@camstack/system 1.2.163 → 1.2.165

package/dist/{dist-DxFjna2a.mjs → dist-BpsHt11f.mjs}

@@ -18151,6 +18151,47 @@ var RebuildStatusSchema = z.object({
 	/** Present when the pass ended by throwing. */
 	error: z.string().nullable()
 });
+/**
+* Acknowledgement that a debug-media reclaim STARTED.
+*
+* The pass is paced at ~2 MB/s over a standing 100 GB — tens of minutes — so
+* it runs detached and this returns immediately. Awaiting it is how the
+* `addons.custom` door hit the 60 s UDS deadline while the walk carried on
+* with no status. Poll {@link pipelineAnalyticsCapability.methods.getMediaReclaimStatus}.
+*/
+var MediaReclaimStartResultSchema = z.object({
+	started: z.boolean(),
+	/** True when a pass was already running; the new request is ignored. */
+	alreadyRunning: z.boolean()
+});
+var MediaReclaimInputSchema = z.object({
+	mode: z.enum(["report", "reclaim"]).default("report"),
+	scopes: z.array(z.enum(["motion-still", "track-filmstrip"])).min(1).optional(),
+	deviceIds: z.array(z.number().int()).min(1).optional(),
+	restart: z.boolean().optional(),
+	pageSize: z.number().int().min(50).max(5e3).optional(),
+	maxRowsPerDevice: z.number().int().min(1).max(5e5).optional(),
+	maxReclaimPerDevice: z.number().int().min(1).max(5e5).optional(),
+	maxBytesPerRun: z.number().int().min(1).optional(),
+	budgetMinutes: z.number().int().min(1).max(720).optional(),
+	throttleBytesPerSec: z.number().int().min(64 * 1024).optional(),
+	graceMinutes: z.number().int().min(1).max(10080).optional()
+});
+var MediaReclaimStatusSchema = z.object({
+	running: z.boolean(),
+	mode: z.enum(["report", "reclaim"]).nullable(),
+	totalExamined: z.number(),
+	totalEligible: z.number(),
+	totalReclaimed: z.number(),
+	totalBytesReclaimed: z.number(),
+	totalRefused: z.number(),
+	/** Device+scope windows finished in this pass. */
+	devicesDone: z.number(),
+	complete: z.boolean().nullable(),
+	startedAtMs: z.number().nullable(),
+	finishedAtMs: z.number().nullable(),
+	error: z.string().nullable()
+});
 var ReplayFrameInputSchema = z.object({
 	timestamp: z.number(),
 	frame: PipelineRunResultBridge
@@ -18574,6 +18615,20 @@ var pipelineAnalyticsCapability = {
 			auth: "admin"
 		}),
 		/**
+		* Reclaim the standing debug-media backlog (motion-visit stills + track
+		* filmstrips). DETACHED: returns `{ started }` immediately. The pass is
+		* tens of minutes; awaiting it is a timeout, not a verdict. Dry-run unless
+		* `mode: 'reclaim'`. Poll `getMediaReclaimStatus`.
+		*/
+		reclaimDebugMedia: method(MediaReclaimInputSchema, MediaReclaimStartResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getMediaReclaimStatus: method(z.object({}), MediaReclaimStatusSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
 		* The CHEAP QUESTION, asked before any media moves: how big is the dataset
 		* the marked (`markForTrain`) tracks would produce?
 		*
@@ -37160,6 +37215,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getMediaReclaimStatus": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getMotionEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -37334,6 +37395,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.reclaimDebugMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.reconcileFromDisk": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -40950,6 +41017,11 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"pipelineAnalytics.reclaimDebugMedia": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
 	"pipelineAnalytics.reconcileFromDisk": [{
 		name: "deviceId",
 		form: "single",

