@camstack/system 1.2.231 → 1.2.233

package/dist/{dist-DUSfUAgz.js → dist-D3lJV9M7.js}

@@ -1,5 +1,5 @@
 let zod = require("zod");
-//#region ../types/dist/event-category-ZyX6jcse.mjs
+//#region ../types/dist/event-category-BVDXG4tB.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -616,6 +616,20 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	* pull-reconcile from the provider's `getStatus` on reconnect. */
 	EventCategory["MeshNetworkChanged"] = "network.mesh.changed";
 	EventCategory["BackupCompleted"] = "backup.completed";
+	/**
+	* A whole backup RUN finished — every destination attempted, win or lose.
+	*
+	* `backup.completed` fires once per DESTINATION, which is the right grain for
+	* a progress UI and the wrong one for a notification: an operator with three
+	* destinations would be told three times. And a run where two of three
+	* destinations succeeded is not a clean success — a single "backup
+	* completed" that hid the failed one would be a lie, so the count of each is
+	* carried here and the message says both.
+	*
+	* Emitted by the backup orchestrator only after the destination loop, so a
+	* run that dies during the BUILD phase produces no completion at all.
+	*/
+	EventCategory["BackupRunCompleted"] = "backup.run-completed";
 	EventCategory["BackupRestored"] = "backup.restored";
 	EventCategory["NotificationDispatched"] = "notification.dispatched";
 	EventCategory["NotificationFailed"] = "notification.failed";
@@ -676,7 +690,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-DBKu2-U5.mjs
+//#region ../types/dist/sleep-BEyvfshj.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8486,6 +8500,72 @@ var cameraPipelineConfigCapability = {
 	exposesDeviceSettings: true,
 	methods: {}
 };
+/**
+* The signals a device can emit to WAKE its own stream.
+*
+* A camera whose stream is built on demand sleeps until something asks for it,
+* and "something" cannot be a consumer that is merely attached — a Frigate-style
+* puller holds a session open for ever, and treating that as demand would keep
+* a battery camera awake for ever, which is the whole thing the battery is for
+* (D173). So the wake has to come from the CAMERA: an event it noticed by
+* itself, with no stream running.
+*
+* ## The vocabulary is the PROVIDER'S, not ours
+*
+* Like `consumables`, this cap declares no vocabulary of its own. A provider
+* names each signal with a `code` it chooses and a `label` an operator reads.
+* Reolink offers motion and camera-native detection; another provider may offer
+* a tamper, a doorbell press, a PIR, or something no camera in this fleet has
+* yet. A fixed enum here would mean every new signal is a framework release.
+*
+* It is deliberately NOT derived from the caps a device already binds. Whether
+* a camera CAN push firmware motion is expressed by `motionSources` containing
+* `'onboard'`, and whether it does AI on-camera by the `native-object-detection`
+* binding — but both answer "what drives the detection pipeline", which is a
+* different question from "what may wake a sleeping stream". A camera can do
+* the first and not be trusted with the second, and the operator picks per
+* camera. Two questions, two authorities.
+*
+* ## Availability is not permission
+*
+* `listSignals` says what the device CAN emit. Whether a given signal actually
+* wakes the stream is the operator's per-camera choice, held by the broker
+* alongside the cooldown — see the stream-broker cap's wake settings. A
+* provider declaring a signal is not a provider enabling it.
+*/
+/** One signal a device can emit. */
+var StreamSignalSchema = zod.z.object({
+	/** Stable id chosen by the provider, e.g. `'motion'`, `'person'`, `'tamper'`. */
+	code: zod.z.string().min(1),
+	/** What an operator reads in the picker. The provider's own wording. */
+	label: zod.z.string().min(1),
+	/**
+	* Whether the provider recommends this signal ON when a camera is first set
+	* up. A provider knows which of its signals are cheap and reliable; an
+	* operator should not have to discover that by trial. Reolink recommends
+	* both of its own.
+	*/
+	recommended: zod.z.boolean()
+});
+var StreamSignalsStatusSchema = zod.z.object({
+	signals: zod.z.array(StreamSignalSchema),
+	lastFetchedAt: zod.z.number()
+});
+var streamSignalsCapability = {
+	name: "stream-signals",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: Object.values(DeviceType),
+	runtimeState: StreamSignalsStatusSchema,
+	methods: { 
+	/**
+	* What this device can emit. Empty is a valid and common answer — most
+	* cameras have nothing to offer here, and an empty list is what makes the
+	* broker's picker show nothing rather than a false choice.
