@camstack/system 1.2.164 → 1.2.166

package/dist/{dist-BpsHt11f.mjs → dist-Dw9cm1NS.mjs}

@@ -4270,6 +4270,13 @@ var MediaRelocateModeSchema = z.enum([
 ]);
 var RelocateMediaInputSchema = z.object({
 	toLocationId: z.string(),
+	/**
+	* Restrict the pass to rows currently on this location. Omitted / `'*'` =
+	* every row that is not already on `toLocationId` (the historical
+	* behaviour). A named source is what a from→to migration needs: without it
+	* "move events off disk 2" also emptied disk 1.
+	*/
+	fromLocationId: z.string().optional(),
 	throttleMbps: z.number().min(1).max(1e3).optional(),
 	/** Omitted = `move`, the pre-existing behaviour. */
 	mode: MediaRelocateModeSchema.optional()
@@ -4337,6 +4344,19 @@ var StorageMigrationDestinationsSchema = z.object({
 	galleryMedia: z.string().min(1).optional()
 }).refine((value) => Object.keys(value).length > 0, { message: "select at least one storage class" });
 /**
+* Optional named source per class. Omitted = the class's current default
+* (the historical behaviour). A named source that is NOT the default is a
+* drain of that disk: bytes move, the default stays, and the source is
+* disabled when the move finishes.
+*/
+var StorageMigrationSourcesSchema = z.object({
+	recordings: z.string().min(1).optional(),
+	recordingsLow: z.string().min(1).optional(),
+	eventMedia: z.string().min(1).optional(),
+	backups: z.string().min(1).optional(),
+	galleryMedia: z.string().min(1).optional()
+}).optional();
+/**
 * How a migration sequences the cutover against the byte move.
 *
 *  - `blocking`     — the historical order: pause, move every byte, repoint,
@@ -4358,6 +4378,8 @@ var StorageMigrationModeSchema = z.enum(["blocking", "nonBlocking"]);
 /** Shared input for planning and starting an orchestrated storage migration. */
 var StorageMigrationInputSchema = z.object({
 	destinations: StorageMigrationDestinationsSchema,
+	/** Omitted = each class's current default. */
+	sources: StorageMigrationSourcesSchema,
 	throttleMbps: z.number().min(1).max(1e3).optional(),
 	/** Omitted = `blocking`, which stays the default. */
 	mode: StorageMigrationModeSchema.optional()
@@ -4437,6 +4459,13 @@ var StorageMigrationMoveSchema = z.object({
 	storageClass: StorageMigrationClassSchema,
 	fromLocationId: z.string(),
 	toLocationId: z.string(),
+	/**
+	* True when `from` was NOT the class default at plan time. The move still
+	* copies bytes, but the default is left alone and the source is disabled
+	* once the copy verifies. Absent on jobs planned before this field existed
+	* — those jobs always repointed, which is `false`.
+	*/
+	freezeSource: z.boolean().optional(),
 	moverJobId: z.string().nullable(),
 	state: RelocateJobStateSchema.nullable(),
 	error: z.string().nullable(),
@@ -4450,6 +4479,7 @@ var StorageMigrationJobSchema = z.object({
 	*  can tell a seconds-long cutover from a thirty-hour one. */
 	mode: StorageMigrationModeSchema,
 	destinations: StorageMigrationDestinationsSchema,
+	sources: StorageMigrationSourcesSchema,
 	throttleMbps: z.number(),
 	moves: z.array(StorageMigrationMoveSchema),
 	pauseLeaseId: z.string().nullable(),
@@ -4499,6 +4529,7 @@ var StorageMigrationFindingSchema = z.object({
 });
 var StorageMigrationPlanSchema = z.object({
 	destinations: StorageMigrationDestinationsSchema,
+	sources: StorageMigrationSourcesSchema,
 	/** The mode this plan was built for. A plan is only valid for its mode: the
 	*  `eventMedia` seal gate and the single-cardinality refusal both depend on
 	*  it. */
@@ -4506,7 +4537,8 @@ var StorageMigrationPlanSchema = z.object({
 	moves: z.array(z.object({
 		storageClass: StorageMigrationClassSchema,
 		fromLocationId: z.string(),
-		toLocationId: z.string()
+		toLocationId: z.string(),
+		freezeSource: z.boolean().optional()
 	})),
 	findings: z.array(StorageMigrationFindingSchema)
 });
@@ -4692,10 +4724,51 @@ var LedgerWalkReportSchema = z.object({
 var RelocatableMediaCountSchema = z.object({ rows: z.number().int().nonnegative() }).nullable();
 var RelocatableMediaCountInputSchema = z.object({
 	toLocationId: z.string().min(1),
+	/** Restrict the count to one source; omitted / `'*'` = every non-target row. */
+	fromLocationId: z.string().optional(),
 	/** Omitted = `move`. */
 	mode: MediaRelocateModeSchema.optional()
 });
 /**
+* Operator cleanup of leftover analytics rows, optional debug media, and
+* ghost ledger entries on frozen footage locations.
+*
+* A pass is tens of minutes on a standing backlog. The hub method RETURNS
+* `{ jobId }` immediately; progress is `cleanupStatus`. Awaiting the work
+* is how `addons.custom` hit the 60 s UDS deadline while reclaim continued
+* with no operator-visible status.
