@camstack/system 1.2.238 → 1.2.240

package/dist/{dist-CHclfj0J.js → dist-Dze0l7UM.js}

@@ -690,7 +690,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-BfJ2k1jm.mjs
+//#region ../types/dist/sleep-BDR76Ykr.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -16998,6 +16998,48 @@ var NcAlarmConfigSchema = zod.z.object({
 	settings: NcAlarmSettingsSchema,
 	coverage: zod.z.array(NcAlarmModeCoverageSchema)
 });
+/**
+* ONE rule's demand on ONE camera's clip ring.
+*
+* A rule, not a camera: the broker takes the MAX over the asks that reach a
+* camera, so the answer stays a faithful description of the rules and the
+* bounding (the byte budget, the broker's own ceiling) stays where the cost
+* lives. A camera that appears in no ask is being told **nothing** — which is
+* a different thing from never having been told, and only the envelope
+* (`rulesLoaded`) can tell those apart.
+*/
+var NcClipRetentionAskSchema = zod.z.object({
+	/**
+	* The camera this ask is about. **Absent = every camera**, which is what a
+	* rule with no `conditions.devices` means: it can fire anywhere, so it is
+	* asking everywhere.
+	*/
+	deviceId: zod.z.number().int().nonnegative().optional(),
+	/** Seconds of history the rule needs held for it. Never zero — a rule that
+	*  needs nothing produces no ask at all. */
+	seconds: zod.z.number().min(0).max(60),
+	/** The profile the rule cuts from, when it named one. Absent = the cheapest
+	*  assigned, which is what the cut defaults to. */
+	profile: CamProfileSchema.optional(),
+	/** Who is asking — so a retention the operator did not expect names a rule. */
+	ruleId: zod.z.string(),
+	ruleName: zod.z.string(),
+	/** Why this many seconds: the rule's own window, or the occupancy ceiling. */
+	reason: zod.z.enum(["window", "occupancy"])
+});
+/**
+* The whole answer, with the one bit that keeps absence from reading as zero.
+*
+* `rulesLoaded` is false until the rule ledger has completed a load at least
+* once. A centre that is up but has not read its rules yet answers with an
+* empty ask list that means nothing at all — applying it would drop every
+* camera's ring to zero for the first events after a restart, which is the
+* footage this mechanism exists to keep.
+*/
+var NcClipRetentionPlanSchema = zod.z.object({
+	rulesLoaded: zod.z.boolean(),
+	asks: zod.z.array(NcClipRetentionAskSchema).readonly()
+});
 var notificationRulesCapability = {
 	name: "notification-rules",
 	scope: "system",
@@ -17030,6 +17072,23 @@ var notificationRulesCapability = {
 			auth: "admin"
 		}),
 		/**
+		* WHAT THE RULES ACTUALLY ASK the stream broker to retain, per camera.
+		*
+		* The notification centre owns the rules, so it is the only thing that can
+		* say how much history a camera's notifications will ever reach back for.
+		* Before this the broker guessed — a flat minute on every camera — and
+		* learned the PROFILE reactively, after the first clip had already been cut
+		* from the wrong one. This is the same ask stated once, in front.
+		*
+		* A QUERY, pulled by each node's broker, not a push: brokers are per node
+		* (a camera's ring lives wherever its stream is ingested) while this cap is
+		* a singleton, so a push would have to enumerate the cluster. The pull also
+		* makes the failure mode right — a broker that cannot reach the centre
+		* keeps the plan it has, and a plan that has never arrived is UNKNOWN
+		* rather than empty (D49: a read that fails changes nothing).
+		*/
+		getClipRetentionAsks: method(zod.z.object({}), NcClipRetentionPlanSchema, { auth: "admin" }),
+		/**
 		* PERMANENT per-camera mute — the notifications half of the per-camera
 		* function switch group ([D61](../../../../docs/decisions/adr-0067.md)).
 		*
@@ -21645,6 +21704,18 @@ var RunnerLocalMetricsSchema = zod.z.object({
 * runner has zero knowledge of other agents, no global state, and never
 * makes assignment decisions itself.
 */
+/**
+* Why a runner declined to look at a camera out of band. Named rather than a
+* bare `false`: a camera asleep on battery (D173), one attached elsewhere, one
+* already mid-session and one already bursting are four different facts, and a
+* caller told only "no" cannot tell a protection from a bug.