+	*/
+listSignals: method(zod.z.void(), zod.z.array(StreamSignalSchema).readonly()) }
+};
 /** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
 var StreamFormatSchema = zod.z.enum([
 	"webrtc",
@@ -8895,6 +8975,46 @@ var streamBrokerCapability = {
 	mode: "singleton",
 	exposesDeviceSettings: true,
 	methods: {
+		/**
+		* A device reporting that one of ITS OWN signals just fired.
+		*
+		* The provider calls this; nothing polls. The broker then decides whether
+		* to wake the source, and the decision has two terms that must BOTH hold:
+		*
+		*  - the signal is ENABLED for this camera (the operator's per-camera
+		*    choice — a camera may declare a signal the operator does not want
+		*    waking anything), and
+		*  - a consumer is actually attached and waiting on the prestream. Waking
+		*    a camera nobody is watching is the one thing a battery camera must
+		*    never do, and a signal arriving with no consumer is exactly that.
+		*
+		* Reported, never inferred: a signal that fires while the stream is
+		* already up refreshes the hold instead of starting a second one, which is
+		* what makes continuous motion keep a camera awake without stacking
+		* timers.
+		*
+		* `code` is the provider's own, from `streamSignals.listSignals`. An
+		* unknown code is REFUSED rather than treated as a wildcard wake — a
+		* provider and an operator disagreeing about a name must not become a
+		* camera that wakes for everything.
+		*/
+		reportStreamSignal: method(zod.z.object({
+			deviceId: zod.z.number().int().nonnegative(),
+			/** The provider's signal code. */
+			code: zod.z.string().min(1),
+			/** Ms epoch. Absent ⇒ now. */
+			at: zod.z.number().optional()
+		}), zod.z.object({
+			/** Whether the broker acted on it, and if not, why. */
+			accepted: zod.z.boolean(),
+			reason: zod.z.enum([
+				"woke",
+				"hold-extended",
+				"not-enabled",
+				"no-consumer",
+				"unknown-code"
+			])
+		}), { kind: "mutation" }),
 		publishCameraStream: method(zod.z.object({
 			deviceId: zod.z.number().int().nonnegative(),
 			camStreamId: zod.z.string().min(1),
@@ -9372,6 +9492,16 @@ var PickStreamRequirementsSchema = zod.z.object({
 	acceptCodecs: zod.z.array(StreamCodecSchema).readonly().optional(),
 	/** Minimum vertical resolution. Streams shorter than this are dropped. */
 	minHeight: zod.z.number().int().positive().optional(),
+	/**
+	* Maximum vertical resolution. Streams TALLER than this are dropped.
+	*
+	* A consumer can have a ceiling as real as its floor: Alexa documents
+	* 480p to 1080p, and a 4K stream is as unusable to an Echo as a 360p one.
+	* Without this the ceiling had to be re-implemented by every caller — and
+	* one caller implementing it privately is how a second scoring authority
+	* gets born.
+	*/
+	maxHeight: zod.z.number().int().positive().optional(),
 	/** Minimum horizontal resolution. */
 	minWidth: zod.z.number().int().positive().optional(),
 	/**
@@ -9388,7 +9518,22 @@ var PickStreamRequirementsSchema = zod.z.object({
 	* transcoded" guard: if the device is already serving the consumer's
 	* codec end-to-end, there's nothing to optimise.
 	*/
-	requireSiblingCodec: zod.z.array(StreamCodecSchema).readonly().optional()
+	requireSiblingCodec: zod.z.array(StreamCodecSchema).readonly().optional(),
+	/**
+	* Whether a stream the consumer CANNOT decode may still be picked, on the
+	* understanding that it will be transcoded.
+	*
+	* Default `false` — today's behaviour, and the right one for a bypass
+	* question ("is there a stream I can forward untouched?"). Set `true` to
+	* ask the larger question: "what is the best stream for me, transcoding if
+	* I must?" A stream that satisfies `acceptCodecs` always outranks one that
+	* does not, so a passthrough is never lost to a transcode; the answer says
+	* which it is in {@link PickedCamStreamSchema.transcodes}.
+	*
+	* This is what lets one picker serve both the bypass and the full source
+	* choice, instead of a consumer scoring privately when the bypass misses.
