorkerNativeCapSnapshot as rt, getOrInitReadinessRegistryForClient as s, SOCKET_PLANE_TOP_N as sn, validateProviderRegistrations as st, installManifestPythonDeps as t, formatHeapSpaces as tn, createBrokerDeviceManagerApi as tt, clusterEventTopic as u, diffSocketPlane as un, capActionSuffix as ut, resolveHwAccel as v, EVENT_PLANE_TOP_N as vn, CapabilityUnavailableError as vt, buildLinkChain as w, createAddonDataPlaneFacility as wt, getCapUsageRegistry as x, diffEventPlane as xn, resolveAddonClass as xt, CapUsageRegistry as y, createEventPlaneMeter as yn, copyBundledNativeModules as yt, AGENT_CAP_FWD_ACTION as z, createDeferredHeapWatchSink as zt };
+//#region src/kernel/deps/manifest-system-deps.ts
+/**
+* Auto-install the host binaries declared in an addon's manifest
+* (`camstack.addons[].systemDependencies`) before `onInitialize()` runs.
+*
+* ── Why this is framework and not addon-local ──────────────────────────────
+* The Python precedent (`camstack.addons[].python.requirements` →
+* `installManifestPythonDeps`, called from the same place in
+* `addon-runner.ts`) already answers "this addon needs something installed,
+* satisfy it before its caps register". A binary is the same question with a
+* different package manager, so it gets the same mechanism rather than a
+* second one per addon — CLAUDE.md forbids a parallel answer where one exists,
+* and the next addon that needs `rclone` or `mediainfo` inherits this for
+* free instead of copying a startup routine.
+*
+* ── The four things this has to get right ──────────────────────────────────
+*  1. **Cheap on the common path.** The binary is probed first; the package
+*     manager is only invoked when it is genuinely absent. Runners respawn
+*     routinely (deploys, updates, crash recovery) and a network round-trip on
+*     every boot is a cost the Python mechanism does not impose either.
+*  2. **Runs every boot, not once.** The install lands INSIDE the container
+*     and is lost on every image update. That is expected. "Already
+*     installed" is a success, not an error.
+*  3. **Honest, not fatal.** A failure warns and returns. The addon still
+*     loads; the capability that wraps the binary is responsible for refusing
+*     loudly on its own surface. Aborting the runner here would take the
+*     addon's SIBLINGS down with it (they share `execution.group`).
+*  4. **Platform reality is stated, not assumed.** An unsupported host logs
+*     which manager it looked for and continues. Silence would read as
+*     "installed".
+*
+* Every branch that declines to install SAYS SO. A dependency step that
+* produced no line at all is indistinguishable from one that never ran, and
+* the failure it precedes ("smbclient: ENOENT") arrives minutes later in a
+* different addon's logs.
+*/
+var execFileAsync = promisify(execFile);
+/** How long a single package-manager invocation may take. */
+var INSTALL_TIMEOUT_MS = 300 * 1e3;
+/** How long the `command -v <binary>` presence probe may take. */
+var PROBE_TIMEOUT_MS = 1e4;
+/**
+* Satisfy every `systemDependencies` entry the declaration carries.
+* Resolves regardless of outcome — see the docblock.