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-B29Skpzo.js");
+const require_dist = require("./dist-BhE8zNfY.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -26,7 +26,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
 const require_tls$1 = require("./tls-BxQlomxd.js");
-const require_manifest_system_deps = require("./manifest-system-deps-DBje540e.js");
+const require_manifest_system_deps = require("./manifest-system-deps-uflHvHDB.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $ as isObjectInput, $t as parseJsonUnknown$1, Bt as ReadinessTimeoutError, Ft as DEVICE_STATUS_METHOD, Gt as createEvent, Ht as asJsonObject$1, J as extractNestedAddonId, Jt as expandCapMethods, Kt as emitDownForOwnedCaps, Nt as DATAPLANE_SECRET_HEADER$1, Pt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Q as isCollectionArrayMethod, Qt as parseJsonObject, T as addonSettingsCapability, Ut as asNumber, Wt as asString$1, Z as isArrayOutputSchema, _t as resolveMethodAuth, bt as scopesAllowDeviceCap, ct as looseSchema, dt as objectInputDeclaresAddonId, en as readinessKey, f as LOG_LEVEL_RANK, h as RUNTIME_DEFAULTS, in as EventCategory$1, it as lifecycleJobSchema, jt as errMsg$1, mt as procedureAuthKey, nn as scopeKey, nt as isVoidInput, p as METHOD_ACCESS_MAP, rt as kebabToCamel, st as logLevelAtMost, t as ALL_CAPABILITY_DEFINITIONS, tn as resolveCapMount, yt as scopesAllowAddon, zt as ReadinessRegistry } from "./dist-DxFjna2a.mjs";
+import { $ as isObjectInput, $t as parseJsonUnknown$1, Bt as ReadinessTimeoutError, Ft as DEVICE_STATUS_METHOD, Gt as createEvent, Ht as asJsonObject$1, J as extractNestedAddonId, Jt as expandCapMethods, Kt as emitDownForOwnedCaps, Nt as DATAPLANE_SECRET_HEADER$1, Pt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Q as isCollectionArrayMethod, Qt as parseJsonObject, T as addonSettingsCapability, Ut as asNumber, Wt as asString$1, Z as isArrayOutputSchema, _t as resolveMethodAuth, bt as scopesAllowDeviceCap, ct as looseSchema, dt as objectInputDeclaresAddonId, en as readinessKey, f as LOG_LEVEL_RANK, h as RUNTIME_DEFAULTS, in as EventCategory$1, it as lifecycleJobSchema, jt as errMsg$1, mt as procedureAuthKey, nn as scopeKey, nt as isVoidInput, p as METHOD_ACCESS_MAP, rt as kebabToCamel, st as logLevelAtMost, t as ALL_CAPABILITY_DEFINITIONS, tn as resolveCapMount, yt as scopesAllowAddon, zt as ReadinessRegistry } from "./dist-BpsHt11f.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -25,7 +25,7 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-BhKdxJgf.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-DOTmtLCW.mjs";
-import { $ as FrameDecoder, $t as DECISIVE_HEAP_SPACES, A as createUdsEventBus, At as HEAP_WATCH_INTERVAL_MS, B as CapRouteError, Bt as buildHeapSample, C as ipcParentLink, Cn as diffEventPlane, Ct as resolveAddonClass, D as createHubCapForwardService, Dt as HEAP_RECLAIM_MIN_INTERVAL_MS, E as HUB_CAP_FWD_SERVICE, Et as createAddonDataPlaneFacility, F as LocalChildRegistry, Ft as RSS_BUDGET_REANNOUNCE_MIN_MS, G as PARENT_ROUTED_PROVIDER_ADDON_ID, Gt as hubMainRssBudget, H as callWithServiceDiscovery, Ht as createLoopDelayMeter, I as UDS_NO_ROUTE_PREFIX, It as RSS_BUDGET_RELEASE_RATIO, J as createLocalTransport, Jt as reclaimIntervalMs, K as __resetCapUsageRegistryForTests, Kt as nextRssBudgetState, L