+	*/
+	allowTranscode: zod.z.boolean().optional()
 }).readonly();
 var PickStreamPreferencesSchema = zod.z.object({
 	/**
@@ -9402,12 +9547,32 @@ var PickStreamPreferencesSchema = zod.z.object({
 	* picks the tallest stream; `'lowest'` picks the shortest (used by
 	* memory-constrained consumers / Apple Home guest sessions).
 	*/
-	resolutionPreference: zod.z.enum(["highest", "lowest"]).optional()
+	resolutionPreference: zod.z.enum(["highest", "lowest"]).optional(),
+	/**
+	* The height the consumer actually wants to DELIVER.
+	*
+	* Not a constraint — an ordering. With it set, the SMALLEST stream at or
+	* above the target wins, and only if nothing reaches it does the tallest
+	* take over. Pulling 1296 lines to draw 720 on a 1280x800 Echo panel costs
+	* a decode and buys nothing, and `resolutionPreference: 'highest'` cannot
+	* express that: it says "as big as possible", which is a different wish.
+	*
+	* Ignored when absent, so every existing caller keeps its ordering.
+	*/
+	targetHeight: zod.z.number().int().positive().optional()
 }).readonly();
 var PickedCamStreamSchema = zod.z.object({
 	camStreamId: zod.z.string(),
 	codec: zod.z.string().optional(),
 	resolution: CamStreamResolutionSchema.optional(),
+	/**
+	* Whether serving this stream requires a decode + re-encode.
+	*
+	* `false` is a stream the consumer can take as it stands. Only ever `true`
+	* when the caller asked for it with `allowTranscode`, so a caller that did
+	* not ask cannot be handed a cost it never agreed to pay.
+	*/
+	transcodes: zod.z.boolean(),
 	/** One-line explanation of why this stream won — for logs / debug UI. */
 	reason: zod.z.string()
 });
@@ -15484,6 +15649,8 @@ var NcSystemEventKindSchema = zod.z.enum([
 	"device-enabled",
 	"device-battery-low",
 	"device-battery-normal",
+	"device-consumable-low",
+	"device-consumable-normal",
 	"stream-online",
 	"stream-offline",
 	"node-online",
@@ -15502,6 +15669,7 @@ var NcSystemEventKindSchema = zod.z.enum([
 	"addon-updated",
 	"server-updated",
 	"export-completed",
+	"backup-completed",
 	"camera-online",
 	"camera-offline",
 	"camera-disabled",
@@ -24943,10 +25111,28 @@ var webrtcSessionCapability = {
 		getSessionState: method(zod.z.object({
 			deviceId: zod.z.number().int().nonnegative(),
 			sessionId: zod.z.string()
-		}), zod.z.object({ pendingRenegotiation: zod.z.object({
-			target: WebrtcStreamTargetSchema,
-			epoch: zod.z.number()
-		}).nullable() }))
+		}), zod.z.object({
+			pendingRenegotiation: zod.z.object({
+				target: WebrtcStreamTargetSchema,
+				epoch: zod.z.number()
+			}).nullable(),
+			/**
+			* Whether the session still EXISTS.
+			*
+			* A consumer that holds a resource for the life of a session needs to
+			* be able to ask, because a session does not always end the way it
+			* began. Measured on this hub 2026-09-13: an Echo that got stuck never
+			* sent `SessionDisconnected`, so the Alexa exporter's
+			* `releaseEgressTranscode` never ran, and a 2304x1296 HEVC to 720p
+			* H.264 transcode kept running for NOBODY for more than twenty
+			* minutes. The WebRTC session had logged `WebRTC session closed`
+			* minutes earlier — the broker knew; the holder had no way to ask.
+			*
+			* `false` for a session id the provider has never heard of, which is
+			* the same answer as "it ended": either way nothing is holding it up.
+			*/
+			alive: zod.z.boolean()
+		}))
 	},
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
 	mount: { kind: "server-provided" }
@@ -29995,11 +30181,39 @@ var NativeObjectDetectionStatusSchema = zod.z.object({
 	supportedClasses: zod.z.array(NativeObjectClassEnum).readonly(),
 	/**
 	* Whether forwarding of onboard AI detections is enabled for this device.
-	* Default FALSE (opt-in, cold-start) — onboard AI pushes are noisy/sparse and
-	* churn the tracker, so forwarding stays off until the operator enables it.