+*/
+var OccupancyBurstRefusalSchema = zod.z.enum([
+	"not-attached",
+	"battery-asleep",
+	"not-watching",
+	"already-bursting"
+]);
 var pipelineRunnerCapability = {
 	name: "pipeline-runner",
 	scope: "system",
@@ -21681,6 +21752,50 @@ var pipelineRunnerCapability = {
 		/** List the deviceIds currently attached to this runner. */
 		getLocalCameras: method(zod.z.void(), zod.z.array(zod.z.number()).readonly()),
 		/**
+		* Look at a camera NOW, out of band, because something just happened that
+		* only a fresh look can settle.
+		*
+		* The periodic recheck (`occupancyRecheckSec`, 300 s) exists to watch a
+		* still scene. It is the wrong instrument for a QUESTION that has just been
+		* asked: on device 617 a parked car's departure was observed, a departure
+		* strike was armed — and then the motion session ended, the strike decayed
+		* after its 30 s TTL, and the next periodic look arrived up to five minutes
+		* later with nothing left to confirm. Every one of those departures was
+		* settled by the entry ageing out 6 to 10 minutes of observed time later,
+		* and the notification's clip showed an empty space with nothing leaving
+		* it.
+		*
+		* Two numbers make the ask specific, and a caller that ignores them wastes
+		* the burst: a confirmation must land at least
+		* `DEPARTURE_CONFIRM_MIN_GAP_MS` (3 s) after the read that armed the
+		* strike — before that it is the same optical event and is refused — and
+		* `DEPARTURE_ABSENCE_MIN_READS` (5) consecutive unassociated frames are
+		* needed, while `occupancyRecheckFrames` defaults to FOUR. A burst of four
+		* can never confirm an absence; that is why two periodic looks were always
+		* required.
+		*
+		* The runner answers whether it actually started one. A refusal is NAMED,
+		* never a silent `false`: a camera that is asleep on battery (D173 — this
+		* must not become a self-initiated wake), detached, mid-session or already
+		* bursting are four different facts, and a caller told only "no" cannot
+		* tell a protection from a bug.
+		*/
+		requestOccupancyBurst: method(zod.z.object({
+			deviceId: zod.z.number(),
+			/** How many frames to collect. The caller sizes this against what its
+			*  own confirmation needs; the runner clamps it to the field's range. */
+			frames: zod.z.number().int().positive().optional(),
+			/** Why, for the log. A burst nobody can attribute is a cost nobody can
+			*  defend — the periodic one at least has a timer to point at. */
+			reason: zod.z.string()
+		}), zod.z.object({
+			started: zod.z.boolean(),
+			refusedBecause: OccupancyBurstRefusalSchema.optional()
+		}), {
+			auth: "admin",
+			kind: "mutation"
+		}),
+		/**
 		* Best-effort NATIVE-resolution crop of a retention-ring frame. Given the
 		* `FrameHandle` that rode an inference-result event and a normalized `bbox`,
 		* the runner asks the decode worker still holding that frame's NATIVE
@@ -40391,6 +40506,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.getClipRetentionAsks": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.getConditionCatalog": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -41579,6 +41700,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.requestOccupancyBurst": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineRunner.runDetailSubtree": {
 		capName: "pipeline-runner",
 		capScope: "system",
@@ -44918,6 +45045,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineRunner.requestOccupancyBurst": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineRunner.runDetailSubtree": [{
 		name: "deviceId",
 		form: "single",

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CHclfj0J.js");
+const require_dist = require("./dist-Dze0l7UM.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -27,7 +27,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-CAsHdMwP.js");
 const require_tls$1 = require("./tls-BFs4PzoW.js");
-const require_manifest_system_deps = require("./manifest-system-deps-CrSP0Kkp.js");
+const require_manifest_system_deps = require("./manifest-system-deps-CzyjTMcO.js");
