@camstack/system 1.2.222 → 1.2.224

package/dist/{dist-0sWJNwme.js → dist-DdRxWA7g.js}

@@ -3384,8 +3384,23 @@ function errMsg(err) {
 	if (typeof err === "string") return err;
 	return String(err);
 }
-//#endregion
-//#region ../types/dist/index.mjs
+new Set([
+	"track",
+	"summary",
+	"face",
+	"identity",
+	"plate",
+	"vehicle",
+	"scene",
+	"motion",
+	"object",
+	"audio"
+]);
+new Set([
+	"motion",
+	"object",
+	"audio"
+]);
 /**
 * Shared video / audio encode profile schemas used by every consumer
 * that asks the stream broker to spawn a derived stream
@@ -10085,8 +10100,17 @@ var settingsStoreCapability = {
 		insert: method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
-			record: SettingsRecordSchema
-		}), zod.z.void(), { kind: "mutation" }),
+			record: zod.z.object({
+				id: zod.z.string().optional(),
+				data: zod.z.record(zod.z.string(), zod.z.unknown())
+			})
+		}), zod.z.object({ 
+		/**
+		* The id the row ACTUALLY got (D473): the one supplied, the UUID minted
+		* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
+		* primary key — which is the only place an auto key is knowable.
+		*/
+id: zod.z.union([zod.z.string(), zod.z.number()]) }), { kind: "mutation" }),
 		/**
 		* Insert MANY records in ONE transaction, returning how many landed.
 		*
@@ -10347,8 +10371,17 @@ var dataStoreProviderCapability = {
 		insert: method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
-			record: SettingsRecordSchema
-		}), zod.z.void(), {
+			record: zod.z.object({
+				id: zod.z.string().optional(),
+				data: zod.z.record(zod.z.string(), zod.z.unknown())
+			})
+		}), zod.z.object({ 
+		/**
+		* The id the row ACTUALLY got (D473): the one supplied, the UUID minted
+		* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
+		* primary key — which is the only place an auto key is knowable.
+		*/
+id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
@@ -18586,7 +18619,20 @@ var TrackSchema = zod.z.object({
 	...TrackRetrainFields
 });
 var BaseEventFields = {
-	id: zod.z.string(),
+	/**
+	* A SQLite ROWID, assigned by the database (D474).
+	*
+	* Was a 36-character UUID and cost 263 MB of a 1 117 MB database — paid
+	* TWICE per row, in the row and in the primary-key index, across 2.1 million
+	* motion, audio and object events. An `INTEGER PRIMARY KEY` in SQLite **is**
+	* the rowid: the table itself is that B-tree, so the index stops existing
+	* rather than getting smaller. No shorter string does that.
+	*
+	* Defined once here for all three event kinds, which is why they move
+	* together: a per-table migration would have forked this and
+	* `COMMON_BASE_COLUMNS` and reunited them two stages later.
+	*/
+	id: zod.z.number().int(),
 	deviceId: zod.z.number(),
 	timestamp: zod.z.number()
 };
@@ -18605,7 +18651,34 @@ var MotionEventSchema = zod.z.object({
 	/** Omitted in slim projection. */
 	frameHeight: zod.z.number().optional(),
 	/** Populated by B5 (recording playback URL for this event). */
-	mediaUrl: zod.z.string().optional()
+	mediaUrl: zod.z.string().optional(),
+	/**
+	* One row per motion EPISODE, not one per push (D475). `null` while the
+	* episode is still open — a further rising edge extends it in place rather
+	* than inserting a new row. Set once, at close, to `lastOnAt - startedAt`
+	* (the span from the first rising edge to the LAST one, deliberately NOT
+	* `closedAt - startedAt` — the close delay is a quiet CONFIRMATION, not
+	* movement, and folding it in would report `MOTION_CLOSE_AFTER_MS` of
+	* motion for an instantaneous trigger).
+	*
+	* **Absent** (not merely `null`) on a row written before D475 — that means
+	* "closed the old way, before this column existed", never "still open".
+	* Nothing in this codebase may read an absent `durationMs` as an open
+	* episode; only `null` means open.
+	*/
+	durationMs: zod.z.number().nullable().optional(),
+	/**
+	* Ms offsets from `timestamp` (the episode's own first rising edge, so the
+	* first entry is always `0`) of every genuine off→on transition the
+	* episode saw — "ogni evento on si deve salvare" (D475). NOT one entry per
+	* push: a firmware source that keepalives at ~1 Hz for the whole burst
+	* (Reolink, Hikvision) produces exactly one edge; a source that reports an
+	* explicit `false` mid-episode and then resumes before the quiet window
+	* elapses produces another. Stored compactly — see `motion-edge-codec.ts`
+	* — and decoded back to this shape on read. Absent/empty on a legacy row,
+	* which must never be read as "no episode happened here".
+	*/
+	edges: zod.z.array(zod.z.number()).readonly().optional()
 });
 /**
 * Which detection SOURCE produced an object event. `pipeline` = the ML
@@ -18668,6 +18741,23 @@ var ObjectEventSchema = zod.z.object({
 	* includes it (it is light). Absent on rows written before this field.
 	*/
 	frameId: zod.z.string().optional(),
+	/**
+	* A PRODUCER-chosen key that makes a synthetic event's emission idempotent
+	* (D474).