+	*
+	* The COLD-START default is the provider's, and it is not one value for
+	* every camera: a mains camera carries the boxed side-channel and its
+	* detections are usable subjects, so it defaults ON; a battery camera never
+	* attaches that channel, so the same toggle would buy it nothing but a write
+	* — it defaults OFF and an operator who wants it turns it on knowing what it
+	* costs. {@link NativeObjectDetectionOptionsSchema.geometry} is how the UI
+	* says which of the two a camera is.
 	*/
 	enabled: zod.z.boolean()
 });
+/**
+* What a camera's onboard detections actually CARRY.
+*
+* `boxed` — the firmware ships a bounding box with the class, so a detection is
+* a subject the pipeline can track, crop and score.
+* `flag-only` — the firmware ships the class and nothing else. The pipeline
+* needs geometry to make a subject out of it, so such a push reaches the
+* tracker as motion and no further. On Reolink this is every battery camera:
+* the boxes ride the BcMedia sub-stream, which a battery camera never attaches.
+*
+* Reported and not inferred, because the operator's question in front of the
+* toggle is "what do I get", and "a class with no box" and "a subject" are
+* different answers (D14: the derived form is only as honest as `getOptions`).
+*/
+var NativeObjectGeometryEnum = zod.z.enum(["boxed", "flag-only"]);
+var NativeObjectDetectionOptionsSchema = zod.z.object({
+	/** Classes this firmware can detect — the same list the status reports. */
+	supportedClasses: zod.z.array(NativeObjectClassEnum).readonly(),
+	/** What a detection from this camera carries. */
+	geometry: NativeObjectGeometryEnum
+});
+var NativeObjectDetectionSettingsPatchSchema = zod.z.object({ enabled: zod.z.boolean().optional() });
 var NativeObjectDetectionRuntimeStateSchema = NativeObjectDetectionStatusSchema.extend({ 
 /** Required by createRuntimeStateBridge — epoch ms of last refresh. */
 lastFetchedAt: zod.z.number() });
@@ -30009,13 +30223,28 @@ var nativeObjectDetectionCapability = {
 	deviceNative: true,
 	mode: "singleton",
 	deviceTypes: [DeviceType.Camera],
-	methods: { setEnabled: method(zod.z.object({
-		deviceId: zod.z.number(),
-		enabled: zod.z.boolean()
-	}), zod.z.void(), {
-		kind: "mutation",
-		auth: "admin"
-	}) },
+	deviceConfig: { ui: {
+		kind: "derived-form",
+		builderId: "native-object-detection",
+		tab: "motion"
+	} },
+	methods: {
+		getOptions: method(zod.z.object({ deviceId: zod.z.number() }), NativeObjectDetectionOptionsSchema),
+		setSettings: method(zod.z.object({
+			deviceId: zod.z.number(),
+			settings: NativeObjectDetectionSettingsPatchSchema
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setEnabled: method(zod.z.object({
+			deviceId: zod.z.number(),
+			enabled: zod.z.boolean()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
 	events: { onDetected: { data: zod.z.object({
 		deviceId: zod.z.number(),
 		detection: NativeDetectionSchema
@@ -36969,6 +37198,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	streamBrokerCapability,
 	streamCatalogCapability,
 	streamParamsCapability,
+	streamSignalsCapability,
 	switchCapability,
 	systemCapability,
 	tamperCapability,
@@ -39747,12 +39977,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"nativeObjectDetection.getOptions": {
+		capName: "native-object-detection",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"nativeObjectDetection.setEnabled": {
 		capName: "native-object-detection",
 		capScope: "device",
 		addonId: null,
 		access: "create"
 	},
+	"nativeObjectDetection.setSettings": {
+		capName: "native-object-detection",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"navigation.getFeatures": {
 		capName: "navigation",
 		capScope: "device",
@@ -42411,6 +42653,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.reportStreamSignal": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.restartProfile": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -42495,6 +42743,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamSignals.listSignals": {
+		capName: "stream-signals",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"switch.setState": {
 		capName: "switch",
 		capScope: "device",
@@ -43967,11 +44221,21 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"nativeObjectDetection.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"nativeObjectDetection.setEnabled": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"nativeObjectDetection.setSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"navigation.getFeatures": [{
 		name: "deviceId",
 		form: "single",
@@ -44867,6 +45131,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"streamBroker.reportStreamSignal": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"streamBroker.restartProfile": [{
 		name: "deviceId",
 		form: "single",
@@ -45099,7 +45368,7 @@ Object.freeze({
 });
 /**
 * Per-cap runtime-state policy, projected from every `*.cap.ts` that declares
-* `runtimeState`. 67 caps: 35 `restored`, 32 `session`.