as AGENT_CAP_FWD_ACTION, Lt as RUNNER_HEAP_WATCH_INTERVAL_MS, M as createUdsLogger, Mt as HUB_MAIN_HEAP_WATCH_LABEL, N as createUdsLoggerWithControl, Nt as HUB_MAIN_RSS_BUDGET_MB, O as createParentUnownedCallHandler, Ot as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, P as LocalChildClient, Pt as HUB_RSS_BUDGET_ENV, Q as localEndpointPath, Qt as strandedMb, R as AGENT_CAP_FWD_SERVICE, Rt as RUNNER_RSS_BUDGET_ENV, S as buildLinkChain, Sn as createEventPlaneReader, St as installManifestNativeDeps, T as HUB_CAP_FWD_ACTION, Tt as runNpm, U as readMoleculerFanoutMode, Ut as createV8Reclaimer, V as classifyCapRoute, Vt as createDeferredHeapWatchSink, W as CapUsageRegistry, Wt as describeRss, X as UdsLocalTransportServer, Xt as startHeapWatch, Y as UdsLocalTransportClient, Yt as shouldReclaim, Z as SocketChannel, Zt as startRunnerHeapWatch, _ as AddonDepsManager, _n as sampleSocketDirection, _t as serializeTypedArrays, a as createUdsAddonContext, an as heapSpaceField, b as brokerCallForCap, bn as EVENT_PLANE_TOP_N, bt as CapabilityUnavailableError, c as getOrInitReadinessRegistryForClient, cn as EMPTY_SOCKET_PLANE_BASELINE, ct as createAddonService, d as clusterEventTopic, dn as createSocketPlaneReader, dt as capActionName, en as HEAP_SPACE_REPORT_MIN_MB, et as encodeFrame, f as getBrokerEventBus, fn as diffSocketPlane, ft as capActionSuffix, g as subscribePassthrough, gn as recordSocketFrame, gt as deserializeTypedArrays, h as setNodeEventInterest, hn as createSocketDirectionCounters, ht as parseCapAction, i as createAddonContext, in as heapSnapshotAuthorised, j as udsChildLogToWorkerEntry, jt as HEAP_WATCH_WARN_RATIO, k as createUdsEventBridge, kt as HEAP_RECLAIM_TRIGGER_MB, l as setHubConnected, ln as SOCKET_PLANE_TOP_N, lt as validateProviderRegistrations, m as registerEventBusService, mn as EMPTY_SOCKET_DIRECTION, mt as capServiceName, n as installManifestPythonDeps, nn as emitHeapDiagnosticReport, nt as buildUdsNativeCapProxy, o as getWorkerDeviceRegistry, on as readHeapSpaces, ot as mountNativeCapService, p as getMoleculerEventStats, pn as formatSocketPlane, pt as capBareAction, q as getCapUsageRegistry, qt as parseRssBudgetMb, r as adaptBrokerToCluster, rn as formatHeapSpaces, rt as createBrokerDeviceManagerApi, s as getOrInitReadinessRegistry, sn as selectReportedSpaces, t as installManifestSystemDeps, tn as RUNNER_HEAP_SNAPSHOT_ENV, tt as buildNativeCapProxy, u as EVENT_TOPIC_PREFIX, un as createSocketPlaneMeter, ut as NATIVE_PROVIDER_SERVICE_INFIX, v as createKernelHwAccel, vn as socketDirectionBytes, vt as DeviceRegistry, w as localProviderLink, wn as formatEventPlane, wt as resolveNpmInvocation, x as brokerTransportLink, xn as createEventPlaneMeter, xt as copyBundledNativeModules, y as resolveHwAccel, yn as socketDirectionMessages, yt as CapabilityHandle, z as CapRouteResolver, zt as ZERO_LOOP_DELAY } from "./manifest-system-deps-CG9ESHhv.mjs";