+*/
+var StorageCleanupPhaseSchema = z.enum([
+	"orphans",
+	"debug-media",
+	"ghost-ledger",
+	"done",
+	"failed",
+	"cancelled"
+]);
+var StorageCleanupInputSchema = z.object({ 
+/** Also walk motion stills / track filmstrips. Off by default. */
+includeDebugMedia: z.boolean().optional() });
+var StorageCleanupJobSchema = z.object({
+	jobId: z.string(),
+	phase: StorageCleanupPhaseSchema,
+	includeDebugMedia: z.boolean(),
+	orphansReclaimed: z.number().int().nonnegative(),
+	orphanBytesReclaimed: z.number().int().nonnegative(),
+	debugMediaReclaimed: z.number().int().nonnegative(),
+	debugMediaBytesReclaimed: z.number().int().nonnegative(),
+	ghostsForgotten: z.number().int().nonnegative(),
+	ghostBytesForgotten: z.number().int().nonnegative(),
+	/** Short operator-facing line: current collection, pass, or location. */
+	detail: z.string().nullable(),
+	cancelRequested: z.boolean(),
+	startedAt: z.number(),
+	updatedAt: z.number(),
+	finishedAt: z.number().nullable(),
+	error: z.string().nullable()
+});
+var StorageCleanupStatusInputSchema = z.object({ jobId: z.string().optional() });
+/**
 * `StorageLocationType` — an addon-declared id that identifies the *kind* of
 * storage a location serves. Defined here (not in `capabilities/storage.cap.ts`)
 * so the persisted record schema and the consumer-facing cap can both consume it
@@ -4723,11 +4796,10 @@ var StorageLocationTypeSchema = z.string().regex(/^[a-z][a-zA-Z0-9-]*$/);
 * The default location for a type uses `id === <type>:default` by
 * convention (the bare type ref like `'backups'` resolves to it).
 *
-* `isSystem: true` marks a location as orchestrator-seeded and
-* undeletable. The bootstrap-installed defaults (one per type) carry
-* this flag; operator-added locations don't. Editing the config of
-* a system location is allowed (path migration, provider swap) but
-* deleting it is rejected at the cap level.
+* `isSystem` is a legacy persisted flag. Seed still creates the initial
+* `<type>:default` locations; the flag is no longer a lock, a badge, or a
+* prune selector. New writes leave it false. Deletion is gated on uniqueness
+* / last-enabled, not on this bit.
 */
 var StorageLocationSchema = z.object({
 	id: z.string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/),
@@ -21633,7 +21705,23 @@ var storageMigrationCapability = {
 		drain: method(StorageMigrationDrainInputSchema, z.object({ jobId: z.string() }), {
 			kind: "mutation",
 			auth: "admin"
-		})
+		}),
+		/**
+		* One operator cleanup of leftover analytics (DB + blobs) and ghost
+		* ledger rows on frozen footage locations. Optional debug-media sweep.
+		* Returns immediately; poll {@link cleanupStatus}.
+		*/
+		cleanupStart: method(StorageCleanupInputSchema, z.object({ jobId: z.string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		cleanupStatus: method(StorageCleanupStatusInputSchema, StorageCleanupJobSchema.nullable(), { auth: "admin" }),
+		cleanupCancel: method(z.object({ jobId: z.string() }), z.object({ cancelled: z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Recent finished migration jobs, newest first. The live job is `status`. */
+		history: method(z.object({}), z.array(StorageMigrationJobSchema).readonly(), { auth: "admin" })
 	}
 };
 var ProviderInfoSchema = z.discriminatedUnion("shouldSaveDiskSpace", [z.object({
@@ -29899,6 +29987,33 @@ var RecordingRebalanceInputSchema = z.object({
 	minMoveGb: z.number().min(0).optional()
 });
 /**
+* Operator-facing placement of one camera onto a recordings location.
+*
+* `pinLocationId` is the operator instruction: a location id, or `null` for
+* Auto (the planner may move this camera). `locationId` is where high/mid
+* currently write — the plan, which may disagree with the pin when Auto.
+*/
+var RecordingDevicePlacementSchema = z.object({
+	deviceId: z.number().int(),
+	profile: z.string(),
+	locationId: z.string()
+});
+var RecordingDevicePinSchema = z.object({
+	deviceId: z.number().int(),
+	/** Recordings-class location this camera is pinned to. */
+	locationId: z.string()
+});
+var RecordingPlacementViewSchema = z.object({
+	assignments: z.array(RecordingDevicePlacementSchema),
+	pins: z.array(RecordingDevicePinSchema),
+	defaultLocations: z.record(z.string(), z.string())
+});
+var RecordingSetDevicePlacementInputSchema = z.object({
+	deviceId: z.number().int(),
+	/** `null` = Auto. Otherwise a `recordings:*` location id. */
+	locationId: z.string().nullable()
+});
+/**
 * Result of locating footage at a wall-clock instant for one device/profile.
 * `segment` carries the covering segment's window; `gap` reports the forward
 * nearest covered edge (`null` past the end of footage / when none exists)
@@ -30251,6 +30366,22 @@ var recordingCapability = {
 		startStorageRebalance: method(RecordingRebalanceInputSchema, RecordingRebalancePlanSchema, {
 			kind: "mutation",
 			auth: "admin"
+		}),
+		/**
+		* The placement plan in force plus operator pins. Drives the Locations
+		* admin page: Auto vs a named recordings location, per camera.