+	*
+	* Only the package detector writes it, and it exists because the event id
+	* stopped being choosable: the delivery and pick-up rows used to BE their
+	* dedupe key (`pa-pkg-<entryId>-delivered`), which is how "never emit a
+	* second delivery for this entry" survived a restart. An `INTEGER` rowid is
+	* assigned by SQLite, so that key had to move off the primary key rather
+	* than be dropped — a detector that cannot recognise its own row re-delivers
+	* every parcel on every boot.
+	*
+	* Absent on every other object event, and on every row written before this
+	* field. Never a substitute for `id`: it is unique per (producer, occasion),
+	* not per row, and nothing addresses a row by it.
+	*/
+	idempotencyKey: zod.z.string().optional(),
 	/** Omitted in slim projection. */
 	trackId: zod.z.string().optional(),
 	className: zod.z.string(),
@@ -29325,26 +29415,59 @@ authKey: zod.z.string().optional() }), zod.z.object({
 		}), { kind: "mutation" })
 	}
 };
-/**
-* Hardware / firmware motion sensor cap — binary detected state plus
-* a timestamp of the last observation. Distinct from
-* `motion-detection.cap.ts` which owns the LOCAL ML motion pipeline;
-* `motion` is the lightweight readout from on-camera motion (Reolink
-* `GetMdState`, Baichuan push `type: motion`, ONVIF analytics).
-*
-* Native-motion providers also fan out to `detection.camera-native`
-* with `source: 'onboard'` so cross-cutting system services
-* (alert-center, advanced-notifier) can subscribe once and receive
-* motion from every camera.
-*/
 var MotionStatusSchema = zod.z.object({
 	detected: zod.z.boolean(),
 	/** Ms epoch of the last detected-true observation. Null if never detected. */
 	lastDetectedAt: zod.z.number().nullable(),
 	/**
-	* Ms after which `detected` auto-reverts to false if no fresh push
-	* arrives. Null means the provider leaves detected state until a
-	* native "clear" event.
+	* `MOTION_CLOSE_AFTER_MS` while `detected: true` on a `Camera` device,
+	* `null` while false and on every `Sensor` device (D475) — see that
+	* constant's doc for the one-authority rule.
+	*
+	* ## Reading this field still arms nothing
+	*
+	* It reads like an instruction to the consumer ("revert after N ms if
+	* no fresh push arrives") and it is not one: nothing in this repo reads
+	* the LIVE cap value to drive a timer. `pipeline-analytics`'s motion-episode
+	* close DOES now use the same number — `MOTION_CLOSE_AFTER_MS` — but as an
+	* imported constant, not as a read of `device.state.motion.value`, so this
+	* field stays what it always was: DESCRIPTIVE output, mirroring an answer
+	* computed elsewhere. Building a self-clear timer out of a READ of this
+	* field would add a second falling-edge authority beside whichever one
+	* already owns the device, and two that can disagree are worse than one.
+	* Consumers that need a falling edge SHAPED differently — held open across
+	* a flapping source — debounce on their own side and say so, as
+	* `addon-export-alexa/src/motion-clear-hold.ts` and
+	* `addon-export-hap`'s `RESET_DEBOUNCE_MS` both do.
+	*
+	* ## Who writes it
+	*
+	* - **Cameras** — the runner's phase machine, `active → watching` on
+	*   `cooldown_expired`, which then writes this slice with
+	*   `detected: false` (`handlePhaseChanged` in
+	*   `pipeline-runner/index.ts`). It produces the FALLING edge, which
+	*   matters most for the sources that only ever push a rising one:
+	*   Reolink emits `MotionOnMotionChanged { detected: true }` and never
+	*   a false.
+	* - **Sensors** (Home Assistant binary sensors, Homematic) — the
+	*   provider pushes the false itself, from the upstream system's own
+	*   state change. No phase machine is involved.
+	*
+	* ### The phase machine is CANONICAL, not sole — and that is a defect
+	*
+	* An earlier revision of this docblock (mine, 2026-09-12) claimed the
+	* phase machine is the sole writer for a camera. It is not.
+	* `hikvision-camera.ts:3464` and `amcrest-camera.ts:445` both call
+	* `setCapSlice(motionCapability, …)` on their own rising edge, and
+	* Hikvision's comment says why: it read THIS docblock, agreed the
+	* runner is canonical, and wrote anyway to avoid per-tick churn. So
+	* two authorities can disagree about one slice, which this repo
+	* forbids, and the doc said otherwise — which is worse than saying
+	* nothing, because it reads as verification.
+	*
+	* This predates D475 and is not fixed there: the fix touches every
+	* camera provider. Recorded in D475's Consequences. Do not restore the
+	* "sole writer" wording without also removing the other writers.
 	*/
 	autoClearAfterMs: zod.z.number().nullable()
 });
@@ -29414,7 +29537,11 @@ onMotionChanged: { data: MotionOnMotionChangedDataSchema } },
 	*/
 	runtimeState: MotionStatusSchema,
 	/**
-	* Runtime-state durability: **session** — self-clearing by construction (`autoClearAfterMs`); a restored `detected: true` is a frozen event, and the next frame re-publishes the real one.
+	* Runtime-state durability: **session** — every writer of this slice
+	* writes only on an EDGE, so a restored `detected: true` would stay
+	* frozen until the next one instead of being corrected. The next edge
+	* re-publishes the real state. (On who the writers are, and why there
+	* is more than one, see `autoClearAfterMs` above.)