+import { $ as FrameDecoder, $t as DECISIVE_HEAP_SPACES, A as createUdsEventBus, At as HEAP_WATCH_INTERVAL_MS, B as CapRouteError, Bt as buildHeapSample, C as ipcParentLink, Cn as diffEventPlane, Ct as resolveAddonClass, D as createHubCapForwardService, Dt as HEAP_RECLAIM_MIN_INTERVAL_MS, E as HUB_CAP_FWD_SERVICE, Et as createAddonDataPlaneFacility, F as LocalChildRegistry, Ft as RSS_BUDGET_REANNOUNCE_MIN_MS, G as PARENT_ROUTED_PROVIDER_ADDON_ID, Gt as hubMainRssBudget, H as callWithServiceDiscovery, Ht as createLoopDelayMeter, I as UDS_NO_ROUTE_PREFIX, It as RSS_BUDGET_RELEASE_RATIO, J as createLocalTransport, Jt as reclaimIntervalMs, K as __resetCapUsageRegistryForTests, Kt as nextRssBudgetState, L as AGENT_CAP_FWD_ACTION, Lt as RUNNER_HEAP_WATCH_INTERVAL_MS, M as createUdsLogger, Mt as HUB_MAIN_HEAP_WATCH_LABEL, N as createUdsLoggerWithControl, Nt as HUB_MAIN_RSS_BUDGET_MB, O as createParentUnownedCallHandler, Ot as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, P as LocalChildClient, Pt as HUB_RSS_BUDGET_ENV, Q as localEndpointPath, Qt as strandedMb, R as AGENT_CAP_FWD_SERVICE, Rt as RUNNER_RSS_BUDGET_ENV, S as buildLinkChain, Sn as createEventPlaneReader, St as installManifestNativeDeps, T as HUB_CAP_FWD_ACTION, Tt as runNpm, U as readMoleculerFanoutMode, Ut as createV8Reclaimer, V as classifyCapRoute, Vt as createDeferredHeapWatchSink, W as CapUsageRegistry, Wt as describeRss, X as UdsLocalTransportServer, Xt as startHeapWatch, Y as UdsLocalTransportClient, Yt as shouldReclaim, Z as SocketChannel, Zt as startRunnerHeapWatch, _ as AddonDepsManager, _n as sampleSocketDirection, _t as serializeTypedArrays, a as createUdsAddonContext, an as heapSpaceField, b as brokerCallForCap, bn as EVENT_PLANE_TOP_N, bt as CapabilityUnavailableError, c as getOrInitReadinessRegistryForClient, cn as EMPTY_SOCKET_PLANE_BASELINE, ct as createAddonService, d as clusterEventTopic, dn as createSocketPlaneReader, dt as capActionName, en as HEAP_SPACE_REPORT_MIN_MB, et as encodeFrame, f as getBrokerEventBus, fn as diffSocketPlane, ft as capActionSuffix, g as subscribePassthrough, gn as recordSocketFrame, gt as deserializeTypedArrays, h as setNodeEventInterest, hn as createSocketDirectionCounters, ht as parseCapAction, i as createAddonContext, in as heapSnapshotAuthorised, j as udsChildLogToWorkerEntry, jt as HEAP_WATCH_WARN_RATIO, k as createUdsEventBridge, kt as HEAP_RECLAIM_TRIGGER_MB, l as setHubConnected, ln as SOCKET_PLANE_TOP_N, lt as validateProviderRegistrations, m as registerEventBusService, mn as EMPTY_SOCKET_DIRECTION, mt as capServiceName, n as installManifestPythonDeps, nn as emitHeapDiagnosticReport, nt as buildUdsNativeCapProxy, o as getWorkerDeviceRegistry, on as readHeapSpaces, ot as mountNativeCapService, p as getMoleculerEventStats, pn as formatSocketPlane, pt as capBareAction, q as getCapUsageRegistry, qt as parseRssBudgetMb, r as adaptBrokerToCluster, rn as formatHeapSpaces, rt as createBrokerDeviceManagerApi, s as getOrInitReadinessRegistry, sn as selectReportedSpaces, t as installManifestSystemDeps, tn as RUNNER_HEAP_SNAPSHOT_ENV, tt as buildNativeCapProxy, u as EVENT_TOPIC_PREFIX, un as createSocketPlaneMeter, ut as NATIVE_PROVIDER_SERVICE_INFIX, v as createKernelHwAccel, vn as socketDirectionBytes, vt as DeviceRegistry, w as localProviderLink, wn as formatEventPlane, wt as resolveNpmInvocation, x as brokerTransportLink, xn as createEventPlaneMeter, xt as copyBundledNativeModules, y as resolveHwAccel, yn as socketDirectionMessages, yt as CapabilityHandle, z as CapRouteResolver, zt as ZERO_LOOP_DELAY } from "./manifest-system-deps-D2GebQTp.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { z } from "zod";