+* `runtimeState`. 68 caps: 35 `restored`, 33 `session`.
 *
 * A cap absent from this map has no runtime-state slice at all. A cap PRESENT
 * with `durability: 'session'` has one and has decided not to keep it.
@@ -45325,6 +45594,10 @@ var RUNTIME_STATE_POLICY = {
 		durability: "restored",
 		volatileFields: ["lastFetchedAt"]
 	},
+	"stream-signals": {
+		durability: "session",
+		volatileFields: []
+	},
 	"switch": {
 		durability: "restored",
 		volatileFields: ["lastChangedAt"]

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DUSfUAgz.js");
+const require_dist = require("./dist-D3lJV9M7.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -29,7 +29,7 @@ const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-CAs
 const require_tls$1 = require("./tls-BFs4PzoW.js");
 const require_manifest_system_deps = require("./manifest-system-deps-CrSP0Kkp.js");
 const require_resource_monitor = require("./resource-monitor-LVE1BoLs.js");
-const require_custom_action_registry = require("./custom-action-registry-DAFhWd0h.js");
+const require_custom_action_registry = require("./custom-action-registry-CWFK5UDj.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { A as addonSettingsCapability, Dt as procedureAuthKey, Ft as scopesAllowDeviceCap, Jt as errMsg$1, Mt as resolveMethodAuth, Pt as scopesAllowAddon, Qt as DEVICE_STATUS_METHOD, Xt as DATAPLANE_SECRET_HEADER$1, Zt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, _ as RUNTIME_DEFAULTS, _n as readinessKey, _t as logLevelAtMost, an as asJsonObject$1, at as isArrayOutputSchema, cn as createEvent, ct as isObjectInput, dn as expandCapMethods, dt as isVoidInput, ft as kebabToCamel, gn as parseJsonUnknown, h as METHOD_ACCESS_MAP, hn as parseJsonObject, ln as emitDownForOwnedCaps, mt as lifecycleJobSchema, nn as ReadinessRegistry, on as asNumber, ot as isCollectionArrayMethod, p as LOG_LEVEL_RANK, rn as ReadinessTimeoutError, sn as asString$1, t as ALL_CAPABILITY_DEFINITIONS, tt as extractNestedAddonId, vn as resolveCapMount, vt as looseSchema, wt as objectInputDeclaresAddonId, xn as EventCategory$1, yn as scopeKey } from "./dist-Zhe9cTnK.mjs";
+import { A as addonSettingsCapability, Dt as procedureAuthKey, Ft as scopesAllowDeviceCap, Jt as errMsg$1, Mt as resolveMethodAuth, Pt as scopesAllowAddon, Qt as DEVICE_STATUS_METHOD, Xt as DATAPLANE_SECRET_HEADER$1, Zt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, _ as RUNTIME_DEFAULTS, _n as readinessKey, _t as logLevelAtMost, an as asJsonObject$1, at as isArrayOutputSchema, cn as createEvent, ct as isObjectInput, dn as expandCapMethods, dt as isVoidInput, ft as kebabToCamel, gn as parseJsonUnknown, h as METHOD_ACCESS_MAP, hn as parseJsonObject, ln as emitDownForOwnedCaps, mt as lifecycleJobSchema, nn as ReadinessRegistry, on as asNumber, ot as isCollectionArrayMethod, p as LOG_LEVEL_RANK, rn as ReadinessTimeoutError, sn as asString$1, t as ALL_CAPABILITY_DEFINITIONS, tt as extractNestedAddonId, vn as resolveCapMount, vt as looseSchema, wt as objectInputDeclaresAddonId, xn as EventCategory$1, yn as scopeKey } from "./dist-BIvXRexm.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -28,7 +28,7 @@ import { _ as fetchJson, a as createFileDataPlaneHandler, c as parseRangeHeader,
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-2xbgg78V.mjs";