 	*
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.

package/dist/{dist-T9GvfhgV.mjs → dist-DmfYrdAn.mjs}

@@ -3384,8 +3384,23 @@ function errMsg(err) {
 	if (typeof err === "string") return err;
 	return String(err);
 }
-//#endregion
-//#region ../types/dist/index.mjs
+new Set([
+	"track",
+	"summary",
+	"face",
+	"identity",
+	"plate",
+	"vehicle",
+	"scene",
+	"motion",
+	"object",
+	"audio"
+]);
+new Set([
+	"motion",
+	"object",
+	"audio"
+]);
 /**
 * Shared video / audio encode profile schemas used by every consumer
 * that asks the stream broker to spawn a derived stream
@@ -10085,8 +10100,17 @@ var settingsStoreCapability = {
 		insert: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
-			record: SettingsRecordSchema
-		}), z.void(), { kind: "mutation" }),
+			record: z.object({
+				id: z.string().optional(),
+				data: z.record(z.string(), z.unknown())
+			})
+		}), z.object({ 
+		/**
+		* The id the row ACTUALLY got (D473): the one supplied, the UUID minted
+		* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
+		* primary key — which is the only place an auto key is knowable.
+		*/
+id: z.union([z.string(), z.number()]) }), { kind: "mutation" }),
 		/**
 		* Insert MANY records in ONE transaction, returning how many landed.
 		*
@@ -10347,8 +10371,17 @@ var dataStoreProviderCapability = {
 		insert: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
-			record: SettingsRecordSchema
-		}), z.void(), {
+			record: z.object({
+				id: z.string().optional(),
+				data: z.record(z.string(), z.unknown())
+			})
+		}), z.object({ 
+		/**
+		* The id the row ACTUALLY got (D473): the one supplied, the UUID minted
+		* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
+		* primary key — which is the only place an auto key is knowable.
+		*/
+id: z.union([z.string(), z.number()]) }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
@@ -18586,7 +18619,20 @@ var TrackSchema = z.object({
 	...TrackRetrainFields
 });
 var BaseEventFields = {
-	id: z.string(),
+	/**
+	* A SQLite ROWID, assigned by the database (D474).
+	*
+	* Was a 36-character UUID and cost 263 MB of a 1 117 MB database — paid
+	* TWICE per row, in the row and in the primary-key index, across 2.1 million
+	* motion, audio and object events. An `INTEGER PRIMARY KEY` in SQLite **is**
+	* the rowid: the table itself is that B-tree, so the index stops existing
+	* rather than getting smaller. No shorter string does that.
+	*
+	* Defined once here for all three event kinds, which is why they move
+	* together: a per-table migration would have forked this and
+	* `COMMON_BASE_COLUMNS` and reunited them two stages later.
+	*/
+	id: z.number().int(),
 	deviceId: z.number(),
 	timestamp: z.number()
 };
@@ -18605,7 +18651,34 @@ var MotionEventSchema = z.object({
 	/** Omitted in slim projection. */
 	frameHeight: z.number().optional(),
 	/** Populated by B5 (recording playback URL for this event). */
-	mediaUrl: z.string().optional()
+	mediaUrl: z.string().optional(),
+	/**
+	* One row per motion EPISODE, not one per push (D475). `null` while the
+	* episode is still open — a further rising edge extends it in place rather
+	* than inserting a new row. Set once, at close, to `lastOnAt - startedAt`
+	* (the span from the first rising edge to the LAST one, deliberately NOT
+	* `closedAt - startedAt` — the close delay is a quiet CONFIRMATION, not
+	* movement, and folding it in would report `MOTION_CLOSE_AFTER_MS` of
+	* motion for an instantaneous trigger).
+	*
+	* **Absent** (not merely `null`) on a row written before D475 — that means
+	* "closed the old way, before this column existed", never "still open".
+	* Nothing in this codebase may read an absent `durationMs` as an open
+	* episode; only `null` means open.
+	*/
+	durationMs: z.number().nullable().optional(),
+	/**
+	* Ms offsets from `timestamp` (the episode's own first rising edge, so the
+	* first entry is always `0`) of every genuine off→on transition the
+	* episode saw — "ogni evento on si deve salvare" (D475). NOT one entry per
+	* push: a firmware source that keepalives at ~1 Hz for the whole burst
+	* (Reolink, Hikvision) produces exactly one edge; a source that reports an
+	* explicit `false` mid-episode and then resumes before the quiet window
+	* elapses produces another. Stored compactly — see `motion-edge-codec.ts`
+	* — and decoded back to this shape on read. Absent/empty on a legacy row,
+	* which must never be read as "no episode happened here".
+	*/
+	edges: z.array(z.number()).readonly().optional()
 });
 /**
 * Which detection SOURCE produced an object event. `pipeline` = the ML
@@ -18668,6 +18741,23 @@ var ObjectEventSchema = z.object({
 	* includes it (it is light). Absent on rows written before this field.
 	*/
 	frameId: z.string().optional(),
+	/**
+	* A PRODUCER-chosen key that makes a synthetic event's emission idempotent
+	* (D474).