package/dist/kernel/deps/manifest-system-deps.d.ts

@@ -1,12 +1,15 @@
 import { AddonDeclaration, IScopedLogger } from '@camstack/types';
-/** Host package managers this mechanism knows how to drive. */
-export type SystemPackageManager = 'apt' | 'apk' | 'dnf' | 'brew';
+import { PackageInstallRequest, PackageInstallResult } from './system-package-broker.js';
+import { SystemPackageManager } from './system-package-allowlist.js';
+export type { SystemPackageManager } from './system-package-allowlist.js';
 /** Test seams — production callers omit these. */
 export interface InstallManifestSystemDepsOptions {
     readonly hasBinary?: (binary: string) => Promise<boolean>;
     readonly detectManager?: () => Promise<SystemPackageManager | null>;
     readonly run?: (command: string, args: readonly string[]) => Promise<void>;
     readonly platform?: NodeJS.Platform;
+    readonly helperAvailable?: () => Promise<boolean>;
+    readonly requestInstall?: (req: PackageInstallRequest) => Promise<PackageInstallResult>;
 }
 /**
  * Satisfy every `systemDependencies` entry the declaration carries.

package/dist/kernel/deps/system-package-allowlist.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Packages the privileged helper will install (D326).
+ *
+ * The helper process reads `scripts/docker/pkg-allowlist.json` (baked into
+ * the image). This module is the runner-side copy of the same list, so an
+ * unknown package is refused before a socket write. Keep them identical —
+ * `scripts/check-pkg-allowlist.ts` fails CI when they drift.
+ */
+export type SystemPackageManager = 'apt' | 'apk' | 'dnf' | 'brew';
+export type DistroPackageManager = Exclude<SystemPackageManager, 'brew'>;
+export declare const DISTRO_PACKAGE_ALLOWLIST: Readonly<Record<DistroPackageManager, readonly string[]>>;
+export declare function packageIsAllowlisted(manager: SystemPackageManager, packageName: string): boolean;

package/dist/kernel/deps/system-package-broker.d.ts

@@ -0,0 +1,31 @@
+import { SystemPackageManager } from './system-package-allowlist.js';
+export interface PackageInstallRequest {
+    readonly addonId: string;
+    readonly binary: string;
+    readonly manager: SystemPackageManager;
+    readonly packageName: string;
+}
+export interface PackageInstallResult {
+    readonly ok: boolean;
+    readonly error?: string;
+}
+export type PackageInstallDecision = {
+    readonly kind: 'helper';
+} | {
+    readonly kind: 'local';
+} | {
+    readonly kind: 'refuse';
+    readonly reason: 'not-allowlisted' | 'helper-unavailable';
+};
+/**
+ * Who is allowed to run the package manager for this request.
+ *
+ * Apt/apk/dnf need root. In the CamStack container that is the
+ * `camstack-pkgd` helper, not the runner and not hub-main (both uid
+ * 1001). Brew is owned by the logged-in user, so it stays in-process.
+ */
+export declare function decidePackageInstall(input: {
+    readonly manager: SystemPackageManager;
+    readonly packageName: string;
+    readonly helperAvailable: boolean;
+}): PackageInstallDecision;

package/dist/kernel/deps/system-package-client.d.ts

@@ -0,0 +1,9 @@
+import { PackageInstallRequest, PackageInstallResult } from './system-package-broker.js';
+/** Default path the entrypoint binds before dropping to uid 1001. */
+export declare const DEFAULT_PKGD_SOCKET = "/run/camstack/pkgd.sock";
+export declare function pkgdSocketPath(): string;
+export declare function privilegedHelperAvailable(socketPath?: string): boolean;
+/**
+ * One JSON object per line. The helper answers one request per connection.
+ */
+export declare function requestPrivilegedInstall(req: PackageInstallRequest, socketPath?: string, timeoutMs?: number): Promise<PackageInstallResult>;

package/dist/{manifest-system-deps-CG9ESHhv.mjs → manifest-system-deps-D2GebQTp.mjs}