 const require_resource_monitor = require("./resource-monitor-LVE1BoLs.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let zod = require("zod");

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { A as addonSettingsCapability, Ct as objectInputDeclaresAddonId, Et as procedureAuthKey, Nt as scopesAllowAddon, Pt as scopesAllowDeviceCap, Xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Yt as DATAPLANE_SECRET_HEADER$1, Zt as DEVICE_STATUS_METHOD, _ as RUNTIME_DEFAULTS, _n as resolveCapMount, _t as looseSchema, an as asNumber, at as isCollectionArrayMethod, bn as EventCategory$1, cn as emitDownForOwnedCaps, dt as kebabToCamel, et as extractNestedAddonId, gn as readinessKey, gt as logLevelAtMost, h as METHOD_ACCESS_MAP, hn as parseJsonUnknown, in as asJsonObject$1, it as isArrayOutputSchema, jt as resolveMethodAuth, mn as parseJsonObject, nn as ReadinessTimeoutError, on as asString$1, p as LOG_LEVEL_RANK, pt as lifecycleJobSchema, qt as errMsg$1, sn as createEvent, st as isObjectInput, t as ALL_CAPABILITY_DEFINITIONS, tn as ReadinessRegistry, un as expandCapMethods, ut as isVoidInput, vn as scopeKey } from "./dist-D5hpgLSL.mjs";
+import { A as addonSettingsCapability, Ct as objectInputDeclaresAddonId, Et as procedureAuthKey, Nt as scopesAllowAddon, Pt as scopesAllowDeviceCap, Xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Yt as DATAPLANE_SECRET_HEADER$1, Zt as DEVICE_STATUS_METHOD, _ as RUNTIME_DEFAULTS, _n as resolveCapMount, _t as looseSchema, an as asNumber, at as isCollectionArrayMethod, bn as EventCategory$1, cn as emitDownForOwnedCaps, dt as kebabToCamel, et as extractNestedAddonId, gn as readinessKey, gt as logLevelAtMost, h as METHOD_ACCESS_MAP, hn as parseJsonUnknown, in as asJsonObject$1, it as isArrayOutputSchema, jt as resolveMethodAuth, mn as parseJsonObject, nn as ReadinessTimeoutError, on as asString$1, p as LOG_LEVEL_RANK, pt as lifecycleJobSchema, qt as errMsg$1, sn as createEvent, st as isObjectInput, t as ALL_CAPABILITY_DEFINITIONS, tn as ReadinessRegistry, un as expandCapMethods, ut as isVoidInput, vn as scopeKey } from "./dist-CDDG1zn3.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -26,7 +26,7 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { _ as fetchJson, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, f as collectModelFiles, g as ensureModel, h as downloadModel, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as downloadFile, n as STALL_TICK_MS, o as contentTypeFor, p as deleteModelFromDisk, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as getModelFilePath, y as isModelDownloaded } from "./event-loop-stall-monitor-GPrVvx14.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-2xbgg78V.mjs";
-import { $ as buildUdsNativeCapProxy, $t as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, A as createUdsLoggerWithControl, An as recordSocketFrame, At as HUB_MAIN_HEAP_WATCH_LABEL, B as readMoleculerFanoutMode, Bn as diffCapActionCensus, Bt as createLoopDelayMeter, C as ipcParentLink, Cn as createSocketPlaneMeter, Ct as runNpm, D as createUdsEventBus, Dn as readSocketQueues, Dt as HEAP_RECLAIM_TRIGGER_MB, E as createUdsEventBridge, En as formatSocketPlane, Et as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, F as CapRouteError, Fn as CAP_ACTION_UNLABELLED, Ft as RUNNER_HEAP_WATCH_INTERVAL_MS, G as createLocalTransport, Gn as formatEventPlane, Gt as parseRssBudgetMb, H as PARENT_ROUTED_PROVIDER_ADDON_ID, Hn as createEventPlaneMeter, Ht as describeRss, I as classifyCapRoute, In as EMPTY_CAP_ACTION_READING, It as RUNNER_RSS_BUDGET_ENV, J as SocketChannel, Jt as startHeapWatch, K as UdsLocalTransportClient, Kt as reclaimIntervalMs, L as LocalChildClient, Ln as MAX_CAP_ACTIONS_PER_PEER, Lt as ZERO_LOOP_DELAY, M as AGENT_CAP_FWD_SERVICE, Mn as socketDirectionBytes, Mt as HUB_RSS_BUDGET_ENV, N as CapRouteResolver, Nn as socketDirectionMessages, Nt as RSS_BUDGET_REANNOUNCE_MIN_MS, O as udsChildLogToWorkerEntry, On as EMPTY_SOCKET_DIRECTION, Ot as HEAP_WATCH_INTERVAL_MS, P as callWithServiceDiscovery, Pn as CAP_ACTION_OVERFLOW_LABEL, Pt as RSS_BUDGET_RELEASE_RATIO, Q as buildNativeCapProxy, Qt