+	*
+	* Only the package detector writes it, and it exists because the event id
+	* stopped being choosable: the delivery and pick-up rows used to BE their
+	* dedupe key (`pa-pkg-<entryId>-delivered`), which is how "never emit a
+	* second delivery for this entry" survived a restart. An `INTEGER` rowid is
+	* assigned by SQLite, so that key had to move off the primary key rather
+	* than be dropped — a detector that cannot recognise its own row re-delivers
+	* every parcel on every boot.
+	*
+	* Absent on every other object event, and on every row written before this
+	* field. Never a substitute for `id`: it is unique per (producer, occasion),
+	* not per row, and nothing addresses a row by it.
+	*/
+	idempotencyKey: z.string().optional(),
 	/** Omitted in slim projection. */
 	trackId: z.string().optional(),
 	className: z.string(),
@@ -29325,26 +29415,59 @@ authKey: z.string().optional() }), z.object({
 		}), { kind: "mutation" })
 	}
 };
-/**
-* Hardware / firmware motion sensor cap — binary detected state plus
-* a timestamp of the last observation. Distinct from
-* `motion-detection.cap.ts` which owns the LOCAL ML motion pipeline;
-* `motion` is the lightweight readout from on-camera motion (Reolink
-* `GetMdState`, Baichuan push `type: motion`, ONVIF analytics).
-*
-* Native-motion providers also fan out to `detection.camera-native`
-* with `source: 'onboard'` so cross-cutting system services
-* (alert-center, advanced-notifier) can subscribe once and receive
-* motion from every camera.
-*/
 var MotionStatusSchema = z.object({
 	detected: z.boolean(),
 	/** Ms epoch of the last detected-true observation. Null if never detected. */
 	lastDetectedAt: z.number().nullable(),
 	/**
-	* Ms after which `detected` auto-reverts to false if no fresh push
-	* arrives. Null means the provider leaves detected state until a
-	* native "clear" event.
+	* `MOTION_CLOSE_AFTER_MS` while `detected: true` on a `Camera` device,
+	* `null` while false and on every `Sensor` device (D475) — see that
+	* constant's doc for the one-authority rule.
+	*
+	* ## Reading this field still arms nothing
+	*
+	* It reads like an instruction to the consumer ("revert after N ms if
+	* no fresh push arrives") and it is not one: nothing in this repo reads
+	* the LIVE cap value to drive a timer. `pipeline-analytics`'s motion-episode
+	* close DOES now use the same number — `MOTION_CLOSE_AFTER_MS` — but as an
+	* imported constant, not as a read of `device.state.motion.value`, so this
+	* field stays what it always was: DESCRIPTIVE output, mirroring an answer
+	* computed elsewhere. Building a self-clear timer out of a READ of this
+	* field would add a second falling-edge authority beside whichever one
+	* already owns the device, and two that can disagree are worse than one.
+	* Consumers that need a falling edge SHAPED differently — held open across
+	* a flapping source — debounce on their own side and say so, as
+	* `addon-export-alexa/src/motion-clear-hold.ts` and
+	* `addon-export-hap`'s `RESET_DEBOUNCE_MS` both do.
+	*
+	* ## Who writes it
+	*
+	* - **Cameras** — the runner's phase machine, `active → watching` on
+	*   `cooldown_expired`, which then writes this slice with
+	*   `detected: false` (`handlePhaseChanged` in
+	*   `pipeline-runner/index.ts`). It produces the FALLING edge, which
+	*   matters most for the sources that only ever push a rising one:
+	*   Reolink emits `MotionOnMotionChanged { detected: true }` and never
+	*   a false.
+	* - **Sensors** (Home Assistant binary sensors, Homematic) — the
+	*   provider pushes the false itself, from the upstream system's own
+	*   state change. No phase machine is involved.
+	*
+	* ### The phase machine is CANONICAL, not sole — and that is a defect
+	*
+	* An earlier revision of this docblock (mine, 2026-09-12) claimed the
+	* phase machine is the sole writer for a camera. It is not.
+	* `hikvision-camera.ts:3464` and `amcrest-camera.ts:445` both call
+	* `setCapSlice(motionCapability, …)` on their own rising edge, and
+	* Hikvision's comment says why: it read THIS docblock, agreed the
+	* runner is canonical, and wrote anyway to avoid per-tick churn. So
+	* two authorities can disagree about one slice, which this repo
+	* forbids, and the doc said otherwise — which is worse than saying
+	* nothing, because it reads as verification.
+	*
+	* This predates D475 and is not fixed there: the fix touches every
+	* camera provider. Recorded in D475's Consequences. Do not restore the
+	* "sole writer" wording without also removing the other writers.
 	*/
 	autoClearAfterMs: z.number().nullable()
 });
@@ -29414,7 +29537,11 @@ onMotionChanged: { data: MotionOnMotionChangedDataSchema } },
 	*/
 	runtimeState: MotionStatusSchema,
 	/**
-	* Runtime-state durability: **session** — self-clearing by construction (`autoClearAfterMs`); a restored `detected: true` is a frozen event, and the next frame re-publishes the real one.
+	* Runtime-state durability: **session** — every writer of this slice
+	* writes only on an EDGE, so a restored `detected: true` would stay
+	* frozen until the next one instead of being corrected. The next edge
+	* re-publishes the real state. (On who the writers are, and why there
+	* is more than one, see `autoClearAfterMs` above.)