@@ -1,4 +1,4 @@
-import "./dist-DxFjna2a.mjs";
+import "./dist-BpsHt11f.mjs";
 import * as crypto$1 from "node:crypto";
 import { randomBytes, randomUUID } from "node:crypto";
 import { ensureBinary, ensureFfmpeg, ensurePython, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
@@ -8,6 +8,7 @@ import { isAbsolute, join } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import * as fs from "node:fs";
+import { existsSync } from "node:fs";
 import * as os from "node:os";
 import { tmpdir } from "node:os";
 import { createServer } from "node:http";
@@ -15,7 +16,7 @@ import * as v8 from "node:v8";
 import { monitorEventLoopDelay } from "node:perf_hooks";
 import * as vm from "node:vm";
 import { BOOT_RECOVERY_BACKOFF_MS, DATAPLANE_SECRET_HEADER, DeviceType, DisposerChain, EventCategory, ReadinessRegistry, asJsonObject, asString, createDeviceProxy, createEventBusSliceSource, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods, readNodePin, scopeKey, sleep, withCapInputDefaults } from "@camstack/types/addon";
-import { connect, createServer as createServer$1 } from "node:net";
+import { connect, createConnection, createServer as createServer$1 } from "node:net";
 import { TRPCClientError, createTRPCClient } from "@trpc/client";
 //#region src/kernel/event-plane-report.ts
 /**
@@ -9694,6 +9695,106 @@ async function installManifestPythonDeps(declaration, addonDir, deps, logger) {
 	await deps.installPythonRequirements(reqAbs);
 }
 //#endregion
+//#region src/kernel/deps/system-package-allowlist.ts
+var DISTRO_PACKAGE_ALLOWLIST = {
+	apt: ["smbclient"],
+	apk: ["samba-client"],
+	dnf: ["samba-client"]
+};
+function packageIsAllowlisted(manager, packageName) {
+	if (manager === "brew") return true;
+	if (packageName.length === 0) return false;
+	if (!/^[a-zA-Z0-9][a-zA-Z0-9+._-]*$/.test(packageName)) return false;
+	return DISTRO_PACKAGE_ALLOWLIST[manager].includes(packageName);
+}
+//#endregion
+//#region src/kernel/deps/system-package-broker.ts
+/**
+* Who is allowed to run the package manager for this request.
+*
+* Apt/apk/dnf need root. In the CamStack container that is the
+* `camstack-pkgd` helper, not the runner and not hub-main (both uid
+* 1001). Brew is owned by the logged-in user, so it stays in-process.
+*/
+function decidePackageInstall(input) {
+	if (input.manager === "brew") return { kind: "local" };
+	if (!packageIsAllowlisted(input.manager, input.packageName)) return {
+		kind: "refuse",
+		reason: "not-allowlisted"
+	};
+	if (!input.helperAvailable) return {
+		kind: "refuse",
+		reason: "helper-unavailable"
+	};
+	return { kind: "helper" };
+}
+function pkgdSocketPath() {
+	return process.env["CAMSTACK_PKGD_SOCKET"] ?? "/run/camstack/pkgd.sock";
+}
+function privilegedHelperAvailable(socketPath = pkgdSocketPath()) {
+	return existsSync(socketPath);
+}
+/**
+* One JSON object per line. The helper answers one request per connection.
+*/
+function requestPrivilegedInstall(req, socketPath = pkgdSocketPath(), timeoutMs = 360 * 1e3) {
+	return new Promise((resolve) => {
+		const socket = createConnection({ path: socketPath });
+		const chunks = [];
+		const finish = (result) => {
+			socket.destroy();
+			resolve(result);
+		};
+		const timer = setTimeout(() => {
+			finish({
+				ok: false,
+				error: `privileged helper timed out after ${timeoutMs}ms`
+			});
+		}, timeoutMs);
+		socket.on("connect", () => {
+			socket.write(`${JSON.stringify({
+				v: 1,
+				...req
+			})}\n`);
+		});
+		socket.on("data", (data) => {
+			chunks.push(data);
+			const text = Buffer.concat(chunks).toString("utf8");
+			const nl = text.indexOf("\n");
+			if (nl === -1) return;
+			clearTimeout(timer);
+			try {