+		*/
+		getPlacement: method(z.object({}), RecordingPlacementViewSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* Pin a camera to a recordings location, or clear the pin (Auto). High and
+		* mid follow the pin; low stays with the recordingsLow planner.
+		*/
+		setDevicePlacement: method(RecordingSetDevicePlacementInputSchema, z.object({ ok: z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
 		})
 	}
 };
@@ -38325,6 +38456,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.getPlacement": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.getPlaybackManifest": {
 		capName: "recording",
 		capScope: "system",
@@ -38451,6 +38588,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.setDevicePlacement": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.startStorageMigrationMove": {
 		capName: "recording",
 		capScope: "system",
@@ -38895,12 +39038,36 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"storageMigration.cleanupCancel": {
+		capName: "storage-migration",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"storageMigration.cleanupStart": {
+		capName: "storage-migration",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"storageMigration.cleanupStatus": {
+		capName: "storage-migration",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageMigration.drain": {
 		capName: "storage-migration",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"storageMigration.history": {
+		capName: "storage-migration",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageMigration.movers": {
 		capName: "storage-migration",
 		capScope: "system",
@@ -41387,6 +41554,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"recording.setDevicePlacement": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"recording.startStorageMigrationMove": [{
 		name: "deviceId",
 		form: "single",
@@ -42678,4 +42850,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { isObjectInput as $, parseJsonUnknown as $t, bareAddonId as A, vectorStoreCapability as At, deviceManagerCapability as B, ReadinessTimeoutError as Bt, UserRecordSchema as C, snapshotCapability as Ct, alertsCapability as D, streamQualityLabel as Dt, addonWidgetsCapability as E, storageProviderCapability as Et, coreBlockIdFromAddonId as F, DEVICE_STATUS_METHOD as Ft, enumerateItemArrayFields as G, createEvent as Gt, deviceStatusCapability as H, asJsonObject as Ht, coreBlocksCapability as I, DeviceFeature as It, extractNestedAddonId as J, expandCapMethods as Jt, enumerateSchemaFields as K, emitDownForOwnedCaps as Kt, dataStoreProviderCapability as L, DeviceRole as Lt, buildStreamParamsConfigSchema as M, BaseAddon as Mt, collectSecretConfigKeys as N, DATAPLANE_SECRET_HEADER as Nt, authProviderCapability as O, userManagementCapability as Ot, coreBlockAddonId as P, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Pt, isCollectionArrayMethod as Q, parseJsonObject as Qt, decodeVectorBase64 as R, DeviceType as Rt, StorageMigrationJobSchema as S, settingsStoreCapability as St, addonSettingsCapability as T, storageMigrationCapability as Tt, doorbellCapability as U, asNumber as Ut, deviceStateCapability as V, WELL_KNOWN_TAB_MAP as Vt, enumerateInferenceDevices as W, asString as Wt, foldSnapshotByFunction as X, isDeviceConfigCap as Xt, filesystemBrowseCapability as Y, hydrateSchema as Yt, isArrayOutputSchema as Z, nodePin as Zt, SOURCE_DEVICE_TYPES as _, resolveMethodAuth as _t, CAP_NAMES_WITH_STATUS as a, localNetworkCapability as at, ScopedTokenSchema as b, scopesAllowDeviceCap as bt, CoreBlockSchema as c, looseSchema as ct, DeviceStatusSchema as d, objectInputDeclaresAddonId as dt, readinessKey as en, isSameAddonId as et, LOG_LEVEL_RANK as f, parseStreamParamsFormPatch as ft, SOURCE_CAPS as g, resolveBucketMs as gt, RUNTIME_DEFAULTS as h, reducePoints as ht, BatteryStatusSchema as i, EventCategory as in, lifecycleJobSchema as it, batteryCapability as j, errMsg as jt, backupCapability as k, vectorDimFromBase64 as kt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as l, metricsProviderCapability as lt, REDACTED_SECRET as m, procedureAuthKey as mt, AlertSchema as n, scopeKey as nn, isVoidInput as nt, CORE_BLOCKS_ADDON_ID as o, logDestinationCapability as ot, METHOD_ACCESS_MAP as p, platformProbeCapability as pt, evaluateSensorEdge as q, emitReadiness as qt, ApiKeyRecordSchema as r, sleep as rn, kebabToCamel as rt, CORE_BLOCK_ADDON_PREFIX as s, logLevelAtMost as st, ALL_CAPABILITY_DEFINITIONS as t, resolveCapMount as tn, isSourceCap as tt, DeclaredDevices as u, normalizeUnit as ut, STORAGE_ACCESS_FALLBACK as v, runtimeStatePolicyFor as vt, addonPagesCapability as w, storageCapability as wt, StorageLocationTypeSchema as x, scoreRuntimes as xt, STREAM_PROFILE_META as y, scopesAllowAddon as yt, deriveBatteryPresence as z, ReadinessRegistry as zt };