 	*
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-0sWJNwme.js");
+const require_dist = require("./dist-DdRxWA7g.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -27,9 +27,9 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-CAsHdMwP.js");
 const require_tls$1 = require("./tls-BFs4PzoW.js");
-const require_manifest_system_deps = require("./manifest-system-deps-YYKKCKSF.js");
+const require_manifest_system_deps = require("./manifest-system-deps-8x1jgPz_.js");
 const require_resource_monitor = require("./resource-monitor-LVE1BoLs.js");
-const require_custom_action_registry = require("./custom-action-registry-DvVMHLfJ.js");
+const require_custom_action_registry = require("./custom-action-registry-BTB-LgGN.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { A as addonSettingsCapability, Dt as procedureAuthKey, Ft as scopesAllowDeviceCap, Jt as errMsg$1, Mt as resolveMethodAuth, Pt as scopesAllowAddon, Qt as DEVICE_STATUS_METHOD, Xt as DATAPLANE_SECRET_HEADER$1, Zt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, _ as RUNTIME_DEFAULTS, _n as readinessKey, _t as logLevelAtMost, an as asJsonObject$1, at as isArrayOutputSchema, cn as createEvent, ct as isObjectInput, dn as expandCapMethods, dt as isVoidInput, ft as kebabToCamel, gn as parseJsonUnknown, h as METHOD_ACCESS_MAP, hn as parseJsonObject, ln as emitDownForOwnedCaps, mt as lifecycleJobSchema, nn as ReadinessRegistry, on as asNumber, ot as isCollectionArrayMethod, p as LOG_LEVEL_RANK, rn as ReadinessTimeoutError, sn as asString$1, t as ALL_CAPABILITY_DEFINITIONS, tt as extractNestedAddonId, vn as resolveCapMount, vt as looseSchema, wt as objectInputDeclaresAddonId, xn as EventCategory$1, yn as scopeKey } from "./dist-T9GvfhgV.mjs";
+import { A as addonSettingsCapability, Dt as procedureAuthKey, Ft as scopesAllowDeviceCap, Jt as errMsg$1, Mt as resolveMethodAuth, Pt as scopesAllowAddon, Qt as DEVICE_STATUS_METHOD, Xt as DATAPLANE_SECRET_HEADER$1, Zt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, _ as RUNTIME_DEFAULTS, _n as readinessKey, _t as logLevelAtMost, an as asJsonObject$1, at as isArrayOutputSchema, cn as createEvent, ct as isObjectInput, dn as expandCapMethods, dt as isVoidInput, ft as kebabToCamel, gn as parseJsonUnknown, h as METHOD_ACCESS_MAP, hn as parseJsonObject, ln as emitDownForOwnedCaps, mt as lifecycleJobSchema, nn as ReadinessRegistry, on as asNumber, ot as isCollectionArrayMethod, p as LOG_LEVEL_RANK, rn as ReadinessTimeoutError, sn as asString$1, t as ALL_CAPABILITY_DEFINITIONS, tt as extractNestedAddonId, vn as resolveCapMount, vt as looseSchema, wt as objectInputDeclaresAddonId, xn as EventCategory$1, yn as scopeKey } from "./dist-DmfYrdAn.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -26,9 +26,9 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { _ as fetchJson, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, f as collectModelFiles, g as ensureModel, h as downloadModel, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as downloadFile, n as STALL_TICK_MS, o as contentTypeFor, p as deleteModelFromDisk, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as getModelFilePath, y as isModelDownloaded } from "./event-loop-stall-monitor-GPrVvx14.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-2xbgg78V.mjs";
-import { $ as buildUdsNativeCapProxy, $t as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, A as createUdsLoggerWithControl, An as sampleSocketDirection, At as HUB_MAIN_RSS_BUDGET_MB, B as readMoleculerFanoutMode, Bn as EVENT_PLANE_TOP_N, Bt as createV8Reclaimer, C as ipcParentLink, Cn as createSocketPlaneReader, Ct as createAddonDataPlaneFacility, D as createUdsEventBus, Dn as EMPTY_SOCKET_DIRECTION, Dt as HEAP_WATCH_INTERVAL_MS, E as createUdsEventBridge, En as readSocketQueues, Et as HEAP_RECLAIM_TRIGGER_MB, F as CapRouteError, Fn as EMPTY_CAP_ACTION_READING, Ft as RUNNER_RSS_BUDGET_ENV, G as createLocalTransport, Gt as reclaimIntervalMs, H as PARENT_ROUTED_PROVIDER_ADDON_ID, Hn as createEventPlaneReader, Ht as hubMainRssBudget, I as classifyCapRoute, In as MAX_CAP_ACTIONS_PER_PEER, It as ZERO_LOOP_DELAY, J as SocketChannel, Jt as startRunnerHeapWatch, K as UdsLocalTransportClient, Kt as shouldReclaim, L as LocalChildClient, Ln as capActionLabel, Lt as buildHeapSample, M as AGENT_CAP_FWD_SERVICE, Mn as socketDirectionMessages, Mt as RSS_BUDGET_REANNOUNCE_MIN_MS, N as CapRouteResolver, Nn as CAP_ACTION_OVERFLOW_LABEL, Nt as RSS_BUDGET_RELEASE_RATIO, O as udsChildLogToWorkerEntry, On as