 import { $ as buildUdsNativeCapProxy, $t as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, A as createUdsLoggerWithControl, An as recordSocketFrame, At as HUB_MAIN_HEAP_WATCH_LABEL, B as readMoleculerFanoutMode, Bn as diffCapActionCensus, Bt as createLoopDelayMeter, C as ipcParentLink, Cn as createSocketPlaneMeter, Ct as runNpm, D as createUdsEventBus, Dn as readSocketQueues, Dt as HEAP_RECLAIM_TRIGGER_MB, E as createUdsEventBridge, En as formatSocketPlane, Et as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, F as CapRouteError, Fn as CAP_ACTION_UNLABELLED, Ft as RUNNER_HEAP_WATCH_INTERVAL_MS, G as createLocalTransport, Gn as formatEventPlane, Gt as parseRssBudgetMb, H as PARENT_ROUTED_PROVIDER_ADDON_ID, Hn as createEventPlaneMeter, Ht as describeRss, I as classifyCapRoute, In as EMPTY_CAP_ACTION_READING, It as RUNNER_RSS_BUDGET_ENV, J as SocketChannel, Jt as startHeapWatch, K as UdsLocalTransportClient, Kt as reclaimIntervalMs, L as LocalChildClient, Ln as MAX_CAP_ACTIONS_PER_PEER, Lt as ZERO_LOOP_DELAY, M as AGENT_CAP_FWD_SERVICE, Mn as socketDirectionBytes, Mt as HUB_RSS_BUDGET_ENV, N as CapRouteResolver, Nn as socketDirectionMessages, Nt as RSS_BUDGET_REANNOUNCE_MIN_MS, O as udsChildLogToWorkerEntry, On as EMPTY_SOCKET_DIRECTION, Ot as HEAP_WATCH_INTERVAL_MS, P as callWithServiceDiscovery, Pn as CAP_ACTION_OVERFLOW_LABEL, Pt as RSS_BUDGET_RELEASE_RATIO, Q as buildNativeCapProxy, Qt as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, R as LocalChildRegistry, Rn as capActionLabel, Rt as buildHeapSample, S as buildLinkChain, Sn as SOCKET_QUEUE_TOP_N, St as resolveNpmInvocation, T as createParentUnownedCallHandler, Tn as diffSocketPlane, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as __resetCapUsageRegistryForTests, Un as createEventPlaneReader, Ut as hubMainRssBudget, V as CapUsageRegistry, Vn as EVENT_PLANE_TOP_N, Vt as createV8Reclaimer, W as getCapUsageRegistry, Wn as diffEventPlane, Wt as nextRssBudgetState, X as FrameDecoder, Xt as strandedMb, Y as localEndpointPath, Yt as startRunnerHeapWatch, Z as encodeFrame, Zt as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, _ as AddonDepsManager, _n as MESH_QUEUE_TOP_N, _t as CapabilityUnavailableError, a as createUdsAddonContext, an as DECISIVE_HEAP_SPACES, at as createAddonService, b as brokerCallForCap, bn as EMPTY_SOCKET_PLANE_BASELINE, bt as resolveAddonClass, c as getOrInitReadinessRegistryForClient, cn as formatHeapSpaces, ct as capActionName, d as clusterEventTopic, dn as selectReportedSpaces, dt as capServiceName, en as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, et as createBrokerDeviceManagerApi, f as getBrokerEventBus, fn as OUTBOUND_QUEUE_COOLDOWN_MS, ft as parseCapAction, g as subscribePassthrough, gn as formatOutboundQueueVerdict, gt as CapabilityHandle, h as setNodeEventInterest, hn as createOutboundQueueGate, ht as DeviceRegistry, i as createAddonContext, in as isArrayBufferCensusReport, j as AGENT_CAP_FWD_ACTION, jn as sampleSocketDirection, jt as HUB_MAIN_RSS_BUDGET_MB, k as createUdsLogger, kn as createSocketDirectionCounters, kt as HEAP_WATCH_WARN_RATIO, l as setHubConnected, ln as heapSpaceField, lt as capActionSuffix, m as registerEventBusService, mn as OUTBOUND_QUEUE_THRESHOLD_BYTES, mt as serializeTypedArrays, n as installManifestPythonDeps, nn as createInspectorArrayBufferCensus, o as getWorkerDeviceRegistry, on as HEAP_SPACE_REPORT_MIN_MB, ot as validateProviderRegistrations, p as getMoleculerEventStats, pn as OUTBOUND_QUEUE_SUSTAIN_MS, pt as deserializeTypedArrays, q as UdsLocalTransportServer, qt as shouldReclaim, r as adaptBrokerToCluster, rn as formatArrayBufferCensus, rt as mountNativeCapService, s as getOrInitReadinessRegistry, sn as emitHeapDiagnosticReport, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestSystemDeps, tn as createArrayBufferCensusGate, u as EVENT_TOPIC_PREFIX, un as readHeapSpaces, ut as capBareAction, v as createKernelHwAccel, vn as createMeshQueueReader, vt as copyBundledNativeModules, w as localProviderLink, wn as createSocketPlaneReader, wt as createAddonDataPlaneFacility, x as brokerTransportLink, xn as SOCKET_PLANE_TOP_N, xt as buildNpmChildEnv, y as resolveHwAccel, yn as formatMeshQueue, yt as installManifestNativeDeps, z as UDS_NO_ROUTE_PREFIX, zn as createCapActionCensus, zt as createDeferredHeapWatchSink } from "./manifest-system-deps-BEj9Dpu1.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Vp0bPV3U.mjs";