+				const parsed = JSON.parse(text.slice(0, nl));
+				finish({
+					ok: parsed.ok === true,
+					...parsed.error !== void 0 ? { error: parsed.error } : {}
+				});
+			} catch (err) {
+				finish({
+					ok: false,
+					error: err instanceof Error ? err.message : String(err)
+				});
+			}
+		});
+		socket.on("error", (err) => {
+			clearTimeout(timer);
+			finish({
+				ok: false,
+				error: err.message
+			});
+		});
+		socket.on("end", () => {
+			if (chunks.length === 0) {
+				clearTimeout(timer);
+				finish({
+					ok: false,
+					error: "privileged helper closed without a reply"
+				});
+			}
+		});
+	});
+}
+//#endregion
 //#region src/kernel/deps/manifest-system-deps.ts
 /**
 * Auto-install the host binaries declared in an addon's manifest
@@ -9724,6 +9825,9 @@ async function installManifestPythonDeps(declaration, addonDir, deps, logger) {
 *  4. **Platform reality is stated, not assumed.** An unsupported host logs
 *     which manager it looked for and continues. Silence would read as
 *     "installed".
+*  5. **Apt is not the runner's.** Distro package managers need root. The
+*     runner and hub-main are uid 1001 (`gosu` in the entrypoint). Apt/apk/dnf
+*     go through `camstack-pkgd` (allowlisted). Brew stays in-process.
 *
 * Every branch that declines to install SAYS SO. A dependency step that
 * produced no line at all is indistinguishable from one that never ran, and
@@ -9746,12 +9850,16 @@ async function installManifestSystemDeps(declaration, logger, options = {}) {
 	const detectManager = options.detectManager ?? defaultDetectManager;
 	const run = options.run ?? defaultRun;
 	const platform = options.platform ?? process.platform;
+	const helperAvailable = options.helperAvailable ?? (async () => privilegedHelperAvailable());
+	const requestInstall = options.requestInstall ?? ((req) => requestPrivilegedInstall(req));
 	for (const dep of deps) try {
 		await satisfyOne(dep, declaration.id, {
 			hasBinary,
 			detectManager,
 			run,
-			platform
+			platform,
+			helperAvailable,
+			requestInstall
 		}, logger);
 	} catch (err) {
 		logger.warn("system dependency step failed", { meta: {
@@ -9789,15 +9897,43 @@ async function satisfyOne(dep, addonId, rt, logger) {
 		} });
 		return;
 	}
-	const plan = planFor(manager, packageName);
+	const decision = decidePackageInstall({
+		manager,
+		packageName,
+		helperAvailable: await rt.helperAvailable()
+	});
+	if (decision.kind === "refuse") {
+		const message = decision.reason === "helper-unavailable" ? "system dependency missing and the privileged helper is not running — apt cannot run as uid 1001" : "system dependency missing and the package is not on the helper allowlist";
+		logger.warn(message, { meta: {
+			addonId,
+			binary: dep.binary,
+			manager,
+			package: packageName,
+			reason: decision.reason,
+			...dep.reason !== void 0 ? { reason: dep.reason } : {}
+		} });
+		return;
+	}
 	logger.info("installing system dependency", { meta: {
 		addonId,
 		binary: dep.binary,
 		manager,
-		package: packageName
+		package: packageName,
+		via: decision.kind
 	} });
 	try {
-		for (const [command, args] of plan.steps) await rt.run(command, args);
+		if (decision.kind === "helper") {
+			const result = await rt.requestInstall({
+				addonId,
+				binary: dep.binary,
+				manager,
+				packageName
+			});
+			if (!result.ok) throw new Error(result.error ?? "privileged helper refused");
+		} else {
+			const plan = planFor(manager, packageName);
+			for (const [command, args] of plan.steps) await rt.run(command, args);
+		}
 	} catch (err) {
 		logger.warn("system dependency install failed — the addon loads, its capability must refuse", { meta: {
 			addonId,