as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, R as LocalChildRegistry, Rn as capActionLabel, Rt as buildHeapSample, S as buildLinkChain, Sn as SOCKET_QUEUE_TOP_N, St as resolveNpmInvocation, T as createParentUnownedCallHandler, Tn as diffSocketPlane, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as __resetCapUsageRegistryForTests, Un as createEventPlaneReader, Ut as hubMainRssBudget, V as CapUsageRegistry, Vn as EVENT_PLANE_TOP_N, Vt as createV8Reclaimer, W as getCapUsageRegistry, Wn as diffEventPlane, Wt as nextRssBudgetState, X as FrameDecoder, Xt as strandedMb, Y as localEndpointPath, Yt as startRunnerHeapWatch, Z as encodeFrame, Zt as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, _ as AddonDepsManager, _n as MESH_QUEUE_TOP_N, _t as CapabilityUnavailableError, a as createUdsAddonContext, an as DECISIVE_HEAP_SPACES, at as createAddonService, b as brokerCallForCap, bn as EMPTY_SOCKET_PLANE_BASELINE, bt as resolveAddonClass, c as getOrInitReadinessRegistryForClient, cn as formatHeapSpaces, ct as capActionName, d as clusterEventTopic, dn as selectReportedSpaces, dt as capServiceName, en as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, et as createBrokerDeviceManagerApi, f as getBrokerEventBus, fn as OUTBOUND_QUEUE_COOLDOWN_MS, ft as parseCapAction, g as subscribePassthrough, gn as formatOutboundQueueVerdict, gt as CapabilityHandle, h as setNodeEventInterest, hn as createOutboundQueueGate, ht as DeviceRegistry, i as createAddonContext, in as isArrayBufferCensusReport, j as AGENT_CAP_FWD_ACTION, jn as sampleSocketDirection, jt as HUB_MAIN_RSS_BUDGET_MB, k as createUdsLogger, kn as createSocketDirectionCounters, kt as HEAP_WATCH_WARN_RATIO, l as setHubConnected, ln as heapSpaceField, lt as capActionSuffix, m as registerEventBusService, mn as OUTBOUND_QUEUE_THRESHOLD_BYTES, mt as serializeTypedArrays, n as installManifestPythonDeps, nn as createInspectorArrayBufferCensus, o as getWorkerDeviceRegistry, on as HEAP_SPACE_REPORT_MIN_MB, ot as validateProviderRegistrations, p as getMoleculerEventStats, pn as OUTBOUND_QUEUE_SUSTAIN_MS, pt as deserializeTypedArrays, q as UdsLocalTransportServer, qt as shouldReclaim, r as adaptBrokerToCluster, rn as formatArrayBufferCensus, rt as mountNativeCapService, s as getOrInitReadinessRegistry, sn as emitHeapDiagnosticReport, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestSystemDeps, tn as createArrayBufferCensusGate, u as EVENT_TOPIC_PREFIX, un as readHeapSpaces, ut as capBareAction, v as createKernelHwAccel, vn as createMeshQueueReader, vt as copyBundledNativeModules, w as localProviderLink, wn as createSocketPlaneReader, wt as createAddonDataPlaneFacility, x as brokerTransportLink, xn as SOCKET_PLANE_TOP_N, xt as buildNpmChildEnv, y as resolveHwAccel, yn as formatMeshQueue, yt as installManifestNativeDeps, z as UDS_NO_ROUTE_PREFIX, zn as createCapActionCensus, zt as createDeferredHeapWatchSink } from "./manifest-system-deps-BEj9Dpu1.mjs";
+import { $ as buildUdsNativeCapProxy, $t as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, A as createUdsLoggerWithControl, An as recordSocketFrame, At as HUB_MAIN_HEAP_WATCH_LABEL, B as readMoleculerFanoutMode, Bn as diffCapActionCensus, Bt as createLoopDelayMeter, C as ipcParentLink, Cn as createSocketPlaneMeter, Ct as runNpm, D as createUdsEventBus, Dn as readSocketQueues, Dt as HEAP_RECLAIM_TRIGGER_MB, E as createUdsEventBridge, En as formatSocketPlane, Et as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, F as CapRouteError, Fn as CAP_ACTION_UNLABELLED, Ft as RUNNER_HEAP_WATCH_INTERVAL_MS, G as createLocalTransport, Gn as formatEventPlane, Gt as parseRssBudgetMb, H as PARENT_ROUTED_PROVIDER_ADDON_ID, Hn as createEventPlaneMeter, Ht as describeRss, I as classifyCapRoute, In as EMPTY_CAP_ACTION_READING, It as RUNNER_RSS_BUDGET_ENV, J as SocketChannel, Jt as startHeapWatch, K as UdsLocalTransportClient, Kt as reclaimIntervalMs, L as LocalChildClient, Ln as MAX_CAP_ACTIONS_PER_PEER, Lt as ZERO_LOOP_DELAY, M as AGENT_CAP_FWD_SERVICE, Mn as socketDirectionBytes, Mt as HUB_RSS_BUDGET_ENV, N as CapRouteResolver, Nn as