@camstack/system 1.2.239 → 1.2.241

package/dist/{dist-B3ELrqnI.js → dist-C6JIhqS6.js}

@@ -690,7 +690,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-e0RweZzn.mjs
+//#region ../types/dist/sleep-BDR76Ykr.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -16998,6 +16998,48 @@ var NcAlarmConfigSchema = zod.z.object({
 	settings: NcAlarmSettingsSchema,
 	coverage: zod.z.array(NcAlarmModeCoverageSchema)
 });
+/**
+* ONE rule's demand on ONE camera's clip ring.
+*
+* A rule, not a camera: the broker takes the MAX over the asks that reach a
+* camera, so the answer stays a faithful description of the rules and the
+* bounding (the byte budget, the broker's own ceiling) stays where the cost
+* lives. A camera that appears in no ask is being told **nothing** — which is
+* a different thing from never having been told, and only the envelope
+* (`rulesLoaded`) can tell those apart.
+*/
+var NcClipRetentionAskSchema = zod.z.object({
+	/**
+	* The camera this ask is about. **Absent = every camera**, which is what a
+	* rule with no `conditions.devices` means: it can fire anywhere, so it is
+	* asking everywhere.
+	*/
+	deviceId: zod.z.number().int().nonnegative().optional(),
+	/** Seconds of history the rule needs held for it. Never zero — a rule that
+	*  needs nothing produces no ask at all. */
+	seconds: zod.z.number().min(0).max(60),
+	/** The profile the rule cuts from, when it named one. Absent = the cheapest
+	*  assigned, which is what the cut defaults to. */
+	profile: CamProfileSchema.optional(),
+	/** Who is asking — so a retention the operator did not expect names a rule. */
+	ruleId: zod.z.string(),
+	ruleName: zod.z.string(),
+	/** Why this many seconds: the rule's own window, or the occupancy ceiling. */
+	reason: zod.z.enum(["window", "occupancy"])
+});
+/**
+* The whole answer, with the one bit that keeps absence from reading as zero.
+*
+* `rulesLoaded` is false until the rule ledger has completed a load at least
+* once. A centre that is up but has not read its rules yet answers with an
+* empty ask list that means nothing at all — applying it would drop every
+* camera's ring to zero for the first events after a restart, which is the
+* footage this mechanism exists to keep.
+*/
+var NcClipRetentionPlanSchema = zod.z.object({
+	rulesLoaded: zod.z.boolean(),
+	asks: zod.z.array(NcClipRetentionAskSchema).readonly()
+});
 var notificationRulesCapability = {
 	name: "notification-rules",
 	scope: "system",
@@ -17030,6 +17072,23 @@ var notificationRulesCapability = {
 			auth: "admin"
 		}),
 		/**
+		* WHAT THE RULES ACTUALLY ASK the stream broker to retain, per camera.
+		*
+		* The notification centre owns the rules, so it is the only thing that can
+		* say how much history a camera's notifications will ever reach back for.
+		* Before this the broker guessed — a flat minute on every camera — and
+		* learned the PROFILE reactively, after the first clip had already been cut
+		* from the wrong one. This is the same ask stated once, in front.
+		*
+		* A QUERY, pulled by each node's broker, not a push: brokers are per node
+		* (a camera's ring lives wherever its stream is ingested) while this cap is
+		* a singleton, so a push would have to enumerate the cluster. The pull also
+		* makes the failure mode right — a broker that cannot reach the centre
+		* keeps the plan it has, and a plan that has never arrived is UNKNOWN
+		* rather than empty (D49: a read that fails changes nothing).
+		*/
+		getClipRetentionAsks: method(zod.z.object({}), NcClipRetentionPlanSchema, { auth: "admin" }),
+		/**
 		* PERMANENT per-camera mute — the notifications half of the per-camera
 		* function switch group ([D61](../../../../docs/decisions/adr-0067.md)).
 		*
@@ -18520,13 +18579,26 @@ var TrackAudioLabelSchema = zod.z.object({
 *  - `audio` — an audio event on the camera itself that was anomalous for
 *    THAT camera, loud, and heard while nothing visual was happening (D62).
 *
+*  - `onboard` — the CAMERA's own firmware, paired with a decoded frame in
+*    that frame's pixel space. A real root detector and a SPATIAL one: its
+*    boxes are the same kind of fact `pipeline`'s are, produced by a different
+*    detector.
+*
+* `onboard` was missing here while `DetectionSourceSchema` already had it, so
+* a persisted onboard track failed `safeParse` on read and came back with NO
+* source at all — which `isSpatialTrack` then admitted by accident, through the
+* `undefined` arm rather than by anybody's decision, and which `excludeSources`
+* could not name.