createSocketDirectionCounters, Ot as HEAP_WATCH_WARN_RATIO, P as callWithServiceDiscovery, Pn as CAP_ACTION_UNLABELLED, Pt as RUNNER_HEAP_WATCH_INTERVAL_MS, Q as buildNativeCapProxy, Qt as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, R as LocalChildRegistry, Rn as createCapActionCensus, Rt as createDeferredHeapWatchSink, S as buildLinkChain, Sn as createSocketPlaneMeter, St as runNpm, T as createParentUnownedCallHandler, Tn as formatSocketPlane, Tt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, U as __resetCapUsageRegistryForTests, Un as diffEventPlane, Ut as nextRssBudgetState, V as CapUsageRegistry, Vn as createEventPlaneMeter, Vt as describeRss, W as getCapUsageRegistry, Wn as formatEventPlane, Wt as parseRssBudgetMb, X as FrameDecoder, Xt as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, Y as localEndpointPath, Yt as strandedMb, Z as encodeFrame, Zt as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, _ as AddonDepsManager, _n as createMeshQueueReader, _t as CapabilityUnavailableError, a as createUdsAddonContext, an as HEAP_SPACE_REPORT_MIN_MB, at as createAddonService, b as brokerCallForCap, bn as SOCKET_PLANE_TOP_N, bt as resolveAddonClass, c as getOrInitReadinessRegistryForClient, cn as heapSpaceField, ct as capActionName, d as clusterEventTopic, dn as OUTBOUND_QUEUE_COOLDOWN_MS, dt as capServiceName, en as createArrayBufferCensusGate, et as createBrokerDeviceManagerApi, f as getBrokerEventBus, fn as OUTBOUND_QUEUE_SUSTAIN_MS, ft as parseCapAction, g as subscribePassthrough, gn as MESH_QUEUE_TOP_N, gt as CapabilityHandle, h as setNodeEventInterest, hn as formatOutboundQueueVerdict, ht as DeviceRegistry, i as createAddonContext, in as DECISIVE_HEAP_SPACES, j as AGENT_CAP_FWD_ACTION, jn as socketDirectionBytes, jt as HUB_RSS_BUDGET_ENV, k as createUdsLogger, kn as recordSocketFrame, kt as HUB_MAIN_HEAP_WATCH_LABEL, l as setHubConnected, ln as readHeapSpaces, lt as capActionSuffix, m as registerEventBusService, mn as createOutboundQueueGate, mt as serializeTypedArrays, n as installManifestPythonDeps, nn as formatArrayBufferCensus, o as getWorkerDeviceRegistry, on as emitHeapDiagnosticReport, ot as validateProviderRegistrations, p as getMoleculerEventStats, pn as OUTBOUND_QUEUE_THRESHOLD_BYTES, pt as deserializeTypedArrays, q as UdsLocalTransportServer, qt as startHeapWatch, r as adaptBrokerToCluster, rn as isArrayBufferCensusReport, rt as mountNativeCapService, s as getOrInitReadinessRegistry, sn as formatHeapSpaces, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestSystemDeps, tn as createInspectorArrayBufferCensus, u as EVENT_TOPIC_PREFIX, un as selectReportedSpaces, ut as capBareAction, v as createKernelHwAccel, vn as formatMeshQueue, vt as copyBundledNativeModules, w as localProviderLink, wn as diffSocketPlane, wt as HEAP_RECLAIM_MIN_INTERVAL_MS, x as brokerTransportLink, xn as SOCKET_QUEUE_TOP_N, xt as resolveNpmInvocation, y as resolveHwAccel, yn as EMPTY_SOCKET_PLANE_BASELINE, yt as installManifestNativeDeps, z as UDS_NO_ROUTE_PREFIX, zn as diffCapActionCensus, zt as createLoopDelayMeter } from "./manifest-system-deps-D4cmEnqQ.mjs";
+import { $ as buildUdsNativeCapProxy, $t as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, A as createUdsLoggerWithControl, An as sampleSocketDirection, At as HUB_MAIN_RSS_BUDGET_MB, B as readMoleculerFanoutMode, Bn as EVENT_PLANE_TOP_N, Bt as createV8Reclaimer, C as ipcParentLink, Cn as createSocketPlaneReader, Ct as createAddonDataPlaneFacility, D as createUdsEventBus, Dn as EMPTY_SOCKET_DIRECTION, Dt as HEAP_WATCH_INTERVAL_MS, E as createUdsEventBridge, En as readSocketQueues, Et as HEAP_RECLAIM_TRIGGER_MB, F as CapRouteError, Fn as EMPTY_CAP_ACTION_READING, Ft as RUNNER_RSS_BUDGET_ENV, G as createLocalTransport, Gt as reclaimIntervalMs, H as PARENT_ROUTED_PROVIDER_ADDON_ID, Hn as createEventPlaneReader, Ht as hubMainRssBudget, I as classifyCapRoute, In as MAX_CAP_ACTIONS_PER_PEER, It as ZERO_LOOP_DELAY, J as SocketChannel, Jt as startRunnerHeapWatch, K as UdsLocalTransportClient, Kt as shouldReclaim, L as LocalChildClient, Ln as capActionLabel, Lt as buildHeapSample, M as AGENT_CAP_FWD_SERVICE, Mn as socketDirectionMessages, Mt as RSS_BUDGET_REANNOUNCE_MIN_MS, N as CapRouteResolver, Nn as CAP_ACTION_OVERFLOW_LABEL, Nt as RSS_BUDGET_RELEASE_RATIO, O as udsChildLogToWorkerEntry, On as createSocketDirectionCounters, Ot as HEAP_WATCH_WARN_RATIO, P as callWithServiceDiscovery, Pn as CAP_ACTION_UNLABELLED, Pt as RUNNER_HEAP_WATCH_INTERVAL_MS, Q as buildNativeCapProxy, Qt