-import { t as CustomActionRegistry } from "./custom-action-registry-CM03Xda0.mjs";
+import { t as CustomActionRegistry } from "./custom-action-registry-CFHYDHAu.mjs";
 import { z } from "zod";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";

package/dist/{retired-settings-keys-BK_geSOq.mjs → retired-settings-keys-CV3ZLGnJ.mjs}

@@ -1,4 +1,4 @@
-import { an as asJsonObject } from "./dist-Zhe9cTnK.mjs";
+import { an as asJsonObject } from "./dist-BIvXRexm.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-D61PxN8L.js → retired-settings-keys-YPsd2Exa.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DUSfUAgz.js");
+const require_dist = require("./dist-D3lJV9M7.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/snapshot-courtesy-LoJNgHHZ.mjs

@@ -0,0 +1,140 @@
+import sharp from "sharp";
+//#region src/builtins/snapshot/snapshot-courtesy.ts
+/**
+* State treatment for a camera that cannot produce a current frame.
+*
+* ── Why this exists ───────────────────────────────────────────────────────
+* A disabled, offline or sleeping camera has no frame, and until 2026-08-11 the
+* snapshot service simply had nothing to say about it: the media route answered
+* **404** and the client painted "Unavailable". Measured on the live grid that
+* day, 10 of 26 tiles were 404s — one genuinely disabled camera plus nine dead
+* legacy rows. A 404 is indistinguishable from a broken camera, so an operator
+* who deliberately switched a camera off saw the same thing as a fault ([D62]:
+* "an off switch is REPORTED off; disabled must never look like broken").
+*
+* So the service answers with an image that SAYS what is going on, carrying
+* the camera's own name. When a real cached frame exists it remains visible
+* under the treatment; otherwise the generated courtesy background is used.
+*
+* ── Why sharp and not ffmpeg ──────────────────────────────────────────────
+* The first draft of this file shelled out to `ffmpeg` with a `drawtext`
+* filter. That was written before the resize path was measured, and it was the
+* wrong call for the same reason: this runs in the snapshot wrapper, a system
+* builtin loaded in the hub's ROOT process, so every render was a fork + exec
+* on the loop that serves the API — 52 ms against sharp's 4.8 ms in that
+* container, to draw two lines of text.
+*
+* `terminal-frame-renderer.ts` already renders text this way (SVG → sharp), so
+* this is the house pattern rather than a new one. It also drops the font-PATH
+* probing the ffmpeg version needed: an SVG names a font FAMILY and fontconfig
+* resolves it — verified in the hub image, where `fc-match "DejaVu Sans Mono"`
+* answers with the real file.
+*
+* Rendering is pure input → bytes with no I/O of its own, and the geometry and
+* escaping are separated out so they stay testable without rasterizing.
+*/
+/** Default tile size when the caller asks for no particular width. */
+var COURTESY_DEFAULT_WIDTH = 640;
+/**
+* Font stack for the rendered text. Family names, not paths — librsvg resolves
+* them through fontconfig, and the trailing generics keep a host without DejaVu
+* rendering something legible instead of nothing.
+*/
+var COURTESY_FONT_STACK = "DejaVu Sans,DejaVu Sans Mono,Helvetica,Arial,sans-serif";
+/** The word the frame carries. Deliberately the operator's vocabulary. */
+function courtesyLabel(reason) {
+	switch (reason) {
+		case "disabled": return "Disabled";
+		case "offline": return "Offline";
+		case "sleeping": return "Sleeping";
+		case "unreachable": return "Unreachable";
+		case "waking": return "Waking";
+	}
+}
+/**
+* Background per reason. A disabled camera is a DELIBERATE state and must not
+* read as an alarm, so it is neutral grey; offline is a fault and is warmer.