+*
 * The spatial subsystems (tracker association, occupancy count, re-id /
 * embedding, resurrection) MUST skip every synthetic source. Test for that
-* with `isSpatialTrack`, which allow-lists `pipeline` — a `!== 'sensor'`
-* check silently readmits every source added after it was written.
+* with `isSpatialTrack`, which allow-lists the spatial sources explicitly — a
+* `!== 'sensor'` check silently readmits every source added after it was
+* written.
 */
 var TrackSourceSchema = zod.z.enum([
 	"pipeline",
+	"onboard",
 	"sensor",
 	"audio"
 ]);
@@ -21263,13 +21335,39 @@ var MotionSourceEnum = zod.z.enum([
 */
 var MotionSourcesSchema = zod.z.array(MotionSourceEnum);
 /**
-* Which root detectors a camera runs. Deliberately the SAME vocabulary
-* post-analysis already tags every detection with (`DetectionSource`) rather
-* than a second spelling of the same two ideas — the value an operator picks
-* here is the value that comes back on the track, the overlay and the debug
-* row.
+* Which root detector a camera runs — EXACTLY ONE.
+*
+* Deliberately the SAME vocabulary post-analysis already tags every detection
+* with (`DetectionSource`) rather than a second spelling of the same two
+* ideas: the value an operator picks here is the value that comes back on the
+* track, the overlay and the debug row.
+*
+* ## Why one, and why it is still an array
+*
+* Two roots on one camera is a capability nobody asked for and the operator has
+* since ruled out. It was never free: both planes feed the SAME per-device
+* stationary registry, both can promote the same parked object, and the two
+* detectors disagree about the same box by construction — which is the
+* disagreement D505 had to arbitrate. Removing the case removes the arbitration.
+*
+* The ARRAY shape survives because the stored settings and the attach payload
+* already speak it on every camera of every fleet, and a cap input that
+* suddenly refuses a stored value makes the camera un-attachable — a fail-closed
+* in the one direction that costs an operator their cameras. So the wire stays
+* tolerant and the TYPE is exact: a longer list is truncated to its first
+* element rather than refused, and `max(1)` is what every consumer can then
+* rely on.
+*
+* AT MOST one, not exactly one. The EMPTY list is a legal, deliberate pick —
+* a camera an operator left with no root detector — and `planDetectionSources`
+* has always said so: inventing a root for them is how a default acts without
+* anybody choosing it. Tightening this to `length(1)` broke that, and the
+* suite caught it.
+*
+* Measured before tightening (2026-09-15, this fleet, 6 h of attaches): 3327
+* `["pipeline"]` and 2 `["onboard"]`. Not one camera had two.
 */
-var DetectionSourcesSchema = zod.z.array(DetectionSourceSchema);
+var DetectionSourcesSchema = zod.z.preprocess((value) => Array.isArray(value) && value.length > 1 ? value.slice(0, 1) : value, zod.z.array(DetectionSourceSchema).max(1));
 /**
 * Input shape for `pipeline-runner.reportMotion` cap method. Exported
 * so cap-side consumers (the orchestrator forward, the runner addon's
@@ -40447,6 +40545,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.getClipRetentionAsks": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.getConditionCatalog": {
 		capName: "notification-rules",
 		capScope: "system",

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-B3ELrqnI.js");
+const require_dist = require("./dist-C6JIhqS6.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -27,7 +27,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-CAsHdMwP.js");
 const require_tls$1 = require("./tls-BFs4PzoW.js");
-const require_manifest_system_deps = require("./manifest-system-deps-CrSP0Kkp.js");
+const require_manifest_system_deps = require("./manifest-system-deps-CzyjTMcO.js");
 const require_resource_monitor = require("./resource-monitor-LVE1BoLs.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let zod = require("zod");