+export { isCollectionArrayMethod as $, parseJsonObject as $t, backupCapability as A, vectorDimFromBase64 as At, deriveBatteryPresence as B, ReadinessRegistry as Bt, StorageMigrationJobSchema as C, settingsStoreCapability as Ct, addonWidgetsCapability as D, storageProviderCapability as Dt, addonSettingsCapability as E, storageMigrationCapability as Et, coreBlockAddonId as F, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Ft, enumerateInferenceDevices as G, asString as Gt, deviceStateCapability as H, WELL_KNOWN_TAB_MAP as Ht, coreBlockIdFromAddonId as I, DEVICE_STATUS_METHOD as It, evaluateSensorEdge as J, emitReadiness as Jt, enumerateItemArrayFields as K, createEvent as Kt, coreBlocksCapability as L, DeviceFeature as Lt, batteryCapability as M, errMsg as Mt, buildStreamParamsConfigSchema as N, BaseAddon as Nt, alertsCapability as O, streamQualityLabel as Ot, collectSecretConfigKeys as P, DATAPLANE_SECRET_HEADER as Pt, isArrayOutputSchema as Q, nodePin as Qt, dataStoreProviderCapability as R, DeviceRole as Rt, StorageLocationTypeSchema as S, scoreRuntimes as St, addonPagesCapability as T, storageCapability as Tt, deviceStatusCapability as U, asJsonObject as Ut, deviceManagerCapability as V, ReadinessTimeoutError as Vt, doorbellCapability as W, asNumber as Wt, filesystemBrowseCapability as X, hydrateSchema as Xt, extractNestedAddonId as Y, expandCapMethods as Yt, foldSnapshotByFunction as Z, isDeviceConfigCap as Zt, SOURCE_DEVICE_TYPES as _, resolveBucketMs as _t, CAP_NAMES_WITH_STATUS as a, EventCategory as an, lifecycleJobSchema as at, ScopedTokenSchema as b, scopesAllowAddon as bt, CoreBlockSchema as c, logLevelAtMost as ct, DeviceStatusSchema as d, normalizeUnit as dt, parseJsonUnknown as en, isObjectInput as et, LOG_LEVEL_RANK as f, objectInputDeclaresAddonId as ft, SOURCE_CAPS as g, reducePoints as gt, RUNTIME_DEFAULTS as h, procedureAuthKey as ht, BatteryStatusSchema as i, sleep as in, kebabToCamel as it, bareAddonId as j, vectorStoreCapability as jt, authProviderCapability as k, userManagementCapability as kt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as l, looseSchema as lt, REDACTED_SECRET as m, platformProbeCapability as mt, AlertSchema as n, resolveCapMount as nn, isSourceCap as nt, CORE_BLOCKS_ADDON_ID as o, localNetworkCapability as ot, METHOD_ACCESS_MAP as p, parseStreamParamsFormPatch as pt, enumerateSchemaFields as q, emitDownForOwnedCaps as qt, ApiKeyRecordSchema as r, scopeKey as rn, isVoidInput as rt, CORE_BLOCK_ADDON_PREFIX as s, logDestinationCapability as st, ALL_CAPABILITY_DEFINITIONS as t, readinessKey as tn, isSameAddonId as tt, DeclaredDevices as u, metricsProviderCapability as ut, STORAGE_ACCESS_FALLBACK as v, resolveMethodAuth as vt, UserRecordSchema as w, snapshotCapability as wt, StorageCleanupJobSchema as x, scopesAllowDeviceCap as xt, STREAM_PROFILE_META as y, runtimeStatePolicyFor as yt, decodeVectorBase64 as z, DeviceType as zt };

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BhE8zNfY.js");
+const require_dist = require("./dist-CFTKQGym.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -26,7 +26,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
 const require_tls$1 = require("./tls-BxQlomxd.js");
-const require_manifest_system_deps = require("./manifest-system-deps-CJLqfJUs.js");
+const require_manifest_system_deps = require("./manifest-system-deps-BIxY1Y5e.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $ as isObjectInput, $t as parseJsonUnknown$1, Bt as ReadinessTimeoutError, Ft as DEVICE_STATUS_METHOD, Gt as createEvent, Ht as asJsonObject$1, J as extractNestedAddonId, Jt as expandCapMethods, Kt as emitDownForOwnedCaps, Nt as DATAPLANE_SECRET_HEADER$1, Pt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Q as isCollectionArrayMethod, Qt as parseJsonObject, T as addonSettingsCapability, Ut as asNumber, Wt as asString$1, Z as isArrayOutputSchema, _t as resolveMethodAuth, bt as scopesAllowDeviceCap, ct as looseSchema, dt as objectInputDeclaresAddonId, en as readinessKey, f as LOG_LEVEL_RANK, h as RUNTIME_DEFAULTS, in as EventCategory$1, it as lifecycleJobSchema, jt as errMsg$1, mt as procedureAuthKey, nn as scopeKey, nt as isVoidInput, p as METHOD_ACCESS_MAP, rt as kebabToCamel, st as logLevelAtMost, t as ALL_CAPABILITY_DEFINITIONS, tn as resolveCapMount, yt as scopesAllowAddon, zt as ReadinessRegistry } from "./dist-BpsHt11f.mjs";