as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, R as LocalChildRegistry, Rn as createCapActionCensus, Rt as createDeferredHeapWatchSink, S as buildLinkChain, Sn as createSocketPlaneMeter, St as runNpm, T as createParentUnownedCallHandler, Tn as formatSocketPlane, Tt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, U as __resetCapUsageRegistryForTests, Un as diffEventPlane, Ut as nextRssBudgetState, V as CapUsageRegistry, Vn as createEventPlaneMeter, Vt as describeRss, W as getCapUsageRegistry, Wn as formatEventPlane, Wt as parseRssBudgetMb, X as FrameDecoder, Xt as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, Y as localEndpointPath, Yt as strandedMb, Z as encodeFrame, Zt as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, _ as AddonDepsManager, _n as createMeshQueueReader, _t as CapabilityUnavailableError, a as createUdsAddonContext, an as HEAP_SPACE_REPORT_MIN_MB, at as createAddonService, b as brokerCallForCap, bn as SOCKET_PLANE_TOP_N, bt as resolveAddonClass, c as getOrInitReadinessRegistryForClient, cn as heapSpaceField, ct as capActionName, d as clusterEventTopic, dn as OUTBOUND_QUEUE_COOLDOWN_MS, dt as capServiceName, en as createArrayBufferCensusGate, et as createBrokerDeviceManagerApi, f as getBrokerEventBus, fn as OUTBOUND_QUEUE_SUSTAIN_MS, ft as parseCapAction, g as subscribePassthrough, gn as MESH_QUEUE_TOP_N, gt as CapabilityHandle, h as setNodeEventInterest, hn as formatOutboundQueueVerdict, ht as DeviceRegistry, i as createAddonContext, in as DECISIVE_HEAP_SPACES, j as AGENT_CAP_FWD_ACTION, jn as socketDirectionBytes, jt as HUB_RSS_BUDGET_ENV, k as createUdsLogger, kn as recordSocketFrame, kt as HUB_MAIN_HEAP_WATCH_LABEL, l as setHubConnected, ln as readHeapSpaces, lt as capActionSuffix, m as registerEventBusService, mn as createOutboundQueueGate, mt as serializeTypedArrays, n as installManifestPythonDeps, nn as formatArrayBufferCensus, o as getWorkerDeviceRegistry, on as emitHeapDiagnosticReport, ot as validateProviderRegistrations, p as getMoleculerEventStats, pn as OUTBOUND_QUEUE_THRESHOLD_BYTES, pt as deserializeTypedArrays, q as UdsLocalTransportServer, qt as startHeapWatch, r as adaptBrokerToCluster, rn as isArrayBufferCensusReport, rt as mountNativeCapService, s as getOrInitReadinessRegistry, sn as formatHeapSpaces, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestSystemDeps, tn as createInspectorArrayBufferCensus, u as EVENT_TOPIC_PREFIX, un as selectReportedSpaces, ut as capBareAction, v as createKernelHwAccel, vn as formatMeshQueue, vt as copyBundledNativeModules, w as localProviderLink, wn as diffSocketPlane, wt as HEAP_RECLAIM_MIN_INTERVAL_MS, x as brokerTransportLink, xn as SOCKET_QUEUE_TOP_N, xt as resolveNpmInvocation, y as resolveHwAccel, yn as EMPTY_SOCKET_PLANE_BASELINE, yt as installManifestNativeDeps, z as UDS_NO_ROUTE_PREFIX, zn as diffCapActionCensus, zt as createLoopDelayMeter } from "./manifest-system-deps-BhYmLVHw.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Vp0bPV3U.mjs";
-import { t as CustomActionRegistry } from "./custom-action-registry-DvtOs-tp.mjs";
+import { t as CustomActionRegistry } from "./custom-action-registry-CdLp1P9C.mjs";
 import { z } from "zod";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
@@ -48,7 +48,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { EventEmitter } from "node:events";
 import As from "node:stream";
 import { StringDecoder } from "node:string_decoder";
-import { lstatSync, readdir as readdir$1, readdirSync, readlinkSync, realpathSync } from "fs";
+import { lstatSync, readdir as readdir$1, readdirSync as readdirSync$1, readlinkSync, realpathSync } from "fs";
 import "path";
 import { createRequire } from "module";
 //#region src/addon/addon-api-factory.ts
@@ -92203,7 +92203,7 @@ while (this[Le](this[Ft]()) && this[C].length);
 }, wt = {
 	lstatSync,
 	readdir: readdir$1,
-	readdirSync,
+	readdirSync: readdirSync$1,
 	readlinkSync,
 	realpathSync: realpathSync.native,
 	promises: {

package/dist/kernel/heap-watch.d.ts

@@ -4,6 +4,7 @@ import { MeshPeerQueue, MeshQueueReader } from './moleculer/mesh-queue-report.js
 import { OutboundQueueGateOptions, OutboundQueueReading } from './outbound-queue-watch.js';
 import { HeapSpaceReader } from './heap-spaces.js';
 import { NodeGcObserver } from './gc-census.js';
+import { TaskTicks } from './process-cpu-census.js';
 import { ArrayBufferCensus, ArrayBufferCensusGateOptions } from './array-buffer-census.js';
 /**
  * What hub-main calls itself in a `[mem]` line.