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { A as addonSettingsCapability, Ct as objectInputDeclaresAddonId, Et as procedureAuthKey, Nt as scopesAllowAddon, Pt as scopesAllowDeviceCap, Xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Yt as DATAPLANE_SECRET_HEADER$1, Zt as DEVICE_STATUS_METHOD, _ as RUNTIME_DEFAULTS, _n as resolveCapMount, _t as looseSchema, an as asNumber, at as isCollectionArrayMethod, bn as EventCategory$1, cn as emitDownForOwnedCaps, dt as kebabToCamel, et as extractNestedAddonId, gn as readinessKey, gt as logLevelAtMost, h as METHOD_ACCESS_MAP, hn as parseJsonUnknown, in as asJsonObject$1, it as isArrayOutputSchema, jt as resolveMethodAuth, mn as parseJsonObject, nn as ReadinessTimeoutError, on as asString$1, p as LOG_LEVEL_RANK, pt as lifecycleJobSchema, qt as errMsg$1, sn as createEvent, st as isObjectInput, t as ALL_CAPABILITY_DEFINITIONS, tn as ReadinessRegistry, un as expandCapMethods, ut as isVoidInput, vn as scopeKey } from "./dist-DGLUnOm4.mjs";
+import { A as addonSettingsCapability, Ct as objectInputDeclaresAddonId, Et as procedureAuthKey, Nt as scopesAllowAddon, Pt as scopesAllowDeviceCap, Xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Yt as DATAPLANE_SECRET_HEADER$1, Zt as DEVICE_STATUS_METHOD, _ as RUNTIME_DEFAULTS, _n as resolveCapMount, _t as looseSchema, an as asNumber, at as isCollectionArrayMethod, bn as EventCategory$1, cn as emitDownForOwnedCaps, dt as kebabToCamel, et as extractNestedAddonId, gn as readinessKey, gt as logLevelAtMost, h as METHOD_ACCESS_MAP, hn as parseJsonUnknown, in as asJsonObject$1, it as isArrayOutputSchema, jt as resolveMethodAuth, mn as parseJsonObject, nn as ReadinessTimeoutError, on as asString$1, p as LOG_LEVEL_RANK, pt as lifecycleJobSchema, qt as errMsg$1, sn as createEvent, st as isObjectInput, t as ALL_CAPABILITY_DEFINITIONS, tn as ReadinessRegistry, un as expandCapMethods, ut as isVoidInput, vn as scopeKey } from "./dist-BjSYm1hH.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -26,7 +26,7 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { _ as fetchJson, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, f as collectModelFiles, g as ensureModel, h as downloadModel, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as downloadFile, n as STALL_TICK_MS, o as contentTypeFor, p as deleteModelFromDisk, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as getModelFilePath, y as isModelDownloaded } from "./event-loop-stall-monitor-GPrVvx14.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-2xbgg78V.mjs";
-import { $ as buildUdsNativeCapProxy, $t as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, A as createUdsLoggerWithControl, An as recordSocketFrame, At as HUB_MAIN_HEAP_WATCH_LABEL, B as readMoleculerFanoutMode, Bn as diffCapActionCensus, Bt as createLoopDelayMeter, C as ipcParentLink, Cn as createSocketPlaneMeter, Ct as runNpm, D as createUdsEventBus, Dn as readSocketQueues, Dt as HEAP_RECLAIM_TRIGGER_MB, E as createUdsEventBridge, En as formatSocketPlane, Et as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, F as CapRouteError, Fn as CAP_ACTION_UNLABELLED, Ft as RUNNER_HEAP_WATCH_INTERVAL_MS, G as createLocalTransport, Gn as formatEventPlane, Gt as parseRssBudgetMb, H as PARENT_ROUTED_PROVIDER_ADDON_ID, Hn as createEventPlaneMeter, Ht as describeRss, I as classifyCapRoute, In as EMPTY_CAP_ACTION_READING, It as RUNNER_RSS_BUDGET_ENV, J as SocketChannel, Jt as startHeapWatch, K as UdsLocalTransportClient, Kt as reclaimIntervalMs, L as LocalChildClient, Ln as MAX_CAP_ACTIONS_PER_PEER, Lt as ZERO_LOOP_DELAY, M as AGENT_CAP_FWD_SERVICE, Mn as socketDirectionBytes, Mt as HUB_RSS_BUDGET_ENV, N as CapRouteResolver, Nn as socketDirectionMessages, Nt as RSS_BUDGET_REANNOUNCE_MIN_MS, O as udsChildLogToWorkerEntry, On as EMPTY_SOCKET_DIRECTION, Ot as HEAP_WATCH_INTERVAL_MS, P as callWithServiceDiscovery, Pn as CAP_ACTION_OVERFLOW_LABEL, Pt as RSS_BUDGET_RELEASE_RATIO, Q as buildNativeCapProxy, Qt as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, R as LocalChildRegistry, Rn as capActionLabel, Rt as buildHeapSample, S as