socketDirectionMessages, Nt as RSS_BUDGET_REANNOUNCE_MIN_MS, O as udsChildLogToWorkerEntry, On as EMPTY_SOCKET_DIRECTION, Ot as HEAP_WATCH_INTERVAL_MS, P as callWithServiceDiscovery, Pn as CAP_ACTION_OVERFLOW_LABEL, Pt as RSS_BUDGET_RELEASE_RATIO, Q as buildNativeCapProxy, Qt as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, R as LocalChildRegistry, Rn as capActionLabel, Rt as buildHeapSample, S as buildLinkChain, Sn as SOCKET_QUEUE_TOP_N, St as resolveNpmInvocation, T as createParentUnownedCallHandler, Tn as diffSocketPlane, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as __resetCapUsageRegistryForTests, Un as createEventPlaneReader, Ut as hubMainRssBudget, V as CapUsageRegistry, Vn as EVENT_PLANE_TOP_N, Vt as createV8Reclaimer, W as getCapUsageRegistry, Wn as diffEventPlane, Wt as nextRssBudgetState, X as FrameDecoder, Xt as strandedMb, Y as localEndpointPath, Yt as startRunnerHeapWatch, Z as encodeFrame, Zt as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, _ as AddonDepsManager, _n as MESH_QUEUE_TOP_N, _t as CapabilityUnavailableError, a as createUdsAddonContext, an as DECISIVE_HEAP_SPACES, at as createAddonService, b as brokerCallForCap, bn as EMPTY_SOCKET_PLANE_BASELINE, bt as resolveAddonClass, c as getOrInitReadinessRegistryForClient, cn as formatHeapSpaces, ct as capActionName, d as clusterEventTopic, dn as selectReportedSpaces, dt as capServiceName, en as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, et as createBrokerDeviceManagerApi, f as getBrokerEventBus, fn as OUTBOUND_QUEUE_COOLDOWN_MS, ft as parseCapAction, g as subscribePassthrough, gn as formatOutboundQueueVerdict, gt as CapabilityHandle, h as setNodeEventInterest, hn as createOutboundQueueGate, ht as DeviceRegistry, i as createAddonContext, in as isArrayBufferCensusReport, j as AGENT_CAP_FWD_ACTION, jn as sampleSocketDirection, jt as HUB_MAIN_RSS_BUDGET_MB, k as createUdsLogger, kn as createSocketDirectionCounters, kt as HEAP_WATCH_WARN_RATIO, l as setHubConnected, ln as heapSpaceField, lt as capActionSuffix, m as registerEventBusService, mn as OUTBOUND_QUEUE_THRESHOLD_BYTES, mt as serializeTypedArrays, n as installManifestPythonDeps, nn as createInspectorArrayBufferCensus, o as getWorkerDeviceRegistry, on as HEAP_SPACE_REPORT_MIN_MB, ot as validateProviderRegistrations, p as getMoleculerEventStats, pn as OUTBOUND_QUEUE_SUSTAIN_MS, pt as deserializeTypedArrays, q as UdsLocalTransportServer, qt as shouldReclaim, r as adaptBrokerToCluster, rn as formatArrayBufferCensus, rt as mountNativeCapService, s as getOrInitReadinessRegistry, sn as emitHeapDiagnosticReport, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestSystemDeps, tn as createArrayBufferCensusGate, u as EVENT_TOPIC_PREFIX, un as readHeapSpaces, ut as capBareAction, v as createKernelHwAccel, vn as createMeshQueueReader, vt as copyBundledNativeModules, w as localProviderLink, wn as createSocketPlaneReader, wt as createAddonDataPlaneFacility, x as brokerTransportLink, xn as SOCKET_PLANE_TOP_N, xt as buildNpmChildEnv, y as resolveHwAccel, yn as formatMeshQueue, yt as installManifestNativeDeps, z as UDS_NO_ROUTE_PREFIX, zn as createCapActionCensus, zt as createDeferredHeapWatchSink } from "./manifest-system-deps-CfR7Z90J.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Vp0bPV3U.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { z } from "zod";

package/dist/kernel/moleculer/device-event-ring.d.ts

@@ -0,0 +1,113 @@
+import { SystemEvent } from '@camstack/types';
+/** One declared mirror category and the reason it may be collapsed. */
+export interface MirrorCategoryDeclaration {
+    /** Exact event category. Not a glob — a mirror is declared one by one. */
+    readonly category: string;
+    /** Why the penultimate value of this category carries no information. */
+    readonly reason: string;
+}
+/**
+ * The categories whose per-device history is ONE slot: the latest value.
+ *
+ * Declared here, with a reason each, on purpose — the alternative is `if`s
+ * scattered over the delivery path, and nobody can then answer "what does this
+ * system collapse, and who decided?".