+import { $ as isCollectionArrayMethod, $t as parseJsonObject, Bt as ReadinessRegistry, E as addonSettingsCapability, Ft as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Gt as asString$1, It as DEVICE_STATUS_METHOD, Kt as createEvent, Mt as errMsg$1, Pt as DATAPLANE_SECRET_HEADER$1, Q as isArrayOutputSchema, Ut as asJsonObject$1, Vt as ReadinessTimeoutError, Wt as asNumber, Y as extractNestedAddonId, Yt as expandCapMethods, an as EventCategory$1, at as lifecycleJobSchema, bt as scopesAllowAddon, ct as logLevelAtMost, en as parseJsonUnknown$1, et as isObjectInput, f as LOG_LEVEL_RANK, ft as objectInputDeclaresAddonId, h as RUNTIME_DEFAULTS, ht as procedureAuthKey, it as kebabToCamel, lt as looseSchema, nn as resolveCapMount, p as METHOD_ACCESS_MAP, qt as emitDownForOwnedCaps, rn as scopeKey, rt as isVoidInput, t as ALL_CAPABILITY_DEFINITIONS, tn as readinessKey, vt as resolveMethodAuth, xt as scopesAllowDeviceCap } from "./dist-Dw9cm1NS.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -25,7 +25,7 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-BhKdxJgf.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-DOTmtLCW.mjs";
-import { $ as FrameDecoder, $t as DECISIVE_HEAP_SPACES, A as createUdsEventBus, At as HEAP_WATCH_INTERVAL_MS, B as CapRouteError, Bt as buildHeapSample, C as ipcParentLink, Cn as diffEventPlane, Ct as resolveAddonClass, D as createHubCapForwardService, Dt as HEAP_RECLAIM_MIN_INTERVAL_MS, E as HUB_CAP_FWD_SERVICE, Et as createAddonDataPlaneFacility, F as LocalChildRegistry, Ft as RSS_BUDGET_REANNOUNCE_MIN_MS, G as PARENT_ROUTED_PROVIDER_ADDON_ID, Gt as hubMainRssBudget, H as callWithServiceDiscovery, Ht as createLoopDelayMeter, I as UDS_NO_ROUTE_PREFIX, It as RSS_BUDGET_RELEASE_RATIO, J as createLocalTransport, Jt as reclaimIntervalMs, K as __resetCapUsageRegistryForTests, Kt as nextRssBudgetState, L as AGENT_CAP_FWD_ACTION, Lt as RUNNER_HEAP_WATCH_INTERVAL_MS, M as createUdsLogger, Mt as HUB_MAIN_HEAP_WATCH_LABEL, N as createUdsLoggerWithControl, Nt as HUB_MAIN_RSS_BUDGET_MB, O as createParentUnownedCallHandler, Ot as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, P as LocalChildClient, Pt as HUB_RSS_BUDGET_ENV, Q as localEndpointPath, Qt as strandedMb, R as AGENT_CAP_FWD_SERVICE, Rt as RUNNER_RSS_BUDGET_ENV, S as buildLinkChain, Sn as createEventPlaneReader, St as installManifestNativeDeps, T as HUB_CAP_FWD_ACTION, Tt as runNpm, U as readMoleculerFanoutMode, Ut as createV8Reclaimer, V as classifyCapRoute, Vt as createDeferredHeapWatchSink, W as CapUsageRegistry, Wt as describeRss, X as UdsLocalTransportServer, Xt as startHeapWatch, Y as UdsLocalTransportClient, Yt as shouldReclaim, Z as SocketChannel, Zt as startRunnerHeapWatch, _ as AddonDepsManager, _n as sampleSocketDirection, _t as serializeTypedArrays, a as createUdsAddonContext, an as heapSpaceField, b as brokerCallForCap, bn as EVENT_PLANE_TOP_N, bt as CapabilityUnavailableError, c as getOrInitReadinessRegistryForClient, cn as EMPTY_SOCKET_PLANE_BASELINE, ct as createAddonService, d as clusterEventTopic, dn as createSocketPlaneReader, dt as capActionName, en as HEAP_SPACE_REPORT_MIN_MB, et as encodeFrame, f as getBrokerEventBus, fn as diffSocketPlane, ft as capActionSuffix, g as subscribePassthrough, gn as recordSocketFrame, gt as deserializeTypedArrays, h as setNodeEventInterest, hn as createSocketDirectionCounters, ht as parseCapAction, i as createAddonContext, in as heapSnapshotAuthorised, j as udsChildLogToWorkerEntry, jt as HEAP_WATCH_WARN_RATIO, k as createUdsEventBridge, kt as HEAP_RECLAIM_TRIGGER_MB, l as setHubConnected, ln as SOCKET_PLANE_TOP_N, lt as validateProviderRegistrations, m as registerEventBusService, mn as EMPTY_SOCKET_DIRECTION, mt as capServiceName, n as installManifestPythonDeps, nn as emitHeapDiagnosticReport, nt as buildUdsNativeCapProxy, o as getWorkerDeviceRegistry, on as readHeapSpaces, ot as mountNativeCapService, p as getMoleculerEventStats, pn as formatSocketPlane, pt as capBareAction, q as getCapUsageRegistry, qt as parseRssBudgetMb, r as adaptBrokerToCluster, rn as formatHeapSpaces, rt as createBrokerDeviceManagerApi, s as getOrInitReadinessRegistry, sn as selectReportedSpaces, t as installManifestSystemDeps, tn as RUNNER_HEAP_SNAPSHOT_ENV, tt as buildNativeCapProxy, u as EVENT_TOPIC_PREFIX, un as createSocketPlaneMeter, ut as NATIVE_PROVIDER_SERVICE_INFIX, v as createKernelHwAccel, vn as socketDirectionBytes, vt as DeviceRegistry, w as localProviderLink, wn as formatEventPlane, wt as resolveNpmInvocation, x as brokerTransportLink, xn as createEventPlaneMeter, xt as copyBundledNativeModules, y as resolveHwAccel, yn as socketDirectionMessages, yt as CapabilityHandle, z as CapRouteResolver, zt as ZERO_LOOP_DELAY } from "./manifest-system-deps-Bk_XLYbB.mjs";