buildLinkChain, Sn as SOCKET_QUEUE_TOP_N, St as resolveNpmInvocation, T as createParentUnownedCallHandler, Tn as diffSocketPlane, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as __resetCapUsageRegistryForTests, Un as createEventPlaneReader, Ut as hubMainRssBudget, V as CapUsageRegistry, Vn as EVENT_PLANE_TOP_N, Vt as createV8Reclaimer, W as getCapUsageRegistry, Wn as diffEventPlane, Wt as nextRssBudgetState, X as FrameDecoder, Xt as strandedMb, Y as localEndpointPath, Yt as startRunnerHeapWatch, Z as encodeFrame, Zt as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, _ as AddonDepsManager, _n as MESH_QUEUE_TOP_N, _t as CapabilityUnavailableError, a as createUdsAddonContext, an as DECISIVE_HEAP_SPACES, at as createAddonService, b as brokerCallForCap, bn as EMPTY_SOCKET_PLANE_BASELINE, bt as resolveAddonClass, c as getOrInitReadinessRegistryForClient, cn as formatHeapSpaces, ct as capActionName, d as clusterEventTopic, dn as selectReportedSpaces, dt as capServiceName, en as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, et as createBrokerDeviceManagerApi, f as getBrokerEventBus, fn as OUTBOUND_QUEUE_COOLDOWN_MS, ft as parseCapAction, g as subscribePassthrough, gn as formatOutboundQueueVerdict, gt as CapabilityHandle, h as setNodeEventInterest, hn as createOutboundQueueGate, ht as DeviceRegistry, i as createAddonContext, in as isArrayBufferCensusReport, j as AGENT_CAP_FWD_ACTION, jn as sampleSocketDirection, jt as HUB_MAIN_RSS_BUDGET_MB, k as createUdsLogger, kn as createSocketDirectionCounters, kt as HEAP_WATCH_WARN_RATIO, l as setHubConnected, ln as heapSpaceField, lt as capActionSuffix, m as registerEventBusService, mn as OUTBOUND_QUEUE_THRESHOLD_BYTES, mt as serializeTypedArrays, n as installManifestPythonDeps, nn as createInspectorArrayBufferCensus, o as getWorkerDeviceRegistry, on as HEAP_SPACE_REPORT_MIN_MB, ot as validateProviderRegistrations, p as getMoleculerEventStats, pn as OUTBOUND_QUEUE_SUSTAIN_MS, pt as deserializeTypedArrays, q as UdsLocalTransportServer, qt as shouldReclaim, r as adaptBrokerToCluster, rn as formatArrayBufferCensus, rt as mountNativeCapService, s as getOrInitReadinessRegistry, sn as emitHeapDiagnosticReport, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestSystemDeps, tn as createArrayBufferCensusGate, u as EVENT_TOPIC_PREFIX, un as readHeapSpaces, ut as capBareAction, v as createKernelHwAccel, vn as createMeshQueueReader, vt as copyBundledNativeModules, w as localProviderLink, wn as createSocketPlaneReader, wt as createAddonDataPlaneFacility, x as brokerTransportLink, xn as SOCKET_PLANE_TOP_N, xt as buildNpmChildEnv, y as resolveHwAccel, yn as formatMeshQueue, yt as installManifestNativeDeps, z as UDS_NO_ROUTE_PREFIX, zn as createCapActionCensus, zt as createDeferredHeapWatchSink } from "./manifest-system-deps-BEj9Dpu1.mjs";
+import { $ as buildUdsNativeCapProxy, $t as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, A as createUdsLoggerWithControl, An as recordSocketFrame, At as HUB_MAIN_HEAP_WATCH_LABEL, B as readMoleculerFanoutMode, Bn as diffCapActionCensus, Bt as createLoopDelayMeter, C as ipcParentLink, Cn as createSocketPlaneMeter, Ct as runNpm, D as createUdsEventBus, Dn as readSocketQueues, Dt as HEAP_RECLAIM_TRIGGER_MB, E as createUdsEventBridge, En as formatSocketPlane, Et as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, F as CapRouteError, Fn as CAP_ACTION_UNLABELLED, Ft as RUNNER_HEAP_WATCH_INTERVAL_MS, G as createLocalTransport, Gn as formatEventPlane, Gt as parseRssBudgetMb, H as PARENT_ROUTED_PROVIDER_ADDON_ID, Hn as createEventPlaneMeter, Ht as describeRss, I as classifyCapRoute, In as EMPTY_CAP_ACTION_READING, It as RUNNER_RSS_BUDGET_ENV, J as SocketChannel, Jt as startHeapWatch, K as UdsLocalTransportClient, Kt as reclaimIntervalMs, L as LocalChildClient, Ln as MAX_CAP_ACTIONS_PER_PEER, Lt as ZERO_LOOP_DELAY, M as AGENT_CAP_FWD_SERVICE, Mn as socketDirectionBytes, Mt as HUB_RSS_BUDGET_ENV, N as CapRouteResolver, Nn as socketDirectionMessages, Nt as RSS_BUDGET_REANNOUNCE_MIN_MS, O as