+*/
+async function installManifestSystemDeps(declaration, logger, options = {}) {
+	const deps = declaration.systemDependencies;
+	if (!deps || deps.length === 0) return;
+	const hasBinary = options.hasBinary ?? defaultHasBinary;
+	const detectManager = options.detectManager ?? defaultDetectManager;
+	const run = options.run ?? defaultRun;
+	const platform = options.platform ?? process.platform;
+	for (const dep of deps) try {
+		await satisfyOne(dep, declaration.id, {
+			hasBinary,
+			detectManager,
+			run,
+			platform
+		}, logger);
+	} catch (err) {
+		logger.warn("system dependency step failed", { meta: {
+			addonId: declaration.id,
+			binary: dep.binary,
+			error: err instanceof Error ? err.message : String(err)
+		} });
+	}
+}
+async function satisfyOne(dep, addonId, rt, logger) {
+	if (await rt.hasBinary(dep.binary)) {
+		logger.debug("system dependency already present", { meta: {
+			addonId,
+			binary: dep.binary
+		} });
+		return;
+	}
+	const manager = await rt.detectManager();
+	if (manager === null) {
+		logger.warn("system dependency missing and no supported package manager on this host", { meta: {
+			addonId,
+			binary: dep.binary,
+			platform: rt.platform,
+			...dep.reason !== void 0 ? { reason: dep.reason } : {}
+		} });
+		return;
+	}
+	const packageName = dep.packages[manager];
+	if (packageName === void 0 || packageName.length === 0) {
+		logger.warn("system dependency missing and the addon declares no package for this manager", { meta: {
+			addonId,
+			binary: dep.binary,
+			manager,
+			...dep.reason !== void 0 ? { reason: dep.reason } : {}
+		} });
+		return;
+	}
+	const plan = planFor(manager, packageName);
+	logger.info("installing system dependency", { meta: {
+		addonId,
+		binary: dep.binary,
+		manager,
+		package: packageName
+	} });
+	try {
+		for (const [command, args] of plan.steps) await rt.run(command, args);
+	} catch (err) {
+		logger.warn("system dependency install failed — the addon loads, its capability must refuse", { meta: {
+			addonId,
+			binary: dep.binary,
+			manager,
+			package: packageName,
+			error: err instanceof Error ? err.message : String(err),
+			...dep.reason !== void 0 ? { reason: dep.reason } : {}
+		} });
+		return;
+	}
+	if (!await rt.hasBinary(dep.binary)) {
+		logger.warn("system dependency installed but the binary still does not resolve", { meta: {
+			addonId,
+			binary: dep.binary,
+			manager,
+			package: packageName
+		} });
+		return;
+	}
+	logger.info("system dependency installed", { meta: {
+		addonId,
+		binary: dep.binary,
+		manager,
+		package: packageName
+	} });
+}
+function planFor(manager, packageName) {
+	switch (manager) {
+		case "apt": return {
+			manager,
+			steps: [["apt-get", ["update"]], ["apt-get", [
+				"install",
+				"-y",
+				"--no-install-recommends",
+				packageName
+			]]]
+		};
+		case "apk": return {
+			manager,
+			steps: [["apk", [
+				"add",
+				"--no-cache",
+				packageName
+			]]]
+		};
+		case "dnf": return {
+			manager,
+			steps: [["dnf", [
+				"install",
+				"-y",
+				packageName
+			]]]
+		};
+		case "brew": return {
+			manager,
+			steps: [["brew", ["install", packageName]]]
+		};
+	}
+}
+async function defaultHasBinary(binary) {
+	try {
+		await execFileAsync("command", ["-v", binary], {
+			timeout: PROBE_TIMEOUT_MS,
+			shell: process.platform === "win32" ? false : "/bin/sh"
+		});
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function defaultDetectManager() {
+	const candidates = os.platform() === "darwin" ? ["brew"] : [
+		"apt",
+		"apk",
+		"dnf",
+		"brew"
+	];
+	for (const candidate of candidates) if (await defaultHasBinary(candidate === "apt" ? "apt-get" : candidate)) return candidate;
+	return null;
+}
+async function defaultRun(command, args) {