+ *
+ * Adding an entry DELETES history for that category. Add one only when the
+ * category is genuinely a state mirror (a snapshot of a current value), never
+ * because it is merely frequent — a frequent EDGE (a motion start, a crash)
+ * belongs in `RING_BUFFER_DENY_PATTERNS` or nowhere, not here.
+ */
+export declare const MIRROR_CATEGORIES: readonly MirrorCategoryDeclaration[];
+/** The declared reason this category is a mirror, or `undefined` if unclassified. */
+export declare function mirrorReason(category: string): string | undefined;
+/**
+ * Is this category declared a mirror? An unclassified category is NOT a mirror
+ * — the safe default is to keep its history.
+ */
+export declare function isMirrorCategory(category: string): boolean;
+/**
+ * Non-mirror events retained per device. ~1.1 events/s fleet-wide after
+ * coalescing ⇒ ~3 000/day/camera ⇒ 2 000 ≈ 16 h.
+ */
+export declare const MAX_DEVICE_RING_EVENTS = 2000;
+/**
+ * Cap on the retained `data` payload, in UTF-8 bytes. The COUNT is not what
+ * costs memory — 32 devices × 2 000 events × 817 B (measured average) ≈ 52 MB.
+ * Capping the payload brings the worst case to ≈ 26 MB and the realistic case
+ * far below it, since most events are already under the cap.
+ */
+export declare const MAX_RETAINED_DATA_BYTES = 256;
+/** Bytes of the original JSON kept as a human-readable preview of a cut payload. */
+export declare const TRUNCATED_PREVIEW_BYTES = 160;
+/**
+ * Devices tracked at once. Far above the fleet (32) — it exists so a bad
+ * deviceId stream cannot grow the map without bound. Eviction is
+ * least-recently-written.
+ */
+export declare const MAX_TRACKED_DEVICES = 512;
+/** Marker key present on — and only on — a payload this module cut. */
+export declare const TRUNCATED_DATA_KEY = "__truncated";
+/**
+ * What replaces a payload above {@link MAX_RETAINED_DATA_BYTES}. A consumer
+ * MUST be able to tell a short payload from a cut one, so the replacement says
+ * so explicitly rather than silently shipping a prefix.
+ */
+export interface TruncatedEventData extends Record<string, unknown> {
+    readonly __truncated: true;
+    /** Size of the original JSON payload, or `null` when it could not be measured. */
+    readonly __originalBytes: number | null;
+    /** First {@link TRUNCATED_PREVIEW_BYTES} characters of the original JSON. */
+    readonly __preview: string;
+}
+/** Is this the marked replacement of a cut payload? */
+export declare function isTruncatedEventData(data: Record<string, unknown>): data is TruncatedEventData;
+/**
+ * The event as it should be RETAINED: unchanged when its payload is within the
+ * cap, otherwise a NEW event whose `data` is the marked replacement. The
+ * argument is never mutated — the same object is still live on the fan-out path
+ * and in the global ring.
+ */
+export declare function capEventData(event: SystemEvent): SystemEvent;
+/**
+ * The device this event is about, or `undefined` when it is about no device.
+ *
+ * Same rule as `matchesEventFilter` — `source.deviceId`, or `source.id` when
+ * the source IS a device — so a read filtered by `deviceId` and a read served
+ * from that device's ring agree on which events belong to it. A non-numeric
+ * device source id yields `undefined` rather than `NaN`: an unattributable
+ * event must never become a bucket of its own.
+ */
+export declare function eventDeviceId(event: SystemEvent): number | undefined;
+interface DeviceRing {
+    /** Non-mirror events, oldest first, bounded by {@link MAX_DEVICE_RING_EVENTS}. */
+    readonly history: SystemEvent[];
+    /** Latest event per declared-mirror category. */
+    readonly mirrors: Map<string, SystemEvent>;
+}
+/**
+ * Every device's ring. Insertion order is least-recently-written first, which
+ * is what {@link MAX_TRACKED_DEVICES} evicts by.
+ */
+export interface DeviceEventRings {
+    readonly byDevice: Map<number, DeviceRing>;
+}
+export declare function createDeviceEventRings(): DeviceEventRings;
+/**
+ * Retain `event` in its device's ring, with its payload capped.
+ *
+ * Returns the device it was filed under, or `undefined` when the event names no
+ * device — the caller has already retained it in the global ring and nothing
+ * more happens here. No device is fabricated.
+ */
+export declare function recordDeviceEvent(rings: DeviceEventRings, event: SystemEvent): number | undefined;
+/**
+ * Everything retained for one device, oldest first — history merged with the
+ * current value of each mirror, ordered by timestamp so the caller's `-limit`
+ * slice means the same thing it means on the global ring.