udsChildLogToWorkerEntry, On as EMPTY_SOCKET_DIRECTION, Ot as HEAP_WATCH_INTERVAL_MS, P as callWithServiceDiscovery, Pn as CAP_ACTION_OVERFLOW_LABEL, Pt as RSS_BUDGET_RELEASE_RATIO, Q as buildNativeCapProxy, Qt as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, R as LocalChildRegistry, Rn as capActionLabel, Rt as buildHeapSample, S as buildLinkChain, Sn as SOCKET_QUEUE_TOP_N, St as resolveNpmInvocation, T as createParentUnownedCallHandler, Tn as diffSocketPlane, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as __resetCapUsageRegistryForTests, Un as createEventPlaneReader, Ut as hubMainRssBudget, V as CapUsageRegistry, Vn as EVENT_PLANE_TOP_N, Vt as createV8Reclaimer, W as getCapUsageRegistry, Wn as diffEventPlane, Wt as nextRssBudgetState, X as FrameDecoder, Xt as strandedMb, Y as localEndpointPath, Yt as startRunnerHeapWatch, Z as encodeFrame, Zt as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, _ as AddonDepsManager, _n as MESH_QUEUE_TOP_N, _t as CapabilityUnavailableError, a as createUdsAddonContext, an as DECISIVE_HEAP_SPACES, at as createAddonService, b as brokerCallForCap, bn as EMPTY_SOCKET_PLANE_BASELINE, bt as resolveAddonClass, c as getOrInitReadinessRegistryForClient, cn as formatHeapSpaces, ct as capActionName, d as clusterEventTopic, dn as selectReportedSpaces, dt as capServiceName, en as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, et as createBrokerDeviceManagerApi, f as getBrokerEventBus, fn as OUTBOUND_QUEUE_COOLDOWN_MS, ft as parseCapAction, g as subscribePassthrough, gn as formatOutboundQueueVerdict, gt as CapabilityHandle, h as setNodeEventInterest, hn as createOutboundQueueGate, ht as DeviceRegistry, i as createAddonContext, in as isArrayBufferCensusReport, j as AGENT_CAP_FWD_ACTION, jn as sampleSocketDirection, jt as HUB_MAIN_RSS_BUDGET_MB, k as createUdsLogger, kn as createSocketDirectionCounters, kt as HEAP_WATCH_WARN_RATIO, l as setHubConnected, ln as heapSpaceField, lt as capActionSuffix, m as registerEventBusService, mn as OUTBOUND_QUEUE_THRESHOLD_BYTES, mt as serializeTypedArrays, n as installManifestPythonDeps, nn as createInspectorArrayBufferCensus, o as getWorkerDeviceRegistry, on as HEAP_SPACE_REPORT_MIN_MB, ot as validateProviderRegistrations, p as getMoleculerEventStats, pn as OUTBOUND_QUEUE_SUSTAIN_MS, pt as deserializeTypedArrays, q as UdsLocalTransportServer, qt as shouldReclaim, r as adaptBrokerToCluster, rn as formatArrayBufferCensus, rt as mountNativeCapService, s as getOrInitReadinessRegistry, sn as emitHeapDiagnosticReport, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestSystemDeps, tn as createArrayBufferCensusGate, u as EVENT_TOPIC_PREFIX, un as readHeapSpaces, ut as capBareAction, v as createKernelHwAccel, vn as createMeshQueueReader, vt as copyBundledNativeModules, w as localProviderLink, wn as createSocketPlaneReader, wt as createAddonDataPlaneFacility, x as brokerTransportLink, xn as SOCKET_PLANE_TOP_N, xt as buildNpmChildEnv, y as resolveHwAccel, yn as formatMeshQueue, yt as installManifestNativeDeps, z as UDS_NO_ROUTE_PREFIX, zn as createCapActionCensus, zt as createDeferredHeapWatchSink } from "./manifest-system-deps-CfR7Z90J.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Vp0bPV3U.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { z } from "zod";

package/dist/kernel/moleculer/device-event-ring.d.ts

@@ -0,0 +1,113 @@
+import { SystemEvent } from '@camstack/types';
+/** One declared mirror category and the reason it may be collapsed. */
+export interface MirrorCategoryDeclaration {
+    /** Exact event category. Not a glob — a mirror is declared one by one. */
+    readonly category: string;
+    /** Why the penultimate value of this category carries no information. */
+    readonly reason: string;
+}
+/**
+ * The categories whose per-device history is ONE slot: the latest value.
+ *
+ * Declared here, with a reason each, on purpose — the alternative is `if`s
+ * scattered over the delivery path, and nobody can then answer "what does this
+ * system collapse, and who decided?".