+import { $ as FrameDecoder, $t as DECISIVE_HEAP_SPACES, A as createUdsEventBus, At as HEAP_WATCH_INTERVAL_MS, B as CapRouteError, Bt as buildHeapSample, C as ipcParentLink, Cn as diffEventPlane, Ct as resolveAddonClass, D as createHubCapForwardService, Dt as HEAP_RECLAIM_MIN_INTERVAL_MS, E as HUB_CAP_FWD_SERVICE, Et as createAddonDataPlaneFacility, F as LocalChildRegistry, Ft as RSS_BUDGET_REANNOUNCE_MIN_MS, G as PARENT_ROUTED_PROVIDER_ADDON_ID, Gt as hubMainRssBudget, H as callWithServiceDiscovery, Ht as createLoopDelayMeter, I as UDS_NO_ROUTE_PREFIX, It as RSS_BUDGET_RELEASE_RATIO, J as createLocalTransport, Jt as reclaimIntervalMs, K as __resetCapUsageRegistryForTests, Kt as nextRssBudgetState, L as AGENT_CAP_FWD_ACTION, Lt as RUNNER_HEAP_WATCH_INTERVAL_MS, M as createUdsLogger, Mt as HUB_MAIN_HEAP_WATCH_LABEL, N as createUdsLoggerWithControl, Nt as HUB_MAIN_RSS_BUDGET_MB, O as createParentUnownedCallHandler, Ot as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, P as LocalChildClient, Pt as HUB_RSS_BUDGET_ENV, Q as localEndpointPath, Qt as strandedMb, R as AGENT_CAP_FWD_SERVICE, Rt as RUNNER_RSS_BUDGET_ENV, S as buildLinkChain, Sn as createEventPlaneReader, St as installManifestNativeDeps, T as HUB_CAP_FWD_ACTION, Tt as runNpm, U as readMoleculerFanoutMode, Ut as createV8Reclaimer, V as classifyCapRoute, Vt as createDeferredHeapWatchSink, W as CapUsageRegistry, Wt as describeRss, X as UdsLocalTransportServer, Xt as startHeapWatch, Y as UdsLocalTransportClient, Yt as shouldReclaim, Z as SocketChannel, Zt as startRunnerHeapWatch, _ as AddonDepsManager, _n as sampleSocketDirection, _t as serializeTypedArrays, a as createUdsAddonContext, an as heapSpaceField, b as brokerCallForCap, bn as EVENT_PLANE_TOP_N, bt as CapabilityUnavailableError, c as getOrInitReadinessRegistryForClient, cn as EMPTY_SOCKET_PLANE_BASELINE, ct as createAddonService, d as clusterEventTopic, dn as createSocketPlaneReader, dt as capActionName, en as HEAP_SPACE_REPORT_MIN_MB, et as encodeFrame, f as getBrokerEventBus, fn as diffSocketPlane, ft as capActionSuffix, g as subscribePassthrough, gn as recordSocketFrame, gt as deserializeTypedArrays, h as setNodeEventInterest, hn as createSocketDirectionCounters, ht as parseCapAction, i as createAddonContext, in as heapSnapshotAuthorised, j as udsChildLogToWorkerEntry, jt as HEAP_WATCH_WARN_RATIO, k as createUdsEventBridge, kt as HEAP_RECLAIM_TRIGGER_MB, l as setHubConnected, ln as SOCKET_PLANE_TOP_N, lt as validateProviderRegistrations, m as registerEventBusService, mn as EMPTY_SOCKET_DIRECTION, mt as capServiceName, n as installManifestPythonDeps, nn as emitHeapDiagnosticReport, nt as buildUdsNativeCapProxy, o as getWorkerDeviceRegistry, on as readHeapSpaces, ot as mountNativeCapService, p as getMoleculerEventStats, pn as formatSocketPlane, pt as capBareAction, q as getCapUsageRegistry, qt as parseRssBudgetMb, r as adaptBrokerToCluster, rn as formatHeapSpaces, rt as createBrokerDeviceManagerApi, s as getOrInitReadinessRegistry, sn as selectReportedSpaces, t as installManifestSystemDeps, tn as RUNNER_HEAP_SNAPSHOT_ENV, tt as buildNativeCapProxy, u as EVENT_TOPIC_PREFIX, un as createSocketPlaneMeter, ut as NATIVE_PROVIDER_SERVICE_INFIX, v as createKernelHwAccel, vn as socketDirectionBytes, vt as DeviceRegistry, w as localProviderLink, wn as formatEventPlane, wt as resolveNpmInvocation, x as brokerTransportLink, xn as createEventPlaneMeter, xt as copyBundledNativeModules, y as resolveHwAccel, yn as socketDirectionMessages, yt as CapabilityHandle, z as CapRouteResolver, zt as ZERO_LOOP_DELAY } from "./manifest-system-deps-DTz_zNQf.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { z } from "zod";

package/dist/kernel/deps/manifest-system-deps.d.ts

@@ -1,12 +1,15 @@
 import { AddonDeclaration, IScopedLogger } from '@camstack/types';
-/** Host package managers this mechanism knows how to drive. */
-export type SystemPackageManager = 'apt' | 'apk' | 'dnf' | 'brew';
+import { PackageInstallRequest, PackageInstallResult } from './system-package-broker.js';
+import { SystemPackageManager } from './system-package-allowlist.js';
+export type { SystemPackageManager } from './system-package-allowlist.js';
 /** Test seams — production callers omit these. */
 export interface InstallManifestSystemDepsOptions {
     readonly hasBinary?: (binary: string) => Promise<boolean>;
     readonly detectManager?: () => Promise<SystemPackageManager | null>;
     readonly run?: (command: string, args: readonly string[]) => Promise<void>;
     readonly platform?: NodeJS.Platform;
+    readonly helperAvailable?: () => Promise<boolean>;
+    readonly requestInstall?: (req: PackageInstallRequest) => Promise<PackageInstallResult>;
 }
 /**
  * Satisfy every `systemDependencies` entry the declaration carries.