+ *
+ * An unknown device yields `[]`: unknown is the truth about a camera that has
+ * emitted nothing since this process started.
+ */
+export declare function getDeviceRecent(rings: DeviceEventRings, deviceId: number): readonly SystemEvent[];
+export {};

package/dist/kernel/moleculer/event-bus-core.d.ts

@@ -1,4 +1,5 @@
 import { EventFilter, SystemEvent } from '@camstack/types';
+import { DeviceEventRings } from './device-event-ring.js';
 export interface SubscriberEntry {
     /** Original filter — kept whole so non-category dimensions are honoured per-event. */
     readonly filter: EventFilter | string | undefined;
@@ -29,6 +30,23 @@ export interface SharedBusState {
      * Cleared on server restart (intentional — events are volatile by design).
      */
     readonly recent: SystemEvent[];
+    /**
+     * Per-device rings BESIDE `recent[]` — not a replacement for it.
+     *
+     * `recent[]` is one global, count-bounded ring: a busy fleet evicts a quiet
+     * camera's events out of it long before an operator opens that camera's
+     * panel, and filtering a global ring by device cannot bring them back. A
+     * per-device ask is therefore answered from here instead
+     * (`getBrokerEventBus().getRecent({ deviceId })`), while an ask that names no
+     * device is still answered from `recent[]`.
+     *
+     * Populated under exactly the same conditions as `recent[]` (retaining bus,
+     * category not on the high-frequency deny-list), with mirror categories
+     * coalesced and payloads capped — see `device-event-ring.ts`. An event that
+     * names no device is retained in `recent[]` ONLY; no device is invented for
+     * it.
+     */
+    readonly deviceRings: DeviceEventRings;
     /**
      * Whether this bus retains events in `recent[]` to back the
      * `getRecent`/audit capability.

package/dist/{manifest-system-deps-BEj9Dpu1.mjs → manifest-system-deps-CfR7Z90J.mjs}

@@ -6971,6 +6971,137 @@ function getCapUsageRegistry() {
 function __resetCapUsageRegistryForTests() {
 	singleton = null;
 }
+var MIRROR_REASON_BY_CATEGORY = new Map([
+	{
+		category: "device.state-changed",
+		reason: "Device runtime-state mirror, 69.1 % of fleet traffic. Each event is a snapshot of the slice AFTER the change; the superseded snapshot describes a state the device is no longer in, and every consumer (SystemMirror, DeviceStateHandle) reads the latest one only."
+	},
+	{
+		category: "camera-streams.onCamStreamsChanged",
+		reason: "Full stream-list snapshot per camera, 20.1 % of fleet traffic. The payload is the complete current list, not a delta, so an older list is strictly less true than the newer one."
+	},
+	{
+		category: "system.ready-state",
+		reason: "Readiness is a LEVEL, not an edge: the event reports whether a capability is ready right now. Declared for the case where it carries a deviceId; when it does not it stays in the global ring like any other unattributed event."
+	}
+].map((m) => [m.category, m.reason]));
+/**
+* Is this category declared a mirror? An unclassified category is NOT a mirror
+* — the safe default is to keep its history.
+*/
+function isMirrorCategory(category) {
+	return MIRROR_REASON_BY_CATEGORY.has(category);
+}
+/**
+* Non-mirror events retained per device. ~1.1 events/s fleet-wide after
+* coalescing ⇒ ~3 000/day/camera ⇒ 2 000 ≈ 16 h.
+*/
+var MAX_DEVICE_RING_EVENTS = 2e3;
+function serializePayload(data) {
+	try {
+		const json = JSON.stringify(data);
+		if (typeof json !== "string") return null;
+		return {
+			json,
+			bytes: Buffer.byteLength(json, "utf8")
+		};
+	} catch {
+		return null;
+	}
+}
+/**
+* The event as it should be RETAINED: unchanged when its payload is within the
+* cap, otherwise a NEW event whose `data` is the marked replacement. The
+* argument is never mutated — the same object is still live on the fan-out path
+* and in the global ring.
+*/
+function capEventData(event) {
+	const serialized = serializePayload(event.data);
+	if (serialized !== null && serialized.bytes <= 256) return event;
+	const truncated = {
+		__truncated: true,
+		__originalBytes: serialized?.bytes ?? null,
+		__preview: serialized === null ? "" : serialized.json.slice(0, 160)
+	};
+	return {
+		...event,
+		data: truncated
+	};
+}
+/**
+* The device this event is about, or `undefined` when it is about no device.