+ *
+ * Adding an entry DELETES history for that category. Add one only when the
+ * category is genuinely a state mirror (a snapshot of a current value), never
+ * because it is merely frequent — a frequent EDGE (a motion start, a crash)
+ * belongs in `RING_BUFFER_DENY_PATTERNS` or nowhere, not here.
+ */
+export declare const MIRROR_CATEGORIES: readonly MirrorCategoryDeclaration[];
+/** The declared reason this category is a mirror, or `undefined` if unclassified. */
+export declare function mirrorReason(category: string): string | undefined;
+/**
+ * Is this category declared a mirror? An unclassified category is NOT a mirror
+ * — the safe default is to keep its history.
+ */
+export declare function isMirrorCategory(category: string): boolean;
+/**
+ * Non-mirror events retained per device. ~1.1 events/s fleet-wide after
+ * coalescing ⇒ ~3 000/day/camera ⇒ 2 000 ≈ 16 h.
+ */
+export declare const MAX_DEVICE_RING_EVENTS = 2000;
+/**
+ * Cap on the retained `data` payload, in UTF-8 bytes. The COUNT is not what
+ * costs memory — 32 devices × 2 000 events × 817 B (measured average) ≈ 52 MB.
+ * Capping the payload brings the worst case to ≈ 26 MB and the realistic case
+ * far below it, since most events are already under the cap.
+ */
+export declare const MAX_RETAINED_DATA_BYTES = 256;
+/** Bytes of the original JSON kept as a human-readable preview of a cut payload. */
+export declare const TRUNCATED_PREVIEW_BYTES = 160;
+/**
+ * Devices tracked at once. Far above the fleet (32) — it exists so a bad
+ * deviceId stream cannot grow the map without bound. Eviction is
+ * least-recently-written.
+ */
+export declare const MAX_TRACKED_DEVICES = 512;
+/** Marker key present on — and only on — a payload this module cut. */
+export declare const TRUNCATED_DATA_KEY = "__truncated";
+/**
+ * What replaces a payload above {@link MAX_RETAINED_DATA_BYTES}. A consumer
+ * MUST be able to tell a short payload from a cut one, so the replacement says
+ * so explicitly rather than silently shipping a prefix.
+ */
+export interface TruncatedEventData extends Record<string, unknown> {
+    readonly __truncated: true;
+    /** Size of the original JSON payload, or `null` when it could not be measured. */
+    readonly __originalBytes: number | null;
+    /** First {@link TRUNCATED_PREVIEW_BYTES} characters of the original JSON. */
+    readonly __preview: string;
+}
+/** Is this the marked replacement of a cut payload? */
+export declare function isTruncatedEventData(data: Record<string, unknown>): data is TruncatedEventData;
+/**
+ * The event as it should be RETAINED: unchanged when its payload is within the
+ * cap, otherwise a NEW event whose `data` is the marked replacement. The
+ * argument is never mutated — the same object is still live on the fan-out path
+ * and in the global ring.
+ */
+export declare function capEventData(event: SystemEvent): SystemEvent;
+/**
+ * The device this event is about, or `undefined` when it is about no device.
+ *
+ * Same rule as `matchesEventFilter` — `source.deviceId`, or `source.id` when
+ * the source IS a device — so a read filtered by `deviceId` and a read served
+ * from that device's ring agree on which events belong to it. A non-numeric
+ * device source id yields `undefined` rather than `NaN`: an unattributable
+ * event must never become a bucket of its own.
+ */
+export declare function eventDeviceId(event: SystemEvent): number | undefined;
+interface DeviceRing {
+    /** Non-mirror events, oldest first, bounded by {@link MAX_DEVICE_RING_EVENTS}. */
+    readonly history: SystemEvent[];
+    /** Latest event per declared-mirror category. */
+    readonly mirrors: Map<string, SystemEvent>;
+}
+/**
+ * Every device's ring. Insertion order is least-recently-written first, which
+ * is what {@link MAX_TRACKED_DEVICES} evicts by.
+ */
+export interface DeviceEventRings {
+    readonly byDevice: Map<number, DeviceRing>;
+}
+export declare function createDeviceEventRings(): DeviceEventRings;
+/**
+ * Retain `event` in its device's ring, with its payload capped.
+ *
+ * Returns the device it was filed under, or `undefined` when the event names no
+ * device — the caller has already retained it in the global ring and nothing
+ * more happens here. No device is fabricated.
+ */
+export declare function recordDeviceEvent(rings: DeviceEventRings, event: SystemEvent): number | undefined;
+/**
+ * Everything retained for one device, oldest first — history merged with the
+ * current value of each mirror, ordered by timestamp so the caller's `-limit`
+ * slice means the same thing it means on the global ring.