@@ -641,6 +642,19 @@ export interface HeapWatchProbes {
      * sequence of collections can be posed; nothing in production passes one.
      */
     readonly gcObserver?: NodeGcObserver;
+    /**
+     * How this process reads its own CPU. Defaults to the real
+     * `process.cpuUsage()` and the real `/proc/self/task`, for EVERY process —
+     * `docker stats` reports the cgroup, and nothing on any line said what share
+     * of it this process was (see `process-cpu-census.ts`). A spec passes its own
+     * so a cost can be posed; nothing in production passes one.
+     */
+    readonly processCpu?: ProcessCpuProbe;
+}
+/** The two readings `process-cpu-census.ts` needs, injectable for a spec. */
+export interface ProcessCpuProbe {
+    readonly cpuUsageUs: () => number;
+    readonly readTasks: () => readonly TaskTicks[] | null;
 }
 /** How the census is wired: the census itself plus the gate's thresholds. */
 export interface ArrayBufferCensusProbe extends ArrayBufferCensusGateOptions {

package/dist/kernel/process-cpu-census.d.ts

@@ -0,0 +1,74 @@
+/**
+ * A window shorter than this is not answered. Same rule and same reason as
+ * `GC_CENSUS_MIN_WINDOW_MS`: the boot line spans milliseconds, and a percentage
+ * computed over it is noise wearing a decimal point. The unread interval is
+ * KEPT, so the next line describes it rather than losing it (D393 applied to a
+ * rate, as D458 part 3 put it).
+ */
+export declare const PROCESS_CPU_MIN_WINDOW_MS = 1000;
+/** One thread's cumulative scheduled time, in whatever unit `/proc` counts. */
+export interface TaskTicks {
+    /** The thread name — `MainThread`, `V8Worker`, `libuv-worker`, … */
+    readonly comm: string;
+    /** Cumulative `utime + stime` for this thread. Units never leave this module. */
+    readonly ticks: number;
+}
+/** What V8's background threads cost, when the platform let us find out. */
+export interface V8WorkerCpu {
+    /** Percent of ONE core, over the same window as the process reading. */
+    readonly percentOfCore: number;
+    /** How many threads that is spread over — 4 is the usual platform pool. */
+    readonly threads: number;
+}
+export interface ProcessCpuReading {
+    /** Percent of ONE core this process used across the window. */
+    readonly percentOfCore: number;
+    readonly windowMs: number;
+    /**
+     * `null` means UNKNOWN — not zero. Off Linux, or with `/proc` unreadable, or
+     * when the thread deltas cannot describe an interval, there is no reading,
+     * and the line says nothing rather than printing a zero somebody will quote.
+     */
+    readonly v8Workers: V8WorkerCpu | null;
+}
+export interface ProcessCpuCensus {
+    /** The window since the last read that ANSWERED. `null` when too short. */
+    read(at: number): ProcessCpuReading | null;
+}
+export interface ProcessCpuCensusOptions {
+    /** Cumulative user+system CPU for the whole process, in microseconds. */
+    readonly cpuUsageUs: () => number;
+    /** Per-thread cumulative ticks, or `null` when the platform cannot say. */
+    readonly readTasks: () => readonly TaskTicks[] | null;
+    readonly startedAt: number;
+}
+/**
+ * The census. Always exists — `process.cpuUsage()` is available on every
+ * platform Node runs on, so unlike the GC census there is no runtime in which
+ * this has nothing to report.
+ */
+export declare function createProcessCpuCensus(options: ProcessCpuCensusOptions): ProcessCpuCensus;
+/**
+ * Per-thread ticks for THIS process, or `null` where that cannot be read.
+ *
+ * `/proc/self/task/<tid>/stat` is `pid (comm) state ppid …`, and `comm` may
+ * itself contain spaces and parentheses — so the split is on the LAST `)`,
+ * never on whitespace. `utime` and `stime` are the 12th and 13th fields after
+ * it. Everything that can fail is inside the try: a non-Linux platform, a
+ * container with `hidepid`, a thread that exits between the readdir and the
+ * read. A thread that vanishes mid-scan is skipped rather than failing the
+ * whole reading — it contributed to neither snapshot's total.
+ */
+export declare function readSelfTaskTicks(): readonly TaskTicks[] | null;
+/**
+ * The two fields, APPENDED LAST on the `[mem]` line — after everything D446,
+ * D456 and D458 appended, so every Loki prefix written since 2026-08-29 still
+ * matches (D446's rule).
+ *
+ * `procCpu` prints whenever there is a window, including at 0.0 %, because an
+ * idle process is a reading and it is the one that says a runner is alive and
+ * doing nothing. `v8WorkerCpu` is CONDITIONAL and its absence is the reading:
+ * the platform could not be asked. It carries its thread count because "36.6 %
+ * over four threads" and "36.6 % on one" are different faults.
+ */
+export declare function formatProcessCpu(reading: ProcessCpuReading | null | undefined): string;