+	await execFileAsync(command, [...args], { timeout: INSTALL_TIMEOUT_MS });
+}
+//#endregion
+export { FrameDecoder as $, DECISIVE_HEAP_SPACES as $t, createUdsEventBus as A, HEAP_WATCH_INTERVAL_MS as At, CapRouteError as B, buildHeapSample as Bt, ipcParentLink as C, diffEventPlane as Cn, resolveAddonClass as Ct, createHubCapForwardService as D, HEAP_RECLAIM_MIN_INTERVAL_MS as Dt, HUB_CAP_FWD_SERVICE as E, createAddonDataPlaneFacility as Et, LocalChildRegistry as F, RSS_BUDGET_REANNOUNCE_MIN_MS as Ft, PARENT_ROUTED_PROVIDER_ADDON_ID as G, hubMainRssBudget as Gt, callWithServiceDiscovery as H, createLoopDelayMeter as Ht, UDS_NO_ROUTE_PREFIX as I, RSS_BUDGET_RELEASE_RATIO as It, createLocalTransport as J, reclaimIntervalMs as Jt, __resetCapUsageRegistryForTests as K, nextRssBudgetState as Kt, AGENT_CAP_FWD_ACTION as L, RUNNER_HEAP_WATCH_INTERVAL_MS as Lt, createUdsLogger as M, HUB_MAIN_HEAP_WATCH_LABEL as Mt, createUdsLoggerWithControl as N, HUB_MAIN_RSS_BUDGET_MB as Nt, createParentUnownedCallHandler as O, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS as Ot, LocalChildClient as P, HUB_RSS_BUDGET_ENV as Pt, localEndpointPath as Q, strandedMb as Qt, AGENT_CAP_FWD_SERVICE as R, RUNNER_RSS_BUDGET_ENV as Rt, buildLinkChain as S, createEventPlaneReader as Sn, installManifestNativeDeps as St, HUB_CAP_FWD_ACTION as T, runNpm as Tt, readMoleculerFanoutMode as U, createV8Reclaimer as Ut, classifyCapRoute as V, createDeferredHeapWatchSink as Vt, CapUsageRegistry as W, describeRss as Wt, UdsLocalTransportServer as X, startHeapWatch as Xt, UdsLocalTransportClient as Y, shouldReclaim as Yt, SocketChannel as Z, startRunnerHeapWatch as Zt, AddonDepsManager as _, sampleSocketDirection as _n, serializeTypedArrays as _t, createUdsAddonContext as a, heapSpaceField as an, getWorkerNativeCapSnapshot as at, brokerCallForCap as b, EVENT_PLANE_TOP_N as bn, CapabilityUnavailableError as bt, getOrInitReadinessRegistryForClient as c, EMPTY_SOCKET_PLANE_BASELINE as cn, createAddonService as ct, clusterEventTopic as d, createSocketPlaneReader as dn, capActionName as dt, HEAP_SPACE_REPORT_MIN_MB as en, encodeFrame as et, getBrokerEventBus as f, diffSocketPlane as fn, capActionSuffix as ft, subscribePassthrough as g, recordSocketFrame as gn, deserializeTypedArrays as gt, setNodeEventInterest as h, createSocketDirectionCounters as hn, parseCapAction as ht, createAddonContext as i, heapSnapshotAuthorised as in, getWorkerNativeCapProvider as it, udsChildLogToWorkerEntry as j, HEAP_WATCH_WARN_RATIO as jt, createUdsEventBridge as k, HEAP_RECLAIM_TRIGGER_MB as kt, setHubConnected as l, SOCKET_PLANE_TOP_N as ln, validateProviderRegistrations as lt, registerEventBusService as m, EMPTY_SOCKET_DIRECTION as mn, capServiceName as mt, installManifestPythonDeps as n, emitHeapDiagnosticReport as nn, buildUdsNativeCapProxy as nt, getWorkerDeviceRegistry as o, readHeapSpaces as on, mountNativeCapService as ot, getMoleculerEventStats as p, formatSocketPlane as pn, capBareAction as pt, getCapUsageRegistry as q, parseRssBudgetMb as qt, adaptBrokerToCluster as r, formatHeapSpaces as rn, createBrokerDeviceManagerApi as rt, getOrInitReadinessRegistry as s, selectReportedSpaces as sn, setWorkerNativeCapsChangeListener as st, installManifestSystemDeps as t, RUNNER_HEAP_SNAPSHOT_ENV as tn, buildNativeCapProxy as tt, EVENT_TOPIC_PREFIX as u, createSocketPlaneMeter as un, NATIVE_PROVIDER_SERVICE_INFIX as ut, createKernelHwAccel as v, socketDirectionBytes as vn, DeviceRegistry as vt, localProviderLink as w, formatEventPlane as wn, resolveNpmInvocation as wt, brokerTransportLink as x, createEventPlaneMeter as xn, copyBundledNativeModules as xt, resolveHwAccel as y, socketDirectionMessages as yn, CapabilityHandle as yt, CapRouteResolver as z, ZERO_LOOP_DELAY as zt };