package/dist/kernel/deps/system-package-allowlist.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Packages the privileged helper will install (D326).
+ *
+ * The helper process reads `scripts/docker/pkg-allowlist.json` (baked into
+ * the image). This module is the runner-side copy of the same list, so an
+ * unknown package is refused before a socket write. Keep them identical —
+ * `scripts/check-pkg-allowlist.ts` fails CI when they drift.
+ */
+export type SystemPackageManager = 'apt' | 'apk' | 'dnf' | 'brew';
+export type DistroPackageManager = Exclude<SystemPackageManager, 'brew'>;
+export declare const DISTRO_PACKAGE_ALLOWLIST: Readonly<Record<DistroPackageManager, readonly string[]>>;
+export declare function packageIsAllowlisted(manager: SystemPackageManager, packageName: string): boolean;

package/dist/kernel/deps/system-package-broker.d.ts

@@ -0,0 +1,31 @@
+import { SystemPackageManager } from './system-package-allowlist.js';
+export interface PackageInstallRequest {
+    readonly addonId: string;
+    readonly binary: string;
+    readonly manager: SystemPackageManager;
+    readonly packageName: string;
+}
+export interface PackageInstallResult {
+    readonly ok: boolean;
+    readonly error?: string;
+}
+export type PackageInstallDecision = {
+    readonly kind: 'helper';
+} | {
+    readonly kind: 'local';
+} | {
+    readonly kind: 'refuse';
+    readonly reason: 'not-allowlisted' | 'helper-unavailable';
+};
+/**
+ * Who is allowed to run the package manager for this request.
+ *
+ * Apt/apk/dnf need root. In the CamStack container that is the
+ * `camstack-pkgd` helper, not the runner and not hub-main (both uid
+ * 1001). Brew is owned by the logged-in user, so it stays in-process.
+ */
+export declare function decidePackageInstall(input: {
+    readonly manager: SystemPackageManager;
+    readonly packageName: string;
+    readonly helperAvailable: boolean;
+}): PackageInstallDecision;

package/dist/kernel/deps/system-package-client.d.ts

@@ -0,0 +1,9 @@
+import { PackageInstallRequest, PackageInstallResult } from './system-package-broker.js';
+/** Default path the entrypoint binds before dropping to uid 1001. */
+export declare const DEFAULT_PKGD_SOCKET = "/run/camstack/pkgd.sock";
+export declare function pkgdSocketPath(): string;
+export declare function privilegedHelperAvailable(socketPath?: string): boolean;
+/**
+ * One JSON object per line. The helper answers one request per connection.
+ */
+export declare function requestPrivilegedInstall(req: PackageInstallRequest, socketPath?: string, timeoutMs?: number): Promise<PackageInstallResult>;

package/dist/{manifest-system-deps-CJLqfJUs.js → manifest-system-deps-BIxY1Y5e.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-require("./dist-BhE8zNfY.js");
+require("./dist-CFTKQGym.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let _camstack_types_node = require("@camstack/types/node");
@@ -9698,6 +9698,106 @@ async function installManifestPythonDeps(declaration, addonDir, deps, logger) {
 	await deps.installPythonRequirements(reqAbs);
 }
 //#endregion
+//#region src/kernel/deps/system-package-allowlist.ts
+var DISTRO_PACKAGE_ALLOWLIST = {
+	apt: ["smbclient"],
+	apk: ["samba-client"],
+	dnf: ["samba-client"]
+};
+function packageIsAllowlisted(manager, packageName) {
+	if (manager === "brew") return true;
+	if (packageName.length === 0) return false;
+	if (!/^[a-zA-Z0-9][a-zA-Z0-9+._-]*$/.test(packageName)) return false;
+	return DISTRO_PACKAGE_ALLOWLIST[manager].includes(packageName);
+}
+//#endregion
+//#region src/kernel/deps/system-package-broker.ts
+/**
+* Who is allowed to run the package manager for this request.
+*
+* Apt/apk/dnf need root. In the CamStack container that is the
+* `camstack-pkgd` helper, not the runner and not hub-main (both uid
+* 1001). Brew is owned by the logged-in user, so it stays in-process.