+ *
+ * An unknown device yields `[]`: unknown is the truth about a camera that has
+ * emitted nothing since this process started.
+ */
+export declare function getDeviceRecent(rings: DeviceEventRings, deviceId: number): readonly SystemEvent[];
+export {};

package/dist/kernel/moleculer/event-bus-core.d.ts

@@ -1,4 +1,5 @@
 import { EventFilter, SystemEvent } from '@camstack/types';
+import { DeviceEventRings } from './device-event-ring.js';
 export interface SubscriberEntry {
     /** Original filter — kept whole so non-category dimensions are honoured per-event. */
     readonly filter: EventFilter | string | undefined;
@@ -29,6 +30,23 @@ export interface SharedBusState {
      * Cleared on server restart (intentional — events are volatile by design).
      */
     readonly recent: SystemEvent[];
+    /**
+     * Per-device rings BESIDE `recent[]` — not a replacement for it.
+     *
+     * `recent[]` is one global, count-bounded ring: a busy fleet evicts a quiet
+     * camera's events out of it long before an operator opens that camera's
+     * panel, and filtering a global ring by device cannot bring them back. A
+     * per-device ask is therefore answered from here instead
+     * (`getBrokerEventBus().getRecent({ deviceId })`), while an ask that names no
+     * device is still answered from `recent[]`.
+     *
+     * Populated under exactly the same conditions as `recent[]` (retaining bus,
+     * category not on the high-frequency deny-list), with mirror categories
+     * coalesced and payloads capped — see `device-event-ring.ts`. An event that
+     * names no device is retained in `recent[]` ONLY; no device is invented for
+     * it.
+     */
+    readonly deviceRings: DeviceEventRings;
     /**
      * Whether this bus retains events in `recent[]` to back the
      * `getRecent`/audit capability.

package/dist/{manifest-system-deps-BEj9Dpu1.mjs → manifest-system-deps-CfR7Z90J.mjs}

@@ -6971,6 +6971,137 @@ function getCapUsageRegistry() {
 function __resetCapUsageRegistryForTests() {
 	singleton = null;
 }
+var MIRROR_REASON_BY_CATEGORY = new Map([
+	{
+		category: "device.state-changed",
+		reason: "Device runtime-state mirror, 69.1 % of fleet traffic. Each event is a snapshot of the slice AFTER the change; the superseded snapshot describes a state the device is no longer in, and every consumer (SystemMirror, DeviceStateHandle) reads the latest one only."
+	},
+	{
+		category: "camera-streams.onCamStreamsChanged",
+		reason: "Full stream-list snapshot per camera, 20.1 % of fleet traffic. The payload is the complete current list, not a delta, so an older list is strictly less true than the newer one."
+	},
+	{
+		category: "system.ready-state",
+		reason: "Readiness is a LEVEL, not an edge: the event reports whether a capability is ready right now. Declared for the case where it carries a deviceId; when it does not it stays in the global ring like any other unattributed event."
+	}
+].map((m) => [m.category, m.reason]));
+/**
+* Is this category declared a mirror? An unclassified category is NOT a mirror
+* — the safe default is to keep its history.
+*/
+function isMirrorCategory(category) {
+	return MIRROR_REASON_BY_CATEGORY.has(category);
+}
+/**
+* Non-mirror events retained per device. ~1.1 events/s fleet-wide after
+* coalescing ⇒ ~3 000/day/camera ⇒ 2 000 ≈ 16 h.
+*/
+var MAX_DEVICE_RING_EVENTS = 2e3;
+function serializePayload(data) {
+	try {
+		const json = JSON.stringify(data);
+		if (typeof json !== "string") return null;
+		return {
+			json,
+			bytes: Buffer.byteLength(json, "utf8")
+		};
+	} catch {
+		return null;
+	}
+}
+/**
+* The event as it should be RETAINED: unchanged when its payload is within the
+* cap, otherwise a NEW event whose `data` is the marked replacement. The
+* argument is never mutated — the same object is still live on the fan-out path
+* and in the global ring.
+*/
+function capEventData(event) {
+	const serialized = serializePayload(event.data);
+	if (serialized !== null && serialized.bytes <= 256) return event;
+	const truncated = {
+		__truncated: true,
+		__originalBytes: serialized?.bytes ?? null,
+		__preview: serialized === null ? "" : serialized.json.slice(0, 160)
+	};
+	return {
+		...event,
+		data: truncated
+	};
+}
+/**
+* The device this event is about, or `undefined` when it is about no device.