+*/
+function courtesyBackground(reason) {
+	switch (reason) {
+		case "disabled": return "#2b2b31";
+		case "offline": return "#3a2b2b";
+		case "sleeping": return "#232b3a";
+		case "waking": return "#243247";
+		case "unreachable": return "#3a2b2b";
+	}
+}
+/** XML escaping for text placed inside an SVG `<text>` node. */
+function escapeCourtesyText(value) {
+	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&apos;");
+}
+/**
+* The SVG the frame is rasterized from: the state large and centred, the
+* camera's name under it, smaller and dimmer.
+*
+* Sizes derive from the width so a 240 px grid tile and a 1920 px full-bleed
+* frame read the same, with a floor so a thumbnail stays legible.
+*/
+function buildCourtesySvg(spec) {
+	return buildStateSvg(spec, false);
+}
+/**
+* The same state treatment as a courtesy frame, but translucent so the last
+* real camera frame remains visible underneath it.
+*/
+function buildCourtesyOverlaySvg(spec) {
+	return buildStateSvg(spec, true);
+}
+function buildStateSvg(spec, overlay) {
+	const stateSize = Math.max(12, Math.round(spec.width / 12));
+	const nameSize = Math.max(9, Math.round(spec.width / 26));
+	const state = escapeCourtesyText(courtesyLabel(spec.reason));
+	const name = escapeCourtesyText(spec.deviceName);
+	const midY = spec.height / 2;
+	const washOpacity = overlay ? "0.62" : "1";
+	const textStroke = Math.max(1, Math.round(spec.width / 320));
+	return [
+		`<svg xmlns="http://www.w3.org/2000/svg" width="${String(spec.width)}" height="${String(spec.height)}">`,
+		`<rect width="100%" height="100%" fill="${courtesyBackground(spec.reason)}" fill-opacity="${washOpacity}"/>`,
+		`<g font-family="${COURTESY_FONT_STACK}" text-anchor="middle" paint-order="stroke" stroke="#111118" stroke-width="${String(textStroke)}">`,
+		`<text x="50%" y="${String(Math.round(midY))}" font-size="${String(stateSize)}" fill="#e8e8ee">${state}</text>`,
+		`<text x="50%" y="${String(Math.round(midY + stateSize))}" font-size="${String(nameSize)}" fill="#9a9aa8">${name}</text>`,
+		`</g></svg>`
+	].join("");
+}
+/** Cache key — a courtesy frame is a pure function of these four. */
+function courtesyCacheKey(spec) {
+	return `${spec.reason}:${String(spec.width)}x${String(spec.height)}:${spec.deviceName}`;
+}
+/**
+* Render the frame.
+*
+* Rejects on failure — the caller decides what to do, exactly as `resizeJpeg`
+* does, so a broken courtesy path is never mistaken for a broken camera.
+*/
+function renderCourtesyJpeg(spec) {
+	return sharp(Buffer.from(buildCourtesySvg(spec))).jpeg({ quality: 82 }).toBuffer().then((bytes) => {
+		if (bytes.length === 0) throw new Error("courtesy frame produced no bytes");
+		return bytes;
+	});
+}
+/**
+* Paint the state treatment over a real cached frame.
+*
+* The source dimensions are authoritative: overlays preserve the original
+* frame rather than resizing it to the generated courtesy-frame default.
+*/
+async function renderCourtesyOverlayJpeg(background, spec) {
+	const metadata = await sharp(background).metadata();
+	if (!metadata.width || !metadata.height) throw new Error("cached snapshot has no renderable dimensions");
+	const overlay = Buffer.from(buildCourtesyOverlaySvg({
+		...spec,
+		width: metadata.width,
+		height: metadata.height
+	}));
+	const bytes = await sharp(background).composite([{ input: overlay }]).jpeg({ quality: 82 }).toBuffer();
+	if (bytes.length === 0) throw new Error("courtesy overlay produced no bytes");
+	return bytes;
+}
+//#endregion
+export { renderCourtesyOverlayJpeg as i, courtesyCacheKey as n, renderCourtesyJpeg as r, COURTESY_DEFAULT_WIDTH as t };