+*/
+function decidePackageInstall(input) {
+	if (input.manager === "brew") return { kind: "local" };
+	if (!packageIsAllowlisted(input.manager, input.packageName)) return {
+		kind: "refuse",
+		reason: "not-allowlisted"
+	};
+	if (!input.helperAvailable) return {
+		kind: "refuse",
+		reason: "helper-unavailable"
+	};
+	return { kind: "helper" };
+}
+function pkgdSocketPath() {
+	return process.env["CAMSTACK_PKGD_SOCKET"] ?? "/run/camstack/pkgd.sock";
+}
+function privilegedHelperAvailable(socketPath = pkgdSocketPath()) {
+	return (0, node_fs.existsSync)(socketPath);
+}
+/**
+* One JSON object per line. The helper answers one request per connection.
+*/
+function requestPrivilegedInstall(req, socketPath = pkgdSocketPath(), timeoutMs = 360 * 1e3) {
+	return new Promise((resolve) => {
+		const socket = (0, node_net.createConnection)({ path: socketPath });
+		const chunks = [];
+		const finish = (result) => {
+			socket.destroy();
+			resolve(result);
+		};
+		const timer = setTimeout(() => {
+			finish({
+				ok: false,
+				error: `privileged helper timed out after ${timeoutMs}ms`
+			});
+		}, timeoutMs);
+		socket.on("connect", () => {
+			socket.write(`${JSON.stringify({
+				v: 1,
+				...req
+			})}\n`);
+		});
+		socket.on("data", (data) => {
+			chunks.push(data);
+			const text = Buffer.concat(chunks).toString("utf8");
+			const nl = text.indexOf("\n");
+			if (nl === -1) return;
+			clearTimeout(timer);
+			try {
+				const parsed = JSON.parse(text.slice(0, nl));
+				finish({
+					ok: parsed.ok === true,
+					...parsed.error !== void 0 ? { error: parsed.error } : {}
+				});
+			} catch (err) {
+				finish({
+					ok: false,
+					error: err instanceof Error ? err.message : String(err)
+				});
+			}
+		});
+		socket.on("error", (err) => {
+			clearTimeout(timer);
+			finish({
+				ok: false,
+				error: err.message
+			});
+		});
+		socket.on("end", () => {
+			if (chunks.length === 0) {
+				clearTimeout(timer);
+				finish({
+					ok: false,
+					error: "privileged helper closed without a reply"
+				});
+			}
+		});
+	});
+}
+//#endregion
 //#region src/kernel/deps/manifest-system-deps.ts
 /**
 * Auto-install the host binaries declared in an addon's manifest
@@ -9728,6 +9828,9 @@ async function installManifestPythonDeps(declaration, addonDir, deps, logger) {
 *  4. **Platform reality is stated, not assumed.** An unsupported host logs
 *     which manager it looked for and continues. Silence would read as
 *     "installed".
+*  5. **Apt is not the runner's.** Distro package managers need root. The
+*     runner and hub-main are uid 1001 (`gosu` in the entrypoint). Apt/apk/dnf
+*     go through `camstack-pkgd` (allowlisted). Brew stays in-process.
 *
 * Every branch that declines to install SAYS SO. A dependency step that
 * produced no line at all is indistinguishable from one that never ran, and
@@ -9750,12 +9853,16 @@ async function installManifestSystemDeps(declaration, logger, options = {}) {
 	const detectManager = options.detectManager ?? defaultDetectManager;
 	const run = options.run ?? defaultRun;
 	const platform = options.platform ?? process.platform;
+	const helperAvailable = options.helperAvailable ?? (async () => privilegedHelperAvailable());
+	const requestInstall = options.requestInstall ?? ((req) => requestPrivilegedInstall(req));
 	for (const dep of deps) try {
 		await satisfyOne(dep, declaration.id, {
 			hasBinary,
 			detectManager,
 			run,
-			platform
+			platform,
+			helperAvailable,
+			requestInstall
 		}, logger);
 	} catch (err) {
 		logger.warn("system dependency step failed", { meta: {
@@ -9793,15 +9900,43 @@ async function satisfyOne(dep, addonId, rt, logger) {
 		} });
 		return;
 	}
-	const plan = planFor(manager, packageName);
+	const decision = decidePackageInstall({
+		manager,
+		packageName,
+		helperAvailable: await rt.helperAvailable()
+	});
+	if (decision.kind === "refuse") {
+		const message = decision.reason === "helper-unavailable" ? "system dependency missing and the privileged helper is not running — apt cannot run as uid 1001" : "system dependency missing and the package is not on the helper allowlist";
+		logger.warn(message, { meta: {
+			addonId,
+			binary: dep.binary,
+			manager,
+			package: packageName,
+			reason: decision.reason,
+			...dep.reason !== void 0 ? { reason: dep.reason } : {}
+		} });
+		return;
+	}
 	logger.info("installing system dependency", { meta: {
 		addonId,
 		binary: dep.binary,
 		manager,
-		package: packageName
+		package: packageName,
+		via: decision.kind
 	} });
 	try {
-		for (const [command, args] of plan.steps) await rt.run(command, args);
+		if (decision.kind === "helper") {
+			const result = await rt.requestInstall({
+				addonId,
+				binary: dep.binary,
+				manager,
+				packageName
+			});
+			if (!result.ok) throw new Error(result.error ?? "privileged helper refused");
+		} else {
+			const plan = planFor(manager, packageName);
+			for (const [command, args] of plan.steps) await rt.run(command, args);
+		}
 	} catch (err) {
 		logger.warn("system dependency install failed — the addon loads, its capability must refuse", { meta: {
 			addonId,