package/dist/{manifest-system-deps-DBje540e.js → manifest-system-deps-uflHvHDB.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-require("./dist-B29Skpzo.js");
+require("./dist-BhE8zNfY.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let _camstack_types_node = require("@camstack/types/node");
@@ -9698,6 +9698,106 @@ async function installManifestPythonDeps(declaration, addonDir, deps, logger) {
 	await deps.installPythonRequirements(reqAbs);
 }
 //#endregion
+//#region src/kernel/deps/system-package-allowlist.ts
+var DISTRO_PACKAGE_ALLOWLIST = {
+	apt: ["smbclient"],
+	apk: ["samba-client"],
+	dnf: ["samba-client"]
+};
+function packageIsAllowlisted(manager, packageName) {
+	if (manager === "brew") return true;
+	if (packageName.length === 0) return false;
+	if (!/^[a-zA-Z0-9][a-zA-Z0-9+._-]*$/.test(packageName)) return false;
+	return DISTRO_PACKAGE_ALLOWLIST[manager].includes(packageName);
+}
+//#endregion
+//#region src/kernel/deps/system-package-broker.ts
+/**
+* Who is allowed to run the package manager for this request.
+*
+* Apt/apk/dnf need root. In the CamStack container that is the
+* `camstack-pkgd` helper, not the runner and not hub-main (both uid
+* 1001). Brew is owned by the logged-in user, so it stays in-process.
+*/
+function decidePackageInstall(input) {
+	if (input.manager === "brew") return { kind: "local" };
+	if (!packageIsAllowlisted(input.manager, input.packageName)) return {
+		kind: "refuse",
+		reason: "not-allowlisted"
+	};
+	if (!input.helperAvailable) return {
+		kind: "refuse",
+		reason: "helper-unavailable"
+	};
+	return { kind: "helper" };
+}
+function pkgdSocketPath() {
+	return process.env["CAMSTACK_PKGD_SOCKET"] ?? "/run/camstack/pkgd.sock";
+}
+function privilegedHelperAvailable(socketPath = pkgdSocketPath()) {
+	return (0, node_fs.existsSync)(socketPath);
+}
+/**
+* One JSON object per line. The helper answers one request per connection.
+*/
+function requestPrivilegedInstall(req, socketPath = pkgdSocketPath(), timeoutMs = 360 * 1e3) {
+	return new Promise((resolve) => {
+		const socket = (0, node_net.createConnection)({ path: socketPath });
+		const chunks = [];
+		const finish = (result) => {
+			socket.destroy();
+			resolve(result);
+		};
+		const timer = setTimeout(() => {
+			finish({
+				ok: false,
+				error: `privileged helper timed out after ${timeoutMs}ms`
+			});
+		}, timeoutMs);
+		socket.on("connect", () => {
+			socket.write(`${JSON.stringify({
+				v: 1,
+				...req
+			})}\n`);
+		});
+		socket.on("data", (data) => {
+			chunks.push(data);
+			const text = Buffer.concat(chunks).toString("utf8");
+			const nl = text.indexOf("\n");
+			if (nl === -1) return;
+			clearTimeout(timer);
+			try {
+				const parsed = JSON.parse(text.slice(0, nl));
+				finish({
+					ok: parsed.ok === true,
+					...parsed.error !== void 0 ? { error: parsed.error } : {}
+				});
+			} catch (err) {
+				finish({
+					ok: false,
+					error: err instanceof Error ? err.message : String(err)
+				});
+			}
+		});
+		socket.on("error", (err) => {
+			clearTimeout(timer);
+			finish({
+				ok: false,
+				error: err.message
+			});
+		});
+		socket.on("end", () => {
+			if (chunks.length === 0) {
+				clearTimeout(timer);
+				finish({
+					ok: false,
+					error: "privileged helper closed without a reply"
+				});
+			}
+		});
+	});
+}
+//#endregion
 //#region src/kernel/deps/manifest-system-deps.ts
 /**
 * Auto-install the host binaries declared in an addon's manifest
@@ -9728,6 +9828,9 @@ async function installManifestPythonDeps(declaration, addonDir, deps, logger) {
 *  4. **Platform reality is stated, not assumed.** An unsupported host logs
 *     which manager it looked for and continues. Silence would read as
 *     "installed".
+*  5. **Apt is not the runner's.** Distro package managers need root. The
+*     runner and hub-main are uid 1001 (`gosu` in the entrypoint). Apt/apk/dnf
+*     go through `camstack-pkgd` (allowlisted). Brew stays in-process.
 *
 * Every branch that declines to install SAYS SO. A dependency step that
 * produced no line at all is indistinguishable from one that never ran, and
@@ -9750,12 +9853,16 @@ async function installManifestSystemDeps(declaration, logger, options = {}) {
 	const detectManager = options.detectManager ?? defaultDetectManager;
 	const run = options.run ?? defaultRun;
 	const platform = options.platform ?? process.platform;
+	const helperAvailable = options.helperAvailable ?? (async () => privilegedHelperAvailable());
+	const requestInstall = options.requestInstall ?? ((req) => requestPrivilegedInstall(req));
 	for (const dep of deps) try {
 		await satisfyOne(dep, declaration.id, {
 			hasBinary,
 			detectManager,
 			run,
-			platform
+			platform,
+			helperAvailable,
+			requestInstall
 		}, logger);
 	} catch (err) {
 		logger.warn("system dependency step failed", { meta: {
@@ -9793,15 +9900,43 @@ async function satisfyOne(dep, addonId, rt, logger) {
 		} });
 		return;
 	}
-	const plan = planFor(manager, packageName);
+	const decision = decidePackageInstall({
+		manager,
+		packageName,
+		helperAvailable: await rt.helperAvailable()
+	});
+	if (decision.kind === "refuse") {
+		const message = decision.reason === "helper-unavailable" ? "system dependency missing and the privileged helper is not running — apt cannot run as uid 1001" : "system dependency missing and the package is not on the helper allowlist";
+		logger.warn(message, { meta: {
+			addonId,
+			binary: dep.binary,
+			manager,
+			package: packageName,
+			reason: decision.reason,
+			...dep.reason !== void 0 ? { reason: dep.reason } : {}
+		} });
+		return;
+	}
 	logger.info("installing system dependency", { meta: {
 		addonId,
 		binary: dep.binary,
 		manager,
-		package: packageName
+		package: packageName,
+		via: decision.kind
 	} });
 	try {
-		for (const [command, args] of plan.steps) await rt.run(command, args);
+		if (decision.kind === "helper") {
+			const result = await rt.requestInstall({
+				addonId,
+				binary: dep.binary,
+				manager,
+				packageName
+			});
+			if (!result.ok) throw new Error(result.error ?? "privileged helper refused");
+		} else {
+			const plan = planFor(manager, packageName);
+			for (const [command, args] of plan.steps) await rt.run(command, args);
+		}
 	} catch (err) {
 		logger.warn("system dependency install failed — the addon loads, its capability must refuse", { meta: {
 			addonId,

package/dist/{retired-settings-keys-CRL0qOnU.js → retired-settings-keys-CqDbI-vK.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-B29Skpzo.js");
+const require_dist = require("./dist-BhE8zNfY.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-N0NZzDE3.mjs → retired-settings-keys-DLwieFXR.mjs}

@@ -1,4 +1,4 @@
-import { Ht as asJsonObject } from "./dist-DxFjna2a.mjs";
+import { Ht as asJsonObject } from "./dist-BpsHt11f.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.163",
+  "version": "1.2.165",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",