+*
+* Same rule as `matchesEventFilter` — `source.deviceId`, or `source.id` when
+* the source IS a device — so a read filtered by `deviceId` and a read served
+* from that device's ring agree on which events belong to it. A non-numeric
+* device source id yields `undefined` rather than `NaN`: an unattributable
+* event must never become a bucket of its own.
+*/
+function eventDeviceId(event) {
+	const explicit = event.source.deviceId;
+	if (explicit !== void 0) return Number.isFinite(explicit) ? explicit : void 0;
+	if (event.source.type !== "device") return void 0;
+	const asNumber = Number(event.source.id);
+	return Number.isFinite(asNumber) ? asNumber : void 0;
+}
+function createDeviceEventRings() {
+	return { byDevice: /* @__PURE__ */ new Map() };
+}
+function ringFor(rings, deviceId) {
+	const existing = rings.byDevice.get(deviceId);
+	if (existing !== void 0) {
+		rings.byDevice.delete(deviceId);
+		rings.byDevice.set(deviceId, existing);
+		return existing;
+	}
+	const created = {
+		history: [],
+		mirrors: /* @__PURE__ */ new Map()
+	};
+	rings.byDevice.set(deviceId, created);
+	while (rings.byDevice.size > 512) {
+		const oldest = rings.byDevice.keys().next();
+		if (oldest.done === true) break;
+		rings.byDevice.delete(oldest.value);
+	}
+	return created;
+}
+/**
+* Retain `event` in its device's ring, with its payload capped.
+*
+* Returns the device it was filed under, or `undefined` when the event names no
+* device — the caller has already retained it in the global ring and nothing
+* more happens here. No device is fabricated.
+*/
+function recordDeviceEvent(rings, event) {
+	const deviceId = eventDeviceId(event);
+	if (deviceId === void 0) return void 0;
+	const ring = ringFor(rings, deviceId);
+	const retained = capEventData(event);
+	if (isMirrorCategory(event.category)) {
+		ring.mirrors.set(event.category, retained);
+		return deviceId;
+	}
+	ring.history.push(retained);
+	if (ring.history.length > 2e3) ring.history.splice(0, ring.history.length - MAX_DEVICE_RING_EVENTS);
+	return deviceId;
+}
+/**
+* Everything retained for one device, oldest first — history merged with the
+* current value of each mirror, ordered by timestamp so the caller's `-limit`
+* slice means the same thing it means on the global ring.
+*
+* An unknown device yields `[]`: unknown is the truth about a camera that has
+* emitted nothing since this process started.
+*/
+function getDeviceRecent(rings, deviceId) {
+	const ring = rings.byDevice.get(deviceId);
+	if (ring === void 0) return [];
+	if (ring.mirrors.size === 0) return ring.history;
+	const merged = [...ring.history, ...ring.mirrors.values()];
+	merged.sort((a, b) => a.timestamp.getTime() - b.timestamp.getTime());
+	return merged;
+}
 //#endregion
 //#region src/kernel/moleculer/event-bus-core.ts
 /**
@@ -6982,6 +7113,7 @@ function createSharedBusState(retainRecent = false) {
 	return {
 		handlers: /* @__PURE__ */ new Map(),
 		recent: [],
+		deviceRings: createDeviceEventRings(),
 		retainRecent
 	};
 }
@@ -7165,6 +7297,7 @@ function deliverShared(state, event) {
 	if (state.retainRecent && !isHighFrequencyCategory(event.category)) {
 		state.recent.push(event);
 		if (state.recent.length > 1e3) state.recent.splice(0, state.recent.length - MAX_RECENT_EVENTS);
+		recordDeviceEvent(state.deviceRings, event);
 	}
 	const delivered = /* @__PURE__ */ new Set();
 	for (const [pattern, set] of state.handlers) {
@@ -10130,14 +10263,15 @@ function getBrokerEventBus(broker, options) {
 			});
 		},
 		getRecent(filter, limit) {
-			const filtered = filter ? state.recent.filter((e) => {
+			const source = filter?.deviceId !== void 0 ? getDeviceRecent(state.deviceRings, filter.deviceId) : state.recent;
+			const filtered = filter ? source.filter((e) => {
 				const cat = filter.category;
 				if (cat) {
 					const categories = typeof cat === "string" ? [cat] : Array.isArray(cat) ? cat : [];
 					if (categories.length > 0 && !categories.some((c) => matchesPattern(String(c), e.category))) return false;
 				}
 				return matchesEventFilter(e, filter);
-			}) : state.recent;
+			}) : source;
 			return limit !== void 0 ? filtered.slice(-limit) : filtered;
 		}
 	};