+*
+* Same rule as `matchesEventFilter` — `source.deviceId`, or `source.id` when
+* the source IS a device — so a read filtered by `deviceId` and a read served
+* from that device's ring agree on which events belong to it. A non-numeric
+* device source id yields `undefined` rather than `NaN`: an unattributable
+* event must never become a bucket of its own.
+*/
+function eventDeviceId(event) {
+	const explicit = event.source.deviceId;
+	if (explicit !== void 0) return Number.isFinite(explicit) ? explicit : void 0;
+	if (event.source.type !== "device") return void 0;
+	const asNumber = Number(event.source.id);
+	return Number.isFinite(asNumber) ? asNumber : void 0;
+}
+function createDeviceEventRings() {
+	return { byDevice: /* @__PURE__ */ new Map() };
+}
+function ringFor(rings, deviceId) {
+	const existing = rings.byDevice.get(deviceId);
+	if (existing !== void 0) {
+		rings.byDevice.delete(deviceId);
+		rings.byDevice.set(deviceId, existing);
+		return existing;
+	}
+	const created = {
+		history: [],
+		mirrors: /* @__PURE__ */ new Map()
+	};
+	rings.byDevice.set(deviceId, created);
+	while (rings.byDevice.size > 512) {
+		const oldest = rings.byDevice.keys().next();
+		if (oldest.done === true) break;
+		rings.byDevice.delete(oldest.value);
+	}
+	return created;
+}
+/**
+* Retain `event` in its device's ring, with its payload capped.
+*
+* Returns the device it was filed under, or `undefined` when the event names no
+* device — the caller has already retained it in the global ring and nothing
+* more happens here. No device is fabricated.
+*/
+function recordDeviceEvent(rings, event) {
+	const deviceId = eventDeviceId(event);
+	if (deviceId === void 0) return void 0;
+	const ring = ringFor(rings, deviceId);
+	const retained = capEventData(event);
+	if (isMirrorCategory(event.category)) {
+		ring.mirrors.set(event.category, retained);
+		return deviceId;
+	}
+	ring.history.push(retained);
+	if (ring.history.length > 2e3) ring.history.splice(0, ring.history.length - MAX_DEVICE_RING_EVENTS);
+	return deviceId;
+}
+/**
+* Everything retained for one device, oldest first — history merged with the
+* current value of each mirror, ordered by timestamp so the caller's `-limit`
+* slice means the same thing it means on the global ring.
+*
+* An unknown device yields `[]`: unknown is the truth about a camera that has
+* emitted nothing since this process started.
+*/
+function getDeviceRecent(rings, deviceId) {
+	const ring = rings.byDevice.get(deviceId);
+	if (ring === void 0) return [];
+	if (ring.mirrors.size === 0) return ring.history;
+	const merged = [...ring.history, ...ring.mirrors.values()];
+	merged.sort((a, b) => a.timestamp.getTime() - b.timestamp.getTime());
+	return merged;
+}
 //#endregion
 //#region src/kernel/moleculer/event-bus-core.ts
 /**
@@ -6982,6 +7113,7 @@ function createSharedBusState(retainRecent = false) {
 	return {
 		handlers: /* @__PURE__ */ new Map(),
 		recent: [],
+		deviceRings: createDeviceEventRings(),
 		retainRecent
 	};
 }
@@ -7165,6 +7297,7 @@ function deliverShared(state, event) {
 	if (state.retainRecent && !isHighFrequencyCategory(event.category)) {
 		state.recent.push(event);
 		if (state.recent.length > 1e3) state.recent.splice(0, state.recent.length - MAX_RECENT_EVENTS);
+		recordDeviceEvent(state.deviceRings, event);
 	}
 	const delivered = /* @__PURE__ */ new Set();
 	for (const [pattern, set] of state.handlers) {
@@ -10130,14 +10263,15 @@ function getBrokerEventBus(broker, options) {
 			});
 		},
 		getRecent(filter, limit) {
-			const filtered = filter ? state.recent.filter((e) => {
+			const source = filter?.deviceId !== void 0 ? getDeviceRecent(state.deviceRings, filter.deviceId) : state.recent;
+			const filtered = filter ? source.filter((e) => {
 				const cat = filter.category;
 				if (cat) {
 					const categories = typeof cat === "string" ? [cat] : Array.isArray(cat) ? cat : [];
 					if (categories.length > 0 && !categories.some((c) => matchesPattern(String(c), e.category))) return false;
 				}
 				return matchesEventFilter(e, filter);
-			}) : state.recent;
+			}) : source;
 			return limit !== void 0 ? filtered.slice(-limit) : filtered;
 		}
 	};